@remit/mailbox-service 0.0.72 → 0.0.74

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.72",
+  "version": "0.0.74",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/message-delete-no-trash.test.ts

@@ -13,6 +13,7 @@ import {
 	MessageMoveService,
 	NoTrashMailboxError,
 	StaleTrashAppointmentError,
+	UnconfirmedTrashMailboxError,
 } from "./message-move.js";
 
 const ACCOUNT = "acc-1";
@@ -200,14 +201,34 @@ describe("delete only expunges when it was asked to", () => {
 		);
 	});
 
-	it("expunges a message already inside a Trash that resolves by name", async () => {
-		// D4a: the rows were selected and the dialog named the consequence, so
-		// consent is per message. Empty Trash has no such consent and refuses.
-		const { service, events } = buildWorld(
+	it("refuses to expunge a message already inside a Trash that only resolves by name", async () => {
+		// #876: a message already sitting in the guessed folder used to fall
+		// straight through to an expunge, on the same name guess Empty Trash
+		// refuses to act on. Deleting it is exactly as unrecoverable, so it
+		// demands the same confirmed evidence — nobody, neither the user nor the
+		// server, ever said this folder is Trash.
+		const { service, patches, events, message } = buildWorld(
 			{ kind: "proposed", mailbox: { mailboxId: TRASH, fullPath: "Trash" } },
 			TRASH,
 		);
 
+		await assert.rejects(
+			() => service.deleteMessages(ACCOUNT_CONFIG, [MESSAGE_ID], ACCOUNT),
+			(error: unknown) =>
+				error instanceof UnconfirmedTrashMailboxError &&
+				error.statusCode === 409 &&
+				error.publicApiError?.details?.reason === "unconfirmed" &&
+				error.publicApiError?.details?.accountId === ACCOUNT,
+		);
+
+		assert.deepEqual(events, []);
+		assert.deepEqual(patches, []);
+		assert.equal(message.mailboxId, TRASH);
+	});
+
+	it("expunges a message already inside a confirmed Trash", async () => {
+		const { service, events } = buildWorld(flaggedTrash, TRASH);
+
 		await service.deleteMessages(ACCOUNT_CONFIG, [MESSAGE_ID], ACCOUNT);
 
 		assert.deepEqual(

package/src/message-move.ts

@@ -162,7 +162,8 @@ export class StaleTrashAppointmentError extends FolderRoleUnresolvedError {
 
 /**
  * A folder resolves as Trash by its name alone. Enough to move mail into,
- * never enough to expunge — so only the Empty Trash path raises it.
+ * never enough to expunge — raised by Empty Trash and by a delete that would
+ * expunge a message already sitting in that folder.
  */
 export class UnconfirmedTrashMailboxError extends FolderRoleUnresolvedError {
 	name = "UnconfirmedTrashMailboxError";
@@ -307,12 +308,13 @@ export class MessageMoveService {
 		const wantsPermanentDelete =
 			options.permanent === true || options.toTrash === false;
 
-		const trashGate = wantsPermanentDelete
+		const trashResolution = wantsPermanentDelete
 			? null
-			: trashMailboxAt(
-					await this.mailboxSpecialUseService.resolveTrashRole(accountId),
-					"resolved",
-				);
+			: await this.mailboxSpecialUseService.resolveTrashRole(accountId);
+
+		const trashGate = trashResolution
+			? trashMailboxAt(trashResolution, "resolved")
+			: null;
 
 		if (trashGate && !trashGate.allowed) {
 			this.log.error(
@@ -324,6 +326,34 @@ export class MessageMoveService {
 
 		const trashMailbox = trashGate ? trashGate.mailbox : null;
 
+		// A message already sitting in the folder resolved as Trash deletes by
+		// expunging it, not by moving it — the same unrecoverable act Empty
+		// Trash performs, so it demands the same confirmed evidence. The name
+		// guess ("resolved") is enough to file mail into; it is never enough to
+		// destroy mail that is already there. Checked once, before any local
+		// write, so a batch that touches such a message is refused whole rather
+		// than partially expunged.
+		if (!wantsPermanentDelete && trashResolution && trashMailbox) {
+			const deletesInPlace = messages.some(
+				(message) => message.mailboxId === trashMailbox.mailboxId,
+			);
+
+			if (deletesInPlace) {
+				const confirmedTrashGate = trashMailboxAt(trashResolution, "confirmed");
+				if (!confirmedTrashGate.allowed) {
+					this.log.error(
+						{
+							accountId,
+							messageCount: messages.length,
+							reason: confirmedTrashGate.reason,
+						},
+						"Refused to delete: this account's Trash is not confirmed",
+					);
+					throw trashRefusal(confirmedTrashGate.reason, accountId);
+				}
+			}
+		}
+
 		// Group messages by operation type
 		const moveToTrashMessages: Array<{
 			messageId: string;

package/src/outbox-attachment.ts

@@ -7,10 +7,7 @@ import type {
 import { holdsRoom } from "@remit/data-ports";
 import { ConflictError } from "@remit/data-ports/errors";
 import { base36uuid } from "@remit/data-ports/id";
-import {
-	OutboxAttachmentRejectionReason,
-	OutboxMessageStatus,
-} from "@remit/domain-enums";
+import { OutboxAttachmentRejectionReason } from "@remit/domain-enums";
 import type { StorageService } from "@remit/storage-service";
 import {
 	buildOutboxAttachmentKey,
@@ -20,6 +17,7 @@ import {
 	normalizeAttachmentContentType,
 	sanitizeAttachmentFilename,
 } from "./outbox-attachment-filename.js";
+import { isOpenForWork } from "./outbox-status.js";
 
 /**
  * 25 MB is what most receiving servers accept, and base64 inflates it to roughly
@@ -111,9 +109,14 @@ export class OutboxAttachmentService {
 	 * Resolve a draft the caller is entitled to act on.
 	 *
 	 * Mode "act": the caller has named the draft, so a foreign one is denied with
-	 * 403 rather than feigned as a 404. An entry that has left draft is a
-	 * conflict. Both abort the request — only the file itself comes back as a
-	 * result the composer can render next to the row it refused.
+	 * 403 rather than feigned as a 404. An entry the user can no longer work on
+	 * is a conflict. Both abort the request — only the file itself comes back as
+	 * a result the composer can render next to the row it refused.
+	 *
+	 * Same predicate the composer's other two writes use. A `failed` message is
+	 * editable and sendable again (#933), and an attachment is part of what the
+	 * correction may be — a message refused for the wrong file would otherwise
+	 * still be stuck.
 	 */
 	private getWritableDraft = async (
 		accountConfigId: string,
@@ -125,7 +128,7 @@ export class OutboxAttachmentService {
 			"act",
 		);
 
-		if (outbox.status !== OutboxMessageStatus.draft) {
+		if (!isOpenForWork(outbox.status)) {
 			throw new ConflictError(
 				`This message is already ${outbox.status} and can no longer take an attachment. Start a new message to change it.`,
 			);

package/src/outbox-failed-recovery.test.ts

@@ -0,0 +1,366 @@
+/**
+ * The two ways an outbox row used to become unusable without ever leaving.
+ *
+ * `createAndSend` wrote the row at `queued` and then enqueued. A throw from the
+ * enqueue left it there, and `queued` is accepted by neither `send` nor
+ * `deleteDraft` — the message could be neither sent nor discarded (#936).
+ *
+ * A send that failed settled at `failed`, and `updateDraft` refused anything
+ * but `draft`. Retry re-queued the same envelope and Edit took a 409 on the
+ * flush that precedes the send, so a message refused for a bad address had no
+ * way back to sent short of retyping it (#933).
+ *
+ * Where a stranded row settles is the load-bearing part. Not `draft`: a throw
+ * from `SendMessage` says the response was lost, not that the broker refused
+ * the event, and `draft` is inside the SMTP worker's send fence — a row put
+ * there is sendable both by the event that landed anyway and by the user
+ * pressing Send. `failed` is outside that fence and, since #933, is a row the
+ * user can still edit and send.
+ */
+
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type {
+	IAccountRepository,
+	IOutboxMessageRepository,
+	OutboxMessageItem,
+	UpdateOutboxMessageInput,
+} from "@remit/data-ports";
+import { ConflictError } from "@remit/data-ports/errors";
+import { OutboxMessageStatus } from "@remit/domain-enums";
+import type { OutboxAttachmentService } from "./outbox-attachment.js";
+import { OutboxQueueService } from "./outbox-queue.js";
+
+const ACCOUNT_CONFIG_ID = "cfg-1";
+const ACCOUNT_ID = "acc-1";
+const OUTBOX_MESSAGE_ID = "ob-1";
+
+const row = (overrides: Partial<OutboxMessageItem>): OutboxMessageItem =>
+	({
+		outboxMessageId: OUTBOX_MESSAGE_ID,
+		accountId: ACCOUNT_ID,
+		accountConfigId: ACCOUNT_CONFIG_ID,
+		fromAddress: "me@example.com",
+		toAddresses: ["typo@exmaple.com"],
+		ccAddresses: [],
+		bccAddresses: [],
+		references: [],
+		messageIdValue: "<m1@example.com>",
+		subject: "Invoice",
+		textBody: "Attached.",
+		status: OutboxMessageStatus.draft,
+		createdAt: 0,
+		updatedAt: 0,
+		...overrides,
+	}) as OutboxMessageItem;
+
+interface ConditionalWrite {
+	expected: OutboxMessageItem["status"];
+	input: UpdateOutboxMessageInput;
+	applied: boolean;
+}
+
+interface Harness {
+	service: OutboxQueueService;
+	enqueued: string[];
+	createdStatuses: string[];
+	writes: ConditionalWrite[];
+	/** What the row holds now, after every write this harness applied. */
+	status: () => OutboxMessageItem["status"];
+}
+
+interface HarnessOptions {
+	enqueueFails?: Error;
+	settleFails?: Error;
+	/** Moves the row the instant the service reads it, as a racing writer would. */
+	movesOnRead?: OutboxMessageItem["status"];
+}
+
+const createHarness = (
+	stored: OutboxMessageItem,
+	options: HarnessOptions = {},
+): Harness => {
+	let current = stored;
+
+	const harness: Harness = {
+		service: undefined as unknown as OutboxQueueService,
+		enqueued: [],
+		createdStatuses: [],
+		writes: [],
+		status: () => current.status,
+	};
+
+	const outboxMessageService = {
+		get: async () => {
+			const seen = current;
+			if (options.movesOnRead) {
+				current = row({ ...current, status: options.movesOnRead });
+			}
+			return seen;
+		},
+		create: async (input: Record<string, unknown>) => {
+			current = row(input as Partial<OutboxMessageItem>);
+			harness.createdStatuses.push(current.status);
+			return current;
+		},
+		updateIfStatus: async (
+			_configId: string,
+			_id: string,
+			expected: OutboxMessageItem["status"],
+			input: UpdateOutboxMessageInput,
+		) => {
+			if (options.settleFails && input.status === OutboxMessageStatus.failed) {
+				throw options.settleFails;
+			}
+			const applied = current.status === expected;
+			harness.writes.push({ expected, input, applied });
+			if (!applied) return null;
+			current = row({ ...current, ...input });
+			return current;
+		},
+	} as unknown as IOutboxMessageRepository;
+
+	harness.service = new OutboxQueueService({
+		outboxMessageService,
+		outboxAttachmentService: {} as unknown as OutboxAttachmentService,
+		accountService: {} as unknown as IAccountRepository,
+		sqsSmtpQueueUrl: "http://localhost/queue",
+		sqsClient: {
+			send: async (command: { input: { MessageBody: string } }) => {
+				if (options.enqueueFails) throw options.enqueueFails;
+				harness.enqueued.push(command.input.MessageBody);
+				return {};
+			},
+		} as never,
+	});
+
+	return harness;
+};
+
+const createInput = {
+	accountId: ACCOUNT_ID,
+	accountConfigId: ACCOUNT_CONFIG_ID,
+	fromAddress: "me@example.com",
+	toAddresses: ["them@example.com"],
+	subject: "Invoice",
+	textBody: "Attached.",
+};
+
+const applied = (harness: Harness): UpdateOutboxMessageInput[] =>
+	harness.writes.filter((write) => write.applied).map((write) => write.input);
+
+describe("an enqueue that reports a failure", () => {
+	it("settles the new row of createAndSend at `failed`, never at `queued`", async () => {
+		const harness = createHarness(row({}), {
+			enqueueFails: new Error("SQS unavailable"),
+		});
+
+		await assert.rejects(
+			() => harness.service.createAndSend(createInput),
+			/SQS unavailable/,
+			"the caller still hears the failure",
+		);
+
+		assert.deepEqual(harness.createdStatuses, [OutboxMessageStatus.queued]);
+		assert.equal(harness.status(), OutboxMessageStatus.failed);
+	});
+
+	it("settles at `failed` rather than `draft` — the event may have landed", async () => {
+		// `draft` is inside the worker's send fence, so a row put back there is
+		// sent by the landed event and sendable again by hand: two copies of one
+		// message. This is the assertion that keeps it out.
+		const harness = createHarness(row({}), {
+			enqueueFails: new Error("SQS unavailable"),
+		});
+
+		await assert.rejects(() => harness.service.createAndSend(createInput));
+
+		assert.notEqual(harness.status(), OutboxMessageStatus.draft);
+		assert.match(
+			String(applied(harness).at(-1)?.lastError),
+			/could not be handed to the outgoing queue/,
+			"and it says why, where the Outbox shows it",
+		);
+	});
+
+	it("takes a draft that was sent to `failed`, not back to `draft`", async () => {
+		const harness = createHarness(row({}), {
+			enqueueFails: new Error("SQS unavailable"),
+		});
+
+		await assert.rejects(() =>
+			harness.service.send(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID),
+		);
+
+		assert.equal(harness.status(), OutboxMessageStatus.failed);
+	});
+
+	it("returns a `blocked` row to `blocked` — outside the fence, and the reason stands", async () => {
+		const harness = createHarness(
+			row({ status: OutboxMessageStatus.blocked }),
+			{
+				enqueueFails: new Error("SQS unavailable"),
+			},
+		);
+
+		await assert.rejects(() =>
+			harness.service.send(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID),
+		);
+
+		assert.equal(harness.status(), OutboxMessageStatus.blocked);
+	});
+
+	it("only settles a row still at `queued` — the worker may already hold it", async () => {
+		const harness = createHarness(row({}), {
+			enqueueFails: new Error("SQS unavailable"),
+		});
+
+		await assert.rejects(() => harness.service.createAndSend(createInput));
+
+		const settle = harness.writes.at(-1);
+		assert.equal(settle?.expected, OutboxMessageStatus.queued);
+	});
+
+	it("still reports the enqueue failure when the settle write also fails", async () => {
+		// The settle is the repair, not the failure. Replacing the enqueue error
+		// with the repair's would name the wrong cause and hide the row's state.
+		const harness = createHarness(row({}), {
+			enqueueFails: new Error("SQS unavailable"),
+			settleFails: new Error("database unreachable"),
+		});
+
+		await assert.rejects(
+			() => harness.service.createAndSend(createInput),
+			/SQS unavailable/,
+		);
+	});
+
+	it("keeps the row at `queued` when the enqueue succeeds", async () => {
+		const harness = createHarness(row({}));
+
+		await harness.service.createAndSend(createInput);
+
+		assert.equal(harness.enqueued.length, 1);
+		assert.deepEqual(harness.writes, [], "nothing walked the row back");
+	});
+});
+
+describe("correcting a message that failed to send", () => {
+	it("accepts the edit and returns the row to `draft`", async () => {
+		const harness = createHarness(row({ status: OutboxMessageStatus.failed }));
+
+		const updated = await harness.service.updateDraft(
+			ACCOUNT_CONFIG_ID,
+			OUTBOX_MESSAGE_ID,
+			{ toAddresses: ["them@example.com"] },
+		);
+
+		assert.deepEqual(applied(harness), [
+			{
+				status: OutboxMessageStatus.draft,
+				toAddresses: ["them@example.com"],
+			},
+		]);
+		assert.equal(updated.status, OutboxMessageStatus.draft);
+		assert.equal(updated.subject, "Invoice", "its content came with it");
+	});
+
+	it("sends the corrected message", async () => {
+		const harness = createHarness(row({ status: OutboxMessageStatus.failed }));
+
+		await harness.service.updateDraft(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID, {
+			toAddresses: ["them@example.com"],
+		});
+		await harness.service.send(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID);
+
+		assert.equal(harness.status(), OutboxMessageStatus.queued);
+		assert.equal(harness.enqueued.length, 1);
+	});
+
+	it("accepts the edit on a `blocked` row too — Send already does", async () => {
+		const harness = createHarness(row({ status: OutboxMessageStatus.blocked }));
+
+		await harness.service.updateDraft(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID, {
+			subject: "Invoice, corrected",
+		});
+
+		assert.equal(applied(harness).at(0)?.status, OutboxMessageStatus.draft);
+	});
+
+	it("writes no status on a row that is already a draft", async () => {
+		const harness = createHarness(row({}));
+
+		await harness.service.updateDraft(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID, {
+			subject: "Invoice, corrected",
+		});
+
+		assert.deepEqual(applied(harness), [{ subject: "Invoice, corrected" }]);
+	});
+});
+
+describe("a message that moves while the request is deciding", () => {
+	it("refuses the edit rather than pulling a queued row back to `draft`", async () => {
+		// The send this loses to has an event on the wire, and `draft` is inside
+		// the fence that event has to pass.
+		const harness = createHarness(row({ status: OutboxMessageStatus.failed }), {
+			movesOnRead: OutboxMessageStatus.queued,
+		});
+
+		await assert.rejects(
+			() =>
+				harness.service.updateDraft(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID, {
+					toAddresses: ["them@example.com"],
+				}),
+			(error: unknown) => {
+				assert.ok(error instanceof ConflictError);
+				assert.equal(error.statusCode, 409);
+				return true;
+			},
+		);
+
+		assert.equal(harness.status(), OutboxMessageStatus.queued);
+	});
+
+	it("refuses the second of two sends racing the same row", async () => {
+		const harness = createHarness(row({}), {
+			movesOnRead: OutboxMessageStatus.sending,
+		});
+
+		await assert.rejects(
+			() => harness.service.send(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID),
+			(error: unknown) => {
+				assert.ok(error instanceof ConflictError);
+				return true;
+			},
+		);
+
+		assert.deepEqual(harness.enqueued, [], "nothing reached the SMTP queue");
+	});
+});
+
+describe("a message that is not the user's to edit", () => {
+	for (const status of [
+		OutboxMessageStatus.queued,
+		OutboxMessageStatus.sending,
+		OutboxMessageStatus.sent,
+		OutboxMessageStatus.unfiled,
+	]) {
+		it(`refuses the edit of a \`${status}\` row`, async () => {
+			const harness = createHarness(row({ status }));
+
+			await assert.rejects(
+				() =>
+					harness.service.updateDraft(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID, {
+						toAddresses: ["them@example.com"],
+					}),
+				(error: unknown) => {
+					assert.ok(error instanceof ConflictError);
+					assert.equal(error.statusCode, 409);
+					return true;
+				},
+			);
+
+			assert.deepEqual(harness.writes, []);
+		});
+	}
+});

package/src/outbox-queue-settled-row.test.ts

@@ -67,6 +67,15 @@ const createHarness = (stored: OutboxMessageItem): Harness => {
 			harness.statusWrites.push(status);
 			return { ...stored, status };
 		},
+		updateIfStatus: async (
+			_configId: string,
+			_id: string,
+			_expected: OutboxMessageItem["status"],
+			input: { status?: OutboxMessageItem["status"] },
+		) => {
+			if (input.status) harness.statusWrites.push(input.status);
+			return { ...stored, ...input };
+		},
 		delete: async (_configId: string, id: string) => {
 			harness.deleted.push(id);
 		},

package/src/outbox-queue.test.ts

@@ -72,6 +72,15 @@ const createHarness = (stored: OutboxMessageItem): Harness => {
 			harness.statusWrites.push(status);
 			return draft({ status });
 		},
+		updateIfStatus: async (
+			_configId: string,
+			_id: string,
+			_expected: OutboxMessageItem["status"],
+			input: { status?: OutboxMessageItem["status"] },
+		) => {
+			if (input.status) harness.statusWrites.push(input.status);
+			return draft(input as Partial<OutboxMessageItem>);
+		},
 	} as unknown as IOutboxMessageRepository;
 
 	harness.service = new OutboxQueueService({

package/src/outbox-queue.ts

@@ -9,6 +9,7 @@ import { BadRequestError, ConflictError } from "@remit/data-ports/errors";
 import { OutboxMessageStatus } from "@remit/domain-enums";
 import { createQueueProducer } from "@remit/sqs-client/producer";
 import type { OutboxAttachmentService } from "./outbox-attachment.js";
+import { isOpenForWork } from "./outbox-status.js";
 
 interface SendMessageEvent {
 	type: "SEND_MESSAGE";
@@ -87,6 +88,38 @@ const hasNowhereToGo = (message: {
 const NO_RECIPIENT_MESSAGE =
 	"This message has nobody to send to. Add a recipient before sending it.";
 
+const ENQUEUE_FAILED_MESSAGE =
+	"This message could not be handed to the outgoing queue, so it was not sent. Send it again.";
+
+const MOVED_WHILE_EDITING_MESSAGE =
+	"This message started sending while it was being edited, so the change was not saved. Open the Outbox to see where it stands.";
+
+const MOVED_WHILE_SENDING_MESSAGE =
+	"This message already left the queue and cannot be sent again. Open the Outbox to see where it stands.";
+
+/**
+ * Where a row goes when the enqueue reports a failure — never `draft`, and
+ * never back to `draft` where it came from.
+ *
+ * A throw from `SendMessage` does not prove the broker refused the event. This
+ * queue is not FIFO on the send path and carries no deduplication id, so a
+ * timeout or a lost response leaves an event that may still be delivered. And
+ * `draft` is inside the worker's send fence (`SENDABLE_STATUSES`, smtp-worker
+ * `send-message-core.ts`): a row put back there is sendable by the landed event
+ * and by the user pressing Send, which is two copies of one message. `failed`
+ * is outside that fence, so the landed event is dropped on arrival, and a
+ * `failed` row is editable and sendable by hand (#933) — the recovery survives.
+ *
+ * `blocked` is outside the fence too and names a cause the enqueue did not
+ * change, so a row that came from there goes back to it.
+ */
+const settledStatusFor = (
+	priorStatus: OutboxMessageItem["status"],
+): OutboxMessageItem["status"] =>
+	priorStatus === OutboxMessageStatus.blocked
+		? OutboxMessageStatus.blocked
+		: OutboxMessageStatus.failed;
+
 const generateMessageId = (domain: string): string => {
 	const timestamp = Date.now();
 	const random = randomUUID().replace(/-/g, "").slice(0, 16);
@@ -168,16 +201,30 @@ export class OutboxQueueService {
 			outboxMessageId,
 			"act",
 		);
-		if (existing.status !== OutboxMessageStatus.draft) {
+		if (!isOpenForWork(existing.status)) {
 			throw new ConflictError(
 				`This message is already ${existing.status} and can no longer be edited as a draft. Start a new message to change it.`,
 			);
 		}
 
-		const updated = await this.outboxMessageService.update(
+		// Editing a settled failure returns the row to `draft`: it is no longer the
+		// message that failed, and the Outbox renders a `failed` row with its
+		// `lastError` — a failure reported against text that never went out. The
+		// same row moves to Drafts carrying its content, recipients and
+		// attachments, so there is no copy to reconcile.
+		//
+		// Conditional on the status this decision was read from. A concurrent send
+		// can move the row to `queued` between the two, and an unconditional write
+		// would pull it back to `draft` with its event already on the wire — the
+		// worker's fence takes `draft`, so that row goes out and stays sendable.
+		const updated = await this.outboxMessageService.updateIfStatus(
 			accountConfigId,
 			outboxMessageId,
+			existing.status,
 			{
+				...(existing.status !== OutboxMessageStatus.draft && {
+					status: OutboxMessageStatus.draft,
+				}),
 				...(input.toAddresses !== undefined && {
 					toAddresses: input.toAddresses,
 				}),
@@ -196,6 +243,7 @@ export class OutboxQueueService {
 				}),
 			},
 		);
+		if (!updated) throw new ConflictError(MOVED_WHILE_EDITING_MESSAGE);
 
 		this.log.info({ outboxMessageId }, "Updated draft outbox message");
 
@@ -211,11 +259,7 @@ export class OutboxQueueService {
 			outboxMessageId,
 			"act",
 		);
-		if (
-			existing.status !== OutboxMessageStatus.draft &&
-			existing.status !== OutboxMessageStatus.failed &&
-			existing.status !== OutboxMessageStatus.blocked
-		) {
+		if (!isOpenForWork(existing.status)) {
 			throw new ConflictError(
 				`This message is already ${existing.status} and cannot be sent again. Open the Outbox to see where it stands.`,
 			);
@@ -225,20 +269,25 @@ export class OutboxQueueService {
 			throw new BadRequestError(NO_RECIPIENT_MESSAGE);
 		}
 
-		const updated = await this.outboxMessageService.updateStatus(
+		// Conditional on the status this send was decided against, so two presses —
+		// or a press racing the worker — produce one queued row and one conflict
+		// rather than two events for the same message.
+		const updated = await this.outboxMessageService.updateIfStatus(
 			accountConfigId,
 			outboxMessageId,
-			OutboxMessageStatus.queued,
+			existing.status,
+			{ status: OutboxMessageStatus.queued },
 		);
+		if (!updated) throw new ConflictError(MOVED_WHILE_SENDING_MESSAGE);
 
 		// `queued` is a dead end for a row the queue never accepted: `send` takes
 		// draft, failed and blocked, `deleteDraft` those three plus unfiled, so a
 		// row parked at `queued` by a failed enqueue is neither sendable nor
-		// discardable (#845.8). Put it back where it came from and let the enqueue
-		// failure surface — the row stays reachable, the caller still hears no.
+		// discardable (#845.8). Settle it and let the enqueue failure surface —
+		// the row stays reachable, the caller still hears no.
 		await this.enqueueSend(existing.accountId, outboxMessageId).catch(
 			async (error: unknown) => {
-				await this.outboxMessageService.updateStatus(
+				await this.settleUnqueued(
 					accountConfigId,
 					outboxMessageId,
 					existing.status,
@@ -282,7 +331,21 @@ export class OutboxQueueService {
 			status: OutboxMessageStatus.queued,
 		});
 
-		await this.enqueueSend(input.accountId, outbox.outboxMessageId);
+		// Same dead end as in `send`: a row parked at `queued` by an enqueue that
+		// threw is neither sendable nor discardable (#845.8, #931, #936). This row
+		// is new, so there is no prior status — it settles at `failed`, carrying
+		// the reason, which keeps the composed text editable and sendable while
+		// staying outside the fence a landed event has to pass.
+		await this.enqueueSend(input.accountId, outbox.outboxMessageId).catch(
+			async (error: unknown) => {
+				await this.settleUnqueued(
+					input.accountConfigId,
+					outbox.outboxMessageId,
+					OutboxMessageStatus.failed,
+				);
+				throw error;
+			},
+		);
 
 		this.log.info(
 			{ outboxMessageId: outbox.outboxMessageId, accountId: input.accountId },
@@ -330,6 +393,45 @@ export class OutboxQueueService {
 		this.log.info({ outboxMessageId }, "Deleted outbox message");
 	};
 
+	/**
+	 * Take a row back out of `queued` after the enqueue reported a failure.
+	 *
+	 * Conditional on `queued`, because the event may have landed regardless — an
+	 * error from `SendMessage` says the response was lost, not that the broker
+	 * refused it. If the worker already has the row, it holds the newer truth and
+	 * this write does nothing.
+	 *
+	 * Never rejects. The enqueue failure is what went wrong and what the caller
+	 * has to hear; a settle that also fails would replace it with the wrong
+	 * cause, so it is logged and the row is left where #936 found it — which the
+	 * caller's error at least names.
+	 */
+	private settleUnqueued = async (
+		accountConfigId: string,
+		outboxMessageId: string,
+		priorStatus: OutboxMessageItem["status"],
+	): Promise<void> => {
+		const status = settledStatusFor(priorStatus);
+		await this.outboxMessageService
+			.updateIfStatus(
+				accountConfigId,
+				outboxMessageId,
+				OutboxMessageStatus.queued,
+				{
+					status,
+					...(status === OutboxMessageStatus.failed && {
+						lastError: ENQUEUE_FAILED_MESSAGE,
+					}),
+				},
+			)
+			.catch((settleError: unknown) => {
+				this.log.error(
+					{ outboxMessageId, settleError: String(settleError) },
+					"Could not settle an outbox message the queue refused",
+				);
+			});
+	};
+
 	private enqueueSend = async (
 		accountId: string,
 		outboxMessageId: string,

package/src/outbox-status.ts

@@ -0,0 +1,21 @@
+import type { OutboxMessageItem } from "@remit/data-ports";
+import { OutboxMessageStatus } from "@remit/domain-enums";
+
+/**
+ * Whether the message is still the user's to work on: nothing of it is on the
+ * wire, so Send, Edit and its attachments all apply.
+ *
+ * One predicate for all three because they answer the same question, and
+ * splitting them is what dead-ended a refused message. Sending took `failed`
+ * while editing took only `draft`, so a message the server turned away for a
+ * bad address could be re-sent unchanged or deleted, and nothing else — Retry
+ * queued the same envelope, and Edit took a 409 on the flush that precedes the
+ * send (#933).
+ *
+ * Everything absent is in the worker's hands or settled: `queued` and `sending`
+ * are mid-flight, `sent` and `unfiled` were delivered.
+ */
+export const isOpenForWork = (status: OutboxMessageItem["status"]): boolean =>
+	status === OutboxMessageStatus.draft ||
+	status === OutboxMessageStatus.failed ||
+	status === OutboxMessageStatus.blocked;