@remit/imap-worker 0.0.86 → 0.0.88

package/src/handlers/message-delete.test.ts

@@ -1,1869 +0,0 @@
-import assert from "node:assert";
-import { beforeEach, describe, it, mock } from "node:test";
-import type { ThreadMessageItem } from "@remit/data-ports";
-import type { Logger } from "@remit/logger-lambda";
-import { renderMetrics, resetMetrics } from "@remit/logger-lambda";
-import { noopLogger } from "@remit/logger-lambda/noop-logger";
-import {
-	buildThreadMessageTrashUpdate,
-	buildThreadMessageUndelete,
-} from "@remit/mailbox-service";
-import type { MessageDeleteEvent } from "../events.js";
-import {
-	deleteAllThreadMessagesForMessage,
-	getMessageDeleteMaxAttempts,
-	handleMessageDelete,
-	MESSAGE_DELETE_MAX_ATTEMPTS,
-	type MessageDeleteDeps,
-} from "./message-delete.js";
-
-describe("getMessageDeleteMaxAttempts — env-derived threshold (#980)", () => {
-	it("parses the injected env var", () => {
-		assert.equal(
-			getMessageDeleteMaxAttempts({ MESSAGE_DELETE_MAX_ATTEMPTS: "3" }),
-			3,
-		);
-		assert.equal(
-			getMessageDeleteMaxAttempts({ MESSAGE_DELETE_MAX_ATTEMPTS: "5" }),
-			5,
-		);
-	});
-
-	it("defaults to the mailbox queue's own maxReceiveCount when unset", () => {
-		assert.equal(getMessageDeleteMaxAttempts({}), 3);
-	});
-
-	it("defaults on a non-numeric or non-positive value", () => {
-		assert.equal(
-			getMessageDeleteMaxAttempts({ MESSAGE_DELETE_MAX_ATTEMPTS: "nope" }),
-			3,
-		);
-		assert.equal(
-			getMessageDeleteMaxAttempts({ MESSAGE_DELETE_MAX_ATTEMPTS: "0" }),
-			3,
-		);
-	});
-
-	it("MESSAGE_DELETE_MAX_ATTEMPTS is a concrete, positive number at module load", () => {
-		assert.ok(MESSAGE_DELETE_MAX_ATTEMPTS > 0);
-	});
-});
-
-const sourceMailboxId = "source-mailbox-id-aaaaaaaaa";
-const trashMailboxId = "trash-mailbox-id-aaaaaaaaa";
-
-const baseThreadMessage = {
-	sentDate: 1700000000000,
-	mailboxId: sourceMailboxId,
-	isRead: true,
-	isDeleted: false,
-	hasStars: true,
-	hasAttachment: false,
-} satisfies Pick<
-	ThreadMessageItem,
-	| "sentDate"
-	| "mailboxId"
-	| "isRead"
-	| "isDeleted"
-	| "hasStars"
-	| "hasAttachment"
->;
-
-describe("buildThreadMessageTrashUpdate", () => {
-	// Regression for the same composites-direction landmine PR #186 fixed in
-	// `flag-queue.ts`. The CURRENT row state must go in `composites`; the NEW
-	// values must go in `set`. Flipping any of these silently drops the
-	// move-to-trash update on the ThreadMessage row — IMAP shows the message in
-	// Trash but the local thread-list still shows it in the source mailbox.
-
-	it("set carries the NEW uid, destination mailboxId, and isDeleted=true", () => {
-		const args = buildThreadMessageTrashUpdate(
-			baseThreadMessage,
-			42,
-			trashMailboxId,
-		);
-
-		assert.strictEqual(args.set.uid, 42);
-		assert.strictEqual(
-			args.set.mailboxId,
-			trashMailboxId,
-			"set.mailboxId must be the NEW trash mailbox",
-		);
-		assert.strictEqual(
-			args.set.isDeleted,
-			true,
-			"set.isDeleted must be true (move-to-trash marks the row deleted)",
-		);
-	});
-
-	it("composites.mailboxId is the CURRENT (source) mailboxId, not Trash", () => {
-		const args = buildThreadMessageTrashUpdate(
-			baseThreadMessage,
-			42,
-			trashMailboxId,
-		);
-
-		assert.strictEqual(
-			args.composites.mailboxId,
-			sourceMailboxId,
-			"composites.mailboxId must be the CURRENT source mailbox; passing Trash breaks the conditional check",
-		);
-		assert.notStrictEqual(
-			args.composites.mailboxId,
-			trashMailboxId,
-			"composites.mailboxId must NOT match the new trash mailbox id",
-		);
-	});
-
-	it("composites.isDeleted is the CURRENT value, not the new true", () => {
-		const args = buildThreadMessageTrashUpdate(
-			baseThreadMessage,
-			42,
-			trashMailboxId,
-		);
-
-		assert.strictEqual(
-			args.composites.isDeleted,
-			false,
-			"composites.isDeleted must be the CURRENT value (false), not the new value (true)",
-		);
-	});
-
-	it("composites mirrors every CURRENT indexed attribute on the threadMessage", () => {
-		const tm = {
-			sentDate: 1700000000123,
-			mailboxId: sourceMailboxId,
-			isRead: false,
-			isDeleted: false,
-			hasStars: true,
-			hasAttachment: true,
-		};
-
-		const args = buildThreadMessageTrashUpdate(tm, 99, trashMailboxId);
-
-		assert.deepStrictEqual(args.composites, {
-			sentDate: tm.sentDate,
-			mailboxId: tm.mailboxId,
-			isRead: tm.isRead,
-			isDeleted: tm.isDeleted,
-			hasStars: tm.hasStars,
-			hasAttachment: tm.hasAttachment,
-		});
-	});
-});
-
-describe("buildThreadMessageUndelete", () => {
-	// Every `set` payload here is hand-written, so the three builders can drift
-	// apart silently. Undelete is the exact inverse of the trash update's
-	// deletion mark, and it must move nothing else: the mail is still in Trash
-	// at the uid the row already carries.
-
-	it("clears only the deletion mark that buildThreadMessageTrashUpdate set", () => {
-		const trashed = buildThreadMessageTrashUpdate(
-			baseThreadMessage,
-			42,
-			trashMailboxId,
-		);
-		const undelete = buildThreadMessageUndelete(baseThreadMessage);
-
-		assert.strictEqual(trashed.set.isDeleted, true);
-		assert.strictEqual(undelete.set.isDeleted, false);
-		assert.deepStrictEqual(
-			Object.keys(undelete.set),
-			["isDeleted"],
-			"undelete must not move the row's uid or mailbox",
-		);
-	});
-
-	it("carries the CURRENT row state in composites, like every other builder", () => {
-		const undelete = buildThreadMessageUndelete(baseThreadMessage);
-
-		assert.deepStrictEqual(
-			undelete.composites,
-			buildThreadMessageTrashUpdate(baseThreadMessage, 42, trashMailboxId)
-				.composites,
-		);
-		assert.strictEqual(
-			undelete.composites.isDeleted,
-			baseThreadMessage.isDeleted,
-			"composites hold the state to check against, never the new value",
-		);
-	});
-});
-
-describe("deleteAllThreadMessagesForMessage (#212)", () => {
-	// Regression for the multi-mailbox cleanup gap in #212. A single Message
-	// can have ThreadMessage rows in multiple mailboxes (e.g. INBOX + a label
-	// folder copy). The pre-fix code used `findByMessageId` (single row) and
-	// left orphan rows behind that then leaked into other mailbox listings.
-
-	const baseRow = (
-		threadMessageId: string,
-		mailboxId: string,
-	): Pick<
-		ThreadMessageItem,
-		"accountConfigId" | "threadMessageId" | "mailboxId"
-	> => ({
-		accountConfigId: "alice-config-aaaaaaaaaa",
-		threadMessageId,
-		mailboxId,
-	});
-
-	it("deletes every ThreadMessage row returned by findAllByMessageId", async () => {
-		const rows = [
-			baseRow("alice-tm-1-aaaaaaaaaa", "alice-inbox-aaaaaaaaa"),
-			baseRow("alice-tm-2-aaaaaaaaaa", "alice-label-aaaaaaaaa"),
-		];
-
-		const findAllByMessageId = mock.fn(async () => rows);
-		const deleteRow = mock.fn(async () => undefined);
-
-		const count = await deleteAllThreadMessagesForMessage(
-			{
-				findAllByMessageId,
-				delete: deleteRow,
-			} as unknown as Parameters<typeof deleteAllThreadMessagesForMessage>[0],
-			"alice-config-aaaaaaaaaa",
-			"alice-msg-multi-aaaaaaaa",
-		);
-
-		assert.equal(count, 2);
-		assert.equal(deleteRow.mock.calls.length, 2);
-		assert.deepEqual(deleteRow.mock.calls[0].arguments, [
-			"alice-config-aaaaaaaaaa",
-			"alice-tm-1-aaaaaaaaaa",
-		]);
-		assert.deepEqual(deleteRow.mock.calls[1].arguments, [
-			"alice-config-aaaaaaaaaa",
-			"alice-tm-2-aaaaaaaaaa",
-		]);
-	});
-
-	it("returns zero when no ThreadMessage rows exist", async () => {
-		const findAllByMessageId = mock.fn(async () => []);
-		const deleteRow = mock.fn(async () => undefined);
-
-		const count = await deleteAllThreadMessagesForMessage(
-			{
-				findAllByMessageId,
-				delete: deleteRow,
-			} as unknown as Parameters<typeof deleteAllThreadMessagesForMessage>[0],
-			"alice-config-aaaaaaaaaa",
-			"alice-msg-missing-aaaaaa",
-		);
-
-		assert.equal(count, 0);
-		assert.equal(deleteRow.mock.calls.length, 0);
-	});
-});
-
-interface Call {
-	method: string;
-	args: unknown[];
-}
-
-interface LogLine {
-	level: string;
-	fields: Record<string, unknown>;
-}
-
-interface Connection {
-	openBox: (
-		path: string,
-		readOnly?: boolean,
-	) => Promise<{ uidvalidity: number }>;
-	moveMessages: (
-		uids: number[],
-		dest: string,
-	) => Promise<{ uidMap: Map<number, number> }>;
-	deleteMessages: (uids: number[]) => Promise<void>;
-	createMailbox: (path: string) => Promise<void>;
-	fetchMessages: (uids: number[]) => Promise<{ uid: number }[]>;
-	search: (criteria: unknown[]) => Promise<number[]>;
-}
-
-interface Harness {
-	calls: Call[];
-	account: {
-		accountId: string;
-		accountConfigId: string;
-		deletedAt?: number;
-	} | null;
-	mailbox: { mailboxId: string; uidValidity: number; cursorState?: string };
-	mailboxError?: Error;
-	folderPaths: Record<string, string>;
-	goneMailboxIds: string[];
-	connection: Connection;
-	threadMessageUpdateError?: Error;
-	messageRow: { messageIdHeader?: string; status?: string } | undefined;
-	/** The row was settled by another lane, so every transition loses. */
-	transitionLost?: boolean;
-	destinationSearchUids: number[];
-	// A Message-ID SEARCH is answered by whichever folder was opened last, so a
-	// case can put the same header in both. Default: the source still holds it,
-	// the destination does not.
-	sourceSearchUids: number[];
-	openBoxPath: string;
-	threadMessage: Record<string, unknown> | null;
-	allThreadMessages: Record<string, unknown>[];
-	getConnectionCount: number;
-	disconnectCount: number;
-	// Rejections handed to `getConnection`, one per call, oldest first. A
-	// dropped connection is how the guarded openBox gets skipped on a delivery
-	// that still goes on to settle the row.
-	connectionErrors: Error[];
-	logs: LogLine[];
-}
-
-// The level a give-up is logged at is behaviour: a routine pause must not page
-// anyone, and the local rows going while the server copy survives must stay
-// readable whichever level it lands on.
-const capturingLog = (): Logger => {
-	const at =
-		(level: string) =>
-		(fields: Record<string, unknown>): void => {
-			h.logs.push({ level, fields });
-		};
-	const log = {
-		info: at("info"),
-		warn: at("warn"),
-		error: at("error"),
-		debug: at("debug"),
-		fatal: at("fatal"),
-		trace: at("trace"),
-		child: () => log,
-	} as unknown as Logger;
-	return log;
-};
-
-const loggedWith = (key: string, value: string): LogLine[] =>
-	h.logs.filter((line) => line.fields[key] === value);
-
-let h: Harness;
-
-const record =
-	(method: string) =>
-	async (...args: unknown[]) => {
-		h.calls.push({ method, args });
-	};
-
-const MESSAGE_ID_HEADER = "<trashed-message@example.com>";
-
-// The source-presence probe (`isMessageGoneFromOpenMailbox`) and the
-// destination probe both go through `connection.search`; only the criterion
-// form tells them apart.
-const isMessageIdSearch = (criteria: unknown): boolean =>
-	Array.isArray(criteria) &&
-	Array.isArray(criteria[0]) &&
-	criteria[0][0] === "HEADER";
-
-const buildConnection = (): Connection => ({
-	openBox: async (path: string) => {
-		h.openBoxPath = path;
-		return { uidvalidity: 1 };
-	},
-	moveMessages: async () => ({ uidMap: new Map([[10, 20]]) }),
-	deleteMessages: record(
-		"connection.deleteMessages",
-	) as Connection["deleteMessages"],
-	createMailbox: record(
-		"connection.createMailbox",
-	) as Connection["createMailbox"],
-	// The source box still holds the uid unless a case says otherwise, so the
-	// presence probe only reports "gone" where a test made it true.
-	fetchMessages: async (uids: number[]) => {
-		h.calls.push({ method: "connection.fetchMessages", args: [uids] });
-		return uids.map((uid) => ({ uid }));
-	},
-	search: async (...args: unknown[]) => {
-		h.calls.push({ method: "connection.search", args });
-		if (!isMessageIdSearch(args[0])) return [10];
-		return h.openBoxPath === "INBOX"
-			? h.sourceSearchUids
-			: h.destinationSearchUids;
-	},
-});
-
-const sourceNoLongerHoldsTheUid = (): void => {
-	h.sourceSearchUids = [];
-	h.connection.fetchMessages = async () => [];
-	h.connection.search = async (...args: unknown[]) => {
-		h.calls.push({ method: "connection.search", args });
-		if (!isMessageIdSearch(args[0])) return [];
-		return h.openBoxPath === "INBOX"
-			? h.sourceSearchUids
-			: h.destinationSearchUids;
-	};
-};
-
-const fresh = (): Harness => ({
-	calls: [],
-	account: { accountId: "acc-1", accountConfigId: "cfg-1" },
-	mailbox: { mailboxId: "src-mbx", uidValidity: 1, cursorState: undefined },
-	folderPaths: { "src-mbx": "INBOX", "trash-mbx": "Trash" },
-	goneMailboxIds: [],
-	// What the API writes before it enqueues: a move to Trash records `moving`,
-	// a permanent delete records `deleting`, and the handler's guard asks one
-	// question of both — is a mutation still outstanding on this row.
-	messageRow: { messageIdHeader: MESSAGE_ID_HEADER, status: "moving" },
-	destinationSearchUids: [],
-	sourceSearchUids: [10],
-	openBoxPath: "INBOX",
-	connection: buildConnection(),
-	threadMessage: {
-		...baseThreadMessage,
-		accountConfigId: "cfg-1",
-		threadMessageId: "tm-1",
-	},
-	allThreadMessages: [
-		{ ...baseThreadMessage, accountConfigId: "cfg-1", threadMessageId: "tm-1" },
-		{ ...baseThreadMessage, accountConfigId: "cfg-1", threadMessageId: "tm-2" },
-	],
-	getConnectionCount: 0,
-	disconnectCount: 0,
-	connectionErrors: [],
-	logs: [],
-});
-
-const deps = (): MessageDeleteDeps =>
-	({
-		getClient: async () => ({
-			account: {
-				get: async (accountId: string) => {
-					h.calls.push({ method: "account.get", args: [accountId] });
-					return h.account;
-				},
-			},
-			message: {
-				get: async (messageIds: string[]) => {
-					h.calls.push({ method: "message.get", args: [messageIds] });
-					return h.messageRow ? [h.messageRow] : [];
-				},
-				updateUid: record("message.updateUid"),
-				transitionPlacement: async (...args: unknown[]) => {
-					h.calls.push({ method: "message.transitionPlacement", args });
-					return h.transitionLost ? undefined : { messageId: "msg-1" };
-				},
-				update: record("message.update"),
-				delete: record("message.delete"),
-			},
-			threadMessage: {
-				findByMessageId: async () => h.threadMessage,
-				findAllByMessageId: async (...args: unknown[]) => {
-					h.calls.push({ method: "threadMessage.findAllByMessageId", args });
-					return h.allThreadMessages;
-				},
-				update: async (...args: unknown[]) => {
-					h.calls.push({ method: "threadMessage.update", args });
-					if (h.threadMessageUpdateError) throw h.threadMessageUpdateError;
-				},
-				delete: record("threadMessage.delete"),
-				deleteMany: record("threadMessage.deleteMany"),
-			},
-			mailbox: {
-				get: async (_accountId: string, mailboxId: string) => {
-					if (h.mailboxError) throw h.mailboxError;
-					if (h.goneMailboxIds.includes(mailboxId)) {
-						throw Object.assign(new Error(`Mailbox not found: ${mailboxId}`), {
-							name: "NotFoundError",
-						});
-					}
-					const row =
-						mailboxId === h.mailbox.mailboxId
-							? h.mailbox
-							: { mailboxId, uidValidity: 1, cursorState: "normal" };
-					return { ...row, fullPath: h.folderPaths[mailboxId] };
-				},
-				update: record("mailbox.update"),
-			},
-			secrets: {},
-		}),
-		buildLifecycleDeps: () => ({}),
-		withOAuthLifecycle: async (
-			_deps: unknown,
-			_account: unknown,
-			_log: unknown,
-			cb: (credentials: unknown) => Promise<void>,
-		) => cb({}),
-		emitEvent: record("emitEvent"),
-		createConnectionScope: () => ({
-			getConnection: async () => {
-				h.getConnectionCount += 1;
-				const failure = h.connectionErrors.shift();
-				if (failure) throw failure;
-				return h.connection;
-			},
-			disconnect: async () => {
-				h.disconnectCount += 1;
-			},
-		}),
-	}) as unknown as MessageDeleteDeps;
-
-const moveEvent: MessageDeleteEvent = {
-	type: "MESSAGE_DELETE",
-	schemaVersion: 2,
-	accountId: "acc-1",
-	messageId: "msg-1",
-	mailboxId: "src-mbx",
-	mailboxPath: "INBOX",
-	uid: 10,
-	operation: "move_to_trash",
-	destinationMailboxId: "trash-mbx",
-	destinationMailboxPath: "Trash",
-} as MessageDeleteEvent;
-
-const permanentEvent: MessageDeleteEvent = {
-	type: "MESSAGE_DELETE",
-	schemaVersion: 2,
-	accountId: "acc-1",
-	messageId: "msg-1",
-	mailboxId: "src-mbx",
-	mailboxPath: "INBOX",
-	uid: 10,
-	operation: "permanent_delete",
-} as MessageDeleteEvent;
-
-/**
- * A permanent delete's row carries `deleting`, which is the state its own guard
- * asks for — the move to Trash's is `moving`, and the default fixture is that.
- * Called at the point of the handler call so the row is right for the event.
- */
-const permanent = (): MessageDeleteEvent => {
-	if (h.messageRow) h.messageRow.status = "deleting";
-	return permanentEvent;
-};
-
-const called = (method: string): Call[] =>
-	h.calls.filter((c) => c.method === method);
-
-/**
- * The transient attempt marker: the one transition that writes nothing but the
- * attempt's own sync status, predicated on this delete still being outstanding.
- * Told apart from the hand-back transitions, which write a whole placement.
- */
-/**
- * The hand-back transitions: the ones that write a whole placement back onto
- * the row. Told apart from the attempt marker, which writes only a sync status,
- * and from the claim that precedes a removal, which writes only a status.
- */
-const restoreCalls = (): Call[] =>
-	called("message.transitionPlacement").filter(
-		(candidate) =>
-			(candidate.args[2] as { mailboxId?: string }).mailboxId !== undefined,
-	);
-
-const attemptMarkerSyncStatus = (): string | undefined => {
-	const call = called("message.transitionPlacement").find(
-		(candidate) => Object.keys(candidate.args[2] as object).length === 1,
-	);
-	return (call?.args[2] as { syncStatus?: string })?.syncStatus;
-};
-
-// The one write that puts a given-up delete back on its source pair. It clears
-// `moving` in the same write as the pair, which is what keeps a later delete
-// from waiting on a mutation that has terminated (#1005), and it is a
-// transition rather than a plain update so a row another lane already settled
-// keeps its own placement (imap-mutations R3).
-const restoredToSource = (syncStatus: string): unknown[] => [
-	"msg-1",
-	{ status: ["moving", "deleting"] },
-	{
-		mailboxId: "src-mbx",
-		uid: 10,
-		status: "active",
-		syncStatus,
-		// A give-up names the mutation it gave up on, so the reading pane can
-		// offer the way out for THAT one (#1229). `none` rides along with every
-		// other sync status, so the field never outlives its gate.
-		abandonedMutation: syncStatus === "abandoned" ? "delete" : "none",
-	},
-];
-
-// Label order in the rendered text is prom-client's, not ours.
-const imapFailures = async (operation: string): Promise<number> => {
-	const line = (await renderMetrics())
-		.split("\n")
-		.find(
-			(candidate) =>
-				candidate.startsWith("remit_imap_failures_total{") &&
-				candidate.includes(`operation="${operation}"`),
-		);
-	return line ? Number(line.slice(line.lastIndexOf(" ") + 1)) : 0;
-};
-
-describe("handleMessageDelete", () => {
-	beforeEach(() => {
-		h = fresh();
-		resetMetrics();
-	});
-
-	it("moves to trash, rewrites the uid, and flips the thread row to deleted", async () => {
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.deepEqual(called("message.updateUid")[0]?.args, [
-			"msg-1",
-			20,
-			"trash-mbx",
-		]);
-		const update = called("threadMessage.update")[0];
-		assert.deepEqual(update?.args[2], {
-			uid: 20,
-			mailboxId: "trash-mbx",
-			isDeleted: true,
-		});
-		assert.equal(h.disconnectCount, 1);
-	});
-
-	// UIDPLUS is an extension: a server without it answers a perfectly
-	// successful MOVE with no COPYUID entry. An empty uidMap is therefore
-	// UNCONFIRMED, and the destination is asked by Message-ID before any
-	// verdict — the rule every sibling handler already carries. Issue #979.
-	describe("no COPYUID entry on the move to trash", () => {
-		it("settles the row on the probed uid when the message left the source and is at the destination (non-UIDPLUS server, genuine success)", async () => {
-			h.connection.moveMessages = async () => ({ uidMap: new Map() });
-			sourceNoLongerHoldsTheUid();
-			h.destinationSearchUids = [77];
-
-			await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-			assert.deepEqual(called("message.updateUid")[0]?.args, [
-				"msg-1",
-				77,
-				"trash-mbx",
-			]);
-			assert.deepEqual(called("threadMessage.update")[0]?.args[2], {
-				uid: 77,
-				mailboxId: "trash-mbx",
-				isDeleted: true,
-			});
-			assert.equal(
-				called("message.update").length,
-				0,
-				"a settled move never marks the row failed",
-			);
-		});
-
-		// Issue #1122. Trash already holds an older copy of this Message-ID (a
-		// resend, a sieve `fileinto` + `keep`, an earlier delete of another
-		// folder's copy). Settling on uid 12 points the row at that copy and
-		// orphans the one this MOVE just delivered: Empty Trash then expunges by
-		// the wrong uid and the fresh copy survives, unreachable.
-		it("settles on the copy this move delivered, not on an older copy already in Trash", async () => {
-			h.connection.moveMessages = async () => ({ uidMap: new Map() });
-			sourceNoLongerHoldsTheUid();
-			h.destinationSearchUids = [12, 77];
-
-			await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-			assert.deepEqual(called("message.updateUid")[0]?.args, [
-				"msg-1",
-				77,
-				"trash-mbx",
-			]);
-			assert.deepEqual(called("threadMessage.update")[0]?.args[2], {
-				uid: 77,
-				mailboxId: "trash-mbx",
-				isDeleted: true,
-			});
-		});
-
-		it("probes the DESTINATION mailbox, read-only, by Message-ID", async () => {
-			h.connection.moveMessages = async () => ({ uidMap: new Map() });
-			sourceNoLongerHoldsTheUid();
-			h.destinationSearchUids = [77];
-			const opened: unknown[][] = [];
-			h.connection.openBox = (async (...args: unknown[]) => {
-				opened.push(args);
-				h.openBoxPath = args[0] as string;
-				return { uidvalidity: 1 };
-			}) as Connection["openBox"];
-
-			await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-			assert.deepEqual(
-				opened,
-				[
-					["INBOX", false],
-					["INBOX", true],
-					["Trash", true],
-				],
-				"the source is re-asked read-only, then the destination is EXAMINEd — neither probe may SELECT a box writable",
-			);
-			assert.deepEqual(called("connection.search").at(-1)?.args[0], [
-				["HEADER", "Message-ID", MESSAGE_ID_HEADER],
-			]);
-		});
-
-		// Issue #980. Within the budget the row is marked unsettled and the
-		// event is re-thrown so the queue redelivers it, exactly as
-		// `handleMessageMove` does; nothing is reverted and nothing is deleted,
-		// because a MOVE that ran server-side but dropped before the tagged OK
-		// is indistinguishable from one that never ran (#655, PR #652).
-		it("throws to redeliver while the budget still has attempts left", async () => {
-			h.connection.moveMessages = async () => ({ uidMap: new Map() });
-			sourceNoLongerHoldsTheUid();
-			h.destinationSearchUids = [];
-
-			await assert.rejects(
-				handleMessageDelete(moveEvent, noopLogger, 1, deps()),
-				/unconfirmed/,
-			);
-
-			assert.equal(called("message.updateUid").length, 0);
-			assert.equal(
-				called("message.delete").length,
-				0,
-				"an unconfirmed move must never delete the local row inside the budget",
-			);
-			assert.equal(
-				called("threadMessage.deleteMany").length,
-				0,
-				"an unconfirmed move must never delete the listing rows inside the budget",
-			);
-			assert.equal(
-				called("threadMessage.update").length,
-				0,
-				"an unconfirmed move must never revert the listing row to the source",
-			);
-			assert.equal(attemptMarkerSyncStatus(), "failed");
-			assert.equal(h.disconnectCount, 1);
-		});
-
-		it("settles once at the ceiling: reconciles the stale rows and resyncs both folders", async () => {
-			h.connection.moveMessages = async () => ({ uidMap: new Map() });
-			sourceNoLongerHoldsTheUid();
-			h.destinationSearchUids = [];
-
-			await handleMessageDelete(moveEvent, noopLogger, 3, deps());
-
-			assert.equal(
-				called("threadMessage.deleteMany").length,
-				1,
-				"the ceiling settles the row rather than leaving it claiming a uid the server does not have",
-			);
-			assert.equal(called("message.delete").length, 1);
-			assert.deepEqual(
-				called("emitEvent").map((c) => c.args[0]),
-				[
-					{ type: "SYNC_MESSAGES", accountId: "acc-1", mailboxId: "src-mbx" },
-					{ type: "SYNC_MESSAGES", accountId: "acc-1", mailboxId: "trash-mbx" },
-				],
-				"both folders re-project from IMAP so the message reappears where it actually is",
-			);
-			assert.equal(h.disconnectCount, 1);
-		});
-
-		// A message with no Message-ID header on a non-UIDPLUS server can never
-		// be confirmed at the destination, so redelivering it only burns the
-		// budget on an answer that cannot change.
-		it("settles on the first attempt when the row carries no Message-ID header", async () => {
-			h.connection.moveMessages = async () => ({ uidMap: new Map() });
-			sourceNoLongerHoldsTheUid();
-			h.messageRow = { status: "moving" };
-
-			await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-			assert.equal(
-				called("connection.search").filter((c) =>
-					JSON.stringify(c.args).includes("HEADER"),
-				).length,
-				0,
-			);
-			assert.equal(called("message.updateUid").length, 0);
-			assert.equal(
-				called("message.delete").length,
-				1,
-				"an unprobeable row settles instead of spending the whole budget",
-			);
-			assert.equal(called("emitEvent").length, 2);
-			assert.equal(
-				await imapFailures("MESSAGE_DELETE_TRASH_MOVE_UNCONFIRMED"),
-				1,
-			);
-		});
-
-		// The row this event names was already deleted, so there is nothing to
-		// settle and nothing to show. Re-throwing would loop a NotFoundError on
-		// the account's per-group FIFO and block every later mailbox event.
-		it("acks without touching the database when the local row is already gone", async () => {
-			h.connection.moveMessages = async () => ({ uidMap: new Map() });
-			sourceNoLongerHoldsTheUid();
-			h.messageRow = undefined;
-
-			await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-			assert.equal(called("message.update").length, 0);
-			assert.equal(called("message.delete").length, 0);
-			assert.equal(called("threadMessage.deleteMany").length, 0);
-			assert.equal(called("emitEvent").length, 0);
-		});
-
-		// A lost SQS acknowledgement is the ordinary way this happens: the delete
-		// ran, `settleTrashMoveConfirmed` wrote the Trash uid, and the record came
-		// back anyway. Without the guard its three siblings carry (MESSAGE_MOVE,
-		// MESSAGE_COPY, FLAG_PUSH) the redelivery MOVEs a uid the source no longer
-		// holds, exhausts, and the terminal resolver reads the source's honest
-		// "gone" as grounds to delete rows that are correct — taking spamReport,
-		// classificationState, category and the Undo target's `originalMailboxId`
-		// with them, none of which the resync re-projection can rebuild.
-		it("skips a redelivery of a delete that already settled, rather than re-running it", async () => {
-			h.messageRow = { messageIdHeader: MESSAGE_ID_HEADER, status: "active" };
-
-			await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-			assert.equal(h.getConnectionCount, 0, "no IMAP command is issued");
-			assert.equal(called("message.updateUid").length, 0);
-			assert.equal(called("message.delete").length, 0);
-			assert.equal(called("threadMessage.delete").length, 0);
-			assert.equal(called("threadMessage.deleteMany").length, 0);
-			assert.equal(called("message.transitionPlacement").length, 0);
-			assert.equal(called("emitEvent").length, 0);
-		});
-
-		// The guard asks for the state THIS delete wrote, not for "is anything
-		// outstanding". A move to Trash records `moving`, a permanent delete
-		// records `deleting`, and a row in the other one belongs to a different
-		// mutation — reading it as unsettled is what would let a redelivery
-		// finish somebody else's work against a uid it never owned.
-		it("proceeds on a move-to-trash row still marked moving, which is its own work", async () => {
-			h.messageRow = { messageIdHeader: MESSAGE_ID_HEADER, status: "moving" };
-
-			await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-			assert.equal(h.getConnectionCount, 1, "the delete runs");
-		});
-
-		it("skips a move-to-trash whose row a permanent delete has claimed", async () => {
-			h.messageRow = { messageIdHeader: MESSAGE_ID_HEADER, status: "deleting" };
-
-			await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-			assert.equal(h.getConnectionCount, 0, "no IMAP command is issued");
-			assert.equal(called("message.updateUid").length, 0);
-			assert.equal(called("emitEvent").length, 0);
-		});
-
-		it("proceeds on a permanent delete's own deleting row", async () => {
-			h.messageRow = { messageIdHeader: MESSAGE_ID_HEADER, status: "deleting" };
-
-			await handleMessageDelete(permanent(), noopLogger, 1, deps());
-
-			assert.equal(h.getConnectionCount, 1, "the expunge runs");
-		});
-
-		it("skips a permanent delete whose row a move has claimed", async () => {
-			h.messageRow = { messageIdHeader: MESSAGE_ID_HEADER, status: "moving" };
-
-			await handleMessageDelete(permanentEvent, noopLogger, 1, deps());
-
-			assert.equal(h.getConnectionCount, 0, "no expunge is issued");
-			assert.equal(called("message.delete").length, 0);
-			assert.equal(called("emitEvent").length, 0);
-		});
-
-		it("skips a redelivered permanent delete the same way", async () => {
-			h.messageRow = { messageIdHeader: MESSAGE_ID_HEADER, status: "active" };
-
-			await handleMessageDelete(permanentEvent, noopLogger, 1, deps());
-
-			assert.equal(h.getConnectionCount, 0);
-			assert.equal(called("message.delete").length, 0);
-			assert.equal(called("emitEvent").length, 0);
-		});
-
-		// One Message-ID can have several server copies in one account while
-		// `deriveMessageId` gives them one local row. A source that still holds
-		// the uid proves the MOVE did not happen, so any hit at the destination
-		// is a different copy — including the highest one #1122 now takes, since
-		// with no fresh copy at all the highest match is still an older copy.
-		it("never takes a destination hit while the source still holds the uid (duplicate Message-ID)", async () => {
-			h.connection.moveMessages = async () => ({ uidMap: new Map() });
-			h.destinationSearchUids = [100];
-
-			await assert.rejects(
-				handleMessageDelete(moveEvent, noopLogger, 1, deps()),
-				/unconfirmed/,
-			);
-
-			assert.equal(
-				called("message.updateUid").length,
-				0,
-				"an earlier copy's uid must never settle this row",
-			);
-			assert.equal(called("threadMessage.update").length, 0);
-			assert.equal(called("message.delete").length, 0);
-			assert.equal(attemptMarkerSyncStatus(), "failed");
-		});
-
-		// Issue #1098. A source that still holds the uid at the ceiling means the
-		// MOVE never took effect, so the row goes back to the source folder: the
-		// optimistic transition left `mailboxId` on Trash while `uid` still
-		// named the source's message, and settling `status` to `active` on top of
-		// that pair switched off every guard that reads `status === "moving"`.
-		// The UI then resolved a Trash `mailboxId` to "Delete permanently", an
-		// expunge of Trash by a uid belonging to a different message. This is not
-		// a revert on ambiguity (#652, #655): the presence probe has just
-		// answered, so the pair written here is the placement the server holds.
-		it("moves a message still at its source back to the source folder at the ceiling", async () => {
-			h.connection.moveMessages = async () => ({ uidMap: new Map() });
-			h.destinationSearchUids = [100];
-			h.allThreadMessages = [
-				{
-					...baseThreadMessage,
-					accountConfigId: "cfg-1",
-					threadMessageId: "tm-1",
-					mailboxId: "trash-mbx",
-					isDeleted: true,
-				},
-			];
-
-			await handleMessageDelete(moveEvent, noopLogger, 3, deps());
-
-			assert.equal(called("message.delete").length, 0);
-			assert.equal(called("threadMessage.deleteMany").length, 0);
-
-			// `mailboxId` and `uid` name the same message again, and the same write
-			// settles `status` out of `moving`, so no later delete of this message
-			// waits on a mutation that has terminated. It also carries the give-up
-			// (#1153) and names it a delete (#1229): the user asked for one, it did
-			// not happen, and nothing is coming to try again.
-			assert.deepEqual(
-				called("message.transitionPlacement").at(-1)?.args,
-				restoredToSource("abandoned"),
-			);
-			assert.equal(
-				called("message.update").length,
-				0,
-				"settling `status` without repairing the pair is what left the row addressable as a Trash expunge",
-			);
-
-			// The listing row follows the Message row out of Trash, which is what
-			// makes "Delete permanently" unreachable: the client resolves that
-			// outcome from a target whose `mailboxId` is the Trash mailbox.
-			assert.deepEqual(called("threadMessage.update").at(-1)?.args, [
-				"cfg-1",
-				"tm-1",
-				{ uid: 10, mailboxId: "src-mbx", isDeleted: false },
-				{
-					composites: {
-						sentDate: baseThreadMessage.sentDate,
-						mailboxId: "trash-mbx",
-						isRead: true,
-						isDeleted: true,
-						hasStars: true,
-						hasAttachment: false,
-					},
-				},
-			]);
-			assert.equal(await imapFailures("MESSAGE_DELETE_EXHAUSTED"), 1);
-		});
-
-		// The optimistic transition already pointed the row at Trash. The
-		// server has now confirmed the message never left the source, so the row
-		// and the server disagree about where the mail is, and only a resync of
-		// both folders settles that. Without it the user is shown the message in
-		// Trash indefinitely while it sits in the source folder.
-		it("resyncs both folders when the server confirms the message never left the source", async () => {
-			h.connection.moveMessages = async () => ({ uidMap: new Map() });
-			h.destinationSearchUids = [100];
-
-			await handleMessageDelete(moveEvent, noopLogger, 3, deps());
-
-			assert.deepEqual(
-				called("emitEvent").map((c) => c.args[0]),
-				[
-					{ type: "SYNC_MESSAGES", accountId: "acc-1", mailboxId: "src-mbx" },
-					{ type: "SYNC_MESSAGES", accountId: "acc-1", mailboxId: "trash-mbx" },
-				],
-				"a confirmed divergence resyncs on the broken verdict too, not only on the reconciled one",
-			);
-		});
-
-		// Issue #980, the failure the budget exists for: every redelivery
-		// re-MOVEs a uid the source no longer holds and throws identically. The
-		// ceiling lives in the error catch, so a throwing `moveMessages` settles
-		// there rather than running past the budget into the dead-letter queue.
-		describe("a re-MOVE that throws", () => {
-			const moveThrows = (): void => {
-				h.connection.moveMessages = async () => {
-					throw new Error(
-						"NO [TRYAGAIN] UID MOVE failed: no matching messages",
-					);
-				};
-			};
-
-			it("re-throws inside the budget so the queue redelivers", async () => {
-				moveThrows();
-
-				await assert.rejects(
-					handleMessageDelete(moveEvent, noopLogger, 1, deps()),
-					/UID MOVE failed/,
-				);
-
-				assert.equal(called("message.delete").length, 0);
-				assert.equal(called("threadMessage.deleteMany").length, 0);
-				assert.equal(attemptMarkerSyncStatus(), "failed");
-			});
-
-			it("settles at the ceiling instead of dead-lettering undiagnosed", async () => {
-				moveThrows();
-				sourceNoLongerHoldsTheUid();
-
-				await handleMessageDelete(moveEvent, noopLogger, 3, deps());
-
-				assert.equal(
-					called("threadMessage.deleteMany").length,
-					1,
-					"the ceiling must diagnose the failure, not hand it to the DLQ",
-				);
-				assert.equal(called("message.delete").length, 1);
-				assert.equal(called("emitEvent").length, 2);
-			});
-
-			it("settles a still-present message at the ceiling back onto its source", async () => {
-				moveThrows();
-
-				await handleMessageDelete(moveEvent, noopLogger, 3, deps());
-
-				assert.deepEqual(
-					called("message.transitionPlacement").at(-1)?.args,
-					restoredToSource("abandoned"),
-				);
-				assert.equal(await imapFailures("MESSAGE_DELETE_EXHAUSTED"), 1);
-			});
-		});
-
-		// A probe the server refused says nothing either way, so it counts as
-		// unconfirmed and spends an attempt. The budget is what makes that safe:
-		// without a ceiling the redeliveries would re-MOVE a uid the source no
-		// longer holds forever and head-of-line block the account's deletes.
-		it("treats an unanswerable probe as unconfirmed and spends an attempt", async () => {
-			h.connection.moveMessages = async () => ({ uidMap: new Map() });
-			h.connection.openBox = (async (_path: string, readOnly?: boolean) => {
-				if (readOnly) throw new Error("NO [SERVERBUG] EXAMINE failed");
-				return { uidvalidity: 1 };
-			}) as Connection["openBox"];
-
-			await assert.rejects(
-				handleMessageDelete(moveEvent, noopLogger, 1, deps()),
-				/unconfirmed/,
-			);
-
-			assert.equal(called("message.updateUid").length, 0);
-			assert.equal(called("message.delete").length, 0);
-			assert.equal(called("threadMessage.deleteMany").length, 0);
-			assert.equal(called("threadMessage.update").length, 0);
-			assert.equal(attemptMarkerSyncStatus(), "failed");
-			assert.equal(h.disconnectCount, 1);
-		});
-	});
-
-	// The queue handler `JSON.parse`s the body and casts it to WorkerEvent with
-	// no validation, so an event whose `operation` is missing, misspelled or
-	// from a newer producer reaches here. It must never be read as an expunge.
-	for (const [name, operation] of [
-		["missing", undefined],
-		["unknown", "trash"],
-		["empty", ""],
-	] as const) {
-		it(`abandons the delete and hands the row back when operation is ${name}`, async () => {
-			const malformed = {
-				...moveEvent,
-				operation,
-			} as unknown as MessageDeleteEvent;
-
-			await handleMessageDelete(malformed, noopLogger, 1, deps());
-
-			assert.equal(
-				called("connection.deleteMessages").length,
-				0,
-				"nothing may be expunged for an operation nobody wrote",
-			);
-			assert.equal(called("message.delete").length, 0);
-			assert.equal(called("threadMessage.delete").length, 0);
-
-			// The row goes back to the mailbox the server still holds it in, so
-			// the failure is visible as the message reappearing rather than as an
-			// invisible syncStatus on a row that claims Trash. A refusal keeps
-			// `failed`: the product turned down something the user asked for.
-			assert.deepEqual(
-				called("message.transitionPlacement")[0]?.args,
-				restoredToSource("abandoned"),
-			);
-			assert.deepEqual(called("threadMessage.update")[0]?.args[2], {
-				uid: 10,
-				mailboxId: "src-mbx",
-				isDeleted: false,
-			});
-		});
-	}
-
-	it("refuses to expunge a move-to-trash that names no destination", async () => {
-		const destinationless = {
-			...moveEvent,
-			destinationMailboxId: undefined,
-			destinationMailboxPath: undefined,
-		} as MessageDeleteEvent;
-
-		await handleMessageDelete(destinationless, noopLogger, 1, deps());
-
-		assert.equal(called("connection.deleteMessages").length, 0);
-		assert.equal(called("message.delete").length, 0);
-		assert.deepEqual(
-			called("message.transitionPlacement")[0]?.args,
-			restoredToSource("abandoned"),
-		);
-	});
-
-	it("expunges on the server and removes every thread row before the message row", async () => {
-		await handleMessageDelete(permanent(), noopLogger, 1, deps());
-
-		assert.deepEqual(called("connection.deleteMessages")[0]?.args, [[10]]);
-		assert.equal(called("threadMessage.delete").length, 2);
-		assert.ok(
-			h.calls.findIndex((c) => c.method === "threadMessage.delete") <
-				h.calls.findIndex((c) => c.method === "message.delete"),
-			"thread rows go first so no row outlives its message",
-		);
-	});
-
-	// Regression on #212: a permanent delete the server has already applied must
-	// still reconcile the local rows, now that the text alone no longer decides.
-	it("cleans up locally and swallows the error when the message is confirmed gone on IMAP", async () => {
-		h.connection.deleteMessages = async () => {
-			throw new Error("NONEXISTENT uid");
-		};
-		sourceNoLongerHoldsTheUid();
-
-		await handleMessageDelete(permanent(), noopLogger, 1, deps());
-
-		assert.equal(called("message.delete").length, 1);
-		assert.equal(called("threadMessage.delete").length, 2);
-	});
-
-	// Issue #845. The three cases below are the same bug from three directions:
-	// "not found" in an error string is never on its own a reason to destroy the
-	// only local record of live mail.
-
-	it("keeps the rows when a move-to-trash fails after the MOVE landed", async () => {
-		// The MOVE succeeded; the ThreadMessage write behind it did not. The
-		// message is sitting in Trash, and the NotFoundError names a local row,
-		// not a mail-server one.
-		h.threadMessageUpdateError = Object.assign(
-			new Error("Thread message not found"),
-			{ name: "NotFoundError" },
-		);
-		sourceNoLongerHoldsTheUid();
-
-		await assert.rejects(
-			handleMessageDelete(moveEvent, noopLogger, 1, deps()),
-			/not found/,
-		);
-
-		assert.equal(
-			called("message.delete").length,
-			0,
-			"the message is in Trash; deleting its row loses the only handle on it",
-		);
-		assert.equal(called("threadMessage.delete").length, 0);
-		assert.equal(
-			called("connection.search").length,
-			0,
-			"a move-to-trash never probes: absence from the source is its success signature",
-		);
-		assert.equal(attemptMarkerSyncStatus(), "failed");
-	});
-
-	it("keeps the rows on a NONEXISTENT move-to-trash whose source still holds the uid", async () => {
-		h.connection.moveMessages = async () => {
-			throw new Error("NONEXISTENT: mailbox does not exist");
-		};
-
-		await assert.rejects(
-			handleMessageDelete(moveEvent, noopLogger, 1, deps()),
-			/NONEXISTENT/,
-		);
-
-		assert.equal(called("message.delete").length, 0);
-		assert.equal(called("threadMessage.delete").length, 0);
-		assert.equal(attemptMarkerSyncStatus(), "failed");
-	});
-
-	it("keeps the rows when a permanent delete's source still holds the uid", async () => {
-		h.connection.deleteMessages = async () => {
-			throw new Error("NONEXISTENT uid");
-		};
-		// imapflow drops rows on back-to-back FETCHes (#408); the SEARCH is what
-		// the verdict rests on, and it still lists the uid.
-		h.connection.fetchMessages = async () => [];
-
-		await assert.rejects(
-			handleMessageDelete(permanent(), noopLogger, 1, deps()),
-			/NONEXISTENT/,
-		);
-
-		assert.equal(
-			called("connection.search").length,
-			1,
-			"the error text only selects a candidate; the source box decides",
-		);
-		assert.equal(called("message.delete").length, 0);
-		assert.equal(called("threadMessage.delete").length, 0);
-	});
-
-	it("keeps the rows and rethrows the original error when the probe cannot answer", async () => {
-		// The SELECT is what failed, so there is no open box left for the probe
-		// to ask. The IMAP error must still be the one that rejects, and the row
-		// must not be stranded mid-delete for the record to carry to the DLQ.
-		h.connection.openBox = async () => {
-			throw new Error("NONEXISTENT mailbox does not exist");
-		};
-		h.connection.fetchMessages = async () => {
-			throw new Error("No mailbox selected");
-		};
-
-		await assert.rejects(
-			handleMessageDelete(permanent(), noopLogger, 1, deps()),
-			/NONEXISTENT mailbox does not exist/,
-		);
-
-		assert.equal(called("message.delete").length, 0);
-		assert.equal(called("threadMessage.delete").length, 0);
-		assert.equal(attemptMarkerSyncStatus(), "failed");
-	});
-
-	it("abandons rather than creating the destination on TRYCREATE", async () => {
-		// Creating it resurrects an empty `Trash` beside the real one, and the
-		// name-hint rule then has two folders to choose between. The picker
-		// offers the ones the account actually has.
-		h.connection.moveMessages = async () => {
-			throw new Error("TRYCREATE: no such mailbox");
-		};
-
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.equal(called("connection.createMailbox").length, 0);
-		assert.deepEqual(
-			called("message.transitionPlacement")[0]?.args,
-			restoredToSource("abandoned"),
-		);
-		assert.deepEqual(called("threadMessage.update")[0]?.args[2], {
-			uid: 10,
-			mailboxId: "src-mbx",
-			isDeleted: false,
-		});
-	});
-
-	// Removing the Message row is destructive, and the refusal paths reach it on
-	// whatever the row happens to be — an unrecognised operation is answered on
-	// an `active` row as readily as on a `deleting` one. So the removal is
-	// claimed first, and a row with no delete outstanding is left alone.
-	it("never removes a row no delete is outstanding on", async () => {
-		h.messageRow = { messageIdHeader: MESSAGE_ID_HEADER, status: "active" };
-		h.allThreadMessages = [];
-		h.transitionLost = true;
-		const malformed = {
-			...moveEvent,
-			operation: undefined,
-		} as unknown as MessageDeleteEvent;
-
-		await handleMessageDelete(malformed, noopLogger, 1, deps());
-
-		assert.deepEqual(
-			called("message.transitionPlacement")[0]?.args[1],
-			{ status: ["moving", "deleting"] },
-			"the removal is claimed off a placement this delete owns",
-		);
-		assert.equal(
-			called("message.delete").length,
-			0,
-			"and a lost claim removes nothing",
-		);
-	});
-
-	it("removes the row once the claim on it wins", async () => {
-		h.messageRow = { messageIdHeader: MESSAGE_ID_HEADER, status: "deleting" };
-		h.allThreadMessages = [];
-		const malformed = {
-			...moveEvent,
-			operation: undefined,
-		} as unknown as MessageDeleteEvent;
-
-		await handleMessageDelete(malformed, noopLogger, 1, deps());
-
-		assert.deepEqual(
-			called("message.delete").map((c) => c.args[0]),
-			["msg-1"],
-		);
-	});
-
-	it("abandons an event minted under an unknown contract, before connecting", async () => {
-		const unversioned = {
-			...moveEvent,
-			schemaVersion: undefined,
-		} as unknown as MessageDeleteEvent;
-
-		await handleMessageDelete(unversioned, noopLogger, 1, deps());
-
-		assert.equal(h.getConnectionCount, 0);
-		assert.equal(called("connection.deleteMessages").length, 0);
-		assert.deepEqual(
-			called("message.transitionPlacement")[0]?.args,
-			restoredToSource("abandoned"),
-		);
-		assert.deepEqual(called("threadMessage.update")[0]?.args[2], {
-			uid: 10,
-			mailboxId: "src-mbx",
-			isDeleted: false,
-		});
-	});
-
-	it("hands back every listing row a message has, not just the first", async () => {
-		const unversioned = {
-			...moveEvent,
-			schemaVersion: undefined,
-		} as unknown as MessageDeleteEvent;
-
-		await handleMessageDelete(unversioned, noopLogger, 1, deps());
-
-		assert.deepEqual(
-			called("threadMessage.update").map((c) => c.args[1]),
-			["tm-1", "tm-2"],
-		);
-	});
-
-	it("finishes the removal when an abandoned delete has no listing rows left", async () => {
-		// A permanent delete removes them before it enqueues, and they cannot be
-		// rebuilt here. Restoring the Message alone leaves mail nothing can list,
-		// which is worse than either consistent state; the server copy survives
-		// and a full sync brings it back.
-		h.allThreadMessages = [];
-		const unversioned = {
-			...permanent(),
-			schemaVersion: undefined,
-		} as unknown as MessageDeleteEvent;
-
-		await handleMessageDelete(unversioned, noopLogger, 1, deps());
-
-		assert.equal(called("connection.deleteMessages").length, 0);
-		assert.deepEqual(called("message.delete")[0]?.args, ["msg-1"]);
-		assert.equal(
-			called("message.update").length,
-			0,
-			"never leave a Message row no listing can reach",
-		);
-	});
-
-	it("marks failed and rethrows on an unclassified IMAP error", async () => {
-		h.connection.moveMessages = async () => {
-			throw new Error("server exploded");
-		};
-
-		await assert.rejects(
-			handleMessageDelete(moveEvent, noopLogger, 1, deps()),
-			/server exploded/,
-		);
-
-		assert.equal(attemptMarkerSyncStatus(), "failed");
-	});
-
-	// Issue #1203. The pause is thrown by the openBox guard before the MOVE is
-	// issued, so acking left the row `moving` on Trash with the source's uid.
-	// Nothing re-enqueues a MESSAGE_DELETE, and the cursor rebuild matches rows
-	// by `(accountConfigId, mailboxId)`, so a row naming Trash is in neither
-	// folder's set — the message stayed undeletable and unmovable for good.
-	it("hands the optimistic trash move back when openBox trips a UIDVALIDITY mismatch", async () => {
-		h.connection.openBox = async () => ({ uidvalidity: 999 });
-
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.equal(
-			(called("mailbox.update")[0]?.args[2] as { cursorState?: string })
-				?.cursorState,
-			"cursor_invalid",
-		);
-		assert.deepEqual(
-			called("message.transitionPlacement")[0]?.args,
-			restoredToSource("synced"),
-			"the row goes back to the source pair, which is the set the rebuild adjudicates",
-		);
-		assert.equal(
-			(called("threadMessage.update")[0]?.args[2] as { isDeleted?: boolean })
-				?.isDeleted,
-			false,
-			"the listing rows lose the deletion mark the optimistic write put on them",
-		);
-	});
-
-	// The terminal resolver opens the source itself, and since #1005 its answer
-	// WRITES a placement. A folder deleted and recreated renumbers every uid, so
-	// a uid-keyed probe finds whatever now sits at this one, reads it as "still
-	// at source", and binds the row to a stranger the next permanent delete
-	// expunges. The dropped connection is what makes it reachable: it skips the
-	// guarded openBox on the very delivery that goes on to settle.
-	it("never settles an exhausted delete off a uid-keyed probe that skipped the cursor guard", async () => {
-		h.connectionErrors = [new Error("ECONNRESET")];
-		h.connection.openBox = async (path: string) => {
-			h.openBoxPath = path;
-			return { uidvalidity: 999 };
-		};
-
-		await handleMessageDelete(
-			moveEvent,
-			noopLogger,
-			MESSAGE_DELETE_MAX_ATTEMPTS,
-			deps(),
-		);
-
-		assert.equal(
-			called("connection.fetchMessages").length,
-			0,
-			"the guard refused the SELECT, so nothing was settled off a uid on the dead axis",
-		);
-		assert.equal(
-			called("message.delete").length,
-			0,
-			"a renumbered folder answers for a different message; nothing is reconciled away off it",
-		);
-		assert.equal(
-			(called("mailbox.update")[0]?.args[2] as { cursorState?: string })
-				?.cursorState,
-			"cursor_invalid",
-			"the probe trips the mailbox into a rebuild instead",
-		);
-		// Issue #1203: "leaving it for the cursor rebuild" was never an option —
-		// the rebuild matches rows by `(accountConfigId, mailboxId)`, so it only
-		// sees this row once the row names the source again. The source still
-		// answers to the Message-ID, so the pair the row goes back on is the one
-		// the server has just confirmed on the axis a UIDVALIDITY change leaves
-		// intact.
-		assert.deepEqual(
-			called("message.transitionPlacement")[0]?.args,
-			restoredToSource("synced"),
-		);
-	});
-
-	// Issue #1203, the redelivery half, and the mail-loss edge in it. INBOX was
-	// recreated (UIDVALIDITY bumped, which is why the cursor is paused), the
-	// MOVE never ran, and INBOX honestly answers "no" for the Message-ID because
-	// it no longer holds anything it used to. Trash holds an older copy of the
-	// same Message-ID at uid 77 — a sieve `fileinto` + `keep`, a resend — which
-	// `deriveMessageId` folds into this one local row. Settling `moved` on 77
-	// binds the row to that copy, and the next permanent delete expunges it:
-	// Trash is not paused, so no rebuild is ever coming to adjudicate there.
-	it("never settles a redelivered paused trash move as moved off a destination sighting", async () => {
-		h.mailbox = {
-			mailboxId: "src-mbx",
-			uidValidity: 1,
-			cursorState: "cursor_invalid",
-		};
-		h.sourceSearchUids = [];
-		h.destinationSearchUids = [77];
-
-		await handleMessageDelete(moveEvent, capturingLog(), 2, deps());
-
-		assert.equal(
-			called("message.updateUid").length,
-			0,
-			"a sighting off a source whose uid axis has moved is not proof this delete ran",
-		);
-		// The source pair is the set its own cursor rebuild walks and adjudicates
-		// by Message-ID, so handing the row back there is the reconcile path.
-		assert.deepEqual(
-			called("message.transitionPlacement")[0]?.args,
-			restoredToSource("abandoned"),
-		);
-		assert.equal(
-			loggedWith("alert", "message_delete_paused_placement_unproven").length,
-			1,
-			"a placement the server never settled is an operator's to adjudicate",
-		);
-	});
-
-	// Issue #1203 and the taxonomy `message-copy.ts` already applies: an
-	// evidence-free redelivery is broken, not settled. With no Message-ID header
-	// neither folder was asked, and silence is not an answer to write `synced`
-	// on. Route in: attempt 1 issues the MOVE, the confirmation comes back
-	// unprobeable, and the exhausted settle's guarded openBox trips the pause.
-	// `receiveCount === 1` there is not proof the command never left.
-	it("settles a paused delete broken when the MOVE was issued and neither folder can be asked", async () => {
-		h.connection.moveMessages = async () => ({ uidMap: new Map() });
-		sourceNoLongerHoldsTheUid();
-		h.messageRow = { status: "moving" };
-		let opened = 0;
-		h.connection.openBox = async (path: string) => {
-			h.openBoxPath = path;
-			opened += 1;
-			// The folder was recreated between the confirmation probe and the
-			// settle, which is what the terminal resolver's guarded openBox
-			// refuses to settle off.
-			return { uidvalidity: opened > 2 ? 999 : 1 };
-		};
-
-		await handleMessageDelete(moveEvent, capturingLog(), 1, deps());
-
-		assert.deepEqual(
-			called("message.transitionPlacement")[0]?.args,
-			restoredToSource("abandoned"),
-			"the first attempt reaches this settle with the MOVE already issued, so `synced` claims what nothing confirmed",
-		);
-		assert.equal(
-			loggedWith("alert", "message_delete_paused_placement_unproven").length,
-			1,
-		);
-	});
-
-	// The user's delete was silently dropped. Nothing throws, nothing alerts and
-	// the row reads settled, so the only trace it ever leaves is this metric —
-	// the counterpart of copy's `message_copy_not_landed`.
-	it("counts a paused delete the server was never told about", async () => {
-		h.mailbox = {
-			mailboxId: "src-mbx",
-			uidValidity: 1,
-			cursorState: "rebuilding",
-		};
-
-		await handleMessageDelete(moveEvent, capturingLog(), 1, deps());
-
-		const dropped = loggedWith("metric", "message_delete_dropped_on_pause");
-		assert.equal(dropped.length, 1);
-		assert.equal(dropped[0]?.level, "warn");
-		assert.deepEqual(
-			called("message.transitionPlacement")[0]?.args,
-			restoredToSource("synced"),
-		);
-	});
-
-	// The listing rows decide the outcome, so the caller has already read them.
-	// Reading them a second time inside `restoreSourcePlacement` is a query per
-	// hand-back for an answer already in hand.
-	it("reads the listing rows once per hand-back", async () => {
-		h.mailbox = {
-			mailboxId: "src-mbx",
-			uidValidity: 1,
-			cursorState: "rebuilding",
-		};
-
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.equal(called("threadMessage.findAllByMessageId").length, 1);
-	});
-
-	// A permanent delete has no destination, so the resync was gated off
-	// entirely: `handBackDelete` removed the local row, nothing enqueued a
-	// SYNC_MESSAGES, and the mail was invisible until the next scheduled sync
-	// while the server still held it. One folder is all this event touches, and
-	// SYNC_MESSAGES on a paused mailbox routes to the cursor rebuild.
-	it("resyncs the source folder after a paused permanent delete removes the local rows", async () => {
-		h.mailbox = {
-			mailboxId: "src-mbx",
-			uidValidity: 1,
-			cursorState: "rebuilding",
-		};
-		h.allThreadMessages = [];
-
-		await handleMessageDelete(permanent(), capturingLog(), 1, deps());
-
-		assert.deepEqual(
-			called("emitEvent").map((c) => c.args[0]),
-			[{ type: "SYNC_MESSAGES", accountId: "acc-1", mailboxId: "src-mbx" }],
-			"the folder whose rows just went must be told to re-project them",
-		);
-	});
-
-	// The pause is the expected skip the guard doc calls never-a-fault, so it
-	// alerted on every routine paused permanent delete. The fact that local mail
-	// went while the server copy survived still has to be readable.
-	it("does not alert on a routine paused permanent delete", async () => {
-		h.mailbox = {
-			mailboxId: "src-mbx",
-			uidValidity: 1,
-			cursorState: "rebuilding",
-		};
-		h.allThreadMessages = [];
-
-		await handleMessageDelete(permanent(), capturingLog(), 1, deps());
-
-		assert.deepEqual(
-			h.logs.filter((line) => line.level === "error"),
-			[],
-			"a pause the guard expects never pages anyone",
-		);
-		const dropped = loggedWith("metric", "message_delete_dropped_on_pause");
-		assert.equal(dropped.length, 1);
-		assert.equal(
-			dropped[0]?.fields.localRowsRemoved,
-			true,
-			"local mail disappearing while the server still holds it stays visible",
-		);
-	});
-
-	// A refusal is not a pause: the product declined something the user asked
-	// for, and that still wakes someone.
-	it("keeps alerting when a refused delete removed the last listing rows", async () => {
-		h.allThreadMessages = [];
-		const unversioned = {
-			...permanent(),
-			schemaVersion: undefined,
-		} as unknown as MessageDeleteEvent;
-
-		await handleMessageDelete(unversioned, capturingLog(), 1, deps());
-
-		assert.equal(
-			loggedWith("alert", "message_delete_unknown_schema_version").length,
-			1,
-		);
-	});
-
-	// Issue #1122 on the same path. Trash already held an older copy of this
-	// Message-ID and the MOVE never ran, so the destination hit is not this
-	// message. The source is asked first for exactly this reason, and its answer
-	// ends it — settling on uid 12 would hand Empty Trash a stranger's uid.
-	it("never binds a redelivered paused trash move to an older copy while the source still answers", async () => {
-		h.mailbox = {
-			mailboxId: "src-mbx",
-			uidValidity: 1,
-			cursorState: "cursor_invalid",
-		};
-		h.sourceSearchUids = [4];
-		h.destinationSearchUids = [12];
-
-		await handleMessageDelete(moveEvent, noopLogger, 2, deps());
-
-		assert.equal(called("message.updateUid").length, 0);
-		assert.deepEqual(
-			called("message.transitionPlacement")[0]?.args,
-			restoredToSource("synced"),
-		);
-	});
-
-	// A paused settle is a settle, so both folders re-read their counts from
-	// IMAP — the same resync every other terminal verdict in this handler runs.
-	// Without it the repair depended entirely on someone else arming the
-	// mailbox's rebuild.
-	it("resyncs both folders after a paused delete settles", async () => {
-		h.mailbox = {
-			mailboxId: "src-mbx",
-			uidValidity: 1,
-			cursorState: "rebuilding",
-		};
-
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.deepEqual(
-			called("emitEvent").map((c) => c.args[0]),
-			[
-				{ type: "SYNC_MESSAGES", accountId: "acc-1", mailboxId: "src-mbx" },
-				{ type: "SYNC_MESSAGES", accountId: "acc-1", mailboxId: "trash-mbx" },
-			],
-		);
-	});
-
-	it("skips without opening a connection when the cursor is rebuilding", async () => {
-		h.mailbox = {
-			mailboxId: "src-mbx",
-			uidValidity: 1,
-			cursorState: "rebuilding",
-		};
-
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.equal(h.getConnectionCount, 0);
-		assert.deepEqual(
-			called("message.transitionPlacement")[0]?.args,
-			restoredToSource("synced"),
-		);
-	});
-
-	// A permanent delete drops its listing rows at enqueue and only the sync
-	// path can shape them, so restoring the Message alone leaves mail nothing
-	// can list. The row is removed instead and the mailbox's own resync
-	// re-projects it — leaving it `deleting` made the message invisible locally
-	// while the server still held it (issue #1203). The rule is the listing
-	// rows, the same one `abandonDelete` resolves this state by, not the
-	// operation on the event.
-	it("removes a paused delete that has no listing rows left to restore", async () => {
-		h.mailbox = {
-			mailboxId: "src-mbx",
-			uidValidity: 1,
-			cursorState: "rebuilding",
-		};
-		h.allThreadMessages = [];
-
-		await handleMessageDelete(permanent(), noopLogger, 1, deps());
-
-		assert.equal(h.getConnectionCount, 0);
-		assert.deepEqual(called("message.delete")[0]?.args, ["msg-1"]);
-		assert.equal(
-			restoreCalls().length,
-			0,
-			"a row no listing can reach is never restored",
-		);
-	});
-
-	it("removes a paused move to trash whose listing rows are already gone", async () => {
-		h.mailbox = {
-			mailboxId: "src-mbx",
-			uidValidity: 1,
-			cursorState: "rebuilding",
-		};
-		h.allThreadMessages = [];
-
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.deepEqual(called("message.delete")[0]?.args, ["msg-1"]);
-		assert.equal(
-			restoreCalls().length,
-			0,
-			"restoring a Message no listing can reach is the silent vanish, not a hand-back",
-		);
-	});
-
-	it("acks terminally without connecting when the mailbox was deleted", async () => {
-		h.mailboxError = Object.assign(new Error("Mailbox not found: src-mbx"), {
-			name: "NotFoundError",
-		});
-
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.equal(h.getConnectionCount, 0);
-		assert.equal(called("message.updateUid").length, 0);
-		assert.equal(called("message.delete").length, 0);
-	});
-
-	it("returns early without connecting when the account is soft-deleted", async () => {
-		h.account = {
-			accountId: "acc-1",
-			accountConfigId: "cfg-1",
-			deletedAt: Date.now(),
-		};
-
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.equal(h.getConnectionCount, 0);
-	});
-
-	it("throws when the account no longer exists", async () => {
-		h.account = null;
-
-		await assert.rejects(
-			handleMessageDelete(moveEvent, noopLogger, 1, deps()),
-			/not found/,
-		);
-	});
-});
-
-describe("handleMessageDelete — folder paths come from the mailbox rows", () => {
-	beforeEach(() => {
-		h = fresh();
-	});
-
-	const movedTo = (): string[] => {
-		const destinations: string[] = [];
-		h.connection.moveMessages = async (
-			_uids: number[],
-			destination: string,
-		) => {
-			destinations.push(destination);
-			return { uidMap: new Map([[10, 20]]) };
-		};
-		return destinations;
-	};
-
-	it("runs a delete enqueued with the version 2 payload that carries folder paths", async () => {
-		const destinations = movedTo();
-
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.deepEqual(destinations, ["Trash"]);
-		assert.deepEqual(called("message.updateUid")[0]?.args, [
-			"msg-1",
-			20,
-			"trash-mbx",
-		]);
-	});
-
-	it("runs a delete enqueued with the pathless payload", async () => {
-		const destinations = movedTo();
-		const pathless: MessageDeleteEvent = {
-			type: "MESSAGE_DELETE",
-			schemaVersion: 3,
-			eventId: "evt-1",
-			timestamp: 1,
-			accountId: "acc-1",
-			messageId: "msg-1",
-			mailboxId: "src-mbx",
-			uid: 10,
-			operation: "move_to_trash",
-			destinationMailboxId: "trash-mbx",
-		};
-
-		await handleMessageDelete(pathless, noopLogger, 1, deps());
-
-		assert.deepEqual(destinations, ["Trash"]);
-		assert.deepEqual(called("message.updateUid")[0]?.args, [
-			"msg-1",
-			20,
-			"trash-mbx",
-		]);
-	});
-
-	it("moves to Trash under its current path when the folder was renamed after enqueue", async () => {
-		const destinations = movedTo();
-		const opened: string[] = [];
-		const openBox = h.connection.openBox;
-		h.connection.openBox = async (path: string) => {
-			opened.push(path);
-			return openBox(path);
-		};
-		h.folderPaths = { "src-mbx": "Mail/INBOX", "trash-mbx": "Deleted Items" };
-
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.equal(opened[0], "Mail/INBOX");
-		assert.deepEqual(destinations, ["Deleted Items"]);
-	});
-
-	it("opens the source under its current path when it was renamed after enqueue", async () => {
-		const destinations = movedTo();
-		const opened: string[] = [];
-		const openBox = h.connection.openBox;
-		h.connection.openBox = async (path: string) => {
-			opened.push(path);
-			return openBox(path);
-		};
-		h.folderPaths = { "src-mbx": "Old/Inbox-renamed", "trash-mbx": "Trash" };
-
-		await handleMessageDelete(moveEvent, noopLogger, 1, deps());
-
-		assert.equal(opened[0], "Old/Inbox-renamed");
-		assert.deepEqual(destinations, ["Trash"]);
-	});
-
-	it("resyncs the source when a redelivered delete finds the Trash mailbox deleted", async () => {
-		h.goneMailboxIds = ["trash-mbx"];
-
-		await handleMessageDelete(moveEvent, noopLogger, 2, deps());
-
-		assert.deepEqual(called("emitEvent")[0]?.args, [
-			{ type: "SYNC_MESSAGES", accountId: "acc-1", mailboxId: "src-mbx" },
-		]);
-	});
-
-	it("hands the row back without connecting when the Trash mailbox was deleted", async () => {
-		h.goneMailboxIds = ["trash-mbx"];
-		const destinations = movedTo();
-
-		await handleMessageDelete(moveEvent, capturingLog(), 1, deps());
-
-		assert.equal(h.getConnectionCount, 0);
-		assert.deepEqual(destinations, []);
-		assert.equal(called("connection.deleteMessages").length, 0);
-		assert.equal(called("message.delete").length, 0);
-		assert.deepEqual(restoreCalls()[0]?.args, restoredToSource("abandoned"));
-		assert.equal(
-			loggedWith("alert", "message_delete_destination_gone").length,
-			1,
-		);
-	});
-});