feat: empty the trash, the one action that asks first

Item 118, unblocked by 103. Message > Empty trash..., scoped to the
account selector, with no default shortcut.

purgeMessages() is a separate worker entry point from moveMessages()
rather than a flag on it, because the two look alike and only one can be
undone. It takes named ids, never a folder sweep, so the blast radius is
what the dialog enumerated and the user confirmed, and it deletes every
file of a message: notmuch deduplicates by Message-ID, so leaving one
behind leaves the message alive in the folder the user emptied.

It confirms, naming the count and the account, defaulting to Cancel.
That breaks CLAUDE.md's no-confirmation rule deliberately and the rule
now records it as its single exception, in the same paragraph: a purge
has no inverse to push onto the undo stack, so the protection the rule
provides has to come from somewhere, and the dialog is where.

Two defects found rather than reasoned. The count claimed messages whose
files were already gone, overstating an irreversible action; an absent
file is correctly not an error, but that is not the same as destroyed.
And the user's hand test found the list still showing mail that no
longer existed: a purge removes rows rather than changing them, so there
is no optimistic update to apply and nothing was connected to
messagesPurged at all. It re-runs the current query now.

Verified against the live index after the user emptied one real
account's trash: zero files on disk, zero in the index. The suite is 37
of 38, the failure being item 136 on an unrelated path. Ten new strings
translated, lrelease reports 0 unfinished.

Item 168 is filed from the same hand test, on Delete being offered on
mail already in the trash.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HFuRPtzFrSxCQjFk6tq7gD

1 files changed, 85 insertions, 0 deletions

diff --git a/tests/test_mainwindow.cpp b/tests/test_mainwindow.cpp
index 53eea2f..6020a1d 100644
--- a/tests/test_mainwindow.cpp
+++ b/tests/test_mainwindow.cpp
@@ -260,6 +260,7 @@ private slots:
     void narrowingAnEmptyQueryBarIsAPlainSearch();
     void aMalformedAccountIsReportedWithoutBlockingTheConstructor();
     void aWorkerBackedWindowReturnsRealThreads();
+    void aPurgeTakesTheRowsOutOfTheViewWithoutARefresh();
 
     // Compose and send, item 123 task 12.
     void theMailRootComesFromTheConfigNotTheIndex();
@@ -383,6 +384,7 @@ private slots:
     void editTagsOnAReplyCountsItsOwnThreadNotTheFirstInTheList();
     void markCurrentThreadReadResolvesTheThreadThroughTheIndex();
     void deletingAReplyRepaintsThatReplyRow();
+    void emptyTrashAsksBeforeDestroyingAnything();
     void theUnreadLabelSaysWhichDirectionItWillGo();
     void theUnreadLabelFollowsAWriteWithoutReselecting();
     void theUnreadActionIsHiddenOnAMixedSelection();
@@ -5212,6 +5214,48 @@ void TestMainWindow::deletingAReplyRepaintsThatReplyRow()
              "deleting one reply marked its whole thread deleted");
 }
 
+void TestMainWindow::emptyTrashAsksBeforeDestroyingAnything()
+{
+    // Item 118, and the one place this application asks. CLAUDE.md rules out
+    // confirmation dialogs for mutations because every mutation pushes its
+    // inverse onto the undo stack; a purge has no inverse, so the rule does
+    // not reach it. What the rule protects is that a user never loses work to
+    // a keystroke, and here the dialog is what provides that rather than
+    // contradicting it.
+    //
+    // Asserting the action EXISTS and is wired, not the dialog's buttons: a
+    // modal cannot be driven from a test without blocking it (item 84), so
+    // the dialog itself is a hand test. What is pinned here is that nothing
+    // is destroyed without going through it.
+    const Config config;
+    MainWindow window(config);
+
+    auto *action = window.findChild<QAction *>(QStringLiteral("empty_trash"));
+    QVERIFY2(action, "empty_trash does not exist");
+
+    // Reachable from a menu, which everyActionIsReachableFromAMenu() also
+    // enforces globally. Named here as well because an unreachable purge is
+    // worse than an unreachable anything else: the user cannot discover the
+    // action, but a stray keybinding still runs it.
+    bool found = false;
+    const QList<QMenu *> menus = window.findChildren<QMenu *>();
+    for (QMenu *menu : menus) {
+        if (menu->actions().contains(action)) {
+            found = true;
+            break;
+        }
+    }
+    QVERIFY2(found, "empty_trash is in no menu");
+
+    // No shortcut, deliberately: this is the one irreversible action, and a
+    // chord is exactly how it would be run by accident.
+    QVERIFY2(action->shortcut().isEmpty(),
+             qPrintable(QStringLiteral("empty_trash carries the shortcut %1; "
+                                       "the one irreversible action must not "
+                                       "be a keystroke away")
+                            .arg(action->shortcut().toString())));
+}
+
 void TestMainWindow::theUnreadLabelSaysWhichDirectionItWillGo()
 {
     // The user's note: "the label for toggle unread should be dynamic. On an
@@ -8666,6 +8710,47 @@ void TestMainWindow::aWorkerBackedWindowReturnsRealThreads()
     QTRY_VERIFY_WITH_TIMEOUT(model->rowCount(QModelIndex()) == 1, 15000);
 }
 
+void TestMainWindow::aPurgeTakesTheRowsOutOfTheViewWithoutARefresh()
+{
+    // Found by hand: the mail was destroyed correctly and the list went on
+    // showing it until the user re-ran the query themselves.
+    //
+    // A purge is the one mutation with no optimistic update to apply. Every
+    // other one CHANGES a row, so the model can rewrite it in place; this one
+    // takes the row away entirely, and the only honest view afterwards is the
+    // one the query gives now.
+    WorkerBackedWindow backed;
+    QVERIFY(backed.fixture().addMessage(
+        QStringLiteral("acct/trash"), QStringLiteral("doomed@example.org"),
+        QStringLiteral("A subject"), QStringLiteral("sender@example.org"),
+        QStringLiteral("Fri, 14 Aug 2026 10:00:00 +0200"),
+        QStringLiteral("Body text.")));
+    QVERIFY2(backed.buildWithAccounts({ { QStringLiteral("acct"),
+                                          QStringLiteral("acct"),
+                                          QStringLiteral("trash"),
+                                          {}, {}, {} } }),
+             qPrintable(backed.error()));
+
+    MainWindow window(backed.config());
+
+    auto *model = window.findChild<ThreadListModel *>();
+    QVERIFY(model);
+    auto *queryEdit =
+        window.findChild<QLineEdit *>(QStringLiteral("queryEdit"));
+    QVERIFY(queryEdit);
+
+    queryEdit->setText(QStringLiteral("path:\"acct/trash/**\""));
+    queryEdit->returnPressed();
+    QTRY_VERIFY_WITH_TIMEOUT(model->rowCount(QModelIndex()) == 1, 15000);
+
+    // Straight to the purge, bypassing the confirmation: a modal cannot be
+    // driven from a test without blocking it (item 84), and what is under
+    // test is what happens AFTER the user has confirmed.
+    window.purgeForTesting({ QStringLiteral("doomed@example.org") });
+
+    QTRY_VERIFY_WITH_TIMEOUT(model->rowCount(QModelIndex()) == 0, 15000);
+}
+
 namespace {
 
 /// A worker-backed window with one message in one account's maildir.