Mailbox identity, plan, and receipt boundary

A human alias resolves to one immutable account and live provider identity; all reversible mutation evidence remains bound to that identity from preview through rollback.