#19: fix F1-F3 defects found auditing the phases against PLAN.md

Every fix here is a case where the code and the plan disagreed, and the
code was wrong.

Certificates (section 8.2, 8.4). The parser documented that it skipped
expired entries but never checked, so an expired certificate would be
served until every handshake failed. LastReload() only advanced when
acme.json changed - and it does not change for sixty days - which made
the timestamp risk R2 monitors indistinguishable from a watcher gone
blind. Expiry is now checked on every pass, LastReload records the check
and LastChange the swap, and the <7d/<24h alerts of section 8.4 exist.

ARC (section 5). buildArcSealer resolved the DKIM key at startup, before
runDnsReconciler had provisioned one. On a first boot ARC was disabled
until someone restarted the process, which the log even admitted while
offering no way for it to start. A LazySealer binds on first use instead.

Health (section 8.4). There was no degraded state at all. /health now
reports one - still 200, because restarting cannot fix a certificate
Traefik never issued.

Bounces. DSNs were sent From postmaster@lambdamail.local, a domain that
does not resolve, so the notification was itself undeliverable. They now
carry the configured mail host, a Message-ID, and Auto-Submitted so a
vacation responder cannot loop against them.

Fan-out atomicity (section 6.1). Persist ran one transaction per
recipient, so a failure halfway through an alias fan-out left earlier
recipients with a copy while the sender was told to retry - and the retry
delivered to them twice. PersistAll commits the whole delivery or none of
it. Verified against Postgres by reverting the repository to the old
behaviour and confirming the new test fails on it.

SMTP replies. The use case encoded replies in error text ("550 5.7.1 ...")
which the adapter re-parsed by prefix, so rewording a message could turn a
permanent refusal into a retry. SmtpRejection carries the decision and the
adapter renders it.

Repository tests. These only run with TEST_DATABASE_URL, which CI does
set - so the job was red: copy and expunge seeded a 68-character digest
into a CHAR(64) column, and three others used fixed digests that collide
with the UNIQUE index on any re-run. A shared testBlobDigest() helper
fixes both; the suite now passes twice in a row against one database.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/internal/presentation/smtp/backend.go

@@ -8,7 +8,6 @@ import (
 	"errors"
 	"io"
 	"net"
-	"strings"
 
 	gosmtp "github.com/emersion/go-smtp"
 
@@ -141,28 +140,23 @@ func (s *session) Data(r io.Reader) error {
 		if errors.As(err, &smtpErr) {
 			return smtpErr
 		}
-		errMsg := err.Error()
-		if strings.HasPrefix(errMsg, "550 ") {
+
+		// A refusal the use case decided on carries its own reply. Rendering
+		// it here is the only place the wire format is chosen.
+		var rejection *usecase.SmtpRejection
+		if errors.As(err, &rejection) {
 			return &gosmtp.SMTPError{
-				Code:         550,
-				EnhancedCode: gosmtp.EnhancedCode{5, 7, 1},
-				Message:      strings.TrimPrefix(errMsg, "550 5.7.1 "),
-			}
-		}
-		if strings.HasPrefix(errMsg, "554 ") {
-			return &gosmtp.SMTPError{
-				Code:         554,
-				EnhancedCode: gosmtp.EnhancedCode{5, 7, 1},
-				Message:      strings.TrimPrefix(errMsg, "554 5.7.1 "),
-			}
-		}
-		if strings.HasPrefix(errMsg, "451 ") {
-			return &gosmtp.SMTPError{
-				Code:         451,
-				EnhancedCode: gosmtp.EnhancedCode{4, 7, 1},
-				Message:      strings.TrimPrefix(errMsg, "451 4.7.1 "),
+				Code: rejection.Code,
+				EnhancedCode: gosmtp.EnhancedCode{
+					rejection.EnhancedCode[0], rejection.EnhancedCode[1], rejection.EnhancedCode[2],
+				},
+				Message: rejection.Message,
 			}
 		}
+
+		// Anything else is an internal failure. It is reported as temporary so
+		// the sender retries: the message was not stored, and telling the peer
+		// it failed permanently would discard mail over a bug on this side.
 		return &gosmtp.SMTPError{
 			Code:         451,
 			EnhancedCode: gosmtp.EnhancedCode{4, 3, 0},

services/protocols/internal/presentation/smtp/backend_test.go

@@ -12,6 +12,7 @@ import (
 
 	"lambdamail/protocols/internal/application/port"
 	"lambdamail/protocols/internal/application/usecase"
+	"lambdamail/protocols/internal/domain/valueobject"
 )
 
 type fakeMailboxRepository struct {
@@ -37,6 +38,8 @@ func (f *fakeMailboxRepository) ResolveDeliveryTargets(_ context.Context, addres
 type recordingBlobStorage struct {
 	stored []byte
 	ref    port.BlobRef
+	// err makes Store fail, standing in for an unexpected internal failure.
+	err error
 }
 
 func (b *recordingBlobStorage) Store(_ context.Context, r io.Reader) (port.BlobRef, error) {
@@ -44,21 +47,44 @@ func (b *recordingBlobStorage) Store(_ context.Context, r io.Reader) (port.BlobR
 	if err != nil {
 		return port.BlobRef{}, err
 	}
+	if b.err != nil {
+		return port.BlobRef{}, b.err
+	}
 	b.stored = data
 	return b.ref, nil
 }
 
+// rejectingScanner stands in for the spam or virus scanner refusing a message.
+type rejectingScanner struct{ rejection error }
+
+func (s *rejectingScanner) Scan(_ context.Context, _ port.ScanInput) (*valueobject.ScanResult, error) {
+	return nil, s.rejection
+}
+
 type recordingMessageRepository struct {
 	persisted []port.PersistInboundMessageInput
 }
 
-func (m *recordingMessageRepository) Persist(_ context.Context, input port.PersistInboundMessageInput) (int64, error) {
-	m.persisted = append(m.persisted, input)
-	return int64(len(m.persisted)), nil
+func (m *recordingMessageRepository) PersistAll(_ context.Context, inputs []port.PersistInboundMessageInput) ([]int64, error) {
+	uids := make([]int64, 0, len(inputs))
+	for _, input := range inputs {
+		m.persisted = append(m.persisted, input)
+		uids = append(uids, int64(len(m.persisted)))
+	}
+	return uids, nil
 }
 
 func newTestSession(mailboxes *fakeMailboxRepository, blobs *recordingBlobStorage, messages *recordingMessageRepository) gosmtp.Session {
+	return newTestSessionWithScanner(mailboxes, blobs, messages, nil)
+}
+
+// newTestSessionWithScanner builds a session whose scanner refuses the message
+// with the given error, which is how a rejection reaches the Data handler.
+func newTestSessionWithScanner(mailboxes *fakeMailboxRepository, blobs *recordingBlobStorage, messages *recordingMessageRepository, rejection error) gosmtp.Session {
 	uc := usecase.NewProcessInboundEmailUseCase(mailboxes, blobs, messages)
+	if rejection != nil {
+		uc.SetScanner(&rejectingScanner{rejection: rejection})
+	}
 	backend := NewBackend(uc)
 	session, err := backend.NewSession(nil)
 	if err != nil {
@@ -194,3 +220,81 @@ func TestSession_Reset_ClearsAccumulatedRecipients(t *testing.T) {
 		t.Errorf("persisted %d messages after Reset, want 0", len(messages.persisted))
 	}
 }
+
+// The reply a remote MTA receives must come from the use case's decision, not
+// from parsing its error text: rewording a message would otherwise change a
+// permanent refusal into a retry, or the reverse.
+func TestSession_Data_RendersUseCaseRejectionVerbatim(t *testing.T) {
+	cases := []struct {
+		name             string
+		rejection        *usecase.SmtpRejection
+		wantCode         int
+		wantEnhancedCode gosmtp.EnhancedCode
+	}{
+		{"virus is permanent", &usecase.SmtpRejection{Code: 554, EnhancedCode: [3]int{5, 7, 1}, Message: "Virus detected: Eicar-Test"}, 554, gosmtp.EnhancedCode{5, 7, 1}},
+		{"greylist is temporary", &usecase.SmtpRejection{Code: 451, EnhancedCode: [3]int{4, 7, 1}, Message: "Greylisted, please try again later"}, 451, gosmtp.EnhancedCode{4, 7, 1}},
+		{"dmarc reject is permanent", &usecase.SmtpRejection{Code: 550, EnhancedCode: [3]int{5, 7, 1}, Message: "DMARC policy rejects this message"}, 550, gosmtp.EnhancedCode{5, 7, 1}},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			mailboxID := uuid.New()
+			mailboxes := &fakeMailboxRepository{byAddress: map[string]port.MailboxRecord{
+				"user@example.test": {ID: mailboxID, QuotaBytes: 1000},
+			}}
+			session := newTestSessionWithScanner(mailboxes,
+				&recordingBlobStorage{ref: port.BlobRef{ID: uuid.New()}}, &recordingMessageRepository{}, tc.rejection)
+
+			if err := session.Mail("sender@remote.test", nil); err != nil {
+				t.Fatalf("MAIL FROM: %v", err)
+			}
+			if err := session.Rcpt("user@example.test", nil); err != nil {
+				t.Fatalf("RCPT TO: %v", err)
+			}
+
+			err := session.Data(bytes.NewBufferString("Subject: hi\r\n\r\nbody\r\n"))
+
+			var smtpErr *gosmtp.SMTPError
+			if !errors.As(err, &smtpErr) {
+				t.Fatalf("Data returned %v, want an *gosmtp.SMTPError", err)
+			}
+			if smtpErr.Code != tc.wantCode {
+				t.Errorf("reply code = %d, want %d", smtpErr.Code, tc.wantCode)
+			}
+			if smtpErr.EnhancedCode != tc.wantEnhancedCode {
+				t.Errorf("enhanced code = %v, want %v", smtpErr.EnhancedCode, tc.wantEnhancedCode)
+			}
+			if smtpErr.Message != tc.rejection.Message {
+				t.Errorf("message = %q, want %q", smtpErr.Message, tc.rejection.Message)
+			}
+		})
+	}
+}
+
+// An unexpected internal failure must be temporary: the message was not
+// stored, and a permanent reply would discard mail over a bug on this side.
+func TestSession_Data_ReportsInternalFailureAsTemporary(t *testing.T) {
+	mailboxID := uuid.New()
+	mailboxes := &fakeMailboxRepository{byAddress: map[string]port.MailboxRecord{
+		"user@example.test": {ID: mailboxID, QuotaBytes: 1000},
+	}}
+	session := newTestSession(mailboxes,
+		&recordingBlobStorage{err: errors.New("disk full")}, &recordingMessageRepository{})
+
+	if err := session.Mail("sender@remote.test", nil); err != nil {
+		t.Fatalf("MAIL FROM: %v", err)
+	}
+	if err := session.Rcpt("user@example.test", nil); err != nil {
+		t.Fatalf("RCPT TO: %v", err)
+	}
+
+	err := session.Data(bytes.NewBufferString("Subject: hi\r\n\r\nbody\r\n"))
+
+	var smtpErr *gosmtp.SMTPError
+	if !errors.As(err, &smtpErr) {
+		t.Fatalf("Data returned %v, want an *gosmtp.SMTPError", err)
+	}
+	if smtpErr.Code != 451 {
+		t.Errorf("reply code = %d, want 451 so the sender retries", smtpErr.Code)
+	}
+}