The cause has turned out to be a bad operation of the customer. He removed postmaster.pid after doing 'kill -SIGKILL' against postmaster, and started a new instance. As a consequence, two different server instances wrote different heap pages to the data file, producing multiple rows with the same primary key value.
Thanks for any investigation.
Regards
Takayuki Tsunakawa