@remit/drizzle-service 0.0.83 → 0.0.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/drizzle-service",
-  "version": "0.0.83",
+  "version": "0.0.85",
   "description": "Drizzle ORM service over SQLite",
   "type": "module",
   "main": "src/index.ts",

package/src/mailbox-sync-status-backfill.sqlite.test.ts

@@ -0,0 +1,118 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import Database from "better-sqlite3";
+import {
+	applyMigration,
+	migrationJournal,
+} from "./test-shipped-sqlite-schema.js";
+
+/**
+ * `sync_status` becomes NOT NULL, and on a real install almost every row is
+ * NULL: the sweep's insert is the only create path that omitted it, and the
+ * sweep is what discovers a folder in the first place.
+ *
+ * drizzle-kit does not emit data migrations, and SQLite cannot alter
+ * nullability, so the schema change is a copy-and-swap whose `INSERT … SELECT`
+ * would violate the new constraint on every one of those rows. Because drizzle
+ * runs a folder's whole pending set inside one `BEGIN`/`COMMIT`, that failure
+ * rolls the entities set back and the migrate one-shot that gates all six
+ * services never completes.
+ *
+ * So the pair is proven here in the order the migrator runs it, against the
+ * data it will actually meet.
+ */
+const BACKFILL = "0026_mailbox_sync_status_backfill";
+const SCHEMA_CHANGE = "0027_mailbox_sync_status_total";
+
+const atPredecessor = (): Database.Database => {
+	const sqlite = new Database(":memory:");
+	for (const entry of migrationJournal()) {
+		if (entry.tag === BACKFILL) return sqlite;
+		applyMigration(sqlite, entry.tag);
+	}
+	throw new Error(`${BACKFILL} is not in the journal`);
+};
+
+const seed = (
+	sqlite: Database.Database,
+	rows: Array<{ mailboxId: string; syncStatus: string | null }>,
+): void => {
+	const insert = sqlite.prepare(
+		`INSERT INTO mailbox (
+			mailbox_id, account_id, namespace_type, namespace_prefix,
+			hierarchy_delimiter, full_path, uid_validity, uid_next, highest_modseq,
+			message_count, unseen_count, deleted_count, total_size, last_sync_uid,
+			high_water_mark_uid, last_message_sync_at, parent_mailbox_id,
+			sync_status, cursor_state, created_at, updated_at
+		) VALUES (?, 'acct', 'personal', '', '/', ?, 1, 1, '0', 0, 0, 0, 0, 0, 0, 0,
+			'None', ?, 'normal', 0, 0)`,
+	);
+	for (const row of rows) {
+		insert.run(row.mailboxId, `Folder/${row.mailboxId}`, row.syncStatus);
+	}
+};
+
+describe("mailbox sync_status becomes total", () => {
+	test("the backfill runs first, so the rebuild sees no NULLs", () => {
+		const sqlite = atPredecessor();
+		seed(sqlite, [
+			{ mailboxId: "swept-1", syncStatus: null },
+			{ mailboxId: "swept-2", syncStatus: null },
+			{ mailboxId: "created", syncStatus: "pending" },
+			{ mailboxId: "failed", syncStatus: "failed" },
+		]);
+
+		applyMigration(sqlite, BACKFILL);
+		applyMigration(sqlite, SCHEMA_CHANGE);
+
+		const rows = sqlite
+			.prepare(
+				"SELECT mailbox_id, sync_status FROM mailbox ORDER BY mailbox_id",
+			)
+			.all() as Array<{ mailbox_id: string; sync_status: string }>;
+
+		assert.deepEqual(rows, [
+			{ mailbox_id: "created", sync_status: "pending" },
+			{ mailbox_id: "failed", sync_status: "failed" },
+			{ mailbox_id: "swept-1", sync_status: "synced" },
+			{ mailbox_id: "swept-2", sync_status: "synced" },
+		]);
+		sqlite.close();
+	});
+
+	test("the rebuild is refused without the backfill ahead of it", () => {
+		// The failure this ordering exists to prevent, made visible: without the
+		// backfill the copy-and-swap cannot insert a NULL into the new column.
+		const sqlite = atPredecessor();
+		seed(sqlite, [{ mailboxId: "swept-1", syncStatus: null }]);
+
+		assert.throws(
+			() => applyMigration(sqlite, SCHEMA_CHANGE),
+			/NOT NULL constraint failed/,
+		);
+		sqlite.close();
+	});
+
+	test("the rebuild keeps the account index and the new column", () => {
+		const sqlite = atPredecessor();
+		applyMigration(sqlite, BACKFILL);
+		applyMigration(sqlite, SCHEMA_CHANGE);
+		applyMigration(sqlite, "0028_mailbox_pending_path");
+
+		const columns = (
+			sqlite.prepare("PRAGMA table_info(mailbox)").all() as Array<{
+				name: string;
+			}>
+		).map((column) => column.name);
+		assert.equal(columns.includes("pending_path"), true);
+		assert.equal(columns.includes("old_path"), false);
+
+		const indexes = (
+			sqlite.prepare("PRAGMA index_list(mailbox)").all() as Array<{
+				name: string;
+			}>
+		).map((index) => index.name);
+		assert.equal(indexes.includes("mailbox_by_account_id"), true);
+		sqlite.close();
+	});
+});

package/src/repair/junk-only-address.sqlite.test.ts

@@ -7,7 +7,10 @@ import Database from "better-sqlite3";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { AccountSettingRepo } from "../repos/i4-account-setting.js";
 import { MailboxSpecialUseRepo } from "../repos/i4-mailbox-special-use.js";
-import { shippedTableDdl } from "../test-shipped-sqlite-schema.js";
+import {
+	applyMigration,
+	shippedTableDdl,
+} from "../test-shipped-sqlite-schema.js";
 import {
 	type JunkOnlyRepairClient,
 	type JunkOnlyRepairMode,
@@ -197,6 +200,9 @@ describe("addresses standing only on mail in Junk", () => {
 		]) {
 			sqlite.exec(shippedTableDdl(DDL_TAG, table));
 		}
+		// `mailbox` is read through the repo, which selects every column the
+		// entity declares — including the rename target added after this DDL.
+		applyMigration(sqlite, "0028_mailbox_pending_path");
 		sqlite.exec(
 			readFileSync(
 				new URL(

package/src/repos/i4-address-merge-flags.sqlite.test.ts

@@ -75,6 +75,137 @@ describe("concurrent flag merges on one address", () => {
 		await repo.deleteAddress(addr.accountConfigId, addr.addressId);
 	});
 
+	test("marking a blocked sender never-spam drops the block", async () => {
+		const addr = await address();
+		await repo.mergeFlags(addr.accountConfigId, addr.addressId, {
+			blocked: { value: true, setAt: 1 },
+			muted: { value: true, setAt: 1 },
+		});
+
+		await repo.mergeFlags(addr.accountConfigId, addr.addressId, {
+			neverSpam: { value: true, setAt: 2 },
+		});
+
+		const merged = await repo.getAddress(addr.accountConfigId, addr.addressId);
+		assert.equal(merged.flags?.neverSpam?.value, true);
+		assert.equal(merged.flags?.blocked, undefined);
+		assert.equal(
+			merged.flags?.muted?.value,
+			true,
+			"a flag on another axis is untouched",
+		);
+
+		await repo.deleteAddress(addr.accountConfigId, addr.addressId);
+	});
+
+	test("blocking a never-spam sender drops the grant", async () => {
+		const addr = await address();
+		await repo.mergeFlags(addr.accountConfigId, addr.addressId, {
+			neverSpam: { value: true, setAt: 1 },
+		});
+
+		await repo.mergeFlags(addr.accountConfigId, addr.addressId, {
+			blocked: { value: true, setAt: 2 },
+		});
+
+		const merged = await repo.getAddress(addr.accountConfigId, addr.addressId);
+		assert.equal(merged.flags?.blocked?.value, true);
+		assert.equal(merged.flags?.neverSpam, undefined);
+
+		await repo.deleteAddress(addr.accountConfigId, addr.addressId);
+	});
+
+	test("a never-spam grant turned off leaves a later block alone", async () => {
+		const addr = await address();
+		await repo.mergeFlags(addr.accountConfigId, addr.addressId, {
+			neverSpam: { value: false, setAt: 1 },
+		});
+
+		await repo.mergeFlags(addr.accountConfigId, addr.addressId, {
+			blocked: { value: true, setAt: 2 },
+		});
+
+		const merged = await repo.getAddress(addr.accountConfigId, addr.addressId);
+		assert.equal(merged.flags?.blocked?.value, true);
+		assert.equal(
+			merged.flags?.neverSpam?.value,
+			false,
+			"an explicit false is not a contradiction and keeps its audit trail",
+		);
+
+		await repo.deleteAddress(addr.accountConfigId, addr.addressId);
+	});
+
+	// A row written before the invariant existed still carries both. Healing it
+	// while patching an unrelated key would revoke a placement instruction the
+	// user never touched, so the write leaves it and the read arbitrates.
+	test("a patch about another flag leaves a legacy both-set row alone", async () => {
+		const accountConfigId = randomId();
+		const addr = await repo.createAddress({
+			addressId: randomId(),
+			accountConfigId,
+			localPart: "legacy",
+			domain: "example.com",
+			normalizedEmail: "legacy@example.com",
+			normalizedCompound: "legacy@example.com:legacy",
+			flags: {
+				blocked: { value: true, setAt: 1 },
+				neverSpam: { value: true, setAt: 2 },
+			},
+		});
+
+		await repo.mergeFlags(addr.accountConfigId, addr.addressId, {
+			muted: { value: true, setAt: 3 },
+		});
+
+		const merged = await repo.getAddress(addr.accountConfigId, addr.addressId);
+		assert.equal(merged.flags?.blocked?.value, true);
+		assert.equal(merged.flags?.neverSpam?.value, true);
+		assert.equal(merged.flags?.muted?.value, true);
+
+		await repo.deleteAddress(addr.accountConfigId, addr.addressId);
+	});
+
+	test("writing either placement flag heals a legacy both-set row", async () => {
+		const accountConfigId = randomId();
+		const addr = await repo.createAddress({
+			addressId: randomId(),
+			accountConfigId,
+			localPart: "legacy",
+			domain: "example.com",
+			normalizedEmail: "legacy2@example.com",
+			normalizedCompound: "legacy2@example.com:legacy",
+			flags: {
+				blocked: { value: true, setAt: 1 },
+				neverSpam: { value: true, setAt: 2 },
+			},
+		});
+
+		await repo.mergeFlags(addr.accountConfigId, addr.addressId, {
+			neverSpam: { value: true, setAt: 3 },
+		});
+
+		const merged = await repo.getAddress(addr.accountConfigId, addr.addressId);
+		assert.equal(merged.flags?.neverSpam?.value, true);
+		assert.equal(merged.flags?.blocked, undefined);
+
+		await repo.deleteAddress(addr.accountConfigId, addr.addressId);
+	});
+
+	test("one patch naming both contradictory flags settles on the block", async () => {
+		const addr = await address();
+		await repo.mergeFlags(addr.accountConfigId, addr.addressId, {
+			blocked: { value: true, setAt: 1 },
+			neverSpam: { value: true, setAt: 1 },
+		});
+
+		const merged = await repo.getAddress(addr.accountConfigId, addr.addressId);
+		assert.equal(merged.flags?.blocked?.value, true);
+		assert.equal(merged.flags?.neverSpam, undefined);
+
+		await repo.deleteAddress(addr.accountConfigId, addr.addressId);
+	});
+
 	test("a concurrent merge does not resurrect a deleted flag", async () => {
 		const addr = await address();
 		await repo.mergeFlags(addr.accountConfigId, addr.addressId, {

package/src/repos/i4-address.ts

@@ -70,6 +70,41 @@ type MergeAttempt =
 	| { outcome: "missing" }
 	| { outcome: "contended" };
 
+/**
+ * `blocked` and `neverSpam` are two directly contradictory statements about
+ * where a sender's mail belongs (issue #605), so a row asserting both is not a
+ * tie to break — it is a row that should not exist. This is the only place that
+ * sees both keys at once: `buildFlagsPatch` stays a pure per-key translation,
+ * and the merge fold is the read-modify-write of the whole map.
+ *
+ * The flag the patch just raised wins, so the instruction the user gave last is
+ * the one that stands. A patch raising both resolves to `blocked` — the same
+ * direction the `blocked`/`vip` same-second tie already breaks in.
+ *
+ * Only a patch that raises one of the two is allowed to drop the other. A row
+ * that somehow already carries both survives a patch about anything else
+ * untouched: dropping a placement instruction as a side effect of writing
+ * `muted` would be a silent revocation the user never asked for. Such a row is
+ * resolved on read — `resolveSenderPlacement` reads it as `Blocked` — and
+ * healed the next time either key is written.
+ */
+const dropContradictedPlacementFlag = (
+	next: AddressFlags,
+	patch: FlagsMergePatch,
+): AddressFlags => {
+	if (next.blocked?.value !== true || next.neverSpam?.value !== true)
+		return next;
+	if (patch.blocked?.value === true) {
+		const { neverSpam: _neverSpam, ...rest } = next;
+		return rest;
+	}
+	if (patch.neverSpam?.value === true) {
+		const { blocked: _blocked, ...rest } = next;
+		return rest;
+	}
+	return next;
+};
+
 /**
  * The stored `"<display name> <email>"` compound, folded in JavaScript exactly
  * as message sync folds it — SQL `lower()` stops at ASCII, and the search reads
@@ -496,7 +531,7 @@ export class AddressRepo implements IAddressRepository {
 				}
 				(next[key] as AddressFlags[keyof AddressFlags]) = value;
 			}
-			return next;
+			return dropContradictedPlacementFlag(next, patch);
 		});
 	}
 

package/src/repos/i4-mailbox.sqlite.test.ts

@@ -68,31 +68,39 @@ describe("MailboxRepo (sqlite)", () => {
 		assert.equal(reread.highestModseq, "9007199254740993");
 	});
 
-	test("renameChildPaths marks each child pending along with its new path (#290)", async () => {
-		// A renamed parent is set pending by the caller; its children's new paths
-		// are equally absent from the server until MAILBOX_RENAME lands, so they
-		// must be pending too — otherwise a reconcile in that window reaps the
-		// child as server-deleted.
+	test("a row written without a state reads back synced (D1)", async () => {
 		const accountId = randomUUID();
-		const parent = await repo.create({
-			...makeMailboxInput(accountId, "Work"),
-			syncStatus: MailboxSyncStatus.pending,
-		});
-		const child = await repo.create({
-			...makeMailboxInput(accountId, "Work/sub"),
-			syncStatus: MailboxSyncStatus.synced,
-		});
+		const created = await repo.create(
+			makeMailboxInput(accountId, "Discovered"),
+		);
+		assert.equal(created.syncStatus, MailboxSyncStatus.synced);
+		const fetched = await repo.get(accountId, created.mailboxId);
+		assert.equal(fetched.syncStatus, MailboxSyncStatus.synced);
+	});
 
-		await repo.renameChildPaths(accountId, "Work", "Projects", "/");
+	test("pendingPath round-trips and clears", async () => {
+		const accountId = randomUUID();
+		const created = await repo.create(makeMailboxInput(accountId, "Archive"));
+		assert.equal(created.pendingPath, undefined);
 
-		const renamedChild = await repo.get(accountId, child.mailboxId);
-		assert.equal(renamedChild.fullPath, "Projects/sub");
-		assert.equal(renamedChild.syncStatus, MailboxSyncStatus.pending);
+		const claimed = await repo.transition(accountId, created.mailboxId, {
+			from: [MailboxSyncStatus.synced],
+			to: MailboxSyncStatus.pending,
+			set: { pendingPath: "Records" },
+		});
+		assert.equal(claimed?.pendingPath, "Records");
+		assert.equal(
+			(await repo.get(accountId, created.mailboxId)).pendingPath,
+			"Records",
+		);
 
-		// The parent row is untouched by this call (its own path/status is the
-		// caller's job).
-		const parentRow = await repo.get(accountId, parent.mailboxId);
-		assert.equal(parentRow.fullPath, "Work");
+		const settled = await repo.transition(accountId, created.mailboxId, {
+			from: [MailboxSyncStatus.pending],
+			to: MailboxSyncStatus.synced,
+			set: { fullPath: "Records", pendingPath: null },
+		});
+		assert.equal(settled?.pendingPath, undefined);
+		assert.equal(settled?.fullPath, "Records");
 	});
 });
 
@@ -115,6 +123,9 @@ describe("MailboxRepo (sqlite, shipped migrations)", () => {
 		const sqlite = new Database(":memory:");
 		sqlite.exec(shippedTableDdl("0000_happy_roland_deschain", "mailbox"));
 		applyMigration(sqlite, "0002_highest_modseq_text");
+		applyMigration(sqlite, "0026_mailbox_sync_status_backfill");
+		applyMigration(sqlite, "0027_mailbox_sync_status_total");
+		applyMigration(sqlite, "0028_mailbox_pending_path");
 		const db = drizzle(sqlite, { schema: { mailbox: mailboxTable } });
 		repo = new MailboxRepo(db as never);
 		close = async () => {
@@ -157,6 +168,31 @@ describe("MailboxRepo (sqlite, shipped migrations)", () => {
 		assert.strictEqual(fetched.highestModseq, "900:149");
 	});
 
+	test("a row inserted without a state reads back synced", async () => {
+		const accountId = randomUUID();
+		const created = await repo.create(makeMailboxInput(accountId, "Notes"));
+		assert.equal(created.syncStatus, MailboxSyncStatus.synced);
+	});
+
+	test("pendingPath round-trips and clears on the shipped shape", async () => {
+		const accountId = randomUUID();
+		const created = await repo.create(makeMailboxInput(accountId, "Receipts"));
+
+		const claimed = await repo.transition(accountId, created.mailboxId, {
+			from: [MailboxSyncStatus.synced],
+			to: MailboxSyncStatus.pending,
+			set: { pendingPath: "Invoices" },
+		});
+		assert.equal(claimed?.pendingPath, "Invoices");
+
+		const cleared = await repo.transition(accountId, created.mailboxId, {
+			from: [MailboxSyncStatus.pending],
+			to: MailboxSyncStatus.synced,
+			set: { pendingPath: null },
+		});
+		assert.equal(cleared?.pendingPath, undefined);
+	});
+
 	test("round-trips a cursor above 2^53 with its exact digits", async () => {
 		const accountId = randomUUID();
 		const modseq = "18446744073709551615";

package/src/repos/i4-mailbox.test.ts

@@ -1,7 +1,31 @@
 import assert from "node:assert";
 import { after, before, describe, test } from "node:test";
+import { MailboxSyncStatus } from "@remit/domain-enums";
+import { eq } from "drizzle-orm";
+import {
+	envelopeId as deriveEnvelopeId,
+	rootBodyPartId as deriveRootBodyPartId,
+} from "../id.js";
+import {
+	filterTable,
+	mailboxSpecialUseTable,
+	mailboxTable,
+	messageTable,
+	outboxTable,
+	threadMessageTable,
+} from "../schema.js";
 import { createTestDb, randomId, type TestDb } from "../test-db.js";
+import { runInTransaction } from "../tx.js";
 import { MailboxRepo } from "./i4-mailbox.js";
+import { DrizzleMessageRepository, deleteMessageSubtree } from "./message.js";
+
+/** Every state a row can carry, for a transition that decides against none. */
+const EVERY_STATE = [
+	MailboxSyncStatus.synced,
+	MailboxSyncStatus.pending,
+	MailboxSyncStatus.failed,
+	MailboxSyncStatus.deleting,
+] as const;
 
 function makeMailboxInput(accountId: string, fullPath = "INBOX") {
 	return {
@@ -143,19 +167,6 @@ describe("MailboxRepo", () => {
 		assert.deepEqual(await repo.findByPathPrefix(accountId, "Work", ""), []);
 	});
 
-	test("renameChildPaths updates all children", async () => {
-		const accountId = randomId();
-		await repo.create(makeMailboxInput(accountId, "OldName/Sub1"));
-		await repo.create(makeMailboxInput(accountId, "OldName/Sub2"));
-
-		await repo.renameChildPaths(accountId, "OldName", "NewName");
-
-		const sub1 = await repo.findByPath(accountId, "NewName/Sub1");
-		const sub2 = await repo.findByPath(accountId, "NewName/Sub2");
-		assert.ok(sub1, "Sub1 renamed");
-		assert.ok(sub2, "Sub2 renamed");
-	});
-
 	test("cross-tenant: get refuses a foreign account", async () => {
 		const accountId = randomId();
 		const other = randomId();
@@ -217,6 +228,490 @@ describe("MailboxRepo", () => {
 		await repo.delete(accountB, b.mailboxId);
 	});
 
+	describe("transition — the conditional write (D3)", () => {
+		test("an accepted from-state applies the new state and the set fields", async () => {
+			const accountId = randomId();
+			const mailbox = await repo.create(makeMailboxInput(accountId, "Archive"));
+
+			const written = await repo.transition(accountId, mailbox.mailboxId, {
+				from: [MailboxSyncStatus.synced, MailboxSyncStatus.failed],
+				to: MailboxSyncStatus.pending,
+				set: { pendingPath: "Records" },
+			});
+
+			assert.equal(written?.syncStatus, MailboxSyncStatus.pending);
+			assert.equal(written?.pendingPath, "Records");
+			assert.equal(written?.fullPath, "Archive", "fullPath stays confirmed");
+		});
+
+		test("a state outside `from` writes nothing and leaves the row byte-identical", async () => {
+			const accountId = randomId();
+			const mailbox = await repo.create(makeMailboxInput(accountId, "Work"));
+			const before = await repo.get(accountId, mailbox.mailboxId);
+
+			const lost = await repo.transition(accountId, mailbox.mailboxId, {
+				from: [MailboxSyncStatus.deleting],
+				to: MailboxSyncStatus.synced,
+				set: { fullPath: "Nope" },
+			});
+
+			assert.equal(lost, null);
+			assert.deepEqual(await repo.get(accountId, mailbox.mailboxId), before);
+		});
+
+		test("an absent id is a null, not a throw", async () => {
+			assert.equal(
+				await repo.transition(randomId(), "no-such-mailbox", {
+					from: EVERY_STATE,
+					to: MailboxSyncStatus.synced,
+				}),
+				null,
+			);
+		});
+
+		test("wherePendingPath as a string matches only that target", async () => {
+			const accountId = randomId();
+			const mailbox = await repo.create(makeMailboxInput(accountId, "Bills"));
+			await repo.transition(accountId, mailbox.mailboxId, {
+				from: [MailboxSyncStatus.synced],
+				to: MailboxSyncStatus.pending,
+				set: { pendingPath: "Invoices" },
+			});
+
+			assert.equal(
+				await repo.transition(accountId, mailbox.mailboxId, {
+					from: [MailboxSyncStatus.pending],
+					wherePendingPath: "Somewhere else",
+					to: MailboxSyncStatus.synced,
+				}),
+				null,
+			);
+
+			const settled = await repo.transition(accountId, mailbox.mailboxId, {
+				from: [MailboxSyncStatus.pending],
+				wherePendingPath: "Invoices",
+				to: MailboxSyncStatus.synced,
+				set: { fullPath: "Invoices", pendingPath: null },
+			});
+			assert.equal(settled?.fullPath, "Invoices");
+		});
+
+		test("wherePendingPath: null refuses a row a rename has claimed", async () => {
+			// The seventh-state hole (D3): a create settle that predicates on
+			// `pending` alone matches a row a rename has since claimed, writes
+			// `synced` with the rename target still on it, and the rename then
+			// never runs and is never marked failed.
+			const accountId = randomId();
+			const claimed = await repo.create(makeMailboxInput(accountId, "Notes"));
+			await repo.transition(accountId, claimed.mailboxId, {
+				from: [MailboxSyncStatus.synced],
+				to: MailboxSyncStatus.pending,
+				set: { pendingPath: "Journal" },
+			});
+
+			const createSettle = await repo.transition(accountId, claimed.mailboxId, {
+				from: [MailboxSyncStatus.pending],
+				wherePendingPath: null,
+				to: MailboxSyncStatus.synced,
+			});
+			assert.equal(createSettle, null);
+
+			const still = await repo.get(accountId, claimed.mailboxId);
+			assert.equal(still.syncStatus, MailboxSyncStatus.pending);
+			assert.equal(still.pendingPath, "Journal");
+
+			const creating = await repo.create({
+				...makeMailboxInput(accountId, "Fresh"),
+				syncStatus: MailboxSyncStatus.pending,
+			});
+			const settled = await repo.transition(accountId, creating.mailboxId, {
+				from: [MailboxSyncStatus.pending],
+				wherePendingPath: null,
+				to: MailboxSyncStatus.synced,
+			});
+			assert.equal(settled?.syncStatus, MailboxSyncStatus.synced);
+		});
+
+		test("omitting wherePendingPath predicates on syncStatus alone", async () => {
+			const accountId = randomId();
+			const mailbox = await repo.create(makeMailboxInput(accountId, "Old"));
+			await repo.transition(accountId, mailbox.mailboxId, {
+				from: [MailboxSyncStatus.synced],
+				to: MailboxSyncStatus.pending,
+				set: { pendingPath: "New" },
+			});
+
+			const written = await repo.transition(accountId, mailbox.mailboxId, {
+				from: [MailboxSyncStatus.pending],
+				to: MailboxSyncStatus.failed,
+			});
+			assert.equal(written?.syncStatus, MailboxSyncStatus.failed);
+			assert.equal(written?.pendingPath, "New");
+		});
+
+		test("a rename target survives only under pending and failed", async () => {
+			// The invariant, over the only writer of either field: a caller that
+			// asks for the seventh combination does not get it. `synced` with a
+			// rename target on it is what strands a folder whose rename then never
+			// runs and is never marked failed.
+			const accountId = randomId();
+			const mailbox = await repo.create(makeMailboxInput(accountId, "Trips"));
+
+			for (const to of EVERY_STATE) {
+				const written = await repo.transition(accountId, mailbox.mailboxId, {
+					from: EVERY_STATE,
+					to,
+					set: { pendingPath: "Holidays" },
+				});
+				assert.equal(
+					written?.pendingPath,
+					to === MailboxSyncStatus.pending || to === MailboxSyncStatus.failed
+						? "Holidays"
+						: undefined,
+					`transition to ${to}`,
+				);
+				assert.deepEqual(
+					await repo.get(accountId, mailbox.mailboxId),
+					written,
+					"what the transition returned is what the row now says",
+				);
+			}
+		});
+
+		test("two overlapping transitions with the same from: exactly one wins", async () => {
+			const accountId = randomId();
+			const mailbox = await repo.create(makeMailboxInput(accountId, "Races"));
+
+			const outcomes = await Promise.all([
+				repo.transition(accountId, mailbox.mailboxId, {
+					from: [MailboxSyncStatus.synced],
+					to: MailboxSyncStatus.deleting,
+				}),
+				repo.transition(accountId, mailbox.mailboxId, {
+					from: [MailboxSyncStatus.synced],
+					to: MailboxSyncStatus.pending,
+				}),
+			]);
+
+			assert.equal(outcomes.filter((outcome) => outcome !== null).length, 1);
+		});
+
+		test("cross-tenant: a foreign account transitions nothing", async () => {
+			const accountId = randomId();
+			const mailbox = await repo.create(makeMailboxInput(accountId, "Private"));
+
+			assert.equal(
+				await repo.transition(randomId(), mailbox.mailboxId, {
+					from: EVERY_STATE,
+					to: MailboxSyncStatus.deleting,
+				}),
+				null,
+			);
+			assert.equal(
+				(await repo.get(accountId, mailbox.mailboxId)).syncStatus,
+				MailboxSyncStatus.synced,
+			);
+		});
+	});
+
+	describe("transitionSubtree — the intent, all-or-nothing (D6)", () => {
+		const seedSubtree = async (accountId: string) => ({
+			parent: await repo.create(makeMailboxInput(accountId, "Work")),
+			child: await repo.create(makeMailboxInput(accountId, "Work/Projects")),
+			grandchild: await repo.create(
+				makeMailboxInput(accountId, "Work/Projects/Alpha"),
+			),
+		});
+
+		test("transitions the folder and every descendant, each from its own path", async () => {
+			const accountId = randomId();
+			const { parent, child, grandchild } = await seedSubtree(accountId);
+
+			const written = await repo.transitionSubtree(
+				accountId,
+				parent.mailboxId,
+				{
+					from: [MailboxSyncStatus.synced, MailboxSyncStatus.failed],
+					to: MailboxSyncStatus.pending,
+					rowSet: (row) => ({
+						pendingPath: row.fullPath.replace("Work", "Archive"),
+					}),
+				},
+			);
+
+			assert.equal(written?.length, 3);
+			assert.equal(
+				(await repo.get(accountId, parent.mailboxId)).pendingPath,
+				"Archive",
+			);
+			assert.equal(
+				(await repo.get(accountId, child.mailboxId)).pendingPath,
+				"Archive/Projects",
+			);
+			assert.equal(
+				(await repo.get(accountId, grandchild.mailboxId)).pendingPath,
+				"Archive/Projects/Alpha",
+			);
+		});
+
+		test("one descendant outside `from` refuses the intent and writes nothing", async () => {
+			const accountId = randomId();
+			const { parent, child, grandchild } = await seedSubtree(accountId);
+			await repo.transition(accountId, grandchild.mailboxId, {
+				from: [MailboxSyncStatus.synced],
+				to: MailboxSyncStatus.deleting,
+			});
+
+			const refused = await repo.transitionSubtree(
+				accountId,
+				parent.mailboxId,
+				{
+					from: [MailboxSyncStatus.synced],
+					to: MailboxSyncStatus.pending,
+					rowSet: (row) => ({ pendingPath: `Moved/${row.fullPath}` }),
+				},
+			);
+
+			assert.equal(refused, null);
+			for (const row of [parent, child]) {
+				const after = await repo.get(accountId, row.mailboxId);
+				assert.equal(after.syncStatus, MailboxSyncStatus.synced);
+				assert.equal(after.pendingPath, undefined);
+			}
+			assert.equal(
+				(await repo.get(accountId, grandchild.mailboxId)).syncStatus,
+				MailboxSyncStatus.deleting,
+			);
+		});
+
+		test("the from-state predicate rides each UPDATE, not a prior read", async () => {
+			// A read-then-check-then-write version passes the case above and still
+			// misses a row that leaves an accepted state after the read. The
+			// predicate is on the UPDATE, so the affected-row count catches it.
+			const accountId = randomId();
+			const { parent, child } = await seedSubtree(accountId);
+
+			const refused = await repo.transitionSubtree(
+				accountId,
+				parent.mailboxId,
+				{
+					from: [MailboxSyncStatus.synced],
+					to: MailboxSyncStatus.pending,
+					rowSet: (row) => {
+						if (row.mailboxId === parent.mailboxId) {
+							// Not a real concurrent writer — the shape of one. The row
+							// leaves `synced` after the subtree was resolved.
+							db.update(mailboxTable)
+								.set({ syncStatus: MailboxSyncStatus.deleting })
+								.where(eq(mailboxTable.mailboxId, child.mailboxId))
+								.run();
+						}
+						return { pendingPath: row.fullPath };
+					},
+				},
+			);
+
+			assert.equal(refused, null);
+			assert.equal(
+				(await repo.get(accountId, parent.mailboxId)).syncStatus,
+				MailboxSyncStatus.synced,
+			);
+		});
+
+		test("an absent folder is a null", async () => {
+			assert.equal(
+				await repo.transitionSubtree(randomId(), "no-such-mailbox", {
+					from: EVERY_STATE,
+					to: MailboxSyncStatus.pending,
+					rowSet: () => ({}),
+				}),
+				null,
+			);
+		});
+	});
+
+	describe("deleteMailboxWithMail — the folder's mail goes with it (D8)", () => {
+		const seedMessage = async (mailboxId: string, uid: number) => {
+			const messageId = randomId();
+			await new DrizzleMessageRepository(db as never).create({
+				messageId,
+				mailboxId,
+				uid,
+				sequenceNumber: uid,
+				rfc822Size: 10,
+				internalDate: 1700000000000,
+				envelopeId: deriveEnvelopeId(messageId),
+				rootBodyPartId: deriveRootBodyPartId(messageId),
+			});
+			await db.insert(threadMessageTable).values({
+				threadMessageId: randomId(),
+				accountConfigId: "acct",
+				threadId: randomId(),
+				messageId,
+				mailboxId,
+				uid,
+				referenceOrder: 0,
+				internalDate: 1700000000000,
+				sentDate: 1700000000000,
+				isRead: false,
+				hasAttachment: false,
+				hasStars: false,
+				isDeleted: false,
+				createdAt: 1700000000000,
+				updatedAt: 1700000000000,
+			});
+			return messageId;
+		};
+
+		const outboxEventsFor = async (messageId: string) =>
+			db.select().from(outboxTable).where(eq(outboxTable.messageId, messageId));
+
+		test("removes the folder, its mail and its own child rows, and nothing else's", async () => {
+			const accountId = randomId();
+			const doomed = await repo.create(makeMailboxInput(accountId, "Receipts"));
+			const spared = await repo.create(makeMailboxInput(accountId, "Keep"));
+			const doomedMessage = await seedMessage(doomed.mailboxId, 1);
+			const sparedMessage = await seedMessage(spared.mailboxId, 1);
+			await db.insert(mailboxSpecialUseTable).values({
+				mailboxSpecialUseId: randomId(),
+				mailboxId: doomed.mailboxId,
+				specialUse: "Archive",
+			});
+
+			await repo.deleteMailboxWithMail(accountId, doomed.mailboxId);
+
+			await assert.rejects(
+				() => repo.get(accountId, doomed.mailboxId),
+				/Mailbox not found/,
+			);
+			assert.deepEqual(
+				await db
+					.select()
+					.from(messageTable)
+					.where(eq(messageTable.mailboxId, doomed.mailboxId)),
+				[],
+			);
+			assert.deepEqual(
+				await db
+					.select()
+					.from(threadMessageTable)
+					.where(eq(threadMessageTable.mailboxId, doomed.mailboxId)),
+				[],
+			);
+			assert.deepEqual(
+				await db
+					.select()
+					.from(mailboxSpecialUseTable)
+					.where(eq(mailboxSpecialUseTable.mailboxId, doomed.mailboxId)),
+				[],
+			);
+
+			// The search index is cleared by the outbox row, not by the delete.
+			const removals = await outboxEventsFor(doomedMessage);
+			assert.deepEqual(
+				removals.map((row) => row.event),
+				["message.removed"],
+			);
+
+			const survivors = await db
+				.select()
+				.from(messageTable)
+				.where(eq(messageTable.mailboxId, spared.mailboxId));
+			assert.equal(survivors.length, 1);
+			assert.equal(
+				(await outboxEventsFor(sparedMessage)).some(
+					(row) => row.event === "message.removed",
+				),
+				false,
+			);
+			assert.equal(
+				(await repo.get(accountId, spared.mailboxId)).mailboxId,
+				spared.mailboxId,
+			);
+		});
+
+		test("leaves a filter bound to the folder alone", async () => {
+			// D16 refuses the delete while a binding stands, so there is nothing to
+			// unbind — and deleting a user's filters as a side effect of a folder
+			// delete is the outcome the design rules out. This is the test that
+			// stops a future refactor doing it.
+			const accountId = randomId();
+			const mailbox = await repo.create(makeMailboxInput(accountId, "Bound"));
+			const filterId = randomId();
+			await db.insert(filterTable).values({
+				filterId,
+				accountConfigId: accountId,
+				name: "Invoices → Bound",
+				scope: "Standing",
+				ruleChangedAt: 0,
+				actionChangedAt: 0,
+				actionMailboxId: mailbox.mailboxId,
+				createdAt: 0,
+				updatedAt: 0,
+			});
+
+			await repo.deleteMailboxWithMail(accountId, mailbox.mailboxId);
+
+			const rows = await db
+				.select()
+				.from(filterTable)
+				.where(eq(filterTable.filterId, filterId));
+			assert.equal(rows.length, 1);
+			assert.equal(rows[0].actionMailboxId, mailbox.mailboxId);
+		});
+
+		test("re-running after a partial removal completes", async () => {
+			const accountId = randomId();
+			const mailbox = await repo.create(makeMailboxInput(accountId, "Resume"));
+			const first = await seedMessage(mailbox.mailboxId, 1);
+			await seedMessage(mailbox.mailboxId, 2);
+
+			// The shape an interruption leaves: one message's rows already gone,
+			// the mailbox row still there and still `deleting`.
+			await runInTransaction(db, (tx) => deleteMessageSubtree(tx, [first]));
+			await repo.transition(accountId, mailbox.mailboxId, {
+				from: EVERY_STATE,
+				to: MailboxSyncStatus.deleting,
+			});
+
+			await repo.deleteMailboxWithMail(accountId, mailbox.mailboxId);
+
+			await assert.rejects(
+				() => repo.get(accountId, mailbox.mailboxId),
+				/Mailbox not found/,
+			);
+			assert.deepEqual(
+				await db
+					.select()
+					.from(messageTable)
+					.where(eq(messageTable.mailboxId, mailbox.mailboxId)),
+				[],
+			);
+		});
+
+		test("cross-tenant: a foreign account removes neither the row nor its mail", async () => {
+			const accountId = randomId();
+			const mailbox = await repo.create(makeMailboxInput(accountId, "Mine"));
+			await seedMessage(mailbox.mailboxId, 1);
+
+			await repo.deleteMailboxWithMail(randomId(), mailbox.mailboxId);
+
+			assert.equal(
+				(await repo.get(accountId, mailbox.mailboxId)).mailboxId,
+				mailbox.mailboxId,
+			);
+			assert.equal(
+				(
+					await db
+						.select()
+						.from(messageTable)
+						.where(eq(messageTable.mailboxId, mailbox.mailboxId))
+				).length,
+				1,
+			);
+		});
+	});
+
 	describe("continuation token rejection (#172)", () => {
 		for (const [label, token] of [
 			["an unparseable", "not-a-cursor"],

package/src/repos/i4-mailbox.ts

@@ -3,16 +3,32 @@ import type {
 	CreateMailboxInput,
 	IMailboxRepository,
 	MailboxItem,
+	MailboxStatePredicate,
+	MailboxSubtreeTransitionIntent,
+	MailboxTransitionIntent,
+	MailboxTransitionWrite,
 	ResultList,
 	UpdateMailboxInput,
 } from "@remit/data-ports";
-import { MailboxCursorState, MailboxSyncStatus } from "@remit/domain-enums";
-import { and, asc, eq, gt, inArray, or } from "drizzle-orm";
+import { MailboxCursorState } from "@remit/domain-enums";
+import { and, asc, eq, gt, inArray, isNull, or, type SQL } from "drizzle-orm";
 import shortUuid from "short-uuid";
 import type { Db } from "../db.js";
 import { NotFoundError } from "../error.js";
 import { decodeToken, resultList } from "../pagination.js";
-import { mailboxTable } from "../schema/i4-mailbox.js";
+import {
+	mailboxAttributeTable,
+	mailboxFlagTable,
+	mailboxSpecialUseTable,
+	mailboxTable,
+} from "../schema/i4-mailbox.js";
+import { mailboxLockTable } from "../schema/i4-mailbox-lock.js";
+import { messageFlagPushTable } from "../schema/i4-message-flag-push.js";
+import { messagePlacementMoveTable } from "../schema/i4-message-placement-move.js";
+import { messageTable } from "../schema/message-data.js";
+import { threadMessageTable } from "../schema/thread-message.js";
+import { runInTransaction } from "../tx.js";
+import { deleteMessageSubtree } from "./message.js";
 
 const base36Translator = shortUuid.createTranslator(
 	shortUuid.constants.uuid25Base36,
@@ -21,6 +37,63 @@ const generateMailboxId = () => base36Translator.fromUUID(randomUUID());
 
 type DB = Db<Record<string, unknown>>;
 
+/**
+ * Message subtrees removed per transaction by {@link MailboxRepo.deleteMailboxWithMail},
+ * matching `SUBTREE_BATCH_SIZE` in the account purge. On SQLite each batch holds
+ * the process's only write slot, so the bound is what keeps a large folder's
+ * delete from parking every other writer behind it (D8).
+ */
+const MAIL_DELETE_BATCH_SIZE = 100;
+
+/** Refuses a subtree intent from inside the transaction, so the throw is the rollback. */
+class SubtreeContested extends Error {
+	constructor() {
+		super("mailbox subtree transition contested");
+		this.name = "SubtreeContested";
+	}
+}
+
+/** The WHERE terms of a folder-state transition (folder-rename-and-delete.md D3). */
+const stateTerms = (expected: MailboxStatePredicate): SQL[] => {
+	const terms: SQL[] = [
+		inArray(mailboxTable.syncStatus, [...expected.from]),
+	] as SQL[];
+	if (expected.wherePendingPath === undefined) return terms;
+	terms.push(
+		expected.wherePendingPath === null
+			? isNull(mailboxTable.pendingPath)
+			: eq(mailboxTable.pendingPath, expected.wherePendingPath),
+	);
+	return terms;
+};
+
+/**
+ * A rename target only means something while a rename is outstanding or has
+ * just failed, so the two states that cannot carry one drop it here rather than
+ * relying on every caller to remember. That is what makes the invariant — a
+ * non-null `pendingPath` only under `pending` or `failed` — hold by
+ * construction: this is the only writer of either field, and `synced` with a
+ * target on it is the seventh combination the design calls unreachable.
+ */
+const KEEPS_A_RENAME_TARGET: readonly MailboxItem["syncStatus"][] = [
+	"pending",
+	"failed",
+];
+
+const transitionSet = (
+	to: MailboxItem["syncStatus"],
+	write: MailboxTransitionWrite | undefined,
+): Partial<typeof mailboxTable.$inferInsert> => ({
+	syncStatus: to,
+	...(write?.fullPath !== undefined ? { fullPath: write.fullPath } : {}),
+	...(KEEPS_A_RENAME_TARGET.includes(to)
+		? write?.pendingPath !== undefined
+			? { pendingPath: write.pendingPath }
+			: {}
+		: { pendingPath: null }),
+	updatedAt: Date.now(),
+});
+
 export function rowToMailbox(
 	row: typeof mailboxTable.$inferSelect,
 ): MailboxItem {
@@ -43,9 +116,9 @@ export function rowToMailbox(
 		lastMessageSyncAt: row.lastMessageSyncAt,
 		initialSyncCompletedAt: row.initialSyncCompletedAt ?? undefined,
 		parentMailboxId: row.parentMailboxId,
-		syncStatus: (row.syncStatus as MailboxItem["syncStatus"]) ?? undefined,
+		syncStatus: row.syncStatus as MailboxItem["syncStatus"],
+		...(row.pendingPath !== null ? { pendingPath: row.pendingPath } : {}),
 		cursorState: (row.cursorState as MailboxItem["cursorState"]) ?? undefined,
-		oldPath: row.oldPath ?? undefined,
 		specialUse: (row.specialUse as MailboxItem["specialUse"]) ?? undefined,
 		createdAt: row.createdAt,
 		updatedAt: row.updatedAt,
@@ -78,9 +151,11 @@ export class MailboxRepo implements IMailboxRepository {
 				lastMessageSyncAt: input.lastMessageSyncAt,
 				initialSyncCompletedAt: input.initialSyncCompletedAt,
 				parentMailboxId: input.parentMailboxId ?? "",
-				syncStatus: input.syncStatus,
+				// Total per D1: an insert that names no state is a folder the
+				// server just told us about, and a folder the server told us
+				// about is confirmed.
+				syncStatus: input.syncStatus ?? "synced",
 				cursorState: input.cursorState ?? MailboxCursorState.normal,
-				oldPath: input.oldPath,
 				specialUse: input.specialUse ?? null,
 				createdAt: now,
 				updatedAt: now,
@@ -161,16 +236,12 @@ export class MailboxRepo implements IMailboxRepository {
 			updates.initialSyncCompletedAt = input.initialSyncCompletedAt;
 		if (input.parentMailboxId !== undefined)
 			updates.parentMailboxId = input.parentMailboxId;
-		if (input.syncStatus !== undefined) updates.syncStatus = input.syncStatus;
 		if (input.cursorState !== undefined)
 			updates.cursorState = input.cursorState;
-		if (input.oldPath !== undefined) updates.oldPath = input.oldPath;
 		if (input.specialUse !== undefined) updates.specialUse = input.specialUse;
 
 		if (remove) {
 			for (const field of remove) {
-				if (field === "syncStatus") updates.syncStatus = null;
-				if (field === "oldPath") updates.oldPath = null;
 				if (field === "specialUse") updates.specialUse = null;
 			}
 		}
@@ -189,6 +260,81 @@ export class MailboxRepo implements IMailboxRepository {
 		return rowToMailbox(row);
 	}
 
+	async transition(
+		accountId: string,
+		mailboxId: string,
+		intent: MailboxTransitionIntent,
+	): Promise<MailboxItem | null> {
+		const [row] = await this.db
+			.update(mailboxTable)
+			.set(transitionSet(intent.to, intent.set))
+			.where(
+				and(
+					eq(mailboxTable.accountId, accountId),
+					eq(mailboxTable.mailboxId, mailboxId),
+					...stateTerms(intent),
+				),
+			)
+			.returning();
+		return row ? rowToMailbox(row) : null;
+	}
+
+	async transitionSubtree(
+		accountId: string,
+		mailboxId: string,
+		intent: MailboxSubtreeTransitionIntent,
+	): Promise<MailboxItem[] | null> {
+		return runInTransaction(this.db, async (tx) => {
+			const repo = new MailboxRepo(tx);
+			const root = await repo
+				.get(accountId, mailboxId)
+				.catch((error: unknown) => {
+					if (error instanceof NotFoundError) return null;
+					throw error;
+				});
+			if (!root) return null;
+
+			const subtree = [
+				root,
+				...(await repo.findByPathPrefix(
+					accountId,
+					root.fullPath,
+					root.hierarchyDelimiter,
+				)),
+			];
+
+			const written: MailboxItem[] = [];
+			for (const row of subtree) {
+				// The from-state predicate rides each UPDATE rather than a read
+				// taken before them (D3). Read-then-check-then-write is safe on
+				// SQLite only because `runInTransaction` serializes top-level
+				// writes; under Postgres READ COMMITTED a single-row transition
+				// committing in between is missed entirely.
+				const [updated] = await tx
+					.update(mailboxTable)
+					.set(transitionSet(intent.to, intent.rowSet(row)))
+					.where(
+						and(
+							eq(mailboxTable.accountId, accountId),
+							eq(mailboxTable.mailboxId, row.mailboxId),
+							inArray(mailboxTable.syncStatus, [...intent.from]),
+						),
+					)
+					.returning();
+				if (updated) written.push(rowToMailbox(updated));
+			}
+
+			// A subtree cannot be half-renamed: one row that moved out from under
+			// this call refuses the whole intent, and the throw is what rolls the
+			// rest back.
+			if (written.length !== subtree.length) throw new SubtreeContested();
+			return written;
+		}).catch((error: unknown) => {
+			if (error instanceof SubtreeContested) return null;
+			throw error;
+		});
+	}
+
 	async resolveAccountId(mailboxId: string): Promise<string | null> {
 		const [row] = await this.db
 			.select({ accountId: mailboxTable.accountId })
@@ -335,22 +481,78 @@ export class MailboxRepo implements IMailboxRepository {
 		return rows.map(rowToMailbox);
 	}
 
-	async renameChildPaths(
+	async deleteMailboxWithMail(
 		accountId: string,
-		oldPath: string,
-		newPath: string,
-		delimiter = "/",
+		mailboxId: string,
 	): Promise<void> {
-		const children = await this.findByPathPrefix(accountId, oldPath, delimiter);
-		for (const child of children) {
-			const newChildPath = child.fullPath.replace(oldPath, newPath);
-			// Mark the child pending, like the renamed parent: its new path is not
-			// on the server until MAILBOX_RENAME lands, so a reconcile running in
-			// that window must not reap it as server-deleted (#290).
-			await this.update(accountId, child.mailboxId, {
-				fullPath: newChildPath,
-				syncStatus: MailboxSyncStatus.pending,
+		// Tenant scope, and the re-entry guard in the same read: a redelivery that
+		// arrives after the final commit finds no row and has nothing left to do,
+		// exactly as `delete` no-ops. Every removal below keys on `mailboxId`
+		// alone, so this is what stops a foreign accountId reaching them.
+		const [owned] = await this.db
+			.select({ mailboxId: mailboxTable.mailboxId })
+			.from(mailboxTable)
+			.where(
+				and(
+					eq(mailboxTable.accountId, accountId),
+					eq(mailboxTable.mailboxId, mailboxId),
+				),
+			);
+		if (!owned) return;
+
+		// Ordered, batched and resumable rather than one transaction (D8). The
+		// caller keeps the row `deleting` until the last commit, so an interrupted
+		// run re-enters here and continues against whatever is left.
+		for (;;) {
+			const rows = await this.db
+				.select({ messageId: messageTable.messageId })
+				.from(messageTable)
+				.where(eq(messageTable.mailboxId, mailboxId))
+				.limit(MAIL_DELETE_BATCH_SIZE);
+			if (rows.length === 0) break;
+			const messageIds = rows.map((row) => row.messageId);
+
+			await runInTransaction(this.db, async (tx) => {
+				// The primitive the rest of the codebase deletes mail with: nine
+				// per-message child tables plus one `message.removed` outbox row
+				// each, which is what clears the search index. A bespoke table
+				// list would orphan those nine and leave deleted mail searchable.
+				await deleteMessageSubtree(tx, messageIds);
+				await tx
+					.delete(threadMessageTable)
+					.where(inArray(threadMessageTable.messageId, messageIds));
 			});
 		}
+
+		await this.db
+			.delete(mailboxSpecialUseTable)
+			.where(eq(mailboxSpecialUseTable.mailboxId, mailboxId));
+		await this.db
+			.delete(mailboxAttributeTable)
+			.where(eq(mailboxAttributeTable.mailboxId, mailboxId));
+		await this.db
+			.delete(mailboxFlagTable)
+			.where(eq(mailboxFlagTable.mailboxId, mailboxId));
+		await this.db
+			.delete(mailboxLockTable)
+			.where(eq(mailboxLockTable.mailboxId, mailboxId));
+		await this.db
+			.delete(messageFlagPushTable)
+			.where(eq(messageFlagPushTable.mailboxId, mailboxId));
+		await this.db
+			.delete(messagePlacementMoveTable)
+			.where(
+				or(
+					eq(messagePlacementMoveTable.sourceMailboxId, mailboxId),
+					eq(messagePlacementMoveTable.destinationMailboxId, mailboxId),
+				),
+			);
+
+		// `filter` also carries a mailboxId and is deliberately not in that list:
+		// D16 refuses the delete while any filter or role appointment is bound, so
+		// there is nothing to unbind, and deleting a user's filters as a side
+		// effect of a folder delete is the outcome the design rules out.
+
+		await this.delete(accountId, mailboxId);
 	}
 }

package/src/schema/i4-mailbox.ts

@@ -2,3 +2,5 @@ import * as entities from "@remit/drizzle-sqlite-schema";
 
 export const mailboxTable = entities.mailboxes;
 export const mailboxSpecialUseTable = entities.mailboxSpecialUseEntries;
+export const mailboxAttributeTable = entities.mailboxAttributeEntries;
+export const mailboxFlagTable = entities.mailboxFlags;