fedipod 1.36.6 → 1.39.0

package/README.md

@@ -23,6 +23,11 @@ This README is about the `FediPod BrowserAgent`. There are also a number of [oth
 2. Choose your pod provider. You'll be redirected to your provider to login if you have a pod or sign up if you need to create one.
 3. Back on fedipod.net, choose your handle and where your address lives:
    on your pod, `@handle@yourpod`, or at this site, `@handle@fedipod.net`.
+   Choose where on your pod your data goes: a container named `fedipod`,
+   inside whichever container you name (your pod's root if you leave it
+   empty). If your pod has no public type index yet, you're asked whether
+   to create one; FediPod records there where your account lives, and
+   nothing is set up without it.
 4. You see your Fediverse timeline.
 
 From now on, anyone can open your profile at `https://fedipod.net/@handle@provider`, signed in or not.
@@ -71,6 +76,10 @@ an alias, so a Move from it lands here.
 client-to-server, dokieli for one, can post as you. It sends to the outbox
 address in your actor document, which your WebID profile also names, signed in
 at your pod. The post goes out the next time you open fedipod.net.
+If your account turns a post down when it runs, you get a direct message from
+yourself saying what was refused and why. Signed in, your outbox shows you
+everything you've done, likes and follows included; everyone else sees only
+your public posts.
 
 **The manage page.** `manage`, in the bar's account group, opens it: your profile,
 aliases, the gateway, key rotation, recovering posts, parking, moving to
@@ -98,7 +107,11 @@ For these, see [Other ways to run FediPod](#other-ways-to-run-fedipod).
 
 Everything you publish and everything you read is stored on your pod. Your
 signing key is stored there too, in a container only you can read through
-your pod's login. fedipod.net holds no key: it verifies incoming mail, drops
+your pod's login.
+It all lives in the `fedipod` container you chose at sign-up. Your pod's
+public type index records it, as an ActivityStreams actor, which is how
+FediPod and other Solid apps find your account again.
+ fedipod.net holds no key: it verifies incoming mail, drops
 the junk, forwards the rest to your pod, and hands your browser the app.
 With an address on your pod, `@handle@yourpod`, you can detach from it at
 any time and attach to a gateway of your own; your address and your data do

package/bin/fedipod.mjs

@@ -25,6 +25,12 @@
 //     --pod-name, --group, --summary, --icon, --root, --keys) keeps setup
 //     entirely on the command line, as does a non-TTY stdin. --cli forces it.
 //
+//     --in <container>  the container on the pod that holds `fedipod/`
+//                       (asked when not given; empty is the pod's root)
+//     --create-type-index  make a public type index when the pod has none;
+//                       where the account lives is recorded there, and
+//                       without one and without this, setup stops
+//
 //     The password is prompted (or AP_PASSWORD) — used once to create the
 //     account and/or mint a revocable CSS client-credential, never stored.
 //     Keys live in AP_HOME by default (the pod host cannot read them);

package/cli.md

@@ -32,10 +32,16 @@ prompt. `--profile NAME` names the new identity when you have more than one.
 `--address pod` (the default) puts your address on your pod, `@you@yourpod`;
 `--address front` puts it at a gateway, `@you@the-gateway`, with your posts,
 key and data still on your pod. `--gateway <url>` names the gateway
-(`https://fedipod.net` by default). A pod on a suffix-based host cannot
+(`https://fedipod.net` by default). A suffixed pod cannot
 answer WebFinger for a handle, so it always takes a gateway address, whichever
 `--address` you gave.
 
+Your data goes in a container named `fedipod`, inside the container you name
+with `--in <path>` (asked when you leave it out; empty is your pod's root). Where
+it lives is recorded in your pod's public type index. If your pod has none,
+setup asks before making one, and `--create-type-index` says yes in advance;
+without a yes, setup stops before anything is written.
+
 ## Which identity a command acts on
 
 `--profile NAME` works on every command, not just `up`; `AP_PROFILE` is the

package/device-agent.md

@@ -12,9 +12,9 @@ connect to it; and it can host a [group](groups.md).
 - Node 20 or newer.
 - A Solid pod, such as `https://alice.solidcommunity.net/` or
   `https://server.example/alice/`. The address is `@handle@yourpod`, or
-  `@handle@fedipod.net` when the pod is on a path of a shared host, since
-  the shared host cannot answer for the handle; the posts, key and data
-  stay on the pod either way.
+  `@handle@fedipod.net` when the pod is suffixed, since a suffixed pod
+  cannot answer for the handle; the posts, key and data stay on the pod
+  either way.
 - Followers-only and direct posts need a pod that enforces WAC access control;
   on one that does not, the composer refuses those two and says why.
 - While the agent is off, your mail waits on your pod's host. Run it as a

package/gateway.md

@@ -32,7 +32,7 @@ password is typed anywhere:
    restarts the agent itself to publish under it.
 
 In the BrowserAgent the same choice is made once, at sign-up, and cannot be
-changed afterwards. A pod on a suffix-based host, like
+changed afterwards. A suffixed pod, like
 `https://server.example/alice/`, always takes the gateway-based name: nothing
 at that host answers for the handle, so the gateway does. Its posts, key and
 data stay on the pod.

package/groups.md

@@ -60,7 +60,8 @@ A group that withdraws a post it carried to you takes it off your timeline too.
 ## Inviting people
 
 A group has a page anyone can open, at `ap/profile.html` under its pod's
-app container — `<pod>/fedipod/ap/profile.html`. It
+app container — `<pod>/fedipod/ap/profile.html`
+by default, or under the `fedipod` container wherever it was put at setup. It
 carries the group's address and a Follow box that sends a visitor to their
 own server's follow screen, so it is the link to put where people will find
 it. Posts the group carries appear in members' timelines as the group

package/gui.md

@@ -46,7 +46,9 @@ its own port.
 ## Sharing an account
 
 Each identity has a page anyone can open, at `ap/profile.html` under its pod
-— for example `https://your-pod.example/fedipod/ap/profile.html`. It
+— for example `https://your-pod.example/fedipod/ap/profile.html`
+(the `fedipod` container is wherever you put it at setup; the manage page's
+"stored at" row says where). It
 shows the name, bio and address, and offers a Follow box: a visitor types
 their own server and lands on that server's follow screen. Hand out that
 link, or the `@name@host` address itself, which works in the search box of

package/lib/client/c2s.mjs

@@ -28,6 +28,7 @@ import * as social from '../core/social.mjs';
 import * as wire from '../core/wire.mjs';
 import { readLenient } from '../core/as2.mjs';
 import { safeSlug } from '../core/publisher/notes.mjs';
+import * as podNotes from '../pod/notes.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
@@ -192,9 +193,11 @@ export class C2S {
    * published copy and it stays the canonical one; this is served only where
    * that copy cannot be read by the client asking.
    */
-  sendLocalOutbox(res, url, origin) {
+  sendLocalOutbox(res, url, origin, { owner = false } = {}) {
     const id = `${origin}ap/outbox`;
-    const outbox = this.store.read('outbox.json', []);     // newest first
+    // newest first; the owner's view is every message, the public one what a
+    // stranger may see
+    const outbox = this.store.read(owner ? 'outbox-own.json' : 'outbox.json', []);
     const page = url?.searchParams?.get('page') || null;
     const ct = { 'content-type': 'application/activity+json; charset=utf-8' };
     if (!page) {
@@ -270,12 +273,22 @@ export class C2S {
       return this.sendInbox(res, url);
     }
     if (req.method === 'GET' || req.method === 'HEAD') {
+      // The owner, signed in, reads every message the actor produced (§5.1:
+      // the outbox is filtered by who asks). Anyone else reads the public one.
+      const owner = pathname === '/ap/outbox' && req.headers.authorization
+        ? (await this.auth(req, pathname)).ok : false;
       // Where the client surface answers on an address a stranger can reach,
       // the pod's copies already name it and are the documents. Standalone
       // they are not reachable by the client asking, so it is answered here.
       const local = this.agent.publisher?.clientOrigin ? null : this.localOrigin(req);
       if (local && pathname === '/ap/actor') return this.sendLocalActor(req, res, local);
-      if (local && pathname === '/ap/outbox') return this.sendLocalOutbox(res, url, local);
+      if (local && pathname === '/ap/outbox') return this.sendLocalOutbox(res, url, local, { owner });
+      // The owner is answered here, not sent on: a redirect loses the
+      // credential (a browser drops it across origins, and a DPoP proof names
+      // the address it was made for), so the pod would refuse them.
+      if (owner && pathname === '/ap/outbox') {
+        return this.sendLocalOutbox(res, url, this.agent.publisher.clientOrigin, { owner });
+      }
       // The pod's copy is the document; send the reader there.
       const target = pathname === '/ap/actor' ? this.urls.actor : this.urls.outbox;
       res.writeHead(303, { location: target, 'cache-control': 'no-store' });
@@ -334,14 +347,22 @@ export class C2S {
   visibilityOf(activity, object) {
     const to = arr(activity.to ?? object?.to).map(idOf);
     const cc = arr(activity.cc ?? object?.cc).map(idOf);
-    if (!to.length && !cc.length) return 'public';
+    // Blind copies alone are still an audience: a post for them and nobody
+    // else is direct, never public.
+    const blind = arr(activity.bto ?? object?.bto).length + arr(activity.bcc ?? object?.bcc).length;
+    if (!to.length && !cc.length) return blind ? 'direct' : 'public';
     if (to.includes(wire.PUBLIC)) return 'public';
     if (cc.includes(wire.PUBLIC)) return 'unlisted';
-    if (to.includes(this.urls.followers)) return 'private';
+    // Followers named anywhere — "to alice, cc my followers" included — is a
+    // followers-only post that also reaches whoever else is named.
+    if (to.includes(this.urls.followers) || cc.includes(this.urls.followers)) return 'private';
     return 'direct';
   }
 
-  async dispatch(activity, { slug = null, raw = null } = {}) {
+  // `serial` and `at` name what this activity will make: the outbox door
+  // chose them and told the client, so they are used as given. A client
+  // posting here directly gets fresh ones.
+  async dispatch(activity, { slug = null, raw = null, serial = Date.now(), at = new Date().toISOString() } = {}) {
     const reply = (status, body, headers = {}) => ({ status, body, headers });
     if (!activity || typeof activity !== 'object' || Array.isArray(activity) || !activity.type) {
       return reply(400, { error: 'a typed ActivityStreams object is required' });
@@ -349,10 +370,12 @@ export class C2S {
     // A bare object arrives without an activity around it; the server supplies
     // the Create (§6.2.1), carrying the object's own addressing up onto it.
     if (!ACTIVITY_TYPES.has(activity.type)) {
-      activity = { type: 'Create', object: activity, to: activity.to, cc: activity.cc };
+      // Every audience field is copied up onto the Create (§6.2.1).
+      const { to, cc, bto, bcc, audience } = activity;
+      activity = { type: 'Create', object: activity, to, cc, bto, bcc, audience };
     }
     try {
-      return await this._dispatch(activity, { slug, raw, reply });
+      return await this._dispatch(activity, { slug, raw, reply, serial, at });
     } catch (e) {
       this.log(`c2s ${activity?.type}: ${e.message}`);
       return reply(422, { error: e.message || String(e) });
@@ -366,11 +389,23 @@ export class C2S {
     const pick = (...fields) => [...new Set(fields.flatMap((f) => arr(activity[f] ?? object?.[f]).map(idOf)))]
       .filter((a) => typeof a === 'string' && /^https?:\/\//u.test(a)
         && a !== wire.PUBLIC && a !== this.urls.followers && a !== this.urls.actor);
-    return { also: pick('to', 'cc'), deliverTo: pick('bto', 'bcc') };
+    // `audience` is who the post is for, a group most often: delivered to and
+    // named like to and cc (§7.1).
+    return { also: pick('to', 'cc', 'audience'), deliverTo: pick('bto', 'bcc') };
   }
 
-  async _dispatch(activity, { slug, raw, reply }) {
+  async _dispatch(activity, { slug, raw, reply, serial, at }) {
     const agent = this.agent;
+    // §6: every post to the outbox answers 201 with the new activity's id.
+    const made = (id, body = {}) => reply(201, { id, ...body }, { location: id });
+    // What is never sent anywhere — a person's block, a pin — is still a
+    // message this actor produced, so the owner's outbox records it here.
+    const kept = (type, extra) => {
+      const id = type === 'Undo' ? wire.undoActivityId(this.urls, serial) : `${this.urls.actor}#${type.toLowerCase()}-${serial}`;
+      const act = { id, type, actor: this.urls.actor, published: at, ...extra };
+      agent.publisher.recordOwn?.(act);
+      return act.id;
+    };
     const object = typeof activity.object === 'object' && activity.object !== null
       ? activity.object : null;
     const objectId = idOf(activity.object);
@@ -411,6 +446,7 @@ export class C2S {
               visibility,
               spoilerText: object.summary || null,
               sensitive: object.sensitive === true,
+              slug,
             });
             return reply(201,
               { id: wire.createActivityId(question.id), object: question.id },
@@ -445,19 +481,32 @@ export class C2S {
         if (s.actor !== this.urls.actor || s.kind !== 'post') {
           return reply(403, { error: 'not your note' });
         }
-        const text = String(object?.source?.content ?? object?.content ?? '');
-        if (!text.trim()) return reply(422, { error: 'the edit has no content' });
-        const attachments = object?.attachment !== undefined
+        // §6.3: a client's Update changes only what it sends, and a field sent
+        // as null is removed. What was sent is read from the bytes, because a
+        // JSON-LD reading drops the nulls that mean "remove this".
+        const sent = raw?.type === 'Update' && raw.object && typeof raw.object === 'object' ? raw.object : (object || {});
+        const has = (k) => Object.prototype.hasOwnProperty.call(sent, k);
+        const stored = await Promise.resolve().then(() => podNotes.read(agent.remote, s.noteId)).catch(() => null);
+        if (stored?.type && stored.type !== 'Note') {
+          await agent.publisher.updateObject(s, sent, { updated: at });
+          return made(wire.updateActivityId(s.noteId, at), { object: s.noteId });
+        }
+        const text = has('content') || sent.source?.content !== undefined
+          ? String(object?.source?.content ?? object?.content ?? '') : String(s.text ?? '');
+        if (!text.trim()) return reply(422, { error: 'the edit leaves the note with no content' });
+        const attachments = has('attachment')
           ? arr(object.attachment).map((a) => ({
             url: a?.url, mediaType: a?.mediaType,
             ...(a?.name ? { description: a.name } : {}),
           })).filter((a) => a.url)
           : null;
         await agent.publisher.updateNote(s, {
-          content: text, spoilerText: object?.summary || null,
-          sensitive: object?.sensitive === undefined ? null : object.sensitive === true, attachments,
+          content: text,
+          spoilerText: has('summary') ? (object?.summary || null) : (s.spoiler || null),
+          sensitive: has('sensitive') ? object?.sensitive === true : null, attachments,
+          updated: at,
         });
-        return reply(200, { ok: true, object: s.noteId });
+        return made(wire.updateActivityId(s.noteId, at), { object: s.noteId });
       }
 
       case 'Delete': {
@@ -471,7 +520,7 @@ export class C2S {
         }
         const r = await social.deleteNote(agent, s);
         if (!r.ok) return reply(502, { error: r.error, stillPublished: r.stillPublished });
-        return reply(200, { ok: true });
+        return made(wire.deleteActivityId(s.noteId), { object: s.noteId });
       }
 
       case 'Follow': {
@@ -479,31 +528,27 @@ export class C2S {
         // An acct: form or bare handle resolves through WebFinger; an https
         // IRI is fetched directly.
         if (/^acct:|^@|^[^/@]+@[^/@]+$/.test(objectId) && !/^https?:/.test(objectId)) {
-          const r = await social.followHandle(agent, objectId.replace(/^acct:/, ''));
+          const r = await social.followHandle(agent, objectId.replace(/^acct:/, ''), { serial });
           const rec = this.store.getContacts().following.find((f) => f.actor === r.actor);
-          return reply(201, { id: rec?.followActivity?.id, object: r.actor },
-            rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
+          return made(rec?.followActivity?.id, { object: r.actor });
         }
-        const doc = await social.followActor(agent, objectId);
+        const doc = await social.followActor(agent, objectId, { serial });
         const rec = this.store.getContacts().following.find((f) => f.actor === doc.id);
-        return reply(201, { id: rec?.followActivity?.id, object: doc.id },
-          rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
+        return made(rec?.followActivity?.id, { object: doc.id });
       }
 
       case 'Like': {
         const s = this.byIri(objectId);
         if (!s) return reply(422, { error: 'that note is not held here — like what the timeline holds' });
-        const updated = await social.favourite(agent, s);
-        return reply(201, { id: updated.likeActivity?.id, object: s.noteId },
-          updated.likeActivity?.id ? { location: updated.likeActivity.id } : {});
+        const updated = await social.favourite(agent, s, { serial });
+        return made(updated.likeActivity?.id, { object: s.noteId });
       }
 
       case 'Announce': {
         const s = this.byIri(objectId);
         if (!s) return reply(422, { error: 'that note is not held here — boost what the timeline holds' });
-        const updated = await social.reblog(agent, s);
-        return reply(201, { id: updated.announceActivity?.id, object: s.noteId },
-          updated.announceActivity?.id ? { location: updated.announceActivity.id } : {});
+        const updated = await social.reblog(agent, s, { serial });
+        return made(updated.announceActivity?.id, { object: s.noteId });
       }
 
       case 'Undo': {
@@ -511,39 +556,47 @@ export class C2S {
         // sends one, by its type+object when it re-states it instead.
         const inner = object;
         const innerId = idOf(activity.object);
+        const undone = wire.undoActivityId(this.urls, serial);
         if (inner?.type === 'Block') {
           const target = idOf(inner.object);
           if (!target) return reply(400, { error: 'unblock whom?' });
-          await social.unblockActor(agent, target);
-          return reply(200, { ok: true, object: target });
+          await social.unblockActor(agent, target, { serial });
+          // A group's unban was sent, and recorded as it went; a person's is not.
+          if (this.store.getConfig()?.kind !== 'group') {
+            kept('Undo', { object: { type: 'Block', actor: this.urls.actor, object: target } });
+          }
+          return made(undone, { object: target });
         }
         const statuses = this.store.getStatuses();
         let s = innerId ? statuses.find((x) => x.likeActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Like') s = this.byIri(idOf(inner.object));
         if (s?.favourited) {
-          const updated = await social.unfavourite(agent, s);
-          return reply(200, { ok: true, object: updated.noteId });
+          const updated = await social.unfavourite(agent, s, { serial });
+          return made(undone, { object: updated.noteId });
         }
         s = innerId ? statuses.find((x) => x.announceActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Announce') s = this.byIri(idOf(inner.object));
         if (s?.reblogged) {
-          const updated = await social.unreblog(agent, s);
-          return reply(200, { ok: true, object: updated.noteId });
+          const updated = await social.unreblog(agent, s, { serial });
+          return made(undone, { object: updated.noteId });
         }
         const following = this.store.getContacts().following;
         const rec = following.find((f) => f.followActivity?.id === innerId)
           || (inner?.type === 'Follow' ? following.find((f) => f.actor === idOf(inner.object)) : null);
         if (rec) {
-          await social.unfollowActor(agent, rec.actor);
-          return reply(200, { ok: true, object: rec.actor });
+          await social.unfollowActor(agent, rec.actor, { serial });
+          return made(undone, { object: rec.actor });
         }
         return reply(422, { error: 'nothing here matches what that Undo names' });
       }
 
       case 'Block': {
         if (!objectId) return reply(400, { error: 'block whom? object must name an actor' });
-        await social.blockActor(agent, objectId);
-        return reply(200, { ok: true, object: objectId });
+        await social.blockActor(agent, objectId, { serial });
+        // A group's ban was sent to its members; a person's never goes anywhere.
+        const id = this.store.getConfig()?.kind === 'group'
+          ? `${this.urls.actor}#block-${serial}` : kept('Block', { object: objectId });
+        return made(id, { object: objectId });
       }
 
       case 'Add':
@@ -556,7 +609,8 @@ export class C2S {
         const s = this.byIri(objectId);
         if (!s) return reply(404, { error: 'no such note here' });
         const updated = await social.pinStatus(agent, s, activity.type === 'Add');
-        return reply(200, { ok: true, object: updated.noteId, pinned: !!updated.pinned });
+        return made(kept(activity.type, { object: updated.noteId, target: this.urls.featured }),
+          { object: updated.noteId, pinned: !!updated.pinned });
       }
 
       case 'Accept':
@@ -566,10 +620,10 @@ export class C2S {
         const requester = object?.actor ? idOf(object.actor) : objectId;
         if (!requester) return reply(400, { error: 'whose request? object must name the Follow or its actor' });
         const r = activity.type === 'Accept'
-          ? await social.admitRequest(agent, requester).catch((e) => ({ error: e.message }))
-          : await social.refuseRequest(agent, requester).catch((e) => ({ error: e.message }));
+          ? await social.admitRequest(agent, requester, { serial }).catch((e) => ({ error: e.message }))
+          : await social.refuseRequest(agent, requester, { serial }).catch((e) => ({ error: e.message }));
         if (r.error) return reply(404, { error: r.error });
-        return reply(200, { ok: true, object: requester });
+        return made(`${this.urls.actor}#${activity.type.toLowerCase()}-${serial}`, { object: requester });
       }
 
       case 'Move':

package/lib/client/masto/accounts.mjs

@@ -255,6 +255,7 @@ export async function handle(api, ctx) {
     if (req.method === 'POST' && !b.domains.includes(domain)) b.domains.push(domain);
     if (req.method === 'DELETE') b.domains = b.domains.filter(d => d !== domain);
     api.store.setBlocklist(b);
+    Promise.resolve(api.agent?.publisher?.publishCollections?.({ blocked: true })).catch(() => {});
     return send(200, {});
   }
 

package/lib/core/deliver.mjs

@@ -187,7 +187,21 @@ export class Deliverer {
     return out;
   }
 
+  // A fresh activity of this actor's, for the outbox its owner reads. Never
+  // allowed to stop a delivery; a retry from the queue is not fresh.
+  _sent(activity) {
+    try { this.onSent?.(activity); } catch (e) { this.log(`owner's outbox record: ${e.message}`); }
+  }
+
+  // An inbox on a blocked domain is never delivered to, whoever still lists it.
+  _blockedInbox(inbox) {
+    try { return !!this.store.getBlocklist?.().domains.length && this.store.isBlocked?.(new URL(inbox).origin + '/'); }
+    catch { return false; }
+  }
+
   async deliver(inbox, activity) {
+    this._sent(activity);
+    if (this._blockedInbox(inbox)) return;
     // Proved before anything else, so the copy that goes on the queue is the
     // copy that was signed — a retry days later must not post a bare activity.
     const signed = await this.proofed(activity);
@@ -250,13 +264,15 @@ export class Deliverer {
   }
 
   async deliverToAll(inboxes, activity) {
+    this._sent(activity);
     // Proved once for the whole fan-out: every recipient gets the same bytes,
     // and one signature is computed rather than one per follower.
     const signed = await this.proofed(activity);
     // Shared inboxes deduplicate fan-out to the same server. Sent in batches
     // of batchSize, and a host found cooling by one batch is not asked again
     // by the next.
-    const targets = [...new Set(inboxes)].map((inbox) => ({ inbox, activity: signed }));
+    const targets = [...new Set(inboxes)].filter((inbox) => !this._blockedInbox(inbox))
+      .map((inbox) => ({ inbox, activity: signed }));
     for (let i = 0; i < targets.length; i += this.batchSize) {
       const chunk = targets.slice(i, i + this.batchSize).filter((t) => !this._queueIfCooling(t.inbox, signed));
       if (!chunk.length) continue;

package/lib/core/intake/activities.mjs

@@ -5,6 +5,9 @@
 import { dropFollower } from '../store.mjs';
 import { emojisOf, pollOf, isContentType, trimActivity, reactionOf, quoteOf, quotePolicyOf, authorOf } from './activity.mjs';
 
+// How long a follower's refollow waits before it is answered again.
+const REACCEPT_MS = 60 * 60 * 1000;
+
 const idOf = (v) => (typeof v === 'string' ? v : v?.id);
 
 // §7.6 Add / §7.9 Remove. The side effect would be to add or remove the object
@@ -98,6 +101,18 @@ export async function onFollow(intake, activity, actor, { trusted = false } = {}
     await intake.republish({ followers: true });
     intake.log(`new follower: ${actor}`);
   }
+  // A refollow from someone already following is answered again — their server
+  // may have lost our Accept — but not every time: the same Follow sent over and
+  // over would otherwise make us send, and record, an Accept for each one.
+  if (existing) {
+    const c = intake.store.getContacts();
+    const f = c.followers.find(x => x.actor === actor);
+    if (f?.acceptedAt && Date.now() - Date.parse(f.acceptedAt) < REACCEPT_MS) {
+      intake.log(`refollow from ${actor} — already accepted within the hour, not answered again`);
+      return;
+    }
+    if (f) { f.acceptedAt = new Date().toISOString(); intake.store.setContacts(c); }
+  }
   const { acceptActivity } = await import('../wire.mjs');
   await intake.deliverer.deliver(doc.inbox,
     acceptActivity({ urls: intake.urls, followActivity: activity, serial: intake.serial++ }));
@@ -370,8 +385,9 @@ export async function onDelete(intake, activity, actor) {
       await intake.forget(s, { collect: retracted });
     }
     if (retracted.length) {
-      const gone = new Set(retracted);
-      await intake.publisher.unrecordOutbox(i => gone.has(i?.id));
+      const gone = new Set(retracted.map(u => u.object.id));
+      await intake.publisher.unrecordOutbox(i => gone.has(i?.id),
+        { record: (was) => (intake.config.private ? null : retracted.filter(u => was.includes(u.object.id))) });
     }
     // Both: an account deletion drops them from followers AND following.
     await intake.republish({ followers: true, following: true });

package/lib/core/intake/group.mjs

@@ -175,7 +175,9 @@ export async function amplify(intake, noteId, { approved = false, activity = nul
   // Marked carried before recorded: a failed outbox write costs one missing
   // entry, a failed status write would carry the same post twice.
   intake.store.updateStatus(noteId, { announcedAt: new Date().toISOString(), announceActivity: act });
-  await intake.publisher.recordOutbox(act);
+  // A private group's carries are written for its members alone, so they go on
+  // its owner's full outbox (recorded as sent) and never on the public one.
+  if (!intake.config.private) await intake.publisher.recordOutbox(act);
   intake.store.setPending(intake.store.getPending().filter(p => p.noteId !== noteId));
   intake.log(`amplified ${noteId} → ${inboxes.length} inbox(es)`);
   // What the group carried is what the group's conversation holds. A forum

package/lib/core/intake/index.mjs

@@ -656,10 +656,33 @@ export class Intake {
   // document, not our reading of it); the graph is what it decides from.
   // Returns null when published, else the reason it was not — a dead letter.
   async ownerPostFrom(activity, raw, receipt) {
+    // The receipt names the body it vouches for; a body it does not name is
+    // not the owner's. A body already handled — a replayed request, or an item
+    // the pod would not let us delete — is not published twice.
+    const hash = raw ? await sha256Hex(raw) : null;
+    if (receipt.hash && receipt.hash !== hash) return 'owner post refused: the body is not the one its receipt names';
+    const seen = this.store.read('c2s-seen.json', []);
+    if (hash && seen.includes(hash)) {
+      this.log('owner post already handled — not published again');
+      return null;
+    }
     let asSent = null;
     try { asSent = raw ? JSON.parse(raw) : null; } catch { asSent = null; }
-    const r = await this.ownerPost(activity, { raw: asSent, slug: receipt.slug || null });
-    if (!r || r.status >= 300) return `owner post refused (${r?.status || '?'}): ${r?.body?.error || ''}`;
+    const r = await this.ownerPost(activity, { raw: asSent, slug: receipt.slug || null,
+      // What the door told the client this will be called, when it said.
+      ...(receipt.serial ? { serial: receipt.serial } : {}), ...(receipt.at ? { at: receipt.at } : {}) });
+    // Handled, one way or the other: a second sight of it changes nothing. A
+    // throw above is not handled, and is tried again.
+    if (hash) this.store.write('c2s-seen.json', [hash, ...this.store.read('c2s-seen.json', [])].slice(0, C2S_SEEN_MAX));
+    if (!r || r.status >= 300) {
+      const why = r?.body?.error || 'no reason was given';
+      // The door already answered the app "created"; the owner is the one
+      // left to tell.
+      await this.publisher.noteToSelf?.(`An app asked your account to publish ${article(activity.type)}, `
+        + `and your account refused it: ${why}. Nothing was sent.`)
+        .catch(e => this.log(`could not tell the owner their post was refused: ${e.message}`));
+      return `owner post refused (${r?.status || '?'}): ${why}`;
+    }
     this.log(`owner post from the outbox door published: ${r.body?.object || r.body?.id || activity.type}`);
     return null;
   }
@@ -699,3 +722,11 @@ export class Intake {
   retract(...a) { return notes.retract(this, ...a); }
   addReply(...a) { return notes.addReply(this, ...a); }
 }
+
+// "a Like", "an Update": the kind of activity, as a sentence says it.
+const article = (type) => `${/^[AEIOU]/u.test(String(type)) ? 'an' : 'a'} ${type || 'post'}`;
+
+// Bodies the outbox door handed over that were handled, newest first.
+const C2S_SEEN_MAX = 500;
+const sha256Hex = async (text) => [...new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256',
+  new TextEncoder().encode(text)))].map(b => b.toString(16).padStart(2, '0')).join('');

package/lib/core/intake/notes.mjs

@@ -91,7 +91,11 @@ export async function maybeForward(intake, activity) {
       .filter(Boolean))];
     if (!inboxes.length) return;
     intake._forwardBudget -= 1;
-    await intake.deliverer.deliverToAll(inboxes, activity);
+    // Blind copies are for their sender's delivery alone and never travel on
+    // (§6, §7.1), from the activity or its object.
+    const strip = (o) => { if (!o || typeof o !== 'object') return o; const { bto, bcc, ...rest } = o; return rest; };   // eslint-disable-line no-unused-vars
+    const onward = { ...strip(activity), ...(activity.object && typeof activity.object === 'object' ? { object: strip(activity.object) } : {}) };
+    await intake.deliverer.deliverToAll(inboxes, onward);
     intake.store.write('forwarded.json', [...forwarded, id].slice(-MAX_FORWARDED));
     intake.log(`forwarded ${activity.type} ${id} to ${inboxes.length} follower inbox(es)`);
   } catch (e) {
@@ -319,10 +323,13 @@ export async function retract(intake, noteId, { collect = null } = {}) {
   if (!s.announceActivity) throw new Error('that post was never carried');
   const { undoActivity } = await import('../wire.mjs');
   const inboxes = intake.announceTargets(s.actor);
-  await intake.deliverer.deliverToAll(inboxes,
-    undoActivity({ urls: intake.urls, activity: s.announceActivity, serial: intake.serial++ }));
-  if (collect) collect.push(s.announceActivity.id);
-  else await intake.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id);
+  const undo = undoActivity({ urls: intake.urls, activity: s.announceActivity, serial: intake.serial++ });
+  await intake.deliverer.deliverToAll(inboxes, undo);
+  // The Undo takes the carry's place in the outbox, so a reader catching up
+  // from it learns the carry was withdrawn.
+  if (collect) collect.push(undo);
+  else await intake.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id,
+    { record: () => (intake.config.private ? null : undo) });
   intake.store.updateStatus(noteId, {
     announcedAt: undefined, announceActivity: undefined, retractedAt: new Date().toISOString(),
   });