fedipod-server 0.8.0 → 0.10.0

package/lib/publisher.mjs

@@ -7,6 +7,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import * as wire from './wire.mjs';
+import * as polls from './polls.mjs';
 import { USER_AGENT } from './ua.mjs';
 import { HTTP_TIMEOUT_MS } from './safefetch.mjs';
 
@@ -16,6 +17,11 @@ const ACCEPT_AP = 'application/activity+json, application/ld+json; profile="http
 // still gets everything, so a missed call site degrades to the old cost rather
 // than silently publishing nothing.
 const REBUILD_MAX_PER_RUN = 200;
+// How long a poll gathers votes before its Question is rewritten. Every vote
+// changes a number other servers re-read, and rewriting per vote would make a
+// busy poll a steady write stream against the pod. A burst costs one rewrite
+// and one Update instead.
+const POLL_REWRITE_MS = 10_000;
 const ALL_COLLECTIONS = { followers: true, following: true, outbox: true, acls: true,
   pending: true, blocked: true };
 const AGENT_VERSION = JSON.parse(fs.readFileSync(
@@ -23,7 +29,7 @@ const AGENT_VERSION = JSON.parse(fs.readFileSync(
 
 export class Publisher {
   constructor({ config, remote, local, store, deliverer, publicKeyPem, assertionKey = null, log = console.log,
-    probeFetch = null, resolveMention = null, privateOnPod = true,
+    probeFetch = null, resolveMention = null, privateOnPod = true, clientOrigin = null,
   }) {
     this.config = config;
     this.remote = remote;
@@ -32,6 +38,10 @@ export class Publisher {
     this.deliverer = deliverer;
     this.publicKeyPem = publicKeyPem;
     this.assertionKey = assertionKey;      // Ed25519 public half, multibase; null = no proofs
+    // Where this identity's client surface answers, when that is an address a
+    // stranger can reach. Null on a laptop, where the surface is on loopback
+    // and advertising it to the world would name somewhere nobody can go.
+    this.clientOrigin = clientOrigin;
     // A fronted identity (config.gateway.frontActor) advertises its ids on a
     // shared domain; the map tells RemotePod where each writes on the pod.
     const publicBase = config.gateway?.frontActor
@@ -44,6 +54,8 @@ export class Publisher {
     this.probeFetch = probeFetch || ((u, i) => this.remote.probe(u, i));
     this.resolveMention = resolveMention;
     this.privateOnPod = privateOnPod;
+    // Per-poll rewrite windows, keyed by question id. See POLL_REWRITE_MS.
+    this.pollTimers = new Map();
     this.log = log;
   }
 
@@ -88,6 +100,13 @@ export class Publisher {
       pendingFollowing: priv ? urls.pendingFollowing : null,
       blocked: priv ? urls.blocked : null,
       inbox: gwActive ? gw.url : null,
+      // The agent's own outbox endpoint, where it is reachable: a client
+      // following the actor must arrive somewhere that will take a write.
+      outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : null,
+      // How a client-to-server client finds the way in with nothing configured
+      // by hand. Advertised only where the surface is publicly reachable.
+      oauthAuthorize: this.clientOrigin ? `${this.clientOrigin}oauth/authorize` : null,
+      oauthToken: this.clientOrigin ? `${this.clientOrigin}oauth/token` : null,
     });
     const surface = crypto.createHash('sha256').update(JSON.stringify({
       actor: actorDoc, handle: this.config.handle, host,
@@ -872,20 +891,13 @@ export class Publisher {
   }
 
   // Compose → wire note on remote pod + RDF truth locally + deliver Create.
-  async publishNote(content, { inReplyTo, attachments, visibility = 'public', spoilerText = null } = {}) {
-    const { urls } = this;
-    const priv = visibility === 'private' || visibility === 'direct';
-    if (priv) {
-      const ready = await this.privateReady();
-      if (ready !== true) throw new Error(ready);
-    }
-    const published = new Date().toISOString();
-    const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
-    // A mention nobody can resolve stays plain text rather than failing the post.
-    // The reply's own text decides who is mentioned: trim a handle out and that
-    // person is not notified, which is what every fediverse client leads people
-    // to expect. A Group named in the parent is the one thing carried forward
-    // regardless — drop it and the group stops carrying the thread.
+  // Who this text mentions, resolved. A mention nobody can resolve stays plain
+  // text rather than failing the post. The text itself decides: trim a handle
+  // out and that person is not notified, which is what every fediverse client
+  // leads people to expect. A Group named in the parent is the one thing
+  // carried forward regardless — drop it and the group stops carrying the
+  // thread.
+  async _mentionsFor(content, inReplyTo) {
     const inText = new Set(wire.mentionsIn(content));
     const carried = inReplyTo
       ? (this.store.getStatuses().find(s => s.noteId === inReplyTo)?.mentions || [])
@@ -899,6 +911,19 @@ export class Publisher {
       if (!inText.has(handle) && doc.type !== 'Group') continue;   // author trimmed them out
       mentions.push({ handle, actor: doc.id, page: doc.url || null, inbox: doc.endpoints?.sharedInbox || doc.inbox });
     }
+    return mentions;
+  }
+
+  async publishNote(content, { inReplyTo, attachments, visibility = 'public', spoilerText = null } = {}) {
+    const { urls } = this;
+    const priv = visibility === 'private' || visibility === 'direct';
+    if (priv) {
+      const ready = await this.privateReady();
+      if (ready !== true) throw new Error(ready);
+    }
+    const published = new Date().toISOString();
+    const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+    const mentions = await this._mentionsFor(content, inReplyTo);
     const note = wire.noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions,
       visibility, summary: spoilerText, container: priv ? urls.privateNotes : urls.notes });
 
@@ -951,6 +976,232 @@ export class Publisher {
     return note;
   }
 
+  // --- polls ---------------------------------------------------------------
+  //
+  // A poll is published as a Question and answered by ordinary replies naming
+  // an option, so the count is ours to keep and ours to republish. The roster
+  // of who chose what lives in agent state (polls.VOTES_DOC); the tallies on
+  // the status row and in the pod document are always derived from it.
+
+  /**
+   * Publish a poll. `options` is a list of choice titles, `multiple` lets a
+   * voter pick more than one, and `expiresAt` is when voting stops.
+   */
+  async publishQuestion(content, { options = [], multiple = false, expiresAt = null,
+    inReplyTo = undefined, visibility = 'public', spoilerText = null } = {}) {
+    const { urls } = this;
+    const priv = visibility === 'private' || visibility === 'direct';
+    if (priv) {
+      const ready = await this.privateReady();
+      if (ready !== true) throw new Error(ready);
+    }
+    const titles = [].concat(options).map(o => String(o ?? '').trim()).filter(Boolean);
+    if (titles.length < 2) throw new Error('a poll needs at least two options');
+    // Options are matched BY NAME when a vote arrives — that is the whole of
+    // the convention — so two options reading the same are one option that
+    // cannot be told apart.
+    if (new Set(titles).size !== titles.length) throw new Error('a poll’s options must differ from one another');
+    // Bounded here as well as at the client API, because the outbox is a
+    // second way in and an unbounded poll is a document a stranger sizes.
+    if (titles.length > polls.MAX_OPTIONS) throw new Error(`a poll takes at most ${polls.MAX_OPTIONS} options`);
+    if (titles.some(t => t.length > polls.MAX_OPTION_CHARS)) {
+      throw new Error(`a poll option is at most ${polls.MAX_OPTION_CHARS} characters`);
+    }
+    if (expiresAt) {
+      const ends = Date.parse(expiresAt);
+      if (!Number.isFinite(ends)) throw new Error('the closing time is not a date');
+      const seconds = (ends - Date.now()) / 1000;
+      if (seconds < polls.MIN_SECONDS || seconds > polls.MAX_SECONDS) {
+        throw new Error(`a poll runs between ${polls.MIN_SECONDS} and ${polls.MAX_SECONDS} seconds`);
+      }
+    }
+
+    const published = new Date().toISOString();
+    const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+    const mentions = await this._mentionsFor(content, inReplyTo);
+    const poll = {
+      multiple: !!multiple,
+      expiresAt: expiresAt || null,
+      closed: null,
+      options: titles.map(title => ({ title, votes: 0 })),
+      votersCount: 0,
+      // Resolved once, here: a tally rewrite must not cost a webfinger lookup
+      // per vote for people the poll named.
+      mentionInboxes: [...new Set(mentions.map(m => m.inbox).filter(Boolean))],
+    };
+    const question = wire.questionDoc({
+      urls, slug, content, published, inReplyTo, attachments: [], mentions,
+      visibility, summary: spoilerText,
+      container: priv ? urls.privateNotes : urls.notes,
+      options: poll.options, multiple: poll.multiple, endTime: poll.expiresAt, votersCount: 0,
+    });
+
+    await this.remote.putJson(question.id, question);
+    // Empty, but present: a dangling `replies` that 404s is worse than none.
+    await this.remote.putJson(wire.repliesId(question.id), wire.collection(wire.repliesId(question.id), []));
+    if (!priv) await this.recordOutbox(question.id);
+    await this.local.writeNote('posts', slug, {
+      noteId: question.id, actor: urls.actor, published, content: question.content,
+      inReplyTo, attachments: [],
+    });
+    this.store.addStatus({
+      noteId: question.id, actor: urls.actor, content: question.content, published,
+      kind: 'post', slug, text: content, visibility, poll, inReplyTo,
+      ...(spoilerText ? { spoiler: spoilerText } : {}),
+      ...(question.tag?.length ? { mentions: question.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
+    });
+
+    const create = this._pollActivity('Create', question, wire.createActivityId(question.id));
+    await this.remote.putJson(create.id, create);
+    const contacts = this.store.getContacts();
+    const inboxes = [...new Set([
+      ...(visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
+      ...poll.mentionInboxes,
+    ].filter(Boolean))];
+    await this.deliverer.deliverToAll(inboxes, create);
+    this.log(`poll published: ${question.id} (${titles.length} options) → ${inboxes.length} inbox(es)`);
+    return question;
+  }
+
+  // The Create or Update carrying a Question. The context is hoisted onto the
+  // activity and the embedded object keeps none: a nested @context is legal
+  // JSON-LD but not every server reads one, and votersCount is declared there.
+  _pollActivity(type, question, id) {
+    const { '@context': ctx, ...object } = question;
+    return {
+      '@context': ctx, id, type,
+      actor: this.urls.actor,
+      published: question.published,
+      to: question.to, cc: question.cc,
+      object,
+    };
+  }
+
+  /**
+   * One vote on one of OUR polls, named by the option's title. Returns true
+   * when it counted — a second answer to a single-choice poll, an option we do
+   * not offer, or a poll that has closed all count for nothing.
+   */
+  async recordVote(questionId, actor, optionName) {
+    const s = this.store.getStatuses().find(x => x.noteId === questionId);
+    if (!s?.poll || s.kind !== 'post' || s.actor !== this.urls.actor) return false;
+    if (polls.pollClosed(s.poll)) return false;
+    const index = polls.optionIndex(s.poll, optionName);
+    if (index < 0) return false;
+    const all = this.store.read(polls.VOTES_DOC, {});
+    const { roster, changed } = polls.addVote(all[questionId] || {}, polls.voterKey(actor), index,
+      { multiple: !!s.poll.multiple });
+    if (!changed) return false;
+    this.store.write(polls.VOTES_DOC, { ...all, [questionId]: roster });
+    this.store.updateStatus(questionId, { poll: polls.withTally(s.poll, roster) });
+    this._pollDirty(questionId);
+    return true;
+  }
+
+  // Open the rewrite window for a poll whose count moved. Already open is
+  // already enough: the whole point is that a burst costs one rewrite.
+  _pollDirty(questionId) {
+    if (this.pollTimers.has(questionId)) return;
+    const t = setTimeout(() => {
+      this.pollTimers.delete(questionId);
+      this.republishPoll(questionId).catch(e => this.log(`poll rewrite: ${e.message}`));
+    }, POLL_REWRITE_MS);
+    t.unref?.();
+    this.pollTimers.set(questionId, t);
+  }
+
+  /**
+   * Write the poll's current count back to the pod and tell everyone who has
+   * it. `closing` stamps it shut, which is a one-way door.
+   */
+  async republishPoll(questionId, { closing = null } = {}) {
+    const s = this.store.getStatuses().find(x => x.noteId === questionId);
+    if (!s?.poll) return null;
+    const { urls } = this;
+    const roster = this.store.read(polls.VOTES_DOC, {})[questionId] || {};
+    // A shut poll whose roster has been retired keeps the counts on its row:
+    // deriving them from an empty roster would publish a poll nobody voted in.
+    const shut = closing || s.poll.closed;
+    const counted = shut && !Object.keys(roster).length ? s.poll : polls.withTally(s.poll, roster);
+    const poll = { ...counted, ...(closing ? { closed: closing } : {}) };
+    const container = String(s.noteId).startsWith(urls.privateNotes) ? urls.privateNotes : urls.notes;
+    const slug = s.slug || String(s.noteId).slice(container.length);
+    const mentions = (s.mentions || []).map(m => ({
+      handle: String(m.name || '').replace(/^@/, ''), actor: m.href, page: null, inbox: null,
+    }));
+    const question = wire.questionDoc({
+      urls, slug, content: s.text ?? '', published: s.published, inReplyTo: s.inReplyTo,
+      attachments: [], mentions,
+      visibility: s.visibility || 'public', summary: s.spoiler || null, container,
+      options: poll.options, multiple: !!poll.multiple, endTime: poll.expiresAt,
+      closed: poll.closed, votersCount: poll.votersCount || 0,
+    });
+    await this.remote.putJson(question.id, question);
+    // The Create is overwritten too, so a group's Announce resolves to the
+    // current count rather than to the one the poll opened with.
+    await this.remote.putJson(wire.createActivityId(question.id),
+      this._pollActivity('Create', question, wire.createActivityId(question.id)));
+    this.store.updateStatus(questionId, { poll });
+
+    // Not `updated`: a changed count is not an edit, and stamping one would
+    // have every client show the poll as edited each time somebody voted.
+    //
+    // The Update is named after the STATE it carries rather than the moment it
+    // was sent. A clock only tells two rewrites apart when they fall in
+    // different milliseconds, and a receiving server that has seen an activity
+    // id drops the next one wearing it — which would quietly freeze the count.
+    // Naming the state means an id changes exactly when there is something new
+    // to say, and two sends of the same numbers are the duplicate they look
+    // like.
+    const stamp = crypto.createHash('sha256').update(JSON.stringify([
+      poll.options.map(o => o.votes || 0), poll.votersCount || 0, poll.closed || '',
+    ])).digest('hex').slice(0, 12);
+    const update = this._pollActivity('Update', question, `${question.id}#poll-${stamp}`);
+    const contacts = this.store.getContacts();
+    const inboxes = [...new Set([
+      ...(s.visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
+      ...(s.poll.mentionInboxes || []),
+    ].filter(Boolean))];
+    await this.deliverer.deliverToAll(inboxes, update);
+    this.log(`poll ${closing ? 'closed' : 'count published'}: ${question.id} → ${inboxes.length} inbox(es)`);
+    return poll;
+  }
+
+  /**
+   * Shut any poll whose time is up. Called from the agent's sweep. Closing is
+   * recorded BEFORE the republish, so a failed republish cannot leave a poll
+   * open and collecting votes it has already refused.
+   */
+  async closeDuePolls(now = Date.now()) {
+    const due = this.store.getStatuses().filter(s => s.kind === 'post' && s.poll
+      && !s.poll.closed && s.poll.expiresAt && Date.parse(s.poll.expiresAt) <= now);
+    for (const s of due) {
+      const closed = new Date(Math.min(now, Date.parse(s.poll.expiresAt) || now)).toISOString();
+      clearTimeout(this.pollTimers.get(s.noteId));
+      this.pollTimers.delete(s.noteId);
+      this.store.updateStatus(s.noteId, { poll: { ...s.poll, closed } });
+      const done = await this.republishPoll(s.noteId, { closing: closed })
+        .catch(e => { this.log(`poll close ${s.noteId}: ${e.message}`); return null; });
+      // The roster only ever answered one question — has this person already
+      // voted — and a shut poll has stopped asking it. Dropping it keeps a
+      // document we serialize whole from carrying every poll's voters forever.
+      if (done) {
+        const all = this.store.read(polls.VOTES_DOC, {});
+        if (all[s.noteId]) {
+          delete all[s.noteId];
+          this.store.write(polls.VOTES_DOC, all);
+        }
+      }
+    }
+    return due.length;
+  }
+
+  /** Stop the pending rewrite windows. Called at shutdown. */
+  stopPolls() {
+    for (const t of this.pollTimers.values()) clearTimeout(t);
+    this.pollTimers.clear();
+  }
+
   // The pinned posts, as the actor's featured collection — the one document a
   // remote server reads when it shows this profile's pins.
   async publishFeatured() {

package/lib/social.mjs

@@ -317,6 +317,8 @@ export async function votePoll(agent, s, choices) {
     return { ok: false, error: 'this poll has closed' };
   }
   if (poll.voted) return { ok: false, error: 'already voted' };
+  // Your own poll is the one you are counting, not one you are answering.
+  if (s.actor === urls.actor) return { ok: false, error: 'this is your own poll' };
   const picks = [...new Set(choices)].filter(i => i >= 0 && i < opts.length);
   if (!picks.length) return { ok: false, error: 'invalid choice' };
   if (!poll.multiple && picks.length > 1) return { ok: false, error: 'this poll takes one choice' };

package/lib/storage.mjs

@@ -61,9 +61,15 @@ export class HttpStorage {
     return { notModified: false, names, etag: res.headers.get('etag') };
   }
 
-  async read(p, { etag } = {}) {
+  // `accept` is for callers reading something that is RDF but is wanted as it
+  // was written: asking turtle-first for a JSON-LD document gets turtle back,
+  // because the server is entitled to convert between two RDF syntaxes.
+  async read(p, { etag, accept } = {}) {
     const res = await this.fetchImpl(this._url(p), {
-      headers: { accept: 'text/turtle, application/json;q=0.9, */*;q=0.8', ...(etag ? { 'if-none-match': etag } : {}) },
+      headers: {
+        accept: accept || 'text/turtle, application/json;q=0.9, */*;q=0.8',
+        ...(etag ? { 'if-none-match': etag } : {}),
+      },
     });
     if (res.status === 304) return { ok: true, notModified: true, status: 304, body: null, etag };
     if (res.status >= 400) return { ok: false, notModified: false, status: res.status, body: null, etag: null };

package/lib/wire.mjs

@@ -108,7 +108,7 @@ export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
 export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
   webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
-  blocked = null, inbox = null }) {
+  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null }) {
   // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
   // inline exactly as Mastodon declares it — and only when we actually use it.
   // It is what makes a client show "Request to follow" rather than "Follow" and
@@ -188,8 +188,23 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
     inbox: inbox || urls.inbox,
     // Every Mastodon actor publishes one. With a single actor per pod ours is
     // just the inbox, but its absence is the non-standard thing.
-    endpoints: { sharedInbox: inbox || urls.inbox },
-    outbox: urls.outbox,
+    //
+    // The two OAuth entries are how a client-to-server client finds its way in
+    // without being told anything by hand (ActivityPub 4.1). They appear only
+    // where this identity's client surface answers on an address a stranger
+    // can reach, which is why the caller supplies them rather than this
+    // building them from the pod URL.
+    endpoints: {
+      sharedInbox: inbox || urls.inbox,
+      ...(oauthAuthorize ? { oauthAuthorizationEndpoint: oauthAuthorize } : {}),
+      ...(oauthToken ? { oauthTokenEndpoint: oauthToken } : {}),
+    },
+    // Where a client sends what this actor writes, which the protocol says is
+    // this same address. The pod holds the collection and answers reads of it;
+    // a client-to-server write has to reach the agent, and the pod cannot take
+    // one. So where the agent is reachable it is named here, and a read of it
+    // is sent straight on to the pod's own document.
+    outbox: outbox || urls.outbox,
     // The pinned posts, as the collection other servers read when they show
     // this profile. Mastodon's term, declared the way Mastodon declares it.
     featured: urls.featured,
@@ -645,6 +660,45 @@ export function noteDoc({ urls, slug, content, published, inReplyTo, attachments
   return note;
 }
 
+// A poll is a note that asks something: the same addressing, the same
+// mentions, the same replies collection, with the choices in `oneOf` (pick
+// one) or `anyOf` (pick several). Each choice carries the count as the
+// totalItems of its own replies collection, which is where every server that
+// shows a poll reads it from.
+//
+// `endTime` is when voting stops and `closed` is the stamp saying it has —
+// both plain AS2. `votersCount` is Mastodon's: PEOPLE rather than answers,
+// which differ only once a poll takes several answers each. It is not in the
+// base context, so it is declared inline exactly as Mastodon declares it, and
+// only when we actually carry it.
+export function questionDoc({ options = [], multiple = false, endTime = null,
+  closed = null, votersCount = null, ...rest }) {
+  const note = noteDoc(rest);
+  const choices = options.map(o => ({
+    type: 'Note',
+    name: String(o.title),
+    replies: { type: 'Collection', totalItems: Number(o.votes) || 0 },
+  }));
+  const question = {
+    ...note,
+    type: 'Question',
+    [multiple ? 'anyOf' : 'oneOf']: choices,
+  };
+  if (endTime) question.endTime = endTime;
+  if (closed) question.closed = closed;
+  if (votersCount !== null && votersCount !== undefined) {
+    question['@context'] = [AS_CTX, {
+      toot: 'http://joinmastodon.org/ns#',
+      votersCount: {
+        '@id': 'toot:votersCount',
+        '@type': 'http://www.w3.org/2001/XMLSchema#nonNegativeInteger',
+      },
+    }];
+    question.votersCount = votersCount;
+  }
+  return question;
+}
+
 // The id is a document of its own, not `note.id + '#create'`. A group wraps this
 // whole activity in its Announce (FEP-1b12), and the receiver resolves it by
 // dereferencing this id — a fragment would just serve the Note back under a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/run-agent.mjs

@@ -324,6 +324,7 @@ export class Agent {
     this.deliverer?.stop();
     this.tagfeed?.stop();
     clearInterval(this.schedTimer);
+    this.publisher?.stopPolls();
     this.deliverer = new Deliverer({
       store: this.store, rsaPrivate: keys.rsaPrivate, keyId: this.urls.actor + '#main-key',
       actorId: this.urls.actor, edPrivate: keys.edPrivate,
@@ -338,6 +339,10 @@ export class Agent {
       // Whether the fediverse tree is on the pod at all, so the ACL check does
       // not probe for something the default layout keeps on local disk.
       privateOnPod: !cred.privateRoot,
+      // Inside a pod server the client surface answers on the pod's own
+      // origin, so it can be advertised. Standalone it is on loopback, and
+      // naming it in a world-readable actor would send clients nowhere.
+      clientOrigin: this.embedded ? this.urls.base : null,
     });
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.
@@ -543,6 +548,10 @@ export class Agent {
         }).then(() => this.log(`scheduled post published (${e.id})`))
           .catch(err => this.log(`scheduled post ${e.id} failed: ${err.message} — dropped`));
       }
+      // A poll whose time is up is shut on the same sweep: it stops taking
+      // answers here, and everyone holding it is told once.
+      this.publisher.closeDuePolls()
+        .catch(err => this.log(`closing polls: ${err.message}`));
     }, 30_000);
     this.schedTimer.unref();
     // A CSV import interrupted by a restart or a handoff picks back up here.
@@ -647,6 +656,7 @@ export class Agent {
     this.deliverer?.stop();
     this.importer?.stop();
     clearInterval(this.schedTimer);
+    this.publisher?.stopPolls();
     // The lease too: standing down means standing down. Left renewing, a viewer
     // keeps writing to the pod on the active agent's behalf and can win the
     // lease back on a conditional PUT it had no business making.