fedipod 1.30.0 → 1.32.0

package/web/admin/bar.css

@@ -62,16 +62,32 @@ body { background: var(--surface); }
    quieter than the links; the one in use is marked `aria-current="true"` — the
    current item of a set, which on the record page is not the current PAGE — so
    it needs its own mark rather than borrowing the rule above. */
-#bar #client-pick { display: inline-flex; gap: .6rem; align-items: baseline;
+#bar #client-pick, #bar #account-pick { display: inline-flex; gap: .6rem; align-items: baseline;
   white-space: nowrap; margin-left: 1rem; }
-#bar #client-now { opacity: .75; }
+#bar #client-now, #bar #account-now { opacity: .75; }
+/* The notices bell: the one filled control in the bar, because it is the one
+   thing there that is not a place to go but something to be told. The count is
+   how many notices this browser has not opened yet; with none it is quiet. */
+#bar #bar-notices { display: inline-flex; align-items: center; gap: .35rem; margin-left: 1rem;
+  padding: .3rem .7rem; border-radius: 999px; font-size: 1.05rem; line-height: 1;
+  background: var(--btn); color: var(--btn-text); border: 1px solid var(--btn); }
+/* `display` on an id rule outranks the browser's own [hidden] rule, and the
+   shell has no !important of its own, so the bell hid on the record page and
+   showed on the client with nothing to show. Said here, once, for every page. */
+#bar #bar-notices[hidden] { display: none; }
+#bar #bar-notices:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
+#bar #bar-notices:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+#bar #bar-notices-count { font-size: .9rem; font-weight: 700; min-width: 1.3em; text-align: center;
+  padding: .05rem .4rem; border-radius: 999px; background: var(--btn-text); color: var(--btn); }
+#bar #bar-notices-count:empty { display: none; }
+#bar #bar-notices[data-new="0"] { background: var(--field-bg); color: var(--ink); border-color: var(--field-edge); }
 #bar a[aria-current="true"] {
   font-weight: 700; text-decoration: underline; text-underline-offset: .3rem; }
 
 /* The two-clients notice: said once, to somebody who knew this page when it
    had one client. Sized and placed rather than left to the browser's default,
    which stretched it edge to edge and put it over the very links it names. */
-#client-news {
+#client-news, #notices-list, #notice-view {
   /* Low rather than centred: it points at the links in the bar, so the bar has
      to stay in view while it is read. */
   max-width: 34rem; margin: auto auto 2.5rem; padding: 1.5rem 1.7rem;
@@ -80,13 +96,31 @@ body { background: var(--surface); }
   font: 1rem/1.55 var(--font);
   box-shadow: 0 .6rem 2rem rgba(0, 0, 0, .25);
 }
-#client-news::backdrop { background: rgba(0, 0, 0, .45); }
-#client-news h2 { font-size: 1.25rem; margin: 0 0 .9rem; color: var(--heading); }
-#client-news p { margin: 0 0 1.2rem; }
-#client-news p:last-child { margin: 0; }
-#client-news button {
+#client-news::backdrop, #notices-list::backdrop, #notice-view::backdrop { background: rgba(0, 0, 0, .45); }
+#client-news h2, #notices-list h2, #notice-view h2 { font-size: 1.25rem; margin: 0 0 .9rem; color: var(--heading); }
+#client-news p, #notices-list p, #notice-view p { margin: 0 0 1.2rem; }
+#client-news p:last-child, #notices-list p:last-child, #notice-view p:last-child { margin: 0; }
+#client-news button, #notices-list button, #notice-view button {
   font: inherit; padding: .55rem 1.3rem; border-radius: .35rem; cursor: pointer;
   background: var(--btn); color: var(--btn-text); border: 1px solid var(--btn);
 }
-#client-news button:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
-#client-news button:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+#client-news button:hover, #notices-list button:hover, #notice-view button:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
+#client-news button:focus-visible, #notices-list button:focus-visible, #notice-view button:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+
+/* The notices dialogs are centred and never taller than the window: the
+   client-news rule above sits low, and a short window pushed a list of
+   notices up past the top edge where nothing could reach it. */
+#notices-list, #notice-view { margin: auto; max-height: calc(100dvh - 3rem); overflow: auto; box-sizing: border-box; }
+/* The list of notices: each title a button that opens that notice, the date
+   beside it, the ones not yet opened here in bold. */
+#notices-items { list-style: none; margin: 0 0 1.2rem; padding: 0; }
+#notices-items li { display: flex; gap: .8rem; align-items: baseline; padding: .45rem 0;
+  border-bottom: 1px solid var(--line); }
+#notices-items li:last-child { border-bottom: 0; }
+#notices-items button.notice-open { flex: 1 1 auto; text-align: left; padding: .1rem 0;
+  background: none; border: 0; color: var(--link); text-decoration: underline; text-underline-offset: .2rem; }
+#notices-items li.new button.notice-open { font-weight: 700; }
+#notices-items .when, #notice-view .when { color: var(--sub); font-size: .9rem; white-space: nowrap; }
+#notices-items p.none { color: var(--sub); }
+#notice-view-body p { margin: 0 0 .9rem; }
+#notice-view-body a { color: var(--link); word-break: break-all; }

package/web/admin/client/index.html

@@ -28,8 +28,16 @@ main { flex: 1 1 auto; min-height: 0; display: flex; }
   <h1 class="name">FediPod</h1>
   <select id="actor-pick" aria-label="Local actors"
     title="   Every actor on this machine; choosing one opens its client"></select>
-  <a id="bar-fediverse" href="./" title="   Open the client and read your timeline" aria-current="page">visit account</a>
-  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="./" title="   Open the client and read your timeline" aria-current="page">visit</a>
+  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
 </nav>
 
 <main>
@@ -38,5 +46,24 @@ main { flex: 1 1 auto; min-height: 0; display: flex; }
 
 <script src="../bar.js"></script>
 <script src="client.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="../notices-bar.js"></script>
 </body>
 </html>

package/web/admin/gateway.js

@@ -18,12 +18,31 @@ async function refreshGateway() {
     GATEWAY_WORD.textContent = frontName ? `${host} — publishing as @${frontName}@${host}` : host;
     GW_OPEN_ATTACH.hidden = true;
     GW_OPEN_DETACH.hidden = false;
+    // The account's standing at the gateway — paused, closed. The browser
+    // build's agent reports it; a DeviceAgent's does not, and the pause and
+    // close controls stay hidden.
+    const st = g.standing;
+    const known = !!st && (st.status === 200 || st.status === 410);
+    $('gateway-pause').hidden = !known || !!st.closed || !!st.paused;
+    $('gateway-resume').hidden = !known || !!st.closed || !st.paused;
+    $('gateway-close').hidden = !known || !!st.closed;
+    if (known && st.closed) GATEWAY_WORD.textContent += ' — this address is closed';
+    else if (known && st.paused) GATEWAY_WORD.textContent += st.pausedBy === 'owner' ? ' — paused by you' : ' — paused';
   } else {
     GATEWAY_WORD.textContent = '';
     GW_OPEN_ATTACH.hidden = false;
     GW_OPEN_DETACH.hidden = true;
+    for (const id of ['gateway-pause', 'gateway-resume', 'gateway-close']) $(id).hidden = true;
   }
 }
+const setPausedAtGateway = async (paused) => {
+  const r = await write('/gateway/pause', { paused },
+    paused ? 'paused — posts sent to you are not kept until you resume; follows still arrive'
+      : 'resumed — posts sent to you are kept again');
+  if (r) refreshGateway();
+};
+$('gateway-pause').addEventListener('click', () => setPausedAtGateway(true));
+$('gateway-resume').addEventListener('click', () => setPausedAtGateway(false));
 const gwShape = () => document.querySelector('input[name=gwShape]:checked')?.value || 'pod';
 function gwPreviews() {
   $('gw-pod-preview').textContent = config?.address || `@${config?.handle || 'you'}@your.pod`;

package/web/admin/index.html

@@ -165,7 +165,7 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   fieldset { border-color: #555; } .rows li { border-color: #444; }
 }
 </style>
-<link rel="stylesheet" href="bar.css?v=3">
+<link rel="stylesheet" href="bar.css?v=4">
 <link rel="stylesheet" href="window.css">
 </head>
 <body>
@@ -175,8 +175,16 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   <h1 class="name">FediPod</h1>
   <select id="actor-pick" aria-label="Local actors"
     title="   Every actor on this machine; choosing one goes to its record"></select>
-  <a id="bar-fediverse" href="client/" title="   Open the client and read your timeline">visit account</a>
-  <a id="bar-manage" href="./" title="   The record: what this actor is, and what you can do to it" aria-current="page">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="client/" title="   Open the client and read your timeline">visit</a>
+  <a id="bar-manage" href="./" title="   The record: what this actor is, and what you can do to it" aria-current="page">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
 </nav>
 <main id="page">
 
@@ -321,6 +329,14 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     title="   Attach this account to a mail-filtering gateway">Attach to a gateway</button>
   <button type="button" id="gateway-open-detach" class="inline danger" hidden
     title="   Go back to your pod's own inbox">Detach from gateway</button>
+  <!-- Shown only when the agent reports the account's standing at the gateway
+       (the browser build does; a DeviceAgent's admin does not). -->
+  <button type="button" id="gateway-pause" class="inline" hidden
+    title="   Stop keeping the posts sent to you until you resume; follows still arrive">Pause my account</button>
+  <button type="button" id="gateway-resume" class="inline" hidden
+    title="   Keep the posts sent to you again">Resume my account</button>
+  <button type="button" id="gateway-close" class="inline danger" hidden data-confirm="close-address"
+    title="   Close your address at this gateway for good; nothing on your pod is touched">Close this address</button>
 </span>
 
 <section id="pane-group" hidden>
@@ -516,6 +532,14 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     <label for="confirm-handle">Type the handle to confirm</label>
     <input type="text" id="confirm-handle" autocomplete="off">
   </div>
+  <div id="warn-close-address" class="warn" hidden>
+    <p><strong>This cannot be undone.</strong> Your address at the gateway is closed for good:
+      mail to it is turned away, other servers drop the account the next time they look, and
+      nobody can take the name. Nothing on your pod is touched — your posts, key and data stay
+      where they are.</p>
+    <label for="confirm-handle-close">Type the handle to confirm</label>
+    <input type="text" id="confirm-handle-close" autocomplete="off">
+  </div>
   <!-- "Move private data" (POST /state-move) had a panel here and no way to
        open it: nothing in this page has ever carried data-confirm="move-state",
        so the panel was only ever hidden. Removed 2026-09-09 rather than left as
@@ -556,5 +580,24 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
 <script src="group.js"></script>
 <script src="upkeep.js"></script>
 <script src="gateway.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="notices-bar.js"></script>
 </body>
 </html>

package/web/admin/notices-bar.js

@@ -0,0 +1,90 @@
+// notices-bar.js — the notices bell in the bar, on every page of ours.
+//
+// Whoever runs the site writes notices (the /notices page, admin only); every
+// signed-in account sees the bell. This asks /api/notices once per page load,
+// hides the bell where the site has none to offer (a DeviceAgent's own pages
+// answer no such thing), lists the titles, and opens one notice at a time.
+// Which notices this browser has already opened is this browser's business
+// alone, so it lives in localStorage and nowhere else.
+//
+// Every element here is declared in the page's markup; this fills them.
+(() => {
+  const bell = document.getElementById('bar-notices');
+  const list = document.getElementById('notices-list');
+  const view = document.getElementById('notice-view');
+  if (!bell || !list || !view) return;
+  const $ = (id) => document.getElementById(id);
+  const SEEN = 'fedipod-notices-seen';
+  const readSeen = () => { try { return JSON.parse(localStorage.getItem(SEEN) || '[]'); } catch { return []; } };
+  const writeSeen = (ids) => { try { localStorage.setItem(SEEN, JSON.stringify(ids.slice(-200))); } catch { /* keeps no site data */ } };
+
+  const when = (iso) => { try { return new Date(iso).toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' }); } catch { return ''; } };
+
+  // A notice's body is plain text: paragraphs at blank lines, and a bare
+  // https link becomes a link. Nothing in it is ever read as markup.
+  const renderBody = (el, text) => {
+    el.textContent = '';
+    for (const para of String(text || '').split(/\n\s*\n/u)) {
+      const p = document.createElement('p');
+      for (const part of para.split(/(https?:\/\/[^\s<>"']+)/u)) {
+        if (/^https?:\/\//u.test(part)) {
+          const a = document.createElement('a');
+          a.href = part; a.textContent = part; a.target = '_blank'; a.rel = 'noopener';
+          p.append(a);
+        } else p.append(part);
+      }
+      el.append(p);
+    }
+  };
+
+  let notices = [];
+  const render = () => {
+    const seen = new Set(readSeen());
+    const fresh = notices.filter((n) => !seen.has(n.id)).length;
+    $('bar-notices-count').textContent = fresh ? String(fresh) : '';
+    bell.dataset.new = String(fresh);
+    bell.setAttribute('aria-label', fresh ? `Notices, ${fresh} new` : 'Notices');
+    const ul = $('notices-items');
+    ul.textContent = '';
+    if (!notices.length) {
+      const p = document.createElement('p'); p.className = 'none'; p.textContent = 'No notices.';
+      ul.append(p);
+      return;
+    }
+    for (const n of notices) {
+      const li = document.createElement('li');
+      if (!seen.has(n.id)) li.classList.add('new');
+      const b = document.createElement('button');
+      b.type = 'button'; b.className = 'notice-open'; b.textContent = n.title;
+      b.addEventListener('click', () => open(n));
+      const w = document.createElement('span'); w.className = 'when'; w.textContent = when(n.at);
+      li.append(b, w);
+      ul.append(li);
+    }
+  };
+
+  const open = (n) => {
+    $('notice-view-title').textContent = n.title;
+    $('notice-view-when').textContent = when(n.at);
+    renderBody($('notice-view-body'), n.body);
+    const seen = readSeen();
+    if (!seen.includes(n.id)) { seen.push(n.id); writeSeen(seen); }
+    render();
+    list.close();
+    view.showModal();
+  };
+
+  bell.addEventListener('click', () => { render(); list.showModal(); });
+  $('notices-close').addEventListener('click', () => list.close());
+  $('notice-view-close').addEventListener('click', () => { view.close(); list.showModal(); });
+
+  fetch(location.origin + '/api/notices', { headers: { accept: 'application/json' } })
+    .then((r) => (r.ok ? r.json() : null))
+    .then((j) => {
+      if (!j || !Array.isArray(j.notices)) return;
+      notices = j.notices;
+      render();
+      bell.hidden = false;
+    })
+    .catch(() => { /* no site notices here; the bell stays hidden */ });
+})();

package/web/admin/record.js

@@ -94,6 +94,7 @@ function resetConfirm() {
   for (const k of Object.keys(LIFECYCLE)) $(`warn-${k}`)?.hidden !== undefined && ($(`warn-${k}`).hidden = true);
   $('confirm-handle').value = '';
   $('confirm-handle-move').value = '';
+  $('confirm-handle-close').value = '';
   $('move-target').value = '';
 }
 function closePanels(keep = null) {

package/web/admin/setup/index.html

@@ -59,8 +59,16 @@ button:disabled { opacity: .5; cursor: default; }
 <nav id="bar" aria-label="Site">
   <h1 class="name">FediPod</h1>
   <span id="bar-handle"></span>
-  <a id="bar-fediverse" href="../client/" title="   Open the client and read your timeline">visit account</a>
-  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="../client/" title="   Open the client and read your timeline">visit</a>
+  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
   <a id="bar-add" href="../?new=1" title="   Set up another actor on this machine, with its own pod" aria-current="page">add new account</a>
 </nav>
 <main id="page">
@@ -210,5 +218,24 @@ button:disabled { opacity: .5; cursor: default; }
 <script src="../bar.js"></script>
 <script src="../common.js"></script>
 <script src="setup.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="../notices-bar.js"></script>
 </body>
 </html>

package/web/admin/upkeep.js

@@ -76,6 +76,9 @@ const LIFECYCLE = {
   retire: { path: '/retire', title: 'Retire this identity', go: 'Retire it', danger: true, done: (r) => `retired ${r.deletedAt}: Delete delivered to ${r.inboxes} inbox(es)` },
   move: { path: '/move', title: 'Transfer this account away', go: 'Transfer it', focus: 'move-target',
     done: (r) => `transferred to ${r.target}: Move delivered to ${r.inboxes} inbox(es), unfollowed ${r.unfollowed}/${r.following}` },
+  // The address at the gateway, not the identity: the pod keeps everything.
+  'close-address': { path: '/gateway/close', title: 'Close this address', go: 'Close it', danger: true, focus: 'confirm-handle-close',
+    done: (r) => (r.closed ? 'closed — this address is gone for good; everything on your pod is untouched' : 'not closed') },
 };
 let pending = null;
 
@@ -119,7 +122,8 @@ $('confirm-form').addEventListener('submit', async (ev) => {
   const what = pending;
   const body = what === 'retire' ? { confirm: $('confirm-handle').value.trim() }
     : what === 'move' ? { target: $('move-target').value.trim(), confirm: $('confirm-handle-move').value.trim() }
-      : {};
+      : what === 'close-address' ? { confirm: $('confirm-handle-close').value.trim() }
+        : {};
   if (what === 'move' && !body.target) { say('name the account to transfer to', 'err'); return; }
   $('confirm-go').disabled = true;
   say(`${what} — this talks to the pod and to other servers, so it takes a moment`);

package/web/app/admin-facade.mjs

@@ -33,6 +33,7 @@ export const ADMIN_PATHS = new Set([
   '/deadletter', '/blocks', '/profiles', '/modqueue', '/log', '/fediacct', '/describe', '/follow',
   '/atproto', '/atproto/connect', '/atproto/disconnect',
   '/rebuild', '/move', '/retire', '/inbox/prune', '/park', '/revive', '/takeover',
+  '/gateway/pause', '/gateway/close',
   '/fediacct/connect', '/fediacct/disconnect', '/fediacct/callback',
 ]);
 
@@ -138,6 +139,10 @@ export class AdminFacade {
             configured: !!(g && g.url), url: g?.url || null, webId: g?.webId || null,
             frontActor: g?.frontActor || null, mode: g?.mode || 'off', hasSecret: !!g?.hmacSecret,
             stats: a.store.read('gateway-stats.json', { verified: 0, unverified: 0, lastAt: null }),
+            // The account's standing at the gateway — paused, closed — as the
+            // gateway last said it (agent.mjs tellGateway). The record page
+            // shows its pause and close controls only when this is here.
+            standing: a.gatewayStanding || null,
           });
         }
         case '/deadletter': return json(200, { items: a.store.getDeadLetters() });
@@ -264,6 +269,25 @@ export class AdminFacade {
         return json(200, { ok: true, mode: a.status().mode });
       }
 
+      // The account's standing at its gateway: paused by its owner, or closed
+      // for good (front-core: accounts that go quiet). Both go to the gateway
+      // with the pod session as proof, and its answer is the new standing.
+      case '/gateway/pause': {
+        if (typeof body.paused !== 'boolean') return json(400, { error: 'paused must be true or false' });
+        if (!a.pauseAtGateway || !a.gatewayApi) return json(501, { error: 'this account is not at a gateway' });
+        const r = await a.pauseAtGateway(body.paused);
+        if (!r) return json(502, { error: 'the gateway could not be reached' });
+        return json(r.status === 200 ? 200 : r.status, r);
+      }
+      case '/gateway/close': {
+        const handle = String(a.store.getConfig()?.handle || '').toLowerCase();
+        if (!handle || String(body.confirm || '').toLowerCase() !== handle) return json(400, { error: 'type the handle to confirm' });
+        if (!a.closeAtGateway || !a.gatewayApi) return json(501, { error: 'this account is not at a gateway' });
+        const r = await a.closeAtGateway();
+        if (!r) return json(502, { error: 'the gateway could not be reached' });
+        return json(r.status === 200 ? 200 : r.status, r);
+      }
+
       // Going quiet, and coming back. The record page's active/parked select.
       case '/park': {
         if (!await a.requestTakeover?.()) return json(503, { error: 'another device is active for this pod — park from there' });

package/web/app/agent.mjs

@@ -137,10 +137,35 @@ export class BrowserAgent {
     return true;
   }
 
+  // One call to the gateway's owner API, proved with the pod session. What
+  // comes back on 200 or 410 is the account's standing there, kept for the
+  // manage page; anything else is logged and forgotten.
+  async tellGateway(what, body) {
+    if (!this.gatewayApi) return null;
+    let res;
+    try {
+      res = await this.sessionFetch(`${this.gatewayApi}/${what}`, {
+        method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+      });
+    } catch (e) { this.log(`gateway ${what}: ${e.message}`); return null; }
+    const json = await res.json().catch(() => ({}));
+    const out = { status: res.status, ...json };
+    if (res.status === 200 || res.status === 410) this.gatewayStanding = out;
+    else this.log(`gateway ${what}: ${res.status} ${json.error || ''}`);
+    return out;
+  }
+  openAtGateway() { return this.tellGateway('open', { handle: this.doorKey }); }
+  pauseAtGateway(paused) { return this.tellGateway('pause', { handle: this.doorKey, paused: !!paused }); }
+  closeAtGateway() { return this.tellGateway('close', { handle: this.doorKey, confirm: true }); }
+  static OPEN_EVERY_MS = 60 * 60_000;
+
   // Become the active agent: renew the lease, then start what a viewer skips —
   // publish the face, drain the inbox, run the mirrors.
   async goActive() {
     this.viewer = false;
+    // Reading here is being here: the gateway hears so once an hour.
+    clearInterval(this._openTimer);
+    this._openTimer = setInterval(() => { this.openAtGateway(); }, BrowserAgent.OPEN_EVERY_MS);
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     try {
@@ -179,6 +204,7 @@ export class BrowserAgent {
     this.viewer = true;
     this.log('another device took over — read-only here');
     this.lease.stopRenewal();
+    clearInterval(this._openTimer); this._openTimer = null;
     this.intake?.stop?.();
     // The delivery queue as well. Its timer starts in the Deliverer's
     // constructor and nothing here ever switched it off, so a demoted device
@@ -322,6 +348,28 @@ export class BrowserAgent {
       onGone: () => this.publisher.publishCollections({ followers: true }),
     });
 
+    // The gateway this account's mail comes through, and the account's own
+    // standing there — paused, closed, how much arrived unread (front-core:
+    // accounts that go quiet). The gateway is told on every sign-in and
+    // hourly while this device is active: that is what keeps an account
+    // somebody reads from counting as a quiet one. Only a closed address
+    // stops the boot; a gateway that cannot be reached is no reason to
+    // refuse a sign-in.
+    this.gatewayApi = null;
+    try { if (config.gateway?.url) this.gatewayApi = `${new URL(config.gateway.url).origin}/api`; } catch { this.gatewayApi = null; }
+    this.doorKey = doorKeyOf(config.gateway?.url) || config.handle;
+    this.gatewayStanding = null;
+    const standing = await this.openAtGateway();
+    if (standing?.status === 410) {
+      const host = (() => { try { return new URL(this.gatewayApi).host; } catch { return 'the gateway'; } })();
+      const address = this.doorKey.includes('@') ? `@${this.doorKey}` : `@${this.doorKey}@${host}`;
+      const why = standing.closedBy === 'owner' ? 'you closed it' : 'nothing opened it for six months';
+      const e = new Error(`${address} is closed at ${host}: ${why}, and a closed address does not come back.`
+        + ` Everything on your pod is untouched. The sign-in used here was ${webId}.`);
+      e.code = 'address-closed';
+      throw e;
+    }
+
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem, assertionKey: null, log: this.log,

package/web/app/boot.mjs

@@ -179,6 +179,7 @@ async function issuerForPod(pod) {
 async function podForFrontedAddress(handle) {
   const res = await fetch(`/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
     { headers: { accept: 'application/jrd+json, application/json' } }).catch(() => null);
+  if (res?.status === 410) throw new Error(`@${handle}@${location.host} is closed: nothing on the pod behind it was touched, but the address is gone for good.`);
   if (!res || res.status >= 400) throw new Error(`nobody at this site is called @${handle}@${location.host}`);
   const doc = await res.json().catch(() => ({}));
   const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
@@ -352,6 +353,7 @@ if (typeof document !== 'undefined') (async () => {
         'no-account-here': { title: 'No FediPod account in that pod', retry: 'Create one on this pod', go: () => showIdentity() },
         'no-account': { title: 'No FediPod account in that pod', retry: 'Create one on this pod', go: () => showIdentity() },
         'device-account': { title: 'This account is run from a device', retry: 'Use another pod', go: signIn },
+        'address-closed': { title: 'This address is closed', retry: 'Sign in with another account', go: signIn },
       }[e.code];
 
       // A sign-in the pod would not take: renew it here, and if the pod will

package/web/app/dist/boot.js

@@ -33662,6 +33662,7 @@ async function podForFrontedAddress(handle) {
     `/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
     { headers: { accept: "application/jrd+json, application/json" } }
   ).catch(() => null);
+  if (res?.status === 410) throw new Error(`@${handle}@${location.host} is closed: nothing on the pod behind it was touched, but the address is gone for good.`);
   if (!res || res.status >= 400) throw new Error(`nobody at this site is called @${handle}@${location.host}`);
   const doc = await res.json().catch(() => ({}));
   const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
@@ -33809,7 +33810,8 @@ if (typeof document !== "undefined") (async () => {
         // login and the identity screen lands here.
         "no-account-here": { title: "No FediPod account in that pod", retry: "Create one on this pod", go: () => showIdentity() },
         "no-account": { title: "No FediPod account in that pod", retry: "Create one on this pod", go: () => showIdentity() },
-        "device-account": { title: "This account is run from a device", retry: "Use another pod", go: signIn }
+        "device-account": { title: "This account is run from a device", retry: "Use another pod", go: signIn },
+        "address-closed": { title: "This address is closed", retry: "Sign in with another account", go: signIn }
       }[e.code];
       if (e.code === "sign-in-refused" && once("fedipod-renewing")) {
         $("loading").hidden = true;