feat: empty the trash, the one action that asks first

Item 118, unblocked by 103. Message > Empty trash..., scoped to the
account selector, with no default shortcut.

purgeMessages() is a separate worker entry point from moveMessages()
rather than a flag on it, because the two look alike and only one can be
undone. It takes named ids, never a folder sweep, so the blast radius is
what the dialog enumerated and the user confirmed, and it deletes every
file of a message: notmuch deduplicates by Message-ID, so leaving one
behind leaves the message alive in the folder the user emptied.

It confirms, naming the count and the account, defaulting to Cancel.
That breaks CLAUDE.md's no-confirmation rule deliberately and the rule
now records it as its single exception, in the same paragraph: a purge
has no inverse to push onto the undo stack, so the protection the rule
provides has to come from somewhere, and the dialog is where.

Two defects found rather than reasoned. The count claimed messages whose
files were already gone, overstating an irreversible action; an absent
file is correctly not an error, but that is not the same as destroyed.
And the user's hand test found the list still showing mail that no
longer existed: a purge removes rows rather than changing them, so there
is no optimistic update to apply and nothing was connected to
messagesPurged at all. It re-runs the current query now.

Verified against the live index after the user emptied one real
account's trash: zero files on disk, zero in the index. The suite is 37
of 38, the failure being item 136 on an unrelated path. Ten new strings
translated, lrelease reports 0 unfinished.

Item 168 is filed from the same hand test, on Delete being offered on
mail already in the trash.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HFuRPtzFrSxCQjFk6tq7gD

1 files changed, 26 insertions, 0 deletions

diff --git a/src/notmuchworker.h b/src/notmuchworker.h
index 3ccf8e5..2efddaa 100644
--- a/src/notmuchworker.h
+++ b/src/notmuchworker.h
@@ -134,6 +134,22 @@ public slots:
     /// it, so removing before indexing loses the message's tags.
     void moveMessages(const QStringList &messageIds, const QString &destFolder);
 
+    /// Destroys mail: removes each file from disk and each message from the
+    /// index. **This is the only irreversible operation in the application**
+    /// (item 118), which is why it is a separate entry point rather than a
+    /// flag on moveMessages(): the two look alike and one of them can be
+    /// undone.
+    ///
+    /// Named ids only, never a folder-wide sweep, so the blast radius is
+    /// whatever the caller enumerated and confirmed. A message with several
+    /// files loses every file it has, since leaving one behind would leave
+    /// the message alive in a folder the user emptied.
+    ///
+    /// The caller is responsible for confirming: CLAUDE.md rules out
+    /// confirmation dialogs for mutations because undo replaces them, and
+    /// this is the one action where undo cannot exist.
+    void purgeMessages(const QStringList &messageIds);
+
     /// Indexes one freshly written file, so it appears in a `path:` query
     /// without a full `notmuch new` (item 158).
     ///
@@ -190,6 +206,12 @@ public slots:
     void resolveMessages(const QStringList &messageIds,
                          const QString &requestTag);
 
+    /// The same walk for an arbitrary QUERY, which is what Empty Trash needs:
+    /// it has to enumerate what it is about to destroy before it can say how
+    /// much that is, and the answer must not come from the model, which holds
+    /// whatever the current view happens to be showing.
+    void resolveQueryMessages(const QString &query, const QString &requestTag);
+
 private:
     /// The shared walk behind resolveMessages() and resolveThreadMessages():
     /// runs `query` and emits threadMessagesResolved() with each match's id,
@@ -273,6 +295,10 @@ signals:
     /// than aborting the batch.
     void messagesMoved(const QStringList &messageIds, const QString &destFolder);
 
+    /// What a purge actually destroyed. Unlike a move there is no new path to
+    /// observe afterwards, so this is the only report the UI has.
+    void messagesPurged(const QStringList &messageIds);
+
     /// The same move, reported per message with the folder it came FROM.
     ///
     /// Emitted alongside messagesMoved rather than replacing it: that signal's