Estate mail moves to Hostinger, except airlock, which stays on Resend

rank: decision outranks: []

Estate mail moves to Hostinger, except airlock, which stays on Resend

Date: 2026-11-07 Status: closed Supersedes: none Superseded-by: none — current MR-compliance: MR-4, MR-7

Context

On 2026-11-06 the operator asked to move email from Resend and Reloop back to the Hostinger mail accounts. eva-hq/eva#274 (docs/specs/2026-11-06-hostinger-mail-consolidation.md) scoped that and listed five rulings for FLIGHT, R1 to R5. Traceo ADR 0155 §1 had ruled on 2026-11-03 that Resend stays on devarno.cloud, which carries airlock’s sign-in links for every app.

FLIGHT closed the rulings on 2026-11-07 in a guided wizard. The evidence behind them:

Fact	Value	Source
Railway plan	workspace `Devarno` is `PRO`	Railway API, read by the agent
Port 465 and 587 from airlock to `smtp.hostinger.com`	both reachable	operator ran the TCP probe; the agent’s own run was refused by the permission classifier, so this is operator-reported
Hostinger plan on `devarno.cloud`	Starter Business	hPanel, operator-reported
Send limit	1000 a day per mailbox, no hourly limit shown	hPanel, operator-reported
Resend volume	120 emails in 30 days	Resend dashboard, operator-reported
`send.traceo.cloud`, `send.smo1.io`	both show `forge.rmta.net` in this Resend account	Resend dashboard, operator-reported; DNS re-read by the agent
Last Resend send from `hubble@devarno.cloud`	none	Resend dashboard, operator-reported
Last Resend send from any `@smo1.io` address	none	Resend dashboard, operator-reported
`noreply@` and `hubble@` on `devarno.cloud`	mailboxes; IMAP and SMTP login succeed	agent, no mail sent
`alerts@`	alias of `hubble@`, accepted as sender	agent, at `RCPT` with a wrong-sender control refused `553 5.7.1`

A reachable port shows the path is open. It does not show that SMTP login or relay works from Railway.

Decision

R1. airlock stays on Resend, on devarno.cloud. This keeps 0155 §1. The path to move it is open, and moving it stays possible by a new decision.

R2. Not needed. The plan is Pro and the ports are reachable.

R3. Sending on devarno.cloud uses dedicated mailboxes. hubble@ is hubble’s own mailbox, with alerts@ as its alias. noreply@ exists for airlock and sends nothing while R1 stands. Neither ops@ nor fleet@ carries application mail, because both are identity addresses. Each sender keeps its own password. casa holds no mailbox password; its scripts go through airlock.

R4. choco and smo1.io are in. Their Resend remnants are removed. smo1 purr-api stays on Mailjet.

R5. Hostinger is added to the commercial facts now. The approved row:

- name: Hostinger
  purpose: Sends account, sign-in and verification email
  location: European Union (Lithuania)
  applies_to:
    - traceo

Resend stays listed, because airlock still sends through it.

Soak. FLIGHT ruled traceo’s 0155 step 5 soak as passed, so the Traceo session may start P1. Vercel showed no [email] … failed= since the 2026-11-03 cutover. How many mails were sent in that time is unknown to the agent.

Owner. P1 stays with the Traceo session. P2 to P6 go to a new session named MAIL.

Alternatives considered

Move airlock now — not chosen by FLIGHT. It remains open, as the probe found no block.
Aliases on ops@ or fleet@ — rejected: every app would hold the login to an identity inbox, and one burst suspension would take that address down too.
One new mailbox with an alias — rejected: hubble runs on Vercel and would hold the sign-in mailbox’s password, and alerts would share sign-in’s cap.

Consequences

For code:

The spec’s goal narrows. Resend stays for devarno.cloud: its domain, DKIM, send. record, the key airlock uses, and the account. P4 falls away.
P2 shrinks. The harnesses need not leave Resend for a cutover, because none is coming. Before any key is deleted, MAIL traces which key each harness and app holds. The dashboard shows only 3 keys for at least six consumers, and click-through.mjs:30 and smoke.sh:21 abort if theirs is gone.
P3 proceeds. hubble moves to hubble@ over SMTP and checks the send result. The email channel stays, so mrr_decline keeps its route. casa’s two scripts go through airlock, and its silent “dev mode” return goes. choco’s wiring goes.
P5 shrinks to traceo.cloud and smo1.io in Resend, their resend._domainkey and send. records, and reloop._domainkey.nestr.tools. Those deletions are one-way, so they need operator confirmation at the step.

For docs:

eva-hq/eva#274 is updated to these rulings.
estate/commercial-facts.yaml gains the R5 row in its own PR. estate/legal/ is generated, and the rendered copy is pinned by hash under docs/decisions/2026-10-30-legal-pages-rendered-from-commercial-facts.md. So that PR re-renders, needs a fresh countersign on the new copy, and is then vendored into traceo.
nestr also mails through Hostinger but is not in the facts file. Its legal page has not been checked.

For in-flight phases:

None. With airlock staying, no cutover touches Sparki’s M-1 sign-in flows.

For invariants:

None.

What this decision does NOT do

It does not rule what happens to the idle noreply@ mailbox, or to the Onboarding Resend key, whose owner is unknown.
It does not settle which variables share a Resend key.
It does not record real delivery from hubble@. SPF, DKIM, DMARC and outside-inbox placement are P3 acceptance.
It does not explain why hubble has no Resend send on record. Its key may never have been exercised, so P3 proves the send rather than assuming it worked.

References

eva-hq/eva#274, docs/specs/2026-11-06-hostinger-mail-consolidation.md (the scope and the five rulings)
traceo-cloud/traceo-mcp-server:traceo_mcp_server/docs/decisions/0155-send-transactional-email-over-hostinger-smtp-behind-a-transport-switch.md (the ruling R1 keeps)
docs/decisions/2026-10-30-legal-pages-rendered-from-commercial-facts.md (why R5 needs a re-render and countersign)
https://docs.railway.com/reference/outbound-networking (SMTP by plan)

Sign-off

Subagent: hermes-df session (2026-11-07, operator wizard mail-rulings-wizard.sh)
Human countersign — the rulings above are FLIGHT’s, and the R5 row is the approved wording — flight@arno.host, 2026-11-07 (jzero.run T1)

Countersigned by human:flight@arno.host on 2026-11-07 at jzero.run T1 — box ticked in commit d5e7adef, authored as alex@devarno.cloud: the rulings above are FLIGHT’s, and the R5 row is the approved wording. FLIGHT confirmed the signature to the agent on 2026-11-07. Status flipped open→closed on 2026-11-07 by an agent as scribe (MR-7).