@remit/backend 0.0.67 → 0.0.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.67",
+  "version": "0.0.69",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/folder-role-appointments.test.ts

@@ -1,11 +1,10 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import type { AccountSettingItem } from "@remit/data-ports";
+import type { RoleMailboxCandidate } from "@remit/data-ports/folder-role";
 import { CanonicalMailboxRole, MailboxSpecialUse } from "@remit/domain-enums";
 import {
 	CANONICAL_ROLES,
-	type FolderCandidate,
-	findFolderForRole,
 	groupFolderAppointmentsByAccount,
 	loadFolderAppointmentsForAccount,
 	resolveFolderAppointments,
@@ -40,60 +39,18 @@ describe("CANONICAL_ROLES", () => {
 	});
 });
 
-describe("findFolderForRole", () => {
-	const folders: FolderCandidate[] = [
-		{ mailboxId: "mb-inbox", fullPath: "INBOX" },
+describe("resolveFolderAppointments", () => {
+	const folders: RoleMailboxCandidate[] = [
+		{ mailboxId: "mb-inbox", fullPath: "INBOX", hierarchyDelimiter: "/" },
 		{
-			mailboxId: "mb-drafts-empty",
-			fullPath: "INBOX/Drafts",
-			specialUse: [MailboxSpecialUse.Drafts],
+			mailboxId: "mb-concepten",
+			fullPath: "INBOX/Concepten",
+			hierarchyDelimiter: "/",
 		},
-		{ mailboxId: "mb-concepten", fullPath: "INBOX/Concepten" },
-		{ mailboxId: "mb-sent", fullPath: "INBOX/Sent" },
-		{ mailboxId: "mb-sent-messages", fullPath: "INBOX/Sent Messages" },
-		{ mailboxId: "mb-news", fullPath: "INBOX/Nieuwsbrieven" },
-	];
-
-	it("matches the reserved INBOX name for Inbox", () => {
-		assert.equal(
-			findFolderForRole(CanonicalMailboxRole.Inbox, folders),
-			"mb-inbox",
-		);
-	});
-
-	it("prefers the SPECIAL-USE flag over a name hint", () => {
-		assert.equal(
-			findFolderForRole(CanonicalMailboxRole.Drafts, folders),
-			"mb-drafts-empty",
-		);
-	});
-
-	it("falls back to a weak name hint when no flag is present", () => {
-		assert.equal(
-			findFolderForRole(CanonicalMailboxRole.Sent, folders),
-			"mb-sent",
-		);
-	});
-
-	it("returns null when nothing matches", () => {
-		assert.equal(findFolderForRole(CanonicalMailboxRole.Junk, folders), null);
-	});
-
-	it("never matches a plain user folder", () => {
-		assert.equal(
-			findFolderForRole(CanonicalMailboxRole.Archive, folders),
-			null,
-		);
-	});
-});
-
-describe("resolveFolderAppointments", () => {
-	const folders: FolderCandidate[] = [
-		{ mailboxId: "mb-inbox", fullPath: "INBOX" },
-		{ mailboxId: "mb-concepten", fullPath: "INBOX/Concepten" },
 		{
 			mailboxId: "mb-spam",
 			fullPath: "INBOX/Spam",
+			hierarchyDelimiter: "/",
 			specialUse: [MailboxSpecialUse.Junk],
 		},
 	];

package/src/handlers/folder-role-appointments.ts

@@ -1,67 +1,29 @@
-import type {
-	CanonicalMailboxRole as CanonicalMailboxRoleValue,
-	FolderAppointment,
-} from "@remit/api-openapi-types";
+import type { FolderAppointment } from "@remit/api-openapi-types";
 import type {
 	AccountSettingItem,
 	IAccountSettingRepository,
 	IMailboxRepository,
 } from "@remit/data-ports";
 import {
-	baseSettingName,
-	composeSettingName,
-	SETTING_NAME_SEPARATOR,
-} from "@remit/data-ports/account-settings";
-import {
-	AccountSettingName,
-	CanonicalMailboxRole,
-	MailboxSpecialUse,
-} from "@remit/domain-enums";
+	CANONICAL_ROLES,
+	type CanonicalMailboxRoleValue,
+	composeFolderRoleAppointmentName,
+	parseFolderRoleAppointmentName,
+	type RoleMailboxCandidate,
+	resolveMailboxForRole,
+} from "@remit/data-ports/folder-role";
 
 /**
  * RFC 032 exclusive-folder-appointment (#976): a per-account role→mailbox map.
  * Each row is a `FolderRoleAppointment#<accountId>#<role>` AccountSetting (RFC
  * 032 settings tiers), so a role can never be persisted twice for one account —
  * writing it replaces whichever mailbox previously held it. This module owns
- * that persistence plus the read-side proposal (`findFolderForRole`) that fills
- * any role the user hasn't appointed yet.
+ * that persistence; the read side is `resolveMailboxForRole`
+ * (`@remit/data-ports/folder-role`), the same rule every special-folder lookup
+ * in the backend and the workers goes through.
  */
 
-const FOLDER_ROLE_APPOINTMENT = AccountSettingName.FolderRoleAppointment;
-
-/** The fixed anchor set, in the RFC's canonical display order. */
-export const CANONICAL_ROLES: readonly CanonicalMailboxRoleValue[] =
-	Object.values(CanonicalMailboxRole);
-
-const composeAppointmentName = (
-	accountId: string,
-	role: CanonicalMailboxRoleValue,
-): string =>
-	composeSettingName(
-		FOLDER_ROLE_APPOINTMENT,
-		`${accountId}${SETTING_NAME_SEPARATOR}${role}`,
-	);
-
-/**
- * Split a stored `FolderRoleAppointment#<accountId>#<role>` name back into its
- * two-part target. Unlike the single-target composites (`MailboxRole#<id>`),
- * this setting composes two ids after the base, so it parses the suffix itself
- * rather than reusing `targetIdOf`.
- */
-const parseAppointmentTarget = (
-	name: string,
-): { accountId: string; role: string } | undefined => {
-	if (baseSettingName(name) !== FOLDER_ROLE_APPOINTMENT) return undefined;
-	const idx = name.indexOf(SETTING_NAME_SEPARATOR);
-	if (idx === -1) return undefined;
-	const rest = name.slice(idx + SETTING_NAME_SEPARATOR.length);
-	const roleIdx = rest.lastIndexOf(SETTING_NAME_SEPARATOR);
-	if (roleIdx === -1) return undefined;
-	const accountId = rest.slice(0, roleIdx);
-	const role = rest.slice(roleIdx + SETTING_NAME_SEPARATOR.length);
-	if (!accountId || !role) return undefined;
-	return { accountId, role };
-};
+export { CANONICAL_ROLES };
 
 const stringValueOf = (item: AccountSettingItem): string | undefined => {
 	const { value } = item;
@@ -78,7 +40,7 @@ export const groupFolderAppointmentsByAccount = (
 ): Map<string, Map<string, string>> => {
 	const byAccount = new Map<string, Map<string, string>>();
 	for (const setting of settings) {
-		const target = parseAppointmentTarget(setting.name);
+		const target = parseFolderRoleAppointmentName(setting.name);
 		if (!target) continue;
 		const mailboxId = stringValueOf(setting);
 		if (mailboxId === undefined) continue;
@@ -103,7 +65,7 @@ export const loadFolderAppointmentsForAccount = async (
 		CANONICAL_ROLES.map(async (role) => {
 			const item = await accountSetting.get(
 				accountConfigId,
-				composeAppointmentName(accountId, role),
+				composeFolderRoleAppointmentName(accountId, role),
 			);
 			return [role, item ? stringValueOf(item) : undefined] as const;
 		}),
@@ -128,7 +90,7 @@ export const writeFolderRoleAppointment = (
 	role: CanonicalMailboxRoleValue,
 	mailboxId: string | null,
 ): Promise<unknown> => {
-	const name = composeAppointmentName(accountId, role);
+	const name = composeFolderRoleAppointmentName(accountId, role);
 	if (mailboxId === null) {
 		return accountSetting.delete(accountConfigId, name);
 	}
@@ -139,110 +101,21 @@ export const writeFolderRoleAppointment = (
 	});
 };
 
-/** The minimal folder shape `findFolderForRole` needs to detect a role. */
-export interface FolderCandidate {
-	mailboxId: string;
-	fullPath: string;
-	specialUse?: readonly string[];
-}
-
-// RFC 6154 SPECIAL-USE flag per role. Inbox has no SPECIAL-USE flag (RFC 3501
-// reserves the name itself); a role with no entry here is matched by name hint
-// only.
-const ROLE_TO_SPECIAL_USE: Partial<Record<CanonicalMailboxRoleValue, string>> =
-	{
-		[CanonicalMailboxRole.Drafts]: MailboxSpecialUse.Drafts,
-		[CanonicalMailboxRole.Sent]: MailboxSpecialUse.Sent,
-		[CanonicalMailboxRole.Archive]: MailboxSpecialUse.Archive,
-		[CanonicalMailboxRole.Junk]: MailboxSpecialUse.Junk,
-		[CanonicalMailboxRole.Trash]: MailboxSpecialUse.Trash,
-		[CanonicalMailboxRole.All]: MailboxSpecialUse.All,
-		[CanonicalMailboxRole.Flagged]: MailboxSpecialUse.Flagged,
-	};
-
-// Weak name hints (RFC 032's tier 3 of `findFolderForRole`): used solely to
-// seed a PROPOSAL a human confirms, never to persist a role by itself. Kept
-// intentionally small — this is a fallback for providers with no SPECIAL-USE
-// support, not a substitute for server truth.
-const ROLE_NAME_HINTS: Partial<
-	Record<CanonicalMailboxRoleValue, readonly string[]>
-> = {
-	[CanonicalMailboxRole.Drafts]: ["drafts", "draft", "concepten"],
-	[CanonicalMailboxRole.Sent]: [
-		"sent",
-		"sent mail",
-		"sent items",
-		"sent messages",
-	],
-	[CanonicalMailboxRole.Archive]: ["archive", "archives"],
-	[CanonicalMailboxRole.Junk]: ["junk", "spam"],
-	[CanonicalMailboxRole.Trash]: [
-		"trash",
-		"bin",
-		"deleted",
-		"deleted items",
-		"deleted messages",
-	],
-	[CanonicalMailboxRole.All]: ["all mail", "all"],
-};
-
-const leafName = (fullPath: string): string => {
-	const parts = fullPath.split("/");
-	return (parts[parts.length - 1] || fullPath).toLowerCase();
-};
-
-/**
- * The single best EXISTING folder for a canonical role (RFC 032
- * exclusive-folder-appointment): the IMAP SPECIAL-USE flag first (server
- * truth, language-independent), then — for Inbox only — the reserved `INBOX`
- * name (RFC 3501), then a weak name hint used solely to seed a proposal a
- * human confirms. `null` when nothing matches; the role stays unfilled.
- */
-export const findFolderForRole = (
-	role: CanonicalMailboxRoleValue,
-	folders: readonly FolderCandidate[],
-): string | null => {
-	const specialUse = ROLE_TO_SPECIAL_USE[role];
-	if (specialUse) {
-		const flagged = folders.find((f) => f.specialUse?.includes(specialUse));
-		if (flagged) return flagged.mailboxId;
-	}
-
-	if (role === CanonicalMailboxRole.Inbox) {
-		const inbox = folders.find((f) => f.fullPath.toUpperCase() === "INBOX");
-		if (inbox) return inbox.mailboxId;
-	}
-
-	const hints = ROLE_NAME_HINTS[role];
-	if (hints) {
-		const match = folders.find((f) => hints.includes(leafName(f.fullPath)));
-		if (match) return match.mailboxId;
-	}
-
-	return null;
-};
-
 /**
  * Resolve the full appointment set for one account: the user's persisted
  * choice when set (and still a real mailbox — a deleted mailbox's stale
- * appointment is treated as unfilled and re-proposed), else a server-proposed
- * `findFolderForRole` guess. Always returns one entry per `CANONICAL_ROLES`
- * member (RFC 032 settings tiers: total, never a sparse array), so the map is
- * never empty for a normal provider.
+ * appointment is treated as unfilled and re-proposed), else the server's
+ * SPECIAL-USE flag, else a name proposal. Always returns one entry per
+ * `CANONICAL_ROLES` member (RFC 032 settings tiers: total, never a sparse
+ * array), so the map is never empty for a normal provider.
  */
 export const resolveFolderAppointments = (
 	persisted: ReadonlyMap<string, string>,
-	mailboxes: readonly FolderCandidate[],
+	mailboxes: readonly RoleMailboxCandidate[],
 ): FolderAppointment[] =>
 	CANONICAL_ROLES.map((role) => {
-		const persistedId = persisted.get(role);
-		const validPersisted =
-			persistedId && mailboxes.some((m) => m.mailboxId === persistedId)
-				? persistedId
-				: undefined;
-		const mailboxId =
-			validPersisted ?? findFolderForRole(role, mailboxes) ?? undefined;
-		return mailboxId ? { role, mailboxId } : { role };
+		const found = resolveMailboxForRole(role, mailboxes, persisted.get(role));
+		return found ? { role, mailboxId: found.mailboxId } : { role };
 	});
 
 /**

package/src/handlers/mailbox.ts

@@ -5,6 +5,7 @@ import type {
 import type { IAccountSettingRepository, MailboxItem } from "@remit/data-ports";
 import { ForbiddenError, NotFoundError } from "@remit/data-ports/errors";
 import { MailboxSyncStatus, MessageSystemFlag } from "@remit/domain-enums";
+import { NoTrashMailboxError } from "@remit/mailbox-service";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { getAccountConfigIdFromEvent } from "../auth.js";
 import {
@@ -411,14 +412,18 @@ export const TrashOperations: Record<
 		const account = await client.account.get(accountId);
 		assertAccountOwnership(account, accountConfigId, "act");
 
+		// The same confirmed resolution `emptyTrash` expunges through, so the
+		// count reported is the count of the folder that gets emptied. It
+		// refuses rather than returning zero when no folder is appointed and
+		// none is flagged: "0 deleted" reads as success, and the user goes on
+		// believing their Trash is empty.
 		const trashMailbox =
-			await client.mailboxSpecialUse.findTrashMailbox(accountId);
+			await client.mailboxSpecialUse.findConfirmedTrashMailbox(accountId);
 
 		if (!trashMailbox) {
-			return { deletedCount: 0 };
+			throw new NoTrashMailboxError();
 		}
 
-		// Get count of messages in trash before emptying
 		const messages = await client.message.listAllByMailbox(
 			trashMailbox.mailboxId,
 		);

package/src/service/organize.test.ts

@@ -1,6 +1,10 @@
 import assert from "node:assert/strict";
 import { afterEach, beforeEach, describe, it } from "node:test";
-import type { FilterAnchorItem, FilterItem } from "@remit/data-ports";
+import type {
+	CreateFilterAnchorInput,
+	FilterAnchorItem,
+	FilterItem,
+} from "@remit/data-ports";
 import { BadRequestError, NotFoundError } from "@remit/data-ports/errors";
 import { FilterMatchOperator, FilterState } from "@remit/domain-enums";
 import type {
@@ -17,7 +21,10 @@ import {
 	type OrganizeMatchDeps,
 	type OrganizePredicate,
 } from "./organize.js";
-import { _resetSemanticCapabilityForTest } from "./semantic-capability.js";
+import {
+	_resetSemanticCapabilityForTest,
+	isSemanticSearchUnavailable,
+} from "./semantic-capability.js";
 
 const moduleNotFound = (): Error => {
 	const error = new Error("Cannot find package 'sqlite-vec' imported from …");
@@ -28,11 +35,16 @@ const moduleNotFound = (): Error => {
 const ACCOUNT_CONFIG_ID = "cfg-1";
 const ANCHOR_VECTOR = [1, 0, 0, 0];
 const ORTHOGONAL_VECTOR = [0, 1, 0, 0];
+/** The model the fixtures' embedder is currently configured with. */
+const CURRENT_EMBEDDING_ID = "test-model@4";
+/** The model a persisted anchor was written under before a same-dimension swap. */
+const STALE_EMBEDDING_ID = "older-model@4";
+const ANCHOR_SOURCE_TEXT = "book me a table";
 
 const anchorPayload: AnchorPayload = {
 	anchorEmbedding: ANCHOR_VECTOR,
-	anchorEmbeddingId: "test-model@4",
-	anchorSourceText: "book me a table",
+	anchorEmbeddingId: CURRENT_EMBEDDING_ID,
+	anchorSourceText: ANCHOR_SOURCE_TEXT,
 };
 
 const metadata = (over: Partial<ChunkMetadata>): ChunkMetadata => ({
@@ -113,6 +125,7 @@ const trackingClient = (
 	const labeled: Array<{ messageId: string; labelId: string }> = [];
 	let filterWrites = 0;
 	let filterAnchorWrites = 0;
+	const anchorPuts: CreateFilterAnchorInput[] = [];
 	const activeFilters = seed.activeFilters ?? [];
 	const filterAnchorRows = seed.filterAnchorRows ?? [];
 	const threadMessages = seed.threadMessages ?? {};
@@ -162,9 +175,16 @@ const trackingClient = (
 			refreshExpiry: async (filter: FilterItem) => filter,
 		},
 		filterAnchor: {
-			put: async () => {
+			put: async (input: CreateFilterAnchorInput) => {
 				filterAnchorWrites += 1;
-				return {} as never;
+				anchorPuts.push(input);
+				const row: FilterAnchorItem = { ...input, createdAt: 0, updatedAt: 1 };
+				const at = filterAnchorRows.findIndex(
+					(existing) => existing.filterId === input.filterId,
+				);
+				if (at === -1) filterAnchorRows.push(row);
+				else filterAnchorRows[at] = row;
+				return row;
 			},
 			get: async (_accountConfigId: string, filterId: string) =>
 				filterAnchorRows.find((row) => row.filterId === filterId) ?? null,
@@ -176,6 +196,7 @@ const trackingClient = (
 		labeled,
 		filterWrites: () => filterWrites,
 		filterAnchorWrites: () => filterAnchorWrites,
+		anchorPuts,
 	};
 };
 
@@ -238,10 +259,16 @@ const matchDeps = (
 				vectorStore: store,
 				embed: async (text: string) =>
 					text.includes("reservation") ? ANCHOR_VECTOR : ORTHOGONAL_VECTOR,
+				embeddingId: CURRENT_EMBEDDING_ID,
 			};
 		},
 		listAccountFilterMessages: async () => corpus,
-		filterAnchors: { listByAccountConfig: async () => filterAnchorRows },
+		filterAnchors: {
+			listByAccountConfig: async () => filterAnchorRows,
+			put: async () => {
+				throw new Error("matchDeps must not repair an anchor");
+			},
+		},
 		semanticBuilds: () => semanticBuilds,
 	};
 };
@@ -273,10 +300,16 @@ const vectorlessDeps = (
 				embed: async () => {
 					throw moduleNotFound();
 				},
+				embeddingId: CURRENT_EMBEDDING_ID,
 			};
 		},
 		listAccountFilterMessages: async () => corpus,
-		filterAnchors: { listByAccountConfig: async () => [] },
+		filterAnchors: {
+			listByAccountConfig: async () => [],
+			put: async () => {
+				throw moduleNotFound();
+			},
+		},
 		semanticUsed: () => semanticUsed,
 	};
 };
@@ -391,8 +424,8 @@ describe("matchOrganize honors the persisted FilterAnchor (reader #350)", () =>
 			accountConfigId: ACCOUNT_CONFIG_ID,
 			filterId: "filter-a",
 			anchorEmbedding: ANCHOR_VECTOR,
-			anchorEmbeddingId: "test-model@4",
-			anchorSourceText: "book me a table",
+			anchorEmbeddingId: CURRENT_EMBEDDING_ID,
+			anchorSourceText: ANCHOR_SOURCE_TEXT,
 			anchorMessageId: "msg-anchor",
 			createdAt: 0,
 			updatedAt: 0,
@@ -409,9 +442,15 @@ describe("matchOrganize honors the persisted FilterAnchor (reader #350)", () =>
 				},
 				vectorStore: store,
 				embed: async () => ANCHOR_VECTOR,
+				embeddingId: CURRENT_EMBEDDING_ID,
 			}),
 			listAccountFilterMessages: async () => [],
-			filterAnchors: { listByAccountConfig: async () => [persistedAnchor] },
+			filterAnchors: {
+				listByAccountConfig: async () => [persistedAnchor],
+				put: async () => {
+					throw new Error("a current anchor must not be rewritten");
+				},
+			},
 		};
 
 		const { messageIds } = await matchOrganize(
@@ -542,6 +581,67 @@ describe("matchOrganize on a deployment without the vector pipeline", () => {
 		assert.equal(semanticUnavailable, true);
 	});
 
+	it("keeps widening from a drifted persisted anchor when no embedding model is available", async () => {
+		// Self-host: sqlite-vec is present, `@huggingface/transformers` is not.
+		// The anchor's stamp will never match — after a model swap, or forever
+		// for one pooled from pre-#349 chunks and stamped
+		// UNKNOWN_CHUNK_EMBEDDING_ID — and there is no embedder to repair it
+		// with, so the widen must query with the vector it has rather than go
+		// dark and take every later /search/semantic with it.
+		const store = createMemoryVectorStore();
+		await store.upsert([
+			bodyChunk("msg-1", ANCHOR_VECTOR),
+			bodyChunk("msg-stored-space", ORTHOGONAL_VECTOR),
+		]);
+		const drifted: FilterAnchorItem = {
+			accountConfigId: ACCOUNT_CONFIG_ID,
+			filterId: "filter-a",
+			anchorEmbedding: ORTHOGONAL_VECTOR,
+			anchorEmbeddingId: STALE_EMBEDDING_ID,
+			anchorSourceText: ANCHOR_SOURCE_TEXT,
+			anchorMessageId: "msg-anchor",
+			createdAt: 0,
+			updatedAt: 0,
+		};
+		const deps: OrganizeMatchDeps = {
+			semantic: () => ({
+				buildAnchor: async () => {
+					throw new Error("a persisted anchor must not be re-derived");
+				},
+				vectorStore: store,
+				embed: async () => {
+					throw moduleNotFound();
+				},
+				embeddingId: CURRENT_EMBEDDING_ID,
+			}),
+			listAccountFilterMessages: async () => [],
+			filterAnchors: {
+				listByAccountConfig: async () => [drifted],
+				put: async () => {
+					throw new Error("an unrepairable anchor must not be rewritten");
+				},
+			},
+		};
+
+		const { messageIds, semanticUnavailable } = await matchOrganize(
+			deps,
+			ACCOUNT_CONFIG_ID,
+			predicate(),
+		);
+
+		assert.deepEqual(
+			messageIds,
+			["msg-stored-space"],
+			"the kNN read needs no embedder, so the stored anchor vector still returns real hits",
+		);
+		assert.equal(semanticUnavailable, false);
+		assert.equal(
+			isSemanticSearchUnavailable(),
+			false,
+			"one unrepairable anchor must not disable free-text semantic search for the rest of the process",
+		);
+	});
+
 	it("propagates a genuine (non-capability) semantic failure loudly", async () => {
 		const deps: OrganizeMatchDeps = {
 			semantic: () => ({
@@ -553,9 +653,15 @@ describe("matchOrganize on a deployment without the vector pipeline", () => {
 					getByMessage: async () => [],
 				},
 				embed: async () => [],
+				embeddingId: CURRENT_EMBEDDING_ID,
 			}),
 			listAccountFilterMessages: async () => [],
-			filterAnchors: { listByAccountConfig: async () => [] },
+			filterAnchors: {
+				listByAccountConfig: async () => [],
+				put: async () => {
+					throw new Error("unreachable");
+				},
+			},
 		};
 
 		await assert.rejects(
@@ -885,8 +991,8 @@ describe("applyOrganize resolves move precedence against current Active filters
 			accountConfigId: ACCOUNT_CONFIG_ID,
 			filterId: "filter-newer-semantic",
 			anchorEmbedding: ANCHOR_VECTOR,
-			anchorEmbeddingId: "test-model@4",
-			anchorSourceText: "book me a table",
+			anchorEmbeddingId: CURRENT_EMBEDDING_ID,
+			anchorSourceText: ANCHOR_SOURCE_TEXT,
 			anchorMessageId: "msg-anchor-2",
 			createdAt: 0,
 			updatedAt: 0,
@@ -923,6 +1029,186 @@ describe("applyOrganize resolves move precedence against current Active filters
 	});
 });
 
+/**
+ * A same-dimension embedding-model swap leaves every persisted FilterAnchor
+ * stamped with the old model's id and its vector in the old model's space.
+ * Index-time matching repairs that lazily (RFC 039 Decision 1a); the
+ * back-apply paths must do the same, or they score a current-model vector
+ * against a stale-model anchor and silently disagree with the pipeline they
+ * claim to mirror (reader #399).
+ */
+describe("back-apply repairs a drifted anchor the way index-time matching does (reader #399)", () => {
+	const staleAnchor = (
+		filterId: string,
+		// Written under the previous model: same dimensions, different space, so
+		// nothing but the id stamp distinguishes it from a usable anchor.
+		anchorEmbedding: number[] = ORTHOGONAL_VECTOR,
+	): FilterAnchorItem => ({
+		accountConfigId: ACCOUNT_CONFIG_ID,
+		filterId,
+		anchorEmbedding,
+		anchorEmbeddingId: STALE_EMBEDDING_ID,
+		anchorSourceText: ANCHOR_SOURCE_TEXT,
+		anchorMessageId: "msg-anchor",
+		createdAt: 0,
+		updatedAt: 0,
+	});
+
+	/** Every text embeds into the current model's space. */
+	const currentModelDeps = (
+		store: ReturnType<typeof createMemoryVectorStore>,
+		anchors: FilterAnchorItem[],
+		embed: (text: string) => Promise<number[]> = async () => ANCHOR_VECTOR,
+	): OrganizeMatchDeps & { anchorPuts: CreateFilterAnchorInput[] } => {
+		const anchorPuts: CreateFilterAnchorInput[] = [];
+		return {
+			semantic: () => ({
+				buildAnchor: async () => {
+					throw new Error("a persisted anchor must be repaired, not replaced");
+				},
+				vectorStore: store,
+				embed,
+				embeddingId: CURRENT_EMBEDDING_ID,
+			}),
+			listAccountFilterMessages: async () => [],
+			filterAnchors: {
+				listByAccountConfig: async () => anchors,
+				put: async (input: CreateFilterAnchorInput) => {
+					anchorPuts.push(input);
+					return { ...input, createdAt: 0, updatedAt: 1 };
+				},
+			},
+			anchorPuts,
+		};
+	};
+
+	it("matchSemantic re-embeds a drifted persisted anchor instead of querying with the stale vector", async () => {
+		const store = createMemoryVectorStore();
+		await store.upsert([
+			bodyChunk("msg-1", ANCHOR_VECTOR),
+			bodyChunk("msg-stale-space", ORTHOGONAL_VECTOR),
+		]);
+		const deps = currentModelDeps(store, [staleAnchor("filter-a")]);
+
+		const { messageIds } = await matchOrganize(
+			deps,
+			ACCOUNT_CONFIG_ID,
+			predicate(),
+		);
+
+		assert.deepEqual(
+			messageIds,
+			["msg-1"],
+			"the widen runs on the re-embedded anchor, not the stale-space vector that would have matched msg-stale-space",
+		);
+		assert.deepEqual(
+			deps.anchorPuts.map((put) => [put.filterId, put.anchorEmbeddingId]),
+			[["filter-a", CURRENT_EMBEDDING_ID]],
+			"the repair is written back in place under the current model's id",
+		);
+		assert.deepEqual(deps.anchorPuts[0].anchorEmbedding, ANCHOR_VECTOR);
+		assert.equal(deps.anchorPuts[0].anchorSourceText, ANCHOR_SOURCE_TEXT);
+	});
+
+	it("filterCurrentlyMatches re-embeds a drifted anchor, so the drifted filter still outranks the move", async () => {
+		const store = createMemoryVectorStore();
+		await store.upsert([bodyChunk("msg-1", ANCHOR_VECTOR)]);
+		const p = predicate({
+			actionLabelId: "lbl-1",
+			actionMailboxId: "mbox-old",
+		});
+		const newerSemanticFilter = filterItem({
+			filterId: "filter-newer-semantic",
+			ruleChangedAt: 1_000,
+			actionChangedAt: 1_000,
+			actionMailboxId: "mbox-new",
+			hasAnchor: true,
+		});
+		const drifted = staleAnchor("filter-newer-semantic");
+
+		const { messageIds: matched } = await matchOrganize(
+			matchDeps(store),
+			ACCOUNT_CONFIG_ID,
+			p,
+		);
+		const tracked = trackingClient({
+			activeFilters: [newerSemanticFilter],
+			filterAnchorRows: [drifted],
+			threadMessages: { "msg-1": { subject: "Dinner reservation" } },
+		});
+		const mover = trackingMoveService();
+		const result = await applyOrganize(
+			{
+				client: tracked.client,
+				moveService: mover.moveService,
+				match: currentModelDeps(store, [drifted]),
+			},
+			ACCOUNT_CONFIG_ID,
+			matched,
+			p,
+		);
+
+		assert.equal(result.applied, 1);
+		assert.deepEqual(
+			mover.moves,
+			[],
+			"scored against the re-embedded anchor the newer filter contests the move; against the stale one it would silently lose",
+		);
+		assert.deepEqual(
+			tracked.anchorPuts.map((put) => [put.filterId, put.anchorEmbeddingId]),
+			[["filter-newer-semantic", CURRENT_EMBEDDING_ID]],
+			"the repair is written back in place, not left for the next pass",
+		);
+	});
+
+	it("keeps a failed re-embed isolated to its own filter rather than throwing out of the arbitration", async () => {
+		const store = createMemoryVectorStore();
+		await store.upsert([bodyChunk("msg-1", ANCHOR_VECTOR)]);
+		const p = predicate({ actionMailboxId: "mbox-target" });
+		// The stale vector would score a match, so scoring against it — which is
+		// exactly what this path did before the repair existed — suppresses the
+		// move. A stamp that cannot be honoured is not a match: the filter is
+		// skipped and loudly logged, and the rest of the pass is unaffected.
+		const drifted = staleAnchor("filter-broken-anchor", ANCHOR_VECTOR);
+		const tracked = trackingClient({
+			activeFilters: [
+				filterItem({
+					filterId: "filter-broken-anchor",
+					ruleChangedAt: 1_000,
+					actionChangedAt: 1_000,
+					actionMailboxId: "mbox-elsewhere",
+					hasAnchor: true,
+				}),
+			],
+			filterAnchorRows: [drifted],
+			threadMessages: { "msg-1": { subject: "Dinner reservation" } },
+		});
+		const mover = trackingMoveService();
+
+		const result = await applyOrganize(
+			{
+				client: tracked.client,
+				moveService: mover.moveService,
+				match: currentModelDeps(store, [drifted], async (text) => {
+					if (text === ANCHOR_SOURCE_TEXT) throw new Error("embedder refused");
+					return ANCHOR_VECTOR;
+				}),
+			},
+			ACCOUNT_CONFIG_ID,
+			["msg-1"],
+			p,
+		);
+
+		assert.equal(result.applied, 1);
+		assert.equal(result.failed, 0);
+		assert.deepEqual(
+			mover.moves.map((move) => move.destinationMailboxId),
+			["mbox-target"],
+			"an un-repairable anchor skips its own filter — it neither decides the arbitration on a stale score nor aborts the pass",
+		);
+	});
+});
+
 describe("matchOrganize with ListId and FromDomain clauses", () => {
 	const senderChunk = (
 		messageId: string,

package/src/service/organize.ts

@@ -1,11 +1,15 @@
+import { inspect } from "node:util";
 import type {
+	FilterAnchorItem,
 	FilterItem,
 	IFilterAnchorRepository,
 	OrganizeJobRequestItem,
 } from "@remit/data-ports";
 import { BadRequestError, NotFoundError } from "@remit/data-ports/errors";
 import { FilterClauseField, FilterState } from "@remit/domain-enums";
+import { logger } from "@remit/logger-lambda";
 import {
+	type AnchorEmbedder,
 	buildMatchText,
 	cosineSimilarity,
 	DEFAULT_SEMANTIC_MATCH_THRESHOLD,
@@ -13,6 +17,7 @@ import {
 	literalClausesMatch,
 	NO_ACTION,
 	PlacementMoveService,
+	refreshAnchorForEmbedder,
 	selectMoveWinner,
 } from "@remit/mailbox-service";
 import {
@@ -26,7 +31,10 @@ import {
 	buildVectorStoreFromEnv,
 } from "@remit/search-service/from-env";
 import type { RemitClient } from "./data-client.js";
-import { noteSemanticCapabilityAbsence } from "./semantic-capability.js";
+import {
+	isSemanticCapabilityAbsence,
+	noteSemanticCapabilityAbsence,
+} from "./semantic-capability.js";
 
 /**
  * Hard cap on both the previewed and the applied set. A back-apply is a
@@ -96,6 +104,13 @@ export interface OrganizeSemanticDeps {
 	 * kNN read (see `semantic-capability.ts`).
 	 */
 	embed: (text: string) => Promise<number[]>;
+	/**
+	 * The configured model's `<modelId>@<dimensions>` id, compared against a
+	 * persisted anchor's `anchorEmbeddingId` to catch a same-dimension model
+	 * swap that would otherwise score a current-model vector against a
+	 * stale-model anchor (RFC 039 Decision 1a, reader #399).
+	 */
+	readonly embeddingId: string;
 }
 
 /**
@@ -133,8 +148,10 @@ export interface OrganizeMatchDeps {
 	 * "the standing filter this anchor came from," if one still exists, to
 	 * read its fixed-at-save-time vector instead of re-deriving one from the
 	 * anchor message's current chunks (reader #350 / RFC 039 Decision 1).
+	 * `put` is the write half of the lazy anchor-drift repair
+	 * ({@link refreshAnchorForEmbedder}), never a new standing rule.
 	 */
-	filterAnchors: Pick<IFilterAnchorRepository, "listByAccountConfig">;
+	filterAnchors: Pick<IFilterAnchorRepository, "listByAccountConfig" | "put">;
 }
 
 /** The matched ids plus whether the semantic widen was skipped as unavailable. */
@@ -189,31 +206,67 @@ const filterMessageFromChunks = (
  * rows, read-only, and never touches the vector store. Returns `undefined`
  * when no standing filter was ever anchored on this message (or it has since
  * been deleted), in which case the caller falls back to deriving the anchor
- * live from the message's current chunk vectors, exactly as before.
+ * live from the message's current chunk vectors, exactly as before. The whole
+ * row is returned, not just its payload, so the caller can run the same
+ * anchor-drift repair index-time matching does.
  */
 const findPersistedAnchor = async (
 	filterAnchors: Pick<IFilterAnchorRepository, "listByAccountConfig">,
 	accountConfigId: string,
 	anchorMessageId: string,
-): Promise<AnchorPayload | undefined> => {
-	const anchors = await filterAnchors.listByAccountConfig(accountConfigId);
-	const persisted = anchors.find(
+): Promise<FilterAnchorItem | undefined> =>
+	(await filterAnchors.listByAccountConfig(accountConfigId)).find(
 		(anchor) => anchor.anchorMessageId === anchorMessageId,
 	);
-	if (!persisted) return undefined;
-	return {
-		anchorEmbedding: persisted.anchorEmbedding,
-		anchorEmbeddingId: persisted.anchorEmbeddingId,
-		anchorSourceText: persisted.anchorSourceText,
-	};
-};
+
+/**
+ * The anchor the widen queries with: the persisted row, re-embedded in place
+ * when the embedding model has drifted since it was written. A deployment that
+ * ships no embedding model cannot repair it, and the kNN read itself needs
+ * none, so that case keeps querying with the stored vector rather than going
+ * dark — and is classified without recording the absence, which would
+ * otherwise disable every later `/search/semantic` (see
+ * `semantic-capability.ts`).
+ *
+ * The classifier is wider than a missing embedder: `LocalEmbeddingService`
+ * raises ERR_EMBEDDING_MODEL_UNAVAILABLE for anything that stops the pipeline
+ * loading, a corrupt model file included, and a write failure carrying one of
+ * those codes lands here too. Any of them falls back to the stale vector, so
+ * the fallback is logged — it is the wrong-score condition this repair exists
+ * to close, taken deliberately over returning nothing. Every other failure
+ * propagates.
+ */
+const anchorForWiden = async (
+	deps: OrganizeMatchDeps,
+	semantic: OrganizeSemanticDeps,
+	persisted: FilterAnchorItem,
+): Promise<FilterAnchorItem> =>
+	refreshAnchorForEmbedder(
+		{ anchorRepository: deps.filterAnchors, embedder: semantic },
+		persisted,
+	).catch((error: unknown) => {
+		if (!isSemanticCapabilityAbsence(error)) throw error;
+		logger.warn(
+			{
+				alert: "filter_anchor_repair_unavailable",
+				filterId: persisted.filterId,
+				accountConfigId: persisted.accountConfigId,
+				errorName: (error as { name?: string })?.name,
+				error: inspect(error),
+			},
+			"Cannot re-embed a drifted anchor in this deployment; widening on the stored (previous-model) vector rather than returning nothing",
+		);
+		return persisted;
+	});
 
 /**
  * The semantic (anchor) arm: read the anchor vector — the persisted
  * `FilterAnchor` for a message a standing filter was built from (fixed at
  * save time, unaffected by the anchor message's later deletion or
- * re-chunking), or else pool it fresh from the anchor message's existing
- * chunk vectors, the same as before this filter existed or ever had one.
+ * re-chunking, and re-embedded in place when the embedding model has drifted
+ * since — {@link refreshAnchorForEmbedder}), or else pool it fresh from the
+ * anchor message's existing chunk vectors, the same as before this filter
+ * existed or ever had one.
  * Fan out with a k-NN query gated on the cosine threshold, then refine by
  * literal clauses reconstructed from the same chunk vectors. Every read here
  * goes through the vector store; a deployment without the vector pipeline
@@ -228,13 +281,14 @@ const matchSemantic = async (
 	limit: number,
 ): Promise<string[] | null> => {
 	const semantic = deps.semantic();
-	const anchor =
-		(await findPersistedAnchor(
-			deps.filterAnchors,
-			accountConfigId,
-			predicate.anchorMessageId,
-		)) ??
-		(await semantic.buildAnchor(accountConfigId, predicate.anchorMessageId));
+	const persisted = await findPersistedAnchor(
+		deps.filterAnchors,
+		accountConfigId,
+		predicate.anchorMessageId,
+	);
+	const anchor: AnchorPayload | null = persisted
+		? await anchorForWiden(deps, semantic, persisted)
+		: await semantic.buildAnchor(accountConfigId, predicate.anchorMessageId);
 	if (!anchor) return null;
 	const threshold =
 		predicate.similarityThreshold ?? DEFAULT_SEMANTIC_MATCH_THRESHOLD;
@@ -408,6 +462,7 @@ const buildSemanticFromEnv = (): OrganizeSemanticDeps => {
 			buildMessageAnchor({ store }, { accountConfigId, anchorMessageId }),
 		vectorStore: store,
 		embed: async (text) => (await embedder.embed([text]))[0],
+		embeddingId: embedder.embeddingId,
 	};
 	return cachedSemantic;
 };
@@ -548,14 +603,18 @@ const findFilterMessageForPrecedence = async (
  * Whether one *other* Active filter with a move action currently matches this
  * message — mirrors `FilterPipeline.filterMatches` (mailbox-service
  * filters/pipeline.ts) exactly: literal clauses first, then, for a filter
- * with a semantic anchor, its own persisted `FilterAnchor` compared against
+ * with a semantic anchor, its own persisted `FilterAnchor` — re-embedded in
+ * place through the same {@link refreshAnchorForEmbedder} the pipeline calls
+ * when the model has drifted since the anchor was written — compared against
  * the candidate's embedding. A stale/incompatible anchor on the *other*
  * filter is isolated to that filter (skipped, not thrown) — the same
- * resilience `filterMatches` gives index-time matching, so one bad anchor
- * elsewhere never breaks this back-apply's move.
+ * resilience `filterMatches` gives index-time matching, so one bad anchor,
+ * or one anchor that cannot be re-embedded, never breaks this back-apply's
+ * move.
  */
 const filterCurrentlyMatches = async (
-	filterAnchorService: Pick<IFilterAnchorRepository, "get">,
+	filterAnchorService: Pick<IFilterAnchorRepository, "get" | "put">,
+	embedder: () => AnchorEmbedder,
 	accountConfigId: string,
 	filter: FilterItem,
 	msg: FilterMessage,
@@ -567,21 +626,37 @@ const filterCurrentlyMatches = async (
 	if (!filter.hasAnchor) {
 		return filter.literalClauses.length > 0;
 	}
-	const anchor = await filterAnchorService.get(
+	const stored = await filterAnchorService.get(
 		accountConfigId,
 		filter.filterId,
 	);
-	if (!anchor) return false;
+	if (!stored) return false;
 	const vector = await embed();
 	if (!vector) return false;
-	try {
-		return (
-			cosineSimilarity(vector, anchor.anchorEmbedding) >=
-			DEFAULT_SEMANTIC_MATCH_THRESHOLD
+	const repairAnchor = async (): Promise<FilterAnchorItem> =>
+		refreshAnchorForEmbedder(
+			{ anchorRepository: filterAnchorService, embedder: embedder() },
+			stored,
 		);
-	} catch {
-		return false;
-	}
+	return repairAnchor()
+		.then(
+			(anchor) =>
+				cosineSimilarity(vector, anchor.anchorEmbedding) >=
+				DEFAULT_SEMANTIC_MATCH_THRESHOLD,
+		)
+		.catch((error: unknown) => {
+			logger.error(
+				{
+					alert: "filter_anchor_match_failed",
+					filterId: filter.filterId,
+					accountConfigId,
+					errorName: (error as { name?: string })?.name,
+					error: inspect(error),
+				},
+				"Filter anchor comparison failed during back-apply precedence; skipping this filter, the rest still arbitrate (bad/stale anchor vector or a failed repair, non-fatal)",
+			);
+			return false;
+		});
 };
 
 /**
@@ -634,6 +709,7 @@ const findCurrentMoveWinner = async (
 	for (const filter of movers) {
 		const isMatch = await filterCurrentlyMatches(
 			deps.client.filterAnchor,
+			() => deps.match.semantic(),
 			accountConfigId,
 			filter,
 			msg,

package/src/service/semantic-capability.ts

@@ -20,7 +20,13 @@ import { isSelfHostSqlBackend } from "../data-backend.js";
  * model involved — so it needs only `sqlite-vec`, which the backend image now
  * carries as a musl build (Dockerfile sqlite-vec-musl stage,
  * SQLITE_VEC_EXTENSION_PATH). matchOrganize never consults the memoized flag
- * below; a missing embedder therefore never disables the widen.
+ * below; a missing embedder therefore never disables the widen. The one place
+ * the widen would reach for an embedder is repairing a persisted FilterAnchor
+ * whose model has drifted (organize.ts matchSemantic): with no embedder there
+ * is no repair to be had, so it queries with the stored vector and classifies
+ * the failure through {@link isSemanticCapabilityAbsence}, which deliberately
+ * does not record the absence. Recording it there would take every later
+ * free-text semantic query down on the strength of one filter's stale stamp.
  *
  * The e2e-dev lane runs this backend from source rather than the container, so
  * `@huggingface/transformers` IS present and the local embedder instead tries to
@@ -59,17 +65,25 @@ export const _resetSemanticCapabilityForTest = (): void => {
 
 export const isSemanticSearchUnavailable = (): boolean => semanticUnavailable;
 
+/**
+ * Whether a failure is this deployment simply not carrying the semantic
+ * pipeline — the missing-module/extension shape on a self-host SQL backend.
+ * Records nothing, for the caller that must degrade one operation without
+ * disabling `/search/semantic` process-wide.
+ */
+export const isSemanticCapabilityAbsence = (error: unknown): boolean => {
+	if (!isSelfHostSqlBackend()) return false;
+	const code = (error as { code?: unknown } | null)?.code;
+	return typeof code === "string" && CAPABILITY_ABSENCE_CODES.has(code);
+};
+
 /**
  * Classify a semantic-search failure. Returns true — and remembers the
  * absence — when it is the missing-module/extension shape on a self-host SQL
  * backend; any other error is the caller's to rethrow.
  */
 export const noteSemanticCapabilityAbsence = (error: unknown): boolean => {
-	if (!isSelfHostSqlBackend()) return false;
-	const code = (error as { code?: unknown } | null)?.code;
-	if (typeof code !== "string" || !CAPABILITY_ABSENCE_CODES.has(code)) {
-		return false;
-	}
+	if (!isSemanticCapabilityAbsence(error)) return false;
 	if (!semanticUnavailable) {
 		logger.warn(
 			{ error: error instanceof Error ? error.message : String(error) },