fedipod-server 0.28.0 → 0.29.0

package/lib/core/social.mjs

@@ -126,7 +126,7 @@ async function cacheCounts(agent, doc) {
 
 // `doc` skips the fetch when the caller already resolved the actor; a bulk
 // import passes publish:false and republishes the collections once at the end.
-export async function followActor(agent, actorUrl, { publish = true, doc: fetched = null } = {}) {
+export async function followActor(agent, actorUrl, { publish = true, doc: fetched = null, serial = Date.now() } = {}) {
   const doc = fetched || await agent.intake.fetchAP(actorUrl);
   if (!doc?.inbox) throw new Error(`actor document unusable (${actorUrl})`);
   if (agent.store.isBlocked(doc.id)) throw new Error('actor is blocked');
@@ -136,7 +136,7 @@ export async function followActor(agent, actorUrl, { publish = true, doc: fetche
     rec = { actor: doc.id, inbox: doc.inbox, accepted: false };
     contacts.following.push(rec);
   }
-  const follow = wire.followActivity({ urls: agent.publisher.urls, targetActor: doc.id, serial: Date.now() });
+  const follow = wire.followActivity({ urls: agent.publisher.urls, targetActor: doc.id, serial });
   rec.followActivity = follow;               // kept for a later Undo
   agent.store.setContacts(contacts);
   await agent.deliverer.deliver(doc.inbox, follow);
@@ -144,9 +144,9 @@ export async function followActor(agent, actorUrl, { publish = true, doc: fetche
   return doc;
 }
 
-export async function followHandle(agent, handle) {
+export async function followHandle(agent, handle, { serial = Date.now() } = {}) {
   const doc = await resolveHandle(agent, handle);
-  await followActor(agent, doc.id);
+  await followActor(agent, doc.id, { serial });
   const clean = String(handle || '').replace(/^@/, '');
   const contacts = agent.store.getContacts();
   const rec = contacts.following.find(f => f.actor === doc.id);
@@ -154,13 +154,13 @@ export async function followHandle(agent, handle) {
   return { ok: true, actor: doc.id };
 }
 
-export async function unfollowActor(agent, actor) {
+export async function unfollowActor(agent, actor, { serial = Date.now() } = {}) {
   const contacts = agent.store.getContacts();
   const rec = contacts.following.find(f => f.actor === actor);
   if (!rec) throw new Error('not following that actor');
   if (rec.followActivity) {
     await agent.deliverer.deliver(rec.inbox,
-      wire.undoActivity({ urls: agent.publisher.urls, activity: rec.followActivity, serial: Date.now() }));
+      wire.undoActivity({ urls: agent.publisher.urls, activity: rec.followActivity, serial }));
   }
   contacts.following = contacts.following.filter(f => f.actor !== actor);
   agent.store.setContacts(contacts);
@@ -168,31 +168,31 @@ export async function unfollowActor(agent, actor) {
   return { ok: true };
 }
 
-export async function favourite(agent, s) {
+export async function favourite(agent, s, { serial = Date.now() } = {}) {
   if (s.favourited) return s;
   const doc = await agent.intake.fetchAP(s.actor);
   if (!doc?.inbox) throw new Error('author inbox unavailable');
-  const act = wire.likeActivity({ urls: agent.publisher.urls, noteId: s.noteId, serial: Date.now() });
+  const act = wire.likeActivity({ urls: agent.publisher.urls, noteId: s.noteId, serial, to: s.actor });
   await agent.deliverer.deliver(doc.endpoints?.sharedInbox || doc.inbox, act);
   return agent.store.updateStatus(s.noteId, { favourited: true, likeActivity: act });
 }
 
-export async function unfavourite(agent, s) {
+export async function unfavourite(agent, s, { serial = Date.now() } = {}) {
   if (s.likeActivity) {
     const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
     if (doc?.inbox) {
       await agent.deliverer.deliver(doc.endpoints?.sharedInbox || doc.inbox,
-        wire.undoActivity({ urls: agent.publisher.urls, activity: s.likeActivity, serial: Date.now() }));
+        wire.undoActivity({ urls: agent.publisher.urls, activity: s.likeActivity, serial }));
     }
   }
   return agent.store.updateStatus(s.noteId, { favourited: false, likeActivity: undefined });
 }
 
 // Announce goes to our followers (that's what boosting is) and to the author.
-export async function reblog(agent, s) {
+export async function reblog(agent, s, { serial = Date.now() } = {}) {
   if (s.reblogged) return s;
   const { urls } = agent.publisher;
-  const act = wire.announceActivity({ urls, object: s.noteId, serial: Date.now() });
+  const act = wire.announceActivity({ urls, object: s.noteId, serial });
   const inboxes = new Set(agent.store.getContacts().followers
     .map(f => f.sharedInbox || f.inbox).filter(Boolean));
   if (s.actor !== urls.actor) {
@@ -208,15 +208,15 @@ export async function reblog(agent, s) {
   return updated;
 }
 
-export async function unreblog(agent, s) {
+export async function unreblog(agent, s, { serial = Date.now() } = {}) {
   if (s.announceActivity) {
-    const undo = wire.undoActivity({ urls: agent.publisher.urls, activity: s.announceActivity, serial: Date.now() });
+    const undo = wire.undoActivity({ urls: agent.publisher.urls, activity: s.announceActivity, serial });
     const inboxes = new Set(agent.store.getContacts().followers
       .map(f => f.sharedInbox || f.inbox).filter(Boolean));
     const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
     if (doc?.inbox && s.actor !== agent.publisher.urls.actor) inboxes.add(doc.endpoints?.sharedInbox || doc.inbox);
     await agent.deliverer.deliverToAll([...inboxes], undo);
-    await agent.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id);
+    await agent.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id, { record: () => undo });
   }
   return agent.store.updateStatus(s.noteId, { reblogged: false, announceActivity: undefined });
 }
@@ -260,7 +260,7 @@ export async function ejectFollower(agent, actor) {
 
 // Group: answer a held join request. Admitting is the Accept onFollow would
 // have sent immediately had the group not been gated.
-export async function admitRequest(agent, actor, { publish = true } = {}) {
+export async function admitRequest(agent, actor, { publish = true, serial = Date.now() } = {}) {
   const reqs = agent.store.getRequests();
   const req = reqs.find(r => r.actor === actor);
   if (!req) throw new Error('no such request');
@@ -286,14 +286,14 @@ export async function admitRequest(agent, actor, { publish = true } = {}) {
   // A bulk admit passes publish:false and republishes once for the lot.
   if (publish) await agent.publisher.publishCollections({ followers: true, pending: true });
   await agent.deliverer.deliver(req.inbox, wire.acceptActivity({
-    urls: agent.publisher.urls, followActivity: req.activity, serial: Date.now(),
+    urls: agent.publisher.urls, followActivity: req.activity, serial,
   }));
   return { ok: true, actor };
 }
 
 // Refusing is not a ban: they may ask again, and the queue is where you would
 // see that. Eject is the sticky one, because it mutes.
-export async function refuseRequest(agent, actor) {
+export async function refuseRequest(agent, actor, { serial = Date.now() } = {}) {
   const reqs = agent.store.getRequests();
   const req = reqs.find(r => r.actor === actor);
   if (!req) throw new Error('no such request');
@@ -307,7 +307,7 @@ export async function refuseRequest(agent, actor) {
     return { ok: true, actor };
   }
   await agent.deliverer.deliver(req.inbox, wire.rejectActivity({
-    urls: agent.publisher.urls, followActivity: req.activity, serial: Date.now(),
+    urls: agent.publisher.urls, followActivity: req.activity, serial,
   }));
   return { ok: true, actor };
 }
@@ -375,9 +375,21 @@ export async function votePoll(agent, s, choices) {
 
 export async function deleteNote(agent, s) {
   const { urls } = agent.publisher;
-  const inboxes = agent.store.getContacts().followers
-    .map(f => f.sharedInbox || f.inbox).filter(Boolean);
-  await agent.deliverer.deliverToAll(inboxes, wire.deleteActivity({ urls, noteId: s.noteId }));
+  // The deletion goes where the post went: followers unless it was direct, and
+  // everyone it named or was blind-copied to. Addressed as the post was, read
+  // from the post itself while it is still there.
+  const doc = await Promise.resolve().then(() => podNotes.read(agent.remote, s.noteId)).catch(() => null);
+  const shape = wire.addressing(urls, s.visibility || 'public', (s.mentions || []).map(m => m.href).filter(Boolean));
+  const to = Array.isArray(doc?.to) ? doc.to : shape.to;
+  const cc = Array.isArray(doc?.cc) ? doc.cc : shape.cc;
+  const named = [...to, ...cc, ...(s.addressed || []), ...(s.replyActor ? [s.replyActor] : [])]
+    .filter(a => typeof a === 'string' && a !== wire.PUBLIC && a !== urls.followers && a !== urls.actor);
+  const inboxes = [
+    ...(s.visibility === 'direct' ? [] : agent.store.getContacts().followers.map(f => f.sharedInbox || f.inbox)),
+    ...(agent.publisher.inboxesFor ? await agent.publisher.inboxesFor(named).catch(() => []) : []),
+  ].filter(Boolean);
+  const del = wire.deleteActivity({ urls, noteId: s.noteId, to, cc });
+  await agent.deliverer.deliverToAll(inboxes, del);
 
   // The note is REPLACED with a Tombstone rather than removed, so a peer that
   // dereferences it learns the post was deleted instead of a bare 404 (§7.4).
@@ -386,12 +398,23 @@ export async function deleteNote(agent, s) {
   // not the object, so it is deleted outright.
   const stuck = [];
   const deletedAt = new Date().toISOString();
+  // Only inside the posts folders: an object that lives elsewhere on the pod
+  // (an annotation a client keeps in its own place, or anything it named) is
+  // that client's document, and a deletion here must not overwrite it — the
+  // profile, say — with a Tombstone. Its Create and outbox entry still go.
+  const ours = [urls.notes, urls.privateNotes].some(c => String(s.noteId).startsWith(c));
   try {
-    await podNotes.writeTombstone(agent.remote, s.noteId, wire.noteTombstone(s.noteId, deletedAt));
+    if (ours) await podNotes.writeTombstone(agent.remote, s.noteId, wire.noteTombstone(s.noteId, deletedAt));
   } catch { stuck.push(s.noteId); }
-  if (!await podNotes.dropCreate(agent.remote, wire.createActivityId(s.noteId))) {
-    stuck.push(wire.createActivityId(s.noteId));
-  }
+  // The Create becomes a Tombstone too, not a gap: it embedded the post, so
+  // its words go, and whoever asks for it is told it is gone (410 through the
+  // Gateway) rather than that it never was.
+  // An object kept outside the posts folders has its Create inside them, under
+  // the name it was given (publishObject).
+  const createId = ours ? wire.createActivityId(s.noteId) : (s.slug ? wire.createActivityId(urls.notes + s.slug) : null);
+  try {
+    if (createId) await podNotes.writeTombstone(agent.remote, createId, wire.noteTombstone(createId, deletedAt, 'Create'));
+  } catch { stuck.push(createId); }
   if (stuck.length) {
     agent.log?.(`delete ${s.noteId}: the pod kept ${stuck.length} document(s) — the post is STILL PUBLISHED`);
     return {
@@ -410,8 +433,15 @@ export async function deleteNote(agent, s) {
       .catch(e => agent.log?.(`bluesky mirror not deleted (${e.message}): ${s.atproto.uri}`));
   }
 
-  // The note's outbox entry, and our own boost of it if there was one.
-  await agent.publisher.unrecordOutbox(i => i === s.noteId || (i?.id && i.id === s.announceActivity?.id));
+  // The note's outbox entry, and our own boost of it if there was one. The
+  // Delete takes the post's place — only for a post the outbox listed, so a
+  // private post's deletion stays as private as the post was.
+  const itsOwn = (i) => i === s.noteId || (i?.id && i.id === s.announceActivity?.id)
+    // its edits too: an Update carries the post's words, which must not
+    // outlive the post on the public record
+    || (i?.type === 'Update' && (typeof i.object === 'string' ? i.object : i.object?.id) === s.noteId);
+  await agent.publisher.unrecordOutbox(itsOwn,
+    { record: (gone) => (gone.includes(s.noteId) ? del : null) });
   agent.store.removeStatus(s.noteId);
   return { ok: true };
 }
@@ -436,7 +466,7 @@ export async function announceModeration(agent, activity) {
 // nothing is delivered TO THE BLOCKED PARTY (§6.10). Intake already refuses a
 // blocked author on arrival. A group additionally announces the ban to its
 // members (FEP-1b12) — announceModeration keeps a person's blocks silent.
-export async function blockActor(agent, actorUrl) {
+export async function blockActor(agent, actorUrl, { serial = Date.now() } = {}) {
   if (!/^https?:\/\/\S+$/.test(String(actorUrl || ''))) throw new Error('actor must be a URL');
   const b = agent.store.getBlocklist();
   if (!b.actors.includes(actorUrl)) b.actors.push(actorUrl);
@@ -444,12 +474,12 @@ export async function blockActor(agent, actorUrl) {
   await unfollowActor(agent, actorUrl).catch(() => {});   // not following is fine
   await agent.publisher?.publishCollections({ blocked: true }).catch(() => {});
   await announceModeration(agent,
-    wire.blockActivity({ urls: agent.publisher.urls, targetActor: actorUrl, serial: Date.now() }))
+    wire.blockActivity({ urls: agent.publisher.urls, targetActor: actorUrl, serial }))
     .catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
   return { ok: true, actor: actorUrl };
 }
 
-export async function unblockActor(agent, actorUrl) {
+export async function unblockActor(agent, actorUrl, { serial = Date.now() } = {}) {
   const b = agent.store.getBlocklist();
   b.actors = b.actors.filter(a => a !== actorUrl);
   agent.store.setBlocklist(b);
@@ -459,7 +489,7 @@ export async function unblockActor(agent, actorUrl) {
   await announceModeration(agent, wire.undoActivity({
     urls: agent.publisher.urls,
     activity: { type: 'Block', actor: agent.publisher.urls.actor, object: actorUrl },
-    serial: Date.now(),
+    serial,
   })).catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
   return { ok: true, actor: actorUrl };
 }

package/lib/core/store.mjs

@@ -72,6 +72,11 @@ export function dropFollower(contacts, actor, why) {
   return contacts;
 }
 
+// What a state document looks like on the pod; write() and _put() agree on it.
+const serialise = (obj) => JSON.stringify(obj, null, 2) + '\n';
+// The same record apart from when it was fetched.
+const sameButWhen = (a, b) => JSON.stringify({ ...a, fetchedAt: null }) === JSON.stringify({ ...b, fetchedAt: null });
+
 export class PodStore {
   constructor({ storage = null, log = console.log } = {}) {
     this.lastSkipped = [];        // what the last load could not read, as `name (HTTP n)`
@@ -79,6 +84,7 @@ export class PodStore {
     this.log = log;
     this.cache = new Map();        // name → parsed value
     this.etags = new Map();        // name (or '') → last ETag, for revalidation
+    this.lastText = new Map();     // name → the bytes last loaded from or sent to the pod
     this.timers = new Map();       // name → debounce timer
     this.dirty = new Set();        // written while held; flushed by commit/release
     this._held = 0;
@@ -91,7 +97,7 @@ export class PodStore {
   attach(storage) {
     // A different tree is different state: carrying the old cache and its
     // ETags across would serve one container's documents as another's.
-    if (this.storage && this.storage.base !== storage.base) { this.cache.clear(); this.etags.clear(); }
+    if (this.storage && this.storage.base !== storage.base) { this.cache.clear(); this.etags.clear(); this.lastText.clear(); }
     this.storage = storage;
   }
 
@@ -144,7 +150,7 @@ export class PodStore {
       }
       fetched++;
       this.etags.set(name, r.etag);
-      try { this.cache.set(name, JSON.parse(r.body)); }
+      try { this.cache.set(name, JSON.parse(r.body)); this.lastText.set(name, r.body); }
       catch (e) { this.log(`state load ${name}: unparsable (${e.message})`); }
     }
     // Kept for /status: a document skipped here is a timeline or a contact
@@ -167,6 +173,15 @@ export class PodStore {
   write(name, obj) {
     this.cache.set(name, structuredClone(obj));
     if (!this.storage) return;
+    // The same bytes the pod already holds are not sent again. A like, a
+    // bookmark, a sweep that found nothing new each used to upload the whole
+    // timeline index and the whole people cache, unchanged — the largest
+    // write on the pod, on every small action. A write that had been armed
+    // and is now undone is unarmed with it.
+    if (this.lastText.get(name) === serialise(obj)) {
+      clearTimeout(this.timers.get(name)); this.timers.delete(name); this.dirty.delete(name);
+      return;
+    }
     // Held: record it and leave the writing to the commit boundary the caller
     // already has. See hold().
     if (this._held) { this.dirty.add(name); return; }
@@ -205,13 +220,13 @@ export class PodStore {
   // the returned promise so one failure cannot poison the queue.
   _put(name) {
     const done = this.chain.then(async () => {
-      const body = JSON.stringify(this.cache.get(name), null, 2) + '\n';
+      const body = serialise(this.cache.get(name));
       for (let attempt = 1; attempt <= PUT_RETRIES; attempt++) {
         // A storage that throws is a bug, not a hiccup — but it must not
         // escape into the write queue, where it would look like success.
         const r = await this.storage.write(name, body, 'application/json')
           .catch(e => ({ ok: false, retry: false, why: e.message }));
-        if (r.ok) return true;
+        if (r.ok) { this.lastText.set(name, body); return true; }
         // The storage says whether trying again could possibly help: a pod's
         // 4xx is an answer rather than a hiccup, and a directory's EACCES will
         // still be an EACCES in two seconds.
@@ -236,6 +251,7 @@ export class PodStore {
   // migrates to the local machine — leaving the copy behind would defeat it).
   async remove(name) {
     this.cache.delete(name);
+    this.lastText.delete(name);
     clearTimeout(this.timers.get(name));
     this.timers.delete(name);
     if (!this.storage) return true;
@@ -289,7 +305,17 @@ export class PodStore {
     const b = this.read('blocklist.json', {});
     return { domains: b.domains || [], actors: b.actors || [] };
   }
-  setBlocklist(b) { this.write('blocklist.json', b); }
+  // Blocking someone ends their following as well: a blocked actor, or anyone
+  // on a blocked domain, is no longer delivered to. The mark dropFollower leaves
+  // keeps a reconcile from bringing them back.
+  setBlocklist(b) {
+    this.write('blocklist.json', b);
+    const c = this.getContacts();
+    const gone = c.followers.filter(f => f.actor && this.isBlocked(f.actor)).map(f => f.actor);
+    if (!gone.length) return;
+    for (const actor of gone) dropFollower(c, actor, 'blocked');
+    this.setContacts(c);
+  }
   // Takes an actor URL or an object URL: the actor list only ever matches the
   // former, the domain list matches either.
   isBlocked(url) {
@@ -462,6 +488,7 @@ export class PodStore {
   getActors() { return this.read('actors.json', {}); }
   cacheActor(url, doc) {
     const a = this.getActors();
+    const known = a[url];
     a[url] = {
       name: clamp(plainText(doc.name || doc.preferredUsername || ''), MAX_NAME),
       preferredUsername: clamp(plainText(doc.preferredUsername || ''), MAX_NAME),
@@ -474,9 +501,12 @@ export class PodStore {
       type: doc.type || 'Person',
       followers: doc.followers || null,
       following: doc.following || null,
-      ...(a[url]?.counts ? { counts: a[url].counts } : {}),
+      ...(known?.counts ? { counts: known.counts } : {}),
       fetchedAt: new Date().toISOString(),
     };
+    // Fetched again and found the same: nothing to write. Only the time of
+    // asking differs, and that is not worth the whole cache going to the pod.
+    if (known && sameButWhen(known, a[url])) { a[url] = known; return; }
     this.write('actors.json', prune(a, ACTOR_CACHE_MAX, this.getContacts()));
   }
 

package/lib/core/wire.mjs

@@ -83,7 +83,8 @@ export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
 
 export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
-  webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
+  webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null, liked = null,
+  ownerOutbox = null,
   blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null,
   postingRestrictedToMods = null }) {
   // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
@@ -119,6 +120,12 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
       blocked: { '@id': 'bl:blocked', '@type': '@id' },
     });
   }
+  if (ownerOutbox) {
+    context.push({
+      fedipod: 'https://fedipod.net/ns#',
+      ownerOutbox: { '@id': 'fedipod:ownerOutbox', '@type': '@id' },
+    });
+  }
   // The actor's other identities: the account's WebID, plus any aliases —
   // old accounts elsewhere whose servers check for their own URL here before
   // they will send a Move. Declared inline exactly as Mastodon declares it.
@@ -193,6 +200,12 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
     featured: urls.featured,
     followers: urls.followers,
     following: urls.following,
+    // What this actor has liked (§5.5). Its owner's to read, like the pending
+    // lists below.
+    ...(liked ? { liked } : {}),
+    // Every message this actor produced, as its owner reads it (§5.1), at an
+    // address the owner's own credential reaches.
+    ...(ownerOutbox ? { ownerOutbox } : {}),
     // FEP-1b12: attributedTo names the moderators collection; recipients
     // validate a group's announced moderation against it.
     ...(moderators ? { attributedTo: moderators } : {}),
@@ -252,12 +265,12 @@ export function tombstoneDoc(urls, deletedAt, kind = 'person') {
 // A deleted note is left as a Tombstone at its own URL — kept fetchable — so a
 // peer that dereferences it learns the post was DELETED rather than getting a
 // bare 404 it cannot tell from "never existed" (§7.4).
-export function noteTombstone(noteId, deletedAt) {
+export function noteTombstone(noteId, deletedAt, formerType = 'Note') {
   return {
     '@context': AS_CTX,
     id: noteId,
     type: 'Tombstone',
-    formerType: 'Note',
+    formerType,
     deleted: deletedAt,
   };
 }
@@ -418,25 +431,29 @@ export const FOLLOWERS_PAGE_SIZE = 20;
 export const followersPageId = (id, n) => `${id}-${n}`;
 export const followersPageCount = (total) => Math.max(1, Math.ceil(total / FOLLOWERS_PAGE_SIZE));
 
+// Newest first, as every OrderedCollection is (ActivityPub §5): `first` is the
+// page the newest names were added to and `next` walks back in time, and each
+// page lists its names newest first. The pages themselves are still filled
+// from the oldest end, so a new name rewrites one page.
 export function followersHead(id, total, pageCount = followersPageCount(total)) {
   const pages = Math.max(1, pageCount);
   return {
     '@context': AS_CTX,
     id, type: 'OrderedCollection',
     totalItems: total,
-    first: followersPageId(id, 1),
-    last: followersPageId(id, pages),
+    first: followersPageId(id, pages),
+    last: followersPageId(id, 1),
   };
 }
 
-export function followersPage(id, n, items, pageCount) {
+export function followersPage(id, n, items, pageCount) {    // eslint-disable-line no-unused-vars
   return {
     '@context': AS_CTX,
     id: followersPageId(id, n),
     type: 'OrderedCollectionPage',
     partOf: id,
-    orderedItems: items,
-    ...(n < pageCount ? { next: followersPageId(id, n + 1) } : {}),
+    orderedItems: [...items].reverse(),
+    ...(n > 1 ? { next: followersPageId(id, n - 1) } : {}),
   };
 }
 
@@ -775,12 +792,14 @@ export function followActivity({ urls, targetActor, serial }) {
   };
 }
 
-export function likeActivity({ urls, noteId, serial }) {
+// Addressed to the author of what is liked, the one it is delivered to.
+export function likeActivity({ urls, noteId, serial, to = null }) {
   return {
     '@context': AS_CTX,
     id: urls.actor + '#like-' + serial,
     type: 'Like',
     actor: urls.actor,
+    ...(to ? { to: [to] } : {}),
     object: noteId,
   };
 }
@@ -793,7 +812,7 @@ export function announceActivity({ urls, object, serial, published = new Date().
   audience = null }) {
   return {
     '@context': AS_CTX,
-    id: urls.actor + '#announce-' + serial,
+    id: announceActivityId(urls, serial),
     type: 'Announce',
     actor: urls.actor,
     published,
@@ -831,10 +850,20 @@ export function updateActorActivity({ urls, actor, serial, published = new Date(
 // `serial` names the activity when the note is not being edited — a quote
 // authorization arriving on it changes what the note says about its quote,
 // not what it says.
+// An edit's Update is named by when the edit was made, so whoever made it can
+// say its id before it exists; a restatement that is not an edit has no stamp.
+// Each is a document of its own beside the post, so it can be fetched by its
+// id (§3.1) once it is on the public record; a fragment of another document
+// could not be.
+export const updateActivityId = (noteId, updated) => noteId + '-update-' + String(updated).replace(/[^0-9TZ]/g, '');
+export const deleteActivityId = (noteId) => noteId + '-delete';
+export const announceActivityId = (urls, serial) => urls.notes + 'announce-' + serial;
+export const undoActivityId = (urls, serial) => urls.notes + 'undo-' + serial;
+
 export function updateActivity(note, urls, { serial = null } = {}) {
   return {
     '@context': AS_CTX,
-    id: note.id + '#update-' + (note.updated ? String(note.updated).replace(/[^0-9TZ]/g, '') : 'q' + (serial ?? Date.now())),
+    id: note.updated ? updateActivityId(note.id, note.updated) : note.id + '-update-q' + (serial ?? Date.now()),
     type: 'Update',
     actor: urls.actor,
     to: note.to, cc: note.cc,
@@ -842,23 +871,30 @@ export function updateActivity(note, urls, { serial = null } = {}) {
   };
 }
 
-export function deleteActivity({ urls, noteId }) {
+// Addressed as the post was, so a followers-only or direct post's deletion
+// reaches the people who had it and is not announced to anyone else.
+export function deleteActivity({ urls, noteId, to = [PUBLIC], cc = null }) {
   return {
     '@context': AS_CTX,
-    id: noteId + '#delete',
+    id: deleteActivityId(noteId),
     type: 'Delete',
     actor: urls.actor,
-    to: [PUBLIC],
+    to,
+    ...(cc?.length ? { cc } : {}),
     object: { id: noteId, type: 'Tombstone' },
   };
 }
 
+// Addressed as what it takes back was: an Undo goes to whoever had that.
 export function undoActivity({ urls, activity, serial }) {
+  const to = activity?.to ?? (activity?.type === 'Follow' && typeof activity.object === 'string' ? [activity.object] : null);
   return {
     '@context': AS_CTX,
-    id: urls.actor + '#undo-' + serial,
+    id: undoActivityId(urls, serial),
     type: 'Undo',
     actor: urls.actor,
+    ...(to ? { to } : {}),
+    ...(activity?.cc ? { cc: activity.cc } : {}),
     object: activity,
   };
 }

package/lib/device/admin/routes/lifecycle.mjs

@@ -111,7 +111,7 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
         // A Move target nobody can resolve is a landing pad nobody lands on.
         if (!webfingerHost(urls.base) && !cfg.gateway?.frontActor) {
           return json(res, 400, {
-            error: 'this pod is a suffix-based host, so WebFinger cannot answer for it '
+            error: 'this pod is suffixed, so WebFinger cannot answer for it '
               + '— other servers could never resolve this account as a Move target',
           });
         }

package/lib/device/admin/routes/setup.mjs

@@ -13,6 +13,7 @@ import { copyPrivateHalf, isCurrent, CURRENT_LAYOUT } from '../../migrate.mjs';
 import { insecureUrlReason } from '../../../shared/safefetch.mjs';
 import { newRun, preflight, runSetup, setupInputError, hasCredential, credentialPath } from '../../setup.mjs';
 import { podLayout } from '../../../pod/root.mjs';
+import { chosenRoot, publicIndexKnown } from '../../../core/place.mjs';
 import { portFree, freePortFrom } from '../../ports.mjs';
 import { yieldDirectory } from '../../../gateway/directory.mjs';
 import { localFetch } from '../../../client/localapi.mjs';
@@ -115,7 +116,7 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
     }
     // ---- setup, driven by the page at /admin/setup/ ----
     case '/setup/check': {
-      const pre = preflight(body);
+      const pre = { ...preflight(body), ...await placeCheck(body) };
       // For a new pod, ask the provider where it puts pods, so the page can
       // show the Gateway address before the pod exists. A provider on paths
       // means the address must live at the Gateway; the run decides for real.
@@ -410,3 +411,18 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
     default: return false;
   }
 }
+
+// Where the data will go and whether the type index question has to be asked:
+// a pod you bring is read as a stranger would (its profile is public); a new
+// pod has no index, so the question is always asked for one.
+async function placeCheck(body) {
+  if (body.mode === 'new') return { typeIndex: false };
+  let base;
+  try { base = new URL(String(body.pod || '')).href; } catch { return {}; }
+  if (!base.endsWith('/')) base += '/';
+  const place = chosenRoot(base, body.container);
+  return {
+    typeIndex: await publicIndexKnown(fetch, base),
+    ...(place.problem ? { placeProblem: place.problem } : { place: base + place.root }),
+  };
+}