fix(hooks): keep inbox on mail that was sent AND received

notmuch deduplicates by Message-ID, so mail the user sends to another of
their own accounts is one message with two files: the sender's Sent copy
and the recipient's Inbox copy. The carve-out matched on a file's path
and tagged the message, so matching the Sent copy stripped inbox from
the copy that had genuinely arrived and the mail was missing from the
account that received it.

sent_only() keeps a message only when EVERY file is inside a sent
folder, which is what the docstring already claimed the predicate did.
It is a loop because no query can express it: measured against a
two-file message, `not path:` does not exclude it, and `count
--output=files` reports every file of every matching message rather
than the files that matched. Both read as if they worked, and are wrong
for the same reason, that a notmuch term is a predicate over a message
while this distinction is between its files.

The root comes from database.mail_root rather than database.path, since
this index is split and no message file is under the index directory. A
test fixture with the index outside the mail root covers it; the
ordinary layout cannot, because both keys return the same string there.

Both mutations fail: all->any loses inbox on the self-addressed message,
mail_root->path silently stops stripping anything. Verified read-only
against the live index, tagging nothing: of 807 messages matching a sent
path, 780 are still stripped and 27 are spared, every one of them two
files with one in another account's inbox. No arrival is affected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HFuRPtzFrSxCQjFk6tq7gD

1 files changed, 87 insertions, 5 deletions

diff --git a/assets/hooks/test_post_new.py b/assets/hooks/test_post_new.py
index a0228aa..07728a6 100755
--- a/assets/hooks/test_post_new.py
+++ b/assets/hooks/test_post_new.py
@@ -38,6 +38,16 @@ from pathlib import Path
 HOOK = Path(__file__).resolve().parent / "post-new"
 
 
+def files(env, query):
+    """How many FILES notmuch holds for the messages matching a query, which
+    is not the message count: a message sent to another of the user's own
+    accounts is one message with two files."""
+    result = subprocess.run(
+        ["notmuch", "search", "--output=files", "--", query],
+        env=env, capture_output=True, text=True, check=True)
+    return len([line for line in result.stdout.splitlines() if line])
+
+
 def make_message(maildir, name, sender, subject):
     path = maildir / "new" / name
     path.write_text(
@@ -202,7 +212,7 @@ def test_a_protected_removal_is_skipped_whole_and_the_run_continues():
         assert count(env, "tag:new") == 0
 
 
-def setup_accounts(tmp, sent_config=True):
+def setup_accounts(tmp, sent_config=True, split_index=False):
     """A maildir laid out as qtmaildir configures it: two accounts, each with
     an Inbox and a Sent folder, one message in each.
 
@@ -232,10 +242,23 @@ def setup_accounts(tmp, sent_config=True):
                  "you@example.org", "something else sent")
 
     config = Path(tmp) / "notmuch-config"
-    config.write_text(
-        f"[database]\npath={root}\n\n"
-        f"[new]\ntags=new;unread;inbox\n\n"
-        f"[user]\nname=Test\nprimary_email=you@example.org\n")
+    if split_index:
+        # The index somewhere else entirely, which is how the developer's own
+        # machine runs: `database.path` is then the INDEX directory and no
+        # message file is inside it. Anything reading that key as the mail
+        # root resolves every path wrongly, and the ordinary layout above
+        # cannot show it because both keys return the same string.
+        index = Path(tmp) / "index"
+        index.mkdir()
+        config.write_text(
+            f"[database]\npath={index}\nmail_root={root}\n\n"
+            f"[new]\ntags=new;unread;inbox\n\n"
+            f"[user]\nname=Test\nprimary_email=you@example.org\n")
+    else:
+        config.write_text(
+            f"[database]\npath={root}\n\n"
+            f"[new]\ntags=new;unread;inbox\n\n"
+            f"[user]\nname=Test\nprimary_email=you@example.org\n")
 
     env = dict(os.environ)
     env["NOTMUCH_CONFIG"] = str(config)
@@ -284,6 +307,65 @@ def test_sent_mail_does_not_keep_the_inbox_tag():
         assert count(env, 'tag:inbox and path:"acct-two/Inbox/**"') == 1
 
 
+def test_a_message_that_was_sent_AND_received_keeps_inbox():
+    """Item 166. notmuch deduplicates by Message-ID, so mail the user sends
+    to their own other account is ONE message with TWO files: the sender's
+    Sent copy and the recipient's Inbox copy.
+
+    The carve-out matches on a file's path but tags the MESSAGE, so matching
+    the Sent copy stripped `inbox` from the Inbox copy as well and the mail
+    vanished from the account that genuinely received it. The predicate has
+    to hold for every file, not for any file.
+
+    The identical `name` is what makes this one message: make_message()
+    derives the Message-Id from it.
+    """
+    with tempfile.TemporaryDirectory() as tmp:
+        env = setup_accounts(tmp)
+        root = Path(tmp) / "Mail"
+        make_message(root / "acct-one/Sent", "self-addressed",
+                     "you@example.org", "to my other account")
+        make_message(root / "acct-two/Inbox", "self-addressed",
+                     "you@example.org", "to my other account")
+        subprocess.run(["notmuch", "new"], env=env, capture_output=True,
+                       check=True)
+        # One message, two files: the premise of the whole defect.
+        assert count(env, "id:self-addressed@example.org") == 1
+        assert files(env, "id:self-addressed@example.org") == 2
+
+        write_rules(env, [])
+        result = subprocess.run([str(HOOK)], env=env, capture_output=True,
+                                text=True)
+        assert result.returncode == 0, result.stderr
+
+        # It arrived, so it keeps `inbox`...
+        assert count(env, "tag:inbox and id:self-addressed@example.org") == 1
+        # ...and the ordinary sent message, whose only file is in a sent
+        # folder, still loses it. Without this half the fix could simply be
+        # "never strip anything".
+        assert count(env, "tag:inbox and id:sent-one@example.org") == 0
+
+
+def test_the_carve_out_works_with_the_index_split_from_the_mail():
+    """notmuch can hold the Xapian index outside the Maildir, and this user's
+    does. `database.path` is then the index directory, so a carve-out reading
+    that key as the mail root builds prefixes no message file is under, finds
+    every file "outside" the sent folders, and silently stops stripping
+    anything.
+
+    The ordinary fixture cannot catch it: with the index inside the mail root
+    both keys return the same string and either one passes.
+    """
+    with tempfile.TemporaryDirectory() as tmp:
+        env = setup_accounts(tmp, split_index=True)
+        write_rules(env, [])
+        result = subprocess.run([str(HOOK)], env=env, capture_output=True,
+                                text=True)
+        assert result.returncode == 0, result.stderr
+        assert count(env, 'tag:inbox and path:"acct-one/Sent/**"') == 0
+        assert count(env, 'tag:inbox and path:"acct-one/Inbox/**"') == 1
+
+
 def test_sent_mail_keeps_every_other_tag():
     """Only `inbox` is stripped. `unread` in particular must survive:
     maildir.synchronize_flags is true, so removing it rewrites Maildir