Merge pull request 'Release 2026.9.25' (#53) from bump/2026.9.25 into main

After #37, address fields on PostgreSQL are split into words as the
built-in index splits them, but language text (subject, body,
attachments) still goes straight to PostgreSQL's parser, which keeps a
URL, host, path or file name as tokens of its own:
"https://x.example/shipping-support/" becomes a url, a host and a
url_path, "invoice-2024.pdf" a file. So TEXT/BODY "shipping" missed
messages where the word appears only inside a link, while RocksDB and
the other built-in backends found them: 8 messages across a handful
of searches in the rehearsal.

On insert, language text is now indexed as it was, followed by the
word parts of each token that holds a URL separator (/ . @ : ? = & # _
% + ~ \), split with SpaceTokenizer as keyword_terms() splits addresses.
The parts go through the same text search configuration as the rest of
the text, so they are stemmed like the words around them. Plain words,
words that only carry punctuation ("end.", "(see") and hyphenated words
(the parser already splits those) add nothing, so text without links
is indexed exactly as before. Each part is added once per document.
On sample mail, the text vector of a short order notice with three
links grows from 546 to 716 bytes, a newsletter with 25 tracking links
from 5586 to 6430, and a plain letter not at all.

On search, a query word written as a URL, host, file or hyphenated word
also matches as its word parts, ORed with the query as written, so
"shipping-support" or "invoice-2024.pdf" match the new parts and
documents indexed before this change still match as they did.

Existing messages keep their old vectors until they are reindexed (the
reindexAccounts task); new and reindexed messages match at once.

store::search_tests gains test_url_word_search: five bodies, 19 body
searches for words found only in a URL path, query string, host or
file name, the tokens as written, plain words and non-matches, with the
same expected ids on every backend. It passes on RocksDB, SQLite,
MySQL and PostgreSQL; on main PostgreSQL fails at the first ("shipping"
finds [3], not [0, 3]). On PostgreSQL the suite then stops at the
account sort assertion (query.rs:689) exactly as it does on main.

.gitea/workflows/publish.yml

@@ -3,19 +3,39 @@
 # whether a person pushed it or weekly-release.yml created it through the
 # releases API.
 #
-# The image is multi-arch (linux/amd64, linux/arm64) as before, but built in
-# one buildx run on host1 instead of one native runner per architecture: the
-# Dockerfile's builder stage runs on the build platform and cross-compiles
-# with an aarch64 linker, so only the small final stage (apt, setcap) goes
-# through QEMU for arm64. No digest-joining job is needed.
+# The image is multi-arch (linux/amd64, linux/arm64), built by two jobs on
+# the image-build runner rather than one buildx run for both. The Dockerfile's
+# builder stage runs on the build platform and cross-compiles with an aarch64
+# linker, so only the small final stage (apt, setcap) goes through QEMU for
+# arm64 -- but two release builds (LTO, one codegen unit) side by side on one
+# machine each take twice as long. Production runs amd64, so amd64 goes first
+# and on its own:
+#   * publish-amd64 pushes :<version>-amd64 and :<version>, a plain amd64
+#     image, as soon as its build is done. A deploy can start from it.
+#   * publish-arm64 then builds arm64, pushes :<version>-arm64, and replaces
+#     :<version> with the two-platform index. :latest moves only here, so it
+#     never names an image without arm64.
+#
+# Both jobs use one BuildKit builder, `gitea-builder`, whose container
+# (buildx_buildkit_gitea-builder0) and state volume stay on the runner's host
+# between jobs: a job container's `buildx create` finds the existing container
+# and reuses it and its cache. The dependency build (`cargo chef cook`) is
+# keyed on the recipe, which only a dependency change alters, so a release
+# normally compiles just the workspace. Removing that container or its volume
+# costs the next release a cold build, nothing more. The planner and dependency
+# layers for the build platform are shared, so arm64 also reuses what amd64
+# just did where it can.
 #
 # Two guards before anything is pushed:
 #   * the tag must be v<brand_version!>. The version is a string in
 #     crates/types/src/branding.rs, not Cargo.toml, and the image is tagged
 #     with it, so a tag beside an unbumped macro would publish an image that
 #     reports a different version from its tag.
-#   * the tag must be on main, so an image never describes code that was never
-#     reviewed onto the default branch.
+#   * the tag must be on main or on a release/* branch, so an image never
+#     describes code that was never reviewed onto one of them. A release/*
+#     branch carries a hotfix: it starts at an earlier release tag, takes
+#     fixes through pull requests into it, and is tagged there, so production
+#     can get a fix without everything that has landed on main since.
 #
 # :latest moves with every published tag: tags are cut by the weekly release
 # (or by hand for a real release); there are no prerelease tags here.
@@ -57,12 +77,17 @@ jobs:
             echo "Refusing to publish an image that would report the wrong version." >&2
             exit 1
           fi
-          git merge-base --is-ancestor "$(git rev-parse "${TAG}^{commit}")" origin/main \
-            || { echo "$TAG is not on main" >&2; exit 1; }
+          commit="$(git rev-parse "${TAG}^{commit}")"
+          on=""
+          for ref in origin/main $(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/*'); do
+            if git merge-base --is-ancestor "$commit" "$ref"; then on="$ref"; break; fi
+          done
+          [ -n "$on" ] || { echo "$TAG is not on main or a release/* branch" >&2; exit 1; }
+          echo "$TAG is on $on"
           echo "version=$V" >> "$GITHUB_OUTPUT"
           echo "version $V"
 
-  publish:
+  publish-amd64:
     needs: [version]
     runs-on: docker
     container:
@@ -81,16 +106,15 @@ jobs:
           test -n "$REGISTRY" && test -n "$VERSION"
           test -n "$PACKAGE_TOKEN" || { echo "PACKAGE_TOKEN secret is not set on this repository" >&2; exit 1; }
           echo "$PACKAGE_TOKEN" | docker login -u jcoffey-dev --password-stdin "$REGISTRY"
-          docker run --privileged --rm tonistiigi/binfmt --install arm64
           docker buildx create --use --name gitea-builder --driver docker-container || docker buildx use gitea-builder
-      # Attestations off, as before: they add manifests of their own to the
-      # index, and the index should hold the two images and nothing else.
+      # Attestations off, as before: they add manifests of their own, and the
+      # index should hold the two images and nothing else.
       - run: |
           docker buildx build \
-            --platform linux/amd64,linux/arm64 \
+            --platform linux/amd64 \
             --provenance=false --sbom=false \
+            --tag "$IMAGE:$VERSION-amd64" \
             --tag "$IMAGE:$VERSION" \
-            --tag "$IMAGE:latest" \
             --push .
           docker buildx imagetools inspect "$IMAGE:$VERSION"
       # Gitea keeps a container package on its owner; linking it shows it on
@@ -103,11 +127,47 @@ jobs:
       - if: always()
         run: docker logout "$REGISTRY" || true
 
+  publish-arm64:
+    needs: [version, publish-amd64]
+    runs-on: docker
+    container:
+      image: docker:28-cli@sha256:625d9431a9f54c5a2bc90f24f0e1c3d55b1349fd857dd85035f98c2c9acbdd4d # 28-cli
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
+    env:
+      DOCKER_BUILDKIT: "1"
+      REGISTRY: ${{ vars.REGISTRY }}
+      IMAGE: ${{ vars.REGISTRY }}/${{ github.repository }}
+      VERSION: ${{ needs.version.outputs.version }}
+      PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
+    steps:
+      - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
+      - run: |
+          echo "$PACKAGE_TOKEN" | docker login -u jcoffey-dev --password-stdin "$REGISTRY"
+          docker run --privileged --rm tonistiigi/binfmt --install arm64
+          docker buildx create --use --name gitea-builder --driver docker-container || docker buildx use gitea-builder
+      # The index is built from the two per-architecture tags rather than from
+      # :<version>, which by now is the amd64 image and would be read as such.
+      - run: |
+          docker buildx build \
+            --platform linux/arm64 \
+            --provenance=false --sbom=false \
+            --tag "$IMAGE:$VERSION-arm64" \
+            --push .
+          docker buildx imagetools create \
+            --tag "$IMAGE:$VERSION" \
+            --tag "$IMAGE:latest" \
+            "$IMAGE:$VERSION-amd64" "$IMAGE:$VERSION-arm64"
+          docker buildx imagetools inspect "$IMAGE:$VERSION"
+      - if: always()
+        run: docker logout "$REGISTRY" || true
+
   # The weekly release creates its Release (and so the tag) first; a tag
   # pushed by hand has none. Either way the tag ends up with exactly one
-  # Release, created after the image exists so its pull instructions work.
+  # Release, created once the amd64 image exists so its pull instructions
+  # work; arm64 and the binaries follow.
   release:
-    needs: [version, publish]
+    needs: [version, publish-amd64]
     runs-on: light
     container:
       image: python:3.13-slim@sha256:8d9d0b8bcf6506481eae4907c18f5e3e7902e629f5f6d684f9e7c32e85e3ddf0 # 3.13-slim
@@ -131,7 +191,9 @@ jobs:
           except urllib.error.HTTPError as e:
               if e.code != 404: raise
           image = f"{os.environ['REGISTRY']}/{os.environ['REPO']}:{version}"
-          body = (f"Container image: `{image}` (linux/amd64, linux/arm64); also `:latest`.\n\n"
+          body = (f"Container image: `{image}` (linux/amd64, linux/arm64); also `:latest`. "
+                  "amd64 is published first; arm64 is added to the same tag when its build "
+                  "finishes, and `:latest` moves then.\n\n"
                   "Binaries for a host install are attached: `inbuxa-linux-amd64.tar.gz` and "
                   "`inbuxa-linux-arm64.tar.gz`, with `SHA256SUMS`. Each is the binary out of this "
                   "release's image for that architecture, so it is the same build. The image "
@@ -154,7 +216,7 @@ jobs:
   # `docker create` does not start anything, so pulling an arm64 image on an
   # amd64 runner and copying a file out of it needs no emulation.
   binaries:
-    needs: [version, publish, release]
+    needs: [version, publish-arm64, release]
     runs-on: docker
     container:
       image: docker:28-cli@sha256:625d9431a9f54c5a2bc90f24f0e1c3d55b1349fd857dd85035f98c2c9acbdd4d # 28-cli

crates/common/src/auth/rate_limit.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::auth::AccessToken;
@@ -18,6 +20,16 @@ impl Server {
         access_token: &AccessToken,
         addr: IpAddr,
     ) -> trc::Result<Option<InFlight>> {
+        // inbuxa: an account with unlimited requests passes both limits
+        // below anyway, so don't count its requests. The count is a write to
+        // one counter per account in the in-memory store, and concurrent
+        // requests from one account queue on that key (a row lock on SQL,
+        // conflict retries on RocksDB): in a cluster rehearsal ten parallel
+        // admin writes were accepted one after another, about 33 ms apart.
+        if access_token.has_permission(Permission::UnlimitedRequests) {
+            return Ok(None);
+        }
+
         let rate_reset = if let Some(rate) = &self.core.network.http.rate_authenticated {
             if self.is_ip_allowed(addr) {
                 None

crates/common/src/cache/reload.rs

@@ -7,26 +7,33 @@
  */
 
 use crate::{
-    Core, Server,
+    BuildServer, Core, Server,
     config::{
         server::{Listeners, tls::parse_certificates},
         storage::Storage,
         telemetry::Telemetry,
     },
-    ipc::{QueueEvent, RegistryChange},
+    ipc::{BroadcastEvent, QueueEvent, RegistryChange},
     network::security::{BlockedIps, IpWithTtl},
 };
 use ahash::AHashMap;
 use directory::Directories;
 use registry::{
     schema::{prelude::ObjectType, structs::BlockedIp},
-    types::error::{Error, Warning},
+    types::{
+        error::{Error, Warning},
+        id::ObjectId,
+    },
 };
 use std::sync::Arc;
 use store::{LookupStores, registry::bootstrap::Bootstrap, write::now};
 
 pub struct ReloadResult {
+    /// Errors that kept the reload from being applied.
     pub errors: Vec<Error>,
+    /// inbuxa: errors in objects that already failed when the running
+    /// settings were built; logged, but they don't refuse a reload.
+    pub known_errors: Vec<Error>,
     pub warnings: Vec<Warning>,
     pub replaced_core: bool,
 }
@@ -114,42 +121,66 @@ impl Server {
                     directories: directory.directories,
                 };
 
-                // Parse tracers
+                // inbuxa: upstream swapped the core only when the whole build
+                // was free of errors, while boot runs with whatever built. So one
+                // object that failed (a DNS lookup that timed out, say) refused
+                // every later reload, cluster-wide when the reload came from
+                // ReloadSettings, and the running settings went stale. Now a
+                // reload is refused only for errors in objects that built when
+                // the running settings were built: those would be lost by
+                // applying it. Objects that already failed then are missing
+                // from the running settings anyway, as at boot, so their
+                // errors are reported but don't hold the reload back.
                 let tracers = Telemetry::parse(&mut bootstrap, &storage).await;
+                let core = Box::pin(Core::parse(&mut bootstrap, storage)).await;
+                let mut servers = Listeners::parse(&mut bootstrap).await;
 
-                if bootstrap.errors.is_empty() {
-                    let core = Box::pin(Core::parse(&mut bootstrap, storage)).await;
+                if !self.has_new_build_errors(&bootstrap.errors) {
+                    servers
+                        .parse_tcp_acceptors(&mut bootstrap, self.inner.clone())
+                        .await;
 
-                    if bootstrap.errors.is_empty() {
-                        let mut servers = Listeners::parse(&mut bootstrap).await;
-                        servers
-                            .parse_tcp_acceptors(&mut bootstrap, self.inner.clone())
-                            .await;
+                    if !self.has_new_build_errors(&bootstrap.errors) {
+                        // Update core
+                        self.inner.shared_core.store(core.into());
 
-                        if bootstrap.errors.is_empty() {
-                            // Update core
-                            self.inner.shared_core.store(core.into());
+                        // Update tracers
+                        tracers.update();
 
-                            // Update tracers
+                        // Reload queue settings
+                        self.inner
+                            .ipc
+                            .queue_tx
+                            .send(QueueEvent::ReloadSettings)
+                            .await
+                            .ok();
 
-                            tracers.update();
+                        // inbuxa: the task manager reads the node's role on
+                        // every scan; scan now, so a role that gained task
+                        // types starts claiming them without waiting out the
+                        // refresh interval
+                        self.inner.ipc.task_tx.notify_one();
 
-                            // Reload queue settings
-                            self.inner
-                                .ipc
-                                .queue_tx
-                                .send(QueueEvent::ReloadSettings)
-                                .await
-                                .ok();
+                        self.record_build_errors(&bootstrap.errors);
 
-                            return Ok(ReloadResult {
-                                errors: bootstrap.errors,
-                                warnings: bootstrap.warnings,
-                                replaced_core: true,
-                            });
-                        }
+                        return Ok(ReloadResult {
+                            errors: Vec::new(),
+                            known_errors: bootstrap.errors,
+                            warnings: bootstrap.warnings,
+                            replaced_core: true,
+                        });
                     }
                 }
+
+                let (known_errors, errors) = std::mem::take(&mut bootstrap.errors)
+                    .into_iter()
+                    .partition(|error| self.is_known_build_error(error));
+                return Ok(ReloadResult {
+                    errors,
+                    known_errors,
+                    warnings: bootstrap.warnings,
+                    replaced_core: false,
+                });
             }
         }
 
@@ -163,7 +194,7 @@ impl ReloadResult {
     }
 
     pub fn log(&self) {
-        for error in &self.errors {
+        for error in self.errors.iter().chain(&self.known_errors) {
             error.log();
         }
         for warning in &self.warnings {
@@ -176,8 +207,353 @@ impl From<Bootstrap> for ReloadResult {
     fn from(bootstrap: Bootstrap) -> Self {
         Self {
             errors: bootstrap.errors,
+            known_errors: Vec::new(),
             warnings: bootstrap.warnings,
             replaced_core: false,
         }
     }
 }
+
+// inbuxa: which objects failed to build for the running settings
+impl Server {
+    /// Records the objects that failed to build for the settings now running.
+    pub fn record_build_errors(&self, errors: &[Error]) {
+        *self.inner.data.build_errors.lock() = errors.iter().filter_map(error_object).collect();
+    }
+
+    fn is_known_build_error(&self, error: &Error) -> bool {
+        error_object(error).is_some_and(|id| self.inner.data.build_errors.lock().contains(&id))
+    }
+
+    fn has_new_build_errors(&self, errors: &[Error]) -> bool {
+        errors.iter().any(|error| !self.is_known_build_error(error))
+    }
+}
+
+fn error_object(error: &Error) -> Option<ObjectId> {
+    match error {
+        Error::Validation { object_id, .. }
+        | Error::Build { object_id, .. }
+        | Error::NotFound { object_id } => Some(*object_id),
+        Error::Internal { object_id, .. } => *object_id,
+    }
+}
+
+// inbuxa: upstream applied a registry write to the running settings only on
+// an explicit x:Action ReloadSettings (Directory and Authentication aside), so
+// a new MtaDeliverySchedule, say, stayed unknown ("Queue strategy not found")
+// until someone reloaded. Writes to objects the settings are built from now
+// reload them, here and across the cluster, as ReloadSettings does.
+
+/// Coalesces the full reloads that registry writes trigger. A write waits
+/// for more writes before a reload starts (see [`WRITE_QUIET`]), then
+/// takes the result of the first reload that started after it was stored,
+/// so a burst of writes, or a request with many objects, costs one reload
+/// or two rather than one each.
+pub struct SettingsReloadGate {
+    requested: std::sync::atomic::AtomicU64,
+    reloads: std::sync::atomic::AtomicU64,
+    state: parking_lot::Mutex<SettingsReloadState>,
+    completed: tokio::sync::watch::Sender<u64>,
+}
+
+#[derive(Default)]
+struct SettingsReloadState {
+    /// A reload is waiting for writes to settle, or running.
+    scheduled: bool,
+    /// When the oldest write not yet covered by a reload was stored, and
+    /// the newest.
+    first_write: Option<std::time::Instant>,
+    last_write: Option<std::time::Instant>,
+    /// Recent reloads, oldest first: the last write each covered, and why
+    /// it was refused, if it was.
+    results: std::collections::VecDeque<(u64, Option<String>)>,
+}
+
+impl Default for SettingsReloadGate {
+    fn default() -> Self {
+        Self {
+            requested: Default::default(),
+            reloads: Default::default(),
+            state: Default::default(),
+            completed: tokio::sync::watch::Sender::new(0),
+        }
+    }
+}
+
+impl SettingsReloadGate {
+    /// How many full reloads registry writes have run.
+    pub fn reloads(&self) -> u64 {
+        self.reloads.load(std::sync::atomic::Ordering::Relaxed)
+    }
+}
+
+impl SettingsReloadState {
+    /// The result of the reload that covered write `ticket`, once it ran.
+    fn result_for(&self, ticket: u64) -> Option<Result<(), String>> {
+        self.results
+            .iter()
+            .find(|(covers, _)| *covers >= ticket)
+            .map(|(_, refused)| refused.clone().map_or(Ok(()), Err))
+    }
+}
+
+/// How long a full reload waits after the last registry write for another.
+/// Parallel requests reach the server tens of milliseconds apart (in a
+/// cluster rehearsal, ten x:<Object>/set requests sent at once arrived about
+/// 33 ms apart and each got a reload of its own), so the window is a little
+/// over twice that. A single write pays it once, on top of the reload.
+pub const WRITE_QUIET: std::time::Duration = std::time::Duration::from_millis(75);
+
+/// The longest a full reload waits after the first write it covers, so a
+/// steady stream of writes still reloads at least this often.
+pub const WRITE_MAX_WAIT: std::time::Duration = std::time::Duration::from_millis(250);
+
+/// How many past reload results a waiting write can look up.
+const RELOAD_RESULTS: usize = 64;
+
+/// The reload a write to `object` calls for: the object to reload, or None
+/// when the running settings don't hold that object (accounts, domains and
+/// other data read as needed, stores, which take a restart, and objects with
+/// reload actions of their own, such as applications). Blocked IPs have a
+/// reload of their own; allowed IPs take the full one.
+pub fn write_reload_target(object: ObjectType) -> Option<ObjectType> {
+    match object {
+        ObjectType::Certificate => Some(ObjectType::Certificate),
+        ObjectType::MemoryLookupKey
+        | ObjectType::MemoryLookupKeyValue
+        | ObjectType::HttpLookup
+        | ObjectType::StoreLookup => Some(ObjectType::StoreLookup),
+        ObjectType::BlockedIp => Some(ObjectType::BlockedIp),
+        // Allowed IPs are part of the core's security settings
+        // (Security::parse), which only a full reload rebuilds; the blocked-IP
+        // reload doesn't touch them
+        ObjectType::AllowedIp
+        | ObjectType::AcmeProvider
+        | ObjectType::AddressBook
+        | ObjectType::AiModel
+        | ObjectType::Asn
+        | ObjectType::Authentication
+        | ObjectType::Cache
+        | ObjectType::Calendar
+        | ObjectType::CalendarAlarm
+        | ObjectType::CalendarScheduling
+        | ObjectType::ClusterRole
+        | ObjectType::DataRetention
+        | ObjectType::Directory
+        | ObjectType::DkimReportSettings
+        | ObjectType::DmarcReportSettings
+        | ObjectType::DnsResolver
+        | ObjectType::DsnReportSettings
+        | ObjectType::Email
+        | ObjectType::EventTracingLevel
+        | ObjectType::FileStorage
+        | ObjectType::Http
+        | ObjectType::HttpForm
+        | ObjectType::Imap
+        | ObjectType::Jmap
+        | ObjectType::Metrics
+        | ObjectType::MtaConnectionStrategy
+        | ObjectType::MtaDeliverySchedule
+        | ObjectType::MtaExtensions
+        | ObjectType::MtaHook
+        | ObjectType::MtaInboundSession
+        | ObjectType::MtaInboundThrottle
+        | ObjectType::MtaMilter
+        | ObjectType::MtaOutboundStrategy
+        | ObjectType::MtaOutboundThrottle
+        | ObjectType::MtaQueueQuota
+        | ObjectType::MtaRoute
+        | ObjectType::MtaStageAuth
+        | ObjectType::MtaStageConnect
+        | ObjectType::MtaStageData
+        | ObjectType::MtaStageEhlo
+        | ObjectType::MtaStageMail
+        | ObjectType::MtaStageRcpt
+        | ObjectType::MtaSts
+        | ObjectType::MtaTlsStrategy
+        | ObjectType::MtaVirtualQueue
+        | ObjectType::NetworkListener
+        | ObjectType::OidcProvider
+        | ObjectType::ReportSettings
+        | ObjectType::Search
+        | ObjectType::Security
+        | ObjectType::SenderAuth
+        | ObjectType::Sharing
+        | ObjectType::SieveSystemInterpreter
+        | ObjectType::SieveSystemScript
+        | ObjectType::SieveUserInterpreter
+        | ObjectType::SieveUserScript
+        | ObjectType::SpamClassifier
+        | ObjectType::SpamDnsblServer
+        | ObjectType::SpamDnsblSettings
+        | ObjectType::SpamFileExtension
+        | ObjectType::SpamPyzor
+        | ObjectType::SpamRule
+        | ObjectType::SpamSettings
+        | ObjectType::SpamTag
+        | ObjectType::SpfReportSettings
+        | ObjectType::SystemSettings
+        | ObjectType::TaskManager
+        | ObjectType::TlsReportSettings
+        | ObjectType::Tracer
+        | ObjectType::WebDav
+        | ObjectType::WebHook => Some(object),
+        _ => None,
+    }
+}
+
+impl Server {
+    /// Applies a stored registry write to `object` to the running settings,
+    /// and on success tells the other nodes to do the same. Returns None when
+    /// the write needs no reload, Some(Ok(())) when it was applied, and
+    /// Some(Err(reason)) when the reload was refused (the write stays stored;
+    /// ReloadSettings reports the same errors).
+    pub async fn reload_after_write(&self, object: ObjectType) -> Option<Result<(), String>> {
+        let target = write_reload_target(object)?;
+        let change = RegistryChange::Reload(target);
+
+        if matches!(
+            target,
+            ObjectType::Certificate | ObjectType::StoreLookup | ObjectType::BlockedIp
+        ) {
+            // Cheap, and limited to their own objects
+            let result = self.reload_and_broadcast(change).await;
+            return Some(result);
+        }
+
+        // inbuxa: #39 joined only writes that queued behind a running
+        // reload; requests that arrive tens of milliseconds apart never
+        // overlapped one, so each got a reload of its own. The reload now
+        // waits until writes settle (WRITE_QUIET after the last one, at
+        // most WRITE_MAX_WAIT after the first) and covers them all. It runs
+        // in a task of its own, so a request that goes away doesn't take
+        // it with it; each write then takes the result of the reload that
+        // started after it was stored.
+        let gate = &self.inner.data.settings_reload;
+        let ticket = gate
+            .requested
+            .fetch_add(1, std::sync::atomic::Ordering::SeqCst)
+            + 1;
+        let now = std::time::Instant::now();
+        {
+            let mut state = gate.state.lock();
+            state.first_write.get_or_insert(now);
+            state.last_write = Some(now);
+        }
+
+        loop {
+            let mut completed = {
+                let mut state = gate.state.lock();
+                if let Some(result) = state.result_for(ticket) {
+                    return Some(result);
+                }
+                if !state.scheduled {
+                    state.scheduled = true;
+                    let server = self.clone();
+                    tokio::spawn(async move {
+                        server.run_write_reload(change).await;
+                    });
+                }
+                gate.completed.subscribe()
+            };
+            if completed.changed().await.is_err() {
+                return Some(Err("The settings reload was interrupted".to_string()));
+            }
+        }
+    }
+
+    /// Waits for registry writes to settle, then reloads the settings once
+    /// for all the writes stored so far.
+    async fn run_write_reload(&self, change: RegistryChange) {
+        let gate = &self.inner.data.settings_reload;
+        loop {
+            let deadline = {
+                let state = gate.state.lock();
+                let now = std::time::Instant::now();
+                let first = state.first_write.unwrap_or(now);
+                let last = state.last_write.unwrap_or(now);
+                (last + WRITE_QUIET).min(first + WRITE_MAX_WAIT)
+            };
+            if deadline <= std::time::Instant::now() {
+                break;
+            }
+            tokio::time::sleep_until(deadline.into()).await;
+        }
+
+        // Writes stored from here on wait for the next reload
+        let covers = {
+            let mut state = gate.state.lock();
+            state.first_write = None;
+            state.last_write = None;
+            gate.requested.load(std::sync::atomic::Ordering::SeqCst)
+        };
+        gate.reloads
+            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        let result = self.inner.build_server().reload_and_broadcast(change).await;
+
+        {
+            let mut state = gate.state.lock();
+            if state.results.len() == RELOAD_RESULTS {
+                state.results.pop_front();
+            }
+            state.results.push_back((covers, result.err()));
+            state.scheduled = false;
+        }
+        gate.completed.send_replace(covers);
+    }
+
+    async fn reload_and_broadcast(&self, change: RegistryChange) -> Result<(), String> {
+        match Box::pin(self.reload_registry(change)).await {
+            Ok(reload) if !reload.has_errors() => {
+                reload.log();
+                self.cluster_broadcast(BroadcastEvent::RegistryChange(change))
+                    .await;
+                Ok(())
+            }
+            Ok(reload) => {
+                reload.log();
+                let reason = describe_reload_errors(&reload.errors);
+                trc::event!(
+                    Registry(trc::RegistryEvent::BuildWarning),
+                    Details = "Settings didn't reload after a registry write",
+                    Reason = reason.clone(),
+                );
+                Err(reason)
+            }
+            Err(err) => {
+                let reason = err.to_string();
+                trc::error!(err.details("Failed to reload settings after a registry write"));
+                Err(reason)
+            }
+        }
+    }
+}
+
+/// inbuxa: a refused reload's errors in a sentence: the first one, naming its
+/// object, and how many more there are.
+pub fn describe_reload_errors(errors: &[Error]) -> String {
+    let mut description = match errors.first() {
+        Some(Error::Build { object_id, message }) => format!("{object_id}: {message}"),
+        Some(Error::Validation { object_id, errors }) => format!(
+            "{object_id}: {}",
+            errors
+                .iter()
+                .map(|err| err.to_string())
+                .collect::<Vec<_>>()
+                .join("; ")
+        ),
+        Some(Error::Internal {
+            object_id: Some(object_id),
+            error,
+        }) => format!("{object_id}: {error}"),
+        Some(Error::Internal { error, .. }) => error.to_string(),
+        Some(Error::NotFound { object_id }) => format!("{object_id} was not found"),
+        None => String::new(),
+    };
+    let more = errors.len().saturating_sub(1);
+    if more > 0 {
+        description.push_str(&format!(" ({more} more in the server log.)"));
+    }
+    description
+}

crates/common/src/config/inner.rs

@@ -93,9 +93,12 @@ impl Data {
             registry_id_gen: id_generator.clone(),
             span_id_gen: id_generator,
             queue_status: true.into(),
+            settings_reload: Default::default(),
+            store_health: Default::default(),
             applications,
             logos: Default::default(),
             smtp_connectors: TlsConnectors::try_new().failed("Failed to build TLS connectors"),
+            build_errors: Default::default(),
             asn_geo_data: Default::default(),
         }
     }
@@ -234,9 +237,12 @@ impl Default for Data {
             span_id_gen: Default::default(),
             registry_id_gen: Default::default(),
             queue_status: true.into(),
+            settings_reload: Default::default(),
+            store_health: Default::default(),
             applications: WebApplications::new(),
             logos: Default::default(),
             smtp_connectors: TlsConnectors::try_new().unwrap(),
+            build_errors: Default::default(),
             asn_geo_data: Default::default(),
             lookup_stores: Default::default(),
         }

crates/common/src/config/mailstore/spamfilter.rs

@@ -16,7 +16,6 @@ use mail_auth::common::resolver::ToReverseName;
 use nlp::classifier::model::{CcfhClassifier, FhClassifier};
 use registry::schema::{
     enums::{ExpressionVariable, ModelSize},
-    prelude::ObjectType,
     structs::{
         self, SpamDnsblServer, SpamDnsblSettings, SpamFileExtension, SpamPyzor, SpamRule,
         SpamSettings, SpamTag,
@@ -25,10 +24,10 @@ use registry::schema::{
 use sieve::SpamStatus;
 use std::{
     net::{IpAddr, SocketAddr},
-    time::Duration,
+    sync::Arc,
+    time::{Duration, Instant},
 };
 use store::registry::{RegistryObject, bootstrap::Bootstrap};
-use tokio::net::lookup_host;
 use utils::{cache::CacheItemWeight, glob::GlobMap};
 
 #[derive(rkyv::Archive, rkyv::Deserialize, rkyv::Serialize, Debug, Default)]
@@ -157,7 +156,11 @@ pub struct FtrlParameters {
 
 #[derive(Debug, Clone)]
 pub struct PyzorConfig {
-    pub address: SocketAddr,
+    // inbuxa: the server is resolved when a message is checked, not while the
+    // settings are built (see PyzorConfig::address)
+    pub host: String,
+    pub port: u16,
+    pub resolved: Arc<parking_lot::Mutex<Option<(SocketAddr, Instant)>>>,
     pub timeout: Duration,
     pub min_count: u64,
     pub min_wl_count: u64,
@@ -474,31 +477,15 @@ impl PyzorConfig {
             return None;
         }
 
-        let port = pyzor.port;
-        let host = pyzor.host;
-        let address = match lookup_host(format!("{host}:{port}"))
-            .await
-            .map(|mut a| a.next())
-        {
-            Ok(Some(address)) => address,
-            Ok(None) => {
-                bp.build_error(
-                    ObjectType::SpamPyzor.singleton(),
-                    "Invalid address: No addresses found.",
-                );
-                return None;
-            }
-            Err(err) => {
-                bp.build_error(
-                    ObjectType::SpamPyzor.singleton(),
-                    format!("Invalid address: {}", err),
-                );
-                return None;
-            }
-        };
-
+        // inbuxa: upstream resolved the host here and reported a failed lookup
+        // as a build error, so a DNS hiccup on one node refused every settings
+        // reload on it (and, from the node that ran ReloadSettings, across the
+        // cluster). The lookup now happens when a message is checked; a
+        // failure there is logged as a Pyzor error for that message.
         PyzorConfig {
-            address,
+            host: pyzor.host,
+            port: pyzor.port as u16,
+            resolved: Default::default(),
             timeout: pyzor.timeout.into_inner(),
             min_count: pyzor.block_count,
             min_wl_count: pyzor.allow_count,
@@ -508,6 +495,35 @@ impl PyzorConfig {
     }
 }
 
+// inbuxa: how long a resolved Pyzor address is reused
+const PYZOR_RESOLVE_TTL: Duration = Duration::from_secs(300);
+
+impl PyzorConfig {
+    /// The server's address: the host itself when it is an IP address,
+    /// otherwise the first address it resolves to, reused for five minutes.
+    pub async fn address(&self) -> std::io::Result<SocketAddr> {
+        if let Ok(ip) = self.host.parse::<IpAddr>() {
+            return Ok(SocketAddr::new(ip, self.port));
+        }
+        if let Some((address, resolved_at)) = *self.resolved.lock()
+            && resolved_at.elapsed() < PYZOR_RESOLVE_TTL
+        {
+            return Ok(address);
+        }
+        let address = tokio::net::lookup_host((self.host.as_str(), self.port))
+            .await?
+            .next()
+            .ok_or_else(|| {
+                std::io::Error::new(
+                    std::io::ErrorKind::NotFound,
+                    format!("{} has no addresses", self.host),
+                )
+            })?;
+        *self.resolved.lock() = Some((address, Instant::now()));
+        Ok(address)
+    }
+}
+
 impl ClassifierConfig {
     pub async fn parse(bp: &mut Bootstrap) -> Option<Self> {
         let classifier = bp.setting_infallible::<structs::SpamClassifier>().await;

crates/common/src/config/smtp/session.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use self::resolver::Policy;
@@ -22,7 +24,7 @@ use registry::schema::{
 };
 use smtp_proto::*;
 use std::{
-    net::{SocketAddr, ToSocketAddrs},
+    net::{IpAddr, SocketAddr},
     str::FromStr,
     time::Duration,
 };
@@ -384,19 +386,16 @@ impl SessionConfig {
                     Some(Milter {
                         enable: bp.compile_expr(id, &milter.ctx_enable()),
                         id,
-                        addrs: format!("{}:{}", milter.hostname, milter.port)
-                            .to_socket_addrs()
-                            .map_err(|err| {
-                                bp.build_error(
-                                    id,
-                                    format!(
-                                        "Unable to resolve milter hostname {}: {}",
-                                        milter.hostname, err
-                                    ),
-                                )
-                            })
-                            .ok()?
-                            .collect(),
+                        // inbuxa: upstream resolved the hostname here (a
+                        // blocking lookup) and made a failure a build error,
+                        // which refused the whole settings reload. An IP
+                        // address is kept as is; a name is resolved on each
+                        // connection (MilterClient::connect).
+                        addrs: milter
+                            .hostname
+                            .parse::<IpAddr>()
+                            .map(|ip| vec![SocketAddr::new(ip, milter.port as u16)])
+                            .unwrap_or_default(),
                         hostname: milter.hostname,
                         port: milter.port as u16,
                         timeout_connect: milter.timeout_connect.into_inner(),

crates/common/src/config/telemetry.rs

@@ -31,6 +31,10 @@ pub struct TelemetrySubscriber {
     pub interests: Interests,
     pub typ: TelemetrySubscriberType,
     pub lossy: bool,
+    /// inbuxa: a hash of the settings the running tracer is built from
+    /// (everything but its events, level and lossiness, which change in
+    /// place), so a reload can tell which tracers to start over.
+    pub settings: u64,
 }
 
 #[allow(clippy::large_enum_variant)]
@@ -167,6 +171,7 @@ impl Tracers {
             for tracer in bp.list_infallible::<Tracer>().await {
                 let id = tracer.id;
                 let tracer = tracer.object;
+                let settings = tracer_settings(&tracer);
                 let level;
                 let lossy;
                 let events;
@@ -379,6 +384,7 @@ impl Tracers {
                     interests: Default::default(),
                     lossy,
                     typ,
+                    settings,
                 };
 
                 // Parse disabled events
@@ -426,6 +432,7 @@ impl Tracers {
             for hook in bp.list_infallible::<WebHook>().await {
                 let id = hook.id;
                 let hook = hook.object;
+                let settings = webhook_settings(&hook);
 
                 if !hook.enable {
                     continue;
@@ -448,6 +455,7 @@ impl Tracers {
                     id: format!("w_{}", id.id()),
                     interests: Default::default(),
                     lossy: hook.lossy,
+                    settings,
                     typ: TelemetrySubscriberType::Webhook(WebhookTracer {
                         url: hook.url,
                         timeout: hook.timeout.into_inner(),
@@ -516,6 +524,8 @@ impl Tracers {
                         data: storage.data.clone(),
                     }),
                     lossy: true,
+                    // Stores take a restart
+                    settings: 0,
                 });
             }
 
@@ -541,6 +551,7 @@ impl Tracers {
                         buffered: true,
                     }),
                     lossy: false,
+                    settings: 0,
                 });
             }
         } else {
@@ -568,6 +579,7 @@ impl Tracers {
                     buffered: true,
                 }),
                 lossy: false,
+                settings: 0,
             });
         }
 
@@ -701,6 +713,42 @@ impl Metrics {
     }
 }
 
+// inbuxa: what a tracer is built from, less what changes in place
+macro_rules! in_place_reset {
+    ($tracer:expr) => {{
+        $tracer.enable = true;
+        $tracer.level = Default::default();
+        $tracer.lossy = false;
+        $tracer.events = Default::default();
+        $tracer.events_policy = Default::default();
+    }};
+}
+
+fn settings_hash(settings: &impl std::fmt::Debug) -> u64 {
+    use std::hash::{Hash, Hasher};
+    let mut hasher = std::collections::hash_map::DefaultHasher::new();
+    format!("{settings:?}").hash(&mut hasher);
+    hasher.finish()
+}
+
+fn tracer_settings(tracer: &Tracer) -> u64 {
+    let mut tracer = tracer.clone();
+    match &mut tracer {
+        Tracer::Log(tracer) => in_place_reset!(tracer),
+        Tracer::Stdout(tracer) => in_place_reset!(tracer),
+        Tracer::Journal(tracer) => in_place_reset!(tracer),
+        Tracer::OtelHttp(tracer) => in_place_reset!(tracer),
+        Tracer::OtelGrpc(tracer) => in_place_reset!(tracer),
+    }
+    settings_hash(&tracer)
+}
+
+fn webhook_settings(hook: &WebHook) -> u64 {
+    let mut hook = hook.clone();
+    in_place_reset!(hook);
+    settings_hash(&hook)
+}
+
 fn apply_events(
     event_types: impl IntoIterator<Item = EventType>,
     policy: EventPolicy,

crates/common/src/ipc.rs

@@ -345,8 +345,13 @@ pub struct TaskLocks {
 }
 
 impl TaskLocks {
-    /// How long a task lock lasts, in seconds, unless it is released first.
-    pub const DEFAULT_EXPIRY: u64 = 60 * 60;
+    /// How long a task lock lasts, in seconds, unless it is released first
+    /// or renewed. inbuxa: upstream held a lock for an hour, so a killed
+    /// node's tasks waited that long; the lock is now a five-minute lease
+    /// that the task manager renews every third of it while the task runs
+    /// (renew_task_locks), so a dead node's tasks run elsewhere within
+    /// minutes.
+    pub const DEFAULT_EXPIRY: u64 = 5 * 60;
 
     pub fn is_stopping(&self) -> bool {
         self.stopping.load(Ordering::Acquire)
@@ -370,6 +375,16 @@ impl TaskLocks {
         self.held.lock().len()
     }
 
+    /// inbuxa: the tasks this node holds, to renew their locks.
+    pub fn held_ids(&self) -> Vec<u64> {
+        self.held.lock().iter().copied().collect()
+    }
+
+    /// inbuxa: whether this node holds (and is running) the task.
+    pub fn is_held(&self, id: u64) -> bool {
+        self.held.lock().contains(&id)
+    }
+
     pub fn expiry(&self) -> u64 {
         self.expiry.load(Ordering::Relaxed)
     }

crates/common/src/lib.rs

@@ -161,11 +161,19 @@ pub struct Data {
     pub span_id_gen: SnowflakeIdGenerator,
     pub registry_id_gen: SnowflakeIdGenerator,
     pub queue_status: AtomicBool,
+    // inbuxa: coalesces the settings reloads registry writes trigger
+    pub settings_reload: cache::reload::SettingsReloadGate,
+    // inbuxa: the readiness probe's cached answer
+    pub store_health: storage::ready::StoreHealth,
 
     pub applications: WebApplications,
     pub logos: Mutex<AHashMap<Box<str>, LogoCache>>,
 
     pub smtp_connectors: TlsConnectors,
+
+    // inbuxa: the objects that failed to build when the running settings
+    // were built, at boot or by the last applied reload (see reload_registry)
+    pub build_errors: Mutex<AHashSet<registry::types::id::ObjectId>>,
 }
 
 #[derive(Clone)]

crates/common/src/manager/boot.rs

@@ -240,6 +240,9 @@ impl BootManager {
                     .parse_tcp_acceptors(&mut bootstrap, inner.clone())
                     .await;
 
+                // inbuxa: a reload isn't refused over objects that failed here
+                inner.build_server().record_build_errors(&bootstrap.errors);
+
                 BootManager {
                     inner,
                     bootstrap,

crates/common/src/storage/mod.rs

@@ -26,6 +26,7 @@ pub mod document;
 pub mod encryption;
 pub mod index;
 pub mod quota;
+pub mod ready; // inbuxa: readiness follows the data store
 pub mod state;
 pub mod transaction;
 

crates/common/src/storage/ready.rs

@@ -0,0 +1,83 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! Readiness that reflects the data store.
+//!
+//! /healthz/ready used to answer 200 whenever a data store was configured,
+//! so a load balancer kept sending traffic to a node through a database
+//! outage. It now reads one key from the data store, with a short time
+//! limit, and caches the answer for a couple of seconds so probes can't load
+//! the database. Liveness stays 200: restarting a node doesn't bring its
+//! database back, and an orchestrator that restarts on failed liveness would
+//! otherwise restart every node at once.
+
+use crate::Server;
+use parking_lot::Mutex;
+use std::{
+    sync::atomic::{AtomicBool, Ordering},
+    time::{Duration, Instant},
+};
+use store::{ValueKey, write::ValueClass};
+
+/// How long a probe's answer is reused.
+pub const READY_CACHE: Duration = Duration::from_secs(2);
+/// How long a probe waits for the data store.
+pub const READY_PROBE_TIMEOUT: Duration = Duration::from_secs(2);
+
+#[derive(Default)]
+pub struct StoreHealth {
+    last: Mutex<Option<(Instant, bool)>>,
+    probing: AtomicBool,
+}
+
+/// Clears the probing flag even when the request is dropped mid-probe.
+struct ProbeGuard<'x>(&'x AtomicBool);
+
+impl Drop for ProbeGuard<'_> {
+    fn drop(&mut self) {
+        self.0.store(false, Ordering::Release);
+    }
+}
+
+impl Server {
+    /// Whether the data store answers: a cached result younger than
+    /// READY_CACHE, or a fresh read bounded by READY_PROBE_TIMEOUT. While
+    /// one probe is running, other callers get the last answer.
+    pub async fn is_data_store_ready(&self) -> bool {
+        let store = &self.core.storage.data;
+        if store.is_none() {
+            return false;
+        }
+        let health = &self.inner.data.store_health;
+        let last = *health.last.lock();
+        if let Some((at, ready)) = last
+            && at.elapsed() < READY_CACHE
+        {
+            return ready;
+        }
+        if health.probing.swap(true, Ordering::AcqRel) {
+            return last.is_none_or(|(_, ready)| ready);
+        }
+        let _guard = ProbeGuard(&health.probing);
+
+        let ready = tokio::time::timeout(
+            READY_PROBE_TIMEOUT,
+            store.get_value::<u64>(ValueKey::from(ValueClass::Property(0))),
+        )
+        .await
+        .is_ok_and(|result| result.is_ok());
+        // Say so once per outage, not on every probe
+        if !ready && last.is_none_or(|(_, ready)| ready) {
+            trc::event!(
+                Store(trc::StoreEvent::UnexpectedError),
+                Details = "Readiness probe: the data store didn't answer",
+                Limit = READY_PROBE_TIMEOUT,
+            );
+        }
+        *health.last.lock() = Some((Instant::now(), ready));
+        ready
+    }
+}

crates/common/src/telemetry/mod.rs

@@ -14,15 +14,26 @@ pub mod webhooks;
 use tracers::log::spawn_log_tracer;
 use tracers::otel::spawn_otel_tracer;
 use tracers::stdout::spawn_console_tracer;
+use ahash::AHashMap;
+use parking_lot::Mutex;
 use trc::{Collector, ipc::subscriber::SubscriberBuilder};
 use webhooks::spawn_webhook_tracer;
 
 use crate::config::telemetry::{Telemetry, TelemetrySubscriberType};
 
+/// inbuxa: the tracers this server started, by subscriber id, with the
+/// settings each was built from. Live-tracing streams and other subscribers
+/// registered elsewhere aren't listed, so a reload leaves them running.
+static RUNNING_TRACERS: Mutex<Option<AHashMap<String, u64>>> = Mutex::new(None);
+
 impl Telemetry {
     pub fn enable(self) {
+        let mut running = RUNNING_TRACERS.lock();
+        let running = running.get_or_insert_with(AHashMap::new);
+
         // Spawn tracers
         for tracer in self.tracers.subscribers {
+            running.insert(tracer.id.clone(), tracer.settings);
             tracer.typ.spawn(
                 SubscriberBuilder::new(tracer.id)
                     .with_interests(tracer.interests)
@@ -37,25 +48,39 @@ impl Telemetry {
         Collector::reload();
     }
 
+    // inbuxa: upstream only refreshed the events, level and lossiness of a
+    // tracer that was already running, so a Log tracer moved to another
+    // path (or any tracer whose own settings changed) kept going as it was
+    // built until a restart, while the reload reported the change applied.
+    // A tracer whose settings changed is now started over: the new one is
+    // registered under the same id and the collector swaps it in at an
+    // event boundary, so no event is lost or written twice (see
+    // Update::RegisterSubscriber); the old one writes what it has queued
+    // and stops.
     pub fn update(self) {
+        let mut running = RUNNING_TRACERS.lock();
+        let running = running.get_or_insert_with(AHashMap::new);
+
         // Remove tracers that are no longer active
-        let active_subscribers = Collector::get_subscribers();
-        for subscribed_id in &active_subscribers {
-            if !self
+        running.retain(|id, _| {
+            let keep = self
                 .tracers
                 .subscribers
                 .iter()
-                .any(|tracer| tracer.id == *subscribed_id)
-            {
-                Collector::remove_subscriber(subscribed_id.clone());
+                .any(|tracer| tracer.id == *id);
+            if !keep {
+                Collector::remove_subscriber(id.clone());
             }
-        }
+            keep
+        });
 
-        // Activate new tracers or update existing ones
+        // Start new tracers, start over those whose settings changed and
+        // update the rest in place
         for tracer in self.tracers.subscribers {
-            if active_subscribers.contains(&tracer.id) {
+            if running.get(&tracer.id) == Some(&tracer.settings) {
                 Collector::update_subscriber(tracer.id, tracer.interests, tracer.lossy);
             } else {
+                running.insert(tracer.id.clone(), tracer.settings);
                 tracer.typ.spawn(
                     SubscriberBuilder::new(tracer.id)
                         .with_interests(tracer.interests)

crates/common/src/telemetry/tracers/log.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use std::{path::PathBuf, time::SystemTime};
@@ -15,9 +17,27 @@ use tokio::{
 };
 use trc::{TelemetryEvent, ipc::subscriber::SubscriberBuilder, serializers::text::FmtWriter};
 
+// inbuxa: when a Log tracer is started over on the same files (its rotation
+// or format changed), the new one waits for the old one to write what it
+// has queued, so their lines don't interleave. Keyed by path and prefix;
+// each entry is the last tracer's "done" signal, sent when it ends.
+type LogFileOwners = ahash::AHashMap<(String, String), tokio::sync::oneshot::Receiver<()>>;
+static LOG_FILE_OWNERS: parking_lot::Mutex<Option<LogFileOwners>> = parking_lot::Mutex::new(None);
+
 pub(crate) fn spawn_log_tracer(builder: SubscriberBuilder, settings: LogTracer) {
+    let (done_tx, done_rx) = tokio::sync::oneshot::channel::<()>();
+    let previous = LOG_FILE_OWNERS
+        .lock()
+        .get_or_insert_with(Default::default)
+        .insert((settings.path.clone(), settings.prefix.clone()), done_rx);
     let (_, mut rx) = builder.register();
     tokio::spawn(async move {
+        // Dropped when this tracer ends, however it ends
+        let _done = done_tx;
+        if let Some(previous) = previous {
+            let _ = previous.await;
+        }
+
         if let Some(writer) = settings.build_writer().await {
             let mut buf = FmtWriter::new(writer)
                 .with_ansi(settings.ansi)

crates/common/src/telemetry/tracers/otel.rs

@@ -47,6 +47,10 @@ pub(crate) fn spawn_otel_tracer(builder: SubscriberBuilder, mut otel: OtelTracer
         let mut pending_spans = Vec::new();
 
         let mut active_spans = AHashMap::new();
+        let mut closing = false;
+        let started = std::time::SystemTime::now()
+            .duration_since(std::time::SystemTime::UNIX_EPOCH)
+            .map_or(0, |d| d.as_secs());
 
         loop {
             // Wait for the next event or timeout
@@ -75,12 +79,26 @@ pub(crate) fn spawn_otel_tracer(builder: SubscriberBuilder, mut otel: OtelTracer
                                     events.iter().chain(std::iter::once(&event)),
                                     &instrumentation,
                                 ));
+                            } else if span.inner.timestamp < started {
+                                // inbuxa: a span that was open when this
+                                // tracer replaced another one (its settings
+                                // changed) is exported with its end event
+                                // rather than dropped
+                                pending_spans.push(build_span_data(
+                                    span,
+                                    &event,
+                                    std::iter::once(&event),
+                                    &instrumentation,
+                                ));
                             }
                         }
                     }
                 }
                 Ok(None) => {
-                    break;
+                    // inbuxa: the tracer was removed or replaced; export
+                    // what is pending now rather than drop it
+                    closing = true;
+                    next_delivery = Instant::now();
                 }
                 Err(_) => (),
             }
@@ -131,6 +149,9 @@ pub(crate) fn spawn_otel_tracer(builder: SubscriberBuilder, mut otel: OtelTracer
                     }
                 }
             }
+            if closing {
+                break;
+            }
             wakeup_time = next_retry.unwrap_or(LONG_1Y_SLUMBER);
         }
     });

crates/common/src/telemetry/webhooks/mod.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::{LONG_1Y_SLUMBER, config::telemetry::WebhookTracer};
@@ -25,6 +27,11 @@ use trc::{
 
 pub(crate) fn spawn_webhook_tracer(builder: SubscriberBuilder, settings: WebhookTracer) {
     let (tx, mut rx) = builder.register();
+    // inbuxa: failed deliveries come back through a weak sender, so the
+    // channel closes when the collector drops this webhook (removed, or
+    // replaced after a settings change) and the task ends; upstream held a
+    // sender here and the task outlived its subscription
+    let tx = tx.downgrade();
     tokio::spawn(async move {
         let settings = Arc::new(settings);
         let mut wakeup_time = LONG_1Y_SLUMBER;
@@ -58,6 +65,15 @@ pub(crate) fn spawn_webhook_tracer(builder: SubscriberBuilder, settings: Webhook
                     }
                 }
                 Ok(None) => {
+                    // inbuxa: deliver what is pending rather than drop it
+                    if !pending_events.is_empty() {
+                        spawn_webhook_handler(
+                            settings.clone(),
+                            in_flight.clone(),
+                            std::mem::take(&mut pending_events),
+                            tx.clone(),
+                        );
+                    }
                     break;
                 }
                 Err(_) => (),
@@ -102,7 +118,7 @@ fn spawn_webhook_handler(
     settings: Arc<WebhookTracer>,
     in_flight: Arc<AtomicBool>,
     events: EventBatch,
-    webhook_tx: mpsc::Sender<EventBatch>,
+    webhook_tx: mpsc::WeakSender<EventBatch>,
 ) {
     tokio::spawn(async move {
         in_flight.store(true, Ordering::Relaxed);
@@ -113,7 +129,11 @@ fn spawn_webhook_handler(
         if let Err(err) = post_webhook_events(&settings, &wrapper).await {
             trc::event!(Telemetry(TelemetryEvent::WebhookError), Details = err);
 
-            if webhook_tx.send(wrapper.events.into_inner()).await.is_err() {
+            let sent = match webhook_tx.upgrade() {
+                Some(webhook_tx) => webhook_tx.send(wrapper.events.into_inner()).await.is_ok(),
+                None => false,
+            };
+            if !sent {
                 trc::event!(
                     Server(ServerEvent::ThreadError),
                     Details = "Failed to send failed webhook events back to main thread",

crates/http/src/request.rs

@@ -553,8 +553,10 @@ impl ParseHttp for Server {
                         return Ok(JsonProblemResponse(StatusCode::OK).into_http_response());
                     }
                     "ready" => {
+                        // inbuxa: ready only while the data store answers
+                        // (a cached, time-limited read); liveness stays 200
                         return Ok(JsonProblemResponse({
-                            if !self.core.storage.data.is_none() {
+                            if self.is_data_store_ready().await {
                                 StatusCode::OK
                             } else {
                                 StatusCode::SERVICE_UNAVAILABLE

crates/jmap-proto/src/method/set.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use super::ahash_is_empty;
@@ -71,6 +73,23 @@ pub struct SetResponse<T: JmapObject> {
     #[serde(rename = "notDestroyed")]
     #[serde(skip_serializing_if = "VecMap::is_empty")]
     pub not_destroyed: VecMap<MaybeInvalid<Id>, SetError<T::Property>>,
+
+    // inbuxa: on a registry write that changes the running settings, whether
+    // the server applied it
+    #[serde(rename = "x:settingsReload")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub settings_reload: Option<SettingsReload>,
+}
+
+/// inbuxa: the settings reload that followed a registry write.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct SettingsReload {
+    /// The running settings (here and, through the cluster, on every node)
+    /// include the write.
+    pub applied: bool,
+    /// Why they don't, when they don't.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
 }
 
 impl<'de, T: JmapObject> DeserializeArguments<'de> for SetRequest<'de, T> {
@@ -199,6 +218,7 @@ impl<T: JmapObject> SetResponse<T> {
                 not_created: VecMap::new(),
                 not_updated: VecMap::new(),
                 not_destroyed: VecMap::new(),
+                settings_reload: None,
             })
         } else {
             Err(trc::JmapEvent::RequestTooLarge.into_err())

crates/jmap/src/registry/mapping/action.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::registry::mapping::{RegistrySetResponse, map_bootstrap_error};
@@ -99,7 +101,7 @@ pub(crate) async fn action_set(
                 } else {
                     set.response
                         .not_created
-                        .append(id, map_bootstrap_error(result.errors));
+                        .append(id, reload_refused(result.errors));
                 }
             }
             Action::InvalidateCaches => {
@@ -573,3 +575,14 @@ async fn dmarc_troubleshoot(
 
     Some(request)
 }
+
+/// inbuxa: a refused reload names the object that stopped it and says the
+/// settings weren't applied; upstream passed on the first error's bare message
+/// ("Invalid address: ..."), which read like a problem with the request.
+fn reload_refused(errors: Vec<registry::types::error::Error>) -> SetError<Property> {
+    let description = format!(
+        "Settings were not reloaded. {}",
+        common::cache::reload::describe_reload_errors(&errors)
+    );
+    map_bootstrap_error(errors).with_description(description)
+}

crates/jmap/src/registry/mapping/report.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::{
@@ -15,22 +17,42 @@ use jmap_proto::{error::set::SetError, types::state::State};
 use jmap_tools::{Key, Value};
 use registry::{
     jmap::IntoValue,
-    schema::prelude::{Object, ObjectInner, ObjectType, Property},
+    schema::{
+        prelude::{Object, ObjectInner, ObjectType, Property},
+        structs::Task,
+    },
     types::{EnumImpl, datetime::UTCDateTime},
 };
+use services::task_manager::lock::TaskLockManager;
 use smtp::reporting::index::{ExternalReportIndex, InternalReportIndex};
 use std::str::FromStr;
 use store::{
     U64_LEN, ValueKey,
     registry::{RegistryFilter, RegistryFilterValue, RegistryQuery},
-    write::{BatchBuilder, RegistryClass, ValueClass, key::KeySerializer},
+    write::{BatchBuilder, RegistryClass, TaskQueueClass, ValueClass, key::KeySerializer},
 };
 use trc::AddContext;
 use types::id::Id;
 
 pub(crate) async fn report_set(
-    mut set: RegistrySetResponse<'_>,
+    set: RegistrySetResponse<'_>,
 ) -> trc::Result<RegistrySetResponse<'_>> {
+    // inbuxa: task locks taken to reschedule reports are released however
+    // the request ends; a held lock is renewed, so a leaked one would keep
+    // the report's task from ever running
+    let server = set.server;
+    let mut locked_tasks = Vec::new();
+    let result = report_set_locked(set, &mut locked_tasks).await;
+    for task_id in locked_tasks {
+        server.remove_index_lock(task_id).await;
+    }
+    result
+}
+
+async fn report_set_locked<'x>(
+    mut set: RegistrySetResponse<'x>,
+    locked_tasks: &mut Vec<u64>,
+) -> trc::Result<RegistrySetResponse<'x>> {
     let object_id = set.object_type.to_id();
 
     // Reports cannot be created
@@ -89,12 +111,45 @@ pub(crate) async fn report_set(
                 .get_value::<Object>(ValueKey::from(key.clone()))
                 .await?
             {
+                // inbuxa: the report's task shares its id. Hold the task
+                // while its queue rows move, as x:Task/set does, and move the
+                // row the task is actually queued under
+                if !set.server.try_lock_task(item_id).await {
+                    set.response.not_updated.append(
+                        id,
+                        SetError::forbidden().with_description(
+                            "The report is being sent and cannot be rescheduled".to_string(),
+                        ),
+                    );
+                    continue;
+                }
+                locked_tasks.push(item_id);
+                let queued = set
+                    .server
+                    .store()
+                    .get_value::<Task>(ValueKey::from(ValueClass::TaskQueue(
+                        TaskQueueClass::Task { id: item_id },
+                    )))
+                    .await?;
+
                 match &mut report_obj.inner {
                     ObjectInner::DmarcInternalReport(report) => {
-                        report.reschedule_ops(&mut batch, item_id, report_obj.revision, deliver_at);
+                        report.reschedule_ops(
+                            &mut batch,
+                            item_id,
+                            report_obj.revision,
+                            deliver_at,
+                            queued.as_ref(),
+                        );
                     }
                     ObjectInner::TlsInternalReport(report) => {
-                        report.reschedule_ops(&mut batch, item_id, report_obj.revision, deliver_at);
+                        report.reschedule_ops(
+                            &mut batch,
+                            item_id,
+                            report_obj.revision,
+                            deliver_at,
+                            queued.as_ref(),
+                        );
                     }
                     _ => {}
                 }
@@ -156,6 +211,9 @@ pub(crate) async fn report_set(
             .write(batch.build_all())
             .await
             .caused_by(trc::location!())?;
+        // inbuxa: a rescheduled report may now be due sooner than the task
+        // manager's next scan
+        set.server.notify_task_queue();
     }
 
     Ok(set)

crates/jmap/src/registry/mapping/task.rs

@@ -463,15 +463,10 @@ pub(crate) async fn task_query(
                 .set_values(typ.is_some()),
             |key, value| {
                 if let Some(typ) = typ {
-                    let task_type =
-                        TaskType::from_id(value.deserialize_be_u16(0)?).ok_or_else(|| {
-                            trc::StoreEvent::DataCorruption
-                                .into_err()
-                                .ctx(trc::Key::Key, key.to_vec())
-                                .ctx(trc::Key::Value, value.to_vec())
-                                .caused_by(trc::location!())
-                        })?;
-                    if task_type != typ {
+                    // inbuxa: a row whose type can't be read matches no type
+                    // filter; the task manager logs and repairs it
+                    let task_type = value.deserialize_be_u16(0).ok().and_then(TaskType::from_id);
+                    if task_type != Some(typ) {
                         return Ok(true);
                     }
                 }

crates/jmap/src/registry/set.rs

@@ -38,7 +38,7 @@ use directory::core::secret::{hash_secret, is_password_hash};
 use http_proto::HttpSessionData;
 use jmap_proto::{
     error::set::{SetError, SetErrorType},
-    method::set::{SetRequest, SetResponse},
+    method::set::{SetRequest, SetResponse, SettingsReload},
     object::registry::Registry,
     references::resolve::ResolveCreatedReference,
     request::{IntoValid, MaybeInvalid},
@@ -931,30 +931,28 @@ impl RegistrySet for Server {
             }
         };
 
-        // inbuxa: DIR-17: a directory or the server default applies on the
-        // next request, here and on every node
-        if matches!(
-            object_type,
-            ObjectType::Directory | ObjectType::Authentication
-        ) && let Ok(response) = &result
+        // inbuxa: a write to an object the running settings are built from
+        // applies at once, here and on every node (DIR-17 did this for
+        // directories and the server default; now it covers every such object)
+        let mut result = result;
+        if let Ok(response) = &mut result
             && (!response.created.is_empty()
                 || !response.updated.is_empty()
                 || !response.destroyed.is_empty())
+            && let Some(reload) = self.reload_after_write(object_type).await
         {
-            let change = common::ipc::RegistryChange::Reload(ObjectType::Directory);
-            match Box::pin(self.reload_registry(change)).await {
-                Ok(reload) if !reload.has_errors() => {
-                    self.cluster_broadcast(common::ipc::BroadcastEvent::RegistryChange(change))
-                        .await;
-                }
-                Ok(_) => trc::event!(
-                    Registry(trc::RegistryEvent::BuildWarning),
-                    Details = "Settings didn't reload after a directory change",
-                ),
-                Err(err) => {
-                    trc::error!(err.details("Failed to reload directories"));
-                }
-            }
+            response.settings_reload = Some(match reload {
+                Ok(()) => SettingsReload {
+                    applied: true,
+                    description: None,
+                },
+                Err(reason) => SettingsReload {
+                    applied: false,
+                    description: Some(format!(
+                        "Saved, but the running settings were not reloaded. {reason}"
+                    )),
+                },
+            });
         }
         result
     }

crates/services/src/task_manager/lock.rs

@@ -82,3 +82,42 @@ pub async fn release_task_locks(server: &Server) -> usize {
     }
     ids.len()
 }
+
+/// inbuxa: renews the lease on every task this node is running, so it stays
+/// claimed for as long as it runs while a node that dies loses its claims
+/// within one lock lifetime. Returns how many leases were renewed and how
+/// many were found lost (expired, perhaps taken by another node).
+pub async fn renew_task_locks(server: &Server) -> (usize, usize) {
+    let locks = &server.inner.ipc.task_locks;
+    let expiry = locks.expiry();
+    let (mut renewed, mut lost) = (0, 0);
+    for id in locks.held_ids() {
+        match server
+            .in_memory_store()
+            .renew_lock(KV_LOCK_TASK, &id.to_be_bytes(), expiry)
+            .await
+        {
+            Ok(true) => renewed += 1,
+            Ok(false) => {
+                // Still held here as far as this node knows; the task
+                // finishes and its lock is removed as usual
+                if locks.is_held(id) {
+                    lost += 1;
+                    trc::event!(
+                        TaskManager(TaskManagerEvent::TaskLocked),
+                        Id = id,
+                        Details = "Task lock expired while the task was running",
+                    );
+                }
+            }
+            Err(err) => {
+                trc::error!(
+                    err.details("Failed to renew task lock")
+                        .ctx(trc::Key::Id, id)
+                        .caused_by(trc::location!())
+                );
+            }
+        }
+    }
+    (renewed, lost)
+}

crates/services/src/task_manager/manager.rs

@@ -13,7 +13,7 @@ use crate::task_manager::dkim::DkimManagementTask;
 use crate::task_manager::dns::DnsManagementTask;
 use crate::task_manager::imip::SendImipTask;
 use crate::task_manager::index::SearchIndexTask;
-use crate::task_manager::lock::TaskLockManager;
+use crate::task_manager::lock::{TaskLockManager, renew_task_locks};
 use crate::task_manager::maintenance::MaintenanceTask;
 use crate::task_manager::merge_threads::MergeThreadsTask;
 use crate::task_manager::report::{self, SubmitReportTask};
@@ -24,11 +24,13 @@ use crate::task_manager::{
     TaskJob, TaskManagerIpc, TaskResult,
 };
 use common::BuildServer;
+use common::config::network::ClusterRoles;
 use common::config::server::{DEFAULT_TLS_TIMEOUT, ServerProtocol};
 use common::network::limiter::ConcurrencyLimiter;
 use common::network::{ServerInstance, TcpAcceptor};
 use common::{Inner, Server};
 use registry::schema::enums::TaskType;
+use registry::schema::prelude::ObjectType;
 use registry::schema::structs::{
     Task, TaskManager, TaskRetryStrategy, TaskStatus, TaskStatusFailed, TaskStatusRetry,
 };
@@ -54,24 +56,37 @@ const PERPETUAL_RETRY_MIN_DELAY: u64 = 3600;
 const PERPETUAL_RETRY_MAX_DELAY: u64 = 21600;
 
 pub fn spawn_task_manager(inner: Arc<Inner>) {
-    let is_clustered = {
-        let server = inner.build_server();
-        let roles = &server.core.network.roles;
-
-        if !roles.account_maintenance
-            && !roles.store_maintenance
-            && !roles.search_indexing
-            && !roles.spam_training
-            && !roles.task_manager
-        {
-            return;
-        }
-
-        server.core.storage.coordinator.is_enabled()
-    };
+    // inbuxa: upstream didn't start the task manager on a node whose role
+    // had no task types at boot, so adding one later did nothing until a
+    // restart. It now always runs and reads the role on every scan and
+    // before every job (task_enabled), so a role change applies at the next
+    // settings reload.
+    let is_clustered = inner.build_server().core.storage.coordinator.is_enabled();
 
     trc::event!(TaskManager(TaskManagerEvent::ManagerStarted));
 
+    // inbuxa: keep the leases of running tasks alive, every third of a lock
+    // lifetime, until the node stops
+    {
+        let inner = inner.clone();
+        tokio::spawn(async move {
+            let mut renewed_at = Instant::now();
+            loop {
+                tokio::time::sleep(Duration::from_secs(1)).await;
+                let locks = &inner.ipc.task_locks;
+                if locks.is_stopping() {
+                    break;
+                }
+                if renewed_at.elapsed() >= Duration::from_secs((locks.expiry() / 3).max(1)) {
+                    renewed_at = Instant::now();
+                    if locks.held() > 0 {
+                        renew_task_locks(&inner.build_server()).await;
+                    }
+                }
+            }
+        });
+    }
+
     // Create dummy server instance for alarms
     let server_instance = Arc::new(ServerInstance {
         id: "_local".to_string(),
@@ -126,20 +141,23 @@ pub fn spawn_task_manager(inner: Arc<Inner>) {
                     let server = inner.build_server();
                     let batch_size = server.core.email.index_batch_size;
                     let mut batch = Vec::with_capacity(batch_size);
-                    if let Some(task) = fetch_task(&server, job).await {
+                    if let Some(task) = fetch_enabled_task(&server, job).await {
                         batch.push(task);
                     }
 
                     while batch.len() < batch_size {
                         match rx.try_recv() {
                             Ok(job) => {
-                                if let Some(task) = fetch_task(&server, job).await {
+                                if let Some(task) = fetch_enabled_task(&server, job).await {
                                     batch.push(task);
                                 }
                             }
                             Err(_) => break,
                         }
                     }
+                    if batch.is_empty() {
+                        continue;
+                    }
 
                     // Dispatch. inbuxa: on a task of its own, so a panic
                     // releases the batch's locks and leaves this worker
@@ -180,7 +198,8 @@ pub fn spawn_task_manager(inner: Arc<Inner>) {
                     let server = inner.build_server();
                     let mut refresh_queue = false;
 
-                    if let Some(TaskDetails { task, info }) = fetch_task(&server, job).await {
+                    if let Some(TaskDetails { task, info }) = fetch_enabled_task(&server, job).await
+                    {
                         // inbuxa: on a task of its own, as above
                         let run = {
                             let server = server.clone();
@@ -249,6 +268,17 @@ impl TaskQueueManager for Server {
         if task_locks.is_stopping() {
             return Duration::from_secs(QUEUE_REFRESH_INTERVAL);
         }
+        // inbuxa: with no task type enabled by this node's role there is
+        // nothing to claim; a settings reload wakes the manager when that
+        // changes
+        let roles = &self.core.network.roles;
+        if !(0..TaskType::COUNT as u16)
+            .filter_map(TaskType::from_id)
+            .any(|task_type| task_enabled(roles, task_type))
+        {
+            ipc.locked.clear();
+            return Duration::from_secs(QUEUE_REFRESH_INTERVAL);
+        }
         let lock_expiry = task_locks.expiry();
         let now_timestamp = now();
         let from_key = ValueKey::<ValueClass> {
@@ -269,9 +299,9 @@ impl TaskQueueManager for Server {
 
         // Retrieve tasks pending to be processed
         let mut tasks = Vec::new();
+        let mut unreadable = Vec::new();
         let now = Instant::now();
         let mut next_event = None;
-        let roles = &self.core.network.roles;
         ipc.revision += 1;
         let _ = self
             .store()
@@ -283,32 +313,28 @@ impl TaskQueueManager for Server {
                         let task_id = key.deserialize_be_u64(U64_LEN)?;
 
                         if task_due <= now_timestamp {
-                            let task_type_idx = value.deserialize_be_u16(0)?;
-                            let task_type = TaskType::from_id(task_type_idx).ok_or_else(|| {
-                                trc::StoreEvent::DataCorruption
-                                    .caused_by(trc::location!())
-                                    .ctx(trc::Key::Value, value)
-                            })?;
-                            let enabled = match task_type {
-                                TaskType::IndexDocument
-                                | TaskType::UnindexDocument
-                                | TaskType::IndexTrace => roles.search_indexing,
-                                TaskType::AccountMaintenance
-                                | TaskType::TenantMaintenance
-                                | TaskType::DestroyAccount => roles.account_maintenance,
-                                TaskType::StoreMaintenance => roles.store_maintenance,
-                                TaskType::SpamFilterMaintenance => roles.spam_training,
-                                TaskType::CalendarAlarmEmail
-                                | TaskType::CalendarAlarmNotification
-                                | TaskType::CalendarItipMessage
-                                | TaskType::MergeThreads
-                                | TaskType::DmarcReport
-                                | TaskType::TlsReport
-                                | TaskType::RestoreArchivedItem
-                                | TaskType::AcmeRenewal
-                                | TaskType::DkimManagement
-                                | TaskType::DnsManagement => true,
+                            // inbuxa: a row whose task type can't be read is
+                            // set aside, not allowed to end the scan: every
+                            // task due after it would wait behind it
+                            let Some((task_type_idx, task_type)) = value
+                                .deserialize_be_u16(0)
+                                .ok()
+                                .and_then(|idx| TaskType::from_id(idx).map(|typ| (idx, typ)))
+                            else {
+                                unreadable.push(UnreadableDueRow {
+                                    due: task_due,
+                                    id: task_id,
+                                    value: value.to_vec(),
+                                });
+                                return Ok(true);
                             };
+                            // inbuxa: running here under a lease this node
+                            // renews; don't hand it to a worker again
+                            if task_locks.is_held(task_id) {
+                                return Ok(true);
+                            }
+
+                            let enabled = task_enabled(roles, task_type);
 
                             if !enabled {
                                 trc::event!(
@@ -374,6 +400,11 @@ impl TaskQueueManager for Server {
                 );
             });
 
+        if !unreadable.is_empty() && repair_due_rows(self, unreadable).await {
+            // Look again at once for the rows that were rewritten
+            self.notify_task_queue();
+        }
+
         if !tasks.is_empty() {
             trc::event!(
                 TaskManager(TaskManagerEvent::TaskAcquired),
@@ -437,6 +468,48 @@ impl TaskQueueManager for Server {
     }
 }
 
+/// inbuxa: whether this node's cluster role lets it run a task type. Upstream
+/// checked the dedicated roles (search indexing, account and store
+/// maintenance, spam training) and let every node with a task manager run
+/// the rest, whatever its taskQueueProcessing setting. Every task type now
+/// answers to one ClusterTaskType:
+///
+/// - IndexDocument, UnindexDocument, IndexTrace: searchIndexing
+/// - AccountMaintenance, TenantMaintenance, DestroyAccount: accountMaintenance
+/// - StoreMaintenance: storeMaintenance
+/// - SpamFilterMaintenance: spamClassifierTraining
+/// - DmarcReport, TlsReport: outboundMta. They build and send reports to
+///   other domains (TLS reports can go straight to an HTTPS endpoint), which
+///   is the outbound MTA's business.
+/// - CalendarAlarmEmail, CalendarAlarmNotification, CalendarItipMessage,
+///   MergeThreads, RestoreArchivedItem, AcmeRenewal, DkimManagement,
+///   DnsManagement: taskQueueProcessing, the role for queue tasks with no
+///   role of their own.
+///
+/// A node that may not run a task leaves it unclaimed, so a node that may
+/// picks it up.
+pub fn task_enabled(roles: &ClusterRoles, task_type: TaskType) -> bool {
+    match task_type {
+        TaskType::IndexDocument | TaskType::UnindexDocument | TaskType::IndexTrace => {
+            roles.search_indexing
+        }
+        TaskType::AccountMaintenance | TaskType::TenantMaintenance | TaskType::DestroyAccount => {
+            roles.account_maintenance
+        }
+        TaskType::StoreMaintenance => roles.store_maintenance,
+        TaskType::SpamFilterMaintenance => roles.spam_training,
+        TaskType::DmarcReport | TaskType::TlsReport => roles.outbound_mta,
+        TaskType::CalendarAlarmEmail
+        | TaskType::CalendarAlarmNotification
+        | TaskType::CalendarItipMessage
+        | TaskType::MergeThreads
+        | TaskType::RestoreArchivedItem
+        | TaskType::AcmeRenewal
+        | TaskType::DkimManagement
+        | TaskType::DnsManagement => roles.task_manager,
+    }
+}
+
 async fn run_task(
     server: &Server,
     task: &Task,
@@ -490,6 +563,25 @@ async fn run_task(
     }
 }
 
+/// inbuxa: reads a claimed task when this node's role still allows its type.
+/// The role may have changed since the task was claimed (a settings reload in
+/// between); the claim is then handed back at once for a node that may run
+/// it, rather than held until the lease runs out.
+async fn fetch_enabled_task(server: &Server, job: TaskJob) -> Option<TaskDetails> {
+    if task_enabled(&server.core.network.roles, job.typ) {
+        fetch_task(server, job).await
+    } else {
+        trc::event!(
+            TaskManager(TaskManagerEvent::TaskIgnored),
+            Id = job.id,
+            Details = job.typ.as_str(),
+            Reason = "Task type was disabled by cluster roles after it was claimed.",
+        );
+        server.remove_index_lock(job.id).await;
+        None
+    }
+}
+
 /// Reads a claimed task. When it is gone or can't be read, the claim is
 /// released: inbuxa: holding it would block the task, everywhere, until
 /// the lock expired.
@@ -743,3 +835,114 @@ impl TaskResult {
         )
     }
 }
+
+/// inbuxa: a task queue row whose task type could not be read.
+struct UnreadableDueRow {
+    due: u64,
+    id: u64,
+    value: Vec<u8>,
+}
+
+/// inbuxa: logs each unreadable queue row and repairs it from the task it
+/// schedules. The task row says what the task is, so the queue row is
+/// rewritten with that task's type; a row with no task behind it is removed.
+///
+/// Rescheduling an internal DMARC or TLS report wrote the report's object
+/// type into the queue row instead of the task type. Such a row is the time
+/// an administrator chose, so the task is moved to it as the reschedule
+/// meant to do: the task row takes that due, and a queue row left at the
+/// task's previous due is removed. Returns whether any row was repaired.
+async fn repair_due_rows(server: &Server, rows: Vec<UnreadableDueRow>) -> bool {
+    let mut repaired = false;
+    for row in rows {
+        let UnreadableDueRow { due, id, value } = row;
+        trc::error!(
+            trc::StoreEvent::DataCorruption
+                .into_err()
+                .id(id)
+                .ctx(trc::Key::Due, trc::Value::Timestamp(due))
+                .ctx(
+                    trc::Key::Key,
+                    [due.to_be_bytes(), id.to_be_bytes()].concat()
+                )
+                .ctx(trc::Key::Value, value.clone())
+                .details("Unreadable task queue row skipped")
+                .caused_by(trc::location!())
+        );
+
+        let task_key = ValueClass::TaskQueue(TaskQueueClass::Task { id });
+        let due_key = ValueClass::TaskQueue(TaskQueueClass::Due { id, due });
+        let task = match server
+            .store()
+            .get_value::<Task>(ValueKey::from(task_key.clone()))
+            .await
+        {
+            Ok(task) => task,
+            Err(err) => {
+                trc::error!(
+                    err.id(id)
+                        .details("Failed to read the task of an unreadable queue row.")
+                        .caused_by(trc::location!())
+                );
+                continue;
+            }
+        };
+
+        let mut batch = BatchBuilder::new();
+        let action = if let Some(mut task) = task {
+            let task_type = task.object_type();
+            batch.assert_value(task_key.clone(), AssertValue::Some);
+            if rescheduled_report_type(&value) == Some(task_type) {
+                let old_due = task.due_timestamp();
+                if old_due != due {
+                    batch.clear(ValueClass::TaskQueue(TaskQueueClass::Due {
+                        id,
+                        due: old_due,
+                    }));
+                }
+                task.set_status(TaskStatus::at(due as i64));
+            }
+            batch
+                .set(due_key, task_type.to_id().serialize())
+                .set(task_key, task.to_pickled_vec());
+            "Rewrote the queue row from its task."
+        } else {
+            batch.clear(due_key);
+            "Removed a queue row with no task."
+        };
+
+        match server.store().write(batch.build_all()).await {
+            Ok(_) => {
+                repaired = true;
+                trc::event!(
+                    TaskManager(TaskManagerEvent::TaskIgnored),
+                    Id = id,
+                    Due = trc::Value::Timestamp(due),
+                    Reason = action,
+                );
+            }
+            Err(err) if err.matches(trc::EventType::Store(trc::StoreEvent::AssertValueFailed)) => {
+                // The task went away meanwhile; the next scan looks again
+            }
+            Err(err) => {
+                trc::error!(
+                    err.id(id)
+                        .details("Failed to repair an unreadable queue row.")
+                        .caused_by(trc::location!())
+                );
+            }
+        }
+    }
+    repaired
+}
+
+/// inbuxa: the task type a report reschedule meant, when a queue row holds
+/// an internal report's object type (the value that reschedule wrote).
+fn rescheduled_report_type(value: &[u8]) -> Option<TaskType> {
+    let id = u16::from_be_bytes(value.get(..2)?.try_into().ok()?);
+    match ObjectType::from_id(id)? {
+        ObjectType::DmarcInternalReport => Some(TaskType::DmarcReport),
+        ObjectType::TlsInternalReport => Some(TaskType::TlsReport),
+        _ => None,
+    }
+}

crates/smtp/src/inbound/milter/client.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use common::config::smtp::session::Milter;
@@ -25,7 +27,19 @@ impl MilterClient<TcpStream> {
     pub async fn connect(config: &Milter, session_id: u64) -> Result<Self> {
         tokio::time::timeout(config.timeout_command, async {
             let mut last_err = Error::Disconnected;
-            for addr in &config.addrs {
+            // inbuxa: a hostname is resolved here, per connection, rather
+            // than while the settings are built
+            let resolved;
+            let addrs = if config.addrs.is_empty() {
+                resolved = tokio::net::lookup_host((config.hostname.as_str(), config.port))
+                    .await
+                    .map_err(Error::Io)?
+                    .collect::<Vec<_>>();
+                &resolved
+            } else {
+                &config.addrs
+            };
+            for addr in addrs {
                 match TcpStream::connect(addr).await {
                     Ok(stream) => {
                         return Ok(MilterClient {

crates/smtp/src/lib.rs

@@ -44,7 +44,16 @@ impl StartQueueManager for BootManager {
 impl SpawnQueueManager for IpcReceivers {
     fn spawn_queue_manager(&mut self, inner: Arc<Inner>) {
         let core = inner.shared_core.load();
-        if !core.storage.registry.is_recovery_mode() && core.network.roles.outbound_mta {
+        // inbuxa: upstream started these only when the node's role included
+        // outboundMta at boot, so turning the role on later did nothing and
+        // turning it off left them delivering until a restart. They now run
+        // on every node: the queue follows the role live (see Queue::start),
+        // and the report scheduler records DMARC and TLS results on every
+        // node, whatever its role (see reporting/scheduler.rs). This also
+        // drains the queue channel on nodes
+        // without the role, where every queued message's refresh used to sit
+        // in a channel nobody read until it filled and queueing blocked.
+        if !core.storage.registry.is_recovery_mode() {
             // Spawn queue manager
             self.queue_rx.take().unwrap().spawn(inner.clone());
 

crates/smtp/src/queue/manager.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use super::{Message, QueueId, Status, spool::SmtpSpool};
@@ -39,6 +41,9 @@ pub struct Queue {
     pub urgent_refresh: bool,
     pub last_scan: Instant,
     pub last_full_scan: Instant,
+    /// inbuxa: whether this node's role included outboundMta when last
+    /// checked (None before the first check)
+    pub role_enabled: Option<bool>,
 }
 
 #[derive(Debug)]
@@ -67,6 +72,9 @@ impl SpawnQueue for mpsc::Receiver<QueueEvent> {
 const BACK_PRESSURE_WARN_INTERVAL: Duration = Duration::from_secs(60);
 const MIN_SCAN_INTERVAL: Duration = Duration::from_millis(100);
 const FULL_SCAN_INTERVAL: Duration = Duration::from_secs(QUEUE_REFRESH / 2);
+/// inbuxa: how often a node without the outbound MTA role looks at its role
+/// again when nothing else wakes it (a settings reload does)
+const ROLE_RECHECK_INTERVAL: Duration = Duration::from_secs(30);
 
 impl Queue {
     pub fn new(core: Arc<Inner>, rx: mpsc::Receiver<QueueEvent>) -> Self {
@@ -87,6 +95,7 @@ impl Queue {
             urgent_refresh: false,
             last_scan: now.checked_sub(MIN_SCAN_INTERVAL).unwrap_or(now),
             last_full_scan: now,
+            role_enabled: None,
         }
     }
 
@@ -123,6 +132,27 @@ impl Queue {
                 continue;
             }
 
+            // inbuxa: follow the node's role live. Without outboundMta the
+            // queue claims nothing new; deliveries already running finish
+            // and report back as usual, releasing their locks. When the role
+            // comes back, the whole queue is scanned at once.
+            let role_enabled = self.core.shared_core.load().network.roles.outbound_mta;
+            if self.role_enabled.replace(role_enabled) == Some(false) && role_enabled {
+                trc::event!(
+                    Queue(trc::QueueEvent::Started),
+                    Details = "This node's cluster role now includes outboundMta",
+                );
+                self.scan_from = 0;
+                self.pending_refresh = true;
+                self.urgent_refresh = true;
+            }
+            if !role_enabled {
+                self.pending_refresh = false;
+                self.urgent_refresh = false;
+                self.next_refresh = Instant::now() + ROLE_RECHECK_INTERVAL;
+                continue;
+            }
+
             self.pending_refresh |= refresh_queue;
             if !self.pending_refresh && self.next_refresh > Instant::now() {
                 continue;

crates/smtp/src/reporting/dmarc.rs

@@ -2,9 +2,12 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use super::AggregateTimestamp;
+use super::shared::{MAX_WRITE_RETRIES, Revisioned, write_retry_pause};
 use crate::{
     core::Session,
     queue::RecipientDomain,
@@ -349,29 +352,43 @@ impl DmarcReporting for Server {
         let object_id = ObjectType::DmarcInternalReport.to_id();
         let key = ValueClass::Registry(RegistryClass::Item { object_id, item_id });
 
-        let Some(report) = self
-            .store()
-            .get_value::<DmarcInternalReport>(ValueKey::from(key.clone()))
-            .await
-            .caused_by(trc::location!())?
-        else {
-            return Ok(());
-        };
+        // Delete report. inbuxa: only the version read here, so a record
+        // another node appends meanwhile is sent with it rather than lost
+        let mut attempt = 0;
+        let report = loop {
+            let Some(Revisioned {
+                revision,
+                value: report,
+            }) = self
+                .store()
+                .get_value::<Revisioned<DmarcInternalReport>>(ValueKey::from(key.clone()))
+                .await
+                .caused_by(trc::location!())?
+            else {
+                return Ok(());
+            };
 
-        // Delete report
-        let mut batch = BatchBuilder::new();
-        batch.clear(key).clear(RegistryClass::PrimaryKey {
-            object_id: object_id.into(),
-            index_id: Property::Domain.to_id(),
-            key: KeySerializer::new(report.domain.len() + U64_LEN)
-                .write(&report.domain)
-                .write(report.policy_identifier)
-                .finalize(),
-        });
-        self.store()
-            .write(batch.build_all())
-            .await
-            .caused_by(trc::location!())?;
+            let mut batch = BatchBuilder::new();
+            batch
+                .assert_value(key.clone(), AssertValue::Hash(revision))
+                .clear(key.clone())
+                .clear(RegistryClass::PrimaryKey {
+                    object_id: object_id.into(),
+                    index_id: Property::Domain.to_id(),
+                    key: KeySerializer::new(report.domain.len() + U64_LEN)
+                        .write(&report.domain)
+                        .write(report.policy_identifier)
+                        .finalize(),
+                });
+            match self.store().write(batch.build_all()).await {
+                Ok(_) => break report,
+                Err(err) if err.is_assertion_failure() && attempt < MAX_WRITE_RETRIES => {
+                    attempt += 1;
+                    write_retry_pause(attempt).await;
+                }
+                Err(err) => return Err(err.caused_by(trc::location!())),
+            }
+        };
 
         let span_id = self.inner.data.span_id_gen.generate();
         let event_from = report.report.date_range_begin.timestamp() as u64;
@@ -676,8 +693,11 @@ impl DmarcReporting for Server {
                     break;
                 }
                 Err(err) => {
-                    if err.is_assertion_failure() && rety_count < 3 {
+                    // inbuxa: another node appended first; try again
+                    // after a short pause
+                    if err.is_assertion_failure() && rety_count < MAX_WRITE_RETRIES {
                         rety_count += 1;
+                        write_retry_pause(rety_count).await;
                         continue;
                     }
                     trc::error!(

crates/smtp/src/reporting/index.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use registry::{
@@ -40,35 +42,49 @@ pub trait InternalReportIndex: ObjectImpl {
 
     fn primary_key(&self) -> ValueClass;
 
+    /// Moves the report's delivery, and its queued task, to `at`.
+    ///
+    /// inbuxa: the new queue row carries the task's type, as
+    /// `schedule_task_with_id` writes it, and the task row gets the new due
+    /// too. `queued` is the task as stored: its due, not the report's
+    /// `deliverAt`, is the queue row that exists (they differ once the task
+    /// has been retried).
     fn reschedule_ops(
         &mut self,
         batch: &mut BatchBuilder,
         item_id: u64,
         revision: u64,
         at: UTCDateTime,
+        queued: Option<&Task>,
     ) {
         let current_deliver_at = self.deliver_at();
+        let current_due = current_deliver_at.timestamp() as u64;
+        let queued_due = queued.map_or(current_due, |task| task.due_timestamp());
+        let new_due = at.timestamp() as u64;
 
-        if current_deliver_at != at {
+        if current_deliver_at != at || queued_due != new_due {
             let object = Self::OBJECT;
             let object_id = object.to_id();
             let key = ValueClass::Registry(RegistryClass::Item { object_id, item_id });
 
             self.set_deliver_at(at);
 
-            batch
-                .assert_value(key.clone(), AssertValue::Hash(revision))
-                .clear(ValueClass::TaskQueue(TaskQueueClass::Due {
+            batch.assert_value(key.clone(), AssertValue::Hash(revision));
+            if queued_due != new_due {
+                batch.clear(ValueClass::TaskQueue(TaskQueueClass::Due {
                     id: item_id,
-                    due: current_deliver_at.timestamp() as u64,
-                }))
-                .set(
-                    ValueClass::TaskQueue(TaskQueueClass::Due {
-                        id: item_id,
-                        due: at.timestamp() as u64,
-                    }),
-                    object_id.serialize(),
-                )
+                    due: queued_due,
+                }));
+            }
+            // A row an earlier reschedule left at the report's deliverAt
+            if current_due != new_due && current_due != queued_due {
+                batch.clear(ValueClass::TaskQueue(TaskQueueClass::Due {
+                    id: item_id,
+                    due: current_due,
+                }));
+            }
+            batch
+                .schedule_task_with_id(item_id, self.task(item_id))
                 .set(key, self.to_pickled_vec());
         }
     }

crates/smtp/src/reporting/mod.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use common::config::smtp::report::AggregateFrequency;
@@ -15,6 +17,7 @@ pub mod inbound;
 pub mod index;
 pub mod scheduler;
 pub mod send;
+pub mod shared; // inbuxa: reports written by every node
 pub mod spf;
 pub mod tls;
 

crates/smtp/src/reporting/scheduler.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use super::{dmarc::DmarcReporting, tls::TlsReporting};
@@ -18,6 +20,17 @@ impl SpawnReport for mpsc::Receiver<ReportingEvent> {
         tokio::spawn(async move {
             while let Some(event) = self.recv().await {
                 let server = inner.build_server();
+                // inbuxa: every node records what it received, whatever its
+                // role. An aggregate report covers all of a domain's mail,
+                // whichever node took it, and recording is a store write
+                // that nodes already share: the report's primary key is
+                // versioned, so concurrent appends from several nodes retry
+                // rather than overwrite. Only building and sending the
+                // report (the DmarcReport and TlsReport tasks) belongs to
+                // the outbound MTA; the task manager keeps those to nodes
+                // with that role. Upstream ran this only on outbound MTA
+                // nodes, so mail received anywhere else never reached a
+                // report.
                 match event {
                     ReportingEvent::Dmarc(event) => server.schedule_dmarc(event).await,
                     ReportingEvent::Tls(event) => server.schedule_tls(event).await,

crates/smtp/src/reporting/shared.rs

@@ -0,0 +1,45 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! inbuxa: internal DMARC and TLS reports are shared by every node. Any node
+//! that receives mail appends to them, so several nodes can write one report
+//! at once, and the node that sends it may do so while another is appending.
+//! Appends already guard the report's versioned primary key and retry when
+//! another writer got there first; these helpers give those retries room and
+//! let the sender delete exactly the report it read.
+
+use rand::RngExt;
+use std::time::Duration;
+use store::{Deserialize, xxhash_rust::xxh3::xxh3_64};
+
+/// How many times a report write that lost to another writer is retried.
+/// Upstream retried three times, when only outbound MTA nodes wrote.
+pub(crate) const MAX_WRITE_RETRIES: u32 = 10;
+
+/// A short random pause, longer on each attempt, before retrying a report
+/// write that lost to another node, so the writers spread out instead of
+/// colliding again.
+pub(crate) async fn write_retry_pause(attempt: u32) {
+    let ms = rand::rng().random_range(5..=25u64) * u64::from(attempt.max(1));
+    tokio::time::sleep(Duration::from_millis(ms)).await;
+}
+
+/// A stored value with the hash of the bytes it was read from, for
+/// `AssertValue::Hash`: a write asserting it fails if anyone changed the
+/// value since.
+pub(crate) struct Revisioned<T> {
+    pub revision: u64,
+    pub value: T,
+}
+
+impl<T: Deserialize> Deserialize for Revisioned<T> {
+    fn deserialize(bytes: &[u8]) -> trc::Result<Self> {
+        Ok(Revisioned {
+            revision: xxh3_64(bytes),
+            value: T::deserialize(bytes)?,
+        })
+    }
+}

crates/smtp/src/reporting/tls.rs

@@ -2,9 +2,12 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use super::AggregateTimestamp;
+use super::shared::{MAX_WRITE_RETRIES, Revisioned, write_retry_pause};
 use crate::{
     queue::RecipientDomain,
     reporting::{index::InternalReportIndex, send::MtaReportSend},
@@ -70,28 +73,40 @@ impl TlsReporting for Server {
         let object_id = ObjectType::TlsInternalReport.to_id();
         let key = ValueClass::Registry(RegistryClass::Item { object_id, item_id });
 
-        let Some(report) = self
-            .store()
-            .get_value::<TlsInternalReport>(ValueKey::from(key.clone()))
-            .await
-            .caused_by(trc::location!())?
-        else {
-            return Ok(());
-        };
+        // Delete report. inbuxa: only the version read here, so a result
+        // another node appends meanwhile is sent with it rather than lost
+        let mut attempt = 0;
+        let report = loop {
+            let Some(Revisioned {
+                revision,
+                value: report,
+            }) = self
+                .store()
+                .get_value::<Revisioned<TlsInternalReport>>(ValueKey::from(key.clone()))
+                .await
+                .caused_by(trc::location!())?
+            else {
+                return Ok(());
+            };
 
-        // Delete report
-        let mut batch = BatchBuilder::new();
-        batch.clear(key).clear(RegistryClass::PrimaryKey {
-            object_id: object_id.into(),
-            index_id: Property::Domain.to_id(),
-            key: report.domain.as_bytes().to_vec(),
-        });
-        self.core
-            .storage
-            .data
-            .write(batch.build_all())
-            .await
-            .caused_by(trc::location!())?;
+            let mut batch = BatchBuilder::new();
+            batch
+                .assert_value(key.clone(), AssertValue::Hash(revision))
+                .clear(key.clone())
+                .clear(RegistryClass::PrimaryKey {
+                    object_id: object_id.into(),
+                    index_id: Property::Domain.to_id(),
+                    key: report.domain.as_bytes().to_vec(),
+                });
+            match self.core.storage.data.write(batch.build_all()).await {
+                Ok(_) => break report,
+                Err(err) if err.is_assertion_failure() && attempt < MAX_WRITE_RETRIES => {
+                    attempt += 1;
+                    write_retry_pause(attempt).await;
+                }
+                Err(err) => return Err(err.caused_by(trc::location!())),
+            }
+        };
 
         let domain_name = report.domain.as_str();
         let event_from = report.report.date_range_start.timestamp() as u64;
@@ -477,8 +492,11 @@ impl TlsReporting for Server {
                     break;
                 }
                 Err(err) => {
-                    if err.is_assertion_failure() && rety_count < 3 {
+                    // inbuxa: another node appended first; try again
+                    // after a short pause
+                    if err.is_assertion_failure() && rety_count < MAX_WRITE_RETRIES {
                         rety_count += 1;
+                        write_retry_pause(rety_count).await;
                         continue;
                     }
                     trc::error!(

crates/spam-filter/src/modules/pyzor.rs

@@ -48,19 +48,24 @@ pub(crate) async fn pyzor_check(
     // Send message to address. inbuxa: in tests, a fixed table answers
     // instead of a public server (test_response).
     #[cfg(not(feature = "test_mode"))]
-    let response = pyzor_send_message(config.address, config.timeout, &request).await;
+    let response = match tokio::time::timeout(config.timeout, config.address()).await {
+        Ok(Ok(address)) => pyzor_send_message(address, config.timeout, &request).await,
+        Ok(Err(err)) => Err(err),
+        Err(_) => Err(std::io::Error::new(
+            std::io::ErrorKind::TimedOut,
+            "Timed out resolving the Pyzor server",
+        )),
+    };
     #[cfg(feature = "test_mode")]
     let response = std::io::Result::Ok(test_response(&request));
 
-    response
-        .map(Into::into)
-        .map_err(|err| {
-            trc::SpamEvent::PyzorError
-                .into_err()
-                .ctx(trc::Key::Url, config.address.to_string())
-                .reason(err)
-                .details("Pyzor failed")
-        })
+    response.map(Into::into).map_err(|err| {
+        trc::SpamEvent::PyzorError
+            .into_err()
+            .ctx(trc::Key::Url, format!("{}:{}", config.host, config.port))
+            .reason(err)
+            .details("Pyzor failed")
+    })
 }
 
 /// inbuxa: the answers tests get, by digest, instead of a public server's,

crates/store/src/backend/mod.rs

@@ -30,6 +30,9 @@ pub mod s3;
 pub mod sqlite;
 // inbuxa: scale-out storage (sharded stores)
 pub mod scaleout;
+// inbuxa: client-side SQL query limits
+#[cfg(any(feature = "postgres", feature = "mysql"))]
+pub mod query_timeout;
 
 
 pub const MAX_TOKEN_LENGTH: usize = (u8::MAX >> 1) as usize;

crates/store/src/backend/mysql/blob.rs

@@ -2,13 +2,15 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use std::ops::Range;
 
 use mysql_async::prelude::Queryable;
 
-use super::{MysqlStore, into_error};
+use super::{MysqlStore, bounded, into_error};
 
 impl MysqlStore {
     pub(crate) async fn get_blob(
@@ -16,49 +18,64 @@ impl MysqlStore {
         key: &[u8],
         range: Range<usize>,
     ) -> trc::Result<Option<Vec<u8>>> {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        let s = conn
-            .prep("SELECT v FROM t WHERE k = ?")
-            .await
-            .map_err(into_error)?;
-        conn.exec_first::<Vec<u8>, _, _>(&s, (key,))
-            .await
-            .map(|bytes| {
-                if range.start == 0 && range.end == usize::MAX {
-                    bytes
-                } else {
-                    bytes.map(|bytes| {
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prep("SELECT v FROM t WHERE k = ?")
+                .await
+                .map_err(into_error)?;
+            conn.exec_first::<Vec<u8>, _, _>(&s, (key,))
+                .await
+                .map(|bytes| {
+                    if range.start == 0 && range.end == usize::MAX {
                         bytes
-                            .get(range.start..std::cmp::min(bytes.len(), range.end))
-                            .unwrap_or_default()
-                            .to_vec()
-                    })
-                }
-            })
-            .map_err(into_error)
+                    } else {
+                        bytes.map(|bytes| {
+                            bytes
+                                .get(range.start..std::cmp::min(bytes.len(), range.end))
+                                .unwrap_or_default()
+                                .to_vec()
+                        })
+                    }
+                })
+                .map_err(into_error)
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn put_blob(&self, key: &[u8], data: &[u8]) -> trc::Result<()> {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        let s = conn
-            .prep("INSERT INTO t (k, v) VALUES (?, ?) ON DUPLICATE KEY UPDATE v = VALUES(v)")
-            .await
-            .map_err(into_error)?;
-        conn.exec_drop(&s, (key, data))
-            .await
-            .map_err(into_error)
-            .map(|_| ())
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prep("INSERT INTO t (k, v) VALUES (?, ?) ON DUPLICATE KEY UPDATE v = VALUES(v)")
+                .await
+                .map_err(into_error)?;
+            conn.exec_drop(&s, (key, data))
+                .await
+                .map_err(into_error)
+                .map(|_| ())
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn delete_blob(&self, key: &[u8]) -> trc::Result<bool> {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        let s = conn
-            .prep("DELETE FROM t WHERE k = ?")
-            .await
-            .map_err(into_error)?;
-        conn.exec_iter(&s, (key,))
-            .await
-            .map_err(into_error)
-            .map(|hits| hits.affected_rows() > 0)
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prep("DELETE FROM t WHERE k = ?")
+                .await
+                .map_err(into_error)?;
+            conn.exec_iter(&s, (key,))
+                .await
+                .map_err(into_error)
+                .map(|hits| hits.affected_rows() > 0)
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 }

crates/store/src/backend/mysql/lookup.rs

@@ -2,13 +2,15 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use mysql_async::{Params, Row, prelude::Queryable};
 
 use crate::{IntoRows, QueryResult, QueryType, Value};
 
-use super::{MysqlStore, into_error};
+use super::{MysqlStore, bounded, into_error};
 
 impl MysqlStore {
     pub(crate) async fn sql_query<T: QueryResult>(
@@ -16,28 +18,33 @@ impl MysqlStore {
         query: &str,
         params: &[Value<'_>],
     ) -> trc::Result<T> {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        let s = conn.prep(query).await.map_err(into_error)?;
-        let params = Params::Positional(params.iter().map(Into::into).collect());
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn.prep(query).await.map_err(into_error)?;
+            let params = Params::Positional(params.iter().map(Into::into).collect());
 
-        match T::query_type() {
-            QueryType::Execute => conn.exec_drop(s, params).await.map_or_else(
-                |e| Err(into_error(e)),
-                |_| Ok(T::from_exec(conn.affected_rows() as usize)),
-            ),
-            QueryType::Exists => conn
-                .exec_first::<Row, _, _>(s, params)
-                .await
-                .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_exists(r.is_some()))),
-            QueryType::QueryOne => conn
-                .exec_first::<Row, _, _>(s, params)
-                .await
-                .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_query_one(r))),
-            QueryType::QueryAll => conn
-                .exec::<Row, _, _>(s, params)
-                .await
-                .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_query_all(r))),
-        }
+            match T::query_type() {
+                QueryType::Execute => conn.exec_drop(s, params).await.map_or_else(
+                    |e| Err(into_error(e)),
+                    |_| Ok(T::from_exec(conn.affected_rows() as usize)),
+                ),
+                QueryType::Exists => conn
+                    .exec_first::<Row, _, _>(s, params)
+                    .await
+                    .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_exists(r.is_some()))),
+                QueryType::QueryOne => conn
+                    .exec_first::<Row, _, _>(s, params)
+                    .await
+                    .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_query_one(r))),
+                QueryType::QueryAll => conn
+                    .exec::<Row, _, _>(s, params)
+                    .await
+                    .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_query_all(r))),
+            }
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 }
 

crates/store/src/backend/mysql/main.rs

@@ -6,7 +6,7 @@
  * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use super::{MysqlStore, into_error};
+use super::{MysqlStore, bounded, into_error};
 use crate::{
     backend::mysql::MysqlSearchField,
     search::{
@@ -32,6 +32,9 @@ impl MysqlStore {
             .max_allowed_packet(config.max_allowed_packet.map(|v| v as usize))
             .wait_timeout(config.timeout.map(|t| t.as_secs() as usize))
             .client_found_rows(true)
+            // inbuxa: notice a server that went away without closing the
+            // connection in minutes, not the system default of two hours
+            .tcp_keepalive(Some(super::POOL_KEEPALIVE_IDLE))
             .tcp_port(config.port as u16);
 
         if config.use_tls {
@@ -69,6 +72,7 @@ impl MysqlStore {
                             .db_name(Some(replica.database.clone()))
                             .tcp_port(replica.port as u16),
                     ),
+                    timeouts: Default::default(),
                 })),
                 replica.host,
                 replica.port as u16,
@@ -78,6 +82,7 @@ impl MysqlStore {
 
         let primary = Store::MySQL(Arc::new(MysqlStore {
             conn_pool: Pool::new(opts),
+            timeouts: Default::default(),
         }));
 
         // ST-1: no replicas, no change
@@ -95,89 +100,97 @@ impl MysqlStore {
     }
 
     pub(crate) async fn create_storage_tables(&self) -> trc::Result<()> {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.maintenance;
+        let result = tokio::time::timeout(limit, async {
+            for table in [
+                SUBSPACE_ACL,
+                SUBSPACE_TASK_QUEUE,
+                SUBSPACE_DELETED_ITEMS,
+                SUBSPACE_SPAM_SAMPLES,
+                crate::SUBSPACE_INBUXA, // inbuxa: masked email
+                SUBSPACE_BLOB_LINK,
+                SUBSPACE_IN_MEMORY_VALUE,
+                SUBSPACE_PROPERTY,
+                SUBSPACE_REGISTRY,
+                SUBSPACE_REGISTRY_PK,
+                SUBSPACE_DIRECTORY,
+                SUBSPACE_QUEUE_MESSAGE,
+                SUBSPACE_QUEUE_EVENT,
+                SUBSPACE_REPORT_OUT,
+                SUBSPACE_REPORT_IN,
+                SUBSPACE_LOGS,
+                SUBSPACE_TELEMETRY_SPAN,
+                SUBSPACE_TELEMETRY_METRIC,
+            ] {
+                let table = char::from(table);
+                conn.query_drop(format!(
+                    "CREATE TABLE IF NOT EXISTS {table} (
+                        k VARBINARY(255) NOT NULL,
+                        v MEDIUMBLOB NOT NULL,
+                        PRIMARY KEY (k)
+                    ) ENGINE=InnoDB"
+                ))
+                .await
+                .map_err(into_error)?;
+            }
 
-        for table in [
-            SUBSPACE_ACL,
-            SUBSPACE_TASK_QUEUE,
-            SUBSPACE_DELETED_ITEMS,
-            SUBSPACE_SPAM_SAMPLES,
-            crate::SUBSPACE_INBUXA, // inbuxa: masked email
-            SUBSPACE_BLOB_LINK,
-            SUBSPACE_IN_MEMORY_VALUE,
-            SUBSPACE_PROPERTY,
-            SUBSPACE_REGISTRY,
-            SUBSPACE_REGISTRY_PK,
-            SUBSPACE_DIRECTORY,
-            SUBSPACE_QUEUE_MESSAGE,
-            SUBSPACE_QUEUE_EVENT,
-            SUBSPACE_REPORT_OUT,
-            SUBSPACE_REPORT_IN,
-            SUBSPACE_LOGS,
-            SUBSPACE_TELEMETRY_SPAN,
-            SUBSPACE_TELEMETRY_METRIC,
-        ] {
-            let table = char::from(table);
-            conn.query_drop(format!(
-                "CREATE TABLE IF NOT EXISTS {table} (
-                    k VARBINARY(255) NOT NULL,
-                    v MEDIUMBLOB NOT NULL,
-                    PRIMARY KEY (k)
-                ) ENGINE=InnoDB"
-            ))
-            .await
-            .map_err(into_error)?;
-        }
-
-        conn.query_drop(format!(
-            "CREATE TABLE IF NOT EXISTS {} (
-                k VARBINARY(255) NOT NULL,
-                v LONGBLOB NOT NULL,
-                PRIMARY KEY (k)
-            ) ENGINE=InnoDB",
-            char::from(SUBSPACE_BLOBS),
-        ))
-        .await
-        .map_err(into_error)?;
-
-        for table in [SUBSPACE_INDEXES, SUBSPACE_REGISTRY_IDX] {
-            let table = char::from(table);
-            conn.query_drop(format!(
-                "CREATE TABLE IF NOT EXISTS {table} (
-                    k BLOB,
-                    PRIMARY KEY (k(400))
-                ) ENGINE=InnoDB"
-            ))
-            .await
-            .map_err(into_error)?;
-        }
-
-        for table in [SUBSPACE_COUNTER, SUBSPACE_QUOTA, SUBSPACE_IN_MEMORY_COUNTER] {
             conn.query_drop(format!(
                 "CREATE TABLE IF NOT EXISTS {} (
-                k VARBINARY(255) NOT NULL,
-                v BIGINT NOT NULL DEFAULT 0,
-                PRIMARY KEY (k)
-            ) ENGINE=InnoDB",
-                char::from(table)
+                    k VARBINARY(255) NOT NULL,
+                    v LONGBLOB NOT NULL,
+                    PRIMARY KEY (k)
+                ) ENGINE=InnoDB",
+                char::from(SUBSPACE_BLOBS),
             ))
             .await
             .map_err(into_error)?;
-        }
 
-        Ok(())
+            for table in [SUBSPACE_INDEXES, SUBSPACE_REGISTRY_IDX] {
+                let table = char::from(table);
+                conn.query_drop(format!(
+                    "CREATE TABLE IF NOT EXISTS {table} (
+                        k BLOB,
+                        PRIMARY KEY (k(400))
+                    ) ENGINE=InnoDB"
+                ))
+                .await
+                .map_err(into_error)?;
+            }
+
+            for table in [SUBSPACE_COUNTER, SUBSPACE_QUOTA, SUBSPACE_IN_MEMORY_COUNTER] {
+                conn.query_drop(format!(
+                    "CREATE TABLE IF NOT EXISTS {} (
+                    k VARBINARY(255) NOT NULL,
+                    v BIGINT NOT NULL DEFAULT 0,
+                    PRIMARY KEY (k)
+                ) ENGINE=InnoDB",
+                    char::from(table)
+                ))
+                .await
+                .map_err(into_error)?;
+            }
+
+            Ok(())
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn create_search_tables(&self) -> trc::Result<()> {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.maintenance;
+        let result = tokio::time::timeout(limit, async {
+            create_search_tables::<EmailSearchField>(&mut conn).await?;
+            create_search_tables::<CalendarSearchField>(&mut conn).await?;
+            create_search_tables::<ContactSearchField>(&mut conn).await?;
+            //create_search_tables::<FileSearchField>(&mut conn).await?;
+            create_search_tables::<TracingSearchField>(&mut conn).await?;
 
-        create_search_tables::<EmailSearchField>(&mut conn).await?;
-        create_search_tables::<CalendarSearchField>(&mut conn).await?;
-        create_search_tables::<ContactSearchField>(&mut conn).await?;
-        //create_search_tables::<FileSearchField>(&mut conn).await?;
-        create_search_tables::<TracingSearchField>(&mut conn).await?;
-
-        Ok(())
+            Ok(())
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 }
 

crates/store/src/backend/mysql/mod.rs

@@ -6,6 +6,7 @@
  * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
+use crate::backend::query_timeout::QueryTimeouts;
 use crate::{
     search::{
         CalendarSearchField, ContactSearchField, EmailSearchField, FileSearchField, SearchField,
@@ -14,7 +15,7 @@ use crate::{
     write::SearchIndex,
 };
 use mysql_async::Pool;
-use std::fmt::Display;
+use std::{fmt::Display, time::Duration};
 
 pub mod blob;
 pub mod lookup;
@@ -25,6 +26,72 @@ pub mod write;
 
 pub struct MysqlStore {
     pub(crate) conn_pool: Pool,
+    /// inbuxa: client-side query limits (see backend::query_timeout)
+    pub(crate) timeouts: QueryTimeouts,
+}
+
+/// inbuxa: how long a request waits for a pooled connection (including
+/// opening one). mysql_async's pool has no wait timeout, so upstream waited
+/// forever when the server stopped answering.
+pub(crate) const POOL_WAIT_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30);
+/// inbuxa: idle time before TCP keepalive probes start.
+pub(crate) const POOL_KEEPALIVE_IDLE: std::time::Duration = std::time::Duration::from_secs(60);
+
+impl MysqlStore {
+    /// inbuxa: a pooled connection, or an error once POOL_WAIT_TIMEOUT has
+    /// passed without one.
+    pub(crate) async fn conn(&self) -> trc::Result<mysql_async::Conn> {
+        pool_conn(&self.conn_pool, POOL_WAIT_TIMEOUT).await
+    }
+}
+
+pub(crate) async fn pool_conn(
+    pool: &Pool,
+    wait: std::time::Duration,
+) -> trc::Result<mysql_async::Conn> {
+    match tokio::time::timeout(wait, pool.get_conn()).await {
+        Ok(result) => result.map_err(into_error),
+        Err(_) => Err(trc::StoreEvent::MysqlError
+            .reason("Timed out waiting for a database connection")
+            .details(format!("No connection within {} s", wait.as_secs()))),
+    }
+}
+
+/// inbuxa: the error for an operation that ran past its time limit.
+pub(crate) fn query_timeout_error(limit: Duration) -> trc::Error {
+    trc::StoreEvent::MysqlError
+        .reason("Query timed out")
+        .details(format!(
+            "No answer from the database within {} s",
+            limit.as_secs()
+        ))
+}
+
+/// inbuxa: ends an operation run on `conn` under `limit`. When it ran out,
+/// the connection is closed rather than returned to the pool: a query may
+/// still be in flight on it, or a transaction open. Conn::disconnect marks
+/// the connection closed before it sends anything, so even when the server
+/// doesn't answer and the attempt is dropped, the pool discards it instead
+/// of waiting to clean it up.
+pub(crate) fn bounded<T>(
+    conn: mysql_async::Conn,
+    result: Result<trc::Result<T>, tokio::time::error::Elapsed>,
+    limit: Duration,
+) -> trc::Result<T> {
+    match result {
+        Ok(result) => result,
+        Err(_) => {
+            discard(conn);
+            Err(query_timeout_error(limit))
+        }
+    }
+}
+
+/// inbuxa: closes a connection whose state is unknown (see bounded).
+pub(crate) fn discard(conn: mysql_async::Conn) {
+    tokio::spawn(async move {
+        let _ = tokio::time::timeout(Duration::from_secs(1), conn.disconnect()).await;
+    });
 }
 
 #[inline(always)]

crates/store/src/backend/mysql/read.rs

@@ -2,9 +2,11 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use super::{MysqlStore, into_error, is_timeout_error};
+use super::{MysqlStore, bounded, discard, into_error, is_timeout_error, query_timeout_error};
 use crate::{Deserialize, IterateParams, Key, ValueKey, write::ValueClass};
 use futures::TryStreamExt;
 use mysql_async::{Row, prelude::Queryable};
@@ -14,41 +16,51 @@ impl MysqlStore {
     where
         U: Deserialize + 'static,
     {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        let s = conn
-            .prep(format!(
-                "SELECT v FROM {} WHERE k = ?",
-                char::from(key.subspace())
-            ))
-            .await
-            .map_err(into_error)?;
-        let key = key.serialize(0);
-        conn.exec_first::<Vec<u8>, _, _>(&s, (&key,))
-            .await
-            .map_err(into_error)
-            .and_then(|r| {
-                if let Some(r) = r {
-                    Ok(Some(U::deserialize_owned_with_key(&key, r)?))
-                } else {
-                    Ok(None)
-                }
-            })
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prep(format!(
+                    "SELECT v FROM {} WHERE k = ?",
+                    char::from(key.subspace())
+                ))
+                .await
+                .map_err(into_error)?;
+            let key = key.serialize(0);
+            conn.exec_first::<Vec<u8>, _, _>(&s, (&key,))
+                .await
+                .map_err(into_error)
+                .and_then(|r| {
+                    if let Some(r) = r {
+                        Ok(Some(U::deserialize_owned_with_key(&key, r)?))
+                    } else {
+                        Ok(None)
+                    }
+                })
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn key_exists(&self, key: impl Key) -> trc::Result<bool> {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        let s = conn
-            .prep(format!(
-                "SELECT 1 FROM {} WHERE k = ?",
-                char::from(key.subspace())
-            ))
-            .await
-            .map_err(into_error)?;
-        let key = key.serialize(0);
-        conn.exec_first::<u8, _, _>(&s, (&key,))
-            .await
-            .map_err(into_error)
-            .map(|r| r.is_some())
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prep(format!(
+                    "SELECT 1 FROM {} WHERE k = ?",
+                    char::from(key.subspace())
+                ))
+                .await
+                .map_err(into_error)?;
+            let key = key.serialize(0);
+            conn.exec_first::<u8, _, _>(&s, (&key,))
+                .await
+                .map_err(into_error)
+                .map(|r| r.is_some())
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn iterate<T: Key>(
@@ -56,34 +68,42 @@ impl MysqlStore {
         params: IterateParams<T>,
         mut cb: impl for<'x> FnMut(&'x [u8], &'x [u8]) -> trc::Result<bool> + Sync + Send,
     ) -> trc::Result<()> {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
+        let mut conn = self.conn().await?;
         let table = char::from(params.begin.subspace());
         let begin = params.begin.serialize(0);
         let end = params.end.serialize(0);
         let keys = if params.values { "k, v" } else { "k" };
 
-        let s = conn
-            .prep(&match (params.first, params.ascending) {
-                (true, true) => {
-                    format!(
-                        "SELECT {keys} FROM {table} WHERE k >= ? AND k <= ? ORDER BY k ASC LIMIT 1"
-                    )
-                }
-                (true, false) => {
-                    format!(
-                        "SELECT {keys} FROM {table} WHERE k >= ? AND k <= ? ORDER BY k DESC LIMIT 1"
-                    )
-                }
-                (false, true) => {
-                    format!("SELECT {keys} FROM {table} WHERE k >= ? AND k <= ? ORDER BY k ASC")
-                }
-                (false, false) => {
-                    format!("SELECT {keys} FROM {table} WHERE k >= ? AND k <= ? ORDER BY k DESC")
-                }
-            })
-            .await
-            .map_err(into_error)?;
+        // inbuxa: a scan may run for hours, so the query limit bounds each
+        // wait for the database (preparing, the query starting, the next
+        // row) rather than the scan. A wait that runs out closes the
+        // connection.
+        let limit = self.timeouts.query;
+        let query = match (params.first, params.ascending) {
+            (true, true) => {
+                format!("SELECT {keys} FROM {table} WHERE k >= ? AND k <= ? ORDER BY k ASC LIMIT 1")
+            }
+            (true, false) => {
+                format!(
+                    "SELECT {keys} FROM {table} WHERE k >= ? AND k <= ? ORDER BY k DESC LIMIT 1"
+                )
+            }
+            (false, true) => {
+                format!("SELECT {keys} FROM {table} WHERE k >= ? AND k <= ? ORDER BY k ASC")
+            }
+            (false, false) => {
+                format!("SELECT {keys} FROM {table} WHERE k >= ? AND k <= ? ORDER BY k DESC")
+            }
+        };
+        let s = match tokio::time::timeout(limit, conn.prep(&query)).await {
+            Ok(s) => s.map_err(into_error)?,
+            Err(_) => {
+                discard(conn);
+                return Err(query_timeout_error(limit));
+            }
+        };
         let mut from = begin;
+        let mut stalled = false;
         let mut to = end;
         let mut resume_key = None;
 
@@ -92,13 +112,26 @@ impl MysqlStore {
             let mut timed_out = false;
 
             {
-                let mut rows = conn
-                    .exec_stream::<Row, _, _>(&s, (from.clone(), to.clone()))
-                    .await
-                    .map_err(into_error)?;
+                let mut rows = match tokio::time::timeout(
+                    limit,
+                    conn.exec_stream::<Row, _, _>(&s, (from.clone(), to.clone())),
+                )
+                .await
+                {
+                    Ok(rows) => rows.map_err(into_error)?,
+                    // Leaves the scan loop for the timeout below
+                    Err(_) => break,
+                };
 
                 loop {
-                    match rows.try_next().await {
+                    let next = match tokio::time::timeout(limit, rows.try_next()).await {
+                        Ok(next) => next,
+                        Err(_) => {
+                            stalled = true;
+                            break;
+                        }
+                    };
+                    match next {
                         Ok(Some(mut row)) => {
                             let value = if params.values {
                                 row.take_opt::<Vec<u8>, _>(1)
@@ -134,6 +167,10 @@ impl MysqlStore {
                 }
             }
 
+            if stalled {
+                break;
+            }
+
             match last_key {
                 Some(last_key) if timed_out => {
                     if params.ascending {
@@ -146,6 +183,9 @@ impl MysqlStore {
                 _ => return Ok(()),
             }
         }
+
+        discard(conn);
+        Err(query_timeout_error(limit))
     }
 
     pub(crate) async fn get_counter(
@@ -155,15 +195,20 @@ impl MysqlStore {
         let key = key.into();
         let table = char::from(key.subspace());
         let key = key.serialize(0);
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        let s = conn
-            .prep(format!("SELECT v FROM {table} WHERE k = ?"))
-            .await
-            .map_err(into_error)?;
-        match conn.exec_first::<i64, _, _>(&s, (key,)).await {
-            Ok(Some(num)) => Ok(num),
-            Ok(None) => Ok(0),
-            Err(e) => Err(into_error(e)),
-        }
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prep(format!("SELECT v FROM {table} WHERE k = ?"))
+                .await
+                .map_err(into_error)?;
+            match conn.exec_first::<i64, _, _>(&s, (key,)).await {
+                Ok(Some(num)) => Ok(num),
+                Ok(None) => Ok(0),
+                Err(e) => Err(into_error(e)),
+            }
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 }

crates/store/src/backend/mysql/search.rs

@@ -2,14 +2,16 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::{
     backend::{
         MAX_TOKEN_LENGTH,
         mysql::{
-            DELETE_CHUNK_SIZE, MIN_DELETE_CHUNK_SIZE, MysqlSearchField, MysqlStore, into_error,
-            is_timeout_error,
+            DELETE_CHUNK_SIZE, MIN_DELETE_CHUNK_SIZE, MysqlSearchField, MysqlStore, bounded,
+            into_error, is_timeout_error,
         },
     },
     search::{
@@ -19,63 +21,68 @@ use crate::{
     write::SearchIndex,
 };
 use mysql_async::{IsolationLevel, TxOpts, Value, prelude::Queryable};
-use nlp::tokenizers::word::WordTokenizer;
+use nlp::{language::Language, tokenizers::word::WordTokenizer};
 use std::fmt::Write;
 
 impl MysqlStore {
     pub async fn index(&self, documents: Vec<IndexDocument>) -> trc::Result<()> {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        let mut tx_opts = TxOpts::default();
-        tx_opts
-            .with_consistent_snapshot(false)
-            .with_isolation_level(IsolationLevel::ReadCommitted);
-        let mut trx = conn.start_transaction(tx_opts).await.map_err(into_error)?;
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let mut tx_opts = TxOpts::default();
+            tx_opts
+                .with_consistent_snapshot(false)
+                .with_isolation_level(IsolationLevel::ReadCommitted);
+            let mut trx = conn.start_transaction(tx_opts).await.map_err(into_error)?;
 
-        for document in documents {
-            let index = document.index;
-            let primary_keys = index.primary_keys();
-            let all_fields = index.all_fields();
-            let mut fields = document.fields;
-            let mut values = Vec::with_capacity(fields.len() + 2);
-            let mut query = format!("INSERT INTO {} (", index.mysql_table());
+            for document in documents {
+                let index = document.index;
+                let primary_keys = index.primary_keys();
+                let all_fields = index.all_fields();
+                let mut fields = document.fields;
+                let mut values = Vec::with_capacity(fields.len() + 2);
+                let mut query = format!("INSERT INTO {} (", index.mysql_table());
 
-            for (i, field) in primary_keys.iter().chain(all_fields).enumerate() {
-                if i > 0 {
-                    query.push(',');
+                for (i, field) in primary_keys.iter().chain(all_fields).enumerate() {
+                    if i > 0 {
+                        query.push(',');
+                    }
+                    query.push_str(field.column());
                 }
-                query.push_str(field.column());
+
+                query.push_str(") VALUES (");
+
+                for (i, field) in primary_keys.iter().chain(all_fields).enumerate() {
+                    if i > 0 {
+                        query.push(',');
+                    }
+
+                    if let Some(value) = fields.remove(field) {
+                        query.push('?');
+                        values.push(value);
+                    } else {
+                        query.push_str("NULL");
+                    }
+                }
+
+                query.push_str(") ON DUPLICATE KEY UPDATE ");
+                for (i, field) in all_fields.iter().enumerate() {
+                    if i > 0 {
+                        query.push(',');
+                    }
+                    let column = field.column();
+                    let _ = write!(&mut query, "{column} = VALUES({column})");
+                }
+
+                let s = trx.prep(&query).await.map_err(into_error)?;
+
+                trx.exec_drop(&s, values).await.map_err(into_error)?;
             }
 
-            query.push_str(") VALUES (");
-
-            for (i, field) in primary_keys.iter().chain(all_fields).enumerate() {
-                if i > 0 {
-                    query.push(',');
-                }
-
-                if let Some(value) = fields.remove(field) {
-                    query.push('?');
-                    values.push(value);
-                } else {
-                    query.push_str("NULL");
-                }
-            }
-
-            query.push_str(") ON DUPLICATE KEY UPDATE ");
-            for (i, field) in all_fields.iter().enumerate() {
-                if i > 0 {
-                    query.push(',');
-                }
-                let column = field.column();
-                let _ = write!(&mut query, "{column} = VALUES({column})");
-            }
-
-            let s = trx.prep(&query).await.map_err(into_error)?;
-
-            trx.exec_drop(&s, values).await.map_err(into_error)?;
-        }
-
-        trx.commit().await.map_err(into_error)
+            trx.commit().await.map_err(into_error)
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub async fn query<R: SearchDocumentId>(
@@ -94,13 +101,18 @@ impl MysqlStore {
             build_sort(&mut query, sort);
         }
 
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        let s = conn.prep(query).await.map_err(into_error)?;
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn.prep(query).await.map_err(into_error)?;
 
-        conn.exec::<i64, _, _>(s, params)
-            .await
-            .map(|r| r.into_iter().map(|r| R::from_u64(r as u64)).collect())
-            .map_err(into_error)
+            conn.exec::<i64, _, _>(s, params)
+                .await
+                .map(|r| r.into_iter().map(|r| R::from_u64(r as u64)).collect())
+                .map_err(into_error)
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub async fn unindex(&self, filter: SearchQuery) -> trc::Result<u64> {
@@ -108,44 +120,65 @@ impl MysqlStore {
         let mut query = format!("DELETE FROM {table} ");
         let params = build_filter(&mut query, &filter.filters);
 
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        let s = conn.prep(&query).await.map_err(into_error)?;
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.maintenance;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn.prep(&query).await.map_err(into_error)?;
 
-        match conn.exec_drop(s, params.clone()).await {
-            Ok(_) => return Ok(conn.affected_rows()),
-            Err(err) if is_timeout_error(&err) => (),
-            Err(err) => return Err(into_error(err)),
-        }
+            match conn.exec_drop(s, params.clone()).await {
+                Ok(_) => return Ok(conn.affected_rows()),
+                Err(err) if is_timeout_error(&err) => (),
+                Err(err) => return Err(into_error(err)),
+            }
 
-        let mut chunk_size = DELETE_CHUNK_SIZE;
-        let mut deleted = 0;
-
-        loop {
-            let s = conn
-                .prep(format!("{query} LIMIT {chunk_size}"))
-                .await
-                .map_err(into_error)?;
+            let mut chunk_size = DELETE_CHUNK_SIZE;
+            let mut deleted = 0;
 
             loop {
-                match conn.exec_drop(&s, params.clone()).await {
-                    Ok(_) => {
-                        let affected = conn.affected_rows();
-                        if affected == 0 {
-                            return Ok(deleted);
+                let s = conn
+                    .prep(format!("{query} LIMIT {chunk_size}"))
+                    .await
+                    .map_err(into_error)?;
+
+                loop {
+                    match conn.exec_drop(&s, params.clone()).await {
+                        Ok(_) => {
+                            let affected = conn.affected_rows();
+                            if affected == 0 {
+                                return Ok(deleted);
+                            }
+                            deleted += affected;
                         }
-                        deleted += affected;
+                        Err(err)
+                            if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE =>
+                        {
+                            chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
+                            break;
+                        }
+                        Err(err) => return Err(into_error(err)),
                     }
-                    Err(err) if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE => {
-                        chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
-                        break;
-                    }
-                    Err(err) => return Err(into_error(err)),
                 }
             }
-        }
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 }
 
+// inbuxa: InnoDB's default full-text stopword list
+// (INFORMATION_SCHEMA.INNODB_FT_DEFAULT_STOPWORD) and innodb_ft_min_token_size
+// default; words outside these are not in a FULLTEXT index.
+const FT_STOPWORDS: &[&str] = &[
+    "a", "about", "an", "are", "as", "at", "be", "by", "com", "de", "en", "for", "from", "how",
+    "i", "in", "is", "it", "la", "of", "on", "or", "that", "the", "this", "to", "was", "what",
+    "when", "where", "who", "will", "with", "und", "www",
+];
+const FT_MIN_TOKEN_SIZE: usize = 3;
+
+fn is_ft_indexed(word: &str) -> bool {
+    word.chars().count() >= FT_MIN_TOKEN_SIZE && !FT_STOPWORDS.contains(&word)
+}
+
 fn build_filter(query: &mut String, filters: &[SearchFilter]) -> Vec<Value> {
     if filters.is_empty() {
         return Vec::new();
@@ -171,30 +204,77 @@ fn build_filter(query: &mut String, filters: &[SearchFilter]) -> Vec<Value> {
 
                 if field.is_text() && matches!(op, SearchOperator::Equal | SearchOperator::Contains)
                 {
-                    let (value, mode) = match (value, op) {
-                        (SearchValue::Text { value, .. }, SearchOperator::Equal) => {
-                            (Value::Bytes(format!("{value:?}").into_bytes()), "BOOLEAN")
-                        }
-                        (SearchValue::Text { value, .. }, ..) => {
+                    let (value, mode, unindexed) = match (value, op) {
+                        (SearchValue::Text { value, .. }, SearchOperator::Equal) => (
+                            Value::Bytes(format!("{value:?}").into_bytes()),
+                            "BOOLEAN",
+                            Vec::new(),
+                        ),
+                        (SearchValue::Text { value, language }, ..) => {
                             let mut text_query = String::with_capacity(value.len() + 1);
+                            let mut unindexed = Vec::new();
 
                             for item in WordTokenizer::new(value, MAX_TOKEN_LENGTH) {
-                                if !text_query.is_empty() {
-                                    text_query.push(' ');
+                                // inbuxa: InnoDB never indexes stopwords ("com",
+                                // "de", "www", ...) or words under
+                                // innodb_ft_min_token_size, and a required
+                                // (+word) term it has not indexed matches no row,
+                                // so "example.com" or "[email protected]" found
+                                // nothing. Such words are matched with a
+                                // word-boundary REGEXP instead.
+                                if is_ft_indexed(&item.word) {
+                                    if !text_query.is_empty() {
+                                        text_query.push(' ');
+                                    }
+                                    text_query.push('+');
+                                    text_query.push_str(&item.word);
+                                } else {
+                                    unindexed.push(item.word);
                                 }
-                                text_query.push('+');
-                                text_query.push_str(&item.word);
                             }
 
-                            (Value::Bytes(text_query.into_bytes()), "BOOLEAN")
+                            // For language text (bodies, subjects) the unindexed
+                            // words are noise words and only checked when nothing
+                            // else is left to match; keyword text (addresses,
+                            // contact fields) checks every word, as the other
+                            // backends do.
+                            if !text_query.is_empty() && !matches!(language, Language::None) {
+                                unindexed.clear();
+                            }
+
+                            (Value::Bytes(text_query.into_bytes()), "BOOLEAN", unindexed)
                         }
                         _ => {
                             debug_assert!(false, "Invalid search value for text field");
                             continue;
                         }
                     };
-                    let _ = write!(query, "MATCH({}) AGAINST(? IN {mode} MODE)", field.column());
-                    values.push(value);
+                    if unindexed.is_empty() {
+                        let _ =
+                            write!(query, "MATCH({}) AGAINST(? IN {mode} MODE)", field.column());
+                        values.push(value);
+                    } else {
+                        query.push('(');
+                        let is_empty = matches!(&value, Value::Bytes(v) if v.is_empty());
+                        if !is_empty {
+                            let _ = write!(
+                                query,
+                                "MATCH({}) AGAINST(? IN {mode} MODE) AND ",
+                                field.column()
+                            );
+                            values.push(value);
+                        }
+                        for (i, word) in unindexed.iter().enumerate() {
+                            if i > 0 {
+                                query.push_str(" AND ");
+                            }
+                            let _ = write!(query, "{} REGEXP ?", field.column());
+                            values.push(Value::Bytes(
+                                format!("(^|[^[:alnum:]]){word}([^[:alnum:]]|$)").into_bytes(),
+                            ));
+                        }
+                        query.push(')');
+                    }
                 } else if let SearchValue::KeyValues(kv) = value {
                     let (key, value) = kv.iter().next().unwrap();
 

crates/store/src/backend/mysql/write.rs

@@ -2,9 +2,13 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use super::{DELETE_CHUNK_SIZE, MIN_DELETE_CHUNK_SIZE, MysqlStore, into_error, is_timeout_error};
+use super::{
+    DELETE_CHUNK_SIZE, MIN_DELETE_CHUNK_SIZE, MysqlStore, bounded, into_error, is_timeout_error,
+};
 use crate::{
     IndexKey, Key, LogKey, SUBSPACE_COUNTER, SUBSPACE_IN_MEMORY_COUNTER, SUBSPACE_QUOTA,
     SUBSPACE_REGISTRY_IDX,
@@ -29,42 +33,46 @@ impl MysqlStore {
     pub(crate) async fn write(&self, mut batch: Batch<'_>) -> trc::Result<AssignedIds> {
         let start = Instant::now();
         let mut retry_count = 0;
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-
-        loop {
-            let err = match self.write_trx(&mut conn, &mut batch).await {
-                Ok(result) => {
-                    return Ok(result);
-                }
-                Err(err) => err,
-            };
-
-            let _ = conn.query_drop("ROLLBACK;").await;
-
-            match err {
-                CommitError::Mysql(Error::Server(err))
-                    if [1062, 1213].contains(&err.code)
-                        && retry_count < MAX_COMMIT_ATTEMPTS
-                        && start.elapsed() < MAX_COMMIT_TIME => {}
-                /*CommitError::Retry => {
-                    if retry_count > MAX_COMMIT_ATTEMPTS || start.elapsed() > MAX_COMMIT_TIME {
-                        return Err(trc::StoreEvent::AssertValueFailed
-                            .into_err()
-                            .caused_by(trc::location!()));
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            loop {
+                let err = match self.write_trx(&mut conn, &mut batch).await {
+                    Ok(result) => {
+                        return Ok(result);
                     }
-                }*/
-                CommitError::Mysql(err) => {
-                    return Err(into_error(err));
-                }
-                CommitError::Internal(err) => {
-                    return Err(err);
-                }
-            }
+                    Err(err) => err,
+                };
 
-            let backoff = rand::rng().random_range(50..=300);
-            tokio::time::sleep(Duration::from_millis(backoff)).await;
-            retry_count += 1;
-        }
+                let _ = conn.query_drop("ROLLBACK;").await;
+
+                match err {
+                    CommitError::Mysql(Error::Server(err))
+                        if [1062, 1213].contains(&err.code)
+                            && retry_count < MAX_COMMIT_ATTEMPTS
+                            && start.elapsed() < MAX_COMMIT_TIME => {}
+                    /*CommitError::Retry => {
+                        if retry_count > MAX_COMMIT_ATTEMPTS || start.elapsed() > MAX_COMMIT_TIME {
+                            return Err(trc::StoreEvent::AssertValueFailed
+                                .into_err()
+                                .caused_by(trc::location!()));
+                        }
+                    }*/
+                    CommitError::Mysql(err) => {
+                        return Err(into_error(err));
+                    }
+                    CommitError::Internal(err) => {
+                        return Err(err);
+                    }
+                }
+
+                let backoff = rand::rng().random_range(50..=300);
+                tokio::time::sleep(Duration::from_millis(backoff)).await;
+                retry_count += 1;
+            }
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     async fn write_trx(
@@ -382,72 +390,82 @@ impl MysqlStore {
     }
 
     pub(crate) async fn purge_store(&self) -> trc::Result<()> {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        for subspace in [SUBSPACE_QUOTA, SUBSPACE_COUNTER, SUBSPACE_IN_MEMORY_COUNTER] {
-            purge_table(&mut conn, char::from(subspace)).await?;
-        }
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.maintenance;
+        let result = tokio::time::timeout(limit, async {
+            for subspace in [SUBSPACE_QUOTA, SUBSPACE_COUNTER, SUBSPACE_IN_MEMORY_COUNTER] {
+                purge_table(&mut conn, char::from(subspace)).await?;
+            }
 
-        Ok(())
+            Ok(())
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn delete_range(&self, from: impl Key, to: impl Key) -> trc::Result<()> {
-        let mut conn = self.conn_pool.get_conn().await.map_err(into_error)?;
-        let table = char::from(from.subspace());
-        let mut from = from.serialize(0);
-        let to = to.serialize(0);
+        let mut conn = self.conn().await?;
+        let limit = self.timeouts.maintenance;
+        let result = tokio::time::timeout(limit, async {
+            let table = char::from(from.subspace());
+            let mut from = from.serialize(0);
+            let to = to.serialize(0);
 
-        let delete = conn
-            .prep(format!("DELETE FROM {table} WHERE k >= ? AND k < ?"))
-            .await
-            .map_err(into_error)?;
-
-        match conn.exec_drop(&delete, (&from, &to)).await {
-            Ok(_) => return Ok(()),
-            Err(err) if is_timeout_error(&err) => (),
-            Err(err) => return Err(into_error(err)),
-        }
-
-        let mut chunk_size = DELETE_CHUNK_SIZE;
-
-        loop {
-            let boundary = conn
-                .prep(format!(
-                    "SELECT k FROM {table} WHERE k >= ? AND k < ? ORDER BY k ASC LIMIT 1 OFFSET {chunk_size}"
-                ))
+            let delete = conn
+                .prep(format!("DELETE FROM {table} WHERE k >= ? AND k < ?"))
                 .await
                 .map_err(into_error)?;
 
+            match conn.exec_drop(&delete, (&from, &to)).await {
+                Ok(_) => return Ok(()),
+                Err(err) if is_timeout_error(&err) => (),
+                Err(err) => return Err(into_error(err)),
+            }
+
+            let mut chunk_size = DELETE_CHUNK_SIZE;
+
             loop {
-                let next = match conn
-                    .exec_first::<Vec<u8>, _, _>(&boundary, (&from, &to))
+                let boundary = conn
+                    .prep(format!(
+                        "SELECT k FROM {table} WHERE k >= ? AND k < ? ORDER BY k ASC LIMIT 1 OFFSET {chunk_size}"
+                    ))
                     .await
-                {
-                    Ok(next) => next,
-                    Err(err) if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE => {
-                        chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
-                        break;
-                    }
-                    Err(err) => return Err(into_error(err)),
-                };
+                    .map_err(into_error)?;
 
-                match conn
-                    .exec_drop(&delete, (&from, next.as_ref().unwrap_or(&to)))
-                    .await
-                {
-                    Ok(_) => (),
-                    Err(err) if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE => {
-                        chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
-                        break;
-                    }
-                    Err(err) => return Err(into_error(err)),
-                }
+                loop {
+                    let next = match conn
+                        .exec_first::<Vec<u8>, _, _>(&boundary, (&from, &to))
+                        .await
+                    {
+                        Ok(next) => next,
+                        Err(err) if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE => {
+                            chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
+                            break;
+                        }
+                        Err(err) => return Err(into_error(err)),
+                    };
 
-                match next {
-                    Some(next) => from = next,
-                    None => return Ok(()),
+                    match conn
+                        .exec_drop(&delete, (&from, next.as_ref().unwrap_or(&to)))
+                        .await
+                    {
+                        Ok(_) => (),
+                        Err(err) if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE => {
+                            chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
+                            break;
+                        }
+                        Err(err) => return Err(into_error(err)),
+                    }
+
+                    match next {
+                        Some(next) => from = next,
+                        None => return Ok(()),
+                    }
                 }
             }
-        }
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 }
 

crates/store/src/backend/postgres/blob.rs

@@ -2,13 +2,15 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use std::ops::Range;
 
 use crate::backend::postgres::into_pool_error;
 
-use super::{PostgresStore, into_error};
+use super::{PostgresStore, bounded, into_error};
 
 impl PostgresStore {
     pub(crate) async fn get_blob(
@@ -17,53 +19,68 @@ impl PostgresStore {
         range: Range<usize>,
     ) -> trc::Result<Option<Vec<u8>>> {
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let s = conn
-            .prepare_cached("SELECT v FROM t WHERE k = $1")
-            .await
-            .map_err(into_error)?;
-        conn.query_opt(&s, &[&key])
-            .await
-            .and_then(|row| {
-                if let Some(row) = row {
-                    Ok(Some(if range.start == 0 && range.end == usize::MAX {
-                        row.try_get::<_, Vec<u8>>(0)?
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prepare_cached("SELECT v FROM t WHERE k = $1")
+                .await
+                .map_err(into_error)?;
+            conn.query_opt(&s, &[&key])
+                .await
+                .and_then(|row| {
+                    if let Some(row) = row {
+                        Ok(Some(if range.start == 0 && range.end == usize::MAX {
+                            row.try_get::<_, Vec<u8>>(0)?
+                        } else {
+                            let bytes = row.try_get::<_, &[u8]>(0)?;
+                            bytes
+                                .get(range.start..std::cmp::min(bytes.len(), range.end))
+                                .unwrap_or_default()
+                                .to_vec()
+                        }))
                     } else {
-                        let bytes = row.try_get::<_, &[u8]>(0)?;
-                        bytes
-                            .get(range.start..std::cmp::min(bytes.len(), range.end))
-                            .unwrap_or_default()
-                            .to_vec()
-                    }))
-                } else {
-                    Ok(None)
-                }
-            })
-            .map_err(into_error)
+                        Ok(None)
+                    }
+                })
+                .map_err(into_error)
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn put_blob(&self, key: &[u8], data: &[u8]) -> trc::Result<()> {
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let s = conn
-            .prepare_cached(
-                "INSERT INTO t (k, v) VALUES ($1, $2) ON CONFLICT (k) DO UPDATE SET v = EXCLUDED.v",
-            )
-            .await
-            .map_err(into_error)?;
-        conn.execute(&s, &[&key, &data])
-            .await
-            .map_err(into_error)
-            .map(|_| ())
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prepare_cached(
+                    "INSERT INTO t (k, v) VALUES ($1, $2) ON CONFLICT (k) DO UPDATE SET v = EXCLUDED.v",
+                )
+                .await
+                .map_err(into_error)?;
+            conn.execute(&s, &[&key, &data])
+                .await
+                .map_err(into_error)
+                .map(|_| ())
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn delete_blob(&self, key: &[u8]) -> trc::Result<bool> {
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let s = conn
-            .prepare_cached("DELETE FROM t WHERE k = $1")
-            .await
-            .map_err(into_error)?;
-        conn.execute(&s, &[&key])
-            .await
-            .map_err(into_error)
-            .map(|hits| hits > 0)
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prepare_cached("DELETE FROM t WHERE k = $1")
+                .await
+                .map_err(into_error)?;
+            conn.execute(&s, &[&key])
+                .await
+                .map_err(into_error)
+                .map(|hits| hits > 0)
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 }

crates/store/src/backend/postgres/lookup.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::{QueryResult, QueryType, backend::postgres::into_pool_error};
@@ -12,7 +14,7 @@ use tokio_postgres::types::{FromSql, ToSql, Type};
 
 use crate::IntoRows;
 
-use super::{PostgresStore, into_error};
+use super::{PostgresStore, bounded, into_error};
 
 impl PostgresStore {
     pub(crate) async fn sql_query<T: QueryResult>(
@@ -21,33 +23,38 @@ impl PostgresStore {
         params_: &[crate::Value<'_>],
     ) -> trc::Result<T> {
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let s = conn.prepare_cached(query).await.map_err(into_error)?;
-        let params = params_
-            .iter()
-            .map(|v| v as &(dyn tokio_postgres::types::ToSql + Sync))
-            .collect::<Vec<_>>();
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn.prepare_cached(query).await.map_err(into_error)?;
+            let params = params_
+                .iter()
+                .map(|v| v as &(dyn tokio_postgres::types::ToSql + Sync))
+                .collect::<Vec<_>>();
 
-        match T::query_type() {
-            QueryType::Execute => conn
-                .execute(&s, params.as_slice())
-                .await
-                .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_exec(r as usize))),
-            QueryType::Exists => {
-                let rows = conn.query_raw(&s, params).await.map_err(into_error)?;
-                pin_mut!(rows);
-                rows.try_next()
+            match T::query_type() {
+                QueryType::Execute => conn
+                    .execute(&s, params.as_slice())
                     .await
-                    .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_exists(r.is_some())))
+                    .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_exec(r as usize))),
+                QueryType::Exists => {
+                    let rows = conn.query_raw(&s, params).await.map_err(into_error)?;
+                    pin_mut!(rows);
+                    rows.try_next()
+                        .await
+                        .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_exists(r.is_some())))
+                }
+                QueryType::QueryOne => conn
+                    .query_opt(&s, params.as_slice())
+                    .await
+                    .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_query_one(r))),
+                QueryType::QueryAll => conn
+                    .query(&s, params.as_slice())
+                    .await
+                    .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_query_all(r))),
             }
-            QueryType::QueryOne => conn
-                .query_opt(&s, params.as_slice())
-                .await
-                .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_query_one(r))),
-            QueryType::QueryAll => conn
-                .query(&s, params.as_slice())
-                .await
-                .map_or_else(|e| Err(into_error(e)), |r| Ok(T::from_query_all(r))),
-        }
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 }
 

crates/store/src/backend/postgres/main.rs

@@ -6,7 +6,7 @@
  * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use super::{PostgresStore, into_error};
+use super::{PostgresStore, bounded, into_error};
 use crate::{
     backend::postgres::{
         PsqlSearchField, into_pool_error,
@@ -22,11 +22,34 @@ use crate::{
 use ::registry::schema::{enums::PostgreSqlRecyclingMethod, structs};
 use ahash::AHashSet;
 use deadpool_postgres::{
-    Config, ManagerConfig, Object, Pool, PoolConfig, RecyclingMethod, Runtime,
+    Config, ManagerConfig, Object, Pool, PoolConfig, RecyclingMethod, Runtime, Timeouts,
 };
+use std::time::Duration;
 use tokio_postgres::NoTls;
 use utils::tls::rustls_client_config;
 
+/// inbuxa: how long a request waits for a pooled connection.
+pub(crate) const POOL_WAIT_TIMEOUT: Duration = Duration::from_secs(30);
+/// inbuxa: how long opening a connection may take when the store sets no
+/// timeout of its own.
+pub(crate) const POOL_CREATE_TIMEOUT: Duration = Duration::from_secs(15);
+/// inbuxa: how long checking a pooled connection before reuse may take.
+pub(crate) const POOL_RECYCLE_TIMEOUT: Duration = Duration::from_secs(10);
+/// inbuxa: idle time before TCP keepalive probes start.
+pub(crate) const POOL_KEEPALIVE_IDLE: Duration = Duration::from_secs(60);
+
+/// inbuxa: the pool's timeouts. Opening a connection is bounded by the
+/// store's own timeout when it has one; waiting for one covers at least that
+/// long, so a slow connect isn't cut short by the wait.
+pub(crate) fn pool_timeouts(connect_timeout: Option<Duration>) -> Timeouts {
+    let create = connect_timeout.unwrap_or(POOL_CREATE_TIMEOUT);
+    Timeouts {
+        wait: POOL_WAIT_TIMEOUT.max(create).into(),
+        create: create.into(),
+        recycle: POOL_RECYCLE_TIMEOUT.into(),
+    }
+}
+
 impl PostgresStore {
     pub async fn open(config: structs::PostgreSqlStore) -> Result<Store, String> {
         // inbuxa: ST-15: where the primary is, to tell a replica from it
@@ -46,9 +69,20 @@ impl PostgresStore {
                 PostgreSqlRecyclingMethod::Clean => RecyclingMethod::Clean,
             },
         });
-        if let Some(max_conn) = config.pool_max_connections {
-            cfg.pool = PoolConfig::new(max_conn as usize).into();
-        }
+        // inbuxa: upstream set no pool timeouts, so a request waited for a
+        // free connection, or for one to be made or recycled, for as long as
+        // it took: forever when the server stopped answering. A worker now
+        // gets an error instead and the task or request is retried.
+        let mut pool = config
+            .pool_max_connections
+            .map(|max_conn| PoolConfig::new(max_conn as usize))
+            .unwrap_or_default();
+        pool.timeouts = pool_timeouts(cfg.connect_timeout);
+        cfg.pool = pool.into();
+        // Notice a server that went away without closing the connection in
+        // minutes rather than the system default of two hours
+        cfg.keepalives = true.into();
+        cfg.keepalives_idle = POOL_KEEPALIVE_IDLE.into();
 
         let primary_pool = if config.use_tls {
             cfg.create_pool(
@@ -85,6 +119,7 @@ impl PostgresStore {
                 Store::PostgreSQL(Arc::new(PostgresStore {
                     conn_pool: pool,
                     ts_configs: ts_configs.clone(),
+                    timeouts: Default::default(),
                 })),
                 replica.host,
                 replica.port as u16,
@@ -95,6 +130,7 @@ impl PostgresStore {
         let primary = Store::PostgreSQL(Arc::new(PostgresStore {
             conn_pool: primary_pool,
             ts_configs,
+            timeouts: Default::default(),
         }));
 
         // ST-1: no replicas, no change
@@ -113,84 +149,92 @@ impl PostgresStore {
 
     pub(crate) async fn create_storage_tables(&self) -> trc::Result<()> {
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
+        let limit = self.timeouts.maintenance;
+        let result = tokio::time::timeout(limit, async {
+            for table in [
+                SUBSPACE_ACL,
+                SUBSPACE_TASK_QUEUE,
+                SUBSPACE_DELETED_ITEMS,
+                SUBSPACE_SPAM_SAMPLES,
+                crate::SUBSPACE_INBUXA, // inbuxa: masked email
+                SUBSPACE_BLOB_LINK,
+                SUBSPACE_IN_MEMORY_VALUE,
+                SUBSPACE_PROPERTY,
+                SUBSPACE_REGISTRY,
+                SUBSPACE_REGISTRY_PK,
+                SUBSPACE_QUEUE_MESSAGE,
+                SUBSPACE_QUEUE_EVENT,
+                SUBSPACE_REPORT_OUT,
+                SUBSPACE_REPORT_IN,
+                SUBSPACE_LOGS,
+                SUBSPACE_BLOBS,
+                SUBSPACE_DIRECTORY,
+                SUBSPACE_TELEMETRY_SPAN,
+                SUBSPACE_TELEMETRY_METRIC,
+            ] {
+                let table = char::from(table);
+                conn.execute(
+                    &format!(
+                        "CREATE TABLE IF NOT EXISTS {table} (
+                            k BYTEA PRIMARY KEY,
+                            v BYTEA NOT NULL
+                        )"
+                    ),
+                    &[],
+                )
+                .await
+                .map_err(into_error)?;
+            }
 
-        for table in [
-            SUBSPACE_ACL,
-            SUBSPACE_TASK_QUEUE,
-            SUBSPACE_DELETED_ITEMS,
-            SUBSPACE_SPAM_SAMPLES,
-            crate::SUBSPACE_INBUXA, // inbuxa: masked email
-            SUBSPACE_BLOB_LINK,
-            SUBSPACE_IN_MEMORY_VALUE,
-            SUBSPACE_PROPERTY,
-            SUBSPACE_REGISTRY,
-            SUBSPACE_REGISTRY_PK,
-            SUBSPACE_QUEUE_MESSAGE,
-            SUBSPACE_QUEUE_EVENT,
-            SUBSPACE_REPORT_OUT,
-            SUBSPACE_REPORT_IN,
-            SUBSPACE_LOGS,
-            SUBSPACE_BLOBS,
-            SUBSPACE_DIRECTORY,
-            SUBSPACE_TELEMETRY_SPAN,
-            SUBSPACE_TELEMETRY_METRIC,
-        ] {
-            let table = char::from(table);
-            conn.execute(
-                &format!(
-                    "CREATE TABLE IF NOT EXISTS {table} (
+            for table in [SUBSPACE_INDEXES, SUBSPACE_REGISTRY_IDX] {
+                let table = char::from(table);
+                conn.execute(
+                    &format!(
+                        "CREATE TABLE IF NOT EXISTS {table} (
+                            k BYTEA PRIMARY KEY
+                        )"
+                    ),
+                    &[],
+                )
+                .await
+                .map_err(into_error)?;
+            }
+
+            for table in [SUBSPACE_COUNTER, SUBSPACE_QUOTA, SUBSPACE_IN_MEMORY_COUNTER] {
+                conn.execute(
+                    &format!(
+                        "CREATE TABLE IF NOT EXISTS {} (
                         k BYTEA PRIMARY KEY,
-                        v BYTEA NOT NULL
-                    )"
-                ),
-                &[],
-            )
-            .await
-            .map_err(into_error)?;
-        }
+                        v BIGINT NOT NULL DEFAULT 0
+                    )",
+                        char::from(table)
+                    ),
+                    &[],
+                )
+                .await
+                .map_err(into_error)?;
+            }
 
-        for table in [SUBSPACE_INDEXES, SUBSPACE_REGISTRY_IDX] {
-            let table = char::from(table);
-            conn.execute(
-                &format!(
-                    "CREATE TABLE IF NOT EXISTS {table} (
-                        k BYTEA PRIMARY KEY
-                    )"
-                ),
-                &[],
-            )
-            .await
-            .map_err(into_error)?;
-        }
-
-        for table in [SUBSPACE_COUNTER, SUBSPACE_QUOTA, SUBSPACE_IN_MEMORY_COUNTER] {
-            conn.execute(
-                &format!(
-                    "CREATE TABLE IF NOT EXISTS {} (
-                    k BYTEA PRIMARY KEY,
-                    v BIGINT NOT NULL DEFAULT 0
-                )",
-                    char::from(table)
-                ),
-                &[],
-            )
-            .await
-            .map_err(into_error)?;
-        }
-
-        Ok(())
+            Ok(())
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn create_search_tables(&self) -> trc::Result<()> {
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
+        let limit = self.timeouts.maintenance;
+        let result = tokio::time::timeout(limit, async {
+            create_search_tables::<EmailSearchField>(&conn).await?;
+            create_search_tables::<CalendarSearchField>(&conn).await?;
+            create_search_tables::<ContactSearchField>(&conn).await?;
+            //create_search_tables::<FileSearchField>(&conn).await?;
+            create_search_tables::<TracingSearchField>(&conn).await?;
 
-        create_search_tables::<EmailSearchField>(&conn).await?;
-        create_search_tables::<CalendarSearchField>(&conn).await?;
-        create_search_tables::<ContactSearchField>(&conn).await?;
-        //create_search_tables::<FileSearchField>(&conn).await?;
-        create_search_tables::<TracingSearchField>(&conn).await?;
-
-        Ok(())
+            Ok(())
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 }
 
@@ -231,12 +275,21 @@ async fn create_search_tables<T: SearchableField + PsqlSearchField + 'static>(
     for field in T::all_fields() {
         if field.is_text() || field.is_json() {
             let column_name = field.column();
+            // inbuxa: with GIN's default fastupdate=on, new entries wait in
+            // an unindexed pending list that every search scans in full
+            // until a VACUUM (or 4 MB of backlog) merges it. On a mailbox
+            // taking steady mail that list never drains and searches slow
+            // from milliseconds to hundreds of them. Pay the index update
+            // at insert time instead.
+            let index_name = format!("gin_{table_name}_{column_name}");
             let create_index_query = format!(
-                "CREATE INDEX IF NOT EXISTS gin_{table_name}_{column_name} ON {table_name} USING GIN({column_name})",
+                "CREATE INDEX IF NOT EXISTS {index_name} ON {table_name} USING GIN({column_name}) WITH (fastupdate = off)",
             );
             conn.execute(&create_index_query, &[])
                 .await
                 .map_err(into_error)?;
+            // Indexes made before this change keep fastupdate=on
+            disable_gin_fastupdate(conn, &index_name).await;
         }
 
         if field.is_indexed() {
@@ -253,6 +306,69 @@ async fn create_search_tables<T: SearchableField + PsqlSearchField + 'static>(
     Ok(())
 }
 
+/// inbuxa: turns fastupdate off on a GIN index made with the default and
+/// merges the pending list it has built up. Idempotent: an index that already
+/// has the option is left alone, so this costs one catalog read per index at
+/// startup. A failure is logged and startup goes on, since search still works,
+/// only slower.
+async fn disable_gin_fastupdate(conn: &Object, index_name: &str) {
+    if let Err(err) = try_disable_gin_fastupdate(conn, index_name).await {
+        trc::event!(
+            Store(trc::StoreEvent::PostgresqlError),
+            Details = format!("Failed to turn off fastupdate on search index {index_name}"),
+            Reason = err.to_string(),
+        );
+    }
+}
+
+async fn try_disable_gin_fastupdate(conn: &Object, index_name: &str) -> trc::Result<()> {
+    let options = conn
+        .query_opt(
+            "SELECT COALESCE(reloptions, '{}')::text[] FROM pg_class WHERE oid = to_regclass($1)",
+            &[&index_name],
+        )
+        .await
+        .map_err(into_error)?
+        .map(|row| row.try_get::<_, Vec<String>>(0))
+        .transpose()
+        .map_err(into_error)?;
+    let Some(options) = options else {
+        return Ok(());
+    };
+    if gin_fastupdate_is_off(&options) {
+        return Ok(());
+    }
+    // SET (fastupdate) takes a SHARE UPDATE EXCLUSIVE lock, which doesn't
+    // block reads or writes. Turning it off stops new entries going to the
+    // pending list but doesn't flush the entries already there.
+    conn.execute(
+        &format!("ALTER INDEX {index_name} SET (fastupdate = off)"),
+        &[],
+    )
+    .await
+    .map_err(into_error)?;
+    conn.query_one(
+        "SELECT gin_clean_pending_list($1::text::regclass)",
+        &[&index_name],
+    )
+    .await
+    .map_err(into_error)?;
+    Ok(())
+}
+
+/// Whether a relation's reloptions turn GIN's fastupdate off.
+fn gin_fastupdate_is_off(options: &[String]) -> bool {
+    options.iter().any(|option| {
+        option.split_once('=').is_some_and(|(name, value)| {
+            name.trim().eq_ignore_ascii_case("fastupdate")
+                && matches!(
+                    value.trim().to_ascii_lowercase().as_str(),
+                    "off" | "false" | "no" | "0" | "f" | "n"
+                )
+        })
+    })
+}
+
 async fn discover_ts_configs(pool: &Pool) -> AHashSet<&'static str> {
     let mut ts_configs = AHashSet::from_iter([PG_FALLBACK_LANG, PG_UNSTEMMED_LANG]);
 

crates/store/src/backend/postgres/mod.rs

@@ -6,6 +6,7 @@
  * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
+use crate::backend::query_timeout::QueryTimeouts;
 use crate::{
     search::{
         CalendarSearchField, ContactSearchField, EmailSearchField, FileSearchField, SearchField,
@@ -14,7 +15,8 @@ use crate::{
     write::SearchIndex,
 };
 use ahash::AHashSet;
-use deadpool_postgres::Pool;
+use deadpool_postgres::{Object, Pool};
+use std::time::Duration;
 use tokio_postgres::error::SqlState;
 
 pub mod blob;
@@ -28,6 +30,8 @@ pub mod write;
 pub struct PostgresStore {
     pub(crate) conn_pool: Pool,
     pub(crate) ts_configs: AHashSet<&'static str>,
+    /// inbuxa: client-side query limits (see backend::query_timeout)
+    pub(crate) timeouts: QueryTimeouts,
 }
 
 #[inline(always)]
@@ -72,6 +76,34 @@ pub(crate) fn is_timeout_error(err: &tokio_postgres::Error) -> bool {
     })
 }
 
+/// inbuxa: the error for an operation that ran past its time limit.
+pub(crate) fn query_timeout_error(limit: Duration) -> trc::Error {
+    trc::StoreEvent::PostgresqlError
+        .reason("Query timed out")
+        .details(format!(
+            "No answer from the database within {} s",
+            limit.as_secs()
+        ))
+}
+
+/// inbuxa: ends an operation run on `conn` under `limit`. When it ran out,
+/// the connection is taken out of the pool and closed: a query may still be
+/// in flight on it, or a transaction open, so it can't be handed to the
+/// next caller.
+pub(crate) fn bounded<T>(
+    conn: Object,
+    result: Result<trc::Result<T>, tokio::time::error::Elapsed>,
+    limit: Duration,
+) -> trc::Result<T> {
+    match result {
+        Ok(result) => result,
+        Err(_) => {
+            drop(Object::take(conn));
+            Err(query_timeout_error(limit))
+        }
+    }
+}
+
 #[inline(always)]
 pub(crate) fn into_pool_error(err: deadpool_postgres::PoolError) -> trc::Error {
     match err {

crates/store/src/backend/postgres/read.rs

@@ -2,9 +2,11 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use super::{PostgresStore, into_error, is_timeout_error};
+use super::{PostgresStore, bounded, into_error, is_timeout_error, query_timeout_error};
 use crate::{
     Deserialize, IterateParams, Key, ValueKey, backend::postgres::into_pool_error,
     write::ValueClass,
@@ -17,40 +19,50 @@ impl PostgresStore {
         U: Deserialize + 'static,
     {
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let s = conn
-            .prepare_cached(&format!(
-                "SELECT v FROM {} WHERE k = $1",
-                char::from(key.subspace())
-            ))
-            .await
-            .map_err(into_error)?;
-        let key = key.serialize(0);
-        conn.query_opt(&s, &[&key])
-            .await
-            .map_err(into_error)
-            .and_then(|r| {
-                if let Some(r) = r {
-                    Ok(Some(U::deserialize_with_key(&key, r.get(0))?))
-                } else {
-                    Ok(None)
-                }
-            })
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prepare_cached(&format!(
+                    "SELECT v FROM {} WHERE k = $1",
+                    char::from(key.subspace())
+                ))
+                .await
+                .map_err(into_error)?;
+            let key = key.serialize(0);
+            conn.query_opt(&s, &[&key])
+                .await
+                .map_err(into_error)
+                .and_then(|r| {
+                    if let Some(r) = r {
+                        Ok(Some(U::deserialize_with_key(&key, r.get(0))?))
+                    } else {
+                        Ok(None)
+                    }
+                })
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn key_exists(&self, key: impl Key) -> trc::Result<bool> {
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let s = conn
-            .prepare_cached(&format!(
-                "SELECT 1 FROM {} WHERE k = $1",
-                char::from(key.subspace())
-            ))
-            .await
-            .map_err(into_error)?;
-        let key = key.serialize(0);
-        conn.query_opt(&s, &[&key])
-            .await
-            .map_err(into_error)
-            .map(|r| r.is_some())
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prepare_cached(&format!(
+                    "SELECT 1 FROM {} WHERE k = $1",
+                    char::from(key.subspace())
+                ))
+                .await
+                .map_err(into_error)?;
+            let key = key.serialize(0);
+            conn.query_opt(&s, &[&key])
+                .await
+                .map_err(into_error)
+                .map(|r| r.is_some())
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn iterate<T: Key>(
@@ -64,44 +76,65 @@ impl PostgresStore {
         let end = params.end.serialize(0);
         let keys = if params.values { "k, v" } else { "k" };
 
-        let s = conn
-            .prepare_cached(&match (params.first, params.ascending) {
-                (true, true) => {
-                    format!(
-                        "SELECT {keys} FROM {table} WHERE k >= $1 AND k <= $2 ORDER BY k ASC LIMIT 1"
-                    )
-                }
-                (true, false) => {
-                    format!(
+        // inbuxa: a scan may run for hours, so the query limit bounds each
+        // wait for the database (preparing, the query starting, the next
+        // row) rather than the scan. A wait that runs out closes the
+        // connection.
+        let limit = self.timeouts.query;
+        let query = match (params.first, params.ascending) {
+            (true, true) => {
+                format!(
+                    "SELECT {keys} FROM {table} WHERE k >= $1 AND k <= $2 ORDER BY k ASC LIMIT 1"
+                )
+            }
+            (true, false) => {
+                format!(
                     "SELECT {keys} FROM {table} WHERE k >= $1 AND k <= $2 ORDER BY k DESC LIMIT 1"
                 )
-                }
-                (false, true) => {
-                    format!("SELECT {keys} FROM {table} WHERE k >= $1 AND k <= $2 ORDER BY k ASC")
-                }
-                (false, false) => {
-                    format!("SELECT {keys} FROM {table} WHERE k >= $1 AND k <= $2 ORDER BY k DESC")
-                }
-            })
-            .await.map_err(into_error)?;
+            }
+            (false, true) => {
+                format!("SELECT {keys} FROM {table} WHERE k >= $1 AND k <= $2 ORDER BY k ASC")
+            }
+            (false, false) => {
+                format!("SELECT {keys} FROM {table} WHERE k >= $1 AND k <= $2 ORDER BY k DESC")
+            }
+        };
+        let s = match tokio::time::timeout(limit, conn.prepare_cached(&query)).await {
+            Ok(s) => s.map_err(into_error)?,
+            Err(_) => {
+                drop(deadpool_postgres::Object::take(conn));
+                return Err(query_timeout_error(limit));
+            }
+        };
         let mut from = begin;
         let mut to = end;
         let mut resume_key: Option<Vec<u8>> = None;
 
+        let mut stalled = false;
+
         loop {
             let mut last_key = None;
             let mut timed_out = false;
 
             {
-                let rows = conn
-                    .query_raw(&s, &[&from, &to])
-                    .await
-                    .map_err(into_error)?;
+                let rows =
+                    match tokio::time::timeout(limit, conn.query_raw(&s, &[&from, &to])).await {
+                        Ok(rows) => rows.map_err(into_error)?,
+                        // Leaves the scan loop for the timeout below
+                        Err(_) => break,
+                    };
 
                 pin_mut!(rows);
 
                 loop {
-                    match rows.try_next().await {
+                    let next = match tokio::time::timeout(limit, rows.try_next()).await {
+                        Ok(next) => next,
+                        Err(_) => {
+                            stalled = true;
+                            break;
+                        }
+                    };
+                    match next {
                         Ok(Some(row)) => {
                             let key = row.try_get::<_, &[u8]>(0).map_err(into_error)?;
                             let value = if params.values {
@@ -132,6 +165,10 @@ impl PostgresStore {
                 }
             }
 
+            if stalled {
+                break;
+            }
+
             match last_key {
                 Some(last_key) if timed_out => {
                     if params.ascending {
@@ -144,6 +181,9 @@ impl PostgresStore {
                 _ => return Ok(()),
             }
         }
+
+        drop(deadpool_postgres::Object::take(conn));
+        Err(query_timeout_error(limit))
     }
 
     pub(crate) async fn get_counter(
@@ -155,14 +195,19 @@ impl PostgresStore {
         let key = key.serialize(0);
 
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let s = conn
-            .prepare_cached(&format!("SELECT v FROM {table} WHERE k = $1"))
-            .await
-            .map_err(into_error)?;
-        match conn.query_opt(&s, &[&key]).await {
-            Ok(Some(row)) => row.try_get(0).map_err(into_error),
-            Ok(None) => Ok(0),
-            Err(e) => Err(into_error(e)),
-        }
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn
+                .prepare_cached(&format!("SELECT v FROM {table} WHERE k = $1"))
+                .await
+                .map_err(into_error)?;
+            match conn.query_opt(&s, &[&key]).await {
+                Ok(Some(row)) => row.try_get(0).map_err(into_error),
+                Ok(None) => Ok(0),
+                Err(e) => Err(into_error(e)),
+            }
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 }

crates/store/src/backend/postgres/search.rs

@@ -2,12 +2,17 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::{
-    backend::postgres::{
-        DELETE_CHUNK_SIZE, MIN_DELETE_CHUNK_SIZE, PostgresStore, PsqlSearchField, into_error,
-        into_pool_error, is_timeout_error,
+    backend::{
+        MAX_TOKEN_LENGTH,
+        postgres::{
+            DELETE_CHUNK_SIZE, MIN_DELETE_CHUNK_SIZE, PostgresStore, PsqlSearchField, bounded,
+            into_error, into_pool_error, is_timeout_error,
+        },
     },
     search::{
         IndexDocument, SearchComparator, SearchDocumentId, SearchFilter, SearchOperator,
@@ -15,7 +20,7 @@ use crate::{
     },
     write::SearchIndex,
 };
-use nlp::language::Language;
+use nlp::{language::Language, tokenizers::space::SpaceTokenizer};
 use std::fmt::Write;
 use tokio_postgres::{
     IsolationLevel,
@@ -31,99 +36,135 @@ impl PostgresStore {
 
     pub async fn index(&self, documents: Vec<IndexDocument>) -> trc::Result<()> {
         let mut conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let trx = conn
-            .build_transaction()
-            .isolation_level(IsolationLevel::ReadCommitted)
-            .start()
-            .await
-            .map_err(into_error)?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let trx = conn
+                .build_transaction()
+                .isolation_level(IsolationLevel::ReadCommitted)
+                .start()
+                .await
+                .map_err(into_error)?;
 
-        for document in documents {
-            let index = document.index;
-            let primary_keys = index.primary_keys();
-            let all_fields = index.all_fields();
-            let fields = document.fields;
-            let mut values = Vec::with_capacity(fields.len() + 2);
-            let mut query = format!("INSERT INTO {} (", index.psql_table());
+            for document in documents {
+                let index = document.index;
+                let primary_keys = index.primary_keys();
+                let all_fields = index.all_fields();
+                let fields = document.fields;
+                // inbuxa: keyword text (addresses, contact fields, ...) is split into
+                // words before it reaches the text parser, see keyword_terms();
+                // language text gets the words inside its URLs, host names and
+                // file names added, see url_terms().
+                let keywords = primary_keys
+                    .iter()
+                    .chain(all_fields)
+                    .map(|field| match fields.get(field) {
+                        Some(SearchValue::Text {
+                            value,
+                            language: Language::None,
+                        }) if field.is_text() => Some(keyword_terms(value)),
+                        Some(SearchValue::Text { value, .. }) if field.is_text() => {
+                            url_terms(value)
+                        }
+                        _ => None,
+                    })
+                    .collect::<Vec<_>>();
+                let mut values = Vec::with_capacity(fields.len() + 2);
+                let mut query = format!("INSERT INTO {} (", index.psql_table());
 
-            for (i, field) in primary_keys.iter().chain(all_fields).enumerate() {
-                if i > 0 {
-                    query.push(',');
-                }
-                query.push_str(field.column());
+                for (i, field) in primary_keys.iter().chain(all_fields).enumerate() {
+                    if i > 0 {
+                        query.push(',');
+                    }
+                    query.push_str(field.column());
 
-                if let Some(sort_column) = field.sort_column() {
-                    query.push(',');
-                    query.push_str(sort_column);
-                }
-            }
-
-            query.push_str(") VALUES (");
-
-            for (i, field) in primary_keys.iter().chain(all_fields).enumerate() {
-                if i > 0 {
-                    query.push(',');
+                    if let Some(sort_column) = field.sort_column() {
+                        query.push(',');
+                        query.push_str(sort_column);
+                    }
                 }
 
-                if let Some(value) = fields.get(field) {
-                    let value_ref = format!("${}", values.len() + 1);
-                    let (text_len, language) = if let SearchValue::Text { value, language } = value
-                    {
-                        (value.len(), self.ts_config(language))
-                    } else {
-                        (0, PG_UNSTEMMED_LANG)
-                    };
+                query.push_str(") VALUES (");
 
-                    if field.is_text() {
-                        let _ = write!(&mut query, "to_tsvector('{language}',{value_ref})");
-                    } else if text_len > 512 {
-                        query.push_str("left(");
-                        query.push_str(&value_ref);
-                        query.push_str(",512)");
-                    } else {
-                        query.push_str(&value_ref);
+                for (i, field) in primary_keys.iter().chain(all_fields).enumerate() {
+                    if i > 0 {
+                        query.push(',');
                     }
 
-                    if field.sort_column().is_some() {
-                        if text_len > 255 {
-                            query.push_str(",left(");
+                    if let Some(value) = fields.get(field) {
+                        let value_ref = format!("${}", values.len() + 1);
+                        let (text_len, language) =
+                            if let SearchValue::Text { value, language } = value {
+                                (value.len(), self.ts_config(language))
+                            } else {
+                                (0, PG_UNSTEMMED_LANG)
+                            };
+
+                        if let Some(keywords) = &keywords[i] {
+                            let _ = write!(&mut query, "to_tsvector('{language}',{value_ref})");
+                            values.push(keywords as &(dyn ToSql + Sync));
+                            if field.sort_column().is_some() {
+                                let value_ref = format!("${}", values.len() + 1);
+                                if text_len > 255 {
+                                    let _ = write!(&mut query, ",left({value_ref},255)");
+                                } else {
+                                    let _ = write!(&mut query, ",{value_ref}");
+                                }
+                                values.push(value as &(dyn ToSql + Sync));
+                            }
+                            continue;
+                        } else if field.is_text() {
+                            let _ = write!(&mut query, "to_tsvector('{language}',{value_ref})");
+                        } else if text_len > 512 {
+                            query.push_str("left(");
                             query.push_str(&value_ref);
-                            query.push_str(",255)");
+                            query.push_str(",512)");
                         } else {
-                            query.push(',');
                             query.push_str(&value_ref);
                         }
-                    }
 
-                    values.push(value as &(dyn ToSql + Sync));
-                } else {
-                    query.push_str("NULL");
-                    if field.sort_column().is_some() {
-                        query.push_str(",NULL");
+                        if field.sort_column().is_some() {
+                            if text_len > 255 {
+                                query.push_str(",left(");
+                                query.push_str(&value_ref);
+                                query.push_str(",255)");
+                            } else {
+                                query.push(',');
+                                query.push_str(&value_ref);
+                            }
+                        }
+
+                        values.push(value as &(dyn ToSql + Sync));
+                    } else {
+                        query.push_str("NULL");
+                        if field.sort_column().is_some() {
+                            query.push_str(",NULL");
+                        }
                     }
                 }
-            }
 
-            query.push_str(") ON CONFLICT (");
-            for (i, pkey) in primary_keys.iter().enumerate() {
-                if i > 0 {
-                    query.push(',');
+                query.push_str(") ON CONFLICT (");
+                for (i, pkey) in primary_keys.iter().enumerate() {
+                    if i > 0 {
+                        query.push(',');
+                    }
+                    query.push_str(pkey.column());
                 }
-                query.push_str(pkey.column());
-            }
-            query.push_str(") DO UPDATE SET ");
-            for (i, field) in all_fields.iter().enumerate() {
-                if i > 0 {
-                    query.push(',');
+                query.push_str(") DO UPDATE SET ");
+                for (i, field) in all_fields.iter().enumerate() {
+                    if i > 0 {
+                        query.push(',');
+                    }
+                    let column = field.column();
+                    let _ = write!(&mut query, "{column} = EXCLUDED.{column}");
                 }
-                let column = field.column();
-                let _ = write!(&mut query, "{column} = EXCLUDED.{column}");
+
+                trx.execute(&query, &values).await.map_err(into_error)?;
             }
 
-            trx.execute(&query, &values).await.map_err(into_error)?;
-        }
-
-        trx.commit().await.map_err(into_error)
+            trx.commit().await.map_err(into_error)
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub async fn query<R: SearchDocumentId>(
@@ -134,20 +175,26 @@ impl PostgresStore {
     ) -> trc::Result<Vec<R>> {
         let mut query = format!("SELECT {} FROM {}", R::field().column(), index.psql_table());
         let params = self.build_filter(&mut query, filters);
+        let params = params.iter().map(SqlParam::as_sql).collect::<Vec<_>>();
         if !sort.is_empty() {
             build_sort(&mut query, sort);
         }
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let s = conn.prepare_cached(&query).await.map_err(into_error)?;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let s = conn.prepare_cached(&query).await.map_err(into_error)?;
 
-        conn.query(&s, params.as_slice())
-            .await
-            .and_then(|rows| {
-                rows.into_iter()
-                    .map(|row| row.try_get::<_, DocId>(0).map(|v| R::from_u64(v.0)))
-                    .collect::<Result<Vec<R>, _>>()
-            })
-            .map_err(into_error)
+            conn.query(&s, params.as_slice())
+                .await
+                .and_then(|rows| {
+                    rows.into_iter()
+                        .map(|row| row.try_get::<_, DocId>(0).map(|v| R::from_u64(v.0)))
+                        .collect::<Result<Vec<R>, _>>()
+                })
+                .map_err(into_error)
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub async fn unindex(&self, filter: SearchQuery) -> trc::Result<u64> {
@@ -155,48 +202,54 @@ impl PostgresStore {
         let table = filter.index.psql_table();
         let mut where_clause = String::new();
         let params = self.build_filter(&mut where_clause, &filter.filters);
+        let params = params.iter().map(SqlParam::as_sql).collect::<Vec<_>>();
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let s = conn
-            .prepare_cached(&format!("DELETE FROM {table}{where_clause}"))
-            .await
-            .map_err(into_error)?;
-
-        match conn.execute(&s, params.as_slice()).await {
-            Ok(deleted) => return Ok(deleted),
-            Err(err) if is_timeout_error(&err) => (),
-            Err(err) => return Err(into_error(err)),
-        }
-
-        let mut chunk_size = DELETE_CHUNK_SIZE;
-        let mut deleted = 0;
-
-        loop {
+        let limit = self.timeouts.maintenance;
+        let result = tokio::time::timeout(limit, async {
             let s = conn
-                .prepare_cached(&format!(
-                    "DELETE FROM {table} WHERE ctid IN (SELECT ctid FROM {table}{where_clause} LIMIT {chunk_size})"
-                ))
+                .prepare_cached(&format!("DELETE FROM {table}{where_clause}"))
                 .await
                 .map_err(into_error)?;
 
+            match conn.execute(&s, params.as_slice()).await {
+                Ok(deleted) => return Ok(deleted),
+                Err(err) if is_timeout_error(&err) => (),
+                Err(err) => return Err(into_error(err)),
+            }
+
+            let mut chunk_size = DELETE_CHUNK_SIZE;
+            let mut deleted = 0;
+
             loop {
-                match conn.execute(&s, params.as_slice()).await {
-                    Ok(0) => return Ok(deleted),
-                    Ok(affected) => deleted += affected,
-                    Err(err) if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE => {
-                        chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
-                        break;
+                let s = conn
+                    .prepare_cached(&format!(
+                        "DELETE FROM {table} WHERE ctid IN (SELECT ctid FROM {table}{where_clause} LIMIT {chunk_size})"
+                    ))
+                    .await
+                    .map_err(into_error)?;
+
+                loop {
+                    match conn.execute(&s, params.as_slice()).await {
+                        Ok(0) => return Ok(deleted),
+                        Ok(affected) => deleted += affected,
+                        Err(err) if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE => {
+                            chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
+                            break;
+                        }
+                        Err(err) => return Err(into_error(err)),
                     }
-                    Err(err) => return Err(into_error(err)),
                 }
             }
-        }
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     fn build_filter<'x>(
         &self,
         query: &mut String,
         filters: &'x [SearchFilter],
-    ) -> Vec<&'x (dyn ToSql + Sync)> {
+    ) -> Vec<SqlParam<'x>> {
         if filters.is_empty() {
             return Vec::new();
         }
@@ -237,28 +290,54 @@ impl PostgresStore {
 
                         if matches!(language, Language::None) {
                             let _ = write!(query, "@@ {method}('{config}', ${value_pos})");
+                            if let SearchValue::Text { value, .. } = value {
+                                values.push(SqlParam::Owned(keyword_terms(value)));
+                                continue;
+                            }
                         } else {
+                            // inbuxa: a query word written as a URL, host,
+                            // file or hyphenated word also matches as its word
+                            // parts, which url_terms() indexes
+                            let parts = match value {
+                                SearchValue::Text { value, .. } => query_url_terms(value),
+                                _ => None,
+                            };
+                            let parts_pos = value_pos + 1;
                             let _ = write!(query, "@@ ({method}('{config}', ${value_pos})");
+                            if parts.is_some() {
+                                let _ = write!(query, " || {method}('{config}', ${parts_pos})");
+                            }
                             for fallback in [PG_FALLBACK_LANG, PG_UNSTEMMED_LANG] {
                                 if fallback != config && self.ts_configs.contains(fallback) {
                                     let _ =
                                         write!(query, " || {method}('{fallback}', ${value_pos})");
+                                    if parts.is_some() {
+                                        let _ = write!(
+                                            query,
+                                            " || {method}('{fallback}', ${parts_pos})"
+                                        );
+                                    }
                                 }
                             }
                             query.push(')');
+                            values.push(SqlParam::Ref(value));
+                            if let Some(parts) = parts {
+                                values.push(SqlParam::Owned(parts));
+                            }
+                            continue;
                         }
-                        values.push(value as &(dyn ToSql + Sync));
+                        values.push(SqlParam::Ref(value));
                     } else if let SearchValue::KeyValues(kv) = value {
                         query.push_str(field.column());
                         query.push(' ');
 
                         let (key, value) = kv.iter().next().unwrap();
-                        values.push(key as &(dyn ToSql + Sync));
+                        values.push(SqlParam::Ref(key));
 
                         if !value.is_empty() {
                             let _ = write!(query, "->> ${value_pos} ");
                             op.write_pqsql(query, values.len() + 1);
-                            values.push(value as &(dyn ToSql + Sync));
+                            values.push(SqlParam::Ref(value));
                         } else {
                             let _ = write!(query, " ? ${value_pos}");
                         }
@@ -267,7 +346,7 @@ impl PostgresStore {
                         query.push(' ');
 
                         op.write_pqsql(query, value_pos);
-                        values.push(value as &(dyn ToSql + Sync));
+                        values.push(SqlParam::Ref(value));
                     }
                 }
                 SearchFilter::And | SearchFilter::Or => {
@@ -321,6 +400,107 @@ impl PostgresStore {
     }
 }
 
+// inbuxa: PostgreSQL's text parser keeps "[email protected]" (and host names,
+// URLs, file paths, ...) as a single token, so a search for "user" or
+// "example.com" never matched an address. Keyword text is split into words the
+// same way the built-in index splits it (SpaceTokenizer: lowercase runs of
+// alphanumerics) on both the indexing and the query side, so a full address,
+// its local part, its domain and the display-name words all match, as they do
+// on the other backends.
+pub(crate) fn keyword_terms(value: &str) -> String {
+    let mut terms = String::with_capacity(value.len());
+    for token in SpaceTokenizer::new(value, MAX_TOKEN_LENGTH) {
+        if !terms.is_empty() {
+            terms.push(' ');
+        }
+        terms.push_str(&token);
+    }
+    terms
+}
+
+// inbuxa: in language text (subject, body, attachments) PostgreSQL's parser
+// keeps a URL, a host name, a path or a file name as tokens of its own:
+// "https://x.example/shipping-support/" gives a url, a host and a url_path,
+// "invoice-2024.pdf" a file, so a body search for "shipping" or "invoice"
+// missed messages where the word appears only there, while the built-in index
+// splits them into words. The text is indexed as it was, followed by the word
+// parts of each such token (SpaceTokenizer, as keyword_terms() splits), so
+// they go through the same configuration and stemming as the words around
+// them. On sample mail the text vector grows by about 15% for a newsletter
+// full of tracking links and 30% for a short order notice with three links.
+// Plain words, and words that only carry punctuation ("end.", "(see"),
+// add nothing; hyphenated words are already split by the parser. Returns None
+// when there is nothing to add, so most text is indexed exactly as before.
+/// Characters that join the parts of a URL, host, path, address or file name.
+const URL_SEPARATORS: [char; 13] = [
+    '/', '.', '@', ':', '?', '=', '&', '#', '_', '%', '+', '~', '\\',
+];
+
+pub(crate) fn url_terms(value: &str) -> Option<String> {
+    let mut terms = String::new();
+    // Each word is added once: a phrase search still finds the first URL it
+    // is in, and a newsletter's hundred tracking links don't add a hundred
+    // positions for "utm" and "campaign"
+    let mut seen = std::collections::HashSet::new();
+    for token in value.split(|c: char| {
+        c.is_whitespace() || matches!(c, '<' | '>' | '"' | '(' | ')' | '[' | ']' | '{' | '}')
+    }) {
+        let token = token.trim_matches(|c: char| !c.is_alphanumeric());
+        if token.contains(URL_SEPARATORS) {
+            for word in SpaceTokenizer::new(token, MAX_TOKEN_LENGTH) {
+                if !seen.insert(word.clone()) {
+                    continue;
+                }
+                if terms.is_empty() {
+                    terms.reserve(value.len() + 64);
+                    terms.push_str(value);
+                    terms.push('\n');
+                } else {
+                    terms.push(' ');
+                }
+                terms.push_str(&word);
+            }
+        }
+    }
+    (!terms.is_empty()).then_some(terms)
+}
+
+/// The query side of url_terms(): each query word that is a URL, host, file
+/// name or hyphenated word replaced by its word parts, or None when there is
+/// none. It is searched in addition to the query as written, so documents
+/// indexed before url_terms() still match as they did.
+pub(crate) fn query_url_terms(value: &str) -> Option<String> {
+    let mut terms = String::with_capacity(value.len());
+    let mut changed = false;
+    for token in value.split_whitespace() {
+        let word = token.trim_matches(|c: char| !c.is_alphanumeric());
+        if !terms.is_empty() {
+            terms.push(' ');
+        }
+        if word.contains(URL_SEPARATORS) || word.contains('-') {
+            changed = true;
+            terms.push_str(&keyword_terms(word));
+        } else {
+            terms.push_str(token);
+        }
+    }
+    changed.then_some(terms)
+}
+
+pub(super) enum SqlParam<'x> {
+    Ref(&'x (dyn ToSql + Sync)),
+    Owned(String),
+}
+
+impl SqlParam<'_> {
+    fn as_sql(&self) -> &(dyn ToSql + Sync) {
+        match self {
+            SqlParam::Ref(value) => *value,
+            SqlParam::Owned(value) => value,
+        }
+    }
+}
+
 fn build_sort(query: &mut String, sort: &[SearchComparator]) {
     query.push_str(" ORDER BY ");
     for (i, comparator) in sort.iter().enumerate() {

crates/store/src/backend/postgres/write.rs

@@ -2,9 +2,11 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use super::{PostgresStore, into_error, is_timeout_error};
+use super::{PostgresStore, bounded, into_error, is_timeout_error};
 use crate::{
     IndexKey, Key, LogKey, SUBSPACE_COUNTER, SUBSPACE_IN_MEMORY_COUNTER, SUBSPACE_QUOTA,
     SUBSPACE_REGISTRY_IDX,
@@ -30,48 +32,53 @@ enum CommitError {
 impl PostgresStore {
     pub(crate) async fn write(&self, mut batch: Batch<'_>) -> trc::Result<AssignedIds> {
         let mut conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let start = Instant::now();
-        let mut retry_count = 0;
+        let limit = self.timeouts.query;
+        let result = tokio::time::timeout(limit, async {
+            let start = Instant::now();
+            let mut retry_count = 0;
 
-        loop {
-            match self.write_trx(&mut conn, &mut batch).await {
-                Ok(result) => {
-                    return Ok(result);
-                }
-                Err(err) => {
-                    match err {
-                        CommitError::Postgres(err) => match err.code() {
-                            Some(
-                                &SqlState::T_R_SERIALIZATION_FAILURE
-                                | &SqlState::T_R_DEADLOCK_DETECTED,
-                            ) if retry_count < MAX_COMMIT_ATTEMPTS
-                                && start.elapsed() < MAX_COMMIT_TIME => {}
-                            Some(&SqlState::UNIQUE_VIOLATION) => {
-                                return Err(trc::StoreEvent::AssertValueFailed
-                                    .into_err()
-                                    .reason("Unique violation")
-                                    .caused_by(trc::location!()));
-                            }
-                            _ => return Err(into_error(err)),
-                        },
-                        CommitError::Internal(err) => return Err(err),
-                        /*CommitError::Retry => {
-                            if retry_count > MAX_COMMIT_ATTEMPTS
-                                || start.elapsed() > MAX_COMMIT_TIME
-                            {
-                                return Err(trc::StoreEvent::AssertValueFailed
-                                    .into_err()
-                                    .caused_by(trc::location!()));
-                            }
-                        }*/
+            loop {
+                match self.write_trx(&mut conn, &mut batch).await {
+                    Ok(result) => {
+                        return Ok(result);
                     }
+                    Err(err) => {
+                        match err {
+                            CommitError::Postgres(err) => match err.code() {
+                                Some(
+                                    &SqlState::T_R_SERIALIZATION_FAILURE
+                                    | &SqlState::T_R_DEADLOCK_DETECTED,
+                                ) if retry_count < MAX_COMMIT_ATTEMPTS
+                                    && start.elapsed() < MAX_COMMIT_TIME => {}
+                                Some(&SqlState::UNIQUE_VIOLATION) => {
+                                    return Err(trc::StoreEvent::AssertValueFailed
+                                        .into_err()
+                                        .reason("Unique violation")
+                                        .caused_by(trc::location!()));
+                                }
+                                _ => return Err(into_error(err)),
+                            },
+                            CommitError::Internal(err) => return Err(err),
+                            /*CommitError::Retry => {
+                                if retry_count > MAX_COMMIT_ATTEMPTS
+                                    || start.elapsed() > MAX_COMMIT_TIME
+                                {
+                                    return Err(trc::StoreEvent::AssertValueFailed
+                                        .into_err()
+                                        .caused_by(trc::location!()));
+                                }
+                            }*/
+                        }
 
-                    let backoff = rand::rng().random_range(50..=300);
-                    tokio::time::sleep(Duration::from_millis(backoff)).await;
-                    retry_count += 1;
+                        let backoff = rand::rng().random_range(50..=300);
+                        tokio::time::sleep(Duration::from_millis(backoff)).await;
+                        retry_count += 1;
+                    }
                 }
             }
-        }
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     async fn write_trx(
@@ -393,72 +400,81 @@ impl PostgresStore {
 
     pub(crate) async fn purge_store(&self) -> trc::Result<()> {
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
+        let limit = self.timeouts.maintenance;
+        let result = tokio::time::timeout(limit, async {
+            for subspace in [SUBSPACE_QUOTA, SUBSPACE_COUNTER, SUBSPACE_IN_MEMORY_COUNTER] {
+                purge_table(&conn, char::from(subspace)).await?;
+            }
 
-        for subspace in [SUBSPACE_QUOTA, SUBSPACE_COUNTER, SUBSPACE_IN_MEMORY_COUNTER] {
-            purge_table(&conn, char::from(subspace)).await?;
-        }
-
-        Ok(())
+            Ok(())
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 
     pub(crate) async fn delete_range(&self, from: impl Key, to: impl Key) -> trc::Result<()> {
         let conn = self.conn_pool.get().await.map_err(into_pool_error)?;
-        let table = char::from(from.subspace());
-        let mut from = from.serialize(0);
-        let to = to.serialize(0);
+        let limit = self.timeouts.maintenance;
+        let result = tokio::time::timeout(limit, async {
+            let table = char::from(from.subspace());
+            let mut from = from.serialize(0);
+            let to = to.serialize(0);
 
-        let delete = conn
-            .prepare_cached(&format!("DELETE FROM {table} WHERE k >= $1 AND k < $2"))
-            .await
-            .map_err(into_error)?;
-
-        match conn.execute(&delete, &[&from, &to]).await {
-            Ok(_) => return Ok(()),
-            Err(err) if is_timeout_error(&err) => (),
-            Err(err) => return Err(into_error(err)),
-        }
-
-        let mut chunk_size = DELETE_CHUNK_SIZE;
-
-        loop {
-            let boundary = conn
-                .prepare_cached(&format!(
-                    "SELECT k FROM {table} WHERE k >= $1 AND k < $2 ORDER BY k ASC LIMIT 1 OFFSET {chunk_size}"
-                ))
+            let delete = conn
+                .prepare_cached(&format!("DELETE FROM {table} WHERE k >= $1 AND k < $2"))
                 .await
                 .map_err(into_error)?;
 
+            match conn.execute(&delete, &[&from, &to]).await {
+                Ok(_) => return Ok(()),
+                Err(err) if is_timeout_error(&err) => (),
+                Err(err) => return Err(into_error(err)),
+            }
+
+            let mut chunk_size = DELETE_CHUNK_SIZE;
+
             loop {
-                let next = match conn.query_opt(&boundary, &[&from, &to]).await {
-                    Ok(next) => match next {
-                        Some(row) => Some(row.try_get::<_, Vec<u8>>(0).map_err(into_error)?),
-                        None => None,
-                    },
-                    Err(err) if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE => {
-                        chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
-                        break;
-                    }
-                    Err(err) => return Err(into_error(err)),
-                };
-
-                match conn
-                    .execute(&delete, &[&from, next.as_ref().unwrap_or(&to)])
+                let boundary = conn
+                    .prepare_cached(&format!(
+                        "SELECT k FROM {table} WHERE k >= $1 AND k < $2 ORDER BY k ASC LIMIT 1 OFFSET {chunk_size}"
+                    ))
                     .await
-                {
-                    Ok(_) => (),
-                    Err(err) if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE => {
-                        chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
-                        break;
-                    }
-                    Err(err) => return Err(into_error(err)),
-                }
+                    .map_err(into_error)?;
 
-                match next {
-                    Some(next) => from = next,
-                    None => return Ok(()),
+                loop {
+                    let next = match conn.query_opt(&boundary, &[&from, &to]).await {
+                        Ok(next) => match next {
+                            Some(row) => Some(row.try_get::<_, Vec<u8>>(0).map_err(into_error)?),
+                            None => None,
+                        },
+                        Err(err) if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE => {
+                            chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
+                            break;
+                        }
+                        Err(err) => return Err(into_error(err)),
+                    };
+
+                    match conn
+                        .execute(&delete, &[&from, next.as_ref().unwrap_or(&to)])
+                        .await
+                    {
+                        Ok(_) => (),
+                        Err(err) if is_timeout_error(&err) && chunk_size > MIN_DELETE_CHUNK_SIZE => {
+                            chunk_size = (chunk_size / 2).max(MIN_DELETE_CHUNK_SIZE);
+                            break;
+                        }
+                        Err(err) => return Err(into_error(err)),
+                    }
+
+                    match next {
+                        Some(next) => from = next,
+                        None => return Ok(()),
+                    }
                 }
             }
-        }
+        })
+        .await;
+        bounded(conn, result, limit)
     }
 }
 

crates/store/src/backend/query_timeout.rs

@@ -0,0 +1,77 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! Client-side limits on SQL queries.
+//!
+//! The pool timeouts bound getting a connection, not using one. A database
+//! that stops answering while the TCP connection stays up (a paused
+//! container, a hung server whose kernel still acknowledges keepalives)
+//! left a query on a checked-out connection waiting for as long as it took.
+//! A server-side statement_timeout can't help there: the server that would
+//! enforce it is the one not answering. So each operation on a PostgreSQL
+//! or MySQL connection runs under a time limit here, and a connection whose
+//! operation ran out is closed rather than put back in the pool, since its
+//! protocol state is unknown.
+//!
+//! Two limits:
+//! - `query`, two minutes, for request-path work: reads, writes, blob
+//!   transfers, search queries and document indexing. Those take
+//!   milliseconds; two minutes leaves room for a large blob over a slow
+//!   link and still ends a hang.
+//! - `maintenance`, thirty minutes, for work that legitimately runs long in
+//!   one statement: range deletes (account removal, purges), unindexing,
+//!   and creating tables and indexes at startup.
+//!
+//! Iterating over a range (exports, reindexing, maintenance scans) can run
+//! for hours, so there the `query` limit applies to each wait for the next
+//! row instead of the whole scan.
+
+use std::time::Duration;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct QueryTimeouts {
+    pub query: Duration,
+    pub maintenance: Duration,
+}
+
+impl QueryTimeouts {
+    pub const QUERY: Duration = Duration::from_secs(120);
+    pub const MAINTENANCE: Duration = Duration::from_secs(30 * 60);
+}
+
+impl Default for QueryTimeouts {
+    fn default() -> Self {
+        Self {
+            query: Self::QUERY,
+            maintenance: Self::MAINTENANCE,
+        }
+    }
+}
+
+#[cfg(feature = "test_mode")]
+impl crate::Store {
+    /// Sets the query limits of a SQL store that was just built (tests only:
+    /// the limits aren't configurable).
+    pub fn with_query_timeouts(self, timeouts: QueryTimeouts) -> Self {
+        match self {
+            #[cfg(feature = "postgres")]
+            crate::Store::PostgreSQL(mut store) => {
+                std::sync::Arc::get_mut(&mut store)
+                    .expect("store already shared")
+                    .timeouts = timeouts;
+                crate::Store::PostgreSQL(store)
+            }
+            #[cfg(feature = "mysql")]
+            crate::Store::MySQL(mut store) => {
+                std::sync::Arc::get_mut(&mut store)
+                    .expect("store already shared")
+                    .timeouts = timeouts;
+                crate::Store::MySQL(store)
+            }
+            store => store,
+        }
+    }
+}

crates/store/src/backend/redis/lookup.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use super::{RedisPool, RedisStore, into_error};
@@ -79,6 +81,30 @@ impl RedisStore {
         }
     }
 
+    // inbuxa: see InMemoryStore::renew_lock
+    pub async fn renew_lock(&self, key: &[u8], expires: u64) -> trc::Result<bool> {
+        match &self.pool {
+            RedisPool::Single(pool) => {
+                with_conn(pool, async |conn| {
+                    Self::renew_lock_(conn, key, expires).await
+                })
+                .await
+            }
+            RedisPool::Cluster(pool) => {
+                with_conn(pool, async |conn| {
+                    Self::renew_lock_(conn, key, expires).await
+                })
+                .await
+            }
+            RedisPool::Sentinel(pool) => {
+                with_conn(pool, async |conn| {
+                    Self::renew_lock_(conn, key, expires).await
+                })
+                .await
+            }
+        }
+    }
+
     pub async fn key_delete(&self, key: &[u8]) -> trc::Result<()> {
         match &self.pool {
             RedisPool::Single(pool) => {
@@ -226,6 +252,22 @@ impl RedisStore {
             .map(|reply| reply.is_some())
     }
 
+    async fn renew_lock_(
+        conn: &mut impl AsyncCommands,
+        key: &[u8],
+        expires: u64,
+    ) -> RedisResult<bool> {
+        redis::cmd("SET")
+            .arg(key)
+            .arg(now() + expires)
+            .arg("XX")
+            .arg("EX")
+            .arg(expires as i64)
+            .query_async::<Option<String>>(conn)
+            .await
+            .map(|reply| reply.is_some())
+    }
+
     async fn key_delete_(conn: &mut impl AsyncCommands, key: &[u8]) -> RedisResult<()> {
         conn.del(key).await
     }

crates/store/src/dispatch/lookup.rs

@@ -401,6 +401,57 @@ impl InMemoryStore {
         }
     }
 
+    /// inbuxa: extends a lock this node holds to `duration` seconds from now.
+    /// Returns false when the lock is gone or has expired: it may have been
+    /// taken by someone else since, so it is left alone.
+    pub async fn renew_lock(&self, prefix: u8, key: &[u8], duration: u64) -> trc::Result<bool> {
+        match self {
+            InMemoryStore::Store(store) => {
+                let key = KeyValue::<()>::build_key(prefix, key);
+                let key = ValueClass::InMemory(InMemoryClass::Key(key));
+                let Some(lock_expiry) = store
+                    .get_value::<u64>(ValueKey::from(key.clone()))
+                    .await
+                    .caused_by(trc::location!())?
+                else {
+                    return Ok(false);
+                };
+                let now = now();
+                if lock_expiry <= now {
+                    return Ok(false);
+                }
+
+                let mut batch = BatchBuilder::new();
+                batch.assert_value(key.clone(), AssertValue::U64(lock_expiry));
+                batch.set(key, (now + duration).serialize());
+                match store.write(batch.build_all()).await {
+                    Ok(_) => Ok(true),
+                    Err(err) if err.is_assertion_failure() => Ok(false),
+                    Err(err) => Err(err
+                        .details("Failed to renew lock.")
+                        .caused_by(trc::location!())),
+                }
+            }
+            InMemoryStore::Sharded(store) => {
+                Box::pin(
+                    store
+                        .member(&KeyValue::<()>::build_key(prefix, key))
+                        .renew_lock(prefix, key, duration),
+                )
+                .await
+            }
+            #[cfg(feature = "redis")]
+            InMemoryStore::Redis(store) => {
+                store
+                    .renew_lock(&KeyValue::<()>::build_key(prefix, key), duration)
+                    .await
+            }
+            InMemoryStore::Static(_) | InMemoryStore::Http(_) => {
+                Err(trc::StoreEvent::NotSupported.into_err())
+            }
+        }
+    }
+
     pub async fn remove_lock(&self, prefix: u8, key: &[u8]) -> trc::Result<()> {
         self.key_delete(KeyValue::<()>::build_key(prefix, key))
             .await

crates/trc/src/ipc/collector.rs

@@ -245,9 +245,27 @@ impl Collector {
                 Update::RegisterReceiver { receiver } => {
                     self.receivers.push(receiver);
                 }
-                Update::RegisterSubscriber { subscriber } => {
-                    ACTIVE_SUBSCRIBERS.lock().push(subscriber.id.clone());
-                    self.subscribers.push(subscriber);
+                Update::RegisterSubscriber { mut subscriber } => {
+                    // inbuxa: a subscriber registered under the id of a
+                    // running one replaces it (a tracer whose settings
+                    // changed). Every event collected so far went to the old
+                    // one, every later event goes to the new one: the old
+                    // one's batch is sent first (anything its full channel
+                    // can't take moves over, rather than being dropped), and
+                    // dropping it closes its channel, so its task writes
+                    // what is queued and ends.
+                    if let Some(old) = self.subscribers.iter_mut().find(|s| s.id == subscriber.id) {
+                        let _ = old.send_batch();
+                        if !old.batch.is_empty() {
+                            let mut batch = std::mem::take(&mut old.batch);
+                            batch.append(&mut subscriber.batch);
+                            subscriber.batch = batch;
+                        }
+                        *old = subscriber;
+                    } else {
+                        ACTIVE_SUBSCRIBERS.lock().push(subscriber.id.clone());
+                        self.subscribers.push(subscriber);
+                    }
                 }
                 Update::UnregisterSubscriber { id } => {
                     ACTIVE_SUBSCRIBERS.lock().retain(|s| s != &id);

crates/trc/src/ipc/subscriber.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use std::sync::Arc;
@@ -105,6 +107,9 @@ impl SubscriberBuilder {
         self
     }
 
+    /// Registers the subscriber with the collector. inbuxa: one registered
+    /// under the id of a running subscriber replaces it, handing over at an
+    /// event boundary; the old one's channel then closes.
     pub fn register(self) -> (mpsc::Sender<EventBatch>, mpsc::Receiver<EventBatch>) {
         let (tx, rx) = mpsc::channel(8192);
 

crates/types/src/branding.rs

@@ -81,7 +81,7 @@ fn legacy_setting(name: &str, is_set: impl Fn(&str) -> bool) -> Option<String> {
 #[macro_export]
 macro_rules! brand_version {
     () => {
-        "2026.9.24.3"
+        "2026.9.25"
     };
 }
 

tests/src/cluster/broadcast.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::{
@@ -11,6 +13,7 @@ use crate::{
         server::TestServerBuilder,
     },
 };
+use common::BuildServer;
 use imap_proto::ResponseType;
 use registry::{
     schema::{
@@ -18,7 +21,8 @@ use registry::{
         prelude::{ObjectType, Property, SocketAddr},
         structs::{
             ClusterListenerGroup, ClusterListenerGroupProperties, ClusterRole, ClusterTaskGroup,
-            Coordinator, Imap, NatsCoordinator, NetworkListener, RedisStore,
+            Coordinator, Imap, MtaDeliverySchedule, MtaVirtualQueue, NatsCoordinator,
+            NetworkListener, RedisStore,
         },
     },
     types::map::Map,
@@ -209,6 +213,45 @@ pub async fn cluster_tests() {
         Some("John Doe")
     );
 
+    // inbuxa: a settings write applies on every node, no ReloadSettings
+    let queue_id = admin
+        .registry_create_object(MtaVirtualQueue {
+            name: "clusterq".into(),
+            threads_per_node: 1,
+            description: None,
+        })
+        .await;
+    admin
+        .registry_create_object(MtaDeliverySchedule {
+            name: "cluster-autoreload".into(),
+            queue_id,
+            ..Default::default()
+        })
+        .await;
+    for (node_id, test) in servers.iter().enumerate() {
+        let started = std::time::Instant::now();
+        while !test
+            .server
+            .inner
+            .build_server()
+            .core
+            .smtp
+            .queue
+            .queue_strategy
+            .contains_key("cluster-autoreload")
+        {
+            assert!(
+                started.elapsed() < std::time::Duration::from_secs(5),
+                "node {node_id} didn't pick up the new delivery schedule"
+            );
+            tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+        }
+        println!(
+            "Node {node_id} has the new delivery schedule after {} ms",
+            started.elapsed().as_millis()
+        );
+    }
+
     // Run IMAP idle tests across nodes
     let mut node1_client = imap_client("[email protected]", "this is john's secret", 1).await;
     let mut node2_client = imap_client("[email protected]", "this is john's secret", 2).await;

tests/src/cluster/front_reports.rs

@@ -0,0 +1,317 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! DMARC results recorded on a node without outboundMta reach the aggregate
+//! report, which a node with outboundMta builds and sends. Before, a front
+//! node's results were dropped (or, before live roles, left in a channel
+//! nobody read), so the report covered only the mail the outbound nodes
+//! received. Also checks that nodes appending to one report at once lose
+//! nothing. Needs a store the nodes can share (STORE=PostgreSql or MySql).
+
+use crate::{smtp::inbound::TestMessage, utils::server::TestServerBuilder};
+use common::{Server, config::smtp::report::AggregateFrequency, ipc::DmarcEvent};
+use mail_auth::{
+    common::parse::TxtRecordParser,
+    dmarc::Dmarc,
+    report::{ActionDisposition, DmarcResult, Record, Report},
+};
+use registry::{
+    schema::{
+        enums::ClusterTaskType,
+        prelude::{ObjectType, Property},
+        structs::{
+            ClusterListenerGroup, ClusterRole, ClusterTaskGroup, ClusterTaskGroupProperties,
+            DmarcInternalReport, DmarcReportSettings, Expression, Task, TaskDmarcReport,
+            TaskStatus,
+        },
+    },
+    types::{EnumImpl, map::Map},
+};
+use smtp::reporting::{dmarc::DmarcReporting, send::MtaReportSend};
+use std::{
+    collections::BTreeSet,
+    net::IpAddr,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+use store::{
+    ValueKey,
+    registry::{RegistryFilter, RegistryFilterValue, RegistryQuery},
+    write::{BatchBuilder, RegistryClass, TaskQueueClass, ValueClass, now},
+};
+use types::id::Id;
+
+const FRONT_ROLE: &str = "front_reports_front";
+const MTA_ROLE: &str = "front_reports_mta";
+const DOMAIN: &str = "front-reports.example";
+
+#[tokio::test(flavor = "multi_thread")]
+pub async fn front_node_report_tests() {
+    if matches!(
+        std::env::var("STORE").as_deref(),
+        Ok("RocksDb" | "Sqlite") | Err(_)
+    ) {
+        println!("Skipping front node report tests: they need a store the nodes can share.");
+        return;
+    }
+    println!(
+        "Running front node report tests on {}...",
+        std::env::var("STORE").unwrap_or_default()
+    );
+
+    // A front role without outboundMta, an MTA role with it
+    let seed = TestServerBuilder::new("front_reports_seed").await;
+    seed.insert_object(role(FRONT_ROLE, &[ClusterTaskType::PushNotifications]))
+        .await;
+    seed.insert_object(role(MTA_ROLE, &[ClusterTaskType::OutboundMta]))
+        .await;
+    seed.insert_object(DmarcReportSettings {
+        aggregate_max_report_size: Expression {
+            else_: "1048576".into(),
+            ..Default::default()
+        },
+        ..Default::default()
+    })
+    .await;
+    let seed = seed.disable_services().build().await;
+
+    // The front node receives mail from two sources: the events its SMTP
+    // sessions hand the report scheduler
+    let front = TestServerBuilder::new_with_role(
+        "front_reports_front",
+        "front.front-reports.example".into(),
+        Some(FRONT_ROLE.into()),
+        false,
+    )
+    .await
+    .build_with_opts(false)
+    .await;
+    let front_server = front.server.clone();
+    assert!(!front_server.core.network.roles.outbound_mta);
+    for ip in ["192.0.2.1", "192.0.2.2"] {
+        front_server.schedule_report(event(ip)).await;
+    }
+
+    // Both are recorded in the shared report. Upstream, and main after live
+    // roles, left the front node's results out
+    let report_id = wait_for_report(&front_server, 2).await;
+
+    // Make the report due now. The front node leaves it alone: building and
+    // sending it is the outbound MTA's
+    move_task(&front_server, report_id, TaskStatus::now()).await;
+    tokio::time::sleep(Duration::from_secs(3)).await;
+    front_server.notify_task_queue();
+    tokio::time::sleep(Duration::from_secs(2)).await;
+    assert!(
+        task_exists(&front_server, report_id).await,
+        "the front node ran the report task"
+    );
+
+    // Several writers append to the report at once, from both nodes: none
+    // of their records is lost. The report waits in the future meanwhile, or
+    // the MTA node would send it as soon as it starts
+    move_task(
+        &front_server,
+        report_id,
+        TaskStatus::at(now() as i64 + 3600),
+    )
+    .await;
+    let mut mta = TestServerBuilder::new_with_role(
+        "front_reports_mta",
+        "mta.front-reports.example".into(),
+        Some(MTA_ROLE.into()),
+        false,
+    )
+    .await
+    .capture_queue()
+    .build_with_opts(false)
+    .await;
+    let mta_server = mta.server.clone();
+    assert!(mta_server.core.network.roles.outbound_mta);
+
+    let concurrent: Vec<String> = (10..18).map(|n| format!("192.0.2.{n}")).collect();
+    let mut handles = Vec::new();
+    for (n, ip) in concurrent.iter().enumerate() {
+        let server = if n % 2 == 0 {
+            front_server.clone()
+        } else {
+            mta_server.clone()
+        };
+        let ip = ip.clone();
+        handles.push(tokio::spawn(async move {
+            server.schedule_dmarc(Box::new(event(&ip))).await;
+        }));
+    }
+    for handle in handles {
+        handle.await.unwrap();
+    }
+
+    // Due again, the MTA node sends the report with every record in it
+    move_task(&mta_server, report_id, TaskStatus::now()).await;
+    let message = mta.expect_message().await;
+    let report =
+        Report::parse_rfc5322(message.read_message(&mta).await.as_bytes(), usize::MAX).unwrap();
+    assert_eq!(report.domain(), DOMAIN);
+    let sent: BTreeSet<IpAddr> = report
+        .records()
+        .iter()
+        .map(|r| r.source_ip().unwrap())
+        .collect();
+    let expected: BTreeSet<IpAddr> = ["192.0.2.1", "192.0.2.2"]
+        .into_iter()
+        .map(String::from)
+        .chain(concurrent)
+        .map(|ip| ip.parse().unwrap())
+        .collect();
+    assert_eq!(sent, expected);
+    wait_for(Duration::from_secs(20), "report task to finish", || async {
+        !task_exists(&mta_server, report_id).await
+    })
+    .await;
+    assert!(reports(&mta_server).await.is_empty());
+
+    if seed.is_reset() {
+        seed.temp_dir.delete();
+        front.temp_dir.delete();
+        mta.temp_dir.delete();
+    }
+}
+
+fn role(name: &str, tasks: &[ClusterTaskType]) -> ClusterRole {
+    ClusterRole {
+        name: name.into(),
+        description: None,
+        listeners: ClusterListenerGroup::EnableAll,
+        tasks: ClusterTaskGroup::EnableSome(ClusterTaskGroupProperties {
+            task_types: Map::new(tasks.to_vec()),
+        }),
+    }
+}
+
+fn event(ip: &str) -> DmarcEvent {
+    DmarcEvent {
+        domain: DOMAIN.to_string(),
+        report_record: Record::new()
+            .with_source_ip(ip.parse().unwrap())
+            .with_action_disposition(ActionDisposition::Pass)
+            .with_dmarc_dkim_result(DmarcResult::Pass)
+            .with_dmarc_spf_result(DmarcResult::Pass)
+            .with_envelope_from("sender.example")
+            .with_header_from("sender.example"),
+        dmarc_record: Arc::new(
+            Dmarc::parse(format!("v=DMARC1; p=reject; rua=mailto:reports@{DOMAIN}").as_bytes())
+                .unwrap(),
+        ),
+        interval: AggregateFrequency::Daily,
+        span_id: 0,
+    }
+}
+
+async fn reports(server: &Server) -> Vec<(u64, DmarcInternalReport)> {
+    let ids = server
+        .registry()
+        .query::<Vec<Id>>(RegistryQuery::new(ObjectType::DmarcInternalReport).filter(
+            RegistryFilter::greater_than(
+                Property::Domain,
+                RegistryFilterValue::Bytes(vec![]),
+                true,
+            ),
+        ))
+        .await
+        .unwrap();
+    let mut reports = Vec::new();
+    for id in ids {
+        if let Some(report) = server
+            .store()
+            .get_value::<DmarcInternalReport>(ValueKey::from(ValueClass::Registry(
+                RegistryClass::Item {
+                    object_id: ObjectType::DmarcInternalReport.to_id(),
+                    item_id: id.id(),
+                },
+            )))
+            .await
+            .unwrap()
+        {
+            reports.push((id.id(), report));
+        }
+    }
+    reports
+}
+
+/// Waits for the report for `DOMAIN` to hold `records` records; returns its id.
+async fn wait_for_report(server: &Server, records: usize) -> u64 {
+    let started = Instant::now();
+    loop {
+        let found = reports(server)
+            .await
+            .into_iter()
+            .find(|(_, report)| report.domain == DOMAIN);
+        if let Some((id, report)) = &found
+            && report.report.records.len() == records
+        {
+            return *id;
+        }
+        assert!(
+            started.elapsed() < Duration::from_secs(10),
+            "no report with {records} records for {DOMAIN}: {found:?}"
+        );
+        tokio::time::sleep(Duration::from_millis(200)).await;
+    }
+}
+
+/// Reschedules the report's task.
+async fn move_task(server: &Server, id: u64, status: TaskStatus) {
+    let task = server
+        .store()
+        .get_value::<Task>(ValueKey::from(ValueClass::TaskQueue(
+            TaskQueueClass::Task { id },
+        )))
+        .await
+        .unwrap()
+        .expect("report task missing");
+    let mut batch = BatchBuilder::new();
+    batch
+        .clear(ValueClass::TaskQueue(TaskQueueClass::Due {
+            id,
+            due: task.due_timestamp(),
+        }))
+        .schedule_task_with_id(
+            id,
+            Task::DmarcReport(TaskDmarcReport {
+                report_id: id.into(),
+                status,
+            }),
+        );
+    server.store().write(batch.build_all()).await.unwrap();
+    server.notify_task_queue();
+}
+
+async fn task_exists(server: &Server, id: u64) -> bool {
+    server
+        .store()
+        .get_value::<Task>(ValueKey::from(ValueClass::TaskQueue(
+            TaskQueueClass::Task { id },
+        )))
+        .await
+        .unwrap()
+        .is_some()
+}
+
+async fn wait_for<F, Fut>(within: Duration, what: &str, mut check: F)
+where
+    F: FnMut() -> Fut,
+    Fut: Future<Output = bool>,
+{
+    let started = Instant::now();
+    while !check().await {
+        assert!(
+            started.elapsed() < within,
+            "still waiting for the {what} after {:?}",
+            started.elapsed()
+        );
+        tokio::time::sleep(Duration::from_millis(250)).await;
+    }
+}

tests/src/cluster/live_roles.rs

@@ -0,0 +1,297 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! A node follows edits to its cluster role without a restart: outbound
+//! delivery and report tasks start when the role gains outboundMta and stop
+//! when it loses it. Upstream decided at boot whether the queue, report and
+//! task managers ran at all. Needs a store the seed and the node can share
+//! (STORE=PostgreSql or MySql).
+
+use crate::utils::server::{TestServer, TestServerBuilder};
+use common::Server;
+use registry::{
+    schema::{
+        enums::ClusterTaskType,
+        prelude::{Object, ObjectType},
+        structs::{
+            ClusterListenerGroup, ClusterRole, ClusterTaskGroup, ClusterTaskGroupProperties, Task,
+            TaskStatus, TaskTlsReport,
+        },
+    },
+    types::{id::ObjectId, map::Map},
+};
+use smtp::{
+    queue::{Message, Status},
+    reporting::send::MtaReportSend,
+};
+use std::time::{Duration, Instant};
+use store::{
+    Deserialize, IterateParams, ValueKey,
+    registry::write::{RegistryWrite, RegistryWriteResult},
+    write::{AlignedBytes, Archive, BatchBuilder, QueueClass, TaskQueueClass, ValueClass},
+};
+use types::id::Id;
+use utils::snowflake::SnowflakeIdGenerator;
+
+const BUSY_ROLE: &str = "live_role_busy";
+const IDLE_ROLE: &str = "live_role_idle";
+const WITH: &[ClusterTaskType] = &[
+    ClusterTaskType::PushNotifications,
+    ClusterTaskType::OutboundMta,
+];
+const WITHOUT: &[ClusterTaskType] = &[ClusterTaskType::PushNotifications];
+const RCPT_DOMAIN: &str = "live-role.invalid";
+
+#[tokio::test(flavor = "multi_thread")]
+pub async fn live_role_tests() {
+    if matches!(
+        std::env::var("STORE").as_deref(),
+        Ok("RocksDb" | "Sqlite") | Err(_)
+    ) {
+        println!("Skipping live role tests: they need a store the nodes can share.");
+        return;
+    }
+    println!(
+        "Running live role tests on {}...",
+        std::env::var("STORE").unwrap_or_default()
+    );
+
+    // Two roles: one with outboundMta, one with no task type at all
+    let seed = TestServerBuilder::new("live_roles_seed").await;
+    let busy_id = seed.insert_object(role(BUSY_ROLE, WITH)).await;
+    let idle_id = seed.insert_object(role(IDLE_ROLE, WITHOUT)).await;
+    let seed = seed.disable_services().build().await;
+    let registry = seed.server.clone();
+
+    // 1. The rehearsal case: a node started with outboundMta has it taken
+    // away. Upstream kept delivering, report messages included, until a
+    // restart.
+    let node = start_node("live_roles_busy", BUSY_ROLE).await;
+    let server = node.server.clone();
+    assert!(server.core.network.roles.outbound_mta);
+    let (msg, task) = queue_work(&server, "busy-before").await;
+    assert_runs(&server, &msg, task).await;
+
+    set_role(&registry, &server, busy_id, role(BUSY_ROLE, WITHOUT)).await;
+    let (msg, task) = queue_work(&server, "busy-off").await;
+    assert_idle(&server, &msg, task).await;
+
+    // Given back, it takes up the work left waiting
+    set_role(&registry, &server, busy_id, role(BUSY_ROLE, WITH)).await;
+    assert_runs(&server, &msg, task).await;
+
+    // Off again, so it leaves the next node's work alone
+    set_role(&registry, &server, busy_id, role(BUSY_ROLE, WITHOUT)).await;
+
+    // 2. A node started with no task type at all gains outboundMta.
+    // Upstream never started its queue, report or task manager, so the
+    // role did nothing until a restart.
+    let node2 = start_node("live_roles_idle", IDLE_ROLE).await;
+    let server2 = node2.server.clone();
+    assert!(!server2.core.network.roles.outbound_mta);
+    let (msg, task) = queue_work(&server2, "idle-off").await;
+    assert_idle(&server2, &msg, task).await;
+    set_role(&registry, &server2, idle_id, role(IDLE_ROLE, WITH)).await;
+    assert_runs(&server2, &msg, task).await;
+    set_role(&registry, &server2, idle_id, role(IDLE_ROLE, WITHOUT)).await;
+
+    if seed.is_reset() {
+        seed.temp_dir.delete();
+        node.temp_dir.delete();
+        node2.temp_dir.delete();
+    }
+}
+
+async fn start_node(name: &str, role: &str) -> TestServer {
+    TestServerBuilder::new_with_role(
+        name,
+        format!("{name}.example.com").replace('_', "-"),
+        Some(role.into()),
+        false,
+    )
+    .await
+    .build_with_opts(false)
+    .await
+}
+
+/// Neither the message nor the report task is touched.
+async fn assert_idle(server: &Server, msg: &str, task: u64) {
+    tokio::time::sleep(Duration::from_secs(4)).await;
+    server.notify_task_queue();
+    tokio::time::sleep(Duration::from_secs(1)).await;
+    assert!(
+        !attempted(server, msg).await,
+        "delivery attempted without outboundMta"
+    );
+    assert!(
+        is_pending(server, task).await,
+        "report task claimed without outboundMta"
+    );
+}
+
+/// Delivery of the message is attempted and the report task runs.
+async fn assert_runs(server: &Server, msg: &str, task: u64) {
+    wait_for(Duration::from_secs(20), "message delivery attempt", || {
+        attempted(server, msg)
+    })
+    .await;
+    wait_for(Duration::from_secs(20), "report task to run", || async {
+        !is_pending(server, task).await
+    })
+    .await;
+}
+
+fn role(name: &str, tasks: &[ClusterTaskType]) -> ClusterRole {
+    ClusterRole {
+        name: name.into(),
+        description: None,
+        listeners: ClusterListenerGroup::EnableAll,
+        tasks: ClusterTaskGroup::EnableSome(ClusterTaskGroupProperties {
+            task_types: Map::new(tasks.to_vec()),
+        }),
+    }
+}
+
+/// Stores a new version of a role and reloads the node's settings, as a
+/// JMAP write to the role does.
+async fn set_role(registry: &Server, node: &Server, id: Id, new: ClusterRole) {
+    let enabled = matches!(&new.tasks, ClusterTaskGroup::EnableSome(group)
+        if group.task_types.iter().any(|t| *t == ClusterTaskType::OutboundMta));
+    let old = registry
+        .registry()
+        .get(ObjectId::new(ObjectType::ClusterRole, id))
+        .await
+        .unwrap()
+        .expect("role not found");
+    let new = Object::from(new);
+    let result = registry
+        .registry()
+        .write(RegistryWrite::update(id, &new, &old))
+        .await
+        .unwrap();
+    assert!(
+        matches!(result, RegistryWriteResult::Success(_)),
+        "role update refused"
+    );
+    assert_eq!(
+        node.reload_after_write(ObjectType::ClusterRole).await,
+        Some(Ok(()))
+    );
+    assert_eq!(
+        node.inner.shared_core.load().network.roles.outbound_mta,
+        enabled
+    );
+}
+
+/// Queues a message to an unreachable domain and schedules a TLS report
+/// task, both due now. Returns the recipient's local part and the task id.
+async fn queue_work(server: &Server, name: &str) -> (String, u64) {
+    let local = format!("{name}-{}", SnowflakeIdGenerator::global_id().unwrap());
+    let rcpt = format!("{local}@{RCPT_DOMAIN}");
+    server
+        .send_autogenerated(
+            "[email protected]",
+            [rcpt.as_str()].into_iter(),
+            format!(
+                "From: [email protected]\r\nTo: {rcpt}\r\n\
+                 Subject: live role test\r\n\r\nTest\r\n"
+            )
+            .into_bytes(),
+            None,
+            0,
+        )
+        .await;
+    assert!(
+        queued_recipient(server, &rcpt).await.is_some(),
+        "message to {rcpt} was not queued"
+    );
+
+    let task = SnowflakeIdGenerator::global_id().unwrap();
+    let mut batch = BatchBuilder::new();
+    batch.schedule_task_with_id(
+        task,
+        Task::TlsReport(TaskTlsReport {
+            report_id: u64::MAX.into(),
+            status: TaskStatus::now(),
+        }),
+    );
+    server.store().write(batch.build_all()).await.unwrap();
+    server.notify_task_queue();
+
+    (rcpt, task)
+}
+
+/// Whether delivery to `rcpt` was tried: the message is gone, or its
+/// recipient is no longer scheduled or has a retry count.
+async fn attempted(server: &Server, rcpt: &str) -> bool {
+    match queued_recipient(server, rcpt).await {
+        None => true,
+        Some((status_scheduled, retries)) => !status_scheduled || retries > 0,
+    }
+}
+
+/// The queued recipient `rcpt`: whether it is still scheduled, and how many
+/// times delivery was retried.
+async fn queued_recipient(server: &Server, rcpt: &str) -> Option<(bool, u32)> {
+    let mut found = None;
+    server
+        .store()
+        .iterate(
+            IterateParams::new(
+                ValueKey::from(ValueClass::Queue(QueueClass::Message(0))),
+                ValueKey::from(ValueClass::Queue(QueueClass::Message(u64::MAX))),
+            ),
+            |_, value| {
+                let message = <Archive<AlignedBytes> as Deserialize>::deserialize(value)?
+                    .deserialize::<Message>()?;
+                if let Some(recipient) = message
+                    .recipients
+                    .iter()
+                    .find(|recipient| recipient.address.as_ref() == rcpt)
+                {
+                    found = Some((
+                        matches!(recipient.status, Status::Scheduled),
+                        recipient.retry.inner,
+                    ));
+                    return Ok(false);
+                }
+                Ok(true)
+            },
+        )
+        .await
+        .unwrap();
+    found
+}
+
+async fn is_pending(server: &Server, id: u64) -> bool {
+    matches!(
+        server
+            .store()
+            .get_value::<Task>(ValueKey::from(ValueClass::TaskQueue(
+                TaskQueueClass::Task { id },
+            )))
+            .await
+            .unwrap()
+            .map(|task| task.status().clone()),
+        Some(TaskStatus::Pending(_))
+    )
+}
+
+async fn wait_for<F, Fut>(within: Duration, what: &str, mut check: F)
+where
+    F: FnMut() -> Fut,
+    Fut: Future<Output = bool>,
+{
+    let started = Instant::now();
+    while !check().await {
+        assert!(
+            started.elapsed() < within,
+            "still waiting for the {what} after {:?}",
+            started.elapsed()
+        );
+        tokio::time::sleep(Duration::from_millis(250)).await;
+    }
+}

tests/src/cluster/mod.rs

@@ -7,6 +7,9 @@
  */
 
 pub mod broadcast;
+pub mod front_reports; // inbuxa: every node records DMARC and TLS results
+pub mod live_roles; // inbuxa: role edits apply without a restart
 #[cfg(feature = "nats")]
 pub mod coordinator; // inbuxa: coordinator reconnects
 pub mod stress;
+pub mod task_roles; // inbuxa: task types follow cluster roles

tests/src/cluster/task_roles.rs

@@ -0,0 +1,218 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! Two task managers with different cluster roles over one shared store:
+//! each runs only the task types its role allows, and a task one node may
+//! not run is left for the node that may. Needs a store both nodes can open
+//! (STORE=PostgreSql or MySql).
+
+use crate::utils::server::TestServerBuilder;
+use common::Server;
+use registry::{
+    schema::{
+        enums::{ClusterTaskType, IndexDocumentType},
+        structs::{
+            ClusterListenerGroup, ClusterRole, ClusterTaskGroup, ClusterTaskGroupProperties, Task,
+            TaskDnsManagement, TaskIndexDocument, TaskStatus, TaskTlsReport,
+        },
+    },
+    types::map::Map,
+};
+use std::time::{Duration, Instant};
+use store::{
+    ValueKey,
+    write::{BatchBuilder, TaskQueueClass, ValueClass},
+};
+use utils::snowflake::SnowflakeIdGenerator;
+
+const QUEUE_ROLE: &str = "tasks_queue";
+const INDEX_MTA_ROLE: &str = "tasks_index_mta";
+
+#[tokio::test(flavor = "multi_thread")]
+pub async fn task_role_tests() {
+    if matches!(
+        std::env::var("STORE").as_deref(),
+        Ok("RocksDb" | "Sqlite") | Err(_)
+    ) {
+        println!("Skipping task role tests: they need a store both nodes can open.");
+        return;
+    }
+    println!(
+        "Running task role tests on {}...",
+        std::env::var("STORE").unwrap_or_default()
+    );
+
+    // The roles, stored by a node that runs no services of its own (a node
+    // looks its role up when it starts)
+    let seed = TestServerBuilder::new("task_roles_seed")
+        .await
+        .with_object(role(QUEUE_ROLE, &[ClusterTaskType::TaskQueueProcessing]))
+        .await
+        .with_object(role(
+            INDEX_MTA_ROLE,
+            &[
+                ClusterTaskType::SearchIndexing,
+                ClusterTaskType::OutboundMta,
+            ],
+        ))
+        .await
+        .disable_services()
+        .build()
+        .await;
+
+    // Node A runs queue tasks (taskQueueProcessing) only
+    let node_a = TestServerBuilder::new_with_role(
+        "task_roles_a",
+        "node-a.example.com".into(),
+        Some(QUEUE_ROLE.into()),
+        false,
+    )
+    .await
+    .build_with_opts(false)
+    .await;
+    let server_a = node_a.server.clone();
+    let roles = &server_a.core.network.roles;
+    assert!(roles.task_manager && !roles.search_indexing && !roles.outbound_mta);
+
+    // A DNS task (taskQueueProcessing), an unindex task (searchIndexing) and
+    // a TLS report (outboundMta), all due now
+    let [dns, unindex, report] = new_task_ids();
+    let mut batch = BatchBuilder::new();
+    batch
+        .schedule_task_with_id(
+            dns,
+            Task::DnsManagement(TaskDnsManagement {
+                status: TaskStatus::now(),
+                ..Default::default()
+            }),
+        )
+        .schedule_task_with_id(
+            unindex,
+            Task::UnindexDocument(TaskIndexDocument {
+                account_id: 0u32.into(),
+                document_id: u32::MAX.into(),
+                document_type: IndexDocumentType::File,
+                status: TaskStatus::now(),
+            }),
+        )
+        .schedule_task_with_id(
+            report,
+            Task::TlsReport(TaskTlsReport {
+                report_id: u64::MAX.into(),
+                status: TaskStatus::now(),
+            }),
+        );
+    server_a.store().write(batch.build_all()).await.unwrap();
+    server_a.notify_task_queue();
+
+    // Node A runs the DNS task and leaves the other two alone. Upstream ran
+    // the TLS report here too: report tasks ran on any node with a task
+    // manager.
+    wait_until_run(&server_a, &[dns], Duration::from_secs(20)).await;
+    tokio::time::sleep(Duration::from_secs(3)).await;
+    server_a.notify_task_queue();
+    tokio::time::sleep(Duration::from_secs(2)).await;
+    assert!(
+        is_pending(&server_a, unindex).await,
+        "unindex ran on node A"
+    );
+    assert!(
+        is_pending(&server_a, report).await,
+        "TLS report ran on node A"
+    );
+
+    // Node B (search indexing and outbound MTA) comes up and picks up what
+    // node A left
+    let node_b = TestServerBuilder::new_with_role(
+        "task_roles_b",
+        "node-b.example.com".into(),
+        Some(INDEX_MTA_ROLE.into()),
+        false,
+    )
+    .await
+    .build_with_opts(false)
+    .await;
+    let server_b = node_b.server.clone();
+    let roles = &server_b.core.network.roles;
+    assert!(!roles.task_manager && roles.search_indexing && roles.outbound_mta);
+    server_b.notify_task_queue();
+    wait_until_run(&server_b, &[unindex, report], Duration::from_secs(20)).await;
+
+    // A queue task scheduled now still runs, on node A: node B may not
+    // claim it
+    let [dns] = new_task_ids();
+    let mut batch = BatchBuilder::new();
+    batch.schedule_task_with_id(
+        dns,
+        Task::DnsManagement(TaskDnsManagement {
+            status: TaskStatus::now(),
+            ..Default::default()
+        }),
+    );
+    server_b.store().write(batch.build_all()).await.unwrap();
+    server_b.notify_task_queue();
+    tokio::time::sleep(Duration::from_secs(3)).await;
+    assert!(is_pending(&server_b, dns).await, "DNS task ran on node B");
+    server_a.notify_task_queue();
+    wait_until_run(&server_a, &[dns], Duration::from_secs(20)).await;
+
+    if seed.is_reset() {
+        seed.temp_dir.delete();
+        node_a.temp_dir.delete();
+        node_b.temp_dir.delete();
+    }
+}
+
+fn role(name: &str, tasks: &[ClusterTaskType]) -> ClusterRole {
+    ClusterRole {
+        name: name.into(),
+        description: None,
+        listeners: ClusterListenerGroup::EnableAll,
+        tasks: ClusterTaskGroup::EnableSome(ClusterTaskGroupProperties {
+            task_types: Map::new(tasks.to_vec()),
+        }),
+    }
+}
+
+fn new_task_ids<const N: usize>() -> [u64; N] {
+    std::array::from_fn(|_| SnowflakeIdGenerator::global_id().unwrap())
+}
+
+/// Still due and never run: present, and pending.
+async fn is_pending(server: &Server, id: u64) -> bool {
+    matches!(
+        server
+            .store()
+            .get_value::<Task>(ValueKey::from(ValueClass::TaskQueue(
+                TaskQueueClass::Task { id },
+            )))
+            .await
+            .unwrap()
+            .map(|task| task.status().clone()),
+        Some(TaskStatus::Pending(_))
+    )
+}
+
+async fn wait_until_run(server: &Server, ids: &[u64], within: Duration) {
+    let started = Instant::now();
+    loop {
+        let mut left = 0;
+        for id in ids {
+            if is_pending(server, *id).await {
+                left += 1;
+            }
+        }
+        if left == 0 {
+            return;
+        }
+        assert!(
+            started.elapsed() < within,
+            "{left} task(s) still pending after {:?}",
+            started.elapsed()
+        );
+        tokio::time::sleep(Duration::from_millis(250)).await;
+    }
+}

tests/src/smtp/inbound/milter.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::{
@@ -75,7 +77,7 @@ async fn milter_session() {
                 else_: "true".into(),
                 ..Default::default()
             },
-            hostname: "127.0.0.1".into(),
+            hostname: "localhost".into(), // inbuxa: resolved when the session connects
             port: 9332,
             use_tls: false,
             stages: Map::new(vec![MtaStage::Data]),

tests/src/smtp/inbound/mod.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::utils::server::TestServer;
@@ -40,15 +42,23 @@ pub mod vrfy;
 const EVENT_TIMEOUT: Duration = Duration::from_secs(5);
 
 impl TestServer {
+    // inbuxa: registry writes reload the settings, and each reload sends the
+    // queue a ReloadSettings; read_event, try_read_event and assert_no_events
+    // pass over those (expect_reload_settings still waits for one)
     pub async fn read_event(&mut self) -> QueueEvent {
-        if let Some(event) = self.queue_events.pop_front() {
-            return event;
+        while let Some(event) = self.queue_events.pop_front() {
+            if !event.is_reload_settings() {
+                return event;
+            }
         }
 
-        match tokio::time::timeout(EVENT_TIMEOUT, self.queue_rx.recv()).await {
-            Ok(Some(event)) => event,
-            Ok(None) => panic!("Channel closed."),
-            Err(_) => panic!("No queue event received."),
+        loop {
+            match tokio::time::timeout(EVENT_TIMEOUT, self.queue_rx.recv()).await {
+                Ok(Some(event)) if event.is_reload_settings() => (),
+                Ok(Some(event)) => return event,
+                Ok(None) => panic!("Channel closed."),
+                Err(_) => panic!("No queue event received."),
+            }
         }
     }
 
@@ -78,26 +88,39 @@ impl TestServer {
     }
 
     pub async fn try_read_event(&mut self) -> Option<QueueEvent> {
-        if let Some(event) = self.queue_events.pop_front() {
-            return Some(event);
+        while let Some(event) = self.queue_events.pop_front() {
+            if !event.is_reload_settings() {
+                return Some(event);
+            }
         }
 
-        match tokio::time::timeout(EVENT_TIMEOUT, self.queue_rx.recv()).await {
-            Ok(Some(event)) => Some(event),
-            Ok(None) => panic!("Channel closed."),
-            Err(_) => None,
+        loop {
+            match tokio::time::timeout(EVENT_TIMEOUT, self.queue_rx.recv()).await {
+                Ok(Some(event)) if event.is_reload_settings() => (),
+                Ok(Some(event)) => return Some(event),
+                Ok(None) => panic!("Channel closed."),
+                Err(_) => return None,
+            }
         }
     }
 
     pub fn assert_no_events(&mut self) {
-        if let Some(event) = self.queue_events.pop_front() {
+        if let Some(event) = self
+            .queue_events
+            .iter()
+            .find(|event| !event.is_reload_settings())
+        {
             panic!("Expected empty queue but got {event:?}");
         }
+        self.queue_events.clear();
 
-        match self.queue_rx.try_recv() {
-            Err(TryRecvError::Empty) => (),
-            Ok(event) => panic!("Expected empty queue but got {event:?}"),
-            Err(err) => panic!("Queue error: {err:?}"),
+        loop {
+            match self.queue_rx.try_recv() {
+                Ok(event) if event.is_reload_settings() => (),
+                Err(TryRecvError::Empty) => break,
+                Ok(event) => panic!("Expected empty queue but got {event:?}"),
+                Err(err) => panic!("Queue error: {err:?}"),
+            }
         }
     }
 

tests/src/smtp/reporting/mod.rs

@@ -2,9 +2,12 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 pub mod analyze;
 pub mod dmarc;
+pub mod reschedule; // inbuxa: report reschedules and unreadable queue rows
 pub mod scheduler;
 pub mod tls;

tests/src/smtp/reporting/reschedule.rs

@@ -0,0 +1,370 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! Rescheduling an internal DMARC or TLS report over JMAP moves its task: the
+//! task runs at the new time, x:Task/get shows the new due, and tasks due
+//! after it still run. A task queue row whose type can't be read is logged
+//! and repaired rather than stopping every task due after it, including the
+//! rows an earlier reschedule wrote with the report's object type.
+
+use crate::utils::server::{TestServer, TestServerBuilder};
+use common::{
+    Server,
+    config::smtp::report::AggregateFrequency,
+    ipc::{DmarcEvent, PolicyType, TlsEvent},
+};
+use mail_auth::{
+    common::parse::TxtRecordParser,
+    dmarc::Dmarc,
+    mta_sts::TlsRpt,
+    report::{ActionDisposition, DmarcResult, Record},
+};
+use registry::{
+    schema::{
+        enums::{TaskStoreMaintenanceType, TaskType},
+        prelude::{ObjectType, Property},
+        structs::{
+            DmarcInternalReport, DmarcReportSettings, Expression, Task, TaskStatus,
+            TaskStoreMaintenance, TlsInternalReport, TlsReportSettings,
+        },
+    },
+    types::{EnumImpl, ObjectImpl, datetime::UTCDateTime},
+};
+use serde_json::json;
+use smtp::reporting::{index::InternalReportIndex, send::MtaReportSend};
+use std::{
+    sync::Arc,
+    time::{Duration, Instant},
+};
+use store::{
+    SerializeInfallible, ValueKey,
+    write::{BatchBuilder, RegistryClass, TaskQueueClass, ValueClass, now},
+};
+use types::id::Id;
+use utils::snowflake::SnowflakeIdGenerator;
+
+#[tokio::test(flavor = "multi_thread")]
+#[serial_test::serial]
+async fn report_reschedule() {
+    let mut test = TestServerBuilder::new("smtp_report_reschedule")
+        .await
+        .with_http_listener(19057)
+        .await
+        .capture_queue()
+        .build()
+        .await;
+
+    let admin = test.account("admin");
+    admin
+        .registry_create_object(TlsReportSettings {
+            max_report_size: Expression {
+                else_: "1024".into(),
+                ..Default::default()
+            },
+            ..Default::default()
+        })
+        .await;
+    admin
+        .registry_create_object(DmarcReportSettings {
+            aggregate_max_report_size: Expression {
+                else_: "1024".into(),
+                ..Default::default()
+            },
+            ..Default::default()
+        })
+        .await;
+    admin.reload_settings().await;
+    test.reload_core();
+    test.expect_reload_settings().await;
+    let admin = test.account("admin");
+
+    // A daily DMARC and TLS report, due a day from now
+    schedule_dmarc(&test, "foobar.org").await;
+    schedule_tls(&test, "foobar.org").await;
+    let dmarc_id = wait_for_report::<DmarcInternalReport>(&test, "foobar.org").await;
+    let tls_id = wait_for_report::<TlsInternalReport>(&test, "foobar.org").await;
+
+    // Reschedule both to a few seconds from now, with a task due after them
+    let at = now() + 3;
+    let later = marker_task(&test.server, at + 3).await;
+    for (object, id, task_type) in [
+        (
+            ObjectType::DmarcInternalReport,
+            dmarc_id,
+            TaskType::DmarcReport,
+        ),
+        (ObjectType::TlsInternalReport, tls_id, TaskType::TlsReport),
+    ] {
+        admin
+            .registry_update_object(
+                object,
+                id,
+                json!({
+                    Property::DeliverAt: UTCDateTime::from_timestamp(at as i64),
+                }),
+            )
+            .await;
+
+        // x:Task/get shows the new due, and the queue row carries the task's
+        // type. Upstream wrote the report's object type there and left the
+        // task at its old due
+        let task = admin.registry_get::<Task>(id).await;
+        assert_eq!(task.object_type(), task_type);
+        assert_eq!(
+            task.due_timestamp(),
+            at,
+            "{object:?} task due not moved: {task:?}"
+        );
+        assert_eq!(
+            queue_row(&test.server, id.id(), at).await,
+            Some(task_type.to_id().serialize()),
+            "{object:?} queue row"
+        );
+    }
+
+    // Both reports go out at the new time, and the later task still runs
+    wait_until_run(&test.server, &[dmarc_id.id(), tls_id.id(), later]).await;
+    assert!(now() >= at, "the reports went out before their new time");
+    assert!(
+        admin
+            .registry_get_all::<DmarcInternalReport>()
+            .await
+            .is_empty()
+    );
+    assert!(
+        admin
+            .registry_get_all::<TlsInternalReport>()
+            .await
+            .is_empty()
+    );
+
+    // Rows an earlier reschedule may have left in a store: one with the
+    // report's object type and the task left at its old due, and one that
+    // is unreadable and has no task behind it. Neither may hold back a task
+    // due after them.
+    schedule_dmarc(&test, "foobar.net").await;
+    let dmarc_id = wait_for_report::<DmarcInternalReport>(&test, "foobar.net").await;
+    let at = now() + 2;
+    let old_due = old_style_reschedule(&test.server, dmarc_id.id(), at).await;
+    let orphan = SnowflakeIdGenerator::global_id().unwrap();
+    let mut batch = BatchBuilder::new();
+    batch.set(
+        ValueClass::TaskQueue(TaskQueueClass::Due {
+            id: orphan,
+            due: at,
+        }),
+        vec![0xff, 0xff],
+    );
+    test.server.store().write(batch.build_all()).await.unwrap();
+    let later = marker_task(&test.server, at + 2).await;
+
+    wait_until_run(&test.server, &[dmarc_id.id(), later]).await;
+    assert!(
+        admin
+            .registry_get_all::<DmarcInternalReport>()
+            .await
+            .is_empty()
+    );
+    assert_eq!(queue_row(&test.server, orphan, at).await, None);
+    assert_eq!(queue_row(&test.server, dmarc_id.id(), at).await, None);
+    assert_eq!(queue_row(&test.server, dmarc_id.id(), old_due).await, None);
+
+    // x:Task/query by type skips an unreadable row rather than failing
+    let mut batch = BatchBuilder::new();
+    let due = now() + 3600;
+    batch.set(
+        ValueClass::TaskQueue(TaskQueueClass::Due { id: orphan, due }),
+        vec![0xff, 0xff],
+    );
+    test.server.store().write(batch.build_all()).await.unwrap();
+    admin
+        .registry_query_ids(
+            ObjectType::Task,
+            vec![(Property::Type, TaskType::DmarcReport.as_str())],
+            Vec::<&str>::new(),
+        )
+        .await;
+    let mut batch = BatchBuilder::new();
+    batch.clear(ValueClass::TaskQueue(TaskQueueClass::Due {
+        id: orphan,
+        due,
+    }));
+    test.server.store().write(batch.build_all()).await.unwrap();
+
+    if test.is_reset() {
+        test.temp_dir.delete();
+    }
+}
+
+async fn schedule_dmarc(test: &TestServer, domain: &str) {
+    test.server
+        .schedule_report(DmarcEvent {
+            domain: domain.to_string(),
+            report_record: Record::new()
+                .with_source_ip("192.168.1.2".parse().unwrap())
+                .with_action_disposition(ActionDisposition::Pass)
+                .with_dmarc_dkim_result(DmarcResult::Pass)
+                .with_dmarc_spf_result(DmarcResult::Fail)
+                .with_envelope_from("[email protected]")
+                .with_envelope_to("[email protected]")
+                .with_header_from("[email protected]"),
+            dmarc_record: Arc::new(
+                Dmarc::parse(format!("v=DMARC1; p=reject; rua=mailto:reports@{domain}").as_bytes())
+                    .unwrap(),
+            ),
+            interval: AggregateFrequency::Daily,
+            span_id: 0,
+        })
+        .await;
+}
+
+async fn schedule_tls(test: &TestServer, domain: &str) {
+    test.server
+        .schedule_report(TlsEvent {
+            domain: domain.to_string(),
+            policy: PolicyType::None,
+            failure: None,
+            tls_record: Arc::new(
+                TlsRpt::parse(format!("v=TLSRPTv1;rua=mailto:reports@{domain}").as_bytes())
+                    .unwrap(),
+            ),
+            interval: AggregateFrequency::Daily,
+            span_id: 0,
+        })
+        .await;
+}
+
+trait ReportDomain: ObjectImpl {
+    fn report_domain(&self) -> &str;
+}
+
+impl ReportDomain for DmarcInternalReport {
+    fn report_domain(&self) -> &str {
+        &self.domain
+    }
+}
+
+impl ReportDomain for TlsInternalReport {
+    fn report_domain(&self) -> &str {
+        &self.domain
+    }
+}
+
+async fn wait_for_report<T: ReportDomain>(test: &TestServer, domain: &str) -> Id {
+    let admin = test.account("admin");
+    for _ in 0..100 {
+        if let Some((id, _)) = admin
+            .registry_get_all::<T>()
+            .await
+            .into_iter()
+            .find(|(_, report)| report.report_domain() == domain)
+        {
+            return id;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    panic!("No {} for {domain}", T::OBJECT.as_str());
+}
+
+/// A task that succeeds when it runs, due at `due`.
+async fn marker_task(server: &Server, due: u64) -> u64 {
+    let id = SnowflakeIdGenerator::global_id().unwrap();
+    let mut batch = BatchBuilder::new();
+    batch.schedule_task_with_id(
+        id,
+        Task::StoreMaintenance(TaskStoreMaintenance {
+            maintenance_type: TaskStoreMaintenanceType::RemoveLockDav,
+            shard_index: Some(0),
+            status: TaskStatus::at(due as i64),
+        }),
+    );
+    server.store().write(batch.build_all()).await.unwrap();
+    server.notify_task_queue();
+    id
+}
+
+/// What the reschedule before this fix wrote: the report's object type in
+/// the new queue row, and the task row left at its old due. Returns that
+/// old due.
+async fn old_style_reschedule(server: &Server, item_id: u64, at: u64) -> u64 {
+    let object_id = ObjectType::DmarcInternalReport.to_id();
+    let key = ValueClass::Registry(RegistryClass::Item { object_id, item_id });
+    let mut report = server
+        .store()
+        .get_value::<DmarcInternalReport>(ValueKey::from(key.clone()))
+        .await
+        .unwrap()
+        .unwrap();
+    let old_due = report.deliver_at().timestamp() as u64;
+    report.set_deliver_at(UTCDateTime::from_timestamp(at as i64));
+    let mut batch = BatchBuilder::new();
+    batch
+        .clear(ValueClass::TaskQueue(TaskQueueClass::Due {
+            id: item_id,
+            due: old_due,
+        }))
+        .set(
+            ValueClass::TaskQueue(TaskQueueClass::Due {
+                id: item_id,
+                due: at,
+            }),
+            object_id.serialize(),
+        )
+        .set(key, report.to_pickled_vec());
+    server.store().write(batch.build_all()).await.unwrap();
+    server.notify_task_queue();
+    old_due
+}
+
+struct RawValue(Vec<u8>);
+
+impl store::Deserialize for RawValue {
+    fn deserialize(bytes: &[u8]) -> trc::Result<Self> {
+        Ok(RawValue(bytes.to_vec()))
+    }
+}
+
+async fn queue_row(server: &Server, id: u64, due: u64) -> Option<Vec<u8>> {
+    server
+        .store()
+        .get_value::<RawValue>(ValueKey::from(ValueClass::TaskQueue(TaskQueueClass::Due {
+            id,
+            due,
+        })))
+        .await
+        .unwrap()
+        .map(|raw| raw.0)
+}
+
+async fn task_exists(server: &Server, id: u64) -> bool {
+    server
+        .store()
+        .get_value::<Task>(ValueKey::from(ValueClass::TaskQueue(
+            TaskQueueClass::Task { id },
+        )))
+        .await
+        .unwrap()
+        .is_some()
+}
+
+async fn wait_until_run(server: &Server, ids: &[u64]) {
+    let started = Instant::now();
+    loop {
+        let mut pending = Vec::new();
+        for id in ids {
+            if task_exists(server, *id).await {
+                pending.push(*id);
+            }
+        }
+        if pending.is_empty() {
+            return;
+        }
+        if started.elapsed() > Duration::from_secs(30) {
+            panic!("tasks {pending:?} never ran");
+        }
+        tokio::time::sleep(Duration::from_millis(200)).await;
+    }
+}

tests/src/store/mod.rs

@@ -10,6 +10,8 @@ pub mod blob;
 pub mod import_export;
 pub mod lookup;
 pub mod ops;
+#[cfg(any(feature = "postgres", feature = "mysql"))]
+pub mod pool_timeout; // inbuxa: SQL pools give up instead of hanging
 pub mod query;
 pub mod registry;
 #[cfg(feature = "postgres")]
@@ -19,6 +21,8 @@ pub mod replica_mysql; // inbuxa: read replicas on MySQL
 #[cfg(all(feature = "postgres", feature = "redis"))]
 pub mod replica_cluster; // inbuxa: read replicas across nodes
 pub mod scaleout; // inbuxa: scale-out storage
+#[cfg(feature = "postgres")]
+pub mod search_gin; // inbuxa: GIN indexes without a pending list
 #[cfg(any(feature = "postgres", feature = "mysql"))]
 pub mod sql_timeout;
 pub mod task_locks; // inbuxa: task locks across nodes

tests/src/store/pool_timeout.rs

@@ -0,0 +1,376 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! A database that accepts connections and then says nothing (a hung or
+//! half-dead server, a black-holed failover) gives a worker an error within
+//! the pool's timeouts. Upstream's pools had none, so the worker waited for
+//! good. No database is needed: a local listener that never answers plays
+//! the server.
+//!
+//! inbuxa: the same for a database that stops answering while connections
+//! are already open (a paused container): a query on a checked-out
+//! connection ends within the query limit, the store works again once the
+//! database is back, and /healthz/ready says 503 in between while
+//! /healthz/live stays 200. These need the local test databases; a proxy
+//! that can stop forwarding plays the pause.
+
+use registry::schema::structs::DataStore;
+use std::{
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::{Duration, Instant},
+};
+use store::{
+    IterateParams, Store, ValueKey,
+    backend::query_timeout::QueryTimeouts,
+    write::{BatchBuilder, ValueClass},
+};
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::{TcpListener, TcpStream},
+};
+
+/// Accepts connections on a local port and never sends a byte.
+async fn silent_server() -> u16 {
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    tokio::spawn(async move {
+        let mut held = Vec::new();
+        while let Ok((socket, _)) = listener.accept().await {
+            held.push(socket);
+        }
+    });
+    port
+}
+
+/// Builds the store and reads a key; both must end, with an error for the
+/// read, well within `limit`.
+async fn assert_times_out(data_store: DataStore, limit: Duration) {
+    let started = Instant::now();
+    let result = tokio::time::timeout(limit, async {
+        match Store::build(data_store).await {
+            Ok(store) => store
+                .get_value::<u64>(ValueKey::from(ValueClass::Property(0)))
+                .await
+                .map(|_| ())
+                .map_err(|err| err.to_string()),
+            Err(err) => Err(err.to_string()),
+        }
+    })
+    .await;
+    let elapsed = started.elapsed();
+    match result {
+        Ok(Err(err)) => println!("Got {err} after {elapsed:?}"),
+        Ok(Ok(())) => panic!("a silent server answered?"),
+        Err(_) => panic!("still waiting for a connection after {elapsed:?}"),
+    }
+}
+
+#[cfg(feature = "postgres")]
+#[tokio::test(flavor = "multi_thread")]
+pub async fn postgres_pool_timeout() {
+    use registry::schema::structs::PostgreSqlStore;
+
+    let port = silent_server().await;
+    println!("Running PostgreSQL pool timeout test...");
+    // The store's own timeout bounds opening a connection, handshake
+    // included (tokio-postgres's connect_timeout covers only the TCP connect)
+    assert_times_out(
+        DataStore::PostgreSql(PostgreSqlStore {
+            host: "127.0.0.1".into(),
+            port: port as u64,
+            database: "none".into(),
+            timeout: Some(Duration::from_secs(2).into()),
+            use_tls: false,
+            ..Default::default()
+        }),
+        Duration::from_secs(20),
+    )
+    .await;
+}
+
+#[cfg(feature = "mysql")]
+#[tokio::test(flavor = "multi_thread")]
+pub async fn mysql_pool_timeout() {
+    use registry::schema::structs::MySqlStore;
+
+    let port = silent_server().await;
+    println!("Running MySQL pool timeout test...");
+    // mysql_async has no pool timeout; the store waits 30 s for a connection
+    assert_times_out(
+        DataStore::MySql(MySqlStore {
+            host: "127.0.0.1".into(),
+            port: port as u64,
+            database: "none".into(),
+            use_tls: false,
+            ..Default::default()
+        }),
+        Duration::from_secs(60),
+    )
+    .await;
+}
+
+/// A TCP proxy to a local port that can stop forwarding, in both
+/// directions, while keeping every connection open: a paused server whose
+/// kernel still keeps the connections up.
+struct PausableProxy {
+    port: u16,
+    paused: Arc<AtomicBool>,
+}
+
+impl PausableProxy {
+    async fn start(upstream: u16) -> Self {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let paused = Arc::new(AtomicBool::new(false));
+        let paused_ = paused.clone();
+        tokio::spawn(async move {
+            while let Ok((client, _)) = listener.accept().await {
+                let Ok(server) = TcpStream::connect(("127.0.0.1", upstream)).await else {
+                    continue;
+                };
+                let (client_rx, client_tx) = client.into_split();
+                let (server_rx, server_tx) = server.into_split();
+                tokio::spawn(forward(client_rx, server_tx, paused_.clone()));
+                tokio::spawn(forward(server_rx, client_tx, paused_.clone()));
+            }
+        });
+        PausableProxy { port, paused }
+    }
+
+    fn pause(&self, paused: bool) {
+        self.paused.store(paused, Ordering::SeqCst);
+    }
+}
+
+async fn forward(
+    mut from: tokio::net::tcp::OwnedReadHalf,
+    mut to: tokio::net::tcp::OwnedWriteHalf,
+    paused: Arc<AtomicBool>,
+) {
+    let mut buf = vec![0u8; 16384];
+    loop {
+        while paused.load(Ordering::SeqCst) {
+            tokio::time::sleep(Duration::from_millis(20)).await;
+        }
+        let n = match from.read(&mut buf).await {
+            Ok(0) | Err(_) => return,
+            Ok(n) => n,
+        };
+        // Hold what arrived while paused until the pause ends
+        while paused.load(Ordering::SeqCst) {
+            tokio::time::sleep(Duration::from_millis(20)).await;
+        }
+        if to.write_all(&buf[..n]).await.is_err() {
+            return;
+        }
+    }
+}
+
+const TEST_LIMITS: QueryTimeouts = QueryTimeouts {
+    query: Duration::from_secs(2),
+    maintenance: Duration::from_secs(3),
+};
+
+/// Opens `connections` pooled connections at once, so the operations that
+/// follow find one idle and check it out.
+async fn warm(store: &Store, connections: usize) {
+    let reads = (0..connections).map(|_| async {
+        store
+            .get_value::<u64>(ValueKey::from(ValueClass::Property(0)))
+            .await
+            .unwrap();
+    });
+    futures::future::join_all(reads).await;
+}
+
+/// With the database paused, reads, scans and writes on connections the
+/// pool already holds end in an error within the query limit; once it is
+/// back, the store works again.
+async fn assert_queries_time_out(store: Store, proxy: &PausableProxy) {
+    store.create_tables().await.unwrap();
+    warm(&store, 4).await;
+    // mysql_async resets a connection on its way back to the pool; let
+    // those finish, or the connections are stuck in the reset when the
+    // pause starts and the pool's own wait timeout answers instead
+    tokio::time::sleep(Duration::from_secs(1)).await;
+    proxy.pause(true);
+
+    let key = || ValueKey::from(ValueClass::Property(0));
+    let limit = TEST_LIMITS.query;
+    for (what, op) in [("read", 0), ("scan", 1), ("write", 2)] {
+        let started = Instant::now();
+        let result = tokio::time::timeout(Duration::from_secs(20), async {
+            match op {
+                0 => store.get_value::<u64>(key()).await.map(|_| ()),
+                1 => {
+                    store
+                        .iterate(
+                            IterateParams::new(
+                                ValueKey::from(ValueClass::Property(0)),
+                                ValueKey::from(ValueClass::Property(u8::MAX)),
+                            ),
+                            |_, _| Ok(true),
+                        )
+                        .await
+                }
+                _ => {
+                    let mut batch = BatchBuilder::new();
+                    batch
+                        .with_account_id(u32::MAX - 7)
+                        .with_collection(types::collection::Collection::Email)
+                        .with_document(0)
+                        .set(ValueClass::Property(0), 1u64.to_be_bytes().to_vec());
+                    store.write(batch.build_all()).await.map(|_| ())
+                }
+            }
+        })
+        .await;
+        let elapsed = started.elapsed();
+        match result {
+            Ok(Err(err)) => {
+                let err = format!("{err:?}");
+                println!("Paused database, {what}: {err} after {elapsed:?}");
+                assert!(err.contains("Query timed out"), "{what}: {err}");
+                assert!(
+                    elapsed >= limit && elapsed < limit * 3,
+                    "{what} ended after {elapsed:?}"
+                );
+            }
+            Ok(Ok(())) => panic!("{what} succeeded against a paused database"),
+            Err(_) => panic!("{what} still waiting after {elapsed:?}"),
+        }
+    }
+
+    proxy.pause(false);
+    tokio::time::timeout(Duration::from_secs(20), store.get_value::<u64>(key()))
+        .await
+        .expect("still waiting after the database came back")
+        .expect("the store didn't recover");
+}
+
+#[cfg(feature = "postgres")]
+#[tokio::test(flavor = "multi_thread")]
+pub async fn postgres_query_timeout() {
+    println!("Running PostgreSQL query timeout test...");
+    let DataStore::PostgreSql(mut config) =
+        crate::utils::storage::build_data_store("PostgreSql", "").await
+    else {
+        unreachable!()
+    };
+    let proxy = PausableProxy::start(config.port as u16).await;
+    config.host = "127.0.0.1".into();
+    config.port = proxy.port as u64;
+    // New connections through the paused proxy give up as quickly
+    config.timeout = Some(TEST_LIMITS.query.into());
+    let store = Store::build(DataStore::PostgreSql(config))
+        .await
+        .unwrap()
+        .with_query_timeouts(TEST_LIMITS);
+    assert_queries_time_out(store, &proxy).await;
+}
+
+#[cfg(feature = "mysql")]
+#[tokio::test(flavor = "multi_thread")]
+pub async fn mysql_query_timeout() {
+    println!("Running MySQL query timeout test...");
+    let DataStore::MySql(mut config) = crate::utils::storage::build_data_store("MySql", "").await
+    else {
+        unreachable!()
+    };
+    let proxy = PausableProxy::start(config.port as u16).await;
+    config.host = "127.0.0.1".into();
+    config.port = proxy.port as u64;
+    let store = Store::build(DataStore::MySql(config))
+        .await
+        .unwrap()
+        .with_query_timeouts(TEST_LIMITS);
+    assert_queries_time_out(store, &proxy).await;
+}
+
+/// /healthz/ready follows the data store; /healthz/live doesn't.
+#[cfg(feature = "postgres")]
+#[tokio::test(flavor = "multi_thread")]
+pub async fn postgres_readiness() {
+    use crate::utils::server::TestServerBuilder;
+    use registry::schema::enums::NetworkListenerProtocol;
+
+    const HTTP_PORT: u16 = 11_320;
+    if std::env::var("STORE").as_deref() != Ok("PostgreSql") {
+        println!("Skipping the readiness test: it runs with STORE=PostgreSql.");
+        return;
+    }
+    println!("Running readiness test...");
+
+    let test = TestServerBuilder::new("postgres_readiness")
+        .await
+        .with_listener(NetworkListenerProtocol::Http, "http", HTTP_PORT, true)
+        .await
+        .build()
+        .await;
+
+    // Point the running node's data store at the database through the proxy
+    let DataStore::PostgreSql(mut config) =
+        crate::utils::storage::build_data_store("PostgreSql", "").await
+    else {
+        unreachable!()
+    };
+    let proxy = PausableProxy::start(config.port as u16).await;
+    config.host = "127.0.0.1".into();
+    config.port = proxy.port as u64;
+    config.timeout = Some(TEST_LIMITS.query.into());
+    let store = Store::build(DataStore::PostgreSql(config))
+        .await
+        .unwrap()
+        .with_query_timeouts(TEST_LIMITS);
+    let inner = &test.server.inner;
+    let mut core = inner.shared_core.load_full().as_ref().clone();
+    core.storage.data = store;
+    inner.shared_core.store(Arc::new(core));
+
+    let health = |path: &'static str| async move {
+        reqwest::Client::builder()
+            .danger_accept_invalid_certs(true)
+            .timeout(Duration::from_secs(10))
+            .build()
+            .unwrap()
+            .get(format!("https://127.0.0.1:{HTTP_PORT}/healthz/{path}"))
+            .send()
+            .await
+            .unwrap()
+            .status()
+            .as_u16()
+    };
+    let wait_for = |path: &'static str, status: u16| async move {
+        let started = Instant::now();
+        loop {
+            let got = health(path).await;
+            if got == status {
+                println!("/healthz/{path}: {got} after {:?}", started.elapsed());
+                return;
+            }
+            assert!(
+                started.elapsed() < Duration::from_secs(20),
+                "/healthz/{path} still {got}, expected {status}"
+            );
+            tokio::time::sleep(Duration::from_millis(250)).await;
+        }
+    };
+
+    wait_for("ready", 200).await;
+    proxy.pause(true);
+    wait_for("ready", 503).await;
+    assert_eq!(health("live").await, 200);
+    proxy.pause(false);
+    wait_for("ready", 200).await;
+    assert_eq!(health("live").await, 200);
+
+    if test.is_reset() {
+        test.temp_dir.delete();
+    }
+}

tests/src/store/query.rs

@@ -128,6 +128,16 @@ pub async fn test(test: &TestServer) {
     println!("Running trace document tests...");
     test_trace_documents(store.clone()).await;
 
+    // inbuxa: address fields match by full address, local part, domain and
+    // display name on every backend
+    println!("Running address search tests...");
+    test_address_search(store.clone()).await;
+
+    // inbuxa: words inside URLs, host names and file names in body text
+    // are found on every backend
+    println!("Running URL word search tests...");
+    test_url_word_search(store.clone()).await;
+
     // Large document insert test
     println!("Running large document insert tests...");
     let mut large_text = String::with_capacity(20 * 1024 * 1024);
@@ -972,3 +982,231 @@ async fn test_trace_documents(store: SearchStore) {
             .unwrap();
     }
 }
+
+// inbuxa: the message indexer passes each display name and each address of
+// From/To/Cc/Bcc as keyword text (Language::None). The built-in index splits
+// that text into words, so an address is found by its full form, its local
+// part, its domain or a display-name word; PostgreSQL kept the whole address
+// as one token and MySQL dropped stopwords such as "com" and words under three
+// characters. The expected results below are the built-in (RocksDB/SQLite)
+// results and must be the same on every backend.
+async fn test_address_search(store: SearchStore) {
+    const ACCOUNT_ID: u32 = 7;
+    let messages: [[&[(&str, &str)]; 4]; 5] = [
+        // From, To, Cc, Bcc
+        [
+            &[("Amazon.com", "[email protected]")],
+            &[("Jane Doe", "[email protected]")],
+            &[],
+            &[],
+        ],
+        [
+            &[("", "[email protected]")],
+            &[("", "[email protected]")],
+            &[("Jane Doe", "[email protected]")],
+            &[],
+        ],
+        [
+            &[("GitHub", "[email protected]")],
+            &[("Jo Li", "[email protected]")],
+            &[],
+            &[("Audit", "[email protected]")],
+        ],
+        [
+            &[("Jane Doe", "[email protected]")],
+            &[("Amazon Web Services", "[email protected]")],
+            &[("Bob", "[email protected]")],
+            &[("", "[email protected]")],
+        ],
+        [
+            &[("Newsletter", "[email protected]")],
+            &[("", "[email protected]")],
+            &[],
+            &[],
+        ],
+    ];
+    let fields = [
+        EmailSearchField::From,
+        EmailSearchField::To,
+        EmailSearchField::Cc,
+        EmailSearchField::Bcc,
+    ];
+
+    let mut documents = Vec::new();
+    let mut mask = RoaringBitmap::new();
+    for (document_id, message) in messages.iter().enumerate() {
+        let mut document = IndexDocument::new(SearchIndex::Email)
+            .with_account_id(ACCOUNT_ID)
+            .with_document_id(document_id as u32);
+        for (field, addresses) in fields.iter().zip(message.iter()) {
+            for (name, address) in addresses.iter() {
+                if !name.is_empty() {
+                    document.index_text(field.clone(), name, Language::None);
+                }
+                document.index_text(field.clone(), address, Language::None);
+            }
+        }
+        document.index_unsigned(EmailSearchField::ReceivedAt, document_id as u64);
+        documents.push(document);
+        mask.insert(document_id as u32);
+    }
+    store.index(documents).await.unwrap();
+    if let SearchStore::ElasticSearch(store) = &store {
+        store.refresh_index(SearchIndex::Email).await.unwrap();
+    }
+
+    for (field, text, expected) in [
+        // full address
+        (EmailSearchField::From, "[email protected]", vec![0u32]),
+        (EmailSearchField::To, "[email protected]", vec![0]),
+        (EmailSearchField::Cc, "[email protected]", vec![1]),
+        (EmailSearchField::Bcc, "[email protected]", vec![3]),
+        (EmailSearchField::To, "[email protected]", vec![1, 2]),
+        // local part
+        (EmailSearchField::From, "noreply", vec![0, 2]),
+        (EmailSearchField::To, "jo", vec![1, 2]),
+        (EmailSearchField::Cc, "bob", vec![3]),
+        (EmailSearchField::Bcc, "audit", vec![2]),
+        // domain
+        (EmailSearchField::From, "amazon.com", vec![0, 1]),
+        (EmailSearchField::From, "amazon", vec![0, 1]),
+        (EmailSearchField::To, "example.org", vec![0, 4]),
+        (EmailSearchField::To, "io.de", vec![1, 2]),
+        (EmailSearchField::Cc, "example.net", vec![3]),
+        (EmailSearchField::Bcc, "example.org", vec![2]),
+        (EmailSearchField::From, "www.example.com", vec![4]),
+        (EmailSearchField::From, "com", vec![0, 1, 2, 4]),
+        // display name
+        (EmailSearchField::From, "Jane", vec![3]),
+        (EmailSearchField::From, "jane doe", vec![3]),
+        (EmailSearchField::To, "Web Services", vec![3]),
+        (EmailSearchField::To, "Li", vec![2]),
+        (EmailSearchField::Cc, "Doe", vec![1]),
+        (EmailSearchField::Bcc, "Audit", vec![2]),
+        // hyphenated local part
+        (EmailSearchField::From, "shipment-tracking", vec![1]),
+        (EmailSearchField::From, "tracking", vec![1]),
+        // no match
+        (EmailSearchField::From, "amazon.org", vec![]),
+        (EmailSearchField::To, "noreply", vec![]),
+        (EmailSearchField::Bcc, "jane", vec![]),
+    ] {
+        let ids = store
+            .query_account(
+                SearchQuery::new(SearchIndex::Email)
+                    .with_filters(vec![
+                        SearchFilter::eq(SearchField::AccountId, ACCOUNT_ID),
+                        SearchFilter::has_keyword(field.clone(), text),
+                    ])
+                    .with_comparator(SearchComparator::ascending(EmailSearchField::ReceivedAt))
+                    .with_mask(mask.clone()),
+            )
+            .await
+            .unwrap();
+        assert_eq!(ids, expected, "{field:?} {text:?}");
+    }
+
+    // TEXT-style search across all address fields
+    let ids = store
+        .query_account(
+            SearchQuery::new(SearchIndex::Email)
+                .with_filters(vec![
+                    SearchFilter::eq(SearchField::AccountId, ACCOUNT_ID),
+                    SearchFilter::Or,
+                    SearchFilter::has_keyword(EmailSearchField::From, "example.org"),
+                    SearchFilter::has_keyword(EmailSearchField::To, "example.org"),
+                    SearchFilter::has_keyword(EmailSearchField::Cc, "example.org"),
+                    SearchFilter::has_keyword(EmailSearchField::Bcc, "example.org"),
+                    SearchFilter::End,
+                ])
+                .with_comparator(SearchComparator::ascending(EmailSearchField::ReceivedAt))
+                .with_mask(mask.clone()),
+        )
+        .await
+        .unwrap();
+    assert_eq!(ids, vec![0, 1, 2, 3, 4]);
+
+    store
+        .unindex(
+            SearchQuery::new(SearchIndex::Email)
+                .with_filter(SearchFilter::eq(SearchField::AccountId, ACCOUNT_ID)),
+        )
+        .await
+        .unwrap();
+}
+
+async fn test_url_word_search(store: SearchStore) {
+    const ACCOUNT_ID: u32 = 8;
+    let bodies = [
+        "Track your parcel here: https://x.example/shipping-support/ and reply.",
+        "Reset it at https://mail.example.com/login/?password=reset&user=jane now.",
+        "Attached is invoice-2024.pdf for your records.",
+        "Shipping was fast, thanks again.",
+        "Nothing to see at www.example.org/about-us, really.",
+    ];
+
+    let mut documents = Vec::new();
+    let mut mask = RoaringBitmap::new();
+    for (document_id, body) in bodies.iter().enumerate() {
+        let mut document = IndexDocument::new(SearchIndex::Email)
+            .with_account_id(ACCOUNT_ID)
+            .with_document_id(document_id as u32);
+        document.index_text(EmailSearchField::Body, body, Language::English);
+        document.index_unsigned(EmailSearchField::ReceivedAt, document_id as u64);
+        documents.push(document);
+        mask.insert(document_id as u32);
+    }
+    store.index(documents).await.unwrap();
+    if let SearchStore::ElasticSearch(store) = &store {
+        store.refresh_index(SearchIndex::Email).await.unwrap();
+    }
+
+    for (text, expected) in [
+        // only inside a URL path, a query string or a file name
+        ("shipping", vec![0u32, 3]),
+        ("support", vec![0]),
+        ("password", vec![1]),
+        ("login", vec![1]),
+        ("jane", vec![1]),
+        ("invoice", vec![2]),
+        ("pdf", vec![2]),
+        ("2024", vec![2]),
+        // host names
+        ("example", vec![0, 1, 4]),
+        ("mail", vec![1]),
+        // written as they appear
+        ("https://x.example/shipping-support/", vec![0]),
+        ("shipping-support", vec![0]),
+        ("invoice-2024.pdf", vec![2]),
+        ("mail.example.com", vec![1]),
+        // plain words are unaffected
+        ("parcel", vec![0]),
+        ("records", vec![2]),
+        ("thanks", vec![3]),
+        // no match
+        ("billing", vec![]),
+        ("example.net", vec![]),
+    ] {
+        let ids = store
+            .query_account(
+                SearchQuery::new(SearchIndex::Email)
+                    .with_filters(vec![
+                        SearchFilter::eq(SearchField::AccountId, ACCOUNT_ID),
+                        SearchFilter::has_english_text(EmailSearchField::Body, text),
+                    ])
+                    .with_comparator(SearchComparator::ascending(EmailSearchField::ReceivedAt))
+                    .with_mask(mask.clone()),
+            )
+            .await
+            .unwrap();
+        assert_eq!(ids, expected, "Body {text:?}");
+    }
+
+    store
+        .unindex(
+            SearchQuery::new(SearchIndex::Email)
+                .with_filter(SearchFilter::eq(SearchField::AccountId, ACCOUNT_ID)),
+        )
+        .await
+        .unwrap();
+}

tests/src/store/search_gin.rs

@@ -0,0 +1,159 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! PostgreSQL full-text GIN indexes are built with fastupdate off, and an
+//! index made earlier with the default is switched over at startup. With
+//! fastupdate on, new entries wait in a pending list that every search scans
+//! in full until VACUUM merges it.
+
+use crate::utils::storage::build_data_store;
+use registry::schema::structs::DataStore;
+use store::{Rows, SearchStore, Store};
+
+const SCHEMA: &str = "gin_fastupdate_test";
+
+#[tokio::test(flavor = "multi_thread")]
+pub async fn postgres_gin_fastupdate() {
+    println!("Running PostgreSQL GIN fastupdate test...");
+
+    // Work in a schema of our own so the shared search tables are untouched
+    let admin = Store::build(build_data_store("PostgreSql", "").await)
+        .await
+        .expect("Failed to connect to PostgreSQL");
+    for query in [
+        format!("DROP SCHEMA IF EXISTS {SCHEMA} CASCADE"),
+        format!("CREATE SCHEMA {SCHEMA}"),
+    ] {
+        admin.sql_query::<usize>(&query, vec![]).await.unwrap();
+    }
+    let DataStore::PostgreSql(mut config) = build_data_store("PostgreSql", "").await else {
+        unreachable!()
+    };
+    config.options = Some(format!("-c search_path={SCHEMA}"));
+    let store = Store::build(DataStore::PostgreSql(config))
+        .await
+        .expect("Failed to connect to PostgreSQL");
+    let search = SearchStore::Store(store.clone());
+
+    // A fresh schema
+    search.create_indexes().await.unwrap();
+    let indexes = gin_indexes(&admin).await;
+    assert!(
+        indexes.len() >= 4,
+        "expected the search GIN indexes, found {indexes:?}"
+    );
+    for (name, options) in &indexes {
+        assert!(
+            options.contains("fastupdate=off"),
+            "fresh index {name} has options {options:?}"
+        );
+    }
+
+    // A schema from before the change: the same indexes, made with the
+    // default fastupdate=on, and a pending list with something in it
+    for (name, _) in &indexes {
+        admin
+            .sql_query::<usize>(
+                &format!("ALTER INDEX {SCHEMA}.{name} RESET (fastupdate)"),
+                vec![],
+            )
+            .await
+            .unwrap();
+    }
+    for (name, options) in gin_indexes(&admin).await {
+        assert!(
+            !options.contains("fastupdate"),
+            "index {name} still has options {options:?}"
+        );
+    }
+    admin
+        .sql_query::<usize>(
+            &format!(
+                "INSERT INTO {SCHEMA}.s_email (accid, docid, subj, body) \
+                 SELECT 1, n, to_tsvector('simple', 'pending subject ' || n), \
+                 to_tsvector('simple', 'pending body text ' || n) \
+                 FROM generate_series(1, 500) n"
+            ),
+            vec![],
+        )
+        .await
+        .unwrap();
+    assert!(
+        pending_tuples(&admin, "gin_s_email_body").await > 0,
+        "no pending list to merge"
+    );
+
+    // Startup on the existing schema switches every index over and merges
+    // what was pending
+    search.create_indexes().await.unwrap();
+    for (name, options) in gin_indexes(&admin).await {
+        assert!(
+            options.contains("fastupdate=off"),
+            "existing index {name} has options {options:?} after startup"
+        );
+    }
+    assert_eq!(pending_tuples(&admin, "gin_s_email_body").await, 0);
+
+    // And a second startup changes nothing
+    search.create_indexes().await.unwrap();
+    for (name, options) in gin_indexes(&admin).await {
+        assert!(options.contains("fastupdate=off"), "{name}: {options:?}");
+    }
+
+    admin
+        .sql_query::<usize>(&format!("DROP SCHEMA {SCHEMA} CASCADE"), vec![])
+        .await
+        .unwrap();
+}
+
+/// The GIN indexes in the test schema with their reloptions.
+async fn gin_indexes(admin: &Store) -> Vec<(String, String)> {
+    admin
+        .sql_query::<Rows>(
+            &format!(
+                "SELECT c.relname::text, COALESCE(array_to_string(c.reloptions, ','), '') \
+                 FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace \
+                 JOIN pg_am a ON a.oid = c.relam \
+                 WHERE n.nspname = '{SCHEMA}' AND c.relkind = 'i' AND a.amname = 'gin' \
+                 ORDER BY 1"
+            ),
+            vec![],
+        )
+        .await
+        .unwrap()
+        .rows
+        .into_iter()
+        .map(|row| {
+            let mut values = row.values.into_iter();
+            (
+                values.next().unwrap().to_str().into_owned(),
+                values.next().unwrap().to_str().into_owned(),
+            )
+        })
+        .collect()
+}
+
+/// Tuples waiting in a GIN index's pending list (pgstattuple is a contrib
+/// extension the test database has).
+async fn pending_tuples(admin: &Store, index: &str) -> i64 {
+    admin
+        .sql_query::<usize>("CREATE EXTENSION IF NOT EXISTS pgstattuple", vec![])
+        .await
+        .unwrap();
+    admin
+        .sql_query::<Rows>(
+            &format!("SELECT pending_tuples FROM pgstatginindex('{SCHEMA}.{index}'::regclass)"),
+            vec![],
+        )
+        .await
+        .unwrap()
+        .rows
+        .into_iter()
+        .next()
+        .and_then(|row| row.values.into_iter().next())
+        .map(|value| value.to_str().parse::<i64>().unwrap())
+        .unwrap()
+}

tests/src/store/task_locks.rs

@@ -79,7 +79,33 @@ pub async fn task_lock_tests() {
         "ran before the other node's locks expired: {elapsed:?}"
     );
 
-    // 3. A graceful stop releases the locks this node holds: another node
+    // 3. A task that runs longer than a lock lifetime keeps its claim: the
+    // task manager renews the lease while this node holds it, and the claim
+    // ends when the task does. (Before, a lock simply lasted an hour.)
+    let [id] = new_task_ids(1)[..] else {
+        unreachable!()
+    };
+    assert!(server.try_lock_task(id).await, "claim {id}");
+    tokio::time::sleep(Duration::from_secs(LOCK_EXPIRY + LOCK_EXPIRY / 2)).await;
+    assert!(
+        !foreign_lock(&server, id, LOCK_EXPIRY).await,
+        "lease lapsed while the task ran"
+    );
+    server.remove_index_lock(id).await;
+    assert!(
+        foreign_lock(&server, id, LOCK_EXPIRY).await,
+        "released when the task ended"
+    );
+    let _ = server
+        .in_memory_store()
+        .remove_lock(KV_LOCK_TASK, &id.to_be_bytes())
+        .await;
+    assert!(
+        common::ipc::TaskLocks::DEFAULT_EXPIRY <= 5 * 60,
+        "a dead node's tasks wait no more than a few minutes"
+    );
+
+    // 4. A graceful stop releases the locks this node holds: another node
     // can claim those tasks at once, and this one claims nothing more
     let ids = new_task_ids(3);
     for id in &ids {

tests/src/system/auto_reload.rs

@@ -0,0 +1,272 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+// inbuxa: a registry write to an object the running settings are built from
+// applies without an x:Action ReloadSettings, and the set response says so.
+
+use crate::utils::{
+    jmap::JmapResponse,
+    server::{TestServer, TestServerBuilder},
+};
+use common::BuildServer;
+use registry::{
+    schema::{
+        enums::TracingLevel,
+        prelude::ObjectType,
+        structs::{
+            AllowedIp, CertificateManagement, DkimManagement, DnsManagement, Domain, Expression,
+            MtaDeliverySchedule, MtaStageAuth, MtaVirtualQueue, Tracer, TracerStdout,
+        },
+    },
+    types::ipmask::IpAddrOrMask,
+};
+use serde_json::Value;
+
+#[tokio::test(flavor = "multi_thread")]
+pub async fn settings_reload_tests() {
+    let mut test = TestServerBuilder::new("settings_reload_tests")
+        .await
+        .with_default_listeners()
+        .await
+        .with_object(MtaStageAuth {
+            require: Expression {
+                else_: "false".to_string(),
+                ..Default::default()
+            },
+            ..Default::default()
+        })
+        .await
+        .build()
+        .await;
+
+    let admin = test
+        .create_user_account(
+            "admin",
+            "[email protected]",
+            "these_pretzels_are_making_me_thirsty",
+            &[],
+            "Admin",
+        )
+        .await;
+    test.account("admin")
+        .assign_roles_to_account(admin.id(), &["user", "system"])
+        .await;
+    test.insert_account(admin);
+
+    test_write_applies(&test).await;
+
+    if test.is_reset() {
+        test.temp_dir.delete();
+    }
+}
+
+async fn test_write_applies(test: &TestServer) {
+    println!("Running settings reload after registry writes...");
+    let admin = test.account("[email protected]");
+
+    // A delivery schedule is in use as soon as it is saved
+    let response = admin
+        .registry_create([MtaVirtualQueue {
+            name: "autorld".into(),
+            threads_per_node: 2,
+            description: None,
+        }])
+        .await;
+    assert_applied(&response);
+    let queue_id = response.created_id(0);
+    assert!(!has_schedule(test, "autoreload-schedule"));
+    let response = admin
+        .registry_create([MtaDeliverySchedule {
+            name: "autoreload-schedule".into(),
+            queue_id,
+            ..Default::default()
+        }])
+        .await;
+    assert_applied(&response);
+    assert!(has_schedule(test, "autoreload-schedule"));
+
+    // Destroyed, it's gone at once too
+    let schedule_id = response.created_id(0);
+    let response = admin
+        .registry_destroy(ObjectType::MtaDeliverySchedule, [schedule_id])
+        .await;
+    assert_applied(&response);
+    assert!(!has_schedule(test, "autoreload-schedule"));
+
+    // Concurrent writes all end up in the running settings
+    let names = (0..8)
+        .map(|i| format!("autoreload-{i}"))
+        .collect::<Vec<_>>();
+    let mut writes = Vec::new();
+    for name in &names {
+        writes.push(admin.registry_create([MtaDeliverySchedule {
+            name: name.clone(),
+            queue_id,
+            ..Default::default()
+        }]));
+    }
+    let mut schedule_ids = Vec::new();
+    for response in futures::future::join_all(writes).await {
+        assert_applied(&response);
+        schedule_ids.push(response.created_id(0));
+    }
+    for name in &names {
+        assert!(has_schedule(test, name), "{name} missing");
+    }
+    // A burst of separate requests shares a reload or two: each arrives
+    // tens of milliseconds after the last, so none overlaps a running
+    // reload, and the reload waits for writes to settle instead
+    let reloads = test.server.inner.data.settings_reload.reloads();
+    let started = std::time::Instant::now();
+    let burst = (0..10)
+        .map(|i| format!("autoreload-burst-{i}"))
+        .collect::<Vec<_>>();
+    let mut writes = Vec::new();
+    for name in &burst {
+        writes.push(admin.registry_create([MtaDeliverySchedule {
+            name: name.clone(),
+            queue_id,
+            ..Default::default()
+        }]));
+    }
+    for response in futures::future::join_all(writes).await {
+        assert_applied(&response);
+        schedule_ids.push(response.created_id(0));
+    }
+    let burst_reloads = test.server.inner.data.settings_reload.reloads() - reloads;
+    println!(
+        "10 concurrent writes: {burst_reloads} reload(s), {} ms",
+        started.elapsed().as_millis()
+    );
+    assert!(
+        (1..=2).contains(&burst_reloads),
+        "{burst_reloads} reloads for 10 concurrent writes"
+    );
+    for name in &burst {
+        assert!(has_schedule(test, name), "{name} missing");
+    }
+
+    // A single write still reloads promptly
+    let reloads = test.server.inner.data.settings_reload.reloads();
+    let started = std::time::Instant::now();
+    let response = admin
+        .registry_create([MtaDeliverySchedule {
+            name: "autoreload-single".into(),
+            queue_id,
+            ..Default::default()
+        }])
+        .await;
+    assert_applied(&response);
+    schedule_ids.push(response.created_id(0));
+    println!("1 write: {} ms", started.elapsed().as_millis());
+    assert_eq!(
+        test.server.inner.data.settings_reload.reloads() - reloads,
+        1
+    );
+    assert!(has_schedule(test, "autoreload-single"));
+
+    // Several objects in one request: one reload
+    let response = admin
+        .registry_destroy(ObjectType::MtaDeliverySchedule, schedule_ids.iter())
+        .await;
+    assert_applied(&response);
+    for name in names.iter().chain(&burst) {
+        assert!(!has_schedule(test, name), "{name} still present");
+    }
+
+    // A write whose reload fails is stored, and the response says the
+    // settings weren't reloaded: only one console tracer is allowed.
+    let response = admin
+        .registry_create([
+            Tracer::Stdout(TracerStdout {
+                enable: true,
+                level: TracingLevel::Error,
+                ..Default::default()
+            }),
+            Tracer::Stdout(TracerStdout {
+                enable: true,
+                level: TracingLevel::Error,
+                ..Default::default()
+            }),
+        ])
+        .await;
+    let reload = settings_reload(&response).expect("x:settingsReload missing");
+    assert_eq!(reload["applied"], Value::Bool(false), "{response:?}");
+    let description = reload["description"].as_str().unwrap_or_default();
+    assert!(
+        description.starts_with("Saved, but the running settings were not reloaded. ")
+            && description.contains("Only one console tracer is allowed"),
+        "{description}"
+    );
+    let tracer_ids = [response.created_id(0), response.created_id(1)];
+    let response = admin
+        .registry_destroy(ObjectType::Tracer, tracer_ids.iter())
+        .await;
+    assert_applied(&response);
+
+    // An allowed IP is live as soon as it is saved, and gone once
+    // destroyed. It lives in the core's security settings, which the
+    // blocked-IP reload it used to get doesn't rebuild.
+    let ip: std::net::IpAddr = "198.51.100.7".parse().unwrap();
+    assert!(!is_allowed(test, ip));
+    let response = admin
+        .registry_create([AllowedIp {
+            address: IpAddrOrMask::from_ip(ip),
+            reason: Some("autoreload".into()),
+            ..Default::default()
+        }])
+        .await;
+    assert_applied(&response);
+    assert!(
+        is_allowed(test, ip),
+        "allowed IP not in the running settings"
+    );
+    let allowed_id = response.created_id(0);
+    let response = admin
+        .registry_destroy(ObjectType::AllowedIp, [allowed_id])
+        .await;
+    assert_applied(&response);
+    assert!(!is_allowed(test, ip), "destroyed allowed IP still live");
+
+    // Data that isn't part of the running settings doesn't reload them
+    let response = admin
+        .registry_create([Domain {
+            name: "autoreload.example.org".into(),
+            certificate_management: CertificateManagement::Manual,
+            dns_management: DnsManagement::Manual,
+            dkim_management: DkimManagement::Manual,
+            ..Default::default()
+        }])
+        .await;
+    assert!(settings_reload(&response).is_none(), "{response:?}");
+}
+
+fn settings_reload(response: &JmapResponse) -> Option<&Value> {
+    response.pointer("/methodResponses/0/1/x:settingsReload")
+}
+
+fn assert_applied(response: &JmapResponse) {
+    assert_eq!(
+        settings_reload(response),
+        Some(&serde_json::json!({"applied": true})),
+        "{response:?}"
+    );
+}
+
+fn has_schedule(test: &TestServer, name: &str) -> bool {
+    test.server
+        .inner
+        .build_server()
+        .core
+        .smtp
+        .queue
+        .queue_strategy
+        .contains_key(name)
+}
+
+fn is_allowed(test: &TestServer, ip: std::net::IpAddr) -> bool {
+    test.server.inner.build_server().is_ip_allowed(ip)
+}

tests/src/system/mod.rs

@@ -11,6 +11,7 @@ pub mod authentication;
 pub mod ai;
 pub mod ai_calibration;
 pub mod authorization;
+pub mod auto_reload; // inbuxa: registry writes apply at once
 pub mod branding;
 pub mod crypto;
 pub mod delivery;
@@ -20,8 +21,10 @@ pub mod monitoring;
 pub mod oidc;
 pub mod purge;
 pub mod quota;
+pub mod reload; // inbuxa: reloads and build errors
 pub mod security;
 pub mod task;
+pub mod tracer_reload; // inbuxa: tracers start over when their settings change
 pub mod tenant;
 pub mod undelete;
 

tests/src/system/reload.rs

@@ -0,0 +1,213 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+// inbuxa: a settings reload isn't held back by a DNS lookup, or by objects
+// that already failed when the running settings were built; an error in an
+// object that built then still refuses it, and says which object.
+
+use crate::utils::server::{TestServer, TestServerBuilder};
+use common::{BuildServer, config::mailstore::spamfilter::PyzorConfig, ipc::RegistryChange};
+use registry::schema::{
+    enums::TracingLevel,
+    prelude::{ObjectType, Property},
+    structs::{Action, Expression, MtaStageAuth, SpamPyzor, Tracer, TracerStdout},
+};
+
+#[tokio::test(flavor = "multi_thread")]
+pub async fn reload_tests() {
+    let mut test = TestServerBuilder::new("reload_tests")
+        .await
+        .with_default_listeners()
+        .await
+        .with_object(MtaStageAuth {
+            require: Expression {
+                else_: "false".to_string(),
+                ..Default::default()
+            },
+            ..Default::default()
+        })
+        .await
+        .build()
+        .await;
+
+    let admin = test
+        .create_user_account(
+            "admin",
+            "[email protected]",
+            "these_pretzels_are_making_me_thirsty",
+            &[],
+            "Admin",
+        )
+        .await;
+    test.account("admin")
+        .assign_roles_to_account(admin.id(), &["user", "system"])
+        .await;
+    test.insert_account(admin);
+
+    test_unresolvable_pyzor(&test).await;
+    test_build_errors(&test).await;
+
+    if test.is_reset() {
+        test.temp_dir.delete();
+    }
+}
+
+async fn test_unresolvable_pyzor(test: &TestServer) {
+    println!("Running reload with an unresolvable Pyzor host...");
+    let admin = test.account("[email protected]");
+
+    // Upstream resolved the host while building the settings and refused the
+    // reload when that failed.
+    admin
+        .registry_update_setting(
+            SpamPyzor {
+                enable: true,
+                host: "pyzor.invalid".into(),
+                port: 24441,
+                ..Default::default()
+            },
+            &[Property::Enable, Property::Host, Property::Port],
+        )
+        .await;
+    admin.reload_settings().await;
+
+    let pyzor = running_pyzor(test);
+    assert_eq!(pyzor.host, "pyzor.invalid");
+    assert_eq!(pyzor.port, 24441);
+    assert!(pyzor.address().await.is_err());
+
+    // An IP address needs no lookup
+    admin
+        .registry_update_setting(
+            SpamPyzor {
+                host: "192.0.2.1".into(),
+                ..Default::default()
+            },
+            &[Property::Host],
+        )
+        .await;
+    admin.reload_settings().await;
+    assert_eq!(
+        running_pyzor(test).address().await.unwrap().to_string(),
+        "192.0.2.1:24441"
+    );
+}
+
+async fn test_build_errors(test: &TestServer) {
+    println!("Running reload with build errors...");
+    let admin = test.account("[email protected]");
+    let pyzor_ratio = running_pyzor(test).ratio;
+    assert_ne!(pyzor_ratio, 0.25);
+
+    // Two console tracers: only one is allowed, so the build of one of them
+    // fails. Neither existed when the running settings were built.
+    let mut tracer_ids = Vec::new();
+    for _ in 0..2 {
+        tracer_ids.push(
+            admin
+                .registry_create_object(Tracer::Stdout(TracerStdout {
+                    enable: true,
+                    level: TracingLevel::Error,
+                    ..Default::default()
+                }))
+                .await,
+        );
+    }
+    admin
+        .registry_update_setting(
+            SpamPyzor {
+                ratio: 0.25.into(),
+                ..Default::default()
+            },
+            &[Property::Ratio],
+        )
+        .await;
+
+    // A new error refuses the reload and names the object
+    let err = admin
+        .registry_create_object_expect_err(Action::ReloadSettings)
+        .await;
+    let description = err.description.clone().unwrap_or_default();
+    assert!(
+        description.starts_with("Settings were not reloaded. ")
+            && description.contains("Tracer")
+            && description.contains("Only one console tracer is allowed"),
+        "{err:?}"
+    );
+    assert_eq!(running_pyzor(test).ratio, pyzor_ratio);
+
+    // Had the running settings been built with that tracer failing, as a
+    // restart now would, the same error doesn't hold the reload back.
+    let result = Box::pin(
+        test.server
+            .reload_registry(RegistryChange::Reload(ObjectType::DataStore)),
+    )
+    .await
+    .unwrap();
+    assert!(!result.replaced_core);
+    assert_eq!(result.errors.len(), 1, "{:?}", result.errors);
+    test.server.record_build_errors(&result.errors);
+
+    admin.reload_settings().await;
+    assert_eq!(running_pyzor(test).ratio, 0.25);
+    let result = Box::pin(
+        test.server
+            .reload_registry(RegistryChange::Reload(ObjectType::DataStore)),
+    )
+    .await
+    .unwrap();
+    assert!(result.replaced_core);
+    assert!(result.errors.is_empty());
+    assert_eq!(result.known_errors.len(), 1);
+
+    // Once fixed, the object is no longer known to fail, so a new error
+    // there refuses the reload again.
+    admin
+        .registry_destroy(ObjectType::Tracer, tracer_ids.iter())
+        .await
+        .assert_destroyed(&tracer_ids);
+    admin.reload_settings().await;
+    let result = Box::pin(
+        test.server
+            .reload_registry(RegistryChange::Reload(ObjectType::DataStore)),
+    )
+    .await
+    .unwrap();
+    assert!(result.replaced_core);
+    assert!(result.errors.is_empty() && result.known_errors.is_empty());
+
+    for _ in 0..2 {
+        tracer_ids.push(
+            admin
+                .registry_create_object(Tracer::Stdout(TracerStdout {
+                    enable: true,
+                    level: TracingLevel::Error,
+                    ..Default::default()
+                }))
+                .await,
+        );
+    }
+    admin
+        .registry_create_object_expect_err(Action::ReloadSettings)
+        .await;
+    let tracer_ids = tracer_ids.split_off(2);
+    admin
+        .registry_destroy(ObjectType::Tracer, tracer_ids.iter())
+        .await
+        .assert_destroyed(&tracer_ids);
+    admin.reload_settings().await;
+}
+
+fn running_pyzor(test: &TestServer) -> PyzorConfig {
+    test.server
+        .inner
+        .build_server()
+        .core
+        .spam
+        .pyzor
+        .clone()
+        .expect("Pyzor enabled")
+}

tests/src/system/tracer_reload.rs

@@ -0,0 +1,204 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+// inbuxa: a tracer whose own settings change is started over by the reload
+// that follows the write: a Log tracer moved to another directory writes
+// there from then on, and no event is lost or written twice on the way.
+
+use crate::utils::{
+    jmap::JmapResponse,
+    server::{TestServer, TestServerBuilder},
+};
+use registry::{
+    schema::{
+        enums::{EventPolicy, LogRotateFrequency, TracingLevel},
+        prelude::ObjectType,
+        structs::{Expression, MtaStageAuth, Tracer, TracerLog},
+    },
+    types::map::Map,
+};
+use serde_json::json;
+use std::{
+    path::{Path, PathBuf},
+    time::{Duration, Instant},
+};
+use trc::{EventType, ServerEvent};
+
+const PREFIX: &str = "tracer-reload";
+
+#[tokio::test(flavor = "multi_thread")]
+pub async fn tracer_reload_tests() {
+    let mut test = TestServerBuilder::new("tracer_reload_tests")
+        .await
+        .with_default_listeners()
+        .await
+        .with_object(MtaStageAuth {
+            require: Expression {
+                else_: "false".to_string(),
+                ..Default::default()
+            },
+            ..Default::default()
+        })
+        .await
+        .build()
+        .await;
+
+    let admin = test
+        .create_user_account(
+            "admin",
+            "[email protected]",
+            "these_pretzels_are_making_me_thirsty",
+            &[],
+            "Admin",
+        )
+        .await;
+    test.account("admin")
+        .assign_roles_to_account(admin.id(), &["user", "system"])
+        .await;
+    test.insert_account(admin);
+
+    test_log_tracer_moves(&test).await;
+
+    if test.is_reset() {
+        test.temp_dir.delete();
+    }
+}
+
+async fn test_log_tracer_moves(test: &TestServer) {
+    println!("Running Log tracer path change...");
+    let admin = test.account("[email protected]");
+    let old_dir = test.temp_dir.path.join("tracer-old");
+    let new_dir = test.temp_dir.path.join("tracer-new");
+    for dir in [&old_dir, &new_dir] {
+        let _ = std::fs::remove_dir_all(dir);
+        std::fs::create_dir_all(dir).unwrap();
+    }
+    let old_file = old_dir.join(PREFIX);
+    let new_file = new_dir.join(PREFIX);
+
+    // A Log tracer for one event type, written to the old directory
+    let response = admin
+        .registry_create([Tracer::Log(TracerLog {
+            path: old_dir.to_string_lossy().into_owned(),
+            prefix: PREFIX.into(),
+            rotate: LogRotateFrequency::Never,
+            ansi: false,
+            multiline: false,
+            enable: true,
+            level: TracingLevel::Trace,
+            lossy: false,
+            events: Map::new(vec![EventType::Server(ServerEvent::Licensing)]),
+            events_policy: EventPolicy::Include,
+        })])
+        .await;
+    assert_applied(&response);
+    let tracer_id = response.created_id(0);
+    emit("marker-before");
+    wait_for(&old_file, "marker-before").await;
+
+    // Events keep coming while the path changes
+    let stream = tokio::spawn(async {
+        for i in 0..2000u32 {
+            emit(&format!("seq-{i:05}-end"));
+            if i % 50 == 0 {
+                tokio::time::sleep(Duration::from_millis(1)).await;
+            }
+        }
+    });
+    tokio::time::sleep(Duration::from_millis(5)).await;
+    let response = admin
+        .registry_update(
+            ObjectType::Tracer,
+            [(tracer_id, json!({"path": new_dir.to_string_lossy()}))],
+        )
+        .await;
+    assert_applied(&response);
+    stream.await.unwrap();
+
+    // Once the reload has run, events go to the new file only
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    emit("marker-after");
+    wait_for(&new_file, "marker-after").await;
+    wait_for(&new_file, "seq-01999-end").await;
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    let old = read(&old_file);
+    let new = read(&new_file);
+    assert!(!old.contains("marker-after"), "old file still written to");
+    assert!(!new.contains("marker-before"));
+
+    // Every event written once, in one file or the other
+    let old_seq = count_seq(&old);
+    let new_seq = count_seq(&new);
+    println!(
+        "{} events in the old file, {} in the new one",
+        old_seq.iter().filter(|c| **c > 0).count(),
+        new_seq.iter().filter(|c| **c > 0).count()
+    );
+    for i in 0..2000 {
+        assert_eq!(
+            old_seq[i] + new_seq[i],
+            1,
+            "seq-{i:05} written {} + {} times",
+            old_seq[i],
+            new_seq[i]
+        );
+    }
+    assert!(
+        new_seq.iter().any(|c| *c > 0),
+        "no event of the stream reached the new file"
+    );
+
+    // Removing the tracer stops it
+    let response = admin
+        .registry_destroy(ObjectType::Tracer, [tracer_id])
+        .await;
+    assert_applied(&response);
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    emit("marker-removed");
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert!(!read(&new_file).contains("marker-removed"));
+    assert!(!read(&old_file).contains("marker-removed"));
+}
+
+fn emit(marker: &str) {
+    trc::event!(Server(ServerEvent::Licensing), Details = marker.to_string());
+}
+
+fn read(path: &Path) -> String {
+    std::fs::read_to_string(path).unwrap_or_default()
+}
+
+fn count_seq(text: &str) -> Vec<u32> {
+    let mut counts = vec![0u32; 2000];
+    for part in text.split("seq-").skip(1) {
+        if let Some(n) = part.get(..5).and_then(|n| n.parse::<usize>().ok())
+            && part[5..].starts_with("-end")
+        {
+            counts[n] += 1;
+        }
+    }
+    counts
+}
+
+async fn wait_for(path: &PathBuf, marker: &str) {
+    let started = Instant::now();
+    while !read(path).contains(marker) {
+        assert!(
+            started.elapsed() < Duration::from_secs(10),
+            "{marker} not in {}",
+            path.display()
+        );
+        tokio::time::sleep(Duration::from_millis(20)).await;
+    }
+}
+
+fn assert_applied(response: &JmapResponse) {
+    assert_eq!(
+        response.pointer("/methodResponses/0/1/x:settingsReload"),
+        Some(&json!({"applied": true})),
+        "{response:?}"
+    );
+}