@remit/mailbox-service 0.0.110 → 0.0.112

package/src/body-sync.ts

@@ -5,9 +5,10 @@ import {
 	recordCalendarSuggestion,
 } from "@remit/calendar-service";
 import {
+	type BodyPartItem,
 	type IAddressRepository,
+	type ICalendarStore,
 	type ICalendarSuggestionRepository,
-	type ICalendarUnitOfWork,
 	type IEnvelopeRepository,
 	type IFilterRepository,
 	type IMailboxSpecialUseRepository,
@@ -18,8 +19,13 @@ import {
 	type ThreadMessageItem,
 	type UpdateMessageInput,
 } from "@remit/data-ports";
-import { NotFoundError } from "@remit/data-ports/errors";
+import {
+	MessageGoneFromServerError,
+	MessagePlacementUnsettledError,
+	NotFoundError,
+} from "@remit/data-ports/errors";
 import { deriveAddressId, deriveBodyPartId } from "@remit/data-ports/id";
+import { isEncapsulatedMessage } from "@remit/data-ports/message-parts";
 import { isBulkSender } from "@remit/data-ports/wellknown";
 import {
 	FilterState,
@@ -28,6 +34,7 @@ import {
 	PlacementConfidence,
 	QuarantineFailureStage,
 	SenderTrust,
+	SyncWarningStage,
 } from "@remit/domain-enums";
 import {
 	isStorageNotFoundError,
@@ -37,12 +44,16 @@ import {
 import { type ParsedMail, simpleParser } from "mailparser";
 import pMap from "p-map";
 import { BodyParseError, parseMessageBody } from "./body-parse.js";
-import { mapBodyPartsToContent } from "./body-part-mapper.js";
+import {
+	mapMessagePartsToContent,
+	parsePartSource,
+} from "./body-part-mapper.js";
 import { calendarParts } from "./calendar-parts.js";
 import {
 	classifyParsedMessage,
 	extractPrimaryFromEmail,
 } from "./classify-message.js";
+
 import { extractListId } from "./filters/list-id.js";
 import type { FilterMessage } from "./filters/match.js";
 import {
@@ -62,9 +73,12 @@ import {
 	denormalizeMessageCategory,
 	hasDecidedCategory,
 } from "./message-category.js";
+import { isMessageGoneFromOpenMailbox } from "./message-presence.js";
 import type { PlacementMoveService } from "./placement-move.js";
+import { isPlacementUnsettled, uidMailboxIdOf } from "./placement-settled.js";
 import { type QuarantineService, shapeFromMessageData } from "./quarantine.js";
 import { extractSnippetFromEmail } from "./snippet.js";
+import type { SyncWarningService } from "./sync-warning.js";
 import { type IImapConnection, MailConnectionError } from "./types.js";
 
 const BODY_PART_STORE_CONCURRENCY = 4;
@@ -112,12 +126,20 @@ export const isBodyPartDeferralEnabled = (): boolean => {
  * single HEAD and early-returns, skipping the body.eml GET, the MIME re-parse,
  * and the per-leaf HEADs on every warm re-open.
  *
- * Deliberately an S3-only marker (no Message-row flag): a DDB write would
- * re-fire the redundant vector upsert that #607 removed. A leading dot keeps it
+ * Deliberately an S3-only marker (no Message-row flag). A leading dot keeps it
  * out of any real IMAP section path (those are dot-separated digits).
  */
 const MATERIALIZED_SENTINEL_PART_PATH = ".materialized";
 
+/**
+ * The sentinel for a message carrying a forwarded message. Those parts were
+ * once stored under a layout in which the forwarded message's root overwrote
+ * its own row, so a `.materialized` written then vouches for objects at the
+ * wrong paths. Its own name makes every such message materialize once more,
+ * overwriting what is there; no other message is touched.
+ */
+const MATERIALIZED_SENTINEL_V2_PART_PATH = ".materialized.2";
+
 /**
  * A mid-stream socket drop during the ranged body fetch surfaces as a typed
  * `MailConnectionError` (the connection layer classifies imapflow's
@@ -134,7 +156,7 @@ const isConnectionDrop = (error: unknown): boolean => {
 
 /**
  * Project a parsed message onto the fields a filter matches against (RFC 034) —
- * the literal-clause targets plus the text a semantic anchor embeds. Kept
+ * the literal-clause targets. Kept
  * separate from `ParsedMail` so {@link FilterPipeline} stays parser-agnostic.
  */
 const toFilterMessage = (parsed: ParsedMail): FilterMessage => ({
@@ -241,10 +263,15 @@ export interface StoreBodyPartContentsResult {
 export type ConnectionGetter = () => Promise<IImapConnection>;
 
 export interface BodySyncFolder {
+	mailboxId: string;
 	fullPath: string;
 	placement: FolderPlacement;
 }
 
+export interface BodySyncRoundFolder extends BodySyncFolder {
+	uidValidity: number;
+}
+
 export interface PlacementConfig {
 	mailboxSpecialUseService: IMailboxSpecialUseRepository;
 	/**
@@ -289,7 +316,7 @@ export interface UnsubscribeConfig {
 /**
  * What body sync needs to offer a mail's invitation as a card (issue #1033).
  *
- * The unit of work is here to provision the account's default collection on
+ * The calendar store is here to provision the account's default collection on
  * first use, through the one function every other caller provisions with. That
  * is not bookkeeping: an invitation whose DTSTART names no zone is RFC 5545
  * floating time, and reading it anywhere but where the user's calendar lives
@@ -301,7 +328,7 @@ export interface UnsubscribeConfig {
  */
 export interface CalendarSuggestionConfig {
 	calendarSuggestionService: ICalendarSuggestionRepository;
-	calendarUnitOfWork: ICalendarUnitOfWork;
+	calendarStore: ICalendarStore;
 	filterService: Pick<IFilterRepository, "listByAccountAndState">;
 }
 
@@ -315,6 +342,7 @@ export class BodySyncService {
 		private threadMessageService: IThreadMessageRepository,
 		private addressService: IAddressRepository,
 		private envelopeService: IEnvelopeRepository,
+		private readonly syncWarningService: SyncWarningService,
 		logger?: BodySyncLogger,
 		private readonly placementConfig?: PlacementConfig,
 		private readonly filterConfig?: FilterConfig,
@@ -328,34 +356,16 @@ export class BodySyncService {
 			: undefined;
 	}
 
-	/**
-	 * Sync message bodies for a batch of messages.
-	 *
-	 * Fail-fast on connection errors: if the IMAP connection is lost,
-	 * immediately stop processing and return all remaining messages as failed
-	 * so they can be requeued for later retry.
-	 *
-	 * @param messageIds - The message IDs to sync bodies for
-	 * @param accountId - The account ID (for storage path)
-	 * @param accountConfigId - The account config ID (for thread updates)
-	 * @param folder - The IMAP mailbox path and its folder placement
-	 * @param getConnection - Function to get a (lazy) IMAP connection
-	 * @param force - Bypass the "already stored" skip guard and re-fetch every
-	 * message in this batch even though `bodyStorageKey` is already set. Set
-	 * only by the read-miss re-arm cue (a `/content` read found the storage
-	 * object missing despite the DB row saying otherwise); bulk metadata-sync
-	 * never sets this, so it keeps skipping on `bodyStorageKey` with no
-	 * existence check.
-	 */
 	async syncBodies(
 		messageIds: string[],
 		accountId: string,
 		accountConfigId: string,
-		folder: BodySyncFolder,
+		folder: BodySyncRoundFolder,
 		getConnection: ConnectionGetter,
 		force = false,
 	): Promise<SyncBodiesResult> {
 		const syncedMessageIds: string[] = [];
+		const syncedUids: number[] = [];
 		let skippedCount = 0;
 		const location = {
 			accountId,
@@ -385,8 +395,22 @@ export class BodySyncService {
 		const quarantined =
 			await this.quarantineConfig?.quarantineService.load(accountConfigId);
 
+		const rows = new Map(
+			(await this.messageService.get(messageIds)).map((row) => [
+				row.messageId,
+				row,
+			]),
+		);
+
 		for (const messageId of messageIds) {
-			const message = await this.messageService.get(messageId);
+			const message = rows.get(messageId);
+
+			// A row deleted since the batch was cut, or moved out of this folder
+			// for good, has no uid here; its new uid would fetch another message.
+			if (!message || uidMailboxIdOf(message) !== folder.mailboxId) {
+				skippedCount++;
+				continue;
+			}
 
 			// A quarantined message has no stored body, so nothing else here would
 			// stop it being fetched and re-parsed on every redelivery, forever.
@@ -454,43 +478,31 @@ export class BodySyncService {
 						reStoredMessageIds.has(messageId),
 					);
 				} catch (error) {
-					// A per-message store failure (e.g. the parsed-body S3 write) is a
-					// real fault, but it must not silently mark the message synced —
-					// that would leave parsedBody null and the message unindexed. Leave
-					// the UID in `pending` so it lands in failedMessageIds and the SQS
-					// batch requeues just this message. A dropped connection is handled
-					// by the outer catch (fail-fast on the whole remaining batch).
-					if (isConnectionDrop(error)) throw error;
-
 					// The one error in this frame that is the message's own fault. It
-					// reaches here from the parse call and nowhere else, so the S3, DDB
-					// and SQS work this same frame wraps cannot be mistaken for it and
-					// keeps requeueing below. The row is durable before the UID leaves
-					// `pending`, so the message is never let go of unrecorded.
-					if (
-						error instanceof BodyParseError &&
-						(await this.quarantineBodyParse(messageId, location, error))
-					) {
+					// reaches here from the parse call and nowhere else, so the S3, DB
+					// and queue work this same frame wraps cannot be mistaken for it.
+					// The row is durable before the UID leaves `pending`, so the
+					// message is never let go of unrecorded.
+					if (error instanceof BodyParseError && this.quarantineConfig) {
+						await this.recordQuarantine(
+							this.quarantineConfig,
+							messageId,
+							location,
+							error,
+						);
 						pending.delete(uid);
 						skippedCount++;
 						source.resume();
 						continue;
 					}
 
-					this.log.error?.(
-						{
-							messageId,
-							errorName: (error as { name?: string }).name,
-							error: (error as Error).message,
-						},
-						"Body store failed for message; leaving for requeue",
-					);
-					// Drain the stream so the connection stays usable for the next UID.
-					source.resume();
-					continue;
+					// Anything else is our own storage, database or queue failing. It
+					// aborts the batch, which redelivers whole; what stored skips.
+					throw error;
 				}
 				pending.delete(uid);
 				syncedMessageIds.push(messageId);
+				syncedUids.push(uid);
 			}
 		} catch (error) {
 			this.log.error?.(
@@ -514,6 +526,21 @@ export class BodySyncService {
 		// server silently omitted) — re-enqueue it.
 		const failedMessageIds = [...pending.values()];
 
+		await this.syncWarningService.settle(
+			{
+				accountConfigId,
+				accountId,
+				mailboxId: folder.mailboxId,
+				uidValidity: folder.uidValidity,
+			},
+			SyncWarningStage.Body,
+			{
+				failedUids: [...pending.keys()],
+				syncedUids,
+				serverUids: { kind: "Unlisted" },
+			},
+		);
+
 		this.log.info(
 			{
 				synced: syncedMessageIds.length,
@@ -529,53 +556,10 @@ export class BodySyncService {
 	}
 
 	/**
-	 * Set a message aside because its body will not parse (issue #72).
-	 *
-	 * Returns false when no record was written — either because this service was
-	 * built without a quarantine writer, or because writing it failed. The
-	 * caller then falls back to requeueing rather than dropping a message no
-	 * record survives. The failure the row carries is the parser's, and only the
-	 * parser's — see {@link BodyParseError}.
-	 *
-	 * Reading and writing the record is storage and database work, so its own
-	 * failure is contained per message the same way the save it replaces is: it
-	 * must not take down a batch that has other messages to fetch, and in the
-	 * stream loop a throw would also skip `source.resume()` and leave the
-	 * literal undrained on an otherwise usable connection.
-	 *
-	 * The fingerprint comes from the BodyPart rows metadata sync already wrote:
-	 * the body path streams raw bytes and has no FETCH result to read, and
-	 * re-reading headers the parser has just refused would be reading the very
-	 * thing that is broken.
+	 * Set a message aside because its body will not parse (issue #72). The
+	 * fingerprint comes from the BodyPart rows metadata sync already wrote: the
+	 * body path streams raw bytes and has no FETCH result to read.
 	 */
-	private async quarantineBodyParse(
-		messageId: string,
-		location: {
-			accountId: string;
-			accountConfigId: string;
-			mailboxPath: string;
-		},
-		error: BodyParseError,
-	): Promise<boolean> {
-		const config = this.quarantineConfig;
-		if (!config) return false;
-
-		return this.recordQuarantine(config, messageId, location, error).then(
-			() => true,
-			(writeError: unknown) => {
-				this.log.error?.(
-					{
-						messageId,
-						errorName: (writeError as { name?: string }).name,
-						error: inspect(writeError),
-					},
-					"Could not record quarantine; leaving the message for requeue",
-				);
-				return false;
-			},
-		);
-	}
-
 	private async recordQuarantine(
 		config: QuarantineConfig,
 		messageId: string,
@@ -588,6 +572,10 @@ export class BodySyncService {
 	): Promise<void> {
 		const message = await this.messageService.get(messageId);
 		const messageData = await this.envelopeService.getMessageData(messageId);
+		const threadMessage = await this.threadMessageService.findByMessageId(
+			location.accountConfigId,
+			messageId,
+		);
 
 		await config.quarantineService.record(
 			{
@@ -604,7 +592,11 @@ export class BodySyncService {
 				code: error.failureCode,
 				message: error.message,
 			},
-			shapeFromMessageData(message, messageData),
+			shapeFromMessageData(
+				message,
+				messageData,
+				threadMessage?.messageIdHeader,
+			),
 		);
 	}
 
@@ -761,7 +753,8 @@ export class BodySyncService {
 					accountConfigId,
 					accountId,
 					messageId,
-					parsed,
+					await this.envelopeService.listBodyParts(messageId),
+					body,
 				);
 			}
 			await this.messageService.update(messageId, {
@@ -806,6 +799,7 @@ export class BodySyncService {
 		// The DECISION is computed here; the applies below are unswallowed.
 		const filterDecision = await this.evaluateFilters(
 			accountConfigId,
+			accountId,
 			messageId,
 			parsed,
 		);
@@ -813,10 +807,10 @@ export class BodySyncService {
 		// Store the parsed-body cache BEFORE persisting bodyStorageKey. The skip
 		// guard in syncBodies treats a stored bodyStorageKey as "fully synced",
 		// so if we wrote it first and the parsed-cache write then failed, the
-		// requeued retry would skip the message — leaving parsedBody null and the
-		// search-index upsert bodyless forever. A parsed-cache failure here throws
-		// and propagates before bodyStorageKey is written, so the requeued message
-		// genuinely re-attempts the parsed write and gets indexed.
+		// requeued retry would skip the message — leaving parsedBody null forever.
+		// A parsed-cache failure here throws and propagates before bodyStorageKey
+		// is written, so the requeued message genuinely re-attempts the parsed
+		// write.
 		await this.storeParsedBodyCache(
 			accountConfigId,
 			accountId,
@@ -833,7 +827,8 @@ export class BodySyncService {
 				accountConfigId,
 				accountId,
 				messageId,
-				parsed,
+				await this.envelopeService.listBodyParts(messageId),
+				body,
 			);
 		}
 
@@ -854,10 +849,13 @@ export class BodySyncService {
 			// offer an undo back to it (issue #223). Snapshotted into the marker
 			// rather than read from `originalMailboxId` at derive time, which a
 			// later user move would overwrite — the filter's source must survive an
-			// undo to stay derivable.
-			const sourceMailboxId = (await this.messageService.get(messageId))
-				.mailboxId;
-			await this.filterConfig?.placementMoveService.moveMessage(
+			// undo to stay derivable. A redelivery after a failed enqueue finds
+			// the move already applied locally, so the source is the folder the
+			// uid still names, not the one the row now points at.
+			const sourceMailboxId = uidMailboxIdOf(
+				await this.messageService.get(messageId),
+			);
+			const filed = await this.filterConfig?.placementMoveService.moveMessage(
 				accountConfigId,
 				messageId,
 				destinationMailboxId,
@@ -868,7 +866,7 @@ export class BodySyncService {
 			// there matches but was not moved by Remit. `moveMessage` no-ops in that
 			// case; record neither the marker nor `movedByRemit`, so the badge never
 			// claims a move that did not happen and its Undo is never a no-op.
-			if (sourceMailboxId !== destinationMailboxId) {
+			if (sourceMailboxId !== destinationMailboxId && filed !== "refused") {
 				filterMoved = true;
 				filterMove = {
 					filterId: filterDecision.move.filterId,
@@ -928,9 +926,8 @@ export class BodySyncService {
 		const moved = Boolean(resolved.move || filterMoved);
 
 		// ONE Message UpdateItem per synced message: bodyStorageKey + every
-		// classification/derived field + the move flag + the audit verdict. Each
-		// extra Message mutation emits a DDB stream record that fans out to a
-		// redundant S3-Vectors upsert, so we collapse them into a single write.
+		// classification/derived field + the move flag + the audit verdict,
+		// collapsed into a single write.
 		// The flag is folded in only when a move WAS applied (by the classifier or
 		// a filter); the verdict is folded in whenever Remit decided to act.
 		// Written LAST so bodyStorageKey — the skip-guard signal — is only durable
@@ -1047,7 +1044,9 @@ export class BodySyncService {
 				);
 				needsStore = true;
 				body = await this.fetchFromImap(
-					message.uid,
+					message,
+					accountId,
+					accountConfigId,
 					folder.fullPath,
 					getConnection,
 				);
@@ -1056,7 +1055,9 @@ export class BodySyncService {
 			// Fetch from IMAP and store
 			needsStore = true;
 			body = await this.fetchFromImap(
-				message.uid,
+				message,
+				accountId,
+				accountConfigId,
 				folder.fullPath,
 				getConnection,
 			);
@@ -1099,14 +1100,75 @@ export class BodySyncService {
 	}
 
 	private async fetchFromImap(
-		uid: number,
+		message: MessageItem,
+		accountId: string,
+		accountConfigId: string,
 		mailboxPath: string,
 		getConnection: ConnectionGetter,
 	): Promise<Buffer> {
+		const { uid } = message;
 		this.log.debug?.({ uid }, "Fetching body from IMAP");
 		const connection = await getConnection();
 		await connection.openBox(mailboxPath);
-		return connection.fetchMessageBody(uid);
+		const body = await connection.fetchMessageBody(uid);
+		if (body) return body;
+
+		if (!(await isMessageGoneFromOpenMailbox(connection, uid))) {
+			throw new Error(
+				`IMAP FETCH returned no source for UID ${uid} in ${mailboxPath}, which the server still lists`,
+			);
+		}
+
+		return this.reconcileGoneMessage(message, accountId, mailboxPath);
+	}
+
+	/**
+	 * The server no longer holds the message at the row's UID. A row with our
+	 * own move or delete in flight belongs to that mutation (409). A settled row
+	 * is removed with its thread entries, but only while its placement still
+	 * matches what was read (imap-mutations R3); losing that predicate is a 409
+	 * like any other lost placement transition.
+	 */
+	private async reconcileGoneMessage(
+		message: MessageItem,
+		accountId: string,
+		mailboxPath: string,
+	): Promise<never> {
+		const { messageId, uid } = message;
+		if (isPlacementUnsettled(message)) {
+			throw new MessagePlacementUnsettledError(
+				`Message ${messageId} is not at its UID while a move or delete is in flight`,
+				accountId,
+				messageId,
+				"in_flight",
+			);
+		}
+
+		const reconciled = await this.messageService.deleteIfPlacement(messageId, {
+			status: message.status,
+			mailboxId: message.mailboxId,
+			uid,
+		});
+
+		if (!reconciled) {
+			throw new MessagePlacementUnsettledError(
+				`Message ${messageId} changed placement while its absence from ${mailboxPath} was being reconciled`,
+				accountId,
+				messageId,
+				"in_flight",
+			);
+		}
+
+		this.log.info(
+			{
+				metric: "message_gone_stale_row_reconciled",
+				messageId,
+				uid,
+				mailboxPath,
+			},
+			"Message no longer on the mail server (expunged or moved by another client); stale row reconciled",
+		);
+		throw new MessageGoneFromServerError(messageId);
 	}
 
 	/**
@@ -1298,7 +1360,7 @@ export class BodySyncService {
 		const parts = calendarParts(parsed);
 		if (parts.length === 0) return;
 
-		const { calendarUnitOfWork, calendarSuggestionService, filterService } =
+		const { calendarStore, calendarSuggestionService, filterService } =
 			this.calendarConfig;
 
 		await Promise.resolve()
@@ -1328,7 +1390,7 @@ export class BodySyncService {
 				// the organizer meant it. Idempotent: the id is derived, so a second
 				// first use returns the collection the first one made.
 				const collection = await provisionDefaultCalendar(
-					calendarUnitOfWork,
+					calendarStore,
 					accountConfigId,
 				);
 				for (const part of parts) {
@@ -1398,12 +1460,14 @@ export class BodySyncService {
 	 */
 	private async evaluateFilters(
 		accountConfigId: string,
+		accountId: string,
 		messageId: string,
 		parsed: ParsedMail,
 	): Promise<FilterDecision> {
 		if (!this.filterPipeline) return { labels: [] };
 		return this.filterPipeline.evaluate(
 			accountConfigId,
+			accountId,
 			messageId,
 			toFilterMessage(parsed),
 		);
@@ -1412,8 +1476,7 @@ export class BodySyncService {
 	/**
 	 * Resolve the placement decision for a message, BEFORE the single Message
 	 * update — so both the `movedByRemit` flag and the audit verdict join that
-	 * one UpdateItem instead of a second mutation that would fan out another
-	 * redundant S3-Vectors upsert. Drives both directions (junk → inbox rescue,
+	 * one UpdateItem instead of a second mutation. Drives both directions (junk → inbox rescue,
 	 * inbox → junk demote) off the pure {@link classifyPlacement} verdict.
 	 *
 	 * Returns a {@link PlacementOutcome}: a `verdict` to persist whenever Remit
@@ -1667,10 +1730,10 @@ export class BodySyncService {
 		accountConfigId: string,
 		accountId: string,
 		messageId: string,
-		parsed: ParsedMail,
+		bodyParts: readonly BodyPartItem[],
+		body: Buffer,
 		options?: { skipExisting?: boolean },
 	): Promise<StoreBodyPartContentsResult> {
-		const bodyParts = await this.envelopeService.listBodyParts(messageId);
 		if (bodyParts.length === 0) {
 			this.log.debug?.(
 				{ messageId },
@@ -1680,31 +1743,32 @@ export class BodySyncService {
 		}
 
 		const log = this.log;
-		const pairs = mapBodyPartsToContent(bodyParts, parsed, {
-			messageId,
-			logger:
-				log.warn || log.debug
-					? {
-							warn: (obj, msg) => {
-								log.warn?.(obj, msg);
-							},
-							debug: (obj, msg) => {
-								log.debug?.(obj, msg);
-							},
-						}
-					: undefined,
-		});
+		// A parse of its own: classification and the snippet, which search reads,
+		// need an inline forwarded message's text, which `ignoreEmbedded` keeps out.
+		const pairs = await mapMessagePartsToContent(
+			bodyParts,
+			await parsePartSource(body),
+			{
+				messageId,
+				logger:
+					log.warn || log.debug
+						? {
+								warn: (obj, msg) => {
+									log.warn?.(obj, msg);
+								},
+								debug: (obj, msg) => {
+									log.debug?.(obj, msg);
+								},
+							}
+						: undefined,
+			},
+		);
 
 		if (pairs.length === 0) {
 			return { stored: 0 };
 		}
 
-		const bodyPartIdByPath = new Map(
-			bodyParts.map((bp) => [bp.partPath, bp.bodyPartId]),
-		);
-
 		let stored = 0;
-		const textContents: { bodyPartId: string; content: string }[] = [];
 		await pMap(
 			pairs,
 			async (entry) => {
@@ -1728,30 +1792,10 @@ export class BodySyncService {
 					contentType: entry.contentType,
 				});
 				stored++;
-
-				if (
-					entry.contentType.toLowerCase().startsWith("text/") &&
-					entry.content.length > 0
-				) {
-					const bodyPartId = bodyPartIdByPath.get(entry.partPath);
-					if (bodyPartId) {
-						textContents.push({
-							bodyPartId,
-							content: entry.content.toString("utf8"),
-						});
-					}
-				}
 			},
 			{ concurrency: BODY_PART_STORE_CONCURRENCY },
 		);
 
-		if (textContents.length > 0) {
-			await this.envelopeService.upsertBodyPartContents(
-				messageId,
-				textContents,
-			);
-		}
-
 		this.log.info(
 			{ messageId, partCount: pairs.length, stored },
 			"Body parts stored",
@@ -1787,12 +1831,17 @@ export class BodySyncService {
 		messageId: string,
 		bodyStorageKey: string,
 	): Promise<StoreBodyPartContentsResult> {
+		const bodyParts = await this.envelopeService.listBodyParts(messageId);
+		const carriesMessage = bodyParts.some(isEncapsulatedMessage);
+		const sentinel = carriesMessage
+			? MATERIALIZED_SENTINEL_V2_PART_PATH
+			: MATERIALIZED_SENTINEL_PART_PATH;
 		if (
 			await this.storageService.bodyPartExists(
 				accountConfigId,
 				accountId,
 				messageId,
-				MATERIALIZED_SENTINEL_PART_PATH,
+				sentinel,
 			)
 		) {
 			this.log.debug?.(
@@ -1803,13 +1852,13 @@ export class BodySyncService {
 		}
 
 		const body = await this.storageService.retrieve(bodyStorageKey);
-		const parsed = await simpleParser(body);
 		const result = await this.storeBodyPartContents(
 			accountConfigId,
 			accountId,
 			messageId,
-			parsed,
-			{ skipExisting: true },
+			bodyParts,
+			body,
+			{ skipExisting: !carriesMessage },
 		);
 
 		// Reaching here means storeBodyPartContents resolved — `pMap` rejects on
@@ -1819,47 +1868,24 @@ export class BodySyncService {
 			accountConfigId,
 			accountId,
 			messageId,
-			partPath: MATERIALIZED_SENTINEL_PART_PATH,
+			partPath: sentinel,
 			content: Buffer.alloc(0),
 		});
 
 		return result;
 	}
 
-	/**
-	 * Persist the pre-parsed body cache. A failure here MUST fail the
-	 * surrounding body-sync: the parsed-body object is what the search-index
-	 * pipeline reads, so swallowing a write failure leaves the message marked
-	 * synced while `parsedBody` is null and it never gets indexed — a silent
-	 * search gap. Propagate so the message lands in failedMessageIds and the
-	 * SQS batch requeues it.
-	 */
 	private async storeParsedBodyCache(
 		accountConfigId: string,
 		accountId: string,
 		messageId: string,
 		parsed: ParsedMail,
 	): Promise<void> {
-		const parsedBody = toParsedBody(parsed);
-		try {
-			await this.storageService.storeParsedBody({
-				accountConfigId,
-				accountId,
-				messageId,
-				parsed: parsedBody,
-			});
-			this.log.debug?.({ messageId }, "Parsed body cache stored");
-		} catch (err: unknown) {
-			this.log.error?.(
-				{
-					messageId,
-					errorName: (err as { name?: string }).name,
-					errorCode: (err as { Code?: string }).Code,
-					error: inspect(err),
-				},
-				"Failed to store parsed body cache; failing sync to requeue",
-			);
-			throw err;
-		}
+		await this.storageService.storeParsedBody({
+			accountConfigId,
+			accountId,
+			messageId,
+			parsed: toParsedBody(parsed),
+		});
 	}
 }