@recursiv/sdk 0.7.83 → 0.7.89

package/dist/privacy/facts.generated.js

@@ -0,0 +1,93 @@
+// Generated by scripts/privacy-claims.mjs from docs/privacy-claims.json. Do not edit: CI refuses a hand edit.
+// Change the registry, then run: node scripts/privacy-claims.mjs --write
+export const PRIVACY_REGISTRY_VERSION = 0;
+export const PRIVACY_FACTS = [
+    {
+        id: "agents.tool_mode.chat_only",
+        status: "planned",
+        enforcement: "server",
+        capability: "web_tools",
+        step: "S5",
+        says: "An agent in chat_only tool mode is given no tools, so it opens no web page.",
+    },
+    {
+        id: "agents.turn_stamp",
+        status: "enforced",
+        enforcement: "server",
+        capability: null,
+        step: "S7",
+        says: "Every reply a model writes in an agent chat through the platform's agent turn records, in metadata.ai, the model, its maker and the route, a model swapped in and whether for usage limits or after a failure, and the tools it called.",
+    },
+    {
+        id: "agents.personal_context_sections",
+        status: "planned",
+        enforcement: "server",
+        capability: "activity",
+        step: "S26",
+        says: "A personal agent's turn carries no follows, upvotes, groups or views of the member unless the member turned that part of their activity on.",
+    },
+    {
+        id: "sealed.attest_before_send",
+        status: "enforced",
+        enforcement: "device",
+        capability: "chat_tier",
+        step: "S28",
+        says: "The phone seals a Sealed request only to the key of a router it checked against a fresh challenge of its own: the router's report, signed by its AMD hardware, must answer that challenge with debug mode off and firmware at or above a floor, and its software must be a release Tinfoil signed and listed in a public log. If any check fails there is no key to seal to, so nothing is sealed or sent. How long a checked router is used before it is checked again is up to the app.",
+    },
+    {
+        id: "sealed.attest_second_signer",
+        status: "planned",
+        enforcement: "device",
+        capability: "chat_tier",
+        step: "S28",
+        says: "The phone also requires Recursiv's own signature over the router's release, so a release Tinfoil signed alone is refused.",
+    },
+    {
+        id: "sealed.no_standard_fallback",
+        status: "enforced",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S28",
+        says: "The SDK sends a Sealed request only to the Sealed route, marked Sealed, and only once: a refusal, an error or an answer that is not sealed goes back to the app, and the SDK never sends the request again, to Sealed or to any other route.",
+    },
+    {
+        id: "sealed.gateway_opaque",
+        status: "enforced",
+        enforcement: "server",
+        capability: "chat_tier",
+        step: "S28",
+        says: "The Sealed gateway passes each Sealed request and answer on as bytes it does not read: it never parses, stores or logs a request or answer body. It refuses a request that carries no EHBP encapsulated key, the mark of a sealed body, and a success answer that carries no well-formed EHBP response nonce, the mark of a sealed answer; it cannot tell from the bytes themselves whether a body is sealed.",
+    },
+    {
+        id: "sealed.dest_tinfoil_only",
+        status: "enforced",
+        enforcement: "server",
+        capability: "chat_tier",
+        step: "S28",
+        says: "The Sealed gateway sends Sealed requests, and asks for attestation documents, only to the router origins its configuration lists, named exactly, and it lists only https origins of Tinfoil router hosts (inference.tinfoil.sh or router-N.tinfoil.sh). It refuses any other server a client names and follows no redirect.",
+    },
+    {
+        id: "sealed.no_server_history",
+        status: "enforced",
+        enforcement: "server",
+        capability: "sealed_history",
+        step: "S29",
+        says: "The platform keeps no Sealed chat history: no Sealed route writes a conversation or message row, and the gateway stores no request or answer body.",
+    },
+    {
+        id: "sealed.backup_excluded",
+        status: "planned",
+        enforcement: "device",
+        capability: "sealed_history",
+        step: "S29",
+        says: "Sealed chats saved on a phone are left out of the phone's backups.",
+    },
+    {
+        id: "sealed.no_push",
+        status: "enforced",
+        enforcement: "server",
+        capability: "chat_tier",
+        step: "S29",
+        says: "No Sealed route sends a push notification or writes a notification: a Sealed answer goes back only on the request that asked for it.",
+    },
+];

package/dist/privacy/index.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `@recursiv/sdk/privacy`: the platform privacy facts, generated from the claims registry (docs/privacy-claims.json
+ * in recursivlabs/recursiv). Each fact says one thing the platform does with member data and whether this SDK release
+ * marks it enforced, which it does only once every test that proves it is real and runs in CI.
+ *
+ * An app shows a privacy sentence only when the facts it rests on are live: enforced here AND listed by the API it
+ * talks to (`sdk.privacy.capabilities()`), so neither a newer SDK nor a newer API can make a claim on its own. A fact
+ * held on the phone (`enforcement: 'device'`) needs a third check, the app's own: neither this SDK nor the API can see
+ * which native module the phone runs, so the app names the device facts its installed module carries (`deviceFacts`).
+ *
+ * The types live here, not in the SDK's shared types, so this entry point stands alone.
+ */
+import { PRIVACY_FACTS, PRIVACY_REGISTRY_VERSION } from './facts.generated.js';
+export { PRIVACY_FACTS, PRIVACY_REGISTRY_VERSION };
+export type PrivacyFact = (typeof PRIVACY_FACTS)[number];
+export type PrivacyFactId = PrivacyFact['id'];
+/** `planned`: the platform does not yet prove it. `enforced`: every test that proves it is real and runs in CI. */
+export type PrivacyFactStatus = 'planned' | 'enforced';
+/** Where a fact holds: on the server, on the phone (the native module), in the SDK, or in both server and client. */
+export type PrivacyFactEnforcement = 'server' | 'device' | 'client' | 'server_and_client';
+/** GET /privacy/capabilities: the facts the deployed API's build marks enforced, and the commit it runs. */
+export interface PrivacyCapabilities {
+    /** The commit the API was built from, or `unknown`. */
+    api_commit: string;
+    /** Fact ids, sorted. An id this SDK release does not know is never live here. */
+    facts: string[];
+}
+/** The fact with this id, or undefined for an id this SDK release does not know. */
+export declare function privacyFact(id: string): PrivacyFact | undefined;
+/** Whether this SDK release marks the fact enforced. An unknown id is not. */
+export declare function isFactEnforced(id: string): boolean;
+export interface LiveFactOptions {
+    /**
+     * The device facts (`enforcement: 'device'`) the app's installed native module carries, as the app knows from the
+     * module revision it ships (for Sealed, @recursiv/e2ee-react-native). A device fact is live only when it is named
+     * here too. Left out, no device fact is live. A fact says what the module does, not what the app does with it: for
+     * `sealed.attest_before_send` the app chooses how long a checked router is reused, so copy that says the router is
+     * checked before every send needs the app to check before every send.
+     */
+    deviceFacts?: Iterable<string>;
+}
+/**
+ * Enforced in this SDK release AND listed by the deployed API, and for a device fact also named in `deviceFacts`.
+ * Missing capabilities mean nothing is live.
+ */
+export declare function isFactLive(id: string, capabilities: PrivacyCapabilities | null | undefined, options?: LiveFactOptions): boolean;
+/** Every fact that is live for this API (and, for device facts, this app's native module), in registry order. */
+export declare function liveFacts(capabilities: PrivacyCapabilities | null | undefined, options?: LiveFactOptions): PrivacyFactId[];

package/dist/privacy/index.js

@@ -0,0 +1,42 @@
+/**
+ * `@recursiv/sdk/privacy`: the platform privacy facts, generated from the claims registry (docs/privacy-claims.json
+ * in recursivlabs/recursiv). Each fact says one thing the platform does with member data and whether this SDK release
+ * marks it enforced, which it does only once every test that proves it is real and runs in CI.
+ *
+ * An app shows a privacy sentence only when the facts it rests on are live: enforced here AND listed by the API it
+ * talks to (`sdk.privacy.capabilities()`), so neither a newer SDK nor a newer API can make a claim on its own. A fact
+ * held on the phone (`enforcement: 'device'`) needs a third check, the app's own: neither this SDK nor the API can see
+ * which native module the phone runs, so the app names the device facts its installed module carries (`deviceFacts`).
+ *
+ * The types live here, not in the SDK's shared types, so this entry point stands alone.
+ */
+import { PRIVACY_FACTS, PRIVACY_REGISTRY_VERSION } from './facts.generated.js';
+export { PRIVACY_FACTS, PRIVACY_REGISTRY_VERSION };
+const BY_ID = new Map(PRIVACY_FACTS.map((fact) => [fact.id, fact]));
+/** The fact with this id, or undefined for an id this SDK release does not know. */
+export function privacyFact(id) {
+    return BY_ID.get(id);
+}
+/** Whether this SDK release marks the fact enforced. An unknown id is not. */
+export function isFactEnforced(id) {
+    return BY_ID.get(id)?.status === 'enforced';
+}
+/**
+ * Enforced in this SDK release AND listed by the deployed API, and for a device fact also named in `deviceFacts`.
+ * Missing capabilities mean nothing is live.
+ */
+export function isFactLive(id, capabilities, options = {}) {
+    const fact = BY_ID.get(id);
+    if (!fact || fact.status !== 'enforced')
+        return false;
+    if (!Array.isArray(capabilities?.facts) || !capabilities.facts.includes(id))
+        return false;
+    if (fact.enforcement === 'device')
+        return new Set(options.deviceFacts ?? []).has(id);
+    return true;
+}
+/** Every fact that is live for this API (and, for device facts, this app's native module), in registry order. */
+export function liveFacts(capabilities, options = {}) {
+    const deviceFacts = [...(options.deviceFacts ?? [])];
+    return PRIVACY_FACTS.filter((fact) => isFactLive(fact.id, capabilities, { deviceFacts })).map((fact) => fact.id);
+}

package/dist/resources/discovery-merge.d.ts

@@ -54,6 +54,20 @@ export declare function discoveryRowTitle(row: unknown): string | null;
 export declare function discoveryLeadable(item: DiscoveryPostItem): boolean;
 /** A post with a picture or a video of its own that the reader sees unblurred. */
 export declare function discoveryShowsMedia(item: DiscoveryPostItem): boolean;
+/**
+ * What makes an item the same post as another on one screen: its key, and for an open-network post its network and id
+ * as the network spells it (a Nostr event id in any case) and each picture or clip file it carries (by address, and by
+ * content hash for a file named by one). Two notes that carry one clip are one post to a reader: a bot posting it
+ * again, a mirror account, the source index's copy beside the provider's. A Minds post is its key alone.
+ */
+export declare function discoveryItemIdentities(item: DiscoveryItem): string[];
+/**
+ * The rows with each post shown once: a post item whose identity (discoveryItemIdentities) is in `shown`, or was on an
+ * earlier item of the rows, leaves its module, which keeps its spec in step; a module of posts left with none is dropped.
+ * A story keeps its headline when its posts go, and rows that are not modules pass as they are. `shown` gains the
+ * identities of every post kept.
+ */
+export declare function withoutRepeatedDiscoveryItems<T>(rows: readonly T[], shown?: Set<string>): T[];
 /** A player found this video file (or HLS playlist) will not play: no Discover module promotes it, and it gets no video boost. */
 export declare function reportDiscoveryVideoUnavailable(url: string): void;
 /** Forget every report (a test seam, or a new viewer). */
@@ -151,7 +165,9 @@ export declare function weaveDiscoveryArrival<T extends {
  * that are not posts (a story, a rail, a row of the client's own) take the places they would have had woven in one by
  * one, and the posts fill the other places by engagement under the network mix (DiscoveryEngagementMerge). The first
  * post at the top of the feed, or below the line where it turned (`floor`), leads what comes under it (takeLead): never
- * a post with no picture or clip that nobody engaged with while the batch holds one with either.
+ * a post with no picture or clip that nobody engaged with while the batch holds one with either. A post the rows already
+ * show, or that arrives twice (the same open-network post, or another note with the same clip: discoveryItemIdentities),
+ * is shown once, where it was first.
  */
 export declare function mergeDiscoveryArrival<T extends {
     id: string;

package/dist/resources/discovery-merge.js

@@ -130,6 +130,79 @@ export function discoveryLeadable(item) {
 export function discoveryShowsMedia(item) {
     return discoveryLeadable(item) && hasMedia(item.post.media);
 }
+// ── One post, shown once ────────────────────────────────────────────────
+/** A file named by its SHA-256 (Blossom, nostr.build): the same bytes wherever they are served from. */
+const CONTENT_HASH = /\/([0-9a-f]{64})(?:\.[a-z0-9]{1,8})?$/i;
+/**
+ * What makes an item the same post as another on one screen: its key, and for an open-network post its network and id
+ * as the network spells it (a Nostr event id in any case) and each picture or clip file it carries (by address, and by
+ * content hash for a file named by one). Two notes that carry one clip are one post to a reader: a bot posting it
+ * again, a mirror account, the source index's copy beside the provider's. A Minds post is its key alone.
+ */
+export function discoveryItemIdentities(item) {
+    if (item.kind !== 'social')
+        return [item.key];
+    const post = item.post;
+    const identities = [item.key];
+    if (typeof post.protocol === 'string' && typeof post.nativeId === 'string' && post.nativeId) {
+        identities.push(`post:${post.protocol}:${post.protocol === 'nostr' ? post.nativeId.toLowerCase() : post.nativeId}`);
+    }
+    for (const entry of Array.isArray(post.media) ? post.media : []) {
+        const url = entry?.url;
+        if (typeof url !== 'string' || !/^https?:\/\//i.test(url))
+            continue;
+        const address = url.split('#')[0];
+        identities.push(`media:${address}`);
+        const hash = CONTENT_HASH.exec(address.split('?')[0])?.[1];
+        if (hash)
+            identities.push(`blob:${hash.toLowerCase()}`);
+    }
+    return identities;
+}
+/**
+ * The rows with each post shown once: a post item whose identity (discoveryItemIdentities) is in `shown`, or was on an
+ * earlier item of the rows, leaves its module, which keeps its spec in step; a module of posts left with none is dropped.
+ * A story keeps its headline when its posts go, and rows that are not modules pass as they are. `shown` gains the
+ * identities of every post kept.
+ */
+export function withoutRepeatedDiscoveryItems(rows, shown = new Set()) {
+    const out = [];
+    for (const row of rows) {
+        if (!isModule(row)) {
+            out.push(row);
+            continue;
+        }
+        const items = row.items.filter(item => {
+            if (!isPostItem(item))
+                return true;
+            const identities = discoveryItemIdentities(item);
+            if (identities.some(identity => shown.has(identity)))
+                return false;
+            for (const identity of identities)
+                shown.add(identity);
+            return true;
+        });
+        if (items.length === row.items.length) {
+            out.push(row);
+            continue;
+        }
+        if (!items.some(item => isPostItem(item) || item.kind === 'cluster'))
+            continue;
+        out.push(withItems(row, items));
+    }
+    return out;
+}
+/** The identities of every post the rows show (discoveryItemIdentities). */
+function shownIdentities(rows) {
+    const shown = new Set();
+    for (const row of rows)
+        if (isModule(row))
+            for (const item of row.items)
+                if (isPostItem(item))
+                    for (const identity of discoveryItemIdentities(item))
+                        shown.add(identity);
+    return shown;
+}
 // ── Videos that can play ────────────────────────────────────────────────
 /** Video files (or playlists) a player found will not play this session: never promoted again. */
 const UNAVAILABLE_VIDEOS = new Set();
@@ -332,9 +405,12 @@ export function poolDiscoveryGalleries(modules, now, keep) {
     for (const galleries of themes.values()) {
         const seen = new Set();
         const cards = galleries.flatMap((gallery, from) => gallery.items.filter(isPostItem).flatMap((item, index) => {
-            if (seen.has(item.key))
+            // One card per post: a picture two galleries (or two notes) carry is pooled once (discoveryItemIdentities).
+            const identities = discoveryItemIdentities(item);
+            if (identities.some(identity => seen.has(identity)))
                 return [];
-            seen.add(item.key);
+            for (const identity of identities)
+                seen.add(identity);
             return [{ item, gallery, network: discoveryPostNetwork(item), rank: rankDiscoveryItem(item, reference, now), order: index * galleries.length + from }];
         })).sort((a, b) => a.rank.tier - b.rank.tier || b.rank.score - a.rank.score || a.order - b.order);
         const counts = new Map();
@@ -492,12 +568,16 @@ export function weaveDiscoveryArrival(rows, arriving, reached, floor = 0) {
  * that are not posts (a story, a rail, a row of the client's own) take the places they would have had woven in one by
  * one, and the posts fill the other places by engagement under the network mix (DiscoveryEngagementMerge). The first
  * post at the top of the feed, or below the line where it turned (`floor`), leads what comes under it (takeLead): never
- * a post with no picture or clip that nobody engaged with while the batch holds one with either.
+ * a post with no picture or clip that nobody engaged with while the batch holds one with either. A post the rows already
+ * show, or that arrives twice (the same open-network post, or another note with the same clip: discoveryItemIdentities),
+ * is shown once, where it was first.
  */
 export function mergeDiscoveryArrival(rows, arriving, reached, floor = 0, now = Date.now()) {
     const at = arrivalPlace(rows, reached, floor);
     const head = rows.slice(0, at);
-    const below = at >= rows.length ? [...arriving] : weave(arriving, rows.slice(at));
+    // A post already in the rows, or twice in what arrives, is shown once: where it was first (withoutRepeatedDiscoveryItems).
+    const fresh = withoutRepeatedDiscoveryItems(arriving, shownIdentities(rows));
+    const below = at >= rows.length ? fresh : weave(fresh, rows.slice(at));
     const posts = below.filter(isDiscoveryPostModule);
     if (!posts.length)
         return [...head, ...below];

package/dist/resources/discovery-progressive.d.ts

@@ -77,9 +77,10 @@ export declare const FIRST_SCREEN_MS = 2500;
  */
 export declare const VISITOR_FIRST_SCREEN_MS = 800;
 /**
- * A module without the items in `seen` (item keys). Posts already shown by another source's module are not shown again:
- * the sessions dedupe within themselves, but across them a story's member posts can also arrive in that network's own
- * page. A module that loses items keeps its spec in step. A suggestion already shown leaves its rail, and a rail left
+ * A module without the items in `seen` (item keys, or any identity of a post: discoveryItemIdentities). Posts already
+ * shown by another source's module are not shown again: the sessions dedupe within themselves, but across them a story's
+ * member posts can also arrive in that network's own page, and one clip in two notes. A module that loses items keeps
+ * its spec in step. A suggestion already shown leaves its rail, and a rail left
  * with fewer than two is dropped; a story already shown is dropped whole, and keeps its headline and outlets when only
  * its posts were shown; a post module with none left is dropped (null).
  */

package/dist/resources/discovery-progressive.js

@@ -1,5 +1,6 @@
 import { readFalloverSteps } from './discovery-fallover.js';
 import { composeFirstScreen } from './discovery-first-screen.js';
+import { discoveryItemIdentities } from './discovery-merge.js';
 /** How long a round keeps waiting for its slower sources once one of them has answered. */
 export const DISCOVERY_STRAGGLER_MS = 3000;
 /**
@@ -22,9 +23,10 @@ const isSuggestion = (item) => item.kind === 'group' || item.kind === 'person' |
 /** A suggestion rail with fewer is not drawn: the session builds none with fewer either. */
 const SUGGESTIONS_MIN = 2;
 /**
- * A module without the items in `seen` (item keys). Posts already shown by another source's module are not shown again:
- * the sessions dedupe within themselves, but across them a story's member posts can also arrive in that network's own
- * page. A module that loses items keeps its spec in step. A suggestion already shown leaves its rail, and a rail left
+ * A module without the items in `seen` (item keys, or any identity of a post: discoveryItemIdentities). Posts already
+ * shown by another source's module are not shown again: the sessions dedupe within themselves, but across them a story's
+ * member posts can also arrive in that network's own page, and one clip in two notes. A module that loses items keeps
+ * its spec in step. A suggestion already shown leaves its rail, and a rail left
  * with fewer than two is dropped; a story already shown is dropped whole, and keeps its headline and outlets when only
  * its posts were shown; a post module with none left is dropped (null).
  */
@@ -32,7 +34,7 @@ export function withoutSeenItems(module, seen) {
     const lead = module.items[0];
     if (lead?.kind === 'cluster' && seen.has(lead.key))
         return null;
-    const items = module.items.filter(item => item.kind === 'cluster' || !seen.has(item.key));
+    const items = module.items.filter(item => item.kind === 'cluster' || !discoveryItemIdentities(item).some(identity => seen.has(identity)));
     if (items.length === module.items.length)
         return module;
     if (module.items.some(isSuggestion)) {
@@ -46,14 +48,15 @@ export function withoutSeenItems(module, seen) {
                 module: { ...element, props: { ...element.props, itemKeys: items.map(item => item.key) } } } } };
 }
 /**
- * Claims the posts a module shows, and only those. A story claims the members it carries, never its whole member list:
- * the Minds session reads a story's network members only through its member reader, which may fail, time out or be
- * missing. A member the story does not carry still shows in its network's own page.
+ * Claims the posts a module shows, and only those, by every identity (discoveryItemIdentities). A story claims the members
+ * it carries, never its whole member list: the Minds session reads a story's network members only through its member
+ * reader, which may fail, time out or be missing. A member the story does not carry still shows in its network's own page.
  */
 function remember(module, seen) {
     for (const item of module.items)
         if (isPost(item))
-            seen.add(item.key);
+            for (const identity of discoveryItemIdentities(item))
+                seen.add(identity);
 }
 /** The other networks a feed over every source reads, in the session's own order. */
 export function discoveryRemoteSources(networks, source) {

package/dist/resources/discovery.d.ts

@@ -506,7 +506,15 @@ export interface DiscoveryModule {
     id: string;
     presentation: DiscoveryLayout['presentation'] | DiscoveryRecommendationKind | DiscoveryRadarPresentation;
     source: DiscoveryLayout['source'];
-    /** Subject of the featured window (a browse-category id or `mixed`), for specific module copy. */
+    /**
+     * Subject of the module (a browse-category id), for specific module copy ("Videos in Science"). A post module carries
+     * one only when its featured window was themed so AND most of its own posts were judged into that category (0.7.84):
+     * a window's theme is one judgment of up to six posts taken together, and the module features some of them (one clip,
+     * a conversation) or gathers pictures from the whole page, so an open-network clip with no judgment of its own was
+     * titled after its neighbours ("Videos in Technology" over a Nostr clip of birds). Today a post is judged into a
+     * category when a category feed served it (the read's category filter), so modules on a feed with no category carry
+     * none. A radar story carries its cluster's theme. Absent: title the module by its kind alone.
+     */
     theme?: string;
     items: DiscoveryItem[];
     spec: {

package/dist/resources/discovery.js

@@ -1,4 +1,6 @@
+import { SOCIAL_PROTOCOL_IDS } from '../social-protocol-ids.js';
 import { readFalloverSteps } from './discovery-fallover.js';
+import { discoveryItemIdentities } from './discovery-merge.js';
 import { createDiscoveryTopShare, createProgressiveFeed } from './discovery-progressive.js';
 export * from './discovery-fallover.js';
 export * from './discovery-first-screen.js';
@@ -142,7 +144,8 @@ function recommendationItem(kind, candidate) {
     return { key: `rec:tag:${(nonEmpty(value.slug) ? value.slug : value.name).toLowerCase()}`, kind: 'tag', tag: value };
 }
 const RADAR_KINDS = new Set(['breaking', 'viral', 'story']);
-const RADAR_SOCIAL_KINDS = new Set(['bluesky', 'activitypub', 'nostr']);
+/** A radar member's open network (SOCIAL_PROTOCOL_IDS, Farcaster included before the radar holds any); another kind is skipped. */
+const RADAR_SOCIAL_KINDS = new Set(SOCIAL_PROTOCOL_IDS);
 const httpUrl = (value) => typeof value === 'string' && value.length <= 4096 && /^https?:\/\//i.test(value);
 const countOf = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : null;
 const dimension = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value > 0 ? value : undefined;
@@ -271,7 +274,8 @@ export function pickRadarCluster(clusters, page, options = {}) {
     }
     return breaking[0] ?? unused[0];
 }
-const TOP_NETWORKS = new Set(['bluesky', 'activitypub', 'nostr']);
+/** A feed top's open-network item or lane (SOCIAL_PROTOCOL_IDS); a session keeps only the networks it reads (`readyTop`). */
+const TOP_NETWORKS = new Set(SOCIAL_PROTOCOL_IDS);
 const idString = (value) => typeof value === 'string' && value.length > 0 && value.length <= 4096;
 const counted = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : null;
 /** The refs an app's seen set may hold for a post: its id, or '<protocol>/<nativeId>' (an ActivityPub id also without https://). */
@@ -339,6 +343,19 @@ function topItemSeenRefs(value) {
 }
 const ordinary = { version: 'discovery-layout-v1', presentation: 'posts', source: 'fallback' };
 const key = (protocol, id) => JSON.stringify([protocol, id]);
+/** The judgment of a read made in `category`: its category filter's selection, when that is the category asked. */
+const judgedInto = (category, filter) => (category && filter?.selected === category ? { judged: category } : {});
+/** The judgment of a read's item at `index`. */
+const judgmentAt = (read, index) => (read.judgments ? read.judgments[index] : read.judged);
+/**
+ * A featured module's theme: its lead window's, only when most of the module's own posts were judged into it (see
+ * DiscoveryModule.theme). Never `mixed`.
+ */
+function judgedTheme(theme, judged) {
+    if (!theme || theme === 'mixed' || !judged.length)
+        return undefined;
+    return judged.filter(category => category === theme).length * 2 > judged.length ? theme : undefined;
+}
 const presentations = new Set(['posts', 'visual', 'conversation', 'video', 'thread', 'longread']);
 /** A gallery strip holds up to twelve image posts gathered from the whole page. */
 export const GALLERY_MAX_ITEMS = 12;
@@ -464,7 +481,7 @@ export class DiscoveryFeedSession {
                     ? { key: key(row.post.protocol, row.post.nativeId), kind: 'social', post: row.post }
                     : { key: key('minds', row.id), kind: 'minds', post: row }));
                 const read = { layout: response.meta.discovery ?? ordinary, partial: response.meta.category_filter?.status === 'partial',
-                    ...(response.meta.compass_filter ? { compass: response.meta.compass_filter } : {}) };
+                    ...(response.meta.compass_filter ? { compass: response.meta.compass_filter } : {}), ...judgedInto(this.category, response.meta.category_filter) };
                 if (!this.filtering)
                     return { items, ...read };
                 head ??= read;
@@ -518,7 +535,7 @@ export class DiscoveryFeedSession {
         const kept = data.items.flatMap((post, index) => this.metNetworkPost(post) ? [] : [{ post, index }]);
         const layout = data.discovery ?? ordinary;
         return { items: kept.map(({ post }) => ({ key: key(post.protocol, post.nativeId), kind: 'social', post })), layout, partial: data.categoryFilter?.status === 'partial',
-            ...(kept.length !== data.items.length ? { layouts: kept.map(({ index }) => windowLayout(layout, index)) } : {}) };
+            ...(kept.length !== data.items.length ? { layouts: kept.map(({ index }) => windowLayout(layout, index)) } : {}), ...judgedInto(this.category, data.categoryFilter) };
     }
     /** An open-network post in the member's seen set (options.seen: '<protocol>/<nativeId>', an ActivityPub id also without https://). */
     metNetworkPost(post) {
@@ -607,7 +624,8 @@ export class DiscoveryFeedSession {
             const items = (indexed ? data.items.filter(post => !this.seen.has(key(post.protocol, post.nativeId))) : data.items).filter(post => !this.metNetworkPost(post));
             if (items.length) {
                 stream.done = !topics.length;
-                return { items: items.map(post => ({ key: key(post.protocol, post.nativeId), kind: 'social', post })), layout: data.discovery ?? ordinary, partial };
+                return { items: items.map(post => ({ key: key(post.protocol, post.nativeId), kind: 'social', post })), layout: data.discovery ?? ordinary, partial,
+                    ...judgedInto(this.category, data.categoryFilter) };
             }
         }
         while (topics[0] && passedOver() && !topics[0].cursor?.startsWith(INDEX_CURSOR))
@@ -680,17 +698,25 @@ export class DiscoveryFeedSession {
         // Round-robin before grouping: the largest network cannot occupy every slot.
         // Each item carries the judgment for its own window of its source response,
         // so one page can feature several modules instead of one per source batch.
+        // A post is shown once by every identity (discoveryItemIdentities): a second note carrying a clip already placed is
+        // the same post to a reader, on this page or a later one.
         const mixed = [];
         for (let index = 0; index < Math.max(0, ...reads.map(read => read.items.length)); index++)
             for (const read of reads) {
                 const item = read.items[index];
-                if (!item || this.seen.has(item.key))
+                if (!item)
+                    continue;
+                const identities = discoveryItemIdentities(item);
+                if (identities.some(identity => this.seen.has(identity)))
                     continue;
-                this.seen.add(item.key);
-                mixed.push({ item, layout: read.layouts?.[index] ?? windowLayout(read.layout, index) });
+                for (const identity of identities)
+                    this.seen.add(identity);
+                const judged = judgmentAt(read, index);
+                mixed.push({ item, layout: read.layouts?.[index] ?? windowLayout(read.layout, index), ...(judged ? { judged } : {}) });
             }
-        // Deduplication memory is bounded independently of the UI's virtual window.
-        while (this.seen.size > 4096)
+        // Deduplication memory is bounded independently of the UI's virtual window: an open-network post holds a few
+        // identities (its key, its id and its files), so the bound that held 4096 keys holds four times as many entries.
+        while (this.seen.size > 16_384)
             this.seen.delete(this.seen.values().next().value);
         const modules = topItems.map((item, index) => this.topModule(this.page, index, item));
         const page = this.page++;
@@ -707,9 +733,22 @@ export class DiscoveryFeedSession {
             const onPage = remaining.filter(row => members.has(row.item.key)).map(row => row.item);
             const carried = new Set(onPage.map(item => item.key));
             // Members this page did not carry come from the story's own reads; one an earlier page showed stays shown there.
-            const read = (await this.memberPosts(cluster)).filter(item => !carried.has(item.key) && !this.seen.has(item.key));
+            // They are taken one at a time in the story's member order, each adding its identities as it is kept, so two
+            // members of one read that carry one clip (a mirror note on another server) show once: the one the story lists first.
+            const order = (item) => cluster.memberKeys.indexOf(item.key);
+            const read = [];
+            for (const item of [...await this.memberPosts(cluster)].sort((a, b) => order(a) - order(b))) {
+                if (carried.has(item.key))
+                    continue;
+                const identities = discoveryItemIdentities(item);
+                if (identities.some(identity => this.seen.has(identity)))
+                    continue;
+                for (const identity of identities)
+                    this.seen.add(identity);
+                read.push(item);
+            }
             // Under the story, posts keep the server's member order: the lead media member first, then by member score.
-            clusterItems = [...onPage, ...read].sort((a, b) => cluster.memberKeys.indexOf(a.key) - cluster.memberKeys.indexOf(b.key));
+            clusterItems = [...onPage, ...read].sort((a, b) => order(a) - order(b));
             remaining = remaining.filter(row => !members.has(row.item.key));
             for (const memberKey of cluster.memberKeys)
                 this.seen.add(memberKey);
@@ -742,7 +781,8 @@ export class DiscoveryFeedSession {
             const selected = visual ? images : discussion ? conversations : thread ? quotes : [first];
             const items = selected.map(row => row.item);
             const type = video ? 'DiscoveryVideo' : visual ? 'DiscoveryGallery' : discussion ? 'DiscoveryConversation' : thread ? 'DiscoveryThread' : longread ? 'DiscoveryLongRead' : 'DiscoveryPosts';
-            const theme = presentation !== 'posts' && first.layout.theme && first.layout.theme !== 'mixed' ? first.layout.theme : undefined;
+            // Titled after its lead window's theme only when most of its own posts were judged into it (DiscoveryModule.theme).
+            const theme = presentation !== 'posts' ? judgedTheme(first.layout.theme, selected.map(row => row.judged)) : undefined;
             modules.push({ id: `discovery-${page}-${index}-${items[0].key}`, presentation, source: presentation === 'posts' ? 'fallback' : 'jev', items, ...(theme ? { theme } : {}),
                 spec: { root: 'module', elements: { module: { type, props: { itemKeys: items.map(item => item.key) }, children: [] } } } });
             const selectedKeys = new Set(items.map(item => item.key));
@@ -848,7 +888,7 @@ export class DiscoveryFeedSession {
         }
         const lanes = new Map();
         const networks = value.networks && typeof value.networks === 'object' ? value.networks : {};
-        for (const protocol of TOP_NETWORKS) {
+        for (const protocol of SOCIAL_PROTOCOL_IDS) {
             const entries = networks[protocol];
             if (!streams.has(protocol) || !Array.isArray(entries))
                 continue;
@@ -917,7 +957,9 @@ export class DiscoveryFeedSession {
             const read = at >= 0 ? reads[at] : null;
             if (read) {
                 const kept = read.previews ? [] : read.items;
-                reads[at] = { ...read, items: [...lane, ...kept], layouts: [...lane.map(() => ordinary), ...kept.map((_item, index) => read.layouts?.[index] ?? windowLayout(read.layout, index))] };
+                // The lane's posts lead the read's; they carry no judgment of the read's category.
+                reads[at] = { ...read, items: [...lane, ...kept], layouts: [...lane.map(() => ordinary), ...kept.map((_item, index) => read.layouts?.[index] ?? windowLayout(read.layout, index))],
+                    judgments: [...lane.map(() => undefined), ...kept.map((_item, index) => judgmentAt(read, index))] };
             }
             else if (this.streams.some(stream => stream.protocol === protocol))
                 reads.push({ items: lane, layout: ordinary, partial: false });
@@ -930,10 +972,15 @@ export class DiscoveryFeedSession {
             const found = top.posts.get(row.key) ?? carried.get(row.key);
             if (!found || this.seen.has(row.key))
                 continue;
+            const identities = discoveryItemIdentities(found);
+            if (identities.some(identity => this.seen.has(identity)))
+                continue;
             const position = top.positions.get(row.ref) ?? placed.length;
             placed.push({ ...found, top: { ref: row.ref, position, block: position < 10 ? 'top' : 'below' } });
             this.seen.add(row.key);
             this.topKeys.add(row.key);
+            for (const identity of identities)
+                this.seen.add(identity);
         }
         return placed;
     }