fedipod 1.32.0 → 1.36.6

package/lib/connections/bskyfeed.mjs

@@ -166,6 +166,10 @@ export class BskyFeed {
     this.lastSweep = new Date().toISOString();
     const self = this.atproto.read()?.did;
     let added = 0;
+    // One commit boundary for the sweep, as acctfeed and tagfeed: every item
+    // awaits Bluesky before the next, so the debounce never coalesced them and
+    // the timeline index went to the pod once per notification.
+    this.store.hold?.();
     try {
       // Our own CROSS-POSTS must not echo back into the feed — but a post or
       // reply written natively on Bluesky is ours to see here too. The mirrors
@@ -224,6 +228,8 @@ export class BskyFeed {
     } catch (e) {
       this._backOff(e.status || 0, null);
       return;
+    } finally {
+      this.store.release?.();
     }
     const all = this.store.getStatuses();
     const mirrored = all.filter(s => s.kind === 'bsky');

package/lib/core/deliver.mjs

@@ -73,6 +73,10 @@ export class Deliverer {
     this.edPrivate = edPrivate;
     this.proofKeyId = proofKeyId;
     this.log = log;
+    // How many fresh deliveries one attempt may carry. The Node deliverer
+    // opens a socket per recipient; the browser's relay deliverer sends a
+    // list, and sets this to what the relay accepts.
+    this.batchSize = 1;
     if (!passive) this.startQueue();
   }
 
@@ -171,33 +175,51 @@ export class Deliverer {
     }
   }
 
+  // One attempt per target, answered in order: `{ ok: true }` or `{ error }`
+  // with the error deliverNow would have thrown. Here one at a time; the
+  // relay deliverer sends the whole list in one call.
+  async deliverManyNow(targets) {
+    const out = [];
+    for (const t of targets) {
+      try { await this.deliverNow(t.inbox, t.activity); out.push({ ok: true }); }
+      catch (error) { out.push({ error }); }
+    }
+    return out;
+  }
+
   async deliver(inbox, activity) {
     // Proved before anything else, so the copy that goes on the queue is the
     // copy that was signed — a retry days later must not post a bare activity.
     const signed = await this.proofed(activity);
-    // A host we already know is refusing: queue without asking again. This is
-    // the path a FRESH activity takes, so without it a fan-out to a struggling
-    // server opened one socket per follower before any of this applied.
+    if (this._queueIfCooling(inbox, signed)) return;
+    const [result] = await this.deliverManyNow([{ inbox, activity: signed }]);
+    await this._settle(inbox, signed, result);
+  }
+
+  // A host we already know is refusing: queue without asking again. This is
+  // the path a FRESH activity takes, so without it a fan-out to a struggling
+  // server opened one socket per follower before any of this applied.
+  _queueIfCooling(inbox, signed) {
     const host = hostOf(inbox);
     const until = this._cooling?.get(host);
-    if (until && until > Date.now()) {
-      this.log(`${host} is cooling — queueing ${signed.type} rather than asking again`);
-      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: until });
-      return;
-    }
-    try {
-      await this.deliverNow(inbox, signed);
-      this.log(`delivered ${signed.type} → ${inbox}`);
-    } catch (e) {
-      if (unsalvageable(e)) { await this._unsalvageable(inbox, e); return; }
-      this.log(`delivery failed (${e.message}) — queued`);
-      const wait = e.retryAfterMs || 60_000;
-      if (aboutTheHost(e)) {
-        this._cooling ||= new Map();
-        this._cooling.set(host, Date.now() + wait);
-      }
-      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: Date.now() + wait });
+    if (!until || until <= Date.now()) return false;
+    this.log(`${host} is cooling — queueing ${signed.type} rather than asking again`);
+    this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: until });
+    return true;
+  }
+
+  // What one attempt's outcome means for the queue.
+  async _settle(inbox, signed, result) {
+    if (result.ok) { this.log(`delivered ${signed.type} → ${inbox}`); return; }
+    const e = result.error;
+    if (unsalvageable(e)) { await this._unsalvageable(inbox, e); return; }
+    this.log(`delivery failed (${e.message}) — queued`);
+    const wait = e.retryAfterMs || 60_000;
+    if (aboutTheHost(e)) {
+      this._cooling ||= new Map();
+      this._cooling.set(hostOf(inbox), Date.now() + wait);
     }
+    this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: Date.now() + wait });
   }
 
   // Not retried, and on a 410 the followers who received there are dropped,
@@ -231,8 +253,16 @@ export class Deliverer {
     // Proved once for the whole fan-out: every recipient gets the same bytes,
     // and one signature is computed rather than one per follower.
     const signed = await this.proofed(activity);
-    // Shared inboxes deduplicate fan-out to the same server.
-    for (const inbox of [...new Set(inboxes)]) await this.deliver(inbox, signed);
+    // Shared inboxes deduplicate fan-out to the same server. Sent in batches
+    // of batchSize, and a host found cooling by one batch is not asked again
+    // by the next.
+    const targets = [...new Set(inboxes)].map((inbox) => ({ inbox, activity: signed }));
+    for (let i = 0; i < targets.length; i += this.batchSize) {
+      const chunk = targets.slice(i, i + this.batchSize).filter((t) => !this._queueIfCooling(t.inbox, signed));
+      if (!chunk.length) continue;
+      const results = await this.deliverManyNow(chunk);
+      for (let k = 0; k < chunk.length; k++) await this._settle(chunk[k].inbox, signed, results[k]);
+    }
   }
 
   // Serialized, for the same reason Intake.drain is: the tick is 60s and a

package/lib/core/intake/index.mjs

@@ -51,6 +51,7 @@ const CHAIN_GAP_MS = 5_000;      // pause between chained backlog sweeps
 // enough that a crash re-does little, large enough that a flood of fast
 // rejections does not become a pod write per item.
 const DELETE_BATCH = 10;
+const ORPHAN_RECEIPTS_PER_SWEEP = 20;   // strays from before receipts were deleted with their items
 // Attempt counts live in pod state, not in memory: a restart used to hand every
 // poison item five fresh tries, and under a crash loop that is unbounded.
 const ATTEMPTS_DOC = 'intake-attempts.json';
@@ -359,6 +360,7 @@ export class Intake {
     // deadletter.json where one would do, and a flood is exactly when the pod
     // should be asked for less rather than more.
     const pending = [];
+    const withReceipt = new Set();   // items the listing showed a receipt beside
     const flush = async () => {
       if (!pending.length) return true;
       // Written down before any of them leaves the mailbox. A failure here
@@ -379,13 +381,17 @@ export class Intake {
         }
         this._clearAttempt(url);
         handled++;
+        // Its receipt goes with it. Left beside a deleted item, a receipt
+        // was one stray document per delivery, forever.
+        if (withReceipt.has(url)) await podInbox.dropReceiptBeside(this.remote, url);
         await new Promise(r => setTimeout(r, DELETE_GAP_MS));
       }
       return true;
     };
 
-    for (const { url, size } of items) {
+    for (const { url, size, receipt: hasReceipt } of items) {
       if (url.endsWith('.keep')) continue;
+      if (hasReceipt) withReceipt.add(url);
       // The listing already carries every child's size, so this costs nothing
       // to ask. An activity is a few kB; anything of this order is not one, and
       // reading it with an unbounded res.text() buffers whatever a stranger
@@ -430,9 +436,11 @@ export class Intake {
         }
         // A gateway that verified this delivery left a receipt beside it. Read
         // it only when a gateway is configured (no config → no fetch, so an
-        // install with no gateway pays nothing); a missing or HMAC-invalid
-        // receipt reads as null, which is exactly today's unverified behavior.
-        const receipt = activity ? await this._readReceipt(url) : null;
+        // install with no gateway pays nothing) and the listing showed one
+        // beside this item (`false` is a definite no; a listing that does not
+        // say leaves it to the read); a missing or HMAC-invalid receipt reads
+        // as null, which is exactly today's unverified behavior.
+        const receipt = activity && hasReceipt !== false ? await this._readReceipt(url) : null;
         if (activity && this.gatewaySecret()) this._bumpGatewayStat(!!receipt?.verified);
         // The owner's own post, taken at the outbox door: not mail to read
         // but a write to make. Never archived or forwarded as if received.
@@ -464,6 +472,11 @@ export class Intake {
       if (pending.length >= DELETE_BATCH && !await flush()) return;
     }
     if (!await this._finishSweep(flush)) return;
+    // Receipts earlier drains left behind, a few per sweep until none remain.
+    for (const stray of podInbox.orphanReceipts(this.remote, this.urls).slice(0, ORPHAN_RECEIPTS_PER_SWEEP)) {
+      if (!await podInbox.dropStrayReceipt(this.remote, stray)) break;
+      await new Promise(r => setTimeout(r, DELETE_GAP_MS));
+    }
     // Made progress and there is more waiting: go straight round rather than
     // sleeping. Gated on progress so a sweep that achieved nothing — a
     // cooldown, an unwritable store, poison at the head — cannot spin.

package/lib/core/lease.mjs

@@ -9,13 +9,13 @@
 import crypto from 'node:crypto';
 
 // Renewal is the one thing that writes even when nothing is happening: at 30s
-// it was 120 PUTs an hour per agent, each taking a write lock on the pod. 90s
-// against a 5-minute TTL leaves three missed renewals of headroom and cuts that
-// load by two thirds. The cost is automatic promotion after a crash waiting up
-// to the TTL — a user acting on a second device does not wait, since takeover()
-// claims the lease outright.
-const TTL_MS = 300_000;
-const RENEW_MS = 90_000;
+// it was 120 PUTs an hour per agent, each taking a write lock on the pod; at
+// 90s, 40. Five minutes against a 15-minute TTL leaves two missed renewals of
+// headroom and makes it 12. The cost is automatic promotion after a crash
+// waiting up to the TTL — a user acting on a second device does not wait,
+// since takeover() claims the lease outright.
+const TTL_MS = 900_000;
+const RENEW_MS = 300_000;
 const JITTER = () => 0.85 + Math.random() * 0.3;
 // Distinct from null: null is "nobody holds it", this is "we could not ask".
 const UNREADABLE = Symbol('lease-unreadable');

package/lib/core/store.mjs

@@ -72,6 +72,11 @@ export function dropFollower(contacts, actor, why) {
   return contacts;
 }
 
+// What a state document looks like on the pod; write() and _put() agree on it.
+const serialise = (obj) => JSON.stringify(obj, null, 2) + '\n';
+// The same record apart from when it was fetched.
+const sameButWhen = (a, b) => JSON.stringify({ ...a, fetchedAt: null }) === JSON.stringify({ ...b, fetchedAt: null });
+
 export class PodStore {
   constructor({ storage = null, log = console.log } = {}) {
     this.lastSkipped = [];        // what the last load could not read, as `name (HTTP n)`
@@ -79,6 +84,7 @@ export class PodStore {
     this.log = log;
     this.cache = new Map();        // name → parsed value
     this.etags = new Map();        // name (or '') → last ETag, for revalidation
+    this.lastText = new Map();     // name → the bytes last loaded from or sent to the pod
     this.timers = new Map();       // name → debounce timer
     this.dirty = new Set();        // written while held; flushed by commit/release
     this._held = 0;
@@ -91,7 +97,7 @@ export class PodStore {
   attach(storage) {
     // A different tree is different state: carrying the old cache and its
     // ETags across would serve one container's documents as another's.
-    if (this.storage && this.storage.base !== storage.base) { this.cache.clear(); this.etags.clear(); }
+    if (this.storage && this.storage.base !== storage.base) { this.cache.clear(); this.etags.clear(); this.lastText.clear(); }
     this.storage = storage;
   }
 
@@ -144,7 +150,7 @@ export class PodStore {
       }
       fetched++;
       this.etags.set(name, r.etag);
-      try { this.cache.set(name, JSON.parse(r.body)); }
+      try { this.cache.set(name, JSON.parse(r.body)); this.lastText.set(name, r.body); }
       catch (e) { this.log(`state load ${name}: unparsable (${e.message})`); }
     }
     // Kept for /status: a document skipped here is a timeline or a contact
@@ -167,6 +173,15 @@ export class PodStore {
   write(name, obj) {
     this.cache.set(name, structuredClone(obj));
     if (!this.storage) return;
+    // The same bytes the pod already holds are not sent again. A like, a
+    // bookmark, a sweep that found nothing new each used to upload the whole
+    // timeline index and the whole people cache, unchanged — the largest
+    // write on the pod, on every small action. A write that had been armed
+    // and is now undone is unarmed with it.
+    if (this.lastText.get(name) === serialise(obj)) {
+      clearTimeout(this.timers.get(name)); this.timers.delete(name); this.dirty.delete(name);
+      return;
+    }
     // Held: record it and leave the writing to the commit boundary the caller
     // already has. See hold().
     if (this._held) { this.dirty.add(name); return; }
@@ -205,13 +220,13 @@ export class PodStore {
   // the returned promise so one failure cannot poison the queue.
   _put(name) {
     const done = this.chain.then(async () => {
-      const body = JSON.stringify(this.cache.get(name), null, 2) + '\n';
+      const body = serialise(this.cache.get(name));
       for (let attempt = 1; attempt <= PUT_RETRIES; attempt++) {
         // A storage that throws is a bug, not a hiccup — but it must not
         // escape into the write queue, where it would look like success.
         const r = await this.storage.write(name, body, 'application/json')
           .catch(e => ({ ok: false, retry: false, why: e.message }));
-        if (r.ok) return true;
+        if (r.ok) { this.lastText.set(name, body); return true; }
         // The storage says whether trying again could possibly help: a pod's
         // 4xx is an answer rather than a hiccup, and a directory's EACCES will
         // still be an EACCES in two seconds.
@@ -236,6 +251,7 @@ export class PodStore {
   // migrates to the local machine — leaving the copy behind would defeat it).
   async remove(name) {
     this.cache.delete(name);
+    this.lastText.delete(name);
     clearTimeout(this.timers.get(name));
     this.timers.delete(name);
     if (!this.storage) return true;
@@ -462,6 +478,7 @@ export class PodStore {
   getActors() { return this.read('actors.json', {}); }
   cacheActor(url, doc) {
     const a = this.getActors();
+    const known = a[url];
     a[url] = {
       name: clamp(plainText(doc.name || doc.preferredUsername || ''), MAX_NAME),
       preferredUsername: clamp(plainText(doc.preferredUsername || ''), MAX_NAME),
@@ -474,9 +491,12 @@ export class PodStore {
       type: doc.type || 'Person',
       followers: doc.followers || null,
       following: doc.following || null,
-      ...(a[url]?.counts ? { counts: a[url].counts } : {}),
+      ...(known?.counts ? { counts: known.counts } : {}),
       fetchedAt: new Date().toISOString(),
     };
+    // Fetched again and found the same: nothing to write. Only the time of
+    // asking differs, and that is not worth the whole cache going to the pod.
+    if (known && sameButWhen(known, a[url])) { a[url] = known; return; }
     this.write('actors.json', prune(a, ACTOR_CACHE_MAX, this.getContacts()));
   }
 

package/lib/gateway/caches.mjs

@@ -0,0 +1,36 @@
+// caches.mjs — what one warm gateway process keeps between requests: the
+// pod-token verifier, and the public keys of the servers that deliver here.
+// Built per request, each costs round trips to somebody else's server for
+// every call; built once, a process pays them once.
+
+// The Solid-OIDC verifier remembers the issuers' key sets it has seen. A
+// fresh one per call re-read the caller's WebID document, the issuer's
+// discovery document and its keys on every signed-in call.
+let verifier = null;
+export async function podTokenVerifier() {
+  if (!verifier) verifier = (await import('@solid/access-token-verifier')).createSolidTokenVerifier();
+  return verifier;
+}
+
+// The keys deliveries are signed with, by key id, in the shape Fedify's
+// verifier asks for. A key is held an hour; a key that could not be fetched
+// is held five minutes, so a server that was down is asked again soon.
+// Fedify re-fetches on its own when a held key no longer verifies, so a
+// rotated key costs one failed check, not an hour of refused mail.
+const KEY_TTL_MS = 60 * 60_000;
+const MISS_TTL_MS = 5 * 60_000;
+const KEY_CACHE_MAX = 500;
+const keys = new Map();   // key id → { key, until }
+export const senderKeys = {
+  async get(keyId) {
+    const hit = keys.get(keyId.href);
+    if (!hit) return undefined;
+    if (hit.until < Date.now()) { keys.delete(keyId.href); return undefined; }
+    return hit.key;
+  },
+  async set(keyId, key) {
+    if (keys.size >= KEY_CACHE_MAX) keys.delete(keys.keys().next().value);
+    keys.set(keyId.href, { key, until: Date.now() + (key ? KEY_TTL_MS : MISS_TTL_MS) });
+  },
+  size: () => keys.size,
+};

package/lib/gateway/front-core.mjs

@@ -23,6 +23,8 @@ import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
 import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer } from './quiet.mjs';
 import { routeNoticesApi } from './notices.mjs';
+import { withSecurityHeaders } from './headers.mjs';
+import { podTokenVerifier } from './caches.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -61,7 +63,7 @@ async function verifyPodToken(request, pathname, verifier) {
     // Solid-OIDC binds the token to a key the client proves on every request;
     // a token shown without the proof is one anyone who saw it could show.
     if (!dpop) { console.log(`front: pod token without a DPoP proof refused on ${pathname}`); return null; }
-    const v = verifier || (await import('@solid/access-token-verifier')).createSolidTokenVerifier();
+    const v = verifier || await podTokenVerifier();
     const url = request.url;
     const { webid } = await v(authz, { header: dpop, method: request.method, url });
     return webid || null;
@@ -207,7 +209,9 @@ async function relayOne(item, rec, fetchImpl) {
 
 const j = (status, obj, ct = 'application/json') =>
   ({ status, headers: { 'content-type': ct, 'cache-control': 'no-store' }, body: JSON.stringify(obj) });
-const notFound = () => ({ status: 404, headers: { 'content-type': 'text/plain' }, body: 'not found\n' });
+// Held at the edge like any other missing document: a bot's scan, a dead
+// handle, a typo in a WebFinger query each cost one call, not one per asker.
+const notFound = () => ({ status: 404, headers: { 'content-type': 'text/plain', ...publicFor(MISSING_EDGE_SECONDS) }, body: 'not found\n' });
 
 // A user's public base on the front, a 1:1 mirror of their pod home.
 // The directory key is the FULL fediverse address — handle@host — never the
@@ -243,7 +247,9 @@ function parseUserPath(pathname) {
 const BROWSER_MAX_AGE = 60;
 const publicFor = (seconds, stale = seconds * 4) => ({
   'cache-control': `public, max-age=${Math.min(seconds, BROWSER_MAX_AGE)}`,
-  'netlify-cdn-cache-control': `public, s-maxage=${seconds}, stale-while-revalidate=${stale}`,
+  // `durable`: one copy for every region, and one that a deploy does not
+  // empty. Without it each region held its own and every deploy started cold.
+  'netlify-cdn-cache-control': `public, durable, s-maxage=${seconds}, stale-while-revalidate=${stale}`,
 });
 // How long the edge holds a public document, and a handle's WebFinger
 // answer. Every server that has heard of an account asks for its actor and
@@ -252,6 +258,15 @@ const publicFor = (seconds, stale = seconds * 4) => ({
 // can afford.
 const PUBLIC_EDGE_SECONDS = 600;
 const WEBFINGER_EDGE_SECONDS = 3600;
+// A closed or moved address stays gone; a picture's address stays where it is.
+const GONE_EDGE_SECONDS = 3600;
+const MEDIA_EDGE_SECONDS = 86400;
+// A public document the pod would not give (missing, or not public) is asked
+// for again and again by every server that shows the account — a pinned-posts
+// collection an old account never wrote, a forum count nobody published. Held
+// briefly, so the edge absorbs the asking; briefly, so a document published a
+// moment later is not "missing" for long.
+const MISSING_EDGE_SECONDS = 120;
 
 // Where a pod owner opts their identity in. An operator may name it, because
 // the path it takes is one their pod server can no longer serve; the dot says
@@ -344,51 +359,6 @@ export async function routeFront(request, ctx) {
   return { ...out, headers: withSecurityHeaders(out.headers, out.body) };
 }
 
-// Every response this file makes, hardened in one place rather than in each of
-// the dozen shapes below.
-//
-// `nosniff` matters most: the front serves user-supplied JSON straight from
-// somebody's pod (the proxied actor and object documents), and without it a
-// browser is free to decide for itself that a document is HTML and run what is
-// inside it. The rest is the same posture the app already has — nothing may be
-// framed, no base tag may be rewritten, no plugin content.
-//
-// A content-security-policy goes on the HTML only: it would mean nothing on a
-// JSON document, and `frame-ancestors` has to be a header rather than a meta
-// tag anyway.
-//
-// `script-src 'self'` is the one that matters, and it is only possible because
-// none of these pages carries inline script any more — each has its own file and
-// its own route above. A policy cannot tell an inline block the author wrote
-// from one an attacker injected, so as long as any inline script has to run,
-// every inline script may.
-//
-// `connect-src` allows https: because the pages sign in against the user's own
-// pod, which is a different origin by definition and not one we can name here.
-function withSecurityHeaders(headers = {}, body = null) {
-  const ct = String(headers['content-type'] || '');
-  const isHtml = ct.startsWith('text/html');
-  return {
-    ...headers,
-    'x-content-type-options': 'nosniff',
-    'referrer-policy': 'same-origin',
-    'x-frame-options': 'SAMEORIGIN',
-    ...(isHtml && body ? {
-      'content-security-policy': [
-        "default-src 'self'",
-        "script-src 'self'",             // no inline script: see above
-        "style-src 'self' 'unsafe-inline'",
-        "img-src 'self' https: data:",
-        "connect-src 'self' https:",     // sign-in goes to the user's own pod
-        "object-src 'none'",             // no plugin content, ever
-        "base-uri 'none'",               // no rewriting where relative URLs resolve
-        "frame-ancestors 'self'",        // nobody else may frame these pages
-        "form-action 'self'",            // a form here submits here
-      ].join('; '),
-    } : {}),
-  };
-}
-
 async function route(request, ctx) {
   const url = new URL(request.url);
   const { pathname } = url;
@@ -643,8 +613,8 @@ async function route(request, ctx) {
   }
 
   // The owner's say over an account that goes quiet (quiet.mjs).
-  const quiet = await routeQuietApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod });
-  if (quiet) return quiet;
+  const quiet = await routeQuietApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod, apiPreflight });
+  if (quiet) return withApiCors(quiet);
 
   // The relay: the front sends requests a browser has already signed. A page
   // may not set the Date or Host header, and both are inside an HTTP
@@ -808,7 +778,7 @@ async function route(request, ctx) {
     if (!rec) return notFound();
     // A closed address is gone, and says so rather than pretending never to
     // have existed: the name stays taken.
-    if ((await closedState(ctx, m[1], rec)).closed) return closedAnswer({ 'access-control-allow-origin': '*' });
+    if ((await closedState(ctx, m[1], rec)).closed) return closedAnswer({ 'access-control-allow-origin': '*', ...publicFor(GONE_EDGE_SECONDS) });
     // A fronted identity's documents live on its pod; the pod's own actor id
     // is the alias, so a client signing in by the fronted address can find
     // the pod (and its login) without a lookup only the host could answer.
@@ -909,8 +879,8 @@ async function route(request, ctx) {
       const { status, reason, location } = await handleOwnerPost(request, identFor(rec),
         { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), ownerWebId: webid });
       console.log(`door @${up.handle}: owner post → ${status} (${reason})`);
-      if (status !== 202) return json(status, { error: reason });
-      return json(202, { accepted: true, ...(location ? { object: location } : {}),
+      if (status !== 201) return json(status, { error: reason });
+      return json(201, { accepted: true, ...(location ? { object: location } : {}),
         note: 'it goes out when your FediPod agent next runs' }, location ? { location } : {});
     }
     if (rec.inboxOnly && (request.method === 'GET' || request.method === 'HEAD')) {
@@ -935,14 +905,14 @@ async function route(request, ctx) {
   if (movedBase && up.rest !== 'ap/actor') {
     return { status: 301, headers: { ...open, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
   }
-  if (closed) return gone(open, CLOSED);
+  if (closed) return gone({ ...open, ...publicFor(GONE_EDGE_SECONDS) }, CLOSED);
   const podTarget = rec.podHome + up.rest;
   // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
   // the id rewrite below turns media links onto the front like every other
   // pod url in a document. Answer those by pointing at the pod: bytes are not
   // a document to cap and relabel, and remotes follow a redirect for a picture.
   if (up.rest.startsWith('ap/media/')) {
-    return { status: 302, headers: { location: podTarget, 'cache-control': 'no-store' }, body: '' };
+    return { status: 302, headers: { location: podTarget, ...publicFor(MEDIA_EDGE_SECONDS) }, body: '' };
   }
   // The pod this read belongs to travels with it: an adapter reading a store
   // directly (the CSS server component) has no access control of its own and
@@ -958,7 +928,10 @@ async function route(request, ctx) {
   const got = await podRoot.readPublicDocument(
     ctx.podGet || ((u) => fetch(u, { headers: { accept } })),
     podTarget, { podHome: rec.podHome, accept });
-  if (got.text === null) return { status: got.status, headers: open, body: '' };
+  if (got.text === null) {
+    const hold = [401, 403, 404, 410].includes(got.status) ? publicFor(MISSING_EDGE_SECONDS) : {};
+    return { status: got.status, headers: { ...open, ...hold }, body: '' };
+  }
   let text = got.text;
   text = swap(text, rec.podHome, base);
   // The moved stub: the pod's actor now carries the NEW gateway's ids, and a

package/lib/gateway/gateway-core.mjs

@@ -15,6 +15,7 @@
 import crypto from 'node:crypto';
 import { verifyHttpSignature, makeSafeLoader, makeReceipt, signReceipt } from './httpsig.mjs';
 import * as inbox from '../pod/inbox.mjs';
+import { senderKeys } from './caches.mjs';
 
 const DEFAULT_MAX_BYTES = 512 * 1024;   // mirror intake.mjs MAX_ITEM_BYTES
 
@@ -93,8 +94,10 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
     return { status: 202, reason: 'does not concern us' };
   }
 
+  // The sender's key, kept between deliveries: a server pushing a hundred
+  // items is asked for its key once (caches.mjs).
   const v = await verifyHttpSignature(request, {
-    documentLoader: makeSafeLoader({ fetchImpl }),
+    documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
   });
   // A present-but-invalid signature is a forgery — dropped here, so it never
   // reaches the pod (today it would, drain, and die unapplied). An absent or
@@ -156,7 +159,7 @@ export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxB
   const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: 'accepted', location: slug && ident.notesPrefix ? ident.notesPrefix + slug : null };
+  return { status: 201, reason: 'accepted', location: slug && ident.notesPrefix ? ident.notesPrefix + slug : null };
 }
 
 export const _internal = { isBlocked, concernsUsAtEdge, httpUrl, sha256hex };

package/lib/gateway/headers.mjs

@@ -0,0 +1,49 @@
+// headers.mjs — the hardening every front response carries, in one place.
+// Split out of front-core.mjs, which is at its size gate; nothing here knows
+// about routes.
+
+// Every response this file makes, hardened in one place rather than in each of
+// the dozen shapes below.
+//
+// `nosniff` matters most: the front serves user-supplied JSON straight from
+// somebody's pod (the proxied actor and object documents), and without it a
+// browser is free to decide for itself that a document is HTML and run what is
+// inside it. The rest is the same posture the app already has — nothing may be
+// framed, no base tag may be rewritten, no plugin content.
+//
+// A content-security-policy goes on the HTML only: it would mean nothing on a
+// JSON document, and `frame-ancestors` has to be a header rather than a meta
+// tag anyway.
+//
+// `script-src 'self'` is the one that matters, and it is only possible because
+// none of these pages carries inline script any more — each has its own file and
+// its own route above. A policy cannot tell an inline block the author wrote
+// from one an attacker injected, so as long as any inline script has to run,
+// every inline script may.
+//
+// `connect-src` allows https: because the pages sign in against the user's own
+// pod, which is a different origin by definition and not one we can name here.
+export function withSecurityHeaders(headers = {}, body = null) {
+  const ct = String(headers['content-type'] || '');
+  const isHtml = ct.startsWith('text/html');
+  return {
+    ...headers,
+    'x-content-type-options': 'nosniff',
+    'referrer-policy': 'same-origin',
+    'x-frame-options': 'SAMEORIGIN',
+    ...(isHtml && body ? {
+      'content-security-policy': [
+        "default-src 'self'",
+        "script-src 'self'",             // no inline script: see above
+        "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' https: data:",
+        "connect-src 'self' https:",     // sign-in goes to the user's own pod
+        "object-src 'none'",             // no plugin content, ever
+        "base-uri 'none'",               // no rewriting where relative URLs resolve
+        "frame-ancestors 'self'",        // nobody else may frame these pages
+        "form-action 'self'",            // a form here submits here
+      ].join('; '),
+    } : {}),
+  };
+}
+

package/lib/gateway/quiet.mjs

@@ -101,7 +101,7 @@ export async function accountState(ctx, key, rec) {
 
 // A 410 with a reason, the shape every closed or moved id answers with.
 export const closedAnswer = (headers = {}, why = 'this address is closed') => ({
-  status: 410, headers: { ...headers, 'content-type': 'application/json', 'cache-control': 'no-store' },
+  status: 410, headers: { 'cache-control': 'no-store', ...headers, 'content-type': 'application/json' },
   body: JSON.stringify({ error: why }) });
 
 // The owner of a row, proved the way the relay proves them: a pod token whose
@@ -120,7 +120,12 @@ async function provedOwner(request, pathname, ctx, rec, { j, verifyPodToken, web
 // Returns a response, or null when the path is not one of these.
 export async function routeQuietApi(request, pathname, ctx, deps) {
   const { j } = deps;
-  if (request.method !== 'POST' || !['/api/open', '/api/pause', '/api/close'].includes(pathname)) return null;
+  if (!['/api/open', '/api/pause', '/api/close'].includes(pathname)) return null;
+  // A page at another origin asks first whether it may call, and is answered
+  // as the relay answers it. Unanswered, the browser never sends the call and
+  // some pages asked again every minute.
+  if (request.method === 'OPTIONS') return deps.apiPreflight();
+  if (request.method !== 'POST') return null;
   // The owner is here: their browser says so as it opens the account. The
   // answer is the account's standing at this gateway, which the manage page
   // shows. A closed address is told so and nothing is written.

package/lib/pod/containers.mjs

@@ -51,12 +51,16 @@ export async function provisionPublic(pod, base) {
  * The private half: the home itself and the state container.
  *
  * Idempotent, so two devices doing it at once is harmless — which is what
- * makes it safe to run on every boot rather than only at setup.
+ * makes it safe to run on every boot rather than only at setup. Asked before
+ * written: a browser's worker boots whenever the browser likes, and each boot
+ * used to write the canary and both rules again. Returns whether it wrote.
  */
 export async function provisionPrivate(pod, urls) {
+  if (await exists(pod, urls.state)) return false;
   await pod.putJson(keepUrl(urls.state), KEEP, KEEP_CT);
   await pod.setAcl(urls.state, []);
   await pod.setAcl(urls.home, []);
+  return true;
 }
 
 /**