feat(compose): save drafts atomically into a Maildir, item 123

DraftStore::write() renders a built message into <folder>/cur with the
given Maildir flags, writing through QSaveFile and unlinking the previous
revision only after the new file is in place.

Two orderings here are load-bearing and both are covered by a test that
was checked against the mutation that breaks it.

The unlink runs only after the write has succeeded, so a failed save
leaves the previous revision intact rather than losing both. Provoking
that failure needs care: the plan's version used an unwritable path where
mkpath() fails and the function returns before reaching either the write
or the unlink, so a mutation moving the unlink up survived it. The test
uses an existing but read-only cur/ instead, where the failure lands at
the write.

And the size comparison stays ahead of commit() in the condition, because
QSaveFile::commit() returns true after a short write and renames the
truncated bytes into place: measured, write 4096 of 65536 with commit
reporting true and the file left in the listing. What leaves the
directory empty is the short-circuit returning before commit() is
reached, after which ~QSaveFile() discards the uncommitted scratch file.
Reducing the condition to !file.commit() looks like a simplification and
writes a truncated draft into cur/, where notmuch would index it and
mbsync would upload it.

Resolving the mail root stays the caller's job, per item 124; this takes
an absolute folder path and composes nothing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QP2g3b3kuLx6AYFCNEz6UR

1 files changed, 60 insertions, 0 deletions

diff --git a/src/draftstore.h b/src/draftstore.h
new file mode 100644
index 0000000..13147c7
--- /dev/null
+++ b/src/draftstore.h
@@ -0,0 +1,60 @@
+/*
+ * qtmaildir - a Qt6 mail client for notmuch-indexed Maildirs
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#pragma once
+
+#include <QByteArray>
+#include <QString>
+
+/// Writes message bytes into a Maildir folder.
+///
+/// Drafts and sent copies are the same operation into different folders with
+/// different flags, so they are one unit. Nothing here calls notmuch: the
+/// files become visible on the next sync, which keeps the read-only-by-default
+/// rule intact and needs no write lock.
+class DraftStore
+{
+public:
+    struct Result
+    {
+        QString path;   ///< The file written. Empty on failure.
+        QString error;  ///< Empty on success.
+
+        bool ok() const { return error.isEmpty(); }
+    };
+
+    /// Writes \p bytes into \p folderPath, an absolute Maildir folder.
+    ///
+    /// The folder is the CALLER's to resolve, and item 124 is why it is not
+    /// resolved here: the mail root comes from
+    /// `notmuch_config_get(NOTMUCH_CONFIG_MAIL_ROOT)`, never from
+    /// `notmuch_database_get_path()`, which under a split index returns the
+    /// Xapian directory. A store that composed its own path from the wrong
+    /// accessor would write drafts into the index tree.
+    ///
+    /// \p flags is the Maildir flag string without the `:2,` prefix: "D" for a
+    /// draft, "S" for a sent copy.
+    ///
+    /// \p previousPath, when not empty, is unlinked AFTER the new file is
+    /// safely in place. Maildir has no in-place edit, so a draft rewritten
+    /// every thirty seconds would otherwise accumulate one file per pause.
+    /// The order matters: unlinking first would lose the draft entirely if the
+    /// write then failed.
+    static Result write(const QString &folderPath, const QByteArray &bytes,
+                        const QString &flags, const QString &previousPath = {});
+};