@uuaid/pillar 2.3.0 → 2.4.1

package/HOSTING-LIMITS.md

@@ -29,42 +29,45 @@ envelope to every carrier, so each carrier counts all of your sends.
 
 | Limit | Value | Source | When you hit it | What to do |
 |---|---|---|---|---|
-| Long-poll `wait` | 30 s. A larger value is cut to 30 without an error | :63 | 200 with `envelopes: []` after 30 s | Ask for 25 (§3) |
-| Re-check while waiting | every 400 ms | :426 | n/a | Mail reaches a waiting poll about 0.4 s after it is stored, whatever `wait` is |
-| Rows per reply | 200, oldest first | :418 | 200 with 200 rows | Poll again at once, `since` = highest `seq` |
-| Open long-polls (`wait` > 0) | 48 for community; 64 in all, so 16 are kept for priority grants | :82, :74 | 503 `busy` | Wait at least 2 s, with jitter, and retry, or use `wait=0` for a while |
-| `x-pillar-ts` clock skew | ±5 min | :66 | 401 `clock-skew` | Fix your clock (NTP). Retrying does not help |
-| `x-pillar-delegation` size | 8,192 bytes | :67 | 401 `delegation-too-large` | Send a smaller delegation document |
-
-**Authentication** (:330-361). Send `x-pillar-pubkey`, `x-pillar-ts` (Unix ms)
+| Long-poll `wait` | 30 s. A larger value is cut to 30 without an error | :77 | 200 with `envelopes: []` after 30 s | Ask for 25 (§3) |
+| Re-check while waiting | every 400 ms | :672 | n/a | Mail reaches a waiting poll about 0.4 s after it is stored, whatever `wait` is |
+| Rows per reply | 200, oldest first | :664 | 200 with 200 rows | Poll again at once, `since` = highest `seq` |
+| Open long-polls (`wait` > 0) | 48 for community; 64 in all, so 16 are kept for priority grants | :96, :100 | 503 `busy` | Wait at least 2 s, with jitter, and retry, or use `wait=0` for a while |
+| `x-pillar-ts` clock skew | ±5 min | :80 | 401 `clock-skew` | Fix your clock (NTP). Retrying does not help |
+| `x-pillar-delegation` size | 8,192 bytes | :81 | 401 `delegation-too-large` | Send a smaller delegation document |
+
+**Authentication** (:578-607). Send `x-pillar-pubkey`, `x-pillar-ts` (Unix ms)
 and `x-pillar-sig`, which is Ed25519 over
 `GET /v1/inbox/<uuaid>?since=<seq>` + `"\n"` + ts. `wait` is not signed. The
 uuaid must be derived from the key. To read another identity's inbox, also
 send `x-pillar-delegation`: a delegation document signed by that identity that
-names your key and covers `inbox` or `*` (:376-392). Every auth failure is a
+names your key and covers `inbox` or `*` (:622-638). Every auth failure is a
 401 with the reason in `error`. Reads have no rate limit. Only the open
 long-polls above are capped, and `wait=0` reads are not capped at all.
 
 ### Sending: `POST /v1/envelopes`
 
-The carrier runs these checks in order (:267-313). Each budget is spent when
+The carrier runs these checks in order (:486-576). Each budget is spent when
 its check passes. So a send refused later for being stale or for a full store
 has still used budget, and so has a duplicate.
 
 | Check | Value | Source | When you hit it | What to do |
 |---|---|---|---|---|
-| Raw body read | 2 MiB + 8 KiB | :65 | Connection dropped, no JSON body | Stay under your tier's body limit |
-| Envelope signature and shape | n/a | :268-274 | 400 with the reason (403 `delegation-invalid:*`) | Fix the envelope |
-| Refused sends per client IP | 60 per window | :73 | 429 `rate-limited`, which hides the real reason | Stop and fix the sender |
-| Body size | 512 KiB community; a tier grant can raise it (table below) | :64 | 413 `body-too-large` + `maxBodyBytes`, `tier` | Send the payload as a blob (§3) |
-| Sends per sender uuaid | 120 per window for community | :71 | 429 `rate-limited` | Back off (§3) |
-| Accepted sends per client IP | 300 per window; priority grants use their own bucket of 600 | :72, :83 | 429 `rate-limited` | Everyone behind your NAT shares this budget |
-| Envelope `createdAt` | within ±24 h of carrier time | :69 | 400 `stale-envelope` | Seal a new envelope. Never retry an old one |
-| Store size | 256 MiB. Community sends are refused above 85% (217.6 MiB) | :75, :81 | 503 `carrier-full` | Your other carriers still take it. Don't retry this one soon |
+| Raw body read | 2 MiB + 8 KiB | :79 | Connection dropped, no JSON body | Stay under your tier's body limit |
+| Envelope signature and shape | n/a | :487-497 | 400 with the reason (403 `delegation-invalid:*`) | Fix the envelope |
+| Refused sends per client IP | 60 per window | :87 | 429 `rate-limited`, which hides the real reason | Stop and fix the sender |
+| Body size | 512 KiB community; a tier grant can raise it (table below) | :78 | 413 `body-too-large` + `maxBodyBytes`, `tier` | Send the payload as a blob (§3) |
+| Sends per sender uuaid | 120 per window for community | :85 | 429 `rate-limited` | Back off (§3) |
+| Accepted sends per client IP | 300 per window; priority grants use their own bucket of 600 | :86, :112 | 429 `rate-limited` | Everyone behind your NAT shares this budget |
+| Envelope `createdAt` | within ±24 h of carrier time | :83 | 400 `stale-envelope` | Seal a new envelope. Never retry an old one |
+| Store size | 256 MiB. Community sends are refused above 85% (217.6 MiB) | :89, :95 | 503 `carrier-full` | Your other carriers still take it. Don't retry this one soon |
 
 Sending the same envelope id again is safe. It returns 202 with
-`duplicate: true` (:322-324). On a carrier with a receipt key (below), the
-same id with a different body is refused 409 `envelope-id-conflict`.
+`duplicate: true` and the `seq` it was stored at (:565, :572). The carrier keys
+envelopes on sender and id together (from 2.4.0), so another sender's envelope
+under the same id is a different envelope and is stored. On a carrier with a
+receipt key (below), the same id from the same sender with a different body is
+refused 409 `envelope-id-conflict` (:570).
 
 **Carrier receipts (from 2.1.0).** Start the carrier with
 `--receipt-keychain <file>` (`CARRIER_RECEIPT_KEYCHAIN`; passphrase in
@@ -74,9 +77,9 @@ acceptance receipt signed from the stored row (src/net/carrier-receipt.mjs).
 The carrier never mints this key: a missing or unreadable file refuses to
 start. Without the option nothing changes.
 
-**Windows, memory, retention.** Every rate window is a sliding 60 s (:70),
-held in process memory (:114), so a restart resets every budget; past 10,000
-keys the oldest is dropped (:76). Envelopes are kept 14 days by default (:86;
+**Windows, memory, retention.** Every rate window is a sliding 60 s (:84),
+held in process memory (:230), so a restart resets every budget; past 10,000
+keys the oldest is dropped (:90). Envelopes are kept 14 days by default (:156;
 `--ttl`, bin/carrier.mjs:32, bin/pillar-seed.mjs:66) and expired rows are
 deleted hourly (bin/carrier.mjs:46-49, bin/pillar-seed.mjs:171-174). Each row
 keeps the deadline set when it was stored (`retain_until` = acceptance time +
@@ -161,7 +164,7 @@ extra carriers.
   `<ns>` is one of the self-certifying namespaces `foundation`, `pillar` or
   `agentnet` (`SELF_CERTIFYING_NAMESPACES`, src/identity/keychain.mjs). Every
   identity `pillar init` mints is one (`--namespace pillar|agentnet|foundation`;
-  the default is `foundation` in 2.2.0 and `pillar` from 2.2.1), and it is the rule
+  the default is `foundation` through 2.3.0 and `pillar` from 2.4.0), and it is the rule
   every envelope is accepted on. A device, a service, a registry
   namespace (`zilligon`, `iaaso`, …), or the same local id under any other
   prefix is not self-certified and needs a registry badge naming its key. A self-certified identity signs broker requests with keyId
@@ -300,7 +303,7 @@ front of each one.
 | Proxy rule | Why | pillar-sfo (live) and repo template |
 |---|---|---|
 | Carrier read timeout > 30 s + margin | The carrier can hold a request for 30 s plus one 400 ms tick | `/v1/` → 127.0.0.1:8799, 40 s; template: infra/pillar-carrier-fleet/provision-carrier.sh:102 |
-| Replace `X-Forwarded-For` with the peer's address | The carrier takes the first XFF entry as the client IP (:208-212). If the proxy appends to XFF, a client can pick its own rate bucket. If the proxy sends no XFF, all clients share the proxy's one bucket | template: `$remote_addr` (infra/pillar-carrier-fleet/provision-carrier.sh:107) |
+| Replace `X-Forwarded-For` with the peer's address | The carrier takes the first XFF entry as the client IP (:395-399). If the proxy appends to XFF, a client can pick its own rate bucket. If the proxy sends no XFF, all clients share the proxy's one bucket | template: `$remote_addr` (infra/pillar-carrier-fleet/provision-carrier.sh:107) |
 | Body size ≥ largest honored body + 8 KiB | 512 KiB on a seed; 2 MiB + 8 KiB with `--tier-issuers`. Below that, clients get the proxy's own 413 page, not JSON | the template sets no size on `/v1/`, so the proxy's default applies. Set it explicitly |
 | CORS: allow `x-pillar-pubkey`, `x-pillar-ts`, `x-pillar-sig` | Browser clients send them. Also allow `x-pillar-delegation` and `x-pillar-tier-grant` if browsers poll by delegation or send grants | the template allows neither of those two (infra/pillar-carrier-nyc/nginx-setup.sh:25) |
 | Relay: a short timeout is fine | No relay route long-polls | `/push/` → 127.0.0.1:8801/, 30 s |
@@ -308,13 +311,40 @@ front of each one.
 
 **Under load:**
 - **`carrier-full` does not clear by itself.** `vacuum()` deletes expired rows
-  (:239-243) but never runs SQLite `VACUUM`. The size check reads `page_count`
-  (:308-311), which still counts freed pages. In a local test with the same
+  (:436-441) but never runs SQLite `VACUUM`. The size check reads `page_count`
+  (:527-530), which still counts freed pages. In a local test with the same
   schema, deleting all 300 rows of a 30,904,320-byte store left
   `page_count × page_size` at 30,904,320 bytes, with 7,540 pages free. So once
   the file passes 217.6 MiB, community sends get 503 until you stop the
   carrier, run `sqlite3 <db> 'VACUUM;'`, and restart it. On a `pillar-seed`
   every sender is community, so that means everyone. Watch the file size.
+- **From 2.4.0 a start may run `VACUUM`.** Re-keying the envelopes table (see
+  RELEASE-NOTES-2.4.0.md) copies it and frees the old copy, which would double
+  the counted size. The carrier reclaims those pages right after the re-key,
+  then truncates the WAL (:212-224). It also vacuums on any later start that
+  finds more than a quarter of the file's pages free. That retries a first
+  start that was killed or whose `VACUUM` failed. It also catches a store
+  thinned that much by TTL expiry, where the cap was counting the free pages.
+  At a quarter free or less, a start does not vacuum. If a `VACUUM` fails, the
+  carrier logs `VACUUM failed` with the free page count and keeps running; the
+  next start tries again, or stop it and run `sqlite3 <db> 'VACUUM;'`. A
+  `VACUUM` runs before the carrier listens, so the start waits for it and
+  connections are refused meanwhile (a 122 MiB store thinned by 30% took
+  0.44 s in a local test; carrier disks are not measured). Stop every other
+  process that has the store open (a second carrier, a `sqlite3` shell) before
+  restarting: one holding a read transaction makes the WAL truncation wait out
+  SQLite's 5 s busy timeout, and the carrier then logs that the WAL was not
+  truncated. At peak, under the default secure delete, the re-key used about
+  five times the table on disk in a 119 MiB test: the database, a WAL as large
+  as it (secure delete zeroes the dropped table through the WAL), and the
+  backup. About 1.1 times of that is SQLite's temporary file, in
+  `SQLITE_TMPDIR` or `TMPDIR`, which may be another filesystem: leave room in
+  both before the first 2.4.0 start.
+- **Re-key backups under secure delete.** A start removes
+  `<db>.pre-sender-unique-<ms>-<pid>.bak` files that no running re-key is
+  still writing: its process is gone; or it is over an hour old; or it carries
+  the carrier's own pid but predates this start (a container restart reuses
+  the pid, often 1). After the first 2.4.0 start, check that none remains.
 - Sends get 429 and 503 as in §1; new long-polls get 503 `busy` once 48
   community (64 in all) are open.
 - Nothing limits `wait=0` reads, `/v1/health` or `/v1/seed-info`. Rate-limit
@@ -350,7 +380,7 @@ carrier's code is the `reason` of a refused send or the `error` of a refused
 inbox read; the broker's is its `code`. `pillar` and `pillar-blob` print a
 refusal as one line, `<code>: <fix>`: the server's `fix` when it sends one,
 printed as received (only line breaks and control characters become spaces),
-else the client's map (src/net/refusals.mjs:24-73, exported as
+else the client's map (src/net/refusals.mjs:24-76, exported as
 `@uuaid/pillar/refusals`). A carrier older than 0.2.0-alpha.18 sends no
 `fix`; the client fills it in. On a thrown error, `err.code` and `err.fix`
 carry the same pair. Every fix, the client's and both servers', is a fixed

package/INTERACTION-CONVENTION.md

@@ -57,7 +57,10 @@ and put the real verb inside the sealed payload.
 1. Thread root = the first `request`'s envelope id (known to recipient from
    the envelope itself; the request payload needs no thread field).
 2. Every `request` and `reply` SHOULD be acked within 30s. Absence of an
-   ack = retry (idempotent — carrier dedups on envelope id), not failure.
+   ack = retry, not failure. Resend the SAME envelope: the carrier dedups on
+   sender + envelope id. A new attempt that re-seals takes a new id: a carrier
+   with a receipt key refuses a re-sealed envelope under the same id (409
+   `envelope-id-conflict`), and one without keeps the first.
 3. Multi-turn: same `thread` for the whole conversation, `inReplyTo` =
    the latest envelope id each time.
 4. Errors ride the normal channel: `kind: "reply", status: "error",

package/README.md

@@ -56,8 +56,8 @@ vars and a JSON summary on stdin, and only fires when there is mail.
 
 ### Several readers on one home: `--reader`
 
-Carrier reads are non-destructive and the mailbox is idempotent on envelope
-id, so it never matters which process PULLS a message. It used to matter who
+Carrier reads are non-destructive and the mailbox is idempotent on sender +
+envelope id, so it never matters which process PULLS a message. It used to matter who
 SAW it: `pillar inbox` lists as new only what that run pulled, so when two
 readers shared a home, whichever ran first was the only one that saw the mail
 (and with `--mark-read`, the other never saw it at all).
@@ -258,7 +258,7 @@ header (`x-pillar-tier-grant`), not the envelope.
 
 On send, `deliver()` replicates the envelope to **every** carrier in your set
 in parallel — any one accepting it is success. On receive, you poll **all** of
-them; duplicates across seeds are deduped by envelope id, so handlers fire
+them; duplicates across seeds are deduped by sender + envelope id, so handlers fire
 exactly once. Kill any single seed and delivery continues through the
 survivors.
 

package/bin/pillar.mjs

@@ -3,7 +3,7 @@
  * pillar — one-command CLI.
  *
  *   pillar init  [--home ~/.pillar] [--namespace pillar|agentnet|foundation]
- *                                                first-time setup: mint UUAID + keys (default namespace: foundation in 2.2.0)
+ *                                                first-time setup: mint UUAID + keys (default namespace: pillar since 2.4.0)
  *   pillar init --refresh [--directory URL]      re-sync carriers + address book (keychain untouched)
  *   pillar init --force --confirm <current uuaid> REPLACE the identity (new UUAID); the old one is archived
  *   pillar id    [--home ~/.pillar]              print our UUAID + PeerId + addrs
@@ -42,7 +42,7 @@ import { parseLinkOffer, isLinkOfferLive, LINK_GRANT_KINDS } from "../src/net/li
 import { mintDelegationDoc } from "../src/net/delegation.mjs";
 import { refusalLine } from "../src/net/refusals.mjs";
 import {
-  readerKey, processContext, otherLiveLeases, describeProcess, describeReader, initialCursor, handleInOrder,
+  readerKey, processContext, otherLiveLeases, processesWithMailboxOpen, describeProcess, describeReader, initialCursor, handleInOrder,
   LEASE_TTL_MS, LEASE_HEARTBEAT_MS,
 } from "../src/readers.mjs";
 import { extractGroupTag, findGroup, normalizeMembers } from "../src/groups.mjs";
@@ -382,6 +382,17 @@ async function confirmAndArchiveIdentity(home, old, args) {
   const { Mailbox } = await import("../src/mailbox/mailbox.mjs");
   const mbPath = join(home, "mailbox.db");
   if (existsSync(mbPath)) {
+    // Two checks, each catching what the other cannot:
+    //   1. Lease scan (otherLiveLeases): a recv daemon that has started and is
+    //      heartbeating. Catches remote hosts and processes that opened the DB
+    //      but have since closed it.
+    //   2. File-open scan (processesWithMailboxOpen via lsof): any process with
+    //      an open fd on mailbox.db right now — a pre-lease daemon (idle, DB
+    //      open, no lease yet) or a one-shot `pillar inbox` run.
+    //    The exclusive-lock probe (BEGIN EXCLUSIVE with busy_timeout=0) was
+    //    rejected: WAL mode lets concurrent readers proceed, so an idle daemon
+    //    holding the DB open but not writing would NOT block the probe, giving
+    //    a false pass.
     const mb = new Mailbox(mbPath);
     const live = otherLiveLeases(mb);
     mb.close();
@@ -389,6 +400,11 @@ async function confirmAndArchiveIdentity(home, old, args) {
       console.error(`refusing to replace the identity while ${live.map(describeProcess).join("; ")} is reading this home — stop it first`);
       exit(1);
     }
+    const holders = processesWithMailboxOpen(mbPath);
+    if (holders.length) {
+      console.error(`refusing to replace the identity while ${holders.map((p) => `${p.command} (pid ${p.pid})`).join("; ")} has this home's mailbox open — stop it first`);
+      exit(1);
+    }
   }
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
   const dir = join(home, "rotated", `${stamp}-${(current.split(":")[3] ?? "unknown").slice(0, 8)}`);
@@ -973,7 +989,7 @@ async function cmdRecv(args) {
           const { env, payload } = viewOfRow(p, row, decrypt);
           await handle({ ...env, payload });
         }, {
-          advance: (row) => p.mailbox.setReaderCursor(rk.key, row.seq),
+          advance: (row) => p.mailbox.setReaderCursor(rk.key, row.released_seq ?? row.seq),
           onError: (row, e) => console.error(`reader ${rk.key}: row ${row.seq} not handled, not retried: ${e.message}`),
         });
       } finally { busy = false; }
@@ -1038,7 +1054,7 @@ async function cmdInbox(args) {
       console.log(JSON.stringify(inboxLine(env, payload, { new: true })));
       printed.push({ id: env.id, sender: env.sender, kind: env.kind, payload, groupId });
     }
-    if (rows.length && !args.peek) p.mailbox.setReaderCursor(rk.key, rows.at(-1).seq);
+    if (rows.length && !args.peek) p.mailbox.setReaderCursor(rk.key, rows.at(-1).released_seq ?? rows.at(-1).seq);
     const qCount = (p.mailbox.inboxQuarantined?.(500) ?? []).length;
     console.log(`inbox: ${rows.length} new for reader "${rk.key}" (${pulled} pulled from carriers by this run)${args.peek ? ", cursor not moved (--peek)" : ""}${qCount ? `, ${qCount} quarantined (pillar trust quarantine)` : ""}`);
   } else {
@@ -1051,8 +1067,10 @@ async function cmdInbox(args) {
       printed.push({ id: env.id, sender: env.sender, kind: env.kind, payload: env.payload, groupId: extractGroupTag(env.payload)?.id ?? null });
     }
     // Backlog: rows stored earlier (e.g. by a recv daemon) but never surfaced.
-    const freshIds = new Set(fresh.map(e => e.id));
-    backlog = (p.mailbox.inboxUnread?.(500) ?? []).filter(r => !freshIds.has(r.envelope_id));
+    // Keyed on (sender, id): an id is unique only within its sender.
+    const freshKeys = new Set(fresh.map(e => `${e.sender}\n${e.id}`));
+    const isFresh = (r) => freshKeys.has(`${r.sender}\n${r.envelope_id}`);
+    backlog = (p.mailbox.inboxUnread?.(500) ?? []).filter(r => !isFresh(r));
     if (args.unread) {
       for (const row of backlog) {
         const { env, payload, groupId } = viewOfRow(p, row, decrypt);
@@ -1067,7 +1085,7 @@ async function cmdInbox(args) {
     // other reader already marked read are missing.
     if (prev) {
       const taken = p.mailbox.inboxAfter(prev.cursor, 1000)
-        .filter((r) => !freshIds.has(r.envelope_id) && r.pulled_by !== rk.key && (!args.unread || r.read_at));
+        .filter((r) => !isFresh(r) && r.pulled_by !== rk.key && (!args.unread || r.read_at));
       if (taken.length) {
         const by = new Map();
         for (const r of taken) by.set(r.pulled_by ?? null, (by.get(r.pulled_by ?? null) ?? 0) + 1);
@@ -1086,7 +1104,7 @@ async function cmdInbox(args) {
     console.log(`inbox: ${fresh.length} new, ${backlog.length} older unread${args.unread ? "" : " (--unread to print)"}${qCount ? `, ${qCount} quarantined (pillar trust quarantine)` : ""}`);
   }
   if (args["mark-read"]) {
-    for (const v of printed) p.mailbox.markInboxRead?.(v.id);
+    for (const v of printed) p.mailbox.markInboxRead?.(v.id, v.sender);
     const r = await p.sendReadReceipts(printed);
     if (r.sent || r.dropped) console.error(`read receipts: ${r.sent} sent${r.dropped ? `, ${r.dropped} not sent (per-run cap)` : ""}`);
   }
@@ -1246,7 +1264,7 @@ async function cmdTrust(args) {
   // pillar trust set <open|directory|allowlist>
   // pillar trust allow|block <uuaid>      add to list (removes from the other)
   // pillar trust unlist <uuaid>           remove from both lists
-  // pillar trust quarantine [--release ID]  list quarantined mail / release one
+  // pillar trust quarantine [--release ID [--from UUAID]]  list quarantined mail / release one
   const home = homePath(args);
   const tPath = join(home, "trust.json");
   const t = loadTrustPolicy(home);
@@ -1292,8 +1310,22 @@ async function cmdTrust(args) {
     const { Mailbox } = await import("../src/mailbox/mailbox.mjs");
     const mb = new Mailbox(join(home, "mailbox.db"));
     if (args.release) {
-      mb.db.prepare("update inbox set quarantined = null where envelope_id = ?").run(args.release);
-      console.log(`released: ${args.release} (now visible to pillar inbox --unread)`);
+      // An id is unique only within its sender: with two quarantined senders
+      // under one id, --from picks which one to release.
+      const held = mb.db.prepare("select sender from inbox where envelope_id = ? and quarantined is not null").all(args.release);
+      const from = typeof args.from === "string" ? args.from : undefined;
+      if (!from && held.length > 1) {
+        console.error(`${held.length} senders have ${args.release} quarantined; release one with --from <uuaid>: ${held.map(r => r.sender).join(", ")}`);
+        mb.close();
+        exit(2);
+      }
+      const changed = mb.releaseQuarantined(args.release, from);
+      if (changed === 0) {
+        console.error(`no quarantined row with id ${args.release}${from ? ` from ${from}` : ""} — nothing released`);
+        mb.close();
+        exit(1);
+      }
+      console.log(`released: ${args.release}${from ? ` from ${from}` : ""} (now visible to every reader, including those whose cursor passed its seq)`);
       mb.close();
       return;
     }
@@ -1303,7 +1335,7 @@ async function cmdTrust(args) {
     mb.close();
     return;
   }
-  console.error("usage: pillar trust [set <policy>|allow <uuaid>|block <uuaid>|unlist <uuaid>|quarantine [--release ID]]");
+  console.error("usage: pillar trust [set <policy>|allow <uuaid>|block <uuaid>|unlist <uuaid>|quarantine [--release ID [--from UUAID]]]");
   exit(2);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uuaid/pillar",
-  "version": "2.3.0",
+  "version": "2.4.1",
   "description": "Pillar (Protocol for Inter-agent Linked Ledger And Relay) — the secure delivery layer of UACP, the Universal Agent Communication Protocol. UACP = UUAID (identity) + Envelope (signed, encrypted container) + Pillar (relay, mailbox, routing, store-and-forward). Reference implementation of the UACP delivery layer; includes VDA-1 (IAASO-3901, in ballot) delivery attestation and a blind escrow for the Zilligon ZGN / EVM rails.",
   "license": "Apache-2.0",
   "type": "module",
@@ -72,7 +72,7 @@
     "@libp2p/websockets": "^10.1.19",
     "@multiformats/multiaddr": "^13.0.3",
     "@noble/curves": "^2.3.0",
-    "better-sqlite3": "^12.11.1",
+    "better-sqlite3": "^13.0.3",
     "it-pipe": "^3.0.1",
     "it-pushable": "^3.2.4",
     "libp2p": "^3.3.8",

package/src/groups-v2.mjs

@@ -995,7 +995,7 @@ export class GroupReceiver {
       for (const h of due) {
         const r = this._judgeKnown(h.env, h.g, now, out);
         const x = r.reason ? { msgId: h.msgId, verdict: r.verdict, reason: r.reason } : { msgId: h.msgId, verdict: r.verdict };
-        if (h.env.ref !== undefined) x.ref = h.env.ref; // the caller's handle on the held message (pillar: the envelope id)
+        if (h.env.ref !== undefined) x.ref = h.env.ref; // the caller's handle on the held message (pillar: { id, sender } of its envelope)
         out.released.push(x);
       }
     }

package/src/identity/keychain.mjs

@@ -72,12 +72,14 @@ export const SELF_CERTIFYING_NAMESPACES = Object.freeze(["foundation", "pillar",
  * The namespace `pillar init` mints a NEW agent identity in when no --namespace is given.
  * Expand before contract (owner order 2026-10-24; Uuaid-Codex review K1): 2.2.0 makes every
  * verifier accept foundation, pillar and agentnet but still mints `foundation`, because a
- * `pillar:` identity cannot read its inbox on a pre-2.2.0 carrier. 2.2.1 flips this to
- * `pillar` once the carrier fleet, the main relay and the blob brokers run 2.2.x/1.2.0.
+ * `pillar:` identity cannot read its inbox on a pre-2.2.0 carrier. 2.4.0 flips this to
+ * `pillar` (the contract half; owner order "when i create a new uuaid . it will not be A
+ * foundation UUAID"), now that the carrier fleet, the main relay and the blob brokers run
+ * 2.2.x/1.2.0. 2.2.1 was never published: it would have moved `latest` below 2.3.0.
  * Existing keychains keep the UUAID they were saved with. `Keychain.generate`'s own default
  * stays `foundation` for library callers; CLI mint sites pass `mintNamespace(...)` instead.
  */
-export const NEW_IDENTITY_NAMESPACE = "foundation";
+export const NEW_IDENTITY_NAMESPACE = "pillar";
 
 /**
  * Carrier-infrastructure identities (pillar-seed, pillar-directory, pillar-escrow) stay in

package/src/mailbox/mailbox.mjs

@@ -20,6 +20,33 @@ import { createHash } from "node:crypto";
 import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { jcs } from "../identity/jcs.mjs";
+import { rekeyToSenderUnique } from "../sqlite-rekey.mjs";
+
+// An envelope id is unique only within its sender (Annex B5(a),
+// src/sqlite-rekey.mjs). The outbox keeps UNIQUE(envelope_id): every id in it
+// is this agent's own. INBOX_COLUMNS must declare every column _migrate can
+// add to an older inbox, because the re-key copies the old table's columns.
+const INBOX_COLUMNS = `
+  seq             integer primary key autoincrement,
+  envelope_id     text not null,
+  envelope_sha256 text not null,
+  sender          text not null,
+  received_at     text not null,
+  envelope_json   text not null,
+  chain_hash      text not null,
+  read_at         text,
+  quarantined     text,
+  pulled_by       text,
+  group_id        text,
+  released_seq    integer,
+  unique (sender, envelope_id)`;
+const INBOX_INDEX = "create index if not exists inbox_sender on inbox (sender);";
+// Every cursor read (_seqFloor, inboxTipSeq, inboxAfter) orders on a row's
+// position, coalesce(released_seq, seq); without this index each one, and so
+// every append, scans the whole inbox.
+const INBOX_POS_INDEX = "create index if not exists inbox_pos on inbox (coalesce(released_seq, seq));";
+// The re-key drops the old table and with it every index on it.
+const INBOX_INDEXES = [INBOX_INDEX, "create index if not exists inbox_group on inbox (group_id);", INBOX_POS_INDEX];
 
 const SCHEMA = `
 create table if not exists outbox (
@@ -37,17 +64,8 @@ create table if not exists outbox (
 create index if not exists outbox_recipient on outbox (recipient);
 create index if not exists outbox_status on outbox (status);
 
-create table if not exists inbox (
-  seq             integer primary key autoincrement,
-  envelope_id     text not null unique,
-  envelope_sha256 text not null,
-  sender          text not null,
-  received_at     text not null,
-  envelope_json   text not null,
-  chain_hash      text not null,
-  read_at         text
-);
-create index if not exists inbox_sender on inbox (sender);
+create table if not exists inbox (${INBOX_COLUMNS});
+${INBOX_INDEX}
 
 create table if not exists carrier_cursors (
   carrier text primary key,
@@ -75,6 +93,15 @@ export class Mailbox {
     // transaction that re-reads table_info inside it: the second opener waits
     // on the write lock (busy timeout) and then finds nothing left to add.
     this.db.transaction(() => this._migrate()).immediate();
+    // UNIQUE(sender, envelope_id) (Annex B5(a), user_version 1). It runs after
+    // _migrate, so the table it copies already has every column INBOX_COLUMNS
+    // declares, and outside it: the backup is VACUUM INTO, which SQLite refuses
+    // inside a transaction. The re-key takes its own immediate transaction and
+    // re-checks there, so of two openers only the first rebuilds.
+    rekeyToSenderUnique(this.db, { table: "inbox", columnsSql: INBOX_COLUMNS, indexSql: INBOX_INDEXES });
+    // A store the re-key leaves alone (fresh, or re-keyed by an earlier
+    // build) gets the position index here. An index needs no ladder step.
+    this.db.exec(INBOX_POS_INDEX);
   }
 
   _migrate() {
@@ -100,7 +127,7 @@ export class Mailbox {
         if (!have.has(name)) this.db.exec(`alter table ${table} add column ${name} ${type}`);
       }
     };
-    addCols("inbox", [["pulled_by", "text"], ["group_id", "text"]]);
+    addCols("inbox", [["pulled_by", "text"], ["group_id", "text"], ["released_seq", "integer"]]);
     addCols("outbox", [
       ["kind", "text"], ["thread", "text"], ["group_id", "text"], ["group_msg_id", "text"],
       ["recipient_ack_at", "text"], ["recipient_ack_id", "text"], ["recipient_read_at", "text"],
@@ -212,26 +239,45 @@ export class Mailbox {
   }
 
   /**
-   * Append an incoming envelope.  Same shape.  MUST be idempotent on envelope.id;
-   * a duplicate delivery does NOT re-append and does NOT advance the chain.
+   * Append an incoming envelope.  Same shape.  MUST be idempotent on
+   * (sender, envelope.id); a duplicate delivery does NOT re-append and does
+   * NOT advance the chain.  A DIFFERENT envelope under a stored (sender, id)
+   * is not appended either: it returns `collision: true` alongside
+   * `duplicate: true`, so a caller that only checks `duplicate` still fires
+   * no handlers.  The same id from another sender is a different envelope.
    * `pulledBy` is the reader key of the storing process (metadata only).
+   * `quarantined` is the trust-gate reason string; set it here so insert and
+   * quarantine are one commit — a named reader in another process can never
+   * see the row unquarantined between the two.
    */
-  appendInbound(envelope, { pulledBy = null } = {}) {
+  appendInbound(envelope, { pulledBy = null, quarantined = null } = {}) {
     return this.db.transaction(() => {
-      const existing = this.db.prepare("select seq, envelope_id, envelope_sha256 from inbox where envelope_id = ?").get(envelope.id);
+      const sender = envelope.sender ?? envelope.from ?? "unknown";
+      const envSha = Mailbox.envelopeSha(envelope);
+      const existing = this.db.prepare("select seq, envelope_sha256 from inbox where envelope_id = ? and sender = ?").get(envelope.id, sender);
       if (existing) {
-        return { duplicate: true, seq: existing.seq, envelopeId: envelope.id, envelopeSha256: existing.envelope_sha256 };
+        const collision = existing.envelope_sha256 !== envSha;
+        return { duplicate: true, ...(collision ? { collision: true } : {}), seq: existing.seq, envelopeId: envelope.id, envelopeSha256: existing.envelope_sha256 };
       }
-      const envSha = Mailbox.envelopeSha(envelope);
       const prev = this._getHead("inbox");
       const chainInput = prev == null ? CHAIN_SEED + envSha : prev + envSha;
       const chain = createHash("sha256").update(chainInput).digest("hex");
+      // Explicit seq: must exceed every existing seq AND every released_seq, so a
+      // released row's cursor position never ties with a future row's seq, and
+      // every seq ever issued (the counter), so a deleted row's is never reused.
+      const nextSeq = this._seqFloor() + 1;
       const r = this.db.prepare(`
-        insert into inbox (envelope_id, envelope_sha256, sender, received_at, envelope_json, chain_hash, pulled_by)
-        values (?, ?, ?, ?, ?, ?, ?)
-      `).run(envelope.id, envSha, envelope.sender ?? envelope.from ?? "unknown", new Date().toISOString(), JSON.stringify(envelope), chain, pulledBy);
+        insert into inbox (seq, envelope_id, envelope_sha256, sender, received_at, envelope_json, chain_hash, pulled_by, quarantined)
+        values (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(nextSeq, envelope.id, envSha, sender, new Date().toISOString(), JSON.stringify(envelope), chain, pulledBy,
+        quarantined != null ? String(quarantined).slice(0, 100) : null);
+      // Keep sqlite_sequence at least this seq, so an OLD-code daemon on the
+      // same mailbox (which lets AUTOINCREMENT pick) never ties with this row.
+      // Current SQLite already raises it for an explicit rowid; the bump keeps
+      // that from being an assumption.
+      this.db.prepare("update sqlite_sequence set seq = max(seq, ?) where name = 'inbox'").run(nextSeq);
       this._setHead("inbox", chain);
-      return { duplicate: false, seq: Number(r.lastInsertRowid), envelopeId: envelope.id, envelopeSha256: envSha, chainHash: chain };
+      return { duplicate: false, seq: nextSeq, envelopeId: envelope.id, envelopeSha256: envSha, chainHash: chain };
     })();
   }
 
@@ -245,9 +291,16 @@ export class Mailbox {
     return this.db.prepare("select * from outbox where envelope_id = ?").get(envelopeId) ?? null;
   }
 
-  /** Full inbox row by envelope id (VDA message-delivery instrument). */
-  getInbound(envelopeId) {
-    return this.db.prepare("select * from inbox where envelope_id = ?").get(envelopeId) ?? null;
+  /**
+   * Full inbox row by (envelope id, sender) (VDA message-delivery
+   * instrument).  Without `sender`, the first row stored under the id, which
+   * may be any sender's: pass the sender whenever it is known.
+   */
+  getInbound(envelopeId, sender) {
+    if (sender === undefined) {
+      return this.db.prepare("select * from inbox where envelope_id = ? order by seq asc limit 1").get(envelopeId) ?? null;
+    }
+    return this.db.prepare("select * from inbox where envelope_id = ? and sender = ?").get(envelopeId, sender) ?? null;
   }
 
   markOutboundDelivered(envelopeId, ackSha256) {
@@ -275,9 +328,14 @@ export class Mailbox {
     return this.db.prepare("select * from inbox where quarantined is not null order by seq asc limit ?").all(limit);
   }
 
-  markQuarantined(envelopeId, reason) {
-    this.db.prepare("update inbox set quarantined = ? where envelope_id = ?")
-      .run(String(reason).slice(0, 100), envelopeId);
+  /** Without `sender`, every row under the id is quarantined (the safe side). */
+  markQuarantined(envelopeId, reason, sender) {
+    const r = String(reason).slice(0, 100);
+    if (sender === undefined) {
+      this.db.prepare("update inbox set quarantined = ? where envelope_id = ?").run(r, envelopeId);
+    } else {
+      this.db.prepare("update inbox set quarantined = ? where envelope_id = ? and sender = ?").run(r, envelopeId, sender);
+    }
   }
 
   // ── pillar-group/2 send queue: what the v2 receiver asked to send ─────────
@@ -319,26 +377,100 @@ export class Mailbox {
       .run(state, new Date().toISOString(), envelopeId, reason ? String(reason).slice(0, 200) : null, id);
   }
 
-  clearQuarantine(envelopeId) {
-    this.db.prepare("update inbox set quarantined = null where envelope_id = ?").run(envelopeId);
+  /**
+   * Release a quarantined row (minor 6). The row keeps its original seq (chain
+   * order is immutable) but gets released_seq = tip + 1, so it sorts strictly
+   * after every row a cursor could already have passed: inboxAfter matches on
+   * coalesce(released_seq, seq) > cursor. Released rows appear in release
+   * order. A row quarantined again after a release (a pillar-group/2
+   * hold-expired drop) can be released again, at a new position above the
+   * tip, so readers see it again; a row that is not quarantined is never moved.
+   *
+   * One immediate transaction: (a) read the tip, (b) set released_seq,
+   * (c) bump sqlite_sequence so an OLD-code daemon's next AUTOINCREMENT
+   * insert gets a seq strictly above every released_seq. Without (c) the
+   * old daemon's insert takes the same number as this release and a named
+   * reader that consumed the release never sees the daemon's row.
+   * The immediate transaction also serialises concurrent releases.
+   *
+   * An id is unique only within its sender (Annex B5(a)). Releasing is the
+   * unsafe direction, so without `sender` it refuses when two senders hold
+   * the id quarantined rather than release another sender's row with it.
+   * Returns the number of rows changed (0 = unknown id or not quarantined).
+   */
+  releaseQuarantined(envelopeId, sender) {
+    let changes = 0;
+    this.db.transaction(() => {
+      if (sender === undefined) {
+        const n = this.db.prepare("select count(*) as n from inbox where envelope_id = ? and quarantined is not null").get(envelopeId).n;
+        if (n > 1) throw new Error(`releaseQuarantined: ${n} senders hold envelope ${envelopeId} quarantined; name the sender`);
+      }
+      const tip = this._seqFloor();
+      const where = sender === undefined ? "envelope_id = ?" : "envelope_id = ? and sender = ?";
+      changes = this.db.prepare(`update inbox set quarantined = null, released_seq = ? where ${where} and quarantined is not null`)
+        .run(tip + 1, envelopeId, ...(sender === undefined ? [] : [sender])).changes;
+      if (changes > 0) {
+        this.db.prepare("update sqlite_sequence set seq = max(seq, ?) where name = 'inbox'")
+          .run(tip + 1);
+      }
+    }).immediate();
+    return changes;
   }
 
-  markInboxRead(envelopeId) {
-    this.db.prepare("update inbox set read_at = ? where envelope_id = ? and read_at is null")
-      .run(new Date().toISOString(), envelopeId);
+  /**
+   * pillar-group/2's name for a release: a held message that settles is
+   * released like any quarantined row, so a named reader whose cursor already
+   * passed its seq still sees it (minor 6 on the 2.1.0 group path).
+   */
+  clearQuarantine(envelopeId, sender) {
+    return this.releaseQuarantined(envelopeId, sender);
   }
 
-  setInboundGroup(envelopeId, groupId) {
-    this.db.prepare("update inbox set group_id = ? where envelope_id = ?").run(groupId, envelopeId);
+  /** Without `sender`, every row under the id is marked read. */
+  markInboxRead(envelopeId, sender) {
+    const at = new Date().toISOString();
+    if (sender === undefined) {
+      this.db.prepare("update inbox set read_at = ? where envelope_id = ? and read_at is null").run(at, envelopeId);
+    } else {
+      this.db.prepare("update inbox set read_at = ? where envelope_id = ? and sender = ? and read_at is null").run(at, envelopeId, sender);
+    }
+  }
+
+  /** Without `sender`, every row under the id is tagged. */
+  setInboundGroup(envelopeId, groupId, sender) {
+    if (sender === undefined) {
+      this.db.prepare("update inbox set group_id = ? where envelope_id = ?").run(groupId, envelopeId);
+    } else {
+      this.db.prepare("update inbox set group_id = ? where envelope_id = ? and sender = ?").run(groupId, envelopeId, sender);
+    }
+  }
+
+  /**
+   * The highest number any inbox row occupies or ever occupied: every seq and
+   * released_seq, and the AUTOINCREMENT counter (which the B5(a) re-key carries
+   * and every explicit-seq write bumps). A new seq or released_seq is above it.
+   */
+  _seqFloor() {
+    return this.db.prepare(`select max(
+      coalesce((select max(coalesce(released_seq, seq)) from inbox), 0),
+      coalesce((select seq from sqlite_sequence where name = 'inbox'), 0)) as n`).get().n;
   }
 
   inboxTipSeq() {
-    return this.db.prepare("select coalesce(max(seq), 0) as n from inbox").get().n;
+    return this.db.prepare("select coalesce(max(coalesce(released_seq, seq)), 0) as n from inbox").get().n;
   }
 
-  /** Non-quarantined rows after `seq`, oldest first — what a reader has not seen. */
+  /**
+   * Non-quarantined rows after `seq`, oldest first — what a reader has not seen.
+   * A released row is seen at its released_seq (>= every live cursor), not its
+   * original seq, so no cursor that already passed it skips it.
+   */
   inboxAfter(seq = 0, limit = 500) {
-    return this.db.prepare("select * from inbox where seq > ? and quarantined is null order by seq asc limit ?").all(seq, limit);
+    return this.db.prepare(`
+      select * from inbox
+      where coalesce(released_seq, seq) > ? and quarantined is null
+      order by coalesce(released_seq, seq) asc limit ?
+    `).all(seq, limit);
   }
 
   // ── Readers ────────────────────────────────────────────────────────────────

package/src/net/carrier-server.mjs

@@ -10,7 +10,9 @@
  *   POST /v1/envelopes
  *     body: envelope JSON (sealed by sender's pillar)
  *     - carrier verifies the transport signature before accepting (fail closed)
- *     - idempotent on envelope.id
+ *     - idempotent on (sender, envelope.id), the store's key (Annex B5(a)):
+ *       a stored pair again -> 202 { accepted: true, duplicate: true, seq, sha };
+ *       another sender's envelope under the same id is a different envelope
  *     -> 202 { accepted: true, seq, sha }
  *     With a receipt key (constructor `receiptKeychain`), the 202 also carries
  *     `receipt` + `receiptSig` (uuaid.carrier-receipt.v1, ./carrier-receipt.mjs),
@@ -70,6 +72,7 @@ import { verifyTierGrant } from "../identity/tier.mjs";
 import { verifyDelegationDoc, delegationCoversKind } from "./delegation.mjs";
 import { withCarrierFix } from "./refusals.mjs"; // additive `fix` on refusals; reason/error/status unchanged
 import { carrierReceiptSigningString, carrierReceiptShapeOk, carrierUuaidFromKey } from "./carrier-receipt.mjs";
+import { rekeyToSenderUnique } from "../sqlite-rekey.mjs";
 
 const MAX_WAIT_S = 30;
 const MAX_BODY = 512 * 1024; // 512 KiB per envelope (community tier)
@@ -135,6 +138,20 @@ export function parseSecureDelete(value) {
   throw new Error(`secure-delete must be on or off, not "${value}"`);
 }
 
+// An envelope id is unique only within its sender (Annex B5(a), src/sqlite-rekey.mjs).
+const ENVELOPES_COLUMNS = `
+        seq         integer primary key autoincrement,
+        envelope_id text not null,
+        recipient   text not null,
+        sender      text not null,
+        sha         text not null,
+        body        text not null,
+        created_at  text not null default (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+        retain_until text,
+        envelope_sha text,
+        unique (sender, envelope_id)`;
+const ENVELOPES_INDEX = "create index if not exists idx_envelopes_recipient on envelopes(recipient, seq);";
+
 export class CarrierServer {
   constructor({ dbPath = "carrier.db", ttlDays = 14, cryptoInventory, trustedTierIssuers = [], keychain = null, publicUrl = null, secureDelete = true, receiptKeychain = null, communityInboxWaits = COMMUNITY_CONCURRENT_WAITS } = {}) {
     // Every row's retain_until is created_at + ttlDays, so the TTL must be a
@@ -158,18 +175,8 @@ export class CarrierServer {
     this.db.pragma(`secure_delete = ${this.secureDelete ? "ON" : "OFF"}`);
     this.lastVacuum = null;
     this.db.exec(`
-      create table if not exists envelopes (
-        seq         integer primary key autoincrement,
-        envelope_id text not null unique,
-        recipient   text not null,
-        sender      text not null,
-        sha         text not null,
-        body        text not null,
-        created_at  text not null default (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
-        retain_until text,
-        envelope_sha text
-      );
-      create index if not exists idx_envelopes_recipient on envelopes(recipient, seq);
+      create table if not exists envelopes (${ENVELOPES_COLUMNS});
+      ${ENVELOPES_INDEX}
       -- Lifetime service counters. Kept OUTSIDE the envelopes table because
       -- vacuum() deletes envelopes at TTL, and a seed's service history must
       -- survive its own garbage collection.
@@ -188,6 +195,33 @@ export class CarrierServer {
     if (!cols.has("envelope_sha")) this.db.exec("alter table envelopes add column envelope_sha text");
     this.db.prepare("insert or ignore into seed_stats (k, v) values ('first_seen', ?)")
       .run(new Date().toISOString());
+    // Secure delete promises an expired envelope leaves the disk; a kept backup
+    // would hold every stored envelope past its deadline, so it goes once the
+    // re-key has committed.
+    const rekey = rekeyToSenderUnique(this.db, { table: "envelopes", columnsSql: ENVELOPES_COLUMNS, indexSql: [ENVELOPES_INDEX], keepBackup: !this.secureDelete });
+    if (rekey.migrated) console.warn(`pillar-carrier: envelopes re-keyed on (sender, envelope_id): ${rekey.rows} rows, seq counter ${rekey.counter}, backup ${rekey.backup ?? (this.db.memory ? "none (in-memory)" : "removed (secure delete)")}`);
+    if (rekey.swept) console.warn(`pillar-carrier: removed ${rekey.swept} backup file(s) an interrupted re-key left (secure delete)`);
+    // The rebuild copied the table and freed the old one, so the file is about
+    // twice its size, and the store cap counts every page, free ones too
+    // (page_count, the full-refusal check below). Reclaim them once, here: else
+    // a carrier above about half its cap refuses deposits for good.
+    // Also on a later start: a run killed (or failed) between the re-key's commit and this VACUUM
+    // leaves the freed copy on the file (just under half the pages), and only this check notices it.
+    // A quarter of the pages free also means the cap counts a quarter more than is stored, so a
+    // VACUUM pays its way then too; below that the start skips it.
+    const pages = this.db.memory ? 0 : this.db.pragma("page_count", { simple: true });
+    const freePages = this.db.memory ? 0 : this.db.pragma("freelist_count", { simple: true });
+    if (!this.db.memory && (rekey.migrated || freePages * 4 > pages)) {
+      try {
+        this.db.exec("vacuum");
+        // Another connection reading this file holds the WAL: the checkpoint
+        // waits out the busy timeout (5 s), then leaves the WAL as it is.
+        const [cp] = this.db.pragma("wal_checkpoint(TRUNCATE)");
+        if (cp?.busy) console.warn(`pillar-carrier: free pages reclaimed, but another process holds ${dbPath} open, so its WAL was not truncated; stop other processes on the store before restarting the carrier`);
+      } catch (e) {
+        console.warn(`pillar-carrier: VACUUM failed (${e.message}); the store counts its free pages (${freePages} of ${pages}) toward the size cap until a later start reclaims them, or the carrier is stopped and \`sqlite3 ${dbPath} 'VACUUM;'\` is run`);
+      }
+    }
     this.ttlDays = ttlDays;
     this._backfillRetention(); // @rule carrier.retention-backfill
     this.cryptoInventory = cryptoInventory ?? { ed25519: "active" };
@@ -522,7 +556,11 @@ export class CarrierServer {
       return { code: 202, body };
     } catch (e) {
       if (/UNIQUE constraint/.test(e.message)) {
-        const row = this.db.prepare(`select ${ROW_COLUMNS}, body from envelopes where envelope_id = ?`).get(envelope.id);
+        // The key is (sender, envelope_id), so this lookup names BOTH. By id
+        // alone it could find another sender's envelope and answer this one
+        // with that seq and sha as if it were stored (Annex B5(a)).
+        const row = this.db.prepare(`select ${ROW_COLUMNS}, body from envelopes where envelope_id = ? and sender = ?`).get(envelope.id, envelope.sender);
+        if (!row) throw e;
         // No receipt key: the duplicate answer is exactly the pre-receipt one.
         if (!this.receiptKeychain) return { code: 202, body: { accepted: true, duplicate: true, seq: row.seq, sha: row.sha } }; // @rule carrier.keyless-unchanged
         // §12 rule 1 (P1): the same id with a different body is not a

package/src/pillar.mjs

@@ -682,7 +682,8 @@ export class Pillar {
    * dropped: nothing leaves this process from here.
    */
   async _receiveGroupV2(envelope, payload) {
-    const env = { from: envelope.sender, transportKey: envelope.transportSignature?.publicKey, payload, ref: envelope.id };
+    // ref is this process's handle on a held message: (id, sender), the inbox key (Annex B5(a)).
+    const env = { from: envelope.sender, transportKey: envelope.transportSignature?.publicKey, payload, ref: { id: envelope.id, sender: envelope.sender } };
     if (envelope.delegation) env.delegation = { rootKey: envelope.delegation.principalPublicKey };
     const r = this.groupsV2.receive(env, Date.now());
     this.metrics.inc(`received.group-v2.${r.verdict}`);
@@ -695,15 +696,15 @@ export class Pillar {
       if (ids.length < r.sends.length) this.metrics.inc("group-v2.sends.queue-full", r.sends.length - ids.length);
     }
     for (const x of r.released) await this._settleHeldGroupV2(x.ref, x.verdict, x.reason, groupId);
-    for (const x of r.dropped) if (x.ref) this.mailbox.markQuarantined(x.ref, `group-v2:${x.reason}`);
+    for (const x of r.dropped) if (x.ref) this.mailbox.markQuarantined(x.ref.id, `group-v2:${x.reason}`, x.ref.sender);
     if (["accepted", "invitation", "recovered"].includes(r.verdict)) {
-      this.mailbox.setInboundGroup(envelope.id, groupId);
+      this.mailbox.setInboundGroup(envelope.id, groupId, envelope.sender);
       return true;
     }
     if (r.verdict === "warning") return true;
     // Verdict "v1" (a v1 tag for a group the store does not hold) reaches here only
     // for a marked row whose store file is gone: no verified chain, nothing to file under.
-    this.mailbox.markQuarantined(envelope.id, `group-v2:${r.verdict === "v1" ? "no-chain" : (r.reason ?? r.verdict)}`);
+    this.mailbox.markQuarantined(envelope.id, `group-v2:${r.verdict === "v1" ? "no-chain" : (r.reason ?? r.verdict)}`, envelope.sender);
     return false;
   }
 
@@ -779,12 +780,13 @@ export class Pillar {
     return out;
   }
 
-  async _settleHeldGroupV2(envelopeId, verdict, reason, groupId) {
-    if (!envelopeId) return;
-    if (verdict !== "accepted") { this.mailbox.markQuarantined(envelopeId, `group-v2:${reason ?? verdict}`); return; }
-    this.mailbox.clearQuarantine(envelopeId);
-    this.mailbox.setInboundGroup(envelopeId, groupId);
-    const row = this.mailbox.getInbound(envelopeId);
+  async _settleHeldGroupV2(ref, verdict, reason, groupId) {
+    if (!ref?.id) return;
+    const { id: envelopeId, sender } = ref;
+    if (verdict !== "accepted") { this.mailbox.markQuarantined(envelopeId, `group-v2:${reason ?? verdict}`, sender); return; }
+    this.mailbox.clearQuarantine(envelopeId, sender);
+    this.mailbox.setInboundGroup(envelopeId, groupId, sender);
+    const row = this.mailbox.getInbound(envelopeId, sender);
     if (!row) return;
     const envelope = JSON.parse(row.envelope_json);
     let payload;
@@ -913,7 +915,10 @@ export class Pillar {
         dead.delete(base);
         for (const { seq, envelope } of r.envelopes) {
           since = Math.max(since, seq);
-          if (found.has(envelope.id) || this.mailbox.getInbound(envelope.id)) continue;
+          // Keyed like the inbox, on (sender, id): another sender's envelope
+          // under this id must not hide this one (Annex B5(a)).
+          const key = `${envelope.sender}\u0000${envelope.id}`;
+          if (found.has(key) || this.mailbox.getInbound(envelope.id, envelope.sender)) continue;
           const v = open(envelope, { cryptoInventory: this.cryptoInventory });
           if (!v.ok || envelope.recipient !== this.uuaid) continue;
           let payload;
@@ -921,7 +926,7 @@ export class Pillar {
           if (!this._trustVerdict(envelope, payload).deliver) continue;
           const view = { ...envelope, payload };
           if (match && !match(view)) continue;
-          found.set(envelope.id, view);
+          found.set(key, view);
         }
         if (found.size) { stop = true; ctl.abort(); }
         else if (w === 0 && !r.envelopes.length) {
@@ -965,22 +970,33 @@ export class Pillar {
       console.warn("pillar: envelope decrypt failed (dropping)", envelope.id, e.message);
       return;
     }
-    const persisted = this.mailbox.appendInbound(envelope, { pulledBy: this.reader });
-    if (persisted.duplicate) {
-      this.metrics.inc("received.duplicate");
-      return; // replay: do not re-fire handlers
-    }
-    this.metrics.inc(`received.kind.${envelope.kind}`);
     // Trust gate (recipient consent): quarantine-not-drop. The envelope is
-    // already persisted (chain-hashed evidence); a gated sender just never
+    // persisted either way (chain-hashed evidence); a gated sender just never
     // reaches handlers. An ack/reply (or a read receipt) passes the gate ONLY
     // when it answers an envelope in OUR outbox that was sent TO ITS SENDER —
     // a genuine receipt for our own send. (kind alone is spoofable, and so is
     // an envelope id: ids are visible to every carrier. Sent-to-this-sender
-    // is not.)
+    // is not.) Compute the verdict FIRST so insert and quarantine are one
+    // commit — a named reader in another process can never observe the row
+    // unquarantined between the two writes.
     const verdict2 = this._trustVerdict(envelope, payload);
+    const persisted = this.mailbox.appendInbound(envelope, {
+      pulledBy: this.reader,
+      quarantined: verdict2.deliver ? null : verdict2.reason,
+    });
+    if (persisted.collision) {
+      // Same sender, same id, different envelope: not stored, not handled.
+      this.metrics.inc("received.collision");
+      // eslint-disable-next-line no-console
+      console.warn(`pillar: dropped ${envelope.id} from ${envelope.sender}: a different envelope from that sender already holds this id`);
+      return;
+    }
+    if (persisted.duplicate) {
+      this.metrics.inc("received.duplicate");
+      return; // replay: do not re-fire handlers
+    }
+    this.metrics.inc(`received.kind.${envelope.kind}`);
     if (!verdict2.deliver) {
-      this.mailbox.markQuarantined(envelope.id, verdict2.reason);
       this.metrics.inc(`received.quarantined.${verdict2.reason}`);
       // eslint-disable-next-line no-console
       console.warn(`pillar: quarantined ${envelope.id} from ${envelope.sender} (${verdict2.reason})`);
@@ -1011,7 +1027,7 @@ export class Pillar {
       const fromContact = !!this.addressBook?.get(envelope.sender) || !!this.trust?.allow?.includes(envelope.sender);
       const before = this.mailbox.getGroup(tag.id);
       const after = absorbGroupTag(this.mailbox, tag, { sender: envelope.sender, self: this.uuaid, text: payload?.text ?? "", fromContact });
-      if ((before ?? after)?.members.includes(envelope.sender)) this.mailbox.setInboundGroup(envelope.id, tag.id);
+      if ((before ?? after)?.members.includes(envelope.sender)) this.mailbox.setInboundGroup(envelope.id, tag.id, envelope.sender);
       else this.metrics.inc("received.group.non-member");
     }
     if (this.receipts.delivered && envelope.kind !== "ack") await this._autoAck(envelope, payload, tag);

package/src/readers.mjs

@@ -21,6 +21,7 @@
  */
 import { createHash } from "node:crypto";
 import { hostname, userInfo } from "node:os";
+import { execFileSync } from "node:child_process";
 
 export const READER_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
 export const IMPLICIT_PREFIX = "ctx:";
@@ -78,6 +79,41 @@ export function otherLiveLeases(mailbox, ctx = processContext()) {
   });
 }
 
+/**
+ * Processes (other than this one) that have this mailbox file open RIGHT NOW,
+ * via lsof. This catches what the lease scan cannot: a pre-lease daemon
+ * holding the DB open but not yet writing, or a one-shot `pillar inbox` run
+ * with no lease at all. Returns [] when lsof is unavailable (not a mac/linux
+ * host) — the lease check still applies as a floor.
+ */
+export function processesWithMailboxOpen(mailboxDbPath) {
+  let out;
+  try {
+    out = execFileSync("lsof", ["-F", "pc", mailboxDbPath], { encoding: "utf-8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"] });
+  } catch (e) {
+    // exit 1 with empty stdout = nobody has the file open (normal case)
+    if (e.status === 1 && !e.stdout?.toString().trim()) return [];
+    // exit 1 WITH holders on stdout: lsof found holders but also errored on
+    // another search item. Parse what it found.
+    if (e.status === 1 && e.stdout?.toString().trim()) { out = e.stdout.toString(); }
+    else {
+      // anything else (lsof missing, timeout, unexpected error): warn, continue on lease floor
+      console.error(`warning: the open-file check (lsof) could not run: ${e.message}. init --force will rely on the lease check only.`);
+      return [];
+    }
+  }
+  // lsof -F pc output per open file:  p<pid>\n  c<command>\n  f<fd>\n
+  // (the f line follows c; we pair p with the c that immediately follows it)
+  const procs = [];
+  let pid = null;
+  for (const line of out.split("\n")) {
+    if (line.startsWith("p")) { pid = parseInt(line.slice(1), 10); }
+    else if (line.startsWith("c") && pid != null) { procs.push({ pid, command: line.slice(1) }); pid = null; }
+    // f<fd> and other field lines: ignored; pid already consumed or not yet seen
+  }
+  return procs.filter((p) => p.pid !== process.pid);
+}
+
 /** "pillar recv (pid 4242 on mac, /work/bot, since 2026-09-28T…)" */
 export function describeProcess(row) {
   const where = [row.pid != null ? `pid ${row.pid}` : null, row.host ? `on ${row.host}` : null, row.cwd ?? null]

package/src/sqlite-rekey.mjs

@@ -0,0 +1,190 @@
+/**
+ * Re-key an envelope table from UNIQUE(envelope_id) to UNIQUE(sender,
+ * envelope_id): UACP charter Annex B5(a).
+ *
+ * WHY. An envelope id is chosen by its sender, so it is unique only within
+ * one sender. Keyed on the id alone, a store lets any sender who learns (or
+ * guesses) another sender's next id claim it first; the real envelope then
+ * reads as a duplicate and is never stored. Keyed on (sender, id), each
+ * sender can collide only with itself and its live delegates, of any kind: a
+ * delegate's envelope carries its principal as sender (RedTeam G1).
+ *
+ * HOW. SQLite cannot drop a table constraint in place, so this is its
+ * documented rebuild: create the new table, copy every row with its own seq,
+ * drop the old one, rename. A naive rebuild loses two things, and this keeps
+ * both:
+ *
+ * 1. The AUTOINCREMENT counter. sqlite_sequence holds the highest seq ever
+ *    issued, which is above max(seq) whenever rows were deleted (a carrier's
+ *    TTL vacuum). A rebuild resets it to max(seq), and the next insert would
+ *    reuse a seq that clients already read past with `since=<seq>`: that
+ *    mail would never be delivered. The counter is carried over as
+ *    max(old counter, max(seq)).
+ * 2. The data if anything fails: a file-backed database is copied first with
+ *    VACUUM INTO, and the rebuild is one transaction.
+ *
+ * GUARD. The table itself: a table that still has an id-only UNIQUE is
+ * rebuilt, whatever `user_version` says, because that number is one per FILE
+ * and two envelope tables can share a file (an inbox and a carrier's
+ * envelopes): the first one's re-key must not skip the second's. A table
+ * without it (a fresh one, created with the new key, or one already rebuilt)
+ * is left alone. Either way `user_version` ends at least SENDER_UNIQUE_VERSION
+ * and is never lowered.
+ *
+ * BACKUPS. A kept backup (`keepBackup`) is the copy an operator restores
+ * from, so it stays when the rebuild throws. Under secure delete
+ * (`keepBackup: false`) no copy may outlive the call: it goes whether the
+ * rebuild committed, found the work done or threw, and every start sweeps the
+ * copies a killed run left behind (staleBackupFiles says which: never one a
+ * running re-key is still writing).
+ * The sweep matches every re-key backup of the FILE, so a mailbox sharing a
+ * file with a secure-delete carrier loses its kept backup to that sweep.
+ *
+ * THE VERSION LADDER (a convention every later change must follow).
+ * `user_version` is one integer for the whole database file, and this re-key
+ * now owns it for both envelope databases, carrier.db and mailbox.db. It is a
+ * single monotonic ladder starting at 1 (SENDER_UNIQUE_VERSION). Any later
+ * schema change to either file MUST:
+ *   - take the next number (2, 3, …);
+ *   - guard on `user_version >= <its own number>`;
+ *   - stamp only after its own change has applied.
+ * A change that reused 1, or guarded on `>= 1`, would be skipped silently on
+ * every store this re-key has touched. When a second change arrives, a
+ * dedicated migrations table becomes worth its keep. Until then this
+ * paragraph is the rule (RedTeam, fm-20260928T061937-2986f6).
+ */
+
+import { chmodSync, closeSync, openSync, readdirSync, rmSync, statSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+
+export const SENDER_UNIQUE_VERSION = 1;
+
+/** True if `table` has a UNIQUE index over exactly (envelope_id). */
+function hasIdOnlyUnique(db, table) {
+  for (const ix of db.pragma(`index_list(${table})`)) {
+    if (!ix.unique) continue;
+    const cols = db.pragma(`index_info(${ix.name})`).map((c) => c.name);
+    if (cols.length === 1 && cols[0] === "envelope_id") return true;
+  }
+  return false;
+}
+
+/** True if `pid` names a live process (EPERM: alive, not ours to signal). */
+function alive(pid) {
+  try { process.kill(pid, 0); return true; } catch (e) { return e.code === "EPERM"; }
+}
+
+// A copy is written in seconds (a store is capped at 256 MiB), so one this old
+// is no opener's copy in progress, whatever its pid now names.
+const STALE_BACKUP_MS = 60 * 60 * 1000;
+
+/**
+ * `<db>.pre-sender-unique-<ms>-<pid>.bak`, and the journal VACUUM INTO may
+ * leave beside it, that no running re-key is still writing. A copy another
+ * opener is still writing must stay: deleting it fails that opener's start
+ * (SQLITE_IOERR_DELETE_NOENT). So a copy is stale when its process is gone, or
+ * it is older than STALE_BACKUP_MS, or it carries THIS process's pid but
+ * predates this process: a carrier restarted in a container gets the same pid
+ * (often 1) as the killed run that left the copy (Uuaid-Codex X-1). A copy
+ * with this pid written since this process started is a worker thread's, and
+ * stays.
+ */
+function staleBackupFiles(dbFile) {
+  const prefix = `${basename(dbFile)}.pre-sender-unique-`;
+  const name = /^(\d+)-(\d+)\.bak(-journal|-wal|-shm)?$/;
+  const now = Date.now();
+  const startedAt = now - process.uptime() * 1000;
+  return readdirSync(dirname(dbFile))
+    .filter((f) => {
+      if (!f.startsWith(prefix)) return false;
+      const m = name.exec(f.slice(prefix.length));
+      if (m === null) return false;
+      const ms = Number(m[1]), pid = Number(m[2]);
+      if (now - ms > STALE_BACKUP_MS) return true;
+      if (pid === process.pid) return ms < startedAt;
+      return !alive(pid);
+    })
+    .map((f) => join(dirname(dbFile), f));
+}
+
+function removeBackup(backup) {
+  for (const f of [backup, `${backup}-journal`]) rmSync(f, { force: true });
+}
+
+/**
+ * Rebuild `table` as `create table <table> (<columnsSql>)` if it still has
+ * the id-only key. `columnsSql` must declare every column the old table has
+ * (the copy names the old table's columns) plus `unique (sender,
+ * envelope_id)`. `indexSql` recreates the table's secondary indexes, which
+ * the drop removes. `table` is a code constant, never input.
+ *
+ * Call it OUTSIDE any transaction: the backup is VACUUM INTO, which SQLite
+ * refuses inside one. The rebuild then takes its own IMMEDIATE transaction
+ * and re-checks the guard there, so when several processes open one file at
+ * once only the first rebuilds; a later one finds the work done and removes
+ * the backup it took.
+ *
+ * `keepBackup: false` removes the backup in every outcome and sweeps the ones
+ * earlier runs left (BACKUPS above). A carrier that runs with secure delete
+ * passes it: a copy would otherwise keep envelopes on disk past their
+ * retention deadline.
+ *
+ * Returns { migrated: false, swept } or { migrated: true, backup, rows,
+ * counter, swept }; `swept` counts the stale backup files removed.
+ */
+export function rekeyToSenderUnique(db, { table, columnsSql, indexSql = [], keepBackup = true }) {
+  const stamped = () => db.pragma("user_version", { simple: true }) >= SENDER_UNIQUE_VERSION;
+  const stamp = () => { if (!stamped()) db.pragma(`user_version = ${SENDER_UNIQUE_VERSION}`); };
+  const sweep = () => (keepBackup || db.memory ? 0 : staleBackupFiles(db.name).map((f) => rmSync(f, { force: true })).length);
+  if (!hasIdOnlyUnique(db, table)) {
+    // No write lock on the common path: several processes open one home at once.
+    if (!stamped()) db.transaction(stamp).immediate();
+    return { migrated: false, swept: sweep() };
+  }
+  let backup = null;
+  if (!db.memory) {
+    backup = `${db.name}.pre-sender-unique-${Date.now()}-${process.pid}.bak`;
+    // VACUUM INTO fills an empty file it finds, so create it first with the
+    // live file's mode: a copy of a 0600 store must not be readable by others.
+    closeSync(openSync(backup, "wx", 0o600));
+    chmodSync(backup, statSync(db.name).mode & 0o777);
+    try { db.prepare("vacuum into ?").run(backup); }
+    catch (e) { removeBackup(backup); throw e; }
+  }
+  const tmp = `${table}__rekey`;
+  let result = null;
+  try {
+    result = db.transaction(() => {
+      // Another opener may have finished while this one was copying.
+      if (!hasIdOnlyUnique(db, table)) {
+        stamp();
+        return { migrated: false };
+      }
+      const cols = db.pragma(`table_info(${table})`).map((c) => `"${c.name}"`).join(", ");
+      const oldCounter = db.prepare("select seq from sqlite_sequence where name = ?").get(table)?.seq ?? 0;
+      db.exec(`create table ${tmp} (${columnsSql})`);
+      db.exec(`insert into ${tmp} (${cols}) select ${cols} from ${table}`);
+      db.exec(`drop table ${table}`);
+      db.exec(`alter table ${tmp} rename to ${table}`);
+      for (const sql of indexSql) db.exec(sql);
+      const { rows, maxSeq } = db.prepare(`select count(*) as rows, coalesce(max(seq), 0) as maxSeq from ${table}`).get();
+      const counter = Math.max(oldCounter, maxSeq);
+      // sqlite_sequence has no key on `name`, so "insert or replace" would add
+      // a second row. Delete, then insert the one row.
+      db.prepare("delete from sqlite_sequence where name = ?").run(table);
+      db.prepare("insert into sqlite_sequence (name, seq) values (?, ?)").run(table, counter);
+      stamp();
+      return { migrated: true, backup, rows, counter };
+    }).immediate();
+  } finally {
+    // `result` is null only if the rebuild threw: then a kept backup stays,
+    // and under secure delete this call's own copy still goes. Copies older
+    // runs left are swept below, on a start that gets this far.
+    if (backup && (!keepBackup || (result && !result.migrated))) {
+      removeBackup(backup);
+      if (result?.migrated) result.backup = null;
+    }
+  }
+  result.swept = sweep();
+  return result;
+}

package/src/vda/instruments.mjs

@@ -122,9 +122,12 @@ export function attestMessageDelivery({ claim: claimRaw, mailbox, mailboxOwner,
       });
     }
     // Full sight within the recipient's own inbox: absent = failed (§10.6 satisfied).
-    const row = mailbox.getInbound(claim.envelopeId);
+    // By (id, sender): the same id from another sender is another envelope,
+    // and must not stand in for (or hide) the claimed sender's.
+    const row = mailbox.getInbound(claim.envelopeId, claim.from);
     if (!row) {
-      return buildAttestation({ claim, verdict: "failed", reason: "not-in-recipient-inbox", coverage: coverageInbox, keychain });
+      const reason = mailbox.getInbound(claim.envelopeId) ? "sender-mismatch" : "not-in-recipient-inbox";
+      return buildAttestation({ claim, verdict: "failed", reason, coverage: coverageInbox, keychain });
     }
     if (row.sender !== claim.from) {
       return buildAttestation({ claim, verdict: "failed", reason: "sender-mismatch", coverage: coverageInbox, keychain });