@rapidmx/web-client 0.4.0 → 0.5.0

package/dist/apps/shared/search/LocalIndexLifecycle.js

@@ -3,74 +3,78 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 /**
- * Mounts the Tier 2 local index's lifecycle for one mailbox: starts the background build once it's
- * unlocked, and destroys the index on the same events that destroy the unlocked keys themselves (spec
- * §11 "MUST be destroyed on the same events that destroy private keys: explicit logout, session
- * revocation, and the configurable idle timeout").
+ * Mounts the Tier 2 local index's lifecycle: starts the background build for the active mailbox once it's
+ * unlocked, and destroys an index on the same events that destroy that mailbox's unlocked keys (spec §11
+ * "MUST be destroyed on the same events that destroy private keys: explicit logout, session revocation,
+ * and the configurable idle timeout").
  *
  * **Why polling, not hooking the existing destroy call sites directly**: `destroyUnlockedKeys()`
- * (`react-shared/src/crypto/keySession.ts`) has no observer/callback hook, and its own two real call
- * sites are `useIdleKeyTimeout.ts` (in `react-shared`, not this repo) and the manual "Destroy keys now"
- * button in Settings - editing the former would mean a react-shared source change that (per this
- * session's own earlier finding) doesn't reach `web-client` without a package republish + patch refresh
- * cycle, which is out of scope for wiring up a destroy signal. Watching `getUnlockedKeys()` for a
- * present-to-absent transition instead catches *every* destroy path uniformly - idle timeout, the manual
+ * (`react-shared/src/crypto/keySession.ts`) has no observer/callback hook. Watching `getUnlockedKeys()`
+ * for a present-to-absent transition catches *every* destroy path uniformly - idle timeout, the manual
  * button, or anything else that calls it - without needing to know which one fired.
  *
- * **Explicit logout is the one gap this polling doesn't reliably cover**: `AppShell.tsx`'s sign-out
- * navigates away immediately, which may not leave time for a poll tick to fire first. That case is
- * handled separately, directly in `AppShell.tsx`, via `destroyAllLocalIndexes()` - see that call site's
- * own comment.
+ * Every mailbox this component has seen unlocked is tracked for the life of the mount - not just whichever
+ * is active right now - so switching mailboxes (or a folders-list refresh re-running the build effect)
+ * can never lose a pending unlocked-to-locked transition for a mailbox whose index was already built.
+ *
+ * **Explicit logout** navigates away immediately, which may not leave time for a poll tick - `AppShell.tsx`
+ * handles that case itself via `destroyAllLocalIndexes()`.
  */
 import { useEffect, useRef } from "react";
 import { getUnlockedKeys } from "@rapidmx/react-shared/crypto/keySession.js";
-import { buildLocalIndex } from "./localIndexBuilder.js";
-import { destroyLocalIndex } from "./localIndexRpcClient.js";
-const POLL_INTERVAL_MS = 5000;
-/** Renders nothing - pure side-effect component, mounted by `MailShell.tsx` (which is where a
- * `mailboxUid` is actually known; `AppShell.tsx` itself is mailbox-agnostic, shared by every app). Each
- * `buildLocalIndex()` call below omits its `windowConfig` argument deliberately - that leaves the byte
- * budget to its own default, which already resolves per-device (Web vs. Electron) and per-user
- * preference (Settings > Encryption) on its own; see `localIndexBuilder.ts`/`localIndexSizePreference.ts`
- * for how. */
-export default function LocalIndexLifecycle({ mailboxUid, folders }) {
-    // Guards against re-triggering a build every time this component re-renders (e.g. on an unrelated
-    // folders-list refresh) for a mailbox already built/building this session.
-    const buildStartedForRef = useRef(undefined);
-    const wasUnlockedRef = useRef(false);
-    useEffect(() => {
-        if (!mailboxUid || folders.length === 0) {
+import { buildLocalIndex, cancelLocalIndexBuild } from "./localIndexBuilder.js";
+import { destroyLocalIndex, pruneInaccessibleLocalIndexes } from "./localIndexRpcClient.js";
+export const POLL_INTERVAL_MS = 5000;
+/** Renders nothing - pure side-effect component, mounted by `MailShell.tsx`. */
+export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMailboxUids }) {
+    // mailboxUid -> whether it was unlocked at the last check. An entry exists for every mailbox whose
+    // build this component started; only ever changed by a real observed transition, never reset by an
+    // effect re-run.
+    const trackedRef = useRef(new Map());
+    // The latest props, for the long-lived polling interval below.
+    const latestRef = useRef({ mailboxUid, folders });
+    latestRef.current = { mailboxUid, folders };
+    function startBuildIfUnlocked(targetMailboxUid, targetFolders) {
+        const unlocked = getUnlockedKeys(targetMailboxUid);
+        if (!unlocked || targetFolders.length === 0 || trackedRef.current.get(targetMailboxUid)) {
             return;
         }
-        const unlocked = getUnlockedKeys(mailboxUid);
-        wasUnlockedRef.current = !!unlocked;
-        if (unlocked && buildStartedForRef.current !== mailboxUid) {
-            buildStartedForRef.current = mailboxUid;
-            // Never an unhandled rejection - a broken local index (Worker/WASM/OPFS unsupported or
-            // unavailable, a corrupted store) is best-effort infrastructure, not a build the rest of the
-            // app depends on. searchTier2.ts's own callers already degrade gracefully independent of
-            // whether a build ever completed at all.
-            buildLocalIndex(mailboxUid, unlocked, folders).catch(() => undefined);
+        trackedRef.current.set(targetMailboxUid, true);
+        // Never an unhandled rejection - a broken local index is best-effort infrastructure, not a build
+        // the rest of the app depends on.
+        buildLocalIndex(targetMailboxUid, unlocked, targetFolders).catch(() => undefined);
+    }
+    useEffect(() => {
+        if (mailboxUid) {
+            startBuildIfUnlocked(mailboxUid, folders);
         }
+    }, [mailboxUid, folders]);
+    useEffect(() => {
         const interval = setInterval(() => {
-            const stillUnlocked = !!getUnlockedKeys(mailboxUid);
-            if (wasUnlockedRef.current && !stillUnlocked) {
-                // A present-to-absent transition: something just destroyed this mailbox's unlocked keys
-                // (idle timeout or the manual "Destroy keys now" button - see this module's own doc
-                // comment on why this is observed rather than hooked directly).
-                void destroyLocalIndex(mailboxUid);
-                buildStartedForRef.current = undefined;
+            for (const [trackedUid, wasUnlocked] of trackedRef.current) {
+                if (wasUnlocked && !getUnlockedKeys(trackedUid)) {
+                    // A present-to-absent transition: something just destroyed this mailbox's keys.
+                    trackedRef.current.set(trackedUid, false);
+                    // Stop the pass still running with the now-destroyed keys; the destroy itself also makes
+                    // the Worker reject anything that pass still sends.
+                    void cancelLocalIndexBuild(trackedUid);
+                    void destroyLocalIndex(trackedUid);
+                }
             }
-            else if (!wasUnlockedRef.current && stillUnlocked && buildStartedForRef.current !== mailboxUid) {
-                // The mailbox was re-unlocked this session (e.g. via ComposeWindow's or
-                // MessageDetailPane's own on-demand unlock prompt) - start the build it missed the first
-                // time around.
-                buildStartedForRef.current = mailboxUid;
-                buildLocalIndex(mailboxUid, getUnlockedKeys(mailboxUid), folders).catch(() => undefined);
+            // The active mailbox was (re-)unlocked since the last check, e.g. via an on-demand unlock prompt.
+            const { mailboxUid: activeUid, folders: activeFolders } = latestRef.current;
+            if (activeUid) {
+                startBuildIfUnlocked(activeUid, activeFolders);
             }
-            wasUnlockedRef.current = stillUnlocked;
         }, POLL_INTERVAL_MS);
         return () => clearInterval(interval);
-    }, [mailboxUid, folders]);
+    }, []);
+    // A stable string key so a re-render with an equal-but-new array doesn't re-scan OPFS.
+    const accessibleKey = accessibleMailboxUids && accessibleMailboxUids.length > 0 ? JSON.stringify([...accessibleMailboxUids].sort()) : "";
+    useEffect(() => {
+        if (accessibleKey) {
+            void pruneInaccessibleLocalIndexes(JSON.parse(accessibleKey));
+        }
+    }, [accessibleKey]);
     return null;
 }

package/dist/apps/shared/search/localIndexBuilder.js

@@ -23,10 +23,23 @@
  * own precedent in `apps/www/index.tsx`'s inbox-list decrypt work. An unencrypted message is already
  * fully searchable via Tier 1; indexing it here too would spend this index's bounded byte budget on
  * content that didn't need it.
+ *
+ * **Verification seals.** A message this pass decrypts that has no seal for the vault's current `masterKeyGeneration` is
+ * evaluated with `evaluateMessageSecurityWithSeal()`, against the sender's pinned signing keys from the reader's
+ * contacts (`pinnedSigners.ts`, the message pane's own source, looked up once per sender per pass), so a verified
+ * message gets its seal without being opened (see `apps/shared/components/mail/verificationSeals.ts`). Pins only change
+ * the security state, never the recovered subject or body this index stores. Seal writes are best effort and bounded:
+ * at most `SEAL_WRITE_CONCURRENCY` in flight, at most `MAX_SEAL_WRITES_PER_PASS` per pass (past it, messages are
+ * evaluated without seals), failures ignored, and nothing new starts once the pass is aborted or its keys are destroyed.
+ * A seal carries only a hash, fingerprint, state and time, never plaintext. With no readable vault generation the pass
+ * seals nothing. Signed-only (unencrypted) messages aren't sealed here: this pass never fetches their raw MIME (see
+ * above), and fetching it only to seal would cost a download per message; they are sealed when opened.
  */
-import { getMessageRawContent, listMessages } from "@rapidmx/react-shared/mail/mailApi.js";
-import { evaluateMessageSecurity } from "@rapidmx/react-shared/crypto/messageSecurity.js";
-import { indexLocalEntities, initLocalIndex, setLocalIndexBuilding, setLocalIndexWindow } from "./localIndexRpcClient.js";
+import { getMessageRawContent, listFolders, listMessages } from "@rapidmx/react-shared/mail/mailApi.js";
+import { evaluateMessageSecurity, evaluateMessageSecurityWithSeal } from "@rapidmx/react-shared/crypto/messageSecurity.js";
+import { getPinnedSignerFingerprints } from "../components/mail/pinnedSigners.js";
+import { currentVerificationSeal, readVaultGeneration, sendVerificationSeal, verificationSealPending } from "../components/mail/verificationSeals.js";
+import { getIndexedVersions, indexLocalEntities, initLocalIndex, nextLocalIndexGeneration, pruneLocalEntities, setLocalIndexBuilding, setLocalIndexWindow, } from "./localIndexRpcClient.js";
 import { deriveLocalIndexKey } from "./localIndexKey.js";
 import { getLocalIndexByteBudget } from "./localIndexSizePreference.js";
 /** The RFC 9788 placeholder subject every encrypted message's outer envelope carries server-side - see
@@ -37,32 +50,143 @@ const ENCRYPTED_SUBJECT_PLACEHOLDER = "[...]";
  * validated"). Used as-is rather than invented/adjusted here. Not user-adjustable today (unlike the byte
  * budget - see `localIndexSizePreference.ts`) - nothing in this codebase has asked for that yet. */
 export const WEB_TIME_FLOOR_MONTHS = 12;
-/** Folder types that actually hold messages - excludes `calendar`/`contacts`/other non-mail folder types
- * `FolderType` also covers. Inbox and Sent first: the two folders a "did I find that email" search is
- * overwhelmingly likely to land in, so they're covered soonest if the build is interrupted (tab closed,
- * idle timeout) partway through. */
-const MESSAGE_FOLDER_TYPES = new Set(["inbox", "sent_items", "drafts", "deleted_items", "outbox", "junk"]);
+/** Folder types that actually hold messages, including `user` (custom folders). Inbox and Sent first: the two
+ * folders a "did I find that email" search is overwhelmingly likely to land in, so they're covered soonest if
+ * the build is interrupted (tab closed, idle timeout) partway through. */
+const MESSAGE_FOLDER_TYPES = new Set(["inbox", "sent_items", "drafts", "deleted_items", "outbox", "junk", "archive", "user"]);
+/** Folder types known not to hold mail. Any folder in neither set is skipped, and the pass is then not
+ * complete - a type this module doesn't know about may well hold messages. */
+const NON_MESSAGE_FOLDER_TYPES = new Set(["calendar", "contacts", "tasks", "notes"]);
 const FOLDER_PRIORITY = { inbox: 0, sent_items: 1 };
+/** How many times a pass walks a folder whose total count changed during the walk. `listMessages()` only
+ * pages by offset, so a message removed from an already-walked page shifts a later one onto it unseen;
+ * only a folder whose count held steady across a whole walk is trusted for completeness and pruning. */
+export const MAX_WALK_ATTEMPTS = 3;
+/** Subtracted from the pass's start time before it's recorded as the end of guaranteed coverage - a
+ * message's server-assigned `receivedDate` can be ahead of this device's clock. */
+export const CLOCK_SKEW_MARGIN_MS = 10 * 60 * 1000;
 const PAGE_SIZE = 100;
 const MAX_APPROX_BYTES_PER_MESSAGE_PADDING = 512; // subject/participants/flags overhead beyond raw text length
+const FETCH_FAILED = Symbol("fetch-failed");
+/** How many raw-MIME fetch+decrypt calls run at once - a page of 100 encrypted messages used to fire all
+ * 100 requests simultaneously. */
+export const FETCH_CONCURRENCY = 6;
+/** How many verification seal writes run at once during a pass. */
+export const SEAL_WRITE_CONCURRENCY = 2;
+/** The most verification seals one pass writes. */
+export const MAX_SEAL_WRITES_PER_PASS = 200;
+function createPassSealer(mailboxUid, unlocked, signal) {
+    let generation;
+    const pins = new Map();
+    const queue = [];
+    let queued = 0;
+    let active = 0;
+    let idle;
+    const stopped = () => signal.aborted || !!unlocked.destroyed;
+    const vaultGeneration = () => (generation ?? (generation = readVaultGeneration(mailboxUid)));
+    const pinsFor = (address) => {
+        const key = address.toLowerCase();
+        let entry = pins.get(key);
+        if (!entry) {
+            entry = getPinnedSignerFingerprints(mailboxUid, address).then((fingerprints) => (fingerprints.length > 0 ? fingerprints : undefined), () => undefined);
+            pins.set(key, entry);
+        }
+        return entry;
+    };
+    function pump() {
+        if (stopped()) {
+            queue.length = 0;
+        }
+        while (active < SEAL_WRITE_CONCURRENCY && queue.length > 0) {
+            const write = queue.shift();
+            active++;
+            void write().finally(() => {
+                active--;
+                pump();
+            });
+        }
+        if (active === 0 && queue.length === 0) {
+            idle?.();
+        }
+    }
+    return {
+        async evaluate(message, rawMime) {
+            const current = await vaultGeneration();
+            const { seal, sealGeneration } = currentVerificationSeal(message);
+            if (current === undefined || stopped() || queued >= MAX_SEAL_WRITES_PER_PASS || !verificationSealPending(message.uid, current) || (seal && sealGeneration === current)) {
+                return evaluateMessageSecurity(rawMime, unlocked);
+            }
+            const result = await evaluateMessageSecurityWithSeal(rawMime, unlocked, await pinsFor(message.from.address), undefined, {
+                mailboxUid,
+                messageUid: message.uid,
+                seal,
+                sealGeneration,
+                masterKeyGeneration: current,
+            });
+            const sealToWrite = result.sealToWrite;
+            if (sealToWrite && queued < MAX_SEAL_WRITES_PER_PASS) {
+                queued++;
+                queue.push(() => sendVerificationSeal(message.uid, sealToWrite));
+                pump();
+            }
+            return result;
+        },
+        drain() {
+            return new Promise((resolve) => {
+                idle = resolve;
+                pump();
+            });
+        },
+    };
+}
 /** `cutoff === undefined` means no time floor at all (an unbounded `windowConfig`) - every message is
  * "within" it, so the caller's own end-of-folder check (`messages.length < PAGE_SIZE`) becomes the only
  * stopping condition. */
 function isWithinTimeFloor(receivedDate, cutoff) {
     return !cutoff || new Date(receivedDate).getTime() >= cutoff.getTime();
 }
+/** A relative weight only - the worker enforces the budget against the database's real measured size and
+ * uses these per-row values just to decide how much of the oldest range to evict at once. UTF-8 bytes,
+ * not UTF-16 code units. */
 function estimateByteSize(entity) {
-    const textLength = (entity.subject?.length ?? 0) + (entity.body?.length ?? 0) + (entity.attachmentText?.length ?? 0) + entity.participants.length;
-    return textLength + MAX_APPROX_BYTES_PER_MESSAGE_PADDING;
+    const encoder = new TextEncoder();
+    const textBytes = [entity.subject, entity.body, entity.attachmentText, entity.participants].reduce((total, value) => total + (value ? encoder.encode(value).length : 0), 0);
+    return textBytes + MAX_APPROX_BYTES_PER_MESSAGE_PADDING;
+}
+/** The change marker stored per row: a new server `version` (flags, content) or a folder move both
+ * invalidate the indexed copy. */
+function versionOf(message) {
+    return `${message.version}:${message.folderUid}`;
+}
+/** `Promise.all(items.map(fn))`, but with at most `limit` calls in flight. Preserves input order. */
+async function mapWithConcurrency(items, limit, fn) {
+    const results = new Array(items.length);
+    let next = 0;
+    async function worker() {
+        while (next < items.length) {
+            const index = next++;
+            results[index] = await fn(items[index]);
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return results;
 }
 /** Decrypts one message and shapes it into a `LocalIndexEntity`, or `undefined` when nothing usable was
  * recovered (a decrypt failure, or a message that turns out not to actually be encrypted despite the
  * placeholder subject) - mirrors `searchTier3.ts`'s own `!security.html && !security.subject` discard
  * rule exactly, for the same reason. */
-async function buildEntity(message, unlocked) {
+async function buildEntity(message, sealer) {
+    let rawMime;
+    try {
+        rawMime = await getMessageRawContent(message.uid);
+    }
+    catch {
+        // Distinct from "undecryptable": a message that couldn't even be fetched may well be searchable,
+        // so the pass can't claim complete coverage.
+        return FETCH_FAILED;
+    }
     try {
-        const rawMime = await getMessageRawContent(message.uid);
-        const security = await evaluateMessageSecurity(rawMime, unlocked);
+        const security = await sealer.evaluate(message, rawMime);
         if (!security.subject && !security.html) {
             return undefined;
         }
@@ -87,6 +211,7 @@ async function buildEntity(message, unlocked) {
             subject: security.subject,
             body: security.html,
             byteSize: 0, // filled in below, after the fields above are known
+            entityVersion: versionOf(message),
         };
         entity.byteSize = estimateByteSize(entity);
         return entity;
@@ -100,10 +225,15 @@ async function buildEntity(message, unlocked) {
 /** Runs one full incremental build pass for `mailboxUid`: sets the window, walks mail folders newest-first
  * (per this module's own doc comment on the folder-order simplification), decrypts and indexes only
  * `"[...]"`-subject messages until each folder's own coverage passes the time floor, then clears the
- * `building` flag. Never throws - a failure partway through leaves whatever was indexed so far in place
- * (spec §11's "incomplete-index UX... MUST indicate that coverage is partial" is served by `coverage()`
- * truthfully reporting whatever `indexedFrom` this run actually reached, not by this function needing to
- * succeed completely).
+ * `building` flag. Messages already indexed at the same version are skipped, fetches run at most
+ * `FETCH_CONCURRENCY` at a time, and messages older than the eviction watermark (`WindowState.evictedBefore`)
+ * are neither fetched nor walked past. A failure partway through leaves whatever was indexed so far in place
+ * and records the pass as incomplete (spec §11's "incomplete-index UX... MUST indicate that coverage is
+ * partial" - see `Coverage.complete`). Rows the server no longer lists (deleted or moved elsewhere by any
+ * client) are pruned only within folders whose count held steady for a whole walk (see `MAX_WALK_ATTEMPTS`).
+ *
+ * Only one pass runs per mailbox (a newer call cancels the older), and every Worker call carries this pass's
+ * generation, so a pass outlived by a destroy can't write anything (see `cancelLocalIndexBuild()`).
  *
  * `windowConfig` defaults to this device's own configured byte budget (`getLocalIndexByteBudget()` -
  * 500 MB in a browser tab, 1 GB in Electron, or whatever the user has since set in Settings > Encryption)
@@ -112,42 +242,167 @@ async function buildEntity(message, unlocked) {
  * unlock), without requiring a reload.
  */
 export async function buildLocalIndex(mailboxUid, unlocked, folders, windowConfig = { timeFloorMonths: WEB_TIME_FLOOR_MONTHS, byteBudgetBytes: getLocalIndexByteBudget() }) {
+    // At most one pass per mailbox: a newer one cancels the older and waits for it to wind down first.
+    const previous = activeBuilds.get(mailboxUid);
+    const controller = new AbortController();
+    const run = (async () => {
+        if (previous) {
+            previous.controller.abort();
+            await previous.settled;
+        }
+        await runBuildPass(mailboxUid, unlocked, folders, windowConfig, controller.signal);
+    })();
+    const entry = { controller, settled: run.catch(() => undefined) };
+    activeBuilds.set(mailboxUid, entry);
+    try {
+        await run;
+    }
+    finally {
+        if (activeBuilds.get(mailboxUid) === entry) {
+            activeBuilds.delete(mailboxUid);
+        }
+    }
+}
+const activeBuilds = new Map();
+/** Stops a mailbox's running build pass, if any (e.g. its keys were just destroyed), resolving once it has
+ * wound down. The Worker independently rejects the pass's later calls once the index is destroyed (see
+ * `GenerationParams`); this just stops the fetching and decrypting too. Never rejects. */
+export async function cancelLocalIndexBuild(mailboxUid) {
+    const active = activeBuilds.get(mailboxUid);
+    if (active) {
+        active.controller.abort();
+        await active.settled;
+    }
+}
+function isOlderThan(date, watermark) {
+    return !!watermark && new Date(date).getTime() < new Date(watermark).getTime();
+}
+async function runBuildPass(mailboxUid, unlocked, folders, windowConfig, signal) {
+    const generation = nextLocalIndexGeneration();
     const indexKey = await deriveLocalIndexKey(unlocked.masterKey, mailboxUid);
-    await initLocalIndex({ mailboxUid, indexKey });
-    await setLocalIndexWindow(mailboxUid, windowConfig.timeFloorMonths, windowConfig.byteBudgetBytes);
-    await setLocalIndexBuilding(mailboxUid, true);
+    signal.throwIfAborted();
+    await initLocalIndex({ mailboxUid, indexKey, generation });
+    let { evictedBefore } = await setLocalIndexWindow(mailboxUid, windowConfig.timeFloorMonths, windowConfig.byteBudgetBytes, generation);
+    await setLocalIndexBuilding(mailboxUid, true, { complete: false, generation });
+    // Mail arriving after this moment isn't guaranteed to be picked up by this pass.
+    const coveredUntil = new Date(Date.now() - CLOCK_SKEW_MARGIN_MS).toISOString();
+    let cutoff;
+    if (windowConfig.timeFloorMonths > 0) {
+        cutoff = new Date();
+        cutoff.setMonth(cutoff.getMonth() - windowConfig.timeFloorMonths);
+    }
+    // A pass is "complete" only if every folder was walked back to the time floor (or its end) with a stable
+    // count, no listing/fetch failure and no budget cut-off - the only case where coverage can be used to
+    // narrow Tier 3.
+    let complete = true;
+    const sealer = createPassSealer(mailboxUid, unlocked, signal);
     try {
-        let cutoff;
-        if (windowConfig.timeFloorMonths > 0) {
-            cutoff = new Date();
-            cutoff.setMonth(cutoff.getMonth() - windowConfig.timeFloorMonths);
+        if (folders.some((f) => !MESSAGE_FOLDER_TYPES.has(f.type) && !NON_MESSAGE_FOLDER_TYPES.has(f.type))) {
+            complete = false;
         }
         const mailFolders = folders
             .filter((f) => MESSAGE_FOLDER_TYPES.has(f.type))
             .sort((a, b) => (FOLDER_PRIORITY[a.type] ?? 99) - (FOLDER_PRIORITY[b.type] ?? 99));
-        for (const folder of mailFolders) {
-            let page = 0;
-            for (;;) {
-                const messages = await listMessages(folder.uid, { page, limit: PAGE_SIZE }).catch(() => []);
+        const seenEncryptedUids = new Set();
+        async function walkFolder(folder) {
+            for (let page = 0;; page++) {
+                signal.throwIfAborted();
+                let messages;
+                try {
+                    messages = await listMessages(folder.uid, { page, limit: PAGE_SIZE });
+                }
+                catch {
+                    return "failed";
+                }
                 if (messages.length === 0) {
-                    break;
+                    return "done";
                 }
                 const encrypted = messages.filter((m) => m.subject === ENCRYPTED_SUBJECT_PLACEHOLDER);
-                if (encrypted.length > 0) {
-                    const entities = (await Promise.all(encrypted.map((m) => buildEntity(m, unlocked)))).filter((e) => e !== undefined);
+                for (const m of encrypted) {
+                    seenEncryptedUids.add(m.uid);
+                }
+                // Anything older than the eviction watermark would only be inserted and evicted again.
+                const candidates = encrypted.filter((m) => !isOlderThan(m.receivedDate, evictedBefore));
+                if (candidates.length > 0) {
+                    // Skip anything already indexed at the same version - a re-unlock used to re-fetch and
+                    // re-decrypt the entire window every time.
+                    const indexed = await getIndexedVersions(mailboxUid, candidates.map((m) => m.uid));
+                    const changed = candidates.filter((m) => indexed[m.uid] !== versionOf(m));
+                    const built = await mapWithConcurrency(changed, FETCH_CONCURRENCY, (m) => buildEntity(m, sealer));
+                    signal.throwIfAborted();
+                    if (built.includes(FETCH_FAILED)) {
+                        complete = false;
+                    }
+                    const entities = built.filter((e) => e !== undefined && e !== FETCH_FAILED);
                     if (entities.length > 0) {
-                        await indexLocalEntities(mailboxUid, entities);
+                        ({ evictedBefore } = await indexLocalEntities(mailboxUid, entities, generation));
                     }
                 }
-                const oldestOnPage = messages[messages.length - 1];
-                if (!isWithinTimeFloor(oldestOnPage.receivedDate, cutoff) || messages.length < PAGE_SIZE) {
-                    break;
+                const oldestOnPage = messages[messages.length - 1].receivedDate;
+                if (evictedBefore && isOlderThan(oldestOnPage, evictedBefore) && isWithinTimeFloor(evictedBefore, cutoff)) {
+                    return "budget";
+                }
+                if (!isWithinTimeFloor(oldestOnPage, cutoff) || messages.length < PAGE_SIZE) {
+                    return "done";
                 }
-                page += 1;
             }
         }
+        /** Each folder's current total, or `undefined` if the listing failed. */
+        async function folderTotals() {
+            try {
+                return new Map((await listFolders(mailboxUid)).map((f) => [f.uid, f.totalCount]));
+            }
+            catch {
+                return undefined;
+            }
+        }
+        // Folders walked with a steady count and no listing failure - the only ones whose unseen rows can be
+        // pruned (deleted, or moved elsewhere by any client).
+        const reliable = [];
+        let totalsBefore = await folderTotals();
+        let toWalk = mailFolders;
+        for (let attempt = 0; attempt < MAX_WALK_ATTEMPTS && toWalk.length > 0; attempt++) {
+            const outcomes = new Map();
+            for (const folder of toWalk) {
+                outcomes.set(folder.uid, await walkFolder(folder));
+            }
+            const totalsAfter = await folderTotals();
+            const changed = [];
+            for (const folder of toWalk) {
+                const outcome = outcomes.get(folder.uid);
+                if (outcome === "failed" || !totalsBefore || !totalsAfter) {
+                    // A failed listing, or no counts to vouch for the walk with: indexed as far as it got, but
+                    // neither complete nor prunable (see the `reliable` check below).
+                }
+                else if (totalsAfter.get(folder.uid) === totalsBefore.get(folder.uid)) {
+                    reliable.push(folder.uid);
+                    complete && (complete = outcome === "done");
+                }
+                else {
+                    changed.push(folder);
+                }
+            }
+            totalsBefore = totalsAfter;
+            toWalk = changed;
+        }
+        // Failed, count-less, or still changing after every attempt.
+        if (reliable.length < mailFolders.length) {
+            complete = false;
+        }
+        if (reliable.length > 0) {
+            // Every reliable folder was walked back to at least the watermark (or the floor).
+            const since = evictedBefore && isWithinTimeFloor(evictedBefore, cutoff) ? evictedBefore : cutoff?.toISOString();
+            await pruneLocalEntities(mailboxUid, [...seenEncryptedUids], since, { folderUids: reliable, generation });
+        }
+    }
+    catch (err) {
+        complete = false;
+        throw err;
     }
     finally {
-        await setLocalIndexBuilding(mailboxUid, false);
+        // Rejected (harmlessly) when the index was destroyed mid-pass.
+        await setLocalIndexBuilding(mailboxUid, false, { complete, coveredFrom: cutoff?.toISOString(), coveredUntil, generation }).catch(() => undefined);
+        // At most `SEAL_WRITE_CONCURRENCY` writes are still in flight; queued ones are dropped if the pass was aborted.
+        await sealer.drain();
     }
 }