Test MAS addresses against real Postfix; close MAS-WP-0002, add MAS-WP-0003

- experiments/postfix-probe: Postfix 3.7 -> pipe -> mas-gateway -> ticket
  service in Docker; 14 address forms x 5 configurations. 13/14 arrive
  byte-identical everywhere; quoted "ticket=PR42" is unquoted in transit.
  Legacy bang/percent rewrites never fire for MAS addresses.
- docs/experiment-review.md: Email infrastructure section with results
- MAS-WP-0003: provider-side live test on a real subdomain (needs DNS/MX)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 623586@bnt-lap001
Assistant-Session: 10b30928-5b3b-4c11-9934-5ecca07367d8

workplans/MAS-WP-0002-reference-experiment.md

@@ -4,7 +4,7 @@ type: workplan
 title: "MAS v0.1 reference experiment"
 domain: communication
 repo: mail-address-semantics
-status: active
+status: done
 owner: claude
 topic_slug: coulomb-social
 created: "2026-10-08"
@@ -812,11 +812,11 @@ The service must handle this deliberately and without generating abusive backsca
 
 ## Milestone 9 — Experiment review
 
-> First-pass findings: `docs/experiment-review.md`. Open item: live MTA/provider test (Email infrastructure question).
+> Findings: `docs/experiment-review.md`. MTA half tested against real Postfix (`experiments/postfix-probe/`); provider half continues in MAS-WP-0003.
 
 ```task
 id: MAS-WP-0002-T10
-status: in_progress
+status: done
 priority: medium
 state_hub_task_id: "31bbfb56-5541-5ace-aff7-94ed6f1df57a"
 ```

workplans/MAS-WP-0003-provider-live-test.md

@@ -0,0 +1,94 @@
+---
+id: MAS-WP-0003
+type: workplan
+title: "MAS live provider test on a real subdomain"
+domain: communication
+repo: mail-address-semantics
+status: ready
+owner: claude
+topic_slug: coulomb-social
+created: "2026-10-08"
+updated: "2026-10-08"
+---
+
+# MAS live provider test on a real subdomain
+
+Follow-up to MAS-WP-0002. The MTA half of the review question *which
+characters or address forms were rewritten or rejected?* was answered
+against a real Postfix (`experiments/postfix-probe/`,
+`docs/experiment-review.md`). This workplan answers the provider half. It
+has to be done before the MAS-WP-0002 decision gate.
+
+coulomb.social mail is hosted by IONOS, so the test needs its own
+subdomain (for example `mas.coulomb.social`) with its own MX.
+
+## Choose and provision the test subdomain
+
+```task
+id: MAS-WP-0003-T01
+status: wait
+priority: high
+```
+
+Needs the operator. Pick the subdomain. Add an MX (and A) record at IONOS
+pointing to railiance01 (92.205.62.239). Allow inbound TCP 25 on
+railiance01. Record the choice as a decision.
+
+## Deploy Postfix + gateway + ticket service + statute
+
+```task
+id: MAS-WP-0003-T02
+status: todo
+priority: high
+```
+
+Deploy the probe configuration on railiance01, using `local-domain-safe`
+settings, TLS and the usual relay restrictions. Serve the statute (with
+the namespace set to the subdomain) at `https://<sub>/.well-known/mas`
+through Traefik. Verify the deployment with `mas discover <sub>`.
+Outbound replies need a relay with SPF/DKIM for the subdomain; until that
+exists, keep replies in the outbox only.
+
+## Provider send matrix
+
+```task
+id: MAS-WP-0003-T03
+status: todo
+priority: high
+```
+
+Needs the operator to send from their accounts. Send from Gmail (web and
+mobile), Outlook.com and one corporate gateway to:
+- `ticket!callback@`
+- `ticket=ID@`
+- `ticket=ID+comments@`
+- `ticket=RE=2026-4711@`
+
+Then reply to a service message sent from `ticket=ID@`. For each
+combination, record whether the provider's compose form accepts the
+address and what envelope recipient arrives.
+
+## Forwarding and list paths
+
+```task
+id: MAS-WP-0003-T04
+status: todo
+priority: medium
+```
+
+Send via one forwarding service (SRS) and one mailing list (VERP). Check
+whether `=` collides with SRS0/VERP encoding, and whether facets survive
+or are stripped.
+
+## Close the review
+
+```task
+id: MAS-WP-0003-T05
+status: todo
+priority: high
+```
+
+Fold the results into `docs/experiment-review.md`. Turn the spec gaps
+(quoted equivalence, resource-type case, type-intake semantics for
+`ticket!MODE`) into spec change proposals. Then take the MAS-WP-0002
+decision gate.