fedipod 1.36.6 → 1.40.0

package/web/app/admin-facade.mjs

@@ -33,7 +33,7 @@ export const ADMIN_PATHS = new Set([
   '/deadletter', '/blocks', '/profiles', '/modqueue', '/log', '/fediacct', '/describe', '/follow',
   '/atproto', '/atproto/connect', '/atproto/disconnect',
   '/rebuild', '/move', '/retire', '/inbox/prune', '/park', '/revive', '/takeover',
-  '/gateway/pause', '/gateway/close',
+  '/gateway/pause', '/gateway/keep', '/gateway/close',
   '/fediacct/connect', '/fediacct/disconnect', '/fediacct/callback',
 ]);
 
@@ -143,6 +143,9 @@ export class AdminFacade {
             // gateway last said it (agent.mjs tellGateway). The record page
             // shows its pause and close controls only when this is here.
             standing: a.gatewayStanding || null,
+            // Whether the gateway may act for this account while the app is
+            // closed, and whether it does (agent.mjs setKeeper).
+            keeper: a._keeper ? { available: true, on: !!a._keeper.kept && !a.store.getConfig()?.keeperOff } : null,
           });
         }
         case '/deadletter': return json(200, { items: a.store.getDeadLetters() });
@@ -279,6 +282,13 @@ export class AdminFacade {
         if (!r) return json(502, { error: 'the gateway could not be reached' });
         return json(r.status === 200 ? 200 : r.status, r);
       }
+      case '/gateway/keep': {
+        if (typeof body.on !== 'boolean') return json(400, { error: 'on must be true or false' });
+        if (!a.setKeeper) return json(501, { error: 'this account is not at a gateway' });
+        if (!await a.requestTakeover?.()) return json(503, { error: 'another device is active for this pod — change it from there' });
+        const r = await a.setKeeper(body.on);
+        return json(r?.status === 200 ? 200 : (r?.status || 502), r || { error: 'the gateway could not be reached' });
+      }
       case '/gateway/close': {
         const handle = String(a.store.getConfig()?.handle || '').toLowerCase();
         if (!handle || String(body.confirm || '').toLowerCase() !== handle) return json(400, { error: 'type the handle to confirm' });
@@ -356,7 +366,7 @@ export class AdminFacade {
         const aliases = [...(cfg.aliases || [])];
         if (body.add) {
           if (!webfingerHost(urls.base) && !cfg.gateway?.frontActor) {
-            return json(400, { error: 'this pod is a suffix-based host, so other servers could never resolve it as a Move target' });
+            return json(400, { error: 'this pod is suffixed, so other servers could never resolve it as a Move target' });
           }
           const id = await this.resolveActor(body.add);
           if (!id) return json(400, { error: `could not fetch the old account (${body.add}) — enter its URL or @user@host, and it must answer` });

package/web/app/agent.mjs

@@ -6,7 +6,10 @@
 // the relay (deliver-relay). Everything between — wire, the store, the
 // publisher, intake, the Mastodon facade — is lib/, unchanged.
 import { kvGet, kvPut } from './idb-kv.mjs';
-import { apUrls } from '../../lib/core/wire.mjs';
+import { warmMeta, saveMeta, loadDocs, keepInStep, takeUp, isWarm, DRAIN_EVERY_MS } from './warm-start.mjs';
+import { publishDue, nextDue } from '../../lib/core/scheduled.mjs';
+import { apUrls, DEFAULT_ROOT } from '../../lib/core/wire.mjs';
+import { findAccount } from '../../lib/core/place.mjs';
 import * as containers from '../../lib/pod/containers.mjs';
 import * as podState from '../../lib/pod/state.mjs';
 import { PodStore } from '../../lib/core/store.mjs';
@@ -31,6 +34,7 @@ import { AcctFeed } from '../../lib/connections/acctfeed.mjs';
 import { followActor, unfollowActor, resolveHandle } from '../../lib/core/social.mjs';
 import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { ImportWorker } from '../../lib/connections/import.mjs';
+import { openCopy, copyStorage, copyLeaseOf, moveIntoCopy, leaveCopy, renewCopyToken, standDown, ensureCopyLease, handOverCopy } from './copy-mode.mjs';
 
 // The authorities this identity answers on: exactly one, this origin. The Node
 // agent gets this from lib/guard.mjs, which is not in the browser bundle and
@@ -129,6 +133,9 @@ export class BrowserAgent {
   // the lease, proceed. If we are a viewer, the owner acting HERE outranks the
   // idle active device: claim the lease outright and become active.
   async requestTakeover() {
+    // Working from the copy, an app at the gateway may have taken the lease
+    // since this browser last looked: asked now, before acting (copy-mode.mjs).
+    if (!this.viewer && this.copy) await ensureCopyLease(this);
     if (!this.viewer) return true;
     if (!(await this.lease.takeover())) return false;
     clearTimeout(this._viewerTimer); this._viewerTimer = null;
@@ -159,14 +166,85 @@ export class BrowserAgent {
   closeAtGateway() { return this.tellGateway('close', { handle: this.doorKey, confirm: true }); }
   static OPEN_EVERY_MS = 60 * 60_000;
 
+  // The gateway acting for this account while the app is closed, or not. On:
+  // the rules on the account's folders name the gateway's pod identity, then
+  // the gateway is told. Off: the gateway is told first, so it stops, then the
+  // name comes out of the rules. Every public rule follows, because the
+  // published face's digest includes who the rules name.
+  async setKeeper(on) {
+    const webId = this._keeper?.webId;
+    if (!webId || !this.gatewayApi) return { status: 501, error: 'this gateway cannot act for accounts' };
+    this.store.setConfig({ ...this.store.getConfig(), keeperOff: !on });
+    if (!on) {
+      // The account's copy goes back to the pod first (copy-mode.mjs).
+      const left = await leaveCopy(this);
+      if (!left.ok) return { status: 502, error: left.why };
+      const said = await this.tellGateway('keeper', { handle: this.doorKey, on: false });
+      if (said?.status !== 200) return said || { status: 502 };
+      this._keeper.kept = false;
+      if (this.masto) this.masto.scheduling = false;
+    }
+    this.remote.keepers = on ? [webId] : [];
+    await containers.restateRules(this.remote, this.urls);
+    await this.publisher.publishProfile();
+    await this.store.flush?.();
+    if (!on) return { status: 200, ok: true, kept: false };
+    const said = await this.tellGateway('keeper', { handle: this.doorKey, on: true });
+    if (said?.status === 200) {
+      this._keeper.kept = true;
+      if (this.masto) this.masto.scheduling = true;
+      this.log('the gateway keeps this account running while the app is closed');
+    }
+    return said || { status: 502 };
+  }
+
+  // A post just scheduled: the gateway hears when the next one falls due.
+  onScheduled() { this.hereAtGateway().catch(() => {}); }
+
+  // "The app is open", every five minutes while it is. While it is, the
+  // gateway sends mail straight to the pod; while it is not, it holds the mail
+  // and hands it over in batches, and the answer says how many it just did
+  // (lib/gateway/held-mail.mjs).
+  static HERE_EVERY_MS = 5 * 60_000;
+  async hereAtGateway() {
+    const said = await this.tellGateway('here', { handle: this.doorKey, nextAt: this.store ? nextDue(this.store) : null });
+    if (said?.status === 200) saveMeta(this.webId, { hereAt: Date.now() }).catch(() => {});
+    return said;
+  }
+
+  // The hourly "still here". A worker the browser killed and restarted is the
+  // same person, not a new sign-in: within the hour it answers from the last
+  // check-in, kept in this browser, instead of telling the gateway again.
+  async checkInAtGateway({ always = true } = {}) {
+    if (!this.gatewayApi) return null;
+    const key = `gateway-open:${this.gatewayApi}:${this.doorKey}`;
+    if (!always) {
+      const last = await kvGet(key).catch(() => null);
+      if (last?.standing && Date.now() - last.at < BrowserAgent.OPEN_EVERY_MS) {
+        this.gatewayStanding = last.standing;
+        return last.standing;
+      }
+    }
+    const standing = await this.openAtGateway();
+    if (standing?.status === 200 || standing?.status === 410) {
+      await kvPut(key, { at: Date.now(), standing }).catch(() => {});
+    }
+    await renewCopyToken(this, this.frontOrigin).catch(() => {});
+    return standing;
+  }
+
   // Become the active agent: renew the lease, then start what a viewer skips —
-  // publish the face, drain the inbox, run the mirrors.
-  async goActive() {
+  // publish the face, drain the inbox, run the mirrors. `warm` is a worker the
+  // browser restarted moments ago (warm-start.mjs): what a full start does once
+  // was done then, and the inbox is drained only when its cadence is due.
+  async goActive({ warm = null } = {}) {
     this.viewer = false;
     // Reading here is being here: the gateway hears so once an hour.
     clearInterval(this._openTimer);
-    this._openTimer = setInterval(() => { this.openAtGateway(); }, BrowserAgent.OPEN_EVERY_MS);
-    this.lease.onLost = () => this.demote();
+    this._openTimer = setInterval(() => { this.checkInAtGateway(); }, BrowserAgent.OPEN_EVERY_MS);
+    // Working from the copy, an app at the gateway takes the lease only while
+    // it acts, and this browser takes it back (copy-mode.mjs).
+    this.lease.onLost = () => (this.copy ? standDown(this) : this.demote());
     this.lease.startRenewal();
     try {
       // Forced, not revalidated, when this device WATCHED first: the active
@@ -175,27 +253,67 @@ export class BrowserAgent {
       // would push a whole document back over newer state. A device that
       // booted straight into acting read everything a moment ago; asking
       // again is one revalidation, not a second download of every document.
-      await this.store.load({ force: !!this._watched }).catch((e) => this.log(`re-reading state: ${e.message}`));
-      this._watched = false;
-      // Own posts the outbox names and the timeline index lacks come back
-      // here, before anything acts on the index.
-      await this.publisher.healStatuses().catch((e) => this.log(`healing the timeline index: ${e.message}`));
-      await this.publisher.publishProfilePage().catch((e) => this.log(`profile page: ${e.message}`));
+      if (!warm) {
+        await this.store.load({ force: !!this._watched }).catch((e) => this.log(`re-reading state: ${e.message}`));
+        this._watched = false;
+        // Own posts the outbox names and the timeline index lacks come back
+        // here, before anything acts on the index.
+        await this.publisher.healStatuses().catch((e) => this.log(`healing the timeline index: ${e.message}`));
+        // Likes made before the liked list existed become its first entries.
+        try { this.publisher.backfillLiked(); } catch (e) { this.log(`liked list: ${e.message}`); }
+        await this.publisher.publishProfilePage().catch((e) => this.log(`profile page: ${e.message}`));
+      }
       // And start delivering again, since demote() stopped it. startQueue() is
       // idempotent, so a goActive() that was already active costs nothing.
       this.deliverer?.startQueue?.();
-      await this.publisher.publishProfile();
-      await this.store.flush?.();
-      // An address that just moved here from another gateway: the new
-      // actor is published, so the old gateway and the followers can be told.
-      await completeGatewayMove(this).catch((e) => this.log(`gateway move: ${e.message}`));
-      await this.intake.start();
+      if (!warm) {
+        await this.publisher.publishProfile();
+        await this.store.flush?.();
+        // An address that just moved here from another gateway: the new
+        // actor is published, so the old gateway and the followers can be told.
+        await completeGatewayMove(this).catch((e) => this.log(`gateway move: ${e.message}`));
+        // The gateway has a new identity since this account's copy was made:
+        // the copy goes to the pod from here, and the new one is named below.
+        if (this.copy && this._keeper?.keptBy && this._keeper.keptBy !== this._keeper.webId) {
+          const moved = await handOverCopy(this).catch((e) => ({ ok: false, why: e.message }));
+          if (!moved.ok) this.log(`handing the copy over to the gateway's new identity: ${moved.why}`);
+        }
+        // The first start that can: the gateway may act for this account while
+        // the app is closed, unless its owner said no (setKeeper).
+        if (this._keeper && !this._keeper.kept && !this.copy && !this.store.getConfig()?.keeperOff) {
+          await this.setKeeper(true).catch((e) => this.log(`keeping the account while away: ${e.message}`));
+        }
+        // Kept: from here on the account works from its copy at the gateway.
+        if (this._keeper?.kept && !this.copy && !this.store.getConfig()?.keeperOff) {
+          await moveIntoCopy(this, this.frontOrigin).catch((e) => this.log(`the account's copy: ${e.message}`));
+          if (this.viewer) return;              // another agent holds the copy: reading only
+        }
+      }
+      const now = Date.now();
+      // Said before the drain starts, so held mail is in the inbox to be read.
+      const hereDue = !warm || now - (warm.hereAt || 0) >= BrowserAgent.HERE_EVERY_MS;
+      const here = hereDue ? await this.hereAtGateway() : null;
+      clearInterval(this._hereTimer);
+      this._hereTimer = setInterval(() => {
+        this.hereAtGateway().then((h) => { if (h?.flushed) this.intake?.drain().catch(() => {}); });
+      }, BrowserAgent.HERE_EVERY_MS);
+      // Scheduled posts and polls whose time is up (lib/core/scheduled.mjs).
+      await publishDue(this.store, this.publisher, this.log).catch((e) => this.log(`scheduled posts: ${e.message}`));
+      clearInterval(this._schedTimer);
+      this._schedTimer = setInterval(() => { publishDue(this.store, this.publisher, this.log).catch(() => {}); }, 30_000);
+      const drainNow = !warm || now - (warm.drainedAt || 0) >= DRAIN_EVERY_MS || here?.flushed > 0;
+      await this.intake.start({ drainNow, subscribe: !warm || !!warm.resubscribe });
       this.startBsky();
       this.startAccts();
-      this.tagfeed?.start();
+      this.tagfeed?.start(this.mirrorStart('tags'));
       // Resumes a run that was staged on another device, or here before a
       // restart — the state lives on the pod, not in this process.
       this.importer?.start();
+      // What the next restart may take up.
+      saveMeta(this.webId, warm
+        ? { wakeAt: now, copy: this.copy || null, ...(drainNow ? { drainedAt: now } : {}) }
+        : { root: this.store.getConfig()?.root || null, copy: this.copy || null, fullAt: now, wakeAt: now, drainedAt: now })
+        .catch(() => {});
     } catch (e) { this.log(`going active: ${e.message}`); }
   }
 
@@ -208,6 +326,8 @@ export class BrowserAgent {
     this.log('another device took over — read-only here');
     this.lease.stopRenewal();
     clearInterval(this._openTimer); this._openTimer = null;
+    clearInterval(this._hereTimer); this._hereTimer = null;
+    clearInterval(this._schedTimer); this._schedTimer = null;
     this.intake?.stop?.();
     // The delivery queue as well. Its timer starts in the Deliverer's
     // constructor and nothing here ever switched it off, so a demoted device
@@ -273,7 +393,7 @@ export class BrowserAgent {
     }
   }
 
-  async boot({ oidc, credential, keysRecord, config, frontOrigin }) {
+  async boot({ oidc, credential, keysRecord, config, frontOrigin, restart = false }) {
     let session; let webId; let remotePod;
     if (oidc) {
       session = { fetch: (u, i) => oidc.fetch(u, i) };
@@ -289,8 +409,26 @@ export class BrowserAgent {
     // The pod session's own fetch, for the gateway APIs that take it as
     // proof of the pod (attach, move) — the transport below is for the pod.
     this.sessionFetch = session.fetch;
-    const root = (config && config.root) || 'fedipod/';
     this.remote = new BrowserRemotePod(session, { webId, log: this.log });
+    // Where the account lives: handed in on sign-up, else what its owner's type
+    // index records, else `fedipod/` for an account older than the choice.
+    // A worker the browser restarted moments ago may take up what its last
+    // start read (warm-start.mjs) instead of reading the pod again.
+    const warmFrom = restart ? await warmMeta(webId).catch(() => null) : null;
+    // This browser's lease id, and the account's copy at the gateway when the
+    // gateway keeps the account running (copy-mode.mjs): asked before any state
+    // is read, since it decides where the state is read from.
+    this.holderId = await this.deviceId();
+    this.frontOrigin = frontOrigin || null;
+    this.copy = await openCopy(this, this.frontOrigin, { kept: isWarm(warmFrom) ? warmFrom.copy : null });
+    const warmRoot = isWarm(warmFrom) && !!warmFrom.copy === !!this.copy ? warmFrom.root : null;
+    const copyRoot = this.copy?.podHome?.startsWith(remotePod) ? this.copy.podHome.slice(remotePod.length) : null;
+    this._sweptAt = { ...(warmFrom?.sweptAt || {}) };
+    const root = (config && config.root) || warmRoot || copyRoot
+      || (await findAccount(this.remote, remotePod,
+        (r) => podState.readConfig(this.remote, { state: `${remotePod}${r}ap-state/` }),
+        (c) => (c.kind || 'person') === 'person').catch(() => null))?.root
+      || DEFAULT_ROOT;
     // Pod-native for now: the state store below is read with these, and only
     // the config it holds says whether this identity is fronted.
     this.urls = apUrls(remotePod, root);
@@ -301,7 +439,32 @@ export class BrowserAgent {
     // the deletion deny-list that every other write on this agent observes.
     // The Node agent has always passed remote.fetch here.
     const podFetch = (u, i) => this.remote.fetch(u, i);
-    this.store = new PodStore({ storage: new HttpStorage(this.urls.state, podFetch), log: this.log });
+    const podStateStorage = new HttpStorage(this.urls.state, podFetch);
+    this.store = new PodStore({ storage: this.copy ? copyStorage(this, podStateStorage) : podStateStorage, log: this.log });
+    keepInStep(this.store, webId, this.log);
+    // Single-active-agent lease (lib/lease.mjs): the inbox drain is a
+    // destructive read and the state store is write-through-cached, so exactly
+    // one browser/device may ACT on a pod at a time — a later arrival runs
+    // read-only until the owner acts on it and it takes over. Written with fresh
+    // fetches, never the cached store.
+    // The holder id is kept on this origin, so THIS browser is one holder
+    // however many times its worker is killed and restarted. Without it every
+    // restart was a new holder: the old lease still had minutes to run, so the
+    // browser found its own account "active on another device" and asked to
+    // take it over. Switching between the clients did it every time, being a
+    // navigation. Working from the copy, the lease is the copy's.
+    this.lease = this.copy ? copyLeaseOf(this)
+      : new Lease({ url: this.urls.state + 'lease.json', fetchImpl: podFetch, log: this.log, id: this.holderId });
+    // What was kept is used only while the lease is still this browser's:
+    // nobody else can have written the state in between.
+    this._warm = null;
+    if (warmRoot && warmRoot === root) {
+      const held = await this.lease.resume().catch(() => null);
+      if (held) {
+        const pending = takeUp(this.store, await loadDocs(webId).catch(() => []), warmFrom.listingEtag);
+        this._warm = { ...warmFrom, renewDue: held.renewDue, pending };
+      }
+    }
     // A read that FAILED is not an account that is not there. load() already
     // tells those apart — a missing container, a refused token, a pod saying
     // "too many requests" each come back with their own reason — and throwing
@@ -310,7 +473,10 @@ export class BrowserAgent {
     // unread. Keep it: below is the only place that can tell whether it
     // mattered, because a sign-up hands its config in and needs no read at all.
     let unread = null;
-    await this.store.load().catch((e) => { unread = e; });
+    const fullLoad = () => this.store.load().catch((e) => { unread = e; });
+    // Warm: only documents caught mid-write are read again, else a full load.
+    if (this._warm) await this.store.refresh(this._warm.pending).catch(fullLoad);
+    else await fullLoad();
     // Config: handed in on sign-up, or read from the pod on a returning sign-in.
     const cfg = config || this.store.getConfig();
     if (!cfg) throw await accountNotRead({ unread, podBase: remotePod, state: this.urls.state, webId, actorUrl: this.urls.actor });
@@ -355,15 +521,16 @@ export class BrowserAgent {
     // standing there — paused, closed, how much arrived unread (front-core:
     // accounts that go quiet). The gateway is told on every sign-in and
     // hourly while this device is active: that is what keeps an account
-    // somebody reads from counting as a quiet one. Only a closed address
-    // stops the boot; a gateway that cannot be reached is no reason to
-    // refuse a sign-in.
+    // somebody reads from counting as a quiet one. A worker restart is not a
+    // sign-in and tells it only when the last check-in is an hour old. Only a
+    // closed address stops the boot; a gateway that cannot be reached is no
+    // reason to refuse a sign-in.
     // At the page's own origin, as the relay is: a page on the test alias
     // asked the real site instead and could not get past its preflight.
     this.gatewayApi = config.gateway?.url ? `${frontOrigin.replace(/\/$/, '')}/api` : null;
     this.doorKey = doorKeyOf(config.gateway?.url) || config.handle;
     this.gatewayStanding = null;
-    const standing = await this.openAtGateway();
+    const standing = await this.checkInAtGateway({ always: !restart });
     if (standing?.status === 410) {
       const host = (() => { try { return new URL(this.gatewayApi).host; } catch { return 'the gateway'; } })();
       const address = this.doorKey.includes('@') ? `@${this.doorKey}` : `@${this.doorKey}@${host}`;
@@ -373,6 +540,11 @@ export class BrowserAgent {
       e.code = 'address-closed';
       throw e;
     }
+    // The gateway's own pod identity, when it can act for this account while
+    // the app is closed (lib/gateway/keeper.mjs). Unless the owner turned that
+    // off, every rule this agent writes names it beside the owner.
+    this._keeper = standing?.keeper ? { webId: standing.keeper, kept: !!standing.kept, keptBy: standing.keptBy || null } : null;
+    if (this._keeper && !this.store.getConfig()?.keeperOff) this.remote.keepers = [this._keeper.webId];
 
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,
@@ -405,18 +577,8 @@ export class BrowserAgent {
     // throttled request hangs the whole sign-in. So it runs in the background,
     // where per-request retry rides out the throttling; `this.provisioning`
     // resolves when it is done (a test, or a later call, can await it).
-    // Single-active-agent lease (lib/lease.mjs): the inbox drain is a
-    // destructive read and the state store is write-through-cached, so exactly
-    // one browser/device may ACT on a pod at a time — a later arrival runs
-    // read-only until the owner acts on it and it takes over. Written with fresh
-    // fetches, never the cached store. Passed into Intake so the drain checks it.
-    this.lease = new Lease({ url: this.urls.state + 'lease.json', fetchImpl: podFetch, log: this.log,
-      // Kept on this origin, so THIS browser is one holder however many times
-      // its worker is killed and restarted. Without it every restart was a new
-      // holder: the old lease still had minutes to run, so the browser found
-      // its own account "active on another device" and asked to take it over.
-      // Switching between the clients did it every time, being a navigation.
-      id: await this.deviceId() });
+    // The lease (made above, before the first state read) goes into Intake so
+    // the drain checks it.
     // The client-to-server dispatcher, here only for what the Gateway's
     // outbox door takes on the owner's behalf: the browser answers no
     // /ap/outbox of its own.
@@ -433,15 +595,16 @@ export class BrowserAgent {
     // policy (lib/mastoapi.mjs:315). So any page could have a freshly minted
     // 90-day bearer delivered to an address of its own. One origin, ours, is
     // the whole of the policy here.
-    // Three capabilities this build does not have, declared rather than
+    // Capabilities this build has only in part, declared rather than
     // pretended: no streaming socket (a worker is fetch-only), no web push
-    // (shims/web-push.mjs is a no-op), and no scheduling (nothing here runs
-    // between now and the scheduled time to publish). Each is omitted from the
-    // instance document, so the client hides the control instead of offering
-    // one that quietly does nothing.
+    // (shims/web-push.mjs is a no-op), and scheduling only while the gateway
+    // keeps the account running, because then something is running when the
+    // time comes (setKeeper). Each is omitted from the instance document when
+    // off, so the client hides the control instead of offering one that
+    // quietly does nothing.
     this.masto = new MastoApi({
       agent: this, log: this.log, scheme: 'https',
-      streaming: false, webPush: false, scheduling: false,
+      streaming: false, webPush: false, scheduling: !!(this._keeper?.kept && !this.store.getConfig()?.keeperOff),
       allowed: originAuthorities(self.location.host),
     });
 
@@ -472,21 +635,23 @@ export class BrowserAgent {
     this.provisioning = (async () => {
       // Owner-only containers first; idempotent, so a second device provisioning
       // them too is harmless. Each public document sets its own Read ACL inside
-      // publishProfile. Mirrors run-agent bootstrap.
-      await containers.provisionPrivate(this.remote, this.urls);
+      // publishProfile. Mirrors run-agent bootstrap. A warm restart did this at
+      // its last full start.
+      if (!this._warm) await containers.provisionPrivate(this.remote, this.urls);
       // Connected-account records are reads — safe whether we act or view.
       await this.atproto.load();      // the Bluesky credential, if it is browser-stored
       await this.fediaccts.load();    // connected fediverse accounts, from both backends
       // The lease decides: this device ACTS on the pod, or reads it read-only.
-      this.viewer = !(await this.lease.acquire());
+      // A warm restart already holds it, and writes it only when renewal is due.
+      this.viewer = !(this._warm && !this._warm.renewDue ? true : await this.lease.acquire());
       if (this.viewer) {
         this._watched = true;
         this.log(`read-only viewer: another device is active on @${config.handle}`);
         this.startViewerPoll();       // reload the feed, and promote if the lease frees
         return;
       }
-      await this.goActive();
-      this.log(`browser agent fully provisioned (active): @${config.handle}`);
+      await this.goActive({ warm: this._warm });
+      this.log(`browser agent ${this._warm ? 'resumed' : 'fully provisioned'} (active): @${config.handle}`);
     })().catch((e) => { this.log(`background provisioning: ${e.message}`); throw e; });
     // Never let an unhandled rejection escape when nobody awaits it.
     this.provisioning.catch(() => {});
@@ -551,7 +716,7 @@ export class BrowserAgent {
     if (!this.atproto?.feedActive()) return;   // connected AND not paused
     if (this.store.getConfig()?.quiescedAt) return;
     this.bskyfeed ||= new BskyFeed({ store: this.store, atproto: this.atproto, log: this.log });
-    this.bskyfeed.start();
+    this.bskyfeed.start(this.mirrorStart('bsky'));
   }
 
   stopBsky() { this.bskyfeed?.stop(); }
@@ -568,7 +733,19 @@ export class BrowserAgent {
     if (!this.fediaccts?.connected()) return;
     if (this.store.getConfig()?.quiescedAt) return;
     this.acctfeed ||= new AcctFeed({ store: this.store, accounts: this.fediaccts, log: this.log });
-    this.acctfeed.start();
+    this.acctfeed.start(this.mirrorStart('accts'));
+  }
+
+  // When each mirror last swept, kept in this browser (warm-start.mjs), so a
+  // worker restart does not sweep it again before its interval is up.
+  mirrorStart(name) {
+    return {
+      lastSweptAt: this._sweptAt?.[name] || 0,
+      onSwept: (at) => {
+        this._sweptAt = { ...this._sweptAt, [name]: at };
+        saveMeta(this.webId, { sweptAt: this._sweptAt }).catch(() => {});
+      },
+    };
   }
 
   stopAccts() { this.acctfeed?.stop(); }