fix: handle every rule answer, and keep its failure out of errorOccurred

A second Apply overwrote the pending token, so the first rule's answer
was dropped as stale although its writes had landed: no undo, no pending
count, no accounts. A write's answer cannot be superseded, so the token
is gone and every ruleApplied() is handled. Pending counts are keyed by
generation for the same reason, since a second Apply before the first
count returned dropped the first Apply entirely.

applyRule() no longer emits errorOccurred(). That path reverted an
unrelated in-flight user write and its message was then overwritten by
"nothing to change". The failure travels in the reply instead:
ruleApplied(description, changes, error). openReadOnly() and writeTags()
take an optional error out-parameter so the rule's path stays quiet.
The window shows the error, still records and offers undo for whatever
landed first, and names the rule from the reply's description.

Item 212.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 19 insertions, 11 deletions

diff --git a/src/notmuchworker.h b/src/notmuchworker.h
index a175d7a..63c5203 100644
--- a/src/notmuchworker.h
+++ b/src/notmuchworker.h
@@ -246,10 +246,11 @@ public slots:
     ///
     /// Answers with ruleApplied() ALWAYS, even when nothing moved, and never
     /// with tagsApplied(): the window builds the undo from the answer rather
-    /// than from the shared confirmation queue.
+    /// than from the shared confirmation queue. Never with errorOccurred()
+    /// either: that path reverts whatever unrelated user write is in flight,
+    /// so a failure travels in the reply.
     void applyRule(const QString &query, const QStringList &add,
-                   const QStringList &remove, const QString &description,
-                   quint64 token);
+                   const QStringList &remove, const QString &description);
 
     /// Resolves whole threads to the message ids and file paths they contain.
     ///
@@ -398,10 +399,12 @@ signals:
 
     /// applyRule()'s answer: one TagChange per single-tag operation, in the
     /// order applyRule() documents, each carrying the ids that operation
-    /// actually moved (possibly none). `token` is echoed from the request.
-    /// Emitted even after a write error, carrying what was written before it,
-    /// so the window can still offer undo for that part.
-    void ruleApplied(quint64 token, const QVector<TagChange> &changes);
+    /// actually moved (possibly none). `description` is echoed from the
+    /// request, so the window names the right rule. `error` is empty on
+    /// success; on a failure, `changes` holds what was written before it, so
+    /// the window can still offer undo for that part.
+    void ruleApplied(const QString &description,
+                     const QVector<TagChange> &changes, const QString &error);
 
     /// One file entered or left the index outside a query (item 192).
     ///
@@ -497,13 +500,18 @@ signals:
     void errorOccurred(const QString &message);
 
 private:
-    bool openReadOnly();
+    /// With `error` given, a failure is written there instead of emitted, and
+    /// the non-fatal reopen failure is ignored; applyRule() reports in its
+    /// own reply.
+    bool openReadOnly(QString *error = nullptr);
     void close();
 
     /// applyTags() without the signal: writes `change` and fills `changedIds`
-    /// with the messages whose tags really moved. False, with errorOccurred()
-    /// emitted, when the database could not be opened for writing.
-    bool writeTags(const TagChange &change, QStringList *changedIds);
+    /// with the messages whose tags really moved. False when the database
+    /// could not be opened for writing, with the reason in `error` when given
+    /// and through errorOccurred() otherwise.
+    bool writeTags(const TagChange &change, QStringList *changedIds,
+                   QString *error = nullptr);
 
     QByteArray configPathArg() const;