humanish 0.29.0 → 0.31.0

package/README.md

@@ -262,6 +262,18 @@ you own (a Vercel preview, staging), use an `app-url` subject with
 only declared subject env names do. `humanish init` scaffolds an example at
 `humanish/labs/cua-browser.yaml`.
 
+**Off-app email/SMS verification (`comms`).** When a flow is gated behind an email
+or SMS the app itself sends — a signup verification link, a one-time code, a magic
+link — add a `comms:` block to the lab. Humanish redirects the app's email-API sends
+(via one adopter-named env var, e.g. `RESEND_API_URL`) into a catch **inside** the
+sandbox, so nothing leaves the machine; the persona then opens a synthetic inbox to
+read and click through, and the run bundle gets a digest-only
+`humanish.comms-thread.v1` artifact (from/to/subject/link digests + an OTP count —
+no raw address, link, or code persists). It works on the single-lane clone/local-tree
+route and the concurrent shared-world route, and is vendor-neutral (Resend/SendGrid
+shaped, or a custom profile). See `docs/contracts/schemas.md` for the full `comms:`
+shape.
+
 **Screenshots are full-fidelity by default.** Run bundles live in gitignored
 `.humanish/`, so the Observer shows exactly what the persona saw — the point of
 simming your own app. Set `policies.redactScreenshots: true` to persist blurred

package/dist/comms-sandbox-catch.d.ts

@@ -17,13 +17,20 @@ export declare const DEFAULT_SANDBOX_CATCH_PORT = 8025;
  * and returns a plausible provider success — all normalization/profile parsing happens host-side on the
  * drained lines, so the typed, tested profiles stay in one place. It also serves the host-rendered inbox
  * surface statically at /inbox + /api/inbox (with a script-forbidding CSP). argv: <port> <deliveriesFile>
- * [servedDir]. Binds 127.0.0.1 only (loopback): the app under test reaches it in-sandbox; nothing is
- * exposed to the internet.
+ * <servedDir> [inboxPort]. The capture listener binds 127.0.0.1 (loopback) — the app under test reaches
+ * it in-sandbox, nothing on the internet can inject a fake send. When an [inboxPort] is given (the
+ * shared-world route, where the persona lives in a DIFFERENT sandbox), it ALSO starts a READ-ONLY inbox
+ * listener on 0.0.0.0:<inboxPort> so getHost can proxy the persona's inbox reads to it; that listener
+ * serves GET only (POST → 405). The CUA same-sandbox route omits it and stays loopback-only.
  */
-export declare const SANDBOX_CATCH_SCRIPT = "import json\nimport os\nimport random\nimport sys\nimport time\nfrom http.server import BaseHTTPRequestHandler, ThreadingHTTPServer\nfrom urllib.parse import unquote\n\nPORT = int(sys.argv[1]) if len(sys.argv) > 1 else 8025\nOUT_FILE = sys.argv[2] if len(sys.argv) > 2 else \"/tmp/humanish-comms/deliveries.ndjson\"\nSERVED_DIR = sys.argv[3] if len(sys.argv) > 3 else (os.path.dirname(OUT_FILE) + \"/surface\")\ntry:\n    os.makedirs(os.path.dirname(OUT_FILE), exist_ok=True)\nexcept Exception:\n    pass\nMAX_BODY = 5 * 1024 * 1024\nCSP = \"default-src 'self'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-src 'none'; img-src * data:; style-src 'unsafe-inline'; font-src * data:\"\n\n\ndef message_id():\n    return \"humanish-catch-\" + format(int(time.time() * 1000), \"x\") + format(random.randrange(16 ** 8), \"08x\")\n\n\nclass Handler(BaseHTTPRequestHandler):\n    def log_message(self, *args):\n        return\n\n    def _json(self, status, obj, extra_headers=None):\n        payload = json.dumps(obj).encode(\"utf-8\")\n        self.send_response(status)\n        self.send_header(\"content-type\", \"application/json; charset=utf-8\")\n        for key, value in (extra_headers or {}).items():\n            self.send_header(key, value)\n        self.end_headers()\n        self.wfile.write(payload)\n\n    def do_GET(self):\n        path = self.path.split(\"?\")[0]\n        if path == \"/\" or path == \"/health\":\n            self._json(200, {\"ok\": True, \"service\": \"humanish-comms-catch\"})\n            return\n        if path == \"/inbox\" or path.startswith(\"/inbox/\") or path == \"/api/inbox\" or path.startswith(\"/api/inbox/\"):\n            rel = unquote(path)\n            if \"..\" in rel or chr(0) in rel:\n                self.send_response(400)\n                self.end_headers()\n                return\n            data = None\n            for candidate in (SERVED_DIR + rel, SERVED_DIR + rel + \"/index\"):\n                try:\n                    with open(candidate, \"rb\") as handle:\n                        data = handle.read()\n                    break\n                except Exception:\n                    data = None\n            if data is None:\n                self.send_response(404)\n                self.send_header(\"content-type\", \"text/html; charset=utf-8\")\n                self.end_headers()\n                self.wfile.write(b\"<p>message not found</p>\")\n                return\n            is_api = rel.startswith(\"/api/\")\n            self.send_response(200)\n            self.send_header(\"content-type\", \"application/json; charset=utf-8\" if is_api else \"text/html; charset=utf-8\")\n            if not is_api:\n                self.send_header(\"content-security-policy\", CSP)\n            self.end_headers()\n            self.wfile.write(data)\n            return\n        self._json(404, {\"error\": \"not found\"})\n\n    def do_POST(self):\n        path = self.path.split(\"?\")[0]\n        try:\n            length = int(self.headers.get(\"content-length\") or 0)\n        except Exception:\n            length = 0\n        if length > MAX_BODY:\n            self.send_response(413)\n            self.end_headers()\n            return\n        body = self.rfile.read(length).decode(\"utf-8\", \"replace\") if length > 0 else \"\"\n        try:\n            with open(OUT_FILE, \"a\", encoding=\"utf-8\") as handle:\n                print(json.dumps({\"t\": int(time.time() * 1000), \"path\": path, \"body\": body}), file=handle)\n        except Exception:\n            pass\n        mid = message_id()\n        if path == \"/v3/mail/send\":\n            self.send_response(202)\n            self.send_header(\"x-message-id\", mid)\n            self.end_headers()\n        elif path.endswith(\"/batch\"):\n            self._json(200, {\"data\": [{\"id\": mid}]})\n        else:\n            self._json(200, {\"id\": mid})\n\n\nThreadingHTTPServer((\"127.0.0.1\", PORT), Handler).serve_forever()\n";
+export declare const SANDBOX_CATCH_SCRIPT = "import json\nimport os\nimport random\nimport sys\nimport threading\nimport time\nfrom http.server import BaseHTTPRequestHandler, ThreadingHTTPServer\nfrom urllib.parse import unquote\n\nPORT = int(sys.argv[1]) if len(sys.argv) > 1 else 8025\nOUT_FILE = sys.argv[2] if len(sys.argv) > 2 else \"/tmp/humanish-comms/deliveries.ndjson\"\nSERVED_DIR = sys.argv[3] if len(sys.argv) > 3 else (os.path.dirname(OUT_FILE) + \"/surface\")\nINBOX_PORT = int(sys.argv[4]) if len(sys.argv) > 4 else 0\ntry:\n    os.makedirs(os.path.dirname(OUT_FILE), exist_ok=True)\nexcept Exception:\n    pass\nMAX_BODY = 5 * 1024 * 1024\nCSP = \"default-src 'self'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-src 'none'; img-src * data:; style-src 'unsafe-inline'; font-src * data:\"\n\n\ndef message_id():\n    return \"humanish-catch-\" + format(int(time.time() * 1000), \"x\") + format(random.randrange(16 ** 8), \"08x\")\n\n\nclass BaseHandler(BaseHTTPRequestHandler):\n    def log_message(self, *args):\n        return\n\n    def _json(self, status, obj, extra_headers=None):\n        payload = json.dumps(obj).encode(\"utf-8\")\n        self.send_response(status)\n        self.send_header(\"content-type\", \"application/json; charset=utf-8\")\n        for key, value in (extra_headers or {}).items():\n            self.send_header(key, value)\n        self.end_headers()\n        self.wfile.write(payload)\n\n    def do_GET(self):\n        path = self.path.split(\"?\")[0]\n        if path == \"/\" or path == \"/health\":\n            self._json(200, {\"ok\": True, \"service\": \"humanish-comms-catch\"})\n            return\n        if path == \"/inbox\" or path.startswith(\"/inbox/\") or path == \"/api/inbox\" or path.startswith(\"/api/inbox/\"):\n            rel = unquote(path)\n            if \"..\" in rel or chr(0) in rel:\n                self.send_response(400)\n                self.end_headers()\n                return\n            data = None\n            for candidate in (SERVED_DIR + rel, SERVED_DIR + rel + \"/index\"):\n                try:\n                    with open(candidate, \"rb\") as handle:\n                        data = handle.read()\n                    break\n                except Exception:\n                    data = None\n            if data is None:\n                self.send_response(404)\n                self.send_header(\"content-type\", \"text/html; charset=utf-8\")\n                self.end_headers()\n                self.wfile.write(b\"<p>message not found</p>\")\n                return\n            is_api = rel.startswith(\"/api/\")\n            self.send_response(200)\n            self.send_header(\"content-type\", \"application/json; charset=utf-8\" if is_api else \"text/html; charset=utf-8\")\n            if not is_api:\n                self.send_header(\"content-security-policy\", CSP)\n            self.end_headers()\n            self.wfile.write(data)\n            return\n        self._json(404, {\"error\": \"not found\"})\n\n\nclass CaptureHandler(BaseHandler):\n    def do_POST(self):\n        path = self.path.split(\"?\")[0]\n        try:\n            length = int(self.headers.get(\"content-length\") or 0)\n        except Exception:\n            length = 0\n        if length > MAX_BODY:\n            self.send_response(413)\n            self.end_headers()\n            return\n        body = self.rfile.read(length).decode(\"utf-8\", \"replace\") if length > 0 else \"\"\n        try:\n            with open(OUT_FILE, \"a\", encoding=\"utf-8\") as handle:\n                print(json.dumps({\"t\": int(time.time() * 1000), \"path\": path, \"body\": body}), file=handle)\n        except Exception:\n            pass\n        mid = message_id()\n        if path == \"/v3/mail/send\":\n            self.send_response(202)\n            self.send_header(\"x-message-id\", mid)\n            self.end_headers()\n        elif path.endswith(\"/batch\"):\n            self._json(200, {\"data\": [{\"id\": mid}]})\n        else:\n            self._json(200, {\"id\": mid})\n\n\nclass ReadOnlyHandler(BaseHandler):\n    def do_POST(self):\n        self.send_response(405)\n        self.end_headers()\n\n\n# Optional read-only inbox listener on 0.0.0.0 (getHost-reachable from a DIFFERENT sandbox on the\n# shared-world route). Serves GET /inbox + /api/inbox + /health only; POST capture stays on the\n# 127.0.0.1 listener so nothing on the internet can inject a fake captured send. Started only when a\n# distinct inbox port is provided (the CUA same-sandbox route omits it and stays loopback-only).\nif INBOX_PORT and INBOX_PORT != PORT:\n    threading.Thread(target=lambda: ThreadingHTTPServer((\"0.0.0.0\", INBOX_PORT), ReadOnlyHandler).serve_forever(), daemon=True).start()\n\nThreadingHTTPServer((\"127.0.0.1\", PORT), CaptureHandler).serve_forever()\n";
 export interface DeployCommsCatchOptions {
     /** Fixed loopback port the catch listens on (default 8025). Must be free inside the sandbox. */
     port?: number;
+    /** Optional SECOND fixed port for a READ-ONLY inbox listener bound to 0.0.0.0, so a persona in a
+     *  DIFFERENT sandbox can reach the inbox surface via getHost (the shared-world route). Omit on the
+     *  CUA same-sandbox route (loopback is enough). Must differ from `port` and be free in the sandbox. */
+    inboxPort?: number;
     /** In-sandbox working dir for the script + NDJSON (default /tmp/humanish-comms). */
     dir?: string;
     /** Detached-process name ([a-z0-9-]); default "comms-catch". */
@@ -41,6 +48,9 @@ export interface DeployedCommsCatch {
     /** In-sandbox dir the HOST renders the persona-facing inbox-surface files into (via writeInboxSurface);
      *  the catch serves them at /inbox and /api/inbox. */
     surfaceDir: string;
+    /** The 0.0.0.0 read-only inbox port, when one was requested — getHost-expose THIS to give a
+     *  different-sandbox persona a reachable inbox URL. Absent on the loopback-only (CUA) route. */
+    inboxPort?: number;
     /** Whether the catch's /health returned OUR service marker within the readiness budget. Callers MUST
      *  treat `ready === false` as fatal (do not inject baseUrl into a dead catch — the app's sends would
      *  silently fail with nothing captured). */
@@ -111,27 +121,32 @@ export declare function collectCommsThread(args: {
 export declare function writeInboxSurface(desktop: E2BDesktopSandbox, surfaceDir: string, messages: CommsMessage[], options?: InboxRenderOptions & {
     requestTimeoutMs?: number;
 }): Promise<number>;
+/** A declared inbox recipient the surface renders for (lane + the literal address the app sends to). */
+export interface InboxSurfaceRecipient {
+    lane: string;
+    address: string;
+}
 /**
- * One mid-run inbox-surface refresh cycle: drain the catch INCREMENTALLY from `cursor` into the
- * persistent surface `channel`, poll the provisioned `inboxes`, and (re)render the surface so the
- * persona sees new mail while the session is live. Returns the advanced cursor + whether it rendered.
+ * One mid-run inbox-surface refresh cycle: FULL rebuild from the append-only NDJSON (drain from cursor 0)
+ * into a FRESH FakeInbox each call, provisioning the declared `recipients`, then (re)render the surface
+ * so the persona sees new mail while the session is live. Returns the total captured-send `count` + whether
+ * it rendered.
  *
- * MUST use a channel dedicated to the surface — NOT the teardown evidence channel: the teardown
- * collectCommsThread drains the same append-only NDJSON from cursor 0 into its OWN fresh channel, so
- * feeding both an incremental and a cursor-0 drain into one channel would route every send twice
- * (FakeInbox mints fresh ids each time, so dedup-by-id can't catch it) and double-count the evidence.
- * Two channels + two cursors are independent readers of the same file — no evidence is lost or altered.
- * Skips the (N-file) render when no new sends arrived this tick, so idle ticks are cheap.
+ * The full rebuild is deliberate — it is IDEMPOTENT and RETRY-SAFE: a transient writeInboxSurface failure
+ * PROPAGATES (the caller retries next tick without advancing its `sinceCount`), and because each rebuild
+ * starts from a clean channel, a send is never routed twice, so the persona never sees duplicate emails.
+ * Pass `sinceCount` (the last SUCCESSFULLY-rendered send count) to skip the (N-file) render when nothing
+ * new has arrived. This is independent of the teardown collectCommsThread drain (its own fresh channel,
+ * also cursor 0) — no evidence is lost or altered. The NDJSON is small for a run, so re-reading it is cheap.
  */
 export declare function refreshInboxSurface(args: {
     desktop: E2BDesktopSandbox;
     deployed: Pick<DeployedCommsCatch, "deliveriesPath" | "surfaceDir">;
-    channel: CommsChannel;
-    inboxes: CommsAddress[];
-    cursor: number;
+    recipients: InboxSurfaceRecipient[];
+    sinceCount?: number;
     originMap?: InboxRenderOptions["originMap"];
     requestTimeoutMs?: number;
 }): Promise<{
-    cursor: number;
+    count: number;
     rendered: boolean;
 }>;

package/dist/comms-sandbox-catch.js

@@ -6,6 +6,7 @@
 // each poll `cat` its append-only NDJSON of captured sends back to the host, where the real profiles
 // parse them and route into the CommsChannel. A FIXED loopback port is chosen up front so the app's
 // injected base-URL env (`http://127.0.0.1:<port>`) is known before the sandbox is created.
+import { FakeInbox } from "./comms-fake-inbox.js";
 import { buildCommsThreadArtifact } from "./comms-evidence.js";
 import { buildInboxSurface } from "./comms-inbox.js";
 import { DEFAULT_EMAIL_PROFILES } from "./comms-email-catch.js";
@@ -28,13 +29,17 @@ function shq(value) {
  * and returns a plausible provider success — all normalization/profile parsing happens host-side on the
  * drained lines, so the typed, tested profiles stay in one place. It also serves the host-rendered inbox
  * surface statically at /inbox + /api/inbox (with a script-forbidding CSP). argv: <port> <deliveriesFile>
- * [servedDir]. Binds 127.0.0.1 only (loopback): the app under test reaches it in-sandbox; nothing is
- * exposed to the internet.
+ * <servedDir> [inboxPort]. The capture listener binds 127.0.0.1 (loopback) — the app under test reaches
+ * it in-sandbox, nothing on the internet can inject a fake send. When an [inboxPort] is given (the
+ * shared-world route, where the persona lives in a DIFFERENT sandbox), it ALSO starts a READ-ONLY inbox
+ * listener on 0.0.0.0:<inboxPort> so getHost can proxy the persona's inbox reads to it; that listener
+ * serves GET only (POST → 405). The CUA same-sandbox route omits it and stays loopback-only.
  */
 export const SANDBOX_CATCH_SCRIPT = `import json
 import os
 import random
 import sys
+import threading
 import time
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from urllib.parse import unquote
@@ -42,6 +47,7 @@ from urllib.parse import unquote
 PORT = int(sys.argv[1]) if len(sys.argv) > 1 else 8025
 OUT_FILE = sys.argv[2] if len(sys.argv) > 2 else "/tmp/humanish-comms/deliveries.ndjson"
 SERVED_DIR = sys.argv[3] if len(sys.argv) > 3 else (os.path.dirname(OUT_FILE) + "/surface")
+INBOX_PORT = int(sys.argv[4]) if len(sys.argv) > 4 else 0
 try:
     os.makedirs(os.path.dirname(OUT_FILE), exist_ok=True)
 except Exception:
@@ -54,7 +60,7 @@ def message_id():
     return "humanish-catch-" + format(int(time.time() * 1000), "x") + format(random.randrange(16 ** 8), "08x")
 
 
-class Handler(BaseHTTPRequestHandler):
+class BaseHandler(BaseHTTPRequestHandler):
     def log_message(self, *args):
         return
 
@@ -102,6 +108,8 @@ class Handler(BaseHTTPRequestHandler):
             return
         self._json(404, {"error": "not found"})
 
+
+class CaptureHandler(BaseHandler):
     def do_POST(self):
         path = self.path.split("?")[0]
         try:
@@ -129,7 +137,20 @@ class Handler(BaseHTTPRequestHandler):
             self._json(200, {"id": mid})
 
 
-ThreadingHTTPServer(("127.0.0.1", PORT), Handler).serve_forever()
+class ReadOnlyHandler(BaseHandler):
+    def do_POST(self):
+        self.send_response(405)
+        self.end_headers()
+
+
+# Optional read-only inbox listener on 0.0.0.0 (getHost-reachable from a DIFFERENT sandbox on the
+# shared-world route). Serves GET /inbox + /api/inbox + /health only; POST capture stays on the
+# 127.0.0.1 listener so nothing on the internet can inject a fake captured send. Started only when a
+# distinct inbox port is provided (the CUA same-sandbox route omits it and stays loopback-only).
+if INBOX_PORT and INBOX_PORT != PORT:
+    threading.Thread(target=lambda: ThreadingHTTPServer(("0.0.0.0", INBOX_PORT), ReadOnlyHandler).serve_forever(), daemon=True).start()
+
+ThreadingHTTPServer(("127.0.0.1", PORT), CaptureHandler).serve_forever()
 `;
 /** Readiness probe that asserts OUR service marker in the /health body (not merely any 2xx) — so a
  *  process squatting on the fixed port cannot produce a false "ready" while the app's sends bypass us. */
@@ -159,6 +180,10 @@ export async function deployCommsCatch(desktop, options = {}) {
     if (!Number.isInteger(port) || port <= 0 || port > 65_535) {
         throw new Error(`deployCommsCatch: invalid port ${JSON.stringify(options.port)}`);
     }
+    const inboxPort = options.inboxPort === undefined ? undefined : Math.trunc(Number(options.inboxPort));
+    if (inboxPort !== undefined && (!Number.isInteger(inboxPort) || inboxPort <= 0 || inboxPort > 65_535 || inboxPort === port)) {
+        throw new Error(`deployCommsCatch: invalid inboxPort ${JSON.stringify(options.inboxPort)}`);
+    }
     const dir = options.dir ?? DEFAULT_CATCH_DIR;
     const name = options.name ?? "comms-catch";
     const requestTimeoutMs = options.requestTimeoutMs ?? 30_000;
@@ -169,15 +194,22 @@ export async function deployCommsCatch(desktop, options = {}) {
     await desktop.files.write(scriptPath, SANDBOX_CATCH_SCRIPT);
     await startDetachedProcess(desktop, {
         name,
-        command: `python3 ${shq(scriptPath)} ${port} ${shq(deliveriesPath)} ${shq(surfaceDir)}`,
+        command: `python3 ${shq(scriptPath)} ${port} ${shq(deliveriesPath)} ${shq(surfaceDir)}${inboxPort === undefined ? "" : ` ${inboxPort}`}`,
         requestTimeoutMs
     });
-    const ready = await catchHealthy(desktop, port, {
-        timeoutMs: options.readyTimeoutMs ?? 15_000,
-        requestTimeoutMs,
-        ...(options.timers ?? {})
-    });
-    return { port, baseUrl: `http://127.0.0.1:${port}`, deliveriesPath, surfaceDir, ready };
+    const probe = { timeoutMs: options.readyTimeoutMs ?? 15_000, requestTimeoutMs, ...(options.timers ?? {}) };
+    const ready = await catchHealthy(desktop, port, probe);
+    // Confirm the read-only inbox listener bound too (loopback-reachable at its own port), when requested —
+    // else a getHost-exposed inbox would 502. Fail closed by folding it into `ready`.
+    const inboxReady = inboxPort === undefined ? true : await catchHealthy(desktop, inboxPort, probe);
+    return {
+        port,
+        baseUrl: `http://127.0.0.1:${port}`,
+        deliveriesPath,
+        surfaceDir,
+        ...(inboxPort === undefined ? {} : { inboxPort }),
+        ready: ready && inboxReady
+    };
 }
 /**
  * Drain new captured sends from the in-sandbox NDJSON since `cursor` (a line count). Returns the fresh
@@ -291,26 +323,33 @@ export async function writeInboxSurface(desktop, surfaceDir, messages, options =
     return files.length;
 }
 /**
- * One mid-run inbox-surface refresh cycle: drain the catch INCREMENTALLY from `cursor` into the
- * persistent surface `channel`, poll the provisioned `inboxes`, and (re)render the surface so the
- * persona sees new mail while the session is live. Returns the advanced cursor + whether it rendered.
+ * One mid-run inbox-surface refresh cycle: FULL rebuild from the append-only NDJSON (drain from cursor 0)
+ * into a FRESH FakeInbox each call, provisioning the declared `recipients`, then (re)render the surface
+ * so the persona sees new mail while the session is live. Returns the total captured-send `count` + whether
+ * it rendered.
  *
- * MUST use a channel dedicated to the surface — NOT the teardown evidence channel: the teardown
- * collectCommsThread drains the same append-only NDJSON from cursor 0 into its OWN fresh channel, so
- * feeding both an incremental and a cursor-0 drain into one channel would route every send twice
- * (FakeInbox mints fresh ids each time, so dedup-by-id can't catch it) and double-count the evidence.
- * Two channels + two cursors are independent readers of the same file — no evidence is lost or altered.
- * Skips the (N-file) render when no new sends arrived this tick, so idle ticks are cheap.
+ * The full rebuild is deliberate — it is IDEMPOTENT and RETRY-SAFE: a transient writeInboxSurface failure
+ * PROPAGATES (the caller retries next tick without advancing its `sinceCount`), and because each rebuild
+ * starts from a clean channel, a send is never routed twice, so the persona never sees duplicate emails.
+ * Pass `sinceCount` (the last SUCCESSFULLY-rendered send count) to skip the (N-file) render when nothing
+ * new has arrived. This is independent of the teardown collectCommsThread drain (its own fresh channel,
+ * also cursor 0) — no evidence is lost or altered. The NDJSON is small for a run, so re-reading it is cheap.
  */
 export async function refreshInboxSurface(args) {
-    const { sends, cursor } = await drainCommsCatch(args.desktop, args.deployed, args.cursor, args.requestTimeoutMs);
+    const { sends } = await drainCommsCatch(args.desktop, args.deployed, 0, args.requestTimeoutMs);
     if (sends.length === 0)
-        return { cursor, rendered: false };
-    await routeCapturedSends(sends, args.channel);
+        return { count: 0, rendered: false };
+    if (args.sinceCount !== undefined && sends.length <= args.sinceCount)
+        return { count: sends.length, rendered: false };
+    const channel = new FakeInbox();
+    const inboxes = [];
+    for (const recipient of args.recipients)
+        inboxes.push(await channel.provisionAddress(recipient.lane, recipient.address));
+    await routeCapturedSends(sends, channel);
     const seen = new Set();
     const messages = [];
-    for (const inbox of args.inboxes) {
-        for (const message of await args.channel.poll(inbox, 0)) {
+    for (const inbox of inboxes) {
+        for (const message of await channel.poll(inbox, 0)) {
             if (seen.has(message.id))
                 continue;
             seen.add(message.id);
@@ -318,12 +357,12 @@ export async function refreshInboxSurface(args) {
         }
     }
     if (messages.length === 0)
-        return { cursor, rendered: false };
+        return { count: sends.length, rendered: false };
     messages.sort((a, b) => a.deliveredAt - b.deliveredAt || a.id.localeCompare(b.id));
     await writeInboxSurface(args.desktop, args.deployed.surfaceDir, messages, {
         ...(args.originMap === undefined ? {} : { originMap: args.originMap }),
         ...(args.requestTimeoutMs === undefined ? {} : { requestTimeoutMs: args.requestTimeoutMs })
     });
-    return { cursor, rendered: true };
+    return { count: sends.length, rendered: true };
 }
 //# sourceMappingURL=comms-sandbox-catch.js.map

package/dist/comms-sandbox-catch.js.map

@@ -1 +1 @@
-{"version":3,"file":"comms-sandbox-catch.js","sourceRoot":"","sources":["../src/comms-sandbox-catch.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,wGAAwG;AACxG,uGAAuG;AACvG,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,oGAAoG;AACpG,4FAA4F;AAG5F,OAAO,EAAE,wBAAwB,EAA4B,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAA2B,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAyB,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAuB,MAAM,mBAAmB,CAAC;AAG9E;;8EAE8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEhD,iDAAiD;AACjD,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmGnC,CAAC;AA6BF;0GAC0G;AAC1G,KAAK,UAAU,YAAY,CACzB,OAA0B,EAC1B,IAAY,EACZ,OAAyE;IAEzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAC3C,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ;aAClC,GAAG,CAAC,yCAAyC,IAAI,6BAA6B,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;aAC/H,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,IAAI,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA0B,EAC1B,UAAmC,EAAE;IAErC,kGAAkG;IAClG,sGAAsG;IACtG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,0BAA0B,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,iBAAiB,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,aAAa,CAAC;IAC3C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC5D,MAAM,UAAU,GAAG,GAAG,GAAG,WAAW,CAAC;IACrC,MAAM,cAAc,GAAG,GAAG,GAAG,oBAAoB,CAAC;IAClD,MAAM,UAAU,GAAG,GAAG,GAAG,UAAU,CAAC;IAEpC,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5F,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IAC5D,MAAM,oBAAoB,CAAC,OAAO,EAAE;QAClC,IAAI;QACJ,OAAO,EAAE,WAAW,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE;QACvF,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;QAC9C,SAAS,EAAE,OAAO,CAAC,cAAc,IAAI,MAAM;QAC3C,gBAAgB;QAChB,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;KAC1B,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,IAAI,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA0B,EAC1B,QAAoD,EACpD,MAAM,GAAG,CAAC,EACV,gBAAgB,GAAG,MAAM;IAEzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,sBAAsB,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3H,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxE,oGAAoG;IACpG,oGAAoG;IACpG,sGAAsG;IACtG,wEAAwE;IACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YAC3D,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAwB,EACxB,OAAqB,EACrB,WAA+B,sBAAsB;IAErD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACxC,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,GAAG,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC5E,IAAI,EAAE,UAAU,CAAC,IAAI;aACtB,CAAC,CAAC;YACH,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAQxC;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC3D,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,OAAO,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YACxD,yFAAyF;YACzF,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACzE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,wBAAwB,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA0B,EAC1B,UAAkB,EAClB,QAAwB,EACxB,UAA8D,EAAE;IAEhE,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,uFAAuF;IACvF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,MAAM,EAAE,CAAC,CAAC;IACjI,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAQzC;IACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,OAAO,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC9D,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE;QACxE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;KAC5F,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"comms-sandbox-catch.js","sourceRoot":"","sources":["../src/comms-sandbox-catch.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,wGAAwG;AACxG,uGAAuG;AACvG,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,oGAAoG;AACpG,4FAA4F;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAA4B,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAA2B,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAyB,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAuB,MAAM,mBAAmB,CAAC;AAG9E;;8EAE8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEhD,iDAAiD;AACjD,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoHnC,CAAC;AAoCF;0GAC0G;AAC1G,KAAK,UAAU,YAAY,CACzB,OAA0B,EAC1B,IAAY,EACZ,OAAyE;IAEzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAC3C,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ;aAClC,GAAG,CAAC,yCAAyC,IAAI,6BAA6B,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;aAC/H,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,IAAI,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA0B,EAC1B,UAAmC,EAAE;IAErC,kGAAkG;IAClG,sGAAsG;IACtG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,0BAA0B,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACtG,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,GAAG,MAAM,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5H,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,iBAAiB,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,aAAa,CAAC;IAC3C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC5D,MAAM,UAAU,GAAG,GAAG,GAAG,WAAW,CAAC;IACrC,MAAM,cAAc,GAAG,GAAG,GAAG,oBAAoB,CAAC;IAClD,MAAM,UAAU,GAAG,GAAG,GAAG,UAAU,CAAC;IAEpC,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5F,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IAC5D,MAAM,oBAAoB,CAAC,OAAO,EAAE;QAClC,IAAI;QACJ,OAAO,EAAE,WAAW,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,EAAE;QACxI,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,cAAc,IAAI,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;IAC3G,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACvD,wGAAwG;IACxG,kFAAkF;IAClF,MAAM,UAAU,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAClG,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,oBAAoB,IAAI,EAAE;QACnC,cAAc;QACd,UAAU;QACV,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,KAAK,EAAE,KAAK,IAAI,UAAU;KAC3B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA0B,EAC1B,QAAoD,EACpD,MAAM,GAAG,CAAC,EACV,gBAAgB,GAAG,MAAM;IAEzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,sBAAsB,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3H,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxE,oGAAoG;IACpG,oGAAoG;IACpG,sGAAsG;IACtG,wEAAwE;IACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YAC3D,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAwB,EACxB,OAAqB,EACrB,WAA+B,sBAAsB;IAErD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACxC,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,GAAG,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC5E,IAAI,EAAE,UAAU,CAAC,IAAI;aACtB,CAAC,CAAC;YACH,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAQxC;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC3D,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,OAAO,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YACxD,yFAAyF;YACzF,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACzE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,wBAAwB,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA0B,EAC1B,UAAkB,EAClB,QAAwB,EACxB,UAA8D,EAAE;IAEhE,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,uFAAuF;IACvF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,MAAM,EAAE,CAAC,CAAC;IACjI,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAOzC;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACtH,MAAM,OAAO,GAAG,IAAI,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACzH,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,OAAO,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YACnD,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3E,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE;QACxE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;KAC5F,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC"}

package/dist/comms-types.d.ts

@@ -4,7 +4,7 @@ export interface CommsAddress {
     channel: CommsChannelKind;
     /** Which lane owns this inbox. */
     actorId: string;
-    /** Runtime-only raw address, e.g. patient-07@example.test | +15550137. */
+    /** Runtime-only raw address, e.g. user-07@example.test | +15550137. */
     value: string;
     /** sha256-short(value) — the only form persisted (redaction.digestText). */
     digest: string;

package/dist/concurrent-shared-world-lab.js

@@ -39,9 +39,10 @@ import { adapterScoreFailureMessage, applyBrowserAdapterHooks } from "./adapter-
 import { actorRegistry, isCuaActorDescriptor } from "./actor-registry.js";
 import { toErrorMessage } from "./command-failure.js";
 import { mapWithConcurrency } from "./concurrency.js";
-import { commandDigestOf, composeLaneInstructions, defaultPackLocalTree, provisionCloneSubject, provisionLocalTreeSubject, declaredScreenForRender, resolveLaneDevice, resolveSubjectState, runCuaLane } from "./cua-actor-lab.js";
-import { DEFAULT_SANDBOX_CATCH_PORT, collectCommsThread, deployCommsCatch } from "./comms-sandbox-catch.js";
+import { commandDigestOf, composeLaneInstructions, defaultPackLocalTree, provisionCloneSubject, provisionLocalTreeSubject, declaredScreenForRender, laneHasInboxRecipient, resolveLaneDevice, resolveSubjectState, runCuaLane, withInboxMission } from "./cua-actor-lab.js";
+import { DEFAULT_SANDBOX_CATCH_PORT, collectCommsThread, deployCommsCatch, refreshInboxSurface, writeInboxSurface } from "./comms-sandbox-catch.js";
 import { FakeInbox } from "./comms-fake-inbox.js";
+import { buildOriginMap } from "./comms-inbox.js";
 import { createDesktopSandbox, loadE2BDesktopModule } from "./e2b-desktop-launch.js";
 import { concurrentSharedWorldValidationReason, externalPublicSharedWorldValidationReason } from "./lab-config.js";
 import { buildObserverData } from "./observer-data.js";
@@ -558,6 +559,13 @@ export async function runConcurrentSharedWorld(options) {
     let subjectSandboxId;
     let subjectKilled = false;
     let getHostUrl;
+    // Persona inbox SURFACE (#297 slice B, shared-world): the getHost-exposed inbox URL a persona (in a
+    // DIFFERENT sandbox) opens, the serve->getHost origin-rewrite map (REQUIRED here so the app's loopback
+    // verify links resolve to a reachable host), and the dedicated surface channel + render loop.
+    let commsInboxUrl;
+    let commsOriginMap = [];
+    let surfaceRenderedCount = 0;
+    let surfaceLoop;
     let runError;
     let snapshotIndex = 0;
     let liveObserver;
@@ -698,9 +706,11 @@ export async function runConcurrentSharedWorld(options) {
             // (injected into its env at create) resolves the moment it boots. Fail closed if the catch can't
             // stand up rather than let a comms-declared app silently send real mail to the internet.
             if (commsEmail && commsPort !== undefined) {
-                deployedComms = await deployCommsCatch(subjectDesktop, { port: commsPort, requestTimeoutMs, timers });
+                // A SECOND (0.0.0.0) read-only inbox listener on commsPort+1 so the persona — which lives in a
+                // DIFFERENT sandbox here — can reach the inbox surface via getHost; capture stays loopback.
+                deployedComms = await deployCommsCatch(subjectDesktop, { port: commsPort, inboxPort: commsPort + 1, requestTimeoutMs, timers });
                 if (!deployedComms.ready) {
-                    throw new Error(`comms email catch did not become ready on 127.0.0.1:${commsPort} in the subject sandbox`);
+                    throw new Error(`comms email catch did not become ready in the subject sandbox (loopback capture ${commsPort} / inbox ${commsPort + 1})`);
                 }
             }
             // Provision the ONE shared plane: clone + install/build + seed + serve on 0.0.0.0 + probe
@@ -748,6 +758,61 @@ export async function runConcurrentSharedWorld(options) {
                 throw new Error("getHost returned a non-tokenless URL; refusing to persist a host URL that may carry a credential (invariant 1)");
             }
             getHostUrl = hostUrl;
+            // Persona inbox SURFACE (#297 slice B, shared-world): getHost-expose the read-only inbox listener so
+            // a persona in a DIFFERENT sandbox can open it; build the serve->getHost origin map (REQUIRED here —
+            // the app's loopback verify links must be rewritten to a reachable host); provision the surface
+            // channel; write the EMPTY inbox up front (so /inbox never 404s); and start a render loop that drains
+            // + re-renders on a cadence. The loop shares the prober's dispose signal (disposed together, before
+            // the teardown evidence drain), and uses a DEDICATED FakeInbox + cursor (independent of that drain).
+            if (commsEmail && deployedComms?.inboxPort !== undefined) {
+                const rawInboxHost = subjectDesktop.getHost(deployedComms.inboxPort);
+                const inboxHostUrl = /^https?:\/\//i.test(rawInboxHost) ? rawInboxHost : `https://${rawInboxHost}`;
+                if (!isTokenlessHost(inboxHostUrl)) {
+                    throw new Error("getHost returned a non-tokenless URL for the comms inbox; refusing to advertise it (invariant 1)");
+                }
+                commsInboxUrl = `${inboxHostUrl}/inbox`;
+                commsOriginMap = buildOriginMap({
+                    internalServeUrl: serve.url,
+                    reachableBaseUrl: getHostUrl,
+                    ...(commsEmail.linkOrigin === undefined ? {} : { linkOrigin: commsEmail.linkOrigin })
+                });
+                const surfaceRecipients = (commsEmail.recipients ?? [])
+                    .filter((recipient) => recipient.address !== undefined)
+                    .map((recipient) => ({ lane: recipient.lane, address: recipient.address }));
+                await writeInboxSurface(subjectDesktop, deployedComms.surfaceDir, [], { originMap: commsOriginMap, requestTimeoutMs });
+                const surfaceDeployed = deployedComms;
+                const surfaceCadenceMs = 2500;
+                surfaceLoop = (async () => {
+                    // Full, idempotent rebuild each tick; surfaceRenderedCount advances only on a successful render,
+                    // so a transient failure retries cleanly. Real timer (dispose-interruptible + cleared) — an
+                    // unbounded loop must not busy-spin on the injected instant clock.
+                    for (;;) {
+                        try {
+                            const refreshed = await refreshInboxSurface({
+                                desktop: subjectDesktop,
+                                deployed: surfaceDeployed,
+                                recipients: surfaceRecipients,
+                                sinceCount: surfaceRenderedCount,
+                                originMap: commsOriginMap,
+                                requestTimeoutMs
+                            });
+                            if (refreshed.rendered)
+                                surfaceRenderedCount = refreshed.count;
+                        }
+                        catch {
+                            // Never throw into the render loop; the teardown drain + by-id teardown must still run.
+                        }
+                        if (proberDisposed)
+                            break;
+                        await new Promise((resolve) => {
+                            const timer = setTimeout(resolve, surfaceCadenceMs);
+                            void disposeSignal.then(() => { clearTimeout(timer); resolve(); });
+                        });
+                        if (proberDisposed)
+                            break;
+                    }
+                })();
+            }
             // Baseline state snapshot, then start the background cadence prober.
             await proberSnapshot();
             if (options.onObserverReady) {
@@ -840,8 +905,13 @@ export async function runConcurrentSharedWorld(options) {
             };
             actorResults = await mapWithConcurrency(actorSpecs, Math.max(1, concurrency), async (spec, i) => {
                 const route = resolveActorSeatUrl(getHostUrl, roles[i]?.entry);
+                // Tell this persona its (getHost-reachable) inbox URL — but only when comms is live AND this lane
+                // has a declared recipient it can actually receive mail into (else it would stall on an empty inbox).
+                const laneSpec = commsEmail && commsInboxUrl && laneHasInboxRecipient(commsEmail, spec.laneId)
+                    ? withInboxMission(spec, commsInboxUrl)
+                    : spec;
                 const startedAt = now();
-                const outcome = await runCuaLane(spec, { ...baseActorDeps, appUrl: route });
+                const outcome = await runCuaLane(laneSpec, { ...baseActorDeps, appUrl: route });
                 const endedAt = now();
                 return { spec, outcome, startedAt, endedAt, route };
             });
@@ -858,6 +928,11 @@ export async function runConcurrentSharedWorld(options) {
             if (proberLoop) {
                 await proberLoop.catch(() => undefined);
             }
+            // Stop the inbox-surface render loop too (shares the prober's dispose signal), before the teardown
+            // evidence drain below — so the two in-sandbox reads never overlap and the surface state is final.
+            if (surfaceLoop) {
+                await surfaceLoop.catch(() => undefined);
+            }
             if (subjectDesktop && getHostUrl) {
                 await proberSnapshot().catch(() => undefined);
             }