feat: empty the trash, the one action that asks first

Item 118, unblocked by 103. Message > Empty trash..., scoped to the
account selector, with no default shortcut.

purgeMessages() is a separate worker entry point from moveMessages()
rather than a flag on it, because the two look alike and only one can be
undone. It takes named ids, never a folder sweep, so the blast radius is
what the dialog enumerated and the user confirmed, and it deletes every
file of a message: notmuch deduplicates by Message-ID, so leaving one
behind leaves the message alive in the folder the user emptied.

It confirms, naming the count and the account, defaulting to Cancel.
That breaks CLAUDE.md's no-confirmation rule deliberately and the rule
now records it as its single exception, in the same paragraph: a purge
has no inverse to push onto the undo stack, so the protection the rule
provides has to come from somewhere, and the dialog is where.

Two defects found rather than reasoned. The count claimed messages whose
files were already gone, overstating an irreversible action; an absent
file is correctly not an error, but that is not the same as destroyed.
And the user's hand test found the list still showing mail that no
longer existed: a purge removes rows rather than changing them, so there
is no optimistic update to apply and nothing was connected to
messagesPurged at all. It re-runs the current query now.

Verified against the live index after the user emptied one real
account's trash: zero files on disk, zero in the index. The suite is 37
of 38, the failure being item 136 on an unrelated path. Ten new strings
translated, lrelease reports 0 unfinished.

Item 168 is filed from the same hand test, on Delete being offered on
mail already in the trash.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HFuRPtzFrSxCQjFk6tq7gD

1 files changed, 101 insertions, 0 deletions

diff --git a/src/notmuchworker.cpp b/src/notmuchworker.cpp
index f3a76ea..8ab3ab5 100644
--- a/src/notmuchworker.cpp
+++ b/src/notmuchworker.cpp
@@ -920,6 +920,99 @@ void NotmuchWorker::moveMessages(const QStringList &messageIds,
     emit messagesMovedFrom(origins, destFolder);
 }
 
+void NotmuchWorker::purgeMessages(const QStringList &messageIds)
+{
+    if (messageIds.isEmpty())
+        return;
+
+    // Same handle ordering as applyTags() and moveMessages(): notmuch allows
+    // one open handle per process, so the read-only one closes first.
+    close();
+
+    const QByteArray configPath = configPathArg();
+    notmuch_database_t *db = nullptr;
+    char *error = nullptr;
+    const notmuch_status_t status = notmuch_database_open_with_config(
+        nullptr,
+        NOTMUCH_DATABASE_MODE_READ_WRITE,
+        configPath.isEmpty() ? nullptr : configPath.constData(),
+        nullptr,
+        &db,
+        &error);
+
+    if (status != NOTMUCH_STATUS_SUCCESS) {
+        emit errorOccurred(
+            QStringLiteral("Cannot open database for writing: %1")
+                .arg(QString::fromUtf8(error ? error
+                                             : notmuch_status_to_string(status))));
+        free(error);
+        return;
+    }
+
+    QStringList purged;
+    for (const QString &id : messageIds) {
+        notmuch_message_t *raw = nullptr;
+        // find_message reports SUCCESS with a null message for an unknown id,
+        // so both are checked. A stale id does not abort the batch: the live
+        // ids beside it still have to go.
+        if (notmuch_database_find_message(db, id.toUtf8().constData(), &raw)
+                != NOTMUCH_STATUS_SUCCESS || !raw) {
+            continue;
+        }
+        NmMessage message(raw);
+
+        // EVERY file, not just the first. notmuch deduplicates by Message-ID,
+        // so one message can have several files; unlinking one would leave the
+        // message alive in the folder the user emptied, which reads as the
+        // purge having silently skipped it. This is the same one-message,
+        // many-files property that item 166 turned on.
+        QStringList files;
+        for (NmFilenames names(notmuch_message_get_filenames(message.get()));
+             notmuch_filenames_valid(names.get());
+             notmuch_filenames_move_to_next(names.get())) {
+            files.append(QString::fromUtf8(notmuch_filenames_get(names.get())));
+        }
+
+        // The handle is released before the files go out from under it.
+        message.reset();
+
+        bool removedAny = false;
+        for (const QString &file : files) {
+            // A file already gone is not an ERROR: the index can name a path a
+            // sync has since removed, and the goal state (no file) is reached
+            // either way. Reporting it would teach the user to ignore the one
+            // message that matters here.
+            //
+            // It is not a DESTRUCTION either, which is a separate point and
+            // the one a first version got wrong. The count reaches the user as
+            // the size of an irreversible act, so it must say what this run
+            // actually destroyed, not what was already absent when it started.
+            if (!QFile::exists(file)) {
+                notmuch_database_remove_message(db, file.toUtf8().constData());
+                continue;
+            }
+            if (!QFile::remove(file)) {
+                emit errorOccurred(QStringLiteral("Cannot delete %1")
+                                       .arg(QFileInfo(file).fileName()));
+                continue;
+            }
+            removedAny = true;
+            // The index entry for that path. When the last filename goes, so
+            // does the message and every tag on it, which is exactly what is
+            // wanted here and is the thing moveMessages() has to avoid.
+            notmuch_database_remove_message(db, file.toUtf8().constData());
+        }
+
+        if (removedAny)
+            purged.append(id);
+    }
+
+    notmuch_database_close(db);
+    notmuch_database_destroy(db);
+
+    emit messagesPurged(purged);
+}
+
 void NotmuchWorker::indexDraftFile(const QString &path,
                                    const QString &previousPath)
 {
@@ -1025,6 +1118,14 @@ void NotmuchWorker::resolveMessages(const QStringList &messageIds,
     resolveQuery(terms.join(QStringLiteral(" or ")), requestTag);
 }
 
+void NotmuchWorker::resolveQueryMessages(const QString &query,
+                                         const QString &requestTag)
+{
+    if (query.isEmpty())
+        return;
+    resolveQuery(query, requestTag);
+}
+
 void NotmuchWorker::resolveThreadMessages(const QStringList &threadIds,
                                           const QString &requestTag)
 {