feat(compose): save drafts atomically into a Maildir, item 123

DraftStore::write() renders a built message into <folder>/cur with the
given Maildir flags, writing through QSaveFile and unlinking the previous
revision only after the new file is in place.

Two orderings here are load-bearing and both are covered by a test that
was checked against the mutation that breaks it.

The unlink runs only after the write has succeeded, so a failed save
leaves the previous revision intact rather than losing both. Provoking
that failure needs care: the plan's version used an unwritable path where
mkpath() fails and the function returns before reaching either the write
or the unlink, so a mutation moving the unlink up survived it. The test
uses an existing but read-only cur/ instead, where the failure lands at
the write.

And the size comparison stays ahead of commit() in the condition, because
QSaveFile::commit() returns true after a short write and renames the
truncated bytes into place: measured, write 4096 of 65536 with commit
reporting true and the file left in the listing. What leaves the
directory empty is the short-circuit returning before commit() is
reached, after which ~QSaveFile() discards the uncommitted scratch file.
Reducing the condition to !file.commit() looks like a simplification and
writes a truncated draft into cur/, where notmuch would index it and
mbsync would upload it.

Resolving the mail root stays the caller's job, per item 124; this takes
an absolute folder path and composes nothing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QP2g3b3kuLx6AYFCNEz6UR

3 files changed, 143 insertions, 0 deletions

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index b7a5be2..a4d7c55 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -13,6 +13,7 @@ add_library(qtmaildir_lib STATIC
     carddelegate.cpp
     notmuchworker.cpp
     maildirname.cpp
+    draftstore.cpp
     tagchip.cpp
     tagcolors.cpp
     savequerydialog.cpp
diff --git a/src/draftstore.cpp b/src/draftstore.cpp
new file mode 100644
index 0000000..d458bff
--- /dev/null
+++ b/src/draftstore.cpp
@@ -0,0 +1,82 @@
+/*
+ * qtmaildir - a Qt6 mail client for notmuch-indexed Maildirs
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "draftstore.h"
+
+#include "maildirname.h"
+
+#include <QDir>
+#include <QFile>
+#include <QObject>
+#include <QSaveFile>
+
+DraftStore::Result DraftStore::write(const QString &folderPath,
+                                     const QByteArray &bytes,
+                                     const QString &flags,
+                                     const QString &previousPath)
+{
+    Result result;
+
+    if (folderPath.isEmpty()) {
+        result.error = QObject::tr("No folder was configured to write to.");
+        return result;
+    }
+
+    // cur/, never new/. A file in new/ is re-announced as fresh mail by every
+    // reader of the Maildir, so an autosaved draft would arrive as a new
+    // message on every revision.
+    const QString curPath = folderPath + QStringLiteral("/cur");
+    if (!QDir().mkpath(curPath)) {
+        result.error = QObject::tr("Cannot create the folder %1.").arg(curPath);
+        return result;
+    }
+
+    // A FRESH name, with no previous one to preserve flags from: a draft is
+    // newly composed, and MessageBuilder's bytes carry no filename. The flags
+    // are appended here instead.
+    const QString name = MaildirName::fresh(QString())
+                         + QStringLiteral(":2,") + flags;
+    const QString target = curPath + QLatin1Char('/') + name;
+
+    // QSaveFile: writes to a temporary and renames into place, so a reader
+    // never sees a half-written message. mbsync and notmuch both watch this
+    // directory.
+    QSaveFile file(target);
+    if (!file.open(QIODevice::WriteOnly)) {
+        result.error = QObject::tr("Cannot write to %1: %2")
+                           .arg(target, file.errorString());
+        return result;
+    }
+
+    if (file.write(bytes) != bytes.size() || !file.commit()) {
+        result.error = QObject::tr("Cannot write to %1: %2")
+                           .arg(target, file.errorString());
+        return result;
+    }
+
+    result.path = target;
+
+    // AFTER the new file is safely in place, never before: unlinking first
+    // would lose the draft entirely if the write then failed. A failure to
+    // remove the old revision is not reported as a failure of the write,
+    // because the new revision IS on disk; the cost is one stale file.
+    if (!previousPath.isEmpty() && previousPath != target)
+        QFile::remove(previousPath);
+
+    return result;
+}
diff --git a/src/draftstore.h b/src/draftstore.h
new file mode 100644
index 0000000..13147c7
--- /dev/null
+++ b/src/draftstore.h
@@ -0,0 +1,60 @@
+/*
+ * qtmaildir - a Qt6 mail client for notmuch-indexed Maildirs
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#pragma once
+
+#include <QByteArray>
+#include <QString>
+
+/// Writes message bytes into a Maildir folder.
+///
+/// Drafts and sent copies are the same operation into different folders with
+/// different flags, so they are one unit. Nothing here calls notmuch: the
+/// files become visible on the next sync, which keeps the read-only-by-default
+/// rule intact and needs no write lock.
+class DraftStore
+{
+public:
+    struct Result
+    {
+        QString path;   ///< The file written. Empty on failure.
+        QString error;  ///< Empty on success.
+
+        bool ok() const { return error.isEmpty(); }
+    };
+
+    /// Writes \p bytes into \p folderPath, an absolute Maildir folder.
+    ///
+    /// The folder is the CALLER's to resolve, and item 124 is why it is not
+    /// resolved here: the mail root comes from
+    /// `notmuch_config_get(NOTMUCH_CONFIG_MAIL_ROOT)`, never from
+    /// `notmuch_database_get_path()`, which under a split index returns the
+    /// Xapian directory. A store that composed its own path from the wrong
+    /// accessor would write drafts into the index tree.
+    ///
+    /// \p flags is the Maildir flag string without the `:2,` prefix: "D" for a
+    /// draft, "S" for a sent copy.
+    ///
+    /// \p previousPath, when not empty, is unlinked AFTER the new file is
+    /// safely in place. Maildir has no in-place edit, so a draft rewritten
+    /// every thirty seconds would otherwise accumulate one file per pause.
+    /// The order matters: unlinking first would lose the draft entirely if the
+    /// write then failed.
+    static Result write(const QString &folderPath, const QByteArray &bytes,
+                        const QString &flags, const QString &previousPath = {});
+};