@oneaddress/setup 2.1.3 → 2.3.0

package/dist/index.js

@@ -828,7 +828,7 @@ var Y2 = ({ indicator: t = "dots" } = {}) => {
 };
 
 // src/prompts.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var import_node_net = require("net");
 var import_node_fs3 = require("fs");
 var import_node_os2 = require("os");
@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "2.1.3" : "?";
+var WIZARD_VERSION = true ? "2.3.0" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -909,6 +909,7 @@ function stripAnsi(s) {
 
 // src/scaffold.ts
 var import_promises = require("fs/promises");
+var import_node_crypto = require("crypto");
 var import_node_fs = require("fs");
 var import_node_path = require("path");
 
@@ -1006,10 +1007,11 @@ data.db-shm
     {
       name: "oneaddress.config.json",
       content: `{
-  "//": "Written by npx @oneaddress/setup, read by src/config.ts. Non-secret config only \u2014 secrets live in .env. Any field can be overridden by an env var of the matching name (PARTNER_ID / ONEADDRESS_API / VERIFIES_ACCOUNT_REFERENCE).",
+  "//": "Written by npx @oneaddress/setup, read by src/config.ts. Non-secret config only \u2014 secrets live in .env. Any field can be overridden by an env var of the matching name (PARTNER_ID / ONEADDRESS_API / VERIFIES_ACCOUNT_REFERENCE / RECEIVER_MODE).",
   "partnerId": "%%PARTNER_ID%%",
   "oneAddressApi": "%%ONEADDRESS_API%%",
-  "verifiesAccountReference": %%VERIFIES_ACCOUNT_REFERENCE%%
+  "verifiesAccountReference": %%VERIFIES_ACCOUNT_REFERENCE%%,
+  "mode": "%%RECEIVER_MODE%%"
 }
 `
     },
@@ -1087,6 +1089,7 @@ data.db-shm
  */
 import { DatabaseSync } from 'node:sqlite';
 import { join } from 'node:path';
+import { report } from './report.js';
 import {
   accountIndex,
   buildVerifier,
@@ -1229,6 +1232,50 @@ export { PassphraseRequiredError, WrongPassphraseError };
  * separates them.
  */
 export { isEncrypted };
+
+/**
+ * Read a timestamp out of this database, whichever of the two formats it is in.
+ *
+ * THIS DATABASE HOLDS TWO, AND NOTHING DECLARED WHICH WAS WHICH.
+ *
+ *   a SQL default, \`datetime('now')\`   ->  "2026-09-14 22:39:52"   UTC, no zone
+ *   a JS write, \`toISOString()\`        ->  "2026-09-14T22:39:52.695Z"
+ *
+ * Both appear in the SAME table: \`quarantine.received_at\` is the first and
+ * \`quarantine.replayed_at\` is the second.
+ *
+ * The first is not valid ISO-8601, so \`new Date(...)\` falls to implementation
+ * -defined parsing and V8 reads it as LOCAL time. A row written a minute ago
+ * therefore reads as an hour old for every hour the machine is from UTC. It
+ * reported \`8h ago\` for a two-minute-old row on a partner's machine in Perth,
+ * which is exactly UTC+8 and is how it was found.
+ *
+ * TOLERANT RATHER THAN MIGRATING, deliberately: a receiver that has been
+ * running has rows in the old shape and rewriting somebody's database to fix a
+ * display bug is the wrong trade. This is the same shape as the transition
+ * -tolerant blind-index reads elsewhere in this project.
+ */
+export function parseStoredTime(value: string): Date {
+  // Zone-less \`YYYY-MM-DD HH:MM:SS\` is SQLite's, and SQLite's \`now\` is UTC.
+  const sqlite = /^(\\d{4}-\\d{2}-\\d{2}) (\\d{2}:\\d{2}:\\d{2})$/.exec(value.trim());
+  return new Date(sqlite ? \`\${sqlite[1]}T\${sqlite[2]}Z\` : value);
+}
+
+/**
+ * Add a column to an existing table if it is not already there.
+ *
+ * SQLite has no \`ADD COLUMN IF NOT EXISTS\`, and a receiver that has been
+ * running since before a column existed still has to start. Lives here rather
+ * than in one of the two files that needs it, because the second copy is how
+ * the two drift.
+ */
+export function ensureColumn(table: string, column: string, definition: string): void {
+  const cols = db.prepare(\`PRAGMA table_info(\${table})\`).all() as Array<{ name: string }>;
+  if (cols.some((c) => c.name === column)) return;
+  db.exec(\`ALTER TABLE \${table} ADD COLUMN \${column} \${definition}\`);
+  report.info(\`[db] migrated: added column \${table}.\${column}\`);
+}
+
 export default db;
 `
     },
@@ -1663,9 +1710,8 @@ import { formatLine, report, type ReportLine } from './report.js';
 // One import, same as server.ts. Swapping the store swaps what the dashboard
 // reads, with nothing here to change.
 import { store } from './store.js';
-import type { StoredCustomer } from './customer-store.js';
 import { pendingConfirmCount } from './confirm-queue.js';
-import { heldCount, heldSummary } from './quarantine.js';
+import { exportHeld, heldCount, heldSummary } from './quarantine.js';
 
 /** blessed takes colours as strings; these mirror the site's palette. */
 const AMBER = HEX.amber.toLowerCase();
@@ -1684,19 +1730,50 @@ export interface TuiOptions {
    * Re-apply everything the receiver could not open, bound to [r].
    *
    * Passed IN rather than imported: \`server.ts\` already imports this file for
-   * \`notePreviousAddress\`, so importing it back would be a cycle. Optional so
+   * \`noteChange\`, so importing it back would be a cycle. Optional so
    * the dashboard still renders for a caller that has no replay to offer.
    */
   onReplay?: () => Promise<{ applied: number; failed: number }>;
+  /**
+   * How the dispatches went, asked of the receiver rather than counted here.
+   *
+   * Same reason as \`onReplay\`: \`server.ts\` already imports this file, so this
+   * file cannot import it back. Optional, and a caller that omits it gets
+   * zeroes, which is honest for a dashboard driving nothing.
+   */
+  stats?: () => {
+    received: number;
+    applied: number;
+    failed: number;
+    mode: string;
+    awaitingConnector: number;
+    oldestUndrawn: string | null;
+  };
 }
 
-/** One address as a single line, the way the change panel shows it. */
-function oneLine(a: Record<string, unknown>): string {
-  const parts = [a.street, a.suburb, a.state, a.postcode].filter(Boolean).map(String);
-  return parts.length > 0 ? parts.join(', ') : '(empty)';
+/**
+ * What the server reports about a dispatch it applied.
+ *
+ * DELIBERATELY CARRIES NO ADDRESS AND NO NAME. This is the whole interface
+ * between the protocol layer and the screen, so anything absent from this type
+ * is something the dashboard cannot render however it is rewritten later. The
+ * address-formatting helper that used to live here went with it: a function
+ * that turns an address into a display string, sitting in the UI module, is an
+ * invitation.
+ */
+export interface ChangeFacts {
+  /** The partner's own identifier for their own record. Never the consumer's name. */
+  accountNumber: string;
+  /** Did the account-reference guard run and pass? False means you do not verify them. */
+  accountChecked: boolean;
+  /** Did the record actually move, or was it already current? */
+  changed: boolean;
+  /** Proof of consent, for your audit trail. */
+  loaRef: string | null;
+  dispatchId: string | null;
 }
 
-export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptions): void {
+export function startDashboard({ partnerName, port, onQuit, onReplay, stats }: TuiOptions): void {
   const screen = blessed.screen({
     smartCSR: true,
     title: \`\${partnerName} \u2014 OneAddress receiver\`,
@@ -1758,7 +1835,9 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
   // is the other case: a permanent empty box teaches the eye to skip that
   // region, which is precisely the region that has to be noticed the one day it
   // fills. So it appears, and the two panels above give up the rows.
-  const FAULT_HEIGHT = 7;
+  // Six, not seven. Every row this takes comes off the two panels above it, and
+  // the one above left cannot afford to lose any: see renderChange.
+  const FAULT_HEIGHT = 6;
   const faultBox = blessed.box({
     parent: screen, bottom: 3, left: 0, width: '100%', height: FAULT_HEIGHT,
     label: ' FAULTS ', tags: true, padding: { left: 1, right: 1 }, hidden: true,
@@ -1774,24 +1853,28 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
   });
 
   // \u2500\u2500 State \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  let received = 0;
-  let applied = 0;
-  let failed = 0;
-  let lastChange: { customer: StoredCustomer; previous: Record<string, unknown> } | null = null;
-  let pendingPrevious: Record<string, unknown> = {};
+  let lastChange: ChangeFacts | null = null;
 
-  // The server hands over the address a dispatch REPLACED. Kept as state here
-  // rather than pushed through \`report\`, because the previous address is data
-  // rather than narration and must never end up in a log line.
-  setPrevious = (prev) => { pendingPrevious = prev; };
+  // The server hands over FACTS about a dispatch, never the address. See
+  // \`ChangeFacts\` and the note at the call site in server.ts: this module is
+  // the screen, and a screen is the one place a consumer's home address is
+  // most likely to be photographed.
+  setChange = (facts) => { lastChange = facts; redraw(); };
 
   function renderStatus(): void {
     // Both states are shown, and the unprotected one is the loud colour. A
     // security property mentioned only when it holds is one nobody notices the
     // absence of.
-    const vault = store.encrypted
-      ? \`{green-fg}{bold}ENCRYPTED{/}\`
-      : \`{red-fg}{bold}UNENCRYPTED{/}\`;
+    const inbox = statsMode() === 'inbox';
+    // IN INBOX MODE THERE IS NO CUSTOMER FILE HERE AT ALL, so neither ENCRYPTED
+    // nor UNENCRYPTED is true and both would mislead. The receiver holds
+    // ciphertext it cannot open; the customers live in the partner's own
+    // database, behind their own controls.
+    const vault = inbox
+      ? \`{\${AMBER}-fg}{bold}NONE (inbox){/}\`
+      : store.encrypted
+        ? \`{green-fg}{bold}ENCRYPTED{/}\`
+        : \`{red-fg}{bold}UNENCRYPTED{/}\`;
     status.setContent(
       \`{\${AMBER}-fg}{bold}\${esc(partnerName)}{/}   \` +
       \`{\${DIM}-fg}listening{/} {\${CREAM}-fg}:\${port}/webhook{/}   \` +
@@ -1808,19 +1891,36 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
     if (!lastChange) {
       changeBox.setContent(
         \`\\n  {\${DIM}-fg}Waiting for a dispatch.{/}\\n\\n\` +
-        \`  {\${DIM}-fg}When one arrives, the address it replaced{/}\\n\` +
-        \`  {\${DIM}-fg}and the address that replaced it appear here.{/}\`,
+        \`  {\${DIM}-fg}When one arrives, what happened to it appears here.{/}\\n\` +
+        \`  {\${DIM}-fg}The address itself never does \u2014 see below.{/}\`,
       );
       return;
     }
-    const { customer, previous } = lastChange;
-    let now: Record<string, unknown> = {};
-    try { now = JSON.parse(customer.address) as Record<string, unknown>; } catch { /* keep empty */ }
+    const f = lastChange;
+    // WHAT HAPPENED, NOT WHAT IT SAYS.
+    //
+    // Every line here is a fact about the dispatch and none of them is content.
+    // An operator watching this can tell that the envelope opened, that the
+    // account was one of theirs, and whether the record actually moved - which
+    // is everything the panel was ever for. To read the address itself, look in
+    // your own database, which is where it lives and which is a deliberate act
+    // rather than a screen left open.
+    //
+    // COMPACT ON PURPOSE. The faults band takes rows off this panel when it
+    // appears and blessed clips silently, so a tall panel loses its last line
+    // and reads as a dispatch that half worked. That cost a real end-to-end run
+    // an hour of doubt.
+    const check = f.accountChecked
+      ? \`{green-fg}account matched{/}\`
+      : \`{\${DIM}-fg}account not checked{/}\`;
+    const moved = f.changed
+      ? \`{green-fg}address changed{/}\`
+      : \`{\${AMBER}-fg}already current{/}\`;
     changeBox.setContent(
-      \`\\n  {bold}\${esc(customer.name)}{/bold}\\n\` +
-      \`  {\${DIM}-fg}account{/} {\${AMBER}-fg}\${esc(customer.account_number)}{/}\\n\\n\` +
-      \`  {red-fg}was{/}  \${esc(oneLine(previous))}\\n\\n\` +
-      \`  {green-fg}now{/}  {\${CREAM}-fg}\${esc(oneLine(now))}{/}\\n\`,
+      \`\\n  {\${DIM}-fg}account{/} {\${AMBER}-fg}{bold}\${esc(f.accountNumber)}{/}{/}\\n\\n\` +
+      \`  {green-fg}decrypted{/}  \${check}  \${moved}\\n\\n\` +
+      \`  {\${DIM}-fg}loa_ref{/}   {\${CREAM}-fg}\${esc(f.loaRef ?? '(none)')}{/}\\n\` +
+      \`  {\${DIM}-fg}dispatch{/}  {\${CREAM}-fg}\${esc(f.dispatchId ?? '(none)')}{/}\`,
     );
   }
 
@@ -1835,6 +1935,8 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
    * declines to count returns forever, so the dash below is the honest initial
    * state rather than a placeholder that happens to look the same.
    */
+  const statsMode = (): string => stats?.().mode ?? 'write-through';
+
   let onFile: number | null = null;
   function refreshCount(): void {
     void Promise.resolve(store.count())
@@ -1860,14 +1962,14 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
     // Grouped, never one line per dispatch. The realistic shape of this table
     // is forty rows with ONE cause between them, and forty identical lines hide
     // the single fact that matters.
-    const lines = heldSummary().slice(0, 3).map((l) => \`  {red-fg}\${esc(l)}{/}\`);
+    const lines = heldSummary().slice(0, 2).map((l) => \`  {red-fg}\${esc(l)}{/}\`);
     faultBox.setContent(
-      \`\\n  {bold}\${held}{/bold} dispatch(es) arrived that this receiver could not open.\\n\` +
-      \`  {\${DIM}-fg}They are held, encrypted, exactly as they arrived. Nothing is lost yet.{/}\\n\\n\` +
-      lines.join('\\n') + '\\n\\n' +
+      \`\\n  {bold}\${held}{/bold} dispatch(es) arrived that this receiver could not open. \` +
+      \`{\${DIM}-fg}Held, encrypted, exactly as they arrived.{/}\\n\` +
+      lines.join('\\n') + '\\n' +
       (replayNote
         ? \`  {\${AMBER}-fg}\${esc(replayNote)}{/}\`
-        : \`  {\${DIM}-fg}Fix the cause (usually a key in .env), then press{/} {\${AMBER}-fg}[r]{/} {\${DIM}-fg}to apply them.{/}\`),
+        : \`  {\${DIM}-fg}Fix the cause, then{/} {\${AMBER}-fg}[r]{/} {\${DIM}-fg}to apply,{/} {\${AMBER}-fg}[e]{/} {\${DIM}-fg}to export the list.{/}\`),
     );
   }
 
@@ -1881,12 +1983,27 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
     // with a backlog shows the backlog instead of zero.
     const awaiting = pendingConfirmCount();
     const awaitingColour = awaiting > 0 ? AMBER : DIM;
+    // ASKED, not accumulated. The server counts per dispatch, so a redelivery
+    // updates a record rather than adding one.
+    const s = stats?.() ?? {
+      received: 0, applied: 0, failed: 0,
+      mode: 'write-through', awaitingConnector: 0, oldestUndrawn: null,
+    };
+    const { received, applied, failed } = s;
+    // AWAITING YOUR SYSTEMS, in inbox mode only. Drawn whether or not it is
+    // zero there, and absent entirely in write-through, because a counter for a
+    // thing that cannot happen is noise that teaches the eye to skip the row.
+    const awaitingYou = s.mode === 'inbox'
+      ? \`{\${s.awaitingConnector > 0 ? AMBER : DIM}-fg}awaiting your systems{/} \` +
+        \`{bold}\${s.awaitingConnector}{/bold}   \`
+      : '';
     footer.setContent(
       \`{\${DIM}-fg}received{/} {bold}\${received}{/bold}   \` +
       \`{green-fg}applied{/} {bold}\${applied}{/bold}   \` +
       \`{red-fg}failed{/} {bold}\${failed}{/bold}   \` +
+      awaitingYou +
       \`{\${awaitingColour}-fg}awaiting confirm{/} {bold}\${awaiting}{/bold}\` +
-      \`{|}{\${DIM}-fg}\${onReplay ? '[r] replay  ' : ''}[q] quit{/}  \`,
+      \`{|}{\${DIM}-fg}\${onReplay ? '[r] replay  ' : ''}[e] export  [q] quit{/}  \`,
     );
   }
 
@@ -1899,46 +2016,25 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
   }
 
   // \u2500\u2500 The feed \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  // Counters are derived from the reported lines rather than from a second
-  // channel the server would have to remember to update. One source, so the
-  // footer cannot disagree with the log beside it.
+  // NARRATION ONLY. It used to derive the footer's counters from these lines
+  // too, on the reasoning that one source cannot disagree with itself. That
+  // held until replay shipped: a replay produces exactly the lines an arrival
+  // does, so pressing [r] against a key that could never work drove \`received\`
+  // from 5 to 67 while nothing arrived. A log line says what happened and not
+  // what it happened TO, so two lines about one dispatch are indistinguishable
+  // from two dispatches. The counters key on the dispatch now; see
+  // \`src/tally.ts\`.
   const detach = report.attach((line: ReportLine) => {
     const text = formatLine(line);
     const colour = line.level === 'error' ? 'red' : line.level === 'warn' ? 'yellow' : CREAM;
     const time = new Date(line.at).toTimeString().slice(0, 8);
 
-    // COUNTED ON THE OUTCOME LINE, WHICHEVER IT IS.
-    //
-    // \`received\` used to increment only on \`address.updated for <account>\`,
-    // which is logged AFTER decryption because the account number comes out of
-    // the decrypted envelope. A dispatch that failed to decrypt returned 422
-    // before that line ran, so it was never counted as having arrived: a
-    // partner with a wrong key saw \`received 0 \xB7 failed 12\` and went looking at
-    // their tunnel and their webhook URL. Everything was arriving. The error
-    // line said "check your key" and the counter, louder, said "nothing here".
-    //
-    // Every dispatch produces exactly one of these, so counting either as an
-    // arrival makes received = applied + failed hold.
-    const failure = /REFUSED|decryption failed|Decryption failed|no private key for/.test(text);
-    if (/address\\.updated for /.test(text) || failure) received++;
-    if (failure) failed++;
-    if (/\\[store\\] saved address for /.test(text)) {
-      applied++;
-      // The store logs the account key and never the address, so the panel is
-      // refreshed from the DATABASE rather than parsed out of the log line.
-      const acct = /saved address for (\\S+)/.exec(text)?.[1];
-      // An indexed lookup of the one customer, not a decrypt of the whole
-      // roster to find them. Invisible at three rows and absurd at four
-      // million, which is the scale a real store is pointed at.
-      const prev = pendingPrevious;
-      if (acct) {
-        void Promise.resolve(store.find(acct)).then((customer) => {
-          if (!customer) return;
-          lastChange = { customer, previous: prev };
-          redraw();
-        });
-      }
-    }
+    // NOTHING IS PARSED OUT OF A LOG LINE HERE ANY MORE, and nothing is looked
+    // up from the store. The panel used to scrape the account out of \`[store]
+    // saved address for ...\` and then fetch that customer's record to render
+    // it, which is how a customer's name and address reached the screen. The
+    // server calls \`noteChange\` with facts instead, so this module has no path
+    // to a customer record at all.
 
     logBox.log(\`{\${DIM}-fg}\${time}{/} {\${colour}-fg}\${esc(text)}{/}\`);
     redraw();
@@ -1965,6 +2061,24 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
       .finally(() => { replaying = false; redraw(); });
   });
 
+  // [e] EXPORTS THE FAULT LIST. Metadata only, no payloads: see exportHeld.
+  // Bound unconditionally for the same reason [r] is, so pressing it on a clean
+  // receiver says there is nothing to export rather than appearing to hang.
+  screen.key(['e'], () => {
+    if (heldCount() === 0) {
+      replayNote = 'Nothing held, so nothing to export.';
+      redraw();
+      return;
+    }
+    try {
+      const { path, count } = exportHeld(process.cwd());
+      replayNote = \`Exported \${count} to \${path}\`;
+    } catch (err) {
+      replayNote = \`Export failed: \${err instanceof Error ? err.message : String(err)}\`;
+    }
+    redraw();
+  });
+
   screen.key(['q', 'C-c'], () => {
     detach();
     screen.destroy();
@@ -1991,10 +2105,10 @@ export function startDashboard({ partnerName, port, onQuit, onReplay }: TuiOptio
  * reason \`report\` has a default sink: \`--headless\` must not need a second code
  * path through the handler.
  */
-let setPrevious: (prev: Record<string, unknown>) => void = () => {};
+let setChange: (facts: ChangeFacts) => void = () => {};
 
-export function notePreviousAddress(prev: Record<string, unknown>): void {
-  setPrevious(prev);
+export function noteChange(facts: ChangeFacts): void {
+  setChange(facts);
 }
 `
     },
@@ -2238,6 +2352,14 @@ async function main(): Promise<void> {
     partnerName: string;
     port: number;
     replay: () => Promise<{ applied: number; failed: number }>;
+    stats: () => {
+      received: number;
+      applied: number;
+      failed: number;
+      mode: string;
+      awaitingConnector: number;
+      oldestUndrawn: string | null;
+    };
   };
   try {
     const server = await import('./server.js');
@@ -2249,6 +2371,7 @@ async function main(): Promise<void> {
       // second edge the other way is a cycle. This file is the one place that
       // holds both.
       replay:      server.replayQuarantined,
+      stats:       server.dashboardStats,
     };
   } catch (err) {
     if (err instanceof PassphraseRequiredError) {
@@ -2278,6 +2401,7 @@ async function main(): Promise<void> {
     partnerName: config.partnerName,
     port: config.port,
     onReplay: config.replay,
+    stats: config.stats,
     onQuit: () => { /* the process exits; the OS closes the socket */ },
   });
 }
@@ -2286,6 +2410,708 @@ main().catch((err) => {
   console.error('[startup]', err instanceof Error ? err.message : err);
   process.exit(1);
 });
+`
+    },
+    {
+      name: "src/connector-store.ts",
+      content: `/**
+ * A \`CustomerStore\` whose answers come from the connector.
+ *
+ * ## Why the mode swaps the STORE rather than branching the handler
+ *
+ * The obvious way to build inbox mode is an \`if (mode === 'inbox')\` beside each
+ * verify event in \`server.ts\`. That works and it puts the mode into the middle
+ * of the protocol layer, where it has to be got right twice and stay right
+ * every time either handler changes.
+ *
+ * The contract in \`customer-store.ts\` already says exactly what the receiver
+ * needs from a partner: verify an account, verify an address, apply a change.
+ * In inbox mode the answers come from a different place. That is an
+ * IMPLEMENTATION of the contract, not a special case in the caller, so the
+ * handler is untouched and there is one place the mode lives.
+ *
+ * ## Three methods answer, two deliberately refuse
+ *
+ * \`verifyAccount\` and \`verifyAddress\` ask the connector and wait, because a
+ * consumer is mid-payment on the other end of the first one.
+ *
+ * \`saveAddress\` THROWS. In inbox mode an \`address.updated\` never reaches the
+ * store at all: it is held for the connector to draw, and the connector applies
+ * it against the partner's own database. If this is ever called, the mode
+ * switch has been bypassed and the right answer is a loud failure rather than a
+ * quiet write into a store that should not exist.
+ *
+ * \`find\` and \`count\` return nothing, honestly, because this receiver holds no
+ * customer records in this mode. The dashboard draws a dash rather than a zero,
+ * which is the difference between "not asked" and "none".
+ */
+import { report } from './report.js';
+import { askConnector } from './connector-client.js';
+import type {
+  AccountVerdict,
+  Address,
+  Customer,
+  CustomerStore,
+  StoredCustomer,
+  VerifyResult,
+} from './customer-store.js';
+
+/**
+ * The raw body of the request currently being handled.
+ *
+ * SET BY THE HANDLER, read here. The contract passes a decoded \`Customer\`,
+ * which is exactly what this store does not have and cannot produce: the
+ * receiver holds no private key in this mode, so the only thing it can send the
+ * connector is the ciphertext that arrived. Rather than widen the contract for
+ * one implementation, the handler parks the bytes here for the length of the
+ * request.
+ *
+ * Safe because Node runs one request's synchronous path at a time and this is
+ * read immediately, in the same tick the handler sets it. It would NOT be safe
+ * if anything awaited between the set and the read, which is why they are
+ * adjacent and why this comment exists.
+ */
+let currentRawBody = '';
+
+export function setCurrentRawBody(raw: string): void {
+  currentRawBody = raw;
+}
+
+function verdictOf(body: Record<string, unknown> | undefined, key: string): string | null {
+  const value = body?.[key];
+  return typeof value === 'string' ? value : null;
+}
+
+export const connectorStore = {
+  name: 'connector',
+  // The receiver holds no customer records in this mode, so "is the customer
+  // file encrypted" has no true answer. False is the honest one: there is no
+  // protected customer store here, because there is no customer store here.
+  encrypted: false,
+
+  async verifyAccount(
+    accountNumber: string | null,
+    _name: string,
+    _knownNames: string[] = [],
+  ): Promise<AccountVerdict> {
+    const answer = await askConnector('account.verify', currentRawBody);
+    if (!answer.reached) {
+      // NEVER GUESSED. A fabricated match authorises a stranger's address onto
+      // a customer's account. \`no_account\` is the safe answer and stops the
+      // consumer before they pay, which is the trade this design accepted.
+      report.warn(
+        \`[connector] account check for \${accountNumber ?? '(none)'} could not be answered; \` +
+        'refusing rather than guessing',
+      );
+      return 'no_account';
+    }
+    const status = verdictOf(answer.body, 'status');
+    if (status === 'match' || status === 'no_match' || status === 'no_account') return status;
+    report.warn(\`[connector] account.verify answered "\${status ?? '(nothing)'}", which is not a verdict\`);
+    return 'no_account';
+  },
+
+  async verifyAddress(_customer: Customer, _incoming: Address): Promise<VerifyResult> {
+    const answer = await askConnector('address.verify', currentRawBody);
+    if (!answer.reached) return 'not_found';
+    const result = verdictOf(answer.body, 'result');
+    if (result === 'match' || result === 'mismatch' || result === 'not_found') return result;
+    report.warn(\`[connector] address.verify answered "\${result ?? '(nothing)'}", which is not a result\`);
+    return 'not_found';
+  },
+
+  saveAddress(_customer: Customer, _incoming: Address): Promise<Address> {
+    // Unreachable by design: see the header. Loud rather than quiet.
+    return Promise.reject(new Error(
+      'saveAddress was called in inbox mode. Updates are held for the connector to draw and ' +
+      'apply against your own database; nothing should write through this receiver.',
+    ));
+  },
+
+  find(_accountNumber: string): StoredCustomer | null { return null; },
+  count(): null { return null; },
+} satisfies CustomerStore;
+`
+    },
+    {
+      name: "src/connector-client.ts",
+      content: `/**
+ * Asking the connector a question that cannot wait.
+ *
+ * ## Why this direction exists at all
+ *
+ * Everything else between the receiver and the connector is a PULL: the
+ * connector draws work when it is ready. That is the right shape, because the
+ * partner's system should control its own pace.
+ *
+ * The two verify events cannot work that way. \`account.verify\` runs BEFORE the
+ * consumer pays and has to answer in the same request with match, no match, or
+ * no account; \`address.verify\` is the same shape. Both need a decrypt and a
+ * customer lookup, and in inbox mode both of those live in the connector. So
+ * for these, and only these, the receiver calls out and waits.
+ *
+ * ## A CORRECTION TO THE DESIGN DOCUMENT, recorded where it matters
+ *
+ * \`docs/architecture/receiver-connector-design.md\` says the connector "accepts
+ * no inbound connections". That is not achievable alongside a synchronous
+ * verify, and the verify decision is the one that was taken deliberately. So
+ * the connector DOES listen, on loopback only, and the honest form of the
+ * property is: no inbound port reachable from any NETWORK. The difference
+ * matters the day a partner puts the two on separate hosts, which is what the
+ * transport configuration below exists for.
+ *
+ * ## What happens when the connector is down
+ *
+ * The receiver tells OneAddress honestly that it could not check, and the
+ * consumer is stopped BEFORE they pay rather than after. That is the cost of
+ * choosing this over a verify-only key in the receiver: such a key would keep
+ * answers flowing during an outage and would make "the receiver cannot read
+ * addresses" untrue, which is the whole point of the split.
+ *
+ * It is NEVER answered with a guess. A fabricated match authorises a stranger's
+ * address onto a customer's account; a fabricated no-match costs a support
+ * call. Neither is ours to invent.
+ */
+import { report } from './report.js';
+
+/**
+ * Where the connector listens.
+ *
+ * 3003, NOT 3002. Two loopback listeners exist in this design and swapping them
+ * is silent: the receiver's own draw channel is on 3002, so a receiver pointed
+ * at 3002 for verify asks ITSELF the question and gets a 404 that reads exactly
+ * like a connector that is down.
+ */
+const CONNECTOR_URL = process.env.CONNECTOR_URL ?? 'http://127.0.0.1:3003';
+const TOKEN = process.env.CONNECTOR_TOKEN ?? '';
+/**
+ * Short, because a consumer is watching a spinner on the other end of this.
+ * A verify that takes eight seconds has already failed as far as they are
+ * concerned, and an honest "could not check" beats a long hang.
+ */
+const TIMEOUT_MS = Number(process.env.CONNECTOR_TIMEOUT_MS ?? 5000);
+
+export type VerifyKind = 'account.verify' | 'address.verify';
+
+export interface ConnectorVerdict {
+  reached: boolean;
+  /** Whatever the connector answered. Passed through untouched. */
+  body?: Record<string, unknown>;
+  error?: string;
+}
+
+/**
+ * Hand the connector an encrypted verify event and wait for its answer.
+ *
+ * The RAW BODY goes over, not anything decoded: the receiver holds no private
+ * key in this mode and has nothing to decode it with. The connector decrypts,
+ * looks the customer up in the partner's database, and answers.
+ */
+export async function askConnector(kind: VerifyKind, rawBody: string): Promise<ConnectorVerdict> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const res = await fetch(\`\${CONNECTOR_URL}/verify\`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': \`Bearer \${TOKEN}\`,
+        'X-OneAddress-Verify-Kind': kind,
+      },
+      body: rawBody,
+      signal: controller.signal,
+    });
+    const text = await res.text().catch(() => '');
+    if (!res.ok) {
+      report.error(\`[connector] \${kind} refused: HTTP \${res.status} \${text.slice(0, 200)}\`);
+      return { reached: false, error: \`HTTP \${res.status}\` };
+    }
+    try {
+      return { reached: true, body: JSON.parse(text) as Record<string, unknown> };
+    } catch {
+      report.error(\`[connector] \${kind} answered with something that is not JSON\`);
+      return { reached: false, error: 'bad response' };
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    // NAMES THE REMEDY. This is the failure a partner will actually see, and
+    // "fetch failed" on its own sends them looking at OneAddress.
+    report.error(
+      \`[connector] could not reach the connector for \${kind} (\${message}). \` +
+      \`Account checks will fail until it is back. Is it running, and is CONNECTOR_URL (\${CONNECTOR_URL}) right?\`,
+    );
+    return { reached: false, error: message };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+`
+    },
+    {
+      name: "src/draw-api.ts",
+      content: `/**
+ * The channel your connector draws from.
+ *
+ * ## The most dangerous surface in this receiver
+ *
+ * Everything else here handles ciphertext. This hands out dispatches a
+ * connector will decrypt, and takes its word for what was applied. An exposed
+ * or unauthenticated version of it is precisely the oracle the whole
+ * architecture exists to prevent, so three things are not configurable:
+ *
+ *   1. **It binds to 127.0.0.1 and nothing else.** There is deliberately no
+ *      option to bind it to an interface. A partner who needs the connector on
+ *      another host needs a transport with mutual authentication, not this one
+ *      with a wider bind, and giving them a knob that looks like it does the
+ *      job is how that ends up on a LAN.
+ *   2. **It runs on a SEPARATE PORT from the webhook.** Same process, different
+ *      listener, so nothing routed from the internet can reach these paths even
+ *      by mistake in a reverse proxy.
+ *   3. **It needs its own credential.** \`CONNECTOR_TOKEN\`, not the webhook
+ *      secret and not the confirm secret. Those are shared with OneAddress; a
+ *      leak of either must not also hand somebody your customers' addresses.
+ *      Compared in constant time, and the API refuses to start without it.
+ *
+ * ## What it does NOT decrypt
+ *
+ * Nothing. It hands over \`raw_body\`, the bytes as they arrived. The private key
+ * lives in the connector, which is the only component that can read any of it.
+ */
+import express, { type Request, type Response } from 'express';
+import rateLimit from 'express-rate-limit';
+import { timingSafeEqual } from 'node:crypto';
+import { report } from './report.js';
+import { acknowledge, drawable, markDrawn, type InboxOutcome } from './inbox.js';
+
+const TOKEN = process.env.CONNECTOR_TOKEN ?? '';
+/**
+ * The RECEIVER's loopback listener, which is not the connector's.
+ *
+ * Named \`DRAW_PORT\` rather than \`CONNECTOR_PORT\` because the connector has a
+ * listener of its own, on \`CONNECTOR_PORT\` (3003), for the verify questions
+ * that cannot wait for a draw. One name for two ports on one host is a
+ * misconfiguration nobody would find: each end would bind or dial the other's.
+ */
+const DRAW_PORT = Number(process.env.DRAW_PORT ?? 3002);
+/**
+ * How long a drawn item stays claimed before it is offered again.
+ *
+ * Crash recovery for ONE connector, not concurrency for two. See \`inbox.ts\`.
+ * Generous, because the cost of re-offering too early is a duplicate apply and
+ * the cost of re-offering too late is a delay nobody dies of.
+ */
+const LEASE_SECONDS = Number(process.env.CONNECTOR_LEASE_SECONDS ?? 300);
+
+/** Constant time, and length-safe: \`timingSafeEqual\` throws on a length mismatch. */
+function tokenMatches(presented: string): boolean {
+  const a = Buffer.from(presented);
+  const b = Buffer.from(TOKEN);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
+function authorised(req: Request, res: Response): boolean {
+  const header = req.headers.authorization ?? '';
+  const presented = header.startsWith('Bearer ') ? header.slice(7) : '';
+  if (presented && tokenMatches(presented)) return true;
+  // No detail, deliberately. This endpoint should tell an unauthorised caller
+  // nothing at all about whether it exists or what it holds.
+  res.status(401).json({ error: 'Unauthorised' });
+  return false;
+}
+
+export function startDrawApi(): { port: number } | null {
+  if (connectorTokenMissing()) return null;
+
+  const app = express();
+  app.disable('x-powered-by');
+
+  // A BACKSTOP, AND NOT WHAT KEEPS THIS SHUT.
+  //
+  // What keeps it shut is the loopback bind and the credential, compared in
+  // constant time. This bounds what an attacker who is already on the box can
+  // spend, and it is deliberately far above any real connector: a draw every
+  // two seconds plus an acknowledgement per item is a few hundred a minute at
+  // worst, so a legitimate connector never meets this and a partner who tunes
+  // \`CONNECTOR_POLL_MS\` down still has room.
+  //
+  // No \`trust proxy\` here, unlike the webhook app. There is no proxy in front
+  // of a loopback listener, so \`X-Forwarded-For\` is somebody trying it on, and
+  // trusting it would let them key the limiter on an address of their choosing.
+  //
+  // Attached ONCE, on the app rather than per route. Two references to the same
+  // limiter instance count a request twice and silently halve the ceiling.
+  app.use(rateLimit({
+    windowMs: 60_000,
+    max: 2000,
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: { error: 'Too many requests' },
+  }));
+
+  app.use(express.json({ limit: '2mb' }));
+
+  /**
+   * Take the next batch of work.
+   *
+   * A GET with no side effects would be tidier and would be wrong: drawing has
+   * to stamp the lease, or a connector that asks twice gets the same items and
+   * applies them twice.
+   */
+  app.post('/draw', (req: Request, res: Response) => {
+    if (!authorised(req, res)) return;
+    const limit = Math.min(Number((req.body as { limit?: unknown }).limit ?? 20) || 20, 100);
+    const items = drawable(limit, LEASE_SECONDS);
+    markDrawn(items.map((i) => i.id));
+    if (items.length > 0) report.info(\`[draw] connector took \${items.length} dispatch(es)\`);
+    return res.json({ items });
+  });
+
+  /**
+   * What the connector did with one item.
+   *
+   * \`applied\` queues the confirm to OneAddress. \`failed\` queues a failed
+   * confirm, which is the honest answer when the partner's own system refused
+   * the change: the consumer is told it did not land rather than being told it
+   * did.
+   */
+  app.post('/ack', (req: Request, res: Response) => {
+    if (!authorised(req, res)) return;
+    const body = req.body as { id?: unknown; outcome?: unknown; detail?: unknown };
+    const id = typeof body.id === 'string' ? body.id : '';
+    const outcome: InboxOutcome | null =
+      body.outcome === 'applied' || body.outcome === 'failed' ? body.outcome : null;
+    if (!id || !outcome) {
+      return res.status(400).json({ error: 'id and outcome (applied|failed) are required' });
+    }
+    const detail = typeof body.detail === 'string' ? body.detail : null;
+
+    const result = acknowledge(id, outcome, detail);
+    if (!result) return res.status(404).json({ error: 'unknown id' });
+    if (result.alreadyAcknowledged) {
+      // NOT AN ERROR. A connector that is unsure its acknowledgement landed
+      // should retry, and punishing that is how an update ends up applied and
+      // never confirmed.
+      return res.json({ ok: true, duplicate: true });
+    }
+
+    if (result.dispatchId) onAcknowledged(result.dispatchId, outcome);
+    return res.json({ ok: true });
+  });
+
+  /** Enough for the connector to know it is talking to the right receiver. */
+  app.get('/connector/health', (req: Request, res: Response) => {
+    if (!authorised(req, res)) return;
+    return res.json({ status: 'ok', mode: 'inbox' });
+  });
+
+  app.listen(DRAW_PORT, '127.0.0.1', () =>
+    report.info(\`[draw] connector channel \u2192 http://127.0.0.1:\${DRAW_PORT} (loopback only)\`),
+  );
+  return { port: DRAW_PORT };
+}
+
+/**
+ * Refuse to open the channel without a credential, and say why.
+ *
+ * Returning null rather than throwing, because a receiver in write-through mode
+ * has no connector and must start perfectly well without one. In inbox mode the
+ * caller turns this into a hard failure, since an inbox with no way to drain it
+ * is worse than a receiver that will not start.
+ */
+function connectorTokenMissing(): boolean {
+  if (TOKEN.trim().length >= 16) return false;
+  report.error(
+    '[draw] CONNECTOR_TOKEN is missing or shorter than 16 characters, so the connector ' +
+    'channel was NOT opened. This is its own credential on purpose: it must not be your ' +
+    'webhook secret or your confirm secret, because those are shared with OneAddress and a ' +
+    'leak of either must not also hand somebody your customers\\' addresses.',
+  );
+  return true;
+}
+
+/**
+ * Told when an item is acknowledged, so the receiver can confirm to OneAddress.
+ *
+ * A setter rather than an import, because \`server.ts\` owns the confirm queue
+ * and already imports this module: importing it back would be a cycle.
+ */
+let onAcknowledged: (dispatchId: string, outcome: InboxOutcome) => void = () => {};
+
+export function setAcknowledgementHandler(
+  handler: (dispatchId: string, outcome: InboxOutcome) => void,
+): void {
+  onAcknowledged = handler;
+}
+`
+    },
+    {
+      name: "src/inbox.ts",
+      content: `/**
+ * Dispatches waiting for YOUR system to collect them.
+ *
+ * ## What this is, and why it is not the quarantine
+ *
+ * Both tables hold a signature-verified dispatch as the ciphertext that
+ * arrived. They mean opposite things.
+ *
+ * A QUARANTINED dispatch is one the receiver could not open: something is
+ * wrong, usually a key, and it is purged on a window because holding a
+ * consumer's encrypted address forever is a retention decision nobody made.
+ *
+ * An INBOX dispatch is one nothing is wrong with. It arrived intact and is
+ * waiting for the partner's own systems to draw it, apply it in their database
+ * and say so. **It is NEVER aged out**, and that asymmetry is deliberate: an
+ * undrawn update is a consumer whose address has not landed, and deleting it on
+ * a timer loses it silently. The dashboard reports a growing undrawn count as a
+ * fault instead, which is the honest way to make an operator deal with it.
+ *
+ * ## Nothing here is readable
+ *
+ * The rows hold the bytes as they arrived. In inbox mode the receiver holds no
+ * private key at all, so it could not decrypt these if it wanted to. That is
+ * the property the whole split exists for: the component reachable from the
+ * internet cannot read what it stores.
+ *
+ * ## The lease, and what it is NOT for
+ *
+ * A connector that draws a batch and then crashes must not strand it. So a draw
+ * stamps \`drawn_at\`, and an item becomes drawable again once that stamp is
+ * older than the lease. That is CRASH RECOVERY for one connector.
+ *
+ * It is not a design for two connectors drawing at once. Two would each get
+ * their own view of what is drawable between leases, and nothing here stops
+ * them applying the same update twice. If a second connector is ever wanted,
+ * the claim has to become atomic, the way \`confirm-queue.ts\` already does it.
+ * Written down because a lease LOOKS like it handles concurrency and does not.
+ */
+import db from './db.js';
+import { report } from './report.js';
+
+export type InboxOutcome = 'applied' | 'failed';
+
+db.exec(\`
+  CREATE TABLE IF NOT EXISTS inbox (
+    id          TEXT PRIMARY KEY,
+    dispatch_id TEXT,
+    event       TEXT NOT NULL,
+    raw_body    TEXT NOT NULL,
+    received_at TEXT NOT NULL DEFAULT (datetime('now')),
+    drawn_at    TEXT,
+    applied_at  TEXT,
+    outcome     TEXT,
+    detail      TEXT
+  );
+  CREATE INDEX IF NOT EXISTS idx_inbox_open
+    ON inbox(applied_at, drawn_at, received_at);
+\`);
+
+export interface AcceptInput {
+  key: string;
+  dispatchId: string | null;
+  event: string;
+  rawBody: string;
+}
+
+/**
+ * Take a dispatch for the connector to collect.
+ *
+ * \`INSERT OR IGNORE\`, keyed on the same dispatch identity everything else here
+ * uses, so a OneAddress retry of a delivery we already hold does not queue the
+ * same update twice.
+ */
+export function accept(input: AcceptInput): void {
+  db.prepare(
+    \`INSERT OR IGNORE INTO inbox (id, dispatch_id, event, raw_body)
+     VALUES (?, ?, ?, ?)\`,
+  ).run(input.key, input.dispatchId, input.event, input.rawBody);
+}
+
+export interface InboxItem {
+  id: string;
+  dispatch_id: string | null;
+  event: string;
+  raw_body: string;
+  received_at: string;
+}
+
+/**
+ * What the connector may take now.
+ *
+ * Anything never drawn, plus anything drawn longer ago than the lease and still
+ * unacknowledged, which is the crashed-connector case.
+ */
+export function drawable(limit: number, leaseSeconds: number): InboxItem[] {
+  const cutoff = new Date(Date.now() - leaseSeconds * 1000).toISOString();
+  return db.prepare(
+    \`SELECT id, dispatch_id, event, raw_body, received_at
+       FROM inbox
+      WHERE applied_at IS NULL
+        AND (drawn_at IS NULL OR drawn_at < ?)
+      ORDER BY received_at
+      LIMIT ?\`,
+  ).all(cutoff, limit) as unknown as InboxItem[];
+}
+
+export function markDrawn(ids: string[]): void {
+  if (ids.length === 0) return;
+  const stamp = new Date().toISOString();
+  const stmt = db.prepare('UPDATE inbox SET drawn_at = ? WHERE id = ?');
+  for (const id of ids) stmt.run(stamp, id);
+}
+
+/**
+ * The connector's verdict on one item.
+ *
+ * Returns the dispatch id to confirm, or null when there is nothing to tell
+ * OneAddress: an unknown id, or one already acknowledged. Deliberately not an
+ * error, because a connector retrying an acknowledgement it is unsure landed is
+ * doing the right thing and must not be punished for it.
+ */
+export function acknowledge(
+  id: string,
+  outcome: InboxOutcome,
+  detail: string | null,
+): { dispatchId: string | null; alreadyAcknowledged: boolean } | null {
+  const row = db.prepare(
+    'SELECT dispatch_id, applied_at FROM inbox WHERE id = ?',
+  ).get(id) as { dispatch_id: string | null; applied_at: string | null } | undefined;
+  if (!row) return null;
+  if (row.applied_at !== null) {
+    return { dispatchId: row.dispatch_id, alreadyAcknowledged: true };
+  }
+  db.prepare(
+    'UPDATE inbox SET applied_at = ?, outcome = ?, detail = ? WHERE id = ?',
+  ).run(new Date().toISOString(), outcome, detail?.slice(0, 500) ?? null, id);
+  report.info(\`[inbox] \${id} acknowledged by the connector: \${outcome}\`);
+  return { dispatchId: row.dispatch_id, alreadyAcknowledged: false };
+}
+
+/** How many updates are sitting here unapplied. Shown as a fault when non-zero. */
+export function undrawnCount(): number {
+  const row = db.prepare(
+    'SELECT count(*) AS n FROM inbox WHERE applied_at IS NULL',
+  ).get() as { n: number };
+  return row.n;
+}
+
+/** When the oldest unapplied item arrived, for the age on the dashboard. */
+export function oldestUndrawn(): string | null {
+  const row = db.prepare(
+    'SELECT min(received_at) AS oldest FROM inbox WHERE applied_at IS NULL',
+  ).get() as { oldest: string | null };
+  return row.oldest;
+}
+
+/**
+ * NOTHING PURGES THIS TABLE, and the absence is the design.
+ *
+ * \`purgeQuarantine\` and \`purgeDelivered\` both exist one file over. There is no
+ * \`purgeInbox\`, and there should not be: every row here is an address change a
+ * consumer paid for that has not reached the partner's system yet. Ageing one
+ * out would delete the only copy anybody still has.
+ *
+ * Rows that HAVE been applied are kept too, because they are the partner's own
+ * record of what they were sent and when they acted on it. If that ever needs
+ * bounding, bound the APPLIED rows and never the open ones.
+ */
+export function appliedCount(): number {
+  const row = db.prepare(
+    'SELECT count(*) AS n FROM inbox WHERE applied_at IS NOT NULL',
+  ).get() as { n: number };
+  return row.n;
+}
+`
+    },
+    {
+      name: "src/tally.ts",
+      content: `/**
+ * How many dispatches arrived, landed, and did not.
+ *
+ * ## THE BUG THIS REPLACES, WHICH A PARTNER FOUND IN ABOUT A MINUTE
+ *
+ * The dashboard used to derive these by reading its own log feed: a line
+ * matching a failure pattern counted as one arrival and one failure. The
+ * comment beside it asserted the invariant that made that sound: "every
+ * dispatch produces exactly one of these".
+ *
+ * Then replay shipped. A replay produces exactly the same lines an arrival
+ * does, because it IS a delivery, back in through the front door. Somebody
+ * pressed [r] sixty times against a key that was never going to work and
+ * watched \`received\` climb from 5 to 67 and \`failed\` from 1 to 63. Nothing was
+ * arriving. The receiver was counting its own attempts to fix itself.
+ *
+ * The same fault was always there for a cause nobody had to trigger by hand:
+ * OneAddress RETRIES a 422, so a wrong key inflated these counters on its own,
+ * quietly, every few minutes.
+ *
+ * ## Why counting here fixes the class rather than the instance
+ *
+ * Narration is the wrong source. A log line says what happened, not what it
+ * happened TO, so two lines about one dispatch are indistinguishable from two
+ * dispatches. This keys on the DISPATCH, so every re-delivery of it - a
+ * replay, a OneAddress retry, a partner curling the same body twice - lands on
+ * the entry that is already there.
+ *
+ * That also makes a replay that finally WORKS do the right thing on its own:
+ * the entry flips from failed to applied, and the totals move without anything
+ * having to know a replay was involved.
+ *
+ * ## What is counted, stated because the footer does not have room to
+ *
+ * An \`address.updated\` that was stored is \`applied\`. Anything that could not be
+ * opened, or was refused, is \`failed\`. \`received\` is how many distinct
+ * dispatches reached one of those two, so \`received = applied + failed\` holds
+ * by construction rather than by hoping.
+ *
+ * An \`address.verify\` is deliberately none of them: it answers a question and
+ * changes nothing, so counting it as an application would overstate what this
+ * receiver has done. It still shows in the activity log.
+ *
+ * Since boot, like every other figure on that footer. The held count beside
+ * them is not: the quarantine is on disk and survives a restart.
+ */
+
+export type Outcome = 'applied' | 'failed';
+
+/**
+ * Bounded, because this is memory and a busy receiver runs for months.
+ *
+ * At the cap the oldest entry goes, exactly as \`seenDispatches\` does, and the
+ * totals then describe the most recent 5000 dispatches rather than all of them.
+ * That is the honest trade for a footer: an operator reads it to see whether
+ * things are working now, and nobody audits from it.
+ */
+const MAX_TRACKED = 5000;
+const outcomes = new Map<string, Outcome>();
+
+export function recordOutcome(dispatchKey: string, outcome: Outcome): void {
+  if (!outcomes.has(dispatchKey) && outcomes.size >= MAX_TRACKED) {
+    const oldest = outcomes.keys().next().value;
+    if (oldest !== undefined) outcomes.delete(oldest);
+  }
+  // \`set\` on an existing key overwrites in place and keeps its insertion order,
+  // which is what makes a replay that succeeds flip failed to applied rather
+  // than adding a second entry.
+  outcomes.set(dispatchKey, outcome);
+}
+
+export interface Tally {
+  received: number;
+  applied: number;
+  failed: number;
+}
+
+export function tally(): Tally {
+  let applied = 0;
+  for (const outcome of outcomes.values()) if (outcome === 'applied') applied += 1;
+  return { received: outcomes.size, applied, failed: outcomes.size - applied };
+}
+
+/** Test seam. Never called by the receiver. */
+export function resetTally(): void {
+  outcomes.clear();
+}
 `
     },
     {
@@ -2332,9 +3158,11 @@ main().catch((err) => {
  * replay would apply an address for an account they do not recognise. It stays
  * a refusal.
  */
-import db from './db.js';
+import db, { ensureColumn, parseStoredTime } from './db.js';
 import { report } from './report.js';
 import { createHash } from 'node:crypto';
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 
 /**
  * Why a dispatch could not be applied. Shown verbatim on the dashboard.
@@ -2376,11 +3204,22 @@ db.exec(\`
  * the dispatch header where there is one, and on a hash of the body where there
  * is not, so a retry updates the existing row instead of adding to a pile.
  */
-function rowId(dispatchId: string | null, rawBody: string): string {
+export function dispatchKey(dispatchId: string | null, rawBody: string): string {
   if (dispatchId && dispatchId.trim()) return \`d:\${dispatchId.trim()}\`;
   return \`h:\${createHash('sha256').update(rawBody).digest('hex').slice(0, 32)}\`;
 }
 
+/**
+ * Attempts, so the panel can say how hard this has been tried.
+ *
+ * Added after the quarantine shipped, hence the migration: a partner already
+ * running 2.1.3 has the table without it. Somebody pressed [r] sixty times
+ * against a key that could never work, and the only figure that moved was one
+ * the dashboard was computing wrongly. An attempt count on the row would have
+ * said so immediately.
+ */
+ensureColumn('quarantine', 'attempts', 'INTEGER NOT NULL DEFAULT 0');
+
 export interface QuarantineInput {
   dispatchId: string | null;
   event: string;
@@ -2398,7 +3237,7 @@ export interface QuarantineInput {
  * caller must be able to answer OneAddress whatever happens here.
  */
 export function quarantine(input: QuarantineInput): void {
-  const id = rowId(input.dispatchId, input.rawBody);
+  const id = dispatchKey(input.dispatchId, input.rawBody);
   try {
     db.prepare(
       \`INSERT INTO quarantine (id, dispatch_id, event, reason, key_id, raw_body, detail)
@@ -2435,12 +3274,14 @@ export interface HeldDispatch {
   detail: string | null;
   received_at: string;
   last_error: string | null;
+  attempts: number;
 }
 
 /** Everything still held, oldest first. */
 export function heldDispatches(limit = 50): HeldDispatch[] {
   return db.prepare(
-    \`SELECT id, dispatch_id, event, reason, key_id, raw_body, detail, received_at, last_error
+    \`SELECT id, dispatch_id, event, reason, key_id, raw_body, detail,
+            received_at, last_error, attempts
        FROM quarantine
       WHERE replayed_at IS NULL
       ORDER BY received_at
@@ -2465,15 +3306,39 @@ export function heldCount(): number {
  */
 export function heldSummary(): string[] {
   const rows = db.prepare(
-    \`SELECT reason, key_id, count(*) AS n
+    \`SELECT reason, key_id, count(*) AS n,
+            max(attempts) AS tries, min(received_at) AS oldest
        FROM quarantine
       WHERE replayed_at IS NULL
       GROUP BY reason, key_id
       ORDER BY n DESC\`,
-  ).all() as unknown as { reason: string; key_id: string | null; n: number }[];
-  return rows.map((r) =>
-    \`\${r.n} \xD7 \${r.reason}\${r.key_id ? \` (key_id \${r.key_id})\` : ''}\`,
-  );
+  ).all() as unknown as {
+    reason: string; key_id: string | null; n: number; tries: number; oldest: string;
+  }[];
+  return rows.map((r) => {
+    const cause = \`\${r.n} \xD7 \${r.reason}\${r.key_id ? \` (key_id \${r.key_id})\` : ''}\`;
+    // TRIED AND AGE, because the count alone does not say whether anything is
+    // being done about it. A partner watching "1 \xD7 decrypt_failed" with no
+    // other figure moving cannot tell a replay that is working from one that
+    // is not; "61 tries" answers that without reading the log.
+    const tried = r.tries > 0 ? \`, \${r.tries} \${r.tries === 1 ? 'try' : 'tries'}\` : '';
+    return \`\${cause}\${tried}, first seen \${describeAge(r.oldest)}\`;
+  });
+}
+
+/** "3m ago", "2h ago". Coarse on purpose: nobody acts on seconds. */
+export function describeAge(iso: string): string {
+  // \`parseStoredTime\`, not \`new Date\`. See its docstring: this column is written
+  // by a SQL default in SQLite's zone-less UTC format, which V8 parses as local
+  // time, so a fresh row read as hours old by the machine's UTC offset.
+  const ms = Date.now() - parseStoredTime(iso).getTime();
+  if (!Number.isFinite(ms) || ms < 0) return 'just now';
+  const mins = Math.floor(ms / 60_000);
+  if (mins < 1) return 'moments ago';
+  if (mins < 60) return \`\${mins}m ago\`;
+  const hours = Math.floor(mins / 60);
+  if (hours < 48) return \`\${hours}h ago\`;
+  return \`\${Math.floor(hours / 24)}d ago\`;
 }
 
 export function markReplayed(id: string): void {
@@ -2484,7 +3349,7 @@ export function markReplayed(id: string): void {
 
 /** A replay that failed the same way stays held, with the new reason recorded. */
 export function markReplayFailed(id: string, error: string): void {
-  db.prepare('UPDATE quarantine SET last_error = ? WHERE id = ?')
+  db.prepare('UPDATE quarantine SET last_error = ?, attempts = attempts + 1 WHERE id = ?')
     .run(error.slice(0, 500), id);
 }
 
@@ -2502,13 +3367,27 @@ export function markReplayFailed(id: string, error: string): void {
  * is an update the partner never applied and is now no longer able to.
  */
 export function purgeQuarantine(days: number): { replayed: number; unreplayed: number } {
-  const cutoff = new Date(Date.now() - days * 86_400_000).toISOString();
+  // THE COMPARISON HAPPENS INSIDE SQLITE, IN SQLITE'S OWN FORMAT, and that is
+  // the fix rather than a tidy-up.
+  //
+  // It used to build an ISO cutoff in JS and compare it against a column
+  // written by a SQL default. SQLite compares those as STRINGS, and the two
+  // formats differ at the separator: ' ' is 0x20 and 'T' is 0x54. So on the
+  // boundary DAY a row still inside the window sorted BEFORE the cutoff and was
+  // deleted, up to about a day early. The table holds a consumer's encrypted
+  // address under a window we have written down, so "saved by the date prefix
+  // usually differing" is not good enough.
+  //
+  // \`datetime('now', ?)\` keeps both sides in one format and one clock. The
+  // modifier is a bound parameter rather than interpolated, so \`days\` cannot
+  // reach the SQL text.
+  const cutoffExpr = \`-\${Math.max(0, Math.floor(days))} days\`;
   const doomed = db.prepare(
-    'SELECT id, replayed_at FROM quarantine WHERE received_at < ?',
-  ).all(cutoff) as unknown as { id: string; replayed_at: string | null }[];
+    "SELECT id, replayed_at FROM quarantine WHERE received_at < datetime('now', ?)",
+  ).all(cutoffExpr) as unknown as { id: string; replayed_at: string | null }[];
   if (doomed.length === 0) return { replayed: 0, unreplayed: 0 };
 
-  db.prepare('DELETE FROM quarantine WHERE received_at < ?').run(cutoff);
+  db.prepare("DELETE FROM quarantine WHERE received_at < datetime('now', ?)").run(cutoffExpr);
 
   const unreplayed = doomed.filter((d) => d.replayed_at === null).length;
   const replayed = doomed.length - unreplayed;
@@ -2524,6 +3403,48 @@ export function purgeQuarantine(days: number): { replayed: number; unreplayed: n
   return { replayed, unreplayed };
 }
 
+/**
+ * Write the held list to a file, WITHOUT the payloads.
+ *
+ * ## Why the ciphertext is not in here
+ *
+ * The obvious export carries the payload so the fault can be replayed
+ * somewhere else. It also puts a copy of a consumer's encrypted address in a
+ * file that the retention window cannot reach: the quarantine purges its rows,
+ * and nothing purges an export somebody emailed to support and left in a
+ * downloads folder. The whole point of the retention rule is that a held
+ * address does not sit anywhere indefinitely, and an export that leaks past it
+ * quietly undoes that.
+ *
+ * Nothing in here is personal. A dispatch id, what kind of event it was, why it
+ * could not be opened, which key it asked for, and when. That is the whole of
+ * what diagnoses a key problem, and it is safe to paste into a support ticket
+ * or send to us, which is what an export is for.
+ */
+export function exportHeld(directory: string): { path: string; count: number } {
+  const rows = heldDispatches(500);
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+  const path = join(directory, \`oneaddress-faults-\${stamp}.json\`);
+  writeFileSync(path, JSON.stringify({
+    exported_at: new Date().toISOString(),
+    note: 'Metadata only. The held payloads are deliberately not included: they are encrypted consumer addresses and stay under the receiver retention window.',
+    held: rows.map((r) => ({
+      id: r.id,
+      dispatch_id: r.dispatch_id,
+      event: r.event,
+      reason: r.reason,
+      key_id: r.key_id,
+      received_at: r.received_at,
+      age: describeAge(r.received_at),
+      attempts: r.attempts,
+      detail: r.detail,
+      last_error: r.last_error,
+    })),
+  }, null, 2));
+  report.info(\`[quarantine] exported \${rows.length} held dispatch(es) to \${path}\`);
+  return { path, count: rows.length };
+}
+
 /**
  * Re-run every held dispatch through the handler.
  *
@@ -2533,14 +3454,25 @@ export function purgeQuarantine(days: number): { replayed: number; unreplayed: n
  * on the second call.
  */
 export async function replayHeld(
-  apply: (rawBody: string) => Promise<void>,
+  apply: (rawBody: string, dispatchId: string | null) => Promise<void>,
   limit = 50,
 ): Promise<{ applied: number; failed: number }> {
   let applied = 0;
   let failed = 0;
   for (const row of heldDispatches(limit)) {
     try {
-      await apply(row.raw_body);
+      // THE ROW'S OWN DISPATCH ID, not one re-derived from the body.
+      //
+      // \`redeliver\` used to parse \`dispatch_id\` out of the JSON and send that
+      // as the header. A dispatch that arrived WITHOUT the header was keyed on
+      // a hash of its body; the replay then supplied a header from the body,
+      // so the re-arrival was keyed by id instead, landed in a DIFFERENT row,
+      // and one held dispatch became two. Seen on a real receiver: \`1 \xD7
+      // decrypt_failed\` became \`2 \xD7\` on the first press of [r].
+      //
+      // Identity has to come from one place. This row already knows what it
+      // arrived as.
+      await apply(row.raw_body, row.dispatch_id);
       markReplayed(row.id);
       applied += 1;
       report.info(\`[replay] applied \${row.event} \${row.dispatch_id ?? row.id}\`);
@@ -2881,10 +3813,31 @@ import { report } from './report.js';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
+/**
+ * WRITE-THROUGH or INBOX, and both are supported on purpose.
+ *
+ * \`write-through\` is what this receiver has always done: decrypt the dispatch,
+ * apply it through \`CustomerStore\`, confirm to OneAddress. Right for a sole
+ * trader and for anyone happy for the receiver to reach their data directly.
+ *
+ * \`inbox\` is for a company with change control over its customer master. The
+ * receiver verifies the signature, stores the dispatch AS IT ARRIVED, and holds
+ * no private key at all. The partner's own connector draws it, decrypts it,
+ * applies it in their database, and acknowledges; only then does the receiver
+ * confirm to OneAddress. The component reachable from the internet cannot read
+ * what it holds.
+ *
+ * Nothing on the wire differs between them. The protocol already separates
+ * delivery from application: the webhook 200 acknowledges delivery and the
+ * confirm reports application. Write-through simply collapses the two.
+ */
+export type ReceiverMode = 'write-through' | 'inbox';
+
 export type ReceiverConfig = {
   partnerId:                string;
   oneAddressApi:            string;
   verifiesAccountReference: boolean;
+  mode:                     ReceiverMode;
 };
 
 const DEFAULTS: ReceiverConfig = {
@@ -2895,8 +3848,16 @@ const DEFAULTS: ReceiverConfig = {
   // is missing entirely \u2014 in which case answering account.verify is the safer,
   // more useful default than silently returning "not checked".
   verifiesAccountReference: true,
+  // DEFAULTS TO WHAT THE RECEIVER HAS ALWAYS DONE. Inbox mode needs a connector
+  // running and a key living somewhere else; a receiver that silently switched
+  // into it would accept dispatches nothing ever collects.
+  mode: 'write-through',
 };
 
+function parseMode(value: unknown): ReceiverMode | undefined {
+  return value === 'inbox' || value === 'write-through' ? value : undefined;
+}
+
 function stripTrailingSlash(s: string): string {
   return s.endsWith('/') ? s.slice(0, -1) : s;
 }
@@ -2909,6 +3870,8 @@ function loadConfigFile(): Partial<ReceiverConfig> {
     if (typeof parsed.partnerId === 'string')                out.partnerId = parsed.partnerId;
     if (typeof parsed.oneAddressApi === 'string')            out.oneAddressApi = parsed.oneAddressApi;
     if (typeof parsed.verifiesAccountReference === 'boolean') out.verifiesAccountReference = parsed.verifiesAccountReference;
+    const mode = parseMode(parsed.mode);
+    if (mode) out.mode = mode;
     return out;
   } catch {
     // No config file (or unreadable / malformed): fall back to env + defaults.
@@ -2925,10 +3888,16 @@ export const config: ReceiverConfig = {
     process.env.VERIFIES_ACCOUNT_REFERENCE != null
       ? process.env.VERIFIES_ACCOUNT_REFERENCE === 'true'
       : (fromFile.verifiesAccountReference ?? DEFAULTS.verifiesAccountReference),
+  // An UNRECOGNISED value falls back to write-through rather than failing, and
+  // the startup line below says which mode is live either way, so a typo shows
+  // up as "not the mode I asked for" rather than as a receiver that will not
+  // start. Silent is the thing to avoid, not strict.
+  mode: parseMode(process.env.RECEIVER_MODE) ?? fromFile.mode ?? DEFAULTS.mode,
 };
 
 report.info(
-  '[config] loaded (oneAddressApi=' + config.oneAddressApi +
+  '[config] loaded (mode=' + config.mode +
+  ', oneAddressApi=' + config.oneAddressApi +
   ', verifiesAccountReference=' + config.verifiesAccountReference + ')',
 );
 `
@@ -3044,6 +4013,30 @@ export interface StoredCustomer {
   address: string;
 }
 
+/**
+ * Did this dispatch actually change anything?
+ *
+ * THE ONLY QUESTION THE RECEIVER MAY ASK ABOUT AN ADDRESS, and the reason it
+ * exists here rather than inside a store implementation is that the answer is
+ * a single boolean the dashboard can show, where the two addresses are a
+ * customer's home and must not travel any further than the apply.
+ *
+ * Order- and case-insensitive over the WHOLE object, so it keeps working
+ * whatever fields OneAddress adds. \`saveAddress\` returns the address it
+ * replaced; feed that and the incoming one in here, show the boolean, and let
+ * both go.
+ */
+export function sameAddress(a: Address, b: Address): boolean {
+  const canonical = (x: Address): string =>
+    JSON.stringify(
+      Object.entries(x)
+        .filter(([, v]) => typeof v === 'string' && (v as string).trim() !== '')
+        .map(([k, v]) => [k.toLowerCase(), (v as string).trim().toLowerCase().replace(/\\s+/g, ' ')] as [string, string])
+        .sort((p, q) => p[0].localeCompare(q[0])),
+    );
+  return canonical(a) === canonical(b);
+}
+
 export type AccountVerdict = 'match' | 'no_match' | 'no_account';
 export type VerifyResult = 'match' | 'mismatch' | 'not_found';
 
@@ -3184,7 +4177,7 @@ export interface CustomerStore {
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { report } from './report.js';
-import db, { accountKey, dec, enc, encrypted, isEncrypted, once } from './db.js';
+import db, { accountKey, dec, enc, encrypted, ensureColumn, isEncrypted, once } from './db.js';
 import type {
   AccountVerdict,
   Address,
@@ -3234,13 +4227,6 @@ db.exec(\`
 // Add any missing columns here so the handler upgrades its own schema instead of
 // forcing you to delete the database on every change \u2014 the behaviour a
 // production integration needs.
-function ensureColumn(table: string, column: string, definition: string): void {
-  const cols = db.prepare(\`PRAGMA table_info(\${table})\`).all() as Array<{ name: string }>;
-  if (!cols.some((c) => c.name === column)) {
-    db.exec(\`ALTER TABLE \${table} ADD COLUMN \${column} \${definition}\`);
-    report.info(\`[store] migrated: added column \${table}.\${column}\`);
-  }
-}
 ensureColumn('customers', 'address', "TEXT NOT NULL DEFAULT '{}'");
 ensureColumn('customers', 'updated_at', 'TEXT'); // nullable on migrate; set on write
 ensureColumn('customers', 'account_key', 'TEXT');
@@ -3544,7 +4530,12 @@ export async function saveAddress(customer: Customer, incoming: Address): Promis
   // Metadata only \u2014 the address itself is personal information, so the key is
   // logged and the address never is. Centralised log aggregation turns every
   // log line into a place customer addresses can be read.
-  report.info(\`[store] saved address for \${acct}\${customer.loaRef ? \` (loa_ref \${customer.loaRef})\` : ''}\`);
+  // The ACCOUNT REFERENCE, or a marker - never the name \`acct\` may have fallen
+  // back to. The row is legitimately keyed on the name when you do not verify
+  // account references (see the docstring above); logging it is a different
+  // decision, and the wrong one.
+  const loggable = (customer.accountNumber ?? '').trim() || '(name-keyed record)';
+  report.info(\`[store] saved address for \${loggable}\${customer.loaRef ? \` (loa_ref \${customer.loaRef})\` : ''}\`);
 
   return previous;
 }
@@ -3631,11 +4622,13 @@ import {
 // THE ONLY LINE THAT NAMES AN IMPLEMENTATION. Point this at your own module
 // exporting a \`CustomerStore\` (see src/customer-store.ts) and nothing else in
 // the protocol layer changes.
-import { store } from './store.js';
-import { notePreviousAddress } from './tui.js';
+import { store as writeThroughStore } from './store.js';
+import { connectorStore, setCurrentRawBody } from './connector-store.js';
+import { noteChange } from './tui.js';
 import { config } from './config.js';
 import { safeOneAddressCallbackUrl } from './callback-url.js';
-import { describeKeys, keyFailureAdvice, resolvePrivateKey } from './keys.js';
+import { sameAddress } from './customer-store.js';
+import { configuredKeyIds, describeKeys, keyFailureAdvice, resolvePrivateKey } from './keys.js';
 import {
   drainConfirms,
   enqueueConfirm,
@@ -3644,12 +4637,27 @@ import {
   type ConfirmStatus,
 } from './confirm-queue.js';
 import {
+  dispatchKey,
   heldCount,
   purgeQuarantine,
   quarantine,
   replayHeld,
   type QuarantineReason,
 } from './quarantine.js';
+import { recordOutcome, tally } from './tally.js';
+import { accept as acceptIntoInbox, oldestUndrawn, undrawnCount } from './inbox.js';
+import { setAcknowledgementHandler, startDrawApi } from './draw-api.js';
+
+/**
+ * WHICH STORE ANSWERS, chosen once at startup.
+ *
+ * Inbox mode does not branch the handler. It swaps the implementation of the
+ * contract in \`customer-store.ts\`, so every call site below is identical in
+ * both modes and the mode lives in exactly one place. \`connectorStore\` asks the
+ * partner's connector and refuses to write; \`writeThroughStore\` is the bundled
+ * SQLite one this receiver has always used.
+ */
+const store = config.mode === 'inbox' ? connectorStore : writeThroughStore;
 
 const WEBHOOK_SECRET      = process.env.WEBHOOK_SECRET          ?? '';
 const PARTNER_PRIVATE_KEY = process.env.PARTNER_PRIVATE_KEY_PEM ?? '';
@@ -3669,11 +4677,38 @@ const PORT                = Number(process.env.PORT ?? 3001);
 const ONEADDRESS_API = config.oneAddressApi;
 const CONFIRM_SECRET = process.env.CONFIRM_SECRET || WEBHOOK_SECRET;
 
-if (!WEBHOOK_SECRET || !PARTNER_PRIVATE_KEY || !PARTNER_ID) {
+if (!WEBHOOK_SECRET || !PARTNER_ID) {
   report.error('[startup] Missing required env vars. Check your .env file.');
   process.exit(1);
 }
 
+// THE KEY REQUIREMENT INVERTS WITH THE MODE, and this is the assertion that
+// makes inbox mode mean something.
+//
+// Write-through cannot open a single dispatch without a private key, so a
+// missing one is fatal and always was. Inbox mode's entire property is that the
+// component reachable from the internet CANNOT read what it holds, and a key
+// sitting in this process's environment makes that false \u2014 silently, while
+// every test still passes and every dispatch still lands. Nothing would ever
+// surface it, because in inbox mode nothing here attempts a decrypt to fail.
+//
+// So it refuses to start and names the fix. A partner moving from write-through
+// to inbox has one edit to make, and being told about it once beats believing a
+// property they do not have.
+if (config.mode === 'inbox') {
+  const strayKeys = configuredKeyIds();
+  if (PARTNER_PRIVATE_KEY || strayKeys.length > 0) {
+    report.error('[startup] mode is \`inbox\`, but this receiver has a private key in its environment.');
+    report.error('[startup] Inbox mode exists so the internet-facing process CANNOT read what it stores.');
+    report.error('[startup] Move PARTNER_PRIVATE_KEY_PEM' + (strayKeys.length > 0 ? ' (and the per-key-id variables)' : '') + ' to the connector\\'s .env and remove it here.');
+    process.exit(1);
+  }
+} else if (!PARTNER_PRIVATE_KEY) {
+  report.error('[startup] PARTNER_PRIVATE_KEY_PEM is missing. Check your .env file.');
+  report.error('[startup] (A receiver that should hold no key at all wants RECEIVER_MODE=inbox.)');
+  process.exit(1);
+}
+
 // Startup self-check. Two faults were historically INVISIBLE until a live
 // dispatch, and both read afterwards as "partner key mismatch" deep inside a
 // try/catch, which is a day of reading webhook logs. Assert them here so the
@@ -3703,7 +4738,15 @@ if (PARTNER_PRIVATE_KEY.includes('BEGIN')) {
 // variable is set when it is not, and the second commonest is still holding one
 // key after a rotation. Both are visible in this one line, and neither is
 // visible anywhere else until a dispatch fails.
-report.info(\`[startup] keys: \${describeKeys()}\`);
+// In inbox mode "no key" is the CORRECT state, and \`describeKeys\` would report
+// it as "every dispatch will fail to decrypt", which is true of a write-through
+// receiver and alarming nonsense here. An operator who reads a red line every
+// boot stops reading the line.
+report.info(
+  config.mode === 'inbox'
+    ? '[startup] keys: none, by design \u2014 the connector holds them and this process cannot read a dispatch'
+    : \`[startup] keys: \${describeKeys()}\`,
+);
 // WHICH STORE IS LIVE, said out loud at every boot. A receiver pointed at a
 // partner's own database and one still writing to the bundled demo file behave
 // identically until the first dispatch, and the difference is where a customer's
@@ -3880,6 +4923,21 @@ app.post('/webhook', async (req: Request, res: Response) => {
 
   const event = body.event as string;
 
+  // PARKED FOR THE CONNECTOR STORE, and read in the same tick it is set.
+  // In inbox mode the receiver holds no private key, so the only thing it can
+  // hand the connector for a verify is the ciphertext that arrived. The
+  // CustomerStore contract passes a decoded customer, which this process cannot
+  // produce, so the bytes travel out of band rather than widening the contract
+  // for one implementation. See connector-store.ts for why this is safe and
+  // what would make it unsafe.
+  //
+  // ABOVE EVERY HANDLER THAT READS IT, and that position is the fix rather than
+  // a tidy-up: this sat below \`account.verify\`, which returns long before it, so
+  // in inbox mode the connector was handed the PREVIOUS request's ciphertext, or
+  // an empty string on the first request of the process's life. It would have
+  // answered honestly about the wrong consumer.
+  setCurrentRawBody(rawBody);
+
   // \u2500\u2500 account.verify: pre-payment account check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   // Carries an encrypted CUSTOMER block { name, known_names, account_number } \u2014
   // no address, no session envelope \u2014 so it is handled HERE, above the address-
@@ -3894,6 +4952,20 @@ app.post('/webhook', async (req: Request, res: Response) => {
       return res.status(200).json({ ok: true, skipped: true });
     }
 
+    // \u2500\u2500 INBOX MODE: the receiver cannot open this, and must not try \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    //
+    // The decrypt below is the reason this branch exists. In inbox mode there
+    // is no private key in this process, so \`decryptAddress\` would fail and
+    // answer 422 \u2014 and the consumer, who is mid-payment, would be told the
+    // account check failed when nothing is wrong. The connector holds the key
+    // and the customer records, so it answers. \`connectorStore\` sends the raw
+    // body; the arguments below are the contract's shape, not its source.
+    if (config.mode === 'inbox') {
+      const status = await store.verifyAccount(null, '', []);
+      report.info(\`[webhook] account.verify \u2192 \${status} (answered by the connector)\`);
+      return res.status(200).json({ status });
+    }
+
     const enc = body.customer_encrypted as {
       ephemeralPublicKey: string; iv: string; ciphertext: string; hkdfSalt?: string;
     } | undefined;
@@ -3936,8 +5008,113 @@ app.post('/webhook', async (req: Request, res: Response) => {
    * stops the quarantine being a way for anyone who can reach this port to fill
    * a partner's disk.
    */
-  const hold = (reason: QuarantineReason, keyId: string | null, detail: string): void =>
+  /**
+   * What this dispatch IS, for anything that has to recognise it again.
+   *
+   * The same value the quarantine keys on, so a re-delivery - a OneAddress
+   * retry of a 422, a press of [r], the same body posted twice - lands on the
+   * record that is already there instead of looking like a new arrival.
+   */
+  const key = dispatchKey(dispatch || null, rawBody);
+
+  const hold = (reason: QuarantineReason, keyId: string | null, detail: string): void => {
     quarantine({ dispatchId: dispatch || null, event, reason, keyId, rawBody, detail });
+    recordOutcome(key, 'failed');
+  };
+
+  /**
+   * Post an \`address.verify\` verdict back to OneAddress.
+   *
+   * ONE IMPLEMENTATION, TWO CALLERS, and the second one is why it is a function.
+   * Write-through decrypts the envelope and asks its own store; inbox mode
+   * cannot decrypt anything and asks the connector. Everything from the verdict
+   * onward is identical, including the callback-host check, and a second copy of
+   * that check is a second place for it to be dropped.
+   *
+   * Returns a Response when it REFUSED to post and has already answered the
+   * caller, and null when the verdict went out. Deliberately does NOT remember
+   * the dispatch: the two callers differ on that, and burying the difference in
+   * here is how one of them would get it silently wrong.
+   */
+  const postVerifyVerdict = async (result: string): Promise<Response | null> => {
+    const callbackUrl   = body.callback_url   as string;
+    const callbackToken = body.callback_token as string;
+    const batchId       = body.batch_id       as string;
+
+    // Callback URL is signed inside the body, so HMAC verify already proves it
+    // came from OneAddress. We still validate the host as defence in depth:
+    // if the webhook secret ever leaks, an attacker who can forge a webhook
+    // could otherwise coerce this server into POSTing to any internal
+    // URL (database admin, cloud metadata service, \u2026) \u2014 turning the partner's
+    // network position into an SSRF primitive.
+    const safeCallbackUrl = safeOneAddressCallbackUrl(callbackUrl);
+    if (!safeCallbackUrl) {
+      report.warn(\`[webhook] refusing callback to non-OneAddress host: \${callbackUrl}\`);
+      return res.status(400).json({ error: 'Invalid callback_url host' });
+    }
+
+    await fetch(safeCallbackUrl, {
+      method:  'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        // 2026.2 \u2014 no member_name echo; OneAddress keys the result on
+        // (batch_id, partner_id) and validates the opaque token alone.
+        batch_id:    batchId,
+        partner_id:  PARTNER_ID,
+        result,
+        token:       callbackToken,
+      }),
+    });
+    return null;
+  };
+
+  // \u2500\u2500 INBOX MODE: hold it, do not open it \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  //
+  // An \`address.updated\` is stored exactly as it arrived and the connector is
+  // left to collect it. The 200 below is honest and is not a claim that anything
+  // was applied: the protocol already separates the two, and the CONFIRM is what
+  // reports application. It fires when the connector says so, which may be
+  // hours later, and \`user_services.state\` has carried \`awaiting_confirm\` for
+  // that gap since long before this mode existed.
+  //
+  // The verify events deliberately fall through to the code below, because they
+  // must be answered NOW, before a consumer pays. In inbox mode that answer
+  // comes from the connector.
+  // \u2500\u2500 INBOX MODE, the other half: a verify the receiver cannot open \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  //
+  // \`address.verify\` has to be answered now, like \`account.verify\` above, but it
+  // is answered by POSTing a callback rather than in the response body. The
+  // callback URL and token travel in the CLEARTEXT body, not the envelope, so
+  // this process can still post it; only the VERDICT needs a key, and that comes
+  // from the connector.
+  if (config.mode === 'inbox' && event === 'address.verify') {
+    // The contract's arguments, not its source: \`connectorStore\` sends the raw
+    // body it was parked with and ignores these.
+    const result = await store.verifyAddress({ email: null, name: '' }, {});
+    report.info(\`[webhook] address.verify \u2192 \${result} (answered by the connector)\`);
+    const refused = await postVerifyVerdict(result);
+    if (refused) return refused;
+    // DELIBERATELY NOT \`rememberDispatch\`, for the same reason as the inbox
+    // \`address.updated\` branch below: nothing was decrypted here, so there is
+    // no state a retry would duplicate. OneAddress keys a verify result on
+    // (batch_id, partner_id), so re-answering a retried check is a no-op \u2014 and
+    // NOT remembering is the safer half of the trade, because a check we failed
+    // to answer still gets answered on the retry instead of being dismissed.
+    return res.status(200).json({ ok: true });
+  }
+
+  if (config.mode === 'inbox' && event === 'address.updated') {
+    acceptIntoInbox({ key, dispatchId: dispatch || null, event, rawBody });
+    report.info(\`[inbox] held \${dispatch || key} for the connector\`);
+    // DELIBERATELY NOT \`rememberDispatch\`. A guard in templates.test.ts asserts
+    // that nothing is remembered before the decrypt is attempted, because a
+    // dispatch marked seen too early makes OneAddress's retry look like a
+    // duplicate and loses the update. Adding an exception here for a branch
+    // that happens not to decrypt would weaken the guard for the branch that
+    // does. It is not needed anyway: \`accept\` is INSERT OR IGNORE on the same
+    // dispatch identity, so a redelivery is already harmless.
+    return res.status(200).json({ ok: true, queued: true });
+  }
 
   const DISPATCH_EVENTS = ['address.updated', 'address.verify', 'address.test', 'address.test-dispatch'];
   if (!DISPATCH_EVENTS.includes(event)) {
@@ -4016,6 +5193,9 @@ app.post('/webhook', async (req: Request, res: Response) => {
       return res.status(422).json({ ok: false, error: 'Decryption failed \u2014 partner key mismatch' });
     }
   } else {
+    // No \`hold\` here: there is no payload to hold, so there is nothing a fix
+    // could later apply. It still counts as a dispatch that did not land.
+    recordOutcome(key, 'failed');
     return res.status(422).json({ ok: false, error: 'No encrypted payload on dispatch' });
   }
 
@@ -4030,11 +5210,23 @@ app.post('/webhook', async (req: Request, res: Response) => {
   const loaEncrypted = body.loa_encrypted as
     { session_envelope: string; session_key_share: SessionKeyShare } | null | undefined;
   if (loaEncrypted && typeof loaEncrypted === 'object') {
-    try {
-      const loa: OneAddressD5LOA = await decryptLoaEncrypted(loaEncrypted, PARTNER_PRIVATE_KEY, PARTNER_ID);
-      loaRef = d5LoaRef(loa);
-    } catch (err) {
-      report.error('[webhook] LOA decryption failed:', err instanceof Error ? err.message : err);
+    // RESOLVED BY THE LOA'S OWN key_id, not by the single PARTNER_PRIVATE_KEY_PEM.
+    // It is wrapped to the same key id as the address envelope, but it carries
+    // its own share, so that is what is read. Using the single key meant that
+    // after a rotation with PARTNER_KEYS_STRICT=1 the address opened and the LOA
+    // silently did not, losing the proof-of-consent on exactly the changes a
+    // partner most wants it for, with nothing anyone would see.
+    const loaKeyId = loaEncrypted.session_key_share?.key_id ?? null;
+    const loaKey   = resolvePrivateKey(loaKeyId);
+    if (!loaKey) {
+      report.warn(\`[webhook] no key for the LOA's key_id \${loaKeyId ?? '(none)'} \u2014 applying without a consent reference\`);
+    } else {
+      try {
+        const loa: OneAddressD5LOA = await decryptLoaEncrypted(loaEncrypted, loaKey.pem, PARTNER_ID);
+        loaRef = d5LoaRef(loa);
+      } catch (err) {
+        report.error('[webhook] LOA decryption failed:', err instanceof Error ? err.message : err);
+      }
     }
   }
 
@@ -4052,7 +5244,12 @@ app.post('/webhook', async (req: Request, res: Response) => {
 
   // \u2500\u2500 address.updated: consumer changed their address \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   if (event === 'address.updated') {
-    report.info(\`[webhook] address.updated for \${ctx.accountNumber || ctx.name}\`);
+    // THE ACCOUNT, NEVER THE NAME. This used to fall back to \`ctx.name\`, so a
+    // partner who does not verify account references wrote a real consumer's
+    // name into every log line, and from there into whatever aggregates their
+    // logs. The account reference is the partner's own identifier for their own
+    // record; the name is the consumer's.
+    report.info(\`[webhook] address.updated for \${ctx.accountNumber || '(no account reference)'}\`);
 
     // AN ACCOUNT REFERENCE THAT MATCHES NOTHING MUST BE A HARD NO-MATCH.
     //
@@ -4084,59 +5281,56 @@ app.post('/webhook', async (req: Request, res: Response) => {
       if (verdict !== 'match') {
         report.warn(\`[webhook] address.updated REFUSED (\${verdict}) for account \${ctx.accountNumber ?? '(none)'} \u2014 nothing applied\`);
         queueConfirm(dispatch, 'failed');
+        // A refusal is not a fault and is never held, but it IS a dispatch that
+        // did not land, so it counts. See quarantine.ts for why the two differ.
+        recordOutcome(key, 'failed');
         return res.status(200).json({ ok: false, error: 'account_not_matched', verdict });
       }
     }
 
-    // \`saveAddress\` returns the address it replaced. Handed to the dashboard so
-    // it can show both halves; a no-op under --headless. Passed directly rather
-    // than reported, because the previous address is a customer's address and
-    // must never reach a log line.
+    // THE DASHBOARD IS HANDED FACTS, NOT THE ADDRESS, and that is structural
+    // rather than a formatting choice.
+    //
+    // It used to receive the address this dispatch REPLACED and look the new
+    // one up from the store, and it painted both on a panel. Everything around
+    // here is careful that an address never reaches a log line - two comments
+    // one screen apart say so - and then it was drawn in large text on a screen
+    // that gets screenshotted, screen-shared and left open in an office.
+    //
+    // The receiver does not need to show an address to prove it works. It needs
+    // to show that the envelope opened, that the account was one of yours, and
+    // whether anything actually changed. Those are the facts below, and nothing
+    // that reaches \`tui.ts\` can be turned back into a consumer's home.
+    //
+    // There is nothing here to sneak past, either, which is why this is better
+    // than marking test dispatches as safe to display: a marker is something an
+    // attacker can try to forge onto a real dispatch, and a panel that never
+    // renders an address has nothing to forge it into.
     const replaced = await store.saveAddress(ctx, address);
-    notePreviousAddress(replaced);
+    noteChange({
+      accountNumber:  ctx.accountNumber || '(no account reference)',
+      accountChecked: config.verifiesAccountReference,
+      changed:        !sameAddress(replaced, address),
+      loaRef,
+      dispatchId:     dispatch || null,
+    });
     if (dispatch) rememberDispatch(dispatch); // remember only after it is stored
     // Close the loop back to OneAddress so the service flips to "Confirmed".
     // QUEUED, not sent: this is a local INSERT, so it cannot delay the 200 that
     // acks the delivery, and it survives a restart. The drain loop does the
     // network part and retries it until OneAddress answers.
     queueConfirm(dispatch, 'confirmed');
+    recordOutcome(key, 'applied');
     return res.status(200).json({ ok: true });
   }
 
   // \u2500\u2500 address.verify: consumer is running an address check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   if (event === 'address.verify') {
-    const callbackUrl   = body.callback_url   as string;
-    const callbackToken = body.callback_token as string;
-    const batchId       = body.batch_id       as string;
-
-    // Callback URL is signed inside the body, so HMAC verify already proves it
-    // came from OneAddress. We still validate the host as defence in depth:
-    // if the webhook secret ever leaks, an attacker who can forge a webhook
-    // could otherwise coerce this server into POSTing to any internal
-    // URL (database admin, cloud metadata service, \u2026) \u2014 turning the partner's
-    // network position into an SSRF primitive.
-    const safeCallbackUrl = safeOneAddressCallbackUrl(callbackUrl);
-    if (!safeCallbackUrl) {
-      report.warn(\`[webhook] refusing callback to non-OneAddress host: \${callbackUrl}\`);
-      return res.status(400).json({ error: 'Invalid callback_url host' });
-    }
-
-    report.info(\`[webhook] address.verify for \${ctx.accountNumber || ctx.name}\`);
+    report.info(\`[webhook] address.verify for \${ctx.accountNumber || '(no account reference)'}\`);
     const result = await store.verifyAddress(ctx, address);
     report.info(\`[webhook] address.verify \u2192 \${result}\`);
-
-    await fetch(safeCallbackUrl, {
-      method:  'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        // 2026.2 \u2014 no member_name echo; OneAddress keys the result on
-        // (batch_id, partner_id) and validates the opaque token alone.
-        batch_id:    batchId,
-        partner_id:  PARTNER_ID,
-        result,
-        token:       callbackToken,
-      }),
-    });
+    const refused = await postVerifyVerdict(result);
+    if (refused) return refused;
     if (dispatch) rememberDispatch(dispatch); // remember only after the callback posted
     return res.status(200).json({ ok: true });
   }
@@ -4236,13 +5430,12 @@ setInterval(() => {
  * anyone has fixed anything. We hold the secret, so re-signing is not a bypass:
  * it is the same proof, re-stated now.
  */
-async function redeliver(rawBody: string): Promise<void> {
+async function redeliver(rawBody: string, heldDispatchId: string | null): Promise<void> {
   const ts  = String(Math.floor(Date.now() / 1000));
   const sig = createHmac('sha256', WEBHOOK_SECRET).update(\`\${ts}.\${rawBody}\`).digest('hex');
-  let dispatchId = '';
-  try {
-    dispatchId = String((JSON.parse(rawBody) as { dispatch_id?: unknown }).dispatch_id ?? '');
-  } catch { /* the handler will reject it as bad JSON, which is the right answer */ }
+  // THE ID THE DISPATCH ARRIVED WITH, handed over by the row being replayed.
+  // Re-deriving it from the body is what made one held dispatch become two.
+  const dispatchId = (heldDispatchId ?? '').trim();
 
   const res = await fetch(\`http://127.0.0.1:\${PORT}/webhook\`, {
     method: 'POST',
@@ -4277,6 +5470,29 @@ export async function replayQuarantined(): Promise<{ applied: number; failed: nu
  * moment they are least inclined to. The delay lets \`listen\` settle, since this
  * goes back in through the port.
  */
+// \u2500\u2500 The connector channel, in inbox mode only \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+//
+// Wired here rather than in draw-api.ts because this file owns the confirm
+// queue: an acknowledgement from the connector is the moment OneAddress gets
+// told, and that has to go through the same durable queue every other confirm
+// uses so a failure to reach OneAddress is retried rather than lost.
+if (config.mode === 'inbox') {
+  setAcknowledgementHandler((dispatchId, outcome) => {
+    queueConfirm(dispatchId, outcome === 'applied' ? 'confirmed' : 'failed');
+    recordOutcome(\`d:\${dispatchId}\`, outcome === 'applied' ? 'applied' : 'failed');
+  });
+  const started = startDrawApi();
+  if (!started) {
+    // AN INBOX WITH NO WAY TO DRAIN IT IS WORSE THAN NOT STARTING. In
+    // write-through mode a missing connector token is irrelevant and the
+    // receiver runs; here it means every dispatch would be accepted and held
+    // with nothing able to collect it, and the consumer would be told nothing
+    // for as long as that lasted.
+    report.error('[startup] mode is \`inbox\` but the connector channel could not open. Refusing to start.');
+    process.exit(1);
+  }
+}
+
 setTimeout(() => {
   if (heldCount() === 0) return;
   void replayQuarantined().catch((err: unknown) =>
@@ -4291,8 +5507,34 @@ setTimeout(() => {
 const QUARANTINE_KEEP_DAYS = Number(process.env.QUARANTINE_KEEP_DAYS ?? 30);
 setInterval(() => { purgeQuarantine(QUARANTINE_KEEP_DAYS); }, 3_600_000).unref();
 
-/** How many confirms are still owed. Read by the dashboard. */
-export { pendingConfirmCount };
+/** How many confirms are still owed, and how the dispatches went. Read by the dashboard. */
+export { pendingConfirmCount, tally };
+
+/**
+ * Everything the dashboard footer needs, in one call.
+ *
+ * One hook rather than three, because three would be three chances for the
+ * footer to show figures from different moments.
+ */
+export function dashboardStats(): {
+  received: number;
+  applied: number;
+  failed: number;
+  mode: string;
+  awaitingConnector: number;
+  oldestUndrawn: string | null;
+} {
+  const t = tally();
+  const inbox = config.mode === 'inbox'
+    ? { count: undrawnCount(), oldest: oldestUndrawn() }
+    : { count: 0, oldest: null };
+  return {
+    ...t,
+    mode: config.mode,
+    awaitingConnector: inbox.count,
+    oldestUndrawn: inbox.oldest,
+  };
+}
 
 // Read by src/index.ts to label the dashboard. Exported rather than re-derived
 // there, so the port the UI claims is the port the server actually bound.
@@ -9493,11 +10735,49 @@ npx @oneaddress/conformance test %%WEBHOOK_URL%%
 };
 
 // src/scaffold.ts
-function applyTokens(content, partnerId, webhookSecret, webhookUrl, privateKey, verifiesAccountReference, oneAddressApi) {
-  return content.replaceAll("%%PARTNER_ID%%", partnerId).replaceAll("%%WEBHOOK_SECRET%%", webhookSecret).replaceAll("%%WEBHOOK_URL%%", webhookUrl || "<your-webhook-url>").replaceAll("%%PRIVATE_KEY%%", privateKey || "<paste your PKCS8 PEM private key here>").replaceAll("%%ONEADDRESS_API%%", oneAddressApi || "https://oneaddress.io").replaceAll("%%VERIFIES_ACCOUNT_REFERENCE%%", verifiesAccountReference ? "true" : "false");
+function applyTokens(content, partnerId, webhookSecret, webhookUrl, privateKey, verifiesAccountReference, oneAddressApi, mode, connectorToken) {
+  const filled = content.replaceAll("%%PARTNER_ID%%", partnerId).replaceAll("%%WEBHOOK_SECRET%%", webhookSecret).replaceAll("%%WEBHOOK_URL%%", webhookUrl || "<your-webhook-url>").replaceAll("%%PRIVATE_KEY%%", privateKey || "<paste your PKCS8 PEM private key here>").replaceAll("%%ONEADDRESS_API%%", oneAddressApi || "https://oneaddress.io").replaceAll("%%VERIFIES_ACCOUNT_REFERENCE%%", verifiesAccountReference ? "true" : "false").replaceAll("%%RECEIVER_MODE%%", mode === "inbox" ? "inbox" : "write-through");
+  if (mode !== "inbox") return filled;
+  const withReadme = filled.replace(
+    "## Architecture",
+    `## Inbox mode
+
+This receiver holds dispatches as ciphertext and keeps **no private key** - it refuses to
+start with one - so it cannot read what it stores. A **connector** you run separately draws
+from it, decrypts, applies the change to your systems and acknowledges; only then does
+OneAddress confirm the update to the consumer.
+
+Until that connector runs, updates are held and the dashboard counts them as awaiting your
+systems. Nothing is lost and nothing is applied.
+
+| What | Where |
+|------|-------|
+| The decryption key | Your connector's environment, never this one |
+| \`CONNECTOR_TOKEN\` | \`.env\` here, and the same value in your connector |
+| The draw channel | \`http://127.0.0.1:3002\`, loopback only |
+
+\`CONNECTOR_TOKEN\` is its own credential: **not** your webhook secret and **not** your
+confirm secret. Those two are shared with OneAddress, and a leak of either must not also
+hand somebody your customers' addresses.
+
+## Architecture`
+  );
+  return withReadme.replace(
+    /^PARTNER_PRIVATE_KEY_PEM=.*$/m,
+    `# No PARTNER_PRIVATE_KEY_PEM here, on purpose: this receiver runs in inbox
+# mode and refuses to start with one. The key belongs in your connector.
+
+# The credential your connector presents to draw from this inbox. It must
+# match CONNECTOR_TOKEN in the connector's own environment, and it must not
+# be your webhook secret or your confirm secret.
+CONNECTOR_TOKEN=${connectorToken || generateConnectorToken()}`
+  );
+}
+function generateConnectorToken() {
+  return (0, import_node_crypto.randomBytes)(24).toString("hex");
 }
 var SENSITIVE_FILES = /* @__PURE__ */ new Set([".env"]);
-async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUrl, privateKey = "", verifiesAccountReference = false, oneAddressApi = "https://oneaddress.io") {
+async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUrl, privateKey = "", verifiesAccountReference = false, oneAddressApi = "https://oneaddress.io", mode = "write-through", connectorToken = "") {
   const templates = TEMPLATES[platform];
   if (!templates) throw new Error(`Unknown platform: ${platform}`);
   const written = [];
@@ -9507,7 +10787,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
     if (!(0, import_node_fs.existsSync)(dir)) {
       await (0, import_promises.mkdir)(dir, { recursive: true });
     }
-    const filled = applyTokens(content, partnerId, webhookSecret, webhookUrl, privateKey, verifiesAccountReference, oneAddressApi);
+    const filled = applyTokens(content, partnerId, webhookSecret, webhookUrl, privateKey, verifiesAccountReference, oneAddressApi, mode, connectorToken);
     const isSensitive = SENSITIVE_FILES.has((0, import_node_path.basename)(name));
     await (0, import_promises.writeFile)(dest, filled, { encoding: "utf8", mode: isSensitive ? 384 : 420 });
     if (isSensitive && process.platform !== "win32") {
@@ -9522,11 +10802,11 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 }
 
 // src/register.ts
-var import_node_crypto = require("crypto");
-var PKG_VERSION = true ? "2.1.3" : "dev";
+var import_node_crypto2 = require("crypto");
+var PKG_VERSION = true ? "2.3.0" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
-  return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");
+  return (0, import_node_crypto2.createHmac)("sha256", secret).update(message).digest("hex");
 }
 async function registerInstall(installId, partnerId, webhookSecret, platform, webhookUrl) {
   try {
@@ -9559,10 +10839,10 @@ async function registerInstall(installId, partnerId, webhookSecret, platform, we
 }
 
 // src/conformance.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 async function runConformance(webhookUrl, _partnerId, webhookSecret) {
   function sign(ts, body) {
-    return (0, import_node_crypto2.createHmac)("sha256", webhookSecret).update(`${ts}.${body}`).digest("hex");
+    return (0, import_node_crypto3.createHmac)("sha256", webhookSecret).update(`${ts}.${body}`).digest("hex");
   }
   const validBody = JSON.stringify({ event: "conformance.ping", test: true });
   const now = String(Math.floor(Date.now() / 1e3));
@@ -9603,7 +10883,7 @@ async function runConformance(webhookUrl, _partnerId, webhookSecret) {
             // Unique per test run so a partner re-running `npm test` doesn't
             // hit the scaffolded server's dedup cache and short-circuit the
             // "accepted" assertion with { ok: true, duplicate: true }.
-            "X-OneAddress-Dispatch": `conformance-${(0, import_node_crypto2.randomUUID)()}`
+            "X-OneAddress-Dispatch": `conformance-${(0, import_node_crypto3.randomUUID)()}`
           },
           body: validBody,
           signal: AbortSignal.timeout(8e3)
@@ -9655,7 +10935,7 @@ async function runDecryptCheck(webhookSecret, partnerId) {
   async function callOnce() {
     try {
       const ts = String(Math.floor(Date.now() / 1e3));
-      const sig = (0, import_node_crypto2.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
+      const sig = (0, import_node_crypto3.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
       const res2 = await fetch(VERIFY_DECRYPT_API, {
         method: "POST",
         headers: {
@@ -9730,24 +11010,46 @@ var COMMANDS = {
 function installDependencies(platform, outputDir) {
   const spec = COMMANDS[platform];
   if (!spec) {
-    return { ok: true, output: "", manualCommand: "" };
+    return Promise.resolve({ ok: true, output: "", manualCommand: "" });
   }
   const cwd = spec.cwd ? (0, import_node_path2.join)(outputDir, spec.cwd) : outputDir;
   const manualCommand = `cd ${outputDir} && ${spec.cmd} ${spec.args.join(" ")}`;
-  const result = (0, import_node_child_process.spawnSync)(spec.cmd, spec.args, {
-    cwd,
-    stdio: "pipe",
-    encoding: "utf8",
-    timeout: 5 * 60 * 1e3,
-    // 5 min max
-    shell: process.platform === "win32"
+  return new Promise((resolve2) => {
+    const child = (0, import_node_child_process.spawn)(spec.cmd, spec.args, {
+      cwd,
+      stdio: "pipe",
+      shell: process.platform === "win32"
+    });
+    let output = "";
+    const collect = (chunk) => {
+      if (output.length < 64e3) output += chunk.toString("utf8");
+    };
+    child.stdout?.on("data", collect);
+    child.stderr?.on("data", collect);
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve2(result);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish({
+        ok: false,
+        output: `${output.trim()}
+
+Timed out after 5 minutes.`.trim(),
+        manualCommand
+      });
+    }, 5 * 60 * 1e3);
+    child.on("error", (err) => {
+      finish({ ok: false, output: `${output}${err.message}`.trim(), manualCommand });
+    });
+    child.on("close", (code) => {
+      finish({ ok: code === 0, output: output.trim(), manualCommand });
+    });
   });
-  const output = [result.stdout ?? "", result.stderr ?? ""].join("").trim();
-  return {
-    ok: result.status === 0 && !result.error,
-    output,
-    manualCommand
-  };
 }
 
 // src/autostart.ts
@@ -9932,7 +11234,7 @@ async function handOverTerminal(platform, outputDir, port, secrets = {}) {
 var import_node_child_process3 = require("child_process");
 var import_promises2 = require("fs/promises");
 var import_node_fs2 = require("fs");
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_node_path3 = require("path");
 var import_node_os = __toESM(require("os"));
 var tunnelProcess = null;
@@ -9971,7 +11273,7 @@ function platformKey() {
   return "linux-x64";
 }
 async function sha256File(path) {
-  const hash = (0, import_node_crypto3.createHash)("sha256");
+  const hash = (0, import_node_crypto4.createHash)("sha256");
   hash.update(await (0, import_promises2.readFile)(path));
   return hash.digest("hex");
 }
@@ -10105,7 +11407,7 @@ async function startTunnel(port) {
 }
 
 // src/register-url.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var PORTAL_API = "https://partners.oneaddress.io/api/partner/webhook-url";
 function describeReadFailure(status) {
   if (status === 401) return "the portal rejected the signature (HTTP 401), which means your Webhook signing secret does not match the one on your profile. Copy it again from partners.oneaddress.io \u2192 Webhook \u2192 Webhook signing secret.";
@@ -10116,7 +11418,7 @@ function describeReadFailure(status) {
 async function getExistingWebhookUrl(partnerId, webhookSecret, onError) {
   try {
     const ts = String(Math.floor(Date.now() / 1e3));
-    const sig = (0, import_node_crypto4.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
+    const sig = (0, import_node_crypto5.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
     const res = await fetch(PORTAL_API, {
       method: "GET",
       headers: {
@@ -10140,7 +11442,7 @@ async function getExistingWebhookUrl(partnerId, webhookSecret, onError) {
 async function getVerifiesAccountReference(partnerId, webhookSecret, onError) {
   try {
     const ts = String(Math.floor(Date.now() / 1e3));
-    const sig = (0, import_node_crypto4.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
+    const sig = (0, import_node_crypto5.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
     const res = await fetch(PORTAL_API, {
       method: "GET",
       headers: {
@@ -10167,7 +11469,7 @@ async function getVerifiesAccountReference(partnerId, webhookSecret, onError) {
 async function verifyWebhookSecret(partnerId, webhookSecret) {
   try {
     const ts = String(Math.floor(Date.now() / 1e3));
-    const sig = (0, import_node_crypto4.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
+    const sig = (0, import_node_crypto5.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
     const res = await fetch(PORTAL_API, {
       method: "GET",
       headers: {
@@ -10188,7 +11490,7 @@ async function registerWebhookUrl(partnerId, webhookSecret, webhookUrl) {
   try {
     const body = JSON.stringify({ webhook_url: webhookUrl });
     const ts = String(Math.floor(Date.now() / 1e3));
-    const sig = (0, import_node_crypto4.createHmac)("sha256", webhookSecret).update(`${ts}.${body}`).digest("hex");
+    const sig = (0, import_node_crypto5.createHmac)("sha256", webhookSecret).update(`${ts}.${body}`).digest("hex");
     const res = await fetch(PORTAL_API, {
       method: "PATCH",
       headers: {
@@ -10385,7 +11687,7 @@ ${wrapped}
 -----END EC PRIVATE KEY-----
 `;
     try {
-      const pkcs8 = (0, import_node_crypto5.createPrivateKey)({ key: sec1Pem, format: "pem", type: "sec1" }).export({ type: "pkcs8", format: "pem" });
+      const pkcs8 = (0, import_node_crypto6.createPrivateKey)({ key: sec1Pem, format: "pem", type: "sec1" }).export({ type: "pkcs8", format: "pem" });
       return { pem: pkcs8 };
     } catch (err) {
       return { pem: "", error: translateKeyError(err) };
@@ -10429,7 +11731,7 @@ function translateKeyError(err) {
 function validatePrivateKey(pem) {
   let key;
   try {
-    key = (0, import_node_crypto5.createPrivateKey)({ key: pem, format: "pem", type: "pkcs8" });
+    key = (0, import_node_crypto6.createPrivateKey)({ key: pem, format: "pem", type: "pkcs8" });
   } catch (err) {
     return translateKeyError(err);
   }
@@ -10550,6 +11852,39 @@ async function main() {
     accountRefReason = r2;
   });
   const verifiesAccountReference = accountRefDeclaration === true;
+  const modeChoice = platform !== "ts-node" ? "write-through" : await ve({
+    message: "How should this receiver handle updates?",
+    options: [
+      {
+        value: "write-through",
+        label: "Apply them itself  (simplest)",
+        hint: "Decrypts and writes to a customer store on this machine. Right for a sole trader, or to try it out."
+      },
+      {
+        value: "inbox",
+        label: "Hold them for your own systems to collect",
+        hint: "Holds ciphertext and keeps NO private key, so this process cannot read what it stores. Needs a connector you run separately."
+      }
+    ],
+    initialValue: "write-through"
+  });
+  assertNotCancelled(modeChoice);
+  const receiverMode = modeChoice;
+  const connectorToken = receiverMode === "inbox" ? generateConnectorToken() : "";
+  if (receiverMode === "inbox") {
+    M2.warn(
+      "Inbox mode needs a second process. This receiver will hold dispatches as ciphertext and\nkeep NO private key \u2014 it refuses to start with one \u2014 so a connector of yours must draw,\ndecrypt and apply them, then acknowledge. Until that connector runs, updates are held and\nthe dashboard counts them as awaiting your systems."
+    );
+    M2.info(
+      `Your connector credential (also written to .env as CONNECTOR_TOKEN):
+
+  ${connectorToken}
+
+Set the same value as CONNECTOR_TOKEN in your connector. It is its own credential:
+not your webhook secret and not your confirm secret, because those are shared with
+OneAddress and a leak of either must not also hand somebody your customers' addresses.`
+    );
+  }
   if (accountRefDeclaration === void 0) {
     M2.warn(
       "Could not read your account-reference declaration from the portal.\n" + (accountRefReason ? "Reason: " + accountRefReason + "\n" : "") + "Conformance check-14 has been left out of the generated `npm test`, so a\npassing run does NOT mean your receiver matches account references correctly.\nSet it at partners.oneaddress.io \u2192 My Profile, then re-run this wizard."
@@ -10567,7 +11902,10 @@ async function main() {
       "",
       // webhookUrl — filled in after server starts
       privateKey,
-      verifiesAccountReference
+      verifiesAccountReference,
+      void 0,
+      receiverMode,
+      connectorToken
     );
     s1.stop(`Scaffolded ${written.length} files in ${outDir}`);
     for (const f of written) M2.success(`  ${f}`);
@@ -10579,7 +11917,7 @@ async function main() {
   for (; ; ) {
     const s2 = Y2();
     s2.start("Installing dependencies  (this can take 30\u201360 s)");
-    const install = installDependencies(platform, outDir);
+    const install = await installDependencies(platform, outDir);
     if (install.ok) {
       s2.stop("Dependencies installed");
       break;
@@ -10749,7 +12087,7 @@ one of two things, and neither is your server (it is running on :3001):
       );
     }
     registerInstall(
-      `OA-${(0, import_node_crypto5.randomUUID)()}`,
+      `OA-${(0, import_node_crypto6.randomUUID)()}`,
       pid,
       secret,
       platform,