counters/todo.md

TODO — migadu_counters

State as of 2026-11-09. Review findings refer to review/README.md; the proof tests live in review/_proof_tests/ and should become regression tests as each item is fixed (round 1 and items 7–8 are mapped at the end of review/_proof_tests/README.md).

Done

• Review round 1: #1–#6 (queue + 202, lenient validation + IDN, token logins, INCR with per-key results and master re-read, CDB parse cache, mandatory token / port 5555), plus contrib/pull-domains.sh and counterctl --in/--out.
• #7 plus-addressing counts against the mailbox (domains.Mailbox).
• #8 malformed CDB row is "not hosted" + warning (domains.ErrMalformed).

Review round 2 — done 2026-11-09

#9-#17 fixed, plus the new findings from the 2026-11-09 review: repeat notifications after a lost Redis reply, pool timeouts treated as unknown outcomes, login suffix in the counting log, no retry of rejected transactions, /counters punycode, counter day taken from arrival time, CDB corruption checks, context deadlines on Redis sockets, example config path and placeholders, non-zero exit on a failed drain. Also added: the 80% early warning (warn_percent, warn_*_url) and per-counter notification markers.

Open

• Persistent / recoverable counting on Redis outage (deferred from round 1, #4). A Redis stall longer than a few seconds fills the queue and new requests are dropped (503, dropped_total). Decide whether drop-and-alert is acceptable before building anything.
• Exempt mail_from on /in. An outside sender using MAIL FROM:<support@migadu.com> avoids the recipient's incoming count, unless mizu rejects such senders inbound (not confirmed). Matches the old Lua rule; decide whether to keep it.
• Test gap. Watcher tests can occasionally pass on a stale signal: make them wait for the specific reload they triggered.

Outside this repo (deployment prerequisites)

• mailqueuer client: [counters] section and a fire-and-forget POST /in|/out per recipient inside the publish loop of mailqueuer/internal/handler/ingest.go (after a successful publish; /out when X-Auth-User is set). Reply is 202 {"accepted":true}; counted values only in the counting log and GET /counters.
• Ansible role in ansible-freebsd3, cloned from roles/rcptd: user/group, config.toml.j2 (auth_token is mandatory, port 5555), rc.d script under daemon(8), newsyslog entries for app.log, counting.log, pull.log, templated contrib/pull-domains.sh + contrib/migadu_counters-pull.cron (see contrib/README.md), agent host key acceptance, firewall: mailqueuer hosts → :5555, service → Sentinel :26379/:6379 and admin.migadu.com:443.
• migadu_web /api/limits D branch (domain level); until then notify.domain_url stays empty.
• migadu_web3 branch limit-warning-notifications: review the warning email wording, merge and deploy, then set warn_org_url and warn_address_url. Until then warnings stay off.
• Firewall / monitoring: admin_addr now defaults to localhost; set it explicitly if /metrics or /health are scraped from another host.
• Limits re-tuning: outgoing is counted per recipient (Lua counted per message), so existing */o limits are stricter. Review before relying on outgoing_limit_exceeded!.
• Retire stats-merger's quota module once this service is the source (only fernrohr reads it).
• Dependencies: golang.org/x/net is pinned to v0.43.0 because the offline module cache had it; run go get -u golang.org/x/net && go mod tidy with network access.