fedipod 1.30.0 → 1.36.6

package/web/admin/client/index.html

@@ -28,8 +28,16 @@ main { flex: 1 1 auto; min-height: 0; display: flex; }
   <h1 class="name">FediPod</h1>
   <select id="actor-pick" aria-label="Local actors"
     title="   Every actor on this machine; choosing one opens its client"></select>
-  <a id="bar-fediverse" href="./" title="   Open the client and read your timeline" aria-current="page">visit account</a>
-  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="./" title="   Open the client and read your timeline" aria-current="page">visit</a>
+  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
 </nav>
 
 <main>
@@ -38,5 +46,24 @@ main { flex: 1 1 auto; min-height: 0; display: flex; }
 
 <script src="../bar.js"></script>
 <script src="client.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="../notices-bar.js"></script>
 </body>
 </html>

package/web/admin/gateway.js

@@ -18,12 +18,31 @@ async function refreshGateway() {
     GATEWAY_WORD.textContent = frontName ? `${host} — publishing as @${frontName}@${host}` : host;
     GW_OPEN_ATTACH.hidden = true;
     GW_OPEN_DETACH.hidden = false;
+    // The account's standing at the gateway — paused, closed. The browser
+    // build's agent reports it; a DeviceAgent's does not, and the pause and
+    // close controls stay hidden.
+    const st = g.standing;
+    const known = !!st && (st.status === 200 || st.status === 410);
+    $('gateway-pause').hidden = !known || !!st.closed || !!st.paused;
+    $('gateway-resume').hidden = !known || !!st.closed || !st.paused;
+    $('gateway-close').hidden = !known || !!st.closed;
+    if (known && st.closed) GATEWAY_WORD.textContent += ' — this address is closed';
+    else if (known && st.paused) GATEWAY_WORD.textContent += st.pausedBy === 'owner' ? ' — paused by you' : ' — paused';
   } else {
     GATEWAY_WORD.textContent = '';
     GW_OPEN_ATTACH.hidden = false;
     GW_OPEN_DETACH.hidden = true;
+    for (const id of ['gateway-pause', 'gateway-resume', 'gateway-close']) $(id).hidden = true;
   }
 }
+const setPausedAtGateway = async (paused) => {
+  const r = await write('/gateway/pause', { paused },
+    paused ? 'paused — posts sent to you are not kept until you resume; follows still arrive'
+      : 'resumed — posts sent to you are kept again');
+  if (r) refreshGateway();
+};
+$('gateway-pause').addEventListener('click', () => setPausedAtGateway(true));
+$('gateway-resume').addEventListener('click', () => setPausedAtGateway(false));
 const gwShape = () => document.querySelector('input[name=gwShape]:checked')?.value || 'pod';
 function gwPreviews() {
   $('gw-pod-preview').textContent = config?.address || `@${config?.handle || 'you'}@your.pod`;

package/web/admin/index.html

@@ -165,7 +165,7 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   fieldset { border-color: #555; } .rows li { border-color: #444; }
 }
 </style>
-<link rel="stylesheet" href="bar.css?v=3">
+<link rel="stylesheet" href="bar.css?v=4">
 <link rel="stylesheet" href="window.css">
 </head>
 <body>
@@ -175,8 +175,16 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   <h1 class="name">FediPod</h1>
   <select id="actor-pick" aria-label="Local actors"
     title="   Every actor on this machine; choosing one goes to its record"></select>
-  <a id="bar-fediverse" href="client/" title="   Open the client and read your timeline">visit account</a>
-  <a id="bar-manage" href="./" title="   The record: what this actor is, and what you can do to it" aria-current="page">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="client/" title="   Open the client and read your timeline">visit</a>
+  <a id="bar-manage" href="./" title="   The record: what this actor is, and what you can do to it" aria-current="page">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
 </nav>
 <main id="page">
 
@@ -321,6 +329,14 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     title="   Attach this account to a mail-filtering gateway">Attach to a gateway</button>
   <button type="button" id="gateway-open-detach" class="inline danger" hidden
     title="   Go back to your pod's own inbox">Detach from gateway</button>
+  <!-- Shown only when the agent reports the account's standing at the gateway
+       (the browser build does; a DeviceAgent's admin does not). -->
+  <button type="button" id="gateway-pause" class="inline" hidden
+    title="   Stop keeping the posts sent to you until you resume; follows still arrive">Pause my account</button>
+  <button type="button" id="gateway-resume" class="inline" hidden
+    title="   Keep the posts sent to you again">Resume my account</button>
+  <button type="button" id="gateway-close" class="inline danger" hidden data-confirm="close-address"
+    title="   Close your address at this gateway for good; nothing on your pod is touched">Close this address</button>
 </span>
 
 <section id="pane-group" hidden>
@@ -516,6 +532,14 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     <label for="confirm-handle">Type the handle to confirm</label>
     <input type="text" id="confirm-handle" autocomplete="off">
   </div>
+  <div id="warn-close-address" class="warn" hidden>
+    <p><strong>This cannot be undone.</strong> Your address at the gateway is closed for good:
+      mail to it is turned away, other servers drop the account the next time they look, and
+      nobody can take the name. Nothing on your pod is touched — your posts, key and data stay
+      where they are.</p>
+    <label for="confirm-handle-close">Type the handle to confirm</label>
+    <input type="text" id="confirm-handle-close" autocomplete="off">
+  </div>
   <!-- "Move private data" (POST /state-move) had a panel here and no way to
        open it: nothing in this page has ever carried data-confirm="move-state",
        so the panel was only ever hidden. Removed 2026-09-09 rather than left as
@@ -556,5 +580,24 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
 <script src="group.js"></script>
 <script src="upkeep.js"></script>
 <script src="gateway.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="notices-bar.js"></script>
 </body>
 </html>

package/web/admin/notices-bar.js

@@ -0,0 +1,90 @@
+// notices-bar.js — the notices bell in the bar, on every page of ours.
+//
+// Whoever runs the site writes notices (the /notices page, admin only); every
+// signed-in account sees the bell. This asks /api/notices once per page load,
+// hides the bell where the site has none to offer (a DeviceAgent's own pages
+// answer no such thing), lists the titles, and opens one notice at a time.
+// Which notices this browser has already opened is this browser's business
+// alone, so it lives in localStorage and nowhere else.
+//
+// Every element here is declared in the page's markup; this fills them.
+(() => {
+  const bell = document.getElementById('bar-notices');
+  const list = document.getElementById('notices-list');
+  const view = document.getElementById('notice-view');
+  if (!bell || !list || !view) return;
+  const $ = (id) => document.getElementById(id);
+  const SEEN = 'fedipod-notices-seen';
+  const readSeen = () => { try { return JSON.parse(localStorage.getItem(SEEN) || '[]'); } catch { return []; } };
+  const writeSeen = (ids) => { try { localStorage.setItem(SEEN, JSON.stringify(ids.slice(-200))); } catch { /* keeps no site data */ } };
+
+  const when = (iso) => { try { return new Date(iso).toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' }); } catch { return ''; } };
+
+  // A notice's body is plain text: paragraphs at blank lines, and a bare
+  // https link becomes a link. Nothing in it is ever read as markup.
+  const renderBody = (el, text) => {
+    el.textContent = '';
+    for (const para of String(text || '').split(/\n\s*\n/u)) {
+      const p = document.createElement('p');
+      for (const part of para.split(/(https?:\/\/[^\s<>"']+)/u)) {
+        if (/^https?:\/\//u.test(part)) {
+          const a = document.createElement('a');
+          a.href = part; a.textContent = part; a.target = '_blank'; a.rel = 'noopener';
+          p.append(a);
+        } else p.append(part);
+      }
+      el.append(p);
+    }
+  };
+
+  let notices = [];
+  const render = () => {
+    const seen = new Set(readSeen());
+    const fresh = notices.filter((n) => !seen.has(n.id)).length;
+    $('bar-notices-count').textContent = fresh ? String(fresh) : '';
+    bell.dataset.new = String(fresh);
+    bell.setAttribute('aria-label', fresh ? `Notices, ${fresh} new` : 'Notices');
+    const ul = $('notices-items');
+    ul.textContent = '';
+    if (!notices.length) {
+      const p = document.createElement('p'); p.className = 'none'; p.textContent = 'No notices.';
+      ul.append(p);
+      return;
+    }
+    for (const n of notices) {
+      const li = document.createElement('li');
+      if (!seen.has(n.id)) li.classList.add('new');
+      const b = document.createElement('button');
+      b.type = 'button'; b.className = 'notice-open'; b.textContent = n.title;
+      b.addEventListener('click', () => open(n));
+      const w = document.createElement('span'); w.className = 'when'; w.textContent = when(n.at);
+      li.append(b, w);
+      ul.append(li);
+    }
+  };
+
+  const open = (n) => {
+    $('notice-view-title').textContent = n.title;
+    $('notice-view-when').textContent = when(n.at);
+    renderBody($('notice-view-body'), n.body);
+    const seen = readSeen();
+    if (!seen.includes(n.id)) { seen.push(n.id); writeSeen(seen); }
+    render();
+    list.close();
+    view.showModal();
+  };
+
+  bell.addEventListener('click', () => { render(); list.showModal(); });
+  $('notices-close').addEventListener('click', () => list.close());
+  $('notice-view-close').addEventListener('click', () => { view.close(); list.showModal(); });
+
+  fetch(location.origin + '/api/notices', { headers: { accept: 'application/json' } })
+    .then((r) => (r.ok ? r.json() : null))
+    .then((j) => {
+      if (!j || !Array.isArray(j.notices)) return;
+      notices = j.notices;
+      render();
+      bell.hidden = false;
+    })
+    .catch(() => { /* no site notices here; the bell stays hidden */ });
+})();

package/web/admin/record.js

@@ -94,6 +94,7 @@ function resetConfirm() {
   for (const k of Object.keys(LIFECYCLE)) $(`warn-${k}`)?.hidden !== undefined && ($(`warn-${k}`).hidden = true);
   $('confirm-handle').value = '';
   $('confirm-handle-move').value = '';
+  $('confirm-handle-close').value = '';
   $('move-target').value = '';
 }
 function closePanels(keep = null) {

package/web/admin/setup/index.html

@@ -59,8 +59,16 @@ button:disabled { opacity: .5; cursor: default; }
 <nav id="bar" aria-label="Site">
   <h1 class="name">FediPod</h1>
   <span id="bar-handle"></span>
-  <a id="bar-fediverse" href="../client/" title="   Open the client and read your timeline">visit account</a>
-  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="../client/" title="   Open the client and read your timeline">visit</a>
+  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
   <a id="bar-add" href="../?new=1" title="   Set up another actor on this machine, with its own pod" aria-current="page">add new account</a>
 </nav>
 <main id="page">
@@ -210,5 +218,24 @@ button:disabled { opacity: .5; cursor: default; }
 <script src="../bar.js"></script>
 <script src="../common.js"></script>
 <script src="setup.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="../notices-bar.js"></script>
 </body>
 </html>

package/web/admin/upkeep.js

@@ -76,6 +76,9 @@ const LIFECYCLE = {
   retire: { path: '/retire', title: 'Retire this identity', go: 'Retire it', danger: true, done: (r) => `retired ${r.deletedAt}: Delete delivered to ${r.inboxes} inbox(es)` },
   move: { path: '/move', title: 'Transfer this account away', go: 'Transfer it', focus: 'move-target',
     done: (r) => `transferred to ${r.target}: Move delivered to ${r.inboxes} inbox(es), unfollowed ${r.unfollowed}/${r.following}` },
+  // The address at the gateway, not the identity: the pod keeps everything.
+  'close-address': { path: '/gateway/close', title: 'Close this address', go: 'Close it', danger: true, focus: 'confirm-handle-close',
+    done: (r) => (r.closed ? 'closed — this address is gone for good; everything on your pod is untouched' : 'not closed') },
 };
 let pending = null;
 
@@ -119,7 +122,8 @@ $('confirm-form').addEventListener('submit', async (ev) => {
   const what = pending;
   const body = what === 'retire' ? { confirm: $('confirm-handle').value.trim() }
     : what === 'move' ? { target: $('move-target').value.trim(), confirm: $('confirm-handle-move').value.trim() }
-      : {};
+      : what === 'close-address' ? { confirm: $('confirm-handle-close').value.trim() }
+        : {};
   if (what === 'move' && !body.target) { say('name the account to transfer to', 'err'); return; }
   $('confirm-go').disabled = true;
   say(`${what} — this talks to the pod and to other servers, so it takes a moment`);

package/web/app/admin-facade.mjs

@@ -33,6 +33,7 @@ export const ADMIN_PATHS = new Set([
   '/deadletter', '/blocks', '/profiles', '/modqueue', '/log', '/fediacct', '/describe', '/follow',
   '/atproto', '/atproto/connect', '/atproto/disconnect',
   '/rebuild', '/move', '/retire', '/inbox/prune', '/park', '/revive', '/takeover',
+  '/gateway/pause', '/gateway/close',
   '/fediacct/connect', '/fediacct/disconnect', '/fediacct/callback',
 ]);
 
@@ -138,6 +139,10 @@ export class AdminFacade {
             configured: !!(g && g.url), url: g?.url || null, webId: g?.webId || null,
             frontActor: g?.frontActor || null, mode: g?.mode || 'off', hasSecret: !!g?.hmacSecret,
             stats: a.store.read('gateway-stats.json', { verified: 0, unverified: 0, lastAt: null }),
+            // The account's standing at the gateway — paused, closed — as the
+            // gateway last said it (agent.mjs tellGateway). The record page
+            // shows its pause and close controls only when this is here.
+            standing: a.gatewayStanding || null,
           });
         }
         case '/deadletter': return json(200, { items: a.store.getDeadLetters() });
@@ -264,6 +269,25 @@ export class AdminFacade {
         return json(200, { ok: true, mode: a.status().mode });
       }
 
+      // The account's standing at its gateway: paused by its owner, or closed
+      // for good (front-core: accounts that go quiet). Both go to the gateway
+      // with the pod session as proof, and its answer is the new standing.
+      case '/gateway/pause': {
+        if (typeof body.paused !== 'boolean') return json(400, { error: 'paused must be true or false' });
+        if (!a.pauseAtGateway || !a.gatewayApi) return json(501, { error: 'this account is not at a gateway' });
+        const r = await a.pauseAtGateway(body.paused);
+        if (!r) return json(502, { error: 'the gateway could not be reached' });
+        return json(r.status === 200 ? 200 : r.status, r);
+      }
+      case '/gateway/close': {
+        const handle = String(a.store.getConfig()?.handle || '').toLowerCase();
+        if (!handle || String(body.confirm || '').toLowerCase() !== handle) return json(400, { error: 'type the handle to confirm' });
+        if (!a.closeAtGateway || !a.gatewayApi) return json(501, { error: 'this account is not at a gateway' });
+        const r = await a.closeAtGateway();
+        if (!r) return json(502, { error: 'the gateway could not be reached' });
+        return json(r.status === 200 ? 200 : r.status, r);
+      }
+
       // Going quiet, and coming back. The record page's active/parked select.
       case '/park': {
         if (!await a.requestTakeover?.()) return json(503, { error: 'another device is active for this pod — park from there' });

package/web/app/agent.mjs

@@ -137,19 +137,46 @@ export class BrowserAgent {
     return true;
   }
 
+  // One call to the gateway's owner API, proved with the pod session. What
+  // comes back on 200 or 410 is the account's standing there, kept for the
+  // manage page; anything else is logged and forgotten.
+  async tellGateway(what, body) {
+    if (!this.gatewayApi) return null;
+    let res;
+    try {
+      res = await this.sessionFetch(`${this.gatewayApi}/${what}`, {
+        method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+      });
+    } catch (e) { this.log(`gateway ${what}: ${e.message}`); return null; }
+    const json = await res.json().catch(() => ({}));
+    const out = { status: res.status, ...json };
+    if (res.status === 200 || res.status === 410) this.gatewayStanding = out;
+    else this.log(`gateway ${what}: ${res.status} ${json.error || ''}`);
+    return out;
+  }
+  openAtGateway() { return this.tellGateway('open', { handle: this.doorKey }); }
+  pauseAtGateway(paused) { return this.tellGateway('pause', { handle: this.doorKey, paused: !!paused }); }
+  closeAtGateway() { return this.tellGateway('close', { handle: this.doorKey, confirm: true }); }
+  static OPEN_EVERY_MS = 60 * 60_000;
+
   // Become the active agent: renew the lease, then start what a viewer skips —
   // publish the face, drain the inbox, run the mirrors.
   async goActive() {
     this.viewer = false;
+    // Reading here is being here: the gateway hears so once an hour.
+    clearInterval(this._openTimer);
+    this._openTimer = setInterval(() => { this.openAtGateway(); }, BrowserAgent.OPEN_EVERY_MS);
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     try {
-      // Forced, not revalidated. While this device watched, the ACTIVE one was
-      // writing; our cache is however stale the last viewer poll left it, and
-      // the store is write-through — so the first write from here would push a
-      // whole document back over newer state. Read what is actually there
-      // before acting on it.
-      await this.store.load({ force: true }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      // Forced, not revalidated, when this device WATCHED first: the active
+      // one was writing, our cache is however stale the last viewer poll left
+      // it, and the store is write-through — so the first write from here
+      // would push a whole document back over newer state. A device that
+      // booted straight into acting read everything a moment ago; asking
+      // again is one revalidation, not a second download of every document.
+      await this.store.load({ force: !!this._watched }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      this._watched = false;
       // Own posts the outbox names and the timeline index lacks come back
       // here, before anything acts on the index.
       await this.publisher.healStatuses().catch((e) => this.log(`healing the timeline index: ${e.message}`));
@@ -177,8 +204,10 @@ export class BrowserAgent {
   demote() {
     if (this.viewer) return;
     this.viewer = true;
+    this._watched = true;
     this.log('another device took over — read-only here');
     this.lease.stopRenewal();
+    clearInterval(this._openTimer); this._openTimer = null;
     this.intake?.stop?.();
     // The delivery queue as well. Its timer starts in the Deliverer's
     // constructor and nothing here ever switched it off, so a demoted device
@@ -322,6 +351,29 @@ export class BrowserAgent {
       onGone: () => this.publisher.publishCollections({ followers: true }),
     });
 
+    // The gateway this account's mail comes through, and the account's own
+    // standing there — paused, closed, how much arrived unread (front-core:
+    // accounts that go quiet). The gateway is told on every sign-in and
+    // hourly while this device is active: that is what keeps an account
+    // somebody reads from counting as a quiet one. Only a closed address
+    // stops the boot; a gateway that cannot be reached is no reason to
+    // refuse a sign-in.
+    // At the page's own origin, as the relay is: a page on the test alias
+    // asked the real site instead and could not get past its preflight.
+    this.gatewayApi = config.gateway?.url ? `${frontOrigin.replace(/\/$/, '')}/api` : null;
+    this.doorKey = doorKeyOf(config.gateway?.url) || config.handle;
+    this.gatewayStanding = null;
+    const standing = await this.openAtGateway();
+    if (standing?.status === 410) {
+      const host = (() => { try { return new URL(this.gatewayApi).host; } catch { return 'the gateway'; } })();
+      const address = this.doorKey.includes('@') ? `@${this.doorKey}` : `@${this.doorKey}@${host}`;
+      const why = standing.closedBy === 'owner' ? 'you closed it' : 'nothing opened it for six months';
+      const e = new Error(`${address} is closed at ${host}: ${why}, and a closed address does not come back.`
+        + ` Everything on your pod is untouched. The sign-in used here was ${webId}.`);
+      e.code = 'address-closed';
+      throw e;
+    }
+
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem, assertionKey: null, log: this.log,
@@ -428,6 +480,7 @@ export class BrowserAgent {
       // The lease decides: this device ACTS on the pod, or reads it read-only.
       this.viewer = !(await this.lease.acquire());
       if (this.viewer) {
+        this._watched = true;
         this.log(`read-only viewer: another device is active on @${config.handle}`);
         this.startViewerPoll();       // reload the feed, and promote if the lease frees
         return;

package/web/app/boot.mjs

@@ -179,6 +179,7 @@ async function issuerForPod(pod) {
 async function podForFrontedAddress(handle) {
   const res = await fetch(`/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
     { headers: { accept: 'application/jrd+json, application/json' } }).catch(() => null);
+  if (res?.status === 410) throw new Error(`@${handle}@${location.host} is closed: nothing on the pod behind it was touched, but the address is gone for good.`);
   if (!res || res.status >= 400) throw new Error(`nobody at this site is called @${handle}@${location.host}`);
   const doc = await res.json().catch(() => ({}));
   const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
@@ -352,6 +353,7 @@ if (typeof document !== 'undefined') (async () => {
         'no-account-here': { title: 'No FediPod account in that pod', retry: 'Create one on this pod', go: () => showIdentity() },
         'no-account': { title: 'No FediPod account in that pod', retry: 'Create one on this pod', go: () => showIdentity() },
         'device-account': { title: 'This account is run from a device', retry: 'Use another pod', go: signIn },
+        'address-closed': { title: 'This address is closed', retry: 'Sign in with another account', go: signIn },
       }[e.code];
 
       // A sign-in the pod would not take: renew it here, and if the pod will

package/web/app/deliver-relay.mjs

@@ -10,6 +10,9 @@
 import { Deliverer } from '../../lib/core/deliver.mjs';
 import { sign } from './shims/fedify-sig.mjs';
 
+// What one relay call may carry (lib/gateway/front-core.mjs RELAY_MAX_REQUESTS).
+const RELAY_MAX_REQUESTS = 20;
+
 /**
  * The name the front keys this account's row by, read off its door inbox:
  * `<front>/u/<key>/ap/inbox/`. A mail-door account is keyed by its full
@@ -30,6 +33,7 @@ export class RelayDeliverer extends Deliverer {
     this.relayUrl = opts.relayUrl;       // <front>/api/relay
     this.handle = opts.handle;
     this.sessionFetch = opts.sessionFetch;   // the DPoP session's fetch, to authenticate to the relay
+    this.batchSize = RELAY_MAX_REQUESTS;
   }
 
   // Same contract as Deliverer.signedFetch, DEFAULT INCLUDED: an init with no
@@ -40,32 +44,68 @@ export class RelayDeliverer extends Deliverer {
   // never saw the document it asked for: a Follow from anyone new was rejected
   // with "actor fetch failed", and nothing needing a lookup could be ingested.
   async signedFetch(url, init = {}) {
+    const req = await this._signedRequest(url, init);
+    const [r0] = await this._relay([req]);
+    return this._outcome(r0, url, init.method || 'GET');
+  }
+
+  // A fan-out in one call: the relay takes a list, so a post to twenty
+  // followers is one call, not twenty (Deliverer.deliverToAll, batchSize).
+  async deliverManyNow(targets) {
+    const reqs = await Promise.all(targets.map((t) => this._signedRequest(t.inbox, {
+      method: 'POST', headers: { 'content-type': 'application/activity+json' }, body: JSON.stringify(t.activity),
+    })));
+    let results;
+    try { results = await this._relay(reqs); } catch (error) { return targets.map(() => ({ error })); }
+    return targets.map((t, i) => {
+      try { this._outcome(results[i] || {}, t.inbox, 'POST'); return { ok: true }; }
+      catch (error) { return { error }; }
+    });
+  }
+
+  // Signed here, sent verbatim by the relay. Every signed header goes along,
+  // `accept` included: the signature covers it, so a relay request missing it
+  // carries an invalid signature — and a read without it gets the HTML page
+  // instead of the document.
+  async _signedRequest(url, init = {}) {
     const body = typeof init.body === 'string' ? init.body : (init.body ? new TextDecoder().decode(init.body) : '');
     const s = await sign({ url, method: init.method || 'GET', headers: init.headers || {}, body }, this.rsaPrivate, this.keyId);
-    // Every signed header goes to the relay, `accept` included: the signature
-    // covers it, so a relay request missing it carries an invalid signature —
-    // and a read without it gets the HTML page instead of the document.
-    const relayReq = {
+    return {
       url: s.url, method: s.method, body,
       headers: {
         date: s.headers.date, digest: s.headers.digest, accept: s.headers.accept,
         'content-type': s.headers['content-type'], signature: s.headers.signature,
       },
     };
+  }
+
+  // One relay call for a list of requests; the results in the same order.
+  // The relay's OWN answer, apart from the recipients': unreachable and a
+  // refusal are hiccups the queue retries. Its 404 is not — it says this
+  // account has no row here, and no retry changes that. It used to be read as
+  // a hiccup too, and a tab whose account the site did not know retried its
+  // deliveries every minute for three days.
+  async _relay(requests) {
     let res;
     try {
       res = await this.sessionFetch(this.relayUrl, {
         method: 'POST', headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ handle: this.handle, requests: [relayReq] }),
+        body: JSON.stringify({ handle: this.handle, requests }),
       });
     } catch (e) { const err = new Error(`relay unreachable: ${e.message}`); err.status = 0; throw err; }
+    if (res.status === 404) { const err = new Error('relay: no such account here'); err.status = 404; throw err; }
     if (res.status >= 400) { const err = new Error(`relay ${res.status}`); err.status = 502; throw err; }
     const out = await res.json().catch(() => ({}));
-    const r0 = (out.results && out.results[0]) || {};
+    return Array.isArray(out.results) ? out.results : [];
+  }
+
+  // What the far server answered, as the Node deliverer would have seen it:
+  // a Response for a read, a thrown error carrying the status for a refusal.
+  _outcome(r0, url, method) {
     const status = r0.status || 0;
     if (status === 0) { const err = new Error(r0.error || 'relay could not send'); err.status = 502; throw err; }
     if (status >= 400) {
-      const err = new Error(`${init.method || 'POST'} ${url} → ${status}`); err.status = status;
+      const err = new Error(`${method} ${url} → ${status}`); err.status = status;
       // The receiving server's own answer to "when should I try again", carried
       // through the relay (lib/front-core.mjs). Spelled `retryAfterMs`, which is
       // what the delivery queue reads (lib/deliver.mjs) — the queue's ladder is