@remit/mailbox-service 0.0.97 → 0.0.99

package/src/body-sync.ts

@@ -166,6 +166,7 @@ const extractSnippet = (parsed: ParsedMail): string =>
 		SNIPPET_LENGTH,
 	);
 
+/**
 /**
  * RFC 034 Decision 3.1: `Message.category` is written once and never mutated
  * after — RFC 030's message-list GSI sort key depends on it never churning.
@@ -183,30 +184,20 @@ const hasDecidedCategory = (
 ): boolean =>
 	category !== undefined && category !== MessageCategory.uncategorized;
 
-/**
- * Issue #383 (RFC 039 Non-goals): whether {@link BodySyncService.computePlacement}
- * has already produced a verdict for this message — moved, left in place, or
- * archived, confident or unsure alike. Absence means placement has genuinely
- * never been evaluated. The same two re-entrant paths `hasDecidedCategory`
- * guards (`fetchAndGetBody`'s `NoSuchKey` fallback, `syncBodies(..., force:
- * true)`) also re-enter `computePlacement`; without this guard a message a
- * user manually rescued (never touched by Remit, so `movedByRemit` never
- * recorded anything) can be silently re-evaluated and moved right back.
- */
-const hasDecidedPlacement = (placementDecidedAt: number | undefined): boolean =>
-	placementDecidedAt !== undefined;
-
 /**
  * Issue #499: whether a completed body-sync pass has already stored this
  * message's body. `bodyStorageKey` is written last, once every derivation of
- * that pass has run, so its presence means that pass finished. The same two
- * re-entrant paths `hasDecidedCategory` and `hasDecidedPlacement` guard
- * (`fetchAndGetBody`'s `NoSuchKey` fallback, `syncBodies(..., force: true)`)
- * are the ones that reach the derivations again with it already set.
+ * that pass has run, so its presence means that pass finished.
  *
  * Key presence, and nothing more. What the classifier decided is
  * `Message.category`; whether it ran at all is `Message.classificationState`.
  * Neither is inferred from here — the field this reads is the storage fact.
+ *
+ * The re-fetch paths that re-enter with the key already set (`syncBodies(...,
+ * force: true)` and `fetchAndGetBody`'s `NoSuchKey` fallback) are re-stores
+ * that skip the derivations entirely (issue #1011), so this guard is what
+ * keeps a first store that lands on an already-stored row from re-deciding
+ * anything.
  */
 const hasStoredBody = (bodyStorageKey: string | undefined): boolean =>
 	Boolean(bodyStorageKey);
@@ -217,9 +208,9 @@ const hasStoredBody = (bodyStorageKey: string | undefined): boolean =>
  * means "nothing confident to say":
  *
  * - `already-moved-by-remit` is {@link classifyPlacement}'s guard against
- *   re-deciding a settled placement, and auto-archive is a re-decision. The
- *   re-entrant paths `hasDecidedPlacement` names reach it on messages Remit
- *   itself placed, or that a user moved back afterwards.
+ *   re-deciding a settled placement, and auto-archive is a re-decision. It
+ *   fires on messages Remit itself placed, or that a user moved back
+ *   afterwards.
  * - A message already in Junk gets an unsure `leave` whatever the sender's
  *   `blocked` flag says, since the demote branch only fires outside Junk.
  *   Moving mail out of Junk is a rescue, which this file reserves for a
@@ -397,6 +388,12 @@ export class BodySyncService {
 		// messageId so we can match FETCH rows back and re-enqueue any UID the
 		// server never returns.
 		const pending = new Map<number, string>();
+		// Message IDs in this batch whose row already carried `bodyStorageKey`
+		// when `force` re-added them to `pending`: a forced re-fetch of an
+		// already-stored body is a re-store (issue #1011) — bytes only, no
+		// decision re-run. A message with no stored body inside a forced batch
+		// is still a first store and takes the full decision pass.
+		const reStoredMessageIds = new Set<string>();
 
 		// One read per round, not per message (issue #72). The list is small by
 		// design and almost always empty, so a lookup per message would put a
@@ -438,6 +435,7 @@ export class BodySyncService {
 				skippedCount++;
 				continue;
 			}
+			if (message.bodyStorageKey) reStoredMessageIds.add(messageId);
 			pending.set(message.uid, messageId);
 		}
 
@@ -468,6 +466,7 @@ export class BodySyncService {
 						accountId,
 						accountConfigId,
 						source,
+						reStoredMessageIds.has(messageId),
 					);
 				} catch (error) {
 					// A per-message store failure (e.g. the parsed-body S3 write) is a
@@ -644,12 +643,18 @@ export class BodySyncService {
 	 * cache, per-part objects). The S3 upload never sees a whole-body concat —
 	 * the storage service streams it — but mailparser still needs the full bytes,
 	 * so we collect them in parallel. Later issues move parsing off the hot path.
+	 *
+	 * `isReStore` marks a re-fetch of a message whose row already carried
+	 * `bodyStorageKey` (the `force` re-arm in {@link syncBodies}): the
+	 * post-store steps then re-materialize the body artifacts without
+	 * re-running any decision (issue #1011).
 	 */
 	private async storeStreamedBody(
 		messageId: string,
 		accountId: string,
 		accountConfigId: string,
 		source: Readable,
+		isReStore: boolean,
 	): Promise<void> {
 		const toStorage = new PassThrough();
 		const chunks: Buffer[] = [];
@@ -693,6 +698,7 @@ export class BodySyncService {
 			{
 				uri: ref.uri,
 			},
+			isReStore,
 		);
 	}
 
@@ -724,6 +730,16 @@ export class BodySyncService {
 		accountConfigId: string,
 		body: Buffer,
 		bodyRef: { uri: string },
+		/**
+		 * Whether this call is a re-store of an already-classified message
+		 * rather than a first store. The two re-entrant paths (`force: true`
+		 * in `syncBodies`, and `fetchAndGetBody`'s `NoSuchKey` IMAP fallback) are
+		 * both body-only re-fetches: a body re-sync fetches and stores bytes and
+		 * runs no decision logic (issue #1011). When `isReStore` is true the
+		 * placement/filter/category machinery is skipped entirely and the
+		 * message's existing category is carried forward unchanged.
+		 */
+		isReStore: boolean,
 	): Promise<ParsedMail> {
 		// The one operation on this path that can fail because of how the message
 		// is built. Its own try block lives in `parseMessageBody`, so this frame —
@@ -733,6 +749,43 @@ export class BodySyncService {
 		// feed happens later, alongside the Message write (see below), once the
 		// write-once category is decided.
 		const parsed = await parseMessageBody(body);
+
+		// Body-only re-fetch (issue #1011): the decision pass already ran when
+		// this message's body first landed, so a re-store re-materializes only
+		// the body-derived artifacts — parsed cache, body parts, the storage
+		// key — and re-decides nothing: no classification, placement, filters,
+		// labels, read state, and no second engagement-counter increment.
+		// Skipping the decisions here is what lets the write-once fields stay
+		// safe without per-derivation re-entrancy guards.
+		if (isReStore) {
+			// Same ordering rule as the first-store path below: the parsed-body
+			// cache must be durable before `bodyStorageKey` — the skip-guard
+			// signal — is written, so a failure here requeues the message and
+			// the retry genuinely re-attempts the artifact writes.
+			await this.storeParsedBodyCache(
+				accountConfigId,
+				accountId,
+				messageId,
+				parsed,
+			);
+			if (!isBodyPartDeferralEnabled()) {
+				await this.storeBodyPartContents(
+					accountConfigId,
+					accountId,
+					messageId,
+					parsed,
+				);
+			}
+			await this.messageService.update(messageId, {
+				bodyStorageKey: bodyRef.uri,
+			});
+			this.log.info(
+				{ messageId, storageKey: bodyRef.uri },
+				"Body re-stored without re-running decisions",
+			);
+			return parsed;
+		}
+
 		const snippet = extractSnippet(parsed);
 		const listId = extractListId(parsed);
 
@@ -892,20 +945,19 @@ export class BodySyncService {
 		// once the parsed cache AND the move (when any) are.
 		//
 		// `category` is RFC 034 D3.1's write-once field (RFC 030's message-list
-		// GSI sort key depends on it never churning). This step re-enters on an
-		// already-classified message through two shipped paths — the `NoSuchKey`
-		// fallback in `fetchAndGetBody` and `syncBodies(..., force: true)` — so a
-		// real, previously-decided category is carried forward unchanged instead
-		// of the just-recomputed one.
-		// This also protects a `flags.category` override (issue #299): without
-		// this guard a re-entrant pass would let a *later* override silently
-		// rewrite a category already decided on an earlier message, which is
-		// exactly the churn RFC 030's GSI-safety argument forbids.
+		// GSI sort key depends on it never churning). The re-entrant re-store
+		// paths (issue #1011) return before this write; the carry-forward keeps
+		// the field write-once even when a first store lands on a row that
+		// already carries a real category — a previously-decided category wins
+		// over the just-recomputed one. It likewise protects a `flags.category`
+		// override (issue #299): recomputing would let a *later* override silently
+		// rewrite a category already decided, which is exactly the churn RFC
+		// 030's GSI-safety argument forbids.
 		//
-		// `resolved.placementDecidedAt` (issue #383) guards the same two
-		// re-entrant paths for placement: `computePlacement` already declined to
-		// recompute a verdict once this field is set, so it is only ever present
-		// here on the pass that first decided it.
+		// `resolved.placementDecidedAt` (issue #383) is only ever present on
+		// the pass that first decided it: the re-store paths skip placement
+		// entirely (issue #1011), so `computePlacement` is reached only on a
+		// first store.
 		const finalCategory = hasDecidedCategory(existingMessage.category)
 			? existingMessage.category
 			: classification.category;
@@ -1026,13 +1078,17 @@ export class BodySyncService {
 
 			// Same shared step the sync path (storeStreamedBody) runs — issue
 			// #1271 unified the two body paths so classification/placement no
-			// longer depends on which one fetched the body first.
+			// longer depends on which one fetched the body first. A store from
+			// here is a re-store exactly when the row already claimed a stored
+			// body — the NoSuchKey fallback above; a row with no bodyStorageKey is
+			// a genuine first store and takes the full decision pass.
 			parsed = await this.applyPostStoreSteps(
 				messageId,
 				accountId,
 				accountConfigId,
 				body,
 				{ uri: ref.uri },
+				message.bodyStorageKey != null,
 			);
 		} else {
 			parsed = await simpleParser(body);
@@ -1492,14 +1548,12 @@ export class BodySyncService {
 
 		const message = await this.messageService.get(messageId);
 
-		// Issue #383: placement is meant to run once per message (RFC 039
-		// Non-goals). Once a verdict has EVER been decided for this message —
-		// moved, left in place, or archived — a re-entrant pass (the `NoSuchKey`
-		// fallback in `fetchAndGetBody`, `syncBodies(..., force: true)`) must not
-		// recompute it: a message a user has since moved by hand (which never
-		// touches `movedByRemit`) would otherwise be silently re-evaluated
-		// against the same signals that placed it in the first place.
-		if (hasDecidedPlacement(message.placementDecidedAt)) return {};
+		// Issue #383 / #1011: placement still runs once per message (RFC 039
+		// Non-goals), but the once-per-message guarantee now comes from the
+		// caller rather than a guard here — the re-store paths
+		// (`fetchAndGetBody`'s `NoSuchKey` fallback, `syncBodies(..., force:
+		// true)`) skip the decision steps entirely, so only the pass that first
+		// stores a body ever reaches this method.
 
 		const junkMailbox =
 			await mailboxSpecialUseService.findJunkMailbox(accountId);

package/src/mailbox-delete-intent.test.ts

@@ -0,0 +1,246 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type { IMailboxRepository, MailboxItem } from "@remit/data-ports";
+import { MailboxSyncStatus } from "@remit/domain-enums";
+import { MailboxManagementService } from "./mailbox-management.js";
+import { MailboxQueueService } from "./mailbox-queue.js";
+import type { IImapConnection } from "./types.js";
+
+const row = (over: Partial<MailboxItem> = {}): MailboxItem =>
+	({
+		mailboxId: "mbx-1",
+		accountId: "acc-1",
+		fullPath: "Receipts",
+		hierarchyDelimiter: "/",
+		syncStatus: MailboxSyncStatus.synced,
+		...over,
+	}) as MailboxItem;
+
+const store = (rows: MailboxItem[]) => {
+	const byId = new Map(rows.map((r) => [r.mailboxId, { ...r }]));
+	const removed: string[] = [];
+
+	const repo: Pick<
+		IMailboxRepository,
+		"get" | "transition" | "findByPathPrefix" | "deleteMailboxWithMail"
+	> = {
+		get: (async (_accountId: string, mailboxId: string) => {
+			const found = byId.get(mailboxId as string);
+			if (!found) {
+				throw Object.assign(new Error(`Mailbox not found: ${mailboxId}`), {
+					name: "NotFoundError",
+				});
+			}
+			return found;
+		}) as IMailboxRepository["get"],
+		findByPathPrefix: async () => [],
+		transition: async (_accountId, mailboxId, intent) => {
+			const current = byId.get(mailboxId);
+			if (!current) return null;
+			if (!intent.from.includes(current.syncStatus)) return null;
+			const next = { ...current, syncStatus: intent.to } as MailboxItem;
+			byId.set(mailboxId, next);
+			return next;
+		},
+		deleteMailboxWithMail: async (_accountId, mailboxId) => {
+			removed.push(mailboxId);
+			byId.delete(mailboxId);
+		},
+	};
+
+	return { repo: repo as IMailboxRepository, byId, removed };
+};
+
+const queueOver = (repo: IMailboxRepository) => {
+	const sent: string[] = [];
+	const service = new MailboxQueueService({
+		mailboxService: repo,
+		sqsQueueUrl: "http://localhost:4566/000000000000/mailbox",
+	});
+	(
+		service as unknown as {
+			sqs: {
+				send: (command: { input: { MessageBody: string } }) => Promise<void>;
+			};
+		}
+	).sqs = {
+		send: async (command) => {
+			sent.push(command.input.MessageBody);
+		},
+	};
+	return { service, sent };
+};
+
+describe("MailboxQueueService.deleteMailbox — the recorded intent", () => {
+	it("records `deleting` and enqueues one DELETE", async () => {
+		const { repo, byId } = store([row()]);
+		const { service, sent } = queueOver(repo);
+
+		await service.deleteMailbox("mbx-1", "acc-1");
+
+		assert.equal(byId.get("mbx-1")?.syncStatus, MailboxSyncStatus.deleting);
+		assert.equal(sent.length, 1);
+		assert.equal(
+			(JSON.parse(sent[0]) as { path: string }).path,
+			"Receipts",
+			"the event names the path the server holds",
+		);
+	});
+
+	it("accepts a retry from a failed delete", async () => {
+		const { repo, byId } = store([
+			row({ syncStatus: MailboxSyncStatus.failed }),
+		]);
+		const { service, sent } = queueOver(repo);
+
+		await service.deleteMailbox("mbx-1", "acc-1");
+
+		assert.equal(byId.get("mbx-1")?.syncStatus, MailboxSyncStatus.deleting);
+		assert.equal(sent.length, 1);
+	});
+
+	it("gives the loser a 409 naming the delete already in flight", async () => {
+		const { repo } = store([row({ syncStatus: MailboxSyncStatus.deleting })]);
+		const { service, sent } = queueOver(repo);
+
+		await assert.rejects(
+			service.deleteMailbox("mbx-1", "acc-1"),
+			(error: unknown) =>
+				(error as { statusCode?: number }).statusCode === 409 &&
+				(error as Error).message ===
+					'A delete is already in progress for "Receipts".',
+		);
+		assert.equal(sent.length, 0, "the loser enqueues nothing");
+	});
+
+	it("gives the loser a 409 naming a rename in flight", async () => {
+		const { repo } = store([
+			row({
+				syncStatus: MailboxSyncStatus.pending,
+				pendingPath: "Bonnen",
+			}),
+		]);
+		const { service } = queueOver(repo);
+
+		await assert.rejects(
+			service.deleteMailbox("mbx-1", "acc-1"),
+			(error: unknown) =>
+				(error as Error).message === 'A rename is in progress for "Receipts".',
+		);
+	});
+});
+
+describe("MailboxManagementService.syncDelete — settling the intent", () => {
+	const deleting = () =>
+		store([row({ syncStatus: MailboxSyncStatus.deleting })]);
+
+	const connection = (calls: string[]): IImapConnection =>
+		({
+			deleteMailbox: async (path: string) => {
+				calls.push(path);
+				return { path };
+			},
+		}) as unknown as IImapConnection;
+
+	it("takes the folder's mail with it, not the row alone", async () => {
+		// Removing the row alone leaves every message and thread_message row keyed
+		// to a dead mailboxId — out of every reader, and still in the search index
+		// because nothing writes the `message.removed` outbox event (D8).
+		const { repo, removed, byId } = deleting();
+		const service = new MailboxManagementService(repo);
+		const calls: string[] = [];
+
+		const result = await service.syncDelete(
+			"acc-1",
+			"mbx-1",
+			"Receipts",
+			async () => connection(calls),
+		);
+
+		assert.equal(result.success, true);
+		assert.deepEqual(calls, ["Receipts"]);
+		assert.deepEqual(removed, ["mbx-1"]);
+		assert.equal(byId.has("mbx-1"), false);
+	});
+
+	it("issues no DELETE when the row is not deleting", async () => {
+		const { repo, removed } = store([row()]);
+		const service = new MailboxManagementService(repo);
+		const calls: string[] = [];
+
+		const result = await service.syncDelete(
+			"acc-1",
+			"mbx-1",
+			"Receipts",
+			async () => connection(calls),
+		);
+
+		assert.equal(result.success, true);
+		assert.deepEqual(calls, [], "the connection is never asked");
+		assert.deepEqual(removed, []);
+	});
+
+	it("resolves when the row is already gone", async () => {
+		const { repo } = store([]);
+		const service = new MailboxManagementService(repo);
+		const calls: string[] = [];
+
+		const result = await service.syncDelete(
+			"acc-1",
+			"mbx-1",
+			"Receipts",
+			async () => connection(calls),
+		);
+
+		assert.equal(result.success, true);
+		assert.deepEqual(calls, []);
+	});
+
+	it("resumes an interrupted removal on a redelivery", async () => {
+		// The row stays `deleting` until the final commit, so a redelivery
+		// re-enters, passes the guard and continues where it stopped.
+		const { repo, removed } = deleting();
+		const service = new MailboxManagementService(repo);
+		const calls: string[] = [];
+
+		await service.settleDelete("acc-1", "mbx-1");
+		const result = await service.syncDelete(
+			"acc-1",
+			"mbx-1",
+			"Receipts",
+			async () => connection(calls),
+		);
+
+		assert.equal(result.success, true);
+		assert.deepEqual(calls, [], "no second IMAP DELETE is issued");
+		assert.deepEqual(removed, ["mbx-1"]);
+	});
+});
+
+describe("MailboxManagementService.failDelete", () => {
+	it("marks the row failed, unwinding nothing", async () => {
+		// DELETE is all-or-nothing, so fullPath is still what the server holds,
+		// and no rename target is written — which is how the client tells a failed
+		// delete from a failed rename (T9).
+		const { repo, byId } = store([
+			row({ syncStatus: MailboxSyncStatus.deleting }),
+		]);
+		const service = new MailboxManagementService(repo);
+
+		await service.failDelete("acc-1", "mbx-1");
+
+		assert.equal(byId.get("mbx-1")?.syncStatus, MailboxSyncStatus.failed);
+		assert.equal(byId.get("mbx-1")?.fullPath, "Receipts");
+		assert.equal(byId.get("mbx-1")?.pendingPath, undefined);
+	});
+
+	it("raises a NotFoundError when the row is gone", async () => {
+		const { repo } = store([]);
+		const service = new MailboxManagementService(repo);
+
+		await assert.rejects(
+			service.failDelete("acc-1", "mbx-1"),
+			(error: unknown) => (error as Error).name === "NotFoundError",
+		);
+	});
+});

package/src/mailbox-management.ts

@@ -705,15 +705,103 @@ export class MailboxManagementService {
 		path: string,
 		getConnection: () => Promise<IImapConnection>,
 	): Promise<MailboxManagementSyncResult> => {
+		if (!(await this.deleteIntentStanding(accountId, mailboxId))) {
+			return { success: true };
+		}
+
 		const connection = await getConnection();
 
 		await connection.deleteMailbox(path);
 
-		this.log.info({ mailboxId, path }, "Deleted mailbox on IMAP server");
+		this.log.info(
+			{ accountId, mailboxId, intent: "delete", path },
+			"Deleted mailbox on IMAP server",
+		);
 
-		// Delete the mailbox entity from the local store
-		await this.mailboxService.delete(accountId, mailboxId);
+		await this.settleDelete(accountId, mailboxId);
 
 		return { success: true };
 	};
+
+	/**
+	 * Whether the delete this event was enqueued for is still the folder's live
+	 * intent (D10). Anything else resolves the job with no IMAP call — never a
+	 * throw, which would hold back every later job in the account's FIFO group
+	 * (#339).
+	 */
+	private deleteIntentStanding = async (
+		accountId: string,
+		mailboxId: string,
+	): Promise<boolean> => {
+		const row = await this.mailboxService
+			.get(accountId, mailboxId)
+			.catch((error: unknown) => {
+				if (isNotFoundError(error)) return undefined;
+				throw error;
+			});
+		if (row?.syncStatus === MailboxSyncStatus.deleting) return true;
+		this.log.info(
+			{
+				accountId,
+				mailboxId,
+				intent: "delete",
+				from: row?.syncStatus,
+				outcome: row ? "superseded" : "already-settled",
+			},
+			"Skipping MAILBOX_DELETE: the recorded intent has moved on",
+		);
+		return false;
+	};
+
+	/**
+	 * T8: the confirmed delete takes the folder's local mail with it (D8).
+	 * Removing the row alone leaves every `message` and `thread_message` row
+	 * keyed to a dead mailboxId — out of every reader, and still in the search
+	 * index, because nothing writes the `message.removed` outbox event.
+	 *
+	 * The removal is batched and the mailbox row goes last, so the row stays
+	 * `deleting` throughout and an SQS redelivery re-enters the handler, passes
+	 * the guard above, and resumes where it stopped.
+	 */
+	settleDelete = async (
+		accountId: string,
+		mailboxId: string,
+	): Promise<void> => {
+		await this.mailboxService.deleteMailboxWithMail(accountId, mailboxId);
+		this.log.info(
+			{
+				accountId,
+				mailboxId,
+				intent: "delete",
+				from: MailboxSyncStatus.deleting,
+				outcome: "settled",
+			},
+			"Removed folder and its mail",
+		);
+	};
+
+	/**
+	 * T9: the server refused the delete. Nothing is unwound — DELETE is
+	 * all-or-nothing, so `fullPath` is still what the server holds, and no rename
+	 * target is written, which is how the client tells a failed delete from a
+	 * failed rename.
+	 */
+	failDelete = async (accountId: string, mailboxId: string): Promise<void> => {
+		const failed = await this.mailboxService.transition(accountId, mailboxId, {
+			from: [MailboxSyncStatus.deleting],
+			to: MailboxSyncStatus.failed,
+		});
+		if (!failed) throw new NotFoundError(`Mailbox not found: ${mailboxId}`);
+		this.log.info(
+			{
+				accountId,
+				mailboxId,
+				intent: "delete",
+				from: MailboxSyncStatus.deleting,
+				to: MailboxSyncStatus.failed,
+				outcome: "refused",
+			},
+			"Recorded a refused delete",
+		);
+	};
 }

package/src/mailbox-queue.ts

@@ -14,7 +14,6 @@ import {
 	recordedByRename,
 	refuseContestedIntent,
 } from "./mailbox-intent.js";
-import { EVERY_MAILBOX_STATE } from "./mailbox-presence.js";
 
 /**
  * MAILBOX_CREATE event structure (matches remit-imap-worker/events.ts)
@@ -330,8 +329,12 @@ export class MailboxQueueService {
 	};
 
 	/**
-	 * Delete a mailbox.
-	 * Marks for deletion (syncStatus=deleting) and enqueues IMAP DELETE.
+	 * Record a delete intent (T7) and enqueue IMAP DELETE.
+	 *
+	 * The row stays at `deleting` and stays visible until the worker confirms the
+	 * server delete and removes it with the folder's mail (D8, D11). The enqueue
+	 * happens only after the transition wins, and an enqueue failure stays thrown
+	 * — a 500 to the caller, loud — rather than being swallowed or rolled back.
 	 *
 	 * @param mailboxId - The mailbox to delete
 	 * @param accountId - The account ID for the IMAP sync event
@@ -343,17 +346,30 @@ export class MailboxQueueService {
 		// Get current mailbox to capture path
 		const mailbox = await this.mailboxService.get(accountId, mailboxId);
 
-		// Mark as deleting (soft delete - worker will do actual delete after IMAP sync)
 		const recorded = await this.mailboxService.transition(
 			accountId,
 			mailboxId,
-			{ from: EVERY_MAILBOX_STATE, to: MailboxSyncStatus.deleting },
+			{ from: INTENT_RECORDABLE_FROM, to: MailboxSyncStatus.deleting },
 		);
-		if (!recorded) throw new NotFoundError(`Mailbox not found: ${mailboxId}`);
+		if (!recorded) {
+			await refuseContestedIntent(
+				this.mailboxService,
+				accountId,
+				mailboxId,
+				"folder",
+			);
+		}
 
 		this.log.info(
-			{ mailboxId, path: mailbox.fullPath },
-			"Marked mailbox for deletion (local)",
+			{
+				accountId,
+				mailboxId,
+				intent: "delete",
+				from: mailbox.syncStatus,
+				to: MailboxSyncStatus.deleting,
+				path: mailbox.fullPath,
+			},
+			"Recorded delete intent",
 		);
 
 		// Enqueue IMAP sync