Preserve receiving aliases during private-mail migration #5324

🤖 Generated by the Agentic Engineer

Summary

Preserve receiving continuity for retiring custom-domain addresses by delivering their mail into the retained maintainer mailbox, without keeping separate login accounts.

Motivation

The maintainer confirmed the complete address inventory privately and authorized graceful retirement of the other addresses during the private-mail migration. The prepared initializer currently provisions primary account identities only. A DNS cutover without explicit receiving aliases would lose continuity. Exact personal addresses remain in private operator evidence.

Proposed Solution

Add an optional, strictly validated list of receiving aliases for the maintainer mailbox. An omitted setting preserves existing behavior. When configured, inspect complete current native account/domain ownership under the exclusively owned recovery process before any apply, reject conflicts or unexpected existing maintainer aliases, and verify the complete resulting receiving set. Do not rename, merge or delete existing accounts.

Acceptance Criteria

• Configuration rejects duplicate, malformed, cross-domain and primary-account-colliding aliases; no secrets or personal migration addresses enter source/logs.
• Omission does not clear or manage aliases; configured aliases map only to the retained mailbox and grant no new login or agent-sending rights.
• Complete bounded native query/get refuses competing primary or alias owners, malformed/partial reads and unexpected existing aliases before mutation.
• Readback requires the exact configured receiving set, resolving native domain identities and accounting for native defaults.
• Actual pinned-server proof accepts mail to both configured aliases into the retained mailbox, rejects an unknown address, preserves account/history identity on replay, and refuses conflicting ownership without changing it.
• The image build/publication path remains verified and default-off. Public deployment, MX changes, backup/restore, mail-app migration and Homepage acceptance remain required by Company Email infrastructure and service notifications #5030.

Alternatives Considered

Keeping retired accounts would preserve unnecessary credentials and diverge from the maintainer's requested migration. A catch-all would accept undeclared recipients. Both are broader than the confirmed inventory.

Additional Context

Part of #5030. The administration asset source in #5316 must land before the resulting image is consumed. Standalone plan generation is a private snapshot, not an atomic live reconciliation; bootstrap must perform its fresh ownership check immediately before apply.