@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/activitypub/handlers/inbox-content-handlers.ts

@@ -1,4 +1,5 @@
 import type { Database } from "../../../../db/index.ts";
+import type { SQLiteColumn } from "drizzle-orm/sqlite-core";
 import {
   and,
   count,
@@ -7,72 +8,100 @@ import {
   inArray,
   isNotNull,
   isNull,
+  notExists,
   or,
   sql,
 } from "drizzle-orm";
-import type { BatchItem } from "drizzle-orm/batch";
 import {
   activities,
   actorCache,
   actors,
   announces,
-  blocks,
   bookmarks,
   communities,
+  deliveryEndpointRecipients,
+  deliveryQueue,
+  deliveryResolutions,
   follows,
   inbox as inboxTable,
   likes,
   objectRecipients,
   objects,
+  remoteActorFetchFailures,
+  remoteActorTombstones,
   storyShares,
   storyViews,
   storyVotes,
 } from "../../../../db/index.ts";
+import { insertMany, runBatch } from "../../../../db/d1-write.ts";
+import {
+  addressesPublic,
+  collectBoundedInboundAddresses,
+} from "../inbound-addressing.ts";
 import { upsertActivityAndNotify } from "./inbox-shared-helpers.ts";
 import { normalizeInboundTimestamp } from "./inbound-timestamp.ts";
+import { resolveInboundCommunityScope } from "./inbound-community-scope.ts";
+import {
+  MAX_INBOUND_OBJECT_ID_LENGTH,
+  validateInboundObjectIdentity,
+} from "./inbound-object-identity.ts";
+import { validateInboundReplyTarget } from "./inbound-reply-target.ts";
+import {
+  buildInboundStoryCreateProjection,
+  buildInboundStoryUpdateProjection,
+  declaresStoryAddressing,
+  hasStoryProjectionUpdate,
+  normalizeInboundStoryCreateEndTime,
+  normalizeInboundStoryUpdateEndTime,
+  storyAddressedCollections,
+} from "./inbound-story-projection.ts";
 import {
   deleteObjectCascade,
   purgeMediaBlobs,
 } from "../../posts/delete-cascade.ts";
 import {
-  boundAttachmentsJson,
   boundInboundContent,
+  boundInboundNoteAttachmentsJson,
   boundInboundSummary,
-  MAX_ATTACHMENTS_JSON_LENGTH,
-  MAX_POST_CONTENT_LENGTH,
-  MAX_POST_SUMMARY_LENGTH,
-  truncate,
+  boundInboundTagsJson,
 } from "../../posts/transformers.ts";
 import {
   activityApId,
   generateId,
-  getDomain,
   isLocal,
   isSafeRemoteUrl,
-  objectApId,
 } from "../../../federation-helpers.ts";
 import { getConversationId } from "../../dm/query-helpers.ts";
 import {
   fetchAndUpsertActorCache,
   getInstanceFetchSignerByDb,
 } from "../../../lib/activitypub-actor-cache.ts";
+import {
+  isSameActivityPubActor,
+  normalizeActivityPubActorId,
+} from "../../../lib/activitypub-actor-identity.ts";
+import { activityPubActorIdentityMatchesSql } from "../../../lib/activitypub-actor-identity-sql.ts";
 import { fetchWithTimeout } from "../../../lib/federation-fetch.ts";
 import { signRequest } from "../../../lib/ap-signing.ts";
-import { enqueueDeliveryToActor } from "../../../lib/delivery/queue.ts";
-import { destinationDeclaresAlias } from "../../../lib/account-migration.ts";
+import {
+  destinationDeclaresAlias,
+  enqueuePersistedMoveRefollows,
+  moveRefollowPrefix,
+  rewriteMovedFollowGraph,
+} from "../../../lib/account-migration.ts";
 import { chunkForInClause } from "../../../lib/chunk.ts";
 import {
-  actorIsBlockedBy,
+  actorSuppressesInteractionFrom,
   canViewerReadObjectFull,
 } from "../../../lib/post-visibility.ts";
 import { logger } from "../../../lib/logger.ts";
+import { anyOwnerSuppressesInboundActor } from "../../../lib/personal-actor-moderation.ts";
 import {
   type Activity,
   type ActivityContext,
   type ActivityObject,
   getActivityObject,
   getActivityObjectId,
-  type StoryOverlay,
   typeIncludes,
 } from "../inbox-types.ts";
 
@@ -83,29 +112,6 @@ type ActorRow = typeof actors.$inferSelect;
 // normalizeInboundTimestamp now lives in ./inbound-timestamp.ts (shared with the
 // federated group-chat path) — imported at the top of this file.
 
-// ---------------------------------------------------------------------------
-// Atomic multi-statement commit (mirrors posts/interactions.ts `runBatch` and
-// the inbox-interaction / inbox-shared helper). D1 has no interactive
-// transactions, but both the D1 and libsql drivers expose `db.batch([...])`,
-// which commits a list of prepared statements atomically. The shared
-// `Database` union aliases the abstract `BaseSQLiteDatabase` base (which does
-// not surface `batch`), so we narrow to the concrete batch surface here.
-// ---------------------------------------------------------------------------
-
-type BatchStatement = BatchItem<"sqlite">;
-interface BatchableDb {
-  batch(
-    statements: readonly [BatchStatement, ...BatchStatement[]],
-  ): Promise<unknown>;
-}
-
-async function runBatch(
-  db: Database,
-  statements: readonly [BatchStatement, ...BatchStatement[]],
-): Promise<void> {
-  await (db as unknown as BatchableDb).batch(statements);
-}
-
 // Federation blocklist enforcement lives centrally in
 // `verifyAndParseInbox` (routes/activitypub/inbox.ts): every inbound
 // activity is gated once there before any handler runs, so the per-handler
@@ -120,6 +126,14 @@ function isStoryType(type: string | string[] | undefined): boolean {
   return Array.isArray(type) ? type.includes("Story") : type === "Story";
 }
 
+/** Single-user instance policy: any local owner block/mute suppresses content writes. */
+async function ownerSuppressesInboundActor(
+  db: Database,
+  actorApId: string,
+): Promise<boolean> {
+  return anyOwnerSuppressesInboundActor(db, actorApId);
+}
+
 // The actor object types whose inbound Update represents a remote
 // profile / avatar / public-key change that should refresh the actor cache.
 const ACTOR_OBJECT_TYPES = new Set([
@@ -143,18 +157,6 @@ function isActorTypeUpdate(type: string | string[] | undefined): boolean {
     : ACTOR_OBJECT_TYPES.has(type);
 }
 
-// The ActivityStreams public-collection magic value, including the legacy
-// short forms some implementations still emit.
-export const PUBLIC_COLLECTION = new Set([
-  "https://www.w3.org/ns/activitystreams#Public",
-  "as:Public",
-  "Public",
-]);
-
-export function addressesPublic(addresses: string[]): boolean {
-  return addresses.some((a) => PUBLIC_COLLECTION.has(a));
-}
-
 // A note addressed to a followers collection (the author's `<actor>/followers`)
 // and NOT to Public is a followers-only post. We match any `/followers`
 // collection by suffix (mirrors isDirectNote), which covers the author's
@@ -163,29 +165,115 @@ export function addressesFollowers(addresses: string[]): boolean {
   return addresses.some((a) => a.endsWith("/followers"));
 }
 
+type NoteAddressing = {
+  readonly to: string[];
+  readonly cc: string[];
+  readonly bto: string[];
+  readonly bcc: string[];
+};
+
+type AddressingSource = Pick<Activity, "to" | "cc" | "bto" | "bcc">;
+
+function declaresAddressing(source: AddressingSource): boolean {
+  return (
+    source.to !== undefined ||
+    source.cc !== undefined ||
+    source.bto !== undefined ||
+    source.bcc !== undefined
+  );
+}
+
+function noteAddressing(source: AddressingSource): NoteAddressing {
+  return {
+    to: addressList(source.to),
+    cc: addressList(source.cc),
+    bto: addressList(source.bto),
+    bcc: addressList(source.bcc),
+  };
+}
+
+/**
+ * Resolve the Note reach carried by a Create. The embedded object is the
+ * durable object projection when it declares any addressing field (including
+ * an explicit empty array); peers that put all addressing on the Create
+ * envelope remain compatible through the fallback.
+ */
+function createNoteAddressing(
+  activity: Activity,
+  object: ActivityObject,
+): NoteAddressing {
+  return noteAddressing(declaresAddressing(object) ? object : activity);
+}
+
+function allNoteAddresses(addressing: NoteAddressing): string[] {
+  return [
+    ...addressing.to,
+    ...addressing.cc,
+    ...addressing.bto,
+    ...addressing.bcc,
+  ];
+}
+
+/**
+ * Bounded actor/specific-object recipients, excluding collection reach. These
+ * become indexed object_recipients authority. `bto`/`bcc` values never enter
+ * the public to_json/cc_json projections.
+ */
+function specificRecipientAddresses(addressing: NoteAddressing): string[] {
+  return [...new Set(allNoteAddresses(addressing))].filter(
+    (address) => !addressesPublic([address]) && !address.endsWith("/followers"),
+  );
+}
+
+function hiddenRecipientAddresses(addressing: NoteAddressing): string[] {
+  return [...new Set([...addressing.bto, ...addressing.bcc])].filter(
+    (address) => !addressesPublic([address]) && !address.endsWith("/followers"),
+  );
+}
+
+/**
+ * Derive an object's reply counter from the indexed child edge set.
+ *
+ * Federation delivery is unordered: a child can commit while its parent is
+ * still unknown, making the child's immediate parent UPDATE a legitimate
+ * zero-row no-op. Every later parent insert or duplicate delivery must run this
+ * statement after the insert attempt so both arrival orders — and old stale
+ * rows — converge without depending on a child retry.
+ */
+function recomputeObjectReplyCount(db: Database, objectId: string) {
+  return db
+    .update(objects)
+    .set({
+      replyCount: sql`(SELECT COUNT(*) FROM ${objects} WHERE ${objects.inReplyTo} = ${objectId})`,
+    })
+    .where(eq(objects.apId, objectId));
+}
+
 /**
  * Recipient-INDEPENDENT visibility classification for an inbound generic Note,
  * mirroring the local outbound addressing contract. CRITICAL invariant: a
  * non-public Note is NEVER classified as "unlisted" (world-readable). Direct
- * (addressed-to-specific-actors-only) Notes are diverted BEFORE this is reached
- * (insertDirectNote / the direct-shaped skip), so the residual here is:
+ * addressed Notes are normally diverted before the generic Create insert, but
+ * the classifier itself remains total so every caller fails closed:
  *   - "public"    — the Public collection is in `to`;
- *   - "unlisted"  — Public is only in `cc` (Mastodon-style unlisted), or the
- *                   note carries no usable addressing at all;
+ *   - "unlisted"  — Public is only in `cc` (Mastodon-style unlisted);
  *   - "followers" — a followers collection is addressed and Public is absent.
+ *   - "direct"    — only actor IRIs, or no usable addressing at all. The empty
+ *                   case is intentionally unreadable rather than world-readable.
  * Previously this was derived solely from `to.includes(Public)`, so a remote
  * followers-only post (Public absent) was silently downgraded to "unlisted" and
  * became world-readable. */
-function classifyInboundNoteVisibility(object: {
-  to?: string[];
-  cc?: string[];
-}): "public" | "unlisted" | "followers" {
-  const to = object.to ?? [];
-  const cc = object.cc ?? [];
+function classifyInboundNoteVisibility(
+  addressing: NoteAddressing,
+): "public" | "unlisted" | "followers" | "direct" {
+  const { to, cc, bto, bcc } = addressing;
   if (addressesPublic(to)) return "public";
   if (addressesPublic(cc)) return "unlisted";
-  if (addressesFollowers([...to, ...cc])) return "followers";
-  return "unlisted";
+  // Hidden fields are still audience authority. They are considered for reach
+  // classification but are never copied into visible addressing projections.
+  if (addressesPublic([...bto, ...bcc])) return "public";
+  if (addressesFollowers([...to, ...cc, ...bto, ...bcc])) return "followers";
+  return "direct";
 }
 
 /**
@@ -196,63 +284,42 @@ function classifyInboundNoteVisibility(object: {
  * insertDirectNote. Recipient-independent (keyed on the activity's own
  * addressing), unlike isDirectNote.
  */
-function isDirectShapedNote(object: { to?: string[]; cc?: string[] }): boolean {
-  const all = [...(object.to ?? []), ...(object.cc ?? [])];
+function isDirectShapedNote(addressing: NoteAddressing): boolean {
+  const all = allNoteAddresses(addressing);
   if (all.length === 0) return false;
   if (addressesPublic(all)) return false;
   if (addressesFollowers(all)) return false;
   return true;
 }
 
-// Cap persisted addressing arrays so a remote cannot bloat a row with a huge
-// to/cc list; 64 entries is far beyond any real audience and keeps the explicit-
-// recipient (mention) gate working.
-export const MAX_ADDRESS_ENTRIES = 64;
-function boundAddressJson(addresses: string[] | undefined): string {
-  if (!Array.isArray(addresses) || addresses.length === 0) return "[]";
-  return JSON.stringify(
-    addresses
-      .filter((a) => typeof a === "string")
-      .slice(0, MAX_ADDRESS_ENTRIES),
-  );
+function boundAddressJson(value: unknown): string {
+  return JSON.stringify(addressList(value));
 }
 
 /**
- * Normalize an AS2 addressing field (`to` / `cc` / `audience`) to a bounded list
- * of strings. The field may be absent, a bare string, or an array mixing
- * strings and embedded objects; only the string forms are usable as a
- * collection id, and the same 64-entry cap applies so a remote cannot force a
- * huge `IN (...)` lookup.
+ * Normalize one already-validated AS2 addressing field (`to` / `cc` /
+ * `audience`). The field may be absent, a bare string, or an array mixing
+ * strings and embedded objects. Validation happens once for the complete
+ * envelope/object projection before any caller derives reach from these lists.
  */
 function addressList(value: unknown): string[] {
   if (typeof value === "string") return [value];
   if (!Array.isArray(value)) return [];
-  return value
-    .filter((a): a is string => typeof a === "string")
-    .slice(0, MAX_ADDRESS_ENTRIES);
+  return [...new Set(value.filter((a): a is string => typeof a === "string"))];
 }
 
 /**
- * Reject an inbound object whose `object.id` is asserted under a host the
- * delivering actor does not control (object-ID squatting / cross-origin
- * injection). A remote actor may only Create objects under its own origin, and
- * never under the local domain. Returns true when the object id must be
- * rejected. Mirrors the ownership checks already enforced for Delete/Update.
+ * The embedded object's audience is the persisted object projection. Peers
+ * that put audience only on the activity envelope remain compatible, while an
+ * explicit object-level [] wins and can clear the scope on Update.
  */
-function isObjectIdOriginMismatch(
-  objectId: string | undefined,
-  actor: string,
-  baseUrl: string,
-): boolean {
-  if (!objectId) return false;
-  // A remote actor must never assert a local-domain object id.
-  if (isLocal(objectId, baseUrl)) return true;
-  try {
-    return getDomain(objectId) !== getDomain(actor);
-  } catch {
-    // Unparseable object id: treat as a mismatch (reject) rather than insert.
-    return true;
-  }
+function normalizedObjectAudience(
+  activity: Activity,
+  object: ActivityObject,
+): string[] {
+  const source =
+    object.audience !== undefined ? object.audience : activity.audience;
+  return [...new Set(addressList(source))];
 }
 
 /**
@@ -286,19 +353,18 @@ function extractMentionHrefs(tag: unknown): string[] {
 }
 
 /**
- * Detect an inbound direct (DM) Note: it is addressed (in `to`/`cc`) to one or
- * more recipients but NOT to the Public collection and NOT to a followers
- * collection. The local addressed recipient is the inbox owner (`recipient`),
- * who is necessarily a known local actor row. Mirrors the outbound DM contract
- * in dm/messages.ts (visibility="direct", to=[recipient]).
+ * Detect an inbound direct (DM) Note: it is addressed (in
+ * `to`/`cc`/`bto`/`bcc`) to one or more recipients but NOT to the Public
+ * collection and NOT to a followers collection. The local addressed recipient
+ * is the inbox owner (`recipient`), who is necessarily a known local actor row.
+ * Mirrors the outbound DM contract in dm/messages.ts (visibility="direct",
+ * to=[recipient]).
  */
 function isDirectNote(
-  object: { to?: string[]; cc?: string[] },
+  addressing: NoteAddressing,
   recipient: ActorRow,
 ): boolean {
-  const to = object.to ?? [];
-  const cc = object.cc ?? [];
-  const all = [...to, ...cc];
+  const all = allNoteAddresses(addressing);
   if (all.length === 0) return false;
   // Direct notes are never addressed to the Public collection...
   if (addressesPublic(all)) return false;
@@ -307,9 +373,10 @@ function isDirectNote(
   if (recipient.followersUrl && all.includes(recipient.followersUrl)) {
     return false;
   }
-  // The inbox owner must be explicitly addressed in `to` (the recipient set
-  // that defines a DM); a mere `cc` mention is not treated as a DM.
-  return to.includes(recipient.apId);
+  // Every AS2 audience field names recipients. `bto`/`bcc` are private, not
+  // non-authoritative; dropping them here makes a correctly routed hidden DM
+  // persist without recipient authority and therefore disappear from the UX.
+  return all.includes(recipient.apId);
 }
 
 /**
@@ -318,10 +385,10 @@ function isDirectNote(
  * dm/messages.ts: a direct-visibility Note row, an objectRecipients row, a
  * stored inbound Create activity, and an inbox row so it surfaces.
  *
- * Scope: a single local recipient (the inbox owner). The outbound DM model is
- * strictly 1:1 (to=[otherApId]) and `objects.conversation` is a single column,
- * so multi-recipient / group direct Notes are intentionally out of scope and
- * fall back to the generic Note insert.
+ * Each invocation records delivery for one local inbox owner. The outbound DM
+ * UX remains strictly 1:1 (to=[otherApId]), so only single-recipient direct
+ * Notes receive an `objects.conversation` id; multi-recipient delivery keeps
+ * recipient authority without pretending that it belongs to a 1:1 thread.
  */
 async function insertDirectNote(
   db: Database,
@@ -331,41 +398,35 @@ async function insertDirectNote(
   actor: string,
   recipient: ActorRow,
   baseUrl: string,
+  addressing: NoteAddressing,
+  parentId: string | null,
 ): Promise<void> {
   // Derive the conversation. Honour a sender-supplied `object.conversation`
   // only when it matches the value yurucommu itself would compute for this
   // (sender, localRecipient) pair — otherwise a remote actor could force a
   // message into an arbitrary thread (spoof a reply context). Fall back to the
   // computed id for foreign-origin DMs that carry no/invalid conversation.
-  const computedConversation = getConversationId(
-    baseUrl,
-    actor,
-    recipient.apId,
-  );
+  const directRecipients = specificRecipientAddresses(addressing);
+  const computedConversation =
+    directRecipients.length === 1
+      ? getConversationId(baseUrl, actor, directRecipients[0])
+      : null;
   const conversationId =
-    object.conversation === computedConversation
+    computedConversation && object.conversation === computedConversation
       ? object.conversation
       : computedConversation;
 
-  const attachments = object.attachment
-    ? JSON.stringify(object.attachment)
-    : "[]";
   const publishedAt = normalizeInboundTimestamp(
     object.published,
     new Date().toISOString(),
   );
-  const toJson = JSON.stringify([recipient.apId]);
-
-  // Was the object already present BEFORE this dispatch? This decides whether
-  // this delivery is the one that creates the row (and therefore the one that
-  // owns the postCount +1 and the inbox surfacing). It is read once here and
-  // used only to gate the post-commit side effects; the counter itself is made
-  // crash-/retry-safe by the in-batch NOT-EXISTS guard below.
-  const existingObject = await db
-    .select({ apId: objects.apId })
-    .from(objects)
-    .where(eq(objects.apId, objectId))
-    .get();
+
+  const replyCountStatements = [
+    ...(parentId ? [recomputeObjectReplyCount(db, parentId)] : []),
+    // A direct Note can itself be a late-arriving parent. Recompute even when
+    // the insert conflicts so a peer retry repairs a stale legacy counter.
+    recomputeObjectReplyCount(db, objectId),
+  ];
 
   // #3 (atomicity + idempotency): the object insert and the author postCount
   // bump MUST commit together. Previously the row was inserted
@@ -392,10 +453,15 @@ async function insertDirectNote(
         attributedTo: actor,
         content: boundInboundContent(object.content),
         summary: boundInboundSummary(object.summary),
-        attachmentsJson: boundAttachmentsJson(attachments),
-        inReplyTo: object.inReplyTo || null,
+        attachmentsJson: boundInboundNoteAttachmentsJson(object.attachment),
+        tagsJson: boundInboundTagsJson(object.tag),
+        inReplyTo: parentId,
         visibility: "direct",
-        toJson,
+        // Only visible audience fields are serialized. Hidden `bto` / `bcc`
+        // recipients live exclusively in object_recipients and must never be
+        // disclosed through object JSON or the post API.
+        toJson: boundAddressJson(addressing.to),
+        ccJson: boundAddressJson(addressing.cc),
         conversation: conversationId,
         communityApId: null,
         published: publishedAt,
@@ -420,12 +486,13 @@ async function insertDirectNote(
         type: "to",
       })
       .onConflictDoNothing(),
+    ...replyCountStatements,
   ]);
 
-  if (existingObject) return; // duplicate: no inbox surfacing, no double count
-
   // Store the inbound Create and surface it in the recipient's inbox so the DM
-  // appears in the conversation / message-requests view.
+  // appears in the conversation / message-requests view. Both inserts are
+  // idempotent, so every local recipient in a shared-inbox fan-out gets its own
+  // inbox row and a retry repairs a missing side effect safely.
   const activityId = activity.id || activityApId(baseUrl, generateId());
   await upsertActivityAndNotify(
     db,
@@ -462,53 +529,94 @@ export async function handleCreate(
   // Handle Note type (a remote may send `type` as a string or an array)
   if (!typeIncludes(object.type, "Note")) return;
 
-  // Same-origin guard: a remote actor may only Create objects under its own
-  // origin, never under another host or the local domain. This closes the
-  // object-ID squatting / cross-origin injection vector and mirrors the
-  // ownership checks already enforced for Delete/Update.
-  if (isObjectIdOriginMismatch(object.id, actor, baseUrl)) {
-    log.warn("Create rejected: object id origin does not match actor", {
-      event: "ap.create.object_origin_mismatch",
+  const identity = validateInboundObjectIdentity(object.id, actor, baseUrl);
+  if (!identity.ok) {
+    log.warn("Create rejected: invalid remote object identity", {
+      event: "ap.create.object_identity_invalid",
       actor,
       objectId: object.id,
+      reason: identity.reason,
+    });
+    return;
+  }
+
+  const addressingContract = collectBoundedInboundAddresses([activity, object]);
+  if (!addressingContract.ok) {
+    log.warn("Create(Note) rejected: invalid addressing projection", {
+      event: "ap.create.note_addressing_invalid",
+      actor,
+      objectId: identity.objectId,
+      reason: addressingContract.reason,
+    });
+    return;
+  }
+
+  const replyTarget = validateInboundReplyTarget(object.inReplyTo);
+  if (!replyTarget.ok) {
+    log.warn("Create(Note) rejected: invalid reply target", {
+      event: "ap.create.note_reply_target_invalid",
+      actor,
+      objectId: identity.objectId,
+      reason: replyTarget.reason,
     });
     return;
   }
+  const parentId = replyTarget.parentId ?? null;
 
   // Direct (DM) Note routing: a Note addressed to the local inbox owner that
   // is neither public nor follower-only belongs in the recipient's DM inbox /
   // message-request flow rather than the generic public Note insert.
-  if (object.id && isDirectNote(object, recipient)) {
-    // A DM from an actor the recipient has personally BLOCKED must be dropped —
-    // mirror the local DM send guard (dm/messages.ts) so the reject+block remedy
-    // actually stops federated DM harassment (the operator-scoped federation
-    // blocklist checked in verifyAndParseInbox is a SEPARATE mechanism). `actor`
-    // is the HTTP-signature-verified signer, so blockedApId=actor is not
-    // spoofable. The inbox already ACKs, so dropping here causes no retry storm.
-    const blockedBySigner = await db
-      .select({ b: blocks.blockerApId })
-      .from(blocks)
-      .where(
-        and(
-          eq(blocks.blockerApId, recipient.apId),
-          eq(blocks.blockedApId, actor),
-        ),
-      )
-      .get();
-    if (blockedBySigner) {
-      log.info("Dropped inbound DM from a blocked actor", {
-        event: "ap.create.direct_note_blocked",
-        actor,
-        recipient: recipient.apId,
-      });
+  const addressing = createNoteAddressing(activity, object);
+
+  const parentObj = parentId
+    ? await db
+        .select({
+          apId: objects.apId,
+          attributedTo: objects.attributedTo,
+          visibility: objects.visibility,
+          toJson: objects.toJson,
+          ccJson: objects.ccJson,
+          audienceJson: objects.audienceJson,
+          communityApId: objects.communityApId,
+          type: objects.type,
+          endTime: objects.endTime,
+        })
+        .from(objects)
+        .where(eq(objects.apId, parentId))
+        .get()
+    : null;
+
+  // Inbound replies must pass the canonical read gate for EVERY parent retained
+  // by this instance, including direct Notes and remote-authored objects
+  // delivered to a local recipient. Keeping this check before the direct/generic
+  // routing split prevents either storage path from becoming a restricted-thread
+  // injection bypass. Personal block/mute state remains local-owner state, so
+  // that extra guard applies only when the parent author is local.
+  if (parentId && parentObj) {
+    if (!(await canViewerReadObjectFull(db, parentObj, actor))) return;
+    if (
+      isLocal(parentObj.attributedTo, baseUrl) &&
+      (await actorSuppressesInteractionFrom(db, parentObj.attributedTo, actor))
+    ) {
       return;
     }
-    const existing = await db
-      .select({ apId: objects.apId })
-      .from(objects)
-      .where(eq(objects.apId, object.id))
-      .get();
-    if (existing) return;
+  }
+
+  // Root/public/followers/community Notes are still writes into this local
+  // recipient's feed. Apply the same block/mute policy as DM, reply, mention,
+  // Follow, Like, Announce, and Story before any durable projection is created.
+  // The shared inbox invokes this handler once per resolved local recipient, so
+  // the decision remains recipient-specific on that path.
+  if (await actorSuppressesInteractionFrom(db, recipient.apId, actor)) {
+    log.info("Dropped inbound Note from a blocked or muted actor", {
+      event: "ap.create.note_suppressed",
+      actor,
+      recipient: recipient.apId,
+    });
+    return;
+  }
+
+  if (object.id && isDirectNote(addressing, recipient)) {
     await insertDirectNote(
       db,
       activity,
@@ -517,6 +625,8 @@ export async function handleCreate(
       actor,
       recipient,
       baseUrl,
+      addressing,
+      parentId,
     );
     return;
   }
@@ -527,7 +637,7 @@ export async function handleCreate(
   // addressed to actor A is also dispatched for an unrelated follower B. We must
   // NOT store it as a world-readable generic Note for B — the addressed actor's
   // own delivery handles it via insertDirectNote above. Skip it here.
-  if (isDirectShapedNote(object)) {
+  if (isDirectShapedNote(addressing)) {
     log.warn("Skipping direct Note not addressed to this recipient", {
       event: "ap.create.direct_note_not_addressed",
       actor,
@@ -537,7 +647,7 @@ export async function handleCreate(
     return;
   }
 
-  const objectId = object.id || objectApId(baseUrl, generateId());
+  const objectId = identity.objectId;
 
   // Was the object already present BEFORE this dispatch? This is read ONCE and
   // used only to gate the one-shot side effects (parent notification) below; it
@@ -551,49 +661,18 @@ export async function handleCreate(
     .where(eq(objects.apId, objectId))
     .get();
 
-  const attachments = object.attachment
-    ? JSON.stringify(object.attachment)
-    : "[]";
+  const audience = normalizedObjectAudience(activity, object);
+  const communityScope = await resolveInboundCommunityScope(
+    db,
+    actor,
+    audience,
+  );
+  if (!communityScope.allowed) return;
+
   const publishedAt = normalizeInboundTimestamp(
     object.published,
     new Date().toISOString(),
   );
-  const parentObj = object.inReplyTo
-    ? await db
-        .select({
-          attributedTo: objects.attributedTo,
-          visibility: objects.visibility,
-          toJson: objects.toJson,
-          ccJson: objects.ccJson,
-          audienceJson: objects.audienceJson,
-          communityApId: objects.communityApId,
-          type: objects.type,
-          endTime: objects.endTime,
-        })
-        .from(objects)
-        .where(eq(objects.apId, object.inReplyTo))
-        .get()
-    : null;
-
-  // Inbound reply to a LOCAL parent the sending actor cannot read (or that has
-  // blocked them) is REFUSED — mirroring the local reply 404 gate
-  // (routes/posts/routes.ts). Without this, a remote who merely learns a
-  // followers-only / direct(DM) / private-community post's apId could inflate its
-  // replyCount, deliver a reply notification to the owner (bypassing a personal
-  // block), and — because the stored reply's in_reply_to discloses the parent —
-  // build an existence oracle for the restricted post. A legitimate follower /
-  // addressed recipient still passes canViewerReadObjectFull, so their reply is
-  // ingested normally. (Only gated for LOCAL parents: a remote parent's audience
-  // is the remote instance's concern, and we hold no counter/notification for it.)
-  if (
-    object.inReplyTo &&
-    parentObj &&
-    isLocal(parentObj.attributedTo, baseUrl) &&
-    (!(await canViewerReadObjectFull(db, parentObj, actor)) ||
-      (await actorIsBlockedBy(db, parentObj.attributedTo, actor)))
-  ) {
-    return;
-  }
 
   const shouldNotifyParent = !!(
     parentObj && isLocal(parentObj.attributedTo, baseUrl)
@@ -626,17 +705,19 @@ export async function handleCreate(
       attributedTo: actor,
       content: boundInboundContent(object.content),
       summary: boundInboundSummary(object.summary),
-      attachmentsJson: boundAttachmentsJson(attachments),
-      inReplyTo: object.inReplyTo || null,
+      attachmentsJson: boundInboundNoteAttachmentsJson(object.attachment),
+      tagsJson: boundInboundTagsJson(object.tag),
+      inReplyTo: parentId,
       // Recipient-independent classification: a non-public Note is never stored
       // as world-readable "unlisted". A followers-only post → "followers" (gated
       // by the accepted-follow edge), preserving the remote author's audience.
-      visibility: classifyInboundNoteVisibility(object),
+      visibility: classifyInboundNoteVisibility(addressing),
       // Persist the addressing so the explicit-recipient (mention) gate in
       // canViewerReadObjectFull / the post-detail route can evaluate.
-      toJson: boundAddressJson(object.to),
-      ccJson: boundAddressJson(object.cc),
-      communityApId: null,
+      toJson: boundAddressJson(addressing.to),
+      ccJson: boundAddressJson(addressing.cc),
+      audienceJson: JSON.stringify(audience),
+      communityApId: communityScope.communityApId,
       published: publishedAt,
       isLocal: 0,
     })
@@ -647,20 +728,37 @@ export async function handleCreate(
     .set({ postCount: sql`${actors.postCount} + 1` })
     .where(and(eq(actors.apId, actor), objectAbsent));
 
-  if (object.inReplyTo) {
-    const parentId = object.inReplyTo;
+  // Persist hidden bto/bcc recipients as indexed authority projections on the
+  // generic path. Visible to/cc recipients already remain authoritative in the
+  // JSON projection; duplicating them here is unnecessary and would turn an
+  // ordinary remote @mention into a recipient-table dependency. The canonical
+  // read gate combines both representations without revealing hidden reach.
+  const recipientProjectionStatements = insertMany(
+    db,
+    objectRecipients,
+    hiddenRecipientAddresses(addressing).map((recipientApId) => ({
+      objectApId: objectId,
+      recipientApId,
+      type: "to",
+    })),
+    { conflict: "ignore" },
+  );
+
+  if (parentId) {
     await runBatch(db, [
       bumpPostCount,
       insertObject,
-      db
-        .update(objects)
-        .set({
-          replyCount: sql`(SELECT COUNT(*) FROM ${objects} WHERE ${objects.inReplyTo} = ${parentId})`,
-        })
-        .where(eq(objects.apId, parentId)),
+      ...recipientProjectionStatements,
+      recomputeObjectReplyCount(db, parentId),
+      recomputeObjectReplyCount(db, objectId),
     ]);
   } else {
-    await runBatch(db, [bumpPostCount, insertObject]);
+    await runBatch(db, [
+      bumpPostCount,
+      insertObject,
+      ...recipientProjectionStatements,
+      recomputeObjectReplyCount(db, objectId),
+    ]);
   }
 
   if (existingBeforeInsert) return; // duplicate: no double notification
@@ -683,7 +781,8 @@ export async function handleCreate(
   // that only ever fired for local-origin posts). Runs once (the duplicate
   // delivery short-circuits at `existingBeforeInsert` above). Skips the post
   // author and the parent author (already notified by the reply branch) and
-  // honors the mentioned actor's block of the sender, mirroring the reply gate.
+  // honors the mentioned actor's block/mute of the sender, mirroring the reply
+  // gate.
   const mentionedLocalApIds = new Set<string>();
   for (const href of extractMentionHrefs(object.tag)) {
     if (!isLocal(href, baseUrl)) continue;
@@ -714,7 +813,8 @@ export async function handleCreate(
   ).flat();
 
   for (const { apId: mentionedApId } of existingLocalApIds) {
-    if (await actorIsBlockedBy(db, mentionedApId, actor)) continue;
+    if (await actorSuppressesInteractionFrom(db, mentionedApId, actor))
+      continue;
     await upsertActivityAndNotify(
       db,
       activityApId(baseUrl, generateId()),
@@ -741,18 +841,18 @@ export async function handleCreateStory(
   const object = getActivityObject(activity);
   if (!object) return;
 
-  // Same-origin guard: reject a story whose object id is squatted under another
-  // host or the local domain (see handleCreate for rationale).
-  if (isObjectIdOriginMismatch(object.id, actor, baseUrl)) {
-    log.warn("Create(Story) rejected: object id origin does not match actor", {
-      event: "ap.story.object_origin_mismatch",
+  const identity = validateInboundObjectIdentity(object.id, actor, baseUrl);
+  if (!identity.ok) {
+    log.warn("Create(Story) rejected: invalid remote object identity", {
+      event: "ap.story.object_identity_invalid",
       actor,
       objectId: object.id,
+      reason: identity.reason,
     });
     return;
   }
 
-  const objectId = object.id || objectApId(baseUrl, generateId());
+  const objectId = identity.objectId;
 
   // Per-user block: drop a Story from an actor the local owner has blocked,
   // mirroring the inbound DM blockedBySigner drop + the inbound Like/Announce/
@@ -761,12 +861,7 @@ export async function handleCreateStory(
   // stories were still stored (consuming the per-author cap + retrievable via
   // GET /api/posts/:id). Single-user instance: any blocks row blocking this actor
   // is the owner's block.
-  const blockedByOwner = await db
-    .select({ b: blocks.blockerApId })
-    .from(blocks)
-    .where(eq(blocks.blockedApId, actor))
-    .get();
-  if (blockedByOwner) return;
+  if (await ownerSuppressesInboundActor(db, actor)) return;
 
   // Check if story already exists
   const existing = await db
@@ -774,7 +869,12 @@ export async function handleCreateStory(
     .from(objects)
     .where(eq(objects.apId, objectId))
     .get();
-  if (existing) return;
+  if (existing) {
+    // Duplicate Story delivery is a bounded repair opportunity for a parent
+    // inserted by an older version before one or more child replies arrived.
+    await recomputeObjectReplyCount(db, objectId);
+    return;
+  }
 
   // Per-author flood cap. A hostile remote could Create() an unbounded number of
   // Stories to bloat our feed/storage (each carries an attachment blob + caption).
@@ -803,119 +903,42 @@ export async function handleCreateStory(
     return;
   }
 
-  // attachment validation (required)
-  if (!object.attachment) {
-    log.error("Remote story has no attachment", {
-      event: "ap.story.missing_attachment",
+  // Story metadata has a product-specific storage shape; never feed it through
+  // the generic Note attachment projection. Normalize every remote field at
+  // this boundary so malformed URLs/overlays cannot become durable UI data.
+  const storyProjection = buildInboundStoryCreateProjection(object);
+  if (!storyProjection) {
+    log.warn("Create(Story) rejected: invalid story projection", {
+      event: "ap.story.invalid_projection",
+      actor,
       objectId,
     });
     return;
   }
 
-  // Normalize attachment (handle array or single object)
-  const attachmentArray = Array.isArray(object.attachment)
-    ? object.attachment
-    : [object.attachment];
-  const attachment = attachmentArray[0] as {
-    url?: string;
-    mediaType?: string;
-    width?: number;
-    height?: number;
-  };
-
-  if (!attachment || !attachment.url) {
-    log.error("Remote story attachment has no URL", {
-      event: "ap.story.attachment_missing_url",
+  // Clamp+normalize `published` first and anchor the expiry to that durable
+  // value. Already-expired objects are discarded, closing the live-cap bypass
+  // where a sender could churn unlimited rows with a past endTime.
+  const now = new Date().toISOString();
+  const publishedAt = normalizeInboundTimestamp(object.published, now);
+  const endTime = normalizeInboundStoryCreateEndTime(
+    publishedAt,
+    object.endTime,
+    now,
+  );
+  if (!endTime) {
+    log.debug("Create(Story) dropped: already expired", {
+      event: "ap.story.expired_at_ingress",
+      actor,
       objectId,
     });
     return;
   }
 
-  // overlays validation (optional, validate if present). Cap the COUNT — the
-  // local create path bounds overlays via validateOverlays (MAX_OVERLAYS=20),
-  // and a hostile remote must not pad an unbounded array into attachments_json.
-  const MAX_INBOUND_OVERLAYS = 20;
-  let overlays: StoryOverlay[] | undefined;
-  if (Array.isArray(object.overlays)) {
-    const filtered = (object.overlays as StoryOverlay[])
-      .filter(
-        (o: StoryOverlay) =>
-          o &&
-          o.position &&
-          typeof o.position.x === "number" &&
-          typeof o.position.y === "number",
-      )
-      .slice(0, MAX_INBOUND_OVERLAYS);
-    // Keep at most ONE Question (poll) overlay — votes are keyed only by
-    // (storyApId, actorApId) and tallied by optionIndex with no question
-    // dimension, so a second poll would conflate tallies. Mirror validateOverlays.
-    let seenQuestion = false;
-    const capped = filtered.filter((o: StoryOverlay) => {
-      if (o.type === "Question") {
-        if (seenQuestion) return false;
-        seenQuestion = true;
-      }
-      return true;
-    });
-    if (capped.length > 0) overlays = capped;
-  }
-
-  // Build attachments_json
-  const attachmentData = {
-    attachment: {
-      r2_key: "", // Remote stories don't have local R2 key
-      content_type: attachment.mediaType || "image/jpeg",
-      url: attachment.url,
-      width: attachment.width || 1080,
-      height: attachment.height || 1920,
-    },
-    displayDuration:
-      (object as { displayDuration?: string }).displayDuration || "PT5S",
-    // The remote caption arrives as the AS2 Note `content`; persist it (bounded
-    // to the same local content cap as every other inbound Note path) so the
-    // local renderer shows the same caption as the originating instance.
-    caption:
-      typeof object.content === "string" && object.content.trim().length > 0
-        ? boundInboundContent(object.content)
-        : undefined,
-    overlays,
-  };
-
-  const now = new Date().toISOString();
-  // Clamp the attacker-controlled `endTime`: a story must expire. A non-ISO or
-  // far-future value stored verbatim would never satisfy the expiry filter
-  // (`lt(endTime, now)`, a lexical compare), so a malicious remote could create
-  // never-expiring stories that accumulate forever. Bound it to published + ~25h
-  // (the ~24h story lifetime + slack) and normalize to ISO so the compare holds.
-  const STORY_MAX_LIFETIME_MS = 25 * 60 * 60 * 1000;
-  // Clamp+normalize the inbound `published` FIRST and anchor the endTime bound to
-  // THAT, not the raw value: a far-future `published` ("9999-…") would otherwise
-  // push maxEndMs far into the future too and defeat this very expiry clamp.
-  const publishedAt = normalizeInboundTimestamp(object.published, now);
-  const publishedMs = Date.parse(publishedAt);
-  const maxEndMs =
-    (Number.isNaN(publishedMs) ? Date.now() : publishedMs) +
-    STORY_MAX_LIFETIME_MS;
-  const requestedEndMs = object.endTime ? Date.parse(object.endTime) : NaN;
-  const endTime = new Date(
-    Number.isNaN(requestedEndMs)
-      ? maxEndMs
-      : Math.min(requestedEndMs, maxEndMs),
-  ).toISOString();
-
   // The early existence check above is best-effort (TOCTOU): two isolates
   // racing the same cold story can both pass it. `onConflictDoNothing` keeps
   // that race insert-safe, and gating follow-on side effects on the returned
   // row mirrors the duplicate guard in handleCreate.
-  // Bound the serialized story data. Caption is capped and overlays are
-  // count-limited above, but per-overlay padding could still inflate it; if the
-  // blob exceeds the attachments cap, drop the (decorative) overlays so the core
-  // attachment + caption still persist within bounds.
-  let storyDataJson = JSON.stringify(attachmentData);
-  if (storyDataJson.length > MAX_ATTACHMENTS_JSON_LENGTH) {
-    storyDataJson = JSON.stringify({ ...attachmentData, overlays: undefined });
-  }
-
   // Carry the community scope across the federation boundary. A story that
   // arrived through community fanout is addressed to the community's followers
   // collection, not the author's; storing it with no scope made the local read
@@ -924,26 +947,24 @@ export async function handleCreateStory(
   // communities this instance actually knows and only then mark the scope —
   // an unresolvable audience is left unscoped rather than trusted, and the
   // membership gate is still evaluated locally against `community_members`.
-  const addressedCollections = [
-    ...addressList((activity as { audience?: unknown }).audience),
-    ...addressList(object.to),
-    ...addressList((object as { audience?: unknown }).audience),
-  ];
-  const community = addressedCollections.length
-    ? await db
-        .select({ apId: communities.apId })
-        .from(communities)
-        .where(
-          and(
-            or(
-              inArray(communities.followersUrl, addressedCollections),
-              inArray(communities.apId, addressedCollections),
-            ),
-            isNull(communities.deletedAt),
-          ),
-        )
-        .get()
-    : undefined;
+  const storyAddressing = storyAddressedCollections(activity, object);
+  if (storyAddressing.overflow) {
+    log.warn("Create(Story) rejected: too many addressing entries", {
+      event: "ap.story.addressing_overflow",
+      actor,
+      objectId,
+    });
+    return;
+  }
+  const communityScope = await resolveInboundCommunityScope(
+    db,
+    actor,
+    storyAddressing.addresses,
+  );
+  if (!communityScope.allowed) return;
+  const storyAudience = communityScope.communityApId
+    ? [communityScope.communityApId]
+    : normalizedObjectAudience(activity, object);
 
   const inserted = await db
     .insert(objects)
@@ -952,14 +973,19 @@ export async function handleCreateStory(
       type: "Story",
       attributedTo: actor,
       content: "",
-      attachmentsJson: storyDataJson,
-      ...(community
+      attachmentsJson: storyProjection.json,
+      ...(communityScope.communityApId
         ? {
-            communityApId: community.apId,
-            audienceJson: JSON.stringify([community.apId]),
+            communityApId: communityScope.communityApId,
+            audienceJson: JSON.stringify(storyAudience),
           }
-        : {}),
+        : storyAudience.length > 0
+          ? { audienceJson: JSON.stringify(storyAudience) }
+          : {}),
       endTime,
+      // Handles the child-before-parent order without a second transaction.
+      // The child Create path repairs the opposite concurrent order.
+      replyCount: sql`(SELECT COUNT(*) FROM ${objects} WHERE ${objects.inReplyTo} = ${objectId})`,
       published: publishedAt,
       isLocal: 0,
     })
@@ -999,9 +1025,10 @@ const ANNOUNCED_OBJECT_FETCH_TIMEOUT_MS = 15_000;
  *     a boost must never widen a followers-only/direct object's audience, and
  *     this instance cannot verify a remote author's follower audience.
  *
- * Depth cap: the object's `inReplyTo` is stored verbatim but NEVER resolved —
- * a single Announce triggers at most one object fetch (plus a best-effort
- * author-profile cache fill), not a thread walk.
+ * Depth cap: the object's `inReplyTo` is stored verbatim and a retained parent
+ * is authority-checked locally, but an unknown parent is NEVER fetched. A
+ * single Announce therefore triggers at most one object fetch (plus a
+ * best-effort author-profile cache fill), not a thread walk.
  *
  * Best-effort by contract: every failure returns false and the Announce is
  * dropped exactly as it was before this path existed.
@@ -1013,7 +1040,13 @@ export async function fetchAndPersistAnnouncedNote(
 ): Promise<boolean> {
   // Never fetch a local id (a local object that does not exist is just gone)
   // and never fetch an unsafe URL (non-http(s), credentials, blocked host…).
-  if (isLocal(objectId, baseUrl) || !isSafeRemoteUrl(objectId)) return false;
+  if (
+    objectId.length > MAX_INBOUND_OBJECT_ID_LENGTH ||
+    isLocal(objectId, baseUrl) ||
+    !isSafeRemoteUrl(objectId)
+  ) {
+    return false;
+  }
 
   let note: ActivityObject & { attributedTo?: unknown };
   try {
@@ -1047,18 +1080,72 @@ export async function fetchAndPersistAnnouncedNote(
   const attributedTo =
     typeof note.attributedTo === "string" ? note.attributedTo : null;
   if (!attributedTo || !isSafeRemoteUrl(attributedTo)) return false;
-  try {
-    if (getDomain(attributedTo) !== getDomain(objectId)) return false;
-  } catch {
+  if (!validateInboundObjectIdentity(objectId, attributedTo, baseUrl).ok) {
     return false;
   }
 
+  const addressingContract = collectBoundedInboundAddresses([note]);
+  if (!addressingContract.ok) return false;
+
+  const replyTarget = validateInboundReplyTarget(note.inReplyTo);
+  if (!replyTarget.ok) return false;
+  const parentId = replyTarget.parentId ?? null;
+
   // Addressing gates: a DM-shaped object must never be stored world-readable,
   // and a non-public classification is refused outright (see doc comment).
-  if (isDirectShapedNote(note)) return false;
-  const visibility = classifyInboundNoteVisibility(note);
+  const addressing = noteAddressing(note);
+  if (isDirectShapedNote(addressing)) return false;
+  const visibility = classifyInboundNoteVisibility(addressing);
   if (visibility !== "public" && visibility !== "unlisted") return false;
 
+  const audience = addressList(note.audience);
+  const communityScope = await resolveInboundCommunityScope(
+    db,
+    attributedTo,
+    audience,
+  );
+  if (!communityScope.allowed) return false;
+
+  // A fetched boost target can itself be a reply. If its parent is already
+  // retained, apply the exact same read/suppression authority as ordinary
+  // inbound Create before storing the child. Without this check an Announce of
+  // an otherwise-public Note could inject a reply beneath a local direct or
+  // followers-only parent that its author cannot read. An unknown parent stays
+  // unresolved (the one-fetch depth cap below); later parent arrival repairs
+  // its derived counter through recomputeObjectReplyCount.
+  const parentObj = parentId
+    ? await db
+        .select({
+          apId: objects.apId,
+          attributedTo: objects.attributedTo,
+          visibility: objects.visibility,
+          toJson: objects.toJson,
+          ccJson: objects.ccJson,
+          audienceJson: objects.audienceJson,
+          communityApId: objects.communityApId,
+          type: objects.type,
+          endTime: objects.endTime,
+        })
+        .from(objects)
+        .where(eq(objects.apId, parentId))
+        .get()
+    : null;
+  if (parentId && parentObj) {
+    if (!(await canViewerReadObjectFull(db, parentObj, attributedTo))) {
+      return false;
+    }
+    if (
+      isLocal(parentObj.attributedTo, baseUrl) &&
+      (await actorSuppressesInteractionFrom(
+        db,
+        parentObj.attributedTo,
+        attributedTo,
+      ))
+    ) {
+      return false;
+    }
+  }
+
   // Best-effort author profile fill so the surfaced boost renders with the
   // author's name/icon. Cache-when-absent; a failure never blocks the persist.
   const cachedAuthor = await db
@@ -1078,8 +1165,7 @@ export async function fetchAndPersistAnnouncedNote(
     }
   }
 
-  const attachments = note.attachment ? JSON.stringify(note.attachment) : "[]";
-  await db
+  const insertObject = db
     .insert(objects)
     .values({
       apId: objectId,
@@ -1087,14 +1173,16 @@ export async function fetchAndPersistAnnouncedNote(
       attributedTo,
       content: boundInboundContent(note.content),
       summary: boundInboundSummary(note.summary),
-      attachmentsJson: boundAttachmentsJson(attachments),
-      // Stored verbatim, never resolved (depth cap): a boosted reply keeps its
-      // honest thread link even though the parent may stay unknown here.
-      inReplyTo: note.inReplyTo || null,
+      attachmentsJson: boundInboundNoteAttachmentsJson(note.attachment),
+      tagsJson: boundInboundTagsJson(note.tag),
+      // Stored verbatim and never remotely resolved (depth cap): a boosted
+      // reply keeps its honest thread link even when the parent stays unknown.
+      inReplyTo: parentId,
       visibility,
       toJson: boundAddressJson(note.to),
       ccJson: boundAddressJson(note.cc),
-      communityApId: null,
+      audienceJson: JSON.stringify(audience),
+      communityApId: communityScope.communityApId,
       published: normalizeInboundTimestamp(
         note.published,
         new Date().toISOString(),
@@ -1103,6 +1191,18 @@ export async function fetchAndPersistAnnouncedNote(
     })
     .onConflictDoNothing();
 
+  if (parentId) {
+    await runBatch(db, [
+      insertObject,
+      recomputeObjectReplyCount(db, parentId),
+      // Unknown Announce targets race normal Create delivery; the no-op insert
+      // plus recompute keeps both arrival paths idempotent and repairable.
+      recomputeObjectReplyCount(db, objectId),
+    ]);
+  } else {
+    await runBatch(db, [insertObject, recomputeObjectReplyCount(db, objectId)]);
+  }
+
   return true;
 }
 
@@ -1110,6 +1210,17 @@ export async function fetchAndPersistAnnouncedNote(
 // Delete handler
 // ---------------------------------------------------------------------------
 
+function retainedRemoteActorAliasesSql(column: SQLiteColumn, actorId: string) {
+  return activityPubActorIdentityMatchesSql(
+    sql`SELECT ${column} FROM ${column.table}`,
+    actorId,
+  );
+}
+
+function retainedRemoteActorWhere(column: SQLiteColumn, actorId: string) {
+  return sql`${column} IN (${retainedRemoteActorAliasesSql(column, actorId)})`;
+}
+
 /**
  * Tombstone a remote actor locally in response to a verified inbound
  * Delete(Actor). Mirrors the local /me/delete teardown for the federation-facing
@@ -1122,163 +1233,258 @@ export async function fetchAndPersistAnnouncedNote(
 async function handleRemoteActorDelete(
   c: ActivityContext,
   actorId: string,
+  deleteActivityApId: string,
 ): Promise<void> {
   const db = c.get("db");
+  const canonicalActorId = normalizeActivityPubActorId(actorId) ?? actorId;
+
+  // A Delete(actor) is one authority transition: the remote identity, its
+  // relationship authority, cached content, and every denormalized counter
+  // must disappear together. Keeping these as independent commits made retry
+  // unsafe: a failure after one counterpart counter decrement but before the
+  // follow delete let the retry observe the same edge and decrement again.
+  // D1 batch is the only atomic multi-statement primitive available here.
+  const remoteObjectIds = () =>
+    db
+      .select({ id: objects.apId })
+      .from(objects)
+      .where(retainedRemoteActorWhere(objects.attributedTo, actorId));
 
   // Counterpart count reconcile BEFORE dropping edges (mirrors actors.ts):
   // everyone the deleted remote followed loses a follower; everyone who followed
   // it loses a following. The subquery naturally scopes to LOCAL actors (remote
   // actors have no `actors` row); gt(...,0) guards underflow.
-  await db
-    .update(actors)
-    .set({ followerCount: sql`${actors.followerCount} - 1` })
-    .where(
-      and(
-        inArray(
-          actors.apId,
-          db
-            .select({ id: follows.followingApId })
-            .from(follows)
-            .where(eq(follows.followerApId, actorId)),
+  await runBatch(db, [
+    // Establish deletion authority in the SAME batch that tears down retained
+    // state. A concurrent actor fetch must see either no tombstone before this
+    // batch (and be deleted by it) or the tombstone after it (and refuse its
+    // cache write); it can never commit between these effects.
+    db
+      .insert(remoteActorTombstones)
+      .values({
+        actorApId: canonicalActorId,
+        deleteActivityApId,
+      })
+      .onConflictDoNothing(),
+    db
+      .update(actors)
+      .set({
+        followerCount: sql`MAX(0, ${actors.followerCount} - (SELECT COUNT(*) FROM ${follows} WHERE ${follows.followingApId} = ${actors.apId} AND ${retainedRemoteActorWhere(follows.followerApId, actorId)} AND ${follows.status} = 'accepted'))`,
+      })
+      .where(
+        and(
+          inArray(
+            actors.apId,
+            db
+              .select({ id: follows.followingApId })
+              .from(follows)
+              .where(
+                and(
+                  retainedRemoteActorWhere(follows.followerApId, actorId),
+                  eq(follows.status, "accepted"),
+                ),
+              ),
+          ),
+          gt(actors.followerCount, 0),
         ),
-        gt(actors.followerCount, 0),
       ),
-    );
-  await db
-    .update(actors)
-    .set({ followingCount: sql`${actors.followingCount} - 1` })
-    .where(
-      and(
-        inArray(
-          actors.apId,
-          db
-            .select({ id: follows.followerApId })
-            .from(follows)
-            .where(eq(follows.followingApId, actorId)),
+    db
+      .update(actors)
+      .set({
+        followingCount: sql`MAX(0, ${actors.followingCount} - (SELECT COUNT(*) FROM ${follows} WHERE ${follows.followerApId} = ${actors.apId} AND ${retainedRemoteActorWhere(follows.followingApId, actorId)} AND ${follows.status} = 'accepted'))`,
+      })
+      .where(
+        and(
+          inArray(
+            actors.apId,
+            db
+              .select({ id: follows.followerApId })
+              .from(follows)
+              .where(
+                and(
+                  retainedRemoteActorWhere(follows.followingApId, actorId),
+                  eq(follows.status, "accepted"),
+                ),
+              ),
+          ),
+          gt(actors.followingCount, 0),
         ),
-        gt(actors.followingCount, 0),
       ),
-    );
-  await db
-    .delete(follows)
-    .where(
-      or(eq(follows.followerApId, actorId), eq(follows.followingApId, actorId)),
-    );
-
-  // Recompute the replyCount of any LOCAL parent the remote's cached objects
-  // replied to, counting only the replies that will REMAIN (not authored by the
-  // deleted remote), BEFORE the cascade removes them (mirrors actors.ts).
-  await db
-    .update(objects)
-    .set({
-      replyCount: sql`(SELECT COUNT(*) FROM objects AS child WHERE child.in_reply_to = ${objects.apId} AND child.attributed_to <> ${actorId})`,
-    })
-    .where(
-      inArray(
-        objects.apId,
-        db
-          .select({ id: objects.inReplyTo })
-          .from(objects)
-          .where(
-            and(
-              eq(objects.attributedTo, actorId),
-              isNotNull(objects.inReplyTo),
-            ),
-          ),
+    db
+      .delete(follows)
+      .where(
+        or(
+          retainedRemoteActorWhere(follows.followerApId, actorId),
+          retainedRemoteActorWhere(follows.followingApId, actorId),
+        ),
       ),
-    );
-
-  // Reconcile the like/announce/share counters on OTHER objects the deleted
-  // remote INTERACTED with, BEFORE dropping its edges — mirrors the local
-  // account-delete griefing defense (actors.ts). A throwaway remote could ratchet
-  // a local post's like/announce/share counts then self-delete via a signed
-  // Delete(Person); without this those counts stay permanently inflated and the
-  // edge rows orphan (the object-scoped cascade below only reaps interactions ON
-  // the remote's OWN posts, not the ones it authored on others'). gt(...,0) guards
-  // underflow; the subquery scopes without splicing ids (D1 param ceiling).
-  await db
-    .update(objects)
-    .set({ likeCount: sql`${objects.likeCount} - 1` })
-    .where(
-      and(
-        inArray(
-          objects.apId,
-          db
-            .select({ id: likes.objectApId })
-            .from(likes)
-            .where(eq(likes.actorApId, actorId)),
+    // Cancel recipient-addressed first-hop work while it still has actor
+    // identity. Endpoint-aggregated work is handled by its separate recipient
+    // attribution immediately below.
+    db
+      .delete(deliveryResolutions)
+      .where(
+        retainedRemoteActorWhere(
+          deliveryResolutions.recipientActorApId,
+          actorId,
         ),
-        gt(objects.likeCount, 0),
       ),
-    );
-  await db
-    .update(objects)
-    .set({ announceCount: sql`${objects.announceCount} - 1` })
-    .where(
+    // Endpoint jobs created after 0029 retain every actor identity they
+    // represent. Remove only this deleted actor's attribution first, then
+    // cancel a recipient-aware job only if no co-recipient remains. Legacy
+    // jobs stay fail-safe because their attribution-complete flag is 0.
+    db
+      .delete(deliveryEndpointRecipients)
+      .where(
+        retainedRemoteActorWhere(
+          deliveryEndpointRecipients.recipientActorApId,
+          actorId,
+        ),
+      ),
+    db.delete(deliveryQueue).where(
       and(
-        inArray(
-          objects.apId,
+        eq(deliveryQueue.recipientAttributionComplete, 1),
+        notExists(
           db
-            .select({ id: announces.objectApId })
-            .from(announces)
-            .where(eq(announces.actorApId, actorId)),
+            .select({
+              deliveryJobId: deliveryEndpointRecipients.deliveryJobId,
+            })
+            .from(deliveryEndpointRecipients)
+            .where(
+              eq(deliveryEndpointRecipients.deliveryJobId, deliveryQueue.id),
+            ),
         ),
-        gt(objects.announceCount, 0),
       ),
-    );
-  await db
-    .update(objects)
-    .set({ shareCount: sql`${objects.shareCount} - 1` })
-    .where(
-      and(
+    ),
+
+    // Recompute the replyCount of any LOCAL parent the remote's cached objects
+    // replied to, counting only replies that will remain after this batch.
+    db
+      .update(objects)
+      .set({
+        replyCount: sql`(SELECT COUNT(*) FROM objects AS child WHERE child.in_reply_to = ${objects.apId} AND child.attributed_to NOT IN (${retainedRemoteActorAliasesSql(objects.attributedTo, actorId)}))`,
+      })
+      .where(
         inArray(
           objects.apId,
           db
-            .select({ id: storyShares.storyApId })
-            .from(storyShares)
-            .where(eq(storyShares.actorApId, actorId)),
+            .select({ id: objects.inReplyTo })
+            .from(objects)
+            .where(
+              and(
+                retainedRemoteActorWhere(objects.attributedTo, actorId),
+                isNotNull(objects.inReplyTo),
+              ),
+            ),
         ),
-        gt(objects.shareCount, 0),
       ),
-    );
-  // Delete the interaction edges the remote AUTHORED on OTHER objects.
-  await db.delete(likes).where(eq(likes.actorApId, actorId));
-  await db.delete(announces).where(eq(announces.actorApId, actorId));
-  await db.delete(bookmarks).where(eq(bookmarks.actorApId, actorId));
-  await db.delete(storyShares).where(eq(storyShares.actorApId, actorId));
-  await db.delete(storyVotes).where(eq(storyVotes.actorApId, actorId));
-  await db.delete(storyViews).where(eq(storyViews.actorApId, actorId));
-
-  // Cascade child rows keyed by the remote's authored objects (no FK cascade on
-  // prod D1), then the objects themselves. A fresh subquery per statement avoids
-  // shared-AST reuse.
-  const remoteObjectIds = () =>
+
+    // Reconcile counters on OTHER objects the remote interacted with before
+    // dropping those edges. The subqueries stay bounded and D1-param-safe.
     db
-      .select({ id: objects.apId })
-      .from(objects)
-      .where(eq(objects.attributedTo, actorId));
-  await db.delete(likes).where(inArray(likes.objectApId, remoteObjectIds()));
-  await db
-    .delete(announces)
-    .where(inArray(announces.objectApId, remoteObjectIds()));
-  await db
-    .delete(bookmarks)
-    .where(inArray(bookmarks.objectApId, remoteObjectIds()));
-  await db
-    .delete(objectRecipients)
-    .where(inArray(objectRecipients.objectApId, remoteObjectIds()));
-  await db
-    .delete(storyVotes)
-    .where(inArray(storyVotes.storyApId, remoteObjectIds()));
-  await db
-    .delete(storyViews)
-    .where(inArray(storyViews.storyApId, remoteObjectIds()));
-  await db
-    .delete(storyShares)
-    .where(inArray(storyShares.storyApId, remoteObjectIds()));
-  await db.delete(objects).where(eq(objects.attributedTo, actorId));
-
-  await db.delete(actorCache).where(eq(actorCache.apId, actorId));
+      .update(objects)
+      .set({
+        likeCount: sql`MAX(0, ${objects.likeCount} - (SELECT COUNT(*) FROM ${likes} WHERE ${likes.objectApId} = ${objects.apId} AND ${retainedRemoteActorWhere(likes.actorApId, actorId)}))`,
+      })
+      .where(
+        and(
+          inArray(
+            objects.apId,
+            db
+              .select({ id: likes.objectApId })
+              .from(likes)
+              .where(retainedRemoteActorWhere(likes.actorApId, actorId)),
+          ),
+          gt(objects.likeCount, 0),
+        ),
+      ),
+    db
+      .update(objects)
+      .set({
+        announceCount: sql`MAX(0, ${objects.announceCount} - (SELECT COUNT(*) FROM ${announces} WHERE ${announces.objectApId} = ${objects.apId} AND ${retainedRemoteActorWhere(announces.actorApId, actorId)}))`,
+      })
+      .where(
+        and(
+          inArray(
+            objects.apId,
+            db
+              .select({ id: announces.objectApId })
+              .from(announces)
+              .where(retainedRemoteActorWhere(announces.actorApId, actorId)),
+          ),
+          gt(objects.announceCount, 0),
+        ),
+      ),
+    db
+      .update(objects)
+      .set({
+        shareCount: sql`MAX(0, ${objects.shareCount} - (SELECT COUNT(*) FROM ${storyShares} WHERE ${storyShares.storyApId} = ${objects.apId} AND ${retainedRemoteActorWhere(storyShares.actorApId, actorId)}))`,
+      })
+      .where(
+        and(
+          inArray(
+            objects.apId,
+            db
+              .select({ id: storyShares.storyApId })
+              .from(storyShares)
+              .where(retainedRemoteActorWhere(storyShares.actorApId, actorId)),
+          ),
+          gt(objects.shareCount, 0),
+        ),
+      ),
+
+    // Delete interaction edges the remote authored on other objects.
+    db.delete(likes).where(retainedRemoteActorWhere(likes.actorApId, actorId)),
+    db
+      .delete(announces)
+      .where(retainedRemoteActorWhere(announces.actorApId, actorId)),
+    db
+      .delete(bookmarks)
+      .where(retainedRemoteActorWhere(bookmarks.actorApId, actorId)),
+    db
+      .delete(storyShares)
+      .where(retainedRemoteActorWhere(storyShares.actorApId, actorId)),
+    db
+      .delete(storyVotes)
+      .where(retainedRemoteActorWhere(storyVotes.actorApId, actorId)),
+    db
+      .delete(storyViews)
+      .where(retainedRemoteActorWhere(storyViews.actorApId, actorId)),
+
+    // Cascade child rows keyed by the remote's authored objects (no FK cascade
+    // is assumed), then remove the objects and cached identity itself. A fresh
+    // subquery per statement avoids shared-AST reuse.
+    db.delete(likes).where(inArray(likes.objectApId, remoteObjectIds())),
+    db
+      .delete(announces)
+      .where(inArray(announces.objectApId, remoteObjectIds())),
+    db
+      .delete(bookmarks)
+      .where(inArray(bookmarks.objectApId, remoteObjectIds())),
+    db
+      .delete(objectRecipients)
+      .where(inArray(objectRecipients.objectApId, remoteObjectIds())),
+    db
+      .delete(storyVotes)
+      .where(inArray(storyVotes.storyApId, remoteObjectIds())),
+    db
+      .delete(storyViews)
+      .where(inArray(storyViews.storyApId, remoteObjectIds())),
+    db
+      .delete(storyShares)
+      .where(inArray(storyShares.storyApId, remoteObjectIds())),
+    db
+      .delete(objects)
+      .where(retainedRemoteActorWhere(objects.attributedTo, actorId)),
+    db
+      .delete(actorCache)
+      .where(retainedRemoteActorWhere(actorCache.apId, actorId)),
+    db
+      .delete(remoteActorFetchFailures)
+      .where(
+        retainedRemoteActorWhere(remoteActorFetchFailures.actorApId, actorId),
+      ),
+  ]);
 
   log.info("Processed inbound Delete(actor)", {
     event: "ap.delete.actor",
@@ -1318,14 +1524,14 @@ export async function handleDelete(c: ActivityContext, activity: Activity) {
     // (same origin), so an object that equals the verified actor is owned by the
     // signer. Tombstone the remote locally so a stale profile + dangling follow
     // edge + cached content do not survive indefinitely.
-    if (objectId === actorId) {
-      await handleRemoteActorDelete(c, actorId);
+    if (isSameActivityPubActor(objectId, actorId)) {
+      await handleRemoteActorDelete(c, actorId, activity.id ?? actorId);
     }
     return;
   }
 
   // Verify actor owns the object before deleting
-  if (delObj.attributedTo !== actorId) {
+  if (!isSameActivityPubActor(delObj.attributedTo, actorId)) {
     log.warn("Delete rejected: actor does not own object", {
       event: "ap.delete.actor_ownership_mismatch",
       actor: actorId,
@@ -1413,8 +1619,11 @@ export async function handleUpdate(
   // mirroring the actor==object self-update contract). The remote document is
   // re-fetched from origin (never trusted from the wire) so a spoofed Update
   // body cannot poison the cache.
-  if (isActorTypeUpdate(object.type) || objectId === actor) {
-    if (objectId !== actor) {
+  if (
+    isActorTypeUpdate(object.type) ||
+    isSameActivityPubActor(objectId, actor)
+  ) {
+    if (!isSameActivityPubActor(objectId, actor)) {
       log.warn("Update(actor) rejected: object id does not match actor", {
         event: "ap.update.actor_self_mismatch",
         actor,
@@ -1430,7 +1639,7 @@ export async function handleUpdate(
     const cached = await db
       .select({ lastFetchedAt: actorCache.lastFetchedAt })
       .from(actorCache)
-      .where(eq(actorCache.apId, objectId))
+      .where(eq(actorCache.apId, actor))
       .get();
     if (cached?.lastFetchedAt) {
       const age = Date.now() - new Date(cached.lastFetchedAt).getTime();
@@ -1441,45 +1650,369 @@ export async function handleUpdate(
       ) {
         log.debug("Update(actor) re-fetch skipped: within cooldown", {
           event: "ap.update.actor_refetch_cooldown",
-          actor: objectId,
+          actor,
           ageMs: age,
         });
         return;
       }
     }
-    await refreshActorCache(db, objectId);
+    await refreshActorCache(db, actor);
     return;
   }
 
   const existing = await db
-    .select({ attributedTo: objects.attributedTo })
+    .select({
+      attributedTo: objects.attributedTo,
+      inReplyTo: objects.inReplyTo,
+      type: objects.type,
+      attachmentsJson: objects.attachmentsJson,
+      published: objects.published,
+      endTime: objects.endTime,
+      communityApId: objects.communityApId,
+    })
     .from(objects)
     .where(eq(objects.apId, objectId))
     .get();
-  if (!existing || existing.attributedTo !== actor) return;
+  if (!existing || !isSameActivityPubActor(existing.attributedTo, actor)) {
+    return;
+  }
+
+  // Story is deliberately handled before Note: Yurucommu emits
+  // type=["Story","Note"] for interoperability, but its durable projection is
+  // not a Note attachment array. The old generic branch rewrote
+  // attachments_json/content into the wrong shape and corrupted the Story UI.
+  if (existing.type === "Story" || isStoryType(object.type)) {
+    if (existing.type !== "Story" || !isStoryType(object.type)) {
+      log.warn("Update rejected: object type does not match stored Story", {
+        event: "ap.update.story_type_mismatch",
+        actor,
+        objectId,
+      });
+      return;
+    }
+    if (await ownerSuppressesInboundActor(db, actor)) return;
+
+    const now = new Date().toISOString();
+    const endTime = normalizeInboundStoryUpdateEndTime(
+      existing.published,
+      existing.endTime,
+      object.endTime,
+      now,
+    );
+    if (!endTime) {
+      log.debug("Update(Story) dropped: invalid or expired lifetime", {
+        event: "ap.update.story_expired",
+        actor,
+        objectId,
+      });
+      return;
+    }
+
+    // A Story's scope is fixed at creation. Re-authorize the retained community
+    // on every Update (membership/ban policy may have changed) and fold any new
+    // addressing into the same resolution. A second local community is then
+    // ambiguous and rejected; a valid Update never widens or moves scope.
+    const hasAddressingUpdate = declaresStoryAddressing(activity, object);
+    if (hasAddressingUpdate || existing.communityApId !== null) {
+      const storyAddressing = storyAddressedCollections(activity, object);
+      if (storyAddressing.overflow) {
+        log.warn("Update(Story) rejected: too many addressing entries", {
+          event: "ap.update.story_addressing_overflow",
+          actor,
+          objectId,
+        });
+        return;
+      }
+      const scopeAddresses = existing.communityApId
+        ? [...new Set([...storyAddressing.addresses, existing.communityApId])]
+        : storyAddressing.addresses;
+      const communityScope = await resolveInboundCommunityScope(
+        db,
+        actor,
+        scopeAddresses,
+      );
+      if (
+        !communityScope.allowed ||
+        communityScope.communityApId !== existing.communityApId
+      ) {
+        log.warn("Update(Story) rejected: scope is unauthorized or changed", {
+          event: "ap.update.story_scope_mismatch",
+          actor,
+          objectId,
+          existingCommunityApId: existing.communityApId,
+        });
+        return;
+      }
+    }
+
+    const projection = buildInboundStoryUpdateProjection(
+      object,
+      existing.attachmentsJson,
+    );
+    if (!projection) {
+      log.warn("Update(Story) rejected: invalid story projection", {
+        event: "ap.update.story_invalid_projection",
+        actor,
+        objectId,
+      });
+      return;
+    }
+
+    const projectionChanged = hasStoryProjectionUpdate(object);
+    const updateStory = db
+      .update(objects)
+      .set({
+        attachmentsJson: projectionChanged ? projection.json : undefined,
+        endTime,
+        updated: now,
+      })
+      .where(eq(objects.apId, objectId));
+    if (object.overlays !== undefined) {
+      // Poll votes are indexed only by option position. Replacing/clearing the
+      // overlay list must clear old votes in the same D1 batch, otherwise an old
+      // option 0 is silently counted for a different new option 0.
+      await runBatch(db, [
+        updateStory,
+        db.delete(storyVotes).where(eq(storyVotes.storyApId, objectId)),
+      ]);
+    } else {
+      await updateStory;
+    }
+    return;
+  }
 
   // Update object content
-  if (typeIncludes(object.type, "Note")) {
-    const attachments = object.attachment
-      ? JSON.stringify(object.attachment)
+  if (existing.type === "Note" && typeIncludes(object.type, "Note")) {
+    // Update is instance-dispatched and therefore has no single recipient row.
+    // Yurucommu's default deployment has one local owner, so the same owner-wide
+    // block/mute policy used by Story Update must stop a newly suppressed remote
+    // actor from replacing already-retained Note content or reach.
+    if (await ownerSuppressesInboundActor(db, actor)) return;
+
+    const addressingContract = collectBoundedInboundAddresses([object]);
+    if (!addressingContract.ok) {
+      log.warn("Update(Note) rejected: invalid addressing projection", {
+        event: "ap.update.note_addressing_invalid",
+        actor,
+        objectId,
+        reason: addressingContract.reason,
+      });
+      return;
+    }
+
+    const replyTarget = validateInboundReplyTarget(object.inReplyTo);
+    if (!replyTarget.ok) {
+      log.warn("Update(Note) rejected: invalid reply target", {
+        event: "ap.update.note_reply_target_invalid",
+        actor,
+        objectId,
+        reason: replyTarget.reason,
+      });
+      return;
+    }
+
+    // Content and reach are one authority decision. A remote author can narrow
+    // an existing public Note to followers/direct in the same Update; applying
+    // only its new body would leave that private content readable through the
+    // stale public single-object gate. Treat the presence of either addressing
+    // field as a complete reach update (an omitted counterpart is empty), while
+    // preserving both old fields for peers that send a legacy content-only
+    // partial Update.
+    const hasAddressingUpdate = declaresAddressing(object);
+    const updatedAddressing = hasAddressingUpdate
+      ? noteAddressing(object)
+      : undefined;
+    const hasAudienceUpdate = object.audience !== undefined;
+    const updatedAudience = hasAudienceUpdate
+      ? normalizedObjectAudience(activity, object)
+      : undefined;
+    const communityScope = hasAudienceUpdate
+      ? await resolveInboundCommunityScope(db, actor, updatedAudience ?? [])
+      : existing.communityApId
+        ? await resolveInboundCommunityScope(db, actor, [
+            existing.communityApId,
+          ])
+        : { allowed: true as const, communityApId: null };
+    if (
+      !communityScope.allowed ||
+      (!hasAudienceUpdate &&
+        communityScope.communityApId !== existing.communityApId)
+    ) {
+      log.warn("Update(Note) rejected: actor cannot project into community", {
+        event: "ap.update.note_community_unauthorized",
+        actor,
+        objectId,
+      });
+      return;
+    }
+
+    const hasThreadUpdate = replyTarget.parentId !== undefined;
+    const updatedParentId = replyTarget.parentId;
+    if (updatedParentId === objectId) {
+      log.warn("Update(Note) rejected: object cannot reply to itself", {
+        event: "ap.update.note_self_reply",
+        actor,
+        objectId,
+      });
+      return;
+    }
+    if (updatedParentId) {
+      const parent = await db
+        .select({
+          apId: objects.apId,
+          attributedTo: objects.attributedTo,
+          visibility: objects.visibility,
+          toJson: objects.toJson,
+          ccJson: objects.ccJson,
+          audienceJson: objects.audienceJson,
+          communityApId: objects.communityApId,
+          type: objects.type,
+          endTime: objects.endTime,
+          deletedAt: objects.deletedAt,
+        })
+        .from(objects)
+        .where(eq(objects.apId, updatedParentId))
+        .get();
+      if (
+        parent &&
+        (parent.deletedAt !== null ||
+          !(await canViewerReadObjectFull(db, parent, actor)) ||
+          (isLocal(parent.attributedTo, c.env.APP_URL) &&
+            (await actorSuppressesInteractionFrom(
+              db,
+              parent.attributedTo,
+              actor,
+            ))))
+      ) {
+        log.warn("Update(Note) rejected: reply parent is not readable", {
+          event: "ap.update.note_parent_unreadable",
+          actor,
+          objectId,
+          parentId: updatedParentId,
+        });
+        return;
+      }
+    }
+
+    const updatedVisibility = updatedAddressing
+      ? isDirectShapedNote(updatedAddressing)
+        ? "direct"
+        : classifyInboundNoteVisibility(updatedAddressing)
       : undefined;
-    await db
+    const projectedRecipients = updatedAddressing
+      ? specificRecipientAddresses(updatedAddressing)
+      : [];
+    // DM conversation ids are pair authority. Never carry an old recipient's
+    // thread id across a re-address; only a single specific recipient has a
+    // 1:1 conversation in Yurucommu's model. Public/followers/multi-recipient/
+    // empty reach clears the old DM conversation.
+    const updatedConversation = hasAddressingUpdate
+      ? updatedVisibility === "direct" && projectedRecipients.length === 1
+        ? getConversationId(c.env.APP_URL, actor, projectedRecipients[0])
+        : null
+      : undefined;
+    const updateObject = db
       .update(objects)
       .set({
         content:
-          typeof object.content === "string" && object.content
-            ? truncate(object.content, MAX_POST_CONTENT_LENGTH)
+          object.content !== undefined
+            ? boundInboundContent(object.content)
             : undefined,
         summary:
-          typeof object.summary === "string" && object.summary
-            ? truncate(object.summary, MAX_POST_SUMMARY_LENGTH)
+          object.summary !== undefined
+            ? boundInboundSummary(object.summary)
+            : undefined,
+        attachmentsJson:
+          object.attachment !== undefined
+            ? boundInboundNoteAttachmentsJson(object.attachment)
             : undefined,
-        attachmentsJson: attachments
-          ? boundAttachmentsJson(attachments)
+        tagsJson:
+          object.tag !== undefined
+            ? boundInboundTagsJson(object.tag)
+            : undefined,
+        visibility: updatedVisibility,
+        // bto/bcc are deliberately absent: their recipients are private and
+        // represented only by the indexed recipient projection below.
+        toJson: updatedAddressing
+          ? boundAddressJson(updatedAddressing.to)
+          : undefined,
+        ccJson: updatedAddressing
+          ? boundAddressJson(updatedAddressing.cc)
+          : undefined,
+        audienceJson: hasAudienceUpdate
+          ? JSON.stringify(updatedAudience)
+          : undefined,
+        communityApId: hasAudienceUpdate
+          ? communityScope.communityApId
           : undefined,
+        inReplyTo: hasThreadUpdate ? (updatedParentId ?? null) : undefined,
+        conversation: updatedConversation,
         updated: new Date().toISOString(),
       })
       .where(eq(objects.apId, objectId));
+
+    // `object_recipients(type=to)` is the indexed DM-read authority used by
+    // contacts, requests, unread counts, and conversation discovery. Updating
+    // only toJson would revoke canonical object GET while the old recipient
+    // still received the NEW private body in their contact preview. Replace the
+    // projection in the same D1 batch as the object row so neither old nor new
+    // reach can be observed half-applied. insertMany keeps every statement
+    // below D1's parameter ceiling for the bounded 64-address input.
+    const recipientProjectionStatements = hasAddressingUpdate
+      ? [
+          db
+            .delete(objectRecipients)
+            .where(
+              and(
+                eq(objectRecipients.objectApId, objectId),
+                eq(objectRecipients.type, "to"),
+              ),
+            ),
+          ...insertMany(
+            db,
+            objectRecipients,
+            projectedRecipients.map((recipientApId) => ({
+              objectApId: objectId,
+              recipientApId,
+              type: "to",
+            })),
+            { conflict: "ignore" },
+          ),
+        ]
+      : [];
+
+    // A reply edge and both denormalized parent counters are one mutation.
+    // Recompute (rather than increment/decrement) after the child UPDATE so a
+    // duplicate/retry converges without double-counting. The old and new parent
+    // set has at most two entries, keeping the whole projection far below D1's
+    // 50-statement batch ceiling even at the 64-recipient addressing bound.
+    const parentIdsToRecompute = hasThreadUpdate
+      ? [
+          ...new Set(
+            [existing.inReplyTo, updatedParentId ?? null].filter(
+              (id): id is string => typeof id === "string" && id.length > 0,
+            ),
+          ),
+        ]
+      : [];
+    const parentCounterStatements = parentIdsToRecompute.map((parentId) =>
+      db
+        .update(objects)
+        .set({
+          replyCount: sql`(SELECT COUNT(*) FROM ${objects} WHERE ${objects.inReplyTo} = ${parentId})`,
+        })
+        .where(eq(objects.apId, parentId)),
+    );
+
+    const projectionStatements = [
+      ...recipientProjectionStatements,
+      ...parentCounterStatements,
+    ];
+    if (projectionStatements.length === 0) {
+      await updateObject;
+    } else {
+      await runBatch(db, [updateObject, ...projectionStatements]);
+    }
   }
 }
 
@@ -1493,14 +2026,15 @@ export async function handleMove(
   actor: string,
 ) {
   const db = c.get("db");
-  const oldActorApId = getActivityObjectId(activity);
+  const claimedOldActorApId = getActivityObjectId(activity);
   const newActorApId = getActivityTargetId(activity);
-  if (!oldActorApId || !newActorApId) return;
+  if (!claimedOldActorApId || !newActorApId) return;
 
   // Only accept self-move. Signature verification already ensures the request is signed,
   // but we also require Move.object to match Move.actor (defense-in-depth).
-  if (oldActorApId !== actor) return;
-  if (oldActorApId === newActorApId) return;
+  if (!isSameActivityPubActor(claimedOldActorApId, actor)) return;
+  if (isSameActivityPubActor(actor, newActorApId)) return;
+  const oldActorApId = actor;
 
   if (!isSafeRemoteUrl(newActorApId)) {
     log.warn("Blocked unsafe Move target", {
@@ -1511,6 +2045,31 @@ export async function handleMove(
     return;
   }
 
+  const baseUrl = c.env.APP_URL;
+  const refollowPrefix = await moveRefollowPrefix({
+    baseUrl,
+    inboundActivityId: activity.id,
+    oldActorApId,
+    newActorApId,
+  });
+
+  // The graph + outbound Follow activities commit atomically below, while the
+  // external Queue send necessarily happens afterwards. If that send threw,
+  // the inbox row remains processed=0 and a peer retry reaches this handler.
+  // Resume from the durable activity namespace BEFORE re-fetching the alias:
+  // the old edges are already gone, and a temporary destination fetch outage
+  // must not turn a retryable Queue failure into a silently completed no-op.
+  if (
+    (await enqueuePersistedMoveRefollows({
+      db,
+      env: c.env,
+      newActorApId,
+      refollowPrefix,
+    })) > 0
+  ) {
+    return;
+  }
+
   // SECURITY (account-migration follow-graph hijack): a signed Move only proves
   // the OLD actor consents to move; it does NOT prove the destination is the same
   // person. Without verifying the destination's `alsoKnownAs` back-reference, a
@@ -1536,266 +2095,22 @@ export async function handleMove(
   // Refresh/cache the new actor document (best-effort).
   await refreshActorCache(db, newActorApId);
 
-  // Rewrite follow graph references from old -> new in batches.
-  const followerRows = await db
-    .select({
-      followingApId: follows.followingApId,
-      status: follows.status,
-      activityApId: follows.activityApId,
-      createdAt: follows.createdAt,
-      acceptedAt: follows.acceptedAt,
-    })
-    .from(follows)
-    .where(eq(follows.followerApId, oldActorApId));
-
-  const followingRows = await db
-    .select({
-      followerApId: follows.followerApId,
-      status: follows.status,
-      activityApId: follows.activityApId,
-      createdAt: follows.createdAt,
-      acceptedAt: follows.acceptedAt,
-    })
-    .from(follows)
-    .where(eq(follows.followingApId, oldActorApId));
-
-  const followerTargets = followerRows.map((row) => row.followingApId);
-  const followingSources = followingRows.map((row) => row.followerApId);
-
-  const existingFollowerPairs =
-    followerTargets.length > 0
-      ? await db
-          .select({ followingApId: follows.followingApId })
-          .from(follows)
-          .where(
-            and(
-              eq(follows.followerApId, newActorApId),
-              // Subquery, not `inArray(followerTargets)`: the old actor's follow
-              // graph can exceed D1's 100-bound-parameter ceiling. Same set as
-              // followerTargets (the old actor's followees).
-              inArray(
-                follows.followingApId,
-                db
-                  .select({ id: follows.followingApId })
-                  .from(follows)
-                  .where(eq(follows.followerApId, oldActorApId)),
-              ),
-            ),
-          )
-      : [];
-  const existingFollowingPairs =
-    followingSources.length > 0
-      ? await db
-          .select({ followerApId: follows.followerApId })
-          .from(follows)
-          .where(
-            and(
-              // Subquery, not `inArray(followingSources)`: the old actor's
-              // follower graph can exceed D1's 100-bound-parameter ceiling. Same
-              // set as followingSources (the old actor's followers).
-              inArray(
-                follows.followerApId,
-                db
-                  .select({ id: follows.followerApId })
-                  .from(follows)
-                  .where(eq(follows.followingApId, oldActorApId)),
-              ),
-              eq(follows.followingApId, newActorApId),
-            ),
-          )
-      : [];
-
-  const existingFollowerTargetSet = new Set(
-    existingFollowerPairs.map((row) => row.followingApId),
-  );
-  const existingFollowingSourceSet = new Set(
-    existingFollowingPairs.map((row) => row.followerApId),
-  );
-
-  // Drop self-edges in addition to the existing-pair dedup: if the old and new
-  // actor were already connected (old followed/was-followed-by new, or vice
-  // versa), rewriting the endpoint to the new actor would produce a row where
-  // followerApId === followingApId (a self-follow). Filter those out so the
-  // migration never materializes a self-follow.
-  const followerRewrites = followerRows
-    .filter(
-      (row) =>
-        !existingFollowerTargetSet.has(row.followingApId) &&
-        row.followingApId !== newActorApId,
-    )
-    .map((row) => ({
-      followerApId: newActorApId,
-      followingApId: row.followingApId,
-      status: row.status,
-      activityApId: row.activityApId,
-      createdAt: row.createdAt,
-      acceptedAt: row.acceptedAt,
-    }));
-  // For followers that are LOCAL to this instance, a bare edge rewrite is not
-  // enough: the destination server has no record of the follow, so it would
-  // never deliver the migrated account's posts (the local user's following list
-  // would point at the new actor but silently receive nothing). Re-issue a
-  // fresh, *pending* Follow to the new actor and enqueue outbound delivery —
-  // the standard Mastodon "follow the move target on the user's behalf"
-  // behavior; the destination's Accept flips it to accepted. Remote followers
-  // are left as a plain edge rewrite: re-establishing their follow is their own
-  // server's responsibility.
-  const baseUrl = c.env.APP_URL;
-  const localReFollows: { followerApId: string; followId: string }[] = [];
-  const followingRewrites = followingRows
-    .filter(
-      (row) =>
-        !existingFollowingSourceSet.has(row.followerApId) &&
-        row.followerApId !== newActorApId,
-    )
-    .map((row) => {
-      if (isLocal(row.followerApId, baseUrl)) {
-        const followId = activityApId(baseUrl, generateId());
-        localReFollows.push({ followerApId: row.followerApId, followId });
-        return {
-          followerApId: row.followerApId,
-          followingApId: newActorApId,
-          status: "pending",
-          activityApId: followId,
-          createdAt: row.createdAt,
-          acceptedAt: null,
-        };
-      }
-      return {
-        followerApId: row.followerApId,
-        followingApId: newActorApId,
-        status: row.status,
-        activityApId: row.activityApId,
-        createdAt: row.createdAt,
-        acceptedAt: row.acceptedAt,
-      };
-    });
-
-  // LOCAL followers whose ACCEPTED edge to the old actor we are about to delete.
-  // Each such edge was counted in that follower's followingCount; the re-issued
-  // Follow to the new actor is created PENDING (uncounted) and only re-adds the
-  // +1 when the destination Accepts (handleAccept). So the old +1 must be removed
-  // now, otherwise the eventual Accept stacks a second +1 on the never-removed
-  // old count → a permanent over-count of 1 per migrated follow. Decrementing at
-  // delete time is correct in every Accept-timing case: during the pending window
-  // the follower counts 0 of this relationship (right — it is pending), after the
-  // Accept it is back to 1, and if the Accept never arrives it stays decremented
-  // (right — the edge is perpetually pending). Remote followers' counts are not
-  // ours to manage; only local followingCount is authoritative here.
-  const localAcceptedFollowerApIds = Array.from(
-    new Set(
-      followingRows
-        .filter(
-          (row) =>
-            row.status === "accepted" && isLocal(row.followerApId, baseUrl),
-        )
-        .map((row) => row.followerApId),
-    ),
-  );
-
-  // Symmetric to the above, on the FOLLOWEE side: the old actor's ACCEPTED follow
-  // of a LOCAL actor L incremented L.followerCount (handleFollow). When the
-  // (old→L) rewrite is DROPPED as a duplicate (the NEW actor already follows L,
-  // i.e. L ∈ existingFollowerTargetSet) or as a self-edge (L === newActor), the
-  // delete below still removes (old→L) but NO rewrite re-adds an (new→L) edge for
-  // it — so L would keep a permanent +1 over-count. Decrement those dropped,
-  // accepted, local followees' followerCount once (the non-dropped case is
-  // count-preserving: delete old→L + insert new→L). gt(>0) guards underflow.
-  const droppedAcceptedLocalFolloweeApIds = Array.from(
-    new Set(
-      followerRows
-        .filter(
-          (row) =>
-            row.status === "accepted" &&
-            isLocal(row.followingApId, baseUrl) &&
-            (existingFollowerTargetSet.has(row.followingApId) ||
-              row.followingApId === newActorApId),
-        )
-        .map((row) => row.followingApId),
-    ),
-  );
-
-  // Co-commit the four edge mutations + the per-follower followingCount
-  // decrements in ONE atomic batch. D1 has no interactive transactions, and the
-  // OLD sequential form was non-convergent: a crash between "delete old edges"
-  // and "decrement" left the old edges gone, so a re-dispatch (the row is still
-  // processed=0) re-read EMPTY follower/following rows, skipped the decrement,
-  // and left every migrated local follower's followingCount permanently +1 over.
-  // Batching makes delete+decrement all-or-nothing: a crash before commit changes
-  // nothing (retry re-runs cleanly from the still-present old edges); a crash
-  // after commit re-reads no old edges (the batch is then a no-op) → the
-  // decrement is applied exactly once.
-  const moveOps = [];
-  if (followerRewrites.length > 0) {
-    moveOps.push(db.insert(follows).values(followerRewrites));
-  }
-  if (followerRows.length > 0) {
-    moveOps.push(
-      db.delete(follows).where(eq(follows.followerApId, oldActorApId)),
-    );
-  }
-  if (followingRewrites.length > 0) {
-    moveOps.push(db.insert(follows).values(followingRewrites));
-  }
-  if (followingRows.length > 0) {
-    moveOps.push(
-      db.delete(follows).where(eq(follows.followingApId, oldActorApId)),
-    );
-  }
-  for (const followerApId of localAcceptedFollowerApIds) {
-    moveOps.push(
-      db
-        .update(actors)
-        .set({ followingCount: sql`${actors.followingCount} - 1` })
-        .where(
-          and(eq(actors.apId, followerApId), gt(actors.followingCount, 0)),
-        ),
-    );
-  }
-  for (const followeeApId of droppedAcceptedLocalFolloweeApIds) {
-    moveOps.push(
-      db
-        .update(actors)
-        .set({ followerCount: sql`${actors.followerCount} - 1` })
-        .where(and(eq(actors.apId, followeeApId), gt(actors.followerCount, 0))),
-    );
-  }
-  if (moveOps.length > 0) {
-    await runBatch(db, moveOps as unknown as Parameters<typeof runBatch>[1]);
-  }
+  await rewriteMovedFollowGraph({
+    db,
+    oldActorApId,
+    newActorApId,
+    refollowPrefix,
+  });
 
-  // Record + deliver the outbound Follow activities for migrated local
-  // followers so the destination server registers them as followers and starts
-  // delivering. Best-effort per follower: a delivery enqueue failure must not
-  // abort the rest of the migration (the follow row is already pending and will
-  // simply lack delivery until retried).
-  for (const { followerApId, followId } of localReFollows) {
-    const followActivity = {
-      "@context": "https://www.w3.org/ns/activitystreams",
-      id: followId,
-      type: "Follow",
-      actor: followerApId,
-      object: newActorApId,
-    };
-    try {
-      await db.insert(activities).values({
-        apId: followId,
-        type: "Follow",
-        actorApId: followerApId,
-        objectApId: newActorApId,
-        rawJson: JSON.stringify(followActivity),
-        direction: "outbound",
-      });
-      await enqueueDeliveryToActor(c.env, followId, newActorApId);
-    } catch (e) {
-      log.warn("Failed to issue migration re-follow to move target", {
-        event: "ap.move.refollow_failed",
-        follower: followerApId,
-        newActor: newActorApId,
-        error: e,
-      });
-    }
-  }
+  // Queue delivery is the only non-transactional step. Do not swallow a real
+  // producer failure: the inbox claim remains uncommitted and a retry resumes
+  // the durable activities through the prefix check at the top of this handler.
+  await enqueuePersistedMoveRefollows({
+    db,
+    env: c.env,
+    newActorApId,
+    refollowPrefix,
+  });
 }
 
 // ---------------------------------------------------------------------------