@oneaddress/setup 2.1.3 → 2.2.0

package/dist/index.js

@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "2.1.3" : "?";
+var WIZARD_VERSION = true ? "2.2.0" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -1087,6 +1087,7 @@ data.db-shm
  */
 import { DatabaseSync } from 'node:sqlite';
 import { join } from 'node:path';
+import { report } from './report.js';
 import {
   accountIndex,
   buildVerifier,
@@ -1229,6 +1230,22 @@ export { PassphraseRequiredError, WrongPassphraseError };
  * separates them.
  */
 export { isEncrypted };
+
+/**
+ * Add a column to an existing table if it is not already there.
+ *
+ * SQLite has no \`ADD COLUMN IF NOT EXISTS\`, and a receiver that has been
+ * running since before a column existed still has to start. Lives here rather
+ * than in one of the two files that needs it, because the second copy is how
+ * the two drift.
+ */
+export function ensureColumn(table: string, column: string, definition: string): void {
+  const cols = db.prepare(\`PRAGMA table_info(\${table})\`).all() as Array<{ name: string }>;
+  if (cols.some((c) => c.name === column)) return;
+  db.exec(\`ALTER TABLE \${table} ADD COLUMN \${column} \${definition}\`);
+  report.info(\`[db] migrated: added column \${table}.\${column}\`);
+}
+
 export default db;
 `
     },
@@ -1665,7 +1682,7 @@ import { formatLine, report, type ReportLine } from './report.js';
 import { store } from './store.js';
 import type { StoredCustomer } from './customer-store.js';
 import { pendingConfirmCount } from './confirm-queue.js';
-import { heldCount, heldSummary } from './quarantine.js';
+import { exportHeld, heldCount, heldSummary } from './quarantine.js';
 
 /** blessed takes colours as strings; these mirror the site's palette. */
 const AMBER = HEX.amber.toLowerCase();
@@ -1688,6 +1705,21 @@ export interface TuiOptions {
    * the dashboard still renders for a caller that has no replay to offer.
    */
   onReplay?: () => Promise<{ applied: number; failed: number }>;
+  /**
+   * How the dispatches went, asked of the receiver rather than counted here.
+   *
+   * Same reason as \`onReplay\`: \`server.ts\` already imports this file, so this
+   * file cannot import it back. Optional, and a caller that omits it gets
+   * zeroes, which is honest for a dashboard driving nothing.
+   */
+  stats?: () => {
+    received: number;
+    applied: number;
+    failed: number;
+    mode: string;
+    awaitingConnector: number;
+    oldestUndrawn: string | null;
+  };
 }
 
 /** One address as a single line, the way the change panel shows it. */
@@ -1696,7 +1728,7 @@ function oneLine(a: Record<string, unknown>): string {
   return parts.length > 0 ? parts.join(', ') : '(empty)';
 }
 
-export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptions): void {
+export function startDashboard({ partnerName, port, onQuit, onReplay, stats }: TuiOptions): void {
   const screen = blessed.screen({
     smartCSR: true,
     title: \`\${partnerName} \u2014 OneAddress receiver\`,
@@ -1758,7 +1790,9 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
   // is the other case: a permanent empty box teaches the eye to skip that
   // region, which is precisely the region that has to be noticed the one day it
   // fills. So it appears, and the two panels above give up the rows.
-  const FAULT_HEIGHT = 7;
+  // Six, not seven. Every row this takes comes off the two panels above it, and
+  // the one above left cannot afford to lose any: see renderChange.
+  const FAULT_HEIGHT = 6;
   const faultBox = blessed.box({
     parent: screen, bottom: 3, left: 0, width: '100%', height: FAULT_HEIGHT,
     label: ' FAULTS ', tags: true, padding: { left: 1, right: 1 }, hidden: true,
@@ -1774,9 +1808,6 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
   });
 
   // \u2500\u2500 State \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  let received = 0;
-  let applied = 0;
-  let failed = 0;
   let lastChange: { customer: StoredCustomer; previous: Record<string, unknown> } | null = null;
   let pendingPrevious: Record<string, unknown> = {};
 
@@ -1789,9 +1820,16 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
     // Both states are shown, and the unprotected one is the loud colour. A
     // security property mentioned only when it holds is one nobody notices the
     // absence of.
-    const vault = store.encrypted
-      ? \`{green-fg}{bold}ENCRYPTED{/}\`
-      : \`{red-fg}{bold}UNENCRYPTED{/}\`;
+    const inbox = statsMode() === 'inbox';
+    // IN INBOX MODE THERE IS NO CUSTOMER FILE HERE AT ALL, so neither ENCRYPTED
+    // nor UNENCRYPTED is true and both would mislead. The receiver holds
+    // ciphertext it cannot open; the customers live in the partner's own
+    // database, behind their own controls.
+    const vault = inbox
+      ? \`{\${AMBER}-fg}{bold}NONE (inbox){/}\`
+      : store.encrypted
+        ? \`{green-fg}{bold}ENCRYPTED{/}\`
+        : \`{red-fg}{bold}UNENCRYPTED{/}\`;
     status.setContent(
       \`{\${AMBER}-fg}{bold}\${esc(partnerName)}{/}   \` +
       \`{\${DIM}-fg}listening{/} {\${CREAM}-fg}:\${port}/webhook{/}   \` +
@@ -1816,11 +1854,23 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
     const { customer, previous } = lastChange;
     let now: Record<string, unknown> = {};
     try { now = JSON.parse(customer.address) as Record<string, unknown>; } catch { /* keep empty */ }
+    // COMPACT, AND THAT IS A BUG FIX RATHER THAN A TIDY-UP.
+    //
+    // This used to space the lines out with blanks, which needed eight rows.
+    // The faults band takes seven rows off this panel when it appears, so on a
+    // real terminal the last line fell off the bottom - and the last line is
+    // \`now\`, the one thing the panel exists to show. blessed clips silently, so
+    // it read as a dispatch that had half worked.
+    //
+    // It cost a real end-to-end run an hour of doubt: the address had been
+    // applied, confirmed and acknowledged by OneAddress, and the screen showed
+    // only what it used to be. Adjacent is better anyway, because comparing two
+    // lines a blank apart is harder than comparing two lines.
     changeBox.setContent(
-      \`\\n  {bold}\${esc(customer.name)}{/bold}\\n\` +
+      \`\\n  {bold}\${esc(customer.name)}{/bold}\` +
       \`  {\${DIM}-fg}account{/} {\${AMBER}-fg}\${esc(customer.account_number)}{/}\\n\\n\` +
-      \`  {red-fg}was{/}  \${esc(oneLine(previous))}\\n\\n\` +
-      \`  {green-fg}now{/}  {\${CREAM}-fg}\${esc(oneLine(now))}{/}\\n\`,
+      \`  {red-fg}was{/}  \${esc(oneLine(previous))}\\n\` +
+      \`  {green-fg}now{/}  {\${CREAM}-fg}\${esc(oneLine(now))}{/}\`,
     );
   }
 
@@ -1835,6 +1885,8 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
    * declines to count returns forever, so the dash below is the honest initial
    * state rather than a placeholder that happens to look the same.
    */
+  const statsMode = (): string => stats?.().mode ?? 'write-through';
+
   let onFile: number | null = null;
   function refreshCount(): void {
     void Promise.resolve(store.count())
@@ -1860,14 +1912,14 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
     // Grouped, never one line per dispatch. The realistic shape of this table
     // is forty rows with ONE cause between them, and forty identical lines hide
     // the single fact that matters.
-    const lines = heldSummary().slice(0, 3).map((l) => \`  {red-fg}\${esc(l)}{/}\`);
+    const lines = heldSummary().slice(0, 2).map((l) => \`  {red-fg}\${esc(l)}{/}\`);
     faultBox.setContent(
-      \`\\n  {bold}\${held}{/bold} dispatch(es) arrived that this receiver could not open.\\n\` +
-      \`  {\${DIM}-fg}They are held, encrypted, exactly as they arrived. Nothing is lost yet.{/}\\n\\n\` +
-      lines.join('\\n') + '\\n\\n' +
+      \`\\n  {bold}\${held}{/bold} dispatch(es) arrived that this receiver could not open. \` +
+      \`{\${DIM}-fg}Held, encrypted, exactly as they arrived.{/}\\n\` +
+      lines.join('\\n') + '\\n' +
       (replayNote
         ? \`  {\${AMBER}-fg}\${esc(replayNote)}{/}\`
-        : \`  {\${DIM}-fg}Fix the cause (usually a key in .env), then press{/} {\${AMBER}-fg}[r]{/} {\${DIM}-fg}to apply them.{/}\`),
+        : \`  {\${DIM}-fg}Fix the cause, then{/} {\${AMBER}-fg}[r]{/} {\${DIM}-fg}to apply,{/} {\${AMBER}-fg}[e]{/} {\${DIM}-fg}to export the list.{/}\`),
     );
   }
 
@@ -1881,12 +1933,27 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
     // with a backlog shows the backlog instead of zero.
     const awaiting = pendingConfirmCount();
     const awaitingColour = awaiting > 0 ? AMBER : DIM;
+    // ASKED, not accumulated. The server counts per dispatch, so a redelivery
+    // updates a record rather than adding one.
+    const s = stats?.() ?? {
+      received: 0, applied: 0, failed: 0,
+      mode: 'write-through', awaitingConnector: 0, oldestUndrawn: null,
+    };
+    const { received, applied, failed } = s;
+    // AWAITING YOUR SYSTEMS, in inbox mode only. Drawn whether or not it is
+    // zero there, and absent entirely in write-through, because a counter for a
+    // thing that cannot happen is noise that teaches the eye to skip the row.
+    const awaitingYou = s.mode === 'inbox'
+      ? \`{\${s.awaitingConnector > 0 ? AMBER : DIM}-fg}awaiting your systems{/} \` +
+        \`{bold}\${s.awaitingConnector}{/bold}   \`
+      : '';
     footer.setContent(
       \`{\${DIM}-fg}received{/} {bold}\${received}{/bold}   \` +
       \`{green-fg}applied{/} {bold}\${applied}{/bold}   \` +
       \`{red-fg}failed{/} {bold}\${failed}{/bold}   \` +
+      awaitingYou +
       \`{\${awaitingColour}-fg}awaiting confirm{/} {bold}\${awaiting}{/bold}\` +
-      \`{|}{\${DIM}-fg}\${onReplay ? '[r] replay  ' : ''}[q] quit{/}  \`,
+      \`{|}{\${DIM}-fg}\${onReplay ? '[r] replay  ' : ''}[e] export  [q] quit{/}  \`,
     );
   }
 
@@ -1899,31 +1966,20 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
   }
 
   // \u2500\u2500 The feed \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  // Counters are derived from the reported lines rather than from a second
-  // channel the server would have to remember to update. One source, so the
-  // footer cannot disagree with the log beside it.
+  // NARRATION ONLY. It used to derive the footer's counters from these lines
+  // too, on the reasoning that one source cannot disagree with itself. That
+  // held until replay shipped: a replay produces exactly the lines an arrival
+  // does, so pressing [r] against a key that could never work drove \`received\`
+  // from 5 to 67 while nothing arrived. A log line says what happened and not
+  // what it happened TO, so two lines about one dispatch are indistinguishable
+  // from two dispatches. The counters key on the dispatch now; see
+  // \`src/tally.ts\`.
   const detach = report.attach((line: ReportLine) => {
     const text = formatLine(line);
     const colour = line.level === 'error' ? 'red' : line.level === 'warn' ? 'yellow' : CREAM;
     const time = new Date(line.at).toTimeString().slice(0, 8);
 
-    // COUNTED ON THE OUTCOME LINE, WHICHEVER IT IS.
-    //
-    // \`received\` used to increment only on \`address.updated for <account>\`,
-    // which is logged AFTER decryption because the account number comes out of
-    // the decrypted envelope. A dispatch that failed to decrypt returned 422
-    // before that line ran, so it was never counted as having arrived: a
-    // partner with a wrong key saw \`received 0 \xB7 failed 12\` and went looking at
-    // their tunnel and their webhook URL. Everything was arriving. The error
-    // line said "check your key" and the counter, louder, said "nothing here".
-    //
-    // Every dispatch produces exactly one of these, so counting either as an
-    // arrival makes received = applied + failed hold.
-    const failure = /REFUSED|decryption failed|Decryption failed|no private key for/.test(text);
-    if (/address\\.updated for /.test(text) || failure) received++;
-    if (failure) failed++;
     if (/\\[store\\] saved address for /.test(text)) {
-      applied++;
       // The store logs the account key and never the address, so the panel is
       // refreshed from the DATABASE rather than parsed out of the log line.
       const acct = /saved address for (\\S+)/.exec(text)?.[1];
@@ -1965,6 +2021,24 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
       .finally(() => { replaying = false; redraw(); });
   });
 
+  // [e] EXPORTS THE FAULT LIST. Metadata only, no payloads: see exportHeld.
+  // Bound unconditionally for the same reason [r] is, so pressing it on a clean
+  // receiver says there is nothing to export rather than appearing to hang.
+  screen.key(['e'], () => {
+    if (heldCount() === 0) {
+      replayNote = 'Nothing held, so nothing to export.';
+      redraw();
+      return;
+    }
+    try {
+      const { path, count } = exportHeld(process.cwd());
+      replayNote = \`Exported \${count} to \${path}\`;
+    } catch (err) {
+      replayNote = \`Export failed: \${err instanceof Error ? err.message : String(err)}\`;
+    }
+    redraw();
+  });
+
   screen.key(['q', 'C-c'], () => {
     detach();
     screen.destroy();
@@ -2238,6 +2312,14 @@ async function main(): Promise<void> {
     partnerName: string;
     port: number;
     replay: () => Promise<{ applied: number; failed: number }>;
+    stats: () => {
+      received: number;
+      applied: number;
+      failed: number;
+      mode: string;
+      awaitingConnector: number;
+      oldestUndrawn: string | null;
+    };
   };
   try {
     const server = await import('./server.js');
@@ -2249,6 +2331,7 @@ async function main(): Promise<void> {
       // second edge the other way is a cycle. This file is the one place that
       // holds both.
       replay:      server.replayQuarantined,
+      stats:       server.dashboardStats,
     };
   } catch (err) {
     if (err instanceof PassphraseRequiredError) {
@@ -2278,6 +2361,7 @@ async function main(): Promise<void> {
     partnerName: config.partnerName,
     port: config.port,
     onReplay: config.replay,
+    stats: config.stats,
     onQuit: () => { /* the process exits; the OS closes the socket */ },
   });
 }
@@ -2286,6 +2370,708 @@ main().catch((err) => {
   console.error('[startup]', err instanceof Error ? err.message : err);
   process.exit(1);
 });
+`
+    },
+    {
+      name: "src/connector-store.ts",
+      content: `/**
+ * A \`CustomerStore\` whose answers come from the connector.
+ *
+ * ## Why the mode swaps the STORE rather than branching the handler
+ *
+ * The obvious way to build inbox mode is an \`if (mode === 'inbox')\` beside each
+ * verify event in \`server.ts\`. That works and it puts the mode into the middle
+ * of the protocol layer, where it has to be got right twice and stay right
+ * every time either handler changes.
+ *
+ * The contract in \`customer-store.ts\` already says exactly what the receiver
+ * needs from a partner: verify an account, verify an address, apply a change.
+ * In inbox mode the answers come from a different place. That is an
+ * IMPLEMENTATION of the contract, not a special case in the caller, so the
+ * handler is untouched and there is one place the mode lives.
+ *
+ * ## Three methods answer, two deliberately refuse
+ *
+ * \`verifyAccount\` and \`verifyAddress\` ask the connector and wait, because a
+ * consumer is mid-payment on the other end of the first one.
+ *
+ * \`saveAddress\` THROWS. In inbox mode an \`address.updated\` never reaches the
+ * store at all: it is held for the connector to draw, and the connector applies
+ * it against the partner's own database. If this is ever called, the mode
+ * switch has been bypassed and the right answer is a loud failure rather than a
+ * quiet write into a store that should not exist.
+ *
+ * \`find\` and \`count\` return nothing, honestly, because this receiver holds no
+ * customer records in this mode. The dashboard draws a dash rather than a zero,
+ * which is the difference between "not asked" and "none".
+ */
+import { report } from './report.js';
+import { askConnector } from './connector-client.js';
+import type {
+  AccountVerdict,
+  Address,
+  Customer,
+  CustomerStore,
+  StoredCustomer,
+  VerifyResult,
+} from './customer-store.js';
+
+/**
+ * The raw body of the request currently being handled.
+ *
+ * SET BY THE HANDLER, read here. The contract passes a decoded \`Customer\`,
+ * which is exactly what this store does not have and cannot produce: the
+ * receiver holds no private key in this mode, so the only thing it can send the
+ * connector is the ciphertext that arrived. Rather than widen the contract for
+ * one implementation, the handler parks the bytes here for the length of the
+ * request.
+ *
+ * Safe because Node runs one request's synchronous path at a time and this is
+ * read immediately, in the same tick the handler sets it. It would NOT be safe
+ * if anything awaited between the set and the read, which is why they are
+ * adjacent and why this comment exists.
+ */
+let currentRawBody = '';
+
+export function setCurrentRawBody(raw: string): void {
+  currentRawBody = raw;
+}
+
+function verdictOf(body: Record<string, unknown> | undefined, key: string): string | null {
+  const value = body?.[key];
+  return typeof value === 'string' ? value : null;
+}
+
+export const connectorStore = {
+  name: 'connector',
+  // The receiver holds no customer records in this mode, so "is the customer
+  // file encrypted" has no true answer. False is the honest one: there is no
+  // protected customer store here, because there is no customer store here.
+  encrypted: false,
+
+  async verifyAccount(
+    accountNumber: string | null,
+    _name: string,
+    _knownNames: string[] = [],
+  ): Promise<AccountVerdict> {
+    const answer = await askConnector('account.verify', currentRawBody);
+    if (!answer.reached) {
+      // NEVER GUESSED. A fabricated match authorises a stranger's address onto
+      // a customer's account. \`no_account\` is the safe answer and stops the
+      // consumer before they pay, which is the trade this design accepted.
+      report.warn(
+        \`[connector] account check for \${accountNumber ?? '(none)'} could not be answered; \` +
+        'refusing rather than guessing',
+      );
+      return 'no_account';
+    }
+    const status = verdictOf(answer.body, 'status');
+    if (status === 'match' || status === 'no_match' || status === 'no_account') return status;
+    report.warn(\`[connector] account.verify answered "\${status ?? '(nothing)'}", which is not a verdict\`);
+    return 'no_account';
+  },
+
+  async verifyAddress(_customer: Customer, _incoming: Address): Promise<VerifyResult> {
+    const answer = await askConnector('address.verify', currentRawBody);
+    if (!answer.reached) return 'not_found';
+    const result = verdictOf(answer.body, 'result');
+    if (result === 'match' || result === 'mismatch' || result === 'not_found') return result;
+    report.warn(\`[connector] address.verify answered "\${result ?? '(nothing)'}", which is not a result\`);
+    return 'not_found';
+  },
+
+  saveAddress(_customer: Customer, _incoming: Address): Promise<Address> {
+    // Unreachable by design: see the header. Loud rather than quiet.
+    return Promise.reject(new Error(
+      'saveAddress was called in inbox mode. Updates are held for the connector to draw and ' +
+      'apply against your own database; nothing should write through this receiver.',
+    ));
+  },
+
+  find(_accountNumber: string): StoredCustomer | null { return null; },
+  count(): null { return null; },
+} satisfies CustomerStore;
+`
+    },
+    {
+      name: "src/connector-client.ts",
+      content: `/**
+ * Asking the connector a question that cannot wait.
+ *
+ * ## Why this direction exists at all
+ *
+ * Everything else between the receiver and the connector is a PULL: the
+ * connector draws work when it is ready. That is the right shape, because the
+ * partner's system should control its own pace.
+ *
+ * The two verify events cannot work that way. \`account.verify\` runs BEFORE the
+ * consumer pays and has to answer in the same request with match, no match, or
+ * no account; \`address.verify\` is the same shape. Both need a decrypt and a
+ * customer lookup, and in inbox mode both of those live in the connector. So
+ * for these, and only these, the receiver calls out and waits.
+ *
+ * ## A CORRECTION TO THE DESIGN DOCUMENT, recorded where it matters
+ *
+ * \`docs/architecture/receiver-connector-design.md\` says the connector "accepts
+ * no inbound connections". That is not achievable alongside a synchronous
+ * verify, and the verify decision is the one that was taken deliberately. So
+ * the connector DOES listen, on loopback only, and the honest form of the
+ * property is: no inbound port reachable from any NETWORK. The difference
+ * matters the day a partner puts the two on separate hosts, which is what the
+ * transport configuration below exists for.
+ *
+ * ## What happens when the connector is down
+ *
+ * The receiver tells OneAddress honestly that it could not check, and the
+ * consumer is stopped BEFORE they pay rather than after. That is the cost of
+ * choosing this over a verify-only key in the receiver: such a key would keep
+ * answers flowing during an outage and would make "the receiver cannot read
+ * addresses" untrue, which is the whole point of the split.
+ *
+ * It is NEVER answered with a guess. A fabricated match authorises a stranger's
+ * address onto a customer's account; a fabricated no-match costs a support
+ * call. Neither is ours to invent.
+ */
+import { report } from './report.js';
+
+/**
+ * Where the connector listens.
+ *
+ * 3003, NOT 3002. Two loopback listeners exist in this design and swapping them
+ * is silent: the receiver's own draw channel is on 3002, so a receiver pointed
+ * at 3002 for verify asks ITSELF the question and gets a 404 that reads exactly
+ * like a connector that is down.
+ */
+const CONNECTOR_URL = process.env.CONNECTOR_URL ?? 'http://127.0.0.1:3003';
+const TOKEN = process.env.CONNECTOR_TOKEN ?? '';
+/**
+ * Short, because a consumer is watching a spinner on the other end of this.
+ * A verify that takes eight seconds has already failed as far as they are
+ * concerned, and an honest "could not check" beats a long hang.
+ */
+const TIMEOUT_MS = Number(process.env.CONNECTOR_TIMEOUT_MS ?? 5000);
+
+export type VerifyKind = 'account.verify' | 'address.verify';
+
+export interface ConnectorVerdict {
+  reached: boolean;
+  /** Whatever the connector answered. Passed through untouched. */
+  body?: Record<string, unknown>;
+  error?: string;
+}
+
+/**
+ * Hand the connector an encrypted verify event and wait for its answer.
+ *
+ * The RAW BODY goes over, not anything decoded: the receiver holds no private
+ * key in this mode and has nothing to decode it with. The connector decrypts,
+ * looks the customer up in the partner's database, and answers.
+ */
+export async function askConnector(kind: VerifyKind, rawBody: string): Promise<ConnectorVerdict> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const res = await fetch(\`\${CONNECTOR_URL}/verify\`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': \`Bearer \${TOKEN}\`,
+        'X-OneAddress-Verify-Kind': kind,
+      },
+      body: rawBody,
+      signal: controller.signal,
+    });
+    const text = await res.text().catch(() => '');
+    if (!res.ok) {
+      report.error(\`[connector] \${kind} refused: HTTP \${res.status} \${text.slice(0, 200)}\`);
+      return { reached: false, error: \`HTTP \${res.status}\` };
+    }
+    try {
+      return { reached: true, body: JSON.parse(text) as Record<string, unknown> };
+    } catch {
+      report.error(\`[connector] \${kind} answered with something that is not JSON\`);
+      return { reached: false, error: 'bad response' };
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    // NAMES THE REMEDY. This is the failure a partner will actually see, and
+    // "fetch failed" on its own sends them looking at OneAddress.
+    report.error(
+      \`[connector] could not reach the connector for \${kind} (\${message}). \` +
+      \`Account checks will fail until it is back. Is it running, and is CONNECTOR_URL (\${CONNECTOR_URL}) right?\`,
+    );
+    return { reached: false, error: message };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+`
+    },
+    {
+      name: "src/draw-api.ts",
+      content: `/**
+ * The channel your connector draws from.
+ *
+ * ## The most dangerous surface in this receiver
+ *
+ * Everything else here handles ciphertext. This hands out dispatches a
+ * connector will decrypt, and takes its word for what was applied. An exposed
+ * or unauthenticated version of it is precisely the oracle the whole
+ * architecture exists to prevent, so three things are not configurable:
+ *
+ *   1. **It binds to 127.0.0.1 and nothing else.** There is deliberately no
+ *      option to bind it to an interface. A partner who needs the connector on
+ *      another host needs a transport with mutual authentication, not this one
+ *      with a wider bind, and giving them a knob that looks like it does the
+ *      job is how that ends up on a LAN.
+ *   2. **It runs on a SEPARATE PORT from the webhook.** Same process, different
+ *      listener, so nothing routed from the internet can reach these paths even
+ *      by mistake in a reverse proxy.
+ *   3. **It needs its own credential.** \`CONNECTOR_TOKEN\`, not the webhook
+ *      secret and not the confirm secret. Those are shared with OneAddress; a
+ *      leak of either must not also hand somebody your customers' addresses.
+ *      Compared in constant time, and the API refuses to start without it.
+ *
+ * ## What it does NOT decrypt
+ *
+ * Nothing. It hands over \`raw_body\`, the bytes as they arrived. The private key
+ * lives in the connector, which is the only component that can read any of it.
+ */
+import express, { type Request, type Response } from 'express';
+import rateLimit from 'express-rate-limit';
+import { timingSafeEqual } from 'node:crypto';
+import { report } from './report.js';
+import { acknowledge, drawable, markDrawn, type InboxOutcome } from './inbox.js';
+
+const TOKEN = process.env.CONNECTOR_TOKEN ?? '';
+/**
+ * The RECEIVER's loopback listener, which is not the connector's.
+ *
+ * Named \`DRAW_PORT\` rather than \`CONNECTOR_PORT\` because the connector has a
+ * listener of its own, on \`CONNECTOR_PORT\` (3003), for the verify questions
+ * that cannot wait for a draw. One name for two ports on one host is a
+ * misconfiguration nobody would find: each end would bind or dial the other's.
+ */
+const DRAW_PORT = Number(process.env.DRAW_PORT ?? 3002);
+/**
+ * How long a drawn item stays claimed before it is offered again.
+ *
+ * Crash recovery for ONE connector, not concurrency for two. See \`inbox.ts\`.
+ * Generous, because the cost of re-offering too early is a duplicate apply and
+ * the cost of re-offering too late is a delay nobody dies of.
+ */
+const LEASE_SECONDS = Number(process.env.CONNECTOR_LEASE_SECONDS ?? 300);
+
+/** Constant time, and length-safe: \`timingSafeEqual\` throws on a length mismatch. */
+function tokenMatches(presented: string): boolean {
+  const a = Buffer.from(presented);
+  const b = Buffer.from(TOKEN);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
+function authorised(req: Request, res: Response): boolean {
+  const header = req.headers.authorization ?? '';
+  const presented = header.startsWith('Bearer ') ? header.slice(7) : '';
+  if (presented && tokenMatches(presented)) return true;
+  // No detail, deliberately. This endpoint should tell an unauthorised caller
+  // nothing at all about whether it exists or what it holds.
+  res.status(401).json({ error: 'Unauthorised' });
+  return false;
+}
+
+export function startDrawApi(): { port: number } | null {
+  if (connectorTokenMissing()) return null;
+
+  const app = express();
+  app.disable('x-powered-by');
+
+  // A BACKSTOP, AND NOT WHAT KEEPS THIS SHUT.
+  //
+  // What keeps it shut is the loopback bind and the credential, compared in
+  // constant time. This bounds what an attacker who is already on the box can
+  // spend, and it is deliberately far above any real connector: a draw every
+  // two seconds plus an acknowledgement per item is a few hundred a minute at
+  // worst, so a legitimate connector never meets this and a partner who tunes
+  // \`CONNECTOR_POLL_MS\` down still has room.
+  //
+  // No \`trust proxy\` here, unlike the webhook app. There is no proxy in front
+  // of a loopback listener, so \`X-Forwarded-For\` is somebody trying it on, and
+  // trusting it would let them key the limiter on an address of their choosing.
+  //
+  // Attached ONCE, on the app rather than per route. Two references to the same
+  // limiter instance count a request twice and silently halve the ceiling.
+  app.use(rateLimit({
+    windowMs: 60_000,
+    max: 2000,
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: { error: 'Too many requests' },
+  }));
+
+  app.use(express.json({ limit: '2mb' }));
+
+  /**
+   * Take the next batch of work.
+   *
+   * A GET with no side effects would be tidier and would be wrong: drawing has
+   * to stamp the lease, or a connector that asks twice gets the same items and
+   * applies them twice.
+   */
+  app.post('/draw', (req: Request, res: Response) => {
+    if (!authorised(req, res)) return;
+    const limit = Math.min(Number((req.body as { limit?: unknown }).limit ?? 20) || 20, 100);
+    const items = drawable(limit, LEASE_SECONDS);
+    markDrawn(items.map((i) => i.id));
+    if (items.length > 0) report.info(\`[draw] connector took \${items.length} dispatch(es)\`);
+    return res.json({ items });
+  });
+
+  /**
+   * What the connector did with one item.
+   *
+   * \`applied\` queues the confirm to OneAddress. \`failed\` queues a failed
+   * confirm, which is the honest answer when the partner's own system refused
+   * the change: the consumer is told it did not land rather than being told it
+   * did.
+   */
+  app.post('/ack', (req: Request, res: Response) => {
+    if (!authorised(req, res)) return;
+    const body = req.body as { id?: unknown; outcome?: unknown; detail?: unknown };
+    const id = typeof body.id === 'string' ? body.id : '';
+    const outcome: InboxOutcome | null =
+      body.outcome === 'applied' || body.outcome === 'failed' ? body.outcome : null;
+    if (!id || !outcome) {
+      return res.status(400).json({ error: 'id and outcome (applied|failed) are required' });
+    }
+    const detail = typeof body.detail === 'string' ? body.detail : null;
+
+    const result = acknowledge(id, outcome, detail);
+    if (!result) return res.status(404).json({ error: 'unknown id' });
+    if (result.alreadyAcknowledged) {
+      // NOT AN ERROR. A connector that is unsure its acknowledgement landed
+      // should retry, and punishing that is how an update ends up applied and
+      // never confirmed.
+      return res.json({ ok: true, duplicate: true });
+    }
+
+    if (result.dispatchId) onAcknowledged(result.dispatchId, outcome);
+    return res.json({ ok: true });
+  });
+
+  /** Enough for the connector to know it is talking to the right receiver. */
+  app.get('/connector/health', (req: Request, res: Response) => {
+    if (!authorised(req, res)) return;
+    return res.json({ status: 'ok', mode: 'inbox' });
+  });
+
+  app.listen(DRAW_PORT, '127.0.0.1', () =>
+    report.info(\`[draw] connector channel \u2192 http://127.0.0.1:\${DRAW_PORT} (loopback only)\`),
+  );
+  return { port: DRAW_PORT };
+}
+
+/**
+ * Refuse to open the channel without a credential, and say why.
+ *
+ * Returning null rather than throwing, because a receiver in write-through mode
+ * has no connector and must start perfectly well without one. In inbox mode the
+ * caller turns this into a hard failure, since an inbox with no way to drain it
+ * is worse than a receiver that will not start.
+ */
+function connectorTokenMissing(): boolean {
+  if (TOKEN.trim().length >= 16) return false;
+  report.error(
+    '[draw] CONNECTOR_TOKEN is missing or shorter than 16 characters, so the connector ' +
+    'channel was NOT opened. This is its own credential on purpose: it must not be your ' +
+    'webhook secret or your confirm secret, because those are shared with OneAddress and a ' +
+    'leak of either must not also hand somebody your customers\\' addresses.',
+  );
+  return true;
+}
+
+/**
+ * Told when an item is acknowledged, so the receiver can confirm to OneAddress.
+ *
+ * A setter rather than an import, because \`server.ts\` owns the confirm queue
+ * and already imports this module: importing it back would be a cycle.
+ */
+let onAcknowledged: (dispatchId: string, outcome: InboxOutcome) => void = () => {};
+
+export function setAcknowledgementHandler(
+  handler: (dispatchId: string, outcome: InboxOutcome) => void,
+): void {
+  onAcknowledged = handler;
+}
+`
+    },
+    {
+      name: "src/inbox.ts",
+      content: `/**
+ * Dispatches waiting for YOUR system to collect them.
+ *
+ * ## What this is, and why it is not the quarantine
+ *
+ * Both tables hold a signature-verified dispatch as the ciphertext that
+ * arrived. They mean opposite things.
+ *
+ * A QUARANTINED dispatch is one the receiver could not open: something is
+ * wrong, usually a key, and it is purged on a window because holding a
+ * consumer's encrypted address forever is a retention decision nobody made.
+ *
+ * An INBOX dispatch is one nothing is wrong with. It arrived intact and is
+ * waiting for the partner's own systems to draw it, apply it in their database
+ * and say so. **It is NEVER aged out**, and that asymmetry is deliberate: an
+ * undrawn update is a consumer whose address has not landed, and deleting it on
+ * a timer loses it silently. The dashboard reports a growing undrawn count as a
+ * fault instead, which is the honest way to make an operator deal with it.
+ *
+ * ## Nothing here is readable
+ *
+ * The rows hold the bytes as they arrived. In inbox mode the receiver holds no
+ * private key at all, so it could not decrypt these if it wanted to. That is
+ * the property the whole split exists for: the component reachable from the
+ * internet cannot read what it stores.
+ *
+ * ## The lease, and what it is NOT for
+ *
+ * A connector that draws a batch and then crashes must not strand it. So a draw
+ * stamps \`drawn_at\`, and an item becomes drawable again once that stamp is
+ * older than the lease. That is CRASH RECOVERY for one connector.
+ *
+ * It is not a design for two connectors drawing at once. Two would each get
+ * their own view of what is drawable between leases, and nothing here stops
+ * them applying the same update twice. If a second connector is ever wanted,
+ * the claim has to become atomic, the way \`confirm-queue.ts\` already does it.
+ * Written down because a lease LOOKS like it handles concurrency and does not.
+ */
+import db from './db.js';
+import { report } from './report.js';
+
+export type InboxOutcome = 'applied' | 'failed';
+
+db.exec(\`
+  CREATE TABLE IF NOT EXISTS inbox (
+    id          TEXT PRIMARY KEY,
+    dispatch_id TEXT,
+    event       TEXT NOT NULL,
+    raw_body    TEXT NOT NULL,
+    received_at TEXT NOT NULL DEFAULT (datetime('now')),
+    drawn_at    TEXT,
+    applied_at  TEXT,
+    outcome     TEXT,
+    detail      TEXT
+  );
+  CREATE INDEX IF NOT EXISTS idx_inbox_open
+    ON inbox(applied_at, drawn_at, received_at);
+\`);
+
+export interface AcceptInput {
+  key: string;
+  dispatchId: string | null;
+  event: string;
+  rawBody: string;
+}
+
+/**
+ * Take a dispatch for the connector to collect.
+ *
+ * \`INSERT OR IGNORE\`, keyed on the same dispatch identity everything else here
+ * uses, so a OneAddress retry of a delivery we already hold does not queue the
+ * same update twice.
+ */
+export function accept(input: AcceptInput): void {
+  db.prepare(
+    \`INSERT OR IGNORE INTO inbox (id, dispatch_id, event, raw_body)
+     VALUES (?, ?, ?, ?)\`,
+  ).run(input.key, input.dispatchId, input.event, input.rawBody);
+}
+
+export interface InboxItem {
+  id: string;
+  dispatch_id: string | null;
+  event: string;
+  raw_body: string;
+  received_at: string;
+}
+
+/**
+ * What the connector may take now.
+ *
+ * Anything never drawn, plus anything drawn longer ago than the lease and still
+ * unacknowledged, which is the crashed-connector case.
+ */
+export function drawable(limit: number, leaseSeconds: number): InboxItem[] {
+  const cutoff = new Date(Date.now() - leaseSeconds * 1000).toISOString();
+  return db.prepare(
+    \`SELECT id, dispatch_id, event, raw_body, received_at
+       FROM inbox
+      WHERE applied_at IS NULL
+        AND (drawn_at IS NULL OR drawn_at < ?)
+      ORDER BY received_at
+      LIMIT ?\`,
+  ).all(cutoff, limit) as unknown as InboxItem[];
+}
+
+export function markDrawn(ids: string[]): void {
+  if (ids.length === 0) return;
+  const stamp = new Date().toISOString();
+  const stmt = db.prepare('UPDATE inbox SET drawn_at = ? WHERE id = ?');
+  for (const id of ids) stmt.run(stamp, id);
+}
+
+/**
+ * The connector's verdict on one item.
+ *
+ * Returns the dispatch id to confirm, or null when there is nothing to tell
+ * OneAddress: an unknown id, or one already acknowledged. Deliberately not an
+ * error, because a connector retrying an acknowledgement it is unsure landed is
+ * doing the right thing and must not be punished for it.
+ */
+export function acknowledge(
+  id: string,
+  outcome: InboxOutcome,
+  detail: string | null,
+): { dispatchId: string | null; alreadyAcknowledged: boolean } | null {
+  const row = db.prepare(
+    'SELECT dispatch_id, applied_at FROM inbox WHERE id = ?',
+  ).get(id) as { dispatch_id: string | null; applied_at: string | null } | undefined;
+  if (!row) return null;
+  if (row.applied_at !== null) {
+    return { dispatchId: row.dispatch_id, alreadyAcknowledged: true };
+  }
+  db.prepare(
+    'UPDATE inbox SET applied_at = ?, outcome = ?, detail = ? WHERE id = ?',
+  ).run(new Date().toISOString(), outcome, detail?.slice(0, 500) ?? null, id);
+  report.info(\`[inbox] \${id} acknowledged by the connector: \${outcome}\`);
+  return { dispatchId: row.dispatch_id, alreadyAcknowledged: false };
+}
+
+/** How many updates are sitting here unapplied. Shown as a fault when non-zero. */
+export function undrawnCount(): number {
+  const row = db.prepare(
+    'SELECT count(*) AS n FROM inbox WHERE applied_at IS NULL',
+  ).get() as { n: number };
+  return row.n;
+}
+
+/** When the oldest unapplied item arrived, for the age on the dashboard. */
+export function oldestUndrawn(): string | null {
+  const row = db.prepare(
+    'SELECT min(received_at) AS oldest FROM inbox WHERE applied_at IS NULL',
+  ).get() as { oldest: string | null };
+  return row.oldest;
+}
+
+/**
+ * NOTHING PURGES THIS TABLE, and the absence is the design.
+ *
+ * \`purgeQuarantine\` and \`purgeDelivered\` both exist one file over. There is no
+ * \`purgeInbox\`, and there should not be: every row here is an address change a
+ * consumer paid for that has not reached the partner's system yet. Ageing one
+ * out would delete the only copy anybody still has.
+ *
+ * Rows that HAVE been applied are kept too, because they are the partner's own
+ * record of what they were sent and when they acted on it. If that ever needs
+ * bounding, bound the APPLIED rows and never the open ones.
+ */
+export function appliedCount(): number {
+  const row = db.prepare(
+    'SELECT count(*) AS n FROM inbox WHERE applied_at IS NOT NULL',
+  ).get() as { n: number };
+  return row.n;
+}
+`
+    },
+    {
+      name: "src/tally.ts",
+      content: `/**
+ * How many dispatches arrived, landed, and did not.
+ *
+ * ## THE BUG THIS REPLACES, WHICH A PARTNER FOUND IN ABOUT A MINUTE
+ *
+ * The dashboard used to derive these by reading its own log feed: a line
+ * matching a failure pattern counted as one arrival and one failure. The
+ * comment beside it asserted the invariant that made that sound: "every
+ * dispatch produces exactly one of these".
+ *
+ * Then replay shipped. A replay produces exactly the same lines an arrival
+ * does, because it IS a delivery, back in through the front door. Somebody
+ * pressed [r] sixty times against a key that was never going to work and
+ * watched \`received\` climb from 5 to 67 and \`failed\` from 1 to 63. Nothing was
+ * arriving. The receiver was counting its own attempts to fix itself.
+ *
+ * The same fault was always there for a cause nobody had to trigger by hand:
+ * OneAddress RETRIES a 422, so a wrong key inflated these counters on its own,
+ * quietly, every few minutes.
+ *
+ * ## Why counting here fixes the class rather than the instance
+ *
+ * Narration is the wrong source. A log line says what happened, not what it
+ * happened TO, so two lines about one dispatch are indistinguishable from two
+ * dispatches. This keys on the DISPATCH, so every re-delivery of it - a
+ * replay, a OneAddress retry, a partner curling the same body twice - lands on
+ * the entry that is already there.
+ *
+ * That also makes a replay that finally WORKS do the right thing on its own:
+ * the entry flips from failed to applied, and the totals move without anything
+ * having to know a replay was involved.
+ *
+ * ## What is counted, stated because the footer does not have room to
+ *
+ * An \`address.updated\` that was stored is \`applied\`. Anything that could not be
+ * opened, or was refused, is \`failed\`. \`received\` is how many distinct
+ * dispatches reached one of those two, so \`received = applied + failed\` holds
+ * by construction rather than by hoping.
+ *
+ * An \`address.verify\` is deliberately none of them: it answers a question and
+ * changes nothing, so counting it as an application would overstate what this
+ * receiver has done. It still shows in the activity log.
+ *
+ * Since boot, like every other figure on that footer. The held count beside
+ * them is not: the quarantine is on disk and survives a restart.
+ */
+
+export type Outcome = 'applied' | 'failed';
+
+/**
+ * Bounded, because this is memory and a busy receiver runs for months.
+ *
+ * At the cap the oldest entry goes, exactly as \`seenDispatches\` does, and the
+ * totals then describe the most recent 5000 dispatches rather than all of them.
+ * That is the honest trade for a footer: an operator reads it to see whether
+ * things are working now, and nobody audits from it.
+ */
+const MAX_TRACKED = 5000;
+const outcomes = new Map<string, Outcome>();
+
+export function recordOutcome(dispatchKey: string, outcome: Outcome): void {
+  if (!outcomes.has(dispatchKey) && outcomes.size >= MAX_TRACKED) {
+    const oldest = outcomes.keys().next().value;
+    if (oldest !== undefined) outcomes.delete(oldest);
+  }
+  // \`set\` on an existing key overwrites in place and keeps its insertion order,
+  // which is what makes a replay that succeeds flip failed to applied rather
+  // than adding a second entry.
+  outcomes.set(dispatchKey, outcome);
+}
+
+export interface Tally {
+  received: number;
+  applied: number;
+  failed: number;
+}
+
+export function tally(): Tally {
+  let applied = 0;
+  for (const outcome of outcomes.values()) if (outcome === 'applied') applied += 1;
+  return { received: outcomes.size, applied, failed: outcomes.size - applied };
+}
+
+/** Test seam. Never called by the receiver. */
+export function resetTally(): void {
+  outcomes.clear();
+}
 `
     },
     {
@@ -2332,9 +3118,11 @@ main().catch((err) => {
  * replay would apply an address for an account they do not recognise. It stays
  * a refusal.
  */
-import db from './db.js';
+import db, { ensureColumn } from './db.js';
 import { report } from './report.js';
 import { createHash } from 'node:crypto';
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 
 /**
  * Why a dispatch could not be applied. Shown verbatim on the dashboard.
@@ -2376,11 +3164,22 @@ db.exec(\`
  * the dispatch header where there is one, and on a hash of the body where there
  * is not, so a retry updates the existing row instead of adding to a pile.
  */
-function rowId(dispatchId: string | null, rawBody: string): string {
+export function dispatchKey(dispatchId: string | null, rawBody: string): string {
   if (dispatchId && dispatchId.trim()) return \`d:\${dispatchId.trim()}\`;
   return \`h:\${createHash('sha256').update(rawBody).digest('hex').slice(0, 32)}\`;
 }
 
+/**
+ * Attempts, so the panel can say how hard this has been tried.
+ *
+ * Added after the quarantine shipped, hence the migration: a partner already
+ * running 2.1.3 has the table without it. Somebody pressed [r] sixty times
+ * against a key that could never work, and the only figure that moved was one
+ * the dashboard was computing wrongly. An attempt count on the row would have
+ * said so immediately.
+ */
+ensureColumn('quarantine', 'attempts', 'INTEGER NOT NULL DEFAULT 0');
+
 export interface QuarantineInput {
   dispatchId: string | null;
   event: string;
@@ -2398,7 +3197,7 @@ export interface QuarantineInput {
  * caller must be able to answer OneAddress whatever happens here.
  */
 export function quarantine(input: QuarantineInput): void {
-  const id = rowId(input.dispatchId, input.rawBody);
+  const id = dispatchKey(input.dispatchId, input.rawBody);
   try {
     db.prepare(
       \`INSERT INTO quarantine (id, dispatch_id, event, reason, key_id, raw_body, detail)
@@ -2435,12 +3234,14 @@ export interface HeldDispatch {
   detail: string | null;
   received_at: string;
   last_error: string | null;
+  attempts: number;
 }
 
 /** Everything still held, oldest first. */
 export function heldDispatches(limit = 50): HeldDispatch[] {
   return db.prepare(
-    \`SELECT id, dispatch_id, event, reason, key_id, raw_body, detail, received_at, last_error
+    \`SELECT id, dispatch_id, event, reason, key_id, raw_body, detail,
+            received_at, last_error, attempts
        FROM quarantine
       WHERE replayed_at IS NULL
       ORDER BY received_at
@@ -2465,15 +3266,36 @@ export function heldCount(): number {
  */
 export function heldSummary(): string[] {
   const rows = db.prepare(
-    \`SELECT reason, key_id, count(*) AS n
+    \`SELECT reason, key_id, count(*) AS n,
+            max(attempts) AS tries, min(received_at) AS oldest
        FROM quarantine
       WHERE replayed_at IS NULL
       GROUP BY reason, key_id
       ORDER BY n DESC\`,
-  ).all() as unknown as { reason: string; key_id: string | null; n: number }[];
-  return rows.map((r) =>
-    \`\${r.n} \xD7 \${r.reason}\${r.key_id ? \` (key_id \${r.key_id})\` : ''}\`,
-  );
+  ).all() as unknown as {
+    reason: string; key_id: string | null; n: number; tries: number; oldest: string;
+  }[];
+  return rows.map((r) => {
+    const cause = \`\${r.n} \xD7 \${r.reason}\${r.key_id ? \` (key_id \${r.key_id})\` : ''}\`;
+    // TRIED AND AGE, because the count alone does not say whether anything is
+    // being done about it. A partner watching "1 \xD7 decrypt_failed" with no
+    // other figure moving cannot tell a replay that is working from one that
+    // is not; "61 tries" answers that without reading the log.
+    const tried = r.tries > 0 ? \`, \${r.tries} \${r.tries === 1 ? 'try' : 'tries'}\` : '';
+    return \`\${cause}\${tried}, first seen \${describeAge(r.oldest)}\`;
+  });
+}
+
+/** "3m ago", "2h ago". Coarse on purpose: nobody acts on seconds. */
+export function describeAge(iso: string): string {
+  const ms = Date.now() - new Date(iso).getTime();
+  if (!Number.isFinite(ms) || ms < 0) return 'just now';
+  const mins = Math.floor(ms / 60_000);
+  if (mins < 1) return 'moments ago';
+  if (mins < 60) return \`\${mins}m ago\`;
+  const hours = Math.floor(mins / 60);
+  if (hours < 48) return \`\${hours}h ago\`;
+  return \`\${Math.floor(hours / 24)}d ago\`;
 }
 
 export function markReplayed(id: string): void {
@@ -2484,7 +3306,7 @@ export function markReplayed(id: string): void {
 
 /** A replay that failed the same way stays held, with the new reason recorded. */
 export function markReplayFailed(id: string, error: string): void {
-  db.prepare('UPDATE quarantine SET last_error = ? WHERE id = ?')
+  db.prepare('UPDATE quarantine SET last_error = ?, attempts = attempts + 1 WHERE id = ?')
     .run(error.slice(0, 500), id);
 }
 
@@ -2524,6 +3346,48 @@ export function purgeQuarantine(days: number): { replayed: number; unreplayed: n
   return { replayed, unreplayed };
 }
 
+/**
+ * Write the held list to a file, WITHOUT the payloads.
+ *
+ * ## Why the ciphertext is not in here
+ *
+ * The obvious export carries the payload so the fault can be replayed
+ * somewhere else. It also puts a copy of a consumer's encrypted address in a
+ * file that the retention window cannot reach: the quarantine purges its rows,
+ * and nothing purges an export somebody emailed to support and left in a
+ * downloads folder. The whole point of the retention rule is that a held
+ * address does not sit anywhere indefinitely, and an export that leaks past it
+ * quietly undoes that.
+ *
+ * Nothing in here is personal. A dispatch id, what kind of event it was, why it
+ * could not be opened, which key it asked for, and when. That is the whole of
+ * what diagnoses a key problem, and it is safe to paste into a support ticket
+ * or send to us, which is what an export is for.
+ */
+export function exportHeld(directory: string): { path: string; count: number } {
+  const rows = heldDispatches(500);
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+  const path = join(directory, \`oneaddress-faults-\${stamp}.json\`);
+  writeFileSync(path, JSON.stringify({
+    exported_at: new Date().toISOString(),
+    note: 'Metadata only. The held payloads are deliberately not included: they are encrypted consumer addresses and stay under the receiver retention window.',
+    held: rows.map((r) => ({
+      id: r.id,
+      dispatch_id: r.dispatch_id,
+      event: r.event,
+      reason: r.reason,
+      key_id: r.key_id,
+      received_at: r.received_at,
+      age: describeAge(r.received_at),
+      attempts: r.attempts,
+      detail: r.detail,
+      last_error: r.last_error,
+    })),
+  }, null, 2));
+  report.info(\`[quarantine] exported \${rows.length} held dispatch(es) to \${path}\`);
+  return { path, count: rows.length };
+}
+
 /**
  * Re-run every held dispatch through the handler.
  *
@@ -2533,14 +3397,25 @@ export function purgeQuarantine(days: number): { replayed: number; unreplayed: n
  * on the second call.
  */
 export async function replayHeld(
-  apply: (rawBody: string) => Promise<void>,
+  apply: (rawBody: string, dispatchId: string | null) => Promise<void>,
   limit = 50,
 ): Promise<{ applied: number; failed: number }> {
   let applied = 0;
   let failed = 0;
   for (const row of heldDispatches(limit)) {
     try {
-      await apply(row.raw_body);
+      // THE ROW'S OWN DISPATCH ID, not one re-derived from the body.
+      //
+      // \`redeliver\` used to parse \`dispatch_id\` out of the JSON and send that
+      // as the header. A dispatch that arrived WITHOUT the header was keyed on
+      // a hash of its body; the replay then supplied a header from the body,
+      // so the re-arrival was keyed by id instead, landed in a DIFFERENT row,
+      // and one held dispatch became two. Seen on a real receiver: \`1 \xD7
+      // decrypt_failed\` became \`2 \xD7\` on the first press of [r].
+      //
+      // Identity has to come from one place. This row already knows what it
+      // arrived as.
+      await apply(row.raw_body, row.dispatch_id);
       markReplayed(row.id);
       applied += 1;
       report.info(\`[replay] applied \${row.event} \${row.dispatch_id ?? row.id}\`);
@@ -2881,10 +3756,31 @@ import { report } from './report.js';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
+/**
+ * WRITE-THROUGH or INBOX, and both are supported on purpose.
+ *
+ * \`write-through\` is what this receiver has always done: decrypt the dispatch,
+ * apply it through \`CustomerStore\`, confirm to OneAddress. Right for a sole
+ * trader and for anyone happy for the receiver to reach their data directly.
+ *
+ * \`inbox\` is for a company with change control over its customer master. The
+ * receiver verifies the signature, stores the dispatch AS IT ARRIVED, and holds
+ * no private key at all. The partner's own connector draws it, decrypts it,
+ * applies it in their database, and acknowledges; only then does the receiver
+ * confirm to OneAddress. The component reachable from the internet cannot read
+ * what it holds.
+ *
+ * Nothing on the wire differs between them. The protocol already separates
+ * delivery from application: the webhook 200 acknowledges delivery and the
+ * confirm reports application. Write-through simply collapses the two.
+ */
+export type ReceiverMode = 'write-through' | 'inbox';
+
 export type ReceiverConfig = {
   partnerId:                string;
   oneAddressApi:            string;
   verifiesAccountReference: boolean;
+  mode:                     ReceiverMode;
 };
 
 const DEFAULTS: ReceiverConfig = {
@@ -2895,8 +3791,16 @@ const DEFAULTS: ReceiverConfig = {
   // is missing entirely \u2014 in which case answering account.verify is the safer,
   // more useful default than silently returning "not checked".
   verifiesAccountReference: true,
+  // DEFAULTS TO WHAT THE RECEIVER HAS ALWAYS DONE. Inbox mode needs a connector
+  // running and a key living somewhere else; a receiver that silently switched
+  // into it would accept dispatches nothing ever collects.
+  mode: 'write-through',
 };
 
+function parseMode(value: unknown): ReceiverMode | undefined {
+  return value === 'inbox' || value === 'write-through' ? value : undefined;
+}
+
 function stripTrailingSlash(s: string): string {
   return s.endsWith('/') ? s.slice(0, -1) : s;
 }
@@ -2909,6 +3813,8 @@ function loadConfigFile(): Partial<ReceiverConfig> {
     if (typeof parsed.partnerId === 'string')                out.partnerId = parsed.partnerId;
     if (typeof parsed.oneAddressApi === 'string')            out.oneAddressApi = parsed.oneAddressApi;
     if (typeof parsed.verifiesAccountReference === 'boolean') out.verifiesAccountReference = parsed.verifiesAccountReference;
+    const mode = parseMode(parsed.mode);
+    if (mode) out.mode = mode;
     return out;
   } catch {
     // No config file (or unreadable / malformed): fall back to env + defaults.
@@ -2925,10 +3831,16 @@ export const config: ReceiverConfig = {
     process.env.VERIFIES_ACCOUNT_REFERENCE != null
       ? process.env.VERIFIES_ACCOUNT_REFERENCE === 'true'
       : (fromFile.verifiesAccountReference ?? DEFAULTS.verifiesAccountReference),
+  // An UNRECOGNISED value falls back to write-through rather than failing, and
+  // the startup line below says which mode is live either way, so a typo shows
+  // up as "not the mode I asked for" rather than as a receiver that will not
+  // start. Silent is the thing to avoid, not strict.
+  mode: parseMode(process.env.RECEIVER_MODE) ?? fromFile.mode ?? DEFAULTS.mode,
 };
 
 report.info(
-  '[config] loaded (oneAddressApi=' + config.oneAddressApi +
+  '[config] loaded (mode=' + config.mode +
+  ', oneAddressApi=' + config.oneAddressApi +
   ', verifiesAccountReference=' + config.verifiesAccountReference + ')',
 );
 `
@@ -3184,7 +4096,7 @@ export interface CustomerStore {
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { report } from './report.js';
-import db, { accountKey, dec, enc, encrypted, isEncrypted, once } from './db.js';
+import db, { accountKey, dec, enc, encrypted, ensureColumn, isEncrypted, once } from './db.js';
 import type {
   AccountVerdict,
   Address,
@@ -3234,13 +4146,6 @@ db.exec(\`
 // Add any missing columns here so the handler upgrades its own schema instead of
 // forcing you to delete the database on every change \u2014 the behaviour a
 // production integration needs.
-function ensureColumn(table: string, column: string, definition: string): void {
-  const cols = db.prepare(\`PRAGMA table_info(\${table})\`).all() as Array<{ name: string }>;
-  if (!cols.some((c) => c.name === column)) {
-    db.exec(\`ALTER TABLE \${table} ADD COLUMN \${column} \${definition}\`);
-    report.info(\`[store] migrated: added column \${table}.\${column}\`);
-  }
-}
 ensureColumn('customers', 'address', "TEXT NOT NULL DEFAULT '{}'");
 ensureColumn('customers', 'updated_at', 'TEXT'); // nullable on migrate; set on write
 ensureColumn('customers', 'account_key', 'TEXT');
@@ -3631,11 +4536,12 @@ import {
 // THE ONLY LINE THAT NAMES AN IMPLEMENTATION. Point this at your own module
 // exporting a \`CustomerStore\` (see src/customer-store.ts) and nothing else in
 // the protocol layer changes.
-import { store } from './store.js';
+import { store as writeThroughStore } from './store.js';
+import { connectorStore, setCurrentRawBody } from './connector-store.js';
 import { notePreviousAddress } from './tui.js';
 import { config } from './config.js';
 import { safeOneAddressCallbackUrl } from './callback-url.js';
-import { describeKeys, keyFailureAdvice, resolvePrivateKey } from './keys.js';
+import { configuredKeyIds, describeKeys, keyFailureAdvice, resolvePrivateKey } from './keys.js';
 import {
   drainConfirms,
   enqueueConfirm,
@@ -3644,12 +4550,27 @@ import {
   type ConfirmStatus,
 } from './confirm-queue.js';
 import {
+  dispatchKey,
   heldCount,
   purgeQuarantine,
   quarantine,
   replayHeld,
   type QuarantineReason,
 } from './quarantine.js';
+import { recordOutcome, tally } from './tally.js';
+import { accept as acceptIntoInbox, oldestUndrawn, undrawnCount } from './inbox.js';
+import { setAcknowledgementHandler, startDrawApi } from './draw-api.js';
+
+/**
+ * WHICH STORE ANSWERS, chosen once at startup.
+ *
+ * Inbox mode does not branch the handler. It swaps the implementation of the
+ * contract in \`customer-store.ts\`, so every call site below is identical in
+ * both modes and the mode lives in exactly one place. \`connectorStore\` asks the
+ * partner's connector and refuses to write; \`writeThroughStore\` is the bundled
+ * SQLite one this receiver has always used.
+ */
+const store = config.mode === 'inbox' ? connectorStore : writeThroughStore;
 
 const WEBHOOK_SECRET      = process.env.WEBHOOK_SECRET          ?? '';
 const PARTNER_PRIVATE_KEY = process.env.PARTNER_PRIVATE_KEY_PEM ?? '';
@@ -3669,11 +4590,38 @@ const PORT                = Number(process.env.PORT ?? 3001);
 const ONEADDRESS_API = config.oneAddressApi;
 const CONFIRM_SECRET = process.env.CONFIRM_SECRET || WEBHOOK_SECRET;
 
-if (!WEBHOOK_SECRET || !PARTNER_PRIVATE_KEY || !PARTNER_ID) {
+if (!WEBHOOK_SECRET || !PARTNER_ID) {
   report.error('[startup] Missing required env vars. Check your .env file.');
   process.exit(1);
 }
 
+// THE KEY REQUIREMENT INVERTS WITH THE MODE, and this is the assertion that
+// makes inbox mode mean something.
+//
+// Write-through cannot open a single dispatch without a private key, so a
+// missing one is fatal and always was. Inbox mode's entire property is that the
+// component reachable from the internet CANNOT read what it holds, and a key
+// sitting in this process's environment makes that false \u2014 silently, while
+// every test still passes and every dispatch still lands. Nothing would ever
+// surface it, because in inbox mode nothing here attempts a decrypt to fail.
+//
+// So it refuses to start and names the fix. A partner moving from write-through
+// to inbox has one edit to make, and being told about it once beats believing a
+// property they do not have.
+if (config.mode === 'inbox') {
+  const strayKeys = configuredKeyIds();
+  if (PARTNER_PRIVATE_KEY || strayKeys.length > 0) {
+    report.error('[startup] mode is \`inbox\`, but this receiver has a private key in its environment.');
+    report.error('[startup] Inbox mode exists so the internet-facing process CANNOT read what it stores.');
+    report.error('[startup] Move PARTNER_PRIVATE_KEY_PEM' + (strayKeys.length > 0 ? ' (and the per-key-id variables)' : '') + ' to the connector\\'s .env and remove it here.');
+    process.exit(1);
+  }
+} else if (!PARTNER_PRIVATE_KEY) {
+  report.error('[startup] PARTNER_PRIVATE_KEY_PEM is missing. Check your .env file.');
+  report.error('[startup] (A receiver that should hold no key at all wants RECEIVER_MODE=inbox.)');
+  process.exit(1);
+}
+
 // Startup self-check. Two faults were historically INVISIBLE until a live
 // dispatch, and both read afterwards as "partner key mismatch" deep inside a
 // try/catch, which is a day of reading webhook logs. Assert them here so the
@@ -3703,7 +4651,15 @@ if (PARTNER_PRIVATE_KEY.includes('BEGIN')) {
 // variable is set when it is not, and the second commonest is still holding one
 // key after a rotation. Both are visible in this one line, and neither is
 // visible anywhere else until a dispatch fails.
-report.info(\`[startup] keys: \${describeKeys()}\`);
+// In inbox mode "no key" is the CORRECT state, and \`describeKeys\` would report
+// it as "every dispatch will fail to decrypt", which is true of a write-through
+// receiver and alarming nonsense here. An operator who reads a red line every
+// boot stops reading the line.
+report.info(
+  config.mode === 'inbox'
+    ? '[startup] keys: none, by design \u2014 the connector holds them and this process cannot read a dispatch'
+    : \`[startup] keys: \${describeKeys()}\`,
+);
 // WHICH STORE IS LIVE, said out loud at every boot. A receiver pointed at a
 // partner's own database and one still writing to the bundled demo file behave
 // identically until the first dispatch, and the difference is where a customer's
@@ -3880,6 +4836,21 @@ app.post('/webhook', async (req: Request, res: Response) => {
 
   const event = body.event as string;
 
+  // PARKED FOR THE CONNECTOR STORE, and read in the same tick it is set.
+  // In inbox mode the receiver holds no private key, so the only thing it can
+  // hand the connector for a verify is the ciphertext that arrived. The
+  // CustomerStore contract passes a decoded customer, which this process cannot
+  // produce, so the bytes travel out of band rather than widening the contract
+  // for one implementation. See connector-store.ts for why this is safe and
+  // what would make it unsafe.
+  //
+  // ABOVE EVERY HANDLER THAT READS IT, and that position is the fix rather than
+  // a tidy-up: this sat below \`account.verify\`, which returns long before it, so
+  // in inbox mode the connector was handed the PREVIOUS request's ciphertext, or
+  // an empty string on the first request of the process's life. It would have
+  // answered honestly about the wrong consumer.
+  setCurrentRawBody(rawBody);
+
   // \u2500\u2500 account.verify: pre-payment account check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   // Carries an encrypted CUSTOMER block { name, known_names, account_number } \u2014
   // no address, no session envelope \u2014 so it is handled HERE, above the address-
@@ -3894,6 +4865,20 @@ app.post('/webhook', async (req: Request, res: Response) => {
       return res.status(200).json({ ok: true, skipped: true });
     }
 
+    // \u2500\u2500 INBOX MODE: the receiver cannot open this, and must not try \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    //
+    // The decrypt below is the reason this branch exists. In inbox mode there
+    // is no private key in this process, so \`decryptAddress\` would fail and
+    // answer 422 \u2014 and the consumer, who is mid-payment, would be told the
+    // account check failed when nothing is wrong. The connector holds the key
+    // and the customer records, so it answers. \`connectorStore\` sends the raw
+    // body; the arguments below are the contract's shape, not its source.
+    if (config.mode === 'inbox') {
+      const status = await store.verifyAccount(null, '', []);
+      report.info(\`[webhook] account.verify \u2192 \${status} (answered by the connector)\`);
+      return res.status(200).json({ status });
+    }
+
     const enc = body.customer_encrypted as {
       ephemeralPublicKey: string; iv: string; ciphertext: string; hkdfSalt?: string;
     } | undefined;
@@ -3936,8 +4921,113 @@ app.post('/webhook', async (req: Request, res: Response) => {
    * stops the quarantine being a way for anyone who can reach this port to fill
    * a partner's disk.
    */
-  const hold = (reason: QuarantineReason, keyId: string | null, detail: string): void =>
+  /**
+   * What this dispatch IS, for anything that has to recognise it again.
+   *
+   * The same value the quarantine keys on, so a re-delivery - a OneAddress
+   * retry of a 422, a press of [r], the same body posted twice - lands on the
+   * record that is already there instead of looking like a new arrival.
+   */
+  const key = dispatchKey(dispatch || null, rawBody);
+
+  const hold = (reason: QuarantineReason, keyId: string | null, detail: string): void => {
     quarantine({ dispatchId: dispatch || null, event, reason, keyId, rawBody, detail });
+    recordOutcome(key, 'failed');
+  };
+
+  /**
+   * Post an \`address.verify\` verdict back to OneAddress.
+   *
+   * ONE IMPLEMENTATION, TWO CALLERS, and the second one is why it is a function.
+   * Write-through decrypts the envelope and asks its own store; inbox mode
+   * cannot decrypt anything and asks the connector. Everything from the verdict
+   * onward is identical, including the callback-host check, and a second copy of
+   * that check is a second place for it to be dropped.
+   *
+   * Returns a Response when it REFUSED to post and has already answered the
+   * caller, and null when the verdict went out. Deliberately does NOT remember
+   * the dispatch: the two callers differ on that, and burying the difference in
+   * here is how one of them would get it silently wrong.
+   */
+  const postVerifyVerdict = async (result: string): Promise<Response | null> => {
+    const callbackUrl   = body.callback_url   as string;
+    const callbackToken = body.callback_token as string;
+    const batchId       = body.batch_id       as string;
+
+    // Callback URL is signed inside the body, so HMAC verify already proves it
+    // came from OneAddress. We still validate the host as defence in depth:
+    // if the webhook secret ever leaks, an attacker who can forge a webhook
+    // could otherwise coerce this server into POSTing to any internal
+    // URL (database admin, cloud metadata service, \u2026) \u2014 turning the partner's
+    // network position into an SSRF primitive.
+    const safeCallbackUrl = safeOneAddressCallbackUrl(callbackUrl);
+    if (!safeCallbackUrl) {
+      report.warn(\`[webhook] refusing callback to non-OneAddress host: \${callbackUrl}\`);
+      return res.status(400).json({ error: 'Invalid callback_url host' });
+    }
+
+    await fetch(safeCallbackUrl, {
+      method:  'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        // 2026.2 \u2014 no member_name echo; OneAddress keys the result on
+        // (batch_id, partner_id) and validates the opaque token alone.
+        batch_id:    batchId,
+        partner_id:  PARTNER_ID,
+        result,
+        token:       callbackToken,
+      }),
+    });
+    return null;
+  };
+
+  // \u2500\u2500 INBOX MODE: hold it, do not open it \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  //
+  // An \`address.updated\` is stored exactly as it arrived and the connector is
+  // left to collect it. The 200 below is honest and is not a claim that anything
+  // was applied: the protocol already separates the two, and the CONFIRM is what
+  // reports application. It fires when the connector says so, which may be
+  // hours later, and \`user_services.state\` has carried \`awaiting_confirm\` for
+  // that gap since long before this mode existed.
+  //
+  // The verify events deliberately fall through to the code below, because they
+  // must be answered NOW, before a consumer pays. In inbox mode that answer
+  // comes from the connector.
+  // \u2500\u2500 INBOX MODE, the other half: a verify the receiver cannot open \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  //
+  // \`address.verify\` has to be answered now, like \`account.verify\` above, but it
+  // is answered by POSTing a callback rather than in the response body. The
+  // callback URL and token travel in the CLEARTEXT body, not the envelope, so
+  // this process can still post it; only the VERDICT needs a key, and that comes
+  // from the connector.
+  if (config.mode === 'inbox' && event === 'address.verify') {
+    // The contract's arguments, not its source: \`connectorStore\` sends the raw
+    // body it was parked with and ignores these.
+    const result = await store.verifyAddress({ email: null, name: '' }, {});
+    report.info(\`[webhook] address.verify \u2192 \${result} (answered by the connector)\`);
+    const refused = await postVerifyVerdict(result);
+    if (refused) return refused;
+    // DELIBERATELY NOT \`rememberDispatch\`, for the same reason as the inbox
+    // \`address.updated\` branch below: nothing was decrypted here, so there is
+    // no state a retry would duplicate. OneAddress keys a verify result on
+    // (batch_id, partner_id), so re-answering a retried check is a no-op \u2014 and
+    // NOT remembering is the safer half of the trade, because a check we failed
+    // to answer still gets answered on the retry instead of being dismissed.
+    return res.status(200).json({ ok: true });
+  }
+
+  if (config.mode === 'inbox' && event === 'address.updated') {
+    acceptIntoInbox({ key, dispatchId: dispatch || null, event, rawBody });
+    report.info(\`[inbox] held \${dispatch || key} for the connector\`);
+    // DELIBERATELY NOT \`rememberDispatch\`. A guard in templates.test.ts asserts
+    // that nothing is remembered before the decrypt is attempted, because a
+    // dispatch marked seen too early makes OneAddress's retry look like a
+    // duplicate and loses the update. Adding an exception here for a branch
+    // that happens not to decrypt would weaken the guard for the branch that
+    // does. It is not needed anyway: \`accept\` is INSERT OR IGNORE on the same
+    // dispatch identity, so a redelivery is already harmless.
+    return res.status(200).json({ ok: true, queued: true });
+  }
 
   const DISPATCH_EVENTS = ['address.updated', 'address.verify', 'address.test', 'address.test-dispatch'];
   if (!DISPATCH_EVENTS.includes(event)) {
@@ -4016,6 +5106,9 @@ app.post('/webhook', async (req: Request, res: Response) => {
       return res.status(422).json({ ok: false, error: 'Decryption failed \u2014 partner key mismatch' });
     }
   } else {
+    // No \`hold\` here: there is no payload to hold, so there is nothing a fix
+    // could later apply. It still counts as a dispatch that did not land.
+    recordOutcome(key, 'failed');
     return res.status(422).json({ ok: false, error: 'No encrypted payload on dispatch' });
   }
 
@@ -4030,11 +5123,23 @@ app.post('/webhook', async (req: Request, res: Response) => {
   const loaEncrypted = body.loa_encrypted as
     { session_envelope: string; session_key_share: SessionKeyShare } | null | undefined;
   if (loaEncrypted && typeof loaEncrypted === 'object') {
-    try {
-      const loa: OneAddressD5LOA = await decryptLoaEncrypted(loaEncrypted, PARTNER_PRIVATE_KEY, PARTNER_ID);
-      loaRef = d5LoaRef(loa);
-    } catch (err) {
-      report.error('[webhook] LOA decryption failed:', err instanceof Error ? err.message : err);
+    // RESOLVED BY THE LOA'S OWN key_id, not by the single PARTNER_PRIVATE_KEY_PEM.
+    // It is wrapped to the same key id as the address envelope, but it carries
+    // its own share, so that is what is read. Using the single key meant that
+    // after a rotation with PARTNER_KEYS_STRICT=1 the address opened and the LOA
+    // silently did not, losing the proof-of-consent on exactly the changes a
+    // partner most wants it for, with nothing anyone would see.
+    const loaKeyId = loaEncrypted.session_key_share?.key_id ?? null;
+    const loaKey   = resolvePrivateKey(loaKeyId);
+    if (!loaKey) {
+      report.warn(\`[webhook] no key for the LOA's key_id \${loaKeyId ?? '(none)'} \u2014 applying without a consent reference\`);
+    } else {
+      try {
+        const loa: OneAddressD5LOA = await decryptLoaEncrypted(loaEncrypted, loaKey.pem, PARTNER_ID);
+        loaRef = d5LoaRef(loa);
+      } catch (err) {
+        report.error('[webhook] LOA decryption failed:', err instanceof Error ? err.message : err);
+      }
     }
   }
 
@@ -4084,6 +5189,9 @@ app.post('/webhook', async (req: Request, res: Response) => {
       if (verdict !== 'match') {
         report.warn(\`[webhook] address.updated REFUSED (\${verdict}) for account \${ctx.accountNumber ?? '(none)'} \u2014 nothing applied\`);
         queueConfirm(dispatch, 'failed');
+        // A refusal is not a fault and is never held, but it IS a dispatch that
+        // did not land, so it counts. See quarantine.ts for why the two differ.
+        recordOutcome(key, 'failed');
         return res.status(200).json({ ok: false, error: 'account_not_matched', verdict });
       }
     }
@@ -4100,43 +5208,17 @@ app.post('/webhook', async (req: Request, res: Response) => {
     // acks the delivery, and it survives a restart. The drain loop does the
     // network part and retries it until OneAddress answers.
     queueConfirm(dispatch, 'confirmed');
+    recordOutcome(key, 'applied');
     return res.status(200).json({ ok: true });
   }
 
   // \u2500\u2500 address.verify: consumer is running an address check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   if (event === 'address.verify') {
-    const callbackUrl   = body.callback_url   as string;
-    const callbackToken = body.callback_token as string;
-    const batchId       = body.batch_id       as string;
-
-    // Callback URL is signed inside the body, so HMAC verify already proves it
-    // came from OneAddress. We still validate the host as defence in depth:
-    // if the webhook secret ever leaks, an attacker who can forge a webhook
-    // could otherwise coerce this server into POSTing to any internal
-    // URL (database admin, cloud metadata service, \u2026) \u2014 turning the partner's
-    // network position into an SSRF primitive.
-    const safeCallbackUrl = safeOneAddressCallbackUrl(callbackUrl);
-    if (!safeCallbackUrl) {
-      report.warn(\`[webhook] refusing callback to non-OneAddress host: \${callbackUrl}\`);
-      return res.status(400).json({ error: 'Invalid callback_url host' });
-    }
-
     report.info(\`[webhook] address.verify for \${ctx.accountNumber || ctx.name}\`);
     const result = await store.verifyAddress(ctx, address);
     report.info(\`[webhook] address.verify \u2192 \${result}\`);
-
-    await fetch(safeCallbackUrl, {
-      method:  'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        // 2026.2 \u2014 no member_name echo; OneAddress keys the result on
-        // (batch_id, partner_id) and validates the opaque token alone.
-        batch_id:    batchId,
-        partner_id:  PARTNER_ID,
-        result,
-        token:       callbackToken,
-      }),
-    });
+    const refused = await postVerifyVerdict(result);
+    if (refused) return refused;
     if (dispatch) rememberDispatch(dispatch); // remember only after the callback posted
     return res.status(200).json({ ok: true });
   }
@@ -4236,13 +5318,12 @@ setInterval(() => {
  * anyone has fixed anything. We hold the secret, so re-signing is not a bypass:
  * it is the same proof, re-stated now.
  */
-async function redeliver(rawBody: string): Promise<void> {
+async function redeliver(rawBody: string, heldDispatchId: string | null): Promise<void> {
   const ts  = String(Math.floor(Date.now() / 1000));
   const sig = createHmac('sha256', WEBHOOK_SECRET).update(\`\${ts}.\${rawBody}\`).digest('hex');
-  let dispatchId = '';
-  try {
-    dispatchId = String((JSON.parse(rawBody) as { dispatch_id?: unknown }).dispatch_id ?? '');
-  } catch { /* the handler will reject it as bad JSON, which is the right answer */ }
+  // THE ID THE DISPATCH ARRIVED WITH, handed over by the row being replayed.
+  // Re-deriving it from the body is what made one held dispatch become two.
+  const dispatchId = (heldDispatchId ?? '').trim();
 
   const res = await fetch(\`http://127.0.0.1:\${PORT}/webhook\`, {
     method: 'POST',
@@ -4277,6 +5358,29 @@ export async function replayQuarantined(): Promise<{ applied: number; failed: nu
  * moment they are least inclined to. The delay lets \`listen\` settle, since this
  * goes back in through the port.
  */
+// \u2500\u2500 The connector channel, in inbox mode only \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+//
+// Wired here rather than in draw-api.ts because this file owns the confirm
+// queue: an acknowledgement from the connector is the moment OneAddress gets
+// told, and that has to go through the same durable queue every other confirm
+// uses so a failure to reach OneAddress is retried rather than lost.
+if (config.mode === 'inbox') {
+  setAcknowledgementHandler((dispatchId, outcome) => {
+    queueConfirm(dispatchId, outcome === 'applied' ? 'confirmed' : 'failed');
+    recordOutcome(\`d:\${dispatchId}\`, outcome === 'applied' ? 'applied' : 'failed');
+  });
+  const started = startDrawApi();
+  if (!started) {
+    // AN INBOX WITH NO WAY TO DRAIN IT IS WORSE THAN NOT STARTING. In
+    // write-through mode a missing connector token is irrelevant and the
+    // receiver runs; here it means every dispatch would be accepted and held
+    // with nothing able to collect it, and the consumer would be told nothing
+    // for as long as that lasted.
+    report.error('[startup] mode is \`inbox\` but the connector channel could not open. Refusing to start.');
+    process.exit(1);
+  }
+}
+
 setTimeout(() => {
   if (heldCount() === 0) return;
   void replayQuarantined().catch((err: unknown) =>
@@ -4291,8 +5395,34 @@ setTimeout(() => {
 const QUARANTINE_KEEP_DAYS = Number(process.env.QUARANTINE_KEEP_DAYS ?? 30);
 setInterval(() => { purgeQuarantine(QUARANTINE_KEEP_DAYS); }, 3_600_000).unref();
 
-/** How many confirms are still owed. Read by the dashboard. */
-export { pendingConfirmCount };
+/** How many confirms are still owed, and how the dispatches went. Read by the dashboard. */
+export { pendingConfirmCount, tally };
+
+/**
+ * Everything the dashboard footer needs, in one call.
+ *
+ * One hook rather than three, because three would be three chances for the
+ * footer to show figures from different moments.
+ */
+export function dashboardStats(): {
+  received: number;
+  applied: number;
+  failed: number;
+  mode: string;
+  awaitingConnector: number;
+  oldestUndrawn: string | null;
+} {
+  const t = tally();
+  const inbox = config.mode === 'inbox'
+    ? { count: undrawnCount(), oldest: oldestUndrawn() }
+    : { count: 0, oldest: null };
+  return {
+    ...t,
+    mode: config.mode,
+    awaitingConnector: inbox.count,
+    oldestUndrawn: inbox.oldest,
+  };
+}
 
 // Read by src/index.ts to label the dashboard. Exported rather than re-derived
 // there, so the port the UI claims is the port the server actually bound.
@@ -9523,7 +10653,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto = require("crypto");
-var PKG_VERSION = true ? "2.1.3" : "dev";
+var PKG_VERSION = true ? "2.2.0" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");