diff --git a/src/applications/metamta/adapter/PhabricatorMailImplementationAdapter.php b/src/applications/metamta/adapter/PhabricatorMailImplementationAdapter.php
index 923574d16d..14c7a63663 100644
--- a/src/applications/metamta/adapter/PhabricatorMailImplementationAdapter.php
+++ b/src/applications/metamta/adapter/PhabricatorMailImplementationAdapter.php
@@ -1,87 +1,97 @@
 <?php
 
 abstract class PhabricatorMailImplementationAdapter extends Phobject {
 
   private $key;
+  private $priority;
   private $options = array();
 
   final public function getAdapterType() {
     return $this->getPhobjectClassConstant('ADAPTERTYPE');
   }
 
   final public static function getAllAdapters() {
     return id(new PhutilClassMapQuery())
       ->setAncestorClass(__CLASS__)
       ->setUniqueMethod('getAdapterType')
       ->execute();
   }
 
 
   abstract public function setFrom($email, $name = '');
   abstract public function addReplyTo($email, $name = '');
   abstract public function addTos(array $emails);
   abstract public function addCCs(array $emails);
   abstract public function addAttachment($data, $filename, $mimetype);
   abstract public function addHeader($header_name, $header_value);
   abstract public function setBody($plaintext_body);
   abstract public function setHTMLBody($html_body);
   abstract public function setSubject($subject);
 
 
   /**
    * Some mailers, notably Amazon SES, do not support us setting a specific
    * Message-ID header.
    */
   abstract public function supportsMessageIDHeader();
 
 
   /**
    * Send the message. Generally, this means connecting to some service and
    * handing data to it.
    *
    * If the adapter determines that the mail will never be deliverable, it
    * should throw a @{class:PhabricatorMetaMTAPermanentFailureException}.
    *
    * For temporary failures, throw some other exception or return `false`.
    *
    * @return bool True on success.
    */
   abstract public function send();
 
   final public function setKey($key) {
     $this->key = $key;
     return $this;
   }
 
   final public function getKey() {
     return $this->key;
   }
 
+  final public function setPriority($priority) {
+    $this->priority = $priority;
+    return $this;
+  }
+
+  final public function getPriority() {
+    return $this->priority;
+  }
+
   final public function getOption($key) {
     if (!array_key_exists($key, $this->options)) {
       throw new Exception(
         pht(
           'Mailer ("%s") is attempting to access unknown option ("%s").',
           get_class($this),
           $key));
     }
 
     return $this->options[$key];
   }
 
   final public function setOptions(array $options) {
     $this->validateOptions($options);
     $this->options = $options;
     return $this;
   }
 
   abstract protected function validateOptions(array $options);
 
   abstract public function newDefaultOptions();
   abstract public function newLegacyOptions();
 
   public function prepareForSend() {
     return;
   }
 
 }
diff --git a/src/applications/metamta/controller/PhabricatorMetaMTAMailgunReceiveController.php b/src/applications/metamta/controller/PhabricatorMetaMTAMailgunReceiveController.php
index 467995a186..4eb53b7120 100644
--- a/src/applications/metamta/controller/PhabricatorMetaMTAMailgunReceiveController.php
+++ b/src/applications/metamta/controller/PhabricatorMetaMTAMailgunReceiveController.php
@@ -1,93 +1,110 @@
 <?php
 
 final class PhabricatorMetaMTAMailgunReceiveController
   extends PhabricatorMetaMTAController {
 
   public function shouldRequireLogin() {
     return false;
   }
 
   private function verifyMessage() {
-    $api_key = PhabricatorEnv::getEnvConfig('mailgun.api-key');
     $request = $this->getRequest();
     $timestamp = $request->getStr('timestamp');
     $token = $request->getStr('token');
     $sig = $request->getStr('signature');
-    $hash = hash_hmac('sha256', $timestamp.$token, $api_key);
 
-    return phutil_hashes_are_identical($sig, $hash);
+    // An install may configure multiple Mailgun mailers, and we might receive
+    // inbound mail from any of them. Test the signature to see if it matches
+    // any configured Mailgun mailer.
+
+    $mailers = PhabricatorMetaMTAMail::newMailers();
+    $mailgun_type = PhabricatorMailImplementationMailgunAdapter::ADAPTERTYPE;
+    foreach ($mailers as $mailer) {
+      if ($mailer->getAdapterType() != $mailgun_type) {
+        continue;
+      }
+
+      $api_key = $mailer->getOption('api-key');
+
+      $hash = hash_hmac('sha256', $timestamp.$token, $api_key);
+      if (phutil_hashes_are_identical($sig, $hash)) {
+        return true;
+      }
+    }
+
+    return false;
   }
 
   public function handleRequest(AphrontRequest $request) {
 
     // No CSRF for Mailgun.
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
 
     if (!$this->verifyMessage()) {
       throw new Exception(
         pht('Mail signature is not valid. Check your Mailgun API key.'));
     }
 
     $raw_headers = $request->getStr('message-headers');
     $raw_dict = array();
     if (strlen($raw_headers)) {
       $raw_headers = phutil_json_decode($raw_headers);
       foreach ($raw_headers as $raw_header) {
         list($name, $value) = $raw_header;
         $raw_dict[$name] = $value;
       }
     }
 
     $headers = array(
       'to'      => $request->getStr('recipient'),
       'from'    => $request->getStr('from'),
       'subject' => $request->getStr('subject'),
     ) + $raw_dict;
 
     $received = new PhabricatorMetaMTAReceivedMail();
     $received->setHeaders($headers);
     $received->setBodies(array(
       'text' => $request->getStr('stripped-text'),
       'html' => $request->getStr('stripped-html'),
     ));
 
     $file_phids = array();
     foreach ($_FILES as $file_raw) {
       try {
         $file = PhabricatorFile::newFromPHPUpload(
           $file_raw,
           array(
             'viewPolicy' => PhabricatorPolicies::POLICY_NOONE,
           ));
         $file_phids[] = $file->getPHID();
       } catch (Exception $ex) {
         phlog($ex);
       }
     }
     $received->setAttachments($file_phids);
 
     try {
       $received->save();
       $received->processReceivedMail();
     } catch (Exception $ex) {
       // We can get exceptions here in two cases.
 
       // First, saving the message may throw if we have already received a
       // message with the same Message ID. In this case, we're declining to
       // process a duplicate message, so failing silently is correct.
 
       // Second, processing the message may throw (for example, if it contains
       // an invalid !command). This will generate an email as a side effect,
       // so we don't need to explicitly handle the exception here.
 
       // In these cases, we want to return HTTP 200. If we do not, MailGun will
       // re-transmit the message later.
       phlog($ex);
     }
 
     $response = new AphrontWebpageResponse();
     $response->setContent(pht("Got it! Thanks, Mailgun!\n"));
     return $response;
   }
 
 }
diff --git a/src/applications/metamta/controller/PhabricatorMetaMTASendGridReceiveController.php b/src/applications/metamta/controller/PhabricatorMetaMTASendGridReceiveController.php
index 0a5e28fcee..99e60caa05 100644
--- a/src/applications/metamta/controller/PhabricatorMetaMTASendGridReceiveController.php
+++ b/src/applications/metamta/controller/PhabricatorMetaMTASendGridReceiveController.php
@@ -1,60 +1,80 @@
 <?php
 
 final class PhabricatorMetaMTASendGridReceiveController
   extends PhabricatorMetaMTAController {
 
   public function shouldRequireLogin() {
     return false;
   }
 
   public function handleRequest(AphrontRequest $request) {
+    $mailers = PhabricatorMetaMTAMail::newMailers();
+    $sendgrid_type = PhabricatorMailImplementationSendGridAdapter::ADAPTERTYPE;
+
+    // SendGrid doesn't sign payloads so we can't be sure that SendGrid
+    // actually sent this request, but require a configured SendGrid mailer
+    // before we activate this endpoint.
+
+    $has_sendgrid = false;
+    foreach ($mailers as $mailer) {
+      if ($mailer->getAdapterType() != $sendgrid_type) {
+        continue;
+      }
+
+      $has_sendgrid = true;
+      break;
+    }
+
+    if (!$has_sendgrid) {
+      return new Aphront404Response();
+    }
 
     // No CSRF for SendGrid.
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     $user = $request->getUser();
 
     $raw_headers = $request->getStr('headers');
     $raw_headers = explode("\n", rtrim($raw_headers));
     $raw_dict = array();
     foreach (array_filter($raw_headers) as $header) {
       list($name, $value) = explode(':', $header, 2);
       $raw_dict[$name] = ltrim($value);
     }
 
     $headers = array(
       'to'      => $request->getStr('to'),
       'from'    => $request->getStr('from'),
       'subject' => $request->getStr('subject'),
     ) + $raw_dict;
 
     $received = new PhabricatorMetaMTAReceivedMail();
     $received->setHeaders($headers);
     $received->setBodies(array(
       'text' => $request->getStr('text'),
       'html' => $request->getStr('from'),
     ));
 
     $file_phids = array();
     foreach ($_FILES as $file_raw) {
       try {
         $file = PhabricatorFile::newFromPHPUpload(
           $file_raw,
           array(
             'viewPolicy' => PhabricatorPolicies::POLICY_NOONE,
           ));
         $file_phids[] = $file->getPHID();
       } catch (Exception $ex) {
         phlog($ex);
       }
     }
     $received->setAttachments($file_phids);
     $received->save();
 
     $received->processReceivedMail();
 
     $response = new AphrontWebpageResponse();
     $response->setContent(pht('Got it! Thanks, SendGrid!')."\n");
     return $response;
   }
 
 }
diff --git a/src/applications/metamta/storage/PhabricatorMetaMTAMail.php b/src/applications/metamta/storage/PhabricatorMetaMTAMail.php
index eb1f1fbea2..2ab3299c34 100644
--- a/src/applications/metamta/storage/PhabricatorMetaMTAMail.php
+++ b/src/applications/metamta/storage/PhabricatorMetaMTAMail.php
@@ -1,1427 +1,1485 @@
 <?php
 
 /**
  * @task recipients   Managing Recipients
  */
 final class PhabricatorMetaMTAMail
   extends PhabricatorMetaMTADAO
   implements
     PhabricatorPolicyInterface,
     PhabricatorDestructibleInterface {
 
   const RETRY_DELAY   = 5;
 
   protected $actorPHID;
   protected $parameters = array();
   protected $status;
   protected $message;
   protected $relatedPHID;
 
   private $recipientExpansionMap;
   private $routingMap;
 
   public function __construct() {
 
     $this->status     = PhabricatorMailOutboundStatus::STATUS_QUEUE;
     $this->parameters = array(
       'sensitive' => true,
       'mustEncrypt' => false,
     );
 
     parent::__construct();
   }
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_SERIALIZATION => array(
         'parameters'  => self::SERIALIZATION_JSON,
       ),
       self::CONFIG_COLUMN_SCHEMA => array(
         'actorPHID' => 'phid?',
         'status' => 'text32',
         'relatedPHID' => 'phid?',
 
         // T6203/NULLABILITY
         // This should just be empty if there's no body.
         'message' => 'text?',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'status' => array(
           'columns' => array('status'),
         ),
         'key_actorPHID' => array(
           'columns' => array('actorPHID'),
         ),
         'relatedPHID' => array(
           'columns' => array('relatedPHID'),
         ),
         'key_created' => array(
           'columns' => array('dateCreated'),
         ),
       ),
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorMetaMTAMailPHIDType::TYPECONST);
   }
 
   protected function setParam($param, $value) {
     $this->parameters[$param] = $value;
     return $this;
   }
 
   protected function getParam($param, $default = null) {
     // Some old mail was saved without parameters because no parameters were
     // set or encoding failed. Recover in these cases so we can perform
     // mail migrations, see T9251.
     if (!is_array($this->parameters)) {
       $this->parameters = array();
     }
 
     return idx($this->parameters, $param, $default);
   }
 
   /**
    * These tags are used to allow users to opt out of receiving certain types
    * of mail, like updates when a task's projects change.
    *
    * @param list<const>
    * @return this
    */
   public function setMailTags(array $tags) {
     $this->setParam('mailtags', array_unique($tags));
     return $this;
   }
 
   public function getMailTags() {
     return $this->getParam('mailtags', array());
   }
 
   /**
    * In Gmail, conversations will be broken if you reply to a thread and the
    * server sends back a response without referencing your Message-ID, even if
    * it references a Message-ID earlier in the thread. To avoid this, use the
    * parent email's message ID explicitly if it's available. This overwrites the
    * "In-Reply-To" and "References" headers we would otherwise generate. This
    * needs to be set whenever an action is triggered by an email message. See
    * T251 for more details.
    *
    * @param   string The "Message-ID" of the email which precedes this one.
    * @return  this
    */
   public function setParentMessageID($id) {
     $this->setParam('parent-message-id', $id);
     return $this;
   }
 
   public function getParentMessageID() {
     return $this->getParam('parent-message-id');
   }
 
   public function getSubject() {
     return $this->getParam('subject');
   }
 
   public function addTos(array $phids) {
     $phids = array_unique($phids);
     $this->setParam('to', $phids);
     return $this;
   }
 
   public function addRawTos(array $raw_email) {
 
     // Strip addresses down to bare emails, since the MailAdapter API currently
     // requires we pass it just the address (like `alincoln@logcabin.org`), not
     // a full string like `"Abraham Lincoln" <alincoln@logcabin.org>`.
     foreach ($raw_email as $key => $email) {
       $object = new PhutilEmailAddress($email);
       $raw_email[$key] = $object->getAddress();
     }
 
     $this->setParam('raw-to', $raw_email);
     return $this;
   }
 
   public function addCCs(array $phids) {
     $phids = array_unique($phids);
     $this->setParam('cc', $phids);
     return $this;
   }
 
   public function setExcludeMailRecipientPHIDs(array $exclude) {
     $this->setParam('exclude', $exclude);
     return $this;
   }
 
   private function getExcludeMailRecipientPHIDs() {
     return $this->getParam('exclude', array());
   }
 
   public function setForceHeraldMailRecipientPHIDs(array $force) {
     $this->setParam('herald-force-recipients', $force);
     return $this;
   }
 
   private function getForceHeraldMailRecipientPHIDs() {
     return $this->getParam('herald-force-recipients', array());
   }
 
   public function addPHIDHeaders($name, array $phids) {
     $phids = array_unique($phids);
     foreach ($phids as $phid) {
       $this->addHeader($name, '<'.$phid.'>');
     }
     return $this;
   }
 
   public function addHeader($name, $value) {
     $this->parameters['headers'][] = array($name, $value);
     return $this;
   }
 
   public function addAttachment(PhabricatorMetaMTAAttachment $attachment) {
     $this->parameters['attachments'][] = $attachment->toDictionary();
     return $this;
   }
 
   public function getAttachments() {
     $dicts = $this->getParam('attachments');
 
     $result = array();
     foreach ($dicts as $dict) {
       $result[] = PhabricatorMetaMTAAttachment::newFromDictionary($dict);
     }
     return $result;
   }
 
   public function getAttachmentFilePHIDs() {
     $file_phids = array();
 
     $dictionaries = $this->getParam('attachments');
     if ($dictionaries) {
       foreach ($dictionaries as $dictionary) {
         $file_phid = idx($dictionary, 'filePHID');
         if ($file_phid) {
           $file_phids[] = $file_phid;
         }
       }
     }
 
     return $file_phids;
   }
 
   public function loadAttachedFiles(PhabricatorUser $viewer) {
     $file_phids = $this->getAttachmentFilePHIDs();
 
     if (!$file_phids) {
       return array();
     }
 
     return id(new PhabricatorFileQuery())
       ->setViewer($viewer)
       ->withPHIDs($file_phids)
       ->execute();
   }
 
   public function setAttachments(array $attachments) {
     assert_instances_of($attachments, 'PhabricatorMetaMTAAttachment');
     $this->setParam('attachments', mpull($attachments, 'toDictionary'));
     return $this;
   }
 
   public function setFrom($from) {
     $this->setParam('from', $from);
     $this->setActorPHID($from);
     return $this;
   }
 
   public function getFrom() {
     return $this->getParam('from');
   }
 
   public function setRawFrom($raw_email, $raw_name) {
     $this->setParam('raw-from', array($raw_email, $raw_name));
     return $this;
   }
 
   public function setReplyTo($reply_to) {
     $this->setParam('reply-to', $reply_to);
     return $this;
   }
 
   public function setSubject($subject) {
     $this->setParam('subject', $subject);
     return $this;
   }
 
   public function setSubjectPrefix($prefix) {
     $this->setParam('subject-prefix', $prefix);
     return $this;
   }
 
   public function setVarySubjectPrefix($prefix) {
     $this->setParam('vary-subject-prefix', $prefix);
     return $this;
   }
 
   public function setBody($body) {
     $this->setParam('body', $body);
     return $this;
   }
 
   public function setSensitiveContent($bool) {
     $this->setParam('sensitive', $bool);
     return $this;
   }
 
   public function hasSensitiveContent() {
     return $this->getParam('sensitive', true);
   }
 
   public function setMustEncrypt($bool) {
     $this->setParam('mustEncrypt', $bool);
     return $this;
   }
 
   public function getMustEncrypt() {
     return $this->getParam('mustEncrypt', false);
   }
 
   public function setMustEncryptReasons(array $reasons) {
     $this->setParam('mustEncryptReasons', $reasons);
     return $this;
   }
 
   public function getMustEncryptReasons() {
     return $this->getParam('mustEncryptReasons', array());
   }
 
   public function setMailStamps(array $stamps) {
     return $this->setParam('stamps', $stamps);
   }
 
   public function getMailStamps() {
     return $this->getParam('stamps', array());
   }
 
   public function setMailStampMetadata($metadata) {
     return $this->setParam('stampMetadata', $metadata);
   }
 
   public function getMailStampMetadata() {
     return $this->getParam('stampMetadata', array());
   }
 
   public function setHTMLBody($html) {
     $this->setParam('html-body', $html);
     return $this;
   }
 
   public function getBody() {
     return $this->getParam('body');
   }
 
   public function getHTMLBody() {
     return $this->getParam('html-body');
   }
 
   public function setIsErrorEmail($is_error) {
     $this->setParam('is-error', $is_error);
     return $this;
   }
 
   public function getIsErrorEmail() {
     return $this->getParam('is-error', false);
   }
 
   public function getToPHIDs() {
     return $this->getParam('to', array());
   }
 
   public function getRawToAddresses() {
     return $this->getParam('raw-to', array());
   }
 
   public function getCcPHIDs() {
     return $this->getParam('cc', array());
   }
 
   /**
    * Force delivery of a message, even if recipients have preferences which
    * would otherwise drop the message.
    *
    * This is primarily intended to let users who don't want any email still
    * receive things like password resets.
    *
    * @param bool  True to force delivery despite user preferences.
    * @return this
    */
   public function setForceDelivery($force) {
     $this->setParam('force', $force);
     return $this;
   }
 
   public function getForceDelivery() {
     return $this->getParam('force', false);
   }
 
   /**
    * Flag that this is an auto-generated bulk message and should have bulk
    * headers added to it if appropriate. Broadly, this means some flavor of
    * "Precedence: bulk" or similar, but is implementation and configuration
    * dependent.
    *
    * @param bool  True if the mail is automated bulk mail.
    * @return this
    */
   public function setIsBulk($is_bulk) {
     $this->setParam('is-bulk', $is_bulk);
     return $this;
   }
 
   /**
    * Use this method to set an ID used for message threading. MetaMTA will
    * set appropriate headers (Message-ID, In-Reply-To, References and
    * Thread-Index) based on the capabilities of the underlying mailer.
    *
    * @param string  Unique identifier, appropriate for use in a Message-ID,
    *                In-Reply-To or References headers.
    * @param bool    If true, indicates this is the first message in the thread.
    * @return this
    */
   public function setThreadID($thread_id, $is_first_message = false) {
     $this->setParam('thread-id', $thread_id);
     $this->setParam('is-first-message', $is_first_message);
     return $this;
   }
 
   /**
    * Save a newly created mail to the database. The mail will eventually be
    * delivered by the MetaMTA daemon.
    *
    * @return this
    */
   public function saveAndSend() {
     return $this->save();
   }
 
   /**
    * @return this
    */
   public function save() {
     if ($this->getID()) {
       return parent::save();
     }
 
     // NOTE: When mail is sent from CLI scripts that run tasks in-process, we
     // may re-enter this method from within scheduleTask(). The implementation
     // is intended to avoid anything awkward if we end up reentering this
     // method.
 
     $this->openTransaction();
       // Save to generate a mail ID and PHID.
       $result = parent::save();
 
       // Write the recipient edges.
       $editor = new PhabricatorEdgeEditor();
       $edge_type = PhabricatorMetaMTAMailHasRecipientEdgeType::EDGECONST;
       $recipient_phids = array_merge(
         $this->getToPHIDs(),
         $this->getCcPHIDs());
       $expanded_phids = $this->expandRecipients($recipient_phids);
       $all_phids = array_unique(array_merge(
         $recipient_phids,
         $expanded_phids));
       foreach ($all_phids as $curr_phid) {
         $editor->addEdge($this->getPHID(), $edge_type, $curr_phid);
       }
       $editor->save();
 
     $this->saveTransaction();
 
     // Queue a task to send this mail.
     $mailer_task = PhabricatorWorker::scheduleTask(
       'PhabricatorMetaMTAWorker',
       $this->getID(),
       array(
         'priority' => PhabricatorWorker::PRIORITY_ALERTS,
       ));
 
     return $result;
   }
 
   /**
    * Attempt to deliver an email immediately, in this process.
    *
    * @return void
    */
   public function sendNow() {
     if ($this->getStatus() != PhabricatorMailOutboundStatus::STATUS_QUEUE) {
       throw new Exception(pht('Trying to send an already-sent mail!'));
     }
 
-    $mailers = $this->newMailers();
+    $mailers = self::newMailers();
 
     return $this->sendWithMailers($mailers);
   }
 
-  private function newMailers() {
+  public static function newMailers() {
     $mailers = array();
 
-    $mailer = PhabricatorEnv::newObjectFromConfig('metamta.mail-adapter');
+    $config = PhabricatorEnv::getEnvConfig('cluster.mailers');
+    if ($config === null) {
+      $mailer = PhabricatorEnv::newObjectFromConfig('metamta.mail-adapter');
 
-    $defaults = $mailer->newDefaultOptions();
-    $options = $mailer->newLegacyOptions();
+      $defaults = $mailer->newDefaultOptions();
+      $options = $mailer->newLegacyOptions();
 
-    $options = $options + $defaults;
+      $options = $options + $defaults;
 
-    $mailer
-      ->setKey('default')
-      ->setOptions($options);
+      $mailer
+        ->setKey('default')
+        ->setPriority(-1)
+        ->setOptions($options);
 
-    $mailer->prepareForSend();
+      $mailers[] = $mailer;
+    } else {
+      $adapters = PhabricatorMailImplementationAdapter::getAllAdapters();
+      $next_priority = -1;
+
+      foreach ($config as $spec) {
+        $type = $spec['type'];
+        if (!isset($adapters[$type])) {
+          throw new Exception(
+            pht(
+              'Unknown mailer ("%s")!',
+              $type));
+        }
 
-    $mailers[] = $mailer;
+        $key = $spec['key'];
+        $mailer = id(clone $adapters[$type])
+          ->setKey($key);
 
-    return $mailers;
+        $priority = idx($spec, 'priority');
+        if (!$priority) {
+          $priority = $next_priority;
+          $next_priority--;
+        }
+        $mailer->setPriority($priority);
+
+        $defaults = $mailer->newDefaultOptions();
+        $options = idx($spec, 'options', array()) + $defaults;
+        $mailer->setOptions($options);
+      }
+    }
+
+    $sorted = array();
+    $groups = mgroup($mailers, 'getPriority');
+    ksort($groups);
+    foreach ($groups as $group) {
+      // Reorder services within the same priority group randomly.
+      shuffle($group);
+      foreach ($group as $mailer) {
+        $sorted[] = $mailer;
+      }
+    }
+
+    foreach ($sorted as $mailer) {
+      $mailer->prepareForSend();
+    }
+
+    return $sorted;
   }
 
   public function sendWithMailers(array $mailers) {
+    if (!$mailers) {
+      return $this
+        ->setStatus(PhabricatorMailOutboundStatus::STATUS_VOID)
+        ->setMessage(pht('No mailers are configured.'))
+        ->save();
+    }
+
     $exceptions = array();
     foreach ($mailers as $template_mailer) {
       $mailer = null;
 
       try {
         $mailer = $this->buildMailer($template_mailer);
       } catch (Exception $ex) {
         $exceptions[] = $ex;
         continue;
       }
 
       if (!$mailer) {
         // If we don't get a mailer back, that means the mail doesn't
         // actually need to be sent (for example, because recipients have
         // declined to receive the mail). Void it and return.
         return $this
           ->setStatus(PhabricatorMailOutboundStatus::STATUS_VOID)
           ->save();
       }
 
       try {
         $ok = $mailer->send();
         if (!$ok) {
           // TODO: At some point, we should clean this up and make all mailers
           // throw.
           throw new Exception(
             pht(
               'Mail adapter encountered an unexpected, unspecified '.
               'failure.'));
         }
       } catch (PhabricatorMetaMTAPermanentFailureException $ex) {
         // If any mailer raises a permanent failure, stop trying to send the
         // mail with other mailers.
         $this
           ->setStatus(PhabricatorMailOutboundStatus::STATUS_FAIL)
           ->setMessage($ex->getMessage())
           ->save();
 
         throw $ex;
       } catch (Exception $ex) {
         $exceptions[] = $ex;
         continue;
       }
 
       return $this
         ->setStatus(PhabricatorMailOutboundStatus::STATUS_SENT)
         ->save();
     }
 
     // If we make it here, no mailer could send the mail but no mailer failed
     // permanently either. We update the error message for the mail, but leave
     // it in the current status (usually, STATUS_QUEUE) and try again later.
 
     $messages = array();
     foreach ($exceptions as $ex) {
       $messages[] = $ex->getMessage();
     }
     $messages = implode("\n\n", $messages);
 
     $this
       ->setMessage($messages)
       ->save();
 
     if (count($exceptions) === 1) {
       throw head($exceptions);
     }
 
     throw new PhutilAggregateException(
       pht('Encountered multiple exceptions while transmitting mail.'),
       $exceptions);
   }
 
   private function buildMailer(PhabricatorMailImplementationAdapter $mailer) {
     $headers = $this->generateHeaders();
 
     $params = $this->parameters;
 
     $actors = $this->loadAllActors();
     $deliverable_actors = $this->filterDeliverableActors($actors);
 
     $default_from = PhabricatorEnv::getEnvConfig('metamta.default-address');
     if (empty($params['from'])) {
       $mailer->setFrom($default_from);
     }
 
     $is_first = idx($params, 'is-first-message');
     unset($params['is-first-message']);
 
     $is_threaded = (bool)idx($params, 'thread-id');
     $must_encrypt = $this->getMustEncrypt();
 
     $reply_to_name = idx($params, 'reply-to-name', '');
     unset($params['reply-to-name']);
 
     $add_cc = array();
     $add_to = array();
 
     // If we're sending one mail to everyone, some recipients will be in
     // "Cc" rather than "To". We'll move them to "To" later (or supply a
     // dummy "To") but need to look for the recipient in either the
     // "To" or "Cc" fields here.
     $target_phid = head(idx($params, 'to', array()));
     if (!$target_phid) {
       $target_phid = head(idx($params, 'cc', array()));
     }
 
     $preferences = $this->loadPreferences($target_phid);
 
     foreach ($params as $key => $value) {
       switch ($key) {
         case 'raw-from':
           list($from_email, $from_name) = $value;
           $mailer->setFrom($from_email, $from_name);
           break;
         case 'from':
           // If the mail content must be encrypted, disguise the sender.
           if ($must_encrypt) {
             $mailer->setFrom($default_from, pht('Phabricator'));
             break;
           }
 
           $from = $value;
           $actor_email = null;
           $actor_name = null;
           $actor = idx($actors, $from);
           if ($actor) {
             $actor_email = $actor->getEmailAddress();
             $actor_name = $actor->getName();
           }
           $can_send_as_user = $actor_email &&
             PhabricatorEnv::getEnvConfig('metamta.can-send-as-user');
 
           if ($can_send_as_user) {
             $mailer->setFrom($actor_email, $actor_name);
           } else {
             $from_email = coalesce($actor_email, $default_from);
             $from_name = coalesce($actor_name, pht('Phabricator'));
 
             if (empty($params['reply-to'])) {
               $params['reply-to'] = $from_email;
               $params['reply-to-name'] = $from_name;
             }
 
             $mailer->setFrom($default_from, $from_name);
           }
           break;
         case 'reply-to':
           $mailer->addReplyTo($value, $reply_to_name);
           break;
         case 'to':
           $to_phids = $this->expandRecipients($value);
           $to_actors = array_select_keys($deliverable_actors, $to_phids);
           $add_to = array_merge(
             $add_to,
             mpull($to_actors, 'getEmailAddress'));
           break;
         case 'raw-to':
           $add_to = array_merge($add_to, $value);
           break;
         case 'cc':
           $cc_phids = $this->expandRecipients($value);
           $cc_actors = array_select_keys($deliverable_actors, $cc_phids);
           $add_cc = array_merge(
             $add_cc,
             mpull($cc_actors, 'getEmailAddress'));
           break;
         case 'attachments':
           $attached_viewer = PhabricatorUser::getOmnipotentUser();
           $files = $this->loadAttachedFiles($attached_viewer);
           foreach ($files as $file) {
             $file->attachToObject($this->getPHID());
           }
 
           // If the mail content must be encrypted, don't add attachments.
           if ($must_encrypt) {
             break;
           }
 
           $value = $this->getAttachments();
           foreach ($value as $attachment) {
             $mailer->addAttachment(
               $attachment->getData(),
               $attachment->getFilename(),
               $attachment->getMimeType());
           }
           break;
         case 'subject':
           $subject = array();
 
           if ($is_threaded) {
             if ($this->shouldAddRePrefix($preferences)) {
               $subject[] = 'Re:';
             }
           }
 
           $subject[] = trim(idx($params, 'subject-prefix'));
 
           // If mail content must be encrypted, we replace the subject with
           // a generic one.
           if ($must_encrypt) {
             $subject[] = pht('Object Updated');
           } else {
             $vary_prefix = idx($params, 'vary-subject-prefix');
             if ($vary_prefix != '') {
               if ($this->shouldVarySubject($preferences)) {
                 $subject[] = $vary_prefix;
               }
             }
 
             $subject[] = $value;
           }
 
           $mailer->setSubject(implode(' ', array_filter($subject)));
           break;
         case 'thread-id':
 
           // NOTE: Gmail freaks out about In-Reply-To and References which
           // aren't in the form "<string@domain.tld>"; this is also required
           // by RFC 2822, although some clients are more liberal in what they
           // accept.
           $domain = PhabricatorEnv::getEnvConfig('metamta.domain');
           $value = '<'.$value.'@'.$domain.'>';
 
           if ($is_first && $mailer->supportsMessageIDHeader()) {
             $headers[] = array('Message-ID',  $value);
           } else {
             $in_reply_to = $value;
             $references = array($value);
             $parent_id = $this->getParentMessageID();
             if ($parent_id) {
               $in_reply_to = $parent_id;
               // By RFC 2822, the most immediate parent should appear last
               // in the "References" header, so this order is intentional.
               $references[] = $parent_id;
             }
             $references = implode(' ', $references);
             $headers[] = array('In-Reply-To', $in_reply_to);
             $headers[] = array('References',  $references);
           }
           $thread_index = $this->generateThreadIndex($value, $is_first);
           $headers[] = array('Thread-Index', $thread_index);
           break;
         default:
           // Other parameters are handled elsewhere or are not relevant to
           // constructing the message.
           break;
       }
     }
 
     $stamps = $this->getMailStamps();
     if ($stamps) {
       $headers[] = array('X-Phabricator-Stamps', implode(', ', $stamps));
     }
 
     $raw_body = idx($params, 'body', '');
     $body = $raw_body;
     if ($must_encrypt) {
       $parts = array();
       $parts[] = pht(
         'The content for this message can only be transmitted over a '.
         'secure channel. To view the message content, follow this '.
         'link:');
 
       $parts[] = PhabricatorEnv::getProductionURI($this->getURI());
 
       $body = implode("\n\n", $parts);
     } else {
       $body = $raw_body;
     }
 
     $max = PhabricatorEnv::getEnvConfig('metamta.email-body-limit');
     if (strlen($body) > $max) {
       $body = id(new PhutilUTF8StringTruncator())
         ->setMaximumBytes($max)
         ->truncateString($body);
       $body .= "\n";
       $body .= pht('(This email was truncated at %d bytes.)', $max);
     }
     $mailer->setBody($body);
 
     // If we sent a different message body than we were asked to, record
     // what we actually sent to make debugging and diagnostics easier.
     if ($body !== $raw_body) {
       $this->setParam('body.sent', $body);
     }
 
     if ($must_encrypt) {
       $send_html = false;
     } else {
       $send_html = $this->shouldSendHTML($preferences);
     }
 
     if ($send_html && isset($params['html-body'])) {
       $mailer->setHTMLBody($params['html-body']);
     }
 
     // Pass the headers to the mailer, then save the state so we can show
     // them in the web UI. If the mail must be encrypted, we remove headers
     // which are not on a strict whitelist to avoid disclosing information.
     $filtered_headers = $this->filterHeaders($headers, $must_encrypt);
     foreach ($filtered_headers as $header) {
       list($header_key, $header_value) = $header;
       $mailer->addHeader($header_key, $header_value);
     }
     $this->setParam('headers.unfiltered', $headers);
     $this->setParam('headers.sent', $filtered_headers);
 
     // Save the final deliverability outcomes and reasoning so we can
     // explain why things happened the way they did.
     $actor_list = array();
     foreach ($actors as $actor) {
       $actor_list[$actor->getPHID()] = array(
         'deliverable' => $actor->isDeliverable(),
         'reasons' => $actor->getDeliverabilityReasons(),
       );
     }
     $this->setParam('actors.sent', $actor_list);
 
     $this->setParam('routing.sent', $this->getParam('routing'));
     $this->setParam('routingmap.sent', $this->getRoutingRuleMap());
 
     if (!$add_to && !$add_cc) {
       $this->setMessage(
         pht(
           'Message has no valid recipients: all To/Cc are disabled, '.
           'invalid, or configured not to receive this mail.'));
 
       return null;
     }
 
     if ($this->getIsErrorEmail()) {
       $all_recipients = array_merge($add_to, $add_cc);
       if ($this->shouldRateLimitMail($all_recipients)) {
         $this->setMessage(
           pht(
             'This is an error email, but one or more recipients have '.
             'exceeded the error email rate limit. Declining to deliver '.
             'message.'));
 
         return null;
       }
     }
 
     if (PhabricatorEnv::getEnvConfig('phabricator.silent')) {
       $this->setMessage(
         pht(
           'Phabricator is running in silent mode. See `%s` '.
           'in the configuration to change this setting.',
           'phabricator.silent'));
 
       return null;
     }
 
     // Some mailers require a valid "To:" in order to deliver mail. If we
     // don't have any "To:", try to fill it in with a placeholder "To:".
     // If that also fails, move the "Cc:" line to "To:".
     if (!$add_to) {
       $placeholder_key = 'metamta.placeholder-to-recipient';
       $placeholder = PhabricatorEnv::getEnvConfig($placeholder_key);
       if ($placeholder !== null) {
         $add_to = array($placeholder);
       } else {
         $add_to = $add_cc;
         $add_cc = array();
       }
     }
 
     $add_to = array_unique($add_to);
     $add_cc = array_diff(array_unique($add_cc), $add_to);
 
     $mailer->addTos($add_to);
     if ($add_cc) {
       $mailer->addCCs($add_cc);
     }
 
+    // Keep track of which mailer actually ended up accepting the message.
+    $mailer_key = $mailer->getKey();
+    if ($mailer_key !== null) {
+      $this->setParam('mailer.key', $mailer_key);
+    }
+
     return $mailer;
   }
 
   private function generateThreadIndex($seed, $is_first_mail) {
     // When threading, Outlook ignores the 'References' and 'In-Reply-To'
     // headers that most clients use. Instead, it uses a custom 'Thread-Index'
     // header. The format of this header is something like this (from
     // camel-exchange-folder.c in Evolution Exchange):
 
     /* A new post to a folder gets a 27-byte-long thread index. (The value
      * is apparently unique but meaningless.) Each reply to a post gets a
      * 32-byte-long thread index whose first 27 bytes are the same as the
      * parent's thread index. Each reply to any of those gets a
      * 37-byte-long thread index, etc. The Thread-Index header contains a
      * base64 representation of this value.
      */
 
     // The specific implementation uses a 27-byte header for the first email
     // a recipient receives, and a random 5-byte suffix (32 bytes total)
     // thereafter. This means that all the replies are (incorrectly) siblings,
     // but it would be very difficult to keep track of the entire tree and this
     // gets us reasonable client behavior.
 
     $base = substr(md5($seed), 0, 27);
     if (!$is_first_mail) {
       // Not totally sure, but it seems like outlook orders replies by
       // thread-index rather than timestamp, so to get these to show up in the
       // right order we use the time as the last 4 bytes.
       $base .= ' '.pack('N', time());
     }
 
     return base64_encode($base);
   }
 
   public static function shouldMailEachRecipient() {
     return PhabricatorEnv::getEnvConfig('metamta.one-mail-per-recipient');
   }
 
 
 /* -(  Managing Recipients  )------------------------------------------------ */
 
 
   /**
    * Get all of the recipients for this mail, after preference filters are
    * applied. This list has all objects to whom delivery will be attempted.
    *
    * Note that this expands recipients into their members, because delivery
    * is never directly attempted to aggregate actors like projects.
    *
    * @return  list<phid>  A list of all recipients to whom delivery will be
    *                      attempted.
    * @task recipients
    */
   public function buildRecipientList() {
     $actors = $this->loadAllActors();
     $actors = $this->filterDeliverableActors($actors);
     return mpull($actors, 'getPHID');
   }
 
   public function loadAllActors() {
     $actor_phids = $this->getExpandedRecipientPHIDs();
     return $this->loadActors($actor_phids);
   }
 
   public function getExpandedRecipientPHIDs() {
     $actor_phids = $this->getAllActorPHIDs();
     return $this->expandRecipients($actor_phids);
   }
 
   private function getAllActorPHIDs() {
     return array_merge(
       array($this->getParam('from')),
       $this->getToPHIDs(),
       $this->getCcPHIDs());
   }
 
   /**
    * Expand a list of recipient PHIDs (possibly including aggregate recipients
    * like projects) into a deaggregated list of individual recipient PHIDs.
    * For example, this will expand project PHIDs into a list of the project's
    * members.
    *
    * @param list<phid>  List of recipient PHIDs, possibly including aggregate
    *                    recipients.
    * @return list<phid> Deaggregated list of mailable recipients.
    */
   private function expandRecipients(array $phids) {
     if ($this->recipientExpansionMap === null) {
       $all_phids = $this->getAllActorPHIDs();
       $this->recipientExpansionMap = id(new PhabricatorMetaMTAMemberQuery())
         ->setViewer(PhabricatorUser::getOmnipotentUser())
         ->withPHIDs($all_phids)
         ->execute();
     }
 
     $results = array();
     foreach ($phids as $phid) {
       foreach ($this->recipientExpansionMap[$phid] as $recipient_phid) {
         $results[$recipient_phid] = $recipient_phid;
       }
     }
 
     return array_keys($results);
   }
 
   private function filterDeliverableActors(array $actors) {
     assert_instances_of($actors, 'PhabricatorMetaMTAActor');
     $deliverable_actors = array();
     foreach ($actors as $phid => $actor) {
       if ($actor->isDeliverable()) {
         $deliverable_actors[$phid] = $actor;
       }
     }
     return $deliverable_actors;
   }
 
   private function loadActors(array $actor_phids) {
     $actor_phids = array_filter($actor_phids);
     $viewer = PhabricatorUser::getOmnipotentUser();
 
     $actors = id(new PhabricatorMetaMTAActorQuery())
       ->setViewer($viewer)
       ->withPHIDs($actor_phids)
       ->execute();
 
     if (!$actors) {
       return array();
     }
 
     if ($this->getForceDelivery()) {
       // If we're forcing delivery, skip all the opt-out checks. We don't
       // bother annotating reasoning on the mail in this case because it should
       // always be obvious why the mail hit this rule (e.g., it is a password
       // reset mail).
       foreach ($actors as $actor) {
         $actor->setDeliverable(PhabricatorMetaMTAActor::REASON_FORCE);
       }
       return $actors;
     }
 
     // Exclude explicit recipients.
     foreach ($this->getExcludeMailRecipientPHIDs() as $phid) {
       $actor = idx($actors, $phid);
       if (!$actor) {
         continue;
       }
       $actor->setUndeliverable(PhabricatorMetaMTAActor::REASON_RESPONSE);
     }
 
     // Before running more rules, save a list of the actors who were
     // deliverable before we started running preference-based rules. This stops
     // us from trying to send mail to disabled users just because a Herald rule
     // added them, for example.
     $deliverable = array();
     foreach ($actors as $phid => $actor) {
       if ($actor->isDeliverable()) {
         $deliverable[] = $phid;
       }
     }
 
     // For the rest of the rules, order matters. We're going to run all the
     // possible rules in order from weakest to strongest, and let the strongest
     // matching rule win. The weaker rules leave annotations behind which help
     // users understand why the mail was routed the way it was.
 
     // Exclude the actor if their preferences are set.
     $from_phid = $this->getParam('from');
     $from_actor = idx($actors, $from_phid);
     if ($from_actor) {
       $from_user = id(new PhabricatorPeopleQuery())
         ->setViewer($viewer)
         ->withPHIDs(array($from_phid))
         ->needUserSettings(true)
         ->execute();
       $from_user = head($from_user);
       if ($from_user) {
         $pref_key = PhabricatorEmailSelfActionsSetting::SETTINGKEY;
         $exclude_self = $from_user->getUserSetting($pref_key);
         if ($exclude_self) {
           $from_actor->setUndeliverable(PhabricatorMetaMTAActor::REASON_SELF);
         }
       }
     }
 
     $all_prefs = id(new PhabricatorUserPreferencesQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withUserPHIDs($actor_phids)
       ->needSyntheticPreferences(true)
       ->execute();
     $all_prefs = mpull($all_prefs, null, 'getUserPHID');
 
     $value_email = PhabricatorEmailTagsSetting::VALUE_EMAIL;
 
     // Exclude all recipients who have set preferences to not receive this type
     // of email (for example, a user who says they don't want emails about task
     // CC changes).
     $tags = $this->getParam('mailtags');
     if ($tags) {
       foreach ($all_prefs as $phid => $prefs) {
         $user_mailtags = $prefs->getSettingValue(
           PhabricatorEmailTagsSetting::SETTINGKEY);
 
         // The user must have elected to receive mail for at least one
         // of the mailtags.
         $send = false;
         foreach ($tags as $tag) {
           if (((int)idx($user_mailtags, $tag, $value_email)) == $value_email) {
             $send = true;
             break;
           }
         }
 
         if (!$send) {
           $actors[$phid]->setUndeliverable(
             PhabricatorMetaMTAActor::REASON_MAILTAGS);
         }
       }
     }
 
     foreach ($deliverable as $phid) {
       switch ($this->getRoutingRule($phid)) {
         case PhabricatorMailRoutingRule::ROUTE_AS_NOTIFICATION:
           $actors[$phid]->setUndeliverable(
             PhabricatorMetaMTAActor::REASON_ROUTE_AS_NOTIFICATION);
           break;
         case PhabricatorMailRoutingRule::ROUTE_AS_MAIL:
           $actors[$phid]->setDeliverable(
             PhabricatorMetaMTAActor::REASON_ROUTE_AS_MAIL);
           break;
         default:
           // No change.
           break;
       }
     }
 
     // If recipients were initially deliverable and were added by "Send me an
     // email" Herald rules, annotate them as such and make them deliverable
     // again, overriding any changes made by the "self mail" and "mail tags"
     // settings.
     $force_recipients = $this->getForceHeraldMailRecipientPHIDs();
     $force_recipients = array_fuse($force_recipients);
     if ($force_recipients) {
       foreach ($deliverable as $phid) {
         if (isset($force_recipients[$phid])) {
           $actors[$phid]->setDeliverable(
             PhabricatorMetaMTAActor::REASON_FORCE_HERALD);
         }
       }
     }
 
     // Exclude recipients who don't want any mail. This rule is very strong
     // and runs last.
     foreach ($all_prefs as $phid => $prefs) {
       $exclude = $prefs->getSettingValue(
         PhabricatorEmailNotificationsSetting::SETTINGKEY);
       if ($exclude) {
         $actors[$phid]->setUndeliverable(
           PhabricatorMetaMTAActor::REASON_MAIL_DISABLED);
       }
     }
 
     // Unless delivery was forced earlier (password resets, confirmation mail),
     // never send mail to unverified addresses.
     foreach ($actors as $phid => $actor) {
       if ($actor->getIsVerified()) {
         continue;
       }
 
       $actor->setUndeliverable(PhabricatorMetaMTAActor::REASON_UNVERIFIED);
     }
 
     return $actors;
   }
 
   private function shouldRateLimitMail(array $all_recipients) {
     try {
       PhabricatorSystemActionEngine::willTakeAction(
         $all_recipients,
         new PhabricatorMetaMTAErrorMailAction(),
         1);
       return false;
     } catch (PhabricatorSystemActionRateLimitException $ex) {
       return true;
     }
   }
 
   public function generateHeaders() {
     $headers = array();
 
     $headers[] = array('X-Phabricator-Sent-This-Message', 'Yes');
     $headers[] = array('X-Mail-Transport-Agent', 'MetaMTA');
 
     // Some clients respect this to suppress OOF and other auto-responses.
     $headers[] = array('X-Auto-Response-Suppress', 'All');
 
     $mailtags = $this->getParam('mailtags');
     if ($mailtags) {
       $tag_header = array();
       foreach ($mailtags as $mailtag) {
         $tag_header[] = '<'.$mailtag.'>';
       }
       $tag_header = implode(', ', $tag_header);
       $headers[] = array('X-Phabricator-Mail-Tags', $tag_header);
     }
 
     $value = $this->getParam('headers', array());
     foreach ($value as $pair) {
       list($header_key, $header_value) = $pair;
 
       // NOTE: If we have \n in a header, SES rejects the email.
       $header_value = str_replace("\n", ' ', $header_value);
       $headers[] = array($header_key, $header_value);
     }
 
     $is_bulk = $this->getParam('is-bulk');
     if ($is_bulk) {
       $headers[] = array('Precedence', 'bulk');
     }
 
     if ($this->getMustEncrypt()) {
       $headers[] = array('X-Phabricator-Must-Encrypt', 'Yes');
     }
 
     return $headers;
   }
 
   public function getDeliveredHeaders() {
     return $this->getParam('headers.sent');
   }
 
   public function getUnfilteredHeaders() {
     $unfiltered = $this->getParam('headers.unfiltered');
 
     if ($unfiltered === null) {
       // Older versions of Phabricator did not filter headers, and thus did
       // not record unfiltered headers. If we don't have unfiltered header
       // data just return the delivered headers for compatibility.
       return $this->getDeliveredHeaders();
     }
 
     return $unfiltered;
   }
 
   public function getDeliveredActors() {
     return $this->getParam('actors.sent');
   }
 
   public function getDeliveredRoutingRules() {
     return $this->getParam('routing.sent');
   }
 
   public function getDeliveredRoutingMap() {
     return $this->getParam('routingmap.sent');
   }
 
   public function getDeliveredBody() {
     return $this->getParam('body.sent');
   }
 
   private function filterHeaders(array $headers, $must_encrypt) {
     if (!$must_encrypt) {
       return $headers;
     }
 
     $whitelist = array(
       'In-Reply-To',
       'Message-ID',
       'Precedence',
       'References',
       'Thread-Index',
 
       'X-Mail-Transport-Agent',
       'X-Auto-Response-Suppress',
 
       'X-Phabricator-Sent-This-Message',
       'X-Phabricator-Must-Encrypt',
     );
 
     // NOTE: The major header we want to drop is "X-Phabricator-Mail-Tags".
     // This header contains a significant amount of meaningful information
     // about the object.
 
     $whitelist_map = array();
     foreach ($whitelist as $term) {
       $whitelist_map[phutil_utf8_strtolower($term)] = true;
     }
 
     foreach ($headers as $key => $header) {
       list($name, $value) = $header;
       $name = phutil_utf8_strtolower($name);
 
       if (!isset($whitelist_map[$name])) {
         unset($headers[$key]);
       }
     }
 
     return $headers;
   }
 
   public function getURI() {
     return '/mail/detail/'.$this->getID().'/';
   }
 
 
 /* -(  Routing  )------------------------------------------------------------ */
 
 
   public function addRoutingRule($routing_rule, $phids, $reason_phid) {
     $routing = $this->getParam('routing', array());
     $routing[] = array(
       'routingRule' => $routing_rule,
       'phids' => $phids,
       'reasonPHID' => $reason_phid,
     );
     $this->setParam('routing', $routing);
 
     // Throw the routing map away so we rebuild it.
     $this->routingMap = null;
 
     return $this;
   }
 
   private function getRoutingRule($phid) {
     $map = $this->getRoutingRuleMap();
 
     $info = idx($map, $phid, idx($map, 'default'));
     if ($info) {
       return idx($info, 'rule');
     }
 
     return null;
   }
 
   private function getRoutingRuleMap() {
     if ($this->routingMap === null) {
       $map = array();
 
       $routing = $this->getParam('routing', array());
       foreach ($routing as $route) {
         $phids = $route['phids'];
         if ($phids === null) {
           $phids = array('default');
         }
 
         foreach ($phids as $phid) {
           $new_rule = $route['routingRule'];
 
           $current_rule = idx($map, $phid);
           if ($current_rule === null) {
             $is_stronger = true;
           } else {
             $is_stronger = PhabricatorMailRoutingRule::isStrongerThan(
               $new_rule,
               $current_rule);
           }
 
           if ($is_stronger) {
             $map[$phid] = array(
               'rule' => $new_rule,
               'reason' => $route['reasonPHID'],
             );
           }
         }
       }
 
       $this->routingMap = $map;
     }
 
     return $this->routingMap;
   }
 
 /* -(  Preferences  )-------------------------------------------------------- */
 
 
   private function loadPreferences($target_phid) {
     $viewer = PhabricatorUser::getOmnipotentUser();
 
     if (self::shouldMailEachRecipient()) {
       $preferences = id(new PhabricatorUserPreferencesQuery())
         ->setViewer($viewer)
         ->withUserPHIDs(array($target_phid))
         ->needSyntheticPreferences(true)
         ->executeOne();
       if ($preferences) {
         return $preferences;
       }
     }
 
     return PhabricatorUserPreferences::loadGlobalPreferences($viewer);
   }
 
   private function shouldAddRePrefix(PhabricatorUserPreferences $preferences) {
     $value = $preferences->getSettingValue(
       PhabricatorEmailRePrefixSetting::SETTINGKEY);
 
     return ($value == PhabricatorEmailRePrefixSetting::VALUE_RE_PREFIX);
   }
 
   private function shouldVarySubject(PhabricatorUserPreferences $preferences) {
     $value = $preferences->getSettingValue(
       PhabricatorEmailVarySubjectsSetting::SETTINGKEY);
 
     return ($value == PhabricatorEmailVarySubjectsSetting::VALUE_VARY_SUBJECTS);
   }
 
   private function shouldSendHTML(PhabricatorUserPreferences $preferences) {
     $value = $preferences->getSettingValue(
       PhabricatorEmailFormatSetting::SETTINGKEY);
 
     return ($value == PhabricatorEmailFormatSetting::VALUE_HTML_EMAIL);
   }
 
   public function shouldRenderMailStampsInBody($viewer) {
     $preferences = $this->loadPreferences($viewer->getPHID());
     $value = $preferences->getSettingValue(
       PhabricatorEmailStampsSetting::SETTINGKEY);
 
     return ($value == PhabricatorEmailStampsSetting::VALUE_BODY_STAMPS);
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
     );
   }
 
   public function getPolicy($capability) {
     return PhabricatorPolicies::POLICY_NOONE;
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     $actor_phids = $this->getExpandedRecipientPHIDs();
     return in_array($viewer->getPHID(), $actor_phids);
   }
 
   public function describeAutomaticCapability($capability) {
     return pht(
       'The mail sender and message recipients can always see the mail.');
   }
 
 
 /* -(  PhabricatorDestructibleInterface  )----------------------------------- */
 
 
   public function destroyObjectPermanently(
     PhabricatorDestructionEngine $engine) {
 
     $files = $this->loadAttachedFiles($engine->getViewer());
     foreach ($files as $file) {
       $engine->destroyObject($file);
     }
 
     $this->delete();
   }
 
 }
diff --git a/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php b/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php
index c5390de362..e4f9607801 100644
--- a/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php
+++ b/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php
@@ -1,4129 +1,4130 @@
 <?php
 
 /**
  *
  * Publishing and Managing State
  * ======
  *
  * After applying changes, the Editor queues a worker to publish mail, feed,
  * and notifications, and to perform other background work like updating search
  * indexes. This allows it to do this work without impacting performance for
  * users.
  *
  * When work is moved to the daemons, the Editor state is serialized by
  * @{method:getWorkerState}, then reloaded in a daemon process by
  * @{method:loadWorkerState}. **This is fragile.**
  *
  * State is not persisted into the daemons by default, because we can not send
  * arbitrary objects into the queue. This means the default behavior of any
  * state properties is to reset to their defaults without warning prior to
  * publishing.
  *
  * The easiest way to avoid this is to keep Editors stateless: the overwhelming
  * majority of Editors can be written statelessly. If you need to maintain
  * state, you can either:
  *
  *   - not require state to exist during publishing; or
  *   - pass state to the daemons by implementing @{method:getCustomWorkerState}
  *     and @{method:loadCustomWorkerState}.
  *
  * This architecture isn't ideal, and we may eventually split this class into
  * "Editor" and "Publisher" parts to make it more robust. See T6367 for some
  * discussion and context.
  *
  * @task mail Sending Mail
  * @task feed Publishing Feed Stories
  * @task search Search Index
  * @task files Integration with Files
  * @task workers Managing Workers
  */
 abstract class PhabricatorApplicationTransactionEditor
   extends PhabricatorEditor {
 
   private $contentSource;
   private $object;
   private $xactions;
 
   private $isNewObject;
   private $mentionedPHIDs;
   private $continueOnNoEffect;
   private $continueOnMissingFields;
   private $parentMessageID;
   private $heraldAdapter;
   private $heraldTranscript;
   private $subscribers;
   private $unmentionablePHIDMap = array();
   private $applicationEmail;
 
   private $isPreview;
   private $isHeraldEditor;
   private $isInverseEdgeEditor;
   private $actingAsPHID;
 
   private $heraldEmailPHIDs = array();
   private $heraldForcedEmailPHIDs = array();
   private $heraldHeader;
   private $mailToPHIDs = array();
   private $mailCCPHIDs = array();
   private $feedNotifyPHIDs = array();
   private $feedRelatedPHIDs = array();
   private $feedShouldPublish = false;
   private $mailShouldSend = false;
   private $modularTypes;
   private $silent;
   private $mustEncrypt;
   private $stampTemplates = array();
   private $mailStamps = array();
 
   private $transactionQueue = array();
 
   const STORAGE_ENCODING_BINARY = 'binary';
 
   /**
    * Get the class name for the application this editor is a part of.
    *
    * Uninstalling the application will disable the editor.
    *
    * @return string Editor's application class name.
    */
   abstract public function getEditorApplicationClass();
 
 
   /**
    * Get a description of the objects this editor edits, like "Differential
    * Revisions".
    *
    * @return string Human readable description of edited objects.
    */
   abstract public function getEditorObjectsDescription();
 
 
   public function setActingAsPHID($acting_as_phid) {
     $this->actingAsPHID = $acting_as_phid;
     return $this;
   }
 
   public function getActingAsPHID() {
     if ($this->actingAsPHID) {
       return $this->actingAsPHID;
     }
     return $this->getActor()->getPHID();
   }
 
 
   /**
    * When the editor tries to apply transactions that have no effect, should
    * it raise an exception (default) or drop them and continue?
    *
    * Generally, you will set this flag for edits coming from "Edit" interfaces,
    * and leave it cleared for edits coming from "Comment" interfaces, so the
    * user will get a useful error if they try to submit a comment that does
    * nothing (e.g., empty comment with a status change that has already been
    * performed by another user).
    *
    * @param bool  True to drop transactions without effect and continue.
    * @return this
    */
   public function setContinueOnNoEffect($continue) {
     $this->continueOnNoEffect = $continue;
     return $this;
   }
 
   public function getContinueOnNoEffect() {
     return $this->continueOnNoEffect;
   }
 
 
   /**
    * When the editor tries to apply transactions which don't populate all of
    * an object's required fields, should it raise an exception (default) or
    * drop them and continue?
    *
    * For example, if a user adds a new required custom field (like "Severity")
    * to a task, all existing tasks won't have it populated. When users
    * manually edit existing tasks, it's usually desirable to have them provide
    * a severity. However, other operations (like batch editing just the
    * owner of a task) will fail by default.
    *
    * By setting this flag for edit operations which apply to specific fields
    * (like the priority, batch, and merge editors in Maniphest), these
    * operations can continue to function even if an object is outdated.
    *
    * @param bool  True to continue when transactions don't completely satisfy
    *              all required fields.
    * @return this
    */
   public function setContinueOnMissingFields($continue_on_missing_fields) {
     $this->continueOnMissingFields = $continue_on_missing_fields;
     return $this;
   }
 
   public function getContinueOnMissingFields() {
     return $this->continueOnMissingFields;
   }
 
 
   /**
    * Not strictly necessary, but reply handlers ideally set this value to
    * make email threading work better.
    */
   public function setParentMessageID($parent_message_id) {
     $this->parentMessageID = $parent_message_id;
     return $this;
   }
   public function getParentMessageID() {
     return $this->parentMessageID;
   }
 
   public function getIsNewObject() {
     return $this->isNewObject;
   }
 
   public function getMentionedPHIDs() {
     return $this->mentionedPHIDs;
   }
 
   public function setIsPreview($is_preview) {
     $this->isPreview = $is_preview;
     return $this;
   }
 
   public function getIsPreview() {
     return $this->isPreview;
   }
 
   public function setIsSilent($silent) {
     $this->silent = $silent;
     return $this;
   }
 
   public function getIsSilent() {
     return $this->silent;
   }
 
   public function getMustEncrypt() {
     return $this->mustEncrypt;
   }
 
   public function getHeraldRuleMonograms() {
     // Convert the stored "<123>, <456>" string into a list: "H123", "H456".
     $list = $this->heraldHeader;
     $list = preg_split('/[, ]+/', $list);
 
     foreach ($list as $key => $item) {
       $item = trim($item, '<>');
 
       if (!is_numeric($item)) {
         unset($list[$key]);
         continue;
       }
 
       $list[$key] = 'H'.$item;
     }
 
     return $list;
   }
 
   public function setIsInverseEdgeEditor($is_inverse_edge_editor) {
     $this->isInverseEdgeEditor = $is_inverse_edge_editor;
     return $this;
   }
 
   public function getIsInverseEdgeEditor() {
     return $this->isInverseEdgeEditor;
   }
 
   public function setIsHeraldEditor($is_herald_editor) {
     $this->isHeraldEditor = $is_herald_editor;
     return $this;
   }
 
   public function getIsHeraldEditor() {
     return $this->isHeraldEditor;
   }
 
   public function setUnmentionablePHIDMap(array $map) {
     $this->unmentionablePHIDMap = $map;
     return $this;
   }
 
   public function getUnmentionablePHIDMap() {
     return $this->unmentionablePHIDMap;
   }
 
   protected function shouldEnableMentions(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return true;
   }
 
   public function setApplicationEmail(
     PhabricatorMetaMTAApplicationEmail $email) {
     $this->applicationEmail = $email;
     return $this;
   }
 
   public function getApplicationEmail() {
     return $this->applicationEmail;
   }
 
   public function getTransactionTypesForObject($object) {
     $old = $this->object;
     try {
       $this->object = $object;
       $result = $this->getTransactionTypes();
       $this->object = $old;
     } catch (Exception $ex) {
       $this->object = $old;
       throw $ex;
     }
     return $result;
   }
 
   public function getTransactionTypes() {
     $types = array();
 
     $types[] = PhabricatorTransactions::TYPE_CREATE;
 
     if ($this->object instanceof PhabricatorEditEngineSubtypeInterface) {
       $types[] = PhabricatorTransactions::TYPE_SUBTYPE;
     }
 
     if ($this->object instanceof PhabricatorSubscribableInterface) {
       $types[] = PhabricatorTransactions::TYPE_SUBSCRIBERS;
     }
 
     if ($this->object instanceof PhabricatorCustomFieldInterface) {
       $types[] = PhabricatorTransactions::TYPE_CUSTOMFIELD;
     }
 
     if ($this->object instanceof HarbormasterBuildableInterface) {
       $types[] = PhabricatorTransactions::TYPE_BUILDABLE;
     }
 
     if ($this->object instanceof PhabricatorTokenReceiverInterface) {
       $types[] = PhabricatorTransactions::TYPE_TOKEN;
     }
 
     if ($this->object instanceof PhabricatorProjectInterface ||
         $this->object instanceof PhabricatorMentionableInterface) {
       $types[] = PhabricatorTransactions::TYPE_EDGE;
     }
 
     if ($this->object instanceof PhabricatorSpacesInterface) {
       $types[] = PhabricatorTransactions::TYPE_SPACE;
     }
 
     $template = $this->object->getApplicationTransactionTemplate();
     if ($template instanceof PhabricatorModularTransaction) {
       $xtypes = $template->newModularTransactionTypes();
       foreach ($xtypes as $xtype) {
         $types[] = $xtype->getTransactionTypeConstant();
       }
     }
 
     if ($template) {
       try {
         $comment = $template->getApplicationTransactionCommentObject();
       } catch (PhutilMethodNotImplementedException $ex) {
         $comment = null;
       }
 
       if ($comment) {
         $types[] = PhabricatorTransactions::TYPE_COMMENT;
       }
     }
 
     return $types;
   }
 
   private function adjustTransactionValues(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     if ($xaction->shouldGenerateOldValue()) {
       $old = $this->getTransactionOldValue($object, $xaction);
       $xaction->setOldValue($old);
     }
 
     $new = $this->getTransactionNewValue($object, $xaction);
     $xaction->setNewValue($new);
   }
 
   private function getTransactionOldValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $type = $xaction->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $xtype = clone $xtype;
       $xtype->setStorage($xaction);
       return $xtype->generateOldValue($object);
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_CREATE:
         return null;
       case PhabricatorTransactions::TYPE_SUBTYPE:
         return $object->getEditEngineSubtype();
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         return array_values($this->subscribers);
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
         if ($this->getIsNewObject()) {
           return null;
         }
         return $object->getViewPolicy();
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
         if ($this->getIsNewObject()) {
           return null;
         }
         return $object->getEditPolicy();
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
         if ($this->getIsNewObject()) {
           return null;
         }
         return $object->getJoinPolicy();
       case PhabricatorTransactions::TYPE_SPACE:
         if ($this->getIsNewObject()) {
           return null;
         }
 
         $space_phid = $object->getSpacePHID();
         if ($space_phid === null) {
           $default_space = PhabricatorSpacesNamespaceQuery::getDefaultSpace();
           if ($default_space) {
             $space_phid = $default_space->getPHID();
           }
         }
 
         return $space_phid;
       case PhabricatorTransactions::TYPE_EDGE:
         $edge_type = $xaction->getMetadataValue('edge:type');
         if (!$edge_type) {
           throw new Exception(
             pht(
               "Edge transaction has no '%s'!",
               'edge:type'));
         }
 
         $old_edges = array();
         if ($object->getPHID()) {
           $edge_src = $object->getPHID();
 
           $old_edges = id(new PhabricatorEdgeQuery())
             ->withSourcePHIDs(array($edge_src))
             ->withEdgeTypes(array($edge_type))
             ->needEdgeData(true)
             ->execute();
 
           $old_edges = $old_edges[$edge_src][$edge_type];
         }
         return $old_edges;
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         // NOTE: Custom fields have their old value pre-populated when they are
         // built by PhabricatorCustomFieldList.
         return $xaction->getOldValue();
       case PhabricatorTransactions::TYPE_COMMENT:
         return null;
       default:
         return $this->getCustomTransactionOldValue($object, $xaction);
     }
   }
 
   private function getTransactionNewValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $type = $xaction->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $xtype = clone $xtype;
       $xtype->setStorage($xaction);
       return $xtype->generateNewValue($object, $xaction->getNewValue());
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_CREATE:
         return null;
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         return $this->getPHIDTransactionNewValue($xaction);
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
       case PhabricatorTransactions::TYPE_BUILDABLE:
       case PhabricatorTransactions::TYPE_TOKEN:
       case PhabricatorTransactions::TYPE_INLINESTATE:
       case PhabricatorTransactions::TYPE_SUBTYPE:
         return $xaction->getNewValue();
       case PhabricatorTransactions::TYPE_SPACE:
         $space_phid = $xaction->getNewValue();
         if (!strlen($space_phid)) {
           // If an install has no Spaces or the Spaces controls are not visible
           // to the viewer, we might end up with the empty string here instead
           // of a strict `null`, because some controller just used `getStr()`
           // to read the space PHID from the request.
           // Just make this work like callers might reasonably expect so we
           // don't need to handle this specially in every EditController.
           return $this->getActor()->getDefaultSpacePHID();
         } else {
           return $space_phid;
         }
       case PhabricatorTransactions::TYPE_EDGE:
         $new_value = $this->getEdgeTransactionNewValue($xaction);
 
         $edge_type = $xaction->getMetadataValue('edge:type');
         $type_project = PhabricatorProjectObjectHasProjectEdgeType::EDGECONST;
         if ($edge_type == $type_project) {
           $new_value = $this->applyProjectConflictRules($new_value);
         }
 
         return $new_value;
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getCustomFieldForTransaction($object, $xaction);
         return $field->getNewValueFromApplicationTransactions($xaction);
       case PhabricatorTransactions::TYPE_COMMENT:
         return null;
       default:
         return $this->getCustomTransactionNewValue($object, $xaction);
     }
   }
 
   protected function getCustomTransactionOldValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     throw new Exception(pht('Capability not supported!'));
   }
 
   protected function getCustomTransactionNewValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     throw new Exception(pht('Capability not supported!'));
   }
 
   protected function transactionHasEffect(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorTransactions::TYPE_CREATE:
         return true;
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getCustomFieldForTransaction($object, $xaction);
         return $field->getApplicationTransactionHasEffect($xaction);
       case PhabricatorTransactions::TYPE_EDGE:
         // A straight value comparison here doesn't always get the right
         // result, because newly added edges aren't fully populated. Instead,
         // compare the changes in a more granular way.
         $old = $xaction->getOldValue();
         $new = $xaction->getNewValue();
 
         $old_dst = array_keys($old);
         $new_dst = array_keys($new);
 
         // NOTE: For now, we don't consider edge reordering to be a change.
         // We have very few order-dependent edges and effectively no order
         // oriented UI. This might change in the future.
         sort($old_dst);
         sort($new_dst);
 
         if ($old_dst !== $new_dst) {
           // We've added or removed edges, so this transaction definitely
           // has an effect.
           return true;
         }
 
         // We haven't added or removed edges, but we might have changed
         // edge data.
         foreach ($old as $key => $old_value) {
           $new_value = $new[$key];
           if ($old_value['data'] !== $new_value['data']) {
             return true;
           }
         }
 
         return false;
     }
 
     $type = $xaction->getTransactionType();
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       return $xtype->getTransactionHasEffect(
         $object,
         $xaction->getOldValue(),
         $xaction->getNewValue());
     }
 
     if ($xaction->hasComment()) {
       return true;
     }
 
     return ($xaction->getOldValue() !== $xaction->getNewValue());
   }
 
   protected function shouldApplyInitialEffects(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return false;
   }
 
   protected function applyInitialEffects(
     PhabricatorLiskDAO $object,
     array $xactions) {
     throw new PhutilMethodNotImplementedException();
   }
 
   private function applyInternalEffects(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $type = $xaction->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $xtype = clone $xtype;
       $xtype->setStorage($xaction);
       return $xtype->applyInternalEffects($object, $xaction->getNewValue());
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getCustomFieldForTransaction($object, $xaction);
         return $field->applyApplicationTransactionInternalEffects($xaction);
       case PhabricatorTransactions::TYPE_CREATE:
       case PhabricatorTransactions::TYPE_SUBTYPE:
       case PhabricatorTransactions::TYPE_BUILDABLE:
       case PhabricatorTransactions::TYPE_TOKEN:
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
       case PhabricatorTransactions::TYPE_INLINESTATE:
       case PhabricatorTransactions::TYPE_EDGE:
       case PhabricatorTransactions::TYPE_SPACE:
       case PhabricatorTransactions::TYPE_COMMENT:
         return $this->applyBuiltinInternalTransaction($object, $xaction);
     }
 
     return $this->applyCustomInternalTransaction($object, $xaction);
   }
 
   private function applyExternalEffects(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $type = $xaction->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $xtype = clone $xtype;
       $xtype->setStorage($xaction);
       return $xtype->applyExternalEffects($object, $xaction->getNewValue());
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         $subeditor = id(new PhabricatorSubscriptionsEditor())
           ->setObject($object)
           ->setActor($this->requireActor());
 
         $old_map = array_fuse($xaction->getOldValue());
         $new_map = array_fuse($xaction->getNewValue());
 
         $subeditor->unsubscribe(
           array_keys(
             array_diff_key($old_map, $new_map)));
 
         $subeditor->subscribeExplicit(
           array_keys(
             array_diff_key($new_map, $old_map)));
 
         $subeditor->save();
 
         // for the rest of these edits, subscribers should include those just
         // added as well as those just removed.
         $subscribers = array_unique(array_merge(
           $this->subscribers,
           $xaction->getOldValue(),
           $xaction->getNewValue()));
         $this->subscribers = $subscribers;
         return $this->applyBuiltinExternalTransaction($object, $xaction);
 
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getCustomFieldForTransaction($object, $xaction);
         return $field->applyApplicationTransactionExternalEffects($xaction);
       case PhabricatorTransactions::TYPE_CREATE:
       case PhabricatorTransactions::TYPE_SUBTYPE:
       case PhabricatorTransactions::TYPE_EDGE:
       case PhabricatorTransactions::TYPE_BUILDABLE:
       case PhabricatorTransactions::TYPE_TOKEN:
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
       case PhabricatorTransactions::TYPE_INLINESTATE:
       case PhabricatorTransactions::TYPE_SPACE:
       case PhabricatorTransactions::TYPE_COMMENT:
         return $this->applyBuiltinExternalTransaction($object, $xaction);
     }
 
     return $this->applyCustomExternalTransaction($object, $xaction);
   }
 
   protected function applyCustomInternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     $type = $xaction->getTransactionType();
     throw new Exception(
       pht(
         "Transaction type '%s' is missing an internal apply implementation!",
         $type));
   }
 
   protected function applyCustomExternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     $type = $xaction->getTransactionType();
     throw new Exception(
       pht(
         "Transaction type '%s' is missing an external apply implementation!",
         $type));
   }
 
   /**
    * @{class:PhabricatorTransactions} provides many built-in transactions
    * which should not require much - if any - code in specific applications.
    *
    * This method is a hook for the exceedingly-rare cases where you may need
    * to do **additional** work for built-in transactions. Developers should
    * extend this method, making sure to return the parent implementation
    * regardless of handling any transactions.
    *
    * See also @{method:applyBuiltinExternalTransaction}.
    */
   protected function applyBuiltinInternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
         $object->setViewPolicy($xaction->getNewValue());
         break;
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
         $object->setEditPolicy($xaction->getNewValue());
         break;
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
         $object->setJoinPolicy($xaction->getNewValue());
         break;
       case PhabricatorTransactions::TYPE_SPACE:
         $object->setSpacePHID($xaction->getNewValue());
         break;
       case PhabricatorTransactions::TYPE_SUBTYPE:
         $object->setEditEngineSubtype($xaction->getNewValue());
         break;
     }
   }
 
   /**
    * See @{method::applyBuiltinInternalTransaction}.
    */
   protected function applyBuiltinExternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorTransactions::TYPE_EDGE:
         if ($this->getIsInverseEdgeEditor()) {
           // If we're writing an inverse edge transaction, don't actually
           // do anything. The initiating editor on the other side of the
           // transaction will take care of the edge writes.
           break;
         }
 
         $old = $xaction->getOldValue();
         $new = $xaction->getNewValue();
         $src = $object->getPHID();
         $const = $xaction->getMetadataValue('edge:type');
 
         $type = PhabricatorEdgeType::getByConstant($const);
         if ($type->shouldWriteInverseTransactions()) {
           $this->applyInverseEdgeTransactions(
             $object,
             $xaction,
             $type->getInverseEdgeConstant());
         }
 
         foreach ($new as $dst_phid => $edge) {
           $new[$dst_phid]['src'] = $src;
         }
 
         $editor = new PhabricatorEdgeEditor();
 
         foreach ($old as $dst_phid => $edge) {
           if (!empty($new[$dst_phid])) {
             if ($old[$dst_phid]['data'] === $new[$dst_phid]['data']) {
               continue;
             }
           }
           $editor->removeEdge($src, $const, $dst_phid);
         }
 
         foreach ($new as $dst_phid => $edge) {
           if (!empty($old[$dst_phid])) {
             if ($old[$dst_phid]['data'] === $new[$dst_phid]['data']) {
               continue;
             }
           }
 
           $data = array(
             'data' => $edge['data'],
           );
 
           $editor->addEdge($src, $const, $dst_phid, $data);
         }
 
         $editor->save();
 
         $this->updateWorkboardColumns($object, $const, $old, $new);
         break;
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_SPACE:
         $this->scrambleFileSecrets($object);
         break;
     }
   }
 
   /**
    * Fill in a transaction's common values, like author and content source.
    */
   protected function populateTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $actor = $this->getActor();
 
     // TODO: This needs to be more sophisticated once we have meta-policies.
     $xaction->setViewPolicy(PhabricatorPolicies::POLICY_PUBLIC);
 
     if ($actor->isOmnipotent()) {
       $xaction->setEditPolicy(PhabricatorPolicies::POLICY_NOONE);
     } else {
       $xaction->setEditPolicy($this->getActingAsPHID());
     }
 
     // If the transaction already has an explicit author PHID, allow it to
     // stand. This is used by applications like Owners that hook into the
     // post-apply change pipeline.
     if (!$xaction->getAuthorPHID()) {
       $xaction->setAuthorPHID($this->getActingAsPHID());
     }
 
     $xaction->setContentSource($this->getContentSource());
     $xaction->attachViewer($actor);
     $xaction->attachObject($object);
 
     if ($object->getPHID()) {
       $xaction->setObjectPHID($object->getPHID());
     }
 
     if ($this->getIsSilent()) {
       $xaction->setIsSilentTransaction(true);
     }
 
     return $xaction;
   }
 
   protected function didApplyInternalEffects(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return $xactions;
   }
 
   protected function applyFinalEffects(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return $xactions;
   }
 
   public function setContentSource(PhabricatorContentSource $content_source) {
     $this->contentSource = $content_source;
     return $this;
   }
 
   public function setContentSourceFromRequest(AphrontRequest $request) {
     return $this->setContentSource(
       PhabricatorContentSource::newFromRequest($request));
   }
 
   public function getContentSource() {
     return $this->contentSource;
   }
 
   final public function applyTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $this->object = $object;
     $this->xactions = $xactions;
     $this->isNewObject = ($object->getPHID() === null);
 
     $this->validateEditParameters($object, $xactions);
 
     $actor = $this->requireActor();
 
     // NOTE: Some transaction expansion requires that the edited object be
     // attached.
     foreach ($xactions as $xaction) {
       $xaction->attachObject($object);
       $xaction->attachViewer($actor);
     }
 
     $xactions = $this->expandTransactions($object, $xactions);
     $xactions = $this->expandSupportTransactions($object, $xactions);
     $xactions = $this->combineTransactions($xactions);
 
     foreach ($xactions as $xaction) {
       $xaction = $this->populateTransaction($object, $xaction);
     }
 
     $is_preview = $this->getIsPreview();
     $read_locking = false;
     $transaction_open = false;
 
     if (!$is_preview) {
       $errors = array();
       $type_map = mgroup($xactions, 'getTransactionType');
       foreach ($this->getTransactionTypes() as $type) {
         $type_xactions = idx($type_map, $type, array());
         $errors[] = $this->validateTransaction($object, $type, $type_xactions);
       }
 
       $errors[] = $this->validateAllTransactions($object, $xactions);
       $errors = array_mergev($errors);
 
       $continue_on_missing = $this->getContinueOnMissingFields();
       foreach ($errors as $key => $error) {
         if ($continue_on_missing && $error->getIsMissingFieldError()) {
           unset($errors[$key]);
         }
       }
 
       if ($errors) {
         throw new PhabricatorApplicationTransactionValidationException($errors);
       }
 
       $this->willApplyTransactions($object, $xactions);
 
       if ($object->getID()) {
         foreach ($xactions as $xaction) {
 
           // If any of the transactions require a read lock, hold one and
           // reload the object. We need to do this fairly early so that the
           // call to `adjustTransactionValues()` (which populates old values)
           // is based on the synchronized state of the object, which may differ
           // from the state when it was originally loaded.
 
           if ($this->shouldReadLock($object, $xaction)) {
             $object->openTransaction();
             $object->beginReadLocking();
             $transaction_open = true;
             $read_locking = true;
             $object->reload();
             break;
           }
         }
       }
 
       if ($this->shouldApplyInitialEffects($object, $xactions)) {
         if (!$transaction_open) {
           $object->openTransaction();
           $transaction_open = true;
         }
       }
     }
 
     if ($this->shouldApplyInitialEffects($object, $xactions)) {
       $this->applyInitialEffects($object, $xactions);
     }
 
     foreach ($xactions as $xaction) {
       $this->adjustTransactionValues($object, $xaction);
     }
 
     try {
       $xactions = $this->filterTransactions($object, $xactions);
     } catch (Exception $ex) {
       if ($read_locking) {
         $object->endReadLocking();
       }
       if ($transaction_open) {
         $object->killTransaction();
       }
       throw $ex;
     }
 
     // TODO: Once everything is on EditEngine, just use getIsNewObject() to
     // figure this out instead.
     $mark_as_create = false;
     $create_type = PhabricatorTransactions::TYPE_CREATE;
     foreach ($xactions as $xaction) {
       if ($xaction->getTransactionType() == $create_type) {
         $mark_as_create = true;
       }
     }
 
     if ($mark_as_create) {
       foreach ($xactions as $xaction) {
         $xaction->setIsCreateTransaction(true);
       }
     }
 
     // Now that we've merged, filtered, and combined transactions, check for
     // required capabilities.
     foreach ($xactions as $xaction) {
       $this->requireCapabilities($object, $xaction);
     }
 
     $xactions = $this->sortTransactions($xactions);
     $file_phids = $this->extractFilePHIDs($object, $xactions);
 
     if ($is_preview) {
       $this->loadHandles($xactions);
       return $xactions;
     }
 
     $comment_editor = id(new PhabricatorApplicationTransactionCommentEditor())
       ->setActor($actor)
       ->setActingAsPHID($this->getActingAsPHID())
       ->setContentSource($this->getContentSource());
 
     if (!$transaction_open) {
       $object->openTransaction();
     }
 
     try {
       foreach ($xactions as $xaction) {
         $this->applyInternalEffects($object, $xaction);
       }
 
       $xactions = $this->didApplyInternalEffects($object, $xactions);
 
       try {
         $object->save();
       } catch (AphrontDuplicateKeyQueryException $ex) {
         // This callback has an opportunity to throw a better exception,
         // so execution may end here.
         $this->didCatchDuplicateKeyException($object, $xactions, $ex);
 
         throw $ex;
       }
 
       foreach ($xactions as $xaction) {
         $xaction->setObjectPHID($object->getPHID());
         if ($xaction->getComment()) {
           $xaction->setPHID($xaction->generatePHID());
           $comment_editor->applyEdit($xaction, $xaction->getComment());
         } else {
 
           // TODO: This is a transitional hack to let us migrate edge
           // transactions to a more efficient storage format. For now, we're
           // going to write a new slim format to the database but keep the old
           // bulky format on the objects so we don't have to upgrade all the
           // edit logic to the new format yet. See T13051.
 
           $edge_type = PhabricatorTransactions::TYPE_EDGE;
           if ($xaction->getTransactionType() == $edge_type) {
             $bulky_old = $xaction->getOldValue();
             $bulky_new = $xaction->getNewValue();
 
             $record = PhabricatorEdgeChangeRecord::newFromTransaction($xaction);
             $slim_old = $record->getModernOldEdgeTransactionData();
             $slim_new = $record->getModernNewEdgeTransactionData();
 
             $xaction->setOldValue($slim_old);
             $xaction->setNewValue($slim_new);
             $xaction->save();
 
             $xaction->setOldValue($bulky_old);
             $xaction->setNewValue($bulky_new);
           } else {
             $xaction->save();
           }
         }
       }
 
       if ($file_phids) {
         $this->attachFiles($object, $file_phids);
       }
 
       foreach ($xactions as $xaction) {
         $this->applyExternalEffects($object, $xaction);
       }
 
       $xactions = $this->applyFinalEffects($object, $xactions);
       if ($read_locking) {
         $object->endReadLocking();
         $read_locking = false;
       }
 
       $object->saveTransaction();
     } catch (Exception $ex) {
       $object->killTransaction();
       throw $ex;
     }
 
     // If we need to perform cache engine updates, execute them now.
     id(new PhabricatorCacheEngine())
       ->updateObject($object);
 
     // Now that we've completely applied the core transaction set, try to apply
     // Herald rules. Herald rules are allowed to either take direct actions on
     // the database (like writing flags), or take indirect actions (like saving
     // some targets for CC when we generate mail a little later), or return
     // transactions which we'll apply normally using another Editor.
 
     // First, check if *this* is a sub-editor which is itself applying Herald
     // rules: if it is, stop working and return so we don't descend into
     // madness.
 
     // Otherwise, we're not a Herald editor, so process Herald rules (possibly
     // using a Herald editor to apply resulting transactions) and then send out
     // mail, notifications, and feed updates about everything.
 
     if ($this->getIsHeraldEditor()) {
       // We are the Herald editor, so stop work here and return the updated
       // transactions.
       return $xactions;
     } else if ($this->shouldApplyHeraldRules($object, $xactions)) {
       // We are not the Herald editor, so try to apply Herald rules.
       $herald_xactions = $this->applyHeraldRules($object, $xactions);
 
       if ($herald_xactions) {
         $xscript_id = $this->getHeraldTranscript()->getID();
         foreach ($herald_xactions as $herald_xaction) {
           // Don't set a transcript ID if this is a transaction from another
           // application or source, like Owners.
           if ($herald_xaction->getAuthorPHID()) {
             continue;
           }
 
           $herald_xaction->setMetadataValue('herald:transcriptID', $xscript_id);
         }
 
         // NOTE: We're acting as the omnipotent user because rules deal with
         // their own policy issues. We use a synthetic author PHID (the
         // Herald application) as the author of record, so that transactions
         // will render in a reasonable way ("Herald assigned this task ...").
         $herald_actor = PhabricatorUser::getOmnipotentUser();
         $herald_phid = id(new PhabricatorHeraldApplication())->getPHID();
 
         // TODO: It would be nice to give transactions a more specific source
         // which points at the rule which generated them. You can figure this
         // out from transcripts, but it would be cleaner if you didn't have to.
 
         $herald_source = PhabricatorContentSource::newForSource(
           PhabricatorHeraldContentSource::SOURCECONST);
 
         $herald_editor = newv(get_class($this), array())
           ->setContinueOnNoEffect(true)
           ->setContinueOnMissingFields(true)
           ->setParentMessageID($this->getParentMessageID())
           ->setIsHeraldEditor(true)
           ->setActor($herald_actor)
           ->setActingAsPHID($herald_phid)
           ->setContentSource($herald_source);
 
         $herald_xactions = $herald_editor->applyTransactions(
           $object,
           $herald_xactions);
 
         // Merge the new transactions into the transaction list: we want to
         // send email and publish feed stories about them, too.
         $xactions = array_merge($xactions, $herald_xactions);
       }
 
       // If Herald did not generate transactions, we may still need to handle
       // "Send an Email" rules.
       $adapter = $this->getHeraldAdapter();
       $this->heraldEmailPHIDs = $adapter->getEmailPHIDs();
       $this->heraldForcedEmailPHIDs = $adapter->getForcedEmailPHIDs();
     }
 
     $xactions = $this->didApplyTransactions($object, $xactions);
 
     if ($object instanceof PhabricatorCustomFieldInterface) {
       // Maybe this makes more sense to move into the search index itself? For
       // now I'm putting it here since I think we might end up with things that
       // need it to be up to date once the next page loads, but if we don't go
       // there we could move it into search once search moves to the daemons.
 
       // It now happens in the search indexer as well, but the search indexer is
       // always daemonized, so the logic above still potentially holds. We could
       // possibly get rid of this. The major motivation for putting it in the
       // indexer was to enable reindexing to work.
 
       $fields = PhabricatorCustomField::getObjectFields(
         $object,
         PhabricatorCustomField::ROLE_APPLICATIONSEARCH);
       $fields->readFieldsFromStorage($object);
       $fields->rebuildIndexes($object);
     }
 
     $herald_xscript = $this->getHeraldTranscript();
     if ($herald_xscript) {
       $herald_header = $herald_xscript->getXHeraldRulesHeader();
       $herald_header = HeraldTranscript::saveXHeraldRulesHeader(
         $object->getPHID(),
         $herald_header);
     } else {
       $herald_header = HeraldTranscript::loadXHeraldRulesHeader(
         $object->getPHID());
     }
     $this->heraldHeader = $herald_header;
 
     // We're going to compute some of the data we'll use to publish these
     // transactions here, before queueing a worker.
     //
     // Primarily, this is more correct: we want to publish the object as it
     // exists right now. The worker may not execute for some time, and we want
     // to use the current To/CC list, not respect any changes which may occur
     // between now and when the worker executes.
     //
     // As a secondary benefit, this tends to reduce the amount of state that
     // Editors need to pass into workers.
     $object = $this->willPublish($object, $xactions);
 
     if (!$this->getIsSilent()) {
       if ($this->shouldSendMail($object, $xactions)) {
         $this->mailShouldSend = true;
         $this->mailToPHIDs = $this->getMailTo($object);
         $this->mailCCPHIDs = $this->getMailCC($object);
 
         $mail_xactions = $this->getTransactionsForMail($object, $xactions);
         $stamps = $this->newMailStamps($object, $xactions);
         foreach ($stamps as $stamp) {
           $this->mailStamps[] = $stamp->toDictionary();
         }
       }
 
       if ($this->shouldPublishFeedStory($object, $xactions)) {
         $this->feedShouldPublish = true;
         $this->feedRelatedPHIDs = $this->getFeedRelatedPHIDs(
           $object,
           $xactions);
         $this->feedNotifyPHIDs = $this->getFeedNotifyPHIDs(
           $object,
           $xactions);
       }
     }
 
     PhabricatorWorker::scheduleTask(
       'PhabricatorApplicationTransactionPublishWorker',
       array(
         'objectPHID' => $object->getPHID(),
         'actorPHID' => $this->getActingAsPHID(),
         'xactionPHIDs' => mpull($xactions, 'getPHID'),
         'state' => $this->getWorkerState(),
       ),
       array(
         'objectPHID' => $object->getPHID(),
         'priority' => PhabricatorWorker::PRIORITY_ALERTS,
       ));
 
     $this->flushTransactionQueue($object);
 
     return $xactions;
   }
 
   protected function didCatchDuplicateKeyException(
     PhabricatorLiskDAO $object,
     array $xactions,
     Exception $ex) {
     return;
   }
 
   public function publishTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $this->object = $object;
     $this->xactions = $xactions;
 
     // Hook for edges or other properties that may need (re-)loading
     $object = $this->willPublish($object, $xactions);
 
     // The object might have changed, so reassign it.
     $this->object = $object;
 
     $messages = array();
     if ($this->mailShouldSend) {
       $messages = $this->buildMail($object, $xactions);
     }
 
     if ($this->supportsSearch()) {
       PhabricatorSearchWorker::queueDocumentForIndexing(
         $object->getPHID(),
         array(
           'transactionPHIDs' => mpull($xactions, 'getPHID'),
         ));
     }
 
     if ($this->feedShouldPublish) {
       $mailed = array();
       foreach ($messages as $mail) {
         foreach ($mail->buildRecipientList() as $phid) {
           $mailed[$phid] = $phid;
         }
       }
 
       $this->publishFeedStory($object, $xactions, $mailed);
     }
 
     // NOTE: This actually sends the mail. We do this last to reduce the chance
     // that we send some mail, hit an exception, then send the mail again when
     // retrying.
     foreach ($messages as $mail) {
       $mail->save();
     }
 
     return $xactions;
   }
 
   protected function didApplyTransactions($object, array $xactions) {
     // Hook for subclasses.
     return $xactions;
   }
 
 
   /**
    * Determine if the editor should hold a read lock on the object while
    * applying a transaction.
    *
    * If the editor does not hold a lock, two editors may read an object at the
    * same time, then apply their changes without any synchronization. For most
    * transactions, this does not matter much. However, it is important for some
    * transactions. For example, if an object has a transaction count on it, both
    * editors may read the object with `count = 23`, then independently update it
    * and save the object with `count = 24` twice. This will produce the wrong
    * state: the object really has 25 transactions, but the count is only 24.
    *
    * Generally, transactions fall into one of four buckets:
    *
    *   - Append operations: Actions like adding a comment to an object purely
    *     add information to its state, and do not depend on the current object
    *     state in any way. These transactions never need to hold locks.
    *   - Overwrite operations: Actions like changing the title or description
    *     of an object replace the current value with a new value, so the end
    *     state is consistent without a lock. We currently do not lock these
    *     transactions, although we may in the future.
    *   - Edge operations: Edge and subscription operations have internal
    *     synchronization which limits the damage race conditions can cause.
    *     We do not currently lock these transactions, although we may in the
    *     future.
    *   - Update operations: Actions like incrementing a count on an object.
    *     These operations generally should use locks, unless it is not
    *     important that the state remain consistent in the presence of races.
    *
    * @param   PhabricatorLiskDAO  Object being updated.
    * @param   PhabricatorApplicationTransaction Transaction being applied.
    * @return  bool                True to synchronize the edit with a lock.
    */
   protected function shouldReadLock(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     return false;
   }
 
   private function loadHandles(array $xactions) {
     $phids = array();
     foreach ($xactions as $key => $xaction) {
       $phids[$key] = $xaction->getRequiredHandlePHIDs();
     }
     $handles = array();
     $merged = array_mergev($phids);
     if ($merged) {
       $handles = id(new PhabricatorHandleQuery())
         ->setViewer($this->requireActor())
         ->withPHIDs($merged)
         ->execute();
     }
     foreach ($xactions as $key => $xaction) {
       $xaction->setHandles(array_select_keys($handles, $phids[$key]));
     }
   }
 
   private function loadSubscribers(PhabricatorLiskDAO $object) {
     if ($object->getPHID() &&
         ($object instanceof PhabricatorSubscribableInterface)) {
       $subs = PhabricatorSubscribersQuery::loadSubscribersForPHID(
         $object->getPHID());
       $this->subscribers = array_fuse($subs);
     } else {
       $this->subscribers = array();
     }
   }
 
   private function validateEditParameters(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     if (!$this->getContentSource()) {
       throw new PhutilInvalidStateException('setContentSource');
     }
 
     // Do a bunch of sanity checks that the incoming transactions are fresh.
     // They should be unsaved and have only "transactionType" and "newValue"
     // set.
 
     $types = array_fill_keys($this->getTransactionTypes(), true);
 
     assert_instances_of($xactions, 'PhabricatorApplicationTransaction');
     foreach ($xactions as $xaction) {
       if ($xaction->getPHID() || $xaction->getID()) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht('You can not apply transactions which already have IDs/PHIDs!'));
       }
 
       if ($xaction->getObjectPHID()) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'You can not apply transactions which already have %s!',
             'objectPHIDs'));
       }
 
       if ($xaction->getCommentPHID()) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'You can not apply transactions which already have %s!',
             'commentPHIDs'));
       }
 
       if ($xaction->getCommentVersion() !== 0) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'You can not apply transactions which already have '.
             'commentVersions!'));
       }
 
       $expect_value = !$xaction->shouldGenerateOldValue();
       $has_value = $xaction->hasOldValue();
 
       if ($expect_value && !$has_value) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'This transaction is supposed to have an %s set, but it does not!',
             'oldValue'));
       }
 
       if ($has_value && !$expect_value) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'This transaction should generate its %s automatically, '.
             'but has already had one set!',
             'oldValue'));
       }
 
       $type = $xaction->getTransactionType();
       if (empty($types[$type])) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'Transaction has type "%s", but that transaction type is not '.
             'supported by this editor (%s).',
             $type,
             get_class($this)));
       }
     }
   }
 
   protected function requireCapabilities(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     if ($this->getIsNewObject()) {
       return;
     }
 
     $actor = $this->requireActor();
     switch ($xaction->getTransactionType()) {
       case PhabricatorTransactions::TYPE_COMMENT:
         PhabricatorPolicyFilter::requireCapability(
           $actor,
           $object,
           PhabricatorPolicyCapability::CAN_VIEW);
         break;
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
       case PhabricatorTransactions::TYPE_SPACE:
         PhabricatorPolicyFilter::requireCapability(
           $actor,
           $object,
           PhabricatorPolicyCapability::CAN_EDIT);
         break;
     }
   }
 
   private function buildSubscribeTransaction(
     PhabricatorLiskDAO $object,
     array $xactions,
     array $changes) {
 
     if (!($object instanceof PhabricatorSubscribableInterface)) {
       return null;
     }
 
     if ($this->shouldEnableMentions($object, $xactions)) {
       // Identify newly mentioned users. We ignore users who were previously
       // mentioned so that we don't re-subscribe users after an edit of text
       // which mentions them.
       $old_texts = mpull($changes, 'getOldValue');
       $new_texts = mpull($changes, 'getNewValue');
 
       $old_phids = PhabricatorMarkupEngine::extractPHIDsFromMentions(
         $this->getActor(),
         $old_texts);
 
       $new_phids = PhabricatorMarkupEngine::extractPHIDsFromMentions(
         $this->getActor(),
         $new_texts);
 
       $phids = array_diff($new_phids, $old_phids);
     } else {
       $phids = array();
     }
 
     $this->mentionedPHIDs = $phids;
 
     if ($object->getPHID()) {
       // Don't try to subscribe already-subscribed mentions: we want to generate
       // a dialog about an action having no effect if the user explicitly adds
       // existing CCs, but not if they merely mention existing subscribers.
       $phids = array_diff($phids, $this->subscribers);
     }
 
     if ($phids) {
       $users = id(new PhabricatorPeopleQuery())
         ->setViewer($this->getActor())
         ->withPHIDs($phids)
         ->execute();
       $users = mpull($users, null, 'getPHID');
 
       foreach ($phids as $key => $phid) {
         // Do not subscribe mentioned users
         // who do not have VIEW Permissions
         if ($object instanceof PhabricatorPolicyInterface
           && !PhabricatorPolicyFilter::hasCapability(
           $users[$phid],
           $object,
           PhabricatorPolicyCapability::CAN_VIEW)
         ) {
           unset($phids[$key]);
         } else {
           if ($object->isAutomaticallySubscribed($phid)) {
             unset($phids[$key]);
           }
         }
       }
       $phids = array_values($phids);
     }
     // No else here to properly return null should we unset all subscriber
     if (!$phids) {
       return null;
     }
 
     $xaction = newv(get_class(head($xactions)), array());
     $xaction->setTransactionType(PhabricatorTransactions::TYPE_SUBSCRIBERS);
     $xaction->setNewValue(array('+' => $phids));
 
     return $xaction;
   }
 
   protected function mergeTransactions(
     PhabricatorApplicationTransaction $u,
     PhabricatorApplicationTransaction $v) {
 
     $type = $u->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $object = $this->object;
       return $xtype->mergeTransactions($object, $u, $v);
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         return $this->mergePHIDOrEdgeTransactions($u, $v);
       case PhabricatorTransactions::TYPE_EDGE:
         $u_type = $u->getMetadataValue('edge:type');
         $v_type = $v->getMetadataValue('edge:type');
         if ($u_type == $v_type) {
           return $this->mergePHIDOrEdgeTransactions($u, $v);
         }
         return null;
     }
 
     // By default, do not merge the transactions.
     return null;
   }
 
   /**
    * Optionally expand transactions which imply other effects. For example,
    * resigning from a revision in Differential implies removing yourself as
    * a reviewer.
    */
   protected function expandTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $results = array();
     foreach ($xactions as $xaction) {
       foreach ($this->expandTransaction($object, $xaction) as $expanded) {
         $results[] = $expanded;
       }
     }
 
     return $results;
   }
 
   protected function expandTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     return array($xaction);
   }
 
 
   public function getExpandedSupportTransactions(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $xactions = array($xaction);
     $xactions = $this->expandSupportTransactions(
       $object,
       $xactions);
 
     if (count($xactions) == 1) {
       return array();
     }
 
     foreach ($xactions as $index => $cxaction) {
       if ($cxaction === $xaction) {
         unset($xactions[$index]);
         break;
       }
     }
 
     return $xactions;
   }
 
   private function expandSupportTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
     $this->loadSubscribers($object);
 
     $xactions = $this->applyImplicitCC($object, $xactions);
 
     $changes = $this->getRemarkupChanges($xactions);
 
     $subscribe_xaction = $this->buildSubscribeTransaction(
       $object,
       $xactions,
       $changes);
     if ($subscribe_xaction) {
       $xactions[] = $subscribe_xaction;
     }
 
     // TODO: For now, this is just a placeholder.
     $engine = PhabricatorMarkupEngine::getEngine('extract');
     $engine->setConfig('viewer', $this->requireActor());
 
     $block_xactions = $this->expandRemarkupBlockTransactions(
       $object,
       $xactions,
       $changes,
       $engine);
 
     foreach ($block_xactions as $xaction) {
       $xactions[] = $xaction;
     }
 
     return $xactions;
   }
 
   private function getRemarkupChanges(array $xactions) {
     $changes = array();
 
     foreach ($xactions as $key => $xaction) {
       foreach ($this->getRemarkupChangesFromTransaction($xaction) as $change) {
         $changes[] = $change;
       }
     }
 
     return $changes;
   }
 
   private function getRemarkupChangesFromTransaction(
     PhabricatorApplicationTransaction $transaction) {
     return $transaction->getRemarkupChanges();
   }
 
   private function expandRemarkupBlockTransactions(
     PhabricatorLiskDAO $object,
     array $xactions,
     array $changes,
     PhutilMarkupEngine $engine) {
 
     $block_xactions = $this->expandCustomRemarkupBlockTransactions(
       $object,
       $xactions,
       $changes,
       $engine);
 
     $mentioned_phids = array();
     if ($this->shouldEnableMentions($object, $xactions)) {
       foreach ($changes as $change) {
         // Here, we don't care about processing only new mentions after an edit
         // because there is no way for an object to ever "unmention" itself on
         // another object, so we can ignore the old value.
         $engine->markupText($change->getNewValue());
 
         $mentioned_phids += $engine->getTextMetadata(
           PhabricatorObjectRemarkupRule::KEY_MENTIONED_OBJECTS,
           array());
       }
     }
 
     if (!$mentioned_phids) {
       return $block_xactions;
     }
 
     $mentioned_objects = id(new PhabricatorObjectQuery())
       ->setViewer($this->getActor())
       ->withPHIDs($mentioned_phids)
       ->execute();
 
     $mentionable_phids = array();
     if ($this->shouldEnableMentions($object, $xactions)) {
       foreach ($mentioned_objects as $mentioned_object) {
         if ($mentioned_object instanceof PhabricatorMentionableInterface) {
           $mentioned_phid = $mentioned_object->getPHID();
           if (idx($this->getUnmentionablePHIDMap(), $mentioned_phid)) {
             continue;
           }
           // don't let objects mention themselves
           if ($object->getPHID() && $mentioned_phid == $object->getPHID()) {
             continue;
           }
           $mentionable_phids[$mentioned_phid] = $mentioned_phid;
         }
       }
     }
 
     if ($mentionable_phids) {
       $edge_type = PhabricatorObjectMentionsObjectEdgeType::EDGECONST;
       $block_xactions[] = newv(get_class(head($xactions)), array())
         ->setIgnoreOnNoEffect(true)
         ->setTransactionType(PhabricatorTransactions::TYPE_EDGE)
         ->setMetadataValue('edge:type', $edge_type)
         ->setNewValue(array('+' => $mentionable_phids));
     }
 
     return $block_xactions;
   }
 
   protected function expandCustomRemarkupBlockTransactions(
     PhabricatorLiskDAO $object,
     array $xactions,
     array $changes,
     PhutilMarkupEngine $engine) {
     return array();
   }
 
 
   /**
    * Attempt to combine similar transactions into a smaller number of total
    * transactions. For example, two transactions which edit the title of an
    * object can be merged into a single edit.
    */
   private function combineTransactions(array $xactions) {
     $stray_comments = array();
 
     $result = array();
     $types = array();
     foreach ($xactions as $key => $xaction) {
       $type = $xaction->getTransactionType();
       if (isset($types[$type])) {
         foreach ($types[$type] as $other_key) {
           $other_xaction = $result[$other_key];
 
           // Don't merge transactions with different authors. For example,
           // don't merge Herald transactions and owners transactions.
           if ($other_xaction->getAuthorPHID() != $xaction->getAuthorPHID()) {
             continue;
           }
 
           $merged = $this->mergeTransactions($result[$other_key], $xaction);
           if ($merged) {
             $result[$other_key] = $merged;
 
             if ($xaction->getComment() &&
                 ($xaction->getComment() !== $merged->getComment())) {
               $stray_comments[] = $xaction->getComment();
             }
 
             if ($result[$other_key]->getComment() &&
                 ($result[$other_key]->getComment() !== $merged->getComment())) {
               $stray_comments[] = $result[$other_key]->getComment();
             }
 
             // Move on to the next transaction.
             continue 2;
           }
         }
       }
       $result[$key] = $xaction;
       $types[$type][] = $key;
     }
 
     // If we merged any comments away, restore them.
     foreach ($stray_comments as $comment) {
       $xaction = newv(get_class(head($result)), array());
       $xaction->setTransactionType(PhabricatorTransactions::TYPE_COMMENT);
       $xaction->setComment($comment);
       $result[] = $xaction;
     }
 
     return array_values($result);
   }
 
   public function mergePHIDOrEdgeTransactions(
     PhabricatorApplicationTransaction $u,
     PhabricatorApplicationTransaction $v) {
 
     $result = $u->getNewValue();
     foreach ($v->getNewValue() as $key => $value) {
       if ($u->getTransactionType() == PhabricatorTransactions::TYPE_EDGE) {
         if (empty($result[$key])) {
           $result[$key] = $value;
         } else {
           // We're merging two lists of edge adds, sets, or removes. Merge
           // them by merging individual PHIDs within them.
           $merged = $result[$key];
 
           foreach ($value as $dst => $v_spec) {
             if (empty($merged[$dst])) {
               $merged[$dst] = $v_spec;
             } else {
               // Two transactions are trying to perform the same operation on
               // the same edge. Normalize the edge data and then merge it. This
               // allows transactions to specify how data merges execute in a
               // precise way.
 
               $u_spec = $merged[$dst];
 
               if (!is_array($u_spec)) {
                 $u_spec = array('dst' => $u_spec);
               }
               if (!is_array($v_spec)) {
                 $v_spec = array('dst' => $v_spec);
               }
 
               $ux_data = idx($u_spec, 'data', array());
               $vx_data = idx($v_spec, 'data', array());
 
               $merged_data = $this->mergeEdgeData(
                 $u->getMetadataValue('edge:type'),
                 $ux_data,
                 $vx_data);
 
               $u_spec['data'] = $merged_data;
               $merged[$dst] = $u_spec;
             }
           }
 
           $result[$key] = $merged;
         }
       } else {
         $result[$key] = array_merge($value, idx($result, $key, array()));
       }
     }
     $u->setNewValue($result);
 
     // When combining an "ignore" transaction with a normal transaction, make
     // sure we don't propagate the "ignore" flag.
     if (!$v->getIgnoreOnNoEffect()) {
       $u->setIgnoreOnNoEffect(false);
     }
 
     return $u;
   }
 
   protected function mergeEdgeData($type, array $u, array $v) {
     return $v + $u;
   }
 
   protected function getPHIDTransactionNewValue(
     PhabricatorApplicationTransaction $xaction,
     $old = null) {
 
     if ($old !== null) {
       $old = array_fuse($old);
     } else {
       $old = array_fuse($xaction->getOldValue());
     }
 
     return $this->getPHIDList($old, $xaction->getNewValue());
   }
 
   public function getPHIDList(array $old, array $new) {
     $new_add = idx($new, '+', array());
     unset($new['+']);
     $new_rem = idx($new, '-', array());
     unset($new['-']);
     $new_set = idx($new, '=', null);
     if ($new_set !== null) {
       $new_set = array_fuse($new_set);
     }
     unset($new['=']);
 
     if ($new) {
       throw new Exception(
         pht(
           "Invalid '%s' value for PHID transaction. Value should contain only ".
           "keys '%s' (add PHIDs), '%s' (remove PHIDs) and '%s' (set PHIDS).",
           'new',
           '+',
           '-',
           '='));
     }
 
     $result = array();
 
     foreach ($old as $phid) {
       if ($new_set !== null && empty($new_set[$phid])) {
         continue;
       }
       $result[$phid] = $phid;
     }
 
     if ($new_set !== null) {
       foreach ($new_set as $phid) {
         $result[$phid] = $phid;
       }
     }
 
     foreach ($new_add as $phid) {
       $result[$phid] = $phid;
     }
 
     foreach ($new_rem as $phid) {
       unset($result[$phid]);
     }
 
     return array_values($result);
   }
 
   protected function getEdgeTransactionNewValue(
     PhabricatorApplicationTransaction $xaction) {
 
     $new = $xaction->getNewValue();
     $new_add = idx($new, '+', array());
     unset($new['+']);
     $new_rem = idx($new, '-', array());
     unset($new['-']);
     $new_set = idx($new, '=', null);
     unset($new['=']);
 
     if ($new) {
       throw new Exception(
         pht(
           "Invalid '%s' value for Edge transaction. Value should contain only ".
           "keys '%s' (add edges), '%s' (remove edges) and '%s' (set edges).",
           'new',
           '+',
           '-',
           '='));
     }
 
     $old = $xaction->getOldValue();
 
     $lists = array($new_set, $new_add, $new_rem);
     foreach ($lists as $list) {
       $this->checkEdgeList($list, $xaction->getMetadataValue('edge:type'));
     }
 
     $result = array();
     foreach ($old as $dst_phid => $edge) {
       if ($new_set !== null && empty($new_set[$dst_phid])) {
         continue;
       }
       $result[$dst_phid] = $this->normalizeEdgeTransactionValue(
         $xaction,
         $edge,
         $dst_phid);
     }
 
     if ($new_set !== null) {
       foreach ($new_set as $dst_phid => $edge) {
         $result[$dst_phid] = $this->normalizeEdgeTransactionValue(
           $xaction,
           $edge,
           $dst_phid);
       }
     }
 
     foreach ($new_add as $dst_phid => $edge) {
       $result[$dst_phid] = $this->normalizeEdgeTransactionValue(
         $xaction,
         $edge,
         $dst_phid);
     }
 
     foreach ($new_rem as $dst_phid => $edge) {
       unset($result[$dst_phid]);
     }
 
     return $result;
   }
 
   private function checkEdgeList($list, $edge_type) {
     if (!$list) {
       return;
     }
     foreach ($list as $key => $item) {
       if (phid_get_type($key) === PhabricatorPHIDConstants::PHID_TYPE_UNKNOWN) {
         throw new Exception(
           pht(
             'Edge transactions must have destination PHIDs as in edge '.
             'lists (found key "%s" on transaction of type "%s").',
             $key,
             $edge_type));
       }
       if (!is_array($item) && $item !== $key) {
         throw new Exception(
           pht(
             'Edge transactions must have PHIDs or edge specs as values '.
             '(found value "%s" on transaction of type "%s").',
             $item,
             $edge_type));
       }
     }
   }
 
   private function normalizeEdgeTransactionValue(
     PhabricatorApplicationTransaction $xaction,
     $edge,
     $dst_phid) {
 
     if (!is_array($edge)) {
       if ($edge != $dst_phid) {
         throw new Exception(
           pht(
             'Transaction edge data must either be the edge PHID or an edge '.
             'specification dictionary.'));
       }
       $edge = array();
     } else {
       foreach ($edge as $key => $value) {
         switch ($key) {
           case 'src':
           case 'dst':
           case 'type':
           case 'data':
           case 'dateCreated':
           case 'dateModified':
           case 'seq':
           case 'dataID':
             break;
           default:
             throw new Exception(
               pht(
                 'Transaction edge specification contains unexpected key "%s".',
                 $key));
         }
       }
     }
 
     $edge['dst'] = $dst_phid;
 
     $edge_type = $xaction->getMetadataValue('edge:type');
     if (empty($edge['type'])) {
       $edge['type'] = $edge_type;
     } else {
       if ($edge['type'] != $edge_type) {
         $this_type = $edge['type'];
         throw new Exception(
           pht(
             "Edge transaction includes edge of type '%s', but ".
             "transaction is of type '%s'. Each edge transaction ".
             "must alter edges of only one type.",
             $this_type,
             $edge_type));
       }
     }
 
     if (!isset($edge['data'])) {
       $edge['data'] = array();
     }
 
     return $edge;
   }
 
   protected function sortTransactions(array $xactions) {
     $head = array();
     $tail = array();
 
     // Move bare comments to the end, so the actions precede them.
     foreach ($xactions as $xaction) {
       $type = $xaction->getTransactionType();
       if ($type == PhabricatorTransactions::TYPE_COMMENT) {
         $tail[] = $xaction;
       } else {
         $head[] = $xaction;
       }
     }
 
     return array_values(array_merge($head, $tail));
   }
 
 
   protected function filterTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $type_comment = PhabricatorTransactions::TYPE_COMMENT;
 
     $no_effect = array();
     $has_comment = false;
     $any_effect = false;
     foreach ($xactions as $key => $xaction) {
       if ($this->transactionHasEffect($object, $xaction)) {
         if ($xaction->getTransactionType() != $type_comment) {
           $any_effect = true;
         }
       } else if ($xaction->getIgnoreOnNoEffect()) {
         unset($xactions[$key]);
       } else {
         $no_effect[$key] = $xaction;
       }
       if ($xaction->hasComment()) {
         $has_comment = true;
       }
     }
 
     if (!$no_effect) {
       return $xactions;
     }
 
     if (!$this->getContinueOnNoEffect() && !$this->getIsPreview()) {
       throw new PhabricatorApplicationTransactionNoEffectException(
         $no_effect,
         $any_effect,
         $has_comment);
     }
 
     if (!$any_effect && !$has_comment) {
       // If we only have empty comment transactions, just drop them all.
       return array();
     }
 
     foreach ($no_effect as $key => $xaction) {
       if ($xaction->hasComment()) {
         $xaction->setTransactionType($type_comment);
         $xaction->setOldValue(null);
         $xaction->setNewValue(null);
       } else {
         unset($xactions[$key]);
       }
     }
 
     return $xactions;
   }
 
 
   /**
    * Hook for validating transactions. This callback will be invoked for each
    * available transaction type, even if an edit does not apply any transactions
    * of that type. This allows you to raise exceptions when required fields are
    * missing, by detecting that the object has no field value and there is no
    * transaction which sets one.
    *
    * @param PhabricatorLiskDAO Object being edited.
    * @param string Transaction type to validate.
    * @param list<PhabricatorApplicationTransaction> Transactions of given type,
    *   which may be empty if the edit does not apply any transactions of the
    *   given type.
    * @return list<PhabricatorApplicationTransactionValidationError> List of
    *   validation errors.
    */
   protected function validateTransaction(
     PhabricatorLiskDAO $object,
     $type,
     array $xactions) {
 
     $errors = array();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $errors[] = $xtype->validateTransactions($object, $xactions);
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
         $errors[] = $this->validatePolicyTransaction(
           $object,
           $xactions,
           $type,
           PhabricatorPolicyCapability::CAN_VIEW);
         break;
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
         $errors[] = $this->validatePolicyTransaction(
           $object,
           $xactions,
           $type,
           PhabricatorPolicyCapability::CAN_EDIT);
         break;
       case PhabricatorTransactions::TYPE_SPACE:
         $errors[] = $this->validateSpaceTransactions(
           $object,
           $xactions,
           $type);
         break;
       case PhabricatorTransactions::TYPE_SUBTYPE:
         $errors[] = $this->validateSubtypeTransactions(
           $object,
           $xactions,
           $type);
         break;
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $groups = array();
         foreach ($xactions as $xaction) {
           $groups[$xaction->getMetadataValue('customfield:key')][] = $xaction;
         }
 
         $field_list = PhabricatorCustomField::getObjectFields(
           $object,
           PhabricatorCustomField::ROLE_EDIT);
         $field_list->setViewer($this->getActor());
 
         $role_xactions = PhabricatorCustomField::ROLE_APPLICATIONTRANSACTIONS;
         foreach ($field_list->getFields() as $field) {
           if (!$field->shouldEnableForRole($role_xactions)) {
             continue;
           }
           $errors[] = $field->validateApplicationTransactions(
             $this,
             $type,
             idx($groups, $field->getFieldKey(), array()));
         }
         break;
     }
 
     return array_mergev($errors);
   }
 
   public function validatePolicyTransaction(
     PhabricatorLiskDAO $object,
     array $xactions,
     $transaction_type,
     $capability) {
 
     $actor = $this->requireActor();
     $errors = array();
     // Note $this->xactions is necessary; $xactions is $this->xactions of
     // $transaction_type
     $policy_object = $this->adjustObjectForPolicyChecks(
       $object,
       $this->xactions);
 
     // Make sure the user isn't editing away their ability to $capability this
     // object.
     foreach ($xactions as $xaction) {
       try {
         PhabricatorPolicyFilter::requireCapabilityWithForcedPolicy(
           $actor,
           $policy_object,
           $capability,
           $xaction->getNewValue());
       } catch (PhabricatorPolicyException $ex) {
         $errors[] = new PhabricatorApplicationTransactionValidationError(
           $transaction_type,
           pht('Invalid'),
           pht(
             'You can not select this %s policy, because you would no longer '.
             'be able to %s the object.',
             $capability,
             $capability),
           $xaction);
       }
     }
 
     if ($this->getIsNewObject()) {
       if (!$xactions) {
         $has_capability = PhabricatorPolicyFilter::hasCapability(
           $actor,
           $policy_object,
           $capability);
         if (!$has_capability) {
           $errors[] = new PhabricatorApplicationTransactionValidationError(
             $transaction_type,
             pht('Invalid'),
             pht(
               'The selected %s policy excludes you. Choose a %s policy '.
               'which allows you to %s the object.',
               $capability,
               $capability,
               $capability));
         }
       }
     }
 
     return $errors;
   }
 
 
   private function validateSpaceTransactions(
     PhabricatorLiskDAO $object,
     array $xactions,
     $transaction_type) {
     $errors = array();
 
     $actor = $this->getActor();
 
     $has_spaces = PhabricatorSpacesNamespaceQuery::getViewerSpacesExist($actor);
     $actor_spaces = PhabricatorSpacesNamespaceQuery::getViewerSpaces($actor);
     $active_spaces = PhabricatorSpacesNamespaceQuery::getViewerActiveSpaces(
       $actor);
     foreach ($xactions as $xaction) {
       $space_phid = $xaction->getNewValue();
 
       if ($space_phid === null) {
         if (!$has_spaces) {
           // The install doesn't have any spaces, so this is fine.
           continue;
         }
 
         // The install has some spaces, so every object needs to be put
         // in a valid space.
         $errors[] = new PhabricatorApplicationTransactionValidationError(
           $transaction_type,
           pht('Invalid'),
           pht('You must choose a space for this object.'),
           $xaction);
         continue;
       }
 
       // If the PHID isn't `null`, it needs to be a valid space that the
       // viewer can see.
       if (empty($actor_spaces[$space_phid])) {
         $errors[] = new PhabricatorApplicationTransactionValidationError(
           $transaction_type,
           pht('Invalid'),
           pht(
             'You can not shift this object in the selected space, because '.
             'the space does not exist or you do not have access to it.'),
           $xaction);
       } else if (empty($active_spaces[$space_phid])) {
 
         // It's OK to edit objects in an archived space, so just move on if
         // we aren't adjusting the value.
         $old_space_phid = $this->getTransactionOldValue($object, $xaction);
         if ($space_phid == $old_space_phid) {
           continue;
         }
 
         $errors[] = new PhabricatorApplicationTransactionValidationError(
           $transaction_type,
           pht('Archived'),
           pht(
             'You can not shift this object into the selected space, because '.
             'the space is archived. Objects can not be created inside (or '.
             'moved into) archived spaces.'),
           $xaction);
       }
     }
 
     return $errors;
   }
 
   private function validateSubtypeTransactions(
     PhabricatorLiskDAO $object,
     array $xactions,
     $transaction_type) {
     $errors = array();
 
     $map = $object->newEditEngineSubtypeMap();
     $old = $object->getEditEngineSubtype();
     foreach ($xactions as $xaction) {
       $new = $xaction->getNewValue();
 
       if ($old == $new) {
         continue;
       }
 
       if (!isset($map[$new])) {
         $errors[] = new PhabricatorApplicationTransactionValidationError(
           $transaction_type,
           pht('Invalid'),
           pht(
             'The subtype "%s" is not a valid subtype.',
             $new),
           $xaction);
         continue;
       }
     }
 
     return $errors;
   }
 
   protected function adjustObjectForPolicyChecks(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $copy = clone $object;
 
     foreach ($xactions as $xaction) {
       switch ($xaction->getTransactionType()) {
         case PhabricatorTransactions::TYPE_SUBSCRIBERS:
           $clone_xaction = clone $xaction;
           $clone_xaction->setOldValue(array_values($this->subscribers));
           $clone_xaction->setNewValue(
             $this->getPHIDTransactionNewValue(
               $clone_xaction));
 
           PhabricatorPolicyRule::passTransactionHintToRule(
             $copy,
             new PhabricatorSubscriptionsSubscribersPolicyRule(),
             array_fuse($clone_xaction->getNewValue()));
 
           break;
         case PhabricatorTransactions::TYPE_SPACE:
           $space_phid = $this->getTransactionNewValue($object, $xaction);
           $copy->setSpacePHID($space_phid);
           break;
       }
     }
 
     return $copy;
   }
 
   protected function validateAllTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return array();
   }
 
   /**
    * Check for a missing text field.
    *
    * A text field is missing if the object has no value and there are no
    * transactions which set a value, or if the transactions remove the value.
    * This method is intended to make implementing @{method:validateTransaction}
    * more convenient:
    *
    *   $missing = $this->validateIsEmptyTextField(
    *     $object->getName(),
    *     $xactions);
    *
    * This will return `true` if the net effect of the object and transactions
    * is an empty field.
    *
    * @param wild Current field value.
    * @param list<PhabricatorApplicationTransaction> Transactions editing the
    *          field.
    * @return bool True if the field will be an empty text field after edits.
    */
   protected function validateIsEmptyTextField($field_value, array $xactions) {
     if (strlen($field_value) && empty($xactions)) {
       return false;
     }
 
     if ($xactions && strlen(last($xactions)->getNewValue())) {
       return false;
     }
 
     return true;
   }
 
 
 /* -(  Implicit CCs  )------------------------------------------------------- */
 
 
   /**
    * When a user interacts with an object, we might want to add them to CC.
    */
   final public function applyImplicitCC(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     if (!($object instanceof PhabricatorSubscribableInterface)) {
       // If the object isn't subscribable, we can't CC them.
       return $xactions;
     }
 
     $actor_phid = $this->getActingAsPHID();
 
     $type_user = PhabricatorPeopleUserPHIDType::TYPECONST;
     if (phid_get_type($actor_phid) != $type_user) {
       // Transactions by application actors like Herald, Harbormaster and
       // Diffusion should not CC the applications.
       return $xactions;
     }
 
     if ($object->isAutomaticallySubscribed($actor_phid)) {
       // If they're auto-subscribed, don't CC them.
       return $xactions;
     }
 
     $should_cc = false;
     foreach ($xactions as $xaction) {
       if ($this->shouldImplyCC($object, $xaction)) {
         $should_cc = true;
         break;
       }
     }
 
     if (!$should_cc) {
       // Only some types of actions imply a CC (like adding a comment).
       return $xactions;
     }
 
     if ($object->getPHID()) {
       if (isset($this->subscribers[$actor_phid])) {
         // If the user is already subscribed, don't implicitly CC them.
         return $xactions;
       }
 
       $unsub = PhabricatorEdgeQuery::loadDestinationPHIDs(
         $object->getPHID(),
         PhabricatorObjectHasUnsubscriberEdgeType::EDGECONST);
       $unsub = array_fuse($unsub);
       if (isset($unsub[$actor_phid])) {
         // If the user has previously unsubscribed from this object explicitly,
         // don't implicitly CC them.
         return $xactions;
       }
     }
 
     $xaction = newv(get_class(head($xactions)), array());
     $xaction->setTransactionType(PhabricatorTransactions::TYPE_SUBSCRIBERS);
     $xaction->setNewValue(array('+' => array($actor_phid)));
 
     array_unshift($xactions, $xaction);
 
     return $xactions;
   }
 
   protected function shouldImplyCC(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     return $xaction->isCommentTransaction();
   }
 
 
 /* -(  Sending Mail  )------------------------------------------------------- */
 
 
   /**
    * @task mail
    */
   protected function shouldSendMail(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return false;
   }
 
 
   /**
    * @task mail
    */
   private function buildMail(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $email_to = $this->mailToPHIDs;
     $email_cc = $this->mailCCPHIDs;
     $email_cc = array_merge($email_cc, $this->heraldEmailPHIDs);
 
     $targets = $this->buildReplyHandler($object)
       ->getMailTargets($email_to, $email_cc);
 
     // Set this explicitly before we start swapping out the effective actor.
     $this->setActingAsPHID($this->getActingAsPHID());
 
     $messages = array();
     foreach ($targets as $target) {
       $original_actor = $this->getActor();
 
       $viewer = $target->getViewer();
       $this->setActor($viewer);
       $locale = PhabricatorEnv::beginScopedLocale($viewer->getTranslation());
 
       $caught = null;
       $mail = null;
       try {
         // Reload handles for the new viewer.
         $this->loadHandles($xactions);
 
         $mail = $this->buildMailForTarget($object, $xactions, $target);
 
-        if ($this->mustEncrypt) {
-          $mail
-            ->setMustEncrypt(true)
-            ->setMustEncryptReasons($this->mustEncrypt);
+        if ($mail) {
+          if ($this->mustEncrypt) {
+            $mail
+              ->setMustEncrypt(true)
+              ->setMustEncryptReasons($this->mustEncrypt);
+          }
         }
-
       } catch (Exception $ex) {
         $caught = $ex;
       }
 
       $this->setActor($original_actor);
       unset($locale);
 
       if ($caught) {
         throw $ex;
       }
 
       if ($mail) {
         $messages[] = $mail;
       }
     }
 
     $this->runHeraldMailRules($messages);
 
     return $messages;
   }
 
   protected function getTransactionsForMail(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return $xactions;
   }
 
   private function buildMailForTarget(
     PhabricatorLiskDAO $object,
     array $xactions,
     PhabricatorMailTarget $target) {
 
     // Check if any of the transactions are visible for this viewer. If we
     // don't have any visible transactions, don't send the mail.
 
     $any_visible = false;
     foreach ($xactions as $xaction) {
       if (!$xaction->shouldHideForMail($xactions)) {
         $any_visible = true;
         break;
       }
     }
 
     if (!$any_visible) {
       return null;
     }
 
     $mail_xactions = $this->getTransactionsForMail($object, $xactions);
 
     $mail = $this->buildMailTemplate($object);
     $body = $this->buildMailBody($object, $mail_xactions);
 
     $mail_tags = $this->getMailTags($object, $mail_xactions);
     $action = $this->getMailAction($object, $mail_xactions);
     $stamps = $this->generateMailStamps($object, $this->mailStamps);
 
     if (PhabricatorEnv::getEnvConfig('metamta.email-preferences')) {
       $this->addEmailPreferenceSectionToMailBody(
         $body,
         $object,
         $mail_xactions);
     }
 
     $mail
       ->setSensitiveContent(false)
       ->setFrom($this->getActingAsPHID())
       ->setSubjectPrefix($this->getMailSubjectPrefix())
       ->setVarySubjectPrefix('['.$action.']')
       ->setThreadID($this->getMailThreadID($object), $this->getIsNewObject())
       ->setRelatedPHID($object->getPHID())
       ->setExcludeMailRecipientPHIDs($this->getExcludeMailRecipientPHIDs())
       ->setForceHeraldMailRecipientPHIDs($this->heraldForcedEmailPHIDs)
       ->setMailTags($mail_tags)
       ->setIsBulk(true)
       ->setBody($body->render())
       ->setHTMLBody($body->renderHTML());
 
     foreach ($body->getAttachments() as $attachment) {
       $mail->addAttachment($attachment);
     }
 
     if ($this->heraldHeader) {
       $mail->addHeader('X-Herald-Rules', $this->heraldHeader);
     }
 
     if ($object instanceof PhabricatorProjectInterface) {
       $this->addMailProjectMetadata($object, $mail);
     }
 
     if ($this->getParentMessageID()) {
       $mail->setParentMessageID($this->getParentMessageID());
     }
 
     // If we have stamps, attach the raw dictionary version (not the actual
     // objects) to the mail so that debugging tools can see what we used to
     // render the final list.
     if ($this->mailStamps) {
       $mail->setMailStampMetadata($this->mailStamps);
     }
 
     // If we have rendered stamps, attach them to the mail.
     if ($stamps) {
       $mail->setMailStamps($stamps);
     }
 
     return $target->willSendMail($mail);
   }
 
   private function addMailProjectMetadata(
     PhabricatorLiskDAO $object,
     PhabricatorMetaMTAMail $template) {
 
     $project_phids = PhabricatorEdgeQuery::loadDestinationPHIDs(
       $object->getPHID(),
       PhabricatorProjectObjectHasProjectEdgeType::EDGECONST);
 
     if (!$project_phids) {
       return;
     }
 
     // TODO: This viewer isn't quite right. It would be slightly better to use
     // the mail recipient, but that's not very easy given the way rendering
     // works today.
 
     $handles = id(new PhabricatorHandleQuery())
       ->setViewer($this->requireActor())
       ->withPHIDs($project_phids)
       ->execute();
 
     $project_tags = array();
     foreach ($handles as $handle) {
       if (!$handle->isComplete()) {
         continue;
       }
       $project_tags[] = '<'.$handle->getObjectName().'>';
     }
 
     if (!$project_tags) {
       return;
     }
 
     $project_tags = implode(', ', $project_tags);
     $template->addHeader('X-Phabricator-Projects', $project_tags);
   }
 
 
   protected function getMailThreadID(PhabricatorLiskDAO $object) {
     return $object->getPHID();
   }
 
 
   /**
    * @task mail
    */
   protected function getStrongestAction(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return last(msort($xactions, 'getActionStrength'));
   }
 
 
   /**
    * @task mail
    */
   protected function buildReplyHandler(PhabricatorLiskDAO $object) {
     throw new Exception(pht('Capability not supported.'));
   }
 
   /**
    * @task mail
    */
   protected function getMailSubjectPrefix() {
     throw new Exception(pht('Capability not supported.'));
   }
 
 
   /**
    * @task mail
    */
   protected function getMailTags(
     PhabricatorLiskDAO $object,
     array $xactions) {
     $tags = array();
 
     foreach ($xactions as $xaction) {
       $tags[] = $xaction->getMailTags();
     }
 
     return array_mergev($tags);
   }
 
   /**
    * @task mail
    */
   public function getMailTagsMap() {
     // TODO: We should move shared mail tags, like "comment", here.
     return array();
   }
 
 
   /**
    * @task mail
    */
   protected function getMailAction(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return $this->getStrongestAction($object, $xactions)->getActionName();
   }
 
 
   /**
    * @task mail
    */
   protected function buildMailTemplate(PhabricatorLiskDAO $object) {
     throw new Exception(pht('Capability not supported.'));
   }
 
 
   /**
    * @task mail
    */
   protected function getMailTo(PhabricatorLiskDAO $object) {
     throw new Exception(pht('Capability not supported.'));
   }
 
 
   /**
    * @task mail
    */
   protected function getMailCC(PhabricatorLiskDAO $object) {
     $phids = array();
     $has_support = false;
 
     if ($object instanceof PhabricatorSubscribableInterface) {
       $phid = $object->getPHID();
       $phids[] = PhabricatorSubscribersQuery::loadSubscribersForPHID($phid);
       $has_support = true;
     }
 
     if ($object instanceof PhabricatorProjectInterface) {
       $project_phids = PhabricatorEdgeQuery::loadDestinationPHIDs(
         $object->getPHID(),
         PhabricatorProjectObjectHasProjectEdgeType::EDGECONST);
 
       if ($project_phids) {
         $projects = id(new PhabricatorProjectQuery())
           ->setViewer(PhabricatorUser::getOmnipotentUser())
           ->withPHIDs($project_phids)
           ->needWatchers(true)
           ->execute();
 
         $watcher_phids = array();
         foreach ($projects as $project) {
           foreach ($project->getAllAncestorWatcherPHIDs() as $phid) {
             $watcher_phids[$phid] = $phid;
           }
         }
 
         if ($watcher_phids) {
           // We need to do a visibility check for all the watchers, as
           // watching a project is not a guarantee that you can see objects
           // associated with it.
           $users = id(new PhabricatorPeopleQuery())
             ->setViewer($this->requireActor())
             ->withPHIDs($watcher_phids)
             ->execute();
 
           $watchers = array();
           foreach ($users as $user) {
             $can_see = PhabricatorPolicyFilter::hasCapability(
               $user,
               $object,
               PhabricatorPolicyCapability::CAN_VIEW);
             if ($can_see) {
               $watchers[] = $user->getPHID();
             }
           }
           $phids[] = $watchers;
         }
       }
 
       $has_support = true;
     }
 
     if (!$has_support) {
       throw new Exception(
         pht('The object being edited does not implement any standard '.
           'interfaces (like PhabricatorSubscribableInterface) which allow '.
           'CCs to be generated automatically. Override the "getMailCC()" '.
           'method and generate CCs explicitly.'));
     }
 
     return array_mergev($phids);
   }
 
 
   /**
    * @task mail
    */
   protected function buildMailBody(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $body = new PhabricatorMetaMTAMailBody();
     $body->setViewer($this->requireActor());
 
     $this->addHeadersAndCommentsToMailBody($body, $xactions);
     $this->addCustomFieldsToMailBody($body, $object, $xactions);
     return $body;
   }
 
 
   /**
    * @task mail
    */
   protected function addEmailPreferenceSectionToMailBody(
     PhabricatorMetaMTAMailBody $body,
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $href = PhabricatorEnv::getProductionURI(
       '/settings/panel/emailpreferences/');
     $body->addLinkSection(pht('EMAIL PREFERENCES'), $href);
   }
 
 
   /**
    * @task mail
    */
   protected function addHeadersAndCommentsToMailBody(
     PhabricatorMetaMTAMailBody $body,
     array $xactions,
     $object_label = null,
     $object_href = null) {
 
     $headers = array();
     $headers_html = array();
     $comments = array();
     $details = array();
 
     foreach ($xactions as $xaction) {
       if ($xaction->shouldHideForMail($xactions)) {
         continue;
       }
 
       $header = $xaction->getTitleForMail();
       if ($header !== null) {
         $headers[] = $header;
       }
 
       $header_html = $xaction->getTitleForHTMLMail();
       if ($header_html !== null) {
         $headers_html[] = $header_html;
       }
 
       $comment = $xaction->getBodyForMail();
       if ($comment !== null) {
         $comments[] = $comment;
       }
 
       if ($xaction->hasChangeDetailsForMail()) {
         $details[] = $xaction;
       }
     }
 
     $headers_text = implode("\n", $headers);
     $body->addRawPlaintextSection($headers_text);
 
     $headers_html = phutil_implode_html(phutil_tag('br'), $headers_html);
 
     $header_button = null;
     if ($object_label !== null) {
       $button_style = array(
         'text-decoration: none;',
         'padding: 4px 8px;',
         'margin: 0 8px 8px;',
         'float: right;',
         'color: #464C5C;',
         'font-weight: bold;',
         'border-radius: 3px;',
         'background-color: #F7F7F9;',
         'background-image: linear-gradient(to bottom,#fff,#f1f0f1);',
         'display: inline-block;',
         'border: 1px solid rgba(71,87,120,.2);',
       );
 
       $header_button = phutil_tag(
         'a',
         array(
           'style' => implode(' ', $button_style),
           'href' => $object_href,
         ),
         $object_label);
     }
 
     $xactions_style = array(
     );
 
     $header_action = phutil_tag(
       'td',
       array(),
       $header_button);
 
     $header_action = phutil_tag(
       'td',
       array(
         'style' => implode(' ', $xactions_style),
       ),
       array(
         $headers_html,
         // Add an extra newline to prevent the "View Object" button from
         // running into the transaction text in Mail.app text snippet
         // previews.
         "\n",
       ));
 
     $headers_html = phutil_tag(
       'table',
       array(),
       phutil_tag('tr', array(), array($header_action, $header_button)));
 
     $body->addRawHTMLSection($headers_html);
 
     foreach ($comments as $comment) {
       $body->addRemarkupSection(null, $comment);
     }
 
     foreach ($details as $xaction) {
       $details = $xaction->renderChangeDetailsForMail($body->getViewer());
       if ($details !== null) {
         $label = $this->getMailDiffSectionHeader($xaction);
         $body->addHTMLSection($label, $details);
       }
     }
 
   }
 
   private function getMailDiffSectionHeader($xaction) {
     $type = $xaction->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       return $xtype->getMailDiffSectionHeader();
     }
 
     return pht('EDIT DETAILS');
   }
 
   /**
    * @task mail
    */
   protected function addCustomFieldsToMailBody(
     PhabricatorMetaMTAMailBody $body,
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     if ($object instanceof PhabricatorCustomFieldInterface) {
       $field_list = PhabricatorCustomField::getObjectFields(
         $object,
         PhabricatorCustomField::ROLE_TRANSACTIONMAIL);
       $field_list->setViewer($this->getActor());
       $field_list->readFieldsFromStorage($object);
 
       foreach ($field_list->getFields() as $field) {
         $field->updateTransactionMailBody(
           $body,
           $this,
           $xactions);
       }
     }
   }
 
 
   /**
    * @task mail
    */
   private function runHeraldMailRules(array $messages) {
     foreach ($messages as $message) {
       $engine = new HeraldEngine();
       $adapter = id(new PhabricatorMailOutboundMailHeraldAdapter())
         ->setObject($message);
 
       $rules = $engine->loadRulesForAdapter($adapter);
       $effects = $engine->applyRules($rules, $adapter);
       $engine->applyEffects($effects, $adapter, $rules);
     }
   }
 
 
 /* -(  Publishing Feed Stories  )-------------------------------------------- */
 
 
   /**
    * @task feed
    */
   protected function shouldPublishFeedStory(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return false;
   }
 
 
   /**
    * @task feed
    */
   protected function getFeedStoryType() {
     return 'PhabricatorApplicationTransactionFeedStory';
   }
 
 
   /**
    * @task feed
    */
   protected function getFeedRelatedPHIDs(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $phids = array(
       $object->getPHID(),
       $this->getActingAsPHID(),
     );
 
     if ($object instanceof PhabricatorProjectInterface) {
       $project_phids = PhabricatorEdgeQuery::loadDestinationPHIDs(
         $object->getPHID(),
         PhabricatorProjectObjectHasProjectEdgeType::EDGECONST);
       foreach ($project_phids as $project_phid) {
         $phids[] = $project_phid;
       }
     }
 
     return $phids;
   }
 
 
   /**
    * @task feed
    */
   protected function getFeedNotifyPHIDs(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     return array_unique(array_merge(
       $this->getMailTo($object),
       $this->getMailCC($object)));
   }
 
 
   /**
    * @task feed
    */
   protected function getFeedStoryData(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $xactions = msort($xactions, 'getActionStrength');
     $xactions = array_reverse($xactions);
 
     return array(
       'objectPHID'        => $object->getPHID(),
       'transactionPHIDs'  => mpull($xactions, 'getPHID'),
     );
   }
 
 
   /**
    * @task feed
    */
   protected function publishFeedStory(
     PhabricatorLiskDAO $object,
     array $xactions,
     array $mailed_phids) {
 
     $xactions = mfilter($xactions, 'shouldHideForFeed', true);
 
     if (!$xactions) {
       return;
     }
 
     $related_phids = $this->feedRelatedPHIDs;
     $subscribed_phids = $this->feedNotifyPHIDs;
 
     $story_type = $this->getFeedStoryType();
     $story_data = $this->getFeedStoryData($object, $xactions);
 
     id(new PhabricatorFeedStoryPublisher())
       ->setStoryType($story_type)
       ->setStoryData($story_data)
       ->setStoryTime(time())
       ->setStoryAuthorPHID($this->getActingAsPHID())
       ->setRelatedPHIDs($related_phids)
       ->setPrimaryObjectPHID($object->getPHID())
       ->setSubscribedPHIDs($subscribed_phids)
       ->setMailRecipientPHIDs($mailed_phids)
       ->setMailTags($this->getMailTags($object, $xactions))
       ->publish();
   }
 
 
 /* -(  Search Index  )------------------------------------------------------- */
 
 
   /**
    * @task search
    */
   protected function supportsSearch() {
     return false;
   }
 
 
 /* -(  Herald Integration )-------------------------------------------------- */
 
 
   protected function shouldApplyHeraldRules(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return false;
   }
 
   protected function buildHeraldAdapter(
     PhabricatorLiskDAO $object,
     array $xactions) {
     throw new Exception(pht('No herald adapter specified.'));
   }
 
   private function setHeraldAdapter(HeraldAdapter $adapter) {
     $this->heraldAdapter = $adapter;
     return $this;
   }
 
   protected function getHeraldAdapter() {
     return $this->heraldAdapter;
   }
 
   private function setHeraldTranscript(HeraldTranscript $transcript) {
     $this->heraldTranscript = $transcript;
     return $this;
   }
 
   protected function getHeraldTranscript() {
     return $this->heraldTranscript;
   }
 
   private function applyHeraldRules(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $adapter = $this->buildHeraldAdapter($object, $xactions)
       ->setContentSource($this->getContentSource())
       ->setIsNewObject($this->getIsNewObject())
       ->setAppliedTransactions($xactions);
 
     if ($this->getApplicationEmail()) {
       $adapter->setApplicationEmail($this->getApplicationEmail());
     }
 
     // If this editor is operating in silent mode, tell Herald that we aren't
     // going to send any mail. This allows it to skip "the first time this
     // rule matches, send me an email" rules which would otherwise match even
     // though we aren't going to send any mail.
     if ($this->getIsSilent()) {
       $adapter->setForbiddenAction(
         HeraldMailableState::STATECONST,
         HeraldCoreStateReasons::REASON_SILENT);
     }
 
     $xscript = HeraldEngine::loadAndApplyRules($adapter);
 
     $this->setHeraldAdapter($adapter);
     $this->setHeraldTranscript($xscript);
 
     if ($adapter instanceof HarbormasterBuildableAdapterInterface) {
       HarbormasterBuildable::applyBuildPlans(
         $adapter->getHarbormasterBuildablePHID(),
         $adapter->getHarbormasterContainerPHID(),
         $adapter->getQueuedHarbormasterBuildRequests());
     }
 
     $this->mustEncrypt = $adapter->getMustEncryptReasons();
 
     return array_merge(
       $this->didApplyHeraldRules($object, $adapter, $xscript),
       $adapter->getQueuedTransactions());
   }
 
   protected function didApplyHeraldRules(
     PhabricatorLiskDAO $object,
     HeraldAdapter $adapter,
     HeraldTranscript $transcript) {
     return array();
   }
 
 
 /* -(  Custom Fields  )------------------------------------------------------ */
 
 
   /**
    * @task customfield
    */
   private function getCustomFieldForTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $field_key = $xaction->getMetadataValue('customfield:key');
     if (!$field_key) {
       throw new Exception(
         pht(
         "Custom field transaction has no '%s'!",
         'customfield:key'));
     }
 
     $field = PhabricatorCustomField::getObjectField(
       $object,
       PhabricatorCustomField::ROLE_APPLICATIONTRANSACTIONS,
       $field_key);
 
     if (!$field) {
       throw new Exception(
         pht(
           "Custom field transaction has invalid '%s'; field '%s' ".
           "is disabled or does not exist.",
           'customfield:key',
           $field_key));
     }
 
     if (!$field->shouldAppearInApplicationTransactions()) {
       throw new Exception(
         pht(
           "Custom field transaction '%s' does not implement ".
           "integration for %s.",
           $field_key,
           'ApplicationTransactions'));
     }
 
     $field->setViewer($this->getActor());
 
     return $field;
   }
 
 
 /* -(  Files  )-------------------------------------------------------------- */
 
 
   /**
    * Extract the PHIDs of any files which these transactions attach.
    *
    * @task files
    */
   private function extractFilePHIDs(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $changes = $this->getRemarkupChanges($xactions);
     $blocks = mpull($changes, 'getNewValue');
 
     $phids = array();
     if ($blocks) {
       $phids[] = PhabricatorMarkupEngine::extractFilePHIDsFromEmbeddedFiles(
         $this->getActor(),
         $blocks);
     }
 
     foreach ($xactions as $xaction) {
       $type = $xaction->getTransactionType();
 
       $xtype = $this->getModularTransactionType($type);
       if ($xtype) {
         $phids[] = $xtype->extractFilePHIDs($object, $xaction->getNewValue());
       } else {
         $phids[] = $this->extractFilePHIDsFromCustomTransaction(
           $object,
           $xaction);
       }
     }
 
     $phids = array_unique(array_filter(array_mergev($phids)));
     if (!$phids) {
       return array();
     }
 
     // Only let a user attach files they can actually see, since this would
     // otherwise let you access any file by attaching it to an object you have
     // view permission on.
 
     $files = id(new PhabricatorFileQuery())
       ->setViewer($this->getActor())
       ->withPHIDs($phids)
       ->execute();
 
     return mpull($files, 'getPHID');
   }
 
   /**
    * @task files
    */
   protected function extractFilePHIDsFromCustomTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     return array();
   }
 
 
   /**
    * @task files
    */
   private function attachFiles(
     PhabricatorLiskDAO $object,
     array $file_phids) {
 
     if (!$file_phids) {
       return;
     }
 
     $editor = new PhabricatorEdgeEditor();
 
     $src = $object->getPHID();
     $type = PhabricatorObjectHasFileEdgeType::EDGECONST;
     foreach ($file_phids as $dst) {
       $editor->addEdge($src, $type, $dst);
     }
 
     $editor->save();
   }
 
   private function applyInverseEdgeTransactions(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction,
     $inverse_type) {
 
     $old = $xaction->getOldValue();
     $new = $xaction->getNewValue();
 
     $add = array_keys(array_diff_key($new, $old));
     $rem = array_keys(array_diff_key($old, $new));
 
     $add = array_fuse($add);
     $rem = array_fuse($rem);
     $all = $add + $rem;
 
     $nodes = id(new PhabricatorObjectQuery())
       ->setViewer($this->requireActor())
       ->withPHIDs($all)
       ->execute();
 
     foreach ($nodes as $node) {
       if (!($node instanceof PhabricatorApplicationTransactionInterface)) {
         continue;
       }
 
       if ($node instanceof PhabricatorUser) {
         // TODO: At least for now, don't record inverse edge transactions
         // for users (for example, "alincoln joined project X"): Feed fills
         // this role instead.
         continue;
       }
 
       $editor = $node->getApplicationTransactionEditor();
       $template = $node->getApplicationTransactionTemplate();
       $target = $node->getApplicationTransactionObject();
 
       if (isset($add[$node->getPHID()])) {
         $edge_edit_type = '+';
       } else {
         $edge_edit_type = '-';
       }
 
       $template
         ->setTransactionType($xaction->getTransactionType())
         ->setMetadataValue('edge:type', $inverse_type)
         ->setNewValue(
           array(
             $edge_edit_type => array($object->getPHID() => $object->getPHID()),
           ));
 
       $editor
         ->setContinueOnNoEffect(true)
         ->setContinueOnMissingFields(true)
         ->setParentMessageID($this->getParentMessageID())
         ->setIsInverseEdgeEditor(true)
         ->setActor($this->requireActor())
         ->setActingAsPHID($this->getActingAsPHID())
         ->setContentSource($this->getContentSource());
 
       $editor->applyTransactions($target, array($template));
     }
   }
 
 
 /* -(  Workers  )------------------------------------------------------------ */
 
 
   /**
    * Load any object state which is required to publish transactions.
    *
    * This hook is invoked in the main process before we compute data related
    * to publishing transactions (like email "To" and "CC" lists), and again in
    * the worker before publishing occurs.
    *
    * @return object Publishable object.
    * @task workers
    */
   protected function willPublish(PhabricatorLiskDAO $object, array $xactions) {
     return $object;
   }
 
 
   /**
    * Convert the editor state to a serializable dictionary which can be passed
    * to a worker.
    *
    * This data will be loaded with @{method:loadWorkerState} in the worker.
    *
    * @return dict<string, wild> Serializable editor state.
    * @task workers
    */
   final private function getWorkerState() {
     $state = array();
     foreach ($this->getAutomaticStateProperties() as $property) {
       $state[$property] = $this->$property;
     }
 
     $custom_state = $this->getCustomWorkerState();
     $custom_encoding = $this->getCustomWorkerStateEncoding();
 
     $state += array(
       'excludeMailRecipientPHIDs' => $this->getExcludeMailRecipientPHIDs(),
       'custom' => $this->encodeStateForStorage($custom_state, $custom_encoding),
       'custom.encoding' => $custom_encoding,
     );
 
     return $state;
   }
 
 
   /**
    * Hook; return custom properties which need to be passed to workers.
    *
    * @return dict<string, wild> Custom properties.
    * @task workers
    */
   protected function getCustomWorkerState() {
     return array();
   }
 
 
   /**
    * Hook; return storage encoding for custom properties which need to be
    * passed to workers.
    *
    * This primarily allows binary data to be passed to workers and survive
    * JSON encoding.
    *
    * @return dict<string, string> Property encodings.
    * @task workers
    */
   protected function getCustomWorkerStateEncoding() {
     return array();
   }
 
 
   /**
    * Load editor state using a dictionary emitted by @{method:getWorkerState}.
    *
    * This method is used to load state when running worker operations.
    *
    * @param dict<string, wild> Editor state, from @{method:getWorkerState}.
    * @return this
    * @task workers
    */
   final public function loadWorkerState(array $state) {
     foreach ($this->getAutomaticStateProperties() as $property) {
       $this->$property = idx($state, $property);
     }
 
     $exclude = idx($state, 'excludeMailRecipientPHIDs', array());
     $this->setExcludeMailRecipientPHIDs($exclude);
 
     $custom_state = idx($state, 'custom', array());
     $custom_encodings = idx($state, 'custom.encoding', array());
     $custom = $this->decodeStateFromStorage($custom_state, $custom_encodings);
 
     $this->loadCustomWorkerState($custom);
 
     return $this;
   }
 
 
   /**
    * Hook; set custom properties on the editor from data emitted by
    * @{method:getCustomWorkerState}.
    *
    * @param dict<string, wild> Custom state,
    *   from @{method:getCustomWorkerState}.
    * @return this
    * @task workers
    */
   protected function loadCustomWorkerState(array $state) {
     return $this;
   }
 
 
   /**
    * Get a list of object properties which should be automatically sent to
    * workers in the state data.
    *
    * These properties will be automatically stored and loaded by the editor in
    * the worker.
    *
    * @return list<string> List of properties.
    * @task workers
    */
   private function getAutomaticStateProperties() {
     return array(
       'parentMessageID',
       'isNewObject',
       'heraldEmailPHIDs',
       'heraldForcedEmailPHIDs',
       'heraldHeader',
       'mailToPHIDs',
       'mailCCPHIDs',
       'feedNotifyPHIDs',
       'feedRelatedPHIDs',
       'feedShouldPublish',
       'mailShouldSend',
       'mustEncrypt',
       'mailStamps',
     );
   }
 
   /**
    * Apply encodings prior to storage.
    *
    * See @{method:getCustomWorkerStateEncoding}.
    *
    * @param map<string, wild> Map of values to encode.
    * @param map<string, string> Map of encodings to apply.
    * @return map<string, wild> Map of encoded values.
    * @task workers
    */
   final private function encodeStateForStorage(
     array $state,
     array $encodings) {
 
     foreach ($state as $key => $value) {
       $encoding = idx($encodings, $key);
       switch ($encoding) {
         case self::STORAGE_ENCODING_BINARY:
           // The mechanics of this encoding (serialize + base64) are a little
           // awkward, but it allows us encode arrays and still be JSON-safe
           // with binary data.
 
           $value = @serialize($value);
           if ($value === false) {
             throw new Exception(
               pht(
                 'Failed to serialize() value for key "%s".',
                 $key));
           }
 
           $value = base64_encode($value);
           if ($value === false) {
             throw new Exception(
               pht(
                 'Failed to base64 encode value for key "%s".',
                 $key));
           }
           break;
       }
       $state[$key] = $value;
     }
 
     return $state;
   }
 
 
   /**
    * Undo storage encoding applied when storing state.
    *
    * See @{method:getCustomWorkerStateEncoding}.
    *
    * @param map<string, wild> Map of encoded values.
    * @param map<string, string> Map of encodings.
    * @return map<string, wild> Map of decoded values.
    * @task workers
    */
   final private function decodeStateFromStorage(
     array $state,
     array $encodings) {
 
     foreach ($state as $key => $value) {
       $encoding = idx($encodings, $key);
       switch ($encoding) {
         case self::STORAGE_ENCODING_BINARY:
           $value = base64_decode($value);
           if ($value === false) {
             throw new Exception(
               pht(
                 'Failed to base64_decode() value for key "%s".',
                 $key));
           }
 
           $value = unserialize($value);
           break;
       }
       $state[$key] = $value;
     }
 
     return $state;
   }
 
 
   /**
    * Remove conflicts from a list of projects.
    *
    * Objects aren't allowed to be tagged with multiple milestones in the same
    * group, nor projects such that one tag is the ancestor of any other tag.
    * If the list of PHIDs include mutually exclusive projects, remove the
    * conflicting projects.
    *
    * @param list<phid> List of project PHIDs.
    * @return list<phid> List with conflicts removed.
    */
   private function applyProjectConflictRules(array $phids) {
     if (!$phids) {
       return array();
     }
 
     // Overall, the last project in the list wins in cases of conflict (so when
     // you add something, the thing you just added sticks and removes older
     // values).
 
     // Beyond that, there are two basic cases:
 
     // Milestones: An object can't be in "A > Sprint 3" and "A > Sprint 4".
     // If multiple projects are milestones of the same parent, we only keep the
     // last one.
 
     // Ancestor: You can't be in "A" and "A > B". If "A > B" comes later
     // in the list, we remove "A" and keep "A > B". If "A" comes later, we
     // remove "A > B" and keep "A".
 
     // Note that it's OK to be in "A > B" and "A > C". There's only a conflict
     // if one project is an ancestor of another. It's OK to have something
     // tagged with multiple projects which share a common ancestor, so long as
     // they are not mutual ancestors.
 
     $viewer = PhabricatorUser::getOmnipotentUser();
 
     $projects = id(new PhabricatorProjectQuery())
       ->setViewer($viewer)
       ->withPHIDs(array_keys($phids))
       ->execute();
     $projects = mpull($projects, null, 'getPHID');
 
     // We're going to build a map from each project with milestones to the last
     // milestone in the list. This last milestone is the milestone we'll keep.
     $milestone_map = array();
 
     // We're going to build a set of the projects which have no descendants
     // later in the list. This allows us to apply both ancestor rules.
     $ancestor_map = array();
 
     foreach ($phids as $phid => $ignored) {
       $project = idx($projects, $phid);
       if (!$project) {
         continue;
       }
 
       // This is the last milestone we've seen, so set it as the selection for
       // the project's parent. This might be setting a new value or overwriting
       // an earlier value.
       if ($project->isMilestone()) {
         $parent_phid = $project->getParentProjectPHID();
         $milestone_map[$parent_phid] = $phid;
       }
 
       // Since this is the last item in the list we've examined so far, add it
       // to the set of projects with no later descendants.
       $ancestor_map[$phid] = $phid;
 
       // Remove any ancestors from the set, since this is a later descendant.
       foreach ($project->getAncestorProjects() as $ancestor) {
         $ancestor_phid = $ancestor->getPHID();
         unset($ancestor_map[$ancestor_phid]);
       }
     }
 
     // Now that we've built the maps, we can throw away all the projects which
     // have conflicts.
     foreach ($phids as $phid => $ignored) {
       $project = idx($projects, $phid);
 
       if (!$project) {
         // If a PHID is invalid, we just leave it as-is. We could clean it up,
         // but leaving it untouched is less likely to cause collateral damage.
         continue;
       }
 
       // If this was a milestone, check if it was the last milestone from its
       // group in the list. If not, remove it from the list.
       if ($project->isMilestone()) {
         $parent_phid = $project->getParentProjectPHID();
         if ($milestone_map[$parent_phid] !== $phid) {
           unset($phids[$phid]);
           continue;
         }
       }
 
       // If a later project in the list is a subproject of this one, it will
       // have removed ancestors from the map. If this project does not point
       // at itself in the ancestor map, it should be discarded in favor of a
       // subproject that comes later.
       if (idx($ancestor_map, $phid) !== $phid) {
         unset($phids[$phid]);
         continue;
       }
 
       // If a later project in the list is an ancestor of this one, it will
       // have added itself to the map. If any ancestor of this project points
       // at itself in the map, this project should be discarded in favor of
       // that later ancestor.
       foreach ($project->getAncestorProjects() as $ancestor) {
         $ancestor_phid = $ancestor->getPHID();
         if (isset($ancestor_map[$ancestor_phid])) {
           unset($phids[$phid]);
           continue 2;
         }
       }
     }
 
     return $phids;
   }
 
   /**
    * When the view policy for an object is changed, scramble the secret keys
    * for attached files to invalidate existing URIs.
    */
   private function scrambleFileSecrets($object) {
     // If this is a newly created object, we don't need to scramble anything
     // since it couldn't have been previously published.
     if ($this->getIsNewObject()) {
       return;
     }
 
     // If the object is a file itself, scramble it.
     if ($object instanceof PhabricatorFile) {
       if ($this->shouldScramblePolicy($object->getViewPolicy())) {
         $object->scrambleSecret();
         $object->save();
       }
     }
 
     $phid = $object->getPHID();
 
     $attached_phids = PhabricatorEdgeQuery::loadDestinationPHIDs(
       $phid,
       PhabricatorObjectHasFileEdgeType::EDGECONST);
     if (!$attached_phids) {
       return;
     }
 
     $omnipotent_viewer = PhabricatorUser::getOmnipotentUser();
 
     $files = id(new PhabricatorFileQuery())
       ->setViewer($omnipotent_viewer)
       ->withPHIDs($attached_phids)
       ->execute();
     foreach ($files as $file) {
       $view_policy = $file->getViewPolicy();
       if ($this->shouldScramblePolicy($view_policy)) {
         $file->scrambleSecret();
         $file->save();
       }
     }
   }
 
 
   /**
    * Check if a policy is strong enough to justify scrambling. Objects which
    * are set to very open policies don't need to scramble their files, and
    * files with very open policies don't need to be scrambled when associated
    * objects change.
    */
   private function shouldScramblePolicy($policy) {
     switch ($policy) {
       case PhabricatorPolicies::POLICY_PUBLIC:
       case PhabricatorPolicies::POLICY_USER:
         return false;
     }
 
     return true;
   }
 
   private function updateWorkboardColumns($object, $const, $old, $new) {
     // If an object is removed from a project, remove it from any proxy
     // columns for that project. This allows a task which is moved up from a
     // milestone to the parent to move back into the "Backlog" column on the
     // parent workboard.
 
     if ($const != PhabricatorProjectObjectHasProjectEdgeType::EDGECONST) {
       return;
     }
 
     // TODO: This should likely be some future WorkboardInterface.
     $appears_on_workboards = ($object instanceof ManiphestTask);
     if (!$appears_on_workboards) {
       return;
     }
 
     $removed_phids = array_keys(array_diff_key($old, $new));
     if (!$removed_phids) {
       return;
     }
 
     // Find any proxy columns for the removed projects.
     $proxy_columns = id(new PhabricatorProjectColumnQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withProxyPHIDs($removed_phids)
       ->execute();
     if (!$proxy_columns) {
       return array();
     }
 
     $proxy_phids = mpull($proxy_columns, 'getPHID');
 
     $position_table = new PhabricatorProjectColumnPosition();
     $conn_w = $position_table->establishConnection('w');
 
     queryfx(
       $conn_w,
       'DELETE FROM %T WHERE objectPHID = %s AND columnPHID IN (%Ls)',
       $position_table->getTableName(),
       $object->getPHID(),
       $proxy_phids);
   }
 
   private function getModularTransactionTypes() {
     if ($this->modularTypes === null) {
       $template = $this->object->getApplicationTransactionTemplate();
       if ($template instanceof PhabricatorModularTransaction) {
         $xtypes = $template->newModularTransactionTypes();
         foreach ($xtypes as $key => $xtype) {
           $xtype = clone $xtype;
           $xtype->setEditor($this);
           $xtypes[$key] = $xtype;
         }
       } else {
         $xtypes = array();
       }
 
       $this->modularTypes = $xtypes;
     }
 
     return $this->modularTypes;
   }
 
   private function getModularTransactionType($type) {
     $types = $this->getModularTransactionTypes();
     return idx($types, $type);
   }
 
   private function willApplyTransactions($object, array $xactions) {
     foreach ($xactions as $xaction) {
       $type = $xaction->getTransactionType();
 
       $xtype = $this->getModularTransactionType($type);
       if (!$xtype) {
         continue;
       }
 
       $xtype->willApplyTransactions($object, $xactions);
     }
   }
 
   public function getCreateObjectTitle($author, $object) {
     return pht('%s created this object.', $author);
   }
 
   public function getCreateObjectTitleForFeed($author, $object) {
     return pht('%s created an object: %s.', $author, $object);
   }
 
 /* -(  Queue  )-------------------------------------------------------------- */
 
   protected function queueTransaction(
     PhabricatorApplicationTransaction $xaction) {
     $this->transactionQueue[] = $xaction;
     return $this;
   }
 
   private function flushTransactionQueue($object) {
     if (!$this->transactionQueue) {
       return;
     }
 
     $xactions = $this->transactionQueue;
     $this->transactionQueue = array();
 
     $editor = $this->newQueueEditor();
 
     return $editor->applyTransactions($object, $xactions);
   }
 
   private function newQueueEditor() {
     $editor = id(newv(get_class($this), array()))
       ->setActor($this->getActor())
       ->setContentSource($this->getContentSource())
       ->setContinueOnNoEffect($this->getContinueOnNoEffect())
       ->setContinueOnMissingFields($this->getContinueOnMissingFields())
       ->setIsSilent($this->getIsSilent());
 
     if ($this->actingAsPHID !== null) {
       $editor->setActingAsPHID($this->actingAsPHID);
     }
 
     return $editor;
   }
 
 
 /* -(  Stamps  )------------------------------------------------------------- */
 
 
   public function newMailStampTemplates($object) {
     $actor = $this->getActor();
 
     $templates = array();
 
     $extensions = $this->newMailExtensions($object);
     foreach ($extensions as $extension) {
       $stamps = $extension->newMailStampTemplates($object);
       foreach ($stamps as $stamp) {
         $key = $stamp->getKey();
         if (isset($templates[$key])) {
           throw new Exception(
             pht(
               'Mail extension ("%s") defines a stamp template with the '.
               'same key ("%s") as another template. Each stamp template '.
               'must have a unique key.',
               get_class($extension),
               $key));
         }
 
         $stamp->setViewer($actor);
 
         $templates[$key] = $stamp;
       }
     }
 
     return $templates;
   }
 
   final public function getMailStamp($key) {
     if (!isset($this->stampTemplates)) {
       throw new PhutilInvalidStateException('newMailStampTemplates');
     }
 
     if (!isset($this->stampTemplates[$key])) {
       throw new Exception(
         pht(
           'Editor ("%s") has no mail stamp template with provided key ("%s").',
           get_class($this),
           $key));
     }
 
     return $this->stampTemplates[$key];
   }
 
   private function newMailStamps($object, array $xactions) {
     $actor = $this->getActor();
 
     $this->stampTemplates = $this->newMailStampTemplates($object);
 
     $extensions = $this->newMailExtensions($object);
     $stamps = array();
     foreach ($extensions as $extension) {
       $extension->newMailStamps($object, $xactions);
     }
 
     return $this->stampTemplates;
   }
 
   private function newMailExtensions($object) {
     $actor = $this->getActor();
 
     $all_extensions = PhabricatorMailEngineExtension::getAllExtensions();
 
     $extensions = array();
     foreach ($all_extensions as $key => $template) {
       $extension = id(clone $template)
         ->setViewer($actor)
         ->setEditor($this);
 
       if ($extension->supportsObject($object)) {
         $extensions[$key] = $extension;
       }
     }
 
     return $extensions;
   }
 
   private function generateMailStamps($object, $data) {
     if (!$data || !is_array($data)) {
       return null;
     }
 
     $templates = $this->newMailStampTemplates($object);
     foreach ($data as $spec) {
       if (!is_array($spec)) {
         continue;
       }
 
       $key = idx($spec, 'key');
       if (!isset($templates[$key])) {
         continue;
       }
 
       $type = idx($spec, 'type');
       if ($templates[$key]->getStampType() !== $type) {
         continue;
       }
 
       $value = idx($spec, 'value');
       $templates[$key]->setValueFromDictionary($value);
     }
 
     $results = array();
     foreach ($templates as $template) {
       $value = $template->getValueForRendering();
 
       $rendered = $template->renderStamps($value);
       if ($rendered === null) {
         continue;
       }
 
       $rendered = (array)$rendered;
       foreach ($rendered as $stamp) {
         $results[] = $stamp;
       }
     }
 
     natcasesort($results);
 
     return $results;
   }
 
 }