End-to-end proof against a running AC: sign in with the hosted-session token, load the inbox and match its counts to /api/mail?count=1, send a letter with an escaped heart through the piece and read it back as a literal <3, open a reply from the chip (Re: subject, addressed to the sender), then watch laklok's envelope wear the red unread badge and drop it after the box is marked read — read off screenshots, not flags. ACSession#signIn seeds the hosted session the way boot.mjs picks it up. npm run test:mail:e2e # production npm run test:mail:e2e:local # against a local site Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>