feat(ui): render a single message when its row is selected

loadMessage queries by id: and returns one MessageRef, always matched, since the
user asked for that message by clicking its row and a stub would answer the
wrong question. An unknown id emits an empty vector rather than an error: a
stale row after a reindex is an ordinary race, not a failure worth the status
bar. The signal fires even when empty so the UI handler runs instead of waiting
for a reply that never comes.

The branch in onThreadSelected is placed BEFORE threadAt(), which is the whole
trap. threadAt takes a top-level row number and a child's row number indexes its
siblings, so handing a message row's number to it loads whichever thread happens
to sit at that position. Mutation-checked: with the branch disabled the test
reports thread 't1' for a reply belonging to 't2', a wrong answer plausible
enough to survive review.

m_currentMessageId and m_currentThreadId are mutually exclusive and each clears
the other, so a queued reply can tell which kind of selection it belongs to.
onMessageLoaded carries a third guard onThreadLoaded does not need: a reply
landing after the selection moved to a thread row would render one message where
the conversation belongs.

No mark-read timer for a message row in this pass. Marking one message of a
thread read is a per-message tag write and the pending-edit map is keyed by
thread; item 28 is the record of what happens when that count goes wrong.

1 files changed, 38 insertions, 0 deletions

diff --git a/tests/test_notmuchworker.cpp b/tests/test_notmuchworker.cpp
index 0f47c55..c84e262 100644
--- a/tests/test_notmuchworker.cpp
+++ b/tests/test_notmuchworker.cpp
@@ -58,6 +58,8 @@ private slots:
     void requestAllTagsReturnsSortedTags();
     void requestAllTagsOnUnreadableConfigEmitsError();
 
+    void loadMessageReturnsOnlyThatMessage();
+    void loadMessageOnAnUnknownIdReturnsNothing();
     void loadThreadTreeReportsReplyDepth();
     void loadThreadTreeCarriesTheFactsARowNeeds();
 
@@ -161,6 +163,42 @@ QStringList TestNotmuchWorker::tagsOf(const QString &messageId)
     return {};
 }
 
+void TestNotmuchWorker::loadMessageReturnsOnlyThatMessage()
+{
+    // a2 is a reply in a two-message thread. Selecting a reply row must render
+    // that message alone; loadThread would hand back the whole thread and the
+    // pane would show the conversation the user was trying to look inside.
+    NotmuchWorker worker(m_fixture.configPath());
+    QSignalSpy loaded(&worker, &NotmuchWorker::messageLoaded);
+    worker.loadMessage(QStringLiteral("a2@example.org"), 1);
+
+    QCOMPARE(loaded.count(), 1);
+    const auto messages = loaded.first().at(0).value<QVector<MessageRef>>();
+
+    QCOMPARE(messages.size(), 1);
+    QCOMPARE(messages.first().messageId, QStringLiteral("a2@example.org"));
+    QVERIFY(!messages.first().filePath.isEmpty());
+
+    // matched, so the pane renders it expanded rather than as a stub. The user
+    // asked for this message by clicking it, which is as matched as it gets.
+    QVERIFY(messages.first().matched);
+}
+
+void TestNotmuchWorker::loadMessageOnAnUnknownIdReturnsNothing()
+{
+    // Empty rather than an error: a stale row after a reindex is an ordinary
+    // race, not a failure worth a message in the status bar.
+    NotmuchWorker worker(m_fixture.configPath());
+    QSignalSpy loaded(&worker, &NotmuchWorker::messageLoaded);
+    QSignalSpy errors(&worker, &NotmuchWorker::errorOccurred);
+
+    worker.loadMessage(QStringLiteral("nonexistent@example.org"), 1);
+
+    QCOMPARE(loaded.count(), 1);
+    QVERIFY(loaded.first().at(0).value<QVector<MessageRef>>().isEmpty());
+    QCOMPARE(errors.count(), 0);
+}
+
 void TestNotmuchWorker::loadThreadTreeReportsReplyDepth()
 {
     // Thread A is a root plus one reply carrying In-Reply-To, which is what