#3: close 3 known F1 gaps - folder/mailbox counters, quota-at-RCPT, alias fan-out

Per feature/3-f0-f1-validation's own gap analysis (commit 097fa37):

- InboundMessageRepository.Persist now updates folders.unread_count,
  folders.total_count, and mailboxes.used_bytes in the same transaction
  as the message insert (PLAN.md section 6.1 "++counters" was a no-op
  before this).
- MailboxRecord carries QuotaBytes/UsedBytes; ResolveRecipient rejects
  RCPT with 452 4.2.2 when a target mailbox has already reached its
  quota (used_bytes >= quota_bytes), before DATA - never silently
  accepting mail into a full mailbox.
- MailboxRepository.ResolveDeliveryTargets tries a direct mailbox match
  first, then falls back to the aliases table (exact source_address
  match takes precedence over a domain catch-all). One RCPT TO can now
  fan out to multiple mailboxes; alias destinations that don't resolve
  to an internal active mailbox are silently skipped, since outbound/
  external forwarding doesn't exist yet. postmaster@/abuse@/dmarc@-style
  aliases now actually deliver.

The E2E test's counters_updated subtest flips from a documented KNOWN
GAP (t.Skipf) to a hard assertion now that it passes, and gains two new
subtests (quota_rejected_when_mailbox_full, alias_resolves_to_destination_mailbox)
covering the other two fixes end-to-end. New unit and Postgres
integration test coverage added for all three fixes at every layer.

Verified: full suite green on Windows (unit + E2E via embedded
Postgres, no Docker needed) and via WSL Docker against the real
docker-compose Postgres (all infrastructure/postgres and diskstorage
integration tests, not just E2E). lang-lint clean.

services/protocols/internal/application/port/mailbox_repository.go

@@ -12,11 +12,23 @@ import (
 type MailboxRecord struct {
 	ID              uuid.UUID
 	MaxMessageBytes int64
+	QuotaBytes      int64
+	UsedBytes       int64
 }
 
-// MailboxRepository resolves a recipient address to an active mailbox.
+// MailboxRepository resolves a recipient address to the active mailbox(es)
+// mail for it should be delivered to.
 type MailboxRepository interface {
 	// FindActiveByAddress returns nil, nil (not an error) when no active
 	// mailbox with an active domain matches address.
 	FindActiveByAddress(ctx context.Context, address string) (*MailboxRecord, error)
+
+	// ResolveDeliveryTargets returns every active mailbox mail for address
+	// should be delivered to: the mailbox itself when address matches one
+	// directly, or the mailbox(es) reached through a matching alias
+	// (source_address exact match takes precedence over a domain
+	// catch-all). Returns an empty, non-nil slice (not an error) when
+	// nothing matches - a direct mailbox miss, an alias with no active
+	// destination, or no alias at all are all "not found", not failures.
+	ResolveDeliveryTargets(ctx context.Context, address string) ([]MailboxRecord, error)
 }

services/protocols/internal/application/usecase/process_inbound_email.go

@@ -14,6 +14,13 @@ import (
 // mailbox matches - the presentation layer maps this to SMTP 550 5.1.1.
 var ErrRecipientNotFound = errors.New("process inbound email: recipient not found or inactive")
 
+// ErrMailboxQuotaExceeded is returned by ResolveRecipient when a resolved
+// target mailbox has already reached its storage quota - the presentation
+// layer maps this to SMTP 452 4.2.2. If a single RCPT resolves to multiple
+// mailboxes (alias fan-out) and any one of them is full, the whole RCPT is
+// rejected rather than partially delivering.
+var ErrMailboxQuotaExceeded = errors.New("process inbound email: mailbox has reached its storage quota")
+
 // ProcessInboundEmailInput carries one SMTP DATA transaction's worth of
 // state: the accumulated recipients from one or more successful Rcpt calls,
 // and the message body stream.
@@ -38,16 +45,23 @@ func NewProcessInboundEmailUseCase(mailboxes port.MailboxRepository, blobs port.
 	return &ProcessInboundEmailUseCase{mailboxes: mailboxes, blobs: blobs, messages: messages}
 }
 
-// ResolveRecipient is called from the SMTP session's RCPT TO handler.
-func (uc *ProcessInboundEmailUseCase) ResolveRecipient(ctx context.Context, address string) (*port.MailboxRecord, error) {
-	rec, err := uc.mailboxes.FindActiveByAddress(ctx, address)
+// ResolveRecipient is called from the SMTP session's RCPT TO handler. It
+// returns every mailbox address should be delivered to (more than one for
+// an alias that fans out), or ErrRecipientNotFound / ErrMailboxQuotaExceeded.
+func (uc *ProcessInboundEmailUseCase) ResolveRecipient(ctx context.Context, address string) ([]port.MailboxRecord, error) {
+	targets, err := uc.mailboxes.ResolveDeliveryTargets(ctx, address)
 	if err != nil {
 		return nil, err
 	}
-	if rec == nil {
+	if len(targets) == 0 {
 		return nil, ErrRecipientNotFound
 	}
-	return rec, nil
+	for _, t := range targets {
+		if t.UsedBytes >= t.QuotaBytes {
+			return nil, ErrMailboxQuotaExceeded
+		}
+	}
+	return targets, nil
 }
 
 // Handle is called once from the SMTP session's DATA handler, after one or

services/protocols/internal/application/usecase/process_inbound_email_test.go

@@ -23,19 +23,27 @@ func (f *fakeMailboxRepository) FindActiveByAddress(_ context.Context, address s
 	return &rec, nil
 }
 
+func (f *fakeMailboxRepository) ResolveDeliveryTargets(_ context.Context, address string) ([]port.MailboxRecord, error) {
+	rec, ok := f.byAddress[address]
+	if !ok {
+		return []port.MailboxRecord{}, nil
+	}
+	return []port.MailboxRecord{rec}, nil
+}
+
 func TestUseCase_ResolveRecipient_ReturnsRecordForActiveMailbox(t *testing.T) {
 	mailboxID := uuid.New()
 	mailboxes := &fakeMailboxRepository{byAddress: map[string]port.MailboxRecord{
-		"user@example.test": {ID: mailboxID, MaxMessageBytes: 1000},
+		"user@example.test": {ID: mailboxID, MaxMessageBytes: 1000, QuotaBytes: 1000},
 	}}
 	uc := NewProcessInboundEmailUseCase(mailboxes, nil, nil)
 
-	rec, err := uc.ResolveRecipient(context.Background(), "user@example.test")
+	targets, err := uc.ResolveRecipient(context.Background(), "user@example.test")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if rec.ID != mailboxID {
-		t.Errorf("ID = %v, want %v", rec.ID, mailboxID)
+	if len(targets) != 1 || targets[0].ID != mailboxID {
+		t.Errorf("targets = %+v, want single record with ID %v", targets, mailboxID)
 	}
 }
 
@@ -49,6 +57,44 @@ func TestUseCase_ResolveRecipient_ReturnsErrRecipientNotFoundForUnknownAddress(t
 	}
 }
 
+func TestUseCase_ResolveRecipient_ReturnsErrMailboxQuotaExceededWhenFull(t *testing.T) {
+	mailboxes := &fakeMailboxRepository{byAddress: map[string]port.MailboxRecord{
+		"full@example.test": {ID: uuid.New(), QuotaBytes: 1000, UsedBytes: 1000},
+	}}
+	uc := NewProcessInboundEmailUseCase(mailboxes, nil, nil)
+
+	_, err := uc.ResolveRecipient(context.Background(), "full@example.test")
+	if !errors.Is(err, ErrMailboxQuotaExceeded) {
+		t.Fatalf("error = %v, want ErrMailboxQuotaExceeded", err)
+	}
+}
+
+func TestUseCase_ResolveRecipient_ReturnsErrMailboxQuotaExceededWhenAnyFanOutTargetIsFull(t *testing.T) {
+	mailboxes := &fakeAliasFanOutRepository{targets: []port.MailboxRecord{
+		{ID: uuid.New(), QuotaBytes: 1000, UsedBytes: 0},
+		{ID: uuid.New(), QuotaBytes: 1000, UsedBytes: 1000},
+	}}
+	uc := NewProcessInboundEmailUseCase(mailboxes, nil, nil)
+
+	_, err := uc.ResolveRecipient(context.Background(), "alias@example.test")
+	if !errors.Is(err, ErrMailboxQuotaExceeded) {
+		t.Fatalf("error = %v, want ErrMailboxQuotaExceeded when any fan-out target is full", err)
+	}
+}
+
+// fakeAliasFanOutRepository simulates an alias resolving to multiple mailboxes.
+type fakeAliasFanOutRepository struct {
+	targets []port.MailboxRecord
+}
+
+func (f *fakeAliasFanOutRepository) FindActiveByAddress(_ context.Context, _ string) (*port.MailboxRecord, error) {
+	return nil, nil
+}
+
+func (f *fakeAliasFanOutRepository) ResolveDeliveryTargets(_ context.Context, _ string) ([]port.MailboxRecord, error) {
+	return f.targets, nil
+}
+
 type stubBlobStorage struct {
 	ref port.BlobRef
 	err error