carlos / platform Public

mail: verify reconciles the configuration set, in both directions (#272)

Neither the record nor SES is the source of truth for a domain's
configuration set. DEPLOYMENT INTENT is: a deployment with an SNS topic
wants every identity bound to its account's set, one without wants none
bound, and both stores are projections of that. Either can drift from it,
and one of them did — an out-of-band unbind left the record claiming a set
SES no longer had, which silenced #268's warning for a domain emitting
nothing. A diagnostic that is confidently wrong is worse than one that is
merely absent.

Reconciliation lands in VerifyDomain because IdentityStatus has ALREADY
asked SES about this identity there, so the check is free. The rejected
alternative was reconciling on every status read: that puts a
GetEmailIdentity per domain on a path which today answers from the bucket
alone, and turns a working read into a failure whenever AWS is unreachable.
Catching drift a beat later costs nothing; making every read depend on AWS
costs something on every read.

GetEmailIdentity already returns the binding and IdentityStatus was
discarding it, so Status gains ConfigSet and the field comes free from a
call already being made. The fake had to be fixed to match: it stored the
binding but returned Status alone, so it would have reported an empty
binding forever and a reconciliation test could have passed against
something production would never do — the same divergence its own
NOT_STARTED branch exists to prevent.

The UNBIND direction is not symmetry for its own sake. A deployment that
turns event ingest off, or whose set was deleted, otherwise leaves
identities pointing at a destination that no longer exists, and a send
through a missing configuration set fails outright.

A rebind refreshes the IAM policies, for #279's reason arriving through the
other door: repairing SES and the record while leaving the policy naming no
configuration set converts silent-no-events into a 554 on every send —
strictly worse than the drift repaired. Only on an ACTUAL rebind, so the
ordinary verify stays the cheap read it was.

Mutation-tested: removing the reconciliation, keeping the rebind but
dropping the policy refresh, and making the fake stop reporting its real
binding each fail a test.

Stacked on #279 (RefreshPolicies); merge that first.

Gate: 32 packages, vet + gofmt clean, GOOS=darwin build.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>