Platform email: short, unique mail alias per project on the shared sender domain, independent of the project slug #511

Use case

We run a self-hosted Void platform serving several brands. Our apps put a signed token in the sub-address so that a reply can be matched to its conversation without storing state, in the shape <slug>+reply+<token>@<mail domain>, with a 50-character token (c|t + 26 + . + 22). The shared domain ties the whole mailbox name to the project slug, and that collides with the RFC 5321 limit on the local part.

Problem

On the shared domain, the project slug is also the mailbox name:

• Sender admission requires the part of the From local part before the first + to equal the project slug (admission.ts L388-L391).
• The inbound router splits the recipient on the first + and requires that prefix to equal the authoritative route's slug (proxy/src/email-router.ts L244-L270).
• The runtime then strips <slug>+ from message.to (runtime/email/inbound.ts L200-L216); the slug is injected in router/compile.ts L1205-L1211.

The local part is limited to 64 octets (RFC 5321 section 4.5.3.1.1). With the shape above, the fixed part is +reply+ (7) plus the 50-character token, which is 57 octets. That leaves at most 7 characters for the slug. Descriptive slugs such as brand-feedback cannot be used for mail on the shared domain. The only choices are a shorter token, which weakens the scheme, or a different project name.

Slugs cannot be renamed, so a different name means recreating the project, which changes its URL and loses its deployments.

Proposal

An optional email_alias per project:

• Short, lowercase and unique across the installation, validated with the slug rules and against EMAIL_RESERVED_SLUGS (reserved-slugs.ts L28-L34) so no project can claim a platform address. It should also be rejected when it equals another project's slug.
• When set, admission and the router accept <alias>+... in place of <slug>+.... null keeps today's behaviour exactly.
• The runtime strips the same prefix: stripSlugFromAddress and __VOID_PROJECT_SLUG would carry the alias when one is set.
• Settable by an administrator or by the project owner (your call). The shared-recipient service creates one exact Cloudflare routing rule per receiving project, so changing the alias needs a reconcile of that rule.

I would expect to touch admission.ts, email-router.ts, the shared recipient service, the projects schema plus an additive migration, and the compile step above, with tests in the email-admission and email-shared-recipients integration suites. Happy to send a PR if you prefer this direction.

Questions for maintainers

1. Do you prefer an alias field like this, or another approach, for example a shorter token format in apps, or sub-address handling that does not count the slug against the limit?
2. Should the alias be permanent once mail has been sent from it, or freely changeable? Reply tokens already in flight would break on a change.
3. Should the old slug keep working as a secondary address while an alias is active?

Related: #509, #510