@remit/backend 0.0.79 → 0.0.81

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.79",
+  "version": "0.0.81",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/organize.test.ts

@@ -44,11 +44,11 @@ describe("predicateFromInput (move back-apply accepted)", () => {
 	});
 });
 
-// previewOrganize rejects a body-content (HasWords) clause by throwing
-// BadRequestError (see service/organize.test.ts for the throw site). Proving
-// the 4xx actually reaches the wire — not just that the right class is
-// thrown — means proving the shared error handler maps it, since a plain
-// Error would otherwise fall through to a 500 (reader #457).
+// The matcher returns a body-content (HasWords) refusal as a result (see
+// service/organize.test.ts); previewOrganize is the boundary that words it as a
+// BadRequestError. Proving the 4xx actually reaches the wire — not just that the
+// right class is raised — means proving the shared error handler maps it, since
+// a plain Error would otherwise fall through to a 500 (reader #457).
 describe("previewOrganize rejected-rule response (reader #457)", () => {
 	it("maps a rejected HasWords clause to a 400 naming the reason, not a 500", async () => {
 		const error = new BadRequestError(

package/src/handlers/organize.ts

@@ -5,7 +5,7 @@ import type {
 	OrganizeJobResponse,
 	OrganizePreviewResponse,
 } from "@remit/api-openapi-types";
-import { NotFoundError } from "@remit/data-ports/errors";
+import { BadRequestError, NotFoundError } from "@remit/data-ports/errors";
 import { logger } from "@remit/logger-lambda";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
@@ -157,18 +157,19 @@ export const OrganizeOperations: Record<
 		const client = await getClient();
 		await assertAccount(client, accountId, accountConfigId, "read");
 
-		const { messageIds, semanticUnavailable } = await matchOrganize(
+		const result = await matchOrganize(
 			buildOrganizeMatchDeps(client),
 			accountConfigId,
 			predicateFromInput(input),
 			ORGANIZE_MATCH_LIMIT,
 		);
+		if (result.rejected) throw new BadRequestError(result.rejected.message);
 
 		const response: OrganizePreviewResponse = {
-			matchedCount: messageIds.length,
-			messageIds,
+			matchedCount: result.messageIds.length,
+			messageIds: result.messageIds,
 		};
-		if (semanticUnavailable) response.semanticUnavailable = true;
+		if (result.semanticUnavailable) response.semanticUnavailable = true;
 		return response;
 	},
 };

package/src/handlers/outbox.test.ts

@@ -109,6 +109,15 @@ const createInMemoryOutboxRepository = (): IOutboxMessageRepository => {
 			outboxMessageId: string,
 			status: OutboxMessageItem["status"],
 		) => repository.update(accountConfigId, outboxMessageId, { status }),
+		updateIfStatus: async (
+			accountConfigId: string,
+			outboxMessageId: string,
+			expected: OutboxMessageItem["status"],
+			input: UpdateOutboxMessageInput,
+		) => {
+			if (mustGet(outboxMessageId).status !== expected) return null;
+			return repository.update(accountConfigId, outboxMessageId, input);
+		},
 		markSent: async (
 			accountConfigId: string,
 			outboxMessageId: string,
@@ -453,12 +462,17 @@ describe("a send whose enqueue fails (#845.8)", () => {
 		assert.equal(response.statusCode, 500);
 	});
 
-	it("leaves the row a draft, not stranded at queued", async () => {
+	it("settles the row at failed, not stranded at queued and not back at draft", async () => {
 		const { outboxMessageId } = await draftAgainstQueue(
 			refusingSqsClient().client,
 		);
 
-		assert.equal(await statusOf(outboxMessageId), OutboxMessageStatus.draft);
+		// `queued` is the dead end this suite exists for. `draft` is the other
+		// wrong answer: it is inside the SMTP worker's send fence, and an error
+		// from SQS does not prove the event was refused — one that landed anyway
+		// would send a row the user can still send by hand. `failed` is outside
+		// the fence and, since #933, still editable and sendable.
+		assert.equal(await statusOf(outboxMessageId), OutboxMessageStatus.failed);
 	});
 
 	it("still lets the user discard what could not be queued", async () => {

package/src/service/organize.test.ts

@@ -5,7 +5,7 @@ import type {
 	FilterAnchorItem,
 	FilterItem,
 } from "@remit/data-ports";
-import { BadRequestError, NotFoundError } from "@remit/data-ports/errors";
+import { NotFoundError } from "@remit/data-ports/errors";
 import { FilterMatchOperator, FilterState } from "@remit/domain-enums";
 import type {
 	AnchorPayload,
@@ -16,9 +16,11 @@ import { createMemoryVectorStore } from "@remit/search-service";
 import type { RemitClient } from "./data-client.js";
 import {
 	applyOrganize,
+	BODY_CONTENT_REJECTION_MESSAGE,
 	matchOrganize,
 	type OrganizeCandidate,
 	type OrganizeMatchDeps,
+	type OrganizeMatched,
 	type OrganizePredicate,
 } from "./organize.js";
 import {
@@ -82,6 +84,23 @@ const predicate = (
 	...over,
 });
 
+/**
+ * Run the matcher and assert it accepted the predicate, so every test that only
+ * cares about the matched set reads the accepted arm directly. A rejection is a
+ * result, not a throw (reader #463), so without this the two would be silently
+ * interchangeable at the call site.
+ */
+const matchAccepted = async (
+	...args: Parameters<typeof matchOrganize>
+): Promise<OrganizeMatched> => {
+	const result = await matchOrganize(...args);
+	assert.ok(
+		result.rejected === null,
+		`expected an accepted match, got: ${result.rejected?.message}`,
+	);
+	return result;
+};
+
 /** A standing filter fixture — the "other" filters the precedence check reads. */
 const filterItem = (over: Partial<FilterItem> = {}): FilterItem => ({
 	filterId: "filter-other",
@@ -338,7 +357,7 @@ describe("matchOrganize", () => {
 			bodyChunk("msg-miss", ORTHOGONAL_VECTOR),
 		]);
 
-		const { messageIds, semanticUnavailable } = await matchOrganize(
+		const { messageIds, semanticUnavailable } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			predicate({ actionLabelId: "lbl-1" }),
@@ -352,7 +371,7 @@ describe("matchOrganize", () => {
 		const store = createMemoryVectorStore();
 		await store.upsert([bodyChunk("msg-1", ANCHOR_VECTOR)]);
 
-		const { messageIds } = await matchOrganize(
+		const { messageIds } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			{
@@ -377,7 +396,7 @@ describe("matchOrganize", () => {
 			}),
 		]);
 
-		const { messageIds } = await matchOrganize(
+		const { messageIds } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			{
@@ -396,7 +415,7 @@ describe("matchOrganize", () => {
 			candidate("msg-2", { subject: "Newsletter" }),
 		]);
 
-		const { messageIds } = await matchOrganize(deps, ACCOUNT_CONFIG_ID, {
+		const { messageIds } = await matchAccepted(deps, ACCOUNT_CONFIG_ID, {
 			...predicate(),
 			anchorMessageId: "None",
 			literalClauses: [{ field: "Subject", value: "reservation" }],
@@ -453,7 +472,7 @@ describe("matchOrganize honors the persisted FilterAnchor (reader #350)", () =>
 			},
 		};
 
-		const { messageIds } = await matchOrganize(
+		const { messageIds } = await matchAccepted(
 			deps,
 			ACCOUNT_CONFIG_ID,
 			predicate(),
@@ -478,7 +497,7 @@ describe("matchOrganize honors the persisted FilterAnchor (reader #350)", () =>
 		// No persisted FilterAnchor names this anchorMessageId — an ad hoc "all
 		// like these" widen over a bare message selection, never tied to a
 		// standing filter.
-		const { messageIds } = await matchOrganize(
+		const { messageIds } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			predicate(),
@@ -507,7 +526,7 @@ describe("matchOrganize on a deployment without the vector pipeline", () => {
 			candidate("msg-3", { subject: "Table reservation confirmed" }),
 		]);
 
-		const { messageIds, semanticUnavailable } = await matchOrganize(
+		const { messageIds, semanticUnavailable } = await matchAccepted(
 			deps,
 			ACCOUNT_CONFIG_ID,
 			{
@@ -526,36 +545,51 @@ describe("matchOrganize on a deployment without the vector pipeline", () => {
 		);
 	});
 
-	it("rejects a body-content (HasWords) clause as a 400 rather than matching it against a preview", async () => {
+	it("refuses a body-content (HasWords) clause as a result rather than matching it against a preview", async () => {
 		const deps = vectorlessDeps([
 			candidate("msg-1", { subject: "Dinner reservation" }),
 		]);
 
-		await assert.rejects(
-			() =>
-				matchOrganize(deps, ACCOUNT_CONFIG_ID, {
-					...predicate(),
-					anchorMessageId: "None",
-					literalClauses: [{ field: "HasWords", value: "invoice" }],
-				}),
-			(error: unknown) => {
-				assert.ok(error instanceof BadRequestError);
-				assert.equal(error.statusCode, 400);
-				assert.match(error.message, /HasWords/);
-				return true;
+		const result = await matchOrganize(deps, ACCOUNT_CONFIG_ID, {
+			...predicate(),
+			anchorMessageId: "None",
+			literalClauses: [{ field: "HasWords", value: "invoice" }],
+		});
+
+		assert.deepEqual(
+			result.rejected,
+			{
+				reason: "BodyContentWithoutVectorPipeline",
+				message: BODY_CONTENT_REJECTION_MESSAGE,
 			},
 			"the vector-free literal path must not silently narrow a body match to a preview",
 		);
 		assert.equal(deps.semanticUsed(), false);
 	});
 
+	// The refusal is the same whichever way the vector-free path is reached, so
+	// an anchored predicate that degrades onto it cannot land in the corpus scan
+	// with a body clause it can only mis-evaluate (reader #463).
+	it("refuses a body-content clause reached through the degraded widen fallback", async () => {
+		const deps = vectorlessDeps([
+			candidate("msg-1", { subject: "Dinner reservation" }),
+		]);
+
+		const result = await matchOrganize(deps, ACCOUNT_CONFIG_ID, {
+			...predicate(),
+			literalClauses: [{ field: "HasWords", value: "invoice" }],
+		});
+
+		assert.equal(result.rejected?.reason, "BodyContentWithoutVectorPipeline");
+	});
+
 	it("degrades an anchor+clauses widen to the literal matches, flagged, instead of crashing", async () => {
 		const deps = vectorlessDeps([
 			candidate("msg-1", { subject: "Dinner reservation" }),
 			candidate("msg-2", { subject: "Weekly newsletter" }),
 		]);
 
-		const { messageIds, semanticUnavailable } = await matchOrganize(
+		const { messageIds, semanticUnavailable } = await matchAccepted(
 			deps,
 			ACCOUNT_CONFIG_ID,
 			{
@@ -571,7 +605,7 @@ describe("matchOrganize on a deployment without the vector pipeline", () => {
 	it("degrades an anchor-only widen to an empty flagged result instead of crashing", async () => {
 		const deps = vectorlessDeps([candidate("msg-1"), candidate("msg-2")]);
 
-		const { messageIds, semanticUnavailable } = await matchOrganize(
+		const { messageIds, semanticUnavailable } = await matchAccepted(
 			deps,
 			ACCOUNT_CONFIG_ID,
 			predicate(),
@@ -623,7 +657,7 @@ describe("matchOrganize on a deployment without the vector pipeline", () => {
 			},
 		};
 
-		const { messageIds, semanticUnavailable } = await matchOrganize(
+		const { messageIds, semanticUnavailable } = await matchAccepted(
 			deps,
 			ACCOUNT_CONFIG_ID,
 			predicate(),
@@ -684,12 +718,12 @@ describe("back-apply pipeline (matchOrganize -> applyOrganize)", () => {
 
 		// The preview and the apply share the same matcher — the previewed set is
 		// exactly what gets applied.
-		const previewed = await matchOrganize(
+		const previewed = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			p,
 		);
-		const applied = await matchOrganize(matchDeps(store), ACCOUNT_CONFIG_ID, p);
+		const applied = await matchAccepted(matchDeps(store), ACCOUNT_CONFIG_ID, p);
 		assert.deepEqual(previewed, applied);
 
 		const tracked = trackingClient();
@@ -723,7 +757,7 @@ describe("back-apply pipeline (matchOrganize -> applyOrganize)", () => {
 		await store.upsert([bodyChunk("msg-1", ANCHOR_VECTOR)]);
 		const p = predicate({ actionMailboxId: "mbox-target" });
 
-		const { messageIds: matched } = await matchOrganize(
+		const { messageIds: matched } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			p,
@@ -749,7 +783,7 @@ describe("back-apply pipeline (matchOrganize -> applyOrganize)", () => {
 		]);
 		const p = predicate({ actionMailboxId: "mbox-target" });
 
-		const { messageIds: matched } = await matchOrganize(
+		const { messageIds: matched } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			p,
@@ -799,7 +833,7 @@ describe("back-apply pipeline (matchOrganize -> applyOrganize)", () => {
 			actionMailboxId: "mbox-target",
 		});
 
-		const { messageIds: matched } = await matchOrganize(
+		const { messageIds: matched } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			p,
@@ -834,7 +868,7 @@ describe("back-apply pipeline (matchOrganize -> applyOrganize)", () => {
 		await store.upsert(matching.map((id) => bodyChunk(id, ANCHOR_VECTOR)));
 		const p = predicate({ actionMailboxId: "mbox-target" });
 
-		const { messageIds: matched } = await matchOrganize(
+		const { messageIds: matched } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			p,
@@ -897,7 +931,7 @@ describe("applyOrganize resolves move precedence against current Active filters
 			literalClauses: [{ field: "Subject", value: "reservation" }],
 		});
 
-		const { messageIds: matched } = await matchOrganize(
+		const { messageIds: matched } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			p,
@@ -946,7 +980,7 @@ describe("applyOrganize resolves move precedence against current Active filters
 			literalClauses: [{ field: "Subject", value: "reservation" }],
 		});
 
-		const { messageIds: matched } = await matchOrganize(
+		const { messageIds: matched } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			p,
@@ -998,7 +1032,7 @@ describe("applyOrganize resolves move precedence against current Active filters
 			updatedAt: 0,
 		};
 
-		const { messageIds: matched } = await matchOrganize(
+		const { messageIds: matched } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			p,
@@ -1090,7 +1124,7 @@ describe("back-apply repairs a drifted anchor the way index-time matching does (
 		]);
 		const deps = currentModelDeps(store, [staleAnchor("filter-a")]);
 
-		const { messageIds } = await matchOrganize(
+		const { messageIds } = await matchAccepted(
 			deps,
 			ACCOUNT_CONFIG_ID,
 			predicate(),
@@ -1126,7 +1160,7 @@ describe("back-apply repairs a drifted anchor the way index-time matching does (
 		});
 		const drifted = staleAnchor("filter-newer-semantic");
 
-		const { messageIds: matched } = await matchOrganize(
+		const { messageIds: matched } = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			p,
@@ -1232,7 +1266,7 @@ describe("matchOrganize with ListId and FromDomain clauses", () => {
 			candidate("msg-3", {}),
 		]);
 
-		const { messageIds } = await matchOrganize(deps, ACCOUNT_CONFIG_ID, {
+		const { messageIds } = await matchAccepted(deps, ACCOUNT_CONFIG_ID, {
 			...predicate(),
 			anchorMessageId: "None",
 			literalClauses: [{ field: "ListId", value: "weekly.news.example.com" }],
@@ -1248,7 +1282,7 @@ describe("matchOrganize with ListId and FromDomain clauses", () => {
 			candidate("msg-3", { from: "attacker@github.com.evil.example" }),
 		]);
 
-		const { messageIds } = await matchOrganize(deps, ACCOUNT_CONFIG_ID, {
+		const { messageIds } = await matchAccepted(deps, ACCOUNT_CONFIG_ID, {
 			...predicate(),
 			anchorMessageId: "None",
 			literalClauses: [{ field: "FromDomain", value: "github.com" }],
@@ -1270,13 +1304,13 @@ describe("matchOrganize with ListId and FromDomain clauses", () => {
 			bodyChunk("msg-2", ANCHOR_VECTOR, { listId: "other.list.example" }),
 		]);
 
-		const byListId = await matchOrganize(matchDeps(store), ACCOUNT_CONFIG_ID, {
+		const byListId = await matchAccepted(matchDeps(store), ACCOUNT_CONFIG_ID, {
 			...predicate(),
 			literalClauses: [{ field: "ListId", value: "actions.github.com" }],
 		});
 		assert.deepEqual(byListId.messageIds, ["msg-1"]);
 
-		const byFromDomain = await matchOrganize(
+		const byFromDomain = await matchAccepted(
 			matchDeps(store),
 			ACCOUNT_CONFIG_ID,
 			{
@@ -1299,8 +1333,8 @@ describe("matchOrganize with ListId and FromDomain clauses", () => {
 			literalClauses: [{ field: "ListId", value: "weekly.news.example.com" }],
 		});
 
-		const previewed = await matchOrganize(deps, ACCOUNT_CONFIG_ID, p);
-		const applied = await matchOrganize(deps, ACCOUNT_CONFIG_ID, p);
+		const previewed = await matchAccepted(deps, ACCOUNT_CONFIG_ID, p);
+		const applied = await matchAccepted(deps, ACCOUNT_CONFIG_ID, p);
 		assert.deepEqual(previewed, applied);
 		assert.deepEqual(previewed.messageIds, ["msg-1", "msg-2"]);
 

package/src/service/organize.ts

@@ -5,7 +5,7 @@ import type {
 	IFilterAnchorRepository,
 	OrganizeJobRequestItem,
 } from "@remit/data-ports";
-import { BadRequestError, NotFoundError } from "@remit/data-ports/errors";
+import { NotFoundError } from "@remit/data-ports/errors";
 import { FilterClauseField, FilterState } from "@remit/domain-enums";
 import { logger } from "@remit/logger-lambda";
 import {
@@ -154,12 +154,32 @@ export interface OrganizeMatchDeps {
 	filterAnchors: Pick<IFilterAnchorRepository, "listByAccountConfig" | "put">;
 }
 
+/**
+ * Why the matcher refused a predicate. A refusal is an expected outcome of
+ * asking for a rule this deployment cannot evaluate, not a fault: the HTTP
+ * boundary words it as a 400 and the back-apply worker fails the job row on it,
+ * neither of which may treat it as the infrastructure failure a throw would
+ * make it (reader #463).
+ */
+export interface OrganizeRejection {
+	reason: "BodyContentWithoutVectorPipeline";
+	message: string;
+}
+
 /** The matched ids plus whether the semantic widen was skipped as unavailable. */
-export interface OrganizeMatchResult {
+export interface OrganizeMatched {
+	rejected: null;
 	messageIds: string[];
 	semanticUnavailable: boolean;
 }
 
+/** The predicate was refused: nothing matched, and nothing may be applied. */
+export interface OrganizeMatchRejected {
+	rejected: OrganizeRejection;
+}
+
+export type OrganizeMatchResult = OrganizeMatched | OrganizeMatchRejected;
+
 const hasAnchor = (predicate: OrganizePredicate): boolean =>
 	predicate.anchorMessageId !== NO_ACTION && predicate.anchorMessageId !== "";
 
@@ -334,18 +354,21 @@ const matchSemantic = async (
  * happened to be indexed. Body-content matching therefore requires the widen
  * (vector) path — {@link matchSemantic} reconstructs body text from chunk
  * previews there. This guard keeps the two matchers from diverging silently: a
- * body-content clause reaching the vector-free path is rejected instead of
+ * body-content clause reaching the vector-free path is refused instead of
  * returning a wrong set.
  */
-const assertNoBodyContentClause = (
+export const BODY_CONTENT_REJECTION_MESSAGE =
+	"Organize literal matching cannot evaluate a body-content (HasWords) clause without the vector pipeline — it requires the semantic widen path";
+
+const bodyContentRejection = (
 	clauses: OrganizePredicate["literalClauses"],
-): void => {
-	if (clauses.some((clause) => clause.field === FilterClauseField.HasWords)) {
-		throw new BadRequestError(
-			"Organize literal matching cannot evaluate a body-content (HasWords) clause without the vector pipeline — it requires the semantic widen path",
-		);
-	}
-};
+): OrganizeRejection | null =>
+	clauses.some((clause) => clause.field === FilterClauseField.HasWords)
+		? {
+				reason: "BodyContentWithoutVectorPipeline",
+				message: BODY_CONTENT_REJECTION_MESSAGE,
+			}
+		: null;
 
 /**
  * The literal-only arm: scan a bounded, vector-free slice of the corpus and keep
@@ -353,7 +376,7 @@ const assertNoBodyContentClause = (
  * predicate and as the degraded fallback when a widen is requested on a
  * deployment without the vector pipeline. Serves `From`/`Subject` clauses at
  * full fidelity from the core thread rows; body-content (`HasWords`) clauses are
- * rejected up front (see {@link assertNoBodyContentClause}).
+ * refused before this runs (see {@link bodyContentRejection}).
  */
 const matchLiteral = async (
 	deps: OrganizeMatchDeps,
@@ -362,7 +385,6 @@ const matchLiteral = async (
 	limit: number,
 ): Promise<string[]> => {
 	const clauses = predicate.literalClauses;
-	assertNoBodyContentClause(clauses);
 	const candidates = await deps.listAccountFilterMessages(
 		accountConfigId,
 		limit,
@@ -395,6 +417,9 @@ const matchLiteral = async (
  *   capability-absence is absorbed exactly as `/search/semantic` absorbs it:
  *   the literal matches are returned (empty for an anchor-only predicate) with
  *   `semanticUnavailable` set, never a 500. Any other failure propagates.
+ * - A predicate the vector-free path cannot evaluate (a body-content clause,
+ *   see {@link bodyContentRejection}) comes back as a rejection, so a caller
+ *   can tell a refused rule from a broken deployment (reader #463).
  */
 export const matchOrganize = async (
 	deps: OrganizeMatchDeps,
@@ -405,17 +430,19 @@ export const matchOrganize = async (
 	const anchored = hasAnchor(predicate);
 	const clauses = predicate.literalClauses;
 	if (!anchored && clauses.length === 0) {
-		return { messageIds: [], semanticUnavailable: false };
+		return { rejected: null, messageIds: [], semanticUnavailable: false };
 	}
 
 	if (!anchored) {
+		const rejection = bodyContentRejection(clauses);
+		if (rejection) return { rejected: rejection };
 		const messageIds = await matchLiteral(
 			deps,
 			accountConfigId,
 			predicate,
 			limit,
 		);
-		return { messageIds, semanticUnavailable: false };
+		return { rejected: null, messageIds, semanticUnavailable: false };
 	}
 
 	try {
@@ -425,22 +452,28 @@ export const matchOrganize = async (
 			predicate,
 			limit,
 		);
-		return { messageIds: semanticIds ?? [], semanticUnavailable: false };
+		return {
+			rejected: null,
+			messageIds: semanticIds ?? [],
+			semanticUnavailable: false,
+		};
 	} catch (error) {
 		if (!noteSemanticCapabilityAbsence(error)) throw error;
 		// The widen cannot run on this deployment. Fall back to the literal
 		// clauses over the corpus — nothing when the predicate is anchor-only —
 		// and flag the absence so the client can say so.
 		if (clauses.length === 0) {
-			return { messageIds: [], semanticUnavailable: true };
+			return { rejected: null, messageIds: [], semanticUnavailable: true };
 		}
+		const rejection = bodyContentRejection(clauses);
+		if (rejection) return { rejected: rejection };
 		const messageIds = await matchLiteral(
 			deps,
 			accountConfigId,
 			predicate,
 			limit,
 		);
-		return { messageIds, semanticUnavailable: true };
+		return { rejected: null, messageIds, semanticUnavailable: true };
 	}
 };
 
@@ -480,7 +513,7 @@ const buildSemanticFromEnv = (): OrganizeSemanticDeps => {
  * only a truncated `snippet`, and matching
  * a body-content clause against a preview would silently diverge from the live
  * index-time filter's full-body match. Body-content (`HasWords`) clauses are
- * rejected before this is read (see {@link assertNoBodyContentClause}), so the
+ * rejected before this is read (see {@link bodyContentRejection}), so the
  * empty `text` is never matched against.
  */
 const listAccountFilterMessagesFromClient =