Email verification tests often look like a delivery problem. A test creates a user, waits for a message, extracts a link, and calls the REST API. When it fails intermittently, the first response is usually to increase the timeout.

That treats the symptom. The deeper issue is often mailbox ownership: the application creates one verification request, while the test worker reads evidence that belongs to another request, retry, or user. A mailbox is not just an inbox. In an authentication flow, it is a resource with an owner, a lifetime, and a set of allowed consumers.

The ownership bug behind flaky verification tests

Consider two CI workers running the same Node.js test. Both use a shared test inbox. Worker A requests verification for [email protected] , but the provider delivers slowly. Worker B requests verification for [email protected] , then the inbox query returns the newest message first. If the test filters only by subject, either worker can consume the wrong evidence.

The same bug appears during retries.…