fedipod 0.17.0 → 0.18.0

package/README.md

@@ -74,6 +74,9 @@ keyword filters, scheduled posts, pinned posts (visible from other servers),
 blocking and muting from the client, custom emojis, and web-push
 notifications that reach you while the client is closed.
 
+Polls: up to four options, one answer or several, running from five minutes to
+a month.
+
 ### Other clients
 
 - **Web clients**: drop any static Mastodon client dist into `ui/<name>/`

package/lib/c2s.mjs

@@ -234,8 +234,9 @@ export class C2S {
 
     switch (activity.type) {
       case 'Create': {
-        if (!object || (object.type && object.type !== 'Note')) {
-          return this.send(res, 422, { error: 'only a Note (or a bare Note) can be created here' });
+        const makes = object?.type || 'Note';
+        if (!object || (makes !== 'Note' && makes !== 'Question')) {
+          return this.send(res, 422, { error: 'only a Note or a Question (or a bare Note) can be created here' });
         }
         const visibility = this.visibilityOf(activity, object);
         if (!visibility) {
@@ -246,6 +247,30 @@ export class C2S {
         // visible characters rather than as markup. Documented v1 limit.
         const text = String(object.source?.content ?? object.content ?? '');
         if (!text.trim()) return this.send(res, 422, { error: 'the note has no content' });
+
+        // A Question is a poll: the choices are in oneOf (pick one) or anyOf
+        // (pick several), each naming itself, and endTime is when it shuts.
+        if (makes === 'Question') {
+          const one = arr(object.oneOf);
+          const many = arr(object.anyOf);
+          const titles = (one.length ? one : many).map((c) => String(c?.name ?? '').trim()).filter(Boolean);
+          try {
+            const question = await agent.publisher.publishQuestion(text, {
+              options: titles,
+              multiple: !one.length && many.length > 0,
+              expiresAt: object.endTime || null,
+              inReplyTo: idOf(object.inReplyTo) || undefined,
+              visibility,
+              spoilerText: object.summary || null,
+            });
+            return this.send(res, 201,
+              { id: wire.createActivityId(question.id), object: question.id },
+              { location: wire.createActivityId(question.id) });
+          } catch (e) {
+            return this.send(res, 422, { error: e.message });
+          }
+        }
+
         const attachments = arr(object.attachment).map((a) => ({
           url: a?.url, mediaType: a?.mediaType,
           ...(a?.name ? { description: a.name } : {}),

package/lib/embed.mjs

@@ -202,6 +202,7 @@ export async function startEmbeddedAgent({
     agent.importer?.stop();
     clearInterval(agent.schedTimer);
     clearInterval(agent.refreshTimer);
+    agent.publisher?.stopPolls();
     // Same order the standalone agent's shutdown uses: write what is pending,
     // then let go of the lease so the next agent need not wait out the TTL.
     await Promise.allSettled([

package/lib/intake.mjs

@@ -19,6 +19,7 @@ import { USER_AGENT } from './ua.mjs';
 import { PUBLIC } from './wire.mjs';
 import { HTTP_TIMEOUT_MS, readCapped } from './safefetch.mjs';
 import { linkTargets, REL } from './links.mjs';
+import * as polls from './polls.mjs';
 import { dropFollower } from './store.mjs';
 
 const RDF = $rdf.Namespace('http://www.w3.org/1999/02/22-rdf-syntax-ns#');
@@ -349,13 +350,18 @@ export class Intake {
       || g.each(null, NOTIFY('channelType'), NOTIFY('WebSocketChannel2023'), null)
         .map(n => n.value).find(Boolean);
     if (!channel) { this.wsState = 'unavailable'; this.log('no WebSocketChannel2023 service — polling only'); return; }
+    // The topic is a POD resource, and it travels in the BODY — so the url map
+    // RemotePod applies to the request line never reaches it. A fronted
+    // identity's inbox url names the front, which the pod cannot grant read on,
+    // and the subscription came back 403. A no-op when unfronted.
+    const topic = this.urls.toPod ? this.urls.toPod(this.urls.inbox) : this.urls.inbox;
     const sub = await this.remote.fetch(channel, {
       method: 'POST',
       headers: { 'content-type': 'application/ld+json' },
       body: JSON.stringify({
         '@context': ['https://www.w3.org/ns/solid/notification/v1'],
         type: 'http://www.w3.org/ns/solid/notifications#WebSocketChannel2023',
-        topic: this.urls.inbox,
+        topic,
       }),
     });
     const body = await readCapped(sub).then(JSON.parse).catch(() => null);
@@ -1426,6 +1432,22 @@ export class Intake {
     // somebody else's boost, or through a hashtag feed.
     if (this.store.isBlocked(author)) return `blocked author (${author})`;
 
+    // An answer to one of our polls is a number on a document, not a post. It
+    // arrives as an ordinary reply naming an option and carrying nothing else,
+    // so filing it as one would put a blank entry in the thread and ring the
+    // owner once per voter. Counted or refused — a second answer, an option we
+    // do not offer, a poll already shut — it stops here either way.
+    const asked = note.inReplyTo && this.store.getStatuses()
+      .find(x => x.noteId === String(note.inReplyTo) && x.kind === 'post' && x.poll);
+    if (asked && polls.isVoteShape(note)) {
+      const counted = await this.publisher.recordVote(asked.noteId, author, note.name)
+        .catch(e => { this.log(`vote on ${asked.noteId}: ${e.message}`); return false; });
+      this.log(counted
+        ? `vote counted (${note.name}): ${asked.noteId}`
+        : `vote not counted (${note.name}) from ${author}: ${asked.noteId}`);
+      return;
+    }
+
     // Anyone can Append to a public inbox, so arriving is not the same as
     // belonging in the home timeline. Follow Mastodon's split: people you
     // follow (and their boosts) are HOME; anyone else is a MENTION — kept,

package/lib/mastoapi.mjs

@@ -17,6 +17,10 @@ import { authorOf } from './intake.mjs';
 import { profileUrl, postUrl } from './bskyfeed.mjs';
 import { Push } from './webpush.mjs';
 import { safeFetch, readCapped } from './safefetch.mjs';
+import {
+  MAX_OPTIONS as POLL_MAX_OPTIONS, MAX_OPTION_CHARS as POLL_MAX_OPTION_CHARS,
+  MIN_SECONDS as POLL_MIN_SECONDS, MAX_SECONDS as POLL_MAX_SECONDS,
+} from './polls.mjs';
 
 // What an attachment is allowed to BE. Anything else is stored as bytes, which
 // a browser downloads rather than runs.
@@ -27,6 +31,26 @@ const ATTACHMENT_KINDS = new Set(['image', 'video', 'audio']);
 const NEVER = new Set(['image/svg+xml', 'image/svg']);
 const OPAQUE = 'application/octet-stream';
 
+/**
+ * A poll out of a compose request, or null when there is none. A JSON client
+ * sends a `poll` object; a form-encoded one spells the same thing out in
+ * Rails's bracket notation, which is the shape the option list arrives in.
+ */
+export function pollParams(body) {
+  const nested = body?.poll && typeof body.poll === 'object' ? body.poll : null;
+  const options = [].concat(nested?.options ?? body?.['poll[options][]'] ?? [])
+    .map(o => String(o ?? '').trim()).filter(Boolean);
+  const rawExpiry = nested?.expires_in ?? body?.['poll[expires_in]'];
+  const rawMultiple = nested?.multiple ?? body?.['poll[multiple]'];
+  if (!options.length && rawExpiry === undefined) return null;
+  return {
+    options,
+    expiresIn: rawExpiry === undefined || rawExpiry === null || rawExpiry === ''
+      ? null : Number(rawExpiry),
+    multiple: rawMultiple === true || rawMultiple === 'true' || rawMultiple === '1',
+  };
+}
+
 export function attachmentType(claimed) {
   const t = String(claimed || '').split(';')[0].trim().toLowerCase();
   if (!/^[a-z0-9.+-]+\/[a-z0-9.+-]+$/.test(t) || NEVER.has(t)) return OPAQUE;
@@ -628,7 +652,7 @@ export class MastoApi {
       expires_at: s.poll.expiresAt || null,
       expired: !!s.poll.closed || (!!s.poll.expiresAt && Date.parse(s.poll.expiresAt) < Date.now()),
       multiple: !!s.poll.multiple,
-      votes_count: votes, voters_count: null,
+      votes_count: votes, voters_count: s.poll.votersCount ?? null,
       options: opts.map(o => ({ title: o.title, votes_count: o.votes || 0 })),
       voted: !!s.poll.voted, own_votes: s.poll.ownVotes || [],
       emojis: [],
@@ -1080,6 +1104,41 @@ export class MastoApi {
       const mediaIds = [].concat(body.media_ids || body['media_ids[]'] || []).filter(Boolean);
       const media = this.store.getMedia();
       const attachments = mediaIds.map(id => media[id] && { id, ...media[id] }).filter(Boolean);
+
+      const asking = pollParams(body);
+      if (asking) {
+        // Mastodon's own rules, stated here rather than discovered inside the
+        // publisher, so a client gets the reason back on the request it made.
+        if (attachments.length) return send(422, { error: 'a poll cannot carry media' });
+        if (body.scheduled_at) return send(422, { error: 'a poll cannot be scheduled' });
+        if (asking.options.length < 2) return send(422, { error: 'a poll needs at least two options' });
+        if (asking.options.length > POLL_MAX_OPTIONS) {
+          return send(422, { error: `a poll takes at most ${POLL_MAX_OPTIONS} options` });
+        }
+        if (asking.options.some(o => o.length > POLL_MAX_OPTION_CHARS)) {
+          return send(422, { error: `a poll option is at most ${POLL_MAX_OPTION_CHARS} characters` });
+        }
+        if (new Set(asking.options).size !== asking.options.length) {
+          return send(422, { error: 'a poll\u2019s options must differ from one another' });
+        }
+        const seconds = asking.expiresIn ?? POLL_MAX_SECONDS;
+        if (!Number.isFinite(seconds) || seconds < POLL_MIN_SECONDS || seconds > POLL_MAX_SECONDS) {
+          return send(422, {
+            error: `a poll runs between ${POLL_MIN_SECONDS} and ${POLL_MAX_SECONDS} seconds`,
+          });
+        }
+        try {
+          const q = await this.agent.publisher.publishQuestion(body.status, {
+            options: asking.options, multiple: asking.multiple,
+            expiresAt: new Date(Date.now() + seconds * 1000).toISOString(),
+            inReplyTo, visibility, spoilerText,
+          });
+          return send(200, this.status(this.store.getStatuses().find(x => x.noteId === q.id)));
+        } catch (e) {
+          return send(422, { error: e.message });
+        }
+      }
+
       if (body.scheduled_at) {
         const at = Date.parse(body.scheduled_at);
         if (!Number.isFinite(at) || at < Date.now() + 60_000) {
@@ -1707,7 +1766,12 @@ function instanceConfig() {
       image_size_limit: 10 * 1024 * 1024, video_size_limit: 40 * 1024 * 1024,
       image_matrix_limit: 16777216, video_matrix_limit: 2304000,
     },
-    polls: { max_options: 0 },
+    polls: {
+      max_options: POLL_MAX_OPTIONS,
+      max_characters_per_option: POLL_MAX_OPTION_CHARS,
+      min_expiration: POLL_MIN_SECONDS,
+      max_expiration: POLL_MAX_SECONDS,
+    },
     accounts: { max_featured_tags: 0 },
   };
 }
@@ -1865,7 +1929,17 @@ function readBody(req) {
       const ct = String(req.headers['content-type'] || '');
       try {
         if (ct.includes('application/json')) return resolve(data ? JSON.parse(data) : {});
-        resolve(Object.fromEntries(new URLSearchParams(data)));
+        // A form-encoded list is the same key repeated, spelled with a
+        // trailing `[]`. Reading it as a plain object kept only the last one,
+        // so a client sending its poll or its media that way lost all but the
+        // final value. Only the `[]` keys become lists: everything else keeps
+        // the single value the rest of this file reads.
+        const form = new URLSearchParams(data);
+        const out = {};
+        for (const key of new Set(form.keys())) {
+          out[key] = key.endsWith('[]') ? form.getAll(key) : form.get(key);
+        }
+        resolve(out);
       } catch (e) { reject(e); }
     });
     req.on('error', reject);

package/lib/polls.mjs

@@ -0,0 +1,105 @@
+// polls.mjs — the count behind a Question.
+//
+// A poll travels as a Question whose options live in `oneOf` (pick one) or
+// `anyOf` (pick several). A vote is not a special activity: it arrives as an
+// ordinary reply carrying the option's `name` and no content. So the fediverse
+// carries the votes and the author's server keeps the count — which means when
+// the poll is ours, the roster of who chose what is ours to hold.
+//
+// Everything here is pure. The roster is a plain object the caller stores and
+// hands back; the tallies are always DERIVED from it rather than kept beside
+// it, so a count cannot drift away from the votes it is meant to summarize.
+
+import crypto from 'node:crypto';
+
+/** Where the roster lives in agent state. */
+export const VOTES_DOC = 'poll-votes.json';
+
+// What a poll may be. These are Mastodon's own limits, and they are the ones
+// clients read out of the instance document to draw their poll composer, so a
+// number we chose differently would be a number the composer then lets someone
+// exceed. They live here rather than beside the client API because every way
+// in has to honour them: an option is matched BY NAME when the vote comes
+// back, so a long title is one something else in the network may truncate and
+// hand back unrecognizable.
+export const MAX_OPTIONS = 4;
+export const MAX_OPTION_CHARS = 50;
+export const MIN_SECONDS = 5 * 60;
+export const MAX_SECONDS = 2629746;          // a month, as Mastodon counts one
+
+// A voter is recorded as a hash of their actor id rather than the id itself.
+// The roster is rewritten on every vote inside a document we serialize whole,
+// and a poll that travels would otherwise grow a list of everyone who took
+// part. The hash is stable, which is all a duplicate check needs.
+export function voterKey(actor) {
+  return crypto.createHash('sha256').update(String(actor)).digest('hex').slice(0, 16);
+}
+
+/**
+ * Does this note have the shape of a vote? A name, and no content: that is the
+ * whole convention. Anything carrying prose is a reply somebody wrote, and
+ * swallowing it into a tally would lose it.
+ */
+export function isVoteShape(note) {
+  if (!note?.name || typeof note.name !== 'string') return false;
+  const text = String(note.content ?? '').replace(/<[^>]*>/gu, '').trim();
+  return text === '';
+}
+
+/** Which option is this the name of? -1 when it names none of them. */
+export function optionIndex(poll, name) {
+  const opts = poll?.options || [];
+  return opts.findIndex(o => o.title === String(name));
+}
+
+/** Closed outright, or past its end time. */
+export function pollClosed(poll, now = Date.now()) {
+  if (!poll) return false;
+  if (poll.closed) return true;
+  return !!poll.expiresAt && Date.parse(poll.expiresAt) <= now;
+}
+
+/**
+ * Record one choice. Returns the roster to store and whether anything changed
+ * — an unchanged roster must not cost a rewrite of the Question, which is the
+ * one expense a busy poll can run up on the pod.
+ *
+ * A single-choice poll takes the first answer and ignores the rest, which is
+ * how a voter changing their mind is refused rather than counted twice. A
+ * multiple-choice poll unions the answers, because each choice arrives as its
+ * own reply.
+ */
+export function addVote(roster, key, index, { multiple = false } = {}) {
+  const had = roster[key] || [];
+  if (had.length && !multiple) return { roster, changed: false };
+  if (had.includes(index)) return { roster, changed: false };
+  return { roster: { ...roster, [key]: [...had, index] }, changed: true };
+}
+
+/**
+ * The counts, derived. `votes` is answers given, `voters` is people who gave
+ * them — the same number until a poll takes several answers each.
+ */
+export function tallyOf(roster, optionCount) {
+  const counts = new Array(optionCount).fill(0);
+  let voters = 0;
+  for (const picks of Object.values(roster || {})) {
+    let counted = false;
+    for (const i of picks) {
+      if (i >= 0 && i < optionCount) { counts[i]++; counted = true; }
+    }
+    if (counted) voters++;
+  }
+  return { counts, voters, votes: counts.reduce((n, c) => n + c, 0) };
+}
+
+/** The poll record with its counts brought up to date from the roster. */
+export function withTally(poll, roster) {
+  const opts = poll?.options || [];
+  const { counts, voters } = tallyOf(roster, opts.length);
+  return {
+    ...poll,
+    options: opts.map((o, i) => ({ ...o, votes: counts[i] })),
+    votersCount: voters,
+  };
+}

package/lib/publisher.mjs

@@ -7,6 +7,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import * as wire from './wire.mjs';
+import * as polls from './polls.mjs';
 import { USER_AGENT } from './ua.mjs';
 import { HTTP_TIMEOUT_MS } from './safefetch.mjs';
 
@@ -16,6 +17,11 @@ const ACCEPT_AP = 'application/activity+json, application/ld+json; profile="http
 // still gets everything, so a missed call site degrades to the old cost rather
 // than silently publishing nothing.
 const REBUILD_MAX_PER_RUN = 200;
+// How long a poll gathers votes before its Question is rewritten. Every vote
+// changes a number other servers re-read, and rewriting per vote would make a
+// busy poll a steady write stream against the pod. A burst costs one rewrite
+// and one Update instead.
+const POLL_REWRITE_MS = 10_000;
 const ALL_COLLECTIONS = { followers: true, following: true, outbox: true, acls: true,
   pending: true, blocked: true };
 const AGENT_VERSION = JSON.parse(fs.readFileSync(
@@ -48,6 +54,8 @@ export class Publisher {
     this.probeFetch = probeFetch || ((u, i) => this.remote.probe(u, i));
     this.resolveMention = resolveMention;
     this.privateOnPod = privateOnPod;
+    // Per-poll rewrite windows, keyed by question id. See POLL_REWRITE_MS.
+    this.pollTimers = new Map();
     this.log = log;
   }
 
@@ -883,20 +891,13 @@ export class Publisher {
   }
 
   // Compose → wire note on remote pod + RDF truth locally + deliver Create.
-  async publishNote(content, { inReplyTo, attachments, visibility = 'public', spoilerText = null } = {}) {
-    const { urls } = this;
-    const priv = visibility === 'private' || visibility === 'direct';
-    if (priv) {
-      const ready = await this.privateReady();
-      if (ready !== true) throw new Error(ready);
-    }
-    const published = new Date().toISOString();
-    const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
-    // A mention nobody can resolve stays plain text rather than failing the post.
-    // The reply's own text decides who is mentioned: trim a handle out and that
-    // person is not notified, which is what every fediverse client leads people
-    // to expect. A Group named in the parent is the one thing carried forward
-    // regardless — drop it and the group stops carrying the thread.
+  // Who this text mentions, resolved. A mention nobody can resolve stays plain
+  // text rather than failing the post. The text itself decides: trim a handle
+  // out and that person is not notified, which is what every fediverse client
+  // leads people to expect. A Group named in the parent is the one thing
+  // carried forward regardless — drop it and the group stops carrying the
+  // thread.
+  async _mentionsFor(content, inReplyTo) {
     const inText = new Set(wire.mentionsIn(content));
     const carried = inReplyTo
       ? (this.store.getStatuses().find(s => s.noteId === inReplyTo)?.mentions || [])
@@ -910,6 +911,19 @@ export class Publisher {
       if (!inText.has(handle) && doc.type !== 'Group') continue;   // author trimmed them out
       mentions.push({ handle, actor: doc.id, page: doc.url || null, inbox: doc.endpoints?.sharedInbox || doc.inbox });
     }
+    return mentions;
+  }
+
+  async publishNote(content, { inReplyTo, attachments, visibility = 'public', spoilerText = null } = {}) {
+    const { urls } = this;
+    const priv = visibility === 'private' || visibility === 'direct';
+    if (priv) {
+      const ready = await this.privateReady();
+      if (ready !== true) throw new Error(ready);
+    }
+    const published = new Date().toISOString();
+    const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+    const mentions = await this._mentionsFor(content, inReplyTo);
     const note = wire.noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions,
       visibility, summary: spoilerText, container: priv ? urls.privateNotes : urls.notes });
 
@@ -962,6 +976,232 @@ export class Publisher {
     return note;
   }
 
+  // --- polls ---------------------------------------------------------------
+  //
+  // A poll is published as a Question and answered by ordinary replies naming
+  // an option, so the count is ours to keep and ours to republish. The roster
+  // of who chose what lives in agent state (polls.VOTES_DOC); the tallies on
+  // the status row and in the pod document are always derived from it.
+
+  /**
+   * Publish a poll. `options` is a list of choice titles, `multiple` lets a
+   * voter pick more than one, and `expiresAt` is when voting stops.
+   */
+  async publishQuestion(content, { options = [], multiple = false, expiresAt = null,
+    inReplyTo = undefined, visibility = 'public', spoilerText = null } = {}) {
+    const { urls } = this;
+    const priv = visibility === 'private' || visibility === 'direct';
+    if (priv) {
+      const ready = await this.privateReady();
+      if (ready !== true) throw new Error(ready);
+    }
+    const titles = [].concat(options).map(o => String(o ?? '').trim()).filter(Boolean);
+    if (titles.length < 2) throw new Error('a poll needs at least two options');
+    // Options are matched BY NAME when a vote arrives — that is the whole of
+    // the convention — so two options reading the same are one option that
+    // cannot be told apart.
+    if (new Set(titles).size !== titles.length) throw new Error('a poll’s options must differ from one another');
+    // Bounded here as well as at the client API, because the outbox is a
+    // second way in and an unbounded poll is a document a stranger sizes.
+    if (titles.length > polls.MAX_OPTIONS) throw new Error(`a poll takes at most ${polls.MAX_OPTIONS} options`);
+    if (titles.some(t => t.length > polls.MAX_OPTION_CHARS)) {
+      throw new Error(`a poll option is at most ${polls.MAX_OPTION_CHARS} characters`);
+    }
+    if (expiresAt) {
+      const ends = Date.parse(expiresAt);
+      if (!Number.isFinite(ends)) throw new Error('the closing time is not a date');
+      const seconds = (ends - Date.now()) / 1000;
+      if (seconds < polls.MIN_SECONDS || seconds > polls.MAX_SECONDS) {
+        throw new Error(`a poll runs between ${polls.MIN_SECONDS} and ${polls.MAX_SECONDS} seconds`);
+      }
+    }
+
+    const published = new Date().toISOString();
+    const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+    const mentions = await this._mentionsFor(content, inReplyTo);
+    const poll = {
+      multiple: !!multiple,
+      expiresAt: expiresAt || null,
+      closed: null,
+      options: titles.map(title => ({ title, votes: 0 })),
+      votersCount: 0,
+      // Resolved once, here: a tally rewrite must not cost a webfinger lookup
+      // per vote for people the poll named.
+      mentionInboxes: [...new Set(mentions.map(m => m.inbox).filter(Boolean))],
+    };
+    const question = wire.questionDoc({
+      urls, slug, content, published, inReplyTo, attachments: [], mentions,
+      visibility, summary: spoilerText,
+      container: priv ? urls.privateNotes : urls.notes,
+      options: poll.options, multiple: poll.multiple, endTime: poll.expiresAt, votersCount: 0,
+    });
+
+    await this.remote.putJson(question.id, question);
+    // Empty, but present: a dangling `replies` that 404s is worse than none.
+    await this.remote.putJson(wire.repliesId(question.id), wire.collection(wire.repliesId(question.id), []));
+    if (!priv) await this.recordOutbox(question.id);
+    await this.local.writeNote('posts', slug, {
+      noteId: question.id, actor: urls.actor, published, content: question.content,
+      inReplyTo, attachments: [],
+    });
+    this.store.addStatus({
+      noteId: question.id, actor: urls.actor, content: question.content, published,
+      kind: 'post', slug, text: content, visibility, poll, inReplyTo,
+      ...(spoilerText ? { spoiler: spoilerText } : {}),
+      ...(question.tag?.length ? { mentions: question.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
+    });
+
+    const create = this._pollActivity('Create', question, wire.createActivityId(question.id));
+    await this.remote.putJson(create.id, create);
+    const contacts = this.store.getContacts();
+    const inboxes = [...new Set([
+      ...(visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
+      ...poll.mentionInboxes,
+    ].filter(Boolean))];
+    await this.deliverer.deliverToAll(inboxes, create);
+    this.log(`poll published: ${question.id} (${titles.length} options) → ${inboxes.length} inbox(es)`);
+    return question;
+  }
+
+  // The Create or Update carrying a Question. The context is hoisted onto the
+  // activity and the embedded object keeps none: a nested @context is legal
+  // JSON-LD but not every server reads one, and votersCount is declared there.
+  _pollActivity(type, question, id) {
+    const { '@context': ctx, ...object } = question;
+    return {
+      '@context': ctx, id, type,
+      actor: this.urls.actor,
+      published: question.published,
+      to: question.to, cc: question.cc,
+      object,
+    };
+  }
+
+  /**
+   * One vote on one of OUR polls, named by the option's title. Returns true
+   * when it counted — a second answer to a single-choice poll, an option we do
+   * not offer, or a poll that has closed all count for nothing.
+   */
+  async recordVote(questionId, actor, optionName) {
+    const s = this.store.getStatuses().find(x => x.noteId === questionId);
+    if (!s?.poll || s.kind !== 'post' || s.actor !== this.urls.actor) return false;
+    if (polls.pollClosed(s.poll)) return false;
+    const index = polls.optionIndex(s.poll, optionName);
+    if (index < 0) return false;
+    const all = this.store.read(polls.VOTES_DOC, {});
+    const { roster, changed } = polls.addVote(all[questionId] || {}, polls.voterKey(actor), index,
+      { multiple: !!s.poll.multiple });
+    if (!changed) return false;
+    this.store.write(polls.VOTES_DOC, { ...all, [questionId]: roster });
+    this.store.updateStatus(questionId, { poll: polls.withTally(s.poll, roster) });
+    this._pollDirty(questionId);
+    return true;
+  }
+
+  // Open the rewrite window for a poll whose count moved. Already open is
+  // already enough: the whole point is that a burst costs one rewrite.
+  _pollDirty(questionId) {
+    if (this.pollTimers.has(questionId)) return;
+    const t = setTimeout(() => {
+      this.pollTimers.delete(questionId);
+      this.republishPoll(questionId).catch(e => this.log(`poll rewrite: ${e.message}`));
+    }, POLL_REWRITE_MS);
+    t.unref?.();
+    this.pollTimers.set(questionId, t);
+  }
+
+  /**
+   * Write the poll's current count back to the pod and tell everyone who has
+   * it. `closing` stamps it shut, which is a one-way door.
+   */
+  async republishPoll(questionId, { closing = null } = {}) {
+    const s = this.store.getStatuses().find(x => x.noteId === questionId);
+    if (!s?.poll) return null;
+    const { urls } = this;
+    const roster = this.store.read(polls.VOTES_DOC, {})[questionId] || {};
+    // A shut poll whose roster has been retired keeps the counts on its row:
+    // deriving them from an empty roster would publish a poll nobody voted in.
+    const shut = closing || s.poll.closed;
+    const counted = shut && !Object.keys(roster).length ? s.poll : polls.withTally(s.poll, roster);
+    const poll = { ...counted, ...(closing ? { closed: closing } : {}) };
+    const container = String(s.noteId).startsWith(urls.privateNotes) ? urls.privateNotes : urls.notes;
+    const slug = s.slug || String(s.noteId).slice(container.length);
+    const mentions = (s.mentions || []).map(m => ({
+      handle: String(m.name || '').replace(/^@/, ''), actor: m.href, page: null, inbox: null,
+    }));
+    const question = wire.questionDoc({
+      urls, slug, content: s.text ?? '', published: s.published, inReplyTo: s.inReplyTo,
+      attachments: [], mentions,
+      visibility: s.visibility || 'public', summary: s.spoiler || null, container,
+      options: poll.options, multiple: !!poll.multiple, endTime: poll.expiresAt,
+      closed: poll.closed, votersCount: poll.votersCount || 0,
+    });
+    await this.remote.putJson(question.id, question);
+    // The Create is overwritten too, so a group's Announce resolves to the
+    // current count rather than to the one the poll opened with.
+    await this.remote.putJson(wire.createActivityId(question.id),
+      this._pollActivity('Create', question, wire.createActivityId(question.id)));
+    this.store.updateStatus(questionId, { poll });
+
+    // Not `updated`: a changed count is not an edit, and stamping one would
+    // have every client show the poll as edited each time somebody voted.
+    //
+    // The Update is named after the STATE it carries rather than the moment it
+    // was sent. A clock only tells two rewrites apart when they fall in
+    // different milliseconds, and a receiving server that has seen an activity
+    // id drops the next one wearing it — which would quietly freeze the count.
+    // Naming the state means an id changes exactly when there is something new
+    // to say, and two sends of the same numbers are the duplicate they look
+    // like.
+    const stamp = crypto.createHash('sha256').update(JSON.stringify([
+      poll.options.map(o => o.votes || 0), poll.votersCount || 0, poll.closed || '',
+    ])).digest('hex').slice(0, 12);
+    const update = this._pollActivity('Update', question, `${question.id}#poll-${stamp}`);
+    const contacts = this.store.getContacts();
+    const inboxes = [...new Set([
+      ...(s.visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
+      ...(s.poll.mentionInboxes || []),
+    ].filter(Boolean))];
+    await this.deliverer.deliverToAll(inboxes, update);
+    this.log(`poll ${closing ? 'closed' : 'count published'}: ${question.id} → ${inboxes.length} inbox(es)`);
+    return poll;
+  }
+
+  /**
+   * Shut any poll whose time is up. Called from the agent's sweep. Closing is
+   * recorded BEFORE the republish, so a failed republish cannot leave a poll
+   * open and collecting votes it has already refused.
+   */
+  async closeDuePolls(now = Date.now()) {
+    const due = this.store.getStatuses().filter(s => s.kind === 'post' && s.poll
+      && !s.poll.closed && s.poll.expiresAt && Date.parse(s.poll.expiresAt) <= now);
+    for (const s of due) {
+      const closed = new Date(Math.min(now, Date.parse(s.poll.expiresAt) || now)).toISOString();
+      clearTimeout(this.pollTimers.get(s.noteId));
+      this.pollTimers.delete(s.noteId);
+      this.store.updateStatus(s.noteId, { poll: { ...s.poll, closed } });
+      const done = await this.republishPoll(s.noteId, { closing: closed })
+        .catch(e => { this.log(`poll close ${s.noteId}: ${e.message}`); return null; });
+      // The roster only ever answered one question — has this person already
+      // voted — and a shut poll has stopped asking it. Dropping it keeps a
+      // document we serialize whole from carrying every poll's voters forever.
+      if (done) {
+        const all = this.store.read(polls.VOTES_DOC, {});
+        if (all[s.noteId]) {
+          delete all[s.noteId];
+          this.store.write(polls.VOTES_DOC, all);
+        }
+      }
+    }
+    return due.length;
+  }
+
+  /** Stop the pending rewrite windows. Called at shutdown. */
+  stopPolls() {
+    for (const t of this.pollTimers.values()) clearTimeout(t);
+    this.pollTimers.clear();
+  }
+
   // The pinned posts, as the actor's featured collection — the one document a
   // remote server reads when it shows this profile's pins.
   async publishFeatured() {

package/lib/social.mjs

@@ -317,6 +317,8 @@ export async function votePoll(agent, s, choices) {
     return { ok: false, error: 'this poll has closed' };
   }
   if (poll.voted) return { ok: false, error: 'already voted' };
+  // Your own poll is the one you are counting, not one you are answering.
+  if (s.actor === urls.actor) return { ok: false, error: 'this is your own poll' };
   const picks = [...new Set(choices)].filter(i => i >= 0 && i < opts.length);
   if (!picks.length) return { ok: false, error: 'invalid choice' };
   if (!poll.multiple && picks.length > 1) return { ok: false, error: 'this poll takes one choice' };

package/lib/wire.mjs

@@ -660,6 +660,45 @@ export function noteDoc({ urls, slug, content, published, inReplyTo, attachments
   return note;
 }
 
+// A poll is a note that asks something: the same addressing, the same
+// mentions, the same replies collection, with the choices in `oneOf` (pick
+// one) or `anyOf` (pick several). Each choice carries the count as the
+// totalItems of its own replies collection, which is where every server that
+// shows a poll reads it from.
+//
+// `endTime` is when voting stops and `closed` is the stamp saying it has —
+// both plain AS2. `votersCount` is Mastodon's: PEOPLE rather than answers,
+// which differ only once a poll takes several answers each. It is not in the
+// base context, so it is declared inline exactly as Mastodon declares it, and
+// only when we actually carry it.
+export function questionDoc({ options = [], multiple = false, endTime = null,
+  closed = null, votersCount = null, ...rest }) {
+  const note = noteDoc(rest);
+  const choices = options.map(o => ({
+    type: 'Note',
+    name: String(o.title),
+    replies: { type: 'Collection', totalItems: Number(o.votes) || 0 },
+  }));
+  const question = {
+    ...note,
+    type: 'Question',
+    [multiple ? 'anyOf' : 'oneOf']: choices,
+  };
+  if (endTime) question.endTime = endTime;
+  if (closed) question.closed = closed;
+  if (votersCount !== null && votersCount !== undefined) {
+    question['@context'] = [AS_CTX, {
+      toot: 'http://joinmastodon.org/ns#',
+      votersCount: {
+        '@id': 'toot:votersCount',
+        '@type': 'http://www.w3.org/2001/XMLSchema#nonNegativeInteger',
+      },
+    }];
+    question.votersCount = votersCount;
+  }
+  return question;
+}
+
 // The id is a document of its own, not `note.id + '#create'`. A group wraps this
 // whole activity in its Announce (FEP-1b12), and the receiver resolves it by
 // dereferencing this id — a fragment would just serve the Note back under a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs

@@ -324,6 +324,7 @@ export class Agent {
     this.deliverer?.stop();
     this.tagfeed?.stop();
     clearInterval(this.schedTimer);
+    this.publisher?.stopPolls();
     this.deliverer = new Deliverer({
       store: this.store, rsaPrivate: keys.rsaPrivate, keyId: this.urls.actor + '#main-key',
       actorId: this.urls.actor, edPrivate: keys.edPrivate,
@@ -547,6 +548,10 @@ export class Agent {
         }).then(() => this.log(`scheduled post published (${e.id})`))
           .catch(err => this.log(`scheduled post ${e.id} failed: ${err.message} — dropped`));
       }
+      // A poll whose time is up is shut on the same sweep: it stops taking
+      // answers here, and everyone holding it is told once.
+      this.publisher.closeDuePolls()
+        .catch(err => this.log(`closing polls: ${err.message}`));
     }, 30_000);
     this.schedTimer.unref();
     // A CSV import interrupted by a restart or a handoff picks back up here.
@@ -651,6 +656,7 @@ export class Agent {
     this.deliverer?.stop();
     this.importer?.stop();
     clearInterval(this.schedTimer);
+    this.publisher?.stopPolls();
     // The lease too: standing down means standing down. Left renewing, a viewer
     // keeps writing to the pod on the active agent's behalf and can win the
     // lease back on a conditional PUT it had no business making.