#1153304 neomutt: Maildir sync overwrites flags changed by another program while a local change is pending

Package:
neomutt
Source:
neomutt
Description:
command line mail reader based on Mutt, with added features
Submitter:
Benj. Mako Hill
Date:
2026-11-07 02:21:02 UTC
Severity:
normal
Tags:
#1153304#5
Date:
2026-11-07 02:02:12 UTC
From:
To:
When a Maildir message has an unsynced local change (which $mark_old,
on by default, causes for most messages at open), neomutt's mailbox
check ignores the flags in the file's current name, and the next sync
renames the file to the whole in-memory flag set. Every flag another
program—offlineimap, mbsync, notmuch with maildir.synchronize_flags, a
second neomutt—changed in the meantime is lost, and since the syncing
program then pushes the flags back to the server, the loss is
permanent. Typical result: a message read elsewhere while a reply was
pending here becomes unread again; a flag set in one instance is wiped
by a sync in the other.

This is related to #1153301 (same investigation, same code path) but
loses flags, not messages (hence severity=important rather than
grave).

A reproduction script is attached (two neomutt instances in tmux on a
temporary Maildir, synthetic messages only). With 20250510+dfsg-2 all
four cases fail (the file ends up :2,S / :2,F / :2,F / :2,FS instead
of :2,FS / :2,FS / :2,FS / :2,RS). The code is unchanged in
20260616+dfsg-1 and upstream main.

I have sent a fix upstream: https://github.com/neomutt/neomutt/pull/5075

It records, per message, the flags last seen on disk and, on a check,
takes each flag that changed on disk and that this instance did not
change; a flag changed in both places keeps the local value.

The patch is attached and applies to the Debian source with minor
offsets. As with #1153301, the patch was developed with generative AI
(Claude Fable 5.1) in a human-assistance sense. I'm also not super
familiar with neomutt so I'd appreciate extra eyes.

#1153304#10
Date:
2026-11-07 02:08:44 UTC
From:
To:
This is the reproduction script mentioned in the report which I
failed to attach to the original mail. Whoops!

Regards,
Mako