@remit/drizzle-service 0.0.64 → 0.0.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/drizzle-service",
-  "version": "0.0.64",
+  "version": "0.0.65",
   "description": "Drizzle ORM service over SQLite",
   "type": "module",
   "main": "src/index.ts",

package/src/repair/junk-only-address.sqlite.test.ts

@@ -1,10 +1,17 @@
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import { after, before, beforeEach, describe, test } from "node:test";
+import { composeFolderRoleAppointmentName } from "@remit/data-ports/folder-role";
+import { CanonicalMailboxRole } from "@remit/domain-enums";
 import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { AccountSettingRepo } from "../repos/i4-account-setting.js";
+import { MailboxSpecialUseRepo } from "../repos/i4-mailbox-special-use.js";
 import { shippedTableDdl } from "../test-shipped-sqlite-schema.js";
 import {
 	type JunkOnlyRepairClient,
+	type JunkOnlyRepairMode,
+	type JunkOnlyReport,
 	sweepJunkOnlyAddresses,
 } from "./junk-only-address.js";
 
@@ -22,8 +29,47 @@ interface AddressRow {
 
 describe("addresses standing only on mail in Junk", () => {
 	let sqlite: Database.Database;
+	let specialUse: MailboxSpecialUseRepo;
+	let accountSetting: AccountSettingRepo;
+
+	/**
+	 * Which folder holds Junk is resolved through the repository seam every
+	 * other special-folder lookup reads, so the sweep honours an appointment and
+	 * cannot disagree with the sync that harvested the address.
+	 */
+	const sweep = async (
+		mode: JunkOnlyRepairMode = "repair",
+	): Promise<JunkOnlyReport> =>
+		sweepJunkOnlyAddresses(
+			clientOver(sqlite),
+			mode,
+			await specialUse.resolveJunkRolesForInstance(),
+		);
 
-	const mailbox = (mailboxId: string, specialUse: string | null): void => {
+	const account = (accountId: string): void => {
+		sqlite
+			.prepare(
+				`INSERT OR IGNORE INTO account (
+					account_id, account_config_id, username, email, imap_host,
+					imap_port, imap_tls, imap_start_tls, smtp_port, is_active,
+					connection_state, created_at, updated_at
+				) VALUES (?, 'cfg-1', 'user', 'user@example.com', 'imap.example.com',
+					993, 1, 0, 465, 1, 'disconnected', 0, 0)`,
+			)
+			.run(accountId);
+	};
+
+	const mailbox = (
+		mailboxId: string,
+		designation: string | null,
+		folder: {
+			accountId?: string;
+			fullPath?: string;
+			hierarchyDelimiter?: string;
+		} = {},
+	): void => {
+		const accountId = folder.accountId ?? "acc";
+		account(accountId);
 		sqlite
 			.prepare(
 				`INSERT INTO mailbox (
@@ -32,9 +78,29 @@ describe("addresses standing only on mail in Junk", () => {
 					unseen_count, deleted_count, total_size, last_sync_uid,
 					high_water_mark_uid, last_message_sync_at, special_use,
 					created_at, updated_at
-				) VALUES (?, 'acc', '', '/', ?, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, ?, 0, 0)`,
+				) VALUES (?, ?, '', ?, ?, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, ?, 0, 0)`,
 			)
-			.run(mailboxId, mailboxId, specialUse);
+			.run(
+				mailboxId,
+				accountId,
+				folder.hierarchyDelimiter ?? "/",
+				folder.fullPath ?? mailboxId,
+				designation,
+			);
+	};
+
+	const appointJunk = async (
+		accountId: string,
+		mailboxId: string,
+	): Promise<void> => {
+		await accountSetting.upsert({
+			accountConfigId: "cfg-1",
+			name: composeFolderRoleAppointmentName(
+				accountId,
+				CanonicalMailboxRole.Junk,
+			),
+			value: { kind: "String", value: mailboxId },
+		});
 	};
 
 	const specialUseEntry = (mailboxId: string, specialUse: string): void => {
@@ -117,12 +183,17 @@ describe("addresses standing only on mail in Junk", () => {
 
 	before(() => {
 		sqlite = new Database(":memory:");
+		const db = drizzle(sqlite);
+		specialUse = new MailboxSpecialUseRepo(db as never);
+		accountSetting = new AccountSettingRepo(db as never);
 		for (const table of [
 			"address",
 			"envelope_address",
 			"message",
 			"mailbox",
 			"mailbox_special_use_entry",
+			"account_setting",
+			"account",
 		]) {
 			sqlite.exec(shippedTableDdl(DDL_TAG, table));
 		}
@@ -148,6 +219,8 @@ describe("addresses standing only on mail in Junk", () => {
 			"message",
 			"mailbox",
 			"mailbox_special_use_entry",
+			"account_setting",
+			"account",
 		]) {
 			sqlite.exec(`DELETE FROM ${table}`);
 		}
@@ -167,7 +240,7 @@ describe("addresses standing only on mail in Junk", () => {
 		sighting("spammer", "spam-1");
 		sighting("spammer", "spam-2");
 
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		const report = await sweep();
 
 		assert.equal(report.withholdable, 1);
 		assert.equal(report.withheld, 1);
@@ -181,7 +254,7 @@ describe("addresses standing only on mail in Junk", () => {
 		sighting("colleague", "spam-1");
 		sighting("colleague", "mail-1");
 
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		const report = await sweep();
 
 		assert.equal(report.withholdable, 0);
 		assert.equal(withheld("colleague"), false);
@@ -194,7 +267,7 @@ describe("addresses standing only on mail in Junk", () => {
 			.prepare("UPDATE message SET mailbox_id = 'junk' WHERE message_id = ?")
 			.run("mail-1");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("newsletter"), true);
 	});
@@ -202,13 +275,13 @@ describe("addresses standing only on mail in Junk", () => {
 	test("restores an address whose message moved out of Junk", async () => {
 		address("misfiled");
 		sighting("misfiled", "spam-1");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 		assert.equal(withheld("misfiled"), true);
 
 		sqlite
 			.prepare("UPDATE message SET mailbox_id = 'inbox' WHERE message_id = ?")
 			.run("spam-1");
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		const report = await sweep();
 
 		assert.equal(report.restorable, 1);
 		assert.equal(report.restored, 1);
@@ -219,7 +292,7 @@ describe("addresses standing only on mail in Junk", () => {
 		address("client", { outbound: 1 });
 		sighting("client", "spam-1");
 
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		const report = await sweep();
 
 		assert.equal(report.withholdable, 0);
 		assert.equal(withheld("client"), false);
@@ -229,7 +302,7 @@ describe("addresses standing only on mail in Junk", () => {
 		address("friend", { reply: 2 });
 		sighting("friend", "spam-1");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("friend"), false);
 	});
@@ -238,7 +311,7 @@ describe("addresses standing only on mail in Junk", () => {
 		address("boss", {}, '{"vip":{"value":true,"setAt":1}}');
 		sighting("boss", "spam-1");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("boss"), false);
 	});
@@ -247,13 +320,13 @@ describe("addresses standing only on mail in Junk", () => {
 		address("reformed", {}, '{"junkOnly":{"value":true,"setAt":1}}');
 		sighting("reformed", "spam-1");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 		assert.equal(withheld("reformed"), true);
 
 		sqlite
 			.prepare("UPDATE address SET outbound_count = 1 WHERE address_id = ?")
 			.run("reformed");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("reformed"), false);
 	});
@@ -262,7 +335,7 @@ describe("addresses standing only on mail in Junk", () => {
 		address("ex-colleague");
 		sighting("ex-colleague", "bin-1");
 
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		const report = await sweep();
 
 		assert.equal(report.withholdable, 0);
 		assert.equal(withheld("ex-colleague"), false);
@@ -273,7 +346,7 @@ describe("addresses standing only on mail in Junk", () => {
 		sighting("spammer", "spam-1");
 		sighting("spammer", "bin-1");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("spammer"), true);
 	});
@@ -282,14 +355,14 @@ describe("addresses standing only on mail in Junk", () => {
 		address("junk-then-bin");
 		address("bin-then-junk");
 		sighting("junk-then-bin", "spam-1");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 		sighting("junk-then-bin", "bin-1");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		sighting("bin-then-junk", "bin-1");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 		sighting("bin-then-junk", "spam-1");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("junk-then-bin"), true);
 		assert.equal(withheld("bin-then-junk"), true);
@@ -299,12 +372,12 @@ describe("addresses standing only on mail in Junk", () => {
 		address("spammer");
 		sighting("spammer", "spam-1");
 		sighting("spammer", "bin-1");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		sqlite
 			.prepare("UPDATE address SET flags = '{}' WHERE address_id = ?")
 			.run("spammer");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("spammer"), true);
 	});
@@ -312,12 +385,12 @@ describe("addresses standing only on mail in Junk", () => {
 	test("deleting every spam message leaves the mark standing", async () => {
 		address("spammer");
 		sighting("spammer", "spam-1");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		sqlite
 			.prepare("UPDATE message SET mailbox_id = 'trash' WHERE message_id = ?")
 			.run("spam-1");
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		const report = await sweep();
 
 		assert.equal(report.restorable, 0);
 		assert.equal(withheld("spammer"), true);
@@ -326,12 +399,12 @@ describe("addresses standing only on mail in Junk", () => {
 	test("deleting the spam does not put its sender back", async () => {
 		address("spammer");
 		sighting("spammer", "spam-1");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		sqlite
 			.prepare("UPDATE message SET mailbox_id = 'trash' WHERE message_id = ?")
 			.run("spam-1");
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		const report = await sweep();
 
 		assert.equal(report.restorable, 0);
 		assert.equal(withheld("spammer"), true);
@@ -340,10 +413,10 @@ describe("addresses standing only on mail in Junk", () => {
 	test("purging the spam does not put its sender back", async () => {
 		address("spammer");
 		sighting("spammer", "spam-1");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		sqlite.prepare("DELETE FROM message WHERE message_id = ?").run("spam-1");
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		const report = await sweep();
 
 		assert.equal(report.restorable, 0);
 		assert.equal(withheld("spammer"), true);
@@ -355,7 +428,7 @@ describe("addresses standing only on mail in Junk", () => {
 		sighting("reported", "spam-1");
 		sighting("hushed", "spam-1");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("reported"), true);
 		assert.equal(withheld("hushed"), true);
@@ -364,7 +437,7 @@ describe("addresses standing only on mail in Junk", () => {
 	test("blocking a withheld sender never lifts the mark", async () => {
 		address("spammer");
 		sighting("spammer", "spam-1");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		sqlite
 			.prepare(
@@ -373,96 +446,172 @@ describe("addresses standing only on mail in Junk", () => {
 				 WHERE address_id = ?`,
 			)
 			.run("spammer");
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		const report = await sweep();
 
 		assert.equal(report.restorable, 0);
 		assert.equal(withheld("spammer"), true);
 	});
 
 	test("reads a Junk folder a server does not designate", async () => {
-		mailbox("named-spam", null);
+		mailbox("named-spam", null, { accountId: "acc-named", fullPath: "Spam" });
 		message("spam-5", "named-spam");
 		address("by-name");
 		sighting("by-name", "spam-5");
-		sqlite
-			.prepare("UPDATE mailbox SET full_path = 'Spam' WHERE mailbox_id = ?")
-			.run("named-spam");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("by-name"), true);
 	});
 
 	test("reads a Junk folder nested under any prefix", async () => {
-		mailbox("nested-spam", null);
+		mailbox("nested-spam", null, {
+			accountId: "acc-nested",
+			fullPath: "INBOX/Spam",
+		});
 		message("spam-6", "nested-spam");
 		address("nested");
 		sighting("nested", "spam-6");
-		sqlite
-			.prepare(
-				"UPDATE mailbox SET full_path = 'INBOX/Spam' WHERE mailbox_id = ?",
-			)
-			.run("nested-spam");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("nested"), true);
 	});
 
 	test("reads a Junk folder under a delimiter that is not a slash", async () => {
-		mailbox("dotted-spam", null);
+		mailbox("dotted-spam", null, {
+			accountId: "acc-dotted",
+			fullPath: "Mail.Junk E-mail",
+			hierarchyDelimiter: ".",
+		});
 		message("spam-7", "dotted-spam");
 		address("dotted");
 		sighting("dotted", "spam-7");
-		sqlite
-			.prepare(
-				`UPDATE mailbox SET full_path = 'Mail.Junk E-mail',
-					hierarchy_delimiter = '.' WHERE mailbox_id = ?`,
-			)
-			.run("dotted-spam");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("dotted"), true);
 	});
 
 	test("never reads a prefix as the folder it names", async () => {
-		mailbox("spam-parent", null);
+		mailbox("spam-parent", null, {
+			accountId: "acc-parent",
+			fullPath: "Spam/Receipts",
+		});
 		message("mail-2", "spam-parent");
 		address("under-spam");
 		sighting("under-spam", "mail-2");
-		sqlite
-			.prepare(
-				"UPDATE mailbox SET full_path = 'Spam/Receipts' WHERE mailbox_id = ?",
-			)
-			.run("spam-parent");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("under-spam"), false);
 	});
 
-	test("reads the designation from either place it is stored", async () => {
-		mailbox("column-only", '["Junk"]');
-		mailbox("entry-only", null);
+	test("reads the designation the mailbox sync stored", async () => {
+		mailbox("entry-only", null, {
+			accountId: "acc-entry",
+			fullPath: "Bulk",
+		});
 		specialUseEntry("entry-only", "Junk");
-		message("spam-3", "column-only");
 		message("spam-4", "entry-only");
-		address("by-column");
 		address("by-entry");
-		sighting("by-column", "spam-3");
 		sighting("by-entry", "spam-4");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
-		assert.equal(withheld("by-column"), true);
 		assert.equal(withheld("by-entry"), true);
 	});
 
+	test("a second folder named Spam never claims the role", async () => {
+		mailbox("second-spam", null, { fullPath: "Archive/Spam" });
+		message("spam-3", "second-spam");
+		address("filed-away");
+		sighting("filed-away", "spam-3");
+
+		await sweep();
+
+		assert.equal(withheld("filed-away"), false);
+	});
+
+	test("withholds on the Junk folder the account appointed", async () => {
+		mailbox("rubbish", null, {
+			accountId: "acc-appointed",
+			fullPath: "INBOX/Rubbish",
+		});
+		await appointJunk("acc-appointed", "rubbish");
+		message("spam-8", "rubbish");
+		address("appointed-spammer");
+		sighting("appointed-spammer", "spam-8");
+
+		await sweep();
+
+		assert.equal(withheld("appointed-spammer"), true);
+	});
+
+	test("leaves the same folder alone when nobody appointed it", async () => {
+		mailbox("unclaimed-rubbish", null, {
+			accountId: "acc-unappointed",
+			fullPath: "INBOX/Rubbish",
+		});
+		message("spam-9", "unclaimed-rubbish");
+		address("stranger");
+		sighting("stranger", "spam-9");
+
+		await sweep();
+
+		assert.equal(withheld("stranger"), false);
+	});
+
+	/**
+	 * No folder holds Junk anywhere, so nothing is known about any sighting. The
+	 * predicate must be silent in both directions: an empty id list read as "no
+	 * message is in Junk" would make every sighting live mail and hand back
+	 * every mark the instance had earned.
+	 */
+	test("an instance with no Junk folder neither withholds nor restores", async () => {
+		for (const table of [
+			"envelope_address",
+			"message",
+			"mailbox",
+			"mailbox_special_use_entry",
+		]) {
+			sqlite.exec(`DELETE FROM ${table}`);
+		}
+		mailbox("plain-inbox", null, { fullPath: "INBOX" });
+		message("mail-9", "plain-inbox");
+		address("colleague");
+		address("misfiled", {}, '{"junkOnly":{"value":true,"setAt":1}}');
+		sighting("colleague", "mail-9");
+		sighting("misfiled", "mail-9");
+
+		const report = await sweep();
+
+		assert.equal(report.withholdable, 0);
+		assert.equal(report.restorable, 0);
+		assert.equal(withheld("colleague"), false);
+		assert.equal(withheld("misfiled"), true);
+	});
+
+	test("standing the account gave an address lifts its mark regardless", async () => {
+		for (const table of ["mailbox", "mailbox_special_use_entry"]) {
+			sqlite.exec(`DELETE FROM ${table}`);
+		}
+		mailbox("plain-inbox", null, { fullPath: "INBOX" });
+		address(
+			"reformed",
+			{ outbound: 1 },
+			'{"junkOnly":{"value":true,"setAt":1}}',
+		);
+
+		const report = await sweep();
+
+		assert.equal(report.restorable, 1);
+		assert.equal(withheld("reformed"), false);
+	});
+
 	test("leaves an address no message has ever carried alone", async () => {
 		address("orphan");
 
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		const report = await sweep();
 
 		assert.equal(report.withholdable, 0);
 		assert.equal(withheld("orphan"), false);
@@ -476,7 +625,7 @@ describe("addresses standing only on mail in Junk", () => {
 		sighting("colleague", "mail-1");
 		sighting("client", "spam-2");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(addressCount(), 3);
 	});
@@ -485,7 +634,7 @@ describe("addresses standing only on mail in Junk", () => {
 		address("noisy", {}, '{"muted":{"value":true,"setAt":7}}');
 		sighting("noisy", "spam-1");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.deepEqual(JSON.parse(read("noisy").flags).muted, {
 			value: true,
@@ -496,10 +645,10 @@ describe("addresses standing only on mail in Junk", () => {
 	test("a second run writes nothing", async () => {
 		address("spammer");
 		sighting("spammer", "spam-1");
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 		const first = read("spammer");
 
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		const report = await sweep();
 
 		assert.equal(report.withholdable, 0);
 		assert.equal(report.restorable, 0);
@@ -514,7 +663,7 @@ describe("addresses standing only on mail in Junk", () => {
 		address("misfiled", {}, '{"junkOnly":{"value":true,"setAt":1}}');
 		sighting("misfiled", "mail-1");
 
-		const report = await sweepJunkOnlyAddresses(clientOver(sqlite), "check");
+		const report = await sweep("check");
 
 		assert.equal(report.withholdable, 1);
 		assert.equal(report.restorable, 1);
@@ -528,7 +677,7 @@ describe("addresses standing only on mail in Junk", () => {
 		address("legacy", {}, "");
 		sighting("legacy", "spam-1");
 
-		await sweepJunkOnlyAddresses(clientOver(sqlite), "repair");
+		await sweep();
 
 		assert.equal(withheld("legacy"), true);
 	});

package/src/repair/junk-only-address.ts

@@ -1,8 +1,4 @@
-import {
-	JUNK_FOLDER_NAMES,
-	TRASH_FOLDER_NAMES,
-} from "@remit/data-ports/mailbox-role";
-import { MailboxSpecialUse } from "@remit/domain-enums";
+import type { JunkRoleMailboxes } from "@remit/data-ports/folder-role";
 
 export interface JunkOnlyRepairClient {
 	all(sql: string, params: readonly unknown[]): Promise<unknown[]>;
@@ -19,6 +15,12 @@ export interface JunkOnlyReport {
 	readonly restored: number;
 }
 
+/** A statement or fragment with the values its `?` placeholders take, in order. */
+export interface BoundSql {
+	readonly sql: string;
+	readonly params: readonly unknown[];
+}
+
 export const JUNK_ONLY_FLAG = "junkOnly";
 
 const STORED_FLAGS = "coalesce(nullif(address.flags, ''), '{}')";
@@ -26,41 +28,23 @@ const STORED_FLAGS = "coalesce(nullif(address.flags, ''), '{}')";
 const flagIsSet = (name: string): string =>
 	`coalesce(json_extract(${STORED_FLAGS}, '$.${name}.value'), 0) = 1`;
 
-const quoted = (names: readonly string[]): string =>
-	names.map((name) => `'${name}'`).join(", ");
-
-const MAILBOX_LEAF = `lower(substr(
-		mailbox.full_path,
-		length(rtrim(
-			mailbox.full_path,
-			replace(mailbox.full_path, mailbox.hierarchy_delimiter, '')
-		)) + 1
-	))`;
-
-const mailboxCarriesRole = (
-	specialUse: string,
-	names: readonly string[],
-): string => `(
-	exists (
-		SELECT 1 FROM mailbox_special_use_entry entry
-		WHERE entry.mailbox_id = message.mailbox_id
-		  AND entry.special_use = '${specialUse}'
-	)
-	OR exists (
-		SELECT 1 FROM mailbox
-		WHERE mailbox.mailbox_id = message.mailbox_id
-		  AND (
-			mailbox.special_use LIKE '%"${specialUse}"%'
-			OR ${MAILBOX_LEAF} IN (${quoted(names)})
-		  )
-	)
-)`;
+const EMPTY: BoundSql = { sql: "", params: [] };
 
-const IN_JUNK = mailboxCarriesRole(MailboxSpecialUse.Junk, JUNK_FOLDER_NAMES);
-const IN_TRASH = mailboxCarriesRole(
-	MailboxSpecialUse.Trash,
-	TRASH_FOLDER_NAMES,
-);
+const MATCHES_NOTHING: BoundSql = { sql: "0 = 1", params: [] };
+
+/**
+ * Whether the message sits in one of these mailboxes. An empty list is
+ * false — no mailbox holds the role, so no message is in one. That reading is
+ * right for Trash and wrong for Junk, which is why an unresolvable Junk folder
+ * is handled before this is ever reached.
+ */
+const inMailboxes = (mailboxIds: readonly string[]): BoundSql =>
+	mailboxIds.length === 0
+		? { sql: "(0 = 1)", params: [] }
+		: {
+				sql: `(message.mailbox_id IN (${mailboxIds.map(() => "?").join(", ")}))`,
+				params: mailboxIds,
+			};
 
 const sightingWhere = (extra: string): string => `exists (
 	SELECT 1 FROM envelope_address
@@ -68,47 +52,95 @@ const sightingWhere = (extra: string): string => `exists (
 	WHERE envelope_address.address_id = address.address_id${extra}
 )`;
 
-const SIGHTING_IN_JUNK = sightingWhere(` AND ${IN_JUNK}`);
-const SIGHTING_IN_LIVE_MAIL = sightingWhere(
-	` AND NOT ${IN_JUNK} AND NOT ${IN_TRASH}`,
-);
-
-export const ACCOUNT_HAS_CORRESPONDED = `(
+const ACCOUNT_HAS_CORRESPONDED = `(
 	address.outbound_count > 0
 	OR address.reply_count > 0
 	OR ${flagIsSet("vip")}
 	OR ${flagIsSet("trusted")}
 )`;
 
-export const WITHHOLDABLE = `NOT ${flagIsSet(JUNK_ONLY_FLAG)}
+/**
+ * No account in scope has a Junk folder, so nothing is known about any
+ * sighting: the mark cannot be earned. Silence is not the same as "every
+ * message is live mail" — read that way, one move would restore every address
+ * the sweep had withheld.
+ */
+const withholdable = (roles: JunkRoleMailboxes): BoundSql => {
+	if (roles.junkMailboxIds.length === 0) return MATCHES_NOTHING;
+	const inJunk = inMailboxes(roles.junkMailboxIds);
+	const inTrash = inMailboxes(roles.trashMailboxIds);
+	return {
+		sql: `NOT ${flagIsSet(JUNK_ONLY_FLAG)}
 	AND NOT ${ACCOUNT_HAS_CORRESPONDED}
-	AND ${SIGHTING_IN_JUNK}
-	AND NOT ${SIGHTING_IN_LIVE_MAIL}`;
+	AND ${sightingWhere(` AND ${inJunk.sql}`)}
+	AND NOT ${sightingWhere(` AND NOT ${inJunk.sql} AND NOT ${inTrash.sql}`)}`,
+		params: [...inJunk.params, ...inJunk.params, ...inTrash.params],
+	};
+};
 
-export const RESTORABLE = `${flagIsSet(JUNK_ONLY_FLAG)}
-	AND (${ACCOUNT_HAS_CORRESPONDED} OR ${SIGHTING_IN_LIVE_MAIL})`;
+/**
+ * The same silence lifts no mark either — "stands on live mail" is
+ * unanswerable without knowing which folder is Junk. Standing the account
+ * gave the address itself still lifts it: that evidence needs no folder.
+ */
+const restorable = (roles: JunkRoleMailboxes): BoundSql => {
+	if (roles.junkMailboxIds.length === 0) {
+		return {
+			sql: `${flagIsSet(JUNK_ONLY_FLAG)}
+	AND ${ACCOUNT_HAS_CORRESPONDED}`,
+			params: [],
+		};
+	}
+	const inJunk = inMailboxes(roles.junkMailboxIds);
+	const inTrash = inMailboxes(roles.trashMailboxIds);
+	return {
+		sql: `${flagIsSet(JUNK_ONLY_FLAG)}
+	AND (${ACCOUNT_HAS_CORRESPONDED}
+		OR ${sightingWhere(` AND NOT ${inJunk.sql} AND NOT ${inTrash.sql}`)})`,
+		params: [...inJunk.params, ...inTrash.params],
+	};
+};
 
-export const withholdSql = (scope = ""): string =>
-	`UPDATE address
+export const withholdSql = (
+	roles: JunkRoleMailboxes,
+	now: number,
+	setBy: string,
+	scope: BoundSql = EMPTY,
+): BoundSql => {
+	const predicate = withholdable(roles);
+	return {
+		sql: `UPDATE address
 	 SET flags = json_set(${STORED_FLAGS}, '$.${JUNK_ONLY_FLAG}',
 		   json_object('value', json('true'), 'setAt', CAST(? AS INTEGER), 'setBy', ?)),
 		 updated_at = ?
-	 WHERE ${WITHHOLDABLE}${scope}`;
+	 WHERE ${predicate.sql}${scope.sql}`,
+		params: [now, setBy, now, ...predicate.params, ...scope.params],
+	};
+};
 
-export const restoreSql = (scope = ""): string =>
-	`UPDATE address
+export const restoreSql = (
+	roles: JunkRoleMailboxes,
+	now: number,
+	scope: BoundSql = EMPTY,
+): BoundSql => {
+	const predicate = restorable(roles);
+	return {
+		sql: `UPDATE address
 	 SET flags = json_remove(${STORED_FLAGS}, '$.${JUNK_ONLY_FLAG}'), updated_at = ?
-	 WHERE ${RESTORABLE}${scope}`;
+	 WHERE ${predicate.sql}${scope.sql}`,
+		params: [now, ...predicate.params, ...scope.params],
+	};
+};
 
 const REPAIR_SET_BY = "junk-only-repair";
 
 const countWhere = async (
 	client: JunkOnlyRepairClient,
-	predicate: string,
+	predicate: BoundSql,
 ): Promise<number> => {
 	const [row] = (await client.all(
-		`SELECT count(*) AS row_count FROM address WHERE ${predicate}`,
-		[],
+		`SELECT count(*) AS row_count FROM address WHERE ${predicate.sql}`,
+		predicate.params,
 	)) as { row_count: number }[];
 	return row?.row_count ?? 0;
 };
@@ -116,23 +148,39 @@ const countWhere = async (
 export const sweepJunkOnlyAddresses = async (
 	client: JunkOnlyRepairClient,
 	mode: JunkOnlyRepairMode,
+	roles: JunkRoleMailboxes,
 	now: number = Date.now(),
 ): Promise<JunkOnlyReport> => {
-	const withholdable = await countWhere(client, WITHHOLDABLE);
-	const restorable = await countWhere(client, RESTORABLE);
+	const withholdableCount = await countWhere(client, withholdable(roles));
+	const restorableCount = await countWhere(client, restorable(roles));
 
 	if (mode === "check") {
-		return { mode, withholdable, withheld: 0, restorable, restored: 0 };
+		return {
+			mode,
+			withholdable: withholdableCount,
+			withheld: 0,
+			restorable: restorableCount,
+			restored: 0,
+		};
 	}
 
+	const withhold = withholdSql(roles, now, REPAIR_SET_BY);
 	const withheld =
-		withholdable === 0
+		withholdableCount === 0
 			? 0
-			: await client.run(withholdSql(), [now, REPAIR_SET_BY, now]);
-
-	const restored = restorable === 0 ? 0 : await client.run(restoreSql(), [now]);
-
-	return { mode, withholdable, withheld, restorable, restored };
+			: await client.run(withhold.sql, withhold.params);
+
+	const restore = restoreSql(roles, now);
+	const restored =
+		restorableCount === 0 ? 0 : await client.run(restore.sql, restore.params);
+
+	return {
+		mode,
+		withholdable: withholdableCount,
+		withheld,
+		restorable: restorableCount,
+		restored,
+	};
 };
 
 export const formatJunkOnlyReport = (report: JunkOnlyReport): string[] => {

package/src/repos/i4-account-setting.ts

@@ -5,7 +5,7 @@ import type {
 	IAccountSettingRepository,
 	UpsertAccountSettingInput,
 } from "@remit/data-ports";
-import { eq } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import type { Db } from "../db.js";
 import { accountSettingTable } from "../schema/i4-account-setting.js";
 
@@ -48,6 +48,28 @@ export class AccountSettingRepo implements IAccountSettingRepository {
 		return row ? rowToAccountSetting(row) : null;
 	}
 
+	/**
+	 * The named settings of several configs in one read, for callers that would
+	 * otherwise `get` once per account. Missing rows are simply absent from the
+	 * result rather than an error.
+	 */
+	async getMany(
+		accountConfigIds: readonly string[],
+		names: readonly string[],
+	): Promise<AccountSettingItem[]> {
+		if (accountConfigIds.length === 0 || names.length === 0) return [];
+		const rows = await this.db
+			.select()
+			.from(accountSettingTable)
+			.where(
+				and(
+					inArray(accountSettingTable.accountConfigId, [...accountConfigIds]),
+					inArray(accountSettingTable.name, [...names]),
+				),
+			);
+		return rows.map(rowToAccountSetting);
+	}
+
 	async listByAccountConfig(
 		accountConfigId: string,
 	): Promise<AccountSettingItem[]> {

package/src/repos/i4-address-junk-move.sqlite.test.ts

@@ -3,6 +3,7 @@ import { after, before, beforeEach, describe, test } from "node:test";
 import type Database from "better-sqlite3";
 import { createTestDb, type TestDb } from "../test-db.js";
 import { AddressRepo } from "./i4-address.js";
+import { MailboxSpecialUseRepo } from "./i4-mailbox-special-use.js";
 
 const CONFIG = "cfg-1";
 
@@ -11,8 +12,34 @@ describe("reconciling one message's addresses at the moment it moves", () => {
 	let sqlite: Database.Database;
 	let close: () => Promise<void>;
 	let repo: AddressRepo;
+	let specialUse: MailboxSpecialUseRepo;
 
-	const mailbox = (mailboxId: string, specialUse: string | null): void => {
+	const account = (accountId: string): void => {
+		sqlite
+			.prepare(
+				`INSERT OR IGNORE INTO account (
+					account_id, account_config_id, username, email, imap_host,
+					imap_port, imap_tls, imap_start_tls, smtp_port, is_active,
+					connection_state, created_at, updated_at
+				) VALUES (?, ?, 'user', 'user@example.com', 'imap.example.com',
+					993, 1, 0, 465, 1, 'disconnected', 0, 0)`,
+			)
+			.run(accountId, CONFIG);
+	};
+
+	/**
+	 * A folder the server designated, written the way mailbox sync writes one:
+	 * the denormalized column AND the entry row. The paths are deliberately not
+	 * English — the role has to be read off the designation, not guessed from
+	 * the name.
+	 */
+	const mailbox = (
+		mailboxId: string,
+		designation: string | null,
+		folder: { accountId?: string; fullPath?: string } = {},
+	): void => {
+		const accountId = folder.accountId ?? "acc";
+		account(accountId);
 		sqlite
 			.prepare(
 				`INSERT INTO mailbox (
@@ -21,9 +48,22 @@ describe("reconciling one message's addresses at the moment it moves", () => {
 					unseen_count, deleted_count, total_size, last_sync_uid,
 					high_water_mark_uid, last_message_sync_at, special_use,
 					created_at, updated_at
-				) VALUES (?, 'acc', '', '/', ?, 1, 1, '0', 0, 0, 0, 0, 0, 0, 0, ?, 0, 0)`,
+				) VALUES (?, ?, '', '/', ?, 1, 1, '0', 0, 0, 0, 0, 0, 0, 0, ?, 0, 0)`,
+			)
+			.run(
+				mailboxId,
+				accountId,
+				folder.fullPath ?? mailboxId,
+				designation ? JSON.stringify([designation]) : null,
+			);
+		if (!designation) return;
+		sqlite
+			.prepare(
+				`INSERT INTO mailbox_special_use_entry (
+					mailbox_special_use_id, mailbox_id, special_use
+				) VALUES (?, ?, ?)`,
 			)
-			.run(mailboxId, mailboxId, specialUse);
+			.run(`${mailboxId}-${designation}`, mailboxId, designation);
 	};
 
 	const message = (messageId: string, mailboxId: string): void => {
@@ -84,19 +124,38 @@ describe("reconciling one message's addresses at the moment it moves", () => {
 	before(async () => {
 		({ db, sqlite, close } = await createTestDb());
 		repo = new AddressRepo(db as never);
+		specialUse = new MailboxSpecialUseRepo(db as never);
 	});
 
+	/**
+	 * The roles the caller resolves once and hands down, covering every account
+	 * under the config — which is the scope the predicate reads, because the
+	 * address book is keyed by config.
+	 */
+	const reconcile = async (messageId: string): Promise<void> =>
+		repo.reconcileJunkOnlyForMessage(
+			messageId,
+			await specialUse.resolveJunkRolesForConfig(CONFIG),
+		);
+
 	after(async () => {
 		await close();
 	});
 
 	beforeEach(() => {
-		for (const table of ["address", "envelope_address", "message", "mailbox"]) {
+		for (const table of [
+			"address",
+			"envelope_address",
+			"message",
+			"mailbox",
+			"mailbox_special_use_entry",
+			"account",
+		]) {
 			sqlite.exec(`DELETE FROM ${table}`);
 		}
-		mailbox("inbox", null);
-		mailbox("junk", '["Junk"]');
-		mailbox("trash", '["Trash"]');
+		mailbox("inbox", null, { fullPath: "INBOX" });
+		mailbox("junk", "Junk", { fullPath: "Ongewenst" });
+		mailbox("trash", "Trash", { fullPath: "Prullenbak" });
 	});
 
 	test("a message moved into Junk stops the sender being suggested", async () => {
@@ -106,7 +165,7 @@ describe("reconciling one message's addresses at the moment it moves", () => {
 		assert.deepEqual(await suggested("spammer"), ["spammer"]);
 
 		moveTo("msg", "junk");
-		await repo.reconcileJunkOnlyForMessage("msg");
+		await reconcile("msg");
 
 		assert.equal(await withheld("spammer"), true);
 		assert.deepEqual(await suggested("spammer"), []);
@@ -119,7 +178,7 @@ describe("reconciling one message's addresses at the moment it moves", () => {
 		await repo.incrementOutboundCount(CONFIG, "client", Date.now());
 
 		moveTo("msg", "junk");
-		await repo.reconcileJunkOnlyForMessage("msg");
+		await reconcile("msg");
 
 		assert.equal(await withheld("client"), false);
 	});
@@ -132,7 +191,7 @@ describe("reconciling one message's addresses at the moment it moves", () => {
 		sighting("colleague", "real");
 
 		moveTo("spam", "junk");
-		await repo.reconcileJunkOnlyForMessage("spam");
+		await reconcile("spam");
 
 		assert.equal(await withheld("colleague"), false);
 	});
@@ -152,7 +211,7 @@ describe("reconciling one message's addresses at the moment it moves", () => {
 		assert.deepEqual(await suggested("misfiled"), []);
 
 		moveTo("msg", "inbox");
-		await repo.reconcileJunkOnlyForMessage("msg");
+		await reconcile("msg");
 
 		assert.deepEqual(await suggested("misfiled"), ["misfiled"]);
 	});
@@ -171,7 +230,7 @@ describe("reconciling one message's addresses at the moment it moves", () => {
 		sighting("spammer", "msg");
 
 		moveTo("msg", "trash");
-		await repo.reconcileJunkOnlyForMessage("msg");
+		await reconcile("msg");
 
 		assert.equal(await withheld("spammer"), true);
 	});
@@ -183,20 +242,65 @@ describe("reconciling one message's addresses at the moment it moves", () => {
 		sighting("bystander", "other");
 
 		moveTo("msg", "junk");
-		await repo.reconcileJunkOnlyForMessage("msg");
+		await reconcile("msg");
 
 		assert.equal(await withheld("bystander"), false);
 	});
 
+	test("a sender met only in Junk on two accounts of one config stays withheld", async () => {
+		mailbox("junk-b", "Junk", {
+			accountId: "acc-b",
+			fullPath: "Indésirables",
+		});
+		message("ma", "junk");
+		message("mb", "junk-b");
+		await harvest("spammer");
+		sighting("spammer", "ma");
+		sighting("spammer", "mb");
+
+		await reconcile("ma");
+		assert.equal(await withheld("spammer"), true);
+
+		await reconcile("mb");
+
+		assert.equal(await withheld("spammer"), true);
+	});
+
+	/**
+	 * The name hints are English only, so an account whose server flags nothing
+	 * and whose Junk folder is called `Ongewenst` resolves no Junk at all. That
+	 * silence must lift no mark: reading it as "every sighting is live mail"
+	 * would hand the spammer back on the next move.
+	 */
+	test("a move never lifts a mark when no folder holds Junk", async () => {
+		sqlite.exec("DELETE FROM mailbox_special_use_entry");
+		sqlite.exec("UPDATE mailbox SET special_use = NULL");
+		message("msg", "inbox");
+		await repo.upsertJunkAddress({
+			addressId: "spammer",
+			accountConfigId: CONFIG,
+			displayName: "Name",
+			localPart: "spammer",
+			domain: "example.com",
+			normalizedEmail: "spammer@example.com",
+			normalizedCompound: "name spammer@example.com",
+		});
+		sighting("spammer", "msg");
+
+		await reconcile("msg");
+
+		assert.equal(await withheld("spammer"), true);
+	});
+
 	test("a second reconcile of the same move writes nothing new", async () => {
 		message("msg", "inbox");
 		await harvest("spammer");
 		sighting("spammer", "msg");
 		moveTo("msg", "junk");
-		await repo.reconcileJunkOnlyForMessage("msg");
+		await reconcile("msg");
 		const first = await repo.getAddress(CONFIG, "spammer");
 
-		await repo.reconcileJunkOnlyForMessage("msg");
+		await reconcile("msg");
 
 		assert.deepEqual(await repo.getAddress(CONFIG, "spammer"), first);
 	});

package/src/repos/i4-address.ts

@@ -10,6 +10,7 @@ import type {
 	UpdateAddressInput,
 } from "@remit/data-ports";
 import { BadRequestError } from "@remit/data-ports/errors";
+import type { JunkRoleMailboxes } from "@remit/data-ports/folder-role";
 import { shouldPromoteWellknown } from "@remit/data-ports/wellknown";
 import {
 	and,
@@ -26,6 +27,7 @@ import { NotFoundError } from "../error.js";
 import { envelopeAddressId } from "../id.js";
 import { decodeToken, resultList } from "../pagination.js";
 import {
+	type BoundSql,
 	JUNK_ONLY_FLAG,
 	restoreSql,
 	withholdSql,
@@ -331,15 +333,21 @@ export class AddressRepo implements IAddressRepository {
 		return rowToAddress(row);
 	}
 
-	async reconcileJunkOnlyForMessage(messageId: string): Promise<void> {
-		const scope = ` AND address.address_id IN (
+	async reconcileJunkOnlyForMessage(
+		messageId: string,
+		roles: JunkRoleMailboxes,
+	): Promise<void> {
+		const scope: BoundSql = {
+			sql: ` AND address.address_id IN (
 			SELECT address_id FROM envelope_address WHERE message_id = ?
-		)`;
+		)`,
+			params: [messageId],
+		};
 		const now = Date.now();
-		await this.db.run(
-			boundToDrizzle(withholdSql(scope), [now, JUNK_MOVE, now, messageId]),
-		);
-		await this.db.run(boundToDrizzle(restoreSql(scope), [now, messageId]));
+		const withhold = withholdSql(roles, now, JUNK_MOVE, scope);
+		await this.db.run(boundToDrizzle(withhold.sql, withhold.params));
+		const restore = restoreSql(roles, now, scope);
+		await this.db.run(boundToDrizzle(restore.sql, restore.params));
 	}
 
 	async getAddress(

package/src/repos/i4-mailbox-special-use.ts

@@ -6,6 +6,7 @@ import type {
 import {
 	type CanonicalMailboxRoleValue,
 	composeFolderRoleAppointmentName,
+	type JunkRoleMailboxes,
 	type RoleMailboxCandidate,
 	type RoleResolution,
 	resolveMailboxForRole,
@@ -22,6 +23,23 @@ import { AccountSettingRepo } from "./i4-account-setting.js";
 
 type DB = Db<Record<string, unknown>>;
 
+const JUNK_ROLES: readonly CanonicalMailboxRoleValue[] = [
+	CanonicalMailboxRole.Junk,
+	CanonicalMailboxRole.Trash,
+];
+
+const appointmentKey = (
+	accountId: string,
+	role: CanonicalMailboxRoleValue,
+): string => `${accountId}\u0000${role}`;
+
+// The only place this repository names an appointment setting, so that no read
+// here can reach the display-only label row sitting beside it (#887).
+const appointmentSettingName = (
+	accountId: string,
+	role: CanonicalMailboxRoleValue,
+): string => composeFolderRoleAppointmentName(accountId, role);
+
 interface RoleCandidate extends RoleMailboxCandidate {
 	fullPath: string;
 }
@@ -173,6 +191,148 @@ export class MailboxSpecialUseRepo implements IMailboxSpecialUseRepository {
 		return this.findMailboxForRole(accountId, CanonicalMailboxRole.Junk);
 	}
 
+	/**
+	 * Junk and Trash for every account under one config, in a fixed number of
+	 * reads however many accounts the config holds — this feeds a predicate the
+	 * per-message reconcile runs inside the sync loop.
+	 */
+	async resolveJunkRolesForConfig(
+		accountConfigId: string,
+	): Promise<JunkRoleMailboxes> {
+		const accounts = await this.db
+			.select({ accountId: accountTable.accountId })
+			.from(accountTable)
+			.where(eq(accountTable.accountConfigId, accountConfigId));
+		return this.resolveJunkRoles(accounts.map((row) => row.accountId));
+	}
+
+	/**
+	 * The same answer for every account the instance holds. A mailbox id belongs
+	 * to exactly one account, so a union across accounts is no less selective
+	 * than asking each of them separately — which is what lets the boot sweep
+	 * run one pass over the address table instead of one per config.
+	 */
+	async resolveJunkRolesForInstance(): Promise<JunkRoleMailboxes> {
+		const accounts = await this.db
+			.select({ accountId: accountTable.accountId })
+			.from(accountTable);
+		return this.resolveJunkRoles(accounts.map((row) => row.accountId));
+	}
+
+	private async resolveJunkRoles(
+		accountIds: readonly string[],
+	): Promise<JunkRoleMailboxes> {
+		if (accountIds.length === 0) {
+			return { junkMailboxIds: [], trashMailboxIds: [] };
+		}
+		const [candidates, appointments] = await Promise.all([
+			this.roleCandidatesFor(accountIds),
+			this.appointedMailboxIds(accountIds, JUNK_ROLES),
+		]);
+
+		const junkMailboxIds: string[] = [];
+		const trashMailboxIds: string[] = [];
+		for (const accountId of accountIds) {
+			const mailboxes = candidates.get(accountId) ?? [];
+			const junk = resolveMailboxForRole(
+				CanonicalMailboxRole.Junk,
+				mailboxes,
+				appointments.get(appointmentKey(accountId, CanonicalMailboxRole.Junk)),
+			);
+			if (junk) junkMailboxIds.push(junk.mailboxId);
+			const trash = resolveMailboxForRole(
+				CanonicalMailboxRole.Trash,
+				mailboxes,
+				appointments.get(appointmentKey(accountId, CanonicalMailboxRole.Trash)),
+			);
+			if (trash) trashMailboxIds.push(trash.mailboxId);
+		}
+		return { junkMailboxIds, trashMailboxIds };
+	}
+
+	/**
+	 * Each account's appointment for each role, in two reads. Same precedence
+	 * input as `appointedMailboxId`, batched: an account row missing is a caller
+	 * racing a delete, and leaves the account with no appointment rather than
+	 * failing the lookup.
+	 */
+	private async appointedMailboxIds(
+		accountIds: readonly string[],
+		roles: readonly CanonicalMailboxRoleValue[],
+	): Promise<Map<string, string>> {
+		const accounts = await this.db
+			.select({
+				accountId: accountTable.accountId,
+				accountConfigId: accountTable.accountConfigId,
+			})
+			.from(accountTable)
+			.where(inArray(accountTable.accountId, [...accountIds]));
+		if (accounts.length === 0) return new Map();
+
+		const wanted = new Map<string, string>();
+		for (const account of accounts) {
+			for (const role of roles) {
+				wanted.set(
+					appointmentSettingName(account.accountId, role),
+					appointmentKey(account.accountId, role),
+				);
+			}
+		}
+
+		const settings = await this.accountSetting.getMany(
+			accounts.map((account) => account.accountConfigId),
+			[...wanted.keys()],
+		);
+
+		const appointed = new Map<string, string>();
+		for (const setting of settings) {
+			const key = wanted.get(setting.name);
+			if (!key) continue;
+			if (setting.value.kind !== "String") continue;
+			appointed.set(key, setting.value.value);
+		}
+		return appointed;
+	}
+
+	private async roleCandidatesFor(
+		accountIds: readonly string[],
+	): Promise<Map<string, RoleCandidate[]>> {
+		const rows = await this.db
+			.select()
+			.from(mailboxTable)
+			.where(inArray(mailboxTable.accountId, [...accountIds]));
+		if (rows.length === 0) return new Map();
+
+		const entries = await this.db
+			.select()
+			.from(mailboxSpecialUseTable)
+			.where(
+				inArray(
+					mailboxSpecialUseTable.mailboxId,
+					rows.map((row) => row.mailboxId),
+				),
+			);
+		const byMailbox = new Map<string, string[]>();
+		for (const entry of entries) {
+			const designations = byMailbox.get(entry.mailboxId) ?? [];
+			designations.push(entry.specialUse);
+			byMailbox.set(entry.mailboxId, designations);
+		}
+
+		const byAccount = new Map<string, RoleCandidate[]>();
+		for (const row of rows) {
+			const candidates = byAccount.get(row.accountId) ?? [];
+			candidates.push({
+				mailboxId: row.mailboxId,
+				fullPath: row.fullPath,
+				hierarchyDelimiter: row.hierarchyDelimiter,
+				specialUse: byMailbox.get(row.mailboxId) ?? [],
+			});
+			byAccount.set(row.accountId, candidates);
+		}
+		return byAccount;
+	}
+
 	/**
 	 * The one read behind every `find<Role>Mailbox`: the account's mailboxes and
 	 * its appointment for this role, handed to the shared precedence rule. Read
@@ -211,7 +371,7 @@ export class MailboxSpecialUseRepo implements IMailboxSpecialUseRepository {
 
 		const setting = await this.accountSetting.get(
 			account.accountConfigId,
-			composeFolderRoleAppointmentName(accountId, role),
+			appointmentSettingName(accountId, role),
 		);
 		if (!setting || setting.value.kind !== "String") return undefined;
 		return setting.value.value;