fedipod-server 0.26.0 → 0.28.1

package/dist/handler.js

@@ -657,6 +657,9 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
             runPage: this.args.runPage || webFile('run.html'),
             runPath: this.runPath,
             adminPage: this.args.adminPage || webFile('admin.html'),
+            // The notices page renders here too, and says the server keeps none:
+            // a notices store is the Netlify front's, not this component's.
+            noticesPage: webFile('notices.html'),
             // The opt-in and roster pages load the sign-in library, and the installer
             // command is handed out with it; without these the pages render but
             // cannot be used.
@@ -667,6 +670,7 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
                 'new-account.js': webFile('new-account.js'),
                 'run.js': webFile('run.js'),
                 'admin.js': webFile('admin.js'),
+                'notices.js': webFile('notices.js'),
             },
             installScript: webFile('install.sh'),
             lookup: (h) => this.dir.lookup(h),

package/lib/connections/bskyfeed.mjs

@@ -166,6 +166,10 @@ export class BskyFeed {
     this.lastSweep = new Date().toISOString();
     const self = this.atproto.read()?.did;
     let added = 0;
+    // One commit boundary for the sweep, as acctfeed and tagfeed: every item
+    // awaits Bluesky before the next, so the debounce never coalesced them and
+    // the timeline index went to the pod once per notification.
+    this.store.hold?.();
     try {
       // Our own CROSS-POSTS must not echo back into the feed — but a post or
       // reply written natively on Bluesky is ours to see here too. The mirrors
@@ -224,6 +228,8 @@ export class BskyFeed {
     } catch (e) {
       this._backOff(e.status || 0, null);
       return;
+    } finally {
+      this.store.release?.();
     }
     const all = this.store.getStatuses();
     const mirrored = all.filter(s => s.kind === 'bsky');

package/lib/core/deliver.mjs

@@ -73,6 +73,10 @@ export class Deliverer {
     this.edPrivate = edPrivate;
     this.proofKeyId = proofKeyId;
     this.log = log;
+    // How many fresh deliveries one attempt may carry. The Node deliverer
+    // opens a socket per recipient; the browser's relay deliverer sends a
+    // list, and sets this to what the relay accepts.
+    this.batchSize = 1;
     if (!passive) this.startQueue();
   }
 
@@ -171,33 +175,51 @@ export class Deliverer {
     }
   }
 
+  // One attempt per target, answered in order: `{ ok: true }` or `{ error }`
+  // with the error deliverNow would have thrown. Here one at a time; the
+  // relay deliverer sends the whole list in one call.
+  async deliverManyNow(targets) {
+    const out = [];
+    for (const t of targets) {
+      try { await this.deliverNow(t.inbox, t.activity); out.push({ ok: true }); }
+      catch (error) { out.push({ error }); }
+    }
+    return out;
+  }
+
   async deliver(inbox, activity) {
     // Proved before anything else, so the copy that goes on the queue is the
     // copy that was signed — a retry days later must not post a bare activity.
     const signed = await this.proofed(activity);
-    // A host we already know is refusing: queue without asking again. This is
-    // the path a FRESH activity takes, so without it a fan-out to a struggling
-    // server opened one socket per follower before any of this applied.
+    if (this._queueIfCooling(inbox, signed)) return;
+    const [result] = await this.deliverManyNow([{ inbox, activity: signed }]);
+    await this._settle(inbox, signed, result);
+  }
+
+  // A host we already know is refusing: queue without asking again. This is
+  // the path a FRESH activity takes, so without it a fan-out to a struggling
+  // server opened one socket per follower before any of this applied.
+  _queueIfCooling(inbox, signed) {
     const host = hostOf(inbox);
     const until = this._cooling?.get(host);
-    if (until && until > Date.now()) {
-      this.log(`${host} is cooling — queueing ${signed.type} rather than asking again`);
-      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: until });
-      return;
-    }
-    try {
-      await this.deliverNow(inbox, signed);
-      this.log(`delivered ${signed.type} → ${inbox}`);
-    } catch (e) {
-      if (unsalvageable(e)) { await this._unsalvageable(inbox, e); return; }
-      this.log(`delivery failed (${e.message}) — queued`);
-      const wait = e.retryAfterMs || 60_000;
-      if (aboutTheHost(e)) {
-        this._cooling ||= new Map();
-        this._cooling.set(host, Date.now() + wait);
-      }
-      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: Date.now() + wait });
+    if (!until || until <= Date.now()) return false;
+    this.log(`${host} is cooling — queueing ${signed.type} rather than asking again`);
+    this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: until });
+    return true;
+  }
+
+  // What one attempt's outcome means for the queue.
+  async _settle(inbox, signed, result) {
+    if (result.ok) { this.log(`delivered ${signed.type} → ${inbox}`); return; }
+    const e = result.error;
+    if (unsalvageable(e)) { await this._unsalvageable(inbox, e); return; }
+    this.log(`delivery failed (${e.message}) — queued`);
+    const wait = e.retryAfterMs || 60_000;
+    if (aboutTheHost(e)) {
+      this._cooling ||= new Map();
+      this._cooling.set(hostOf(inbox), Date.now() + wait);
     }
+    this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: Date.now() + wait });
   }
 
   // Not retried, and on a 410 the followers who received there are dropped,
@@ -231,8 +253,16 @@ export class Deliverer {
     // Proved once for the whole fan-out: every recipient gets the same bytes,
     // and one signature is computed rather than one per follower.
     const signed = await this.proofed(activity);
-    // Shared inboxes deduplicate fan-out to the same server.
-    for (const inbox of [...new Set(inboxes)]) await this.deliver(inbox, signed);
+    // Shared inboxes deduplicate fan-out to the same server. Sent in batches
+    // of batchSize, and a host found cooling by one batch is not asked again
+    // by the next.
+    const targets = [...new Set(inboxes)].map((inbox) => ({ inbox, activity: signed }));
+    for (let i = 0; i < targets.length; i += this.batchSize) {
+      const chunk = targets.slice(i, i + this.batchSize).filter((t) => !this._queueIfCooling(t.inbox, signed));
+      if (!chunk.length) continue;
+      const results = await this.deliverManyNow(chunk);
+      for (let k = 0; k < chunk.length; k++) await this._settle(chunk[k].inbox, signed, results[k]);
+    }
   }
 
   // Serialized, for the same reason Intake.drain is: the tick is 60s and a

package/lib/core/intake/index.mjs

@@ -51,6 +51,7 @@ const CHAIN_GAP_MS = 5_000;      // pause between chained backlog sweeps
 // enough that a crash re-does little, large enough that a flood of fast
 // rejections does not become a pod write per item.
 const DELETE_BATCH = 10;
+const ORPHAN_RECEIPTS_PER_SWEEP = 20;   // strays from before receipts were deleted with their items
 // Attempt counts live in pod state, not in memory: a restart used to hand every
 // poison item five fresh tries, and under a crash loop that is unbounded.
 const ATTEMPTS_DOC = 'intake-attempts.json';
@@ -359,6 +360,7 @@ export class Intake {
     // deadletter.json where one would do, and a flood is exactly when the pod
     // should be asked for less rather than more.
     const pending = [];
+    const withReceipt = new Set();   // items the listing showed a receipt beside
     const flush = async () => {
       if (!pending.length) return true;
       // Written down before any of them leaves the mailbox. A failure here
@@ -379,13 +381,17 @@ export class Intake {
         }
         this._clearAttempt(url);
         handled++;
+        // Its receipt goes with it. Left beside a deleted item, a receipt
+        // was one stray document per delivery, forever.
+        if (withReceipt.has(url)) await podInbox.dropReceiptBeside(this.remote, url);
         await new Promise(r => setTimeout(r, DELETE_GAP_MS));
       }
       return true;
     };
 
-    for (const { url, size } of items) {
+    for (const { url, size, receipt: hasReceipt } of items) {
       if (url.endsWith('.keep')) continue;
+      if (hasReceipt) withReceipt.add(url);
       // The listing already carries every child's size, so this costs nothing
       // to ask. An activity is a few kB; anything of this order is not one, and
       // reading it with an unbounded res.text() buffers whatever a stranger
@@ -430,9 +436,11 @@ export class Intake {
         }
         // A gateway that verified this delivery left a receipt beside it. Read
         // it only when a gateway is configured (no config → no fetch, so an
-        // install with no gateway pays nothing); a missing or HMAC-invalid
-        // receipt reads as null, which is exactly today's unverified behavior.
-        const receipt = activity ? await this._readReceipt(url) : null;
+        // install with no gateway pays nothing) and the listing showed one
+        // beside this item (`false` is a definite no; a listing that does not
+        // say leaves it to the read); a missing or HMAC-invalid receipt reads
+        // as null, which is exactly today's unverified behavior.
+        const receipt = activity && hasReceipt !== false ? await this._readReceipt(url) : null;
         if (activity && this.gatewaySecret()) this._bumpGatewayStat(!!receipt?.verified);
         // The owner's own post, taken at the outbox door: not mail to read
         // but a write to make. Never archived or forwarded as if received.
@@ -464,6 +472,11 @@ export class Intake {
       if (pending.length >= DELETE_BATCH && !await flush()) return;
     }
     if (!await this._finishSweep(flush)) return;
+    // Receipts earlier drains left behind, a few per sweep until none remain.
+    for (const stray of podInbox.orphanReceipts(this.remote, this.urls).slice(0, ORPHAN_RECEIPTS_PER_SWEEP)) {
+      if (!await podInbox.dropStrayReceipt(this.remote, stray)) break;
+      await new Promise(r => setTimeout(r, DELETE_GAP_MS));
+    }
     // Made progress and there is more waiting: go straight round rather than
     // sleeping. Gated on progress so a sweep that achieved nothing — a
     // cooldown, an unwritable store, poison at the head — cannot spin.

package/lib/core/lease.mjs

@@ -9,13 +9,13 @@
 import crypto from 'node:crypto';
 
 // Renewal is the one thing that writes even when nothing is happening: at 30s
-// it was 120 PUTs an hour per agent, each taking a write lock on the pod. 90s
-// against a 5-minute TTL leaves three missed renewals of headroom and cuts that
-// load by two thirds. The cost is automatic promotion after a crash waiting up
-// to the TTL — a user acting on a second device does not wait, since takeover()
-// claims the lease outright.
-const TTL_MS = 300_000;
-const RENEW_MS = 90_000;
+// it was 120 PUTs an hour per agent, each taking a write lock on the pod; at
+// 90s, 40. Five minutes against a 15-minute TTL leaves two missed renewals of
+// headroom and makes it 12. The cost is automatic promotion after a crash
+// waiting up to the TTL — a user acting on a second device does not wait,
+// since takeover() claims the lease outright.
+const TTL_MS = 900_000;
+const RENEW_MS = 300_000;
 const JITTER = () => 0.85 + Math.random() * 0.3;
 // Distinct from null: null is "nobody holds it", this is "we could not ask".
 const UNREADABLE = Symbol('lease-unreadable');

package/lib/core/publisher/index.mjs

@@ -106,6 +106,9 @@ export class Publisher {
       image: this.config.image || null, fields: this.config.fields || [],
       webId: this.remote.webId || null,
       aliases: this.config.aliases || [],
+      // A group says whether only its moderators may open posts (Lemmy's
+      // term); a person's actor carries nothing of the kind.
+      postingRestrictedToMods: this.config.kind === 'group' ? !!this.config.postingRestrictedToMods : null,
       moderators,
       pendingFollowers: priv ? urls.pendingFollowers : null,
       pendingFollowing: priv ? urls.pendingFollowing : null,

package/lib/core/store.mjs

@@ -72,6 +72,11 @@ export function dropFollower(contacts, actor, why) {
   return contacts;
 }
 
+// What a state document looks like on the pod; write() and _put() agree on it.
+const serialise = (obj) => JSON.stringify(obj, null, 2) + '\n';
+// The same record apart from when it was fetched.
+const sameButWhen = (a, b) => JSON.stringify({ ...a, fetchedAt: null }) === JSON.stringify({ ...b, fetchedAt: null });
+
 export class PodStore {
   constructor({ storage = null, log = console.log } = {}) {
     this.lastSkipped = [];        // what the last load could not read, as `name (HTTP n)`
@@ -79,6 +84,7 @@ export class PodStore {
     this.log = log;
     this.cache = new Map();        // name → parsed value
     this.etags = new Map();        // name (or '') → last ETag, for revalidation
+    this.lastText = new Map();     // name → the bytes last loaded from or sent to the pod
     this.timers = new Map();       // name → debounce timer
     this.dirty = new Set();        // written while held; flushed by commit/release
     this._held = 0;
@@ -91,7 +97,7 @@ export class PodStore {
   attach(storage) {
     // A different tree is different state: carrying the old cache and its
     // ETags across would serve one container's documents as another's.
-    if (this.storage && this.storage.base !== storage.base) { this.cache.clear(); this.etags.clear(); }
+    if (this.storage && this.storage.base !== storage.base) { this.cache.clear(); this.etags.clear(); this.lastText.clear(); }
     this.storage = storage;
   }
 
@@ -144,7 +150,7 @@ export class PodStore {
       }
       fetched++;
       this.etags.set(name, r.etag);
-      try { this.cache.set(name, JSON.parse(r.body)); }
+      try { this.cache.set(name, JSON.parse(r.body)); this.lastText.set(name, r.body); }
       catch (e) { this.log(`state load ${name}: unparsable (${e.message})`); }
     }
     // Kept for /status: a document skipped here is a timeline or a contact
@@ -167,6 +173,15 @@ export class PodStore {
   write(name, obj) {
     this.cache.set(name, structuredClone(obj));
     if (!this.storage) return;
+    // The same bytes the pod already holds are not sent again. A like, a
+    // bookmark, a sweep that found nothing new each used to upload the whole
+    // timeline index and the whole people cache, unchanged — the largest
+    // write on the pod, on every small action. A write that had been armed
+    // and is now undone is unarmed with it.
+    if (this.lastText.get(name) === serialise(obj)) {
+      clearTimeout(this.timers.get(name)); this.timers.delete(name); this.dirty.delete(name);
+      return;
+    }
     // Held: record it and leave the writing to the commit boundary the caller
     // already has. See hold().
     if (this._held) { this.dirty.add(name); return; }
@@ -205,13 +220,13 @@ export class PodStore {
   // the returned promise so one failure cannot poison the queue.
   _put(name) {
     const done = this.chain.then(async () => {
-      const body = JSON.stringify(this.cache.get(name), null, 2) + '\n';
+      const body = serialise(this.cache.get(name));
       for (let attempt = 1; attempt <= PUT_RETRIES; attempt++) {
         // A storage that throws is a bug, not a hiccup — but it must not
         // escape into the write queue, where it would look like success.
         const r = await this.storage.write(name, body, 'application/json')
           .catch(e => ({ ok: false, retry: false, why: e.message }));
-        if (r.ok) return true;
+        if (r.ok) { this.lastText.set(name, body); return true; }
         // The storage says whether trying again could possibly help: a pod's
         // 4xx is an answer rather than a hiccup, and a directory's EACCES will
         // still be an EACCES in two seconds.
@@ -236,6 +251,7 @@ export class PodStore {
   // migrates to the local machine — leaving the copy behind would defeat it).
   async remove(name) {
     this.cache.delete(name);
+    this.lastText.delete(name);
     clearTimeout(this.timers.get(name));
     this.timers.delete(name);
     if (!this.storage) return true;
@@ -462,6 +478,7 @@ export class PodStore {
   getActors() { return this.read('actors.json', {}); }
   cacheActor(url, doc) {
     const a = this.getActors();
+    const known = a[url];
     a[url] = {
       name: clamp(plainText(doc.name || doc.preferredUsername || ''), MAX_NAME),
       preferredUsername: clamp(plainText(doc.preferredUsername || ''), MAX_NAME),
@@ -474,9 +491,12 @@ export class PodStore {
       type: doc.type || 'Person',
       followers: doc.followers || null,
       following: doc.following || null,
-      ...(a[url]?.counts ? { counts: a[url].counts } : {}),
+      ...(known?.counts ? { counts: known.counts } : {}),
       fetchedAt: new Date().toISOString(),
     };
+    // Fetched again and found the same: nothing to write. Only the time of
+    // asking differs, and that is not worth the whole cache going to the pod.
+    if (known && sameButWhen(known, a[url])) { a[url] = known; return; }
     this.write('actors.json', prune(a, ACTOR_CACHE_MAX, this.getContacts()));
   }
 

package/lib/core/wire.mjs

@@ -3,6 +3,10 @@
 // protocol documents, not our RDF.
 
 export const AS_CTX = 'https://www.w3.org/ns/activitystreams';
+// Lemmy's own context, held locally (lib/core/contexts/join-lemmy.json). It
+// names the three terms a Lemmy reader looks for on a community and its
+// posts: postingRestrictedToMods, stickied, commentsEnabled.
+export const LEMMY_CTX = 'https://join-lemmy.org/context.json';
 export const SEC_CTX = 'https://w3id.org/security/v1';
 export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 
@@ -80,7 +84,8 @@ export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
 export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
   webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
-  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null }) {
+  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null,
+  postingRestrictedToMods = null }) {
   // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
   // inline exactly as Mastodon declares it — and only when we actually use it.
   // It is what makes a client show "Request to follow" rather than "Follow" and
@@ -118,6 +123,9 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
   // old accounts elsewhere whose servers check for their own URL here before
   // they will send a Move. Declared inline exactly as Mastodon declares it.
   if (webId || aliases.length) context.push({ alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' } });
+  // A community says whether only its moderators may open posts in it, in
+  // Lemmy's term, declared through Lemmy's context. Groups only.
+  if (kind === 'group' && postingRestrictedToMods !== null) context.push(LEMMY_CTX);
   if (fields.length) {
     context.push({ schema: 'http://schema.org#', PropertyValue: 'schema:PropertyValue', value: 'schema:value' });
   }
@@ -134,6 +142,7 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
     }] } : {}),
     ...(movedTo ? { movedTo } : {}),
     ...(webId || aliases.length ? { alsoKnownAs: [...(webId ? [webId] : []), ...aliases] } : {}),
+    ...(kind === 'group' && postingRestrictedToMods !== null ? { postingRestrictedToMods: !!postingRestrictedToMods } : {}),
     preferredUsername: handle,
     name: name || handle,
     // The bio, and the avatar. For a group, `summary` is where what the group

package/lib/device/cli/commands/setup.mjs

@@ -52,8 +52,12 @@ if (!newAccount) {
   const { resourceExists } = await import(new URL('../../../../lib/pod/root.mjs', import.meta.url));
   const { apUrls, DEFAULT_ROOT: DR } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
   if (await resourceExists(fetch, apUrls(pod, DR).actor)) {
-    console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
-    process.exit(2);
+    if (String(flag('address') || 'pod').toLowerCase() !== 'front') {
+      console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      console.error('To move an account whose address is at another gateway to this one, add --address front.');
+      process.exit(2);
+    }
+    console.log('The pod already holds an account; if its address is at another gateway, setup moves it here.');
   }
 }
 

package/lib/device/gateway-move.mjs

@@ -0,0 +1,58 @@
+// gateway-move.mjs — the second half of a DeviceAgent moving an address from
+// one gateway to another (lib/device/setup.mjs does the first, when a pod
+// that already holds an account at another gateway is set up with an address
+// at this one). The browser build has the same two halves in
+// web/app/gateway-move.mjs; this is the Node one, which signs and delivers
+// itself instead of going through a relay.
+//
+//   1. The old gateway is told the address moved (POST /api/move, proved with
+//      the pod session as attach was). From then on it serves the old actor
+//      as a moved stub — same key, old id, `movedTo` the new one.
+//   2. A Move goes to every follower, FROM the old actor, signed under the
+//      old key id: the only signature a follower's server can verify against
+//      the old actor. Same key material; only the key id differs.
+//
+// Runs when the agent starts acting, and is safe to run again: a move left
+// pending (the old gateway unreachable) is tried at the next start.
+import { Deliverer } from '../core/deliver.mjs';
+import { moveActivity } from '../core/wire.mjs';
+
+export async function completeGatewayMove(agent, { makeDeliverer = (o) => new Deliverer(o) } = {}) {
+  const cfg = agent.store.getConfig();
+  const mv = cfg?.movedFrom;
+  if (!mv || mv.completedAt) return null;
+  const log = agent.log || (() => {});
+  const newActor = agent.urls.actor;
+
+  // 1. the old gateway
+  let told;
+  try {
+    told = await agent.remote.session.fetch(`${mv.gateway}/api/move`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ handle: mv.handle, movedTo: newActor }),
+    });
+  } catch (e) { told = { status: 0, statusText: e.message }; }
+  if (told.status !== 200) {
+    log(`gateway move: ${mv.gateway} did not mark @${mv.handle} as moved (${told.status || told.statusText}) — will retry at the next start`);
+    return { told: false };
+  }
+
+  // 2. the Move, from the old address
+  const contacts = agent.store.getContacts();
+  const inboxes = [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  const activity = moveActivity({ actor: mv.actor }, newActor, Date.now());
+  const sender = makeDeliverer({
+    store: agent.store, rsaPrivate: agent.deliverer.rsaPrivate,
+    keyId: `${mv.actor}#main-key`, actorId: mv.actor, log, passive: true,
+  });
+  let sent = 0; let failed = 0;
+  for (const inbox of inboxes) {
+    try { await sender.deliverNow(inbox, activity); sent++; }
+    catch (e) { failed++; log(`gateway move: Move to ${inbox} failed: ${e.message}`); }
+  }
+  const done = { ...mv, completedAt: new Date().toISOString(), moveSent: sent, moveFailed: failed };
+  agent.store.setConfig({ ...agent.store.getConfig(), movedFrom: done });
+  await agent.store.flush?.();
+  log(`moved from ${mv.actor} to ${newActor}: Move sent to ${sent} inbox(es)${failed ? `, ${failed} failed` : ''}`);
+  return done;
+}

package/lib/device/migrate.mjs

@@ -27,7 +27,9 @@ export const layoutOf = (cred) => Number(cred?.layout) || 0;
 // deliberately, with `--private-root`, has said where they want it; a migration
 // that overrode that would be moving data on its own initiative.
 export function needsStateMove(cred) {
-  return !cred?.privateRoot;
+  // `stateOnPod` is a move-in from a browser account (setup.mjs): the state
+  // is on the pod because that is where the account already lives.
+  return !cred?.privateRoot && !cred?.stateOnPod;
 }
 
 export function pendingSteps(cred) {

package/lib/device/setup.mjs

@@ -21,6 +21,7 @@ import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from '../shared/safefetch.mjs';
 import { resourceExists } from '../pod/root.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
+import { completeGatewayMove } from './gateway-move.mjs';
 
 const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
 
@@ -125,6 +126,18 @@ export function frontedAddress({ pod, shape }) {
   return pathPod || shape === 'front';
 }
 
+// The account a pod already holds, read as its owner: the config and the key
+// record in its state container. Both null when there is none, or when the
+// credential is not the owner's. Injected for tests.
+export async function readPodAccount({ home, credential, pod, root, log = () => {} }) {
+  const remote = new RemotePod(credential, { home, log });
+  await remote.warmup?.();
+  const urls = apUrls(pod, root || DEFAULT_ROOT);
+  const config = await remote.getJson(urls.state + 'config.json').catch(() => null);
+  const keys = await remote.getJson(urls.state + 'keys.json').catch(() => null);
+  return { config, keys };
+}
+
 // Take an address at a Gateway: attach the pod to it, fronted, and return the
 // gateway config bootstrap writes and connect reads. The pod session proves
 // the pod — no password reaches the Gateway. Injected for tests.
@@ -231,8 +244,13 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
   // several writes, and that pod is a server somebody runs. `state --to` moves
   // it afterwards; starting on the pod and moving later is strictly worse,
   // because the copy left behind was on the pod the whole time.
-  const privateRoot = answers.privateRoot
+  let privateRoot = answers.privateRoot
     || pathToFileURL(path.join(home, 'private')).href + '/';
+  // A pod that already holds an account at ANOTHER gateway, set up with an
+  // address at this one: not a second account but the same one moving in.
+  // Its state and key are on the pod, and stay there.
+  let movingIn = false;
+  let movedFrom = null;
   // Everything that leaves this function — notes, errors, the log — goes
   // through here. Nothing today echoes a password back, but /setup/progress is
   // polled repeatedly and would re-serve one forever if anything ever did.
@@ -266,10 +284,15 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       // reachable, and no silent 401 later on a pod whose profile is empty.
       const usable = await checkPod(pod);
       if (!usable.ok) throw new Error(usable.error);
-      if (await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor)) {
-        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      const held = await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor);
+      if (held && !frontedAddress({ pod, shape })) {
+        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod. '
+          + 'To move an account whose address is at another gateway to this one, ask for an address at this gateway.');
       }
-      skip('account', 'using the pod you already have');
+      if (held && kind === 'group') throw new Error('The pod already hosts a FediPod account, and a group cannot move between gateways.');
+      movingIn = held;
+      if (movingIn) { privateRoot = null; }
+      skip('account', movingIn ? 'the pod already holds the account — its address moves here' : 'using the pod you already have');
     }
 
     // --- credential: the point of no return, and the durability boundary ---
@@ -295,12 +318,14 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
         remotePod: pod.endsWith('/') ? pod : pod + '/',
         createdAt: new Date().toISOString(),
         ...(root ? { root } : {}),
-        ...(keys === 'pod' ? { keysMode: 'pod' } : {}),
-        // Where the private half lives. Per-machine, like keysMode.
+        ...(keys === 'pod' || movingIn ? { keysMode: 'pod' } : {}),
+        // Where the private half lives. Per-machine, like keysMode. A move-in
+        // keeps it on the pod, where the account already is, and says so.
         ...(privateRoot ? { privateRoot } : {}),
+        ...(movingIn ? { stateOnPod: true } : {}),
         // What shape this install is, so `upgrade` can tell an old one from a
         // new one without guessing from the fields.
-        ...(isCurrent({ privateRoot }) ? { layout: CURRENT_LAYOUT } : {}),
+        ...(isCurrent({ privateRoot, stateOnPod: movingIn }) ? { layout: CURRENT_LAYOUT } : {}),
       };
       fs.mkdirSync(home, { recursive: true, mode: 0o700 });
       writeJsonAtomic(credPath, rec);
@@ -316,6 +341,24 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       done('credential', credPath);
     }
 
+    // --- a move-in: the account on the pod, read with the credential just
+    // minted, has to be one whose address lives at another gateway ---
+    if (movingIn) {
+      const cred = JSON.parse(fs.readFileSync(credPath, 'utf8'));
+      const account = await (deps.readPodAccount || readPodAccount)({ home, credential: cred, pod, root: root || DEFAULT_ROOT, log });
+      if (!account?.config) throw new Error('the pod holds an account, but its record could not be read with this credential — is this account the pod\'s owner?');
+      const frontActor = account.config.gateway?.frontActor || null;
+      const gwHost = new URL(gatewayOrigin).host;
+      if (!frontActor) throw new Error('The pod already hosts a FediPod account whose address lives on the pod: nothing to move. Sign in to it instead.');
+      if (new URL(frontActor).host === gwHost) throw new Error(`The pod already hosts a FediPod account at ${gwHost}: sign in to it instead of setting up again.`);
+      if ((account.config.kind || 'person') === 'group') throw new Error('a group cannot move between gateways');
+      if (!account.keys?.rsa || account.keys.ct) {
+        throw new Error(`this account's key is still under a password from an earlier version — sign in once at ${new URL(frontActor).host} first, then set up here`);
+      }
+      movedFrom = { actor: frontActor, gateway: new URL(frontActor).origin, handle: account.config.handle, at: new Date().toISOString() };
+      log(`moving @${account.config.handle}@${new URL(frontActor).host} here, as @${handle}@${gwHost}`);
+    }
+
     // --- take an address at the Gateway, if this pod needs one or asked for
     // one --- before bootstrap, so the config it writes carries the Gateway
     // ids and the key connect mints below is stamped to the Gateway actor from
@@ -346,6 +389,17 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       if (!ready.ok) throw new Error(ready.error);
     }
     await agent.bootstrap({ handle, name: name || handle, root, kind, approveJoins, summary, icon, gateway: gatewayCfg });
+    if (movingIn && movedFrom) {
+      // The old actor becomes an alias, which is what a server checks on the
+      // new actor before it honours a Move; the Move itself is pending until
+      // the new actor is published (completeGatewayMove, below and at every
+      // start). The key stays; its stamp follows the actor.
+      const cfg = agent.store.getConfig() || {};
+      agent.store.setConfig({ ...cfg, aliases: [...new Set([...(cfg.aliases || []), movedFrom.actor])], movedFrom });
+      const keyRec = agent.store.read?.('keys.json', null);
+      if (keyRec?.mintedFor && gatewayCfg?.frontActor) agent.store.write?.('keys.json', { ...keyRec, mintedFor: gatewayCfg.frontActor });
+      await agent.store.flush();
+    }
     done('bootstrap');
 
     begin('connect');
@@ -360,6 +414,12 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     }
     const published = await agent.publisher.publishProfile();
     await agent.store.flush();
+    if (movingIn) {
+      // Tell the old gateway and the followers. Not fatal: left pending, it
+      // is tried again when the agent next starts acting.
+      const moved = await (deps.completeGatewayMove || completeGatewayMove)(agent).catch((e) => { log(`gateway move: ${e.message}`); return null; });
+      if (moved?.completedAt) log(`Move sent from ${movedFrom.actor} to ${moved.moveSent} inbox(es)`);
+    }
     done('publish');
 
     // --- and say plainly whether the world can actually see it ---

package/lib/gateway/caches.mjs

@@ -0,0 +1,36 @@
+// caches.mjs — what one warm gateway process keeps between requests: the
+// pod-token verifier, and the public keys of the servers that deliver here.
+// Built per request, each costs round trips to somebody else's server for
+// every call; built once, a process pays them once.
+
+// The Solid-OIDC verifier remembers the issuers' key sets it has seen. A
+// fresh one per call re-read the caller's WebID document, the issuer's
+// discovery document and its keys on every signed-in call.
+let verifier = null;
+export async function podTokenVerifier() {
+  if (!verifier) verifier = (await import('@solid/access-token-verifier')).createSolidTokenVerifier();
+  return verifier;
+}
+
+// The keys deliveries are signed with, by key id, in the shape Fedify's
+// verifier asks for. A key is held an hour; a key that could not be fetched
+// is held five minutes, so a server that was down is asked again soon.
+// Fedify re-fetches on its own when a held key no longer verifies, so a
+// rotated key costs one failed check, not an hour of refused mail.
+const KEY_TTL_MS = 60 * 60_000;
+const MISS_TTL_MS = 5 * 60_000;
+const KEY_CACHE_MAX = 500;
+const keys = new Map();   // key id → { key, until }
+export const senderKeys = {
+  async get(keyId) {
+    const hit = keys.get(keyId.href);
+    if (!hit) return undefined;
+    if (hit.until < Date.now()) { keys.delete(keyId.href); return undefined; }
+    return hit.key;
+  },
+  async set(keyId, key) {
+    if (keys.size >= KEY_CACHE_MAX) keys.delete(keys.keys().next().value);
+    keys.set(keyId.href, { key, until: Date.now() + (key ? KEY_TTL_MS : MISS_TTL_MS) });
+  },
+  size: () => keys.size,
+};