#19: fix F1-F3 defects found auditing the phases against PLAN.md

Every fix here is a case where the code and the plan disagreed, and the
code was wrong.

Certificates (section 8.2, 8.4). The parser documented that it skipped
expired entries but never checked, so an expired certificate would be
served until every handshake failed. LastReload() only advanced when
acme.json changed - and it does not change for sixty days - which made
the timestamp risk R2 monitors indistinguishable from a watcher gone
blind. Expiry is now checked on every pass, LastReload records the check
and LastChange the swap, and the <7d/<24h alerts of section 8.4 exist.

ARC (section 5). buildArcSealer resolved the DKIM key at startup, before
runDnsReconciler had provisioned one. On a first boot ARC was disabled
until someone restarted the process, which the log even admitted while
offering no way for it to start. A LazySealer binds on first use instead.

Health (section 8.4). There was no degraded state at all. /health now
reports one - still 200, because restarting cannot fix a certificate
Traefik never issued.

Bounces. DSNs were sent From postmaster@lambdamail.local, a domain that
does not resolve, so the notification was itself undeliverable. They now
carry the configured mail host, a Message-ID, and Auto-Submitted so a
vacation responder cannot loop against them.

Fan-out atomicity (section 6.1). Persist ran one transaction per
recipient, so a failure halfway through an alias fan-out left earlier
recipients with a copy while the sender was told to retry - and the retry
delivered to them twice. PersistAll commits the whole delivery or none of
it. Verified against Postgres by reverting the repository to the old
behaviour and confirming the new test fails on it.

SMTP replies. The use case encoded replies in error text ("550 5.7.1 ...")
which the adapter re-parsed by prefix, so rewording a message could turn a
permanent refusal into a retry. SmtpRejection carries the decision and the
adapter renders it.

Repository tests. These only run with TEST_DATABASE_URL, which CI does
set - so the job was red: copy and expunge seeded a 68-character digest
into a CHAR(64) column, and three others used fixed digests that collide
with the UNIQUE index on any re-run. A shared testBlobDigest() helper
fixes both; the suite now passes twice in a row against one database.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/internal/infrastructure/tls/acme_cert_watcher.go

@@ -3,6 +3,7 @@ package tlsprovider
 import (
 	"crypto/sha256"
 	"crypto/tls"
+	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
@@ -37,8 +38,15 @@ type AcmeCertWatcher struct {
 	// using a consistent map.
 	certificates atomic.Pointer[map[string]*tls.Certificate]
 
-	lastHash     atomic.Pointer[[32]byte]
+	lastHash atomic.Pointer[[32]byte]
+	// lastReloadAt is the last time the store was successfully read and found
+	// usable, whether or not its content had changed. It is what PLAN.md risk
+	// R2 monitors: acme.json normally sits untouched for sixty days, so a
+	// timestamp that only advanced on change could not distinguish a healthy
+	// idle watcher from one that has gone blind.
 	lastReloadAt atomic.Pointer[time.Time]
+	// lastChangeAt is the last time the certificates themselves were swapped.
+	lastChangeAt atomic.Pointer[time.Time]
 
 	// unknownSNI counts handshakes for names we hold no certificate for; it
 	// backs the tls_unknown_sni_total metric of PLAN.md section 8.4.
@@ -110,31 +118,80 @@ func (w *AcmeCertWatcher) reload() error {
 		return fmt.Errorf("read %s: %w", w.path, err)
 	}
 
-	hash := sha256.Sum256(raw)
-	if previous := w.lastHash.Load(); previous != nil && *previous == hash {
-		return nil
-	}
-
-	certificates, err := parseAcmeStore(raw)
-	if err != nil {
-		return err
-	}
-	if len(certificates) == 0 {
-		return fmt.Errorf("acme watcher: %s holds no usable certificate", w.path)
-	}
-
-	w.certificates.Store(&certificates)
-	w.lastHash.Store(&hash)
 	now := time.Now()
-	w.lastReloadAt.Store(&now)
 
+	hash := sha256.Sum256(raw)
+	if previous := w.lastHash.Load(); previous == nil || *previous != hash {
+		certificates, err := parseAcmeStore(raw, now)
+		if err != nil {
+			return err
+		}
+		if len(certificates) == 0 {
+			return fmt.Errorf("acme watcher: %s holds no usable certificate", w.path)
+		}
+
+		w.certificates.Store(&certificates)
+		w.lastHash.Store(&hash)
+		w.lastChangeAt.Store(&now)
+	}
+
+	// Expiry is checked on every pass, not only on change: a certificate ages
+	// out while the file it lives in stays byte-identical.
+	w.reportExpiry(now)
+
+	w.lastReloadAt.Store(&now)
 	return nil
 }
 
+// reportExpiry raises the alerts of PLAN.md section 8.4 for certificates that
+// are close to expiring. Renewal is Traefik's job, so all this side can do is
+// make the failure loud before it becomes an outage.
+func (w *AcmeCertWatcher) reportExpiry(now time.Time) {
+	host, expiry, ok := w.EarliestExpiry()
+	if !ok {
+		return
+	}
+
+	switch remaining := expiry.Sub(now); {
+	case remaining <= 0:
+		log.Printf("CRITICAL: the certificate for %s expired at %s and Traefik has not replaced it", host, expiry.Format(time.RFC3339))
+	case remaining < 24*time.Hour:
+		log.Printf("CRITICAL: the certificate for %s expires in %s", host, remaining.Round(time.Minute))
+	case remaining < 7*24*time.Hour:
+		log.Printf("WARNING: the certificate for %s expires in %s", host, remaining.Round(time.Hour))
+	}
+}
+
+// EarliestExpiry reports the soonest expiry across the loaded certificates,
+// which is the one that decides when the deployment breaks.
+func (w *AcmeCertWatcher) EarliestExpiry() (string, time.Time, bool) {
+	loaded := w.certificates.Load()
+	if loaded == nil {
+		return "", time.Time{}, false
+	}
+
+	var (
+		soonestHost string
+		soonest     time.Time
+	)
+	for host, cert := range *loaded {
+		if cert.Leaf == nil {
+			continue
+		}
+		if soonest.IsZero() || cert.Leaf.NotAfter.Before(soonest) {
+			soonest, soonestHost = cert.Leaf.NotAfter, host
+		}
+	}
+	if soonest.IsZero() {
+		return "", time.Time{}, false
+	}
+	return soonestHost, soonest, true
+}
+
 // parseAcmeStore walks every resolver in the file. A single unusable entry -
 // an expired certificate, or one whose key does not match - is skipped rather
 // than failing the whole load, so one stale domain cannot take the server down.
-func parseAcmeStore(raw []byte) (map[string]*tls.Certificate, error) {
+func parseAcmeStore(raw []byte, now time.Time) (map[string]*tls.Certificate, error) {
 	var store acmeFile
 	if err := json.Unmarshal(raw, &store); err != nil {
 		return nil, fmt.Errorf("parse acme store: %w", err)
@@ -161,6 +218,23 @@ func parseAcmeStore(raw []byte) (map[string]*tls.Certificate, error) {
 				continue
 			}
 
+			// X509KeyPair leaves Leaf nil. Parsing it here is what makes the
+			// expiry checks below and in reportExpiry possible at all.
+			leaf, err := x509.ParseCertificate(pair.Certificate[0])
+			if err != nil {
+				log.Printf("acme watcher: skipping %s in resolver %q: leaf certificate is unparseable: %v", entry.Domain.Main, resolverName, err)
+				continue
+			}
+			// An expired entry is worse than a missing one: it would be served
+			// in a handshake every peer then rejects. Skipping it lets the SNI
+			// fallback or the self-signed provider take over instead
+			// (PLAN.md section 8.2, trap 3).
+			if now.After(leaf.NotAfter) {
+				log.Printf("acme watcher: skipping %s in resolver %q: the certificate expired at %s", entry.Domain.Main, resolverName, leaf.NotAfter.Format(time.RFC3339))
+				continue
+			}
+			pair.Leaf = leaf
+
 			for _, name := range append([]string{entry.Domain.Main}, entry.Domain.SANs...) {
 				if name != "" {
 					certificates[strings.ToLower(name)] = &pair
@@ -210,9 +284,9 @@ func wildcardOf(name string) string {
 	return ""
 }
 
-// LastReload reports when the store was last successfully refreshed. A
-// timestamp that stops advancing is the signal that the watcher went blind
-// (PLAN.md risk R2).
+// LastReload reports when the store was last read successfully, changed or
+// not. A timestamp that stops advancing is the signal that the watcher went
+// blind (PLAN.md risk R2).
 func (w *AcmeCertWatcher) LastReload() time.Time {
 	if t := w.lastReloadAt.Load(); t != nil {
 		return *t
@@ -220,6 +294,15 @@ func (w *AcmeCertWatcher) LastReload() time.Time {
 	return time.Time{}
 }
 
+// LastChange reports when the served certificates were last swapped, which is
+// how a renewal that never arrived is detected.
+func (w *AcmeCertWatcher) LastChange() time.Time {
+	if t := w.lastChangeAt.Load(); t != nil {
+		return *t
+	}
+	return time.Time{}
+}
+
 // UnknownSNICount backs the tls_unknown_sni_total metric.
 func (w *AcmeCertWatcher) UnknownSNICount() int64 {
 	return w.unknownSNI.Load()

services/protocols/internal/infrastructure/tls/acme_cert_watcher_test.go

@@ -20,6 +20,13 @@ import (
 // makeCertPEM issues a self-signed certificate for the given names.
 func makeCertPEM(t *testing.T, names ...string) (certPEM, keyPEM []byte) {
 	t.Helper()
+	return makeCertPEMWithValidity(t, -time.Hour, 90*24*time.Hour, names...)
+}
+
+// makeCertPEMWithValidity issues a certificate whose validity window is given
+// relative to now, so a test can produce an expired or nearly expired one.
+func makeCertPEMWithValidity(t *testing.T, notBefore, notAfter time.Duration, names ...string) (certPEM, keyPEM []byte) {
+	t.Helper()
 
 	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
@@ -29,8 +36,8 @@ func makeCertPEM(t *testing.T, names ...string) (certPEM, keyPEM []byte) {
 		SerialNumber: big.NewInt(time.Now().UnixNano()),
 		Subject:      pkix.Name{CommonName: names[0]},
 		DNSNames:     names,
-		NotBefore:    time.Now().Add(-time.Hour),
-		NotAfter:     time.Now().Add(90 * 24 * time.Hour),
+		NotBefore:    time.Now().Add(notBefore),
+		NotAfter:     time.Now().Add(notAfter),
 	}
 	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
 	if err != nil {
@@ -49,6 +56,13 @@ func makeCertPEM(t *testing.T, names ...string) (certPEM, keyPEM []byte) {
 // resolver name to that resolver's account and certificates.
 func writeAcmeStore(t *testing.T, dir, resolverName string, entries map[string][]string) string {
 	t.Helper()
+	return writeAcmeStoreWithValidity(t, dir, resolverName, entries, -time.Hour, 90*24*time.Hour)
+}
+
+// writeAcmeStoreWithValidity is writeAcmeStore with control over how long the
+// issued certificates are valid for.
+func writeAcmeStoreWithValidity(t *testing.T, dir, resolverName string, entries map[string][]string, notBefore, notAfter time.Duration) string {
+	t.Helper()
 
 	type domain struct {
 		Main string   `json:"main"`
@@ -62,7 +76,7 @@ func writeAcmeStore(t *testing.T, dir, resolverName string, entries map[string][
 
 	var certificates []certificate
 	for main, sans := range entries {
-		certPEM, keyPEM := makeCertPEM(t, append([]string{main}, sans...)...)
+		certPEM, keyPEM := makeCertPEMWithValidity(t, notBefore, notAfter, append([]string{main}, sans...)...)
 		certificates = append(certificates, certificate{
 			Domain:      domain{Main: main, SANs: sans},
 			Certificate: base64.StdEncoding.EncodeToString(certPEM),
@@ -240,21 +254,63 @@ func TestAcmeCertWatcher_FailsWhenStoreMissing(t *testing.T) {
 	}
 }
 
-// An identical file must not cause a pointless swap; LastReload only advances
-// when the content actually changed.
-func TestAcmeCertWatcher_SkipsReloadWhenContentUnchanged(t *testing.T) {
+// An identical file must not cause a pointless swap, but the watcher must
+// still record that it looked. acme.json sits untouched for sixty days, so a
+// LastReload that only advanced on change could not tell a healthy idle
+// watcher apart from one that went blind (PLAN.md risk R2).
+func TestAcmeCertWatcher_SkipsSwapButRecordsCheckWhenContentUnchanged(t *testing.T) {
 	dir := t.TempDir()
 	writeAcmeStore(t, dir, "letsencrypt", map[string][]string{"mail.example.test": nil})
 
 	watcher, _ := NewAcmeCertWatcher(dir, "acme.json", "mail.example.test")
-	first := watcher.LastReload()
+	firstReload := watcher.LastReload()
+	firstChange := watcher.LastChange()
 
 	time.Sleep(2 * time.Millisecond)
 	if err := watcher.reload(); err != nil {
 		t.Fatalf("reload: %v", err)
 	}
 
-	if !watcher.LastReload().Equal(first) {
-		t.Error("an unchanged file triggered a reload")
+	if !watcher.LastChange().Equal(firstChange) {
+		t.Error("an unchanged file swapped the certificate store")
+	}
+	if !watcher.LastReload().After(firstReload) {
+		t.Error("LastReload did not advance, so a blind watcher would look identical to an idle one")
+	}
+}
+
+// An expired entry must not be served: every peer would reject the handshake,
+// whereas skipping it lets the SNI fallback take over (PLAN.md section 8.2).
+func TestAcmeCertWatcher_SkipsExpiredCertificate(t *testing.T) {
+	dir := t.TempDir()
+	writeAcmeStoreWithValidity(t, dir, "letsencrypt",
+		map[string][]string{"expired.example.test": nil}, -48*time.Hour, -24*time.Hour)
+
+	if _, err := NewAcmeCertWatcher(dir, "acme.json", "expired.example.test"); err == nil {
+		t.Fatal("a store holding only an expired certificate must not load as usable")
+	}
+}
+
+// The soonest expiry is what decides when the deployment breaks, so it has to
+// be readable for the alerts of PLAN.md section 8.4.
+func TestAcmeCertWatcher_ReportsEarliestExpiry(t *testing.T) {
+	dir := t.TempDir()
+	writeAcmeStoreWithValidity(t, dir, "letsencrypt",
+		map[string][]string{"mail.example.test": nil}, -time.Hour, 72*time.Hour)
+
+	watcher, err := NewAcmeCertWatcher(dir, "acme.json", "mail.example.test")
+	if err != nil {
+		t.Fatalf("NewAcmeCertWatcher: %v", err)
+	}
+
+	host, expiry, ok := watcher.EarliestExpiry()
+	if !ok {
+		t.Fatal("EarliestExpiry reported nothing for a loaded store")
+	}
+	if host != "mail.example.test" {
+		t.Errorf("EarliestExpiry host = %q, want mail.example.test", host)
+	}
+	if remaining := time.Until(expiry); remaining > 73*time.Hour || remaining < 71*time.Hour {
+		t.Errorf("expiry is %s away, want roughly 72h", remaining)
 	}
 }