@remit/mailbox-service 0.0.73 → 0.0.75

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.73",
+  "version": "0.0.75",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/message-delete-junk-reconcile.test.ts

@@ -8,7 +8,7 @@ import type {
 	IThreadMessageRepository,
 } from "@remit/data-ports";
 import { type MessageMoveConfig, MessageMoveService } from "./message-move.js";
-import { trashRole } from "./test-helpers/folder-roles.js";
+import { NO_JUNK_ROLES, trashRole } from "./test-helpers/folder-roles.js";
 
 const ACCOUNT = "acc-1";
 const ACCOUNT_CONFIG = "cfg-1";
@@ -57,6 +57,7 @@ const buildWorld = (trashExists: boolean) => {
 	const mailboxSpecialUseService = {
 		findTrashMailbox: async () => trash,
 		resolveTrashRole: async () => trashRole(trash),
+		resolveJunkRolesForConfig: async () => NO_JUNK_ROLES,
 	} as unknown as IMailboxSpecialUseRepository;
 
 	const addressService = {

package/src/message-delete-no-trash.test.ts

@@ -15,6 +15,7 @@ import {
 	StaleTrashAppointmentError,
 	UnconfirmedTrashMailboxError,
 } from "./message-move.js";
+import { NO_JUNK_ROLES } from "./test-helpers/folder-roles.js";
 
 const ACCOUNT = "acc-1";
 const ACCOUNT_CONFIG = "cfg-1";
@@ -80,6 +81,7 @@ const buildWorld = (
 
 	const mailboxSpecialUseService = {
 		resolveTrashRole: async () => trashResolution,
+		resolveJunkRolesForConfig: async () => NO_JUNK_ROLES,
 	} as unknown as IMailboxSpecialUseRepository;
 
 	const addressService = {

package/src/message-move-copy.test.ts

@@ -15,7 +15,11 @@ import { MailboxCursorState } from "@remit/domain-enums";
 import type { ManagedConnectionFactory } from "./connection-factory.js";
 import { type MessageMoveConfig, MessageMoveService } from "./message-move.js";
 import { MessageSyncService } from "./message-sync.js";
-import { noFolderRoles, trashRole } from "./test-helpers/folder-roles.js";
+import {
+	NO_JUNK_ROLES,
+	noFolderRoles,
+	trashRole,
+} from "./test-helpers/folder-roles.js";
 import type { IImapConnection, ImapMessage } from "./types.js";
 
 const stubAddressService = (): IAddressRepository =>
@@ -176,6 +180,7 @@ const buildWorld = () => {
 	const mailboxSpecialUseService = {
 		findTrashMailbox: async () => null,
 		resolveTrashRole: async () => trashRole(null),
+		resolveJunkRolesForConfig: async () => NO_JUNK_ROLES,
 	} as unknown as IMailboxSpecialUseRepository;
 
 	const config: MessageMoveConfig = {

package/src/message-move-empty-trash.test.ts

@@ -22,6 +22,7 @@ import {
 	StaleTrashAppointmentError,
 	UnconfirmedTrashMailboxError,
 } from "./message-move.js";
+import { NO_JUNK_ROLES } from "./test-helpers/folder-roles.js";
 
 const ACCOUNT = "acc-1";
 const ACCOUNT_CONFIG = "cfg-1";
@@ -100,6 +101,7 @@ const buildWorld = (
 		} as unknown as IAddressRepository,
 		mailboxSpecialUseService: {
 			resolveTrashRole: async () => trashResolution,
+			resolveJunkRolesForConfig: async () => NO_JUNK_ROLES,
 		} as unknown as IMailboxSpecialUseRepository,
 		threadMessageService,
 		sqsQueueUrl: "http://localhost:9324/000000000000/remit-messages.fifo",

package/src/message-move-same-mailbox.test.ts

@@ -8,7 +8,7 @@ import type {
 	IThreadMessageRepository,
 } from "@remit/data-ports";
 import { type MessageMoveConfig, MessageMoveService } from "./message-move.js";
-import { trashRole } from "./test-helpers/folder-roles.js";
+import { NO_JUNK_ROLES, trashRole } from "./test-helpers/folder-roles.js";
 
 const stubAddressService = (): IAddressRepository =>
 	({
@@ -68,6 +68,7 @@ const buildWorld = () => {
 	const mailboxSpecialUseService = {
 		findTrashMailbox: async () => null,
 		resolveTrashRole: async () => trashRole(null),
+		resolveJunkRolesForConfig: async () => NO_JUNK_ROLES,
 	} as unknown as IMailboxSpecialUseRepository;
 
 	const config: MessageMoveConfig = {

package/src/message-move.ts

@@ -395,6 +395,12 @@ export class MessageMoveService {
 
 		// Process move to trash
 		if (trashMailbox && moveToTrashMessages.length > 0) {
+			// Every message in the batch shares the config, so its Junk and Trash
+			// folders resolve once rather than once per message.
+			const configJunkRoles =
+				await this.mailboxSpecialUseService.resolveJunkRolesForConfig(
+					accountConfigId,
+				);
 			for (const { messageId, message, sourceMailbox } of moveToTrashMessages) {
 				// Update local state optimistically
 				await this.messageService.updateForMove(messageId, {
@@ -413,7 +419,10 @@ export class MessageMoveService {
 					true,
 				);
 
-				await this.addressService.reconcileJunkOnlyForMessage(messageId);
+				await this.addressService.reconcileJunkOnlyForMessage(
+					messageId,
+					configJunkRoles,
+				);
 
 				events.push({
 					type: "MESSAGE_DELETE",
@@ -548,7 +557,12 @@ export class MessageMoveService {
 			isMovingToTrash,
 		);
 
-		await this.addressService.reconcileJunkOnlyForMessage(messageId);
+		await this.addressService.reconcileJunkOnlyForMessage(
+			messageId,
+			await this.mailboxSpecialUseService.resolveJunkRolesForConfig(
+				accountConfigId,
+			),
+		);
 
 		// If moving FROM Trash, clear isDeleted
 		if (isMovingFromTrash) {

package/src/message-sync-junk-harvest.test.ts

@@ -19,7 +19,7 @@ import {
 	addressSightingIn,
 	MessageSyncService,
 } from "./message-sync.js";
-import { folderRoles } from "./test-helpers/folder-roles.js";
+import { folderRoles, NO_JUNK_ROLES } from "./test-helpers/folder-roles.js";
 import type { ImapEnvelope, ImapMessage } from "./types.js";
 
 const stub = <T>(): T => ({}) as T;
@@ -141,6 +141,7 @@ const save = async (
 	).saveMessage(mailbox, "acct-1", "cfg-1", msg, {
 		junkMailboxId: role === "Junk" ? mailbox.mailboxId : null,
 		trashMailboxId: role === "Trash" ? mailbox.mailboxId : null,
+		configJunkRoles: NO_JUNK_ROLES,
 	});
 
 	return saved;
@@ -155,6 +156,7 @@ describe("what a mailbox says about the addresses on its messages", () => {
 	const ROLES = (junk: string | null, trash: string | null) => ({
 		junkMailboxId: junk,
 		trashMailboxId: trash,
+		configJunkRoles: NO_JUNK_ROLES,
 	});
 
 	it("reads the folder the account appointed, not the folder’s name", () => {

package/src/message-sync.ts

@@ -13,6 +13,7 @@ import type {
 	ThreadMessageItem,
 } from "@remit/data-ports";
 import { storedDisplayName } from "@remit/data-ports/display-name";
+import type { JunkRoleMailboxes } from "@remit/data-ports/folder-role";
 import {
 	deriveAddressId,
 	deriveBodyPartId,
@@ -92,6 +93,14 @@ export type AddressSighting = "junk" | "discarded" | "correspondent";
 export interface AccountFolderRoles {
 	readonly junkMailboxId: string | null;
 	readonly trashMailboxId: string | null;
+	/**
+	 * The same two roles across every account under the config, for the
+	 * reconcile that follows a save into Junk. The address book is keyed by
+	 * config, so a predicate over an address weighs sightings from all of them —
+	 * resolving only this account withholds a sender on one and restores it on
+	 * the next.
+	 */
+	readonly configJunkRoles: JunkRoleMailboxes;
 }
 
 /**
@@ -462,7 +471,7 @@ export class MessageSyncService {
 		// which catches its own error and reports a `failed` outcome instead of
 		// rejecting. So one bad message can no longer abort the whole batch (the
 		// poison pill that previously froze the mailbox, #817).
-		const roles = await this.folderRolesFor(accountId);
+		const roles = await this.folderRolesFor(accountId, accountConfigId);
 		const outcomes = await pMap(
 			applicable,
 			(msg) =>
@@ -697,7 +706,7 @@ export class MessageSyncService {
 		const newMessages =
 			newUids.length > 0 ? await this.fetchMessageBatch(newUids) : [];
 		const applicable = newMessages.filter((msg) => msg.envelope !== undefined);
-		const roles = await this.folderRolesFor(accountId);
+		const roles = await this.folderRolesFor(accountId, accountConfigId);
 		const outcomes = await pMap(
 			applicable,
 			(msg) =>
@@ -925,7 +934,7 @@ export class MessageSyncService {
 			);
 		}
 
-		const roles = await this.folderRolesFor(accountId);
+		const roles = await this.folderRolesFor(accountId, accountConfigId);
 		const outcomes = await pMap(
 			applicable,
 			(msg) =>
@@ -1280,14 +1289,19 @@ export class MessageSyncService {
 	 * batch rather than per message: the lookup reads an appointment row and
 	 * the account’s mailbox list, and every message in a batch shares both.
 	 */
-	private async folderRolesFor(accountId: string): Promise<AccountFolderRoles> {
-		const [junk, trash] = await Promise.all([
+	private async folderRolesFor(
+		accountId: string,
+		accountConfigId: string,
+	): Promise<AccountFolderRoles> {
+		const [junk, trash, configJunkRoles] = await Promise.all([
 			this.mailboxSpecialUseService.findJunkMailbox(accountId),
 			this.mailboxSpecialUseService.findTrashMailbox(accountId),
+			this.mailboxSpecialUseService.resolveJunkRolesForConfig(accountConfigId),
 		]);
 		return {
 			junkMailboxId: junk?.mailboxId ?? null,
 			trashMailboxId: trash?.mailboxId ?? null,
+			configJunkRoles,
 		};
 	}
 
@@ -1432,7 +1446,10 @@ export class MessageSyncService {
 			owned = created || item.mailboxId === mailboxId;
 
 			if (sighting === "junk") {
-				await repos.address.reconcileJunkOnlyForMessage(messageId);
+				await repos.address.reconcileJunkOnlyForMessage(
+					messageId,
+					roles.configJunkRoles,
+				);
 			}
 
 			await this.createThreadForMessage(

package/src/outbox-attachment.ts

@@ -7,10 +7,7 @@ import type {
 import { holdsRoom } from "@remit/data-ports";
 import { ConflictError } from "@remit/data-ports/errors";
 import { base36uuid } from "@remit/data-ports/id";
-import {
-	OutboxAttachmentRejectionReason,
-	OutboxMessageStatus,
-} from "@remit/domain-enums";
+import { OutboxAttachmentRejectionReason } from "@remit/domain-enums";
 import type { StorageService } from "@remit/storage-service";
 import {
 	buildOutboxAttachmentKey,
@@ -20,6 +17,7 @@ import {
 	normalizeAttachmentContentType,
 	sanitizeAttachmentFilename,
 } from "./outbox-attachment-filename.js";
+import { isOpenForWork } from "./outbox-status.js";
 
 /**
  * 25 MB is what most receiving servers accept, and base64 inflates it to roughly
@@ -111,9 +109,14 @@ export class OutboxAttachmentService {
 	 * Resolve a draft the caller is entitled to act on.
 	 *
 	 * Mode "act": the caller has named the draft, so a foreign one is denied with
-	 * 403 rather than feigned as a 404. An entry that has left draft is a
-	 * conflict. Both abort the request — only the file itself comes back as a
-	 * result the composer can render next to the row it refused.
+	 * 403 rather than feigned as a 404. An entry the user can no longer work on
+	 * is a conflict. Both abort the request — only the file itself comes back as
+	 * a result the composer can render next to the row it refused.
+	 *
+	 * Same predicate the composer's other two writes use. A `failed` message is
+	 * editable and sendable again (#933), and an attachment is part of what the
+	 * correction may be — a message refused for the wrong file would otherwise
+	 * still be stuck.
 	 */
 	private getWritableDraft = async (
 		accountConfigId: string,
@@ -125,7 +128,7 @@ export class OutboxAttachmentService {
 			"act",
 		);
 
-		if (outbox.status !== OutboxMessageStatus.draft) {
+		if (!isOpenForWork(outbox.status)) {
 			throw new ConflictError(
 				`This message is already ${outbox.status} and can no longer take an attachment. Start a new message to change it.`,
 			);

package/src/outbox-failed-recovery.test.ts

@@ -0,0 +1,366 @@
+/**
+ * The two ways an outbox row used to become unusable without ever leaving.
+ *
+ * `createAndSend` wrote the row at `queued` and then enqueued. A throw from the
+ * enqueue left it there, and `queued` is accepted by neither `send` nor
+ * `deleteDraft` — the message could be neither sent nor discarded (#936).
+ *
+ * A send that failed settled at `failed`, and `updateDraft` refused anything
+ * but `draft`. Retry re-queued the same envelope and Edit took a 409 on the
+ * flush that precedes the send, so a message refused for a bad address had no
+ * way back to sent short of retyping it (#933).
+ *
+ * Where a stranded row settles is the load-bearing part. Not `draft`: a throw
+ * from `SendMessage` says the response was lost, not that the broker refused
+ * the event, and `draft` is inside the SMTP worker's send fence — a row put
+ * there is sendable both by the event that landed anyway and by the user
+ * pressing Send. `failed` is outside that fence and, since #933, is a row the
+ * user can still edit and send.
+ */
+
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type {
+	IAccountRepository,
+	IOutboxMessageRepository,
+	OutboxMessageItem,
+	UpdateOutboxMessageInput,
+} from "@remit/data-ports";
+import { ConflictError } from "@remit/data-ports/errors";
+import { OutboxMessageStatus } from "@remit/domain-enums";
+import type { OutboxAttachmentService } from "./outbox-attachment.js";
+import { OutboxQueueService } from "./outbox-queue.js";
+
+const ACCOUNT_CONFIG_ID = "cfg-1";
+const ACCOUNT_ID = "acc-1";
+const OUTBOX_MESSAGE_ID = "ob-1";
+
+const row = (overrides: Partial<OutboxMessageItem>): OutboxMessageItem =>
+	({
+		outboxMessageId: OUTBOX_MESSAGE_ID,
+		accountId: ACCOUNT_ID,
+		accountConfigId: ACCOUNT_CONFIG_ID,
+		fromAddress: "me@example.com",
+		toAddresses: ["typo@exmaple.com"],
+		ccAddresses: [],
+		bccAddresses: [],
+		references: [],
+		messageIdValue: "<m1@example.com>",
+		subject: "Invoice",
+		textBody: "Attached.",
+		status: OutboxMessageStatus.draft,
+		createdAt: 0,
+		updatedAt: 0,
+		...overrides,
+	}) as OutboxMessageItem;
+
+interface ConditionalWrite {
+	expected: OutboxMessageItem["status"];
+	input: UpdateOutboxMessageInput;
+	applied: boolean;
+}
+
+interface Harness {
+	service: OutboxQueueService;
+	enqueued: string[];
+	createdStatuses: string[];
+	writes: ConditionalWrite[];
+	/** What the row holds now, after every write this harness applied. */
+	status: () => OutboxMessageItem["status"];
+}
+
+interface HarnessOptions {
+	enqueueFails?: Error;
+	settleFails?: Error;
+	/** Moves the row the instant the service reads it, as a racing writer would. */
+	movesOnRead?: OutboxMessageItem["status"];
+}
+
+const createHarness = (
+	stored: OutboxMessageItem,
+	options: HarnessOptions = {},
+): Harness => {
+	let current = stored;
+
+	const harness: Harness = {
+		service: undefined as unknown as OutboxQueueService,
+		enqueued: [],
+		createdStatuses: [],
+		writes: [],
+		status: () => current.status,
+	};
+
+	const outboxMessageService = {
+		get: async () => {
+			const seen = current;
+			if (options.movesOnRead) {
+				current = row({ ...current, status: options.movesOnRead });
+			}
+			return seen;
+		},
+		create: async (input: Record<string, unknown>) => {
+			current = row(input as Partial<OutboxMessageItem>);
+			harness.createdStatuses.push(current.status);
+			return current;
+		},
+		updateIfStatus: async (
+			_configId: string,
+			_id: string,
+			expected: OutboxMessageItem["status"],
+			input: UpdateOutboxMessageInput,
+		) => {
+			if (options.settleFails && input.status === OutboxMessageStatus.failed) {
+				throw options.settleFails;
+			}
+			const applied = current.status === expected;
+			harness.writes.push({ expected, input, applied });
+			if (!applied) return null;
+			current = row({ ...current, ...input });
+			return current;
+		},
+	} as unknown as IOutboxMessageRepository;
+
+	harness.service = new OutboxQueueService({
+		outboxMessageService,
+		outboxAttachmentService: {} as unknown as OutboxAttachmentService,
+		accountService: {} as unknown as IAccountRepository,
+		sqsSmtpQueueUrl: "http://localhost/queue",
+		sqsClient: {
+			send: async (command: { input: { MessageBody: string } }) => {
+				if (options.enqueueFails) throw options.enqueueFails;
+				harness.enqueued.push(command.input.MessageBody);
+				return {};
+			},
+		} as never,
+	});
+
+	return harness;
+};
+
+const createInput = {
+	accountId: ACCOUNT_ID,
+	accountConfigId: ACCOUNT_CONFIG_ID,
+	fromAddress: "me@example.com",
+	toAddresses: ["them@example.com"],
+	subject: "Invoice",
+	textBody: "Attached.",
+};
+
+const applied = (harness: Harness): UpdateOutboxMessageInput[] =>
+	harness.writes.filter((write) => write.applied).map((write) => write.input);
+
+describe("an enqueue that reports a failure", () => {
+	it("settles the new row of createAndSend at `failed`, never at `queued`", async () => {
+		const harness = createHarness(row({}), {
+			enqueueFails: new Error("SQS unavailable"),
+		});
+
+		await assert.rejects(
+			() => harness.service.createAndSend(createInput),
+			/SQS unavailable/,
+			"the caller still hears the failure",
+		);
+
+		assert.deepEqual(harness.createdStatuses, [OutboxMessageStatus.queued]);
+		assert.equal(harness.status(), OutboxMessageStatus.failed);
+	});
+
+	it("settles at `failed` rather than `draft` — the event may have landed", async () => {
+		// `draft` is inside the worker's send fence, so a row put back there is
+		// sent by the landed event and sendable again by hand: two copies of one
+		// message. This is the assertion that keeps it out.
+		const harness = createHarness(row({}), {
+			enqueueFails: new Error("SQS unavailable"),
+		});
+
+		await assert.rejects(() => harness.service.createAndSend(createInput));
+
+		assert.notEqual(harness.status(), OutboxMessageStatus.draft);
+		assert.match(
+			String(applied(harness).at(-1)?.lastError),
+			/could not be handed to the outgoing queue/,
+			"and it says why, where the Outbox shows it",
+		);
+	});
+
+	it("takes a draft that was sent to `failed`, not back to `draft`", async () => {
+		const harness = createHarness(row({}), {
+			enqueueFails: new Error("SQS unavailable"),
+		});
+
+		await assert.rejects(() =>
+			harness.service.send(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID),
+		);
+
+		assert.equal(harness.status(), OutboxMessageStatus.failed);
+	});
+
+	it("returns a `blocked` row to `blocked` — outside the fence, and the reason stands", async () => {
+		const harness = createHarness(
+			row({ status: OutboxMessageStatus.blocked }),
+			{
+				enqueueFails: new Error("SQS unavailable"),
+			},
+		);
+
+		await assert.rejects(() =>
+			harness.service.send(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID),
+		);
+
+		assert.equal(harness.status(), OutboxMessageStatus.blocked);
+	});
+
+	it("only settles a row still at `queued` — the worker may already hold it", async () => {
+		const harness = createHarness(row({}), {
+			enqueueFails: new Error("SQS unavailable"),
+		});
+
+		await assert.rejects(() => harness.service.createAndSend(createInput));
+
+		const settle = harness.writes.at(-1);
+		assert.equal(settle?.expected, OutboxMessageStatus.queued);
+	});
+
+	it("still reports the enqueue failure when the settle write also fails", async () => {
+		// The settle is the repair, not the failure. Replacing the enqueue error
+		// with the repair's would name the wrong cause and hide the row's state.
+		const harness = createHarness(row({}), {
+			enqueueFails: new Error("SQS unavailable"),
+			settleFails: new Error("database unreachable"),
+		});
+
+		await assert.rejects(
+			() => harness.service.createAndSend(createInput),
+			/SQS unavailable/,
+		);
+	});
+
+	it("keeps the row at `queued` when the enqueue succeeds", async () => {
+		const harness = createHarness(row({}));
+
+		await harness.service.createAndSend(createInput);
+
+		assert.equal(harness.enqueued.length, 1);
+		assert.deepEqual(harness.writes, [], "nothing walked the row back");
+	});
+});
+
+describe("correcting a message that failed to send", () => {
+	it("accepts the edit and returns the row to `draft`", async () => {
+		const harness = createHarness(row({ status: OutboxMessageStatus.failed }));
+
+		const updated = await harness.service.updateDraft(
+			ACCOUNT_CONFIG_ID,
+			OUTBOX_MESSAGE_ID,
+			{ toAddresses: ["them@example.com"] },
+		);
+
+		assert.deepEqual(applied(harness), [
+			{
+				status: OutboxMessageStatus.draft,
+				toAddresses: ["them@example.com"],
+			},
+		]);
+		assert.equal(updated.status, OutboxMessageStatus.draft);
+		assert.equal(updated.subject, "Invoice", "its content came with it");
+	});
+
+	it("sends the corrected message", async () => {
+		const harness = createHarness(row({ status: OutboxMessageStatus.failed }));
+
+		await harness.service.updateDraft(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID, {
+			toAddresses: ["them@example.com"],
+		});
+		await harness.service.send(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID);
+
+		assert.equal(harness.status(), OutboxMessageStatus.queued);
+		assert.equal(harness.enqueued.length, 1);
+	});
+
+	it("accepts the edit on a `blocked` row too — Send already does", async () => {
+		const harness = createHarness(row({ status: OutboxMessageStatus.blocked }));
+
+		await harness.service.updateDraft(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID, {
+			subject: "Invoice, corrected",
+		});
+
+		assert.equal(applied(harness).at(0)?.status, OutboxMessageStatus.draft);
+	});
+
+	it("writes no status on a row that is already a draft", async () => {
+		const harness = createHarness(row({}));
+
+		await harness.service.updateDraft(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID, {
+			subject: "Invoice, corrected",
+		});
+
+		assert.deepEqual(applied(harness), [{ subject: "Invoice, corrected" }]);
+	});
+});
+
+describe("a message that moves while the request is deciding", () => {
+	it("refuses the edit rather than pulling a queued row back to `draft`", async () => {
+		// The send this loses to has an event on the wire, and `draft` is inside
+		// the fence that event has to pass.
+		const harness = createHarness(row({ status: OutboxMessageStatus.failed }), {
+			movesOnRead: OutboxMessageStatus.queued,
+		});
+
+		await assert.rejects(
+			() =>
+				harness.service.updateDraft(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID, {
+					toAddresses: ["them@example.com"],
+				}),
+			(error: unknown) => {
+				assert.ok(error instanceof ConflictError);
+				assert.equal(error.statusCode, 409);
+				return true;
+			},
+		);
+
+		assert.equal(harness.status(), OutboxMessageStatus.queued);
+	});
+
+	it("refuses the second of two sends racing the same row", async () => {
+		const harness = createHarness(row({}), {
+			movesOnRead: OutboxMessageStatus.sending,
+		});
+
+		await assert.rejects(
+			() => harness.service.send(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID),
+			(error: unknown) => {
+				assert.ok(error instanceof ConflictError);
+				return true;
+			},
+		);
+
+		assert.deepEqual(harness.enqueued, [], "nothing reached the SMTP queue");
+	});
+});
+
+describe("a message that is not the user's to edit", () => {
+	for (const status of [
+		OutboxMessageStatus.queued,
+		OutboxMessageStatus.sending,
+		OutboxMessageStatus.sent,
+		OutboxMessageStatus.unfiled,
+	]) {
+		it(`refuses the edit of a \`${status}\` row`, async () => {
+			const harness = createHarness(row({ status }));
+
+			await assert.rejects(
+				() =>
+					harness.service.updateDraft(ACCOUNT_CONFIG_ID, OUTBOX_MESSAGE_ID, {
+						toAddresses: ["them@example.com"],
+					}),
+				(error: unknown) => {
+					assert.ok(error instanceof ConflictError);
+					assert.equal(error.statusCode, 409);
+					return true;
+				},
+			);
+
+			assert.deepEqual(harness.writes, []);
+		});
+	}
+});

package/src/outbox-queue-settled-row.test.ts

@@ -67,6 +67,15 @@ const createHarness = (stored: OutboxMessageItem): Harness => {
 			harness.statusWrites.push(status);
 			return { ...stored, status };
 		},
+		updateIfStatus: async (
+			_configId: string,
+			_id: string,
+			_expected: OutboxMessageItem["status"],
+			input: { status?: OutboxMessageItem["status"] },
+		) => {
+			if (input.status) harness.statusWrites.push(input.status);
+			return { ...stored, ...input };
+		},
 		delete: async (_configId: string, id: string) => {
 			harness.deleted.push(id);
 		},

package/src/outbox-queue.test.ts

@@ -72,6 +72,15 @@ const createHarness = (stored: OutboxMessageItem): Harness => {
 			harness.statusWrites.push(status);
 			return draft({ status });
 		},
+		updateIfStatus: async (
+			_configId: string,
+			_id: string,
+			_expected: OutboxMessageItem["status"],
+			input: { status?: OutboxMessageItem["status"] },
+		) => {
+			if (input.status) harness.statusWrites.push(input.status);
+			return draft(input as Partial<OutboxMessageItem>);
+		},
 	} as unknown as IOutboxMessageRepository;
 
 	harness.service = new OutboxQueueService({

package/src/outbox-queue.ts

@@ -9,6 +9,7 @@ import { BadRequestError, ConflictError } from "@remit/data-ports/errors";
 import { OutboxMessageStatus } from "@remit/domain-enums";
 import { createQueueProducer } from "@remit/sqs-client/producer";
 import type { OutboxAttachmentService } from "./outbox-attachment.js";
+import { isOpenForWork } from "./outbox-status.js";
 
 interface SendMessageEvent {
 	type: "SEND_MESSAGE";
@@ -87,6 +88,38 @@ const hasNowhereToGo = (message: {
 const NO_RECIPIENT_MESSAGE =
 	"This message has nobody to send to. Add a recipient before sending it.";
 
+const ENQUEUE_FAILED_MESSAGE =
+	"This message could not be handed to the outgoing queue, so it was not sent. Send it again.";
+
+const MOVED_WHILE_EDITING_MESSAGE =
+	"This message started sending while it was being edited, so the change was not saved. Open the Outbox to see where it stands.";
+
+const MOVED_WHILE_SENDING_MESSAGE =
+	"This message already left the queue and cannot be sent again. Open the Outbox to see where it stands.";
+
+/**
+ * Where a row goes when the enqueue reports a failure — never `draft`, and
+ * never back to `draft` where it came from.
+ *
+ * A throw from `SendMessage` does not prove the broker refused the event. This
+ * queue is not FIFO on the send path and carries no deduplication id, so a
+ * timeout or a lost response leaves an event that may still be delivered. And
+ * `draft` is inside the worker's send fence (`SENDABLE_STATUSES`, smtp-worker
+ * `send-message-core.ts`): a row put back there is sendable by the landed event
+ * and by the user pressing Send, which is two copies of one message. `failed`
+ * is outside that fence, so the landed event is dropped on arrival, and a
+ * `failed` row is editable and sendable by hand (#933) — the recovery survives.
+ *
+ * `blocked` is outside the fence too and names a cause the enqueue did not
+ * change, so a row that came from there goes back to it.
+ */
+const settledStatusFor = (
+	priorStatus: OutboxMessageItem["status"],
+): OutboxMessageItem["status"] =>
+	priorStatus === OutboxMessageStatus.blocked
+		? OutboxMessageStatus.blocked
+		: OutboxMessageStatus.failed;
+
 const generateMessageId = (domain: string): string => {
 	const timestamp = Date.now();
 	const random = randomUUID().replace(/-/g, "").slice(0, 16);
@@ -168,16 +201,30 @@ export class OutboxQueueService {
 			outboxMessageId,
 			"act",
 		);
-		if (existing.status !== OutboxMessageStatus.draft) {
+		if (!isOpenForWork(existing.status)) {
 			throw new ConflictError(
 				`This message is already ${existing.status} and can no longer be edited as a draft. Start a new message to change it.`,
 			);
 		}
 
-		const updated = await this.outboxMessageService.update(
+		// Editing a settled failure returns the row to `draft`: it is no longer the
+		// message that failed, and the Outbox renders a `failed` row with its
+		// `lastError` — a failure reported against text that never went out. The
+		// same row moves to Drafts carrying its content, recipients and
+		// attachments, so there is no copy to reconcile.
+		//
+		// Conditional on the status this decision was read from. A concurrent send
+		// can move the row to `queued` between the two, and an unconditional write
+		// would pull it back to `draft` with its event already on the wire — the
+		// worker's fence takes `draft`, so that row goes out and stays sendable.
+		const updated = await this.outboxMessageService.updateIfStatus(
 			accountConfigId,
 			outboxMessageId,
+			existing.status,
 			{
+				...(existing.status !== OutboxMessageStatus.draft && {
+					status: OutboxMessageStatus.draft,
+				}),
 				...(input.toAddresses !== undefined && {
 					toAddresses: input.toAddresses,
 				}),
@@ -196,6 +243,7 @@ export class OutboxQueueService {
 				}),
 			},
 		);
+		if (!updated) throw new ConflictError(MOVED_WHILE_EDITING_MESSAGE);
 
 		this.log.info({ outboxMessageId }, "Updated draft outbox message");
 
@@ -211,11 +259,7 @@ export class OutboxQueueService {
 			outboxMessageId,
 			"act",
 		);
-		if (
-			existing.status !== OutboxMessageStatus.draft &&
-			existing.status !== OutboxMessageStatus.failed &&
-			existing.status !== OutboxMessageStatus.blocked
-		) {
+		if (!isOpenForWork(existing.status)) {
 			throw new ConflictError(
 				`This message is already ${existing.status} and cannot be sent again. Open the Outbox to see where it stands.`,
 			);
@@ -225,20 +269,25 @@ export class OutboxQueueService {
 			throw new BadRequestError(NO_RECIPIENT_MESSAGE);
 		}
 
-		const updated = await this.outboxMessageService.updateStatus(
+		// Conditional on the status this send was decided against, so two presses —
+		// or a press racing the worker — produce one queued row and one conflict
+		// rather than two events for the same message.
+		const updated = await this.outboxMessageService.updateIfStatus(
 			accountConfigId,
 			outboxMessageId,
-			OutboxMessageStatus.queued,
+			existing.status,
+			{ status: OutboxMessageStatus.queued },
 		);
+		if (!updated) throw new ConflictError(MOVED_WHILE_SENDING_MESSAGE);
 
 		// `queued` is a dead end for a row the queue never accepted: `send` takes
 		// draft, failed and blocked, `deleteDraft` those three plus unfiled, so a
 		// row parked at `queued` by a failed enqueue is neither sendable nor
-		// discardable (#845.8). Put it back where it came from and let the enqueue
-		// failure surface — the row stays reachable, the caller still hears no.
+		// discardable (#845.8). Settle it and let the enqueue failure surface —
+		// the row stays reachable, the caller still hears no.
 		await this.enqueueSend(existing.accountId, outboxMessageId).catch(
 			async (error: unknown) => {
-				await this.outboxMessageService.updateStatus(
+				await this.settleUnqueued(
 					accountConfigId,
 					outboxMessageId,
 					existing.status,
@@ -282,7 +331,21 @@ export class OutboxQueueService {
 			status: OutboxMessageStatus.queued,
 		});
 
-		await this.enqueueSend(input.accountId, outbox.outboxMessageId);
+		// Same dead end as in `send`: a row parked at `queued` by an enqueue that
+		// threw is neither sendable nor discardable (#845.8, #931, #936). This row
+		// is new, so there is no prior status — it settles at `failed`, carrying
+		// the reason, which keeps the composed text editable and sendable while
+		// staying outside the fence a landed event has to pass.
+		await this.enqueueSend(input.accountId, outbox.outboxMessageId).catch(
+			async (error: unknown) => {
+				await this.settleUnqueued(
+					input.accountConfigId,
+					outbox.outboxMessageId,
+					OutboxMessageStatus.failed,
+				);
+				throw error;
+			},
+		);
 
 		this.log.info(
 			{ outboxMessageId: outbox.outboxMessageId, accountId: input.accountId },
@@ -330,6 +393,45 @@ export class OutboxQueueService {
 		this.log.info({ outboxMessageId }, "Deleted outbox message");
 	};
 
+	/**
+	 * Take a row back out of `queued` after the enqueue reported a failure.
+	 *
+	 * Conditional on `queued`, because the event may have landed regardless — an
+	 * error from `SendMessage` says the response was lost, not that the broker
+	 * refused it. If the worker already has the row, it holds the newer truth and
+	 * this write does nothing.
+	 *
+	 * Never rejects. The enqueue failure is what went wrong and what the caller
+	 * has to hear; a settle that also fails would replace it with the wrong
+	 * cause, so it is logged and the row is left where #936 found it — which the
+	 * caller's error at least names.
+	 */
+	private settleUnqueued = async (
+		accountConfigId: string,
+		outboxMessageId: string,
+		priorStatus: OutboxMessageItem["status"],
+	): Promise<void> => {
+		const status = settledStatusFor(priorStatus);
+		await this.outboxMessageService
+			.updateIfStatus(
+				accountConfigId,
+				outboxMessageId,
+				OutboxMessageStatus.queued,
+				{
+					status,
+					...(status === OutboxMessageStatus.failed && {
+						lastError: ENQUEUE_FAILED_MESSAGE,
+					}),
+				},
+			)
+			.catch((settleError: unknown) => {
+				this.log.error(
+					{ outboxMessageId, settleError: String(settleError) },
+					"Could not settle an outbox message the queue refused",
+				);
+			});
+	};
+
 	private enqueueSend = async (
 		accountId: string,
 		outboxMessageId: string,

package/src/outbox-status.ts

@@ -0,0 +1,21 @@
+import type { OutboxMessageItem } from "@remit/data-ports";
+import { OutboxMessageStatus } from "@remit/domain-enums";
+
+/**
+ * Whether the message is still the user's to work on: nothing of it is on the
+ * wire, so Send, Edit and its attachments all apply.
+ *
+ * One predicate for all three because they answer the same question, and
+ * splitting them is what dead-ended a refused message. Sending took `failed`
+ * while editing took only `draft`, so a message the server turned away for a
+ * bad address could be re-sent unchanged or deleted, and nothing else — Retry
+ * queued the same envelope, and Edit took a 409 on the flush that precedes the
+ * send (#933).
+ *
+ * Everything absent is in the worker's hands or settled: `queued` and `sending`
+ * are mid-flight, `sent` and `unfiled` were delivered.
+ */
+export const isOpenForWork = (status: OutboxMessageItem["status"]): boolean =>
+	status === OutboxMessageStatus.draft ||
+	status === OutboxMessageStatus.failed ||
+	status === OutboxMessageStatus.blocked;

package/src/placement-move-unsettled.test.ts

@@ -20,6 +20,7 @@ import type {
 	UpdateMessageMoveInput,
 } from "@remit/data-ports";
 import { PlacementMoveService } from "./placement-move.js";
+import { noFolderRoles } from "./test-helpers/folder-roles.js";
 
 const ACCOUNT_ID = "acc-pm";
 const ACCOUNT_CONFIG_ID = "cfg-pm";
@@ -111,6 +112,7 @@ const buildHarness = (): Harness => {
 		threadMessageService,
 		markerService,
 		addressService,
+		mailboxSpecialUseService: noFolderRoles,
 		sqsQueueUrl: "https://sqs.eu-west-1.amazonaws.com/000/message-mgmt",
 		moveSettleTimeoutMs: 200,
 		moveSettlePollMs: 10,

package/src/placement-move.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { SendMessageCommand, type SQSClient } from "@aws-sdk/client-sqs";
 import type {
 	IAddressRepository,
+	IMailboxSpecialUseRepository,
 	IMessagePlacementMoveRepository,
 	IMessageRepository,
 	IThreadMessageRepository,
@@ -44,6 +45,12 @@ export interface PlacementMoveConfig {
 	threadMessageService: IThreadMessageRepository;
 	markerService: IMessagePlacementMoveRepository;
 	addressService: IAddressRepository;
+	/**
+	 * Required, not optional: this mover carries automatic spam placement, and
+	 * one built without the folder-role seam would silently leave the sender of
+	 * every auto-filed spam suggestible in the compose picker.
+	 */
+	mailboxSpecialUseService: IMailboxSpecialUseRepository;
 	sqsQueueUrl: string;
 	sqsEndpoint?: string;
 	logger?: PlacementMoveLogger;
@@ -87,6 +94,7 @@ export class PlacementMoveService {
 	private threadMessageService: IThreadMessageRepository;
 	private markerService: IMessagePlacementMoveRepository;
 	private addressService: IAddressRepository;
+	private mailboxSpecialUseService: IMailboxSpecialUseRepository;
 	private sqs: SQSClient;
 	private queueUrl: string;
 	private log: PlacementMoveLogger;
@@ -98,6 +106,7 @@ export class PlacementMoveService {
 		this.threadMessageService = config.threadMessageService;
 		this.markerService = config.markerService;
 		this.addressService = config.addressService;
+		this.mailboxSpecialUseService = config.mailboxSpecialUseService;
 		this.queueUrl = config.sqsQueueUrl;
 		this.log = config.logger ?? noopLogger;
 		this.moveSettleTimeoutMs =
@@ -200,7 +209,12 @@ export class PlacementMoveService {
 			originalUid: message.uid,
 		});
 
-		await this.addressService.reconcileJunkOnlyForMessage(messageId);
+		await this.addressService.reconcileJunkOnlyForMessage(
+			messageId,
+			await this.mailboxSpecialUseService.resolveJunkRolesForConfig(
+				accountConfigId,
+			),
+		);
 
 		// The queue kick is a serious operational step, not a routine one — a
 		// failure here MUST propagate (never swallowed): the marker stays

package/src/spam-report.test.ts

@@ -19,7 +19,7 @@ import {
 	NoJunkMailboxError,
 	SpamReportService,
 } from "./spam-report.js";
-import { trashRole } from "./test-helpers/folder-roles.js";
+import { NO_JUNK_ROLES, trashRole } from "./test-helpers/folder-roles.js";
 
 const ACCOUNT = "acc-1";
 const ACCOUNT_CONFIG = "cfg-1";
@@ -235,6 +235,7 @@ const buildWorld = (
 		findJunkMailbox: async () => junkMailbox,
 		findTrashMailbox: async () => null,
 		resolveTrashRole: async () => trashRole(null),
+		resolveJunkRolesForConfig: async () => NO_JUNK_ROLES,
 	} as unknown as IMailboxSpecialUseRepository;
 
 	const mailboxService = {

package/src/test-helpers/folder-roles.ts

@@ -1,5 +1,8 @@
 import type { IMailboxSpecialUseRepository } from "@remit/data-ports";
-import type { RoleResolution } from "@remit/data-ports/folder-role";
+import type {
+	JunkRoleMailboxes,
+	RoleResolution,
+} from "@remit/data-ports/folder-role";
 
 type RoleMailbox = { mailboxId: string; fullPath: string };
 
@@ -24,6 +27,7 @@ export const noFolderRoles = {
 	findJunkMailbox: async () => null,
 	findTrashMailbox: async () => null,
 	resolveTrashRole: async () => trashRole(null),
+	resolveJunkRolesForConfig: async () => NO_JUNK_ROLES,
 } as unknown as IMailboxSpecialUseRepository;
 
 /** A folder-role map naming the mailboxes that hold Junk and Trash. */
@@ -41,11 +45,22 @@ export const folderRoles = (roles: {
 				: null,
 		findTrashMailbox: async () => trash,
 		resolveTrashRole: async () => trashRole(trash),
+		resolveJunkRolesForConfig: async () => ({
+			junkMailboxIds: roles.junkMailboxId ? [roles.junkMailboxId] : [],
+			trashMailboxIds: roles.trashMailboxId ? [roles.trashMailboxId] : [],
+		}),
 	} as unknown as IMailboxSpecialUseRepository;
 };
 
+/** An account whose config resolves no Junk and no Trash anywhere. */
+export const NO_JUNK_ROLES: JunkRoleMailboxes = {
+	junkMailboxIds: [],
+	trashMailboxIds: [],
+};
+
 /** The same account, as the resolved map `saveMessage` is handed. */
 export const NO_FOLDER_ROLES = {
 	junkMailboxId: null,
 	trashMailboxId: null,
+	configJunkRoles: NO_JUNK_ROLES,
 };