feat(queries): store saved queries in queries.json

First half of item 23. The storage moves out of the [queries] INI section into
~/.config/qtmaildir/queries.json; the UI that writes it comes next.

The INI could not express order. QSettings reads a section through childKeys(),
which sorts alphabetically and never follows the file, so the saved-query
buttons could not be arranged and config.cpp carried a comment saying a
hand-rolled parser would be needed to change that. queries.json is an ordered
array and nothing sorts it on load. That also makes room for the two fields the
save dialog needs: pinned, which decides whether a query is a button or a menu
entry, and account, which scopes it.

account stores the account KEY, not the maildir path, so it does not duplicate
config that already lives in the account section and go stale when the user
edits it. Config::resolvedQuery() composes through Account::scopedQuery(), whose
parentheses are load-bearing: path:... and a or b binds as (path:... and a) or
b, so an unparenthesised disjunction escapes its scope and matches every
account. A key naming an account that no longer exists resolves to the bare
query rather than a scope built from an empty maildir, which would be path:"/**"
and match everything.

Migration reads [queries] once, when queries.json is absent, marks every entry
pinned so the query row does not empty on the first launch after an upgrade, and
leaves the INI section untouched. Stripping it would mean rewriting a
hand-edited file with QSettings, which drops comments and key order across the
whole file.

The format follows rules.json in shape only: a version and unknown fields
preserved at both levels, so a file written by a later build survives a save
from this one. None of its two-implementation machinery is here, because queries
have exactly one reader; the version constant says so where a future reader will
look. A file whose version this build does not know is refused AND blocks the
save, so a newer document is never overwritten with a lossy reading of itself.

Twelve tests, each checked against a mutation that puts the corresponding bug
back: sorting on load fails three of them, stripping the INI section after
migration fails the byte-identical assertion, concatenating the scope without
parentheses fails the disjunction test, and dropping unknown-field preservation
fails the round trip. The migration test compares the INI file's BYTES rather
than re-reading it through QSettings, which would have passed against a rewrite
that kept every value while dropping the comments.

startup_query still resolves by name, but its fallback now returns the first
entry in the user's own order rather than the alphabetically first one. That is
user-visible for a config whose startup_query matches nothing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 65 insertions, 0 deletions

diff --git a/src/config.h b/src/config.h
index ea0b055..4211b0c 100644
--- a/src/config.h
+++ b/src/config.h
@@ -19,12 +19,15 @@
 #pragma once
 
 #include <QColor>
+#include <QJsonObject>
 #include <QList>
 #include <QString>
 #include <QStringList>
 
 #include "completionentry.h"
 
+class QSettings;
+
 /// One mail account. notmuch has no concept of accounts; it sees a single flat
 /// tree. An account is therefore a path prefix within that tree plus an
 /// identity.
@@ -96,10 +99,32 @@ struct Account
     QString draftsQuery() const;
 };
 
+/// A named query, stored in queries.json.
+///
+/// Stored as an ORDERED array, which is the whole reason the storage moved out
+/// of `[queries]`: QSettings reads a section through childKeys(), which sorts
+/// alphabetically and cannot express the order the buttons appear in.
 struct SavedQuery
 {
     QString name;
     QString query;
+
+    /// Renders as a button in the query row; otherwise it lives in the menu.
+    /// The two tiers are the point of the flag: a row that shows every saved
+    /// query does not scale past a handful.
+    bool pinned = false;
+
+    /// Account KEY, the INI group suffix ("work" from [account.work]), and
+    /// empty for a query that spans every account.
+    ///
+    /// A key rather than a maildir path: the path already lives in the account
+    /// section, and storing a second copy here would go stale the moment the
+    /// user edits it. Resolve through Config::resolvedQuery().
+    QString account;
+
+    /// Keys this build does not understand, preserved verbatim so a file
+    /// written by a later version survives a save from this one.
+    QJsonObject unknown;
 };
 
 /// Reads ~/.config/qtmaildir/qtmaildir.conf.
@@ -117,7 +142,32 @@ public:
 
     QList<Account> accounts() const { return m_accounts; }
     Account account(const QString &key) const;
+
+    /// In document order, which IS the display order. Never sort this.
     QList<SavedQuery> savedQueries() const { return m_savedQueries; }
+    void setSavedQueries(const QList<SavedQuery> &queries)
+    {
+        m_savedQueries = queries;
+    }
+
+    /// Path of queries.json, derived from the config file's own directory so a
+    /// test can point load() at a temporary tree and get both files there.
+    static QString queriesPath(const QString &configPath);
+
+    /// Writes queries.json. False when the file could not be written, or when
+    /// the loaded file had a version this build refuses: overwriting a
+    /// newer-format file with a lossy reading of it is the one outcome worth
+    /// preventing outright.
+    bool saveSavedQueries() const;
+
+    /// The query as it should be run: scoped to its account when it names one.
+    ///
+    /// Composes through Account::scopedQuery(), whose parentheses are
+    /// load-bearing. `path:... and a or b` binds as `(path:... and a) or b`, so
+    /// an unparenthesised disjunction escapes its scope and matches every
+    /// account. An account key naming nothing returns the bare query rather
+    /// than a scope built from an empty maildir, which would be path:"/**".
+    QString resolvedQuery(const SavedQuery &query) const;
 
     /// Empty when unset; the caller disables the Sync button in that case.
     QString syncCommand() const { return m_syncCommand; }
@@ -254,8 +304,23 @@ private:
     /// Records a notice: nothing is wrong, a feature is simply not configured.
     void addNotice(const QString &message);
 
+    /// Reads queries.json, or migrates [queries] when it is absent. Called by
+    /// load(), which has already parsed the INI by then.
+    void loadSavedQueries(const QString &configPath, QSettings &settings);
+
     QList<Account> m_accounts;
     QList<SavedQuery> m_savedQueries;
+
+    /// Where saveSavedQueries() writes, remembered from load().
+    QString m_queriesPath;
+
+    /// Top-level keys of queries.json this build does not understand.
+    QJsonObject m_queriesUnknown;
+
+    /// Set when the file was refused for its version. Blocks the save, so a
+    /// document from a newer build is never overwritten with less than it held.
+    bool m_queriesRefused = false;
+
     QString m_syncCommand;
     QString m_syncLog;
     int m_toolbarIconSize = 24;