Stop a clean migration reporting domains it never lost

The post-migration comparison had the two versions counting domains
differently, and yesterday's wiring turned that into a gate: `run` would have
failed a migration that lost nothing.

The 0.15 side added every domain appearing in any account's address on top of
the domain principals - the fallback's own comment says "if the instance has
no explicit domain principals", but the loop ran unconditionally. The 0.16
side did the reverse, listing only domains some account calls its primary,
discarding the full Domain list it had already fetched. An instance with
three declared domains and accounts aliased across nine reported nine before
and three after. INBUXA is exactly that shape, and this was the account/domain
over-count noted as undiagnosed.

Both sides now mean "the domains this server holds". A domain that still goes
missing is reported as a warning rather than failing the run: what the two
versions call a domain differs across this boundary in ways we have now been
caught by once, and a missing account - which is compared with a local-part
fallback and is what actually matters - still fails.

Narrowing OK() also made String() return before printing the domain lines,
so the new warning would have been silent. Caught by its own test.

internal/validate/live_test.go

@@ -101,7 +101,40 @@ func TestRunLiveFailsWhenAnAccountIsMissing(t *testing.T) {
 	}
 }
 
-func TestRunLiveFailsWhenADomainIsMissing(t *testing.T) {
+func TestRunLiveWarnsButDoesNotBlockWhenADomainIsMissing(t *testing.T) {
+	// What the two versions call a domain differs across the 0.15/0.16
+	// boundary - principals on one side, Domain objects on the other, with
+	// aliases counted differently - and INBUXA's own before-list was
+	// inflated with alias domains that the after-list structurally cannot
+	// contain. Failing the migration on that would abort a run that lost
+	// nothing, so it is reported and not treated as data loss.
+	srv := fakeInstance(t, []string{"example.org"}, map[string]float64{"[email protected]": 10})
+	defer srv.Close()
+
+	store, rs := newRun(t)
+	report, err := RunLive(context.Background(), store, rs, LiveOptions{
+		AdminURL: srv.URL, AdminUser: "admin", AdminPassword: "pw", HTTPClient: srv.Client(),
+		Before: &checkpoint.PreflightSnapshot{
+			Domains:   []string{"example.org", "alias.example"},
+			UsedQuota: map[string]int64{"[email protected]": 1},
+		},
+	})
+	if err != nil {
+		t.Fatalf("RunLive: %v", err)
+	}
+	if report.Blocking() {
+		t.Fatalf("a domain-only difference must not abort the migration, got: %s", report.String())
+	}
+	if got := report.Results[0].Status; got != StatusWarn {
+		t.Fatalf("status = %q, want %q", got, StatusWarn)
+	}
+	if !strings.Contains(report.Results[0].Detail, "alias.example") {
+		t.Fatalf("the operator still needs to be told which domain, got %q", report.Results[0].Detail)
+	}
+}
+
+func TestRunLiveStillBlocksWhenAnAccountAndADomainAreMissing(t *testing.T) {
+	// A lost account is a lost account, whatever the domain list says.
 	srv := fakeInstance(t, []string{"example.org"}, map[string]float64{"[email protected]": 10})
 	defer srv.Close()
 
@@ -109,15 +142,12 @@ func TestRunLiveFailsWhenADomainIsMissing(t *testing.T) {
 	report, _ := RunLive(context.Background(), store, rs, LiveOptions{
 		AdminURL: srv.URL, AdminUser: "admin", AdminPassword: "pw", HTTPClient: srv.Client(),
 		Before: &checkpoint.PreflightSnapshot{
-			Domains:   []string{"example.org", "vanished.example"},
-			UsedQuota: map[string]int64{"[email protected]": 1},
+			Domains:   []string{"example.org", "alias.example"},
+			UsedQuota: map[string]int64{"[email protected]": 1, "[email protected]": 2},
 		},
 	})
 	if !report.Blocking() {
-		t.Fatalf("a missing domain must block, got: %s", report.String())
-	}
-	if !strings.Contains(report.Results[0].Detail, "vanished.example") {
-		t.Fatalf("the report should name the missing domain, got %q", report.Results[0].Detail)
+		t.Fatalf("a missing account must still block, got: %s", report.String())
 	}
 }