fedipod 1.29.2 → 1.32.0

package/README.md

@@ -72,7 +72,7 @@ client-to-server, dokieli for one, can post as you. It sends to the outbox
 address in your actor document, which your WebID profile also names, signed in
 at your pod. The post goes out the next time you open fedipod.net.
 
-**The manage page.** `manage account` in the bar opens it: your profile,
+**The manage page.** `manage`, in the bar's account group, opens it: your profile,
 aliases, the gateway, key rotation, recovering posts, parking, moving to
 another server, retiring, and clearing a backlog. It is the same interface
 the DeviceAgent has, described in [the admin interface](gui.md).

package/device-agent.md

@@ -10,18 +10,25 @@ connect to it; and it can host a [group](groups.md).
 ## Requirements
 
 - Node 20 or newer.
-<!-- CLAUDE 2026-09-23 — any pod; delete these markers when done -->
 - A Solid pod, such as `https://alice.solidcommunity.net/` or
   `https://server.example/alice/`. The address is `@handle@yourpod`, or
   `@handle@fedipod.net` when the pod is on a path of a shared host, since
   the shared host cannot answer for the handle; the posts, key and data
   stay on the pod either way.
-<!-- /CLAUDE -->
 - Followers-only and direct posts need a pod that enforces WAC access control;
   on one that does not, the composer refuses those two and says why.
 - While the agent is off, your mail waits on your pod's host. Run it as a
   service, or attach to a gateway, so it does not pile up there.
 
+Moving in from another gateway: a pod that already holds an account whose
+address lives at a gateway (a browser account at fedipod.net, say) can be set
+up here with an address at a different gateway, and the account moves rather
+than being refused. Setup keeps the account's state and key on the pod,
+attaches at the new gateway, publishes the new address with the old one as an
+alias, tells the old gateway, and sends a Move to every follower from the old
+address. The old gateway then serves the old actor as a stub saying where it
+went. An address on the pod itself has nothing to move; it is a sign-in.
+
 ## Installing
 
 ```

package/gateway.md

@@ -120,7 +120,6 @@ not a note, an annotation say, is kept as the app sent it, under your name.
 
 ## Moving to another gateway
 
-<!-- CLAUDE 2026-09-23 — new in 1.29.0, browser build; delete these markers when done -->
 An address that lives at a gateway, `@you@gateway-a`, can move to another
 one and keep its pod, its posts, its followers and its key. Open the new
 gateway, choose **create an account**, and sign in with the same pod. The
@@ -147,9 +146,49 @@ What happens then, in order:
 The old gateway keeps the stub for as long as its row stands; the owner can
 remove the row from the roster later. An address on the pod, `@you@yourpod`,
 needs none of this: it detaches from one mail door and attaches to another.
-Only the browser build moves in this way for now; the DeviceAgent's setup
-does not yet read a pod that already holds an account.
-<!-- /CLAUDE -->
+
+A DeviceAgent moves the same way: set it up with the pod you already have
+and an address at the new gateway (`--address front`, or "At the gateway"
+on the setup page). Setup reads the account on the pod, keeps its state and
+key there, attaches at the new gateway, and completes the move when the
+agent first acts. See [the DeviceAgent](device-agent.md).
+
+## Accounts that go quiet
+
+A gateway holds no mail. Every delivery it accepts is written into your pod
+inbox, and your agent reads it from there. A BrowserAgent reads only while
+its page is open, so an account nobody opens grows on its pod without limit
+and comes back to a drain of everything at once. fedipod.net keeps two facts
+about each browser account — when its owner last signed in or posted, and
+how much content has arrived since — and acts on them.
+
+**Paused.** After about 5,000 posts, replies, likes, boosts and edits since
+you were last here, or when you say so on the manage page, the door accepts
+content and discards it. Follows, unfollows, account moves, deletions and
+blocks still reach your pod. Signing in ends an automatic pause by itself; a
+pause you set lasts until you lift it.
+
+**Closed.** After six months without a sign-in, or when you say so on the
+manage page, the address is closed for good: its handle, its actor and its
+door answer 410 Gone, other servers drop the account the next time they look,
+and nobody can take the name. Nothing on your pod is touched. An address that
+had already moved to another gateway keeps answering as moved.
+
+Only accounts opened from a browser are counted. A DeviceAgent behind the
+gateway drains its own inbox as it runs, and is never paused or closed by
+time. Accounts from before this was built are counted from their next
+sign-in. A gateway operator sets the cap and the window with
+`FEDIPOD_PAUSE_ITEMS` and `FEDIPOD_CLOSE_DAYS`.
+
+## Notices
+
+Whoever runs the gateway can write notices to everyone with an account
+there. A bell at the right end of the bar, on the record page and in the
+client, shows how many this browser has not opened yet; the list gives the
+titles and each one opens on its own. The operator writes, changes and
+removes them at `/notices`, signed in as the admin the way the roster is.
+A notice is a title and plain text: a blank line starts a paragraph, and a
+web address becomes a link.
 
 ## What the gateway can see
 

package/gui.md

@@ -1,11 +1,11 @@
 # The Admin interface
 
-In the browser version at fedipod.net, `manage account` in the bar opens this
+In the browser version at fedipod.net, `manage`, in the bar's account group, opens this
 same page for your account. The rest of this page describes it as the
 DeviceAgent serves it; the controls are the same, minus the manual inbox
 drain and the local log, which a browser does not have.
 
-Open `https://localhost:8030/` while any agent is running — it forwards you to the agent — then choose `manage account` and select the actor you want from the local actors dropdown.
+Open `https://localhost:8030/` while any agent is running — it forwards you to the agent — then choose `manage` in the bar's account group and select the actor you want from the local actors dropdown.
 Picking an actor marked "(stopped)" starts its agent, then opens its page.
 
 The software row names the version the agent is running. When the copy on the machine is further ahead — after an update, or after pulling a checkout — it says so and asks for a restart, because an agent goes on serving the code it started with until it is restarted.

package/lib/core/publisher/index.mjs

@@ -106,6 +106,9 @@ export class Publisher {
       image: this.config.image || null, fields: this.config.fields || [],
       webId: this.remote.webId || null,
       aliases: this.config.aliases || [],
+      // A group says whether only its moderators may open posts (Lemmy's
+      // term); a person's actor carries nothing of the kind.
+      postingRestrictedToMods: this.config.kind === 'group' ? !!this.config.postingRestrictedToMods : null,
       moderators,
       pendingFollowers: priv ? urls.pendingFollowers : null,
       pendingFollowing: priv ? urls.pendingFollowing : null,

package/lib/core/wire.mjs

@@ -3,6 +3,10 @@
 // protocol documents, not our RDF.
 
 export const AS_CTX = 'https://www.w3.org/ns/activitystreams';
+// Lemmy's own context, held locally (lib/core/contexts/join-lemmy.json). It
+// names the three terms a Lemmy reader looks for on a community and its
+// posts: postingRestrictedToMods, stickied, commentsEnabled.
+export const LEMMY_CTX = 'https://join-lemmy.org/context.json';
 export const SEC_CTX = 'https://w3id.org/security/v1';
 export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 
@@ -80,7 +84,8 @@ export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
 export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
   webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
-  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null }) {
+  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null,
+  postingRestrictedToMods = null }) {
   // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
   // inline exactly as Mastodon declares it — and only when we actually use it.
   // It is what makes a client show "Request to follow" rather than "Follow" and
@@ -118,6 +123,9 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
   // old accounts elsewhere whose servers check for their own URL here before
   // they will send a Move. Declared inline exactly as Mastodon declares it.
   if (webId || aliases.length) context.push({ alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' } });
+  // A community says whether only its moderators may open posts in it, in
+  // Lemmy's term, declared through Lemmy's context. Groups only.
+  if (kind === 'group' && postingRestrictedToMods !== null) context.push(LEMMY_CTX);
   if (fields.length) {
     context.push({ schema: 'http://schema.org#', PropertyValue: 'schema:PropertyValue', value: 'schema:value' });
   }
@@ -134,6 +142,7 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
     }] } : {}),
     ...(movedTo ? { movedTo } : {}),
     ...(webId || aliases.length ? { alsoKnownAs: [...(webId ? [webId] : []), ...aliases] } : {}),
+    ...(kind === 'group' && postingRestrictedToMods !== null ? { postingRestrictedToMods: !!postingRestrictedToMods } : {}),
     preferredUsername: handle,
     name: name || handle,
     // The bio, and the avatar. For a group, `summary` is where what the group

package/lib/device/cli/commands/setup.mjs

@@ -52,8 +52,12 @@ if (!newAccount) {
   const { resourceExists } = await import(new URL('../../../../lib/pod/root.mjs', import.meta.url));
   const { apUrls, DEFAULT_ROOT: DR } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
   if (await resourceExists(fetch, apUrls(pod, DR).actor)) {
-    console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
-    process.exit(2);
+    if (String(flag('address') || 'pod').toLowerCase() !== 'front') {
+      console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      console.error('To move an account whose address is at another gateway to this one, add --address front.');
+      process.exit(2);
+    }
+    console.log('The pod already holds an account; if its address is at another gateway, setup moves it here.');
   }
 }
 

package/lib/device/gateway-move.mjs

@@ -0,0 +1,58 @@
+// gateway-move.mjs — the second half of a DeviceAgent moving an address from
+// one gateway to another (lib/device/setup.mjs does the first, when a pod
+// that already holds an account at another gateway is set up with an address
+// at this one). The browser build has the same two halves in
+// web/app/gateway-move.mjs; this is the Node one, which signs and delivers
+// itself instead of going through a relay.
+//
+//   1. The old gateway is told the address moved (POST /api/move, proved with
+//      the pod session as attach was). From then on it serves the old actor
+//      as a moved stub — same key, old id, `movedTo` the new one.
+//   2. A Move goes to every follower, FROM the old actor, signed under the
+//      old key id: the only signature a follower's server can verify against
+//      the old actor. Same key material; only the key id differs.
+//
+// Runs when the agent starts acting, and is safe to run again: a move left
+// pending (the old gateway unreachable) is tried at the next start.
+import { Deliverer } from '../core/deliver.mjs';
+import { moveActivity } from '../core/wire.mjs';
+
+export async function completeGatewayMove(agent, { makeDeliverer = (o) => new Deliverer(o) } = {}) {
+  const cfg = agent.store.getConfig();
+  const mv = cfg?.movedFrom;
+  if (!mv || mv.completedAt) return null;
+  const log = agent.log || (() => {});
+  const newActor = agent.urls.actor;
+
+  // 1. the old gateway
+  let told;
+  try {
+    told = await agent.remote.session.fetch(`${mv.gateway}/api/move`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ handle: mv.handle, movedTo: newActor }),
+    });
+  } catch (e) { told = { status: 0, statusText: e.message }; }
+  if (told.status !== 200) {
+    log(`gateway move: ${mv.gateway} did not mark @${mv.handle} as moved (${told.status || told.statusText}) — will retry at the next start`);
+    return { told: false };
+  }
+
+  // 2. the Move, from the old address
+  const contacts = agent.store.getContacts();
+  const inboxes = [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  const activity = moveActivity({ actor: mv.actor }, newActor, Date.now());
+  const sender = makeDeliverer({
+    store: agent.store, rsaPrivate: agent.deliverer.rsaPrivate,
+    keyId: `${mv.actor}#main-key`, actorId: mv.actor, log, passive: true,
+  });
+  let sent = 0; let failed = 0;
+  for (const inbox of inboxes) {
+    try { await sender.deliverNow(inbox, activity); sent++; }
+    catch (e) { failed++; log(`gateway move: Move to ${inbox} failed: ${e.message}`); }
+  }
+  const done = { ...mv, completedAt: new Date().toISOString(), moveSent: sent, moveFailed: failed };
+  agent.store.setConfig({ ...agent.store.getConfig(), movedFrom: done });
+  await agent.store.flush?.();
+  log(`moved from ${mv.actor} to ${newActor}: Move sent to ${sent} inbox(es)${failed ? `, ${failed} failed` : ''}`);
+  return done;
+}

package/lib/device/migrate.mjs

@@ -27,7 +27,9 @@ export const layoutOf = (cred) => Number(cred?.layout) || 0;
 // deliberately, with `--private-root`, has said where they want it; a migration
 // that overrode that would be moving data on its own initiative.
 export function needsStateMove(cred) {
-  return !cred?.privateRoot;
+  // `stateOnPod` is a move-in from a browser account (setup.mjs): the state
+  // is on the pod because that is where the account already lives.
+  return !cred?.privateRoot && !cred?.stateOnPod;
 }
 
 export function pendingSteps(cred) {

package/lib/device/setup.mjs

@@ -21,6 +21,7 @@ import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from '../shared/safefetch.mjs';
 import { resourceExists } from '../pod/root.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
+import { completeGatewayMove } from './gateway-move.mjs';
 
 const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
 
@@ -125,6 +126,18 @@ export function frontedAddress({ pod, shape }) {
   return pathPod || shape === 'front';
 }
 
+// The account a pod already holds, read as its owner: the config and the key
+// record in its state container. Both null when there is none, or when the
+// credential is not the owner's. Injected for tests.
+export async function readPodAccount({ home, credential, pod, root, log = () => {} }) {
+  const remote = new RemotePod(credential, { home, log });
+  await remote.warmup?.();
+  const urls = apUrls(pod, root || DEFAULT_ROOT);
+  const config = await remote.getJson(urls.state + 'config.json').catch(() => null);
+  const keys = await remote.getJson(urls.state + 'keys.json').catch(() => null);
+  return { config, keys };
+}
+
 // Take an address at a Gateway: attach the pod to it, fronted, and return the
 // gateway config bootstrap writes and connect reads. The pod session proves
 // the pod — no password reaches the Gateway. Injected for tests.
@@ -231,8 +244,13 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
   // several writes, and that pod is a server somebody runs. `state --to` moves
   // it afterwards; starting on the pod and moving later is strictly worse,
   // because the copy left behind was on the pod the whole time.
-  const privateRoot = answers.privateRoot
+  let privateRoot = answers.privateRoot
     || pathToFileURL(path.join(home, 'private')).href + '/';
+  // A pod that already holds an account at ANOTHER gateway, set up with an
+  // address at this one: not a second account but the same one moving in.
+  // Its state and key are on the pod, and stay there.
+  let movingIn = false;
+  let movedFrom = null;
   // Everything that leaves this function — notes, errors, the log — goes
   // through here. Nothing today echoes a password back, but /setup/progress is
   // polled repeatedly and would re-serve one forever if anything ever did.
@@ -266,10 +284,15 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       // reachable, and no silent 401 later on a pod whose profile is empty.
       const usable = await checkPod(pod);
       if (!usable.ok) throw new Error(usable.error);
-      if (await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor)) {
-        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      const held = await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor);
+      if (held && !frontedAddress({ pod, shape })) {
+        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod. '
+          + 'To move an account whose address is at another gateway to this one, ask for an address at this gateway.');
       }
-      skip('account', 'using the pod you already have');
+      if (held && kind === 'group') throw new Error('The pod already hosts a FediPod account, and a group cannot move between gateways.');
+      movingIn = held;
+      if (movingIn) { privateRoot = null; }
+      skip('account', movingIn ? 'the pod already holds the account — its address moves here' : 'using the pod you already have');
     }
 
     // --- credential: the point of no return, and the durability boundary ---
@@ -295,12 +318,14 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
         remotePod: pod.endsWith('/') ? pod : pod + '/',
         createdAt: new Date().toISOString(),
         ...(root ? { root } : {}),
-        ...(keys === 'pod' ? { keysMode: 'pod' } : {}),
-        // Where the private half lives. Per-machine, like keysMode.
+        ...(keys === 'pod' || movingIn ? { keysMode: 'pod' } : {}),
+        // Where the private half lives. Per-machine, like keysMode. A move-in
+        // keeps it on the pod, where the account already is, and says so.
         ...(privateRoot ? { privateRoot } : {}),
+        ...(movingIn ? { stateOnPod: true } : {}),
         // What shape this install is, so `upgrade` can tell an old one from a
         // new one without guessing from the fields.
-        ...(isCurrent({ privateRoot }) ? { layout: CURRENT_LAYOUT } : {}),
+        ...(isCurrent({ privateRoot, stateOnPod: movingIn }) ? { layout: CURRENT_LAYOUT } : {}),
       };
       fs.mkdirSync(home, { recursive: true, mode: 0o700 });
       writeJsonAtomic(credPath, rec);
@@ -316,6 +341,24 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       done('credential', credPath);
     }
 
+    // --- a move-in: the account on the pod, read with the credential just
+    // minted, has to be one whose address lives at another gateway ---
+    if (movingIn) {
+      const cred = JSON.parse(fs.readFileSync(credPath, 'utf8'));
+      const account = await (deps.readPodAccount || readPodAccount)({ home, credential: cred, pod, root: root || DEFAULT_ROOT, log });
+      if (!account?.config) throw new Error('the pod holds an account, but its record could not be read with this credential — is this account the pod\'s owner?');
+      const frontActor = account.config.gateway?.frontActor || null;
+      const gwHost = new URL(gatewayOrigin).host;
+      if (!frontActor) throw new Error('The pod already hosts a FediPod account whose address lives on the pod: nothing to move. Sign in to it instead.');
+      if (new URL(frontActor).host === gwHost) throw new Error(`The pod already hosts a FediPod account at ${gwHost}: sign in to it instead of setting up again.`);
+      if ((account.config.kind || 'person') === 'group') throw new Error('a group cannot move between gateways');
+      if (!account.keys?.rsa || account.keys.ct) {
+        throw new Error(`this account's key is still under a password from an earlier version — sign in once at ${new URL(frontActor).host} first, then set up here`);
+      }
+      movedFrom = { actor: frontActor, gateway: new URL(frontActor).origin, handle: account.config.handle, at: new Date().toISOString() };
+      log(`moving @${account.config.handle}@${new URL(frontActor).host} here, as @${handle}@${gwHost}`);
+    }
+
     // --- take an address at the Gateway, if this pod needs one or asked for
     // one --- before bootstrap, so the config it writes carries the Gateway
     // ids and the key connect mints below is stamped to the Gateway actor from
@@ -346,6 +389,17 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       if (!ready.ok) throw new Error(ready.error);
     }
     await agent.bootstrap({ handle, name: name || handle, root, kind, approveJoins, summary, icon, gateway: gatewayCfg });
+    if (movingIn && movedFrom) {
+      // The old actor becomes an alias, which is what a server checks on the
+      // new actor before it honours a Move; the Move itself is pending until
+      // the new actor is published (completeGatewayMove, below and at every
+      // start). The key stays; its stamp follows the actor.
+      const cfg = agent.store.getConfig() || {};
+      agent.store.setConfig({ ...cfg, aliases: [...new Set([...(cfg.aliases || []), movedFrom.actor])], movedFrom });
+      const keyRec = agent.store.read?.('keys.json', null);
+      if (keyRec?.mintedFor && gatewayCfg?.frontActor) agent.store.write?.('keys.json', { ...keyRec, mintedFor: gatewayCfg.frontActor });
+      await agent.store.flush();
+    }
     done('bootstrap');
 
     begin('connect');
@@ -360,6 +414,12 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     }
     const published = await agent.publisher.publishProfile();
     await agent.store.flush();
+    if (movingIn) {
+      // Tell the old gateway and the followers. Not fatal: left pending, it
+      // is tried again when the agent next starts acting.
+      const moved = await (deps.completeGatewayMove || completeGatewayMove)(agent).catch((e) => { log(`gateway move: ${e.message}`); return null; });
+      if (moved?.completedAt) log(`Move sent from ${movedFrom.actor} to ${moved.moveSent} inbox(es)`);
+    }
     done('publish');
 
     // --- and say plainly whether the world can actually see it ---

package/lib/gateway/front-core.mjs

@@ -21,6 +21,8 @@ import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
+import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer } from './quiet.mjs';
+import { routeNoticesApi } from './notices.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -276,7 +278,7 @@ const sameOriginRequest = (request, origin) => {
 
 // Top-level paths a handle may not take, so a name never shadows a route.
 const RESERVED = new Set(['u', 'api', 'signup', 'new-account', 'run', 'admin', 'roster', 'gateway',
-  'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install']);
+  'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install', 'notices']);
 
 // Why a handle is unusable, or null when it is fine. Lowercase letters, digits
 // and hyphens; 2–30 chars; not edge-hyphenated; not a reserved route.
@@ -332,6 +334,7 @@ function identFor(rec, policy = null) {
 //   listDirectory() -> { handle: record }  every row, for the admin roster
 //   removeDirectory(handle) -> boolean     drop a row; false when a seeded row remains
 //   podPut(url, body, ct) -> boolean      append to a user's pod (per-user cred inside)
+//   readReceived / writeReceived / dropReceived, pauseItems, closeDays — see quiet.mjs
 //   podGet(url, { podHome }) -> Response   read a user's pod (public reads; plain fetch
 //                                          is fine). `podHome` is the row's own pod, for
 //                                          an adapter that reads a store directly and so
@@ -409,14 +412,13 @@ async function route(request, ctx) {
     return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' }, body: ctx.runPage };
   }
 
-  // The roster page: the host reading who has accounts here. The page signs in
-  // and calls the roster API below; a deploy with no admin supplies no page.
-  // Off /admin, which is the owner's own record page on every agent.
-  if (pathname === '/roster') {
-    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
-    if (!ctx.adminPage) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.adminPage };
-  }
+  // The roster page (/roster, off /admin, which is the owner's own record
+  // page on every agent) is served with the notices page, in notices.mjs.
+
+  // Notices from the operator to every account here, and the page they are
+  // written on (notices.mjs).
+  const notices = await routeNoticesApi(request, pathname, ctx, { j, verifyPodToken, publicFor, notFound });
+  if (notices) return notices;
 
   // The roster: every directory row, secrets stripped, for the host's own
   // eyes. The reader proves themself the way attach proves a pod — a
@@ -432,6 +434,7 @@ async function route(request, ctx) {
         handle: r.handle, kind: r.kind || 'person', fronted: !r.inboxOnly,
         podHome: r.podHome, webId: r.webId || null, actorUrl: r.actorUrl,
         address: r.address || `@${r.handle}@${ctx.host}`,
+        openedAt: r.openedAt || null, pausedAt: r.pausedAt || null, closedAt: r.closedAt || null,
       }))
       .sort((a, b) => (a.address || a.handle).localeCompare(b.address || b.handle));
     return j(200, { host: ctx.host, accounts });
@@ -639,6 +642,10 @@ async function route(request, ctx) {
     return withApiCors(j(200, { ok: true, handle, movedTo, movedAt }));
   }
 
+  // The owner's say over an account that goes quiet (quiet.mjs).
+  const quiet = await routeQuietApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod });
+  if (quiet) return quiet;
+
   // The relay: the front sends requests a browser has already signed. A page
   // may not set the Date or Host header, and both are inside an HTTP
   // signature, so a browser-run agent signs and hands the request here; the
@@ -659,6 +666,8 @@ async function route(request, ctx) {
     if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
     const items = Array.isArray(body.requests) ? body.requests : [];
     if (!items.length) return withApiCors(j(400, { error: 'requests must be a non-empty list' }));
+    // Acting through the relay is being here. Hourly at most; see noteOpened.
+    await noteOpened(ctx, handle, rec).catch((e) => console.log(`relay @${handle}: stamp not written: ${e?.message || e}`));
     if (items.length > RELAY_MAX_REQUESTS) return withApiCors(j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` }));
     const results = await Promise.all(items.map((it) => relayOne(it, rec, ctx.fetchImpl || fetch)));
     // One line per relayed request, so a lookup that fails on the far side is
@@ -767,7 +776,7 @@ async function route(request, ctx) {
   //
   // The name is matched against a literal list, so nothing about the request
   // chooses a file.
-  const mPageScript = /^\/(new-account|run|admin)\.js$/u.exec(pathname);
+  const mPageScript = /^\/(new-account|run|admin|notices)\.js$/u.exec(pathname);
   if (mPageScript) {
     const body = ctx.pageScripts?.[`${mPageScript[1]}.js`];
     if (!body) return notFound();
@@ -797,6 +806,9 @@ async function route(request, ctx) {
     if (!m || m[2] !== ctx.host) return notFound();
     const rec = await ctx.lookup(m[1]);
     if (!rec) return notFound();
+    // A closed address is gone, and says so rather than pretending never to
+    // have existed: the name stays taken.
+    if ((await closedState(ctx, m[1], rec)).closed) return closedAnswer({ 'access-control-allow-origin': '*' });
     // A fronted identity's documents live on its pod; the pod's own actor id
     // is the alias, so a client signing in by the fronted address can find
     // the pod (and its login) without a lookup only the host could answer.
@@ -837,19 +849,25 @@ async function route(request, ctx) {
   // An account that moved to another gateway (see /api/move): where its ids
   // live now. The actor below answers as a stub; everything else redirects.
   const movedBase = rec.movedTo ? rec.movedTo.replace(/ap\/actor$/u, '') : null;
-  const gone = (headers = {}) => ({ status: 410, headers: { ...headers, 'content-type': 'application/json', 'cache-control': 'no-store' },
-    body: JSON.stringify({ error: `this account has moved to ${rec.movedTo}` }) });
+  // A closed address (see "accounts that go quiet" above): every id under it
+  // is gone. Asked after moved, which a close does not undo.
+  const closed = movedBase ? false : (await closedState(ctx, up.handle, rec)).closed;
+  const gone = (headers = {}, why = `this account has moved to ${rec.movedTo}`) => closedAnswer(headers, why);
+  const CLOSED = 'this address is closed';
 
   // Inbox: verify at the door, forward to the user's pod inbox. This is the
   // gateway, per user.
   if (up.rest === 'ap/inbox/' || up.rest === 'ap/inbox') {
     if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
     if (movedBase) { console.log(`door @${up.handle}: delivery → 410 (moved)`); return gone(); }
+    if (closed) { console.log(`door @${up.handle}: delivery → 410 (closed)`); return gone({}, CLOSED); }
     const policy = await policyFor(rec, ctx.fetchImpl || fetch);
-    const { status, reason } = await handleDelivery(request, identFor(rec, policy),
-      { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl });
+    const standing = await accountState(ctx, up.handle, rec);
+    const { status, reason, content, bytes } = await handleDelivery(request, identFor(rec, policy),
+      { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl, paused: standing.paused });
     // One line per delivery, so "did it arrive at the door" has an answer.
     console.log(`door @${up.handle}: delivery → ${status} (${reason})`);
+    if (status === 202 && content) await noteReceived(ctx, up.handle, rec, bytes);
     return { status, headers: {}, body: '' };
   }
 
@@ -876,6 +894,7 @@ async function route(request, ctx) {
         'accept-post': 'application/ld+json, application/activity+json' }, body: null };
     }
     if (movedBase && request.method === 'POST') return gone(cors);
+    if (closed && request.method === 'POST') return gone(cors, CLOSED);
     if (movedBase && (request.method === 'GET' || request.method === 'HEAD')) {
       return { status: 301, headers: { ...cors, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
     }
@@ -916,6 +935,7 @@ async function route(request, ctx) {
   if (movedBase && up.rest !== 'ap/actor') {
     return { status: 301, headers: { ...open, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
   }
+  if (closed) return gone(open, CLOSED);
   const podTarget = rec.podHome + up.rest;
   // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
   // the id rewrite below turns media links onto the front like every other

package/lib/gateway/gateway-core.mjs

@@ -19,9 +19,11 @@ import * as inbox from '../pod/inbox.mjs';
 const DEFAULT_MAX_BYTES = 512 * 1024;   // mirror intake.mjs MAX_ITEM_BYTES
 
 // Control activities are the message itself and must always pass — you want
-// Follows from strangers. Only CONTENT is subject to the concerns-us drop.
-const CONTROL = new Set(['Follow', 'Undo', 'Accept', 'Reject', 'Delete', 'Move',
+// Follows from strangers. Only CONTENT is subject to the concerns-us drop,
+// and to a pause: an account nobody is reading still takes its follows.
+export const CONTROL = new Set(['Follow', 'Undo', 'Accept', 'Reject', 'Delete', 'Move',
   'Add', 'Remove', 'Block']);
+export const isControl = (type) => CONTROL.has(type);
 
 const idOf = (v) => (typeof v === 'string' ? v : v?.id) || null;
 const sha256hex = (s) => crypto.createHash('sha256').update(s).digest('hex');
@@ -64,8 +66,13 @@ function concernsUsAtEdge(activity, ident) {
 // resolved identity policy: { inboxUrl, actorUrl, followersUrl, notesPrefix,
 // following, blocklist, kind, gatewayWebId, hmacSecret }. `podPut(url, body,
 // contentType) → boolean` appends to the pod with the gateway's credential.
-// Returns { status, reason } — the adapter turns it into an HTTP response.
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+// `paused` says nobody is reading this inbox: content is accepted and
+// discarded (the same quiet 202 a blocked sender gets, so nothing retries
+// and nothing counts a failure against this host), control still lands.
+// Returns { status, reason } — the adapter turns it into an HTTP response —
+// and, for a delivery that reached the pod, `content` (whether it was
+// content rather than control) and `bytes`, so the caller can keep count.
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false } = {}) {
   // Read the body once from a clone; the original, unconsumed, goes to the
   // verifier (which needs the body for the Digest check).
   let raw;
@@ -80,7 +87,9 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // Edge drops — silent 202 so a rejected sender does not retry a delivery we
   // will never accept. None of these becomes a pod write.
   if (isBlocked(actor, ident.blocklist)) return { status: 202, reason: 'blocked' };
-  if (!CONTROL.has(activity.type) && !concernsUsAtEdge(activity, ident)) {
+  const content = !CONTROL.has(activity.type);
+  if (content && paused) return { status: 202, reason: 'paused' };
+  if (content && !concernsUsAtEdge(activity, ident)) {
     return { status: 202, reason: 'does not concern us' };
   }
 
@@ -107,7 +116,7 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified' };
+  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified', content, bytes: Buffer.byteLength(raw) };
 }
 
 // The outbox door: the owner's own post, taken on their behalf.