fedipod-server 0.29.0 → 0.30.0

package/lib/core/contexts/security-data-integrity-v1.json

@@ -1,78 +0,0 @@
-{
-  "@context": {
-    "id": "@id",
-    "type": "@type",
-    "@protected": true,
-    "digestMultibase": {
-      "@id": "https://w3id.org/security#digestMultibase",
-      "@type": "https://w3id.org/security#multibase"
-    },
-    "proof": {
-      "@id": "https://w3id.org/security#proof",
-      "@type": "@id",
-      "@container": "@graph"
-    },
-    "DataIntegrityProof": {
-      "@id": "https://w3id.org/security#DataIntegrityProof",
-      "@context": {
-        "@protected": true,
-        "id": "@id",
-        "type": "@type",
-        "challenge": "https://w3id.org/security#challenge",
-        "created": {
-          "@id": "http://purl.org/dc/terms/created",
-          "@type": "http://www.w3.org/2001/XMLSchema#dateTime"
-        },
-        "domain": "https://w3id.org/security#domain",
-        "expires": {
-          "@id": "https://w3id.org/security#expiration",
-          "@type": "http://www.w3.org/2001/XMLSchema#dateTime"
-        },
-        "nonce": "https://w3id.org/security#nonce",
-        "proofPurpose": {
-          "@id": "https://w3id.org/security#proofPurpose",
-          "@type": "@vocab",
-          "@context": {
-            "@protected": true,
-            "id": "@id",
-            "type": "@type",
-            "assertionMethod": {
-              "@id": "https://w3id.org/security#assertionMethod",
-              "@type": "@id",
-              "@container": "@set"
-            },
-            "authentication": {
-              "@id": "https://w3id.org/security#authenticationMethod",
-              "@type": "@id",
-              "@container": "@set"
-            },
-            "capabilityInvocation": {
-              "@id": "https://w3id.org/security#capabilityInvocationMethod",
-              "@type": "@id",
-              "@container": "@set"
-            },
-            "capabilityDelegation": {
-              "@id": "https://w3id.org/security#capabilityDelegationMethod",
-              "@type": "@id",
-              "@container": "@set"
-            },
-            "keyAgreement": {
-              "@id": "https://w3id.org/security#keyAgreementMethod",
-              "@type": "@id",
-              "@container": "@set"
-            }
-          }
-        },
-        "cryptosuite": "https://w3id.org/security#cryptosuite",
-        "proofValue": {
-          "@id": "https://w3id.org/security#proofValue",
-          "@type": "https://w3id.org/security#multibase"
-        },
-        "verificationMethod": {
-          "@id": "https://w3id.org/security#verificationMethod",
-          "@type": "@id"
-        }
-      }
-    }
-  }
-}

package/lib/core/contexts/security-data-integrity-v2.json

@@ -1,81 +0,0 @@
-{
-  "@context": {
-    "id": "@id",
-    "type": "@type",
-    "@protected": true,
-    "proof": {
-      "@id": "https://w3id.org/security#proof",
-      "@type": "@id",
-      "@container": "@graph"
-    },
-    "DataIntegrityProof": {
-      "@id": "https://w3id.org/security#DataIntegrityProof",
-      "@context": {
-        "@protected": true,
-        "id": "@id",
-        "type": "@type",
-        "challenge": "https://w3id.org/security#challenge",
-        "created": {
-          "@id": "http://purl.org/dc/terms/created",
-          "@type": "http://www.w3.org/2001/XMLSchema#dateTime"
-        },
-        "domain": "https://w3id.org/security#domain",
-        "expires": {
-          "@id": "https://w3id.org/security#expiration",
-          "@type": "http://www.w3.org/2001/XMLSchema#dateTime"
-        },
-        "nonce": "https://w3id.org/security#nonce",
-        "previousProof": {
-          "@id": "https://w3id.org/security#previousProof",
-          "@type": "@id"
-        },
-        "proofPurpose": {
-          "@id": "https://w3id.org/security#proofPurpose",
-          "@type": "@vocab",
-          "@context": {
-            "@protected": true,
-            "id": "@id",
-            "type": "@type",
-            "assertionMethod": {
-              "@id": "https://w3id.org/security#assertionMethod",
-              "@type": "@id",
-              "@container": "@set"
-            },
-            "authentication": {
-              "@id": "https://w3id.org/security#authenticationMethod",
-              "@type": "@id",
-              "@container": "@set"
-            },
-            "capabilityInvocation": {
-              "@id": "https://w3id.org/security#capabilityInvocationMethod",
-              "@type": "@id",
-              "@container": "@set"
-            },
-            "capabilityDelegation": {
-              "@id": "https://w3id.org/security#capabilityDelegationMethod",
-              "@type": "@id",
-              "@container": "@set"
-            },
-            "keyAgreement": {
-              "@id": "https://w3id.org/security#keyAgreementMethod",
-              "@type": "@id",
-              "@container": "@set"
-            }
-          }
-        },
-        "cryptosuite": {
-          "@id": "https://w3id.org/security#cryptosuite",
-          "@type": "https://w3id.org/security#cryptosuiteString"
-        },
-        "proofValue": {
-          "@id": "https://w3id.org/security#proofValue",
-          "@type": "https://w3id.org/security#multibase"
-        },
-        "verificationMethod": {
-          "@id": "https://w3id.org/security#verificationMethod",
-          "@type": "@id"
-        }
-      }
-    }
-  }
-}

package/lib/core/contexts/security-multikey-v1.json

@@ -1,35 +0,0 @@
-{
-  "@context": {
-    "id": "@id",
-    "type": "@type",
-    "@protected": true,
-    "Multikey": {
-      "@id": "https://w3id.org/security#Multikey",
-      "@context": {
-        "@protected": true,
-        "id": "@id",
-        "type": "@type",
-        "controller": {
-          "@id": "https://w3id.org/security#controller",
-          "@type": "@id"
-        },
-        "revoked": {
-          "@id": "https://w3id.org/security#revoked",
-          "@type": "http://www.w3.org/2001/XMLSchema#dateTime"
-        },
-        "expires": {
-          "@id": "https://w3id.org/security#expiration",
-          "@type": "http://www.w3.org/2001/XMLSchema#dateTime"
-        },
-        "publicKeyMultibase": {
-          "@id": "https://w3id.org/security#publicKeyMultibase",
-          "@type": "https://w3id.org/security#multibase"
-        },
-        "secretKeyMultibase": {
-          "@id": "https://w3id.org/security#secretKeyMultibase",
-          "@type": "https://w3id.org/security#multibase"
-        }
-      }
-    }
-  }
-}

package/lib/core/contexts/security-v1.json

@@ -1,74 +0,0 @@
-{
-  "@context": {
-    "id": "@id",
-    "type": "@type",
-    "dc": "http://purl.org/dc/terms/",
-    "sec": "https://w3id.org/security#",
-    "xsd": "http://www.w3.org/2001/XMLSchema#",
-    "EcdsaKoblitzSignature2016": "sec:EcdsaKoblitzSignature2016",
-    "Ed25519Signature2018": "sec:Ed25519Signature2018",
-    "EncryptedMessage": "sec:EncryptedMessage",
-    "GraphSignature2012": "sec:GraphSignature2012",
-    "LinkedDataSignature2015": "sec:LinkedDataSignature2015",
-    "LinkedDataSignature2016": "sec:LinkedDataSignature2016",
-    "CryptographicKey": "sec:Key",
-    "authenticationTag": "sec:authenticationTag",
-    "canonicalizationAlgorithm": "sec:canonicalizationAlgorithm",
-    "cipherAlgorithm": "sec:cipherAlgorithm",
-    "cipherData": "sec:cipherData",
-    "cipherKey": "sec:cipherKey",
-    "created": {
-      "@id": "dc:created",
-      "@type": "xsd:dateTime"
-    },
-    "creator": {
-      "@id": "dc:creator",
-      "@type": "@id"
-    },
-    "digestAlgorithm": "sec:digestAlgorithm",
-    "digestValue": "sec:digestValue",
-    "domain": "sec:domain",
-    "encryptionKey": "sec:encryptionKey",
-    "expiration": {
-      "@id": "sec:expiration",
-      "@type": "xsd:dateTime"
-    },
-    "expires": {
-      "@id": "sec:expiration",
-      "@type": "xsd:dateTime"
-    },
-    "initializationVector": "sec:initializationVector",
-    "iterationCount": "sec:iterationCount",
-    "nonce": "sec:nonce",
-    "normalizationAlgorithm": "sec:normalizationAlgorithm",
-    "owner": {
-      "@id": "sec:owner",
-      "@type": "@id"
-    },
-    "password": "sec:password",
-    "privateKey": {
-      "@id": "sec:privateKey",
-      "@type": "@id"
-    },
-    "privateKeyPem": "sec:privateKeyPem",
-    "publicKey": {
-      "@id": "sec:publicKey",
-      "@type": "@id"
-    },
-    "publicKeyBase58": "sec:publicKeyBase58",
-    "publicKeyPem": "sec:publicKeyPem",
-    "publicKeyWif": "sec:publicKeyWif",
-    "publicKeyService": {
-      "@id": "sec:publicKeyService",
-      "@type": "@id"
-    },
-    "revoked": {
-      "@id": "sec:revoked",
-      "@type": "xsd:dateTime"
-    },
-    "salt": "sec:salt",
-    "signature": "sec:signature",
-    "signatureAlgorithm": "sec:signingAlgorithm",
-    "signatureValue": "sec:signatureValue"
-  }
-}

package/lib/core/contexts/webfinger.json

@@ -1,10 +0,0 @@
-{
-  "@context": {
-    "wf": "https://purl.archive.org/socialweb/webfinger#",
-    "xsd": "http://www.w3.org/2001/XMLSchema#",
-    "webfinger": {
-      "@id": "wf:webfinger",
-      "@type": "xsd:string"
-    }
-  }
-}

package/lib/core/deliver.mjs

@@ -1,387 +0,0 @@
-// deliver.mjs — signed outbound delivery + retry queue. Fedify's signRequest
-// does draft-cavage HTTP Signatures (what Mastodon verifies). Failures go to
-// a JSON-file queue with exponential backoff; peers that stay down are
-// dropped after MAX_ATTEMPTS (~3 days).
-
-import { signRequest } from '@fedify/fedify/sig';
-import { webcrypto } from 'node:crypto';
-import { attachProof } from './proof.mjs';
-import { pinnedFor, retryAfterMs, HTTP_TIMEOUT_MS } from '../shared/safefetch.mjs';
-import { USER_AGENT } from '../shared/ua.mjs';
-import { dropFollower } from './store.mjs';
-
-const MAX_REDIRECTS = 3;
-
-// draft-cavage signs `(request-target): <method> <path><query>`. Fedify 2.3.4
-// builds that line from the pathname alone, so a signature over any URL
-// carrying a query is one a correct verifier cannot reconstruct — a paged
-// collection at `?page=2`, a WordPress inbox at `?rest_route=…`. Re-sign just
-// that line, over the header list Fedify already chose; a URL with no query
-// comes back untouched, and anything unexpected is left exactly as signed.
-export async function withQueryInTarget(signed, privateKey) {
-  const url = new URL(signed.url);
-  if (!url.search) return signed;
-  const header = signed.headers.get('signature');
-  if (!header) return signed;
-  const fields = Object.fromEntries(
-    [...header.matchAll(/([A-Za-z]+)="([^"]*)"/g)].map(m => [m[1], m[2]]));
-  const names = fields.headers?.split(/\s+/g) || [];
-  if (!fields.signature || !names.includes('(request-target)')) return signed;
-  if (names.some(n => n.startsWith('(') && n !== '(request-target)')) return signed;
-  const message = names.map(n => n === '(request-target)'
-    ? `(request-target): ${signed.method.toLowerCase()} ${url.pathname}${url.search}`
-    : `${n}: ${(n === 'host' ? signed.headers.get('host') || url.host : signed.headers.get(n)) ?? ''}`)
-    .join('\n');
-  const sig = await webcrypto.subtle.sign('RSASSA-PKCS1-v1_5', privateKey,
-    new TextEncoder().encode(message));
-  const headers = new Headers(signed.headers);
-  headers.set('signature',
-    header.replace(/signature="[^"]*"/, `signature="${Buffer.from(sig).toString('base64')}"`));
-  const init = { method: signed.method, headers, signal: signed.signal };
-  if (signed.method !== 'GET' && signed.method !== 'HEAD') init.body = await signed.arrayBuffer();
-  return new Request(signed.url, init);
-}
-
-const MAX_ATTEMPTS = 12;                       // 2^12 min ≈ 68h of backoff
-const TICK_MS = 60_000;
-const MAX_QUEUE = 2000;                        // beyond it, overflow dead-letters
-
-// Is this failure about the SERVER, or about this one recipient? A 410 Gone,
-// a 403, a 401 from an authorized-fetch instance are answers about one inbox;
-// cooling the whole host for them starves every other recipient on it — which
-// on a big instance is most of your followers. Only a refusal that is about
-// the server, or no answer at all, is grounds to leave it alone.
-const hostOf = (inbox) => { try { return new URL(inbox).host; } catch { return inbox; } };
-const aboutTheHost = (e) => !e.status || e.status >= 500 || e.status === 429;
-// A 410 says the inbox is gone for good and a 404 that nothing answers there:
-// neither earns a second POST. Gone also means whoever read there has left.
-const unsalvageable = (e) => e.status === 404 || e.status === 410;
-
-export class Deliverer {
-  // passive: signing-only (viewer-mode agents) — no queue drain timer, so a
-  // read-only agent never mutates shared delivery state. startQueue() flips
-  // it live when a viewer is promoted to active.
-  constructor({ store, keyId, rsaPrivate, actorId = null, edPrivate = null, proofKeyId = null,
-    log = console.log, passive = false, onGone = null }) {
-    this.store = store;
-    // Called after followers at a gone inbox are dropped: the agent republishes
-    // its followers collection.
-    this.onGone = onGone;
-    this.keyId = keyId;
-    this.rsaPrivate = rsaPrivate;
-    this.actorId = actorId;
-    this.edPrivate = edPrivate;
-    this.proofKeyId = proofKeyId;
-    this.log = log;
-    // How many fresh deliveries one attempt may carry. The Node deliverer
-    // opens a socket per recipient; the browser's relay deliverer sends a
-    // list, and sets this to what the relay accepts.
-    this.batchSize = 1;
-    if (!passive) this.startQueue();
-  }
-
-  startQueue() {
-    if (this.timer) return;
-    this.timer = setInterval(() => this.drainQueue().catch(e => this.log(`queue: ${e.message}`)), TICK_MS);
-    this.timer.unref?.();
-  }
-
-  // Signed fetch — also used for GETs so authorized-fetch instances answer
-  // us. Targets come from attacker-supplied documents, so every hop is
-  // address-checked and the connection is pinned to the checked address.
-  // Redirects are followed by hand because each hop needs its own signature
-  // (the signature covers the request target).
-  async signedFetch(url, init = {}) {
-    let current = url;
-    // Named on every hop: a remote operator seeing our deliveries or our
-    // verify-by-dereference GETs should know what we are.
-    //
-    // And bounded. This was the one remote-facing path in the project without a
-    // deadline — publisher, intake and the token grant all set one — so a peer
-    // that accepted the connection and then stalled held us for undici's 300s
-    // default. Against a 60s queue tick that is five overlapping drains
-    // re-POSTing the same activity at a server already in trouble. One signal,
-    // built once, so it covers all four redirect hops together rather than
-    // giving each hop a fresh deadline.
-    const withUa = {
-      ...init,
-      signal: init.signal || AbortSignal.timeout(HTTP_TIMEOUT_MS),
-      headers: { 'user-agent': USER_AGENT, ...(init.headers || {}) },
-    };
-    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-      const dispatcher = await pinnedFor(current);
-      const req = new Request(current, withUa);
-      const signed = await withQueryInTarget(
-        await signRequest(req, this.rsaPrivate, new URL(this.keyId)), this.rsaPrivate);
-      const res = await fetch(signed, { ...(dispatcher ? { dispatcher } : {}), redirect: 'manual' });
-      if (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
-        current = new URL(res.headers.get('location'), current).href;
-        continue;
-      }
-      // Where this ended up, which is not always where it was asked to go.
-      // Callers compare the document's own id against the URL they REQUESTED,
-      // so without this an open redirector on a victim's origin let an
-      // attacker's server answer for a victim's URL and be believed.
-      try { Object.defineProperty(res, 'finalUrl', { value: current, configurable: true }); }
-      catch { /* a frozen Response: the caller falls back to the requested URL */ }
-      return res;
-    }
-    throw new Error(`too many redirects from ${url}`);
-  }
-
-  async deliverNow(inbox, activity) {
-    const res = await this.signedFetch(inbox, {
-      method: 'POST',
-      headers: { 'content-type': 'application/activity+json' },
-      body: JSON.stringify(activity),
-    });
-    if (res.status >= 400) {
-      // Carry what the server told us instead of flattening it to a string.
-      // The Response used to be discarded here, headers and all, which is why
-      // a `Retry-After: 3600` was answered with four more POSTs inside the
-      // hour it asked for.
-      const err = new Error(`POST ${inbox} → ${res.status}`);
-      err.status = res.status;
-      // Only when the header is ACTUALLY there. Defaulting made every 503
-      // without one — which is most of them — collapse the exponential ladder
-      // to a flat 60s, the opposite of the intent. A remote's own instruction
-      // is honoured up to a day rather than the pod path's 30-minute ceiling:
-      // MAX_ATTEMPTS bounds the wait anyway.
-      const ra = retryAfterMs(res, 24 * 60 * 60_000);
-      if (ra != null) err.retryAfterMs = ra;
-      throw err;
-    }
-    return res;
-  }
-
-  // Deliver, queueing on failure.
-  // FEP-8b32: a proof on everything WE author, so a server that meets one of
-  // our activities second-hand can verify it without asking us.
-  //
-  // Only ours. An activity we forward on someone else's behalf keeps whatever
-  // proof its author gave it — signing that one as an assertion of ours would
-  // be claiming to have written it.
-  async proofed(activity) {
-    if (!this.edPrivate || !this.proofKeyId || !activity || typeof activity !== 'object') return activity;
-    if (activity.proof) return activity;
-    const actor = typeof activity.actor === 'string' ? activity.actor : activity.actor?.id;
-    if (!this.actorId || actor !== this.actorId) return activity;
-    try {
-      return await attachProof(activity,
-        { privateKey: this.edPrivate, verificationMethod: this.proofKeyId });
-    } catch (e) {
-      this.log(`proof: ${e.message}`);      // an unproved activity still federates
-      return activity;
-    }
-  }
-
-  // One attempt per target, answered in order: `{ ok: true }` or `{ error }`
-  // with the error deliverNow would have thrown. Here one at a time; the
-  // relay deliverer sends the whole list in one call.
-  async deliverManyNow(targets) {
-    const out = [];
-    for (const t of targets) {
-      try { await this.deliverNow(t.inbox, t.activity); out.push({ ok: true }); }
-      catch (error) { out.push({ error }); }
-    }
-    return out;
-  }
-
-  // A fresh activity of this actor's, for the outbox its owner reads. Never
-  // allowed to stop a delivery; a retry from the queue is not fresh.
-  _sent(activity) {
-    try { this.onSent?.(activity); } catch (e) { this.log(`owner's outbox record: ${e.message}`); }
-  }
-
-  // An inbox on a blocked domain is never delivered to, whoever still lists it.
-  _blockedInbox(inbox) {
-    try { return !!this.store.getBlocklist?.().domains.length && this.store.isBlocked?.(new URL(inbox).origin + '/'); }
-    catch { return false; }
-  }
-
-  async deliver(inbox, activity) {
-    this._sent(activity);
-    if (this._blockedInbox(inbox)) return;
-    // Proved before anything else, so the copy that goes on the queue is the
-    // copy that was signed — a retry days later must not post a bare activity.
-    const signed = await this.proofed(activity);
-    if (this._queueIfCooling(inbox, signed)) return;
-    const [result] = await this.deliverManyNow([{ inbox, activity: signed }]);
-    await this._settle(inbox, signed, result);
-  }
-
-  // A host we already know is refusing: queue without asking again. This is
-  // the path a FRESH activity takes, so without it a fan-out to a struggling
-  // server opened one socket per follower before any of this applied.
-  _queueIfCooling(inbox, signed) {
-    const host = hostOf(inbox);
-    const until = this._cooling?.get(host);
-    if (!until || until <= Date.now()) return false;
-    this.log(`${host} is cooling — queueing ${signed.type} rather than asking again`);
-    this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: until });
-    return true;
-  }
-
-  // What one attempt's outcome means for the queue.
-  async _settle(inbox, signed, result) {
-    if (result.ok) { this.log(`delivered ${signed.type} → ${inbox}`); return; }
-    const e = result.error;
-    if (unsalvageable(e)) { await this._unsalvageable(inbox, e); return; }
-    this.log(`delivery failed (${e.message}) — queued`);
-    const wait = e.retryAfterMs || 60_000;
-    if (aboutTheHost(e)) {
-      this._cooling ||= new Map();
-      this._cooling.set(hostOf(inbox), Date.now() + wait);
-    }
-    this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: Date.now() + wait });
-  }
-
-  // Not retried, and on a 410 the followers who received there are dropped,
-  // so the next fan-out stops asking; the followers collection is republished
-  // through onGone. A 404 drops only this delivery.
-  async _unsalvageable(inbox, e) {
-    if (e.status !== 410) { this.log(`delivery dropped (${e.message}) — nothing answers there`); return; }
-    const contacts = this.store.getContacts?.();
-    const left = (contacts?.followers || []).filter(f => f.inbox === inbox || f.sharedInbox === inbox);
-    this.log(`${inbox} is gone (410) — delivery dropped${left.length ? `, ${left.length} follower(s) there forgotten` : ''}`);
-    if (!left.length) return;
-    for (const f of left) dropFollower(contacts, f.actor, 'inbox-gone');
-    this.store.setContacts(contacts);
-    try { await this.onGone?.(); } catch (err) { this.log(`followers republish after 410: ${err.message}`); }
-  }
-
-  // The queue has a ceiling: a fan-out into a sea of down servers must not grow
-  // queue.json without bound. Overflow keeps the evidence as a dead letter.
-  _enqueue(item) {
-    const q = this.store.getQueue();
-    if (q.length >= MAX_QUEUE) {
-      this.log(`delivery queue is full (${MAX_QUEUE}) — dead-lettering ${item.activity?.type} → ${item.inbox}`);
-      this.store.addDeadLetter({ inboxUrl: item.inbox, reason: 'delivery queue full', activity: item.activity });
-      return;
-    }
-    q.push(item);
-    this.store.setQueue(q);
-  }
-
-  async deliverToAll(inboxes, activity) {
-    this._sent(activity);
-    // Proved once for the whole fan-out: every recipient gets the same bytes,
-    // and one signature is computed rather than one per follower.
-    const signed = await this.proofed(activity);
-    // Shared inboxes deduplicate fan-out to the same server. Sent in batches
-    // of batchSize, and a host found cooling by one batch is not asked again
-    // by the next.
-    const targets = [...new Set(inboxes)].filter((inbox) => !this._blockedInbox(inbox))
-      .map((inbox) => ({ inbox, activity: signed }));
-    for (let i = 0; i < targets.length; i += this.batchSize) {
-      const chunk = targets.slice(i, i + this.batchSize).filter((t) => !this._queueIfCooling(t.inbox, signed));
-      if (!chunk.length) continue;
-      const results = await this.deliverManyNow(chunk);
-      for (let k = 0; k < chunk.length; k++) await this._settle(chunk[k].inbox, signed, results[k]);
-    }
-  }
-
-  // Serialized, for the same reason Intake.drain is: the tick is 60s and a
-  // drain over slow peers outlasts it, so a second run started on top of the
-  // first. Both read their own clone of queue.json, so both re-POSTed every due
-  // activity — duplicate deliveries at a server that is already failing — and
-  // both then wrote `keep` back from a stale snapshot, losing the attempt
-  // counts that are supposed to make the backoff converge.
-  async drainQueue() {
-    if (this._draining) { this._drainAgain = true; return this._draining; }
-    this._draining = this._drainQueueOnce().finally(() => {
-      this._draining = null;
-      if (this._drainAgain) { this._drainAgain = false; this.drainQueue().catch(e => this.log(`queue: ${e.message}`)); }
-    });
-    return this._draining;
-  }
-
-  // The queue is walked per HOST, not per item.
-  //
-  // It used to be a flat sequential loop, which had two costs against a server
-  // that was down. Every due item for that host was POSTed — the first failure
-  // told us nothing the code could act on — and because each request carries a
-  // 15s deadline, K items for one dead host held the drain for up to 15K
-  // seconds while every healthy peer's activity waited behind them. Compounding
-  // requests at a struggling server, and head-of-line blocking of everyone
-  // else: the shape of the incident this project has a postmortem for.
-  //
-  // One failure now cools the whole host for the rest of this drain, and a
-  // Retry-After it sent decides for how long. The breaker is in memory; what
-  // persists is nextAt, which the queue already carried.
-  async _drainQueueOnce() {
-    const q = this.store.getQueue();
-    if (!q.length) return;
-    const now = Date.now();
-    const keep = [];
-    // Whether anything actually moved. The only early return above is on an
-    // EMPTY queue, so one item with a far-future nextAt used to rewrite
-    // queue.json on all 1440 ticks of a day with byte-identical content —
-    // PodStore.write has no equality check, and the ordinary ladder reaches
-    // hours-long waits by attempt 6, so any peer that fails a few times got
-    // there. A length compare is not enough: getQueue() hands back a clone, so
-    // attempts/nextAt are mutated in place and the count stays the same.
-    let changed = false;
-    // Outlives the drain: a Retry-After only reached items that happened to be
-    // due in the same pass, so a sibling due a minute later ignored it entirely.
-    this._cooling ||= new Map();             // host → until
-    for (const [h, until] of this._cooling) if (until <= now) this._cooling.delete(h);
-
-    const ladderFor = (item) => {
-      const base = Math.min(2 ** item.attempts, 2 ** MAX_ATTEMPTS) * 60_000;
-      return Math.round(base * (0.85 + Math.random() * 0.3));   // jittered, not lockstep
-    };
-
-    for (const item of q) {
-      // Due first, THEN cooling: an item that is not yet due must not have its
-      // ladder advanced on every 60s tick of a 15-minute cooldown. Once
-      // deferred its nextAt IS the cooldown, so it advances exactly once per
-      // cooldown — the same rate as the item that opened the socket.
-      if (item.nextAt > now) { keep.push(item); continue; }
-      const host = hostOf(item.inbox);
-      const until = this._cooling.get(host);
-      if (until && until > now) {
-        // A sibling already failed against this host. Defer without opening a
-        // socket — but ADVANCE THE LADDER, or only the one item that actually
-        // made a request ever climbs it and a queue of K items takes K times
-        // as long to give up as the module promises.
-        item.attempts += 1;
-        changed = true;
-        if (item.attempts > MAX_ATTEMPTS) {
-          this.log(`giving up on ${item.inbox} after ${MAX_ATTEMPTS} attempts`);
-          continue;
-        }
-        item.nextAt = Math.max(item.nextAt, until);
-        keep.push(item);
-        continue;
-      }
-      try {
-        await this.deliverNow(item.inbox, item.activity);
-        changed = true;
-        this.log(`retry ok: ${item.activity.type} → ${item.inbox}`);
-      } catch (e) {
-        if (unsalvageable(e)) { changed = true; await this._unsalvageable(item.inbox, e); continue; }
-        item.attempts += 1;
-        changed = true;
-        const wait = e.retryAfterMs || ladderFor(item);
-        // Cool the host BEFORE the give-up test: a failure is evidence about
-        // the server whether or not the item that produced it survives, and
-        // skipping this left the flat behaviour intact for exactly the backlog
-        // that has just aged out.
-        if (aboutTheHost(e)) {
-          this._cooling.set(host, now + wait);
-          if (e.retryAfterMs) this.log(`${host} asked for ${Math.round(wait / 1000)}s — honouring it`);
-        }
-        if (item.attempts > MAX_ATTEMPTS) {
-          this.log(`giving up on ${item.inbox} after ${MAX_ATTEMPTS} attempts`);
-          continue;
-        }
-        item.nextAt = now + wait;
-        keep.push(item);
-      }
-    }
-    if (changed) this.store.setQueue(keep);
-  }
-
-  stop() { clearInterval(this.timer); this.timer = null; }
-}