@remit/mailbox-service 0.0.88 → 0.0.90

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.88",
+  "version": "0.0.90",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/index.ts

@@ -252,6 +252,7 @@ export {
 	resolveExhaustedPlacementMoveFailure,
 } from "./placement-move-terminal.js";
 export {
+	carriesForeignUid,
 	isPlacementUnsettled,
 	type PlacementBinding,
 	placementBindingOf,

package/src/message-move-empty-trash.test.ts

@@ -46,8 +46,27 @@ const proposedDeletedFolder: RoleResolution<TrashMailbox> = {
 interface TrashMessage {
 	messageId: string;
 	syncStatus: string;
+	status?: string;
+	mailboxId?: string;
+	uid?: number;
+	originalMailboxId?: string;
+	originalUid?: number;
 }
 
+/**
+ * A row mid-move into Trash: the folder is already written, the uid is still
+ * the inbox's, and only `status: moving` says so.
+ */
+const movingIntoTrash = (messageId: string, uid: number): TrashMessage => ({
+	messageId,
+	syncStatus: "pending",
+	status: "moving",
+	mailboxId: REAL_TRASH,
+	uid,
+	originalMailboxId: "mbx-inbox",
+	originalUid: uid,
+});
+
 interface EnqueuedEvent {
 	type: string;
 	schemaVersion?: number;
@@ -194,22 +213,38 @@ describe("MessageMoveService.emptyTrash", () => {
 		assert.equal(deletedCount, 3);
 	});
 
-	it("marks and counts a message whose move to Trash has not settled", async () => {
-		// The user saw the message in Trash and asked for the folder to be
-		// emptied. Skipping it reports a number the folder contradicts, and the
-		// queue is per-account FIFO, so the move has landed on the server before
-		// the expunge is even delivered.
+	it("marks and counts a message whose sync is merely pending", async () => {
+		// `syncStatus: pending` is where every freshly synced inbound row sits
+		// forever; it says nothing about where the message is. The user saw it in
+		// Trash and asked for the folder to be emptied, and skipping it would
+		// report a number the folder contradicts.
 		const { service, markedDeleting } = buildWorld(appointedTrash, [
 			{ messageId: "settled-1", syncStatus: "synced" },
-			{ messageId: "still-moving-1", syncStatus: "pending" },
+			{ messageId: "pending-1", syncStatus: "pending" },
 		]);
 
 		const { deletedCount } = await service.emptyTrash(ACCOUNT_CONFIG, ACCOUNT);
 
-		assert.deepEqual(markedDeleting, ["settled-1", "still-moving-1"]);
+		assert.deepEqual(markedDeleting, ["settled-1", "pending-1"]);
 		assert.equal(deletedCount, 2);
 	});
 
+	it("leaves a row whose move into Trash has not settled unmarked and uncounted", async () => {
+		// Issue #1217. Marking it `deleting` overwrites the `moving` its own
+		// MESSAGE_MOVE reads to decide there is still work to do, so that move
+		// returns without touching IMAP and the worker's expunge then binds the
+		// inbox's uid against whatever Trash really holds at it.
+		const { service, markedDeleting } = buildWorld(appointedTrash, [
+			{ messageId: "settled-1", syncStatus: "synced" },
+			movingIntoTrash("moving-1", 10),
+		]);
+
+		const { deletedCount } = await service.emptyTrash(ACCOUNT_CONFIG, ACCOUNT);
+
+		assert.deepEqual(markedDeleting, ["settled-1"]);
+		assert.equal(deletedCount, 1);
+	});
+
 	it("reports the same count when pressed twice before the worker runs", async () => {
 		// The rows it marked are still in that folder, so N stays true and the
 		// re-mark is idempotent. Reporting 0 the second time while still

package/src/message-move-same-mailbox.test.ts

@@ -48,7 +48,8 @@ const buildWorld = () => {
 	]);
 
 	const messageService = {
-		get: async () => message,
+		get: async (ids: string | string[]) =>
+			Array.isArray(ids) ? [message] : message,
 		update: async (_id: string, patch: Record<string, unknown>) =>
 			Object.assign(message, patch),
 		updateForMove: async (_id: string, patch: Record<string, unknown>) =>

package/src/message-move-unsettled-placement.test.ts

@@ -0,0 +1,339 @@
+/**
+ * Issue #665. While a placement move is in flight the Message row names the
+ * destination folder but still carries the SOURCE folder's uid, so a user move
+ * that binds the pair as it stands sends the worker to `openBox(destination)`
+ * and `moveMessages([uid])` — the destination folder's own message at that uid,
+ * carried off to wherever the user pointed. The reachable press is Undo on the
+ * auto-moved badge, inside the seconds before the placement push confirms.
+ */
+
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type {
+	IAddressRepository,
+	IMailboxRepository,
+	IMailboxSpecialUseRepository,
+	IMessageRepository,
+	IThreadMessageRepository,
+} from "@remit/data-ports";
+import { MessagePlacementUnsettledError } from "@remit/data-ports/errors";
+import { MessageMoveService } from "./message-move.js";
+import { NO_JUNK_ROLES } from "./test-helpers/folder-roles.js";
+
+const ACCOUNT = "acc-1";
+const ACCOUNT_CONFIG = "cfg-1";
+const INBOX = "mbx-inbox";
+const ARCHIVE = "mbx-archive";
+
+const MOVING_ID = "msg-moving";
+const SETTLED_ID = "msg-settled";
+const STRANDED_ID = "msg-stranded";
+const COPY_ID = "msg-copy";
+
+const INBOX_UID = 42;
+const ARCHIVE_UID = 907;
+const SETTLED_UID = 11;
+
+interface CapturedEvent {
+	type: string;
+	messageId?: string;
+	uid?: number;
+	sourceMailboxPath?: string;
+	destinationMailboxPath?: string;
+}
+
+const mailboxes = [
+	{ mailboxId: INBOX, fullPath: "INBOX", accountId: ACCOUNT },
+	{ mailboxId: ARCHIVE, fullPath: "Archive", accountId: ACCOUNT },
+];
+
+/** A row mid-move: Archive is already written, the uid is still INBOX's. */
+const movingRow = () => ({
+	messageId: MOVING_ID,
+	mailboxId: ARCHIVE,
+	uid: INBOX_UID,
+	status: "moving",
+	syncStatus: "pending",
+	originalMailboxId: INBOX,
+	originalUid: INBOX_UID,
+});
+
+/** The same row after the mover gave up without confirming. */
+const strandedRow = () => ({
+	...movingRow(),
+	messageId: STRANDED_ID,
+	syncStatus: "failed",
+});
+
+/** An ordinary settled row. */
+const settledRow = () => ({
+	messageId: SETTLED_ID,
+	mailboxId: INBOX,
+	uid: SETTLED_UID,
+	status: "active",
+	syncStatus: "synced",
+});
+
+/**
+ * A freshly copied row: `moving` until COPYUID lands, with no server-side uid
+ * at all and no move behind it. Its uid is not ready; it does not name anyone.
+ */
+const freshCopyRow = () => ({
+	messageId: COPY_ID,
+	mailboxId: ARCHIVE,
+	uid: 0,
+	status: "moving",
+	syncStatus: "pending",
+});
+
+const buildWorld = (seed: Array<Record<string, unknown>>) => {
+	const patches: Array<{ messageId: string; patch: Record<string, unknown> }> =
+		[];
+	const events: CapturedEvent[] = [];
+	const rows = new Map<string, Record<string, unknown>>(
+		seed.map((row): [string, Record<string, unknown>] => [
+			String(row.messageId),
+			row,
+		]),
+	);
+
+	/** What `updateUid` writes when the placement move confirms. */
+	const settle = (messageId: string) => {
+		Object.assign(rows.get(messageId) ?? {}, {
+			uid: ARCHIVE_UID,
+			status: "active",
+			syncStatus: "synced",
+		});
+	};
+
+	const messageService = {
+		get: async (ids: string | string[]) =>
+			Array.isArray(ids)
+				? ids.flatMap((id) => {
+						const row = rows.get(id);
+						return row ? [row] : [];
+					})
+				: rows.get(ids),
+		update: async (id: string, patch: Record<string, unknown>) => {
+			patches.push({ messageId: id, patch });
+			return Object.assign(rows.get(id) ?? {}, patch);
+		},
+		updateForMove: async (id: string, patch: Record<string, unknown>) => {
+			patches.push({ messageId: id, patch });
+			return Object.assign(rows.get(id) ?? {}, patch);
+		},
+	} as unknown as IMessageRepository;
+
+	const threadMessageService = {
+		getByMessageId: async (_cfg: string, messageId: string) => ({
+			accountConfigId: ACCOUNT_CONFIG,
+			threadMessageId: `tm-${messageId}`,
+			messageId,
+			threadId: "thr-1",
+			mailboxId: rows.get(messageId)?.mailboxId,
+			sentDate: 1,
+			isRead: false,
+			isDeleted: false,
+			hasStars: false,
+			hasAttachment: false,
+		}),
+		update: async () => {},
+	} as unknown as IThreadMessageRepository;
+
+	const mailboxService = {
+		get: async (_accountId: string, ids: string | string[]) =>
+			Array.isArray(ids)
+				? mailboxes.filter((mailbox) => ids.includes(mailbox.mailboxId))
+				: mailboxes.find((mailbox) => mailbox.mailboxId === ids),
+	} as unknown as IMailboxRepository;
+
+	const mailboxSpecialUseService = {
+		findTrashMailbox: async () => null,
+		resolveJunkRolesForConfig: async () => NO_JUNK_ROLES,
+	} as unknown as IMailboxSpecialUseRepository;
+
+	const addressService = {
+		reconcileJunkOnlyForMessage: async () => {},
+	} as unknown as IAddressRepository;
+
+	const service = new MessageMoveService({
+		messageService,
+		mailboxService,
+		mailboxSpecialUseService,
+		threadMessageService,
+		addressService,
+		sqsQueueUrl: "http://localhost:9324/000000000000/remit-messages.fifo",
+		moveSettleTimeoutMs: 200,
+		moveSettlePollMs: 10,
+	});
+
+	(
+		service as unknown as { enqueueEvent: (e: CapturedEvent) => Promise<void> }
+	).enqueueEvent = async (event) => {
+		events.push(event);
+	};
+
+	return { service, patches, events, rows, settle };
+};
+
+describe("a move never binds the folder/uid pair of an in-flight move (#665)", () => {
+	it("binds the confirmed pair once the placement move settles", async () => {
+		const { service, events, settle } = buildWorld([movingRow()]);
+
+		setTimeout(() => settle(MOVING_ID), 30);
+		await service.moveMessage(ACCOUNT_CONFIG, MOVING_ID, INBOX, ACCOUNT);
+
+		assert.equal(events.length, 1);
+		assert.equal(events[0].type, "MESSAGE_MOVE");
+		assert.equal(
+			events[0].sourceMailboxPath,
+			"Archive",
+			"the folder the confirmed move left the message in",
+		);
+		assert.equal(
+			events[0].uid,
+			ARCHIVE_UID,
+			"and that folder's own uid, never the source folder's",
+		);
+		assert.equal(events[0].destinationMailboxPath, "INBOX");
+	});
+
+	it("refuses the move, and touches nothing, when the placement never settles", async () => {
+		const { service, patches, events, rows } = buildWorld([movingRow()]);
+
+		await assert.rejects(
+			() => service.moveMessage(ACCOUNT_CONFIG, MOVING_ID, INBOX, ACCOUNT),
+			(error: unknown) =>
+				error instanceof MessagePlacementUnsettledError &&
+				error.statusCode === 409 &&
+				error.publicApiError?.code === "message_placement_unsettled" &&
+				error.publicApiError?.details?.messageId === MOVING_ID &&
+				error.publicApiError?.details?.accountId === ACCOUNT &&
+				error.publicApiError?.details?.reason === "in_flight",
+		);
+
+		assert.deepEqual(events, [], "nothing was enqueued");
+		assert.deepEqual(patches, [], "and no local write was made");
+		assert.equal(rows.get(MOVING_ID)?.mailboxId, ARCHIVE);
+		assert.equal(rows.get(MOVING_ID)?.uid, INBOX_UID);
+	});
+
+	it("never answers the same-mailbox skip from a folder the message has not reached", async () => {
+		// The skip compares the row's `mailboxId` against the destination. An
+		// in-flight move has already written that folder optimistically, so the
+		// comparison would report the message home and return a silent success
+		// for a move the server has not made.
+		const { service, events } = buildWorld([movingRow()]);
+
+		await assert.rejects(
+			() => service.moveMessage(ACCOUNT_CONFIG, MOVING_ID, ARCHIVE, ACCOUNT),
+			MessagePlacementUnsettledError,
+		);
+
+		assert.deepEqual(events, []);
+	});
+
+	it("moves no part of a batch when one row is in flight", async () => {
+		// All-or-nothing: the settled row is movable on its own and a per-row
+		// gate would have moved it before reaching the refusal.
+		const { service, patches, events } = buildWorld([
+			settledRow(),
+			movingRow(),
+		]);
+
+		await assert.rejects(
+			() =>
+				service.moveMessages(
+					ACCOUNT_CONFIG,
+					[SETTLED_ID, MOVING_ID],
+					ARCHIVE,
+					ACCOUNT,
+				),
+			MessagePlacementUnsettledError,
+		);
+
+		assert.deepEqual(
+			events,
+			[],
+			"the settled row was not moved alongside the refusal",
+		);
+		assert.deepEqual(patches, []);
+	});
+
+	it("moves the whole batch once the in-flight row settles", async () => {
+		const { service, events, settle } = buildWorld([settledRow(), movingRow()]);
+
+		setTimeout(() => settle(MOVING_ID), 30);
+		await service.moveMessages(
+			ACCOUNT_CONFIG,
+			[SETTLED_ID, MOVING_ID],
+			INBOX,
+			ACCOUNT,
+		);
+
+		assert.deepEqual(
+			events.map((event) => [event.messageId, event.uid]),
+			[[MOVING_ID, ARCHIVE_UID]],
+			"the settled row was already in INBOX and skipped; the moved row went with the confirmed uid",
+		);
+	});
+
+	it("waits one row's ceiling for a batch, not one per row", async () => {
+		const rows = [movingRow(), movingRow(), movingRow()].map((row, index) => ({
+			...row,
+			messageId: `${MOVING_ID}-${index}`,
+		}));
+		const { service } = buildWorld(rows);
+
+		const startedAt = Date.now();
+		await assert.rejects(
+			() =>
+				service.moveMessages(
+					ACCOUNT_CONFIG,
+					rows.map((row) => row.messageId),
+					INBOX,
+					ACCOUNT,
+				),
+			MessagePlacementUnsettledError,
+		);
+
+		assert.ok(
+			Date.now() - startedAt < 500,
+			"three rows refused within one 200ms ceiling, not three",
+		);
+	});
+});
+
+describe("the move gate refuses only a uid that names somebody else (#665)", () => {
+	it("moves a freshly copied row rather than waiting on it", async () => {
+		// A copy is `moving` with no server-side uid yet. That uid is not ready,
+		// which is not the same as naming another folder's message.
+		const { service, events } = buildWorld([freshCopyRow()]);
+
+		const startedAt = Date.now();
+		await service.moveMessage(ACCOUNT_CONFIG, COPY_ID, INBOX, ACCOUNT);
+
+		assert.equal(events.length, 1);
+		assert.equal(events[0].type, "MESSAGE_MOVE");
+		assert.ok(Date.now() - startedAt < 100, "and never entered the wait");
+	});
+
+	it("refuses a row stranded by a move that gave up, without spending the ceiling", async () => {
+		// `syncStatus: failed` with `status: moving` is what every handler's
+		// give-up path leaves behind, and only `updateUid` clears it. The pair is
+		// still a lie, so the move is still refused — under a reason whose remedy
+		// is a resync, and without a wait that could never succeed.
+		const { service, events } = buildWorld([strandedRow()]);
+
+		const startedAt = Date.now();
+		await assert.rejects(
+			() => service.moveMessage(ACCOUNT_CONFIG, STRANDED_ID, INBOX, ACCOUNT),
+			(error: unknown) =>
+				error instanceof MessagePlacementUnsettledError &&
+				error.publicApiError?.details?.reason === "unverified",
+		);
+
+		assert.deepEqual(events, []);
+		assert.ok(Date.now() - startedAt < 100, "refused without waiting");
+	});
+});

package/src/message-move.ts

@@ -34,6 +34,7 @@ import {
 } from "@remit/domain-enums";
 import { createQueueProducer } from "@remit/sqs-client/producer";
 import {
+	bindsForeignUid,
 	type PlacementBinding,
 	placementBindingOf,
 	waitForPlacementToSettle,
@@ -521,6 +522,12 @@ export class MessageMoveService {
 	/**
 	 * Move a message to another mailbox.
 	 *
+	 * Waits, never reconciles (imap-mutations R2): the folder and uid go to the
+	 * server as one pair, and once the worker has moved the destination's own
+	 * message at that uid there is no reference left to repair. The person is
+	 * looking at the result, so blocking for the sub-second a move takes is the
+	 * cheap half; on timeout the move refuses ahead of any local write.
+	 *
 	 * @param messageId - Message to move
 	 * @param destinationMailboxId - Destination mailbox ID
 	 * @param accountId - Account ID
@@ -531,13 +538,32 @@ export class MessageMoveService {
 		destinationMailboxId: string,
 		accountId: string,
 	): Promise<void> => {
-		const message = await this.messageService.get(messageId);
+		await this.moveSettledMessage(
+			accountConfigId,
+			await this.settledPlacement(
+				await this.messageService.get(messageId),
+				accountId,
+			),
+			destinationMailboxId,
+			accountId,
+		);
+	};
+
+	private moveSettledMessage = async (
+		accountConfigId: string,
+		message: MessageItem,
+		destinationMailboxId: string,
+		accountId: string,
+	): Promise<void> => {
+		const messageId = message.messageId;
 
 		// IMAP has no same-mailbox MOVE: the server copies the message, expunges
 		// the original and hands back a fresh UID, so a request that asks for the
 		// mailbox the message is already in destroys its identity to reach the
 		// state it was already in. The requested end state holds, so there is
-		// nothing to record as pending and nothing to enqueue.
+		// nothing to record as pending and nothing to enqueue. The row is settled
+		// by the time this compares, so the folder it names is one the message has
+		// actually reached rather than one an in-flight move wrote optimistically.
 		if (message.mailboxId === destinationMailboxId) {
 			this.log.info(
 				{ messageId, mailboxId: destinationMailboxId },
@@ -633,10 +659,18 @@ export class MessageMoveService {
 		destinationMailboxId: string,
 		accountId: string,
 	): Promise<void> => {
-		for (const messageId of messageIds) {
-			await this.moveMessage(
+		// Every row is settled before the first move is written, so the batch's
+		// wait is one row's ceiling rather than the sum across it, and a refusal
+		// lands before any part of the batch has committed.
+		const sources = await this.settledPlacements(
+			await this.messageService.get(messageIds),
+			accountId,
+		);
+
+		for (const source of sources) {
+			await this.moveSettledMessage(
 				accountConfigId,
-				messageId,
+				source,
 				destinationMailboxId,
 				accountId,
 			);
@@ -884,10 +918,22 @@ export class MessageMoveService {
 			trashMailbox.mailboxId,
 		);
 
-		const messages = await this.messageService.listAllByMailbox(
+		const rows = await this.messageService.listAllByMailbox(
 			trashMailbox.mailboxId,
 		);
 
+		// Reconciles, never waits (imap-mutations R2). A row whose move into
+		// Trash has not settled names this folder while still carrying the SOURCE
+		// folder's uid, and marking it `deleting` overwrites the only marker that
+		// says so: its own MESSAGE_MOVE then reads the row as settled and returns
+		// without moving anything, and the worker's expunge binds that borrowed
+		// uid against whatever Trash really holds at it. Left as it stands, that
+		// move runs ahead of this expunge in the account's FIFO group and settles
+		// the row, so the message is in Trash by the time the sweep reaches it and
+		// goes with the rest of this same press — only the count below is one
+		// short of what the sweep ends up removing.
+		const messages = rows.filter((message) => !bindsForeignUid(message));
+
 		// Mark all as deleting locally
 		for (const message of messages) {
 			await this.messageService.update(message.messageId, {

package/src/placement-settled.test.ts

@@ -2,7 +2,7 @@ import assert from "node:assert/strict";
 import { describe, test } from "node:test";
 import type { MessageItem } from "@remit/data-ports";
 import { MessageStatus, MessageSyncStatus } from "@remit/domain-enums";
-import { placementBindingOf } from "./placement-settled.js";
+import { carriesForeignUid, placementBindingOf } from "./placement-settled.js";
 
 /**
  * Pins `placementBindingOf` directly. It is the guard #1098/#1143 depend on and
@@ -70,3 +70,48 @@ describe("placementBindingOf", () => {
 		);
 	});
 });
+
+/**
+ * The same question with the `status` gate off, for callers that resolve a uid
+ * off a row some other operation may have re-marked on its way past (#1217).
+ */
+describe("carriesForeignUid", () => {
+	test("holds whatever an operation has since written to `status`", () => {
+		for (const status of [
+			MessageStatus.moving,
+			MessageStatus.deleting,
+			MessageStatus.active,
+		]) {
+			assert.equal(carriesForeignUid(row({ status })), true, status);
+		}
+	});
+
+	test("is false once `updateUid` settles the move", () => {
+		// The settle writes the destination's own uid and drops `originalUid` in
+		// the same statement, so a destination counter that hands back the
+		// source's number cannot leave the row reading foreign forever.
+		assert.equal(
+			carriesForeignUid(
+				row({
+					status: MessageStatus.active,
+					syncStatus: MessageSyncStatus.synced,
+					originalUid: undefined,
+				}),
+			),
+			false,
+		);
+	});
+
+	test("is false for a row that was never moved", () => {
+		assert.equal(
+			carriesForeignUid(
+				row({ originalUid: undefined, originalMailboxId: undefined }),
+			),
+			false,
+		);
+	});
+
+	test("is false once a restore points the row back at that folder", () => {
+		assert.equal(carriesForeignUid(row({ mailboxId: "mbx-src" })), false);
+	});
+});

package/src/placement-settled.ts

@@ -29,19 +29,33 @@ export const isPlacementUnsettled = (
  * never moved, so its uid names nothing but itself — a freshly copied row is
  * `moving` with `uid: 0` until COPYUID lands, which is a uid that is not ready,
  * not a uid that names somebody else's message.
+ *
+ * Answered without reference to `status`, because `status` is not what clears
+ * it: `updateUid` does, dropping `originalUid` in the same statement that
+ * writes the destination's own, and a restore does by pointing `mailboxId`
+ * back at `originalMailboxId`. An operation that rewrites `status` on its way
+ * past — Empty Trash marking a whole folder `deleting` — leaves the pair
+ * untouched, so anything that resolves a uid off a row it did not settle
+ * itself asks this rather than the binding below (issue #1217).
  */
-export const bindsForeignUid = (
+export const carriesForeignUid = (
 	message: Pick<
 		MessageItem,
-		"status" | "mailboxId" | "uid" | "originalMailboxId" | "originalUid"
+		"mailboxId" | "uid" | "originalMailboxId" | "originalUid"
 	>,
 ): boolean =>
-	isPlacementUnsettled(message) &&
 	message.originalUid !== undefined &&
 	message.originalUid === message.uid &&
 	message.originalMailboxId !== undefined &&
 	message.originalMailboxId !== message.mailboxId;
 
+export const bindsForeignUid = (
+	message: Pick<
+		MessageItem,
+		"status" | "mailboxId" | "uid" | "originalMailboxId" | "originalUid"
+	>,
+): boolean => isPlacementUnsettled(message) && carriesForeignUid(message);
+
 /**
  * `in_flight` — a mover is still working on the row, so waiting resolves it.
  * `abandoned` — the last attempt failed (`syncStatus: failed`) and the row is

package/src/spam-report.test.ts

@@ -10,6 +10,7 @@ import type {
 	IMessageRepository,
 	IThreadMessageRepository,
 } from "@remit/data-ports";
+import { MessagePlacementUnsettledError } from "@remit/data-ports/errors";
 import { deriveAddressId } from "@remit/data-ports/id";
 import { AddressRole } from "@remit/domain-enums";
 import { FlagPushService } from "./flag-push.js";
@@ -279,6 +280,8 @@ const buildWorld = (
 		threadMessageService,
 		addressService,
 		sqsQueueUrl: "http://localhost:9324/000000000000/message-mgmt",
+		moveSettleTimeoutMs: 30,
+		moveSettlePollMs: 5,
 	});
 	(
 		messageMoveService as unknown as {
@@ -394,13 +397,14 @@ describe("SpamReportService.reportSpam", () => {
 	});
 
 	it("is idempotent under a double press", async () => {
-		const { service, sent } = buildWorld();
+		const { service, messages, sent } = buildWorld();
 
 		await service.reportSpam({
 			accountConfigId: ACCOUNT_CONFIG,
 			accountId: ACCOUNT,
 			messageId: MESSAGE_ID,
 		});
+		settleMove(messages);
 		await service.reportSpam({
 			accountConfigId: ACCOUNT_CONFIG,
 			accountId: ACCOUNT,
@@ -409,6 +413,37 @@ describe("SpamReportService.reportSpam", () => {
 
 		// The second call's move is a no-op: MessageMoveService.moveMessage sees
 		// the local mailboxId already equals Junk and skips without enqueueing.
+		// The skip is read off the settled row — a press inside the first move's
+		// flight waits for it rather than answering from the folder that move
+		// wrote optimistically (#665).
+		assert.equal(moveEvents(sent).length, 1);
+	});
+
+	it("refuses a second press inside the first move's flight", async () => {
+		// No settleMove between the presses: the row names Junk while still
+		// carrying the inbox's uid, so acting on it would address whatever Junk
+		// holds at that uid — somebody else's message (#665).
+		const { service, sent } = buildWorld();
+
+		await service.reportSpam({
+			accountConfigId: ACCOUNT_CONFIG,
+			accountId: ACCOUNT,
+			messageId: MESSAGE_ID,
+		});
+
+		await assert.rejects(
+			() =>
+				service.reportSpam({
+					accountConfigId: ACCOUNT_CONFIG,
+					accountId: ACCOUNT,
+					messageId: MESSAGE_ID,
+				}),
+			(error: unknown) =>
+				error instanceof MessagePlacementUnsettledError &&
+				error.statusCode === 409 &&
+				error.publicApiError?.details?.reason === "in_flight",
+		);
+
 		assert.equal(moveEvents(sent).length, 1);
 	});