Harden core trust boundaries and delivery reliability

[AndriGitDev]

Summary

Implemented hardening

• Enforce shared limits for encoded envelopes, courier bundles, fragments, deferred inboxes, direct and mailbox queues, connection counts, mailbox pages, and sneakernet receive work.
• Upgrade direct delivery to /komms/envelope/2 with explicit next-hop acceptance or refusal, avoiding false acceptance when input is malformed or local capacity is exhausted.
• Enforce one live writer per encrypted store and introduce the first atomic pairwise receive transition across ratchet state, history, replay state, receipt routing, and deferred-row acknowledgement.
• Replace destructive deferred-inbox reads with stable row identifiers, explicit acknowledgement, deduplication, expiry handling, and bounded storage quotas.
• Harden daemon RPC socket ownership and stale-socket recovery, and make mailbox polling bounded and fair across configured relays and tokens.
• Add regression coverage for malformed and oversized inputs, saturation, rollback, restart, duplicate handling, writer exclusion, socket ownership, and mailbox fairness.

Architecture and release discipline

• Establish founder-led nonprofit stewardship, contribution expectations, security intake, ownership, and an adoption-triggered path toward broader community maintenance.
• Define a canonical Alpha-to-stable evidence vocabulary and a prioritized P0/P1/P2 stabilization program.
• Correct public claims concerning storage metadata, deletion, first-contact admission, linked-device revocation, group authorship, mailbox custody, bootstrap defaults, platform qualification, and independent assurance.
• Record proposed pre-stable designs for offline-root device authority, opaque indexed storage, atomic protocol commits, recipient-authenticated groups, bounded first contact, capability-scoped discovery, leased mailboxes, and operator-minimized reference discovery.
• Preserve the everyday-user product direction: private communication that works reliably and falls back across replaceable transports.

Why

Reliable private messaging must remain predictable under crashes, restarts, full queues, malformed carrier input, competing processes, and unavailable infrastructure. The previous Alpha had several places where resource use was insufficiently bounded, next-hop acceptance could overstate what the receiver retained, and related durable protocol state was written in separate steps.

The public documentation also mixed implemented behavior, proposed designs, and stable-quality claims. This change makes the current capability and remaining security work explicit while retaining the broader product roadmap.

Compatibility and rollout

• Direct envelope negotiation moves to /komms/envelope/2; Alpha peers must run compatible versions.
• bundle_export is now fallible and rejects oversized bundles or entries.
• pending_push returns a stable sequence, and deferred processing uses pending_all plus explicit acknowledgement.
• A second writer opening the same store now fails with AlreadyOpen, including common path aliases.
• Direct acceptance means admission to a bounded in-memory queue, not durable endpoint custody.
• The implemented atomic receive slice currently covers ordinary retained pairwise text. Other send, handshake, receipt, attachment, ephemeral, call, and group transitions remain stabilization work.

Explicitly not introduced here

• No reference discovery deployment, durable mailbox service, or native-wake service.
• No claim that the current mailbox role survives restart or provides leased delivery.
• No claim that proposed ADRs are already implemented.
• No stable-release, production-readiness, independent-audit, metadata-free, anonymity, or remote-erasure claim.

Validation

• python3 scripts/check-release-version.py
• cargo fmt --all -- --check
• Patch whitespace validation
• Relative Markdown link validation
• Repository terminology validation
• cargo clippy --workspace --all-targets --all-features
• cargo test --workspace --all-features
• cargo build -p kult-protocol --no-default-features

The unchecked Rust gates should complete in pull-request CI before this draft is marked ready for review.