humanish 0.95.0 → 0.96.1

package/dist/concurrent-shared-world-lab.js

@@ -1,3 +1,6 @@
+import { withTransientCommsSecrets } from "./run-narration-secrets.js";
+import { prepareReceivingRun, receivingPublication } from "./comms-receiving-runtime.js";
+import { receivingEmailValidationReason } from "./lab-config.js";
 // The CONCURRENT shared-world lab backend (#164 phase 2): N persona lanes drive ONE shared,
 // mutable service plane SIMULTANEOUSLY — the actual leverage of a sim. A recomposition of shipped
 // pieces + the getHost wrapper:
@@ -502,6 +505,9 @@ function observerResultForConcurrentArtifacts(cwd, runId, artifactRoot, warnings
  * ticking into a directory something else is deleting, which surfaces as an unrelated ENOTEMPTY.
  */
 export async function runConcurrentSharedWorld(options) {
+    return withTransientCommsSecrets(() => runConcurrentSharedWorldWithSecrets(options));
+}
+async function runConcurrentSharedWorldWithSecrets(options) {
     const analysis = resolveAutomaticAnalysis(options.config.review?.analysis);
     const result = await withRunStatusScope(() => runConcurrentSharedWorldInScope(options));
     return completeAutomaticAnalysis(result, analysis.ok ? analysis.config : undefined, options.automaticAnalysis, options.config.review?.analysis === undefined ? "default" : "explicit", analysis.ok && analysis.preferLargerOutput === true);
@@ -581,6 +587,9 @@ async function runConcurrentSharedWorldInScope(options) {
     // The per-seat vision lobby-code reader (default: the real single-frame OpenAI read). Injectable so the
     // barrier's handoff + convergence proof are testable without a live vision call.
     const readLobbyCode = hooks.readLobbyCodeFromFrame ?? readLobbyCodeFromFrame;
+    const receivingReason = receivingEmailValidationReason(config);
+    if (receivingReason)
+        return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_INVALID", receivingReason, descriptor.id);
     const openaiApiKey = env.OPENAI_API_KEY?.trim() ?? "";
     const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
     const knownSecretValues = [
@@ -659,7 +668,7 @@ async function runConcurrentSharedWorldInScope(options) {
     // sandbox at create (fixed port known up front); the catch is deployed before serve; the drain + digest
     // evidence run at subject teardown, then register run-level in the bundle. NOT available on the
     // external-public plane (the app is an operator-owned deployment the harness never provisions).
-    const commsEmail = planeClass === "provisioned-getHost" ? config.comms?.email : undefined;
+    const commsEmail = planeClass === "provisioned-getHost" && config.comms?.email?.kind === "fake" ? config.comms.email : undefined;
     const commsPort = commsEmail ? (commsEmail.port ?? DEFAULT_SANDBOX_CATCH_PORT) : undefined;
     // injectEnv is absent on an adopter-hosted plane (#328): there is no subject env to inject
     // because the operator points their own app at their own catch.
@@ -674,7 +683,7 @@ async function runConcurrentSharedWorldInScope(options) {
     // the previously-inert block into a working one.
     const externalComms = planeClass === "external-public" ? config.comms?.email?.external : undefined;
     const externalCommsEmail = externalComms ? config.comms?.email : undefined;
-    if (config.comms?.email && planeClass === "external-public" && externalComms === undefined) {
+    if (config.comms?.email?.kind === "fake" && planeClass === "external-public" && externalComms === undefined) {
         warnings.push("comms.email is declared but this is the external-public plane (the shared plane is an operator-owned public deployment the harness does not provision) — the in-sandbox email catch cannot be deployed and no comms evidence is collected. Declare `comms.email.external` to host the catch yourself (#328).");
     }
     if (externalComms) {
@@ -741,235 +750,393 @@ async function runConcurrentSharedWorldInScope(options) {
             return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_FAILED", `local-tree packing failed: ${redactText(scrubKnownValues(toErrorMessage(error)))}`, descriptor.id);
         }
     }
-    if (!dryRun && planeClass === "provisioned-getHost") {
-        if (!serve) {
-            // Defense-in-depth: concurrentSharedWorldValidationReason already required serve above.
-            return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_INVALID", "the provisioned-getHost concurrent shared-world route requires `subject.serve`.", descriptor.id);
-        }
-        let subjectModule;
-        let subjectDesktop;
-        // The in-sandbox email catch on the ONE subject sandbox (#297); drained at teardown. Undefined
-        // unless a comms lab declared it. Hoisted so the finally can drain before the subject is killed.
-        let deployedComms;
-        // Background prober dispose signal (FIX-9: cleared in finally).
-        let proberDisposed = false;
-        let releaseDispose = () => { };
-        const disposeSignal = new Promise((resolve) => { releaseDispose = resolve; });
-        let proberLoop;
-        const proberSnapshot = async () => {
-            if (!subjectDesktop)
-                return;
-            const timestamp = now();
-            const idx = snapshotIndex;
-            snapshotIndex += 1;
-            const snapshot = await runCheckpointSnapshot({
-                desktop: subjectDesktop,
-                snapshotIndex: idx,
-                name: `state-${idx}`,
-                checkpoints,
-                prevDigest: undefined,
-                scrub: scrubKnownValues,
-                requestTimeoutMs,
-                timers
-            });
-            stateSnapshots.push({ timestamp, digest: snapshot.digest });
-        };
+    let receiving;
+    if (!dryRun && config.comms?.email?.kind === "real") {
         try {
-            subjectModule = await (hooks.loadDesktopModule ?? loadE2BDesktopModule)();
-            // The ONE subject sandbox: headless service host (no GUI seat). The SUBJECT env is provisioned
-            // HERE; the actor sandboxes get NONE of it (FIX-10). A custom desktop template (image) is
-            // honored on BOTH the subject sandbox (here) and every actor sandbox (via runCuaLane, which
-            // reads the same config); absent keeps the byte-stable Sandbox.create(opts) default.
-            subjectDesktop = await createDesktopSandbox(subjectModule, {
-                apiKey: e2bApiKey,
-                requestTimeoutMs,
-                timeoutMs: timeoutMs + SUBJECT_PROVISION_BUDGET_MS
-                    + (config.subject.state?.seed ?? []).reduce((sum, step) => sum + (step.timeoutMs ?? DEFAULT_STATE_STEP_TIMEOUT_MS), 0)
-                    + SANDBOX_TIMEOUT_BUFFER_MS,
-                metadata: {
-                    ...CONCURRENT_SHARED_WORLD_PROVIDER_METADATA,
-                    labId: config.id,
-                    topology: "shared-world",
-                    topologyMode: "concurrent",
-                    role: "subject",
-                    roleCount: String(roles.length)
-                },
-                ...(subjectEnvNames.length > 0 || Object.keys(commsEnv).length > 0
-                    ? { envs: { ...Object.fromEntries(subjectEnvNames.map((name) => [name, env[name]])), ...commsEnv } }
-                    : {}),
-                dpi: 96,
-                lifecycle: { onTimeout: "kill" }
-            }, config.execution?.desktop?.template);
-            subjectSandboxId = subjectDesktop.sandboxId;
-            // #358 salvage: durable id receipt the moment the subject sandbox exists.
-            await appendSandboxReceipt(runPaths, { at: new Date().toISOString(), laneId: "subject", sandboxId: subjectSandboxId });
-            if (hooks.prepareDesktop) {
-                await hooks.prepareDesktop(subjectDesktop);
-            }
-            // Start the in-sandbox email catch BEFORE the subject serve, so the app's send-API base URL
-            // (injected into its env at create) resolves the moment it boots. Fail closed if the catch can't
-            // stand up rather than let a comms-declared app silently send real mail to the internet.
-            if (commsEmail && commsPort !== undefined) {
-                // A SECOND (0.0.0.0) read-only inbox listener on commsPort+1 so the persona — which lives in a
-                // DIFFERENT sandbox here — can reach the inbox surface via getHost; capture stays loopback.
-                deployedComms = await deployCommsCatch(subjectDesktop, { port: commsPort, inboxPort: commsPort + 1, requestTimeoutMs, timers });
-                if (!deployedComms.ready) {
-                    throw new Error(`comms email catch did not become ready in the subject sandbox (loopback capture ${commsPort} / inbox ${commsPort + 1})`);
-                }
-            }
-            // Provision the ONE shared plane: clone + install/build + seed + serve on 0.0.0.0 + probe
-            // (clone route), or upload/extract the once-per-run packed archive + the SAME shared serve
-            // pipeline (local-tree route).
-            const onSubjectPhase = hooks.onPhase ?? ((event) => {
-                process.stderr.write(`humanish shared-world (concurrent): ${event.message}${event.durationMs === undefined ? "" : ` (${event.durationMs}ms)`}\n`);
+            receiving = await prepareReceivingRun({ cwd, runId, config, env, participants: actorSpecs.map(spec => spec.laneId), runPaths,
+                registerSecrets: values => { for (const value of values)
+                    if (value.length >= 4 && !knownSecretValues.includes(value))
+                        knownSecretValues.push(value); }
             });
-            if (localTreeRoute) {
-                await provisionLocalTreeSubject(subjectDesktop, {
-                    archiveBuffer: localTreeArchiveBuffer,
-                    serve,
-                    ...(config.subject.state === undefined ? {} : { state: config.subject.state }),
-                    requestTimeoutMs,
-                    scrub: scrubKnownValues,
-                    onStateStep: (record) => { stateStepRecords.push(record); },
-                    onPhase: onSubjectPhase,
-                    ...timers
-                });
+            commsArtifactPath = "comms/receiving.json";
+        }
+        catch {
+            return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_INVALID", "Real email setup failed before desktop allocation. Run humanish comms check --online and humanish comms recover to inspect authentication and pending cleanup.", descriptor.id);
+        }
+    }
+    try {
+        if (!dryRun && planeClass === "provisioned-getHost") {
+            if (!serve) {
+                // Defense-in-depth: concurrentSharedWorldValidationReason already required serve above.
+                return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_INVALID", "the provisioned-getHost concurrent shared-world route requires `subject.serve`.", descriptor.id);
             }
-            else {
-                subjectCommit = await provisionCloneSubject(subjectDesktop, {
-                    repo: subjectRepo,
-                    depth: config.subject.clone?.depth ?? 1,
-                    serve,
-                    ...(config.subject.state === undefined ? {} : { state: config.subject.state }),
-                    hasGithubToken,
-                    requestTimeoutMs,
+            let subjectModule;
+            let subjectDesktop;
+            // The in-sandbox email catch on the ONE subject sandbox (#297); drained at teardown. Undefined
+            // unless a comms lab declared it. Hoisted so the finally can drain before the subject is killed.
+            let deployedComms;
+            // Background prober dispose signal (FIX-9: cleared in finally).
+            let proberDisposed = false;
+            let releaseDispose = () => { };
+            const disposeSignal = new Promise((resolve) => { releaseDispose = resolve; });
+            let proberLoop;
+            const proberSnapshot = async () => {
+                if (!subjectDesktop)
+                    return;
+                const timestamp = now();
+                const idx = snapshotIndex;
+                snapshotIndex += 1;
+                const snapshot = await runCheckpointSnapshot({
+                    desktop: subjectDesktop,
+                    snapshotIndex: idx,
+                    name: `state-${idx}`,
+                    checkpoints,
+                    prevDigest: undefined,
                     scrub: scrubKnownValues,
-                    onCommit: (commit) => { subjectCommit = commit; },
-                    onStateStep: (record) => { stateStepRecords.push(record); },
-                    onPhase: onSubjectPhase,
-                    ...timers
+                    requestTimeoutMs,
+                    timers
                 });
-            }
-            // Expose the served port via getHost (FIX-2). Fail closed if the SDK lacks it.
-            if (typeof subjectDesktop.getHost !== "function") {
-                throw new Error("the installed @e2b/desktop SDK does not expose getHost(port); the concurrent shared-world route requires it to reach the subject plane");
-            }
-            // getHost returns a BARE host (e.g. "3000-<sandboxId>.e2b.app", no scheme); e2b exposes the
-            // port over https. Normalize to a full URL before the tokenless check + before persisting.
-            const rawHost = subjectDesktop.getHost(servePort(serve.url));
-            const hostUrl = /^https?:\/\//i.test(rawHost) ? rawHost : `https://${rawHost}`;
-            if (!isTokenlessHost(hostUrl)) {
-                throw new Error("getHost returned a non-tokenless URL; refusing to persist a host URL that may carry a credential (invariant 1)");
-            }
-            getHostUrl = hostUrl;
-            // Persona inbox SURFACE (#297 slice B, shared-world): getHost-expose the read-only inbox listener so
-            // a persona in a DIFFERENT sandbox can open it; build the serve->getHost origin map (REQUIRED here —
-            // the app's loopback verify links must be rewritten to a reachable host); provision the surface
-            // channel; write the EMPTY inbox up front (so /inbox never 404s); and start a render loop that drains
-            // + re-renders on a cadence. The loop shares the prober's dispose signal (disposed together, before
-            // the teardown evidence drain), and uses a DEDICATED FakeInbox + cursor (independent of that drain).
-            if (commsEmail && deployedComms?.inboxPort !== undefined) {
-                const rawInboxHost = subjectDesktop.getHost(deployedComms.inboxPort);
-                const inboxHostUrl = /^https?:\/\//i.test(rawInboxHost) ? rawInboxHost : `https://${rawInboxHost}`;
-                if (!isTokenlessHost(inboxHostUrl)) {
-                    throw new Error("getHost returned a non-tokenless URL for the comms inbox; refusing to advertise it (invariant 1)");
+                stateSnapshots.push({ timestamp, digest: snapshot.digest });
+            };
+            try {
+                subjectModule = await (hooks.loadDesktopModule ?? loadE2BDesktopModule)();
+                // The ONE subject sandbox: headless service host (no GUI seat). The SUBJECT env is provisioned
+                // HERE; the actor sandboxes get NONE of it (FIX-10). A custom desktop template (image) is
+                // honored on BOTH the subject sandbox (here) and every actor sandbox (via runCuaLane, which
+                // reads the same config); absent keeps the byte-stable Sandbox.create(opts) default.
+                subjectDesktop = await createDesktopSandbox(subjectModule, {
+                    apiKey: e2bApiKey,
+                    requestTimeoutMs,
+                    timeoutMs: timeoutMs + SUBJECT_PROVISION_BUDGET_MS
+                        + (config.subject.state?.seed ?? []).reduce((sum, step) => sum + (step.timeoutMs ?? DEFAULT_STATE_STEP_TIMEOUT_MS), 0)
+                        + SANDBOX_TIMEOUT_BUFFER_MS,
+                    metadata: {
+                        ...CONCURRENT_SHARED_WORLD_PROVIDER_METADATA,
+                        labId: config.id,
+                        topology: "shared-world",
+                        topologyMode: "concurrent",
+                        role: "subject",
+                        roleCount: String(roles.length)
+                    },
+                    ...(subjectEnvNames.length > 0 || Object.keys(commsEnv).length > 0
+                        ? { envs: { ...Object.fromEntries(subjectEnvNames.map((name) => [name, env[name]])), ...commsEnv } }
+                        : {}),
+                    dpi: 96,
+                    lifecycle: { onTimeout: "kill" }
+                }, config.execution?.desktop?.template);
+                subjectSandboxId = subjectDesktop.sandboxId;
+                // #358 salvage: durable id receipt the moment the subject sandbox exists.
+                await appendSandboxReceipt(runPaths, { at: new Date().toISOString(), laneId: "subject", sandboxId: subjectSandboxId });
+                if (hooks.prepareDesktop) {
+                    await hooks.prepareDesktop(subjectDesktop);
                 }
-                commsInboxUrl = `${inboxHostUrl}/inbox`;
-                commsOriginMap = buildOriginMap({
-                    internalServeUrl: serve.url,
-                    reachableBaseUrl: getHostUrl,
-                    ...(commsEmail.linkOrigin === undefined ? {} : { linkOrigin: commsEmail.linkOrigin })
+                // Start the in-sandbox email catch BEFORE the subject serve, so the app's send-API base URL
+                // (injected into its env at create) resolves the moment it boots. Fail closed if the catch can't
+                // stand up rather than let a comms-declared app silently send real mail to the internet.
+                if (commsEmail && commsPort !== undefined) {
+                    // A SECOND (0.0.0.0) read-only inbox listener on commsPort+1 so the persona — which lives in a
+                    // DIFFERENT sandbox here — can reach the inbox surface via getHost; capture stays loopback.
+                    deployedComms = await deployCommsCatch(subjectDesktop, { port: commsPort, inboxPort: commsPort + 1, requestTimeoutMs, timers });
+                    if (!deployedComms.ready) {
+                        throw new Error(`comms email catch did not become ready in the subject sandbox (loopback capture ${commsPort} / inbox ${commsPort + 1})`);
+                    }
+                }
+                // Provision the ONE shared plane: clone + install/build + seed + serve on 0.0.0.0 + probe
+                // (clone route), or upload/extract the once-per-run packed archive + the SAME shared serve
+                // pipeline (local-tree route).
+                const onSubjectPhase = hooks.onPhase ?? ((event) => {
+                    process.stderr.write(`humanish shared-world (concurrent): ${event.message}${event.durationMs === undefined ? "" : ` (${event.durationMs}ms)`}\n`);
                 });
-                const surfaceRecipients = (commsEmail.recipients ?? [])
-                    .filter((recipient) => recipient.address !== undefined)
-                    .map((recipient) => ({ lane: recipient.lane, address: recipient.address }));
-                await writeInboxSurface(subjectDesktop, deployedComms.surfaceDir, [], { originMap: commsOriginMap, requestTimeoutMs });
-                const surfaceDeployed = deployedComms;
-                const surfaceCadenceMs = 2500;
-                surfaceLoop = (async () => {
-                    // Full, idempotent rebuild each tick; surfaceRenderedCount advances only on a successful render,
-                    // so a transient failure retries cleanly. Real timer (dispose-interruptible + cleared) — an
-                    // unbounded loop must not busy-spin on the injected instant clock.
-                    for (;;) {
-                        try {
-                            const refreshed = await refreshInboxSurface({
-                                desktop: subjectDesktop,
-                                deployed: surfaceDeployed,
-                                recipients: surfaceRecipients,
-                                sinceCount: surfaceRenderedCount,
-                                originMap: commsOriginMap,
-                                requestTimeoutMs
+                if (localTreeRoute) {
+                    await provisionLocalTreeSubject(subjectDesktop, {
+                        archiveBuffer: localTreeArchiveBuffer,
+                        serve,
+                        ...(config.subject.state === undefined ? {} : { state: config.subject.state }),
+                        requestTimeoutMs,
+                        scrub: scrubKnownValues,
+                        onStateStep: (record) => { stateStepRecords.push(record); },
+                        onPhase: onSubjectPhase,
+                        ...timers
+                    });
+                }
+                else {
+                    subjectCommit = await provisionCloneSubject(subjectDesktop, {
+                        repo: subjectRepo,
+                        depth: config.subject.clone?.depth ?? 1,
+                        serve,
+                        ...(config.subject.state === undefined ? {} : { state: config.subject.state }),
+                        hasGithubToken,
+                        requestTimeoutMs,
+                        scrub: scrubKnownValues,
+                        onCommit: (commit) => { subjectCommit = commit; },
+                        onStateStep: (record) => { stateStepRecords.push(record); },
+                        onPhase: onSubjectPhase,
+                        ...timers
+                    });
+                }
+                // Expose the served port via getHost (FIX-2). Fail closed if the SDK lacks it.
+                if (typeof subjectDesktop.getHost !== "function") {
+                    throw new Error("the installed @e2b/desktop SDK does not expose getHost(port); the concurrent shared-world route requires it to reach the subject plane");
+                }
+                // getHost returns a BARE host (e.g. "3000-<sandboxId>.e2b.app", no scheme); e2b exposes the
+                // port over https. Normalize to a full URL before the tokenless check + before persisting.
+                const rawHost = subjectDesktop.getHost(servePort(serve.url));
+                const hostUrl = /^https?:\/\//i.test(rawHost) ? rawHost : `https://${rawHost}`;
+                if (!isTokenlessHost(hostUrl)) {
+                    throw new Error("getHost returned a non-tokenless URL; refusing to persist a host URL that may carry a credential (invariant 1)");
+                }
+                getHostUrl = hostUrl;
+                // Persona inbox SURFACE (#297 slice B, shared-world): getHost-expose the read-only inbox listener so
+                // a persona in a DIFFERENT sandbox can open it; build the serve->getHost origin map (REQUIRED here —
+                // the app's loopback verify links must be rewritten to a reachable host); provision the surface
+                // channel; write the EMPTY inbox up front (so /inbox never 404s); and start a render loop that drains
+                // + re-renders on a cadence. The loop shares the prober's dispose signal (disposed together, before
+                // the teardown evidence drain), and uses a DEDICATED FakeInbox + cursor (independent of that drain).
+                if (commsEmail && deployedComms?.inboxPort !== undefined) {
+                    const rawInboxHost = subjectDesktop.getHost(deployedComms.inboxPort);
+                    const inboxHostUrl = /^https?:\/\//i.test(rawInboxHost) ? rawInboxHost : `https://${rawInboxHost}`;
+                    if (!isTokenlessHost(inboxHostUrl)) {
+                        throw new Error("getHost returned a non-tokenless URL for the comms inbox; refusing to advertise it (invariant 1)");
+                    }
+                    commsInboxUrl = `${inboxHostUrl}/inbox`;
+                    commsOriginMap = buildOriginMap({
+                        internalServeUrl: serve.url,
+                        reachableBaseUrl: getHostUrl,
+                        ...(commsEmail.linkOrigin === undefined ? {} : { linkOrigin: commsEmail.linkOrigin })
+                    });
+                    const surfaceRecipients = (commsEmail.recipients ?? [])
+                        .filter((recipient) => recipient.address !== undefined)
+                        .map((recipient) => ({ lane: recipient.lane, address: recipient.address }));
+                    await writeInboxSurface(subjectDesktop, deployedComms.surfaceDir, [], { originMap: commsOriginMap, requestTimeoutMs });
+                    const surfaceDeployed = deployedComms;
+                    const surfaceCadenceMs = 2500;
+                    surfaceLoop = (async () => {
+                        // Full, idempotent rebuild each tick; surfaceRenderedCount advances only on a successful render,
+                        // so a transient failure retries cleanly. Real timer (dispose-interruptible + cleared) — an
+                        // unbounded loop must not busy-spin on the injected instant clock.
+                        for (;;) {
+                            try {
+                                const refreshed = await refreshInboxSurface({
+                                    desktop: subjectDesktop,
+                                    deployed: surfaceDeployed,
+                                    recipients: surfaceRecipients,
+                                    sinceCount: surfaceRenderedCount,
+                                    originMap: commsOriginMap,
+                                    requestTimeoutMs
+                                });
+                                if (refreshed.rendered)
+                                    surfaceRenderedCount = refreshed.count;
+                            }
+                            catch {
+                                // Never throw into the render loop; the teardown drain + by-id teardown must still run.
+                            }
+                            if (proberDisposed)
+                                break;
+                            await new Promise((resolve) => {
+                                const timer = setTimeout(resolve, surfaceCadenceMs);
+                                void disposeSignal.then(() => { clearTimeout(timer); resolve(); });
                             });
-                            if (refreshed.rendered)
-                                surfaceRenderedCount = refreshed.count;
-                        }
-                        catch {
-                            // Never throw into the render loop; the teardown drain + by-id teardown must still run.
+                            if (proberDisposed)
+                                break;
                         }
+                    })();
+                }
+                // Baseline state snapshot, then start the background cadence prober.
+                await proberSnapshot();
+                if (options.onObserverReady) {
+                    const inProgressPlaneCommit = localTreeRoute ? localTreeArchive?.git?.commit : subjectCommit;
+                    const inProgressSubject = buildSubjectProvenance({
+                        localTreeRoute,
+                        publicRepo,
+                        subjectCommit: inProgressPlaneCommit,
+                        localTreeArchive,
+                        subjectEnvNames,
+                        state: resolveSubjectState({ declared: config.subject.state, dryRun: false, executed: stateStepRecords })
+                    });
+                    const inProgressBundle = buildConcurrentSharedWorldBundle({
+                        config,
+                        descriptor,
+                        createdAt,
+                        dryRun: false,
+                        inProgress: true,
+                        runId,
+                        source,
+                        roles,
+                        actorSpecs,
+                        actorResults: [],
+                        stateSnapshots,
+                        subject: inProgressSubject,
+                        seedDigest,
+                        ...(inProgressPlaneCommit === undefined ? {} : { subjectCommit: inProgressPlaneCommit }),
+                        hostDigest: hostOriginDigest(getHostUrl)
+                    });
+                    await writeConcurrentRunArtifacts(inProgressBundle, runPaths);
+                    liveObserver = observerResultForConcurrentArtifacts(cwd, runId, artifactRoot, [
+                        "Live concurrent shared-world Observer is attached before final verification; stream auth URLs are runtime-only and are not persisted."
+                    ]);
+                    await options.onObserverReady(liveObserver);
+                }
+                proberLoop = (async () => {
+                    while (!proberDisposed) {
+                        let timer;
+                        await Promise.race([
+                            new Promise((resolve) => { timer = setTimeout(resolve, proberCadenceMs); }),
+                            disposeSignal
+                        ]);
+                        if (timer)
+                            clearTimeout(timer); // FIX-9: no dangling prober timer.
                         if (proberDisposed)
                             break;
-                        await new Promise((resolve) => {
-                            const timer = setTimeout(resolve, surfaceCadenceMs);
-                            void disposeSignal.then(() => { clearTimeout(timer); resolve(); });
-                        });
-                        if (proberDisposed)
-                            break;
+                        await proberSnapshot().catch(() => undefined);
                     }
                 })();
-            }
-            // Baseline state snapshot, then start the background cadence prober.
-            await proberSnapshot();
-            if (options.onObserverReady) {
-                const inProgressPlaneCommit = localTreeRoute ? localTreeArchive?.git?.commit : subjectCommit;
-                const inProgressSubject = buildSubjectProvenance({
-                    localTreeRoute,
-                    publicRepo,
-                    subjectCommit: inProgressPlaneCommit,
-                    localTreeArchive,
-                    subjectEnvNames,
-                    state: resolveSubjectState({ declared: config.subject.state, dryRun: false, executed: stateStepRecords })
-                });
-                const inProgressBundle = buildConcurrentSharedWorldBundle({
+                // Launch N actor sandboxes CONCURRENTLY, INDEPENDENT (FIX-11: runCuaLane + mapWithConcurrency,
+                // NOT runCuaLanes — no pipeline gate / fail-fast). Each actor's window is measured on the ONE
+                // orchestrator clock (FIX-1). cloneRoute=false + subjectEnvNames=[] keep subject creds out of
+                // every actor sandbox (FIX-10).
+                const cuaHooks = {
+                    ...(hooks.loadDesktopModule ? { loadDesktopModule: hooks.loadDesktopModule } : {}),
+                    ...(hooks.detachedTimers ? { detachedTimers: hooks.detachedTimers } : {}),
+                    ...(hooks.env ? { env: hooks.env } : {}),
+                    ...(hooks.prepareDesktop ? { prepareDesktop: (desktop) => hooks.prepareDesktop(desktop) } : {}),
+                    onRuntimeStreamReady: (stream) => {
+                        runtimeStreamUrls.push({ streamId: stream.streamId, url: stream.url });
+                        if (liveObserver) {
+                            attachObserverRuntimeStreamUrls(liveObserver, runtimeStreamUrls);
+                        }
+                    },
+                    onRuntimeStreamEnded: (stream) => {
+                        // Mark, never remove (#357): the tile falls back to recorded evidence and says why.
+                        for (const entry of runtimeStreamUrls) {
+                            if (entry.streamId === stream.streamId)
+                                entry.ended = true;
+                        }
+                        if (liveObserver) {
+                            attachObserverRuntimeStreamUrls(liveObserver, runtimeStreamUrls);
+                        }
+                    }
+                };
+                const baseActorDeps = {
                     config,
                     descriptor,
-                    createdAt,
-                    dryRun: false,
-                    inProgress: true,
-                    runId,
-                    source,
-                    roles,
-                    actorSpecs,
-                    actorResults: [],
-                    stateSnapshots,
-                    subject: inProgressSubject,
-                    seedDigest,
-                    ...(inProgressPlaneCommit === undefined ? {} : { subjectCommit: inProgressPlaneCommit }),
-                    hostDigest: hostOriginDigest(getHostUrl)
+                    cloneRoute: false,
+                    subjectEnvNames: [],
+                    hasGithubToken: false,
+                    env,
+                    openaiApiKey,
+                    e2bApiKey,
+                    requestTimeoutMs,
+                    perLaneSandboxMs: timeoutMs + SANDBOX_TIMEOUT_BUFFER_MS,
+                    timeoutMs,
+                    laneCount: roles.length,
+                    artifactRoot: runPaths,
+                    labCwd: cwd,
+                    redactScreenshots,
+                    scrubKnownValues,
+                    runSession,
+                    ...(receiving ? { receiving } : {}),
+                    now,
+                    hooks: cuaHooks,
+                    ...(runBudget === undefined ? {} : { runBudget }),
+                    // Concurrent lanes are independent evidence seats: a requested-vs-verified screen
+                    // mismatch is recorded as separate facts + a warning instead of failing the lane's
+                    // device claim closed, so one seat's window-manager drift cannot abort the whole
+                    // live multi-actor world (the single-lane/fan-out routes keep fail-closed).
+                    screenMismatchPolicy: "record-evidence"
+                };
+                actorResults = await mapWithConcurrency(actorSpecs, Math.max(1, concurrency), async (spec, i) => {
+                    const route = resolveActorSeatUrl(getHostUrl, roles[i]?.entry);
+                    // Tell this persona its (getHost-reachable) inbox URL — but only when comms is live AND this lane
+                    // has a declared recipient it can actually receive mail into (else it would stall on an empty
+                    // inbox). Only the in-sandbox catch exists on this plane; the adopter-hosted catch is the
+                    // external-public plane's, wired in ITS execution block below (#387).
+                    const laneSpec = commsEmail && commsInboxUrl && laneHasInboxRecipient(commsEmail, spec.laneId)
+                        ? withInboxMission(spec, commsInboxUrl, inboxRecipientFor(commsEmail, spec.laneId)?.address)
+                        : spec;
+                    const startedAt = now();
+                    const outcome = await runCuaLane(laneSpec, { ...baseActorDeps, appUrl: route });
+                    const endedAt = now();
+                    return { spec, outcome, startedAt, endedAt, route };
                 });
-                await writeConcurrentRunArtifacts(inProgressBundle, runPaths);
-                liveObserver = observerResultForConcurrentArtifacts(cwd, runId, artifactRoot, [
-                    "Live concurrent shared-world Observer is attached before final verification; stream auth URLs are runtime-only and are not persisted."
-                ]);
-                await options.onObserverReady(liveObserver);
             }
-            proberLoop = (async () => {
-                while (!proberDisposed) {
-                    let timer;
-                    await Promise.race([
-                        new Promise((resolve) => { timer = setTimeout(resolve, proberCadenceMs); }),
-                        disposeSignal
-                    ]);
-                    if (timer)
-                        clearTimeout(timer); // FIX-9: no dangling prober timer.
-                    if (proberDisposed)
-                        break;
+            catch (error) {
+                runError = redactText(scrubKnownValues(toErrorMessage(error)));
+                warnings.push(`Concurrent shared-world run failed before completion: ${runError}`);
+            }
+            finally {
+                // FIX-9: stop the prober, take a final snapshot while the subject is still alive, then tear
+                // down the ONE subject sandbox BY id (the actor sandboxes are torn down inside runCuaLane).
+                proberDisposed = true;
+                releaseDispose();
+                if (proberLoop) {
+                    await proberLoop.catch(() => undefined);
+                }
+                // Stop the inbox-surface render loop too (shares the prober's dispose signal), before the teardown
+                // evidence drain below — so the two in-sandbox reads never overlap and the surface state is final.
+                if (surfaceLoop) {
+                    await surfaceLoop.catch(() => undefined);
+                }
+                if (subjectDesktop && getHostUrl) {
                     await proberSnapshot().catch(() => undefined);
                 }
-            })();
-            // Launch N actor sandboxes CONCURRENTLY, INDEPENDENT (FIX-11: runCuaLane + mapWithConcurrency,
-            // NOT runCuaLanes — no pipeline gate / fail-fast). Each actor's window is measured on the ONE
-            // orchestrator clock (FIX-1). cloneRoute=false + subjectEnvNames=[] keep subject creds out of
-            // every actor sandbox (FIX-10).
+                // Off-app comms evidence (#297): drain everything the in-sandbox catch captured, route it into a
+                // host fake inbox addressed to the declared recipients, and write the run-level digest-only thread
+                // artifact — while the subject is STILL alive, before it is killed below. Wrapped so a drain error
+                // never blocks teardown (invariant: all sandboxes torn down by id in this finally).
+                if (commsEmail && deployedComms?.ready && subjectDesktop) {
+                    try {
+                        const commsChannel = new FakeInbox();
+                        const commsInboxes = [];
+                        for (const recipient of commsEmail.recipients ?? []) {
+                            if (recipient.address !== undefined) {
+                                commsInboxes.push(await commsChannel.provisionAddress(recipient.lane, recipient.address));
+                            }
+                        }
+                        const collected = await collectCommsThread({
+                            desktop: subjectDesktop,
+                            deployed: deployedComms,
+                            channel: commsChannel,
+                            inboxes: commsInboxes,
+                            requestTimeoutMs
+                        });
+                        if (collected.artifact) {
+                            await writeContainedOutputFile(runPaths, "comms/thread.json", `${JSON.stringify(collected.artifact, null, 2)}\n`, "utf8");
+                            commsArtifactPath = "comms/thread.json";
+                        }
+                        else if (collected.captured > 0) {
+                            warnings.push(`Comms catch captured ${collected.captured} email send(s) but none matched a declared recipient inbox — no comms evidence written. Declare comms.email.recipients[].address to match the address the app sends to.`);
+                        }
+                        else {
+                            // Zero captures is the silent-broken shape (#351): the app never posted to the catch.
+                            warnings.push(`Comms catch captured ZERO email sends — the app never delivered mail through the catch. Verify the app reads ${commsEmail.injectEnv} for its email API base URL (an SDK that ignores it sends real mail or throws) and that the flow reached an email step.`);
+                        }
+                    }
+                    catch (error) {
+                        warnings.push(`Comms evidence collection failed (run continues; subject still torn down): ${redactText(scrubKnownValues(toErrorMessage(error)))}`);
+                    }
+                }
+                if (subjectDesktop && subjectModule) {
+                    if (typeof subjectModule.Sandbox.kill === "function") {
+                        try {
+                            await subjectModule.Sandbox.kill(subjectDesktop.sandboxId, { requestTimeoutMs: 60_000 });
+                            subjectKilled = true;
+                        }
+                        catch (error) {
+                            warnings.push(`Subject sandbox teardown failed (server-side kill-on-timeout will reclaim it): ${redactText(scrubKnownValues(toErrorMessage(error)))}`);
+                        }
+                    }
+                    else {
+                        warnings.push("Installed @e2b/desktop SDK does not expose Sandbox.kill; server-side kill-on-timeout will reclaim the subject sandbox.");
+                    }
+                }
+            }
+        }
+        // EXTERNAL-PUBLIC plane (#164 phase 2): NO subject sandbox, NO getHost, NO prober. The shared plane
+        // is the operator-declared public deployment (publicAppUrl); each seat opens it directly and reaches
+        // the shared session through the real UI. A host-first barrier extracts the /lobby/CODE from the host
+        // seat's CDP-observed URL (onObservedUrl) and threads it into the follower missions; a follower fails
+        // closed WITHOUT opening if the host never yields a code within the handoff deadline.
+        if (!dryRun && planeClass === "external-public") {
             const cuaHooks = {
                 ...(hooks.loadDesktopModule ? { loadDesktopModule: hooks.loadDesktopModule } : {}),
                 ...(hooks.detachedTimers ? { detachedTimers: hooks.detachedTimers } : {}),
@@ -1008,445 +1175,313 @@ async function runConcurrentSharedWorldInScope(options) {
                 artifactRoot: runPaths,
                 labCwd: cwd,
                 redactScreenshots,
-                scrubKnownValues,
+                // Scrub the latched lobby CODE (known once the host resolves it) from ALL narration.
+                scrubKnownValues: scrubKnownValuesWithLobbyCode,
                 runSession,
+                ...(receiving ? { receiving } : {}),
                 now,
                 hooks: cuaHooks,
                 ...(runBudget === undefined ? {} : { runBudget }),
-                // Concurrent lanes are independent evidence seats: a requested-vs-verified screen
-                // mismatch is recorded as separate facts + a warning instead of failing the lane's
-                // device claim closed, so one seat's window-manager drift cannot abort the whole
-                // live multi-actor world (the single-lane/fan-out routes keep fail-closed).
                 screenMismatchPolicy: "record-evidence"
             };
-            actorResults = await mapWithConcurrency(actorSpecs, Math.max(1, concurrency), async (spec, i) => {
-                const route = resolveActorSeatUrl(getHostUrl, roles[i]?.entry);
-                // Tell this persona its (getHost-reachable) inbox URL — but only when comms is live AND this lane
-                // has a declared recipient it can actually receive mail into (else it would stall on an empty
-                // inbox). Only the in-sandbox catch exists on this plane; the adopter-hosted catch is the
-                // external-public plane's, wired in ITS execution block below (#387).
-                const laneSpec = commsEmail && commsInboxUrl && laneHasInboxRecipient(commsEmail, spec.laneId)
-                    ? withInboxMission(spec, commsInboxUrl, inboxRecipientFor(commsEmail, spec.laneId)?.address)
-                    : spec;
-                const startedAt = now();
-                const outcome = await runCuaLane(laneSpec, { ...baseActorDeps, appUrl: route });
-                const endedAt = now();
-                return { spec, outcome, startedAt, endedAt, route };
-            });
-        }
-        catch (error) {
-            runError = redactText(scrubKnownValues(toErrorMessage(error)));
-            warnings.push(`Concurrent shared-world run failed before completion: ${runError}`);
-        }
-        finally {
-            // FIX-9: stop the prober, take a final snapshot while the subject is still alive, then tear
-            // down the ONE subject sandbox BY id (the actor sandboxes are torn down inside runCuaLane).
-            proberDisposed = true;
-            releaseDispose();
-            if (proberLoop) {
-                await proberLoop.catch(() => undefined);
-            }
-            // Stop the inbox-surface render loop too (shares the prober's dispose signal), before the teardown
-            // evidence drain below — so the two in-sandbox reads never overlap and the surface state is final.
-            if (surfaceLoop) {
-                await surfaceLoop.catch(() => undefined);
-            }
-            if (subjectDesktop && getHostUrl) {
-                await proberSnapshot().catch(() => undefined);
+            // Publish an attached live Observer BEFORE fan-out (mirrors the provisioned path).
+            if (options.onObserverReady) {
+                const inProgressBundle = buildConcurrentSharedWorldBundle({
+                    config,
+                    descriptor,
+                    createdAt,
+                    dryRun: false,
+                    inProgress: true,
+                    runId,
+                    source,
+                    roles,
+                    actorSpecs,
+                    actorResults: [],
+                    stateSnapshots: [],
+                    subject: { source: "app-url", envNames: [], state: { provenance: "external-public" } },
+                    seedDigest,
+                    planeClass: "external-public",
+                    // Pre-fan-out snapshot: no seat has observed an origin yet, so the OBSERVED publicOriginDigest
+                    // is not available; surface the DECLARED origin for the live Observer's reference.
+                    ...(declaredOriginDigest === undefined ? {} : { declaredOriginDigest })
+                });
+                await writeConcurrentRunArtifacts(inProgressBundle, runPaths);
+                liveObserver = observerResultForConcurrentArtifacts(cwd, runId, artifactRoot, [
+                    "Live external-public concurrent shared-world Observer is attached before final verification; stream auth URLs are runtime-only and are not persisted."
+                ]);
+                await options.onObserverReady(liveObserver);
             }
-            // Off-app comms evidence (#297): drain everything the in-sandbox catch captured, route it into a
-            // host fake inbox addressed to the declared recipients, and write the run-level digest-only thread
-            // artifact — while the subject is STILL alive, before it is killed below. Wrapped so a drain error
-            // never blocks teardown (invariant: all sandboxes torn down by id in this finally).
-            if (commsEmail && deployedComms?.ready && subjectDesktop) {
-                try {
-                    const commsChannel = new FakeInbox();
-                    const commsInboxes = [];
-                    for (const recipient of commsEmail.recipients ?? []) {
-                        if (recipient.address !== undefined) {
-                            commsInboxes.push(await commsChannel.provisionAddress(recipient.lane, recipient.address));
-                        }
-                    }
-                    const collected = await collectCommsThread({
-                        desktop: subjectDesktop,
-                        deployed: deployedComms,
-                        channel: commsChannel,
-                        inboxes: commsInboxes,
-                        requestTimeoutMs
+            // The host-first handoff barrier.
+            //
+            // TEMPORARY SHIM (tracked by #296): this CDP URL-relay handoff — reading the host's /lobby/CODE off
+            // its own browser and threading it into the follower missions — is a temporary coordination shim.
+            // It is to be augmented/replaced by the actor message bus (fake SMS/email invite) in #297: the
+            // human-realistic version is the HOST SENDING the invite link and followers RECEIVING and tapping
+            // it, rather than the orchestrator relaying the code out-of-band.
+            const lobbyCodeLatch = deferred();
+            const handoffDeadlineMs = hooks.handoffDeadlineMs
+                ?? Math.min(timeoutMs, Math.max(DEFAULT_HANDOFF_DEADLINE_MS, Math.floor(timeoutMs * HANDOFF_DEADLINE_BUDGET_FRACTION)));
+            let deadlineTimer;
+            const deadline = new Promise((_resolve, reject) => {
+                deadlineTimer = setTimeout(() => reject(new HandoffTimeoutError(handoffDeadlineMs)), handoffDeadlineMs);
+            });
+            deadline.catch(() => undefined); // never an unhandled rejection
+            // Resolve the host->follower handoff latch from WHICHEVER path sees the code first (CDP url-read,
+            // host narration, or vision-off-frame). Idempotent: only the first code wins, and it is also stashed
+            // as latchedLobbyCode so it gets scrubbed from any later narration. The latched code and observed URLs
+            // are runtime-only and land in persisted METADATA only as digests (origin + convergence). (The code
+            // is a shareable game code, not a secret, and it still renders in the host's screenshots, which are
+            // full-fidelity unless redactScreenshots is set — the digesting is about narration/URL metadata.)
+            const latchLobbyCode = (code, laneIndex) => {
+                if (latchedLobbyCode !== undefined)
+                    return;
+                observedLobbyCodes[laneIndex] = code;
+                latchedLobbyCode = code;
+                if (deadlineTimer) {
+                    clearTimeout(deadlineTimer);
+                    deadlineTimer = undefined;
+                }
+                lobbyCodeLatch.resolve(code);
+            };
+            // Build an onScreenshot handler that vision-reads the lobby code off THIS seat's own frame (the
+            // CDP-independent observation). `done()` short-circuits once this seat has what it needs (the host
+            // once latched; a follower once it has recorded its own observed code), `onCode` records/latches the
+            // result. One read in flight at a time, bounded by MAX_LOBBY_CODE_VISION_READS so a seat that never
+            // reaches a lobby can't rack up unbounded calls (fire-and-forget; the loop never awaits it).
+            const makeLobbyCodeVisionReader = (done, onCode) => {
+                let inFlight = false;
+                let reads = 0;
+                return (frame) => {
+                    if (done() || inFlight || reads >= MAX_LOBBY_CODE_VISION_READS)
+                        return;
+                    inFlight = true;
+                    reads += 1;
+                    void readLobbyCode(frame, openaiApiKey)
+                        .then((code) => {
+                        if (code !== undefined && !done())
+                            onCode(code);
+                    })
+                        .catch(() => undefined)
+                        .finally(() => {
+                        inFlight = false;
                     });
-                    if (collected.artifact) {
-                        await writeContainedOutputFile(runPaths, "comms/thread.json", `${JSON.stringify(collected.artifact, null, 2)}\n`, "utf8");
-                        commsArtifactPath = "comms/thread.json";
-                    }
-                    else if (collected.captured > 0) {
-                        warnings.push(`Comms catch captured ${collected.captured} email send(s) but none matched a declared recipient inbox — no comms evidence written. Declare comms.email.recipients[].address to match the address the app sends to.`);
-                    }
-                    else {
-                        // Zero captures is the silent-broken shape (#351): the app never posted to the catch.
-                        warnings.push(`Comms catch captured ZERO email sends — the app never delivered mail through the catch. Verify the app reads ${commsEmail.injectEnv} for its email API base URL (an SDK that ignores it sends real mail or throws) and that the flow reached an email step.`);
-                    }
+                };
+            };
+            const makeLaneObservedUrl = (laneIndex, isHost) => (url) => {
+                if (typeof url !== "string" || url.length === 0)
+                    return;
+                observedFinalUrls[laneIndex] = url; // runtime-only; digested to origin, never persisted raw
+                const code = extractLobbyCode(url);
+                if (code !== undefined) {
+                    observedLobbyCodes[laneIndex] = code;
+                    if (isHost)
+                        latchLobbyCode(code, laneIndex);
                 }
-                catch (error) {
-                    warnings.push(`Comms evidence collection failed (run continues; subject still torn down): ${redactText(scrubKnownValues(toErrorMessage(error)))}`);
+            };
+            // The HOST lane (which yields the /lobby/CODE the followers wait on) runs on its OWN dedicated
+            // slot, and the FOLLOWERS run through a bounded pool of size concurrency-1 (blockers 1 & 4):
+            // followers block on `Promise.race([lobbyCodeLatch.promise, deadline])` while holding a worker
+            // slot, so if the host lane were scheduled INSIDE the same bounded pool it could be starved (never
+            // scheduled among the first `concurrency` workers) and the run would die with a spurious
+            // HANDOFF_TIMEOUT (e.g. lanes [p2,p3,host] with concurrency 2). Giving the host its own slot,
+            // started IMMEDIATELY and OUTSIDE the follower pool, guarantees it is ALWAYS schedulable regardless
+            // of its roster position or of concurrency vs lane count — while total in-flight paid desktops stay
+            // ≤ the declared concurrency (host + up to concurrency-1 followers), preserving the spend cap.
+            const runHostLane = async (spec, laneIndex) => {
+                const onObservedUrl = makeLaneObservedUrl(laneIndex, true);
+                // CDP-INDEPENDENT handoff paths (the E2B-desktop CDP url-read the onObservedUrl path relies on is
+                // unreliable in practice). Two backups, both resolving the SAME latch; whichever sees the code first
+                // wins, all digest-only:
+                //   (1) onMessage — scan the host's own narration IF it happens to state the lobby URL; and
+                //   (2) onScreenshot — vision-read the code straight off the host's waiting-room frame. This is the
+                //       robust one: the code is rendered on screen even when CDP fails AND when the host never
+                //       narrates it, and — crucially — the host is NOT asked to announce anything, so it keeps
+                //       running (create -> wait for players -> Start -> play) instead of ending on a stray message.
+                const onMessage = (text) => {
+                    if (latchedLobbyCode !== undefined)
+                        return;
+                    const code = extractLobbyCodeFromNarration(text);
+                    if (code !== undefined)
+                        latchLobbyCode(code, laneIndex);
+                };
+                // Vision-read the host's waiting-room frame and LATCH the code for the followers (stops once latched).
+                const onScreenshot = makeLobbyCodeVisionReader(() => latchedLobbyCode !== undefined, (code) => latchLobbyCode(code, laneIndex));
+                // The host's job includes a long LEGITIMATE idle wait — sitting in the waiting room while the
+                // followers provision their own desktops and walk the Join flow (easily 15-30 turns of an
+                // unchanging "waiting for players" screen). At the default idle backstop (6) the host would give up
+                // before anyone arrives, orphaning the lobby (exactly the earlier failure). Raise the host's idle /
+                // no-progress tolerance so it waits patiently; the per-seat timeout still bounds a truly stuck host.
+                // Adopter-hosted inbox (#387): the persona is told its address and inbox URL on THIS plane —
+                // previously only the provisioned plane's seats ever got the instruction, so external comms
+                // ran on no route at all.
+                const hostInboxSpec = externalCommsEmail && commsInboxUrl && laneHasInboxRecipient(externalCommsEmail, spec.laneId)
+                    ? withInboxMission(spec, commsInboxUrl, inboxRecipientFor(externalCommsEmail, spec.laneId)?.address)
+                    : spec;
+                const hostSpec = {
+                    ...hostInboxSpec,
+                    idleSteps: spec.idleSteps ?? HOST_WAIT_IDLE_STEPS,
+                    noProgressSteps: spec.noProgressSteps ?? HOST_WAIT_IDLE_STEPS
+                };
+                const startedAt = now();
+                let outcome;
+                try {
+                    outcome = await runCuaLane(hostSpec, { ...baseActorDeps, appUrl: publicAppUrl, onObservedUrl, onMessage, onScreenshot });
                 }
-            }
-            if (subjectDesktop && subjectModule) {
-                if (typeof subjectModule.Sandbox.kill === "function") {
-                    try {
-                        await subjectModule.Sandbox.kill(subjectDesktop.sandboxId, { requestTimeoutMs: 60_000 });
-                        subjectKilled = true;
+                finally {
+                    // If the host finished without ever surfacing a code, release followers to fail closed
+                    // immediately rather than wait the full deadline (a no-op if it already resolved).
+                    if (!lobbyCodeLatch.settled()) {
+                        const reason = outcome?.sessionError ?? outcome?.session?.reason ?? "no terminal host outcome was recorded";
+                        hostHandoffFailure = scrubKnownValuesWithLobbyCode(`Host seat ended before producing a lobby URL: ${reason}`);
+                        lobbyCodeLatch.reject(new Error(hostHandoffFailure));
                     }
-                    catch (error) {
-                        warnings.push(`Subject sandbox teardown failed (server-side kill-on-timeout will reclaim it): ${redactText(scrubKnownValues(toErrorMessage(error)))}`);
-                    }
-                }
-                else {
-                    warnings.push("Installed @e2b/desktop SDK does not expose Sandbox.kill; server-side kill-on-timeout will reclaim the subject sandbox.");
                 }
-            }
-        }
-    }
-    // EXTERNAL-PUBLIC plane (#164 phase 2): NO subject sandbox, NO getHost, NO prober. The shared plane
-    // is the operator-declared public deployment (publicAppUrl); each seat opens it directly and reaches
-    // the shared session through the real UI. A host-first barrier extracts the /lobby/CODE from the host
-    // seat's CDP-observed URL (onObservedUrl) and threads it into the follower missions; a follower fails
-    // closed WITHOUT opening if the host never yields a code within the handoff deadline.
-    if (!dryRun && planeClass === "external-public") {
-        const cuaHooks = {
-            ...(hooks.loadDesktopModule ? { loadDesktopModule: hooks.loadDesktopModule } : {}),
-            ...(hooks.detachedTimers ? { detachedTimers: hooks.detachedTimers } : {}),
-            ...(hooks.env ? { env: hooks.env } : {}),
-            ...(hooks.prepareDesktop ? { prepareDesktop: (desktop) => hooks.prepareDesktop(desktop) } : {}),
-            onRuntimeStreamReady: (stream) => {
-                runtimeStreamUrls.push({ streamId: stream.streamId, url: stream.url });
-                if (liveObserver) {
-                    attachObserverRuntimeStreamUrls(liveObserver, runtimeStreamUrls);
-                }
-            },
-            onRuntimeStreamEnded: (stream) => {
-                // Mark, never remove (#357): the tile falls back to recorded evidence and says why.
-                for (const entry of runtimeStreamUrls) {
-                    if (entry.streamId === stream.streamId)
-                        entry.ended = true;
+                const endedAt = now();
+                return { spec, outcome, startedAt, endedAt, route: observedFinalUrls[laneIndex] ?? publicAppUrl };
+            };
+            const runFollowerLane = async (spec, laneIndex) => {
+                const onObservedUrl = makeLaneObservedUrl(laneIndex, false);
+                // FOLLOWER: do NOT compose a mission or open the target until the host yields a lobby code.
+                let code;
+                try {
+                    code = await Promise.race([lobbyCodeLatch.promise, deadline]);
                 }
-                if (liveObserver) {
-                    attachObserverRuntimeStreamUrls(liveObserver, runtimeStreamUrls);
+                catch (error) {
+                    // An ended host is not a deadline expiry. Preserve its actual failure.
+                    const timedOut = error instanceof HandoffTimeoutError;
+                    handoffTimedOut ||= timedOut;
+                    const reason = scrubKnownValuesWithLobbyCode(toErrorMessage(error));
+                    const at = now();
+                    return { spec, outcome: makeBlockedFollowerOutcome(spec, reason, timedOut), startedAt: at, endedAt: at, route: publicAppUrl };
                 }
-            }
-        };
-        const baseActorDeps = {
-            config,
-            descriptor,
-            cloneRoute: false,
-            subjectEnvNames: [],
-            hasGithubToken: false,
-            env,
-            openaiApiKey,
-            e2bApiKey,
-            requestTimeoutMs,
-            perLaneSandboxMs: timeoutMs + SANDBOX_TIMEOUT_BUFFER_MS,
-            timeoutMs,
-            laneCount: roles.length,
-            artifactRoot: runPaths,
-            labCwd: cwd,
-            redactScreenshots,
-            // Scrub the latched lobby CODE (known once the host resolves it) from ALL narration.
-            scrubKnownValues: scrubKnownValuesWithLobbyCode,
-            runSession,
-            now,
-            hooks: cuaHooks,
-            ...(runBudget === undefined ? {} : { runBudget }),
-            screenMismatchPolicy: "record-evidence"
-        };
-        // Publish an attached live Observer BEFORE fan-out (mirrors the provisioned path).
-        if (options.onObserverReady) {
-            const inProgressBundle = buildConcurrentSharedWorldBundle({
-                config,
-                descriptor,
-                createdAt,
-                dryRun: false,
-                inProgress: true,
-                runId,
-                source,
-                roles,
-                actorSpecs,
-                actorResults: [],
-                stateSnapshots: [],
-                subject: { source: "app-url", envNames: [], state: { provenance: "external-public" } },
-                seedDigest,
-                planeClass: "external-public",
-                // Pre-fan-out snapshot: no seat has observed an origin yet, so the OBSERVED publicOriginDigest
-                // is not available; surface the DECLARED origin for the live Observer's reference.
-                ...(declaredOriginDigest === undefined ? {} : { declaredOriginDigest })
-            });
-            await writeConcurrentRunArtifacts(inProgressBundle, runPaths);
-            liveObserver = observerResultForConcurrentArtifacts(cwd, runId, artifactRoot, [
-                "Live external-public concurrent shared-world Observer is attached before final verification; stream auth URLs are runtime-only and are not persisted."
-            ]);
-            await options.onObserverReady(liveObserver);
-        }
-        // The host-first handoff barrier.
-        //
-        // TEMPORARY SHIM (tracked by #296): this CDP URL-relay handoff — reading the host's /lobby/CODE off
-        // its own browser and threading it into the follower missions — is a temporary coordination shim.
-        // It is to be augmented/replaced by the actor message bus (fake SMS/email invite) in #297: the
-        // human-realistic version is the HOST SENDING the invite link and followers RECEIVING and tapping
-        // it, rather than the orchestrator relaying the code out-of-band.
-        const lobbyCodeLatch = deferred();
-        const handoffDeadlineMs = hooks.handoffDeadlineMs
-            ?? Math.min(timeoutMs, Math.max(DEFAULT_HANDOFF_DEADLINE_MS, Math.floor(timeoutMs * HANDOFF_DEADLINE_BUDGET_FRACTION)));
-        let deadlineTimer;
-        const deadline = new Promise((_resolve, reject) => {
-            deadlineTimer = setTimeout(() => reject(new HandoffTimeoutError(handoffDeadlineMs)), handoffDeadlineMs);
-        });
-        deadline.catch(() => undefined); // never an unhandled rejection
-        // Resolve the host->follower handoff latch from WHICHEVER path sees the code first (CDP url-read,
-        // host narration, or vision-off-frame). Idempotent: only the first code wins, and it is also stashed
-        // as latchedLobbyCode so it gets scrubbed from any later narration. The latched code and observed URLs
-        // are runtime-only and land in persisted METADATA only as digests (origin + convergence). (The code
-        // is a shareable game code, not a secret, and it still renders in the host's screenshots, which are
-        // full-fidelity unless redactScreenshots is set — the digesting is about narration/URL metadata.)
-        const latchLobbyCode = (code, laneIndex) => {
-            if (latchedLobbyCode !== undefined)
-                return;
-            observedLobbyCodes[laneIndex] = code;
-            latchedLobbyCode = code;
-            if (deadlineTimer) {
-                clearTimeout(deadlineTimer);
-                deadlineTimer = undefined;
-            }
-            lobbyCodeLatch.resolve(code);
-        };
-        // Build an onScreenshot handler that vision-reads the lobby code off THIS seat's own frame (the
-        // CDP-independent observation). `done()` short-circuits once this seat has what it needs (the host
-        // once latched; a follower once it has recorded its own observed code), `onCode` records/latches the
-        // result. One read in flight at a time, bounded by MAX_LOBBY_CODE_VISION_READS so a seat that never
-        // reaches a lobby can't rack up unbounded calls (fire-and-forget; the loop never awaits it).
-        const makeLobbyCodeVisionReader = (done, onCode) => {
-            let inFlight = false;
-            let reads = 0;
-            return (frame) => {
-                if (done() || inFlight || reads >= MAX_LOBBY_CODE_VISION_READS)
-                    return;
-                inFlight = true;
-                reads += 1;
-                void readLobbyCode(frame, openaiApiKey)
-                    .then((code) => {
-                    if (code !== undefined && !done())
-                        onCode(code);
-                })
-                    .catch(() => undefined)
-                    .finally(() => {
-                    inFlight = false;
-                });
-            };
-        };
-        const makeLaneObservedUrl = (laneIndex, isHost) => (url) => {
-            if (typeof url !== "string" || url.length === 0)
-                return;
-            observedFinalUrls[laneIndex] = url; // runtime-only; digested to origin, never persisted raw
-            const code = extractLobbyCode(url);
-            if (code !== undefined) {
-                observedLobbyCodes[laneIndex] = code;
-                if (isHost)
-                    latchLobbyCode(code, laneIndex);
-            }
-        };
-        // The HOST lane (which yields the /lobby/CODE the followers wait on) runs on its OWN dedicated
-        // slot, and the FOLLOWERS run through a bounded pool of size concurrency-1 (blockers 1 & 4):
-        // followers block on `Promise.race([lobbyCodeLatch.promise, deadline])` while holding a worker
-        // slot, so if the host lane were scheduled INSIDE the same bounded pool it could be starved (never
-        // scheduled among the first `concurrency` workers) and the run would die with a spurious
-        // HANDOFF_TIMEOUT (e.g. lanes [p2,p3,host] with concurrency 2). Giving the host its own slot,
-        // started IMMEDIATELY and OUTSIDE the follower pool, guarantees it is ALWAYS schedulable regardless
-        // of its roster position or of concurrency vs lane count — while total in-flight paid desktops stay
-        // ≤ the declared concurrency (host + up to concurrency-1 followers), preserving the spend cap.
-        const runHostLane = async (spec, laneIndex) => {
-            const onObservedUrl = makeLaneObservedUrl(laneIndex, true);
-            // CDP-INDEPENDENT handoff paths (the E2B-desktop CDP url-read the onObservedUrl path relies on is
-            // unreliable in practice). Two backups, both resolving the SAME latch; whichever sees the code first
-            // wins, all digest-only:
-            //   (1) onMessage — scan the host's own narration IF it happens to state the lobby URL; and
-            //   (2) onScreenshot — vision-read the code straight off the host's waiting-room frame. This is the
-            //       robust one: the code is rendered on screen even when CDP fails AND when the host never
-            //       narrates it, and — crucially — the host is NOT asked to announce anything, so it keeps
-            //       running (create -> wait for players -> Start -> play) instead of ending on a stray message.
-            const onMessage = (text) => {
-                if (latchedLobbyCode !== undefined)
-                    return;
-                const code = extractLobbyCodeFromNarration(text);
-                if (code !== undefined)
-                    latchLobbyCode(code, laneIndex);
-            };
-            // Vision-read the host's waiting-room frame and LATCH the code for the followers (stops once latched).
-            const onScreenshot = makeLobbyCodeVisionReader(() => latchedLobbyCode !== undefined, (code) => latchLobbyCode(code, laneIndex));
-            // The host's job includes a long LEGITIMATE idle wait — sitting in the waiting room while the
-            // followers provision their own desktops and walk the Join flow (easily 15-30 turns of an
-            // unchanging "waiting for players" screen). At the default idle backstop (6) the host would give up
-            // before anyone arrives, orphaning the lobby (exactly the earlier failure). Raise the host's idle /
-            // no-progress tolerance so it waits patiently; the per-seat timeout still bounds a truly stuck host.
-            // Adopter-hosted inbox (#387): the persona is told its address and inbox URL on THIS plane —
-            // previously only the provisioned plane's seats ever got the instruction, so external comms
-            // ran on no route at all.
-            const hostInboxSpec = externalCommsEmail && commsInboxUrl && laneHasInboxRecipient(externalCommsEmail, spec.laneId)
-                ? withInboxMission(spec, commsInboxUrl, inboxRecipientFor(externalCommsEmail, spec.laneId)?.address)
-                : spec;
-            const hostSpec = {
-                ...hostInboxSpec,
-                idleSteps: spec.idleSteps ?? HOST_WAIT_IDLE_STEPS,
-                noProgressSteps: spec.noProgressSteps ?? HOST_WAIT_IDLE_STEPS
+                // Followers also idle-wait — in the waiting room until the host starts, and between rounds. Raise
+                // their idle backstop too (less than the host's: they wait less), so a follower that joins ahead of
+                // the other does not give up before the game begins. Per-seat timeout still bounds a stuck follower.
+                const followerInboxSpec = externalCommsEmail && commsInboxUrl && laneHasInboxRecipient(externalCommsEmail, spec.laneId)
+                    ? withInboxMission(spec, commsInboxUrl, inboxRecipientFor(externalCommsEmail, spec.laneId)?.address)
+                    : spec;
+                const followerSpec = {
+                    ...withLobbyCodeMission(followerInboxSpec, code),
+                    idleSteps: spec.idleSteps ?? FOLLOWER_WAIT_IDLE_STEPS,
+                    noProgressSteps: spec.noProgressSteps ?? FOLLOWER_WAIT_IDLE_STEPS
+                };
+                // Independently OBSERVE this follower's own lobby code by vision-reading its waiting-room frame,
+                // and record it for the cross-seat convergence proof. This does NOT latch anything (followers gate
+                // on the HOST's code, not their own) — it just fills this seat's observedLobbyCodes slot from a
+                // reliable signal instead of the flaky CDP url-read, so lobbyConvergenceDigest can prove all seats
+                // reached the SAME /lobby/CODE. If a follower somehow joined a DIFFERENT lobby, it reads a different
+                // code and convergence correctly fails (no false proof); if it never reads one, the seat stays a
+                // hole and convergence is honestly "not observed" for that seat.
+                const onScreenshot = makeLobbyCodeVisionReader(() => observedLobbyCodes[laneIndex] !== undefined, (observed) => { observedLobbyCodes[laneIndex] = observed; });
+                const startedAt = now();
+                const outcome = await runCuaLane(followerSpec, { ...baseActorDeps, appUrl: publicAppUrl, onObservedUrl, onScreenshot });
+                const endedAt = now();
+                return { spec, outcome, startedAt, endedAt, route: observedFinalUrls[laneIndex] ?? publicAppUrl };
             };
-            const startedAt = now();
-            let outcome;
+            // Split the roster into the designated host lane and the followers, preserving each follower's
+            // ORIGINAL lane index so results land back in lane order (validation guarantees EXACTLY ONE host).
+            const hostLaneIndex = roles.findIndex((role) => role.host === true);
+            const followerEntries = actorSpecs
+                .map((spec, index) => ({ spec, index }))
+                .filter(({ index }) => index !== hostLaneIndex);
+            const laneResults = new Array(actorSpecs.length);
             try {
-                outcome = await runCuaLane(hostSpec, { ...baseActorDeps, appUrl: publicAppUrl, onObservedUrl, onMessage, onScreenshot });
-            }
-            finally {
-                // If the host finished without ever surfacing a code, release followers to fail closed
-                // immediately rather than wait the full deadline (a no-op if it already resolved).
-                if (!lobbyCodeLatch.settled()) {
-                    const reason = outcome?.sessionError ?? outcome?.session?.reason ?? "no terminal host outcome was recorded";
-                    hostHandoffFailure = scrubKnownValuesWithLobbyCode(`Host seat ended before producing a lobby URL: ${reason}`);
-                    lobbyCodeLatch.reject(new Error(hostHandoffFailure));
+                const hostPromise = hostLaneIndex >= 0 && actorSpecs[hostLaneIndex] !== undefined
+                    ? runHostLane(actorSpecs[hostLaneIndex], hostLaneIndex)
+                    : undefined;
+                const followerResultsPromise = mapWithConcurrency(followerEntries, Math.max(1, concurrency - 1), ({ spec, index }) => runFollowerLane(spec, index));
+                const [hostResult, followerResults] = await Promise.all([hostPromise, followerResultsPromise]);
+                if (hostResult !== undefined && hostLaneIndex >= 0) {
+                    laneResults[hostLaneIndex] = hostResult;
                 }
-            }
-            const endedAt = now();
-            return { spec, outcome, startedAt, endedAt, route: observedFinalUrls[laneIndex] ?? publicAppUrl };
-        };
-        const runFollowerLane = async (spec, laneIndex) => {
-            const onObservedUrl = makeLaneObservedUrl(laneIndex, false);
-            // FOLLOWER: do NOT compose a mission or open the target until the host yields a lobby code.
-            let code;
-            try {
-                code = await Promise.race([lobbyCodeLatch.promise, deadline]);
+                followerEntries.forEach((entry, i) => { laneResults[entry.index] = followerResults[i]; });
+                actorResults = laneResults;
             }
             catch (error) {
-                // An ended host is not a deadline expiry. Preserve its actual failure.
-                const timedOut = error instanceof HandoffTimeoutError;
-                handoffTimedOut ||= timedOut;
-                const reason = scrubKnownValuesWithLobbyCode(toErrorMessage(error));
-                const at = now();
-                return { spec, outcome: makeBlockedFollowerOutcome(spec, reason, timedOut), startedAt: at, endedAt: at, route: publicAppUrl };
+                runError = redactText(scrubKnownValuesWithLobbyCode(toErrorMessage(error)));
+                warnings.push(`External-public concurrent shared-world run failed before completion: ${runError}`);
             }
-            // Followers also idle-wait — in the waiting room until the host starts, and between rounds. Raise
-            // their idle backstop too (less than the host's: they wait less), so a follower that joins ahead of
-            // the other does not give up before the game begins. Per-seat timeout still bounds a stuck follower.
-            const followerInboxSpec = externalCommsEmail && commsInboxUrl && laneHasInboxRecipient(externalCommsEmail, spec.laneId)
-                ? withInboxMission(spec, commsInboxUrl, inboxRecipientFor(externalCommsEmail, spec.laneId)?.address)
-                : spec;
-            const followerSpec = {
-                ...withLobbyCodeMission(followerInboxSpec, code),
-                idleSteps: spec.idleSteps ?? FOLLOWER_WAIT_IDLE_STEPS,
-                noProgressSteps: spec.noProgressSteps ?? FOLLOWER_WAIT_IDLE_STEPS
-            };
-            // Independently OBSERVE this follower's own lobby code by vision-reading its waiting-room frame,
-            // and record it for the cross-seat convergence proof. This does NOT latch anything (followers gate
-            // on the HOST's code, not their own) — it just fills this seat's observedLobbyCodes slot from a
-            // reliable signal instead of the flaky CDP url-read, so lobbyConvergenceDigest can prove all seats
-            // reached the SAME /lobby/CODE. If a follower somehow joined a DIFFERENT lobby, it reads a different
-            // code and convergence correctly fails (no false proof); if it never reads one, the seat stays a
-            // hole and convergence is honestly "not observed" for that seat.
-            const onScreenshot = makeLobbyCodeVisionReader(() => observedLobbyCodes[laneIndex] !== undefined, (observed) => { observedLobbyCodes[laneIndex] = observed; });
-            const startedAt = now();
-            const outcome = await runCuaLane(followerSpec, { ...baseActorDeps, appUrl: publicAppUrl, onObservedUrl, onScreenshot });
-            const endedAt = now();
-            return { spec, outcome, startedAt, endedAt, route: observedFinalUrls[laneIndex] ?? publicAppUrl };
-        };
-        // Split the roster into the designated host lane and the followers, preserving each follower's
-        // ORIGINAL lane index so results land back in lane order (validation guarantees EXACTLY ONE host).
-        const hostLaneIndex = roles.findIndex((role) => role.host === true);
-        const followerEntries = actorSpecs
-            .map((spec, index) => ({ spec, index }))
-            .filter(({ index }) => index !== hostLaneIndex);
-        const laneResults = new Array(actorSpecs.length);
-        try {
-            const hostPromise = hostLaneIndex >= 0 && actorSpecs[hostLaneIndex] !== undefined
-                ? runHostLane(actorSpecs[hostLaneIndex], hostLaneIndex)
-                : undefined;
-            const followerResultsPromise = mapWithConcurrency(followerEntries, Math.max(1, concurrency - 1), ({ spec, index }) => runFollowerLane(spec, index));
-            const [hostResult, followerResults] = await Promise.all([hostPromise, followerResultsPromise]);
-            if (hostResult !== undefined && hostLaneIndex >= 0) {
-                laneResults[hostLaneIndex] = hostResult;
-            }
-            followerEntries.forEach((entry, i) => { laneResults[entry.index] = followerResults[i]; });
-            actorResults = laneResults;
-        }
-        catch (error) {
-            runError = redactText(scrubKnownValuesWithLobbyCode(toErrorMessage(error)));
-            warnings.push(`External-public concurrent shared-world run failed before completion: ${runError}`);
-        }
-        finally {
-            if (deadlineTimer) {
-                clearTimeout(deadlineTimer);
-                deadlineTimer = undefined;
-            }
-            // Adopter-hosted drain (#328/#387): same routing and digest-only artifact as the in-sandbox
-            // catch — only the transport differs (HTTP GET /deliveries against the catch the operator
-            // runs). In the finally so the evidence survives a failed run; a drain error never masks
-            // the run's own outcome.
-            if (externalComms && externalCommsEmail) {
-                try {
-                    const commsChannel = new FakeInbox();
-                    const commsInboxes = [];
-                    for (const recipient of externalCommsEmail.recipients ?? []) {
-                        if (recipient.address !== undefined) {
-                            commsInboxes.push(await commsChannel.provisionAddress(recipient.lane, recipient.address));
+            finally {
+                if (deadlineTimer) {
+                    clearTimeout(deadlineTimer);
+                    deadlineTimer = undefined;
+                }
+                // Adopter-hosted drain (#328/#387): same routing and digest-only artifact as the in-sandbox
+                // catch — only the transport differs (HTTP GET /deliveries against the catch the operator
+                // runs). In the finally so the evidence survives a failed run; a drain error never masks
+                // the run's own outcome.
+                if (externalComms && externalCommsEmail) {
+                    try {
+                        const commsChannel = new FakeInbox();
+                        const commsInboxes = [];
+                        for (const recipient of externalCommsEmail.recipients ?? []) {
+                            if (recipient.address !== undefined) {
+                                commsInboxes.push(await commsChannel.provisionAddress(recipient.lane, recipient.address));
+                            }
+                        }
+                        const authToken = externalComms.authTokenEnv === undefined ? undefined : env[externalComms.authTokenEnv];
+                        const collected = await collectExternalCommsThread({
+                            external: { ...externalComms, ...(authToken === undefined ? {} : { authToken }) },
+                            channel: commsChannel,
+                            inboxes: commsInboxes
+                        });
+                        if (collected.artifact) {
+                            const path = "comms/thread.json";
+                            await writeContainedOutputFile(runPaths, path, `${JSON.stringify(collected.artifact, null, 2)}\n`, "utf8");
+                            commsArtifactPath = path;
+                        }
+                        else if (collected.captured > 0) {
+                            warnings.push(`Comms catch captured ${collected.captured} email send(s) but none matched a declared recipient inbox — no comms evidence written. Declare comms.email.recipients[].address to match the address the app sends to.`);
+                        }
+                        else {
+                            warnings.push(`Comms catch captured ZERO email sends — your app never delivered mail through the catch at ${externalComms.catchBaseUrl}. Verify the app's email-API base URL points at it and that the flow reached an email step.`);
                         }
                     }
-                    const authToken = externalComms.authTokenEnv === undefined ? undefined : env[externalComms.authTokenEnv];
-                    const collected = await collectExternalCommsThread({
-                        external: { ...externalComms, ...(authToken === undefined ? {} : { authToken }) },
-                        channel: commsChannel,
-                        inboxes: commsInboxes
-                    });
-                    if (collected.artifact) {
-                        const path = "comms/thread.json";
-                        await writeContainedOutputFile(runPaths, path, `${JSON.stringify(collected.artifact, null, 2)}\n`, "utf8");
-                        commsArtifactPath = path;
-                    }
-                    else if (collected.captured > 0) {
-                        warnings.push(`Comms catch captured ${collected.captured} email send(s) but none matched a declared recipient inbox — no comms evidence written. Declare comms.email.recipients[].address to match the address the app sends to.`);
-                    }
-                    else {
-                        warnings.push(`Comms catch captured ZERO email sends — your app never delivered mail through the catch at ${externalComms.catchBaseUrl}. Verify the app's email-API base URL points at it and that the flow reached an email step.`);
+                    catch (error) {
+                        warnings.push(`Comms evidence collection failed against the adopter-hosted catch (run continues): ${redactText(toErrorMessage(error))}`);
                     }
                 }
-                catch (error) {
-                    warnings.push(`Comms evidence collection failed against the adopter-hosted catch (run continues): ${redactText(toErrorMessage(error))}`);
-                }
+            }
+            // Observed-origin convergence proof (blocker 2): the convergence claim is about what the seats
+            // OBSERVED, not what was DECLARED. Digest each observing seat's origin and require they AGREE on
+            // ONE — that agreement IS the convergence proof and becomes plane.publicOriginDigest. A normal
+            // cross-origin redirect (declared apex -> observed www) is therefore tolerated: the seats still
+            // converge on ONE observed origin. Leave it undefined (verify fails closed) only if the seats did
+            // not converge on a single observed origin (or none observed one).
+            const observedOriginDigests = observedFinalUrls
+                .filter((url) => typeof url === "string" && url.length > 0)
+                .map((url) => hostOriginDigest(url));
+            const distinctObservedOrigins = new Set(observedOriginDigests);
+            publicOriginDigest = distinctObservedOrigins.size === 1
+                ? [...distinctObservedOrigins][0]
+                // NOTHING observed (e.g. a handoff-timeout run where no seat ever navigated): fall back to the
+                // DECLARED origin so a FAILED run's bundle stays structurally valid (every seat's route then
+                // digests to the declared origin too). The run still fails closed for its own reason (HANDOFF_
+                // TIMEOUT / no lobby convergence / no overlap-on-pass). GENUINE divergence (≥2 distinct observed
+                // origins) leaves it undefined so verify fails closed on the non-convergence.
+                : distinctObservedOrigins.size === 0
+                    ? declaredOriginDigest
+                    : undefined;
+            // Lobby-convergence proof: a digest of the shared /lobby/CODE path iff EVERY seat converged on the
+            // SAME code (a follower stuck on "/" yields no code → no false convergence). Digest-only. NOTE:
+            // observedLobbyCodes may be a SPARSE array (a seat that never observed a code leaves a hole), and
+            // Array.prototype.every SKIPS holes — so count the DEFINED codes explicitly, never rely on every().
+            const definedCodes = observedLobbyCodes.filter((code) => code !== undefined);
+            const distinctCodes = new Set(definedCodes);
+            if (distinctCodes.size === 1 && definedCodes.length === roles.length) {
+                lobbyConvergenceDigest = commandDigestOf(`/lobby/${[...distinctCodes][0]}`);
+            }
+            if (handoffTimedOut && runError === undefined) {
+                runError = `The host seat never produced a /lobby/CODE URL within the ${handoffDeadlineMs}ms handoff deadline; follower seats failed closed without opening.`;
             }
         }
-        // Observed-origin convergence proof (blocker 2): the convergence claim is about what the seats
-        // OBSERVED, not what was DECLARED. Digest each observing seat's origin and require they AGREE on
-        // ONE — that agreement IS the convergence proof and becomes plane.publicOriginDigest. A normal
-        // cross-origin redirect (declared apex -> observed www) is therefore tolerated: the seats still
-        // converge on ONE observed origin. Leave it undefined (verify fails closed) only if the seats did
-        // not converge on a single observed origin (or none observed one).
-        const observedOriginDigests = observedFinalUrls
-            .filter((url) => typeof url === "string" && url.length > 0)
-            .map((url) => hostOriginDigest(url));
-        const distinctObservedOrigins = new Set(observedOriginDigests);
-        publicOriginDigest = distinctObservedOrigins.size === 1
-            ? [...distinctObservedOrigins][0]
-            // NOTHING observed (e.g. a handoff-timeout run where no seat ever navigated): fall back to the
-            // DECLARED origin so a FAILED run's bundle stays structurally valid (every seat's route then
-            // digests to the declared origin too). The run still fails closed for its own reason (HANDOFF_
-            // TIMEOUT / no lobby convergence / no overlap-on-pass). GENUINE divergence (≥2 distinct observed
-            // origins) leaves it undefined so verify fails closed on the non-convergence.
-            : distinctObservedOrigins.size === 0
-                ? declaredOriginDigest
-                : undefined;
-        // Lobby-convergence proof: a digest of the shared /lobby/CODE path iff EVERY seat converged on the
-        // SAME code (a follower stuck on "/" yields no code → no false convergence). Digest-only. NOTE:
-        // observedLobbyCodes may be a SPARSE array (a seat that never observed a code leaves a hole), and
-        // Array.prototype.every SKIPS holes — so count the DEFINED codes explicitly, never rely on every().
-        const definedCodes = observedLobbyCodes.filter((code) => code !== undefined);
-        const distinctCodes = new Set(definedCodes);
-        if (distinctCodes.size === 1 && definedCodes.length === roles.length) {
-            lobbyConvergenceDigest = commandDigestOf(`/lobby/${[...distinctCodes][0]}`);
+    }
+    finally {
+        try {
+            await receiving?.finish();
         }
-        if (handoffTimedOut && runError === undefined) {
-            runError = `The host seat never produced a /lobby/CODE URL within the ${handoffDeadlineMs}ms handoff deadline; follower seats failed closed without opening.`;
+        catch {
+            warnings.push("Email finalization could not complete. Inspect humanish comms recover; provider cleanup remains unresolved.");
         }
     }
     // Subject provenance: external-public is the operator-declared, operator-owned public deployment
@@ -1508,6 +1543,8 @@ async function runConcurrentSharedWorldInScope(options) {
         hookLabel: "sharedWorldHooks",
         ...(options.scorerProvenance === undefined ? {} : { scorerProvenance: options.scorerProvenance })
     });
+    if (receiving)
+        bundle.commsReceiving = receiving.snapshot();
     await writeConcurrentRunArtifacts(bundle, runPaths);
     // Finalize identity+liveness from the bundle just written. Deliberately here and not inside
     // writeConcurrentRunArtifacts — that writer is shared with the mid-run in-progress flushes, and
@@ -2055,6 +2092,7 @@ export function buildConcurrentSharedWorldBundle(args) {
     const ranLive = actorResults.some((result) => result.outcome.session !== undefined || result.outcome.sessionError !== undefined);
     return {
         schema: RUN_BUNDLE_SCHEMA,
+        ...receivingPublication(args.config, args.dryRun),
         runId: args.runId,
         mode: dryRun ? "dry-run" : "live",
         simCount: actorSpecs.length,