@remit/imap-worker 0.0.69 → 0.0.71

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/imap-worker",
-  "version": "0.0.69",
+  "version": "0.0.71",
   "type": "module",
   "main": "dist/index.js",
   "exports": {

package/src/handlers/append-sent-message.test.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { beforeEach, describe, it } from "node:test";
-import type { Logger } from "@remit/logger-lambda";
+import { noopLogger } from "@remit/logger-lambda/noop-logger";
 import type { AppendSentMessageEvent } from "../events.js";
 import {
 	APPEND_SENT_MAX_ATTEMPTS,
@@ -8,16 +8,6 @@ import {
 	handleAppendSentMessage,
 } from "./append-sent-message.js";
 
-const noopLog = {
-	info: () => {},
-	warn: () => {},
-	error: () => {},
-	debug: () => {},
-	fatal: () => {},
-	trace: () => {},
-	child: () => noopLog,
-} as unknown as Logger;
-
 interface Call {
 	method: string;
 	args: unknown[];
@@ -175,7 +165,7 @@ describe("handleAppendSentMessage", () => {
 	});
 
 	it("appends a seen RFC822 copy to the Sent folder and drops the outbox row", async () => {
-		await handleAppendSentMessage(event, noopLog, 1, deps());
+		await handleAppendSentMessage(event, noopLogger, 1, deps());
 
 		const append = called("connection.append")[0];
 		assert.equal(append?.args[0], "INBOX/Sent");
@@ -188,7 +178,7 @@ describe("handleAppendSentMessage", () => {
 	});
 
 	it("takes the draft's stored attachments with the row (#679)", async () => {
-		await handleAppendSentMessage(event, noopLog, 1, deps());
+		await handleAppendSentMessage(event, noopLogger, 1, deps());
 
 		// The row is the only reference to those objects. Sweeping has to happen
 		// here too, not only on a discard, or a sent message leaves its files
@@ -201,7 +191,7 @@ describe("handleAppendSentMessage", () => {
 	});
 
 	it("builds the message from the outbox row's own headers", async () => {
-		await handleAppendSentMessage(event, noopLog, 1, deps());
+		await handleAppendSentMessage(event, noopLogger, 1, deps());
 
 		const raw = String(called("connection.append")[0]?.args[1] as Buffer);
 		assert.match(raw, /^From: Alice <alice@example\.com>$/m);
@@ -216,7 +206,7 @@ describe("handleAppendSentMessage", () => {
 	it("uses a bare address when the outbox row carries no display name", async () => {
 		h.outbox = { ...h.outbox, fromName: undefined };
 
-		await handleAppendSentMessage(event, noopLog, 1, deps());
+		await handleAppendSentMessage(event, noopLogger, 1, deps());
 
 		const raw = String(called("connection.append")[0]?.args[1] as Buffer);
 		assert.match(raw, /^From: alice@example\.com$/m);
@@ -225,7 +215,7 @@ describe("handleAppendSentMessage", () => {
 	it("settles the row as unfiled when the account has no Sent folder at all", async () => {
 		h.sentMailbox = null;
 
-		await handleAppendSentMessage(event, noopLog, 1, deps());
+		await handleAppendSentMessage(event, noopLogger, 1, deps());
 
 		assert.equal(called("connection.append").length, 0);
 		assert.equal(called("outboxMessage.delete").length, 0);
@@ -243,7 +233,7 @@ describe("handleAppendSentMessage", () => {
 	it("skips the append while the outbox row is not yet sent", async () => {
 		h.outbox = { ...h.outbox, status: "pending" };
 
-		await handleAppendSentMessage(event, noopLog, 1, deps());
+		await handleAppendSentMessage(event, noopLogger, 1, deps());
 
 		assert.equal(called("connection.append").length, 0);
 		assert.equal(called("outboxMessage.delete").length, 0);
@@ -252,7 +242,7 @@ describe("handleAppendSentMessage", () => {
 	it("returns early without touching the outbox when the account is soft-deleted", async () => {
 		h.account = { ...h.account, deletedAt: Date.now() };
 
-		await handleAppendSentMessage(event, noopLog, 1, deps());
+		await handleAppendSentMessage(event, noopLogger, 1, deps());
 
 		assert.equal(called("connection.append").length, 0);
 		assert.equal(called("outboxMessage.delete").length, 0);
@@ -264,7 +254,7 @@ describe("handleAppendSentMessage", () => {
 		};
 
 		await assert.rejects(
-			handleAppendSentMessage(event, noopLog, 1, deps()),
+			handleAppendSentMessage(event, noopLogger, 1, deps()),
 			/server exploded/,
 		);
 
@@ -282,7 +272,7 @@ describe("handleAppendSentMessage", () => {
 
 		await handleAppendSentMessage(
 			event,
-			noopLog,
+			noopLogger,
 			APPEND_SENT_MAX_ATTEMPTS,
 			deps(),
 		);
@@ -301,7 +291,7 @@ describe("handleAppendSentMessage", () => {
 	it("settles the row as unfiled when a terminal auth failure acks the record", async () => {
 		h.ackWithoutWork = true;
 
-		await handleAppendSentMessage(event, noopLog, 1, deps());
+		await handleAppendSentMessage(event, noopLogger, 1, deps());
 
 		const patch = called("outboxMessage.update")[0]?.args[2] as {
 			status: string;
@@ -313,7 +303,7 @@ describe("handleAppendSentMessage", () => {
 
 	it("leaves the row alone when the APPEND landed but the delete did not", async () => {
 		await assert.rejects(
-			handleAppendSentMessage(event, noopLog, 1, depsWithFailingDelete()),
+			handleAppendSentMessage(event, noopLogger, 1, depsWithFailingDelete()),
 			/storage down/,
 		);
 
@@ -325,7 +315,7 @@ describe("handleAppendSentMessage", () => {
 	it("stops redelivering a landed APPEND at the budget instead of filing another copy", async () => {
 		await handleAppendSentMessage(
 			event,
-			noopLog,
+			noopLogger,
 			APPEND_SENT_MAX_ATTEMPTS,
 			depsWithFailingDelete(),
 		);
@@ -335,7 +325,7 @@ describe("handleAppendSentMessage", () => {
 	});
 
 	it("records the uid the APPEND produced before it deletes the row", async () => {
-		await handleAppendSentMessage(event, noopLog, 1, deps());
+		await handleAppendSentMessage(event, noopLogger, 1, deps());
 
 		// Order is the whole of it: a uid written after the delete is a uid a
 		// redelivery never sees, and the redelivery is what files the second copy.
@@ -352,7 +342,7 @@ describe("handleAppendSentMessage", () => {
 		// nothing, and "filed" still has to be told apart from "not filed".
 		h.append = async () => ({ uid: 0, uidValidity: 0 });
 
-		await handleAppendSentMessage(event, noopLog, 1, deps());
+		await handleAppendSentMessage(event, noopLogger, 1, deps());
 
 		assert.deepEqual(patches(), [{ appendedUid: -1 }]);
 		assert.equal(called("outboxMessage.delete").length, 1);
@@ -361,7 +351,7 @@ describe("handleAppendSentMessage", () => {
 	it("files nothing a second time when a redelivery finds a recorded uid (#858)", async () => {
 		h.outbox = { ...h.outbox, appendedUid: 55 };
 
-		await handleAppendSentMessage(event, noopLog, 1, deps());
+		await handleAppendSentMessage(event, noopLogger, 1, deps());
 
 		// The copy is already in the user's Sent folder. All this redelivery owes
 		// is the delete the last attempt could not make.
@@ -382,7 +372,7 @@ describe("handleAppendSentMessage", () => {
 		h.outbox = { ...h.outbox, appendedUid: 55 };
 
 		await assert.rejects(
-			handleAppendSentMessage(event, noopLog, 1, depsWithFailingDelete()),
+			handleAppendSentMessage(event, noopLogger, 1, depsWithFailingDelete()),
 			/storage down/,
 		);
 
@@ -392,7 +382,7 @@ describe("handleAppendSentMessage", () => {
 
 	it("keeps the row when the uid cannot be recorded", async () => {
 		await assert.rejects(
-			handleAppendSentMessage(event, noopLog, 1, depsWithFailingUpdate()),
+			handleAppendSentMessage(event, noopLogger, 1, depsWithFailingUpdate()),
 			/storage down/,
 		);
 
@@ -425,7 +415,7 @@ describe("handleAppendSentMessage", () => {
 			},
 		};
 
-		await handleAppendSentMessage(event, noopLog, 1, failing);
+		await handleAppendSentMessage(event, noopLogger, 1, failing);
 
 		assert.equal(called("connection.append").length, 0);
 		assert.deepEqual(patches(), []);
@@ -436,7 +426,7 @@ describe("handleAppendSentMessage", () => {
 
 		await handleAppendSentMessage(
 			event,
-			noopLog,
+			noopLogger,
 			APPEND_SENT_MAX_ATTEMPTS,
 			depsWithFailingDelete(),
 		);

package/src/handlers/delete-account-objects.test.ts

@@ -6,21 +6,11 @@ import {
 	S3Client,
 } from "@aws-sdk/client-s3";
 import { SendMessageCommand, SQSClient } from "@aws-sdk/client-sqs";
-import type { Logger } from "@remit/logger-lambda";
+import { noopLogger } from "@remit/logger-lambda/noop-logger";
 import { mockClient } from "aws-sdk-client-mock";
 import type { DeleteAccountObjectsEvent } from "../events.js";
 import { handleDeleteAccountObjects } from "./delete-account-objects.js";
 
-const noopLog = {
-	info: () => {},
-	warn: () => {},
-	error: () => {},
-	debug: () => {},
-	fatal: () => {},
-	trace: () => {},
-	child: () => noopLog,
-} as unknown as Logger;
-
 const s3Mock = mockClient(S3Client);
 const sqsMock = mockClient(SQSClient);
 
@@ -45,7 +35,7 @@ describe("handleDeleteAccountObjects", () => {
 		});
 		s3Mock.on(DeleteObjectsCommand).resolves({});
 
-		await handleDeleteAccountObjects(event, noopLog);
+		await handleDeleteAccountObjects(event, noopLogger);
 
 		const listCall = s3Mock.commandCalls(ListObjectsV2Command)[0];
 		assert.equal(listCall.args[0].input.Prefix, "accounts/cfg-1/");
@@ -72,7 +62,7 @@ describe("handleDeleteAccountObjects", () => {
 			});
 		s3Mock.on(DeleteObjectsCommand).resolves({});
 
-		await handleDeleteAccountObjects(event, noopLog);
+		await handleDeleteAccountObjects(event, noopLogger);
 
 		const listCalls = s3Mock.commandCalls(ListObjectsV2Command);
 		assert.equal(listCalls.length, 2);
@@ -83,7 +73,7 @@ describe("handleDeleteAccountObjects", () => {
 	it("skips the delete call when a page holds no keys", async () => {
 		s3Mock.on(ListObjectsV2Command).resolves({ IsTruncated: false });
 
-		await handleDeleteAccountObjects(event, noopLog);
+		await handleDeleteAccountObjects(event, noopLogger);
 
 		assert.equal(s3Mock.commandCalls(DeleteObjectsCommand).length, 0);
 	});
@@ -94,7 +84,7 @@ describe("handleDeleteAccountObjects", () => {
 
 		await handleDeleteAccountObjects(
 			{ ...event, continuationToken: "tok-mid" },
-			noopLog,
+			noopLogger,
 			() => 5_000,
 		);
 
@@ -119,7 +109,7 @@ describe("handleDeleteAccountObjects", () => {
 		});
 		s3Mock.on(DeleteObjectsCommand).resolves({});
 
-		await handleDeleteAccountObjects(event, noopLog, () => 120_000);
+		await handleDeleteAccountObjects(event, noopLogger, () => 120_000);
 
 		assert.equal(s3Mock.commandCalls(ListObjectsV2Command).length, 1);
 		assert.equal(sqsMock.commandCalls(SendMessageCommand).length, 0);

package/src/handlers/empty-trash.test.ts

@@ -1,20 +1,10 @@
 import assert from "node:assert/strict";
 import { beforeEach, describe, it } from "node:test";
 import type { RoleResolution } from "@remit/data-ports/folder-role";
-import type { Logger } from "@remit/logger-lambda";
+import { noopLogger } from "@remit/logger-lambda/noop-logger";
 import type { EmptyTrashEvent } from "../events.js";
 import { type EmptyTrashDeps, handleEmptyTrash } from "./empty-trash.js";
 
-const noopLog = {
-	info: () => {},
-	warn: () => {},
-	error: () => {},
-	debug: () => {},
-	fatal: () => {},
-	trace: () => {},
-	child: () => noopLog,
-} as unknown as Logger;
-
 interface Call {
 	method: string;
 	args: unknown[];
@@ -33,6 +23,10 @@ interface LocalMessage {
 	messageId: string;
 	uid: number;
 	status: string;
+	syncStatus?: string;
+	mailboxId?: string;
+	originalMailboxId?: string;
+	originalUid?: number;
 }
 
 type TrashMailbox = { mailboxId: string; fullPath: string };
@@ -77,6 +71,29 @@ const deleting = (messageId: string, uid: number): LocalMessage => ({
 	status: "deleting",
 });
 
+/** Mid-move into Trash: the folder is written, the uid is still the source's. */
+const movingIntoTrash = (messageId: string, uid: number): LocalMessage => ({
+	messageId,
+	uid,
+	status: "moving",
+	syncStatus: "pending",
+	mailboxId: "trash-mbx",
+	originalMailboxId: "inbox-mbx",
+	originalUid: uid,
+});
+
+/** The same row between a failed attempt and its redelivery. */
+const retryingIntoTrash = (messageId: string, uid: number): LocalMessage => ({
+	...movingIntoTrash(messageId, uid),
+	syncStatus: "failed",
+});
+
+/** The same row after an empty marked the folder, `status` overwritten. */
+const markedMidMove = (messageId: string, uid: number): LocalMessage => ({
+	...movingIntoTrash(messageId, uid),
+	status: "deleting",
+});
+
 const fresh = (): Harness => ({
 	calls: [],
 	account: { accountId: "acc-1", accountConfigId: "cfg-1" },
@@ -197,7 +214,7 @@ describe("handleEmptyTrash", () => {
 	});
 
 	it("expunges every server uid and both local rows for each trashed message", async () => {
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.deepEqual(called("connection.deleteMessages")[0]?.args, [[10, 11]]);
 		assert.deepEqual(
@@ -218,7 +235,7 @@ describe("handleEmptyTrash", () => {
 			{ messageId: "msg-late", uid: 12, status: "active" },
 		];
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.deepEqual(
 			called("message.delete").map((c) => c.args[0]),
@@ -232,7 +249,7 @@ describe("handleEmptyTrash", () => {
 		// exists anywhere, with nothing left to clear the mark.
 		h.connection.search = async () => [];
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.equal(called("connection.deleteMessages").length, 0);
 		assert.equal(called("message.delete").length, 0);
@@ -247,7 +264,7 @@ describe("handleEmptyTrash", () => {
 		h.localMessages = [deleting("msg-2", 11)];
 		h.connection.search = async () => [];
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.equal(called("message.delete").length, 0);
 		assert.deepEqual(revertedMessageIds(), ["msg-2"]);
@@ -261,7 +278,7 @@ describe("handleEmptyTrash", () => {
 		h.messagesWithoutListingRow = ["msg-expunging"];
 		h.connection.search = async () => [];
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.deepEqual(revertedMessageIds(), ["msg-1"]);
 	});
@@ -269,7 +286,7 @@ describe("handleEmptyTrash", () => {
 	it("deletes the message even when it has no thread row", async () => {
 		h.threadMessage = false;
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.equal(called("message.delete").length, 2);
 		assert.equal(called("threadMessage.delete").length, 0);
@@ -282,7 +299,7 @@ describe("handleEmptyTrash", () => {
 			deletedAt: Date.now(),
 		};
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.equal(h.getConnectionCount, 0);
 	});
@@ -290,7 +307,10 @@ describe("handleEmptyTrash", () => {
 	it("throws when the account no longer exists", async () => {
 		h.account = null;
 
-		await assert.rejects(handleEmptyTrash(event, noopLog, deps()), /not found/);
+		await assert.rejects(
+			handleEmptyTrash(event, noopLogger, deps()),
+			/not found/,
+		);
 	});
 
 	it("acks terminally without connecting when the Trash mailbox was deleted", async () => {
@@ -298,7 +318,7 @@ describe("handleEmptyTrash", () => {
 			name: "NotFoundError",
 		});
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.equal(h.getConnectionCount, 0);
 		assert.equal(called("message.delete").length, 0);
@@ -312,7 +332,7 @@ describe("handleEmptyTrash", () => {
 			trashMailboxPath: "Trash",
 		} as unknown as EmptyTrashEvent;
 
-		await handleEmptyTrash(unversioned, noopLog, deps());
+		await handleEmptyTrash(unversioned, noopLogger, deps());
 
 		assert.equal(h.getConnectionCount, 0, "no connection is ever opened");
 		assert.equal(called("connection.deleteMessages").length, 0);
@@ -326,7 +346,7 @@ describe("handleEmptyTrash", () => {
 			mailbox: { mailboxId: "other-mbx", fullPath: "INBOX/Bak" },
 		};
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.equal(h.getConnectionCount, 0);
 		assert.equal(called("connection.deleteMessages").length, 0);
@@ -339,7 +359,7 @@ describe("handleEmptyTrash", () => {
 			mailbox: { mailboxId: "trash-mbx", fullPath: "Trash" },
 		};
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.equal(called("connection.deleteMessages").length, 0);
 		assert.deepEqual(revertedMessageIds(), ["msg-1", "msg-2"]);
@@ -351,7 +371,7 @@ describe("handleEmptyTrash", () => {
 		h.connection.openBox = async () => ({ uidvalidity: 77 });
 		h.mailbox = { mailboxId: "trash-mbx", uidValidity: 77 };
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.equal(called("connection.deleteMessages").length, 0);
 		assert.deepEqual(revertedMessageIds(), ["msg-1", "msg-2"]);
@@ -367,7 +387,7 @@ describe("handleEmptyTrash", () => {
 		h.connection.openBox = async () => ({ uidvalidity: 77 });
 		h.mailbox = { mailboxId: "trash-mbx", uidValidity: 77 };
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.deepEqual(revertedMessageIds(), ["msg-1"]);
 		assert.deepEqual(undeletedThreadMessageIds(), ["tm-msg-1"]);
@@ -378,7 +398,7 @@ describe("handleEmptyTrash", () => {
 		// marked `deleting` hides healthy mail until the user notices.
 		h.connection.openBox = async () => ({ uidvalidity: 999 });
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.equal(
 			(called("mailbox.update")[0]?.args[2] as { cursorState?: string })
@@ -397,7 +417,7 @@ describe("handleEmptyTrash", () => {
 			cursorState: "rebuilding",
 		};
 
-		await handleEmptyTrash(event, noopLog, deps());
+		await handleEmptyTrash(event, noopLogger, deps());
 
 		assert.equal(h.getConnectionCount, 0);
 		assert.equal(called("message.delete").length, 0);
@@ -410,10 +430,121 @@ describe("handleEmptyTrash", () => {
 		};
 
 		await assert.rejects(
-			handleEmptyTrash(event, noopLog, deps()),
+			handleEmptyTrash(event, noopLogger, deps()),
 			/server exploded/,
 		);
 
 		assert.equal(h.disconnectCount, 1);
 	});
 });
+
+/**
+ * Issue #1217. The sweep matched every row the Trash listing returned against
+ * the expunged uids. A row whose move into Trash has not settled carries the
+ * SOURCE folder's uid, so that match answers for whatever Trash holds at that
+ * uid — a different message, whose Message and thread rows the sweep then
+ * deletes while the mail it named is still sitting in the folder it never left.
+ */
+describe("handleEmptyTrash and an unsettled placement", () => {
+	beforeEach(() => {
+		h = fresh();
+	});
+
+	it("deletes no row of a message whose move into Trash has not settled", async () => {
+		h.localMessages = [
+			deleting("msg-1", 10),
+			movingIntoTrash("msg-moving", 10),
+		];
+
+		await handleEmptyTrash(event, noopLogger, deps());
+
+		assert.deepEqual(
+			called("message.delete").map((c) => c.args[0]),
+			["msg-1"],
+			"uid 10 is msg-1's; the in-flight row only borrows it from the inbox",
+		);
+		assert.equal(called("threadMessage.delete").length, 1);
+	});
+
+	it("leaves a row whose move is mid-retry rather than sweeping it", async () => {
+		// `syncStatus: failed` under `status: moving` is an ordinary transient
+		// attempt about to be redelivered (`data-ports/message-settlement.ts`),
+		// not a give-up. Either way the pair is a lie while it stands, and the
+		// uid is somebody else's.
+		h.localMessages = [retryingIntoTrash("msg-retrying", 11)];
+
+		await handleEmptyTrash(event, noopLogger, deps());
+
+		assert.equal(called("message.delete").length, 0);
+		assert.equal(called("threadMessage.delete").length, 0);
+		assert.deepEqual(revertedMessageIds(), []);
+	});
+
+	it("hands back, rather than binds, a mid-move row an earlier mark rewrote", async () => {
+		// Defence in depth for the shape `emptyTrash` used to write: the mark
+		// overwrote `status` and the row reached here reading settled while its
+		// uid still belonged to the inbox. The uid is not bound — but the mark is
+		// cleared, because nothing else is coming to clear it and a row left
+		// `deleting` is hidden from every listing for good.
+		h.localMessages = [deleting("msg-1", 10), markedMidMove("msg-marked", 11)];
+
+		await handleEmptyTrash(event, noopLogger, deps());
+
+		assert.deepEqual(
+			called("message.delete").map((c) => c.args[0]),
+			["msg-1"],
+		);
+		assert.deepEqual(revertedMessageIds(), ["msg-marked"]);
+		assert.deepEqual(undeletedThreadMessageIds(), ["tm-msg-marked"]);
+	});
+
+	it("sweeps a settled row whose Trash uid matches the one it left behind", async () => {
+		// Two folders count uids independently, so a move can land on the same
+		// number it started from. `updateUid` drops `originalUid` when it settles,
+		// which is what keeps this row apart from one still mid-move — without it
+		// the sweep would expunge the message on the server and then refuse its
+		// rows, leaving mail that no longer exists hidden in Trash for good.
+		h.localMessages = [
+			{
+				messageId: "msg-collided",
+				uid: 10,
+				status: "deleting",
+				syncStatus: "pending",
+				mailboxId: "trash-mbx",
+				originalMailboxId: "inbox-mbx",
+			},
+		];
+
+		await handleEmptyTrash(event, noopLogger, deps());
+
+		assert.deepEqual(
+			called("message.delete").map((c) => c.args[0]),
+			["msg-collided"],
+		);
+		assert.deepEqual(revertedMessageIds(), []);
+	});
+
+	it("sweeps a settled row that reached Trash by a move", async () => {
+		// The confirmed pair: `updateUid` wrote Trash's own uid over the
+		// source's, leaving `originalUid` behind as history. Refusing this would
+		// leave the folder marked for a deletion that already happened.
+		h.localMessages = [
+			{
+				messageId: "msg-settled",
+				uid: 11,
+				status: "deleting",
+				syncStatus: "pending",
+				mailboxId: "trash-mbx",
+				originalMailboxId: "inbox-mbx",
+				originalUid: 42,
+			},
+		];
+
+		await handleEmptyTrash(event, noopLogger, deps());
+
+		assert.deepEqual(
+			called("message.delete").map((c) => c.args[0]),
+			["msg-settled"],
+		);
+	});
+});

package/src/handlers/empty-trash.ts

@@ -5,6 +5,7 @@ import { isCurrentSchemaVersion } from "@remit/data-ports/mutation-events";
 import { MessageStatus, MessageSyncStatus } from "@remit/domain-enums";
 import type { Logger } from "@remit/logger-lambda";
 import {
+	carriesForeignUid,
 	guardConnectionCursor,
 	isCursorRebuildNeeded,
 	MailboxCursorPausedError,
@@ -248,12 +249,29 @@ export const handleEmptyTrash = async (
 					const expunged = new Set(uids);
 					const localMessages =
 						await messageService.listAllByMailbox(trashMailboxId);
-					let deletedCount = 0;
 
-					for (const message of localMessages) {
-						if (!expunged.has(message.uid)) continue;
-						deletedCount += 1;
+					// Reconciles, never waits (imap-mutations R2). A row whose move
+					// into Trash has not settled names this folder while still
+					// carrying the SOURCE folder's uid, so matching it against the
+					// expunge answers for whatever Trash held at that uid — another
+					// message, deleted here in both its rows. Waiting is not open to
+					// this handler the way it is to the API-side mutators: every event
+					// of an account shares one FIFO group, so the move that would
+					// settle the row cannot run until this returns, and the ceiling
+					// would be spent to reach the same answer.
+					//
+					// `carriesForeignUid`, not the placement binding: the binding reads
+					// `status`, and `status` is exactly what an operation marking this
+					// folder overwrites. This is the second half of the gate
+					// `emptyTrash` applies before it marks anything.
+					const swept = localMessages.filter(
+						(message) =>
+							!carriesForeignUid(message) && expunged.has(message.uid),
+					);
+					const sweptIds = new Set(swept.map((message) => message.messageId));
+					const deletedCount = swept.length;
 
+					for (const message of swept) {
 						await messageService.delete(message.messageId);
 
 						const threadMessage = await threadMessageService.findByMessageId(
@@ -268,12 +286,16 @@ export const handleEmptyTrash = async (
 						}
 					}
 
-					// Everything the SEARCH did not name is still marked for a deletion
-					// that will never come: mail another client already emptied, mail
-					// that reached Trash after the SEARCH, or a redelivery finishing a
-					// partial sweep. All three must come back rather than sit invisible.
+					// Everything this sweep did not carry through is still marked for a
+					// deletion that will never come: mail another client already
+					// emptied, mail that reached Trash after the SEARCH, a redelivery
+					// finishing a partial sweep, and a row whose uid the sweep would
+					// not bind. All of them must come back rather than sit invisible —
+					// the last one especially, since nothing else is coming to clear
+					// its mark, and a row hidden in a folder it never left is worse
+					// than one the next sync re-projects.
 					const revertedCount = await handBackMarkedRows(
-						localMessages.filter((message) => !expunged.has(message.uid)),
+						localMessages.filter((message) => !sweptIds.has(message.messageId)),
 					);
 
 					log.info(