@remit/backend 0.0.118 → 0.0.120

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.118",
+  "version": "0.0.120",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",
@@ -23,6 +23,10 @@
       "types": "./src/handlers/folder-role-appointments.ts",
       "default": "./src/handlers/folder-role-appointments.ts"
     },
+    "./folder-role-labels": {
+      "types": "./src/handlers/folder-role-labels.ts",
+      "default": "./src/handlers/folder-role-labels.ts"
+    },
     "./organize": {
       "types": "./src/service/organize.ts",
       "default": "./src/service/organize.ts"

package/src/handlers/address.test.ts

@@ -181,6 +181,44 @@ const clientHolding = (
 		},
 	}) as unknown as RemitClient;
 
+/**
+ * The never-spam grant (#605) travels the same route every other flag does. The
+ * exclusivity against `blocked` is not asserted here: it lives in the repo's
+ * merge fold, the only place that sees both keys at once.
+ */
+describe("AddressDetailOperations_updateAddress never-spam (#605)", () => {
+	it("forwards the grant to the merge patch and hands it back on the address", async () => {
+		const seen: FlagsMergePatch[] = [];
+		setClient(clientHolding(address({ flags: {} }), seen));
+
+		const response = await updateAddress(
+			updateContextFor({ flags: { neverSpam: { value: true, setAt: 20 } } }),
+			eventFor(SUB),
+		);
+
+		assert.deepEqual(seen, [{ neverSpam: { value: true, setAt: 20 } }]);
+		assert.deepEqual(response.flags.neverSpam, { value: true, setAt: 20 });
+	});
+
+	it("clears the grant by naming the key, the removal form every flag shares", async () => {
+		const seen: FlagsMergePatch[] = [];
+		setClient(
+			clientHolding(
+				address({ flags: { neverSpam: { value: true, setAt: 10 } } }),
+				seen,
+			),
+		);
+
+		const response = await updateAddress(
+			updateContextFor({ clearFlags: ["neverSpam"] }),
+			eventFor(SUB),
+		);
+
+		assert.deepEqual(seen, [{ neverSpam: null }]);
+		assert.equal(response.flags.neverSpam, undefined);
+	});
+});
+
 describe("AddressDetailOperations_updateAddress removing a flag (#615)", () => {
 	it("clears the category override, which has no false-equivalent value to send", async () => {
 		const seen: FlagsMergePatch[] = [];

package/src/handlers/folder-role-labels.ts

@@ -0,0 +1,63 @@
+import type { IAccountSettingRepository } from "@remit/data-ports";
+import {
+	type CanonicalMailboxRoleValue,
+	composeFolderRoleAppointmentLabelName,
+} from "@remit/data-ports/folder-role";
+import { rebaseMailboxPath } from "@remit/data-ports/mailbox-name";
+import { loadFolderAppointmentsForAccount } from "./folder-role-appointments.js";
+
+/**
+ * The label row beside each role appointment records the path its folder had at
+ * the time (#887), so a folder another client later deletes can still be named
+ * back to the user. It is display only, and it lives here rather than beside
+ * the appointment writer because that writer is guarded as the only writer of
+ * the appointment row itself.
+ *
+ * A rename keeps every mailboxId, so an appointment survives it — but the path
+ * recorded beside it still names where the folder was. Move the labels with the
+ * branch, or a later third-party delete names a path the user has not seen
+ * since the rename.
+ *
+ * Driven by the settle, not by the intent: under D2 the row keeps the path the
+ * mail server holds until the rename lands, so a label moved when the intent
+ * was recorded would name a path that does not exist — permanently, if the
+ * rename then fails.
+ *
+ * The renamed folder is matched by id; its descendants are matched by the path
+ * each label already holds.
+ */
+export const refreshFolderAppointmentLabels = async (
+	accountSetting: Pick<IAccountSettingRepository, "get" | "upsert">,
+	accountConfigId: string,
+	accountId: string,
+	renamed: { mailboxId: string; oldPath: string; newPath: string },
+	delimiter: string,
+): Promise<void> => {
+	const persisted = await loadFolderAppointmentsForAccount(
+		accountSetting,
+		accountConfigId,
+		accountId,
+	);
+	for (const [role, appointment] of persisted) {
+		const moved =
+			appointment.mailboxId === renamed.mailboxId
+				? renamed.newPath
+				: appointment.lastKnownPath === undefined
+					? undefined
+					: rebaseMailboxPath(
+							appointment.lastKnownPath,
+							renamed.oldPath,
+							renamed.newPath,
+							delimiter,
+						);
+		if (moved === undefined || moved === appointment.lastKnownPath) continue;
+		await accountSetting.upsert({
+			accountConfigId,
+			name: composeFolderRoleAppointmentLabelName(
+				accountId,
+				role as CanonicalMailboxRoleValue,
+			),
+			value: { kind: "String", value: moved },
+		});
+	}
+};

package/src/handlers/folder-role.test.ts

@@ -5,7 +5,7 @@ import { isPublicApiError } from "@remit/data-ports/errors";
 import { composeFolderRoleAppointmentLabelName } from "@remit/data-ports/folder-role";
 import { CanonicalMailboxRole, MailboxSyncStatus } from "@remit/domain-enums";
 import { assertMailboxSettled } from "./folder-role.js";
-import { applyMailboxPatch, type MailboxPatchClient } from "./mailbox.js";
+import { refreshFolderAppointmentLabels } from "./folder-role-labels.js";
 
 const mailbox = (over: Partial<MailboxItem>): MailboxItem =>
 	({
@@ -68,7 +68,7 @@ describe("assertMailboxSettled", () => {
 	});
 });
 
-describe("applyMailboxPatch — the appointment label follows a rename", () => {
+describe("refreshFolderAppointmentLabels — the label follows a settled rename", () => {
 	const labelName = composeFolderRoleAppointmentLabelName(
 		"acc-1",
 		CanonicalMailboxRole.Trash,
@@ -82,68 +82,68 @@ describe("applyMailboxPatch — the appointment label follows a rename", () => {
 
 	const settingsFor = (
 		rows: Record<string, string>,
-		renamed = "INBOX",
-	): { store: Record<string, string>; client: MailboxPatchClient } => {
+	): {
+		store: Record<string, string>;
+		accountSetting: Parameters<typeof refreshFolderAppointmentLabels>[0];
+	} => {
 		const store: Record<string, string> = { ...rows };
-		const client = {
-			mailbox: {
-				get: async () => mailbox({ fullPath: renamed }),
+		const accountSetting = {
+			get: async (_configId: string, name: string) =>
+				store[name] === undefined
+					? undefined
+					: ({
+							name,
+							value: { kind: "String", value: store[name] },
+						} as AccountSettingItem),
+			upsert: async (item: AccountSettingItem) => {
+				if (item.value.kind === "String") store[item.name] = item.value.value;
+				return item;
 			},
-			mailboxQueue: {
-				renameMailbox: async (mailboxId: string, newPath: string) =>
-					mailbox({ mailboxId, fullPath: newPath }),
-			},
-			accountSetting: {
-				get: async (_configId: string, name: string) =>
-					store[name] === undefined
-						? undefined
-						: ({
-								name,
-								value: { kind: "String", value: store[name] },
-							} as AccountSettingItem),
-				upsert: async (item: AccountSettingItem) => {
-					if (item.value.kind === "String") store[item.name] = item.value.value;
-					return item;
-				},
-				delete: async (_configId: string, name: string) => {
-					delete store[name];
-				},
-			},
-		} as unknown as MailboxPatchClient;
-		return { store, client };
+		} as unknown as Parameters<typeof refreshFolderAppointmentLabels>[0];
+		return { store, accountSetting };
 	};
 
-	it("rewrites the recorded path for the folder that was renamed", async () => {
-		const { store, client } = settingsFor(
-			{
-				[appointmentName(CanonicalMailboxRole.Trash)]: "mb-1",
-				[labelName]: "INBOX/Prullenbak",
-			},
-			"INBOX/Prullenbak",
+	const settle = (
+		accountSetting: Parameters<typeof refreshFolderAppointmentLabels>[0],
+		renamed: { mailboxId: string; oldPath: string; newPath: string },
+	) =>
+		refreshFolderAppointmentLabels(
+			accountSetting,
+			"cfg-1",
+			"acc-1",
+			renamed,
+			"/",
 		);
 
-		await applyMailboxPatch(client, "cfg-1", "mb-1", "acc-1", {
-			fullPath: "INBOX/Verwijderd",
+	it("rewrites the recorded path for the folder that was renamed", async () => {
+		const { store, accountSetting } = settingsFor({
+			[appointmentName(CanonicalMailboxRole.Trash)]: "mb-1",
+			[labelName]: "INBOX/Prullenbak",
+		});
+
+		await settle(accountSetting, {
+			mailboxId: "mb-1",
+			oldPath: "INBOX/Prullenbak",
+			newPath: "INBOX/Verwijderd",
 		});
 
 		assert.equal(store[labelName], "INBOX/Verwijderd");
 	});
 
-	// IMAP RENAME moves the subtree in one command and `renameChildPaths`
-	// rewrites every descendant row, so every label under the branch moves too.
+	// IMAP RENAME moves the subtree in one command, so every label under the
+	// branch moves with it.
 	it("carries every appointed folder under the renamed branch with it", async () => {
-		const { store, client } = settingsFor(
-			{
-				[appointmentName(CanonicalMailboxRole.Trash)]: "mb-trash",
-				[labelName]: "INBOX/Prullenbak",
-				[appointmentName(CanonicalMailboxRole.Sent)]: "mb-sent",
-				[sentLabelName]: "INBOX/Verzonden",
-			},
-			"INBOX",
-		);
+		const { store, accountSetting } = settingsFor({
+			[appointmentName(CanonicalMailboxRole.Trash)]: "mb-trash",
+			[labelName]: "INBOX/Prullenbak",
+			[appointmentName(CanonicalMailboxRole.Sent)]: "mb-sent",
+			[sentLabelName]: "INBOX/Verzonden",
+		});
 
-		await applyMailboxPatch(client, "cfg-1", "mb-1", "acc-1", {
-			fullPath: "Mail",
+		await settle(accountSetting, {
+			mailboxId: "mb-1",
+			oldPath: "INBOX",
+			newPath: "Mail",
 		});
 
 		assert.equal(store[labelName], "Mail/Prullenbak");
@@ -151,32 +151,30 @@ describe("applyMailboxPatch — the appointment label follows a rename", () => {
 	});
 
 	it("leaves a folder outside the renamed branch alone", async () => {
-		const { store, client } = settingsFor(
-			{
-				[appointmentName(CanonicalMailboxRole.Trash)]: "mb-trash",
-				[labelName]: "Archief/Prullenbak",
-			},
-			"INBOX",
-		);
+		const { store, accountSetting } = settingsFor({
+			[appointmentName(CanonicalMailboxRole.Trash)]: "mb-trash",
+			[labelName]: "Archief/Prullenbak",
+		});
 
-		await applyMailboxPatch(client, "cfg-1", "mb-1", "acc-1", {
-			fullPath: "Mail",
+		await settle(accountSetting, {
+			mailboxId: "mb-1",
+			oldPath: "INBOX",
+			newPath: "Mail",
 		});
 
 		assert.equal(store[labelName], "Archief/Prullenbak");
 	});
 
 	it("never rebases a sibling that merely shares the prefix", async () => {
-		const { store, client } = settingsFor(
-			{
-				[appointmentName(CanonicalMailboxRole.Trash)]: "mb-trash",
-				[labelName]: "INBOXES/Prullenbak",
-			},
-			"INBOX",
-		);
+		const { store, accountSetting } = settingsFor({
+			[appointmentName(CanonicalMailboxRole.Trash)]: "mb-trash",
+			[labelName]: "INBOXES/Prullenbak",
+		});
 
-		await applyMailboxPatch(client, "cfg-1", "mb-1", "acc-1", {
-			fullPath: "Mail",
+		await settle(accountSetting, {
+			mailboxId: "mb-1",
+			oldPath: "INBOX",
+			newPath: "Mail",
 		});
 
 		assert.equal(store[labelName], "INBOXES/Prullenbak");

package/src/handlers/mailbox-rename-refusal.test.ts

@@ -0,0 +1,247 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type { MailboxItem } from "@remit/data-ports";
+import { MailboxSyncStatus } from "@remit/domain-enums";
+import { applyMailboxPatch, type MailboxPatchClient } from "./mailbox.js";
+
+const ACCOUNT_ID = "acc-1";
+const CONFIG_ID = "cfg-1";
+
+const mailbox = (over: Partial<MailboxItem> = {}): MailboxItem =>
+	({
+		mailboxId: "mbx-1",
+		accountId: ACCOUNT_ID,
+		fullPath: "Work",
+		hierarchyDelimiter: "/",
+		syncStatus: MailboxSyncStatus.synced,
+		...over,
+	}) as MailboxItem;
+
+const clientOver = (
+	row: MailboxItem,
+	others: MailboxItem[] = [],
+): {
+	client: MailboxPatchClient;
+	renames: { mailboxId: string; newPath: string }[];
+	dismissals: string[];
+	settings: string[];
+} => {
+	const renames: { mailboxId: string; newPath: string }[] = [];
+	const dismissals: string[] = [];
+	const settings: string[] = [];
+	const client: MailboxPatchClient = {
+		mailbox: {
+			get: async () => row,
+			listAllByAccount: async () => [row, ...others],
+		},
+		mailboxQueue: {
+			renameMailbox: async (mailboxId, newPath) => {
+				renames.push({ mailboxId, newPath });
+				return mailbox({ pendingPath: newPath });
+			},
+			dismissMailboxIntent: async (mailboxId) => {
+				dismissals.push(mailboxId);
+				return mailbox();
+			},
+		},
+		accountSetting: {
+			get: async () => null,
+			upsert: async (item) => {
+				settings.push(item.name);
+				return item as never;
+			},
+			delete: async (_configId, name) => {
+				settings.push(name);
+			},
+		},
+	};
+	return { client, renames, dismissals, settings };
+};
+
+const patch = (
+	client: MailboxPatchClient,
+	body: Record<string, unknown>,
+): Promise<MailboxItem> =>
+	applyMailboxPatch(client, CONFIG_ID, "mbx-1", ACCOUNT_ID, body);
+
+const refusedWith = (message: string) => (error: unknown) =>
+	(error as { statusCode?: number }).statusCode === 400 &&
+	(error as Error).message === message;
+
+describe("applyMailboxPatch — renames that can never succeed (D4, D5)", () => {
+	it("refuses to rename the inbox", async () => {
+		const { client, renames } = clientOver(mailbox({ fullPath: "INBOX" }));
+
+		await assert.rejects(
+			patch(client, { fullPath: "Postvak" }),
+			refusedWith("The inbox can't be renamed."),
+		);
+		assert.equal(renames.length, 0);
+	});
+
+	it("refuses a target that canonicalizes to the inbox", async () => {
+		const { client, renames } = clientOver(mailbox());
+
+		await assert.rejects(
+			patch(client, { fullPath: "inbox" }),
+			refusedWith("“INBOX” is reserved for the inbox."),
+		);
+		assert.equal(renames.length, 0);
+	});
+
+	it("refuses an empty target", async () => {
+		const { client, renames } = clientOver(mailbox());
+
+		await assert.rejects(
+			patch(client, { fullPath: "   " }),
+			refusedWith("A folder needs a name."),
+		);
+		assert.equal(renames.length, 0);
+	});
+
+	it("refuses a target another folder already holds", async () => {
+		const { client, renames } = clientOver(mailbox(), [
+			mailbox({ mailboxId: "mbx-2", fullPath: "Projects" }),
+		]);
+
+		await assert.rejects(
+			patch(client, { fullPath: "Projects" }),
+			refusedWith("A folder named “Projects” is already there."),
+		);
+		assert.equal(renames.length, 0);
+	});
+
+	/**
+	 * The sweep reads a folder whose leaf name is a role's conventional name but
+	 * which lacks the server's flag as a duplicate, and deletes its row — under
+	 * D8, with the folder's mail — as soon as another folder holds the flag. A
+	 * rename to one of those settles `synced` and is then reaped.
+	 */
+	for (const [name, leaf] of [
+		["Archive", "Archive"],
+		["Trash", "Trash"],
+		["Drafts", "Drafts"],
+		["Sent", "Sent"],
+		["Junk", "Spam"],
+	] as const) {
+		it(`refuses a rename to the reserved ${name} name`, async () => {
+			const { client, renames } = clientOver(mailbox());
+
+			await assert.rejects(
+				patch(client, { fullPath: `Work/${leaf}` }),
+				refusedWith(
+					`“${leaf}” is reserved for a system folder. Pick another name.`,
+				),
+			);
+			assert.equal(renames.length, 0);
+		});
+	}
+
+	it("refuses a target another rename is already on its way to", async () => {
+		// A path a rename is aiming at is as taken as one a folder sits at (D2).
+		// Two renames onto one target both settle, both write it, and the sweep
+		// then reaps one row — with its mail — and inserts a duplicate.
+		const { client, renames } = clientOver(mailbox(), [
+			mailbox({
+				mailboxId: "mbx-2",
+				fullPath: "Admin",
+				syncStatus: MailboxSyncStatus.pending,
+				pendingPath: "Projects",
+			}),
+		]);
+
+		await assert.rejects(
+			patch(client, { fullPath: "Projects" }),
+			refusedWith("“Admin” is already being renamed to “Projects”."),
+		);
+		assert.equal(renames.length, 0);
+	});
+
+	it("lets a failed rename's stale target go to somebody else", async () => {
+		// `failed` keeps its target so the client can name what the rename was
+		// aiming at and offer a retry (T6), and nothing clears it until the user
+		// retries or dismisses. Honouring that claim would tell everyone else the
+		// path is taken by a rename that is not happening, with nothing to wait
+		// for and no way to find out.
+		const { client, renames } = clientOver(mailbox(), [
+			mailbox({
+				mailboxId: "mbx-2",
+				fullPath: "Admin",
+				syncStatus: MailboxSyncStatus.failed,
+				pendingPath: "Projects",
+			}),
+		]);
+
+		await patch(client, { fullPath: "Projects" });
+
+		assert.deepEqual(renames, [{ mailboxId: "mbx-1", newPath: "Projects" }]);
+	});
+
+	it("lets a retry aim at the target its own failed rename recorded", async () => {
+		const { client, renames } = clientOver(
+			mailbox({
+				syncStatus: MailboxSyncStatus.failed,
+				pendingPath: "Projects",
+			}),
+		);
+
+		await patch(client, { fullPath: "Projects" });
+
+		assert.deepEqual(renames, [{ mailboxId: "mbx-1", newPath: "Projects" }]);
+	});
+
+	it("records the intent for an ordinary target", async () => {
+		const { client, renames } = clientOver(mailbox());
+
+		const renamed = await patch(client, { fullPath: "Projects" });
+
+		assert.deepEqual(renames, [{ mailboxId: "mbx-1", newPath: "Projects" }]);
+		assert.equal(renamed.pendingPath, "Projects");
+	});
+});
+
+describe("applyMailboxPatch — dismissing a failed intent (T10, T11)", () => {
+	it("reads a target equal to the confirmed path as a dismissal, not a rename", async () => {
+		const { client, renames, dismissals } = clientOver(
+			mailbox({
+				syncStatus: MailboxSyncStatus.failed,
+				pendingPath: "Projects",
+			}),
+		);
+
+		const dismissed = await patch(client, { fullPath: "Work" });
+
+		assert.deepEqual(dismissals, ["mbx-1"]);
+		assert.equal(renames.length, 0, "nothing is enqueued for a dismissal");
+		assert.equal(dismissed.syncStatus, MailboxSyncStatus.synced);
+	});
+
+	it("dismisses even where the folder's own name is reserved", async () => {
+		// The refusals gate a rename's target. Keeping the name a folder already
+		// has is not one, and a folder called `Archive` must still be able to
+		// dismiss a rename that failed.
+		const { client, dismissals } = clientOver(
+			mailbox({ fullPath: "Archive", syncStatus: MailboxSyncStatus.failed }),
+		);
+
+		await patch(client, { fullPath: "Archive" });
+
+		assert.deepEqual(dismissals, ["mbx-1"]);
+	});
+});
+
+describe("applyMailboxPatch — an override-only PATCH", () => {
+	it("touches no mutation state", async () => {
+		const { client, renames, dismissals, settings } = clientOver(mailbox());
+
+		await patch(client, { muted: true });
+
+		assert.equal(renames.length, 0);
+		assert.equal(dismissals.length, 0);
+		assert.equal(
+			settings.length > 0,
+			true,
+			"the override row is still written",
+		);
+	});
+});

package/src/handlers/mailbox.ts

@@ -3,12 +3,13 @@ import type {
 	RenameMailboxInput,
 } from "@remit/api-openapi-types";
 import type { IAccountSettingRepository, MailboxItem } from "@remit/data-ports";
-import { ForbiddenError, NotFoundError } from "@remit/data-ports/errors";
 import {
-	type CanonicalMailboxRoleValue,
-	composeFolderRoleAppointmentLabelName,
-} from "@remit/data-ports/folder-role";
-import { rebaseMailboxPath } from "@remit/data-ports/mailbox-name";
+	BadRequestError,
+	ForbiddenError,
+	NotFoundError,
+} from "@remit/data-ports/errors";
+import { isReservedFolderName } from "@remit/data-ports/folder-role";
+import { mailboxLeafName } from "@remit/data-ports/mailbox-name";
 import { MailboxSyncStatus, MessageSystemFlag } from "@remit/domain-enums";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { getAccountConfigIdFromEvent } from "../auth.js";
@@ -30,7 +31,6 @@ import {
 	type MailboxOverrides,
 } from "./account-overrides.js";
 import { assertAccountOwnership } from "./account-ownership.js";
-import { loadFolderAppointmentsForAccount } from "./folder-role-appointments.js";
 
 /**
  * The mute flag and the display-name override are user preferences that live
@@ -66,6 +66,7 @@ export const pickMailboxOverrideChanges = (
 export interface MailboxPatchClient {
 	mailbox: {
 		get(accountId: string, mailboxId: string): Promise<MailboxItem>;
+		listAllByAccount(accountId: string): Promise<MailboxItem[]>;
 	};
 	mailboxQueue: {
 		renameMailbox(
@@ -73,53 +74,80 @@ export interface MailboxPatchClient {
 			newPath: string,
 			accountId: string,
 		): Promise<MailboxItem>;
+		dismissMailboxIntent(
+			mailboxId: string,
+			accountId: string,
+		): Promise<MailboxItem>;
 	};
 	accountSetting: Pick<IAccountSettingRepository, "get" | "upsert" | "delete">;
 }
 
 /**
- * A reader-side rename keeps every mailboxId, so the appointments survive it —
- * but the paths recorded beside them (#887) would still name where the folders
- * were before. Move the labels with the branch, or a later third-party delete
- * names a path the user has not seen since the rename.
+ * Refuse a rename that no retry of the same request could ever satisfy (D4).
  *
- * The renamed folder is matched by id; its descendants are matched by the path
- * each label already holds, which is the path their rows carried until the
- * rename intent rewrote them.
+ * `INBOX` is refused at both ends: renaming it moves its mail to the new name
+ * and leaves an empty INBOX behind, and renaming anything *to* it collides with
+ * the one name RFC 3501 reserves (D5).
+ *
+ * A reserved leaf name is refused for a different reason. The mailbox sweep
+ * reads a folder whose leaf name is a role's conventional name but which lacks
+ * the server's flag as a duplicate, and deletes its row — under D8, with the
+ * folder's mail — as soon as another folder holds the flag. A rename to such a
+ * name settles `synced` and is then reaped. Refusing at the API is the same
+ * class of check as the rest of D4 and does not require teaching that heuristic
+ * about renames.
  */
-const refreshAppointmentLabels = async (
-	accountSetting: Pick<IAccountSettingRepository, "get" | "upsert">,
-	accountConfigId: string,
+const assertRenameTargetAllowed = async (
+	client: Pick<MailboxPatchClient, "mailbox">,
 	accountId: string,
-	renamed: { mailboxId: string; oldPath: string; newPath: string },
-	delimiter: string,
+	before: MailboxItem,
+	target: string,
 ): Promise<void> => {
-	const persisted = await loadFolderAppointmentsForAccount(
-		accountSetting,
-		accountConfigId,
-		accountId,
-	);
-	for (const [role, appointment] of persisted) {
-		const moved =
-			appointment.mailboxId === renamed.mailboxId
-				? renamed.newPath
-				: appointment.lastKnownPath === undefined
-					? undefined
-					: rebaseMailboxPath(
-							appointment.lastKnownPath,
-							renamed.oldPath,
-							renamed.newPath,
-							delimiter,
-						);
-		if (moved === undefined || moved === appointment.lastKnownPath) continue;
-		await accountSetting.upsert({
-			accountConfigId,
-			name: composeFolderRoleAppointmentLabelName(
-				accountId,
-				role as CanonicalMailboxRoleValue,
-			),
-			value: { kind: "String", value: moved },
-		});
+	if (before.fullPath.toUpperCase() === "INBOX") {
+		throw new BadRequestError("The inbox can't be renamed.");
+	}
+	if (target.trim().length === 0) {
+		throw new BadRequestError("A folder needs a name.");
+	}
+	if (target.toUpperCase() === "INBOX") {
+		throw new BadRequestError("“INBOX” is reserved for the inbox.");
+	}
+
+	const leaf = mailboxLeafName({
+		fullPath: target,
+		hierarchyDelimiter: before.hierarchyDelimiter,
+	});
+	if (isReservedFolderName(leaf)) {
+		throw new BadRequestError(
+			`“${leaf}” is reserved for a system folder. Pick another name.`,
+		);
+	}
+
+	// A path a rename is on its way to is as taken as one a folder already sits
+	// at (D2). Reading `fullPath` alone accepts a second rename onto a target
+	// another is already recorded for: both settle, both write the same path,
+	// and the sweep then reaps one row — with its mail — and inserts a duplicate
+	// for the survivor's path. The account's folders are few and the sweep
+	// already reads them all, so one pass answers both questions.
+	const folders = await client.mailbox.listAllByAccount(accountId);
+	for (const folder of folders) {
+		if (folder.mailboxId === before.mailboxId) continue;
+		if (folder.fullPath === target) {
+			throw new BadRequestError(`A folder named “${target}” is already there.`);
+		}
+		// `pending` only. A failed rename keeps its target so the client can name
+		// what it was aiming at and offer a retry (T6), and nothing clears it
+		// until the user retries or dismisses — so honouring a `failed` row's
+		// claim would tell everyone else the path is taken by a rename that is
+		// not happening, with no way to find that out and nothing to wait for.
+		if (
+			folder.syncStatus === MailboxSyncStatus.pending &&
+			folder.pendingPath === target
+		) {
+			throw new BadRequestError(
+				`“${folder.fullPath}” is already being renamed to “${target}”.`,
+			);
+		}
 	}
 };
 
@@ -130,6 +158,11 @@ const refreshAppointmentLabels = async (
  * (the recorded subtree intent + MAILBOX_RENAME event) — only when `fullPath`
  * is present. An override-only PATCH therefore never calls
  * `mailboxQueue.renameMailbox`.
+ *
+ * A `fullPath` equal to the row's confirmed one is not a rename: it is the
+ * dismissal of a failed intent (T10, T11), which is how a user keeps the name
+ * the folder already has without new API surface. It is checked first, because
+ * from `failed` it is the one route out that enqueues nothing.
  */
 export const applyMailboxPatch = async (
 	client: MailboxPatchClient,
@@ -161,26 +194,17 @@ export const applyMailboxPatch = async (
 		return client.mailbox.get(accountId, mailboxId);
 	}
 
-	// Read before the rename: the labels of the folders under this one are
-	// rebased off the path it is leaving, which the row no longer carries after.
 	const before = await client.mailbox.get(accountId, mailboxId);
-	const renamed = await client.mailboxQueue.renameMailbox(
-		mailboxId,
-		fullPath,
-		accountId,
-	);
-	await refreshAppointmentLabels(
-		client.accountSetting,
-		accountConfigId,
-		accountId,
-		{
-			mailboxId,
-			oldPath: before.fullPath,
-			newPath: renamed.fullPath,
-		},
-		before.hierarchyDelimiter,
-	);
-	return renamed;
+	if (fullPath === before.fullPath) {
+		return client.mailboxQueue.dismissMailboxIntent(mailboxId, accountId);
+	}
+
+	await assertRenameTargetAllowed(client, accountId, before, fullPath);
+
+	// The row keeps the path the server holds until the rename settles (D2), so
+	// nothing that names a folder by path moves here — the appointment labels
+	// recorded beside each role (#887) included. They move with the settle.
+	return client.mailboxQueue.renameMailbox(mailboxId, fullPath, accountId);
 };
 
 /**