@remit/mailbox-service 0.0.91 → 0.0.93

package/src/placement-move.ts

@@ -7,7 +7,11 @@ import type {
 	IMessageRepository,
 	IThreadMessageRepository,
 } from "@remit/data-ports";
-import { MessageStatus, MessageSyncStatus } from "@remit/domain-enums";
+import {
+	MessageMutation,
+	MessageStatus,
+	MessageSyncStatus,
+} from "@remit/domain-enums";
 import { createQueueProducer } from "@remit/sqs-client/producer";
 import {
 	isPlacementUnsettled,
@@ -163,11 +167,30 @@ export class PlacementMoveService {
 		// to the settled row (docs/architecture/imap-mutations.md R2). Blocking is
 		// cheap — a move settles in well under a second — and on timeout the
 		// dependent write is simply not made.
+		// A delete in flight is not a move to wait out: the user has asked for the
+		// message to go, and a classification filing behind it has nothing left to
+		// file. Skipping is the answer, and it is a clean one — throwing would
+		// burn the ceiling and then drive an ordinary sequence toward the DLQ.
+		if (message.status === MessageStatus.deleting) {
+			this.log.info(
+				{ messageId, accountId, destinationMailboxId },
+				"Placement move not applied: this message is being deleted",
+			);
+			return;
+		}
+
 		if (isPlacementUnsettled(message)) {
 			message = await waitForPlacementToSettle(this.messageService, messageId, {
 				timeoutMs: this.moveSettleTimeoutMs,
 				pollMs: this.moveSettlePollMs,
 			});
+			if (message.status === MessageStatus.deleting) {
+				this.log.info(
+					{ messageId, accountId, destinationMailboxId },
+					"Placement move not applied: a delete claimed this message while the earlier move settled",
+				);
+				return;
+			}
 			if (isPlacementUnsettled(message)) {
 				throw new Error(
 					`Placement move for ${messageId} to ${destinationMailboxId} not applied: an earlier move has not settled`,
@@ -195,20 +218,53 @@ export class PlacementMoveService {
 			destinationMailboxId,
 		});
 
+		// The Message row first, the listing row after it — the order the user
+		// move and the delete already use. A transition off the row the wait above
+		// settled on (imap-mutations R3): this lane rides a standard queue that
+		// the account's FIFO group does not order, so a user's own move or delete
+		// can claim the row between that read and this write, and writing anyway
+		// would stamp Remit's classification over a folder the user just chose,
+		// with the old uid attached.
+		//
+		// Writing the listing row first meant a loser left the two disagreeing —
+		// the listing showing the classification folder while the Message row sat
+		// where the winner put it — and nothing routine reconciles that.
+		//
+		// The marker goes with the loss. It is the record that a move owes IMAP a
+		// push, and this move is not happening, so leaving it would send the
+		// reconciler after a placement nobody wrote and would inflate the folder
+		// counts it predicts.
+		const filed = await this.messageService.transitionPlacement(
+			messageId,
+			{
+				status: MessageStatus.active,
+				mailboxId: sourceMailboxId,
+				uid: message.uid,
+			},
+			{
+				mailboxId: destinationMailboxId,
+				status: MessageStatus.moving,
+				syncStatus: MessageSyncStatus.pending,
+				abandonedMutation: MessageMutation.none,
+				originalMailboxId: sourceMailboxId,
+				originalUid: message.uid,
+			},
+		);
+		if (!filed) {
+			await this.markerService.delete(messageId);
+			this.log.info(
+				{ messageId, accountId, sourceMailboxId, destinationMailboxId },
+				"Placement move not applied: something else claimed this message's placement first",
+			);
+			return;
+		}
+
 		await this.updateThreadMessageMailbox(
 			accountConfigId,
 			messageId,
 			destinationMailboxId,
 		);
 
-		await this.messageService.updateForMove(messageId, {
-			mailboxId: destinationMailboxId,
-			status: MessageStatus.moving,
-			syncStatus: MessageSyncStatus.pending,
-			originalMailboxId: sourceMailboxId,
-			originalUid: message.uid,
-		});
-
 		await this.addressService.reconcileJunkOnlyForMessage(
 			messageId,
 			await this.mailboxSpecialUseService.resolveJunkRolesForConfig(

package/src/placement-settled.test.ts

@@ -9,10 +9,10 @@ import { carriesForeignUid, placementBindingOf } from "./placement-settled.js";
  * only end-to-end specs covered it, so a change made for the client's benefit
  * could have moved it without anything going red.
  *
- * Note what these cases say about `syncStatus: failed`: it answers `abandoned`
- * here for a row that may well be mid-retry. That is correct for a guard whose
- * consequence is a temporary refusal, and it is exactly why no user-facing
- * statement may be derived from that field alone.
+ * Note what these cases say about `syncStatus`: `failed` is a transient attempt
+ * with a redelivery behind it, so a foreign-uid row carrying it is `in_flight`
+ * and gets the settle ceiling. Only `abandoned` — the give-up value of the
+ * placement state model (imap-mutations R3) — refuses outright.
  */
 const row = (over: Partial<MessageItem>): MessageItem =>
 	({
@@ -38,10 +38,40 @@ describe("placementBindingOf", () => {
 		assert.equal(placementBindingOf(row({})), "in_flight");
 	});
 
-	test("`failed` on a foreign-uid row is refused as abandoned", () => {
+	/**
+	 * A give-up cannot reach this pair. `abandoned` is written only alongside
+	 * `active` or `deleted`, on a row already put back on a placement the server
+	 * confirmed, so the binding it produces is `consistent` — there is no
+	 * give-up member here to return, and no dependent mutation is refused on
+	 * account of one.
+	 */
+	test("a give-up never presents as a foreign-uid row at all", () => {
+		assert.equal(
+			placementBindingOf(
+				row({
+					status: MessageStatus.active,
+					syncStatus: MessageSyncStatus.abandoned,
+					mailboxId: "mbx-src",
+				}),
+			),
+			"consistent",
+		);
+	});
+
+	test("`failed` on a foreign-uid row is mid-retry, so it waits rather than refusing", () => {
 		assert.equal(
 			placementBindingOf(row({ syncStatus: MessageSyncStatus.failed })),
-			"abandoned",
+			"in_flight",
+		);
+	});
+
+	// R3's state table calls `deleting` in flight exactly as `moving` is: a
+	// delete points the row at Trash with the source's uid, so a dependent
+	// mutation reading it resolves the same mismatched pair.
+	test("a delete in flight is unsettled, not settled", () => {
+		assert.equal(
+			placementBindingOf(row({ status: MessageStatus.deleting })),
+			"in_flight",
 		);
 	});
 

package/src/placement-settled.ts

@@ -1,5 +1,5 @@
 import type { MessageItem } from "@remit/data-ports";
-import { MessageStatus, MessageSyncStatus } from "@remit/domain-enums";
+import { MessageStatus } from "@remit/domain-enums";
 
 /**
  * Whether the message row's placement is still an unconfirmed local write
@@ -12,18 +12,26 @@ import { MessageStatus, MessageSyncStatus } from "@remit/domain-enums";
  *
  * `syncStatus` is not the signal. An ordinary freshly-synced inbound row is
  * `pending` forever (nothing on the inbound path promotes it), so keying off it
- * defers every outbound mutation in the product. `status` is set to `moving`
- * only by an actual move and cleared only once that move settles.
+ * defers every outbound mutation in the product. `status` is what an actual
+ * mutation writes and what settling clears.
+ *
+ * Both in-flight states count, per the R3 state table: a delete points the row
+ * at Trash with the source's uid exactly as a move points it at the
+ * destination, so a dependent mutation that reads a `deleting` row resolves the
+ * same mismatched pair. Reading `moving` alone let a move enqueued behind a
+ * delete bind to the row mid-delete and be dropped when the delete settled.
  */
 export const isPlacementUnsettled = (
 	message: Pick<MessageItem, "status">,
-): boolean => message.status === MessageStatus.moving;
+): boolean =>
+	message.status === MessageStatus.moving ||
+	message.status === MessageStatus.deleting;
 
 /**
  * Whether the row's `uid` belongs to a folder other than the one `mailboxId`
  * names — the state that makes the pair a lie rather than merely incomplete.
  *
- * `updateForMove` is the only writer of this shape: it points the row at the
+ * The optimistic half of a move is the only writer of this shape: it points the row at the
  * destination and records the pre-move pair, leaving `uid` untouched until the
  * server confirms and `updateUid` replaces it. A row with no `originalUid` was
  * never moved, so its uid names nothing but itself — a freshly copied row is
@@ -57,32 +65,27 @@ export const bindsForeignUid = (
 ): boolean => isPlacementUnsettled(message) && carriesForeignUid(message);
 
 /**
- * `in_flight` — a mover is still working on the row, so waiting resolves it.
- * `abandoned` — the last attempt failed (`syncStatus: failed`) and the row is
- * still `moving`: either a redelivery is pending, or the record dead-lettered
- * and nothing is coming for it. The two are indistinguishable from the row
- * (`message-settlement.ts`), and the pair is a lie either way, so neither is
- * worth spending the settle ceiling on. A mover that exhausts its budget
- * settles the row against IMAP instead of leaving this state behind (#1005).
+ * `in_flight` — a mutation is still working on the row, so waiting resolves it.
+ * That includes a row mid-retry: `message-move`, `message-delete` and
+ * `message-copy` write `syncStatus: failed` on an ordinary transient attempt
+ * and re-throw for redelivery, so a failed attempt is a mutation about to
+ * succeed and the settle ceiling is exactly what it is for (imap-mutations R3).
+ *
+ * There is no give-up member, because a give-up cannot reach here: `abandoned`
+ * is written only alongside `status: active` (a hand-back) or `deleted` (a copy
+ * that never existed), and the row it leaves names a placement the server
+ * confirmed — so it binds `consistent` and no dependent mutation is refused on
+ * account of it. A mutation that exhausts its budget settles the row against
+ * IMAP rather than leaving a mismatched pair behind (#1005).
  */
-export type PlacementBinding = "consistent" | "in_flight" | "abandoned";
+export type PlacementBinding = "consistent" | "in_flight";
 
 export const placementBindingOf = (
 	message: Pick<
 		MessageItem,
-		| "status"
-		| "syncStatus"
-		| "mailboxId"
-		| "uid"
-		| "originalMailboxId"
-		| "originalUid"
+		"status" | "mailboxId" | "uid" | "originalMailboxId" | "originalUid"
 	>,
-): PlacementBinding => {
-	if (!bindsForeignUid(message)) return "consistent";
-	return message.syncStatus === MessageSyncStatus.failed
-		? "abandoned"
-		: "in_flight";
-};
+): PlacementBinding => (bindsForeignUid(message) ? "in_flight" : "consistent");
 
 export interface PlacementSettleOptions {
 	timeoutMs: number;