fix: un dépôt est délivré une fois et retiré, comme en amont

packages/polyfill/src/emulated-verifier/inbox-observer.ts

@@ -187,9 +187,12 @@ async function applyWhatArrived(obs: Observation, inbox: Nuri): Promise<void> {
       // is not theirs. (Landing after it, the run ABANDONS quietly instead and returns; both
       // leave the deposit where it is.) Abandoning is what this package has always called
       // "not a failure", and reporting it would put a broker-looking error in the log every
-      // time a page switches user. Nothing is lost: an inbox is not consumed by being
-      // abandoned, so the deposit is still there for its owner's next connection. Same rule,
-      // same words, as the drain loop in `connect.connectedUser`.
+      // time a page switches user. Nothing is lost: abandoning happens BEFORE the deposit it
+      // stopped at is taken out of the queue (`emulated-verifier/inbox-consume.ts` asks
+      // whether the holder still stands, then pops), so that deposit and every one behind it
+      // are still there for its owner's next connection. What had already been popped was
+      // applied for the holder that was authorised at the time. Same rule, same words, as the
+      // drain loop in `connect.connectedUser`.
       if (!current(obs)) return;
       throw error;
     }
@@ -388,7 +391,9 @@ async function enumerate(obs: Observation): Promise<void> {
  *
  * It never rejects. Failing to WATCH is reported where failures go and denies nobody their
  * session — the same rule the drain loop above it follows, and for the same reason: what
- * has not been applied stays in its queue for the next attempt.
+ * has not been DELIVERED stays in its queue for the next attempt. (Delivered, not applied:
+ * since 2026-08-26 a deposit is popped before its arm runs, so one whose arm then failed is
+ * gone — see `emulated-verifier/inbox-consume.ts`. Failing to WATCH takes nothing out.)
  */
 // @provenance startObservingInboxes kind=aligned level=1 ref=engine/verifier/src/verifier.rs:inbox — upstream a connected verifier is handed each inbox message as it arrives and applies it; here the arrival signal is a document push, and the set of inboxes is the User branch's `AddInboxCap` records
 export async function startObservingInboxes(): Promise<void> {