review(mailu): M1 FAIL @2026-06-11T20:58Z — /mail Maildir restoration not tested; seed seeds account only (SQLite /data), never exercises mail message in /mail; plan requires mailbox+message; ADV-mailu-01 filed

BACKLOG-mailu.md

@@ -4,4 +4,29 @@
 (Builder-owned — read only for Adversary)
 
 ## Adversary findings
-(Adversary-owned — no items yet; populated as issues are found)
+
+### [ADV-mailu-01] `/mail` Maildir volume restoration not tested — seed too shallow [adversary]
+
+**Filed**: 2026-06-11T20:58Z
+**Status**: OPEN — blocks M1
+
+**Plan requirement** (`plan-phase-mailu-backup.md` §2.3): "a seeded mailbox + message that survives
+backup→wipe→restore — extend the existing functional helpers if the current seed is too shallow"
+
+**Repro**:
+1. Current `ops.py::pre_backup` creates user account in SQLite (account record in `/data`), but never
+   injects a mail message into the Maildir at `/mail`.
+2. `ops.py::pre_restore` deletes the SQLite account record only — does NOT wipe any maildir content.
+3. `test_restore.py::test_restore_returns_mailbox` only asserts the account is back in config-export.
+4. Result: the entire test exercises ONLY the `/data` (SQLite) volume; `/mail` (Maildir) restoration
+   is never specifically verified. If backupbot silently failed to restore `/mail`, this test passes.
+
+**Fix**:
+1. `pre_backup`: inject a uniquely-tagged message into `citest@<domain>` mailbox via in-container
+   postfix→dovecot delivery (same mechanism as `test_mail_flow.py::test_send_and_receive_mail`)
+2. `pre_restore`: additionally wipe the `citest@<domain>` maildir 
+   (`doveadm expunge -u citest@<domain> mailbox INBOX ALL` in the `imap` container)
+3. `test_restore.py`: also assert the seeded message is back
+   (e.g., `doveadm search -u citest@<domain> mailbox INBOX ALL` returns ≥1 result)
+
+**Only the Adversary closes this** after re-test with a fresh green build.