@remit/imap-worker 0.0.68 → 0.0.69

package/src/handlers/message-delete.test.ts

@@ -271,6 +271,11 @@ interface Call {
 	args: unknown[];
 }
 
+interface LogLine {
+	level: string;
+	fields: Record<string, unknown>;
+}
+
 interface Connection {
 	openBox: (
 		path: string,
@@ -299,6 +304,11 @@ interface Harness {
 	threadMessageUpdateError?: Error;
 	messageRow: { messageIdHeader?: string } | undefined;
 	destinationSearchUids: number[];
+	// A Message-ID SEARCH is answered by whichever folder was opened last, so a
+	// case can put the same header in both. Default: the source still holds it,
+	// the destination does not.
+	sourceSearchUids: number[];
+	openBoxPath: string;
 	threadMessage: Record<string, unknown> | null;
 	allThreadMessages: Record<string, unknown>[];
 	getConnectionCount: number;
@@ -307,8 +317,33 @@ interface Harness {
 	// dropped connection is how the guarded openBox gets skipped on a delivery
 	// that still goes on to settle the row.
 	connectionErrors: Error[];
+	logs: LogLine[];
 }
 
+// The level a give-up is logged at is behaviour: a routine pause must not page
+// anyone, and the local rows going while the server copy survives must stay
+// readable whichever level it lands on.
+const capturingLog = (): Logger => {
+	const at =
+		(level: string) =>
+		(fields: Record<string, unknown>): void => {
+			h.logs.push({ level, fields });
+		};
+	const log = {
+		info: at("info"),
+		warn: at("warn"),
+		error: at("error"),
+		debug: at("debug"),
+		fatal: at("fatal"),
+		trace: at("trace"),
+		child: () => log,
+	} as unknown as Logger;
+	return log;
+};
+
+const loggedWith = (key: string, value: string): LogLine[] =>
+	h.logs.filter((line) => line.fields[key] === value);
+
 let h: Harness;
 
 const record =
@@ -328,7 +363,10 @@ const isMessageIdSearch = (criteria: unknown): boolean =>
 	criteria[0][0] === "HEADER";
 
 const buildConnection = (): Connection => ({
-	openBox: async () => ({ uidvalidity: 1 }),
+	openBox: async (path: string) => {
+		h.openBoxPath = path;
+		return { uidvalidity: 1 };
+	},
 	moveMessages: async () => ({ uidMap: new Map([[10, 20]]) }),
 	deleteMessages: record(
 		"connection.deleteMessages",
@@ -338,18 +376,28 @@ const buildConnection = (): Connection => ({
 	) as Connection["createMailbox"],
 	// The source box still holds the uid unless a case says otherwise, so the
 	// presence probe only reports "gone" where a test made it true.
-	fetchMessages: async (uids: number[]) => uids.map((uid) => ({ uid })),
+	fetchMessages: async (uids: number[]) => {
+		h.calls.push({ method: "connection.fetchMessages", args: [uids] });
+		return uids.map((uid) => ({ uid }));
+	},
 	search: async (...args: unknown[]) => {
 		h.calls.push({ method: "connection.search", args });
-		return isMessageIdSearch(args[0]) ? h.destinationSearchUids : [10];
+		if (!isMessageIdSearch(args[0])) return [10];
+		return h.openBoxPath === "INBOX"
+			? h.sourceSearchUids
+			: h.destinationSearchUids;
 	},
 });
 
 const sourceNoLongerHoldsTheUid = (): void => {
+	h.sourceSearchUids = [];
 	h.connection.fetchMessages = async () => [];
 	h.connection.search = async (...args: unknown[]) => {
 		h.calls.push({ method: "connection.search", args });
-		return isMessageIdSearch(args[0]) ? h.destinationSearchUids : [];
+		if (!isMessageIdSearch(args[0])) return [];
+		return h.openBoxPath === "INBOX"
+			? h.sourceSearchUids
+			: h.destinationSearchUids;
 	};
 };
 
@@ -359,6 +407,8 @@ const fresh = (): Harness => ({
 	mailbox: { mailboxId: "src-mbx", uidValidity: 1, cursorState: undefined },
 	messageRow: { messageIdHeader: MESSAGE_ID_HEADER },
 	destinationSearchUids: [],
+	sourceSearchUids: [10],
+	openBoxPath: "INBOX",
 	connection: buildConnection(),
 	threadMessage: {
 		...baseThreadMessage,
@@ -372,6 +422,7 @@ const fresh = (): Harness => ({
 	getConnectionCount: 0,
 	disconnectCount: 0,
 	connectionErrors: [],
+	logs: [],
 });
 
 const deps = (): MessageDeleteDeps =>
@@ -389,12 +440,16 @@ const deps = (): MessageDeleteDeps =>
 					return h.messageRow ? [h.messageRow] : [];
 				},
 				updateUid: record("message.updateUid"),
+				updateForMove: record("message.updateForMove"),
 				update: record("message.update"),
 				delete: record("message.delete"),
 			},
 			threadMessage: {
 				findByMessageId: async () => h.threadMessage,
-				findAllByMessageId: async () => h.allThreadMessages,
+				findAllByMessageId: async (...args: unknown[]) => {
+					h.calls.push({ method: "threadMessage.findAllByMessageId", args });
+					return h.allThreadMessages;
+				},
 				update: async (...args: unknown[]) => {
 					h.calls.push({ method: "threadMessage.update", args });
 					if (h.threadMessageUpdateError) throw h.threadMessageUpdateError;
@@ -459,6 +514,16 @@ const permanentEvent: MessageDeleteEvent = {
 const called = (method: string): Call[] =>
 	h.calls.filter((c) => c.method === method);
 
+// The one write that puts a given-up delete back on its source pair. It clears
+// `moving` in the same write as the pair, which is what keeps a later delete
+// from waiting on a mutation that has terminated (#1005), and it goes through
+// `updateForMove` rather than `updateUid` so a row that never moved does not
+// enqueue a search re-index.
+const restoredToSource = (syncStatus: string): unknown[] => [
+	"msg-1",
+	{ mailboxId: "src-mbx", uid: 10, status: "active", syncStatus },
+];
+
 // Label order in the rendered text is prom-client's, not ours.
 const imapFailures = async (operation: string): Promise<number> => {
 	const line = (await renderMetrics())
@@ -554,6 +619,7 @@ describe("handleMessageDelete", () => {
 			const opened: unknown[][] = [];
 			h.connection.openBox = (async (...args: unknown[]) => {
 				opened.push(args);
+				h.openBoxPath = args[0] as string;
 				return { uidvalidity: 1 };
 			}) as Connection["openBox"];
 
@@ -736,14 +802,13 @@ describe("handleMessageDelete", () => {
 			assert.equal(called("message.delete").length, 0);
 			assert.equal(called("threadMessage.deleteMany").length, 0);
 
-			// `mailboxId` and `uid` name the same message again, and `updateUid`
-			// settles `status` out of `moving` in the same write, so no later
-			// delete of this message waits on a mutation that has terminated.
-			assert.deepEqual(called("message.updateUid").at(-1)?.args, [
-				"msg-1",
-				10,
-				"src-mbx",
-			]);
+			// `mailboxId` and `uid` name the same message again, and the same write
+			// settles `status` out of `moving`, so no later delete of this message
+			// waits on a mutation that has terminated.
+			assert.deepEqual(
+				called("message.updateForMove").at(-1)?.args,
+				restoredToSource("synced"),
+			);
 			assert.equal(
 				called("message.update").length,
 				0,
@@ -842,11 +907,10 @@ describe("handleMessageDelete", () => {
 
 				await handleMessageDelete(moveEvent, noopLog, 3, deps());
 
-				assert.deepEqual(called("message.updateUid").at(-1)?.args, [
-					"msg-1",
-					10,
-					"src-mbx",
-				]);
+				assert.deepEqual(
+					called("message.updateForMove").at(-1)?.args,
+					restoredToSource("synced"),
+				);
 				assert.equal(await imapFailures("MESSAGE_DELETE_EXHAUSTED"), 1);
 			});
 		});
@@ -906,16 +970,12 @@ describe("handleMessageDelete", () => {
 
 			// The row goes back to the mailbox the server still holds it in, so
 			// the failure is visible as the message reappearing rather than as an
-			// invisible syncStatus on a row that claims Trash.
-			assert.deepEqual(called("message.updateUid")[0]?.args, [
-				"msg-1",
-				10,
-				"src-mbx",
-			]);
-			assert.deepEqual(called("message.update")[0]?.args[1], {
-				status: "active",
-				syncStatus: "failed",
-			});
+			// invisible syncStatus on a row that claims Trash. A refusal keeps
+			// `failed`: the product turned down something the user asked for.
+			assert.deepEqual(
+				called("message.updateForMove")[0]?.args,
+				restoredToSource("failed"),
+			);
 			assert.deepEqual(called("threadMessage.update")[0]?.args[2], {
 				uid: 10,
 				mailboxId: "src-mbx",
@@ -935,10 +995,10 @@ describe("handleMessageDelete", () => {
 
 		assert.equal(called("connection.deleteMessages").length, 0);
 		assert.equal(called("message.delete").length, 0);
-		assert.deepEqual(called("message.update")[0]?.args[1], {
-			status: "active",
-			syncStatus: "failed",
-		});
+		assert.deepEqual(
+			called("message.updateForMove")[0]?.args,
+			restoredToSource("failed"),
+		);
 	});
 
 	it("expunges on the server and removes every thread row before the message row", async () => {
@@ -1081,15 +1141,10 @@ describe("handleMessageDelete", () => {
 		await handleMessageDelete(moveEvent, noopLog, 1, deps());
 
 		assert.equal(called("connection.createMailbox").length, 0);
-		assert.deepEqual(called("message.updateUid")[0]?.args, [
-			"msg-1",
-			10,
-			"src-mbx",
-		]);
-		assert.deepEqual(called("message.update")[0]?.args[1], {
-			status: "active",
-			syncStatus: "failed",
-		});
+		assert.deepEqual(
+			called("message.updateForMove")[0]?.args,
+			restoredToSource("failed"),
+		);
 		assert.deepEqual(called("threadMessage.update")[0]?.args[2], {
 			uid: 10,
 			mailboxId: "src-mbx",
@@ -1107,11 +1162,10 @@ describe("handleMessageDelete", () => {
 
 		assert.equal(h.getConnectionCount, 0);
 		assert.equal(called("connection.deleteMessages").length, 0);
-		assert.deepEqual(called("message.updateUid")[0]?.args, [
-			"msg-1",
-			10,
-			"src-mbx",
-		]);
+		assert.deepEqual(
+			called("message.updateForMove")[0]?.args,
+			restoredToSource("failed"),
+		);
 		assert.deepEqual(called("threadMessage.update")[0]?.args[2], {
 			uid: 10,
 			mailboxId: "src-mbx",
@@ -1172,7 +1226,12 @@ describe("handleMessageDelete", () => {
 		);
 	});
 
-	it("pauses quietly when openBox trips a UIDVALIDITY mismatch", async () => {
+	// Issue #1203. The pause is thrown by the openBox guard before the MOVE is
+	// issued, so acking left the row `moving` on Trash with the source's uid.
+	// Nothing re-enqueues a MESSAGE_DELETE, and the cursor rebuild matches rows
+	// by `(accountConfigId, mailboxId)`, so a row naming Trash is in neither
+	// folder's set — the message stayed undeletable and unmovable for good.
+	it("hands the optimistic trash move back when openBox trips a UIDVALIDITY mismatch", async () => {
 		h.connection.openBox = async () => ({ uidvalidity: 999 });
 
 		await handleMessageDelete(moveEvent, noopLog, 1, deps());
@@ -1182,18 +1241,31 @@ describe("handleMessageDelete", () => {
 				?.cursorState,
 			"cursor_invalid",
 		);
-		assert.equal(called("message.updateUid").length, 0);
+		assert.deepEqual(
+			called("message.updateForMove")[0]?.args,
+			restoredToSource("synced"),
+			"the row goes back to the source pair, which is the set the rebuild adjudicates",
+		);
+		assert.equal(
+			(called("threadMessage.update")[0]?.args[2] as { isDeleted?: boolean })
+				?.isDeleted,
+			false,
+			"the listing rows lose the deletion mark the optimistic write put on them",
+		);
 	});
 
 	// The terminal resolver opens the source itself, and since #1005 its answer
 	// WRITES a placement. A folder deleted and recreated renumbers every uid, so
-	// an unguarded probe finds whatever now sits at this one, reads it as "still
+	// a uid-keyed probe finds whatever now sits at this one, reads it as "still
 	// at source", and binds the row to a stranger the next permanent delete
 	// expunges. The dropped connection is what makes it reachable: it skips the
 	// guarded openBox on the very delivery that goes on to settle.
-	it("never settles an exhausted delete off a probe that skipped the cursor guard", async () => {
+	it("never settles an exhausted delete off a uid-keyed probe that skipped the cursor guard", async () => {
 		h.connectionErrors = [new Error("ECONNRESET")];
-		h.connection.openBox = async () => ({ uidvalidity: 999 });
+		h.connection.openBox = async (path: string) => {
+			h.openBoxPath = path;
+			return { uidvalidity: 999 };
+		};
 
 		await handleMessageDelete(
 			moveEvent,
@@ -1203,14 +1275,14 @@ describe("handleMessageDelete", () => {
 		);
 
 		assert.equal(
-			called("message.updateUid").length,
+			called("connection.fetchMessages").length,
 			0,
-			"a renumbered folder answers for a different message; nothing settles off it",
+			"the guard refused the SELECT, so nothing was settled off a uid on the dead axis",
 		);
 		assert.equal(
 			called("message.delete").length,
 			0,
-			"and nothing is reconciled away off it either",
+			"a renumbered folder answers for a different message; nothing is reconciled away off it",
 		);
 		assert.equal(
 			(called("mailbox.update")[0]?.args[2] as { cursorState?: string })
@@ -1218,6 +1290,232 @@ describe("handleMessageDelete", () => {
 			"cursor_invalid",
 			"the probe trips the mailbox into a rebuild instead",
 		);
+		// Issue #1203: "leaving it for the cursor rebuild" was never an option —
+		// the rebuild matches rows by `(accountConfigId, mailboxId)`, so it only
+		// sees this row once the row names the source again. The source still
+		// answers to the Message-ID, so the pair the row goes back on is the one
+		// the server has just confirmed on the axis a UIDVALIDITY change leaves
+		// intact.
+		assert.deepEqual(
+			called("message.updateForMove")[0]?.args,
+			restoredToSource("synced"),
+		);
+	});
+
+	// Issue #1203, the redelivery half, and the mail-loss edge in it. INBOX was
+	// recreated (UIDVALIDITY bumped, which is why the cursor is paused), the
+	// MOVE never ran, and INBOX honestly answers "no" for the Message-ID because
+	// it no longer holds anything it used to. Trash holds an older copy of the
+	// same Message-ID at uid 77 — a sieve `fileinto` + `keep`, a resend — which
+	// `deriveMessageId` folds into this one local row. Settling `moved` on 77
+	// binds the row to that copy, and the next permanent delete expunges it:
+	// Trash is not paused, so no rebuild is ever coming to adjudicate there.
+	it("never settles a redelivered paused trash move as moved off a destination sighting", async () => {
+		h.mailbox = {
+			mailboxId: "src-mbx",
+			uidValidity: 1,
+			cursorState: "cursor_invalid",
+		};
+		h.sourceSearchUids = [];
+		h.destinationSearchUids = [77];
+
+		await handleMessageDelete(moveEvent, capturingLog(), 2, deps());
+
+		assert.equal(
+			called("message.updateUid").length,
+			0,
+			"a sighting off a source whose uid axis has moved is not proof this delete ran",
+		);
+		// The source pair is the set its own cursor rebuild walks and adjudicates
+		// by Message-ID, so handing the row back there is the reconcile path.
+		assert.deepEqual(
+			called("message.updateForMove")[0]?.args,
+			restoredToSource("failed"),
+		);
+		assert.equal(
+			loggedWith("alert", "message_delete_paused_placement_unproven").length,
+			1,
+			"a placement the server never settled is an operator's to adjudicate",
+		);
+	});
+
+	// Issue #1203 and the taxonomy `message-copy.ts` already applies: an
+	// evidence-free redelivery is broken, not settled. With no Message-ID header
+	// neither folder was asked, and silence is not an answer to write `synced`
+	// on. Route in: attempt 1 issues the MOVE, the confirmation comes back
+	// unprobeable, and the exhausted settle's guarded openBox trips the pause.
+	// `receiveCount === 1` there is not proof the command never left.
+	it("settles a paused delete broken when the MOVE was issued and neither folder can be asked", async () => {
+		h.connection.moveMessages = async () => ({ uidMap: new Map() });
+		sourceNoLongerHoldsTheUid();
+		h.messageRow = {};
+		let opened = 0;
+		h.connection.openBox = async (path: string) => {
+			h.openBoxPath = path;
+			opened += 1;
+			// The folder was recreated between the confirmation probe and the
+			// settle, which is what the terminal resolver's guarded openBox
+			// refuses to settle off.
+			return { uidvalidity: opened > 2 ? 999 : 1 };
+		};
+
+		await handleMessageDelete(moveEvent, capturingLog(), 1, deps());
+
+		assert.deepEqual(
+			called("message.updateForMove")[0]?.args,
+			restoredToSource("failed"),
+			"the first attempt reaches this settle with the MOVE already issued, so `synced` claims what nothing confirmed",
+		);
+		assert.equal(
+			loggedWith("alert", "message_delete_paused_placement_unproven").length,
+			1,
+		);
+	});
+
+	// The user's delete was silently dropped. Nothing throws, nothing alerts and
+	// the row reads settled, so the only trace it ever leaves is this metric —
+	// the counterpart of copy's `message_copy_not_landed`.
+	it("counts a paused delete the server was never told about", async () => {
+		h.mailbox = {
+			mailboxId: "src-mbx",
+			uidValidity: 1,
+			cursorState: "rebuilding",
+		};
+
+		await handleMessageDelete(moveEvent, capturingLog(), 1, deps());
+
+		const dropped = loggedWith("metric", "message_delete_dropped_on_pause");
+		assert.equal(dropped.length, 1);
+		assert.equal(dropped[0]?.level, "warn");
+		assert.deepEqual(
+			called("message.updateForMove")[0]?.args,
+			restoredToSource("synced"),
+		);
+	});
+
+	// The listing rows decide the outcome, so the caller has already read them.
+	// Reading them a second time inside `restoreSourcePlacement` is a query per
+	// hand-back for an answer already in hand.
+	it("reads the listing rows once per hand-back", async () => {
+		h.mailbox = {
+			mailboxId: "src-mbx",
+			uidValidity: 1,
+			cursorState: "rebuilding",
+		};
+
+		await handleMessageDelete(moveEvent, noopLog, 1, deps());
+
+		assert.equal(called("threadMessage.findAllByMessageId").length, 1);
+	});
+
+	// A permanent delete has no destination, so the resync was gated off
+	// entirely: `handBackDelete` removed the local row, nothing enqueued a
+	// SYNC_MESSAGES, and the mail was invisible until the next scheduled sync
+	// while the server still held it. One folder is all this event touches, and
+	// SYNC_MESSAGES on a paused mailbox routes to the cursor rebuild.
+	it("resyncs the source folder after a paused permanent delete removes the local rows", async () => {
+		h.mailbox = {
+			mailboxId: "src-mbx",
+			uidValidity: 1,
+			cursorState: "rebuilding",
+		};
+		h.allThreadMessages = [];
+
+		await handleMessageDelete(permanentEvent, capturingLog(), 1, deps());
+
+		assert.deepEqual(
+			called("emitEvent").map((c) => c.args[0]),
+			[{ type: "SYNC_MESSAGES", accountId: "acc-1", mailboxId: "src-mbx" }],
+			"the folder whose rows just went must be told to re-project them",
+		);
+	});
+
+	// The pause is the expected skip the guard doc calls never-a-fault, so it
+	// alerted on every routine paused permanent delete. The fact that local mail
+	// went while the server copy survived still has to be readable.
+	it("does not alert on a routine paused permanent delete", async () => {
+		h.mailbox = {
+			mailboxId: "src-mbx",
+			uidValidity: 1,
+			cursorState: "rebuilding",
+		};
+		h.allThreadMessages = [];
+
+		await handleMessageDelete(permanentEvent, capturingLog(), 1, deps());
+
+		assert.deepEqual(
+			h.logs.filter((line) => line.level === "error"),
+			[],
+			"a pause the guard expects never pages anyone",
+		);
+		const dropped = loggedWith("metric", "message_delete_dropped_on_pause");
+		assert.equal(dropped.length, 1);
+		assert.equal(
+			dropped[0]?.fields.localRowsRemoved,
+			true,
+			"local mail disappearing while the server still holds it stays visible",
+		);
+	});
+
+	// A refusal is not a pause: the product declined something the user asked
+	// for, and that still wakes someone.
+	it("keeps alerting when a refused delete removed the last listing rows", async () => {
+		h.allThreadMessages = [];
+		const unversioned = {
+			...permanentEvent,
+			schemaVersion: undefined,
+		} as unknown as MessageDeleteEvent;
+
+		await handleMessageDelete(unversioned, capturingLog(), 1, deps());
+
+		assert.equal(
+			loggedWith("alert", "message_delete_unknown_schema_version").length,
+			1,
+		);
+	});
+
+	// Issue #1122 on the same path. Trash already held an older copy of this
+	// Message-ID and the MOVE never ran, so the destination hit is not this
+	// message. The source is asked first for exactly this reason, and its answer
+	// ends it — settling on uid 12 would hand Empty Trash a stranger's uid.
+	it("never binds a redelivered paused trash move to an older copy while the source still answers", async () => {
+		h.mailbox = {
+			mailboxId: "src-mbx",
+			uidValidity: 1,
+			cursorState: "cursor_invalid",
+		};
+		h.sourceSearchUids = [4];
+		h.destinationSearchUids = [12];
+
+		await handleMessageDelete(moveEvent, noopLog, 2, deps());
+
+		assert.equal(called("message.updateUid").length, 0);
+		assert.deepEqual(
+			called("message.updateForMove")[0]?.args,
+			restoredToSource("synced"),
+		);
+	});
+
+	// A paused settle is a settle, so both folders re-read their counts from
+	// IMAP — the same resync every other terminal verdict in this handler runs.
+	// Without it the repair depended entirely on someone else arming the
+	// mailbox's rebuild.
+	it("resyncs both folders after a paused delete settles", async () => {
+		h.mailbox = {
+			mailboxId: "src-mbx",
+			uidValidity: 1,
+			cursorState: "rebuilding",
+		};
+
+		await handleMessageDelete(moveEvent, noopLog, 1, deps());
+
+		assert.deepEqual(
+			called("emitEvent").map((c) => c.args[0]),
+			[
+				{ type: "SYNC_MESSAGES", accountId: "acc-1", mailboxId: "src-mbx" },
+				{ type: "SYNC_MESSAGES", accountId: "acc-1", mailboxId: "trash-mbx" },
+			],
+		);
 	});
 
 	it("skips without opening a connection when the cursor is rebuilding", async () => {
@@ -1230,6 +1528,54 @@ describe("handleMessageDelete", () => {
 		await handleMessageDelete(moveEvent, noopLog, 1, deps());
 
 		assert.equal(h.getConnectionCount, 0);
+		assert.deepEqual(
+			called("message.updateForMove")[0]?.args,
+			restoredToSource("synced"),
+		);
+	});
+
+	// A permanent delete drops its listing rows at enqueue and only the sync
+	// path can shape them, so restoring the Message alone leaves mail nothing
+	// can list. The row is removed instead and the mailbox's own resync
+	// re-projects it — leaving it `deleting` made the message invisible locally
+	// while the server still held it (issue #1203). The rule is the listing
+	// rows, the same one `abandonDelete` resolves this state by, not the
+	// operation on the event.
+	it("removes a paused delete that has no listing rows left to restore", async () => {
+		h.mailbox = {
+			mailboxId: "src-mbx",
+			uidValidity: 1,
+			cursorState: "rebuilding",
+		};
+		h.allThreadMessages = [];
+
+		await handleMessageDelete(permanentEvent, noopLog, 1, deps());
+
+		assert.equal(h.getConnectionCount, 0);
+		assert.deepEqual(called("message.delete")[0]?.args, ["msg-1"]);
+		assert.equal(
+			called("message.updateForMove").length,
+			0,
+			"a row no listing can reach is never restored",
+		);
+	});
+
+	it("removes a paused move to trash whose listing rows are already gone", async () => {
+		h.mailbox = {
+			mailboxId: "src-mbx",
+			uidValidity: 1,
+			cursorState: "rebuilding",
+		};
+		h.allThreadMessages = [];
+
+		await handleMessageDelete(moveEvent, noopLog, 1, deps());
+
+		assert.deepEqual(called("message.delete")[0]?.args, ["msg-1"]);
+		assert.equal(
+			called("message.updateForMove").length,
+			0,
+			"restoring a Message no listing can reach is the silent vanish, not a hand-back",
+		);
 	});
 
 	it("acks terminally without connecting when the mailbox was deleted", async () => {