Inbound hardening. A letter now needs the stamp Google's routing rule puts in X-Amail-Route, so only OUR tenant's route is honoured even from Google's own relays. Google's Authentication-Results are read: a DMARC failure is refused, and spf/dkim/dmarc ride along on the row so the inbox can mark a sender the gate couldn't vouch for. A sender→box pair gets twenty letters and three buzzes an hour; the door as a whole, sixty a minute. Dedupe is scoped to the box. The service sheds root — CAP_NET_BIND_SERVICE alone opens :25, and lith-mail-renew.sh hands the unprivileged user its own copy of the certificate at deploy and on every renewal. Outbound, decided earlier, now built: a letter to an address nobody here signed up with leaves through Google's SMTP relay as "@handle via Amail <amail+permahandle@aesthetic.computer>" with Reply-To handle@aesthetic.computer — signed by the post office, never as the handle, and answerable at either address. Tapping an outside letter in Amail replies to it; the sent tab marks what left. Addresses read at the root domain now: jeffrey@aesthetic.computer. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>