@bobfrankston/rmfmail 1.0.565 → 1.0.570

package/packages/mailx-store/db.js

@@ -314,6 +314,31 @@ const SCHEMA = `
     );
     CREATE INDEX IF NOT EXISTS idx_audit_log_ts ON audit_log(ts);
     CREATE INDEX IF NOT EXISTS idx_audit_log_folder ON audit_log(account_id, folder_id);
+
+    -- Schema refactor: messages identity vs folder location.
+    -- Before: a messages row was identified by (account, folder, uid).
+    -- Server-side moves required deleting the old row and inserting a
+    -- new one (losing UUID, body cache, flags), or a fragile move-detect
+    -- rebind. A message in multiple Gmail labels needed multiple rows
+    -- with the same Message-ID.
+    -- After: a messages row is one logical email (identity = uuid;
+    -- semantic key = account + message_id). Folder membership lives in
+    -- message_folders. A move is delete-one-membership + add-another.
+    -- Body, UUID, flags, custom annotations all stay put. Multi-folder
+    -- messages just have multiple membership rows.
+    -- During the additive migration, messages.folder_id / messages.uid
+    -- stay populated as primary location so existing reads keep working.
+    -- Reads switch to JOIN with message_folders step by step.
+    CREATE TABLE IF NOT EXISTS message_folders (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        message_row_id INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+        folder_id INTEGER NOT NULL,
+        uid INTEGER NOT NULL,
+        last_seen_at INTEGER NOT NULL,
+        UNIQUE(folder_id, uid)
+    );
+    CREATE INDEX IF NOT EXISTS idx_message_folders_msg ON message_folders(message_row_id);
+    CREATE INDEX IF NOT EXISTS idx_message_folders_folder_uid ON message_folders(folder_id, uid);
 `;
 export class MailxDB {
     db;
@@ -384,6 +409,29 @@ export class MailxDB {
         catch (e) {
             console.error(`  [migration] synthetic-UID cleanup failed: ${e?.message || e}`);
         }
+        // One-shot: backfill message_folders from existing messages rows.
+        // After this runs, every existing (account, folder, uid) row in
+        // messages has a corresponding membership row in message_folders.
+        // New writes (upsertMessage) will populate both during the
+        // additive migration. UNIQUE(folder_id, uid) on message_folders
+        // means INSERT OR IGNORE — the migration is idempotent if rerun.
+        try {
+            const flag = this.getKv("schema", "message_folders_v1");
+            if (!flag) {
+                const now = Date.now();
+                const r = this.db.prepare(`INSERT OR IGNORE INTO message_folders (message_row_id, folder_id, uid, last_seen_at)
+                     SELECT id, folder_id, uid, ? FROM messages`).run(now);
+                const count = r.changes || 0;
+                if (count > 0) {
+                    console.log(`  [migration] message_folders_v1: backfilled ${count} membership rows from messages`);
+                    this.audit({ kind: "migration", count, reason: "message_folders_v1 — populate join table from existing messages.folder_id/uid", source: "MailxDB constructor" });
+                }
+                this.setKv("schema", "message_folders_v1", "1");
+            }
+        }
+        catch (e) {
+            console.error(`  [migration] message_folders backfill failed: ${e?.message || e}`);
+        }
         // One-shot contacts table reset: the contacts schema's UNIQUE constraint
         // was widened from `(email)` to `(source, email, name)` so the same
         // address can carry multiple distinct (name, source) entries — Bob's
@@ -975,23 +1023,66 @@ export class MailxDB {
         }
     }
     deleteFolder(folderId) {
-        const r = this.db.prepare("DELETE FROM messages WHERE folder_id = ?").run(folderId);
-        const count = r.changes || 0;
-        if (count > 0)
-            this.audit({ kind: "delete-bulk", folderId, count, reason: "folder deleted", source: "deleteFolder" });
+        // Drop memberships in this folder first, then GC any messages
+        // rows that are now orphaned (no remaining memberships). A
+        // multi-folder message (e.g. Gmail label = INBOX + Important)
+        // keeps its body intact when only one of its folders is deleted.
+        const orphans = this.gcMembershipsAndCollectOrphans(folderId);
+        if (orphans.count > 0)
+            this.audit({ kind: "delete-bulk", folderId, count: orphans.count, reason: "folder deleted", source: "deleteFolder" });
         this.db.prepare("DELETE FROM folders WHERE id = ?").run(folderId);
     }
     markFolderRead(folderId) {
-        this.db.prepare(`UPDATE messages SET flags_json = REPLACE(flags_json, '[]', '["\\\\Seen"]') WHERE folder_id = ? AND flags_json NOT LIKE '%\\\\Seen%'`).run(folderId);
+        // Mark seen for messages currently in this folder (membership-scoped,
+        // not legacy folder_id) so a message that lives in multiple folders
+        // becomes seen everywhere — which matches IMAP semantics: \Seen is
+        // a per-message flag, not per-folder. (When the day comes that we
+        // want truly per-folder read-state, this needs `flag_overrides`.)
+        this.db.prepare(`UPDATE messages SET flags_json = REPLACE(flags_json, '[]', '["\\\\Seen"]')
+             WHERE id IN (SELECT message_row_id FROM message_folders WHERE folder_id = ?)
+             AND flags_json NOT LIKE '%\\\\Seen%'`).run(folderId);
         this.recalcFolderCounts(folderId);
     }
     deleteAllMessages(accountId, folderId) {
-        const r = this.db.prepare("DELETE FROM messages WHERE account_id = ? AND folder_id = ?").run(accountId, folderId);
-        const count = r.changes || 0;
-        if (count > 0)
-            this.audit({ kind: "delete-bulk", accountId, folderId, count, reason: "deleteAllMessages (emptyFolder)", source: "deleteAllMessages" });
+        const orphans = this.gcMembershipsAndCollectOrphans(folderId, accountId);
+        if (orphans.count > 0)
+            this.audit({ kind: "delete-bulk", accountId, folderId, count: orphans.count, reason: "deleteAllMessages (emptyFolder)", source: "deleteAllMessages" });
         this.recalcFolderCounts(folderId);
     }
+    /** Drop every `message_folders` row in `folderId` (optionally scoped to an
+     *  account) and GC any `messages` rows that no longer have ANY memberships.
+     *  Returns count of memberships removed (so callers can audit "I deleted N
+     *  things"). The messages-row delete cascades to FTS / sync_actions /
+     *  message_folders (CASCADE) so this is the safe single op for "clear
+     *  this folder" without nuking multi-folder messages. */
+    gcMembershipsAndCollectOrphans(folderId, accountId) {
+        // Find membership rows we're about to delete
+        const membershipQ = accountId
+            ? `SELECT mf.id, mf.message_row_id FROM message_folders mf
+               JOIN messages m ON m.id = mf.message_row_id
+               WHERE mf.folder_id = ? AND m.account_id = ?`
+            : `SELECT mf.id, mf.message_row_id FROM message_folders mf WHERE mf.folder_id = ?`;
+        const memberships = (accountId
+            ? this.db.prepare(membershipQ).all(folderId, accountId)
+            : this.db.prepare(membershipQ).all(folderId));
+        if (memberships.length === 0)
+            return { count: 0 };
+        // Drop them
+        const delMemb = this.db.prepare("DELETE FROM message_folders WHERE id = ?");
+        for (const m of memberships)
+            delMemb.run(m.id);
+        // GC any messages rows that now have zero remaining memberships.
+        // Use a Set so a multi-membership row only gets one orphan check.
+        const touched = Array.from(new Set(memberships.map(m => m.message_row_id)));
+        const isOrphan = this.db.prepare("SELECT COUNT(*) AS c FROM message_folders WHERE message_row_id = ?");
+        const delMsg = this.db.prepare("DELETE FROM messages WHERE id = ?");
+        for (const rowId of touched) {
+            if ((isOrphan.get(rowId)?.c | 0) === 0) {
+                delMsg.run(rowId);
+            }
+        }
+        return { count: memberships.length };
+    }
     updateFolderCounts(folderId, total, unread) {
         this.db.prepare("UPDATE folders SET total_count = ?, unread_count = ? WHERE id = ?").run(total, unread, folderId);
     }
@@ -1003,6 +1094,102 @@ export class MailxDB {
         return row || { uidvalidity: 0, highestModseq: "0" };
     }
     // ── Messages ──
+    /** Record that a message row currently lives at (folder, uid). Idempotent
+     *  via UNIQUE(folder_id, uid) — re-inserting the same membership just
+     *  refreshes last_seen_at. A message in N Gmail labels has N rows.
+     *  A server-side move is "delete one membership row, insert another";
+     *  the messages row is untouched. Called from upsertMessage on every
+     *  insert / move-detect / existing-row upsert during the additive
+     *  migration. Reconcile is the only path that DELETES from this table
+     *  (when the server stops listing a UID in a folder). */
+    upsertMessageFolder(messageRowId, folderId, uid) {
+        const now = Date.now();
+        // INSERT OR REPLACE on (folder_id, uid) — if some other message_row_id
+        // somehow had this slot, replace it. In practice this happens after
+        // an EXPUNGE+reinsert: a UID gets reused by the server for a different
+        // message. The new message wins; the old's membership entry goes away.
+        this.db.prepare(`INSERT INTO message_folders (message_row_id, folder_id, uid, last_seen_at)
+             VALUES (?, ?, ?, ?)
+             ON CONFLICT(folder_id, uid) DO UPDATE SET
+                 message_row_id = excluded.message_row_id,
+                 last_seen_at = excluded.last_seen_at`).run(messageRowId, folderId, uid, now);
+    }
+    /** Drop a membership row when reconcile finds the UID is no longer
+     *  on the server in this folder. The messages row itself is NOT
+     *  touched — it may still exist in other folders, or the deferred-
+     *  cleanup pass (later) handles orphan messages with no memberships. */
+    removeMessageFolder(folderId, uid) {
+        const r = this.db.prepare("DELETE FROM message_folders WHERE folder_id = ? AND uid = ?").run(folderId, uid);
+        return (r.changes || 0) > 0;
+    }
+    /** Reconcile-driven membership drop. Called when the server's UID list
+     *  for a folder no longer contains a UID we have locally. Drops the
+     *  membership row; if the messages row has no other memberships AND
+     *  no other folder claims it via the legacy folder_id column, deletes
+     *  the messages row + unlinks the body file. Returns true if any
+     *  cleanup happened (so the caller can skip the legacy delete path).
+     *
+     *  During the additive migration we ALSO have to handle the legacy
+     *  case where the row's folder_id matches but no message_folders row
+     *  was migrated for it (race during initial population, etc.) — we
+     *  fall back to the messages.folder_id check to clean up consistently. */
+    dropFolderMembership(accountId, folderId, uid, folderPath) {
+        // First find the messages row this membership pointed at.
+        const mf = this.db.prepare("SELECT message_row_id FROM message_folders WHERE folder_id = ? AND uid = ?").get(folderId, uid);
+        let rowId = null;
+        if (mf) {
+            // Drop the membership.
+            this.db.prepare("DELETE FROM message_folders WHERE folder_id = ? AND uid = ?").run(folderId, uid);
+            rowId = mf.message_row_id;
+        }
+        else {
+            // Legacy fallback: the row exists in messages.folder_id/uid but
+            // not in message_folders (pre-migration data, or a row that
+            // somehow skipped the dual-write). Use the legacy lookup.
+            const legacy = this.db.prepare("SELECT id FROM messages WHERE account_id = ? AND folder_id = ? AND uid = ?").get(accountId, folderId, uid);
+            rowId = legacy?.id ?? null;
+        }
+        if (rowId === null) {
+            console.log(`  [reconcile-skip] ${accountId} folder=${folderId} uid=${uid}: no row to drop (already gone or moved)`);
+            return false;
+        }
+        // Check if any other memberships exist for this row.
+        const remaining = this.db.prepare("SELECT COUNT(*) AS cnt FROM message_folders WHERE message_row_id = ?").get(rowId);
+        if (remaining.cnt > 0) {
+            // Message lives in another folder still — preserve everything.
+            // The messages.folder_id column may still point at the dropped
+            // location; sync the primary location to one of the remaining
+            // memberships so legacy reads stay consistent.
+            const next = this.db.prepare("SELECT folder_id, uid FROM message_folders WHERE message_row_id = ? ORDER BY id LIMIT 1").get(rowId);
+            if (next) {
+                this.db.prepare("UPDATE messages SET folder_id = ?, uid = ? WHERE id = ?").run(next.folder_id, next.uid, rowId);
+            }
+            console.log(`  [reconcile-membership] ${accountId} ${folderPath || folderId}/${uid}: dropped — message still in ${remaining.cnt} other folder(s)`);
+            this.audit({
+                kind: "delete-membership",
+                accountId, folderId, uid,
+                reason: `reconcile dropped folder membership; ${remaining.cnt} other location(s) remain`,
+                source: `dropFolderMembership (${folderPath || ""})`,
+            });
+            return true;
+        }
+        // No other memberships — message is truly gone. Delete the row.
+        // Capture context for audit before delete.
+        const env = this.db.prepare("SELECT message_id, subject, body_path FROM messages WHERE id = ?").get(rowId);
+        this.db.prepare("DELETE FROM messages WHERE id = ?").run(rowId);
+        if (env) {
+            this.audit({
+                kind: "delete-msg",
+                accountId, folderId, uid,
+                messageId: env.message_id || undefined,
+                subject: env.subject || undefined,
+                reason: "reconcile: server missing this UID after grace, no other folder memberships",
+                source: `dropFolderMembership (${folderPath || ""})`,
+            });
+            console.log(`  [reconcile-delete] ${accountId} ${folderPath || folderId}/${uid} msgid=${env.message_id || "?"} (no other memberships) — body ${env.body_path || "(none)"}`);
+        }
+        return true;
+    }
     upsertMessage(msg) {
         const existing = this.db.prepare("SELECT id, provider_id FROM messages WHERE account_id = ? AND folder_id = ? AND uid = ?").get(msg.accountId, msg.folderId, msg.uid);
         if (existing) {
@@ -1028,6 +1215,11 @@ export class MailxDB {
                     WHERE id = ?
                 `).run(JSON.stringify(msg.flags), Date.now(), existing.id);
             }
+            // Refresh membership last_seen_at — server confirmed this UID
+            // is still in this folder. No-op if migration already populated
+            // it; defensive INSERT-OR-UPDATE handles the race where the row
+            // was created without a corresponding membership.
+            this.upsertMessageFolder(existing.id, msg.folderId, msg.uid);
             return existing.id;
         }
         // Move-detection: if this Message-ID already exists for this account
@@ -1042,9 +1234,17 @@ export class MailxDB {
             const moved = this.db.prepare("SELECT id, folder_id, uid FROM messages WHERE account_id = ? AND message_id = ? LIMIT 1").get(msg.accountId, msg.messageId);
             if (moved) {
                 console.log(`  [move-detect] ${msg.accountId} ${msg.messageId}: rebinding row ${moved.id} (folder ${moved.folder_id}/uid ${moved.uid} → folder ${msg.folderId}/uid ${msg.uid})`);
-                // Update folder_id + uid; preserve uuid, body_path, flags
-                // (server flags will catch up on the next full sync).
+                // Update folder_id + uid on the messages row (additive
+                // migration: keeps the "primary location" columns valid for
+                // existing reads). The new schema's source of truth is
+                // message_folders — see below.
                 this.db.prepare("UPDATE messages SET folder_id = ?, uid = ?, cached_at = ? WHERE id = ?").run(msg.folderId, msg.uid, Date.now(), moved.id);
+                // Add the new membership row. The OLD membership (source
+                // folder + old uid) stays — reconcile in the source folder
+                // is what eventually drops it (when the server stops
+                // listing the UID there). For Gmail multi-label messages,
+                // both memberships persist legitimately.
+                this.upsertMessageFolder(moved.id, msg.folderId, msg.uid);
                 // Notify subscribers so e.g. the reconciler can cancel any
                 // pending deferred-delete for the original (folder, uid) —
                 // otherwise the reconcile-delete grace timer fires for a
@@ -1086,6 +1286,11 @@ export class MailxDB {
             ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         `).run(msg.accountId, msg.folderId, msg.uid, uuid, msg.messageId, msg.inReplyTo, JSON.stringify(msg.references), threadId, msg.date, msg.subject, msg.from.address, msg.from.name, JSON.stringify(msg.to), JSON.stringify(msg.cc), JSON.stringify(msg.flags), msg.size, msg.hasAttachments ? 1 : 0, msg.preview, msg.bodyPath, Date.now(), msg.providerId || null);
         const rowId = Number(result.lastInsertRowid);
+        // Record the (folder, uid) membership for the new row. New schema
+        // source of truth — old folder_id/uid columns above are kept in
+        // sync during the additive migration but reads will move to JOIN
+        // with message_folders.
+        this.upsertMessageFolder(rowId, msg.folderId, msg.uid);
         // Index for full-text search
         try {
             this.db.prepare("INSERT INTO messages_fts (rowid, subject, from_name, from_address, to_text, cc_text, body_text) VALUES (?, ?, ?, ?, ?, ?, ?)").run(rowId, msg.subject, msg.from.name, msg.from.address, toText, ccText, msg.preview);
@@ -1093,41 +1298,47 @@ export class MailxDB {
         catch { /* FTS insert may fail on rebuild, non-fatal */ }
         return rowId;
     }
+    /** List view: messages currently in (account, folder).
+     *  Joins through `message_folders` so the UID + folder location come
+     *  from membership rows, not from the legacy messages.folder_id /
+     *  messages.uid columns. After a server-side move (Sieve filter,
+     *  webmail action, etc.), the membership row is the truth — the
+     *  legacy columns are frozen at first-sight values. */
     getMessages(query) {
         const page = query.page || 1;
         const pageSize = query.pageSize || 50;
         const offset = (page - 1) * pageSize;
         const sort = query.sort || "date";
         const sortDir = query.sortDir || "desc";
-        const sortCol = sort === "from" ? "from_name" : sort === "subject" ? "subject" : "date";
-        let where = "account_id = ? AND folder_id = ?";
+        const sortCol = sort === "from" ? "m.from_name" : sort === "subject" ? "m.subject" : "m.date";
+        let where = "m.account_id = ? AND mf.folder_id = ?";
         const params = [query.accountId, query.folderId];
         if (query.search) {
-            where += " AND (subject LIKE ? OR from_name LIKE ? OR from_address LIKE ?)";
+            where += " AND (m.subject LIKE ? OR m.from_name LIKE ? OR m.from_address LIKE ?)";
             const term = `%${query.search}%`;
             params.push(term, term, term);
         }
         if (query.flaggedOnly) {
-            // flags_json is a JSON array like ["\\Seen","\\Flagged"]. A plain
-            // LIKE on the serialized form is sufficient to find rows with the
-            // \Flagged flag without decoding every row.
-            where += " AND flags_json LIKE '%\\\\Flagged%'";
-        }
-        const total = this.db.prepare(`SELECT COUNT(*) as cnt FROM messages WHERE ${where}`).get(...params).cnt;
-        // LEFT JOIN sync_actions so each row carries a `pending` flag —
-        // true when the user has a queued local action (move/flag/delete)
-        // not yet acknowledged by the server. UI renders these in pink so
-        // local-only state is visible (Slice C of S1). The optimistic-Sent
-        // negative-UID convention was retired — Sent now reflects only what
-        // the server has; pending sends live in the Outbox view.
-        const rows = this.db.prepare(`SELECT m.*, (
+            where += " AND m.flags_json LIKE '%\\\\Flagged%'";
+        }
+        const total = this.db.prepare(`SELECT COUNT(*) as cnt
+             FROM messages m
+             JOIN message_folders mf ON mf.message_row_id = m.id
+             WHERE ${where}`).get(...params).cnt;
+        // pending = user has a queued local action against (account, uid).
+        // uid here is the membership uid (mf.uid), not m.uid — sync_actions
+        // were also keyed against the at-action-time uid, so this match
+        // remains stable across server-side moves of the SAME message
+        // (the action gets re-targeted to the new uid by the reconciler).
+        const rows = this.db.prepare(`SELECT m.*, mf.uid AS uid, mf.folder_id AS folder_id,
                 EXISTS(
                     SELECT 1 FROM sync_actions sa
-                    WHERE sa.account_id = m.account_id AND sa.uid = m.uid
-                )
-            ) AS pending
-            FROM messages m WHERE ${where.replace(/\b(account_id|folder_id|uid|date|subject|from_name|from_address|flags_json)\b/g, "m.$1")}
-            ORDER BY m.${sortCol} ${sortDir} LIMIT ? OFFSET ?`).all(...params, pageSize, offset);
+                    WHERE sa.account_id = m.account_id AND sa.uid = mf.uid
+                ) AS pending
+            FROM messages m
+            JOIN message_folders mf ON mf.message_row_id = m.id
+            WHERE ${where}
+            ORDER BY ${sortCol} ${sortDir} LIMIT ? OFFSET ?`).all(...params, pageSize, offset);
         const items = rows.map(r => ({
             id: r.id,
             accountId: r.account_id,
@@ -1161,14 +1372,19 @@ export class MailxDB {
             return { items: [], total: 0, page, pageSize };
         const placeholders = inboxRows.map(() => "?").join(",");
         const folderIds = inboxRows.map((r) => r.id);
-        const total = this.db.prepare(`SELECT COUNT(*) as cnt FROM messages WHERE folder_id IN (${placeholders})`).get(...folderIds).cnt;
-        const rows = this.db.prepare(`SELECT m.*, EXISTS(
-                SELECT 1 FROM sync_actions sa
-                WHERE sa.account_id = m.account_id AND sa.uid = m.uid
-            ) AS pending,
-            (SELECT COUNT(DISTINCT account_id) FROM messages m2
-             WHERE m2.message_id = m.message_id AND m.message_id != '') AS dupeCount
-            FROM messages m WHERE m.folder_id IN (${placeholders})
+        const total = this.db.prepare(`SELECT COUNT(*) as cnt
+             FROM message_folders mf
+             WHERE mf.folder_id IN (${placeholders})`).get(...folderIds).cnt;
+        const rows = this.db.prepare(`SELECT m.*, mf.uid AS uid, mf.folder_id AS folder_id,
+                EXISTS(
+                    SELECT 1 FROM sync_actions sa
+                    WHERE sa.account_id = m.account_id AND sa.uid = mf.uid
+                ) AS pending,
+                (SELECT COUNT(DISTINCT account_id) FROM messages m2
+                 WHERE m2.message_id = m.message_id AND m.message_id != '') AS dupeCount
+            FROM messages m
+            JOIN message_folders mf ON mf.message_row_id = m.id
+            WHERE mf.folder_id IN (${placeholders})
             ORDER BY m.date DESC LIMIT ? OFFSET ?`).all(...folderIds, pageSize, offset);
         const items = rows.map(r => ({
             id: r.id,
@@ -1225,10 +1441,24 @@ export class MailxDB {
             providerId: r.provider_id || undefined,
         };
     }
+    /** Look up a message by (account, uid) and optionally folder.
+     *  Joins through `message_folders` so the message is found at its
+     *  CURRENT location, not whatever messages.folder_id was at first
+     *  sight. After server-side moves, that's the difference between
+     *  hitting the message in `_Spam` (correct) and hitting nothing
+     *  because the legacy messages.folder_id still points at INBOX. */
     getMessageByUid(accountId, uid, folderId) {
         const sql = folderId != null
-            ? "SELECT * FROM messages WHERE account_id = ? AND uid = ? AND folder_id = ?"
-            : "SELECT * FROM messages WHERE account_id = ? AND uid = ?";
+            ? `SELECT m.*, mf.uid AS uid
+               FROM messages m
+               JOIN message_folders mf ON mf.message_row_id = m.id
+               WHERE m.account_id = ? AND mf.uid = ? AND mf.folder_id = ?
+               LIMIT 1`
+            : `SELECT m.*, mf.uid AS uid
+               FROM messages m
+               JOIN message_folders mf ON mf.message_row_id = m.id
+               WHERE m.account_id = ? AND mf.uid = ?
+               LIMIT 1`;
         const params = folderId != null ? [accountId, uid, folderId] : [accountId, uid];
         const r = this.db.prepare(sql).get(...params);
         if (!r)
@@ -1283,21 +1513,38 @@ export class MailxDB {
         // Size 0 / NULL fall to the end so they don't masquerade as small.
         return this.db.prepare("SELECT uid, folder_id as folderId FROM messages WHERE account_id = ? AND (body_path IS NULL OR body_path = '') ORDER BY (size IS NULL OR size = 0), size ASC, date DESC LIMIT ?").all(accountId, limit);
     }
-    getHighestUid(accountId, folderId) {
-        const r = this.db.prepare("SELECT MAX(uid) as maxUid FROM messages WHERE account_id = ? AND folder_id = ?").get(accountId, folderId);
+    /** Highest server UID we've seen in this folder. After the
+     *  message_folders refactor, this reads from the membership table
+     *  rather than messages.uid — a server-side move from this folder
+     *  drops the membership row, so the high-water mark correctly
+     *  decreases when the message left. account_id is implicit
+     *  (folder_id is account-scoped). */
+    getHighestUid(_accountId, folderId) {
+        const r = this.db.prepare("SELECT MAX(uid) as maxUid FROM message_folders WHERE folder_id = ?").get(folderId);
         return r?.maxUid || 0;
     }
-    getOldestDate(accountId, folderId) {
-        const r = this.db.prepare("SELECT MIN(date) as minDate FROM messages WHERE account_id = ? AND folder_id = ?").get(accountId, folderId);
+    /** Oldest message date in this folder. Joins through message_folders
+     *  so a message that LEFT this folder via server-side move stops
+     *  influencing the date window for incremental backfill. */
+    getOldestDate(_accountId, folderId) {
+        const r = this.db.prepare(`SELECT MIN(m.date) as minDate
+             FROM messages m
+             JOIN message_folders mf ON mf.message_row_id = m.id
+             WHERE mf.folder_id = ?`).get(folderId);
         return r?.minDate || 0;
     }
-    getMessageCount(accountId, folderId) {
-        const r = this.db.prepare("SELECT count(*) as cnt FROM messages WHERE account_id = ? AND folder_id = ?").get(accountId, folderId);
+    /** Number of messages currently IN this folder (server-side membership,
+     *  not whatever messages.folder_id happens to say after a move). */
+    getMessageCount(_accountId, folderId) {
+        const r = this.db.prepare("SELECT count(*) as cnt FROM message_folders WHERE folder_id = ?").get(folderId);
         return r?.cnt || 0;
     }
-    /** Get all UIDs for a folder */
-    getUidsForFolder(accountId, folderId) {
-        const rows = this.db.prepare("SELECT uid FROM messages WHERE account_id = ? AND folder_id = ?").all(accountId, folderId);
+    /** All UIDs the server has confirmed in this folder. Used by
+     *  reconcile to diff against the server's UID list — anything in
+     *  here but NOT on the server gets its membership dropped (which
+     *  may then GC the messages row if it has no other folders). */
+    getUidsForFolder(_accountId, folderId) {
+        const rows = this.db.prepare("SELECT uid FROM message_folders WHERE folder_id = ?").all(folderId);
         return rows.map(r => r.uid);
     }
     /** Delete a message by account + UID. Reason is propagated into the
@@ -1804,7 +2051,7 @@ export class MailxDB {
     }
     // ── Search ──
     /** Full-text search across all messages. Supports qualifiers: from:, to:, subject: */
-    searchMessages(query, page = 1, pageSize = 50, accountId, folderId) {
+    searchMessages(query, page = 1, pageSize = 50, accountId, folderId, includeTrashSpam = false) {
         query = (query || "").trim();
         // Parse qualifiers (C45: extended set — date:, has:, is:, folder:).
         let ftsQuery = "";
@@ -1932,11 +2179,22 @@ export class MailxDB {
                 scopeWhere = " AND m.account_id = ?";
                 scopeParams.push(accountId);
             }
+            // Global / account-wide search excludes trash + junk unless the
+            // user opted in. A user typing "invoice" in the search box almost
+            // never wants the deleted/spam copy that's already filtered out
+            // of every other view. When the user IS explicitly scoped to
+            // trash/junk via folderId, this guard is skipped.
+            if (!includeTrashSpam && !folderId) {
+                scopeWhere += " AND (f.special_use IS NULL OR f.special_use NOT IN ('trash','junk'))";
+            }
             if (extraWhere.length > 0) {
                 scopeWhere += " AND " + extraWhere.join(" AND ");
                 scopeParams.push(...extraParams);
             }
-            const countRow = this.db.prepare(`SELECT COUNT(*) as cnt FROM messages m JOIN messages_fts fts ON m.id = fts.rowid WHERE messages_fts MATCH ?${scopeWhere}`).get(ftsQuery, ...scopeParams);
+            const countRow = this.db.prepare(`SELECT COUNT(*) as cnt FROM messages m
+                 JOIN messages_fts fts ON m.id = fts.rowid
+                 LEFT JOIN folders f ON f.id = m.folder_id AND f.account_id = m.account_id
+                 WHERE messages_fts MATCH ?${scopeWhere}`).get(ftsQuery, ...scopeParams);
             const total = countRow?.cnt || 0;
             const rows = this.db.prepare(`SELECT m.*, f.name AS folder_name FROM messages m
                  JOIN messages_fts fts ON m.id = fts.rowid