@remit/imap-worker 0.0.71 → 0.0.73

package/src/handlers/message-delete.ts

@@ -4,23 +4,29 @@ import type {
 	IThreadMessageRepository,
 	MessageItem,
 } from "@remit/data-ports";
+import { isNotFoundError } from "@remit/data-ports/errors";
 import { isCurrentSchemaVersion } from "@remit/data-ports/mutation-events";
-import { MessageSyncStatus } from "@remit/domain-enums";
+import {
+	MessageMutation,
+	MessageStatus,
+	MessageSyncStatus,
+} from "@remit/domain-enums";
 import type { Logger } from "@remit/logger-lambda";
 import { recordImapFailure } from "@remit/logger-lambda";
 import {
+	buildThreadMessageTrashUpdate,
 	guardConnectionCursor,
 	type IImapConnection,
 	isCursorRebuildNeeded,
 	isMessageGoneFromOpenMailbox,
 	MailboxCursorPausedError,
+	restoreSourcePlacement,
 } from "@remit/mailbox-service";
 import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import { isAccountDeleted } from "../account-check.js";
 import { createConnectionScopeWithCredentials } from "../connection-scope.js";
 import { emitEvent } from "../emit.js";
 import type { MessageDeleteEvent } from "../events.js";
-import { isNotFoundError } from "../is-not-found.js";
 import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
 import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
 import { resolveExhaustedMessageDeleteFailure } from "./message-delete-terminal.js";
@@ -31,8 +37,6 @@ import {
 	probePausedPlacement,
 	searchMailboxForHighestMessageIdUid,
 } from "./message-move.js";
-import { restoreSourcePlacement } from "./restore-source-placement.js";
-import { buildThreadMessageTrashUpdate } from "./thread-message-rows.js";
 
 export const getMessageDeleteMaxAttempts = (
 	processEnv: NodeJS.ProcessEnv = process.env,
@@ -196,6 +200,55 @@ export const handleMessageDelete = async (
 		return;
 	}
 
+	const [message] = await messageService.get([messageId]);
+
+	// The row is gone — a permanent delete that already ran, or a
+	// reconciliation path that removed it. Nothing left to delete; ack.
+	if (!message) {
+		log.warn(
+			{ accountId, messageId, operation },
+			"Skipping MESSAGE_DELETE: message row no longer exists",
+		);
+		return;
+	}
+
+	// This delete already settled. The guard asks for the state THIS delete
+	// wrote, the way MESSAGE_MOVE and MESSAGE_COPY ask for theirs: a move to
+	// Trash records `moving`, a permanent delete records `deleting`, and a row
+	// in the other one is a different mutation's work that this handler must
+	// not read as its own to finish.
+	//
+	// Without it a lost SQS acknowledgement re-runs the delete against a uid
+	// the source no longer holds, exhausts, and lets the terminal resolver
+	// read the source's honest "gone" as grounds to delete rows that are
+	// correct — taking spamReport, classificationState, category and the Undo
+	// target's `originalMailboxId` with them, none of which the resync
+	// re-projection can rebuild.
+	// An operation this build does not recognise gets no verdict here: it falls
+	// through to `abandonDelete` below, which is the designed refusal. Skipping
+	// it as "already settled" would swallow the very event the refusal exists to
+	// report.
+	const outstandingStatus =
+		operation === "move_to_trash"
+			? MessageStatus.moving
+			: operation === "permanent_delete"
+				? MessageStatus.deleting
+				: undefined;
+	if (outstandingStatus !== undefined && message.status !== outstandingStatus) {
+		log.info(
+			{
+				accountId,
+				messageId,
+				operation,
+				uid: message.uid,
+				status: message.status,
+				syncStatus: message.syncStatus,
+			},
+			"Skipping MESSAGE_DELETE: the row no longer carries the mutation this event was enqueued for",
+		);
+		return;
+	}
+
 	/**
 	 * Re-read the folders this delete touched. A move to trash has two; a
 	 * permanent delete has only the source, and it is owed one just as much —
@@ -271,6 +324,24 @@ export const handleMessageDelete = async (
 		}
 
 		if (localRowsRemoved) {
+			// Removing the Message row is destructive and unpredicated on its own,
+			// so it is claimed first: the row is transitioned to `deleted` from a
+			// placement this delete actually owns, and removed only if that claim
+			// wins (imap-mutations R3). A row nothing is deleting — an unrecognised
+			// operation reaches this refusal on whatever the row happens to be —
+			// is left where it is rather than destroyed on the way past.
+			const claimed = await messageService.transitionPlacement(
+				messageId,
+				{ status: [MessageStatus.moving, MessageStatus.deleting] },
+				{ status: MessageStatus.deleted },
+			);
+			if (!claimed) {
+				log.warn(
+					{ ...context, status: message.status },
+					"Delete given up with no listing rows left, and no delete outstanding on the row; the local row was left alone",
+				);
+				return;
+			}
 			await messageService.delete(messageId);
 			return;
 		}
@@ -283,6 +354,12 @@ export const handleMessageDelete = async (
 				sourceMailboxId: mailboxId,
 				uid,
 				syncStatus,
+				// Every hand-back this handler makes is a delete's, so the mutation
+				// follows the give-up rather than being passed in beside it.
+				abandonedMutation:
+					syncStatus === MessageSyncStatus.abandoned
+						? MessageMutation.delete
+						: MessageMutation.none,
 				threadMessages,
 			},
 		);
@@ -294,11 +371,12 @@ export const handleMessageDelete = async (
 	// "anything that is not move_to_trash is an expunge" inference is the same
 	// one that destroyed mail in the service, and an unrecoverable EXPUNGE is
 	// not a default. Abandoning hands the row back where the server still has
-	// it: an invisible `failed` on a row the user cannot see is the shape of
-	// the incident this whole change is about. The row keeps `failed`, because
-	// the product refused something the user asked for.
+	// it: an invisible failure on a row the user cannot see is the shape of the
+	// incident this whole change is about. The row carries `abandoned` — the
+	// give-up value, not the transient one a redelivery follows (R3) — because
+	// the product refused something the user asked for and nothing is coming.
 	const abandonDelete = (reason: string, alert: string): Promise<void> =>
-		handBackDelete(MessageSyncStatus.failed, { alert }, reason);
+		handBackDelete(MessageSyncStatus.abandoned, { alert }, reason);
 
 	const settleTrashMoveConfirmed = async (
 		newUid: number,
@@ -386,7 +464,7 @@ export const handleMessageDelete = async (
 
 		if (unproven) {
 			await handBackDelete(
-				MessageSyncStatus.failed,
+				MessageSyncStatus.abandoned,
 				{ alert: "message_delete_paused_placement_unproven" },
 				placement.kind === "at-destination"
 					? "the destination holds this Message-ID but the source's uid axis has moved, so the sighting does not prove this delete ran"
@@ -751,9 +829,11 @@ export const handleMessageDelete = async (
 						// Transient failure — connections drop. No alarm; redelivery
 						// retries, and `failed` marks the row unsettled meanwhile. It is
 						// not a terminal signal: only the resolver below settles anything.
-						await messageService.update(messageId, {
-							syncStatus: MessageSyncStatus.failed,
-						});
+						await messageService.transitionPlacement(
+							messageId,
+							{ status: [MessageStatus.moving, MessageStatus.deleting] },
+							{ syncStatus: MessageSyncStatus.failed },
+						);
 						throw error;
 					}
 

package/src/handlers/message-move-terminal.test.ts

@@ -4,6 +4,10 @@ import type {
 	IMessageRepository,
 	IThreadMessageRepository,
 } from "@remit/data-ports";
+import {
+	hasAbandonedDelete,
+	hasAbandonedMove,
+} from "@remit/data-ports/message-settlement";
 import {
 	type IImapConnection,
 	placementBindingOf,
@@ -75,8 +79,10 @@ interface ThreadRow {
  * The move's pending state IS the Message row, so these fakes hold real rows
  * and the assertions read the rows back — a resolver that settled the row on
  * anything but the server's own answer shows up here as a changed row, not as
- * an uncalled mock. `updateForMove` writes what the repository writes: whatever
- * fields the caller set, and nothing it left out.
+ * an uncalled mock. `transitionPlacement` honours its predicate the way the
+ * repository does: the write lands only while the row is still in one of the
+ * from-states the caller named (imap-mutations R3), and answers `undefined`
+ * otherwise.
  */
 const buildRepositories = (row: MessageRow) => {
 	const messages = new Map<string, MessageRow>([[row.messageId, row]]);
@@ -104,11 +110,21 @@ const buildRepositories = (row: MessageRow) => {
 				const current = messages.get(messageId);
 				if (current) messages.set(messageId, { ...current, ...input });
 			},
-			updateForMove: async (messageId: string, set: Partial<MessageRow>) => {
+			transitionPlacement: async (
+				messageId: string,
+				expected: { status?: string[] },
+				next: Partial<MessageRow>,
+			) => {
 				const current = messages.get(messageId);
-				if (current) messages.set(messageId, { ...current, ...set });
+				if (!current) return undefined;
+				if (expected.status && !expected.status.includes(current.status)) {
+					return undefined;
+				}
+				const written = { ...current, ...next };
+				messages.set(messageId, written);
+				return written;
 			},
-		} as unknown as Pick<IMessageRepository, "delete" | "updateForMove">,
+		} as unknown as Pick<IMessageRepository, "delete" | "transitionPlacement">,
 		threadMessageService: {
 			findAllByMessageId: async () => [...threadMessages.values()],
 			deleteMany: async (
@@ -204,9 +220,42 @@ describe("resolveExhaustedMessageMoveFailure — the two terminal outcomes (issu
 		assert.ok(errors.some((e) => e.obj.alert === "message_move_failed"));
 	});
 
+	// Issue #1153: before the give-up had a value of its own, this row settled
+	// on `synced` and read exactly like a move that never happened — nothing on
+	// it said "the move you asked for is not coming". #1229 is why it also has
+	// to say WHICH mutation: a hand-back clears `status`, and `status` was the
+	// only field naming one.
+	it("BROKEN: the row says a move gave up, and says it was a move", async () => {
+		const repos = buildRepositories(pendingMoveRow());
+		const { log } = buildLogger();
+		const deps: ResolveExhaustedMessageMoveDeps = {
+			messageService: repos.messageService,
+			threadMessageService: repos.threadMessageService,
+			log,
+		};
+
+		await resolveExhaustedMessageMoveFailure(deps, {
+			...input,
+			getConnection: async () => buildConnection(new Set([101])),
+		});
+
+		const settled = repos.messages.get("msg-1") as unknown as {
+			syncStatus: string;
+			abandonedMutation: string;
+		};
+		assert.equal(settled.syncStatus, "abandoned");
+		assert.equal(settled.abandonedMutation, "move");
+		assert.equal(
+			hasAbandonedDelete(settled as never),
+			false,
+			"and never reads as a delete that gave up",
+		);
+		assert.equal(hasAbandonedMove(settled as never), true);
+	});
+
 	// Issue #1005: a give-up that never writes `status` leaves the row naming
-	// the destination with the source's uid — a pair `bindsForeignUid` refuses,
-	// which made the message undeletable and unmovable for good.
+	// the destination with the source's uid — a pair every dependent mutation
+	// refuses, which made the message undeletable and unmovable for good.
 	it("BROKEN: the settled row is no longer refused by the placement guard (#1005)", async () => {
 		const repos = buildRepositories(pendingMoveRow());
 		const { log } = buildLogger();
@@ -218,8 +267,8 @@ describe("resolveExhaustedMessageMoveFailure — the two terminal outcomes (issu
 
 		assert.equal(
 			placementBindingOf(pendingMoveRow() as never),
-			"abandoned",
-			"the row starts in the state the delete route refuses as unverified",
+			"in_flight",
+			"the row starts on a pair the delete route will not act on",
 		);
 
 		await resolveExhaustedMessageMoveFailure(deps, {
@@ -257,21 +306,17 @@ describe("resolveExhaustedMessageMoveFailure — the two terminal outcomes (issu
 	});
 
 	// The resolver's contract is that it is never re-thrown, so the caller can
-	// ack the record and emit its resync. A row another path deleted while the
-	// probe was in flight has nothing left to restore, and the same NotFound
-	// wraps an ElectroDB composites miss on the listing row.
-	it("BROKEN: a row deleted underneath the probe settles instead of throwing", async () => {
+	// ack the record and emit its resync. A row another path deleted or settled
+	// while the probe was in flight has nothing left to restore, and it loses
+	// the transition's predicate rather than raising; a NotFound still wraps an
+	// ElectroDB composites miss on the listing row.
+	it("BROKEN: a row settled underneath the probe loses the predicate instead of throwing", async () => {
 		const repos = buildRepositories(pendingMoveRow());
-		const notFound = Object.assign(new Error("Message not found: msg-1"), {
-			name: "NotFoundError",
-		});
 		const { log } = buildLogger();
 		const deps: ResolveExhaustedMessageMoveDeps = {
 			messageService: {
 				...repos.messageService,
-				updateForMove: async () => {
-					throw notFound;
-				},
+				transitionPlacement: async () => undefined,
 			} as unknown as ResolveExhaustedMessageMoveDeps["messageService"],
 			threadMessageService: repos.threadMessageService,
 			log,
@@ -320,7 +365,7 @@ describe("resolveExhaustedMessageMoveFailure — the two terminal outcomes (issu
 		const deps: ResolveExhaustedMessageMoveDeps = {
 			messageService: {
 				...repos.messageService,
-				updateForMove: async () => {
+				transitionPlacement: async () => {
 					throw new Error("ProvisionedThroughputExceeded");
 				},
 			} as unknown as ResolveExhaustedMessageMoveDeps["messageService"],

package/src/handlers/message-move-terminal.ts

@@ -2,14 +2,14 @@ import type {
 	IMessageRepository,
 	IThreadMessageRepository,
 } from "@remit/data-ports";
-import { MessageSyncStatus } from "@remit/domain-enums";
+import { MessageMutation, MessageSyncStatus } from "@remit/domain-enums";
 import {
 	type IImapConnection,
 	isMessageGoneFromOpenMailbox,
 	reconcileStaleMessage,
+	restoreSourcePlacement,
 	type StaleMessageReconcileDeps,
 } from "@remit/mailbox-service";
-import { restoreSourcePlacement } from "./restore-source-placement.js";
 
 export interface MessageMoveTerminalLogger {
 	info(obj: Record<string, unknown>, msg: string): void;
@@ -18,7 +18,7 @@ export interface MessageMoveTerminalLogger {
 
 export interface ResolveExhaustedMessageMoveDeps
 	extends StaleMessageReconcileDeps {
-	messageService: Pick<IMessageRepository, "delete" | "updateForMove">;
+	messageService: Pick<IMessageRepository, "delete" | "transitionPlacement">;
 	threadMessageService: Pick<
 		IThreadMessageRepository,
 		"findAllByMessageId" | "deleteMany" | "update"
@@ -149,9 +149,13 @@ export const resolveExhaustedMessageMoveFailure = async (
 		sourceMailboxId,
 		uid,
 		// The probe above just confirmed the pair, so the row is a faithful
-		// projection of the source again. The move's own failure is the alert, not
-		// a `failed` left on a row nothing is still trying to move.
-		syncStatus: MessageSyncStatus.synced,
+		// projection of the source again — and the move the user asked for did
+		// not happen, with nothing left to try it. `abandoned` is the value that
+		// says so without claiming a retry is coming (imap-mutations R3); the
+		// alert stays for the operator, and the mutation names itself so the
+		// reading pane offers the right way out (issue #1229).
+		syncStatus: MessageSyncStatus.abandoned,
+		abandonedMutation: MessageMutation.move,
 	});
 
 	return { outcome: "broken" };

package/src/handlers/message-move.test.ts

@@ -277,7 +277,7 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 				get: async () => [],
 				update: async () => undefined,
 				updateUid: async () => undefined,
-				updateForMove: async () => undefined,
+				transitionPlacement: async () => undefined,
 			},
 			threadMessage: {
 				findAllByMessageId: async () => [],
@@ -410,7 +410,7 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 	const arrangePausedMove = async (
 		options: { probeable: boolean } = { probeable: true },
 	): Promise<{
-		updateForMoveCalls: unknown[][];
+		transitionCalls: unknown[][];
 		updateUidCalls: unknown[][];
 		threadUpdateCalls: unknown[][];
 	}> => {
@@ -424,10 +424,15 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 			},
 		]);
 		mock.method(client.mailbox, "get", async () => pausedSource());
-		const updateForMoveCalls: unknown[][] = [];
-		mock.method(client.message, "updateForMove", async (...args: unknown[]) => {
-			updateForMoveCalls.push(args);
-		});
+		const transitionCalls: unknown[][] = [];
+		mock.method(
+			client.message,
+			"transitionPlacement",
+			async (...args: unknown[]) => {
+				transitionCalls.push(args);
+				return { messageId: "mm-msg-zzz" };
+			},
+		);
 		const updateUidCalls: unknown[][] = [];
 		mock.method(client.message, "updateUid", async (...args: unknown[]) => {
 			updateUidCalls.push(args);
@@ -446,7 +451,7 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 		mock.method(client.threadMessage, "update", async (...args: unknown[]) => {
 			threadUpdateCalls.push(args);
 		});
-		return { updateForMoveCalls, updateUidCalls, threadUpdateCalls };
+		return { transitionCalls, updateUidCalls, threadUpdateCalls };
 	};
 
 	// Issue #1203. Acking a paused cursor left the row `moving` with `mailboxId`
@@ -456,7 +461,7 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 	// neither folder's set: `placementBindingOf` answered `in_flight` for good
 	// and the message became unmovable and undeletable.
 	it("hands the row back to its source on a first delivery, without connecting", async () => {
-		const { updateForMoveCalls, threadUpdateCalls } = await arrangePausedMove();
+		const { transitionCalls, threadUpdateCalls } = await arrangePausedMove();
 
 		await handleMessageMove(event, silentLogger, 1, moveDeps());
 
@@ -466,14 +471,16 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 			"a first delivery has provably issued no MOVE, so it needs no answer from the server",
 		);
 		assert.deepEqual(
-			updateForMoveCalls[0],
+			transitionCalls[0],
 			[
 				"mm-msg-zzz",
+				{ status: ["moving", "deleting"] },
 				{
 					mailboxId: "mm-src-zzz",
 					uid: 10,
 					status: "active",
 					syncStatus: "synced",
+					abandonedMutation: "none",
 				},
 			],
 			"the row goes back to the source pair, which is the set the rebuild adjudicates",
@@ -509,7 +516,7 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 	// binds the row to that copy, and the next permanent delete expunges it:
 	// Archive is not paused, so no rebuild is ever coming to adjudicate there.
 	it("never settles a redelivered paused move as moved off a destination sighting", async () => {
-		const { updateForMoveCalls, updateUidCalls } = await arrangePausedMove();
+		const { transitionCalls, updateUidCalls } = await arrangePausedMove();
 
 		await handleMessageMove(
 			event,
@@ -525,11 +532,12 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 		);
 		// The source pair is the set its own cursor rebuild walks and adjudicates
 		// by Message-ID, so handing the row back there is the reconcile path.
-		assert.deepEqual(updateForMoveCalls[0]?.[1], {
+		assert.deepEqual(transitionCalls[0]?.[2], {
 			mailboxId: "mm-src-zzz",
 			uid: 10,
 			status: "active",
-			syncStatus: "failed",
+			syncStatus: "abandoned",
+			abandonedMutation: "move",
 		});
 		assert.equal(
 			logLines.filter(
@@ -545,7 +553,7 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 	// redelivery is broken, not settled. With no Message-ID header neither
 	// folder was asked, and silence is not an answer to write `synced` on.
 	it("settles a redelivered paused move broken when neither folder can be asked", async () => {
-		const { updateForMoveCalls } = await arrangePausedMove({
+		const { transitionCalls } = await arrangePausedMove({
 			probeable: false,
 		});
 
@@ -557,8 +565,8 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 		);
 
 		assert.equal(
-			(updateForMoveCalls[0]?.[1] as { syncStatus?: string })?.syncStatus,
-			"failed",
+			(transitionCalls[0]?.[2] as { syncStatus?: string })?.syncStatus,
+			"abandoned",
 		);
 		assert.equal(
 			logLines.filter(
@@ -589,7 +597,7 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 	// this message. The source is asked first for exactly that reason, and its
 	// answer ends it.
 	it("never binds a redelivered paused move to an older copy while the source still answers", async () => {
-		const { updateForMoveCalls, updateUidCalls } = await arrangePausedMove();
+		const { transitionCalls, updateUidCalls } = await arrangePausedMove();
 
 		await handleMessageMove(
 			event,
@@ -599,11 +607,12 @@ describe("handleMessageMove — the move's own pending state gates every attempt
 		);
 
 		assert.equal(updateUidCalls.length, 0);
-		assert.deepEqual(updateForMoveCalls[0]?.[1], {
+		assert.deepEqual(transitionCalls[0]?.[2], {
 			mailboxId: "mm-src-zzz",
 			uid: 10,
 			status: "active",
 			syncStatus: "synced",
+			abandonedMutation: "none",
 		});
 	});
 

package/src/handlers/message-move.ts

@@ -1,25 +1,28 @@
 import { getClient } from "@remit/backend/client";
 import type { MessageItem, ThreadMessageItem } from "@remit/data-ports";
-import { MessageSyncStatus } from "@remit/domain-enums";
+import { isNotFoundError } from "@remit/data-ports/errors";
+import {
+	MessageMutation,
+	MessageStatus,
+	MessageSyncStatus,
+} from "@remit/domain-enums";
 import type { Logger } from "@remit/logger-lambda";
 import { recordImapFailure } from "@remit/logger-lambda";
 import {
 	guardConnectionCursor,
 	type IImapConnection,
 	isCursorRebuildNeeded,
-	isPlacementUnsettled,
 	MailboxCursorPausedError,
+	restoreSourcePlacement,
 } from "@remit/mailbox-service";
 import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import { isAccountDeleted } from "../account-check.js";
 import { createConnectionScopeWithCredentials } from "../connection-scope.js";
 import { emitEvent } from "../emit.js";
 import type { MessageMoveEvent, SyncMessagesEvent } from "../events.js";
-import { isNotFoundError } from "../is-not-found.js";
 import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
 import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
 import { resolveExhaustedMessageMoveFailure } from "./message-move-terminal.js";
-import { restoreSourcePlacement } from "./restore-source-placement.js";
 
 export const getMessageMoveMaxAttempts = (
 	processEnv: NodeJS.ProcessEnv = process.env,
@@ -323,7 +326,12 @@ export const handleMessageMove = async (
 	// "gone" as grounds to reconcile away a row that is correct. There is no
 	// marker to find missing (unlike FLAG_PUSH and PLACEMENT_MOVE_PUSH), so the
 	// row's own pending marker is what stands in for one.
-	if (!isPlacementUnsettled(message)) {
+	//
+	// `moving` specifically, not the shared unsettled predicate: the question is
+	// whether THIS move is still outstanding, and a row a delete has since
+	// claimed is `deleting` — work that belongs to MESSAGE_DELETE, and a state
+	// this move must not read as its own to finish.
+	if (message.status !== MessageStatus.moving) {
 		log.info(
 			{ accountId, messageId, uid: message.uid, status: message.status },
 			"Skipping MESSAGE_MOVE: the move already settled against confirmed IMAP state",
@@ -430,6 +438,13 @@ export const handleMessageMove = async (
 						sourceMailboxId,
 						uid,
 						syncStatus,
+						// Every hand-back this handler makes is a move's. Naming it on
+						// the row is what stops the reading pane calling a move that
+						// gave up a failed delete (issue #1229).
+						abandonedMutation:
+							syncStatus === MessageSyncStatus.abandoned
+								? MessageMutation.move
+								: MessageMutation.none,
 					},
 				);
 			};
@@ -451,7 +466,7 @@ export const handleMessageMove = async (
 					mailbox,
 				);
 
-			// A paused cursor is never acked on the optimistic row: `updateForMove`
+			// A paused cursor is never acked on the optimistic row: the transition
 			// has pointed it at the destination while `uid` still names the source,
 			// and that pair strands the row for good — the cursor rebuild matches
 			// rows by `(accountConfigId, mailboxId)`, so a row naming the
@@ -499,7 +514,7 @@ export const handleMessageMove = async (
 
 				if (unproven) {
 					await handBackToSource(
-						MessageSyncStatus.failed,
+						MessageSyncStatus.abandoned,
 						{ alert: "message_move_paused_placement_unproven" },
 						placement.kind === "at-destination"
 							? "destination holds this Message-ID but the source's uid axis has moved, so the sighting does not prove this move ran"
@@ -637,9 +652,11 @@ export const handleMessageMove = async (
 						// alarm; queue redelivery retries, and `failed` marks the row
 						// as unsettled meanwhile. It is not a terminal signal: only the
 						// resolver below settles anything.
-						await messageService.update(messageId, {
-							syncStatus: MessageSyncStatus.failed,
-						});
+						await messageService.transitionPlacement(
+							messageId,
+							{ status: MessageStatus.moving },
+							{ syncStatus: MessageSyncStatus.failed },
+						);
 						throw error;
 					}
 

package/src/handlers/placement-move-push.ts

@@ -1,4 +1,5 @@
 import { getClient } from "@remit/backend/client";
+import { isNotFoundError } from "@remit/data-ports/errors";
 import type { Logger } from "@remit/logger-lambda";
 import { recordImapFailure } from "@remit/logger-lambda";
 import {
@@ -15,7 +16,6 @@ import { isAccountDeleted } from "../account-check.js";
 import { createConnectionScopeWithCredentials } from "../connection-scope.js";
 import { emitEvent } from "../emit.js";
 import type { PlacementMovePushEvent } from "../events.js";
-import { isNotFoundError } from "../is-not-found.js";
 import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
 import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
 import {
@@ -399,6 +399,7 @@ export const handlePlacementMovePush = async (
 							accountConfigId,
 							messageId,
 							uid: message.uid,
+							sourceMailboxId: marker.sourceMailboxId,
 							sourceMailboxPath: sourceMailbox.fullPath,
 							getConnection: scope.getConnection,
 						},

package/src/handlers/sync-message-body.ts

@@ -1,4 +1,5 @@
 import { getClient } from "@remit/backend/client";
+import { isNotFoundError } from "@remit/data-ports/errors";
 import type { Logger } from "@remit/logger-lambda";
 import { recordImapFailure } from "@remit/logger-lambda";
 import {
@@ -11,6 +12,7 @@ import {
 	QuarantineService,
 	resolveExhaustedBodySyncFailures,
 } from "@remit/mailbox-service";
+import { buildFilterConfig } from "@remit/mailbox-service/filter-config";
 import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import { env } from "expect-env";
 import { isAccountDeleted } from "../account-check.js";
@@ -20,8 +22,6 @@ import {
 	createConnectionScopeWithCredentials,
 } from "../connection-scope.js";
 import type { SyncMessageBodyEvent } from "../events.js";
-import { buildFilterConfig } from "../filter-config.js";
-import { isNotFoundError } from "../is-not-found.js";
 import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
 import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
 import { workerVersion } from "../worker-version.js";

package/src/handlers/sync-messages.ts

@@ -13,6 +13,7 @@ import type {
 	IThreadMessageRepository,
 	IUnitOfWork,
 } from "@remit/data-ports";
+import { isNotFoundError } from "@remit/data-ports/errors";
 import { SyncPhase } from "@remit/domain-enums";
 import { type Logger, recordImapFailure } from "@remit/logger-lambda";
 import { RefreshTokenError } from "@remit/mail-oauth-service";
@@ -33,7 +34,6 @@ import type {
 	SyncMessageBodyEvent,
 	SyncMessagesEvent,
 } from "../events.js";
-import { isNotFoundError } from "../is-not-found.js";
 import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
 import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
 import { workerVersion } from "../worker-version.js";