The system script would have some other set of mailboxes -- owned by the
system user. As Nigel mentions, he uses the filesystem for his system
scripts. The system script runs as the postmaster user. So this also
raises a question about how to do envelope matching, for example, with
Relational which prohibits matching against other people's envelopes to
discover who else has received the message.
Most of the sieve specs so far are very targetted at the end user scripts. For
server administrator scripts, I see no reason why they shouldn't have access to
the complete envelope.
So yes, it is an important point to note, that the "envelope" needs to be
refined as the message progresses through the system. So in our
implementation, the server script has the full SMTP envelope to this server,
but the end user only sees an envelope with a single recipient, as the envelope
has at that stage been broken down into lots of smaller envelopes, one per
recipient.
Nigel