@withbuddi/buddi 0.1.0-pre.28 → 0.1.0-pre.30

package/node_modules/@buddi/tool-email/dist/mailbox/actions.js

@@ -12,7 +12,7 @@ export const MAILBOX_ACTION_KINDS = ['mark-read', 'mark-unread', 'archive', 'mov
 export const SEEN = '\\Seen';
 const GMAIL_CAPABILITY = 'X-GM-EXT-1';
 export const ACTION_COLUMNS = 'id, account_id, kind, destination, criteria, origin, actor, policy_id, run_id, action_id, message_ids, ' +
-    'items, changed, note, reverts, undone_at, undone_by, created_at';
+    'items, changed, note, reverts, undone_at, undone_by, created_at, state, reverted_ids';
 function iso(value) {
     if (value === null || value === undefined)
         return null;
@@ -38,6 +38,8 @@ export function toAction(row) {
         undoneAt: iso(row.undone_at),
         undoneBy: row.undone_by ? String(row.undone_by) : null,
         createdAt: iso(row.created_at),
+        state: ['pending', 'done', 'partial', 'unknown'].includes(row.state) ? row.state : 'done',
+        revertedIds: Array.isArray(row.reverted_ids) ? row.reverted_ids.map(String) : [],
     };
 }
 /** A refusal whose message is the sentence the owner and the agent read. */
@@ -84,7 +86,7 @@ export async function loadTargets(db, ids) {
     if (ids.length === 0)
         return [];
     const { rows } = await db.query(`select m.id, m.account_id, m.folder_id, f.name as folder, m.uidvalidity, m.uid, m.message_id,
-            m.subject, m.from_addr, m.flags
+            m.subject, m.from_addr, m.flags, m.gone_at
        from email.messages m join email.folders f on f.id = m.folder_id
       where m.id = any($1::uuid[])`, [ids]);
     const byId = new Map(rows.map((r) => [String(r.id), r]));
@@ -104,6 +106,7 @@ export async function loadTargets(db, ids) {
             subject: r.subject ?? '',
             from: r.from_addr ?? '',
             flags: Array.isArray(r.flags) ? r.flags : [],
+            gone: r.gone_at !== null && r.gone_at !== undefined,
         });
     }
     return out;
@@ -243,13 +246,25 @@ export function destinationFor(facts, kind, account, folder) {
 /* ------------------------------------------------------------------ *
  * Keeping buddi's rows in step
  * ------------------------------------------------------------------ */
-/** The folder row for a server name, created (unsynced, kind other) if new. Never changes an existing one. */
-async function folderRow(db, accountId, name) {
-    const { rows } = await db.query(`insert into email.folders (account_id, name, kind, synced) values ($1, $2, 'other', false)
-     on conflict (account_id, name) do update set name = email.folders.name
-     returning id`, [accountId, name]);
+/**
+ * The folder row for a server name, created (unsynced, kind other) if new.
+ * Never changes an existing row's kind or cursor; records what the server
+ * says the folder is for (`special_use`) when the caller knows it.
+ */
+export async function folderRow(db, accountId, name, specialUse) {
+    const { rows } = await db.query(`insert into email.folders (account_id, name, kind, synced, special_use) values ($1, $2, 'other', false, $3)
+     on conflict (account_id, name) do update set special_use = coalesce(excluded.special_use, email.folders.special_use)
+     returning id`, [accountId, name, specialUse ?? null]);
     return String(rows[0].id);
 }
+/** The SPECIAL-USE attribute the listing gives a folder, or null. */
+export function specialUseOf(listing, name) {
+    const info = listing.find((f) => f.name === name);
+    if (!info)
+        return null;
+    const known = ['\\all', '\\archive', '\\trash', '\\junk', '\\sent', '\\drafts'];
+    return attributesOf(info).find((a) => known.includes(a)) ?? null;
+}
 let unknownCounter = 0;
 /**
  * A placeholder uid for a message whose new uid the server did not report and
@@ -261,21 +276,34 @@ function placeholderUid() {
     unknownCounter = (unknownCounter + 1) % 1000;
     return -(Date.now() * 1000 + unknownCounter);
 }
-/** Point a row at where its message is now. Falls back to "uid unknown" if the poll got there first. */
-async function relocateRow(db, target, folderId, uidValidity, uid) {
+/**
+ * Point a row at where its message is now: folder, UIDVALIDITY, uid — and,
+ * on Gmail, its labels when they are known. The row is no longer "gone"
+ * (buddi knows where it is), and a thread whose newest message this is keeps
+ * its tie-break fields (`last_folder_id`, `last_uidvalidity`, `last_uid`)
+ * pointing at the same place. Falls back to "uid unknown" if the poll got
+ * there first.
+ */
+export async function relocateRow(db, target, folderId, uidValidity, uid, labels) {
+    const labelJson = labels === undefined ? null : JSON.stringify(labels ?? []);
+    let where = null;
     if (uidValidity !== null && uid !== null) {
-        const result = await db.query(`update email.messages set folder_id = $2, uidvalidity = $3, uid = $4
+        const result = await db.query(`update email.messages set folder_id = $2, uidvalidity = $3, uid = $4, gone_at = null,
+              labels = case when $6::jsonb is null then labels else $6::jsonb end
         where id = $1
           and not exists (select 1 from email.messages o
-                           where o.account_id = $5 and o.folder_id = $2 and o.uidvalidity = $3 and o.uid = $4)`, [target.id, folderId, uidValidity, uid, target.accountId]);
+                           where o.account_id = $5 and o.folder_id = $2 and o.uidvalidity = $3 and o.uid = $4
+                             and o.id <> $1)`, [target.id, folderId, uidValidity, uid, target.accountId, labelJson]);
         if ((result.rowCount ?? 0) > 0)
-            return;
+            where = { uidValidity, uid };
     }
-    await db.query(`update email.messages set folder_id = $2, uidvalidity = 0, uid = $3 where id = $1`, [
-        target.id,
-        folderId,
-        placeholderUid(),
-    ]);
+    if (where === null) {
+        where = { uidValidity: 0, uid: placeholderUid() };
+        await db.query(`update email.messages set folder_id = $2, uidvalidity = 0, uid = $3, gone_at = null,
+              labels = case when $4::jsonb is null then labels else $4::jsonb end
+        where id = $1`, [target.id, folderId, where.uid, labelJson]);
+    }
+    await db.query(`update email.threads set last_folder_id = $2, last_uidvalidity = $3, last_uid = $4 where last_message_id = $1`, [target.id, folderId, where.uidValidity, where.uid]);
 }
 async function setSeenLocally(db, ids, seen) {
     if (ids.length === 0)
@@ -285,6 +313,117 @@ async function setSeenLocally(db, ids, seen) {
           where id = any($1::uuid[]) and not (flags @> '["\\\\Seen"]'::jsonb)`
         : `update email.messages set flags = flags - '\\Seen' where id = any($1::uuid[])`, [ids]);
 }
+/* ------------------------------------------------------------------ *
+ * The trail, written before the server is touched
+ * ------------------------------------------------------------------ */
+/**
+ * Trail rows of changes running in this process right now. A `pending` row
+ * not in here was left by a process that stopped mid-change, and the next
+ * poll reconciles it (`reconcileTrail`). One process per installation, so
+ * this set is the whole truth about what is in flight.
+ */
+const inFlightTrail = new Set();
+/** The trail rows a change in this process is still writing. */
+export function trailInFlight() {
+    return [...inFlightTrail];
+}
+/** An item from before intent-first has no status: it was written after the change, so it happened. */
+export function statusOf(item) {
+    return item.status ?? 'done';
+}
+/**
+ * The trail row, written before the first server command: `pending`, with
+ * the messages it is about and no items yet. Each folder's items are added
+ * as `planned` right before that folder's command and become `done` once the
+ * server answered, so a crash anywhere leaves a row that says what may have
+ * happened.
+ */
+async function beginTrail(db, input) {
+    const p = input.provenance;
+    const { rows } = await db.query(`insert into email.mailbox_actions
+       (account_id, kind, destination, criteria, origin, actor, policy_id, run_id, action_id, message_ids,
+        items, changed, note, reverts, created_at, state)
+     values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10::uuid[], '[]'::jsonb, 0, null, $11, $12, 'pending')
+     returning id`, [
+        input.accountId,
+        input.kind,
+        input.destination,
+        p.criteria ?? null,
+        p.origin,
+        p.actor,
+        p.policyId ?? null,
+        p.runId ?? null,
+        p.actionId ?? null,
+        input.messageIds,
+        input.reverts ?? null,
+        input.now,
+    ]);
+    const id = String(rows[0].id);
+    inFlightTrail.add(id);
+    return id;
+}
+/** The items as they stand, on the row. */
+async function saveTrail(db, id, items) {
+    const kept = items.filter((i) => statusOf(i) !== 'dropped');
+    await db.query(`update email.mailbox_actions set items = $2::jsonb, changed = $3 where id = $1`, [id, JSON.stringify(kept), kept.filter((i) => statusOf(i) === 'done').length]);
+}
+/**
+ * Close a trail row. Without an error: `done`, or deleted when nothing
+ * changed. With one: `partial` when what was done is all known; still
+ * `pending` when a command was sent and its answer never came (the next poll
+ * asks the server); deleted when nothing reached the server.
+ */
+async function finishTrail(db, id, items, outcome) {
+    inFlightTrail.delete(id);
+    const kept = items.filter((i) => statusOf(i) !== 'dropped');
+    const done = kept.filter((i) => statusOf(i) === 'done');
+    const uncertain = kept.filter((i) => statusOf(i) === 'planned');
+    const skipped = outcome.skippedNote ? ` Skipped ${outcome.skippedNote}.` : '';
+    let state;
+    let note;
+    if (outcome.error !== undefined) {
+        const why = outcome.error instanceof Error ? outcome.error.message : String(outcome.error);
+        if (uncertain.length > 0) {
+            state = 'pending';
+            note = `Interrupted after ${plural(done.length, 'message')}: ${why}. ${plural(uncertain.length, 'more was', 'more were')} sent to the server without an answer; buddi checks ${uncertain.length === 1 ? 'it' : 'them'} on its next poll.${skipped}`;
+        }
+        else if (done.length > 0) {
+            state = 'partial';
+            note = `Partial: stopped by an error after ${plural(done.length, 'message')}: ${why}.${skipped}`;
+        }
+        else {
+            await db.query(`delete from email.mailbox_actions where id = $1`, [id]);
+            return null;
+        }
+    }
+    else {
+        if (done.length === 0) {
+            await db.query(`delete from email.mailbox_actions where id = $1`, [id]);
+            return null;
+        }
+        state = 'done';
+        note = skipped ? skipped.trim() : null;
+    }
+    const { rows } = await db.query(`update email.mailbox_actions set state = $2, note = $3, items = $4::jsonb, message_ids = $5::uuid[], changed = $6
+      where id = $1 returning ${ACTION_COLUMNS}`, [id, state, note, JSON.stringify(kept), kept.map((i) => i.id), done.length]);
+    return rows[0] ? toAction(rows[0]) : null;
+}
+/**
+ * After an undo (or its reconcile): the messages it put back join the
+ * original's `reverted_ids`, and the original is stamped undone once the undo
+ * finished without an error or nothing of it is left to put back. A partial
+ * undo leaves it undoable, for the rest.
+ */
+async function markReverted(db, original, doneIds, finished, undoId, now) {
+    const reverted = new Set([...original.revertedIds, ...doneIds]);
+    const remaining = original.items.filter((i) => statusOf(i) === 'done' && !reverted.has(i.id));
+    const complete = (finished && undoId !== null) || remaining.length === 0;
+    await db.query(`update email.mailbox_actions
+        set reverted_ids = $2::uuid[],
+            undone_at = case when $3 then $4 else undone_at end,
+            undone_by = case when $3 then $5::uuid else undone_by end
+      where id = $1`, [original.id, [...reverted], complete, now, undoId]);
+}
 /**
  * Find where each target is now, on the server: its folder's generation must
  * match, and a row whose uid is unknown (UIDVALIDITY 0) is looked up by
@@ -345,34 +484,33 @@ async function landed(client, destination, moved, result) {
     }
     return { uidValidity, uids };
 }
-async function recordAction(db, input) {
-    const p = input.provenance;
-    const { rows } = await db.query(`insert into email.mailbox_actions
-       (account_id, kind, destination, criteria, origin, actor, policy_id, run_id, action_id, message_ids,
-        items, changed, note, reverts, created_at)
-     values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10::uuid[], $11::jsonb, $12, $13, $14, $15)
-     returning ${ACTION_COLUMNS}`, [
-        input.accountId,
-        input.kind,
-        input.destination,
-        p.criteria ?? null,
-        p.origin,
-        p.actor,
-        p.policyId ?? null,
-        p.runId ?? null,
-        p.actionId ?? null,
-        input.messageIds,
-        JSON.stringify(input.items),
-        input.changed,
-        input.note,
-        input.reverts ?? null,
-        input.now,
-    ]);
-    return toAction(rows[0]);
+/** Gmail's own name for inbox membership, as X-GM-LABELS spells it. */
+export const GMAIL_INBOX_LABEL = '\\Inbox';
+/**
+ * On Gmail, a folder that is a label the owner made: not INBOX and not one
+ * of Gmail's own (All Mail, Trash, Spam, Sent, Drafts, Starred, Important).
+ */
+export function isUserLabel(facts, name) {
+    if (!facts.gmail || name.toUpperCase() === INBOX)
+        return false;
+    const info = facts.listing.find((f) => f.name === name);
+    if (!info)
+        return false;
+    return !attributesOf(info).some((a) => a.startsWith('\\') && a !== '\\hasnochildren' && a !== '\\haschildren');
+}
+/** Labels without Gmail's inbox marker, deduplicated, in a stable order. */
+function plainLabels(labels) {
+    return [...new Set((labels ?? []).filter((l) => l !== GMAIL_INBOX_LABEL))].sort();
+}
+function skippedWords(reasons) {
+    return [...reasons.entries()].map(([why, n]) => `${n} ${why}`).join(', ');
 }
 /**
  * Carry out one change on one account's server, keep the rows in step, and
- * write it on the trail.
+ * write it on the trail — intent first: the row exists, `pending`, before the
+ * first command, each folder's messages are on it as `planned` before that
+ * folder's command and `done` after it, so a crash between the server change
+ * and the record leaves a row the next poll reconciles (`reconcileTrail`).
  *
  * Messages no longer where buddi last saw them are skipped, never guessed at,
  * and the note says how many. Nothing is recorded when nothing changed.
@@ -387,11 +525,26 @@ export async function performAction(db, client, input) {
         if (n > 0)
             reasons.set(why, (reasons.get(why) ?? 0) + n);
     };
-    // Whatever the server already did stays on the trail even if a later
-    // folder fails (a dropped connection, a lookup): the change is recorded as
-    // partial, with the error, and the error is thrown on.
+    // A message the poll found gone from its folder has no place on the server
+    // buddi knows: it was moved or deleted in another app.
+    const live = targets.filter((t) => !t.gone);
+    for (const t of targets)
+        if (t.gone)
+            skip('moved or deleted in another mail app');
+    if (live.length === 0) {
+        return { action: null, changed: 0, skipped: targets.length, note: `Nothing changed in ${account.address} (${skippedWords(reasons)}).` };
+    }
+    const trailId = await beginTrail(db, {
+        accountId: account.id,
+        kind,
+        destination,
+        provenance: input.provenance,
+        messageIds: live.map((t) => t.id),
+        now: input.now,
+    });
+    const save = () => saveTrail(db, trailId, items);
     try {
-        for (const [folder, group] of byFolder(targets)) {
+        for (const [folder, group] of byFolder(live)) {
             const here = await locate(client, folder, group);
             skip(`no longer in ${folder}`, group.length - here.size);
             const present = group.filter((t) => here.has(t.id));
@@ -403,16 +556,21 @@ export async function performAction(db, client, input) {
                 skip(seen ? 'already read' : 'already unread', present.length - change.length);
                 if (change.length === 0)
                     continue;
-                await client.storeFlags(folder, change.map((t) => here.get(t.id).uid), [SEEN], seen ? 'add' : 'remove');
-                for (const t of change) {
+                const planned = change.map((t) => {
                     const at = here.get(t.id);
-                    items.push({
+                    return {
                         id: t.id, subject: t.subject, from: t.from, messageId: t.messageId,
                         fromFolder: folder, fromUidValidity: t.uidValidity > 0 ? t.uidValidity : 0, fromUid: at.uid,
-                        prevFlags: at.flags,
-                    });
-                }
+                        prevFlags: at.flags, wantSeen: seen, status: 'planned',
+                    };
+                });
+                items.push(...planned);
+                await save();
+                await client.storeFlags(folder, change.map((t) => here.get(t.id).uid), [SEEN], seen ? 'add' : 'remove');
+                for (const p of planned)
+                    p.status = 'done';
                 await setSeenLocally(db, change.map((t) => t.id), seen);
+                await save();
                 continue;
             }
             // A move of some kind. Already there is not a change.
@@ -424,82 +582,77 @@ export async function performAction(db, client, input) {
             }
             if (movable.length === 0)
                 continue;
+            /*
+             * Gmail, from the inbox to a label: the label goes on and Inbox comes
+             * off (X-GM-LABELS), so every other label stays exactly as it was.
+             * Anywhere else a MOVE (from another label it swaps that label for the
+             * new one, which is what moving between labels means).
+             */
+            const labelMove = kind === 'move' && facts.gmail && folder.toUpperCase() === INBOX && isUserLabel(facts, destination);
             const source = await client.open(folder);
-            const labels = facts.gmail && kind === 'trash'
+            const labels = facts.gmail && (kind === 'trash' || labelMove)
                 ? await client.fetchLabels(folder, movable.map((t) => here.get(t.id).uid))
                 : new Map();
             const moved = movable.map((t) => ({ target: t, uid: here.get(t.id).uid }));
-            const result = await client.move(folder, moved.map((m) => m.uid), destination);
-            // The server has moved them: on the trail now, refined below. Should the
-            // landing lookup fail, each row still follows to the destination with its
-            // uid unknown (found by Message-ID next time), so undo can find it.
-            const pushed = moved.map((m) => {
-                const item = {
-                    id: m.target.id, subject: m.target.subject, from: m.target.from, messageId: m.target.messageId,
-                    fromFolder: folder, fromUidValidity: source.uidValidity, fromUid: m.uid,
-                    toFolder: destination, toUidValidity: 0, toUid: null,
-                    prevFlags: here.get(m.target.id).flags,
-                    ...(labels.has(m.uid) ? { prevLabels: labels.get(m.uid) } : {}),
-                };
-                items.push(item);
-                return item;
-            });
-            const destId = await folderRow(db, account.id, destination);
+            const pushed = moved.map((m) => ({
+                id: m.target.id, subject: m.target.subject, from: m.target.from, messageId: m.target.messageId,
+                fromFolder: folder, fromUidValidity: source.uidValidity, fromUid: m.uid,
+                toFolder: destination, toUidValidity: 0, toUid: null,
+                prevFlags: here.get(m.target.id).flags,
+                ...(labels.has(m.uid) ? { prevLabels: plainLabels(labels.get(m.uid)) } : {}),
+                ...(labelMove ? { via: 'labels' } : {}),
+                status: 'planned',
+            }));
+            items.push(...pushed);
+            await save();
+            let result;
+            const uids = moved.map((m) => m.uid);
+            if (labelMove) {
+                await client.storeLabels(folder, uids, [destination], 'add');
+                await client.storeLabels(folder, uids, [GMAIL_INBOX_LABEL], 'remove');
+                result = { uidValidity: null, uidMap: new Map() };
+            }
+            else {
+                result = await client.move(folder, uids, destination);
+            }
+            // The server has moved them: done, refined below. Should the landing
+            // lookup fail, each row still follows to the destination with its uid
+            // unknown (found by Message-ID next time), so undo can find it.
+            for (const p of pushed)
+                p.status = 'done';
+            const labelsAfter = (m) => labelMove ? plainLabels([...(labels.get(m.uid) ?? []), destination]) : facts.gmail && kind === 'trash' ? [] : undefined;
+            const destId = await folderRow(db, account.id, destination, specialUseOf(facts.listing, destination));
             let where;
             try {
                 where = await landed(client, destination, moved, result);
             }
             catch (err) {
                 for (const m of moved)
-                    await relocateRow(db, m.target, destId, null, null);
+                    await relocateRow(db, m.target, destId, null, null, labelsAfter(m));
                 throw err;
             }
             for (const [i, m] of moved.entries()) {
                 const newUid = where.uids.get(m.target.id) ?? null;
-                await relocateRow(db, m.target, destId, newUid === null ? null : where.uidValidity, newUid);
+                await relocateRow(db, m.target, destId, newUid === null ? null : where.uidValidity, newUid, labelsAfter(m));
                 pushed[i].toUidValidity = where.uidValidity ?? 0;
                 pushed[i].toUid = newUid;
             }
+            await save();
         }
     }
     catch (err) {
-        if (items.length > 0) {
-            const why = err instanceof Error ? err.message : String(err);
-            const skippedNote = [...reasons.entries()].map(([r, n]) => `${n} ${r}`).join(', ');
-            await recordAction(db, {
-                accountId: account.id,
-                kind,
-                destination,
-                provenance: input.provenance,
-                messageIds: items.map((i) => i.id),
-                items,
-                changed: items.length,
-                note: `Partial: stopped by an error after ${plural(items.length, 'message')}: ${why}.${skippedNote ? ` Skipped ${skippedNote}.` : ''}`,
-                now: input.now,
-            }).catch(() => { });
-        }
+        await finishTrail(db, trailId, items, { error: err, skippedNote: skippedWords(reasons) }).catch(() => { });
         throw err;
     }
     const skipped = [...reasons.values()].reduce((a, b) => a + b, 0);
-    const skippedNote = [...reasons.entries()].map(([why, n]) => `${n} ${why}`).join(', ');
-    const done = `${verbOf(kind, destination)}: ${plural(items.length, 'message')} in ${account.address}`;
-    const note = items.length === 0
+    const skippedNote = skippedWords(reasons);
+    const action = await finishTrail(db, trailId, items, { skippedNote });
+    const changed = action?.changed ?? 0;
+    const done = `${verbOf(kind, destination)}: ${plural(changed, 'message')} in ${account.address}`;
+    const note = changed === 0
         ? `Nothing changed in ${account.address}${skippedNote ? ` (${skippedNote})` : ''}.`
         : `${done}.${skippedNote ? ` Skipped ${skippedNote}.` : ''}${kind === 'trash' ? ' They are in Trash, not deleted; undo puts them back while they are still there.' : ' Undo puts them back.'}`;
-    if (items.length === 0)
-        return { action: null, changed: 0, skipped, note };
-    const action = await recordAction(db, {
-        accountId: account.id,
-        kind,
-        destination,
-        provenance: input.provenance,
-        messageIds: items.map((i) => i.id),
-        items,
-        changed: items.length,
-        note: skippedNote ? `Skipped ${skippedNote}.` : null,
-        now: input.now,
-    });
-    return { action, changed: items.length, skipped, note };
+    return { action, changed, skipped, note };
 }
 /* ------------------------------------------------------------------ *
  * Undo
@@ -512,38 +665,81 @@ export async function findAction(db, id) {
 export async function lastUndoable(db, accountIds) {
     const { rows } = await db.query(`select ${ACTION_COLUMNS} from email.mailbox_actions
       where account_id = any($1::uuid[]) and kind <> 'undo' and undone_at is null
+        and state <> 'pending' and changed > 0
       order by created_at desc, seq desc limit 1`, [accountIds]);
     return rows[0] ? toAction(rows[0]) : null;
 }
+/** The messages of a change an undo can still put back: done, and not put back already. */
+export function undoableItems(action) {
+    const reverted = new Set(action.revertedIds);
+    return action.items.filter((i) => statusOf(i) === 'done' && !reverted.has(i.id));
+}
 /** Why a change cannot be undone, or null when it can. */
 export function undoRefusal(action) {
     if (action.kind === 'undo')
         return 'That was itself an undo; buddi does not undo an undo. Make the change again instead.';
     if (action.undoneAt)
         return `That change was already undone (${action.undoneAt}).`;
+    if (action.state === 'pending') {
+        return 'buddi stopped while making that change, and has not yet checked with the server how far it got. It does on its next poll; undo it after that.';
+    }
+    if (undoableItems(action).length === 0)
+        return 'Nothing of that change is left to put back.';
     return null;
 }
+/**
+ * How many of a change's messages buddi has seen move since, in another mail
+ * app: gone from the folder the change left them in, or now somewhere else.
+ * An undo leaves those where the owner put them.
+ */
+export async function movedSince(db, action) {
+    const items = undoableItems(action);
+    if (items.length === 0)
+        return 0;
+    const { rows } = await db.query(`select m.id, f.name as folder, m.gone_at from email.messages m join email.folders f on f.id = m.folder_id
+      where m.id = any($1::uuid[])`, [items.map((i) => i.id)]);
+    const byId = new Map(rows.map((r) => [String(r.id), r]));
+    let n = 0;
+    for (const item of items) {
+        const row = byId.get(item.id);
+        if (!row)
+            continue;
+        if (row.gone_at !== null && row.gone_at !== undefined)
+            n += 1;
+        else if (item.toFolder && row.folder !== item.toFolder)
+            n += 1;
+    }
+    return n;
+}
 /** The sentence an undo's approval and the Recent changes row say. */
-export function describeUndo(action, account) {
-    const n = plural(action.changed, 'message');
+export function describeUndo(action, account, moved = 0) {
+    const left = undoableItems(action).length;
+    const n = plural(left, 'message');
+    const rest = action.revertedIds.length > 0 ? ' the rest of' : '';
+    const since = moved > 0
+        ? ` ${plural(moved, 'of them has', 'of them have')} since been moved in another mail app and will stay where ${moved === 1 ? 'it is' : 'they are'}.`
+        : '';
     switch (action.kind) {
         case 'mark-read':
-            return `Undo "${verbOf(action.kind)}" on ${n} in ${account}: they become unread again.`;
+            return `Undo${rest} "${verbOf(action.kind)}" on ${n} in ${account}: they become unread again.${since}`;
         case 'mark-unread':
-            return `Undo "${verbOf(action.kind)}" on ${n} in ${account}: they become read again.`;
+            return `Undo${rest} "${verbOf(action.kind)}" on ${n} in ${account}: they become read again.${since}`;
         case 'trash':
-            return `Undo "${verbOf(action.kind)}" on ${n} in ${account}: they move back from Trash to where they were (any already emptied from Trash cannot come back).`;
+            return `Undo${rest} "${verbOf(action.kind)}" on ${n} in ${account}: they move back from Trash to where they were (any already emptied from Trash cannot come back).${since}`;
         default:
-            return `Undo "${verbOf(action.kind, action.destination)}" on ${n} in ${account}: they move back to where they were.`;
+            return `Undo${rest} "${verbOf(action.kind, action.destination)}" on ${n} in ${account}: they move back to where they were.${since}`;
     }
 }
 /**
  * Put one change back, as far as the mailbox still allows, and record the
- * undo as a change of its own.
+ * undo as a change of its own — intent first, like `performAction`.
  *
  * Each message is acted on where buddi's row says it is now — the row
- * followed it — and only if the server still has it there: a message emptied
- * from Trash, or moved again in another client, is skipped and counted.
+ * followed it — and only if that is still where the change left it: one the
+ * poll saw moved in another mail app is left where the owner put it, and one
+ * emptied from Trash is skipped; the note says which. An undo stopped by an
+ * error records what it put back, is marked partial, and leaves the change
+ * undoable for the rest.
  */
 export async function undoAction(db, client, input) {
     const { account, action } = input;
@@ -551,106 +747,353 @@ export async function undoAction(db, client, input) {
     if (refusal)
         throw new MailboxRefusal(refusal);
     const facts = await serverFacts(client);
-    const current = await loadTargets(db, action.items.map((i) => i.id));
-    const itemOf = new Map(action.items.map((i) => [i.id, i]));
+    const wanted = undoableItems(action);
+    const current = await loadTargets(db, wanted.map((i) => i.id));
+    const itemOf = new Map(wanted.map((i) => [i.id, i]));
     const items = [];
-    let skipped = action.items.length - current.length;
-    for (const [folder, group] of byFolder(current)) {
-        const here = await locate(client, folder, group);
-        skipped += group.length - here.size;
-        const present = group.filter((t) => here.has(t.id));
-        if (present.length === 0)
-            continue;
-        if (action.kind === 'mark-read' || action.kind === 'mark-unread') {
-            const restoreSeen = present.filter((t) => (itemOf.get(t.id).prevFlags ?? []).includes(SEEN));
-            const restoreUnseen = present.filter((t) => !(itemOf.get(t.id).prevFlags ?? []).includes(SEEN));
-            if (restoreSeen.length > 0) {
-                await client.storeFlags(folder, restoreSeen.map((t) => here.get(t.id).uid), [SEEN], 'add');
-                await setSeenLocally(db, restoreSeen.map((t) => t.id), true);
-            }
-            if (restoreUnseen.length > 0) {
-                await client.storeFlags(folder, restoreUnseen.map((t) => here.get(t.id).uid), [SEEN], 'remove');
-                await setSeenLocally(db, restoreUnseen.map((t) => t.id), false);
+    const reasons = new Map();
+    const skip = (why, n = 1) => {
+        if (n > 0)
+            reasons.set(why, (reasons.get(why) ?? 0) + n);
+    };
+    skip('no longer known to buddi', wanted.length - current.length);
+    const isMove = action.kind !== 'mark-read' && action.kind !== 'mark-unread';
+    const eligible = current.filter((t) => {
+        const item = itemOf.get(t.id);
+        if (t.gone || (isMove && item.toFolder && t.folder !== item.toFolder)) {
+            skip('moved in another mail app since, so left where you put it');
+            return false;
+        }
+        return true;
+    });
+    const summary = (changed) => {
+        const skipped = [...reasons.values()].reduce((a, b) => a + b, 0);
+        const why = skippedWords(reasons);
+        return changed === 0
+            ? `Nothing could be put back in ${account.address}${skipped > 0 ? ` (${why})` : ''}.`
+            : `Undid "${verbOf(action.kind, action.destination)}" on ${plural(changed, 'message')} in ${account.address}.${skipped > 0 ? ` ${plural(skipped, 'message')} could not be put back: ${why}.` : ''}`;
+    };
+    if (eligible.length === 0) {
+        return { action: null, changed: 0, skipped: [...reasons.values()].reduce((a, b) => a + b, 0), note: summary(0) };
+    }
+    const trailId = await beginTrail(db, {
+        accountId: account.id,
+        kind: 'undo',
+        destination: null,
+        provenance: input.provenance,
+        messageIds: eligible.map((t) => t.id),
+        reverts: action.id,
+        now: input.now,
+    });
+    const save = () => saveTrail(db, trailId, items);
+    const doneIds = () => items.filter((i) => statusOf(i) === 'done').map((i) => i.id);
+    try {
+        for (const [folder, group] of byFolder(eligible)) {
+            const here = await locate(client, folder, group);
+            skip('no longer where the change left it', group.length - here.size);
+            const present = group.filter((t) => here.has(t.id));
+            if (present.length === 0)
+                continue;
+            if (!isMove) {
+                for (const seen of [true, false]) {
+                    const list = present.filter((t) => (itemOf.get(t.id).prevFlags ?? []).includes(SEEN) === seen);
+                    if (list.length === 0)
+                        continue;
+                    const planned = list.map((t) => ({
+                        id: t.id, subject: t.subject, from: t.from, messageId: t.messageId,
+                        fromFolder: folder, fromUidValidity: t.uidValidity, fromUid: here.get(t.id).uid,
+                        prevFlags: here.get(t.id).flags, wantSeen: seen, status: 'planned',
+                    }));
+                    items.push(...planned);
+                    await save();
+                    await client.storeFlags(folder, list.map((t) => here.get(t.id).uid), [SEEN], seen ? 'add' : 'remove');
+                    for (const p of planned)
+                        p.status = 'done';
+                    await setSeenLocally(db, list.map((t) => t.id), seen);
+                    await save();
+                }
+                continue;
             }
+            // Moves: back to each message's own original folder.
+            const back = new Map();
             for (const t of present) {
-                items.push({
-                    id: t.id, subject: t.subject, from: t.from, messageId: t.messageId,
-                    fromFolder: folder, fromUidValidity: t.uidValidity, fromUid: here.get(t.id).uid,
-                    prevFlags: here.get(t.id).flags,
-                });
+                const original = itemOf.get(t.id).fromFolder;
+                if (original === folder) {
+                    skip('already back where it was');
+                    continue;
+                }
+                const list = back.get(original) ?? [];
+                list.push(t);
+                back.set(original, list);
             }
-            continue;
-        }
-        // Moves: back to each message's own original folder.
-        const back = new Map();
-        for (const t of present) {
-            const original = itemOf.get(t.id).fromFolder;
-            if (original === folder) {
-                skipped += 1;
-                continue;
+            for (const [original, list] of back) {
+                if (!facts.listing.some((f) => f.name === original)) {
+                    skip(`its old folder ${original} is gone`, list.length);
+                    continue;
+                }
+                const source = await client.open(folder);
+                const viaLabels = list.filter((t) => facts.gmail && itemOf.get(t.id).via === 'labels' && original.toUpperCase() === INBOX);
+                const viaMove = list.filter((t) => !viaLabels.includes(t));
+                const destId = await folderRow(db, account.id, original, specialUseOf(facts.listing, original));
+                if (viaMove.length > 0) {
+                    const moved = viaMove.map((t) => ({ target: t, uid: here.get(t.id).uid }));
+                    const pushed = moved.map((m) => ({
+                        id: m.target.id, subject: m.target.subject, from: m.target.from, messageId: m.target.messageId,
+                        fromFolder: folder, fromUidValidity: source.uidValidity, fromUid: m.uid,
+                        toFolder: original, toUidValidity: 0, toUid: null, status: 'planned',
+                    }));
+                    items.push(...pushed);
+                    await save();
+                    const result = await client.move(folder, moved.map((m) => m.uid), original);
+                    for (const p of pushed)
+                        p.status = 'done';
+                    const where = await landed(client, original, moved, result);
+                    for (const [i, m] of moved.entries()) {
+                        const newUid = where.uids.get(m.target.id) ?? null;
+                        const prev = itemOf.get(m.target.id).prevLabels;
+                        await relocateRow(db, m.target, destId, newUid === null ? null : where.uidValidity, newUid, facts.gmail && prev ? plainLabels(prev) : undefined);
+                        pushed[i].toUidValidity = where.uidValidity ?? 0;
+                        pushed[i].toUid = newUid;
+                    }
+                    // Gmail drops a message's labels in Trash: give back the ones it had.
+                    if (facts.gmail) {
+                        const byLabels = new Map();
+                        for (const m of moved) {
+                            const prev = plainLabels(itemOf.get(m.target.id).prevLabels);
+                            const uid = where.uids.get(m.target.id);
+                            if (prev.length === 0 || uid === null || uid === undefined)
+                                continue;
+                            const key = JSON.stringify(prev);
+                            byLabels.set(key, [...(byLabels.get(key) ?? []), uid]);
+                        }
+                        for (const [key, uids] of byLabels)
+                            await client.addLabels(original, uids, JSON.parse(key));
+                    }
+                    await save();
+                }
+                if (viaLabels.length > 0) {
+                    await undoLabelMove(db, client, { folder, original, destId, source, list: viaLabels, here, itemOf, items, save });
+                }
             }
-            const list = back.get(original) ?? [];
-            list.push(t);
-            back.set(original, list);
         }
-        for (const [original, list] of back) {
-            if (!facts.listing.some((f) => f.name === original)) {
-                skipped += list.length;
+    }
+    catch (err) {
+        const undo = await finishTrail(db, trailId, items, { error: err, skippedNote: skippedWords(reasons) }).catch(() => null);
+        await markReverted(db, action, doneIds(), false, undo?.id ?? null, input.now).catch(() => { });
+        throw err;
+    }
+    const undo = await finishTrail(db, trailId, items, { skippedNote: skippedWords(reasons) });
+    const changed = undo?.changed ?? 0;
+    if (undo)
+        await markReverted(db, action, doneIds(), true, undo.id, input.now);
+    return { action: undo, changed, skipped: [...reasons.values()].reduce((a, b) => a + b, 0), note: summary(changed) };
+}
+/**
+ * Undo a Gmail label move exactly: the labels the message had before come
+ * back, any added since go, and Inbox goes back on — over X-GM-LABELS, so the
+ * message never passes through a MOVE that would drop one. The label it was
+ * moved to comes off last, from the inbox copy, so the message is never
+ * without a home in between.
+ */
+async function undoLabelMove(db, client, input) {
+    const { folder, original, list, here, itemOf, items, save } = input;
+    const uidOf = (t) => here.get(t.id).uid;
+    const now = await client.fetchLabels(folder, list.map(uidOf));
+    // One set of commands per distinct (before, now): usually all of them.
+    const groups = new Map();
+    for (const t of list) {
+        const prev = plainLabels(itemOf.get(t.id).prevLabels);
+        const current = plainLabels(now.get(uidOf(t)));
+        const key = JSON.stringify([prev, current]);
+        const g = groups.get(key) ?? { prev, current, targets: [] };
+        g.targets.push(t);
+        groups.set(key, g);
+    }
+    for (const { prev, current, targets } of groups.values()) {
+        const pushed = targets.map((t) => ({
+            id: t.id, subject: t.subject, from: t.from, messageId: t.messageId,
+            fromFolder: folder, fromUidValidity: input.source.uidValidity, fromUid: uidOf(t),
+            toFolder: original, toUidValidity: 0, toUid: null, prevLabels: current, via: 'labels', status: 'planned',
+        }));
+        items.push(...pushed);
+        await save();
+        const uids = targets.map(uidOf);
+        const add = prev.filter((l) => !current.includes(l));
+        const remove = current.filter((l) => !prev.includes(l) && l !== folder);
+        if (add.length > 0)
+            await client.storeLabels(folder, uids, add, 'add');
+        if (remove.length > 0)
+            await client.storeLabels(folder, uids, remove, 'remove');
+        await client.storeLabels(folder, uids, [GMAIL_INBOX_LABEL], 'add');
+        for (const p of pushed)
+            p.status = 'done';
+        // Back in the inbox; now find each one there and take the moved-to label off.
+        const status = await client.open(original);
+        for (const [i, t] of targets.entries()) {
+            const uid = t.messageId ? await client.findByMessageId(original, t.messageId) : null;
+            if (uid !== null && !prev.includes(folder))
+                await client.storeLabels(original, [uid], [folder], 'remove');
+            await relocateRow(db, t, input.destId, uid === null ? null : status.uidValidity, uid, prev);
+            pushed[i].toUidValidity = uid === null ? 0 : status.uidValidity;
+            pushed[i].toUid = uid;
+        }
+        await save();
+    }
+}
+/* ------------------------------------------------------------------ *
+ * After a crash: what the server says happened
+ * ------------------------------------------------------------------ */
+/**
+ * Settle the `pending` trail rows a stopped process left for this account:
+ * for each message planned and never confirmed, ask the server by Message-ID
+ * where it is. Still where it was: it did not happen — the item goes. In
+ * the destination: it happened — the row follows and the item is done.
+ * Neither, or no Message-ID to ask with: unknown. The row becomes `done`, `partial`
+ * (something did not happen) or `unknown`, or goes when nothing happened. An
+ * interrupted undo puts what it did on its change's `reverted_ids`.
+ */
+export async function reconcileTrail(db, client, input) {
+    const { rows } = await db.query(`select ${ACTION_COLUMNS} from email.mailbox_actions
+      where account_id = $1 and state = 'pending' and not (id = any($2::uuid[]))
+      order by created_at, seq`, [input.account.id, trailInFlight()]);
+    if (rows.length === 0)
+        return { settled: 0 };
+    const facts = await serverFacts(client);
+    let settled = 0;
+    for (const action of rows.map(toAction)) {
+        const items = action.items.map((i) => ({ ...i }));
+        let dropped = 0;
+        for (const item of items) {
+            if (statusOf(item) !== 'planned')
+                continue;
+            const target = (await loadTargets(db, [item.id]))[0];
+            if (item.toFolder) {
+                /*
+                 * Gmail's label move is two commands — the label on, then Inbox off
+                 * (an undo: the labels back, Inbox on, then the label off) — and a
+                 * crash between them leaves the message where it was *and* changed.
+                 * The Inbox step is the move itself, so a half-done one is finished
+                 * here: its second command is sent, and the item goes on as done.
+                 */
+                if (facts.gmail && item.via === 'labels' && item.messageId) {
+                    await finishLabelMove(db, client, action, item);
+                }
+                // Where it was first: on Gmail, All Mail also holds what is still
+                // in the inbox, so "found in the destination" alone proves nothing.
+                const stayed = item.messageId ? await client.findByMessageId(item.fromFolder, item.messageId) : null;
+                if (stayed !== null) {
+                    item.status = 'dropped';
+                    dropped += 1;
+                    continue;
+                }
+                const there = item.messageId ? await client.findByMessageId(item.toFolder, item.messageId) : null;
+                if (there !== null) {
+                    const status = await client.open(item.toFolder);
+                    item.status = 'done';
+                    item.toUidValidity = status.uidValidity;
+                    item.toUid = there;
+                    if (target) {
+                        const destId = await folderRow(db, input.account.id, item.toFolder, specialUseOf(facts.listing, item.toFolder));
+                        let labels;
+                        if (facts.gmail)
+                            labels = plainLabels((await client.fetchLabels(item.toFolder, [there])).get(there));
+                        await relocateRow(db, target, destId, status.uidValidity, there, labels);
+                    }
+                    continue;
+                }
+                item.status = 'unknown';
                 continue;
             }
-            const source = await client.open(folder);
-            const moved = list.map((t) => ({ target: t, uid: here.get(t.id).uid }));
-            const result = await client.move(folder, moved.map((m) => m.uid), original);
-            const where = await landed(client, original, moved, result);
-            const destId = await folderRow(db, account.id, original);
-            for (const m of moved) {
-                const newUid = where.uids.get(m.target.id) ?? null;
-                await relocateRow(db, m.target, destId, newUid === null ? null : where.uidValidity, newUid);
-                items.push({
-                    id: m.target.id, subject: m.target.subject, from: m.target.from, messageId: m.target.messageId,
-                    fromFolder: folder, fromUidValidity: source.uidValidity, fromUid: m.uid,
-                    toFolder: original, toUidValidity: where.uidValidity ?? 0, toUid: newUid,
-                });
+            // A flag change: is the read mark what the change wanted?
+            const status = await client.open(item.fromFolder);
+            let uid = item.fromUidValidity === status.uidValidity && item.fromUid > 0 ? item.fromUid : null;
+            if (uid === null && item.messageId)
+                uid = await client.findByMessageId(item.fromFolder, item.messageId);
+            const flags = uid === null ? undefined : (await client.fetchFlags(item.fromFolder, [uid]))[0]?.flags;
+            if (!flags) {
+                item.status = 'unknown';
             }
-            // Gmail drops a message's labels in Trash: give back the ones it had.
-            if (facts.gmail) {
-                const byLabels = new Map();
-                for (const m of moved) {
-                    const prev = itemOf.get(m.target.id).prevLabels ?? [];
-                    const uid = where.uids.get(m.target.id);
-                    if (prev.length === 0 || uid === null || uid === undefined)
-                        continue;
-                    const key = JSON.stringify([...prev].sort());
-                    byLabels.set(key, [...(byLabels.get(key) ?? []), uid]);
-                }
-                for (const [key, uids] of byLabels)
-                    await client.addLabels(original, uids, JSON.parse(key));
+            else if (flags.includes(SEEN) === (item.wantSeen ?? action.kind === 'mark-read')) {
+                item.status = 'done';
+                if (target)
+                    await setSeenLocally(db, [target.id], flags.includes(SEEN));
+            }
+            else {
+                item.status = 'dropped';
+                dropped += 1;
+            }
+        }
+        const kept = items.filter((i) => statusOf(i) !== 'dropped');
+        const done = kept.filter((i) => statusOf(i) === 'done');
+        const unknown = kept.filter((i) => statusOf(i) === 'unknown');
+        if (done.length === 0 && unknown.length === 0) {
+            await db.query(`delete from email.mailbox_actions where id = $1`, [action.id]);
+        }
+        else {
+            const state = unknown.length > 0 ? 'unknown' : dropped > 0 ? 'partial' : 'done';
+            const note = `buddi stopped while making this change; checked with the server afterwards: ${plural(done.length, 'message')} changed` +
+                (dropped > 0 ? `, ${dropped} not` : '') +
+                (unknown.length > 0 ? `, ${unknown.length} could not be confirmed (not found where it was or where it was going)` : '') +
+                '.';
+            await db.query(`update email.mailbox_actions set state = $2, note = $3, items = $4::jsonb, message_ids = $5::uuid[], changed = $6 where id = $1`, [action.id, state, note, JSON.stringify(kept), kept.map((i) => i.id), done.length]);
+            if (action.kind === 'undo' && action.reverts) {
+                const original = await findAction(db, action.reverts);
+                if (original)
+                    await markReverted(db, original, done.map((i) => i.id), false, null, input.now);
             }
         }
+        settled += 1;
     }
-    const note = items.length === 0
-        ? `Nothing could be put back in ${account.address}${skipped > 0 ? ` (${plural(skipped, 'message')} no longer where the change left ${skipped === 1 ? 'it' : 'them'})` : ''}.`
-        : `Undid "${verbOf(action.kind, action.destination)}" on ${plural(items.length, 'message')} in ${account.address}.${skipped > 0 ? ` ${plural(skipped, 'message')} could not be put back: no longer where the change left ${skipped === 1 ? 'it' : 'them'}.` : ''}`;
-    if (items.length === 0)
-        return { action: null, changed: 0, skipped, note };
-    const undo = await recordAction(db, {
-        accountId: account.id,
-        kind: 'undo',
-        destination: null,
-        provenance: input.provenance,
-        messageIds: items.map((i) => i.id),
-        items,
-        changed: items.length,
-        note: skipped > 0 ? `${plural(skipped, 'message')} could not be put back.` : null,
-        reverts: action.id,
-        now: input.now,
-    });
-    await db.query(`update email.mailbox_actions set undone_at = $2, undone_by = $3 where id = $1`, [
-        action.id,
-        input.now,
-        undo.id,
-    ]);
-    return { action: undo, changed: items.length, skipped, note };
+    return { settled };
+}
+/**
+ * A Gmail label move (or its undo) a stopped process left between its two
+ * commands, finished from what the server says (X-GM-LABELS):
+ *
+ *  - a move (Inbox → label): still in the inbox but already carrying the
+ *    label it did not have before — Inbox comes off;
+ *  - an undo (label → Inbox): already back in the inbox but still carrying
+ *    the label it was moved to — the label comes off, unless the message
+ *    had it before the original move.
+ *
+ * Anything else is left for the ordinary check (never happened, happened,
+ * or unknown). A message the owner touched since cannot be told apart, so
+ * only the exact half-done shape is finished.
+ */
+async function finishLabelMove(db, client, action, item) {
+    const toInbox = item.toFolder.toUpperCase() === INBOX;
+    const uid = await client.findByMessageId(INBOX, item.messageId);
+    if (uid === null)
+        return;
+    const labels = plainLabels((await client.fetchLabels(INBOX, [uid])).get(uid));
+    if (!toInbox) {
+        const before = plainLabels(item.prevLabels);
+        if (labels.includes(item.toFolder) && !before.includes(item.toFolder)) {
+            await client.storeLabels(INBOX, [uid], [GMAIL_INBOX_LABEL], 'remove');
+        }
+        return;
+    }
+    if (!labels.includes(item.fromFolder))
+        return;
+    const original = action.reverts ? await findAction(db, action.reverts) : null;
+    const before = original?.items.find((i) => i.id === item.id)?.prevLabels;
+    if (before === undefined || plainLabels(before).includes(item.fromFolder))
+        return;
+    await client.storeLabels(INBOX, [uid], [item.fromFolder], 'remove');
+}
+/**
+ * The poll's half of intent-first: when this account has `pending` trail rows
+ * no change in this process is writing, open a writer and settle them
+ * (`reconcileTrail`). One cheap query when there are none.
+ */
+export async function reconcilePendingChanges(ctx, account, opts) {
+    const db = ctx.buddi.db;
+    const { rows } = await db.query(`select 1 from email.mailbox_actions
+      where account_id = $1 and state = 'pending' and not (id = any($2::uuid[])) limit 1`, [account.id, trailInFlight()]);
+    if (rows.length === 0)
+        return 0;
+    const { settled } = await withWriter(ctx, account, opts, (client) => reconcileTrail(db, client, { account, now: ctx.buddi.clock.now() }));
+    return settled;
 }
 /** The newest changes, for the Mail page's Recent changes. */
 export async function recentActions(db, accountIds, limit = 20) {