@remit/imap-worker 0.0.64 → 0.0.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/imap-worker",
-  "version": "0.0.64",
+  "version": "0.0.66",
   "type": "module",
   "main": "dist/index.js",
   "exports": {

package/src/handlers/append-sent-message.ts

@@ -10,6 +10,7 @@ import {
 	buildMailMessage,
 	renderRawMessage,
 } from "@remit/smtp-service/message-builder";
+import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import { isAccountDeleted } from "../account-check.js";
 import { createConnectionScopeWithCredentials } from "../connection-scope.js";
 import type { AppendSentMessageEvent } from "../events.js";
@@ -29,23 +30,9 @@ const ROW_SURVIVED_ITS_DELETE =
 const unfiledAppendRefused = (fullPath: string, error: unknown): string =>
 	`Sent, but not filed: the mail server refused to store a copy in ${fullPath} (${error instanceof Error ? error.message : String(error)}).`;
 
-/**
- * Fallback when `APPEND_SENT_MAX_ATTEMPTS` is unset (local dev, unit tests).
- * Matches the shared `MAX_RECEIVE_COUNT` every queue's redrive policy uses,
- * same pattern as `FLAG_PUSH_MAX_ATTEMPTS` / `BODY_SYNC_MAX_ATTEMPTS`.
- */
-const DEFAULT_APPEND_SENT_MAX_ATTEMPTS = 3;
-
 export const getAppendSentMaxAttempts = (
 	processEnv: NodeJS.ProcessEnv = process.env,
-): number => {
-	const raw = processEnv.APPEND_SENT_MAX_ATTEMPTS;
-	if (!raw) return DEFAULT_APPEND_SENT_MAX_ATTEMPTS;
-	const parsed = Number.parseInt(raw, 10);
-	return Number.isFinite(parsed) && parsed > 0
-		? parsed
-		: DEFAULT_APPEND_SENT_MAX_ATTEMPTS;
-};
+): number => attemptBudget("APPEND_SENT_MAX_ATTEMPTS", 3, processEnv);
 
 export const APPEND_SENT_MAX_ATTEMPTS = getAppendSentMaxAttempts();
 

package/src/handlers/flag-push.ts

@@ -8,6 +8,7 @@ import {
 	MailboxCursorPausedError,
 	resolveExhaustedFlagPushFailure,
 } from "@remit/mailbox-service";
+import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import { isAccountDeleted } from "../account-check.js";
 import { createConnectionScopeWithCredentials } from "../connection-scope.js";
 import type { FlagPushEvent } from "../events.js";
@@ -15,24 +16,9 @@ import { isNotFoundError } from "../is-not-found.js";
 import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
 import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
 
-/**
- * Fallback when `FLAG_PUSH_MAX_ATTEMPTS` is unset (local dev, unit tests).
- * Matches the shared `MAX_RECEIVE_COUNT` every queue's redrive policy uses
- * (`infra/stacks/dev/stacks/remit-queue-stack.ts`), same pattern as
- * `BODY_SYNC_MAX_ATTEMPTS` (#1270) / `PLACEMENT_MOVE_MAX_ATTEMPTS` (#1289).
- */
-const DEFAULT_FLAG_PUSH_MAX_ATTEMPTS = 3;
-
 export const getFlagPushMaxAttempts = (
 	processEnv: NodeJS.ProcessEnv = process.env,
-): number => {
-	const raw = processEnv.FLAG_PUSH_MAX_ATTEMPTS;
-	if (!raw) return DEFAULT_FLAG_PUSH_MAX_ATTEMPTS;
-	const parsed = Number.parseInt(raw, 10);
-	return Number.isFinite(parsed) && parsed > 0
-		? parsed
-		: DEFAULT_FLAG_PUSH_MAX_ATTEMPTS;
-};
+): number => attemptBudget("FLAG_PUSH_MAX_ATTEMPTS", 3, processEnv);
 
 export const FLAG_PUSH_MAX_ATTEMPTS = getFlagPushMaxAttempts();
 

package/src/handlers/message-copy.test.ts

@@ -229,6 +229,25 @@ describe("handleMessageCopy", () => {
 		assert.equal(called("threadMessage.update").length, 1);
 	});
 
+	// Issue #1122. `deriveCopyMessageId` reuses the row, so copying the same
+	// message into the same folder twice issues a second server COPY and leaves
+	// the destination holding both. Nothing here can rule the older one out the
+	// way the trash probe's source check does — a COPY leaves the source
+	// untouched — so the row must settle on the highest match. Settling on 12
+	// points it at the earlier copy and orphans the one just made.
+	it("settles on the copy this event made, not on an earlier copy of the same message", async () => {
+		h.connection.copyMessages = async () => ({ uidMap: new Map() });
+		h.destinationHolds = [12, 42];
+
+		await handleMessageCopy(event, noopLog, 1, deps());
+
+		assert.deepEqual(called("message.updateUid")[0]?.args, [
+			"new-msg",
+			42,
+			"dst-mbx",
+		]);
+	});
+
 	it("reconciles the optimistic row away when the destination does not hold the copy", async () => {
 		h.connection.copyMessages = async () => ({ uidMap: new Map() });
 		h.destinationHolds = [];

package/src/handlers/message-copy.ts

@@ -9,13 +9,14 @@ import {
 	MailboxCursorPausedError,
 	reconcileStaleMessage,
 } from "@remit/mailbox-service";
+import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import { isAccountDeleted } from "../account-check.js";
 import { createConnectionScopeWithCredentials } from "../connection-scope.js";
 import type { MessageCopyEvent } from "../events.js";
 import { isNotFoundError } from "../is-not-found.js";
 import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
 import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
-import { searchMailboxByMessageId } from "./message-move.js";
+import { searchMailboxForHighestMessageIdUid } from "./message-move.js";
 
 export interface MessageCopyDeps {
 	getClient: typeof getClient;
@@ -31,24 +32,9 @@ const defaultDeps: MessageCopyDeps = {
 	createConnectionScope: createConnectionScopeWithCredentials,
 };
 
-/**
- * Fallback when `MESSAGE_COPY_MAX_ATTEMPTS` is unset (local dev, unit tests).
- * Matches the `maxReceiveCount` the message queue's redrive policy uses
- * (`remit-messages.fifo`, `deploy/vps/queues.json`), same pattern as
- * `MESSAGE_MOVE_MAX_ATTEMPTS`.
- */
-const DEFAULT_MESSAGE_COPY_MAX_ATTEMPTS = 3;
-
 export const getMessageCopyMaxAttempts = (
 	processEnv: NodeJS.ProcessEnv = process.env,
-): number => {
-	const raw = processEnv.MESSAGE_COPY_MAX_ATTEMPTS;
-	if (!raw) return DEFAULT_MESSAGE_COPY_MAX_ATTEMPTS;
-	const parsed = Number.parseInt(raw, 10);
-	return Number.isFinite(parsed) && parsed > 0
-		? parsed
-		: DEFAULT_MESSAGE_COPY_MAX_ATTEMPTS;
-};
+): number => attemptBudget("MESSAGE_COPY_MAX_ATTEMPTS", 3, processEnv);
 
 export const MESSAGE_COPY_MAX_ATTEMPTS = getMessageCopyMaxAttempts();
 
@@ -202,11 +188,18 @@ export const handleMessageCopy = async (
 			// handle: a `guardConnectionCursor` wrap is bound to the SOURCE mailbox
 			// snapshot alone, and opening the destination through it trips that
 			// mailbox into a rebuild.
+			//
+			// This is the call site with no source-side gate to fall back on
+			// (#1122): a COPY leaves the source untouched, so nothing here can rule
+			// an older destination copy out the way `confirmTrashMoveUid` does. The
+			// fresh copy is the highest matching uid, and `deriveCopyMessageId`
+			// makes a repeated copy of the same message a second server COPY, so
+			// this probe must never bind to the earlier one.
 			const probeDestination = async (
 				connection: IImapConnection,
 			): Promise<CopyProbe> => {
 				if (!copyRow.messageIdHeader) return { kind: "unprobeable" };
-				const probedUid = await searchMailboxByMessageId(
+				const probedUid = await searchMailboxForHighestMessageIdUid(
 					connection,
 					destinationMailboxPath,
 					copyRow.messageIdHeader,

package/src/handlers/message-delete.test.ts

@@ -516,6 +516,30 @@ describe("handleMessageDelete", () => {
 			);
 		});
 
+		// Issue #1122. Trash already holds an older copy of this Message-ID (a
+		// resend, a sieve `fileinto` + `keep`, an earlier delete of another
+		// folder's copy). Settling on uid 12 points the row at that copy and
+		// orphans the one this MOVE just delivered: Empty Trash then expunges by
+		// the wrong uid and the fresh copy survives, unreachable.
+		it("settles on the copy this move delivered, not on an older copy already in Trash", async () => {
+			h.connection.moveMessages = async () => ({ uidMap: new Map() });
+			sourceNoLongerHoldsTheUid();
+			h.destinationSearchUids = [12, 77];
+
+			await handleMessageDelete(moveEvent, noopLog, 1, deps());
+
+			assert.deepEqual(called("message.updateUid")[0]?.args, [
+				"msg-1",
+				77,
+				"trash-mbx",
+			]);
+			assert.deepEqual(called("threadMessage.update")[0]?.args[2], {
+				uid: 77,
+				mailboxId: "trash-mbx",
+				isDeleted: true,
+			});
+		});
+
 		it("probes the DESTINATION mailbox, read-only, by Message-ID", async () => {
 			h.connection.moveMessages = async () => ({ uidMap: new Map() });
 			sourceNoLongerHoldsTheUid();
@@ -650,11 +674,11 @@ describe("handleMessageDelete", () => {
 			assert.equal(called("emitEvent").length, 0);
 		});
 
-		// `searchMailboxByMessageId` returns the LOWEST matching uid, and one
-		// Message-ID can have several server copies in one account while
+		// One Message-ID can have several server copies in one account while
 		// `deriveMessageId` gives them one local row. A source that still holds
 		// the uid proves the MOVE did not happen, so any hit at the destination
-		// is a different copy.
+		// is a different copy — including the highest one #1122 now takes, since
+		// with no fresh copy at all the highest match is still an older copy.
 		it("never takes a destination hit while the source still holds the uid (duplicate Message-ID)", async () => {
 			h.connection.moveMessages = async () => ({ uidMap: new Map() });
 			h.destinationSearchUids = [100];

package/src/handlers/message-delete.ts

@@ -14,6 +14,7 @@ import {
 	isMessageGoneFromOpenMailbox,
 	MailboxCursorPausedError,
 } from "@remit/mailbox-service";
+import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import { isAccountDeleted } from "../account-check.js";
 import { createConnectionScopeWithCredentials } from "../connection-scope.js";
 import { emitEvent } from "../emit.js";
@@ -22,30 +23,18 @@ import { isNotFoundError } from "../is-not-found.js";
 import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
 import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
 import { resolveExhaustedMessageDeleteFailure } from "./message-delete-terminal.js";
-import { emitMoveResync, searchMailboxByMessageId } from "./message-move.js";
+import {
+	emitMoveResync,
+	searchMailboxForHighestMessageIdUid,
+} from "./message-move.js";
 import {
 	buildThreadMessageMoveRevert,
 	buildThreadMessageTrashUpdate,
 } from "./thread-message-rows.js";
 
-/**
- * Fallback when `MESSAGE_DELETE_MAX_ATTEMPTS` is unset (local dev, unit tests).
- * Matches the `maxReceiveCount` the redrive policy of the queue `emit.ts`
- * routes MESSAGE_DELETE onto uses (`remit-message-mgmt`,
- * `deploy/vps/queues.json`), same pattern as `MESSAGE_MOVE_MAX_ATTEMPTS`.
- */
-const DEFAULT_MESSAGE_DELETE_MAX_ATTEMPTS = 3;
-
 export const getMessageDeleteMaxAttempts = (
 	processEnv: NodeJS.ProcessEnv = process.env,
-): number => {
-	const raw = processEnv.MESSAGE_DELETE_MAX_ATTEMPTS;
-	if (!raw) return DEFAULT_MESSAGE_DELETE_MAX_ATTEMPTS;
-	const parsed = Number.parseInt(raw, 10);
-	return Number.isFinite(parsed) && parsed > 0
-		? parsed
-		: DEFAULT_MESSAGE_DELETE_MAX_ATTEMPTS;
-};
+): number => attemptBudget("MESSAGE_DELETE_MAX_ATTEMPTS", 3, processEnv);
 
 export const MESSAGE_DELETE_MAX_ATTEMPTS = getMessageDeleteMaxAttempts();
 
@@ -84,14 +73,14 @@ export const deleteAllThreadMessagesForMessage = async (
  * never be opened through the source's guard.
  *
  * The source is asked first, and a source that still holds the uid ends it: the
- * MOVE did not happen, so nothing at the destination can be this message.
- * Skipping that question is not safe, because `searchMailboxByMessageId`
- * returns the LOWEST matching uid rather than the one that just arrived, and
- * one Message-ID can have several server copies in one account (a sieve
- * `fileinto` + `keep`, a multi-label store, a resend) while
- * `deriveMessageId` is folder-independent and gives them one local row. An
- * ungated probe can hand back an earlier copy's uid, and Empty Trash then
- * expunges by that uid. It also closes the second half of #912: an empty
+ * MOVE did not happen, so nothing at the destination can be this message. The
+ * gate survives #1122's switch to the highest matching uid and is not made
+ * redundant by it — highest picks the fresh copy out of several only once a
+ * fresh copy exists, and where the MOVE never ran every hit at the destination
+ * is an older copy of the same Message-ID (a sieve `fileinto` + `keep`, a
+ * multi-label store, a resend) that `deriveMessageId` folds into this one local
+ * row. An ungated probe hands back that copy's uid, and Empty Trash then
+ * expunges by it. The gate also closes the second half of #912: an empty
  * `uidMap` can mean the MOVE matched nothing at all.
  *
  * A row with no `messageIdHeader`, and a row that is already deleted, have
@@ -123,7 +112,7 @@ const confirmTrashMoveUid = async (
 	if (!message) return { outcome: "row-gone" };
 	if (!message.messageIdHeader) return { outcome: "unprobeable" };
 
-	const probedUid = await searchMailboxByMessageId(
+	const probedUid = await searchMailboxForHighestMessageIdUid(
 		destinationConnection,
 		destinationMailboxPath,
 		message.messageIdHeader,

package/src/handlers/message-move.test.ts

@@ -12,7 +12,7 @@ import {
 	handleMessageMove,
 	MESSAGE_MOVE_MAX_ATTEMPTS,
 	moveThenResync,
-	searchMailboxByMessageId,
+	searchMailboxForHighestMessageIdUid,
 } from "./message-move.js";
 
 const silentLogger = (() => {
@@ -343,7 +343,7 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 	});
 });
 
-describe("searchMailboxByMessageId — the probe that binds a move to a UID (#912)", () => {
+describe("searchMailboxForHighestMessageIdUid — the probe that binds a move to a UID (#912)", () => {
 	const isMessageIdCriterion = (
 		criterion: unknown,
 	): criterion is [string, string, string] =>
@@ -381,7 +381,7 @@ describe("searchMailboxByMessageId — the probe that binds a move to a UID (#91
 			},
 		} as unknown as IImapConnection;
 
-		await searchMailboxByMessageId(
+		await searchMailboxForHighestMessageIdUid(
 			destination,
 			"Archive",
 			'<a"b@example.com>\r\nUID 1',
@@ -392,14 +392,14 @@ describe("searchMailboxByMessageId — the probe that binds a move to a UID (#91
 		]);
 	});
 
-	it("answers null, not the lowest UID, when the folder holds no such message", async () => {
+	it("answers null, not another message's UID, when the folder holds no such message", async () => {
 		const destination = buildDestination([
 			{ uid: 11, messageIdHeader: "<stranger-a@example.com>" },
 			{ uid: 12, messageIdHeader: "<stranger-b@example.com>" },
 		]);
 
 		assert.strictEqual(
-			await searchMailboxByMessageId(
+			await searchMailboxForHighestMessageIdUid(
 				destination,
 				"Archive",
 				"<moved@example.com>",
@@ -415,7 +415,7 @@ describe("searchMailboxByMessageId — the probe that binds a move to a UID (#91
 		]);
 
 		assert.strictEqual(
-			await searchMailboxByMessageId(
+			await searchMailboxForHighestMessageIdUid(
 				destination,
 				"Archive",
 				"<moved@example.com>",
@@ -423,4 +423,43 @@ describe("searchMailboxByMessageId — the probe that binds a move to a UID (#91
 			12,
 		);
 	});
+
+	// Issue #1122. The folder already held an older copy of this Message-ID — a
+	// sieve `fileinto` + `keep`, a resend, an earlier copy of the same message —
+	// and the uid this probe hands back settles the row the fresh copy lives in.
+	// Answering 12 binds that row to mail this operation never touched and
+	// leaves the copy that just arrived unreachable by any later delete.
+	it("answers the newest copy's UID when the folder already held an older copy of it", async () => {
+		const destination = buildDestination([
+			{ uid: 12, messageIdHeader: "<moved@example.com>" },
+			{ uid: 40, messageIdHeader: "<moved@example.com>" },
+		]);
+
+		assert.strictEqual(
+			await searchMailboxForHighestMessageIdUid(
+				destination,
+				"Archive",
+				"<moved@example.com>",
+			),
+			40,
+		);
+	});
+
+	// RFC 3501 does not order a SEARCH response, so the fresh copy is the
+	// highest uid returned rather than the last one returned.
+	it("takes the highest match whatever order the server lists them in", async () => {
+		const destination = buildDestination([
+			{ uid: 40, messageIdHeader: "<moved@example.com>" },
+			{ uid: 12, messageIdHeader: "<moved@example.com>" },
+		]);
+
+		assert.strictEqual(
+			await searchMailboxForHighestMessageIdUid(
+				destination,
+				"Archive",
+				"<moved@example.com>",
+			),
+			40,
+		);
+	});
 });

package/src/handlers/message-move.ts

@@ -10,6 +10,7 @@ import {
 	isPlacementUnsettled,
 	MailboxCursorPausedError,
 } from "@remit/mailbox-service";
+import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import { isAccountDeleted } from "../account-check.js";
 import { createConnectionScopeWithCredentials } from "../connection-scope.js";
 import { emitEvent } from "../emit.js";
@@ -19,24 +20,9 @@ import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
 import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
 import { resolveExhaustedMessageMoveFailure } from "./message-move-terminal.js";
 
-/**
- * Fallback when `MESSAGE_MOVE_MAX_ATTEMPTS` is unset (local dev, unit tests).
- * Matches the `maxReceiveCount` the message queue's redrive policy uses
- * (`remit-messages.fifo`, `deploy/vps/queues.json`), same pattern as
- * `FLAG_PUSH_MAX_ATTEMPTS` and `PLACEMENT_MOVE_MAX_ATTEMPTS`.
- */
-const DEFAULT_MESSAGE_MOVE_MAX_ATTEMPTS = 3;
-
 export const getMessageMoveMaxAttempts = (
 	processEnv: NodeJS.ProcessEnv = process.env,
-): number => {
-	const raw = processEnv.MESSAGE_MOVE_MAX_ATTEMPTS;
-	if (!raw) return DEFAULT_MESSAGE_MOVE_MAX_ATTEMPTS;
-	const parsed = Number.parseInt(raw, 10);
-	return Number.isFinite(parsed) && parsed > 0
-		? parsed
-		: DEFAULT_MESSAGE_MOVE_MAX_ATTEMPTS;
-};
+): number => attemptBudget("MESSAGE_MOVE_MAX_ATTEMPTS", 3, processEnv);
 
 export const MESSAGE_MOVE_MAX_ATTEMPTS = getMessageMoveMaxAttempts();
 
@@ -67,11 +53,28 @@ export const emitMoveResync = async (
 };
 
 /**
- * SEARCH a mailbox for a message by its RFC822 Message-ID header. Read-only
- * (EXAMINE, not SELECT) — this is a verification probe, never a write.
- * Returns the first matching UID, or `null` if nothing matched.
+ * SEARCH a mailbox for copies of a message identified by its RFC822 Message-ID
+ * header and answer the HIGHEST matching uid. Read-only (EXAMINE, not SELECT) —
+ * this is a verification probe, never a write. `null` when nothing matched.
+ *
+ * The highest uid is the freshly delivered copy only when one exists; deciding
+ * that it does is the caller's job, not this function's. Every probe in this
+ * package wants the highest: uids ascend with arrival inside a UIDVALIDITY, so a
+ * copy that has just landed outranks every copy of the same Message-ID the
+ * folder already held. Where nothing was delivered, the highest is simply the
+ * newest pre-existing copy, and a caller that has not ruled that case out binds
+ * itself to unrelated mail.
+ * One Message-ID can have several server copies in one account (a sieve
+ * `fileinto` + `keep`, a resend, a repeated COPY — `deriveCopyMessageId` reuses
+ * the row, so the second copy is a second server COPY), while `deriveMessageId`
+ * is folder-independent and gives them one local row. Taking the lowest bound
+ * the fresh copy's row to an older copy's uid and orphaned the fresh one, which
+ * a later delete or Empty Trash then expunged by the wrong uid (issue #1122).
+ *
+ * The maximum is computed rather than read off the tail: RFC 3501 leaves the
+ * order of a SEARCH response unspecified, so "last returned" is not "highest".
  */
-export const searchMailboxByMessageId = async (
+export const searchMailboxForHighestMessageIdUid = async (
 	connection: IImapConnection,
 	mailboxPath: string,
 	messageIdHeader: string,
@@ -80,7 +83,8 @@ export const searchMailboxByMessageId = async (
 	const uids = await connection.search([
 		["HEADER", "Message-ID", messageIdHeader],
 	]);
-	return uids[0] ?? null;
+	if (uids.length === 0) return null;
+	return uids.reduce((highest, uid) => (uid > highest ? uid : highest));
 };
 
 /**
@@ -287,7 +291,7 @@ export const handleMessageMove = async (
 							const newUid =
 								result.uidMap.get(uid) ??
 								(message.messageIdHeader
-									? await searchMailboxByMessageId(
+									? await searchMailboxForHighestMessageIdUid(
 											rawConnection,
 											destinationMailboxPath,
 											message.messageIdHeader,

package/src/handlers/placement-move-push.test.ts

@@ -156,6 +156,28 @@ describe("attemptMove — the IMAP push (issue #1271)", () => {
 			assert.equal(outcome.newUid, 77);
 		});
 
+		// Issue #1122. The destination already held an older copy of this
+		// Message-ID; the marker must bind to the copy this MOVE delivered, or
+		// the placement row names mail this push never touched.
+		it("moved: binds to the newest copy when the destination already held an older one", async () => {
+			const connection = buildConnection({
+				uidMap: new Map(),
+				destinationSearchUids: [15, 77],
+			});
+
+			const outcome = await attemptMove(
+				connection,
+				connection,
+				"Junk",
+				"INBOX",
+				42,
+				MESSAGE_ID_HEADER,
+			);
+
+			assert.equal(outcome.kind, "moved");
+			assert.equal(outcome.newUid, 77);
+		});
+
 		it("throws (never deletes) when unconfirmed at the destination but STILL present at the source", async () => {
 			const connection = buildConnection({
 				uidMap: new Map(),

package/src/handlers/placement-move-push.ts

@@ -10,6 +10,7 @@ import {
 	reconcileStaleMessage,
 	resolveExhaustedPlacementMoveFailure,
 } from "@remit/mailbox-service";
+import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import { isAccountDeleted } from "../account-check.js";
 import { createConnectionScopeWithCredentials } from "../connection-scope.js";
 import { emitEvent } from "../emit.js";
@@ -20,27 +21,12 @@ import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
 import {
 	buildThreadMessageMoveUpdate,
 	emitMoveResync,
-	searchMailboxByMessageId,
+	searchMailboxForHighestMessageIdUid,
 } from "./message-move.js";
 
-/**
- * Fallback when `PLACEMENT_MOVE_MAX_ATTEMPTS` is unset (local dev, unit
- * tests). Matches the placement-move queue's own `MAX_RECEIVE_COUNT` default
- * (`infra/stacks/dev/stacks/remit-queue-stack.ts`), same pattern as
- * `BODY_SYNC_MAX_ATTEMPTS` (#1270).
- */
-const DEFAULT_PLACEMENT_MOVE_MAX_ATTEMPTS = 3;
-
 export const getPlacementMoveMaxAttempts = (
 	processEnv: NodeJS.ProcessEnv = process.env,
-): number => {
-	const raw = processEnv.PLACEMENT_MOVE_MAX_ATTEMPTS;
-	if (!raw) return DEFAULT_PLACEMENT_MOVE_MAX_ATTEMPTS;
-	const parsed = Number.parseInt(raw, 10);
-	return Number.isFinite(parsed) && parsed > 0
-		? parsed
-		: DEFAULT_PLACEMENT_MOVE_MAX_ATTEMPTS;
-};
+): number => attemptBudget("PLACEMENT_MOVE_MAX_ATTEMPTS", 3, processEnv);
 
 export const PLACEMENT_MOVE_MAX_ATTEMPTS = getPlacementMoveMaxAttempts();
 
@@ -111,9 +97,16 @@ export const attemptMove = async (
 	}
 
 	// Unconfirmed: either no COPYUID entry, or the server explicitly claimed
-	// "not found" — never trust either without independent verification.
+	// "not found" — never trust either without independent verification. A
+	// message this MOVE delivered is the newest copy of that Message-ID at the
+	// destination, so the probe binds to the highest matching uid (#1122).
+	// Unlike `confirmTrashMoveUid`, this probe is ungated: where the MOVE never
+	// ran and an older copy filed there earlier is the only match, the marker
+	// binds to that unrelated mail. Pre-existing, and not narrowed by taking the
+	// highest — the source is not asked first here, so nothing rules the case
+	// out.
 	if (messageIdHeader) {
-		const destinationUid = await searchMailboxByMessageId(
+		const destinationUid = await searchMailboxForHighestMessageIdUid(
 			destinationConnection,
 			destinationMailboxPath,
 			messageIdHeader,

package/src/handlers/sync-message-body.ts

@@ -11,6 +11,7 @@ import {
 	QuarantineService,
 	resolveExhaustedBodySyncFailures,
 } from "@remit/mailbox-service";
+import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import { env } from "expect-env";
 import { isAccountDeleted } from "../account-check.js";
 import { isBodySyncEnabled } from "../body-sync-gate.js";
@@ -27,37 +28,9 @@ import { workerVersion } from "../worker-version.js";
 
 const bodySyncEnabledParameterName = env.BODY_SYNC_ENABLED_PARAMETER_NAME;
 
-/**
- * Fallback when `BODY_SYNC_MAX_ATTEMPTS` is unset (local dev, unit tests).
- * Matches the body queue's own `MAX_RECEIVE_COUNT` default
- * (`infra/stacks/dev/stacks/remit-queue-stack.ts`) so an environment that
- * never injects the var still behaves like production.
- */
-const DEFAULT_BODY_SYNC_MAX_ATTEMPTS = 3;
-
-/**
- * Reads the redelivery-budget-exhaustion threshold. CDK derives
- * `BODY_SYNC_MAX_ATTEMPTS` from the body queue's own `MAX_RECEIVE_COUNT`
- * (`remit-worker-stack.ts`) so the two constants can't drift apart — a
- * hand-copied duplicate here previously risked the worker resolving
- * "last attempt" on a different delivery than the queue's redrive policy
- * actually uses (issue #1270). SQS's own `ApproximateReceiveCount` is the
- * source of truth for how many times a record has been delivered; once it
- * reaches this value, the current invocation is the last attempt before the
- * queue's own redrive would DLQ the record, so retry exhaustion is resolved
- * here (see `resolveExhaustedBodySyncFailures`) instead of letting the
- * record dead-letter with no diagnosis.
- */
 export const getBodySyncMaxAttempts = (
 	processEnv: NodeJS.ProcessEnv = process.env,
-): number => {
-	const raw = processEnv.BODY_SYNC_MAX_ATTEMPTS;
-	if (!raw) return DEFAULT_BODY_SYNC_MAX_ATTEMPTS;
-	const parsed = Number.parseInt(raw, 10);
-	return Number.isFinite(parsed) && parsed > 0
-		? parsed
-		: DEFAULT_BODY_SYNC_MAX_ATTEMPTS;
-};
+): number => attemptBudget("BODY_SYNC_MAX_ATTEMPTS", 3, processEnv);
 
 export const BODY_SYNC_MAX_ATTEMPTS = getBodySyncMaxAttempts();