Any additional thoughts on how to troubleshoot this? We dug in a little deeper but nothing seems to connect to the backend service properly.

Any ideas on other ways to modify permissions, or see actual settings applied to a delegated account?

Correction above, the TARGET_MAILBOX and MAILBOX_GETTING_ACCESS are swapped. We also tried "" and literally nothing instead of none, but those are ...

The assumption of 143 > 7143 and 993 > 7993 seems sound - and that's what our configuration has. Double checking that 7993 Imap Server is run...