fedipod-server 0.28.0 → 0.29.0

package/lib/client/c2s.mjs

@@ -28,6 +28,7 @@ import * as social from '../core/social.mjs';
 import * as wire from '../core/wire.mjs';
 import { readLenient } from '../core/as2.mjs';
 import { safeSlug } from '../core/publisher/notes.mjs';
+import * as podNotes from '../pod/notes.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
@@ -192,9 +193,11 @@ export class C2S {
    * published copy and it stays the canonical one; this is served only where
    * that copy cannot be read by the client asking.
    */
-  sendLocalOutbox(res, url, origin) {
+  sendLocalOutbox(res, url, origin, { owner = false } = {}) {
     const id = `${origin}ap/outbox`;
-    const outbox = this.store.read('outbox.json', []);     // newest first
+    // newest first; the owner's view is every message, the public one what a
+    // stranger may see
+    const outbox = this.store.read(owner ? 'outbox-own.json' : 'outbox.json', []);
     const page = url?.searchParams?.get('page') || null;
     const ct = { 'content-type': 'application/activity+json; charset=utf-8' };
     if (!page) {
@@ -270,12 +273,22 @@ export class C2S {
       return this.sendInbox(res, url);
     }
     if (req.method === 'GET' || req.method === 'HEAD') {
+      // The owner, signed in, reads every message the actor produced (§5.1:
+      // the outbox is filtered by who asks). Anyone else reads the public one.
+      const owner = pathname === '/ap/outbox' && req.headers.authorization
+        ? (await this.auth(req, pathname)).ok : false;
       // Where the client surface answers on an address a stranger can reach,
       // the pod's copies already name it and are the documents. Standalone
       // they are not reachable by the client asking, so it is answered here.
       const local = this.agent.publisher?.clientOrigin ? null : this.localOrigin(req);
       if (local && pathname === '/ap/actor') return this.sendLocalActor(req, res, local);
-      if (local && pathname === '/ap/outbox') return this.sendLocalOutbox(res, url, local);
+      if (local && pathname === '/ap/outbox') return this.sendLocalOutbox(res, url, local, { owner });
+      // The owner is answered here, not sent on: a redirect loses the
+      // credential (a browser drops it across origins, and a DPoP proof names
+      // the address it was made for), so the pod would refuse them.
+      if (owner && pathname === '/ap/outbox') {
+        return this.sendLocalOutbox(res, url, this.agent.publisher.clientOrigin, { owner });
+      }
       // The pod's copy is the document; send the reader there.
       const target = pathname === '/ap/actor' ? this.urls.actor : this.urls.outbox;
       res.writeHead(303, { location: target, 'cache-control': 'no-store' });
@@ -334,14 +347,22 @@ export class C2S {
   visibilityOf(activity, object) {
     const to = arr(activity.to ?? object?.to).map(idOf);
     const cc = arr(activity.cc ?? object?.cc).map(idOf);
-    if (!to.length && !cc.length) return 'public';
+    // Blind copies alone are still an audience: a post for them and nobody
+    // else is direct, never public.
+    const blind = arr(activity.bto ?? object?.bto).length + arr(activity.bcc ?? object?.bcc).length;
+    if (!to.length && !cc.length) return blind ? 'direct' : 'public';
     if (to.includes(wire.PUBLIC)) return 'public';
     if (cc.includes(wire.PUBLIC)) return 'unlisted';
-    if (to.includes(this.urls.followers)) return 'private';
+    // Followers named anywhere — "to alice, cc my followers" included — is a
+    // followers-only post that also reaches whoever else is named.
+    if (to.includes(this.urls.followers) || cc.includes(this.urls.followers)) return 'private';
     return 'direct';
   }
 
-  async dispatch(activity, { slug = null, raw = null } = {}) {
+  // `serial` and `at` name what this activity will make: the outbox door
+  // chose them and told the client, so they are used as given. A client
+  // posting here directly gets fresh ones.
+  async dispatch(activity, { slug = null, raw = null, serial = Date.now(), at = new Date().toISOString() } = {}) {
     const reply = (status, body, headers = {}) => ({ status, body, headers });
     if (!activity || typeof activity !== 'object' || Array.isArray(activity) || !activity.type) {
       return reply(400, { error: 'a typed ActivityStreams object is required' });
@@ -349,10 +370,12 @@ export class C2S {
     // A bare object arrives without an activity around it; the server supplies
     // the Create (§6.2.1), carrying the object's own addressing up onto it.
     if (!ACTIVITY_TYPES.has(activity.type)) {
-      activity = { type: 'Create', object: activity, to: activity.to, cc: activity.cc };
+      // Every audience field is copied up onto the Create (§6.2.1).
+      const { to, cc, bto, bcc, audience } = activity;
+      activity = { type: 'Create', object: activity, to, cc, bto, bcc, audience };
     }
     try {
-      return await this._dispatch(activity, { slug, raw, reply });
+      return await this._dispatch(activity, { slug, raw, reply, serial, at });
     } catch (e) {
       this.log(`c2s ${activity?.type}: ${e.message}`);
       return reply(422, { error: e.message || String(e) });
@@ -366,11 +389,23 @@ export class C2S {
     const pick = (...fields) => [...new Set(fields.flatMap((f) => arr(activity[f] ?? object?.[f]).map(idOf)))]
       .filter((a) => typeof a === 'string' && /^https?:\/\//u.test(a)
         && a !== wire.PUBLIC && a !== this.urls.followers && a !== this.urls.actor);
-    return { also: pick('to', 'cc'), deliverTo: pick('bto', 'bcc') };
+    // `audience` is who the post is for, a group most often: delivered to and
+    // named like to and cc (§7.1).
+    return { also: pick('to', 'cc', 'audience'), deliverTo: pick('bto', 'bcc') };
   }
 
-  async _dispatch(activity, { slug, raw, reply }) {
+  async _dispatch(activity, { slug, raw, reply, serial, at }) {
     const agent = this.agent;
+    // §6: every post to the outbox answers 201 with the new activity's id.
+    const made = (id, body = {}) => reply(201, { id, ...body }, { location: id });
+    // What is never sent anywhere — a person's block, a pin — is still a
+    // message this actor produced, so the owner's outbox records it here.
+    const kept = (type, extra) => {
+      const id = type === 'Undo' ? wire.undoActivityId(this.urls, serial) : `${this.urls.actor}#${type.toLowerCase()}-${serial}`;
+      const act = { id, type, actor: this.urls.actor, published: at, ...extra };
+      agent.publisher.recordOwn?.(act);
+      return act.id;
+    };
     const object = typeof activity.object === 'object' && activity.object !== null
       ? activity.object : null;
     const objectId = idOf(activity.object);
@@ -411,6 +446,7 @@ export class C2S {
               visibility,
               spoilerText: object.summary || null,
               sensitive: object.sensitive === true,
+              slug,
             });
             return reply(201,
               { id: wire.createActivityId(question.id), object: question.id },
@@ -445,19 +481,32 @@ export class C2S {
         if (s.actor !== this.urls.actor || s.kind !== 'post') {
           return reply(403, { error: 'not your note' });
         }
-        const text = String(object?.source?.content ?? object?.content ?? '');
-        if (!text.trim()) return reply(422, { error: 'the edit has no content' });
-        const attachments = object?.attachment !== undefined
+        // §6.3: a client's Update changes only what it sends, and a field sent
+        // as null is removed. What was sent is read from the bytes, because a
+        // JSON-LD reading drops the nulls that mean "remove this".
+        const sent = raw?.type === 'Update' && raw.object && typeof raw.object === 'object' ? raw.object : (object || {});
+        const has = (k) => Object.prototype.hasOwnProperty.call(sent, k);
+        const stored = await Promise.resolve().then(() => podNotes.read(agent.remote, s.noteId)).catch(() => null);
+        if (stored?.type && stored.type !== 'Note') {
+          await agent.publisher.updateObject(s, sent, { updated: at });
+          return made(wire.updateActivityId(s.noteId, at), { object: s.noteId });
+        }
+        const text = has('content') || sent.source?.content !== undefined
+          ? String(object?.source?.content ?? object?.content ?? '') : String(s.text ?? '');
+        if (!text.trim()) return reply(422, { error: 'the edit leaves the note with no content' });
+        const attachments = has('attachment')
           ? arr(object.attachment).map((a) => ({
             url: a?.url, mediaType: a?.mediaType,
             ...(a?.name ? { description: a.name } : {}),
           })).filter((a) => a.url)
           : null;
         await agent.publisher.updateNote(s, {
-          content: text, spoilerText: object?.summary || null,
-          sensitive: object?.sensitive === undefined ? null : object.sensitive === true, attachments,
+          content: text,
+          spoilerText: has('summary') ? (object?.summary || null) : (s.spoiler || null),
+          sensitive: has('sensitive') ? object?.sensitive === true : null, attachments,
+          updated: at,
         });
-        return reply(200, { ok: true, object: s.noteId });
+        return made(wire.updateActivityId(s.noteId, at), { object: s.noteId });
       }
 
       case 'Delete': {
@@ -471,7 +520,7 @@ export class C2S {
         }
         const r = await social.deleteNote(agent, s);
         if (!r.ok) return reply(502, { error: r.error, stillPublished: r.stillPublished });
-        return reply(200, { ok: true });
+        return made(wire.deleteActivityId(s.noteId), { object: s.noteId });
       }
 
       case 'Follow': {
@@ -479,31 +528,27 @@ export class C2S {
         // An acct: form or bare handle resolves through WebFinger; an https
         // IRI is fetched directly.
         if (/^acct:|^@|^[^/@]+@[^/@]+$/.test(objectId) && !/^https?:/.test(objectId)) {
-          const r = await social.followHandle(agent, objectId.replace(/^acct:/, ''));
+          const r = await social.followHandle(agent, objectId.replace(/^acct:/, ''), { serial });
           const rec = this.store.getContacts().following.find((f) => f.actor === r.actor);
-          return reply(201, { id: rec?.followActivity?.id, object: r.actor },
-            rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
+          return made(rec?.followActivity?.id, { object: r.actor });
         }
-        const doc = await social.followActor(agent, objectId);
+        const doc = await social.followActor(agent, objectId, { serial });
         const rec = this.store.getContacts().following.find((f) => f.actor === doc.id);
-        return reply(201, { id: rec?.followActivity?.id, object: doc.id },
-          rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
+        return made(rec?.followActivity?.id, { object: doc.id });
       }
 
       case 'Like': {
         const s = this.byIri(objectId);
         if (!s) return reply(422, { error: 'that note is not held here — like what the timeline holds' });
-        const updated = await social.favourite(agent, s);
-        return reply(201, { id: updated.likeActivity?.id, object: s.noteId },
-          updated.likeActivity?.id ? { location: updated.likeActivity.id } : {});
+        const updated = await social.favourite(agent, s, { serial });
+        return made(updated.likeActivity?.id, { object: s.noteId });
       }
 
       case 'Announce': {
         const s = this.byIri(objectId);
         if (!s) return reply(422, { error: 'that note is not held here — boost what the timeline holds' });
-        const updated = await social.reblog(agent, s);
-        return reply(201, { id: updated.announceActivity?.id, object: s.noteId },
-          updated.announceActivity?.id ? { location: updated.announceActivity.id } : {});
+        const updated = await social.reblog(agent, s, { serial });
+        return made(updated.announceActivity?.id, { object: s.noteId });
       }
 
       case 'Undo': {
@@ -511,39 +556,47 @@ export class C2S {
         // sends one, by its type+object when it re-states it instead.
         const inner = object;
         const innerId = idOf(activity.object);
+        const undone = wire.undoActivityId(this.urls, serial);
         if (inner?.type === 'Block') {
           const target = idOf(inner.object);
           if (!target) return reply(400, { error: 'unblock whom?' });
-          await social.unblockActor(agent, target);
-          return reply(200, { ok: true, object: target });
+          await social.unblockActor(agent, target, { serial });
+          // A group's unban was sent, and recorded as it went; a person's is not.
+          if (this.store.getConfig()?.kind !== 'group') {
+            kept('Undo', { object: { type: 'Block', actor: this.urls.actor, object: target } });
+          }
+          return made(undone, { object: target });
         }
         const statuses = this.store.getStatuses();
         let s = innerId ? statuses.find((x) => x.likeActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Like') s = this.byIri(idOf(inner.object));
         if (s?.favourited) {
-          const updated = await social.unfavourite(agent, s);
-          return reply(200, { ok: true, object: updated.noteId });
+          const updated = await social.unfavourite(agent, s, { serial });
+          return made(undone, { object: updated.noteId });
         }
         s = innerId ? statuses.find((x) => x.announceActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Announce') s = this.byIri(idOf(inner.object));
         if (s?.reblogged) {
-          const updated = await social.unreblog(agent, s);
-          return reply(200, { ok: true, object: updated.noteId });
+          const updated = await social.unreblog(agent, s, { serial });
+          return made(undone, { object: updated.noteId });
         }
         const following = this.store.getContacts().following;
         const rec = following.find((f) => f.followActivity?.id === innerId)
           || (inner?.type === 'Follow' ? following.find((f) => f.actor === idOf(inner.object)) : null);
         if (rec) {
-          await social.unfollowActor(agent, rec.actor);
-          return reply(200, { ok: true, object: rec.actor });
+          await social.unfollowActor(agent, rec.actor, { serial });
+          return made(undone, { object: rec.actor });
         }
         return reply(422, { error: 'nothing here matches what that Undo names' });
       }
 
       case 'Block': {
         if (!objectId) return reply(400, { error: 'block whom? object must name an actor' });
-        await social.blockActor(agent, objectId);
-        return reply(200, { ok: true, object: objectId });
+        await social.blockActor(agent, objectId, { serial });
+        // A group's ban was sent to its members; a person's never goes anywhere.
+        const id = this.store.getConfig()?.kind === 'group'
+          ? `${this.urls.actor}#block-${serial}` : kept('Block', { object: objectId });
+        return made(id, { object: objectId });
       }
 
       case 'Add':
@@ -556,7 +609,8 @@ export class C2S {
         const s = this.byIri(objectId);
         if (!s) return reply(404, { error: 'no such note here' });
         const updated = await social.pinStatus(agent, s, activity.type === 'Add');
-        return reply(200, { ok: true, object: updated.noteId, pinned: !!updated.pinned });
+        return made(kept(activity.type, { object: updated.noteId, target: this.urls.featured }),
+          { object: updated.noteId, pinned: !!updated.pinned });
       }
 
       case 'Accept':
@@ -566,10 +620,10 @@ export class C2S {
         const requester = object?.actor ? idOf(object.actor) : objectId;
         if (!requester) return reply(400, { error: 'whose request? object must name the Follow or its actor' });
         const r = activity.type === 'Accept'
-          ? await social.admitRequest(agent, requester).catch((e) => ({ error: e.message }))
-          : await social.refuseRequest(agent, requester).catch((e) => ({ error: e.message }));
+          ? await social.admitRequest(agent, requester, { serial }).catch((e) => ({ error: e.message }))
+          : await social.refuseRequest(agent, requester, { serial }).catch((e) => ({ error: e.message }));
         if (r.error) return reply(404, { error: r.error });
-        return reply(200, { ok: true, object: requester });
+        return made(`${this.urls.actor}#${activity.type.toLowerCase()}-${serial}`, { object: requester });
       }
 
       case 'Move':

package/lib/client/masto/accounts.mjs

@@ -255,6 +255,7 @@ export async function handle(api, ctx) {
     if (req.method === 'POST' && !b.domains.includes(domain)) b.domains.push(domain);
     if (req.method === 'DELETE') b.domains = b.domains.filter(d => d !== domain);
     api.store.setBlocklist(b);
+    Promise.resolve(api.agent?.publisher?.publishCollections?.({ blocked: true })).catch(() => {});
     return send(200, {});
   }
 

package/lib/connections/bskyfeed.mjs

@@ -166,6 +166,10 @@ export class BskyFeed {
     this.lastSweep = new Date().toISOString();
     const self = this.atproto.read()?.did;
     let added = 0;
+    // One commit boundary for the sweep, as acctfeed and tagfeed: every item
+    // awaits Bluesky before the next, so the debounce never coalesced them and
+    // the timeline index went to the pod once per notification.
+    this.store.hold?.();
     try {
       // Our own CROSS-POSTS must not echo back into the feed — but a post or
       // reply written natively on Bluesky is ours to see here too. The mirrors
@@ -224,6 +228,8 @@ export class BskyFeed {
     } catch (e) {
       this._backOff(e.status || 0, null);
       return;
+    } finally {
+      this.store.release?.();
     }
     const all = this.store.getStatuses();
     const mirrored = all.filter(s => s.kind === 'bsky');

package/lib/core/deliver.mjs

@@ -73,6 +73,10 @@ export class Deliverer {
     this.edPrivate = edPrivate;
     this.proofKeyId = proofKeyId;
     this.log = log;
+    // How many fresh deliveries one attempt may carry. The Node deliverer
+    // opens a socket per recipient; the browser's relay deliverer sends a
+    // list, and sets this to what the relay accepts.
+    this.batchSize = 1;
     if (!passive) this.startQueue();
   }
 
@@ -171,33 +175,65 @@ export class Deliverer {
     }
   }
 
+  // One attempt per target, answered in order: `{ ok: true }` or `{ error }`
+  // with the error deliverNow would have thrown. Here one at a time; the
+  // relay deliverer sends the whole list in one call.
+  async deliverManyNow(targets) {
+    const out = [];
+    for (const t of targets) {
+      try { await this.deliverNow(t.inbox, t.activity); out.push({ ok: true }); }
+      catch (error) { out.push({ error }); }
+    }
+    return out;
+  }
+
+  // A fresh activity of this actor's, for the outbox its owner reads. Never
+  // allowed to stop a delivery; a retry from the queue is not fresh.
+  _sent(activity) {
+    try { this.onSent?.(activity); } catch (e) { this.log(`owner's outbox record: ${e.message}`); }
+  }
+
+  // An inbox on a blocked domain is never delivered to, whoever still lists it.
+  _blockedInbox(inbox) {
+    try { return !!this.store.getBlocklist?.().domains.length && this.store.isBlocked?.(new URL(inbox).origin + '/'); }
+    catch { return false; }
+  }
+
   async deliver(inbox, activity) {
+    this._sent(activity);
+    if (this._blockedInbox(inbox)) return;
     // Proved before anything else, so the copy that goes on the queue is the
     // copy that was signed — a retry days later must not post a bare activity.
     const signed = await this.proofed(activity);
-    // A host we already know is refusing: queue without asking again. This is
-    // the path a FRESH activity takes, so without it a fan-out to a struggling
-    // server opened one socket per follower before any of this applied.
+    if (this._queueIfCooling(inbox, signed)) return;
+    const [result] = await this.deliverManyNow([{ inbox, activity: signed }]);
+    await this._settle(inbox, signed, result);
+  }
+
+  // A host we already know is refusing: queue without asking again. This is
+  // the path a FRESH activity takes, so without it a fan-out to a struggling
+  // server opened one socket per follower before any of this applied.
+  _queueIfCooling(inbox, signed) {
     const host = hostOf(inbox);
     const until = this._cooling?.get(host);
-    if (until && until > Date.now()) {
-      this.log(`${host} is cooling — queueing ${signed.type} rather than asking again`);
-      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: until });
-      return;
-    }
-    try {
-      await this.deliverNow(inbox, signed);
-      this.log(`delivered ${signed.type} → ${inbox}`);
-    } catch (e) {
-      if (unsalvageable(e)) { await this._unsalvageable(inbox, e); return; }
-      this.log(`delivery failed (${e.message}) — queued`);
-      const wait = e.retryAfterMs || 60_000;
-      if (aboutTheHost(e)) {
-        this._cooling ||= new Map();
-        this._cooling.set(host, Date.now() + wait);
-      }
-      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: Date.now() + wait });
+    if (!until || until <= Date.now()) return false;
+    this.log(`${host} is cooling — queueing ${signed.type} rather than asking again`);
+    this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: until });
+    return true;
+  }
+
+  // What one attempt's outcome means for the queue.
+  async _settle(inbox, signed, result) {
+    if (result.ok) { this.log(`delivered ${signed.type} → ${inbox}`); return; }
+    const e = result.error;
+    if (unsalvageable(e)) { await this._unsalvageable(inbox, e); return; }
+    this.log(`delivery failed (${e.message}) — queued`);
+    const wait = e.retryAfterMs || 60_000;
+    if (aboutTheHost(e)) {
+      this._cooling ||= new Map();
+      this._cooling.set(hostOf(inbox), Date.now() + wait);
     }
+    this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: Date.now() + wait });
   }
 
   // Not retried, and on a 410 the followers who received there are dropped,
@@ -228,11 +264,21 @@ export class Deliverer {
   }
 
   async deliverToAll(inboxes, activity) {
+    this._sent(activity);
     // Proved once for the whole fan-out: every recipient gets the same bytes,
     // and one signature is computed rather than one per follower.
     const signed = await this.proofed(activity);
-    // Shared inboxes deduplicate fan-out to the same server.
-    for (const inbox of [...new Set(inboxes)]) await this.deliver(inbox, signed);
+    // Shared inboxes deduplicate fan-out to the same server. Sent in batches
+    // of batchSize, and a host found cooling by one batch is not asked again
+    // by the next.
+    const targets = [...new Set(inboxes)].filter((inbox) => !this._blockedInbox(inbox))
+      .map((inbox) => ({ inbox, activity: signed }));
+    for (let i = 0; i < targets.length; i += this.batchSize) {
+      const chunk = targets.slice(i, i + this.batchSize).filter((t) => !this._queueIfCooling(t.inbox, signed));
+      if (!chunk.length) continue;
+      const results = await this.deliverManyNow(chunk);
+      for (let k = 0; k < chunk.length; k++) await this._settle(chunk[k].inbox, signed, results[k]);
+    }
   }
 
   // Serialized, for the same reason Intake.drain is: the tick is 60s and a

package/lib/core/intake/activities.mjs

@@ -5,6 +5,9 @@
 import { dropFollower } from '../store.mjs';
 import { emojisOf, pollOf, isContentType, trimActivity, reactionOf, quoteOf, quotePolicyOf, authorOf } from './activity.mjs';
 
+// How long a follower's refollow waits before it is answered again.
+const REACCEPT_MS = 60 * 60 * 1000;
+
 const idOf = (v) => (typeof v === 'string' ? v : v?.id);
 
 // §7.6 Add / §7.9 Remove. The side effect would be to add or remove the object
@@ -98,6 +101,18 @@ export async function onFollow(intake, activity, actor, { trusted = false } = {}
     await intake.republish({ followers: true });
     intake.log(`new follower: ${actor}`);
   }
+  // A refollow from someone already following is answered again — their server
+  // may have lost our Accept — but not every time: the same Follow sent over and
+  // over would otherwise make us send, and record, an Accept for each one.
+  if (existing) {
+    const c = intake.store.getContacts();
+    const f = c.followers.find(x => x.actor === actor);
+    if (f?.acceptedAt && Date.now() - Date.parse(f.acceptedAt) < REACCEPT_MS) {
+      intake.log(`refollow from ${actor} — already accepted within the hour, not answered again`);
+      return;
+    }
+    if (f) { f.acceptedAt = new Date().toISOString(); intake.store.setContacts(c); }
+  }
   const { acceptActivity } = await import('../wire.mjs');
   await intake.deliverer.deliver(doc.inbox,
     acceptActivity({ urls: intake.urls, followActivity: activity, serial: intake.serial++ }));
@@ -370,8 +385,9 @@ export async function onDelete(intake, activity, actor) {
       await intake.forget(s, { collect: retracted });
     }
     if (retracted.length) {
-      const gone = new Set(retracted);
-      await intake.publisher.unrecordOutbox(i => gone.has(i?.id));
+      const gone = new Set(retracted.map(u => u.object.id));
+      await intake.publisher.unrecordOutbox(i => gone.has(i?.id),
+        { record: (was) => (intake.config.private ? null : retracted.filter(u => was.includes(u.object.id))) });
     }
     // Both: an account deletion drops them from followers AND following.
     await intake.republish({ followers: true, following: true });

package/lib/core/intake/group.mjs

@@ -175,7 +175,9 @@ export async function amplify(intake, noteId, { approved = false, activity = nul
   // Marked carried before recorded: a failed outbox write costs one missing
   // entry, a failed status write would carry the same post twice.
   intake.store.updateStatus(noteId, { announcedAt: new Date().toISOString(), announceActivity: act });
-  await intake.publisher.recordOutbox(act);
+  // A private group's carries are written for its members alone, so they go on
+  // its owner's full outbox (recorded as sent) and never on the public one.
+  if (!intake.config.private) await intake.publisher.recordOutbox(act);
   intake.store.setPending(intake.store.getPending().filter(p => p.noteId !== noteId));
   intake.log(`amplified ${noteId} → ${inboxes.length} inbox(es)`);
   // What the group carried is what the group's conversation holds. A forum

package/lib/core/intake/index.mjs

@@ -51,6 +51,7 @@ const CHAIN_GAP_MS = 5_000;      // pause between chained backlog sweeps
 // enough that a crash re-does little, large enough that a flood of fast
 // rejections does not become a pod write per item.
 const DELETE_BATCH = 10;
+const ORPHAN_RECEIPTS_PER_SWEEP = 20;   // strays from before receipts were deleted with their items
 // Attempt counts live in pod state, not in memory: a restart used to hand every
 // poison item five fresh tries, and under a crash loop that is unbounded.
 const ATTEMPTS_DOC = 'intake-attempts.json';
@@ -359,6 +360,7 @@ export class Intake {
     // deadletter.json where one would do, and a flood is exactly when the pod
     // should be asked for less rather than more.
     const pending = [];
+    const withReceipt = new Set();   // items the listing showed a receipt beside
     const flush = async () => {
       if (!pending.length) return true;
       // Written down before any of them leaves the mailbox. A failure here
@@ -379,13 +381,17 @@ export class Intake {
         }
         this._clearAttempt(url);
         handled++;
+        // Its receipt goes with it. Left beside a deleted item, a receipt
+        // was one stray document per delivery, forever.
+        if (withReceipt.has(url)) await podInbox.dropReceiptBeside(this.remote, url);
         await new Promise(r => setTimeout(r, DELETE_GAP_MS));
       }
       return true;
     };
 
-    for (const { url, size } of items) {
+    for (const { url, size, receipt: hasReceipt } of items) {
       if (url.endsWith('.keep')) continue;
+      if (hasReceipt) withReceipt.add(url);
       // The listing already carries every child's size, so this costs nothing
       // to ask. An activity is a few kB; anything of this order is not one, and
       // reading it with an unbounded res.text() buffers whatever a stranger
@@ -430,9 +436,11 @@ export class Intake {
         }
         // A gateway that verified this delivery left a receipt beside it. Read
         // it only when a gateway is configured (no config → no fetch, so an
-        // install with no gateway pays nothing); a missing or HMAC-invalid
-        // receipt reads as null, which is exactly today's unverified behavior.
-        const receipt = activity ? await this._readReceipt(url) : null;
+        // install with no gateway pays nothing) and the listing showed one
+        // beside this item (`false` is a definite no; a listing that does not
+        // say leaves it to the read); a missing or HMAC-invalid receipt reads
+        // as null, which is exactly today's unverified behavior.
+        const receipt = activity && hasReceipt !== false ? await this._readReceipt(url) : null;
         if (activity && this.gatewaySecret()) this._bumpGatewayStat(!!receipt?.verified);
         // The owner's own post, taken at the outbox door: not mail to read
         // but a write to make. Never archived or forwarded as if received.
@@ -464,6 +472,11 @@ export class Intake {
       if (pending.length >= DELETE_BATCH && !await flush()) return;
     }
     if (!await this._finishSweep(flush)) return;
+    // Receipts earlier drains left behind, a few per sweep until none remain.
+    for (const stray of podInbox.orphanReceipts(this.remote, this.urls).slice(0, ORPHAN_RECEIPTS_PER_SWEEP)) {
+      if (!await podInbox.dropStrayReceipt(this.remote, stray)) break;
+      await new Promise(r => setTimeout(r, DELETE_GAP_MS));
+    }
     // Made progress and there is more waiting: go straight round rather than
     // sleeping. Gated on progress so a sweep that achieved nothing — a
     // cooldown, an unwritable store, poison at the head — cannot spin.
@@ -643,10 +656,33 @@ export class Intake {
   // document, not our reading of it); the graph is what it decides from.
   // Returns null when published, else the reason it was not — a dead letter.
   async ownerPostFrom(activity, raw, receipt) {
+    // The receipt names the body it vouches for; a body it does not name is
+    // not the owner's. A body already handled — a replayed request, or an item
+    // the pod would not let us delete — is not published twice.
+    const hash = raw ? await sha256Hex(raw) : null;
+    if (receipt.hash && receipt.hash !== hash) return 'owner post refused: the body is not the one its receipt names';
+    const seen = this.store.read('c2s-seen.json', []);
+    if (hash && seen.includes(hash)) {
+      this.log('owner post already handled — not published again');
+      return null;
+    }
     let asSent = null;
     try { asSent = raw ? JSON.parse(raw) : null; } catch { asSent = null; }
-    const r = await this.ownerPost(activity, { raw: asSent, slug: receipt.slug || null });
-    if (!r || r.status >= 300) return `owner post refused (${r?.status || '?'}): ${r?.body?.error || ''}`;
+    const r = await this.ownerPost(activity, { raw: asSent, slug: receipt.slug || null,
+      // What the door told the client this will be called, when it said.
+      ...(receipt.serial ? { serial: receipt.serial } : {}), ...(receipt.at ? { at: receipt.at } : {}) });
+    // Handled, one way or the other: a second sight of it changes nothing. A
+    // throw above is not handled, and is tried again.
+    if (hash) this.store.write('c2s-seen.json', [hash, ...this.store.read('c2s-seen.json', [])].slice(0, C2S_SEEN_MAX));
+    if (!r || r.status >= 300) {
+      const why = r?.body?.error || 'no reason was given';
+      // The door already answered the app "created"; the owner is the one
+      // left to tell.
+      await this.publisher.noteToSelf?.(`An app asked your account to publish ${article(activity.type)}, `
+        + `and your account refused it: ${why}. Nothing was sent.`)
+        .catch(e => this.log(`could not tell the owner their post was refused: ${e.message}`));
+      return `owner post refused (${r?.status || '?'}): ${why}`;
+    }
     this.log(`owner post from the outbox door published: ${r.body?.object || r.body?.id || activity.type}`);
     return null;
   }
@@ -686,3 +722,11 @@ export class Intake {
   retract(...a) { return notes.retract(this, ...a); }
   addReply(...a) { return notes.addReply(this, ...a); }
 }
+
+// "a Like", "an Update": the kind of activity, as a sentence says it.
+const article = (type) => `${/^[AEIOU]/u.test(String(type)) ? 'an' : 'a'} ${type || 'post'}`;
+
+// Bodies the outbox door handed over that were handled, newest first.
+const C2S_SEEN_MAX = 500;
+const sha256Hex = async (text) => [...new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256',
+  new TextEncoder().encode(text)))].map(b => b.toString(16).padStart(2, '0')).join('');

package/lib/core/intake/notes.mjs

@@ -91,7 +91,11 @@ export async function maybeForward(intake, activity) {
       .filter(Boolean))];
     if (!inboxes.length) return;
     intake._forwardBudget -= 1;
-    await intake.deliverer.deliverToAll(inboxes, activity);
+    // Blind copies are for their sender's delivery alone and never travel on
+    // (§6, §7.1), from the activity or its object.
+    const strip = (o) => { if (!o || typeof o !== 'object') return o; const { bto, bcc, ...rest } = o; return rest; };   // eslint-disable-line no-unused-vars
+    const onward = { ...strip(activity), ...(activity.object && typeof activity.object === 'object' ? { object: strip(activity.object) } : {}) };
+    await intake.deliverer.deliverToAll(inboxes, onward);
     intake.store.write('forwarded.json', [...forwarded, id].slice(-MAX_FORWARDED));
     intake.log(`forwarded ${activity.type} ${id} to ${inboxes.length} follower inbox(es)`);
   } catch (e) {
@@ -319,10 +323,13 @@ export async function retract(intake, noteId, { collect = null } = {}) {
   if (!s.announceActivity) throw new Error('that post was never carried');
   const { undoActivity } = await import('../wire.mjs');
   const inboxes = intake.announceTargets(s.actor);
-  await intake.deliverer.deliverToAll(inboxes,
-    undoActivity({ urls: intake.urls, activity: s.announceActivity, serial: intake.serial++ }));
-  if (collect) collect.push(s.announceActivity.id);
-  else await intake.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id);
+  const undo = undoActivity({ urls: intake.urls, activity: s.announceActivity, serial: intake.serial++ });
+  await intake.deliverer.deliverToAll(inboxes, undo);
+  // The Undo takes the carry's place in the outbox, so a reader catching up
+  // from it learns the carry was withdrawn.
+  if (collect) collect.push(undo);
+  else await intake.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id,
+    { record: () => (intake.config.private ? null : undo) });
   intake.store.updateStatus(noteId, {
     announcedAt: undefined, announceActivity: undefined, retractedAt: new Date().toISOString(),
   });