@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/actors.ts

@@ -14,14 +14,12 @@ import {
   or,
   sql,
 } from "drizzle-orm";
-import type { BatchItem } from "drizzle-orm/batch";
 import {
   activities,
   actorCache,
   actors,
   blocks,
   communities,
-  deliveryQueue,
   follows,
   inbox,
   mediaUploads,
@@ -29,6 +27,8 @@ import {
   notDeleted,
   nowIso,
   objects,
+  runBatch,
+  type D1Statement,
 } from "../../db/index.ts";
 import type { Database } from "../../db/index.ts";
 import type { Env, Variables } from "../types.ts";
@@ -36,21 +36,33 @@ import {
   activityApId,
   formatUsername,
   generateId,
+  isLocal,
   isSafeRemoteUrl,
   parseLimit,
   parseOffset,
   safeJsonParse,
 } from "../federation-helpers.ts";
 import { enqueueFanoutToFollowers } from "../lib/delivery/queue.ts";
+import { prepareDeliveryFanoutJob } from "../lib/delivery/fanout-outbox.ts";
 import {
   destinationDeclaresAlias,
   resolveMoveTarget,
 } from "../lib/account-migration.ts";
 import { getInstanceFetchSigner } from "./activitypub/query-helpers.ts";
-import { severFollowEdge } from "./activitypub/handlers/inbox-interaction-handlers.ts";
-import { teardownActor } from "./account-teardown.ts";
+import { blockActorAndSeverFollowPair } from "../lib/follow-edge-mutations.ts";
+import {
+  deletePersonalActorBlock,
+  deletePersonalActorMute,
+  personalActorIsBlockedBy,
+  resolveRetainedPersonalMuteTarget,
+} from "../lib/personal-actor-moderation.ts";
+import {
+  finalizeActorDeletionAndSessions,
+  teardownActor,
+} from "./account-teardown.ts";
 import { CacheTags, CacheTTL, withCache } from "../middleware/cache.ts";
 import {
+  type AppContext,
   actorExists,
   createRelation,
   deleteRelation,
@@ -69,12 +81,56 @@ import {
 } from "./actors-helpers.ts";
 import { reapReplacedMediaUrl } from "./posts/delete-cascade.ts";
 import { safeUrlJoin } from "../lib/activitypub-helpers.ts";
+import { isActorBlockedStrict } from "../lib/blocklist.ts";
 import { encodeFeedCursor, feedCursorWhere } from "../lib/feed-cursor.ts";
 import { chunkForInClause } from "../lib/chunk.ts";
 import { logger } from "../lib/logger.ts";
+import { excludeModeratedActors } from "../lib/feed-exclude.ts";
+import {
+  activityDeleteCascadeStatements,
+  activityDeliveryDrainedGuard,
+  deleteActivitiesCascade,
+} from "../lib/activity-delete-cascade.ts";
+import {
+  claimRemoteActorFetch,
+  fetchAndUpsertActorCache,
+  getRemoteActorFetchFailure,
+  recordRemoteActorFetchFailure,
+  type RemoteActorFetchFailureState,
+} from "../lib/activitypub-actor-cache.ts";
 
 const log = logger.child({ component: "actors" });
 
+function remoteActorFetchFailureResponse(
+  c: AppContext,
+  failure: RemoteActorFetchFailureState,
+): Response {
+  if (failure.kind === "gone") {
+    return c.json({ error: "Remote actor is gone", code: "ACTOR_GONE" }, 410);
+  }
+
+  const retryAfter = failure.retryAfterSeconds ?? 30;
+  c.header("Retry-After", retryAfter.toString());
+  if (failure.kind === "invalid") {
+    return c.json(
+      {
+        error: "Remote actor returned invalid data",
+        code: "ACTOR_INVALID",
+        retry_after: retryAfter,
+      },
+      502,
+    );
+  }
+  return c.json(
+    {
+      error: "Remote actor is temporarily unavailable",
+      code: "ACTOR_UNAVAILABLE",
+      retry_after: retryAfter,
+    },
+    503,
+  );
+}
+
 // Mastodon-parity profile metadata limits. Mastodon caps profile fields at 4
 // rows with bounded name/value lengths; we mirror that to keep the served
 // actor document and federated Update(Person) bounded.
@@ -137,15 +193,21 @@ function fieldsToAttachments(
 const TOMBSTONE_REAP_AFTER_MS = 24 * 60 * 60 * 1000;
 
 /**
- * Hard-delete tombstoned local actors whose federation Delete has drained.
+ * Reap signing material for tombstoned local actors and communities whose
+ * federation work has drained.
  *
  * A tombstone is only reaped when (a) its `deletedAt` is older than
- * TOMBSTONE_REAP_AFTER_MS and (b) it has NO non-terminal (pending / processing
- * / failed / retry_wait) delivery_queue rows for any of its Delete activities —
- * i.e. nothing still needs the private key to sign a retry. The preserved Delete activity
- * rows are removed alongside the actor so they do not accumulate forever.
+ * TOMBSTONE_REAP_AFTER_MS and (b) it has NO non-terminal endpoint-delivery or
+ * actor-resolution rows for any of its Delete activities — i.e. nothing can
+ * still resolve into a delivery that needs the private key to sign a retry.
+ * The preserved Delete activity rows are removed alongside the actor so they
+ * do not accumulate forever.
  *
- * Returns the number of tombstones hard-deleted.
+ * Actor rows are hard-deleted as before. Community rows remain as permanent
+ * lifecycle tombstones so their scoped objects keep failing the read gate, but
+ * their private signing key is scrubbed after every Group activity projection
+ * is terminal. Returns the total number of actor rows deleted + community keys
+ * scrubbed.
  */
 export async function reapDrainedTombstones(db: Database): Promise<number> {
   const cutoff = new Date(Date.now() - TOMBSTONE_REAP_AFTER_MS).toISOString();
@@ -157,70 +219,83 @@ export async function reapDrainedTombstones(db: Database): Promise<number> {
       and(sql`${actors.deletedAt} IS NOT NULL`, lt(actors.deletedAt, cutoff)),
     )
     .limit(100);
-  if (candidates.length === 0) return 0;
 
   let reaped = 0;
   for (const { apId } of candidates) {
-    // Delete activities this actor authored (preserved through teardown for
-    // the delivery signer). Outbound by construction.
-    const deleteActivities = await db
-      .select({ apId: activities.apId })
-      .from(activities)
-      .where(
-        and(eq(activities.actorApId, apId), eq(activities.type, "Delete")),
-      );
-    const deleteActivityIds = deleteActivities.map((a) => a.apId);
-
-    if (deleteActivityIds.length > 0) {
-      // Any non-terminal delivery job for those Delete activities means the
-      // signer may still need this actor's key — skip reaping for now. Chunked:
-      // a prolific deleted actor can have >100 Delete activities, which would
-      // blow D1's 100-bound-param cap and 500 this fire-and-forget reap, leaking
-      // the tombstone (and its signing key) forever.
-      let hasPendingDelivery = false;
-      for (const chunk of chunkForInClause(deleteActivityIds)) {
-        const pending = await db
-          .select({ id: deliveryQueue.id })
-          .from(deliveryQueue)
-          .where(
-            and(
-              inArray(deliveryQueue.activityApId, chunk),
-              // Non-terminal delivery states (anything other than the terminal
-              // "delivered" / "dead_letter"). A "retry_wait" row is a Delete
-              // between attempts and will be re-sent, so reaping the tombstone
-              // (and its signing key) while one exists would strand the retry
-              // unsigned. queue-delivery.ts writes: pending / processing /
-              // failed / retry_wait / delivered / dead_letter.
-              inArray(deliveryQueue.status, [
-                "pending",
-                "processing",
-                "failed",
-                "retry_wait",
-              ]),
-            ),
-          )
-          .limit(1)
-          .get();
-        if (pending) {
-          hasPendingDelivery = true;
-          break;
-        }
-      }
-      if (hasPendingDelivery) continue;
-    }
+    // Check the delivery authority on every statement in ONE batch. A
+    // resolution worker can materialize an endpoint while cleanup is starting;
+    // an unguarded cascade would delete that new job and then the signing key.
+    // D1 serializes this batch, so any active row that appears before or during
+    // it fences all subsequent cleanup statements.
+    const deleteActivityWhere = and(
+      eq(activities.actorApId, apId),
+      eq(activities.type, "Delete"),
+    )!;
+    const drainedGuard = activityDeliveryDrainedGuard(db, deleteActivityWhere);
+    await runBatch(db, [
+      ...activityDeleteCascadeStatements(db, deleteActivityWhere, {
+        guard: drainedGuard,
+      }),
+      db
+        .delete(actors)
+        .where(
+          and(
+            eq(actors.apId, apId),
+            isNotNull(actors.deletedAt),
+            lt(actors.deletedAt, cutoff),
+            drainedGuard,
+          ),
+        ) as D1Statement,
+    ]);
+    const actorRemains = await db
+      .select({ apId: actors.apId })
+      .from(actors)
+      .where(eq(actors.apId, apId))
+      .get();
+    if (!actorRemains) reaped += 1;
+  }
 
-    // Drained: remove the terminal delivery_queue rows, the preserved Delete
-    // activities, then the tombstone row itself (chunked for D1's param cap).
-    if (deleteActivityIds.length > 0) {
-      for (const chunk of chunkForInClause(deleteActivityIds)) {
-        await db
-          .delete(deliveryQueue)
-          .where(inArray(deliveryQueue.activityApId, chunk));
-        await db.delete(activities).where(inArray(activities.apId, chunk));
-      }
-    }
-    await db.delete(actors).where(eq(actors.apId, apId));
-    reaped += 1;
+  // A retired Group cannot be hard-deleted: its community row is the durable
+  // negative lifecycle fact used by direct object reads. Once all Group-authored
+  // activity projections have drained, remove those ledgers/projections and
+  // scrub only the private signing key.
+  const communityCandidates = await db
+    .select({ apId: communities.apId })
+    .from(communities)
+    .where(
+      and(
+        isNotNull(communities.deletedAt),
+        lt(communities.deletedAt, cutoff),
+        ne(communities.privateKeyPem, ""),
+      ),
+    )
+    .limit(100);
+  for (const { apId } of communityCandidates) {
+    const groupActivityWhere = eq(activities.actorApId, apId);
+    const drainedGuard = activityDeliveryDrainedGuard(db, groupActivityWhere);
+    await runBatch(db, [
+      ...activityDeleteCascadeStatements(db, groupActivityWhere, {
+        guard: drainedGuard,
+      }),
+      db
+        .update(communities)
+        .set({ privateKeyPem: "" })
+        .where(
+          and(
+            eq(communities.apId, apId),
+            isNotNull(communities.deletedAt),
+            lt(communities.deletedAt, cutoff),
+            ne(communities.privateKeyPem, ""),
+            drainedGuard,
+          ),
+        ) as D1Statement,
+    ]);
+    const communityAfter = await db
+      .select({ privateKeyPem: communities.privateKeyPem })
+      .from(communities)
+      .where(eq(communities.apId, apId))
+      .get();
+    if (communityAfter?.privateKeyPem === "") reaped += 1;
   }
 
   return reaped;
@@ -239,23 +314,10 @@ export async function reapDrainedTombstones(db: Database): Promise<number> {
  * delivery_queue rows AND the preserved Delete activity rows, so re-registration
  * starts clean and no half-signed Delete is sent.
  *
- * Mirrors the activity/queue cleanup `reapDrainedTombstones` performs, but is
- * unconditional (the revive supersedes the Delete) and only scoped to non-
- * terminal delivery rows; terminal rows are removed alongside the activity.
+ * Mirrors the activity/projection cleanup `reapDrainedTombstones` performs,
+ * but is unconditional because the revive supersedes the Delete.
  * Returns the number of Delete activities cancelled.
  */
-// D1 has no interactive transactions, but both the D1 and libsql drivers expose
-// `db.batch([...])`, which commits a list of prepared statements atomically. The
-// shared `Database` union aliases the abstract `BaseSQLiteDatabase` base (which
-// does not surface `batch`), so we narrow to the concrete batch surface here
-// rather than weakening the shared type (mirrors inbox-interaction-handlers.ts).
-type BatchStatement = BatchItem<"sqlite">;
-interface BatchableDb {
-  batch(
-    statements: readonly [BatchStatement, ...BatchStatement[]],
-  ): Promise<unknown>;
-}
-
 export async function cancelTombstoneDelete(
   db: Database,
   apId: string,
@@ -267,20 +329,13 @@ export async function cancelTombstoneDelete(
   const deleteActivityIds = deleteActivities.map((a) => a.apId);
   if (deleteActivityIds.length === 0) return 0;
 
-  // Drop every delivery_queue row for those Delete activities (any status — the
-  // Delete is superseded, including in-flight retry_wait jobs) together with the
-  // preserved Delete activity rows, so no signer can pick up a job referencing
-  // an activity whose actor row has been rotated. Each chunk's two deletes stay
-  // paired in one atomic batch; chunked because a prolific actor can have >100
-  // Delete activities, which would blow D1's 100-bound-param cap and 500 the
-  // revive.
+  // Drop every durable projection for those Delete activities (any queue status
+  // — the Delete is superseded, including in-flight retry_wait jobs) together
+  // with the activity rows, so no signer can pick up work referencing an
+  // activity whose actor row has been rotated. Each chunk stays in one atomic
+  // batch; chunking keeps the predicate below D1's 100-bound-param ceiling.
   for (const chunk of chunkForInClause(deleteActivityIds)) {
-    await (db as unknown as BatchableDb).batch([
-      db
-        .delete(deliveryQueue)
-        .where(inArray(deliveryQueue.activityApId, chunk)),
-      db.delete(activities).where(inArray(activities.apId, chunk)),
-    ]);
+    await deleteActivitiesCascade(db, inArray(activities.apId, chunk));
   }
 
   return deleteActivityIds.length;
@@ -359,7 +414,7 @@ actorsRoute.get(
         following_count: a.followingCount,
         post_count: a.postCount,
         created_at: a.createdAt,
-        username: formatUsername(a.apId),
+        username: formatUsername(a.apId, a.preferredUsername),
       })),
     });
   },
@@ -394,20 +449,11 @@ actorsRoute.post("/me/blocked", async (c) => {
     c,
     "block",
     async (db, actorId, targetId) => {
-      await db
-        .insert(blocks)
-        .values({ blockerApId: actorId, blockedApId: targetId })
-        .onConflictDoNothing();
-      // Sever BOTH follow edges + reconcile counts (mirrors the federated
-      // handleBlock). Without this a blocked actor who was an accepted follower
-      // stays in the fan-out set and keeps receiving the blocker's posts, and
-      // both actors' follower/following counts stay inflated — defeating the
-      // whole point of the block. severFollowEdge gates each decrement on an
-      // EXISTS(... status='accepted') subquery so a pending/absent edge is a
-      // clean no-op (no under-count). Pending follow-request rows are deleted by
-      // the edge delete inside severFollowEdge regardless of status.
-      await severFollowEdge(db, targetId, actorId); // target follows actor
-      await severFollowEdge(db, actorId, targetId); // actor follows target
+      // The block row, both follow-edge removals, and all four counter
+      // reconciliations are one D1 commit. Without that boundary a failure
+      // between the two directions can leave follower-only delivery authority
+      // half alive even though the API reports failure.
+      await blockActorAndSeverFollowPair(db, actorId, targetId);
     },
     async (db, actorId) =>
       (
@@ -417,17 +463,14 @@ actorsRoute.post("/me/blocked", async (c) => {
           .where(eq(blocks.blockerApId, actorId))
           .get()
       )?.n ?? 0,
+    (db, actorId, targetId) => personalActorIsBlockedBy(db, actorId, targetId),
   );
 });
 
 // Unblock a user
 actorsRoute.delete("/me/blocked", async (c) => {
   return deleteRelation(c, "block", (db, actorId, targetId) =>
-    db
-      .delete(blocks)
-      .where(
-        and(eq(blocks.blockerApId, actorId), eq(blocks.blockedApId, targetId)),
-      ),
+    deletePersonalActorBlock(db, actorId, targetId),
   );
 });
 
@@ -458,11 +501,20 @@ actorsRoute.post("/me/muted", async (c) => {
   return createRelation(
     c,
     "mute",
-    (db, actorId, targetId) =>
-      db
+    async (db, actorId, targetId) => {
+      const retainedTarget = await resolveRetainedPersonalMuteTarget(
+        db,
+        actorId,
+        targetId,
+      );
+      await db
         .insert(mutes)
-        .values({ muterApId: actorId, mutedApId: targetId })
-        .onConflictDoNothing(),
+        .values({
+          muterApId: actorId,
+          mutedApId: retainedTarget ?? targetId,
+        })
+        .onConflictDoNothing();
+    },
     async (db, actorId) =>
       (
         await db
@@ -471,15 +523,15 @@ actorsRoute.post("/me/muted", async (c) => {
           .where(eq(mutes.muterApId, actorId))
           .get()
       )?.n ?? 0,
+    async (db, actorId, targetId) =>
+      Boolean(await resolveRetainedPersonalMuteTarget(db, actorId, targetId)),
   );
 });
 
 // Unmute a user
 actorsRoute.delete("/me/muted", async (c) => {
   return deleteRelation(c, "mute", (db, actorId, targetId) =>
-    db
-      .delete(mutes)
-      .where(and(eq(mutes.muterApId, actorId), eq(mutes.mutedApId, targetId))),
+    deletePersonalActorMute(db, actorId, targetId),
   );
 });
 
@@ -509,11 +561,17 @@ actorsRoute.post("/me/delete", async (c) => {
     // Delete(Actor) (snapshotting follower inboxes before the graph is dropped),
     // reconciles every counterparty's denormalized counters, deletes the actor's
     // edges / interactions / memberships / media / DM state, hands off sole-owned
-    // communities to an heir, hard-deletes its authored objects, and
-    // tombstones+scrubs the actor row. This is the EXACT cascade teardownActor
-    // applies to each sub-account below — one chokepoint instead of a ~440-line
-    // hand-rolled copy that had to be kept in sync.
-    await teardownActor(db, c.env, baseUrl, actorApIdVal, actor.followers_url);
+    // communities to an heir, and hard-deletes its authored objects. The owner
+    // tombstone is finalized below after all sub-accounts succeed. This is the
+    // EXACT cascade teardownActor applies to each sub-account below — one
+    // chokepoint instead of a ~440-line hand-rolled copy that had to be kept in
+    // sync.
+    // Defer the owner's tombstone until every sub-account has completed. If a
+    // later media/DB step fails, the owner row and session remain live so the
+    // same authenticated request can retry the incomplete cascade.
+    await teardownActor(db, c.env, baseUrl, actorApIdVal, actor.followers_url, {
+      finalizeActor: false,
+    });
     // Now fully tear down each sub-account (same cascade the owner just received)
     // so no "deleted" sub-account content / edge / counter / membership / sole
     // ownership survives, and each federates its own Delete(Actor).
@@ -521,6 +579,12 @@ actorsRoute.post("/me/delete", async (c) => {
       await teardownActor(db, c.env, baseUrl, sub.apId, sub.followersUrl);
     }
 
+    // Finalize the owner only after all owner/sub-account teardown work has
+    // succeeded. Sessions are removed last so a failure above cannot discard
+    // the retry authority. Tombstoned actors fail closed in session-actor.ts.
+    const sessionActorIds = [actorApIdVal, ...subAccounts.map((s) => s.apId)];
+    await finalizeActorDeletionAndSessions(db, actorApIdVal, sessionActorIds);
+
     deleteCookie(c, "session");
 
     return c.json({ success: true });
@@ -577,6 +641,8 @@ actorsRoute.get("/:identifier/posts", async (c) => {
     conditions.push(eq(objects.visibility, "public"));
     conditions.push(eq(objects.audienceJson, "[]"));
   }
+  const excludeAuthor = excludeModeratedActors(currentActor?.ap_id ?? "");
+  if (excludeAuthor) conditions.push(excludeAuthor);
   // Composite (published, apId) cursor so posts sharing a published millisecond
   // aren't skipped at a page boundary (see lib/feed-cursor.ts).
   const profileCursor = feedCursorWhere(
@@ -634,7 +700,7 @@ actorsRoute.get("/:identifier/posts", async (c) => {
       type: p.type,
       author: {
         ap_id: p.attributedTo,
-        username: formatUsername(p.attributedTo),
+        username: formatUsername(p.attributedTo, author?.preferredUsername),
         preferred_username: author?.preferredUsername || null,
         name: author?.name || null,
         icon_url: author?.iconUrl || null,
@@ -702,12 +768,82 @@ actorsRoute.get("/:identifier", async (c) => {
     .get();
 
   if (!localActor) {
-    const cachedActor = await db
+    // A cached remote actor remains in storage so an operator unblock can be
+    // reversible, but it must not stay directly discoverable while its actor
+    // or domain is defederated. Apply the same complete actor/domain decision
+    // as ingress and outbound delivery before projecting the cached profile.
+    if (await isActorBlockedStrict(db, apId)) {
+      return c.json({ error: "Actor not found" }, 404);
+    }
+    let cachedActor = await db
       .select()
       .from(actorCache)
       .where(eq(actorCache.apId, apId))
       .get();
-    if (!cachedActor) return c.json({ error: "Actor not found" }, 404);
+    if (!cachedActor) {
+      // A Follow edge can outlive the optional presentation cache (for
+      // example after cache eviction or an interrupted refresh). The profile
+      // link projected from that durable relationship must remain recoverable,
+      // but this public read route must not become an arbitrary remote-fetch
+      // proxy. Only an authenticated read of a safe non-local actor with a
+      // retained pending/accepted relationship may hydrate the missing row.
+      const retainedRelationship =
+        currentActor && !isLocal(apId, baseUrl) && isSafeRemoteUrl(apId)
+          ? await db
+              .select({ followerApId: follows.followerApId })
+              .from(follows)
+              .where(
+                and(
+                  or(
+                    eq(follows.followerApId, apId),
+                    eq(follows.followingApId, apId),
+                  ),
+                  inArray(follows.status, ["pending", "accepted"]),
+                ),
+              )
+              .get()
+          : null;
+      if (!retainedRelationship) {
+        return c.json({ error: "Actor not found" }, 404);
+      }
+
+      const activeFailure = await getRemoteActorFetchFailure(db, apId);
+      if (activeFailure) {
+        return remoteActorFetchFailureResponse(c, activeFailure);
+      }
+
+      const fetchClaim = await claimRemoteActorFetch(db, apId);
+      if (!fetchClaim.owned) {
+        return remoteActorFetchFailureResponse(c, fetchClaim.failure);
+      }
+
+      const recovered = await fetchAndUpsertActorCache(db, apId, {
+        mode: "insert",
+        signer: await getInstanceFetchSigner(c),
+      });
+      if (!recovered.ok) {
+        const failure = await recordRemoteActorFetchFailure(
+          db,
+          apId,
+          recovered,
+          new Date(),
+          fetchClaim.token,
+        );
+        // Another entry path may have successfully cached the actor while this
+        // claimed network request was failing. The failure update is fenced by
+        // actor_cache existence; re-read before returning a stale 410/503.
+        cachedActor = await db
+          .select()
+          .from(actorCache)
+          .where(eq(actorCache.apId, apId))
+          .get();
+        if (!cachedActor) {
+          return remoteActorFetchFailureResponse(c, failure);
+        }
+      } else {
+        cachedActor = recovered.row;
+      }
+    }
 
     // Project the remote actor's AS Person document (cached `rawJson`) so the
     // client banner/fields work for REMOTE actors too: `attachment` ->
@@ -727,7 +863,10 @@ actorsRoute.get("/:identifier", async (c) => {
         name: cachedActor.name,
         summary: cachedActor.summary,
         icon_url: cachedActor.iconUrl,
-        username: formatUsername(cachedActor.apId),
+        username: formatUsername(
+          cachedActor.apId,
+          cachedActor.preferredUsername,
+        ),
         fields: sanitizeProfileFields(rawAttachment),
         also_known_as: rawAlsoKnownAs.slice(0, MAX_ALSO_KNOWN_AS),
         moved_to: rawMovedTo,
@@ -784,7 +923,7 @@ actorsRoute.get("/:identifier", async (c) => {
       post_count: localActor.postCount,
       is_private: localActor.isPrivate,
       created_at: localActor.createdAt,
-      username: formatUsername(localActor.apId),
+      username: formatUsername(localActor.apId, localActor.preferredUsername),
       fields: sanitizeProfileFields(safeJsonParse(localActor.fieldsJson, [])),
       also_known_as: safeJsonParse<string[]>(localActor.alsoKnownAsJson, []),
       moved_to: localActor.movedTo,
@@ -907,23 +1046,11 @@ actorsRoute.put("/me", async (c) => {
   }
 
   const db = c.get("db");
-  await db.update(actors).set(updates).where(eq(actors.apId, actor.ap_id));
-
-  // A replaced avatar/header is attached to no object, so no GC path reclaims
-  // the prior blob — reap it now if the old URL is a local /media upload no
-  // longer referenced anywhere (best-effort; never fails the update).
-  for (const [dbKey, oldUrl] of [
-    ["iconUrl", actor.icon_url],
-    ["headerUrl", actor.header_url],
-  ] as const) {
-    if (updates[dbKey] !== undefined && oldUrl && oldUrl !== updates[dbKey]) {
-      await reapReplacedMediaUrl(db, oldUrl, actor.ap_id, c.env.MEDIA);
-    }
-  }
 
   // The `actor` context snapshot predates the new columns, so to federate a
-  // faithful Person we read the current persisted values when the request did
-  // not itself supply them.
+  // faithful Person we read the currently persisted values when the request
+  // does not itself supply them. This read deliberately precedes the atomic
+  // profile + Activity + fanout-intent write below.
   if (nextFields === undefined || nextAlsoKnownAs === undefined) {
     const persisted = await db
       .select({
@@ -1032,18 +1159,46 @@ actorsRoute.put("/me", async (c) => {
     object: personObject,
   };
 
-  try {
-    await db.insert(activities).values({
+  const preparedFanout = await prepareDeliveryFanoutJob(db, {
+    kind: "followers",
+    activityId: updateActivityId,
+    targetApId: actor.ap_id,
+  });
+  await runBatch(db, [
+    db
+      .update(actors)
+      .set(updates)
+      .where(eq(actors.apId, actor.ap_id)) as D1Statement,
+    db.insert(activities).values({
       apId: updateActivityId,
       type: "Update",
       actorApId: actor.ap_id,
       objectApId: actor.ap_id,
       rawJson: JSON.stringify(updateActivity),
       direction: "outbound",
-    });
+    }) as D1Statement,
+    preparedFanout.statement,
+  ]);
+
+  // A replaced avatar/header is attached to no object, so no GC path reclaims
+  // the prior blob — reap it after the durable profile mutation commits if the
+  // old URL is a local /media upload no longer referenced anywhere
+  // (best-effort; never fails the update).
+  for (const [dbKey, oldUrl] of [
+    ["iconUrl", actor.icon_url],
+    ["headerUrl", actor.header_url],
+  ] as const) {
+    if (updates[dbKey] !== undefined && oldUrl && oldUrl !== updates[dbKey]) {
+      await reapReplacedMediaUrl(db, oldUrl, actor.ap_id, c.env.MEDIA);
+    }
+  }
+
+  try {
     await enqueueFanoutToFollowers(c.env, updateActivityId, actor.ap_id);
   } catch (err) {
-    // Federation is best-effort; the local profile update already succeeded.
+    // The semantic fanout is already durable in the same commit as the profile
+    // and Activity. Queue publication is only a best-effort wakeup; a later
+    // request/startup/retention sweep republishes the pending row.
     log.error("Failed to enqueue profile Update federation", {
       event: "actors.profile.update_federation_failed",
       actor: actor.ap_id,
@@ -1110,11 +1265,6 @@ actorsRoute.post("/me/move", async (c) => {
   const db = c.get("db");
   const baseUrl = c.env.APP_URL;
 
-  await db
-    .update(actors)
-    .set({ movedTo: target })
-    .where(eq(actors.apId, actor.ap_id));
-
   // Federate Move(actor) addressed to followers so they migrate their follow.
   const moveActivityId = activityApId(baseUrl, generateId());
   const moveActivity = {
@@ -1128,18 +1278,32 @@ actorsRoute.post("/me/move", async (c) => {
     cc: [actor.followers_url],
   };
 
-  try {
-    await db.insert(activities).values({
+  const preparedFanout = await prepareDeliveryFanoutJob(db, {
+    kind: "followers",
+    activityId: moveActivityId,
+    targetApId: actor.ap_id,
+  });
+  await runBatch(db, [
+    db
+      .update(actors)
+      .set({ movedTo: target })
+      .where(eq(actors.apId, actor.ap_id)) as D1Statement,
+    db.insert(activities).values({
       apId: moveActivityId,
       type: "Move",
       actorApId: actor.ap_id,
       objectApId: actor.ap_id,
       rawJson: JSON.stringify(moveActivity),
       direction: "outbound",
-    });
+    }) as D1Statement,
+    preparedFanout.statement,
+  ]);
+
+  try {
     await enqueueFanoutToFollowers(c.env, moveActivityId, actor.ap_id);
   } catch (err) {
-    // Federation is best-effort; the local moved_to marker already persisted.
+    // The moved_to marker, Activity, and semantic fanout are already one atomic
+    // durable commit. Queue publication is only a best-effort wakeup.
     log.error("Failed to enqueue account Move federation", {
       event: "actors.account.move_federation_failed",
       actor: actor.ap_id,
@@ -1241,7 +1405,7 @@ actorsRoute.get("/me/export", async (c) => {
       fields: sanitizeProfileFields(safeJsonParse(profileRow.fieldsJson, [])),
       also_known_as: safeJsonParse<string[]>(profileRow.alsoKnownAsJson, []),
       moved_to: profileRow.movedTo,
-      username: formatUsername(profileRow.apId),
+      username: formatUsername(profileRow.apId, profileRow.preferredUsername),
     },
     outbox: {
       type: "OrderedCollection",