#3: close 3 known F1 gaps - folder/mailbox counters, quota-at-RCPT, alias fan-out

Per feature/3-f0-f1-validation's own gap analysis (commit 097fa37):

- InboundMessageRepository.Persist now updates folders.unread_count,
  folders.total_count, and mailboxes.used_bytes in the same transaction
  as the message insert (PLAN.md section 6.1 "++counters" was a no-op
  before this).
- MailboxRecord carries QuotaBytes/UsedBytes; ResolveRecipient rejects
  RCPT with 452 4.2.2 when a target mailbox has already reached its
  quota (used_bytes >= quota_bytes), before DATA - never silently
  accepting mail into a full mailbox.
- MailboxRepository.ResolveDeliveryTargets tries a direct mailbox match
  first, then falls back to the aliases table (exact source_address
  match takes precedence over a domain catch-all). One RCPT TO can now
  fan out to multiple mailboxes; alias destinations that don't resolve
  to an internal active mailbox are silently skipped, since outbound/
  external forwarding doesn't exist yet. postmaster@/abuse@/dmarc@-style
  aliases now actually deliver.

The E2E test's counters_updated subtest flips from a documented KNOWN
GAP (t.Skipf) to a hard assertion now that it passes, and gains two new
subtests (quota_rejected_when_mailbox_full, alias_resolves_to_destination_mailbox)
covering the other two fixes end-to-end. New unit and Postgres
integration test coverage added for all three fixes at every layer.

Verified: full suite green on Windows (unit + E2E via embedded
Postgres, no Docker needed) and via WSL Docker against the real
docker-compose Postgres (all infrastructure/postgres and diskstorage
integration tests, not just E2E). lang-lint clean.

services/protocols/internal/infrastructure/postgres/inbound_message_repository.go

@@ -39,8 +39,11 @@ func (r *InboundMessageRepository) Persist(ctx context.Context, input port.Persi
 		return 0, fmt.Errorf("find inbox folder for mailbox %s: %w", input.MailboxID, err)
 	}
 
-	if _, err := tx.Exec(ctx, `UPDATE folders SET uid_next = uid_next + 1 WHERE id = $1`, folderID); err != nil {
-		return 0, fmt.Errorf("advance uid_next: %w", err)
+	if _, err := tx.Exec(ctx, `
+		UPDATE folders SET uid_next = uid_next + 1, unread_count = unread_count + 1, total_count = total_count + 1
+		WHERE id = $1
+	`, folderID); err != nil {
+		return 0, fmt.Errorf("advance uid_next and folder counters: %w", err)
 	}
 
 	// email_messages.id defaults to gen_random_uuid() per the migration - no explicit value needed.
@@ -61,6 +64,10 @@ func (r *InboundMessageRepository) Persist(ctx context.Context, input port.Persi
 		return 0, fmt.Errorf("increment blob ref_count: %w", err)
 	}
 
+	if _, err := tx.Exec(ctx, `UPDATE mailboxes SET used_bytes = used_bytes + $1 WHERE id = $2`, input.Blob.SizeBytes, input.MailboxID); err != nil {
+		return 0, fmt.Errorf("increment mailbox used_bytes: %w", err)
+	}
+
 	if _, err := tx.Exec(ctx, `
 		INSERT INTO domain_events_outbox (event_type, aggregate_id, payload)
 		VALUES ('EmailReceived', $1, $2)

services/protocols/internal/infrastructure/postgres/inbound_message_repository_test.go

@@ -73,6 +73,25 @@ func TestInboundMessageRepository_Persist_AllocatesSequentialUIDs(t *testing.T)
 	if refCount != 2 {
 		t.Errorf("ref_count = %d, want 2 after two Persist calls referencing the same blob", refCount)
 	}
+
+	var unreadCount, totalCount int
+	if err := pool.QueryRow(ctx, `SELECT unread_count, total_count FROM folders WHERE id = $1`, folderID).Scan(&unreadCount, &totalCount); err != nil {
+		t.Fatalf("query folder counters: %v", err)
+	}
+	if unreadCount != 2 {
+		t.Errorf("folder unread_count = %d, want 2 after two Persist calls", unreadCount)
+	}
+	if totalCount != 2 {
+		t.Errorf("folder total_count = %d, want 2 after two Persist calls", totalCount)
+	}
+
+	var usedBytes int64
+	if err := pool.QueryRow(ctx, `SELECT used_bytes FROM mailboxes WHERE id = $1`, mailboxID).Scan(&usedBytes); err != nil {
+		t.Fatalf("query mailbox used_bytes: %v", err)
+	}
+	if usedBytes != blob.SizeBytes*2 {
+		t.Errorf("mailbox used_bytes = %d, want %d (two Persist calls of %d bytes each)", usedBytes, blob.SizeBytes*2, blob.SizeBytes)
+	}
 }
 
 func TestInboundMessageRepository_Persist_ReturnsErrorWhenNoInboxFolderExists(t *testing.T) {

services/protocols/internal/infrastructure/postgres/mailbox_repository.go

@@ -21,7 +21,7 @@ func NewMailboxRepository(pool *pgxpool.Pool) *MailboxRepository {
 
 func (r *MailboxRepository) FindActiveByAddress(ctx context.Context, address string) (*port.MailboxRecord, error) {
 	row := r.pool.QueryRow(ctx, `
-		SELECT m.id, d.max_message_bytes
+		SELECT m.id, d.max_message_bytes, m.quota_bytes, m.used_bytes
 		FROM mailboxes m
 		JOIN domains d ON d.id = m.domain_id
 		WHERE m.email_address = $1
@@ -31,7 +31,7 @@ func (r *MailboxRepository) FindActiveByAddress(ctx context.Context, address str
 
 	var rec port.MailboxRecord
 	var id uuid.UUID
-	if err := row.Scan(&id, &rec.MaxMessageBytes); err != nil {
+	if err := row.Scan(&id, &rec.MaxMessageBytes, &rec.QuotaBytes, &rec.UsedBytes); err != nil {
 		if err == pgx.ErrNoRows {
 			return nil, nil
 		}
@@ -40,3 +40,49 @@ func (r *MailboxRepository) FindActiveByAddress(ctx context.Context, address str
 	rec.ID = id
 	return &rec, nil
 }
+
+// ResolveDeliveryTargets tries a direct mailbox match first, then falls back
+// to aliases: an exact source_address match takes precedence over a
+// domain-wide catch-all. Destination addresses that don't resolve to an
+// internal active mailbox (e.g. external forwarding) are silently skipped -
+// outbound delivery doesn't exist yet in this sub-project's scope.
+func (r *MailboxRepository) ResolveDeliveryTargets(ctx context.Context, address string) ([]port.MailboxRecord, error) {
+	direct, err := r.FindActiveByAddress(ctx, address)
+	if err != nil {
+		return nil, err
+	}
+	if direct != nil {
+		return []port.MailboxRecord{*direct}, nil
+	}
+
+	var destinations []string
+	err = r.pool.QueryRow(ctx, `
+		SELECT a.destination_addresses
+		FROM aliases a
+		JOIN domains d ON d.id = a.domain_id
+		WHERE d.is_active = true
+		  AND a.is_active = true
+		  AND d.name = split_part($1, '@', 2)
+		  AND (a.source_address = $1 OR (a.is_catch_all AND a.source_address = '*@' || split_part($1, '@', 2)))
+		ORDER BY a.is_catch_all ASC
+		LIMIT 1
+	`, address).Scan(&destinations)
+	if err != nil {
+		if err == pgx.ErrNoRows {
+			return []port.MailboxRecord{}, nil
+		}
+		return nil, err
+	}
+
+	targets := []port.MailboxRecord{}
+	for _, dest := range destinations {
+		rec, err := r.FindActiveByAddress(ctx, dest)
+		if err != nil {
+			return nil, err
+		}
+		if rec != nil {
+			targets = append(targets, *rec)
+		}
+	}
+	return targets, nil
+}

services/protocols/internal/infrastructure/postgres/mailbox_repository_test.go

@@ -118,3 +118,194 @@ func TestMailboxRepository_FindActiveByAddress_ExcludesInactiveMailbox(t *testin
 		t.Errorf("rec = %+v, want nil - mailbox is_active=false must be excluded", rec)
 	}
 }
+
+func TestMailboxRepository_FindActiveByAddress_ReturnsQuotaAndUsedBytes(t *testing.T) {
+	pool := testPool(t)
+	defer pool.Close()
+	ctx := context.Background()
+
+	domainID := uuid.New()
+	domainName := "repo-test-quota-" + domainID.String() + ".invalid"
+	_, err := pool.Exec(ctx, `INSERT INTO domains (id, name, punycode_name) VALUES ($1, $2, $3)`,
+		domainID, domainName, domainName)
+	if err != nil {
+		t.Fatalf("seed domain: %v", err)
+	}
+	defer pool.Exec(ctx, `DELETE FROM domains WHERE id = $1`, domainID)
+
+	address := "user@" + domainName
+	_, err = pool.Exec(ctx, `INSERT INTO mailboxes (id, domain_id, local_part, email_address, password_hash, quota_bytes, used_bytes) VALUES ($1, $2, 'user', $3, '$argon2id$v=19$m=65536,t=3,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG', 5000, 4000)`,
+		uuid.New(), domainID, address)
+	if err != nil {
+		t.Fatalf("seed mailbox: %v", err)
+	}
+
+	repo := NewMailboxRepository(pool)
+	rec, err := repo.FindActiveByAddress(ctx, address)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if rec == nil {
+		t.Fatal("rec = nil, want a record for the seeded mailbox")
+	}
+	if rec.QuotaBytes != 5000 {
+		t.Errorf("QuotaBytes = %d, want 5000", rec.QuotaBytes)
+	}
+	if rec.UsedBytes != 4000 {
+		t.Errorf("UsedBytes = %d, want 4000", rec.UsedBytes)
+	}
+}
+
+func TestMailboxRepository_ResolveDeliveryTargets_PrefersDirectMailboxMatch(t *testing.T) {
+	pool := testPool(t)
+	defer pool.Close()
+	ctx := context.Background()
+
+	domainID := uuid.New()
+	domainName := "repo-test-direct-" + domainID.String() + ".invalid"
+	_, err := pool.Exec(ctx, `INSERT INTO domains (id, name, punycode_name) VALUES ($1, $2, $3)`,
+		domainID, domainName, domainName)
+	if err != nil {
+		t.Fatalf("seed domain: %v", err)
+	}
+	defer pool.Exec(ctx, `DELETE FROM domains WHERE id = $1`, domainID)
+
+	mailboxID := uuid.New()
+	address := "user@" + domainName
+	_, err = pool.Exec(ctx, `INSERT INTO mailboxes (id, domain_id, local_part, email_address, password_hash) VALUES ($1, $2, 'user', $3, '$argon2id$v=19$m=65536,t=3,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG')`,
+		mailboxID, domainID, address)
+	if err != nil {
+		t.Fatalf("seed mailbox: %v", err)
+	}
+
+	repo := NewMailboxRepository(pool)
+	targets, err := repo.ResolveDeliveryTargets(ctx, address)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(targets) != 1 || targets[0].ID != mailboxID {
+		t.Errorf("targets = %+v, want single record with ID %v (direct mailbox match)", targets, mailboxID)
+	}
+}
+
+func TestMailboxRepository_ResolveDeliveryTargets_ResolvesSpecificAlias(t *testing.T) {
+	pool := testPool(t)
+	defer pool.Close()
+	ctx := context.Background()
+
+	domainID := uuid.New()
+	domainName := "repo-test-alias-" + domainID.String() + ".invalid"
+	_, err := pool.Exec(ctx, `INSERT INTO domains (id, name, punycode_name) VALUES ($1, $2, $3)`,
+		domainID, domainName, domainName)
+	if err != nil {
+		t.Fatalf("seed domain: %v", err)
+	}
+	defer pool.Exec(ctx, `DELETE FROM domains WHERE id = $1`, domainID)
+
+	destMailboxID := uuid.New()
+	destAddress := "realuser@" + domainName
+	_, err = pool.Exec(ctx, `INSERT INTO mailboxes (id, domain_id, local_part, email_address, password_hash) VALUES ($1, $2, 'realuser', $3, '$argon2id$v=19$m=65536,t=3,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG')`,
+		destMailboxID, domainID, destAddress)
+	if err != nil {
+		t.Fatalf("seed destination mailbox: %v", err)
+	}
+
+	aliasAddress := "postmaster@" + domainName
+	_, err = pool.Exec(ctx, `INSERT INTO aliases (id, domain_id, source_address, destination_addresses) VALUES ($1, $2, $3, $4)`,
+		uuid.New(), domainID, aliasAddress, []string{destAddress})
+	if err != nil {
+		t.Fatalf("seed alias: %v", err)
+	}
+
+	repo := NewMailboxRepository(pool)
+	targets, err := repo.ResolveDeliveryTargets(ctx, aliasAddress)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(targets) != 1 || targets[0].ID != destMailboxID {
+		t.Errorf("targets = %+v, want single record with ID %v (alias destination)", targets, destMailboxID)
+	}
+}
+
+func TestMailboxRepository_ResolveDeliveryTargets_ResolvesCatchAllAlias(t *testing.T) {
+	pool := testPool(t)
+	defer pool.Close()
+	ctx := context.Background()
+
+	domainID := uuid.New()
+	domainName := "repo-test-catchall-" + domainID.String() + ".invalid"
+	_, err := pool.Exec(ctx, `INSERT INTO domains (id, name, punycode_name) VALUES ($1, $2, $3)`,
+		domainID, domainName, domainName)
+	if err != nil {
+		t.Fatalf("seed domain: %v", err)
+	}
+	defer pool.Exec(ctx, `DELETE FROM domains WHERE id = $1`, domainID)
+
+	destMailboxID := uuid.New()
+	destAddress := "catchall-target@" + domainName
+	_, err = pool.Exec(ctx, `INSERT INTO mailboxes (id, domain_id, local_part, email_address, password_hash) VALUES ($1, $2, 'catchall-target', $3, '$argon2id$v=19$m=65536,t=3,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG')`,
+		destMailboxID, domainID, destAddress)
+	if err != nil {
+		t.Fatalf("seed destination mailbox: %v", err)
+	}
+
+	_, err = pool.Exec(ctx, `INSERT INTO aliases (id, domain_id, source_address, destination_addresses, is_catch_all) VALUES ($1, $2, $3, $4, true)`,
+		uuid.New(), domainID, "*@"+domainName, []string{destAddress})
+	if err != nil {
+		t.Fatalf("seed catch-all alias: %v", err)
+	}
+
+	repo := NewMailboxRepository(pool)
+	targets, err := repo.ResolveDeliveryTargets(ctx, "whatever-unmapped@"+domainName)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(targets) != 1 || targets[0].ID != destMailboxID {
+		t.Errorf("targets = %+v, want single record with ID %v (catch-all destination)", targets, destMailboxID)
+	}
+}
+
+func TestMailboxRepository_ResolveDeliveryTargets_ReturnsEmptySliceWhenNothingMatches(t *testing.T) {
+	pool := testPool(t)
+	defer pool.Close()
+
+	repo := NewMailboxRepository(pool)
+	targets, err := repo.ResolveDeliveryTargets(context.Background(), "definitely-not-seeded@example.invalid")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(targets) != 0 {
+		t.Errorf("targets = %+v, want empty slice for an address with no mailbox and no alias", targets)
+	}
+}
+
+func TestMailboxRepository_ResolveDeliveryTargets_SkipsAliasDestinationThatIsNotAnInternalMailbox(t *testing.T) {
+	pool := testPool(t)
+	defer pool.Close()
+	ctx := context.Background()
+
+	domainID := uuid.New()
+	domainName := "repo-test-external-" + domainID.String() + ".invalid"
+	_, err := pool.Exec(ctx, `INSERT INTO domains (id, name, punycode_name) VALUES ($1, $2, $3)`,
+		domainID, domainName, domainName)
+	if err != nil {
+		t.Fatalf("seed domain: %v", err)
+	}
+	defer pool.Exec(ctx, `DELETE FROM domains WHERE id = $1`, domainID)
+
+	aliasAddress := "forward@" + domainName
+	_, err = pool.Exec(ctx, `INSERT INTO aliases (id, domain_id, source_address, destination_addresses) VALUES ($1, $2, $3, $4)`,
+		uuid.New(), domainID, aliasAddress, []string{"someone@external-provider.invalid"})
+	if err != nil {
+		t.Fatalf("seed alias: %v", err)
+	}
+
+	repo := NewMailboxRepository(pool)
+	targets, err := repo.ResolveDeliveryTargets(ctx, aliasAddress)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(targets) != 0 {
+		t.Errorf("targets = %+v, want empty slice - external forwarding destinations are not internal mailboxes and outbound delivery does not exist yet", targets)
+	}
+}