@remit/mailbox-service 0.0.87 → 0.0.89

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.87",
+  "version": "0.0.89",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/filters/match.test.ts

@@ -8,6 +8,7 @@ import {
 	cosineSimilarity,
 	type FilterMessage,
 	literalClausesMatch,
+	literalClauseTerms,
 	selectMoveWinner,
 } from "./match.js";
 
@@ -287,3 +288,106 @@ describe("buildMatchText", () => {
 		assert.equal(text.length, 512);
 	});
 });
+
+describe("literalClauseTerms (reader #459)", () => {
+	it("narrows From and Subject onto the columns that carry them", () => {
+		assert.deepEqual(
+			literalClauseTerms(
+				[
+					clause(FilterClauseField.From, " alice@acme.example "),
+					clause(FilterClauseField.Subject, "invoice"),
+				],
+				FilterMatchOperator.And,
+			),
+			{
+				terms: [
+					{ field: "sender", contains: "alice@acme.example" },
+					{ field: "subject", contains: "invoice" },
+				],
+				operator: "and",
+			},
+		);
+	});
+
+	it("narrows FromDomain to the registrable domain, which the sender always contains", () => {
+		const narrowing = literalClauseTerms(
+			[clause(FilterClauseField.FromDomain, "billing@mail.acme.example")],
+			FilterMatchOperator.And,
+		);
+
+		assert.deepEqual(narrowing?.terms, [
+			{ field: "sender", contains: "acme.example" },
+		]);
+		assert.equal(
+			clauseMatches(
+				clause(FilterClauseField.FromDomain, "billing@mail.acme.example"),
+				message(),
+			),
+			true,
+		);
+	});
+
+	it("narrows ListId to its canonical form", () => {
+		assert.deepEqual(
+			literalClauseTerms(
+				[clause(FilterClauseField.ListId, "News <Weekly.News.Example.com>")],
+				FilterMatchOperator.And,
+			)?.terms,
+			[{ field: "listId", contains: "weekly.news.example.com" }],
+		);
+	});
+
+	it("returns null for clauses nothing can satisfy, so no query is worth running", () => {
+		assert.equal(
+			literalClauseTerms(
+				[clause(FilterClauseField.From, "   ")],
+				FilterMatchOperator.And,
+			),
+			null,
+		);
+		assert.equal(
+			literalClauseTerms(
+				[clause(FilterClauseField.FromDomain, "not a domain")],
+				FilterMatchOperator.Or,
+			),
+			null,
+		);
+	});
+
+	it("drops an unsatisfiable clause from an Or instead of losing the rest", () => {
+		assert.deepEqual(
+			literalClauseTerms(
+				[
+					clause(FilterClauseField.From, ""),
+					clause(FilterClauseField.Subject, "invoice"),
+				],
+				FilterMatchOperator.Or,
+			),
+			{ terms: [{ field: "subject", contains: "invoice" }], operator: "or" },
+		);
+	});
+
+	it("narrows nothing when an Or reaches a clause no column carries", () => {
+		assert.deepEqual(
+			literalClauseTerms(
+				[
+					clause(FilterClauseField.HasWords, "quarter"),
+					clause(FilterClauseField.Subject, "invoice"),
+				],
+				FilterMatchOperator.Or,
+			),
+			{ terms: [], operator: "or" },
+		);
+	});
+
+	it("narrows nothing for no clauses, matching the vacuous pass of literalClausesMatch", () => {
+		assert.deepEqual(literalClauseTerms([], FilterMatchOperator.And), {
+			terms: [],
+			operator: "and",
+		});
+		assert.equal(
+			literalClausesMatch([], FilterMatchOperator.And, message()),
+			true,
+		);
+	});
+});

package/src/filters/match.ts

@@ -1,4 +1,8 @@
-import { FILTER_NO_ACTION, type FilterItem } from "@remit/data-ports";
+import {
+	FILTER_NO_ACTION,
+	type FilterItem,
+	type ThreadMessageFieldTerm,
+} from "@remit/data-ports";
 import { FilterClauseField, FilterMatchOperator } from "@remit/domain-enums";
 import { getDomain } from "tldts";
 import { normalizeListId } from "./list-id.js";
@@ -108,6 +112,87 @@ export const literalClausesMatch = (
 		: clauses.every((clause) => clauseMatches(clause, msg));
 };
 
+/**
+ * What a store can be asked for on behalf of one clause: a column term, or the
+ * two answers a term cannot express — a clause nothing can satisfy, and a
+ * clause selecting on something no ThreadMessage column carries.
+ */
+type ClauseNarrowing =
+	| { kind: "Term"; term: ThreadMessageFieldTerm }
+	| { kind: "NeverMatches" }
+	| { kind: "Unnarrowable" };
+
+const clauseNarrowing = (clause: FilterClause): ClauseNarrowing => {
+	const value = clause.value.trim();
+	if (value === "") return { kind: "NeverMatches" };
+	switch (clause.field) {
+		case FilterClauseField.From:
+			return { kind: "Term", term: { field: "sender", contains: value } };
+		case FilterClauseField.Subject:
+			return { kind: "Term", term: { field: "subject", contains: value } };
+		case FilterClauseField.ListId: {
+			const target = normalizeListId(value);
+			if (target === "") return { kind: "NeverMatches" };
+			return { kind: "Term", term: { field: "listId", contains: target } };
+		}
+		case FilterClauseField.FromDomain: {
+			const target = registrableDomain(value);
+			if (target === null) return { kind: "NeverMatches" };
+			return { kind: "Term", term: { field: "sender", contains: target } };
+		}
+		default:
+			return { kind: "Unnarrowable" };
+	}
+};
+
+/**
+ * The terms to query with, and how to combine them. Empty terms narrow nothing
+ * — the caller reads the whole corpus and refines it.
+ */
+export interface LiteralClauseNarrowing {
+	terms: ThreadMessageFieldTerm[];
+	operator: "and" | "or";
+}
+
+/**
+ * The store-side half of {@link literalClausesMatch}: the column terms a query
+ * can evaluate on behalf of these clauses, or `null` when they can match
+ * nothing at all and there is no query worth running.
+ *
+ * A term is deliberately WIDER than the clause it stands for — a `FromDomain`
+ * clause narrows to the registrable domain appearing anywhere in the sender,
+ * so `github.com.evil.example` still comes back — and a `HasWords` clause
+ * cannot be narrowed at all, since no row column carries the body. The rows a
+ * term selects are candidates; `literalClausesMatch` still decides. Pushing the
+ * terms down is what makes the caller's bound a bound on RESULTS: filtering a
+ * date-ordered page instead answers "matches among the newest N messages"
+ * (#459).
+ */
+export const literalClauseTerms = (
+	clauses: readonly FilterClause[],
+	operator: FilterItem["matchOperator"],
+): LiteralClauseNarrowing | null => {
+	const combine = operator === FilterMatchOperator.Or ? "or" : "and";
+	if (clauses.length === 0) return { terms: [], operator: combine };
+	const narrowings = clauses.map(clauseNarrowing);
+	const terms = narrowings.flatMap((narrowing) =>
+		narrowing.kind === "Term" ? [narrowing.term] : [],
+	);
+	if (combine === "and") {
+		if (narrowings.some((narrowing) => narrowing.kind === "NeverMatches")) {
+			return null;
+		}
+		return { terms, operator: "and" };
+	}
+	if (narrowings.every((narrowing) => narrowing.kind === "NeverMatches")) {
+		return null;
+	}
+	if (narrowings.some((narrowing) => narrowing.kind === "Unnarrowable")) {
+		return { terms: [], operator: "or" };
+	}
+	return { terms, operator: "or" };
+};
+
 /**
  * Cosine similarity of two equal-length vectors. Throws on a dimension mismatch
  * rather than silently scoring incomparable vectors — a mismatch means a stale

package/src/index.ts

@@ -76,7 +76,9 @@ export {
 	cosineSimilarity,
 	DEFAULT_SEMANTIC_MATCH_THRESHOLD,
 	type FilterMessage,
+	type LiteralClauseNarrowing,
 	literalClausesMatch,
+	literalClauseTerms,
 	NO_ACTION,
 	selectMoveWinner,
 } from "./filters/match.js";

package/src/message-move-same-mailbox.test.ts

@@ -48,7 +48,8 @@ const buildWorld = () => {
 	]);
 
 	const messageService = {
-		get: async () => message,
+		get: async (ids: string | string[]) =>
+			Array.isArray(ids) ? [message] : message,
 		update: async (_id: string, patch: Record<string, unknown>) =>
 			Object.assign(message, patch),
 		updateForMove: async (_id: string, patch: Record<string, unknown>) =>

package/src/message-move-unsettled-placement.test.ts

@@ -0,0 +1,339 @@
+/**
+ * Issue #665. While a placement move is in flight the Message row names the
+ * destination folder but still carries the SOURCE folder's uid, so a user move
+ * that binds the pair as it stands sends the worker to `openBox(destination)`
+ * and `moveMessages([uid])` — the destination folder's own message at that uid,
+ * carried off to wherever the user pointed. The reachable press is Undo on the
+ * auto-moved badge, inside the seconds before the placement push confirms.
+ */
+
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type {
+	IAddressRepository,
+	IMailboxRepository,
+	IMailboxSpecialUseRepository,
+	IMessageRepository,
+	IThreadMessageRepository,
+} from "@remit/data-ports";
+import { MessagePlacementUnsettledError } from "@remit/data-ports/errors";
+import { MessageMoveService } from "./message-move.js";
+import { NO_JUNK_ROLES } from "./test-helpers/folder-roles.js";
+
+const ACCOUNT = "acc-1";
+const ACCOUNT_CONFIG = "cfg-1";
+const INBOX = "mbx-inbox";
+const ARCHIVE = "mbx-archive";
+
+const MOVING_ID = "msg-moving";
+const SETTLED_ID = "msg-settled";
+const STRANDED_ID = "msg-stranded";
+const COPY_ID = "msg-copy";
+
+const INBOX_UID = 42;
+const ARCHIVE_UID = 907;
+const SETTLED_UID = 11;
+
+interface CapturedEvent {
+	type: string;
+	messageId?: string;
+	uid?: number;
+	sourceMailboxPath?: string;
+	destinationMailboxPath?: string;
+}
+
+const mailboxes = [
+	{ mailboxId: INBOX, fullPath: "INBOX", accountId: ACCOUNT },
+	{ mailboxId: ARCHIVE, fullPath: "Archive", accountId: ACCOUNT },
+];
+
+/** A row mid-move: Archive is already written, the uid is still INBOX's. */
+const movingRow = () => ({
+	messageId: MOVING_ID,
+	mailboxId: ARCHIVE,
+	uid: INBOX_UID,
+	status: "moving",
+	syncStatus: "pending",
+	originalMailboxId: INBOX,
+	originalUid: INBOX_UID,
+});
+
+/** The same row after the mover gave up without confirming. */
+const strandedRow = () => ({
+	...movingRow(),
+	messageId: STRANDED_ID,
+	syncStatus: "failed",
+});
+
+/** An ordinary settled row. */
+const settledRow = () => ({
+	messageId: SETTLED_ID,
+	mailboxId: INBOX,
+	uid: SETTLED_UID,
+	status: "active",
+	syncStatus: "synced",
+});
+
+/**
+ * A freshly copied row: `moving` until COPYUID lands, with no server-side uid
+ * at all and no move behind it. Its uid is not ready; it does not name anyone.
+ */
+const freshCopyRow = () => ({
+	messageId: COPY_ID,
+	mailboxId: ARCHIVE,
+	uid: 0,
+	status: "moving",
+	syncStatus: "pending",
+});
+
+const buildWorld = (seed: Array<Record<string, unknown>>) => {
+	const patches: Array<{ messageId: string; patch: Record<string, unknown> }> =
+		[];
+	const events: CapturedEvent[] = [];
+	const rows = new Map<string, Record<string, unknown>>(
+		seed.map((row): [string, Record<string, unknown>] => [
+			String(row.messageId),
+			row,
+		]),
+	);
+
+	/** What `updateUid` writes when the placement move confirms. */
+	const settle = (messageId: string) => {
+		Object.assign(rows.get(messageId) ?? {}, {
+			uid: ARCHIVE_UID,
+			status: "active",
+			syncStatus: "synced",
+		});
+	};
+
+	const messageService = {
+		get: async (ids: string | string[]) =>
+			Array.isArray(ids)
+				? ids.flatMap((id) => {
+						const row = rows.get(id);
+						return row ? [row] : [];
+					})
+				: rows.get(ids),
+		update: async (id: string, patch: Record<string, unknown>) => {
+			patches.push({ messageId: id, patch });
+			return Object.assign(rows.get(id) ?? {}, patch);
+		},
+		updateForMove: async (id: string, patch: Record<string, unknown>) => {
+			patches.push({ messageId: id, patch });
+			return Object.assign(rows.get(id) ?? {}, patch);
+		},
+	} as unknown as IMessageRepository;
+
+	const threadMessageService = {
+		getByMessageId: async (_cfg: string, messageId: string) => ({
+			accountConfigId: ACCOUNT_CONFIG,
+			threadMessageId: `tm-${messageId}`,
+			messageId,
+			threadId: "thr-1",
+			mailboxId: rows.get(messageId)?.mailboxId,
+			sentDate: 1,
+			isRead: false,
+			isDeleted: false,
+			hasStars: false,
+			hasAttachment: false,
+		}),
+		update: async () => {},
+	} as unknown as IThreadMessageRepository;
+
+	const mailboxService = {
+		get: async (_accountId: string, ids: string | string[]) =>
+			Array.isArray(ids)
+				? mailboxes.filter((mailbox) => ids.includes(mailbox.mailboxId))
+				: mailboxes.find((mailbox) => mailbox.mailboxId === ids),
+	} as unknown as IMailboxRepository;
+
+	const mailboxSpecialUseService = {
+		findTrashMailbox: async () => null,
+		resolveJunkRolesForConfig: async () => NO_JUNK_ROLES,
+	} as unknown as IMailboxSpecialUseRepository;
+
+	const addressService = {
+		reconcileJunkOnlyForMessage: async () => {},
+	} as unknown as IAddressRepository;
+
+	const service = new MessageMoveService({
+		messageService,
+		mailboxService,
+		mailboxSpecialUseService,
+		threadMessageService,
+		addressService,
+		sqsQueueUrl: "http://localhost:9324/000000000000/remit-messages.fifo",
+		moveSettleTimeoutMs: 200,
+		moveSettlePollMs: 10,
+	});
+
+	(
+		service as unknown as { enqueueEvent: (e: CapturedEvent) => Promise<void> }
+	).enqueueEvent = async (event) => {
+		events.push(event);
+	};
+
+	return { service, patches, events, rows, settle };
+};
+
+describe("a move never binds the folder/uid pair of an in-flight move (#665)", () => {
+	it("binds the confirmed pair once the placement move settles", async () => {
+		const { service, events, settle } = buildWorld([movingRow()]);
+
+		setTimeout(() => settle(MOVING_ID), 30);
+		await service.moveMessage(ACCOUNT_CONFIG, MOVING_ID, INBOX, ACCOUNT);
+
+		assert.equal(events.length, 1);
+		assert.equal(events[0].type, "MESSAGE_MOVE");
+		assert.equal(
+			events[0].sourceMailboxPath,
+			"Archive",
+			"the folder the confirmed move left the message in",
+		);
+		assert.equal(
+			events[0].uid,
+			ARCHIVE_UID,
+			"and that folder's own uid, never the source folder's",
+		);
+		assert.equal(events[0].destinationMailboxPath, "INBOX");
+	});
+
+	it("refuses the move, and touches nothing, when the placement never settles", async () => {
+		const { service, patches, events, rows } = buildWorld([movingRow()]);
+
+		await assert.rejects(
+			() => service.moveMessage(ACCOUNT_CONFIG, MOVING_ID, INBOX, ACCOUNT),
+			(error: unknown) =>
+				error instanceof MessagePlacementUnsettledError &&
+				error.statusCode === 409 &&
+				error.publicApiError?.code === "message_placement_unsettled" &&
+				error.publicApiError?.details?.messageId === MOVING_ID &&
+				error.publicApiError?.details?.accountId === ACCOUNT &&
+				error.publicApiError?.details?.reason === "in_flight",
+		);
+
+		assert.deepEqual(events, [], "nothing was enqueued");
+		assert.deepEqual(patches, [], "and no local write was made");
+		assert.equal(rows.get(MOVING_ID)?.mailboxId, ARCHIVE);
+		assert.equal(rows.get(MOVING_ID)?.uid, INBOX_UID);
+	});
+
+	it("never answers the same-mailbox skip from a folder the message has not reached", async () => {
+		// The skip compares the row's `mailboxId` against the destination. An
+		// in-flight move has already written that folder optimistically, so the
+		// comparison would report the message home and return a silent success
+		// for a move the server has not made.
+		const { service, events } = buildWorld([movingRow()]);
+
+		await assert.rejects(
+			() => service.moveMessage(ACCOUNT_CONFIG, MOVING_ID, ARCHIVE, ACCOUNT),
+			MessagePlacementUnsettledError,
+		);
+
+		assert.deepEqual(events, []);
+	});
+
+	it("moves no part of a batch when one row is in flight", async () => {
+		// All-or-nothing: the settled row is movable on its own and a per-row
+		// gate would have moved it before reaching the refusal.
+		const { service, patches, events } = buildWorld([
+			settledRow(),
+			movingRow(),
+		]);
+
+		await assert.rejects(
+			() =>
+				service.moveMessages(
+					ACCOUNT_CONFIG,
+					[SETTLED_ID, MOVING_ID],
+					ARCHIVE,
+					ACCOUNT,
+				),
+			MessagePlacementUnsettledError,
+		);
+
+		assert.deepEqual(
+			events,
+			[],
+			"the settled row was not moved alongside the refusal",
+		);
+		assert.deepEqual(patches, []);
+	});
+
+	it("moves the whole batch once the in-flight row settles", async () => {
+		const { service, events, settle } = buildWorld([settledRow(), movingRow()]);
+
+		setTimeout(() => settle(MOVING_ID), 30);
+		await service.moveMessages(
+			ACCOUNT_CONFIG,
+			[SETTLED_ID, MOVING_ID],
+			INBOX,
+			ACCOUNT,
+		);
+
+		assert.deepEqual(
+			events.map((event) => [event.messageId, event.uid]),
+			[[MOVING_ID, ARCHIVE_UID]],
+			"the settled row was already in INBOX and skipped; the moved row went with the confirmed uid",
+		);
+	});
+
+	it("waits one row's ceiling for a batch, not one per row", async () => {
+		const rows = [movingRow(), movingRow(), movingRow()].map((row, index) => ({
+			...row,
+			messageId: `${MOVING_ID}-${index}`,
+		}));
+		const { service } = buildWorld(rows);
+
+		const startedAt = Date.now();
+		await assert.rejects(
+			() =>
+				service.moveMessages(
+					ACCOUNT_CONFIG,
+					rows.map((row) => row.messageId),
+					INBOX,
+					ACCOUNT,
+				),
+			MessagePlacementUnsettledError,
+		);
+
+		assert.ok(
+			Date.now() - startedAt < 500,
+			"three rows refused within one 200ms ceiling, not three",
+		);
+	});
+});
+
+describe("the move gate refuses only a uid that names somebody else (#665)", () => {
+	it("moves a freshly copied row rather than waiting on it", async () => {
+		// A copy is `moving` with no server-side uid yet. That uid is not ready,
+		// which is not the same as naming another folder's message.
+		const { service, events } = buildWorld([freshCopyRow()]);
+
+		const startedAt = Date.now();
+		await service.moveMessage(ACCOUNT_CONFIG, COPY_ID, INBOX, ACCOUNT);
+
+		assert.equal(events.length, 1);
+		assert.equal(events[0].type, "MESSAGE_MOVE");
+		assert.ok(Date.now() - startedAt < 100, "and never entered the wait");
+	});
+
+	it("refuses a row stranded by a move that gave up, without spending the ceiling", async () => {
+		// `syncStatus: failed` with `status: moving` is what every handler's
+		// give-up path leaves behind, and only `updateUid` clears it. The pair is
+		// still a lie, so the move is still refused — under a reason whose remedy
+		// is a resync, and without a wait that could never succeed.
+		const { service, events } = buildWorld([strandedRow()]);
+
+		const startedAt = Date.now();
+		await assert.rejects(
+			() => service.moveMessage(ACCOUNT_CONFIG, STRANDED_ID, INBOX, ACCOUNT),
+			(error: unknown) =>
+				error instanceof MessagePlacementUnsettledError &&
+				error.publicApiError?.details?.reason === "unverified",
+		);
+
+		assert.deepEqual(events, []);
+		assert.ok(Date.now() - startedAt < 100, "refused without waiting");
+	});
+});

package/src/message-move.ts

@@ -521,6 +521,12 @@ export class MessageMoveService {
 	/**
 	 * Move a message to another mailbox.
 	 *
+	 * Waits, never reconciles (imap-mutations R2): the folder and uid go to the
+	 * server as one pair, and once the worker has moved the destination's own
+	 * message at that uid there is no reference left to repair. The person is
+	 * looking at the result, so blocking for the sub-second a move takes is the
+	 * cheap half; on timeout the move refuses ahead of any local write.
+	 *
 	 * @param messageId - Message to move
 	 * @param destinationMailboxId - Destination mailbox ID
 	 * @param accountId - Account ID
@@ -531,13 +537,32 @@ export class MessageMoveService {
 		destinationMailboxId: string,
 		accountId: string,
 	): Promise<void> => {
-		const message = await this.messageService.get(messageId);
+		await this.moveSettledMessage(
+			accountConfigId,
+			await this.settledPlacement(
+				await this.messageService.get(messageId),
+				accountId,
+			),
+			destinationMailboxId,
+			accountId,
+		);
+	};
+
+	private moveSettledMessage = async (
+		accountConfigId: string,
+		message: MessageItem,
+		destinationMailboxId: string,
+		accountId: string,
+	): Promise<void> => {
+		const messageId = message.messageId;
 
 		// IMAP has no same-mailbox MOVE: the server copies the message, expunges
 		// the original and hands back a fresh UID, so a request that asks for the
 		// mailbox the message is already in destroys its identity to reach the
 		// state it was already in. The requested end state holds, so there is
-		// nothing to record as pending and nothing to enqueue.
+		// nothing to record as pending and nothing to enqueue. The row is settled
+		// by the time this compares, so the folder it names is one the message has
+		// actually reached rather than one an in-flight move wrote optimistically.
 		if (message.mailboxId === destinationMailboxId) {
 			this.log.info(
 				{ messageId, mailboxId: destinationMailboxId },
@@ -633,10 +658,18 @@ export class MessageMoveService {
 		destinationMailboxId: string,
 		accountId: string,
 	): Promise<void> => {
-		for (const messageId of messageIds) {
-			await this.moveMessage(
+		// Every row is settled before the first move is written, so the batch's
+		// wait is one row's ceiling rather than the sum across it, and a refusal
+		// lands before any part of the batch has committed.
+		const sources = await this.settledPlacements(
+			await this.messageService.get(messageIds),
+			accountId,
+		);
+
+		for (const source of sources) {
+			await this.moveSettledMessage(
 				accountConfigId,
-				messageId,
+				source,
 				destinationMailboxId,
 				accountId,
 			);

package/src/spam-report.test.ts

@@ -10,6 +10,7 @@ import type {
 	IMessageRepository,
 	IThreadMessageRepository,
 } from "@remit/data-ports";
+import { MessagePlacementUnsettledError } from "@remit/data-ports/errors";
 import { deriveAddressId } from "@remit/data-ports/id";
 import { AddressRole } from "@remit/domain-enums";
 import { FlagPushService } from "./flag-push.js";
@@ -279,6 +280,8 @@ const buildWorld = (
 		threadMessageService,
 		addressService,
 		sqsQueueUrl: "http://localhost:9324/000000000000/message-mgmt",
+		moveSettleTimeoutMs: 30,
+		moveSettlePollMs: 5,
 	});
 	(
 		messageMoveService as unknown as {
@@ -394,13 +397,14 @@ describe("SpamReportService.reportSpam", () => {
 	});
 
 	it("is idempotent under a double press", async () => {
-		const { service, sent } = buildWorld();
+		const { service, messages, sent } = buildWorld();
 
 		await service.reportSpam({
 			accountConfigId: ACCOUNT_CONFIG,
 			accountId: ACCOUNT,
 			messageId: MESSAGE_ID,
 		});
+		settleMove(messages);
 		await service.reportSpam({
 			accountConfigId: ACCOUNT_CONFIG,
 			accountId: ACCOUNT,
@@ -409,6 +413,37 @@ describe("SpamReportService.reportSpam", () => {
 
 		// The second call's move is a no-op: MessageMoveService.moveMessage sees
 		// the local mailboxId already equals Junk and skips without enqueueing.
+		// The skip is read off the settled row — a press inside the first move's
+		// flight waits for it rather than answering from the folder that move
+		// wrote optimistically (#665).
+		assert.equal(moveEvents(sent).length, 1);
+	});
+
+	it("refuses a second press inside the first move's flight", async () => {
+		// No settleMove between the presses: the row names Junk while still
+		// carrying the inbox's uid, so acting on it would address whatever Junk
+		// holds at that uid — somebody else's message (#665).
+		const { service, sent } = buildWorld();
+
+		await service.reportSpam({
+			accountConfigId: ACCOUNT_CONFIG,
+			accountId: ACCOUNT,
+			messageId: MESSAGE_ID,
+		});
+
+		await assert.rejects(
+			() =>
+				service.reportSpam({
+					accountConfigId: ACCOUNT_CONFIG,
+					accountId: ACCOUNT,
+					messageId: MESSAGE_ID,
+				}),
+			(error: unknown) =>
+				error instanceof MessagePlacementUnsettledError &&
+				error.statusCode === 409 &&
+				error.publicApiError?.details?.reason === "in_flight",
+		);
+
 		assert.equal(moveEvents(sent).length, 1);
 	});