feat(2): Q4.9 mailu — recipe_meta + health + 3 functional (create-mailbox/imap-login/mail-flow); P4 N/A deferred

mailu (full email stack). TLS_FLAVOR=notls avoids certdumper/ACME dep (cc-ci file-provider cert);
MAIL_DOMAIN/HOSTNAMES=run domain; TRAEFIK_STACK_NAME for the letsencrypt-volume mount. P2 vacuous (no
corpus). P3: test_mailbox (flask mailu user create + config-export read-back), test_imap_login
(mailbox authenticates over dovecot IMAP:143), test_mail_flow (SMTP submission send → IMAP retrieve,
auth to avoid greylisting). P4 N/A (no backupbot label) — DEFERRED.md + PARITY.md, Adversary §7.1
sign-off pending. Smoke-validated: 8 services converge, mail ports 25/587/143/993 host-open, flask CLI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

machine-docs/DEFERRED.md

@@ -276,3 +276,17 @@ before the build is called done) — but does **not** force closure.
 - **Re-entry trigger:** upstream discourse recipe ships a deployable image version; OR operator
       approves a cc-ci-authored discourse recipe-PR + release.
 - **Linked IDEA / BACKLOG:** Q4.6.
+
+### 2026-05-29 — mailu: no backup config (P4 N/A) — recipe-PR to add backupbot
+- [ ] **What:** mailu (Q4.9) ships **no `backupbot.backup` label** on any service, so cc-ci's
+      backup/restore tiers cleanly SKIP (`backup_capable=False`) — P4 (backup data-integrity) is N/A
+      for mailu as published (no backup mechanism to exercise). Durable fix = a recipe-PR adding
+      backupbot labels (admin sqlite DB at /data + the `mailu` mail volume), mirroring the immich Q3.5
+      / Q3.2b pattern.
+- **Filed by:** Builder, phase 2 (Q4.9 mailu enrollment).
+- **Reason for deferral:** UPSTREAM recipe has no backup config; adding it is a recipe change
+      (operator-merge-gated via recipe-create-pr), not a cc-ci/test change. mailu install+upgrade+
+      functional (create-mailbox + IMAP-login + send/receive mail-flow) are covered.
+- **Re-entry trigger:** Adversary §7.1 sign-off accepting P4-N/A for mailu, OR operator approves a
+      cc-ci-authored mailu backupbot recipe-PR.
+- **Linked IDEA / BACKLOG:** Q4.9.