@remit/imap-worker 0.0.85 → 0.0.87

package/src/handlers/mailbox-management.ts

@@ -3,7 +3,7 @@ import { refreshFolderAppointmentLabels } from "@remit/backend/folder-role-label
 import type { IMailboxRepository } from "@remit/data-ports";
 import { isNotFoundError, NotFoundError } from "@remit/data-ports/errors";
 import { MailboxSyncStatus } from "@remit/domain-enums";
-import type { Logger } from "@remit/logger-lambda";
+import type { Logger } from "@remit/logger";
 import {
 	FolderGoneUpstreamError,
 	FolderRenameSettleError,
@@ -24,20 +24,6 @@ import type {
 import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
 import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
 
-export interface MailboxManagementDeps {
-	getClient: typeof getClient;
-	buildLifecycleDeps: typeof buildLifecycleDeps;
-	withOAuthLifecycle: typeof withOAuthLifecycle;
-	createConnectionScope: typeof createConnectionScopeWithCredentials;
-}
-
-const defaultDeps: MailboxManagementDeps = {
-	getClient,
-	buildLifecycleDeps,
-	withOAuthLifecycle,
-	createConnectionScope: createConnectionScopeWithCredentials,
-};
-
 /**
  * The outcome of a create, written against the state a create in flight is:
  * `pending` with no recorded rename target (D3, D10). Without the absence
@@ -85,15 +71,8 @@ const recordCreateOutcome = async (
 const handleCreate = async (
 	event: MailboxCreateEvent,
 	log: Logger,
-	deps: MailboxManagementDeps,
+	createConnectionScope: typeof createConnectionScopeWithCredentials,
 ): Promise<void> => {
-	const {
-		getClient,
-		buildLifecycleDeps,
-		withOAuthLifecycle,
-		createConnectionScope: createConnectionScopeWithCredentials,
-	} = deps;
-
 	const {
 		account: accountService,
 		mailbox: mailboxService,
@@ -118,7 +97,7 @@ const handleCreate = async (
 		account,
 		log,
 		async (credentials) => {
-			const scope = createConnectionScopeWithCredentials(account, credentials);
+			const scope = createConnectionScope(account, credentials);
 			const managementService = new MailboxManagementService(
 				mailboxService,
 				log,
@@ -209,15 +188,8 @@ const handleCreate = async (
 const handleRename = async (
 	event: MailboxRenameEvent,
 	log: Logger,
-	deps: MailboxManagementDeps,
+	createConnectionScope: typeof createConnectionScopeWithCredentials,
 ): Promise<void> => {
-	const {
-		getClient,
-		buildLifecycleDeps,
-		withOAuthLifecycle,
-		createConnectionScope: createConnectionScopeWithCredentials,
-	} = deps;
-
 	const {
 		account: accountService,
 		accountSetting: accountSettingService,
@@ -246,7 +218,7 @@ const handleRename = async (
 		account,
 		log,
 		async (credentials) => {
-			const scope = createConnectionScopeWithCredentials(account, credentials);
+			const scope = createConnectionScope(account, credentials);
 			const managementService = new MailboxManagementService(
 				mailboxService,
 				log,
@@ -321,8 +293,7 @@ const handleRename = async (
 						// folder's mail. Removing the root row alone is the orphaning
 						// bug: every descendant recorded the same intent (D6) and would
 						// be left `pending` at a path that does not exist, with its mail
-						// stranded out of every reader and still in the search index
-						// (D8).
+						// stranded out of every reader (D8).
 						if (error instanceof FolderGoneUpstreamError) {
 							log.info(
 								{ accountId, mailboxId, oldPath, intent: "rename" },
@@ -387,15 +358,8 @@ const handleRename = async (
 const handleDelete = async (
 	event: MailboxDeleteEvent,
 	log: Logger,
-	deps: MailboxManagementDeps,
+	createConnectionScope: typeof createConnectionScopeWithCredentials,
 ): Promise<void> => {
-	const {
-		getClient,
-		buildLifecycleDeps,
-		withOAuthLifecycle,
-		createConnectionScope: createConnectionScopeWithCredentials,
-	} = deps;
-
 	const {
 		account: accountService,
 		mailbox: mailboxService,
@@ -420,7 +384,7 @@ const handleDelete = async (
 		account,
 		log,
 		async (credentials) => {
-			const scope = createConnectionScopeWithCredentials(account, credentials);
+			const scope = createConnectionScope(account, credentials);
 			const managementService = new MailboxManagementService(
 				mailboxService,
 				log,
@@ -509,14 +473,14 @@ const handleDelete = async (
 export const processMailboxManagement = async (
 	event: MailboxManagementEvent,
 	log: Logger,
-	deps: MailboxManagementDeps = defaultDeps,
+	createConnectionScope = createConnectionScopeWithCredentials,
 ): Promise<void> => {
 	switch (event.type) {
 		case "MAILBOX_CREATE":
-			return handleCreate(event, log, deps);
+			return handleCreate(event, log, createConnectionScope);
 		case "MAILBOX_RENAME":
-			return handleRename(event, log, deps);
+			return handleRename(event, log, createConnectionScope);
 		case "MAILBOX_DELETE":
-			return handleDelete(event, log, deps);
+			return handleDelete(event, log, createConnectionScope);
 	}
 };

package/src/handlers/message-copy.sqlite.test.ts

@@ -0,0 +1,298 @@
+import assert from "node:assert/strict";
+import { after, before, describe, it } from "node:test";
+import {
+	MailboxCursorState,
+	MessageMutation,
+	MessageStatus,
+	MessageSyncStatus,
+} from "@remit/domain-enums";
+import type {
+	MessageCopyEvent,
+	MessageDeleteEvent,
+	MessageMoveEvent,
+} from "../events.js";
+import { mail, openStore, type World } from "../test-helpers/test-world.js";
+import { handleMessageCopy } from "./message-copy.js";
+import { handleMessageDelete } from "./message-delete.js";
+import { handleMessageMove } from "./message-move.js";
+
+let store: Awaited<ReturnType<typeof openStore>>;
+
+before(async () => {
+	store = await openStore();
+});
+
+after(() => store.close());
+
+interface Arranged {
+	w: World;
+	copyId: string;
+	sourceMessageId: string;
+	uid: number;
+	messageIdHeader: string;
+	inboxId: string;
+	projectsId: string;
+	event: MessageCopyEvent;
+}
+
+/** A message in INBOX, copied to Projects through the service the API calls. */
+const arrange = async (
+	options: { olderCopyInProjects?: boolean } = {},
+): Promise<Arranged> => {
+	const w = await store.world();
+	const inbox = await w.folder("INBOX");
+	const projects = await w.folder("Projects");
+	const seeded = await w.message(inbox);
+	if (options.olderCopyInProjects) {
+		w.imap.deliver("Projects", mail(seeded.messageIdHeader));
+	}
+
+	const copyId = await w.client.messageMove.copyMessage(
+		w.account.accountConfigId,
+		seeded.messageId,
+		projects.mailboxId,
+		w.account.accountId,
+	);
+	const event = w
+		.queued()
+		.find(
+			(body) => body.type === "MESSAGE_COPY",
+		) as unknown as MessageCopyEvent;
+	assert.ok(event, "the copy enqueued a MESSAGE_COPY");
+
+	return {
+		w,
+		copyId,
+		sourceMessageId: seeded.messageId,
+		uid: seeded.uid,
+		messageIdHeader: seeded.messageIdHeader,
+		inboxId: inbox.mailboxId,
+		projectsId: projects.mailboxId,
+		event,
+	};
+};
+
+const run = (a: Arranged, receiveCount = 1) =>
+	handleMessageCopy(a.event, a.w.log, receiveCount, a.w.scope);
+
+describe("a message copy", () => {
+	it("lands at the destination, leaves the source alone and settles the copy row", async () => {
+		const a = await arrange();
+
+		await run(a);
+
+		assert.deepEqual(a.w.imap.uids("INBOX"), [a.uid]);
+		const [copyUid] = a.w.imap.uids("Projects", a.messageIdHeader);
+		const row = await a.w.row(a.copyId);
+		assert.equal(row?.mailboxId, a.projectsId);
+		assert.equal(row?.uid, copyUid);
+		assert.equal(row?.status, MessageStatus.active);
+		assert.equal(row?.syncStatus, MessageSyncStatus.synced);
+		assert.equal((await a.w.row(a.sourceMessageId))?.mailboxId, a.inboxId);
+	});
+
+	it("settles on the copy this event made when the server sends no COPYUID", async () => {
+		const a = await arrange({ olderCopyInProjects: true });
+		a.w.imap.uidplus = false;
+
+		await run(a);
+
+		const copies = a.w.imap.uids("Projects", a.messageIdHeader);
+		assert.equal(copies.length, 2);
+		assert.equal((await a.w.row(a.copyId))?.uid, Math.max(...copies));
+	});
+
+	it("reconciles the copy row away when the destination does not hold the copy", async () => {
+		const a = await arrange();
+		a.w.imap.uidplus = false;
+		a.w.imap.ignoreNext.add("COPY");
+
+		await run(a);
+
+		assert.equal(await a.w.row(a.copyId), undefined);
+		assert.equal(
+			a.w.logs.filter(
+				(line) => line.fields.metric === "message_copy_not_landed",
+			).length,
+			1,
+		);
+	});
+
+	// COPY has no source-side effect, so a second one is a duplicate the user
+	// then has to find and delete.
+	it("never copies twice when a redelivery finds the copy already landed", async () => {
+		const a = await arrange();
+		a.w.imap.deliver("Projects", mail(a.messageIdHeader));
+
+		await run(a, 2);
+
+		assert.deepEqual(a.w.imap.commands("COPY"), []);
+		assert.equal(a.w.imap.uids("Projects", a.messageIdHeader).length, 1);
+		assert.equal((await a.w.row(a.copyId))?.status, MessageStatus.active);
+	});
+
+	it("issues nothing when a redelivery finds the copy already settled", async () => {
+		const a = await arrange();
+		await run(a);
+		const commands = a.w.imap.log.length;
+
+		await run(a);
+
+		assert.equal(a.w.imap.log.length, commands);
+	});
+
+	it("creates a destination the server does not have and redelivers", async () => {
+		const a = await arrange();
+		a.w.imap.removeFolder("Projects");
+
+		await assert.rejects(run(a), /TRYCREATE/);
+
+		assert.deepEqual(a.w.imap.commands("CREATE"), ["CREATE Projects"]);
+	});
+
+	it("gives the copy up when the source message is gone on the server", async () => {
+		const a = await arrange();
+		a.w.imap.failNext.COPY = new Error("Message not found (NONEXISTENT)");
+
+		await run(a);
+
+		const row = await a.w.row(a.copyId);
+		assert.equal(row?.status, MessageStatus.deleted);
+		assert.equal(row?.syncStatus, MessageSyncStatus.abandoned);
+		assert.equal(row?.abandonedMutation, MessageMutation.copy);
+	});
+
+	it("marks the copy failed and redelivers when the connection drops", async () => {
+		const a = await arrange();
+		a.w.imap.failNext.COPY = new Error("Connection reset");
+
+		await assert.rejects(run(a), /Connection reset/);
+
+		assert.equal(
+			(await a.w.row(a.copyId))?.syncStatus,
+			MessageSyncStatus.failed,
+		);
+	});
+
+	it("settles on the destination's copy at the ceiling instead of dead-lettering", async () => {
+		const a = await arrange();
+		a.w.imap.deliver("Projects", mail(a.messageIdHeader));
+		a.w.imap.failNext.COPY = new Error("Connection reset");
+
+		await run(a, 3);
+
+		const [copyUid] = a.w.imap.uids("Projects", a.messageIdHeader);
+		const row = await a.w.row(a.copyId);
+		assert.equal(row?.uid, copyUid);
+		assert.equal(row?.status, MessageStatus.active);
+	});
+
+	it("reconciles the copy row away at the ceiling when nothing reached the destination", async () => {
+		const a = await arrange();
+		a.w.imap.failNext.COPY = new Error("Connection reset");
+
+		await run(a, 3);
+
+		assert.equal(await a.w.row(a.copyId), undefined);
+	});
+
+	it("reconciles the copy row away without connecting when the destination mailbox was deleted", async () => {
+		const a = await arrange();
+		await a.w.client.mailbox.delete(a.w.account.accountId, a.projectsId);
+
+		await run(a);
+
+		assert.equal(a.w.imap.connections, 0);
+		assert.equal(await a.w.row(a.copyId), undefined);
+	});
+
+	it("reconciles the copy row away without connecting while the source cursor is rebuilding", async () => {
+		const a = await arrange();
+		await a.w.client.mailbox.update(a.w.account.accountId, a.inboxId, {
+			cursorState: MailboxCursorState.rebuilding,
+		});
+
+		await run(a);
+
+		assert.equal(a.w.imap.connections, 0);
+		assert.equal(await a.w.row(a.copyId), undefined);
+	});
+
+	it("copies nothing when the source's UIDVALIDITY changed under it", async () => {
+		const a = await arrange();
+		a.w.imap.setUidValidity("INBOX", 2);
+
+		await run(a);
+
+		assert.deepEqual(a.w.imap.commands("COPY"), []);
+		assert.equal(await a.w.row(a.copyId), undefined);
+	});
+
+	it("acks without connecting when the source mailbox was deleted", async () => {
+		const a = await arrange();
+		await a.w.client.mailbox.delete(a.w.account.accountId, a.inboxId);
+
+		await run(a);
+
+		assert.equal(a.w.imap.connections, 0);
+	});
+});
+
+describe("a fresh copy acted on before the server confirms it", () => {
+	const isMove = (
+		body: Record<string, unknown>,
+	): body is Record<string, unknown> & MessageMoveEvent =>
+		body.type === "MESSAGE_MOVE";
+	const isDelete = (
+		body: Record<string, unknown>,
+	): body is Record<string, unknown> & MessageDeleteEvent =>
+		body.type === "MESSAGE_DELETE";
+
+	it("waits for the copy to settle, then moves the copy and leaves the original", async () => {
+		const a = await arrange();
+
+		const moving = a.w.client.messageMove.moveMessage(
+			a.w.account.accountConfigId,
+			a.copyId,
+			a.inboxId,
+			a.w.account.accountId,
+		);
+		await run(a);
+		await moving;
+		const [copyUid] = a.w.imap.uids("Projects", a.messageIdHeader);
+		const event = a.w.queued().find(isMove);
+		assert.ok(event, "the move enqueued a MESSAGE_MOVE");
+		assert.equal(event.uid, copyUid);
+
+		await handleMessageMove(event, a.w.log, 1, a.w.scope);
+
+		assert.deepEqual(a.w.imap.uids("Projects", a.messageIdHeader), []);
+		assert.equal(a.w.imap.uids("INBOX", a.messageIdHeader).length, 2);
+		const row = await a.w.row(a.copyId);
+		assert.equal(row?.mailboxId, a.inboxId);
+		assert.equal(row?.status, MessageStatus.active);
+		assert.equal((await a.w.row(a.sourceMessageId))?.uid, a.uid);
+	});
+
+	it("waits for the copy to settle, then expunges the copy and leaves the original", async () => {
+		const a = await arrange();
+
+		const deleting = a.w.client.messageMove.deleteMessages(
+			a.w.account.accountConfigId,
+			[a.copyId],
+			a.w.account.accountId,
+			{ permanent: true },
+		);
+		await run(a);
+		assert.deepEqual((await deleting).refusedMessageIds, []);
+		const event = a.w.queued().find(isDelete);
+		assert.ok(event, "the delete enqueued a MESSAGE_DELETE");
+
+		await handleMessageDelete(event, a.w.log, 1, a.w.scope);
+
+		assert.deepEqual(a.w.imap.uids("Projects", a.messageIdHeader), []);
+		assert.deepEqual(a.w.imap.uids("INBOX"), [a.uid]);
+		assert.equal(await a.w.row(a.copyId), undefined);
+		assert.equal((await a.w.row(a.sourceMessageId))?.mailboxId, a.inboxId);
+	});
+});

package/src/handlers/message-copy.ts

@@ -4,13 +4,12 @@ import {
 	MessageStatus,
 	MessageSyncStatus,
 } from "@remit/domain-enums";
-import type { Logger } from "@remit/logger-lambda";
+import type { Logger } from "@remit/logger";
 import {
 	guardConnectionCursor,
 	type IImapConnection,
 	isCursorRebuildNeeded,
 	MailboxCursorPausedError,
-	reconcileStaleMessage,
 } from "@remit/mailbox-service";
 import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import { isAccountDeleted } from "../account-check.js";
@@ -24,22 +23,7 @@ import {
 	emitMoveResync,
 	searchMailboxForHighestMessageIdUid,
 } from "./message-move.js";
-
-export interface MessageCopyDeps {
-	getClient: typeof getClient;
-	buildLifecycleDeps: typeof buildLifecycleDeps;
-	withOAuthLifecycle: typeof withOAuthLifecycle;
-	createConnectionScope: typeof createConnectionScopeWithCredentials;
-	emitEvent: typeof emitEvent;
-}
-
-const defaultDeps: MessageCopyDeps = {
-	getClient,
-	buildLifecycleDeps,
-	withOAuthLifecycle,
-	createConnectionScope: createConnectionScopeWithCredentials,
-	emitEvent,
-};
+import { probeableMessageIdHeader } from "./probe-message-id.js";
 
 export const getMessageCopyMaxAttempts = (
 	processEnv: NodeJS.ProcessEnv = process.env,
@@ -49,8 +33,8 @@ export const MESSAGE_COPY_MAX_ATTEMPTS = getMessageCopyMaxAttempts();
 
 /**
  * Where the destination says this copy is. `unprobeable` is the row that
- * carries no Message-ID header (`messageIdHeader` is optional on Message, and
- * drafts and automated senders do arrive without one): the server was never
+ * carries no usable Message-ID header (drafts, automated senders and bounces
+ * do arrive without one): the server was never
  * asked, so its silence says nothing.
  */
 export type CopyProbe =
@@ -85,16 +69,8 @@ export const handleMessageCopy = async (
 	event: MessageCopyEvent,
 	log: Logger,
 	receiveCount = 1,
-	deps: MessageCopyDeps = defaultDeps,
+	createConnectionScope = createConnectionScopeWithCredentials,
 ): Promise<void> => {
-	const {
-		getClient,
-		buildLifecycleDeps,
-		withOAuthLifecycle,
-		createConnectionScope: createConnectionScopeWithCredentials,
-		emitEvent,
-	} = deps;
-
 	const {
 		account: accountService,
 		message: messageService,
@@ -153,6 +129,11 @@ export const handleMessageCopy = async (
 	// whether THIS copy is still outstanding, and a `deleting` row is somebody
 	// else's work — reading it as unsettled is what would let the second COPY
 	// through.
+	const copyPlacement = {
+		status: copyRow.status,
+		mailboxId: copyRow.mailboxId,
+		uid: copyRow.uid,
+	};
 	if (copyRow.status !== MessageStatus.moving) {
 		log.info(
 			{ accountId, newMessageId, uid: copyRow.uid, status: copyRow.status },
@@ -161,6 +142,11 @@ export const handleMessageCopy = async (
 		return;
 	}
 
+	// `failed` is an earlier attempt's mark, and the re-drive's: either may
+	// have issued a COPY whose answer was lost.
+	const earlierAttempt =
+		receiveCount > 1 || copyRow.syncStatus === MessageSyncStatus.failed;
+
 	await withOAuthLifecycle(
 		buildLifecycleDeps(secrets, accountService),
 		account,
@@ -192,10 +178,9 @@ export const handleMessageCopy = async (
 				destinationMailboxId,
 			);
 			if (destination.kind === "gone") {
-				const { threadMessagesDeleted } = await reconcileStaleMessage(
-					{ messageService, threadMessageService },
-					account.accountConfigId,
+				const reconciled = await messageService.deleteIfPlacement(
 					newMessageId,
+					copyPlacement,
 				);
 				log.warn(
 					{
@@ -204,7 +189,7 @@ export const handleMessageCopy = async (
 						sourceMessageId,
 						newMessageId,
 						mailboxId: destinationMailboxId,
-						threadMessagesDeleted,
+						reconciled,
 					},
 					"Skipping MESSAGE_COPY: destination mailbox no longer exists (deleted); optimistic copy row reconciled away",
 				);
@@ -217,21 +202,19 @@ export const handleMessageCopy = async (
 			// handle: a `guardConnectionCursor` wrap is bound to the SOURCE mailbox
 			// snapshot alone, and opening the destination through it trips that
 			// mailbox into a rebuild.
-			//
-			// This is the call site with no source-side gate to fall back on
-			// (#1122): a COPY leaves the source untouched, so nothing here can rule
-			// an older destination copy out the way `confirmTrashMoveUid` does. The
-			// fresh copy is the highest matching uid, and `deriveCopyMessageId`
-			// makes a repeated copy of the same message a second server COPY, so
-			// this probe must never bind to the earlier one.
 			const probeDestination = async (
 				connection: IImapConnection,
 			): Promise<CopyProbe> => {
-				if (!copyRow.messageIdHeader) return { kind: "unprobeable" };
+				const messageIdHeader = await probeableMessageIdHeader(
+					threadMessageService,
+					account.accountConfigId,
+					newMessageId,
+				);
+				if (!messageIdHeader) return { kind: "unprobeable" };
 				const probedUid = await searchMailboxForHighestMessageIdUid(
 					connection,
 					destinationMailboxPath,
-					copyRow.messageIdHeader,
+					messageIdHeader,
 				);
 				return probedUid === null
 					? { kind: "absent" }
@@ -288,10 +271,9 @@ export const handleMessageCopy = async (
 			// reality, the same terminal outcome `resolveExhaustedMessageMoveFailure`
 			// calls `reconciled`. Routine: metric, no alarm.
 			const settleNeverLanded = async (reason: string): Promise<void> => {
-				const { threadMessagesDeleted } = await reconcileStaleMessage(
-					{ messageService, threadMessageService },
-					account.accountConfigId,
+				const reconciled = await messageService.deleteIfPlacement(
 					newMessageId,
+					copyPlacement,
 				);
 				log.info(
 					{
@@ -300,7 +282,7 @@ export const handleMessageCopy = async (
 						sourceMessageId,
 						newMessageId,
 						destination: destinationMailboxPath,
-						threadMessagesDeleted,
+						reconciled,
 						reason,
 					},
 					"Copy absent from its destination; optimistic copy row reconciled away",
@@ -352,7 +334,7 @@ export const handleMessageCopy = async (
 				);
 			};
 
-			const scope = createConnectionScopeWithCredentials(account, credentials);
+			const scope = createConnectionScope(account, credentials);
 
 			// A paused cursor settles rather than acks: acking leaves the optimistic
 			// row at `uid: 0`/`moving` with nothing to re-enqueue it and no folder
@@ -380,7 +362,7 @@ export const handleMessageCopy = async (
 			const settlePausedCopy = async (
 				commandIssued: boolean,
 			): Promise<void> => {
-				const mayHaveIssued = commandIssued || receiveCount > 1;
+				const mayHaveIssued = commandIssued || earlierAttempt;
 
 				if (!mayHaveIssued) {
 					await settleNeverLanded(
@@ -445,7 +427,7 @@ export const handleMessageCopy = async (
 					// duplicates the mail. `absent` is an answer the server gave, so
 					// copying again is safe; `unprobeable` is silence, and copying on
 					// silence is the duplicate this guard exists to prevent.
-					if (receiveCount > 1) {
+					if (earlierAttempt) {
 						const earlier = await probeDestination(rawConnection);
 						if (earlier.kind === "confirmed") {
 							await settleCopied(earlier.uid);

package/src/handlers/message-delete-terminal.ts

@@ -1,14 +1,13 @@
 import type {
 	IMessageRepository,
 	IThreadMessageRepository,
+	MessageItem,
 } from "@remit/data-ports";
 import { MessageMutation, MessageSyncStatus } from "@remit/domain-enums";
 import {
 	type IImapConnection,
 	isMessageGoneFromOpenMailbox,
-	reconcileStaleMessage,
 	restoreSourcePlacement,
-	type StaleMessageReconcileDeps,
 } from "@remit/mailbox-service";
 
 export interface MessageDeleteTerminalLogger {
@@ -16,9 +15,11 @@ export interface MessageDeleteTerminalLogger {
 	error(obj: Record<string, unknown>, msg: string): void;
 }
 
-export interface ResolveExhaustedMessageDeleteDeps
-	extends StaleMessageReconcileDeps {
-	messageService: Pick<IMessageRepository, "delete" | "transitionPlacement">;
+export interface ResolveExhaustedMessageDeleteDeps {
+	messageService: Pick<
+		IMessageRepository,
+		"deleteIfPlacement" | "transitionPlacement"
+	>;
 	threadMessageService: Pick<
 		IThreadMessageRepository,
 		"findAllByMessageId" | "deleteMany" | "update"
@@ -27,6 +28,8 @@ export interface ResolveExhaustedMessageDeleteDeps
 }
 
 export interface ResolveExhaustedMessageDeleteInput {
+	/** Where the row stood when the caller read it; the delete holds only while it still does. */
+	placement: Pick<MessageItem, "status" | "mailboxId" | "uid">;
 	accountId: string;
 	accountConfigId: string;
 	messageId: string;
@@ -53,7 +56,7 @@ export interface ResolveExhaustedMessageDeleteResult {
  *    than by a FETCH coming back empty. The move to Trash landed server-side,
  *    or a foreign client moved or expunged the message; from here those are
  *    indistinguishable and have the same answer. The stale rows are deleted via
- *    {@link reconcileStaleMessage} and the caller resyncs the affected folders,
+ *    `deleteIfPlacement` and the caller resyncs the affected folders,
  *    so whichever folder actually holds the message re-projects it with the
  *    server's own UID. Metric only, no alarm — routine.
  * 2. BROKEN — the message is still at the source, so the delete never took
@@ -93,10 +96,9 @@ export const resolveExhaustedMessageDeleteFailure = async (
 	await connection.openBox(sourceMailboxPath, true);
 
 	if (await isMessageGoneFromOpenMailbox(connection, uid)) {
-		const { threadMessagesDeleted } = await reconcileStaleMessage(
-			deps,
-			accountConfigId,
+		const reconciled = await deps.messageService.deleteIfPlacement(
 			messageId,
+			input.placement,
 		);
 		deps.log.info(
 			{
@@ -106,7 +108,7 @@ export const resolveExhaustedMessageDeleteFailure = async (
 				messageId,
 				uid,
 				sourceMailboxPath,
-				threadMessagesDeleted,
+				reconciled,
 			},
 			"Message no longer at its delete source after retry exhaustion (the delete landed server-side, or an external delete or move); stale row reconciled",
 		);