@remit/mailbox-service 0.0.98 → 0.0.99

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.98",
+  "version": "0.0.99",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/body-sync-category-override.test.ts

@@ -381,10 +381,8 @@ describe("Address.flags.category overrides classification at sync time (issue #2
 			);
 
 			assert.equal(harness.messageUpdates.length, 1);
-			assert.equal(
-				harness.messageUpdates[0].input.category,
-				MessageCategory.marketing,
-			);
+			// Re-store writes only bodyStorageKey — category untouched on row + thread.
+			assert.equal(harness.messageUpdates[0].input.category, undefined);
 			assert.equal(harness.message.category, MessageCategory.marketing);
 			assert.equal(harness.rows[0].category, MessageCategory.marketing);
 		});
@@ -422,10 +420,8 @@ describe("Address.flags.category overrides classification at sync time (issue #2
 
 			assert.deepEqual(result.syncedMessageIds, ["m-1"]);
 			assert.equal(harness.messageUpdates.length, 1);
-			assert.equal(
-				harness.messageUpdates[0].input.category,
-				MessageCategory.marketing,
-			);
+			// Re-store writes only bodyStorageKey — category untouched on row + thread.
+			assert.equal(harness.messageUpdates[0].input.category, undefined);
 			assert.equal(harness.message.category, MessageCategory.marketing);
 			assert.equal(harness.rows[0].category, MessageCategory.marketing);
 		});

package/src/body-sync-category-writeonce.test.ts

@@ -2,15 +2,13 @@
  * RFC 034 Decision 3.1: `Message.category` is written once and never mutated
  * after — RFC 030's message-list GSI sort key depends on it never churning.
  *
- * `applyPostStoreSteps` computes a fresh classification on every pass and
- * folds it into the single Message update, with no check for whether the
- * message already carries a decided category. Two shipped paths re-enter it
- * on an already-classified message — the `NoSuchKey` fallback in
- * `fetchAndGetBody`, and `syncBodies(..., force: true)` — and both must leave
- * `category` untouched. Each test below feeds a re-entrant pass a body that
- * would classify differently from the message's existing category, so a
- * regression that drops the guard shows up even though header classification
- * is otherwise deterministic (issue #355).
+ * The re-entrant paths — `fetchAndGetBody`'s `NoSuchKey` fallback and
+ * `syncBodies(..., force: true)` — are now body-only re-stores (issue #1011):
+ * `applyPostStoreSteps(isReStore: true)` skips the entire decision pass and
+ * writes only `bodyStorageKey`, so the existing category on the row is never
+ * touched. Each test below feeds a re-store a body that would classify
+ * differently, so a regression that drops the isReStore skip shows up as the
+ * category field appearing in the update input (or changing on the row).
  */
 
 import assert from "node:assert/strict";
@@ -157,10 +155,11 @@ describe("Message.category survives a re-entrant classification pass", () => {
 		);
 
 		assert.equal(harness.messageUpdates.length, 1);
-		assert.equal(
-			harness.messageUpdates[0].input.category,
-			MessageCategory.marketing,
-		);
+		// Re-store writes only bodyStorageKey — category is untouched on the row.
+		assert.equal(harness.messageUpdates[0].input.category, undefined);
+		assert.deepEqual(Object.keys(harness.messageUpdates[0].input).sort(), [
+			"bodyStorageKey",
+		]);
 		assert.equal(harness.message.category, MessageCategory.marketing);
 	});
 
@@ -196,10 +195,11 @@ describe("Message.category survives a re-entrant classification pass", () => {
 
 		assert.deepEqual(result.syncedMessageIds, ["m-1"]);
 		assert.equal(harness.messageUpdates.length, 1);
-		assert.equal(
-			harness.messageUpdates[0].input.category,
-			MessageCategory.marketing,
-		);
+		// Re-store writes only bodyStorageKey — category is untouched on the row.
+		assert.equal(harness.messageUpdates[0].input.category, undefined);
+		assert.deepEqual(Object.keys(harness.messageUpdates[0].input).sort(), [
+			"bodyStorageKey",
+		]);
 		assert.equal(harness.message.category, MessageCategory.marketing);
 	});
 

package/src/body-sync-placement-writeonce.test.ts

@@ -1,20 +1,18 @@
 /**
- * RFC 039 Non-goals / issue #383: placement is meant to run once per message.
- * #378 (issue #355) guarded `Message.category` against the same two re-entrant
- * paths re-running `applyPostStoreSteps` on an already-processed message —
- * `fetchAndGetBody`'s `NoSuchKey` fallback and `syncBodies(..., force: true)`
- * — but did not guard `resolvePlacement`/`computePlacement`. Without a guard,
- * a message the provider originally junked and a user later rescued by hand
- * (never touched by Remit, so `movedByRemit` records nothing) gets
- * `classifyPlacement` re-evaluated against the same demote signals that
- * junked it in the first place, and can be silently moved right back.
+ * RFC 039 Non-goals / issues #383, #1011: placement is meant to run once per
+ * message. The two re-entrant paths — `fetchAndGetBody`'s `NoSuchKey` fallback
+ * and `syncBodies(..., force: true)` — are now marked as re-stores by
+ * `applyPostStoreSteps(isReStore: true)`, which skips the entire decision pass
+ * (placement, filters, classification) and writes only `bodyStorageKey`. This
+ * replaces the old per-field guards (`hasDecidedPlacement`,
+ * `hasDecidedCategory`, `hasClassifiedBody`) that each individual derivation
+ * carried.
  *
- * Each "already decided" test below presets `placementDecidedAt` on the
- * fixture (as a genuine first pass would have left it) and feeds the
- * re-entrant pass a body whose headers WOULD trigger a confident demote if
- * `classifyPlacement` ran fresh — so a regression that drops the guard shows
- * up as an unwanted move, not as a passing test relying on deterministic
- * heuristics happening to agree.
+ * The last test below previously asserted that a legacy row (movedByRemit: true,
+ * no placementDecidedAt) gets backfilled with placementDecidedAt on re-enter —
+ * that behavior is gone by design: re-stores never re-decide placement, so a
+ * pre-#1011 row that never got placementDecidedAt simply keeps not having it
+ * (and never gets moved by Remit either).
  */
 
 import assert from "node:assert/strict";
@@ -201,6 +199,11 @@ describe("placement survives a re-entrant computePlacement pass (issue #383)", (
 		assert.equal(harness.message.mailboxId, MAILBOXES.inbox.mailboxId);
 		assert.equal(harness.messageUpdates[0]?.input.movedByRemit, undefined);
 		assert.equal(harness.messageUpdates[0]?.input.placementVerdict, undefined);
+		// The re-store wrote only bodyStorageKey — no placement fields.
+		assert.equal(
+			harness.messageUpdates[0]?.input.placementDecidedAt,
+			undefined,
+		);
 	});
 
 	it("keeps a user-rescued message in Inbox when syncBodies re-fetches with force", async () => {
@@ -279,16 +282,18 @@ describe("placement survives a re-entrant computePlacement pass (issue #383)", (
 		);
 	});
 
-	it("continues to protect a message Remit itself already moved (movedByRemit: true), unchanged behavior", async () => {
+	it("a legacy row with movedByRemit: true and no placementDecidedAt is not re-decided on re-store", async () => {
 		const harness = buildHarness(
 			{
 				messageId: "m-1",
 				mailboxId: MAILBOXES.inbox.mailboxId,
 				bodyStorageKey: "s3://bodies/m-1",
 				movedByRemit: true,
-				// No placementDecidedAt — a legacy row synced before issue #383's
-				// guard existed. `classifyPlacement`'s own `movedByRemit` check
-				// must still hold on its own.
+				// No placementDecidedAt and no category — a legacy row synced before
+				// the write-once guards existed. Under #1011 a re-store skips the
+				// decision pass entirely, so placement is never re-evaluated and the
+				// row's missing fields are never backfilled — the re-store writes only
+				// bodyStorageKey.
 			},
 			async () => {
 				throw noSuchKeyError();
@@ -313,10 +318,20 @@ describe("placement survives a re-entrant computePlacement pass (issue #383)", (
 			[],
 			"movedByRemit must keep protecting a legacy row with no placementDecidedAt of its own",
 		);
+		// The re-store wrote only bodyStorageKey — no placement fields were
+		// re-decided or backfilled.
 		assert.equal(harness.message.mailboxId, MAILBOXES.inbox.mailboxId);
-		assert.ok(
-			typeof harness.messageUpdates[0]?.input.placementDecidedAt === "number",
-			"the legacy row is backfilled with placementDecidedAt going forward, self-healing for future passes",
+		assert.equal(
+			harness.messageUpdates[0]?.input.placementDecidedAt,
+			undefined,
+		);
+		assert.equal(harness.messageUpdates[0]?.input.movedByRemit, undefined);
+		assert.equal(harness.messageUpdates[0]?.input.placementVerdict, undefined);
+		// The only field written is bodyStorageKey.
+		assert.equal(
+			Object.keys(harness.messageUpdates[0]?.input ?? {}).length,
+			1,
+			"re-store must write only bodyStorageKey",
 		);
 	});
 });

package/src/body-sync-resync.test.ts

@@ -0,0 +1,605 @@
+/**
+ * Issue #1011: a forced body re-sync must not re-fire standing rules on an
+ * already-seen message.
+ *
+ * The two re-entrant paths — `fetchAndGetBody`'s `NoSuchKey` IMAP fallback, and
+ * `syncBodies(..., force: true)` (the read-miss re-arm cue) — both re-fetch a
+ * body whose row already carries `bodyStorageKey`. That is a body-only fetch:
+ * the decision pass (placement, filters, classification) already ran when the
+ * body first landed. Re-running it now would move mail the user has since filed
+ * by hand, re-fire the engagement counter, re-apply labels, and rewrite the
+ * write-once category.
+ *
+ * Each test below presets a message whose body was already stored and whose
+ * headers WOULD trigger a confident placement demote or a standing filter move
+ * if the decision pass ran fresh. A regression that drops the `isReStore` skip
+ * shows up as an unwanted move, not as a passing test relying on the heuristics
+ * happening to agree.
+ */
+
+import assert from "node:assert/strict";
+import { Readable } from "node:stream";
+import { describe, it } from "node:test";
+import type {
+	FilterItem,
+	IAddressRepository,
+	IEnvelopeRepository,
+	IFilterAnchorRepository,
+	IFilterRepository,
+	IMailboxSpecialUseRepository,
+	IMessageLabelRepository,
+	IMessageRepository,
+	IThreadMessageRepository,
+	MessageItem,
+	UpdateMessageInput,
+} from "@remit/data-ports";
+import { NotFoundError } from "@remit/data-ports/errors";
+import {
+	FilterClauseField,
+	FilterMatchOperator,
+	FilterState,
+	MessageCategory,
+} from "@remit/domain-enums";
+import type { StorageService } from "@remit/storage-service";
+import type { PlacementConfig } from "./body-sync.js";
+import { BodySyncService } from "./body-sync.js";
+import { NO_ACTION } from "./filters/match.js";
+import type { FilterConfig } from "./filters/pipeline.js";
+import type { PlacementMoveService } from "./placement-move.js";
+import type { IImapConnection } from "./types.js";
+
+const MAILBOXES = {
+	inbox: { mailboxId: "mb-inbox", fullPath: "INBOX" },
+	junk: { mailboxId: "mb-junk", fullPath: "Junk" },
+	travel: { mailboxId: "mb-travel", fullPath: "Travel" },
+};
+
+/**
+ * Demote headers: DKIM domain mismatches From, dmarc=fail, untrusted sender.
+ * `classifyPlacement`'s demote branch (inbox → junk, HIGH bar) confidently acts
+ * on this set when the message currently sits in Inbox.
+ */
+const DEMOTE_EML = Buffer.from(
+	[
+		"From: Support <support@evil-mimic.example>",
+		"To: me@example.com",
+		"Subject: Verify your account",
+		"Authentication-Results: mx.example.com; dmarc=fail",
+		"DKIM-Signature: v=1; a=rsa-sha256; d=relay.example.net; s=sel; b=xxx",
+		"X-Spam-Status: No, score=0.1",
+		"Content-Type: text/plain",
+		"",
+		"body",
+	].join("\r\n"),
+);
+
+/**
+ * A standing literal filter that matches subjects containing "invitation" and
+ * moves them to `destinationMailboxId`. Used to assert that a re-store does not
+ * re-fire the filter on an already-seen message.
+ */
+const buildInvitationFilter = (destinationMailboxId: string): FilterItem =>
+	({
+		filterId: "flt-invite",
+		accountConfigId: "cfg-1",
+		name: "Invitations",
+		scope: "Standing",
+		state: FilterState.Active,
+		hasAnchor: false,
+		ruleChangedAt: 1,
+		matchOperator: FilterMatchOperator.And,
+		literalClauses: [{ field: FilterClauseField.Subject, value: "invitation" }],
+		actionLabelId: NO_ACTION,
+		actionMailboxId: destinationMailboxId,
+		createdAt: 1,
+		updatedAt: 1,
+	}) as unknown as FilterItem;
+
+const INVITATION_EML = Buffer.from(
+	[
+		"From: Someone <someone@example.com>",
+		"To: me@example.com",
+		"Subject: You have a new invitation to Travel",
+		"Content-Type: text/plain",
+		"",
+		"details",
+	].join("\r\n"),
+);
+
+interface Harness {
+	service: BodySyncService;
+	message: MessageItem;
+	messageUpdates: Array<{ messageId: string; input: UpdateMessageInput }>;
+	moves: Array<{ messageId: string; destinationMailboxId: string }>;
+}
+
+const noSuchKeyError = () =>
+	Object.assign(new Error("missing"), { name: "NoSuchKey" });
+
+/**
+ * Build a BodySyncService harness with both placement and filter configs wired,
+ * so we can assert that neither fires during a re-store.
+ */
+const buildHarness = (
+	message: Partial<MessageItem> & Pick<MessageItem, "messageId">,
+	retrieve: () => Promise<Buffer>,
+	filter: FilterItem | null,
+): Harness => {
+	const messageUpdates: Array<{
+		messageId: string;
+		input: UpdateMessageInput;
+	}> = [];
+	const moves: Array<{ messageId: string; destinationMailboxId: string }> = [];
+
+	const messageRow = {
+		uid: 1,
+		mailboxId: MAILBOXES.inbox.mailboxId,
+		...message,
+	} as unknown as MessageItem;
+
+	const messageService = {
+		get: async (messageId: string) =>
+			messageId === message.messageId ? messageRow : undefined,
+		update: async (messageId: string, input: UpdateMessageInput) => {
+			messageUpdates.push({ messageId, input });
+			Object.assign(messageRow, input);
+		},
+	} as unknown as IMessageRepository;
+
+	const threadMessageService = {
+		findAllByMessageId: async () => [
+			{
+				threadMessageId: "tm-1",
+				messageId: message.messageId,
+				mailboxId: messageRow.mailboxId,
+				sentDate: 1,
+				isRead: false,
+				isDeleted: false,
+				hasStars: false,
+				hasAttachment: false,
+			},
+		],
+		update: async () => {},
+	} as unknown as IThreadMessageRepository;
+
+	const storageService = {
+		retrieve,
+		storeMessageBody: async () => ({ uri: `s3://bodies/${message.messageId}` }),
+		storeMessageBodyStream: async () => ({
+			uri: `s3://bodies/${message.messageId}`,
+		}),
+		storeParsedBody: async () => {},
+		listBodyParts: async () => [],
+	} as unknown as StorageService;
+
+	const addressService = {
+		getAddress: async () => {
+			throw new NotFoundError("Address not found");
+		},
+		incrementInboundCount: async () => {},
+	} as unknown as IAddressRepository;
+
+	const envelopeService = {
+		listBodyParts: async () => [],
+	} as unknown as IEnvelopeRepository;
+
+	const mailboxSpecialUseService = {
+		findJunkMailbox: async () => MAILBOXES.junk,
+		findArchiveMailbox: async () => null,
+		findInboxMailbox: async () => MAILBOXES.inbox,
+	} as unknown as IMailboxSpecialUseRepository;
+
+	const placementMoveService = {
+		moveMessage: async (
+			_accountConfigId: string,
+			messageId: string,
+			destinationMailboxId: string,
+		) => {
+			moves.push({ messageId, destinationMailboxId });
+			messageRow.mailboxId = destinationMailboxId;
+		},
+	} as unknown as PlacementMoveService;
+
+	const placementConfig: PlacementConfig = {
+		mailboxSpecialUseService,
+		placementMoveService,
+	};
+
+	const filterConfig: FilterConfig | undefined = filter
+		? {
+				filterService: {
+					listByAccountAndState: async () => [filter],
+					refreshExpiry: async (f: FilterItem) => f,
+				} as unknown as IFilterRepository,
+				filterAnchorService: {
+					get: async () => undefined,
+				} as unknown as IFilterAnchorRepository,
+				messageLabelService: {
+					apply: async () => {},
+				} as unknown as IMessageLabelRepository,
+				placementMoveService,
+			}
+		: undefined;
+
+	const service = new BodySyncService(
+		messageService,
+		storageService,
+		threadMessageService,
+		addressService,
+		envelopeService,
+		{ info: () => {}, error: () => {}, debug: () => {}, warn: () => {} },
+		placementConfig,
+		filterConfig,
+	);
+
+	return { service, message: messageRow, messageUpdates, moves };
+};
+
+const noSuchKeyConn = (body: Buffer): IImapConnection =>
+	({
+		openBox: async () => {},
+		fetchMessageBody: async () => body,
+	}) as unknown as IImapConnection;
+
+const streamBody = (body: Buffer): Readable =>
+	Readable.from([body]) as unknown as Readable;
+
+describe("issue #1011: forced re-store does not re-fire standing rules", () => {
+	it("syncBodies(force: true) does not re-evaluate placement on a stored message", async () => {
+		const harness = buildHarness(
+			{
+				messageId: "m-1",
+				mailboxId: MAILBOXES.inbox.mailboxId,
+				bodyStorageKey: "s3://bodies/m-1",
+				// Already classified and placed — category and placementDecidedAt
+				// set by a prior, genuine first-store pass.
+				category: MessageCategory.personal,
+				placementDecidedAt: 500,
+			},
+			async () => {
+				throw new Error("force path must not retrieve from storage");
+			},
+			null, // no filter config
+		);
+
+		const connection = {
+			openBox: async () => {},
+			async *fetchMessageBodies(uids: number[]) {
+				for (const uid of uids) {
+					yield { uid, source: streamBody(DEMOTE_EML) };
+				}
+			},
+		} as unknown as IImapConnection;
+
+		const result = await harness.service.syncBodies(
+			["m-1"],
+			"acc-1",
+			"cfg-1",
+			"INBOX",
+			async () => connection,
+			true,
+		);
+
+		assert.deepEqual(result.syncedMessageIds, ["m-1"], "message is synced");
+
+		// No placement move — a hand-rescued message stays where the user put it.
+		assert.deepEqual(
+			harness.moves,
+			[],
+			"a forced re-store must not re-decide placement, even though headers would demote",
+		);
+		assert.equal(harness.message.mailboxId, MAILBOXES.inbox.mailboxId);
+
+		// The update writes only bodyStorageKey — no placement or category churn.
+		const update = harness.messageUpdates[0];
+		assert.equal(update?.input.movedByRemit, undefined);
+		assert.equal(update?.input.placementVerdict, undefined);
+		assert.equal(update?.input.placementDecidedAt, undefined);
+		assert.equal(update?.input.category, undefined);
+		assert.deepEqual(
+			Object.keys(update?.input ?? {}).sort(),
+			["bodyStorageKey"],
+			"re-store must write only bodyStorageKey",
+		);
+	});
+
+	it("syncBodies(force: true) does not re-fire a standing filter on a stored message", async () => {
+		const harness = buildHarness(
+			{
+				messageId: "m-1",
+				mailboxId: MAILBOXES.travel.mailboxId,
+				bodyStorageKey: "s3://bodies/m-1",
+				category: MessageCategory.personal,
+			},
+			async () => {
+				throw new Error("force path must not retrieve from storage");
+			},
+			buildInvitationFilter(MAILBOXES.junk.mailboxId),
+		);
+
+		const connection = {
+			openBox: async () => {},
+			async *fetchMessageBodies(uids: number[]) {
+				for (const uid of uids) {
+					yield { uid, source: streamBody(INVITATION_EML) };
+				}
+			},
+		} as unknown as IImapConnection;
+
+		const result = await harness.service.syncBodies(
+			["m-1"],
+			"acc-1",
+			"cfg-1",
+			"INBOX",
+			async () => connection,
+			true,
+		);
+
+		assert.deepEqual(result.syncedMessageIds, ["m-1"]);
+
+		// No filter move — the message already sits in its filter destination
+		// (Travel) and a re-store must not re-fire the filter.
+		assert.deepEqual(
+			harness.moves,
+			[],
+			"a forced re-store must not re-fire standing filters",
+		);
+		// The update writes only bodyStorageKey — no filterMove marker.
+		const update = harness.messageUpdates[0];
+		assert.equal(update?.input.filterMove, undefined);
+		assert.equal(update?.input.movedByRemit, undefined);
+		assert.deepEqual(
+			Object.keys(update?.input ?? {}).sort(),
+			["bodyStorageKey"],
+			"re-store must write only bodyStorageKey",
+		);
+	});
+
+	it("fetchAndGetBody NoSuchKey fallback does not re-fire placement or filters", async () => {
+		const harness = buildHarness(
+			{
+				messageId: "m-1",
+				mailboxId: MAILBOXES.inbox.mailboxId,
+				bodyStorageKey: "s3://bodies/m-1",
+				category: MessageCategory.personal,
+				placementDecidedAt: 500,
+			},
+			async () => {
+				throw noSuchKeyError();
+			},
+			buildInvitationFilter(MAILBOXES.junk.mailboxId),
+		);
+
+		await harness.service.fetchAndGetBody(
+			"m-1",
+			"acc-1",
+			"cfg-1",
+			"INBOX",
+			async () => noSuchKeyConn(DEMOTE_EML),
+		);
+
+		assert.deepEqual(
+			harness.moves,
+			[],
+			"the NoSuchKey fallback must not re-decide placement or re-fire filters",
+		);
+		assert.equal(harness.message.mailboxId, MAILBOXES.inbox.mailboxId);
+
+		const update = harness.messageUpdates[0];
+		assert.equal(update?.input.movedByRemit, undefined);
+		assert.equal(update?.input.placementVerdict, undefined);
+		assert.equal(update?.input.filterMove, undefined);
+		assert.deepEqual(
+			Object.keys(update?.input ?? {}).sort(),
+			["bodyStorageKey"],
+			"re-store must write only bodyStorageKey",
+		);
+	});
+
+	it("a first-store via fetchAndGetBody (no bodyStorageKey) still runs placement and filters", async () => {
+		// Regression guard: the re-store skip must not disable decisions on a
+		// genuine first store that happens to arrive via the read path.
+		const harness = buildHarness(
+			{
+				messageId: "m-1",
+				mailboxId: MAILBOXES.inbox.mailboxId,
+				// No bodyStorageKey — a genuine first store.
+			},
+			async () => {
+				throw new Error("must not retrieve from storage on a first store");
+			},
+			buildInvitationFilter(MAILBOXES.travel.mailboxId),
+		);
+
+		await harness.service.fetchAndGetBody(
+			"m-1",
+			"acc-1",
+			"cfg-1",
+			"INBOX",
+			async () => noSuchKeyConn(INVITATION_EML),
+		);
+
+		// The filter fires — it is a first store, not a re-store.
+		assert.deepEqual(
+			harness.moves,
+			[{ messageId: "m-1", destinationMailboxId: MAILBOXES.travel.mailboxId }],
+			"a genuine first store must run the standing filter",
+		);
+		const update = harness.messageUpdates[0];
+		assert.equal(update?.input.filterMove?.filterId, "flt-invite");
+		assert.equal(update?.input.movedByRemit, true);
+	});
+
+	it("a forced batch re-stores a stored message (bytes only) but first-stores a never-stored one", async () => {
+		// A forced batch may contain both never-stored messages (first store —
+		// full decisions) and already-stored ones (re-store — bytes only).
+		const storedMessage = {
+			messageId: "m-stored",
+			mailboxId: MAILBOXES.inbox.mailboxId,
+			uid: 1,
+			bodyStorageKey: "s3://bodies/m-stored",
+			category: MessageCategory.personal,
+		} as unknown as MessageItem;
+		const newMessage = {
+			messageId: "m-new",
+			mailboxId: MAILBOXES.inbox.mailboxId,
+			uid: 2,
+		} as unknown as MessageItem;
+
+		const messageUpdates: Array<{
+			messageId: string;
+			input: UpdateMessageInput;
+		}> = [];
+		const moves: Array<{ messageId: string; destinationMailboxId: string }> =
+			[];
+
+		const messageService = {
+			get: async (messageId: string) =>
+				messageId === "m-stored"
+					? storedMessage
+					: messageId === "m-new"
+						? newMessage
+						: undefined,
+			update: async (id: string, input: UpdateMessageInput) => {
+				messageUpdates.push({ messageId: id, input });
+				const row = id === "m-stored" ? storedMessage : newMessage;
+				Object.assign(row, input);
+			},
+		} as unknown as IMessageRepository;
+
+		const threadMessageService = {
+			findAllByMessageId: async (
+				_accountConfigId: string,
+				messageId: string,
+			) => [
+				{
+					threadMessageId: `tm-${messageId}`,
+					messageId,
+					mailboxId:
+						messageId === "m-stored"
+							? storedMessage.mailboxId
+							: newMessage.mailboxId,
+					sentDate: 1,
+					isRead: false,
+					isDeleted: false,
+					hasStars: false,
+					hasAttachment: false,
+				},
+			],
+			update: async () => {},
+		} as unknown as IThreadMessageRepository;
+
+		const storageService = {
+			retrieve: async () => {
+				throw new Error("must not retrieve on force path");
+			},
+			storeMessageBodyStream: async () => ({
+				uri: "s3://bodies/m",
+			}),
+			storeParsedBody: async () => {},
+			listBodyParts: async () => [],
+		} as unknown as StorageService;
+
+		const addressService = {
+			getAddress: async () => {
+				throw new NotFoundError("not found");
+			},
+			incrementInboundCount: async () => {},
+		} as unknown as IAddressRepository;
+
+		const envelopeService = {
+			listBodyParts: async () => [],
+		} as unknown as IEnvelopeRepository;
+
+		const mailboxSpecialUseService = {
+			findJunkMailbox: async () => MAILBOXES.junk,
+			findArchiveMailbox: async () => null,
+			findInboxMailbox: async () => MAILBOXES.inbox,
+		} as unknown as IMailboxSpecialUseRepository;
+
+		const placementMoveService = {
+			moveMessage: async (
+				_accountConfigId: string,
+				messageId: string,
+				destinationMailboxId: string,
+			) => {
+				moves.push({ messageId, destinationMailboxId });
+			},
+		} as unknown as PlacementMoveService;
+
+		const filterConfig: FilterConfig = {
+			filterService: {
+				listByAccountAndState: async () => [
+					buildInvitationFilter(MAILBOXES.junk.mailboxId),
+				],
+				refreshExpiry: async (f: FilterItem) => f,
+			} as unknown as IFilterRepository,
+			filterAnchorService: {
+				get: async () => undefined,
+			} as unknown as IFilterAnchorRepository,
+			messageLabelService: {
+				apply: async () => {},
+			} as unknown as IMessageLabelRepository,
+			placementMoveService,
+		};
+
+		const service = new BodySyncService(
+			messageService,
+			storageService,
+			threadMessageService,
+			addressService,
+			envelopeService,
+			{ info: () => {}, error: () => {}, debug: () => {}, warn: () => {} },
+			{ mailboxSpecialUseService, placementMoveService },
+			filterConfig,
+		);
+
+		// UID 1 is the stored message, UID 2 is new. fetchMessageBodies yields
+		// in order; the stored one (DEMOTE_EML) would demote if placement ran,
+		// the new one (INVITATION_EML) would trigger the filter.
+		const connection = {
+			openBox: async () => {},
+			async *fetchMessageBodies() {
+				yield { uid: 1, source: streamBody(DEMOTE_EML) };
+				yield { uid: 2, source: streamBody(INVITATION_EML) };
+			},
+		} as unknown as IImapConnection;
+
+		const result = await service.syncBodies(
+			["m-stored", "m-new"],
+			"acc-1",
+			"cfg-1",
+			"INBOX",
+			async () => connection,
+			true,
+		);
+
+		// Both messages were handled.
+		assert.deepEqual(result.syncedMessageIds.sort(), ["m-new", "m-stored"]);
+
+		// The stored message is a re-store: no placement move, no filter run.
+		const storedUpdate = messageUpdates.find((u) => u.messageId === "m-stored");
+		assert.equal(storedUpdate?.input.movedByRemit, undefined);
+		assert.equal(storedUpdate?.input.filterMove, undefined);
+		assert.deepEqual(
+			Object.keys(storedUpdate?.input ?? {}).sort(),
+			["bodyStorageKey"],
+			"stored message in a forced batch must re-store (bytes only)",
+		);
+
+		// The new message is a first-store: the filter fires.
+		assert.deepEqual(
+			moves,
+			[
+				{
+					messageId: "m-new",
+					destinationMailboxId: MAILBOXES.junk.mailboxId,
+				},
+			],
+			"only the never-stored message in the forced batch takes the decision pass",
+		);
+		const newUpdate = messageUpdates.find((u) => u.messageId === "m-new");
+		assert.equal(newUpdate?.input.movedByRemit, true);
+		assert.equal(newUpdate?.input.filterMove?.filterId, "flt-invite");
+	});
+});

package/src/body-sync.ts

@@ -166,6 +166,7 @@ const extractSnippet = (parsed: ParsedMail): string =>
 		SNIPPET_LENGTH,
 	);
 
+/**
 /**
  * RFC 034 Decision 3.1: `Message.category` is written once and never mutated
  * after — RFC 030's message-list GSI sort key depends on it never churning.
@@ -183,30 +184,20 @@ const hasDecidedCategory = (
 ): boolean =>
 	category !== undefined && category !== MessageCategory.uncategorized;
 
-/**
- * Issue #383 (RFC 039 Non-goals): whether {@link BodySyncService.computePlacement}
- * has already produced a verdict for this message — moved, left in place, or
- * archived, confident or unsure alike. Absence means placement has genuinely
- * never been evaluated. The same two re-entrant paths `hasDecidedCategory`
- * guards (`fetchAndGetBody`'s `NoSuchKey` fallback, `syncBodies(..., force:
- * true)`) also re-enter `computePlacement`; without this guard a message a
- * user manually rescued (never touched by Remit, so `movedByRemit` never
- * recorded anything) can be silently re-evaluated and moved right back.
- */
-const hasDecidedPlacement = (placementDecidedAt: number | undefined): boolean =>
-	placementDecidedAt !== undefined;
-
 /**
  * Issue #499: whether a completed body-sync pass has already stored this
  * message's body. `bodyStorageKey` is written last, once every derivation of
- * that pass has run, so its presence means that pass finished. The same two
- * re-entrant paths `hasDecidedCategory` and `hasDecidedPlacement` guard
- * (`fetchAndGetBody`'s `NoSuchKey` fallback, `syncBodies(..., force: true)`)
- * are the ones that reach the derivations again with it already set.
+ * that pass has run, so its presence means that pass finished.
  *
  * Key presence, and nothing more. What the classifier decided is
  * `Message.category`; whether it ran at all is `Message.classificationState`.
  * Neither is inferred from here — the field this reads is the storage fact.
+ *
+ * The re-fetch paths that re-enter with the key already set (`syncBodies(...,
+ * force: true)` and `fetchAndGetBody`'s `NoSuchKey` fallback) are re-stores
+ * that skip the derivations entirely (issue #1011), so this guard is what
+ * keeps a first store that lands on an already-stored row from re-deciding
+ * anything.
  */
 const hasStoredBody = (bodyStorageKey: string | undefined): boolean =>
 	Boolean(bodyStorageKey);
@@ -217,9 +208,9 @@ const hasStoredBody = (bodyStorageKey: string | undefined): boolean =>
  * means "nothing confident to say":
  *
  * - `already-moved-by-remit` is {@link classifyPlacement}'s guard against
- *   re-deciding a settled placement, and auto-archive is a re-decision. The
- *   re-entrant paths `hasDecidedPlacement` names reach it on messages Remit
- *   itself placed, or that a user moved back afterwards.
+ *   re-deciding a settled placement, and auto-archive is a re-decision. It
+ *   fires on messages Remit itself placed, or that a user moved back
+ *   afterwards.
  * - A message already in Junk gets an unsure `leave` whatever the sender's
  *   `blocked` flag says, since the demote branch only fires outside Junk.
  *   Moving mail out of Junk is a rescue, which this file reserves for a
@@ -397,6 +388,12 @@ export class BodySyncService {
 		// messageId so we can match FETCH rows back and re-enqueue any UID the
 		// server never returns.
 		const pending = new Map<number, string>();
+		// Message IDs in this batch whose row already carried `bodyStorageKey`
+		// when `force` re-added them to `pending`: a forced re-fetch of an
+		// already-stored body is a re-store (issue #1011) — bytes only, no
+		// decision re-run. A message with no stored body inside a forced batch
+		// is still a first store and takes the full decision pass.
+		const reStoredMessageIds = new Set<string>();
 
 		// One read per round, not per message (issue #72). The list is small by
 		// design and almost always empty, so a lookup per message would put a
@@ -438,6 +435,7 @@ export class BodySyncService {
 				skippedCount++;
 				continue;
 			}
+			if (message.bodyStorageKey) reStoredMessageIds.add(messageId);
 			pending.set(message.uid, messageId);
 		}
 
@@ -468,6 +466,7 @@ export class BodySyncService {
 						accountId,
 						accountConfigId,
 						source,
+						reStoredMessageIds.has(messageId),
 					);
 				} catch (error) {
 					// A per-message store failure (e.g. the parsed-body S3 write) is a
@@ -644,12 +643,18 @@ export class BodySyncService {
 	 * cache, per-part objects). The S3 upload never sees a whole-body concat —
 	 * the storage service streams it — but mailparser still needs the full bytes,
 	 * so we collect them in parallel. Later issues move parsing off the hot path.
+	 *
+	 * `isReStore` marks a re-fetch of a message whose row already carried
+	 * `bodyStorageKey` (the `force` re-arm in {@link syncBodies}): the
+	 * post-store steps then re-materialize the body artifacts without
+	 * re-running any decision (issue #1011).
 	 */
 	private async storeStreamedBody(
 		messageId: string,
 		accountId: string,
 		accountConfigId: string,
 		source: Readable,
+		isReStore: boolean,
 	): Promise<void> {
 		const toStorage = new PassThrough();
 		const chunks: Buffer[] = [];
@@ -693,6 +698,7 @@ export class BodySyncService {
 			{
 				uri: ref.uri,
 			},
+			isReStore,
 		);
 	}
 
@@ -724,6 +730,16 @@ export class BodySyncService {
 		accountConfigId: string,
 		body: Buffer,
 		bodyRef: { uri: string },
+		/**
+		 * Whether this call is a re-store of an already-classified message
+		 * rather than a first store. The two re-entrant paths (`force: true`
+		 * in `syncBodies`, and `fetchAndGetBody`'s `NoSuchKey` IMAP fallback) are
+		 * both body-only re-fetches: a body re-sync fetches and stores bytes and
+		 * runs no decision logic (issue #1011). When `isReStore` is true the
+		 * placement/filter/category machinery is skipped entirely and the
+		 * message's existing category is carried forward unchanged.
+		 */
+		isReStore: boolean,
 	): Promise<ParsedMail> {
 		// The one operation on this path that can fail because of how the message
 		// is built. Its own try block lives in `parseMessageBody`, so this frame —
@@ -733,6 +749,43 @@ export class BodySyncService {
 		// feed happens later, alongside the Message write (see below), once the
 		// write-once category is decided.
 		const parsed = await parseMessageBody(body);
+
+		// Body-only re-fetch (issue #1011): the decision pass already ran when
+		// this message's body first landed, so a re-store re-materializes only
+		// the body-derived artifacts — parsed cache, body parts, the storage
+		// key — and re-decides nothing: no classification, placement, filters,
+		// labels, read state, and no second engagement-counter increment.
+		// Skipping the decisions here is what lets the write-once fields stay
+		// safe without per-derivation re-entrancy guards.
+		if (isReStore) {
+			// Same ordering rule as the first-store path below: the parsed-body
+			// cache must be durable before `bodyStorageKey` — the skip-guard
+			// signal — is written, so a failure here requeues the message and
+			// the retry genuinely re-attempts the artifact writes.
+			await this.storeParsedBodyCache(
+				accountConfigId,
+				accountId,
+				messageId,
+				parsed,
+			);
+			if (!isBodyPartDeferralEnabled()) {
+				await this.storeBodyPartContents(
+					accountConfigId,
+					accountId,
+					messageId,
+					parsed,
+				);
+			}
+			await this.messageService.update(messageId, {
+				bodyStorageKey: bodyRef.uri,
+			});
+			this.log.info(
+				{ messageId, storageKey: bodyRef.uri },
+				"Body re-stored without re-running decisions",
+			);
+			return parsed;
+		}
+
 		const snippet = extractSnippet(parsed);
 		const listId = extractListId(parsed);
 
@@ -892,20 +945,19 @@ export class BodySyncService {
 		// once the parsed cache AND the move (when any) are.
 		//
 		// `category` is RFC 034 D3.1's write-once field (RFC 030's message-list
-		// GSI sort key depends on it never churning). This step re-enters on an
-		// already-classified message through two shipped paths — the `NoSuchKey`
-		// fallback in `fetchAndGetBody` and `syncBodies(..., force: true)` — so a
-		// real, previously-decided category is carried forward unchanged instead
-		// of the just-recomputed one.
-		// This also protects a `flags.category` override (issue #299): without
-		// this guard a re-entrant pass would let a *later* override silently
-		// rewrite a category already decided on an earlier message, which is
-		// exactly the churn RFC 030's GSI-safety argument forbids.
+		// GSI sort key depends on it never churning). The re-entrant re-store
+		// paths (issue #1011) return before this write; the carry-forward keeps
+		// the field write-once even when a first store lands on a row that
+		// already carries a real category — a previously-decided category wins
+		// over the just-recomputed one. It likewise protects a `flags.category`
+		// override (issue #299): recomputing would let a *later* override silently
+		// rewrite a category already decided, which is exactly the churn RFC
+		// 030's GSI-safety argument forbids.
 		//
-		// `resolved.placementDecidedAt` (issue #383) guards the same two
-		// re-entrant paths for placement: `computePlacement` already declined to
-		// recompute a verdict once this field is set, so it is only ever present
-		// here on the pass that first decided it.
+		// `resolved.placementDecidedAt` (issue #383) is only ever present on
+		// the pass that first decided it: the re-store paths skip placement
+		// entirely (issue #1011), so `computePlacement` is reached only on a
+		// first store.
 		const finalCategory = hasDecidedCategory(existingMessage.category)
 			? existingMessage.category
 			: classification.category;
@@ -1026,13 +1078,17 @@ export class BodySyncService {
 
 			// Same shared step the sync path (storeStreamedBody) runs — issue
 			// #1271 unified the two body paths so classification/placement no
-			// longer depends on which one fetched the body first.
+			// longer depends on which one fetched the body first. A store from
+			// here is a re-store exactly when the row already claimed a stored
+			// body — the NoSuchKey fallback above; a row with no bodyStorageKey is
+			// a genuine first store and takes the full decision pass.
 			parsed = await this.applyPostStoreSteps(
 				messageId,
 				accountId,
 				accountConfigId,
 				body,
 				{ uri: ref.uri },
+				message.bodyStorageKey != null,
 			);
 		} else {
 			parsed = await simpleParser(body);
@@ -1492,14 +1548,12 @@ export class BodySyncService {
 
 		const message = await this.messageService.get(messageId);
 
-		// Issue #383: placement is meant to run once per message (RFC 039
-		// Non-goals). Once a verdict has EVER been decided for this message —
-		// moved, left in place, or archived — a re-entrant pass (the `NoSuchKey`
-		// fallback in `fetchAndGetBody`, `syncBodies(..., force: true)`) must not
-		// recompute it: a message a user has since moved by hand (which never
-		// touches `movedByRemit`) would otherwise be silently re-evaluated
-		// against the same signals that placed it in the first place.
-		if (hasDecidedPlacement(message.placementDecidedAt)) return {};
+		// Issue #383 / #1011: placement still runs once per message (RFC 039
+		// Non-goals), but the once-per-message guarantee now comes from the
+		// caller rather than a guard here — the re-store paths
+		// (`fetchAndGetBody`'s `NoSuchKey` fallback, `syncBodies(..., force:
+		// true)`) skip the decision steps entirely, so only the pass that first
+		// stores a body ever reaches this method.
 
 		const junkMailbox =
 			await mailboxSpecialUseService.findJunkMailbox(accountId);