fedipod 1.36.6 → 1.40.0

package/lib/client/masto/index.mjs

@@ -149,7 +149,10 @@ export class MastoApi {
     // A viewer-mode agent (another agent holds the drain lease) may not act —
     // but a user acting HERE outranks the idle active agent elsewhere, so a
     // write attempt claims the lease and proceeds. Only a failed claim 503s.
-    if (this.agent.viewer && req.method !== 'GET' && req.method !== 'HEAD') {
+    // An agent working from a copy its gateway shares (the browser build,
+    // web/app/copy-mode.mjs) asks every time, since an app at the gateway may
+    // have taken the lease without it hearing yet.
+    if ((this.agent.viewer || this.agent.copy) && req.method !== 'GET' && req.method !== 'HEAD') {
       const took = await this.agent.requestTakeover?.();
       if (!took) return send(503, { error: 'another agent is active for this pod — takeover failed, try again' });
     }

package/lib/client/masto/oauth.mjs

@@ -45,7 +45,7 @@ const parseRedirects = (v) => (Array.isArray(v) ? v : String(v || '').split(/\s+
 // The sign-in page for an account whose owner signs in at their pod: no
 // password of ours exists, and none is asked for. The page carries the
 // client's request in its address, signs the owner in at the pod with the
-// fediverse-account library, and proves that sign-in back to /oauth/authorize.
+// fediverse-session library, and proves that sign-in back to /oauth/authorize.
 function sendPodSigninPage(res, client, webId, mount = '') {
   let asking = '';
   if (client && (client.name || client.redirect)) {

package/lib/client/masto/statuses.mjs

@@ -112,6 +112,9 @@ export async function handle(api, ctx) {
       };
       sched.push(entry);
       api.store.setScheduled(sched);
+      // Whatever keeps the time for this agent hears of it (a browser app
+      // tells its gateway, which publishes it if the app has closed by then).
+      api.agent.onScheduled?.();
       return send(200, api.scheduledJson(entry));
     }
     let note;

package/lib/connections/acctfeed.mjs

@@ -55,18 +55,22 @@ export class AcctFeed {
     });
   }
 
-  start() {
+  // `lastSweptAt` and `onSwept`: see TagFeed.start — a restarted browser
+  // worker sweeps only when the interval is due.
+  start({ lastSweptAt = 0, onSwept = null } = {}) {
     this.stopped = false;
-    this.sweep().catch(e => this.log(`acctfeed: ${e.message}`));
-    const tick = () => {
-      this.timer = setTimeout(() => {
-        this.sweep()
-          .catch(e => this.log(`acctfeed: ${e.message}`))
-          .finally(() => { if (!this.stopped) tick(); });
-      }, Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3)));
+    const sweep = () => this.sweep()
+      .catch(e => this.log(`acctfeed: ${e.message}`))
+      .finally(() => onSwept?.(Date.now()));
+    const every = () => Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3));
+    const tick = (ms) => {
+      this.timer = setTimeout(() => { sweep().finally(() => { if (!this.stopped) tick(every()); }); }, ms);
       this.timer.unref?.();
     };
-    tick();
+    const due = lastSweptAt + this.config().intervalMin * 60_000 - Date.now();
+    if (due > 0) { tick(due); return; }
+    sweep();
+    tick(every());
   }
 
   stop() { this.stopped = true; clearTimeout(this.timer); }

package/lib/connections/bskyfeed.mjs

@@ -52,18 +52,22 @@ export class BskyFeed {
     return this.config();
   }
 
-  start() {
+  // `lastSweptAt` and `onSwept`: see TagFeed.start — a restarted browser
+  // worker sweeps only when the interval is due.
+  start({ lastSweptAt = 0, onSwept = null } = {}) {
     this.stopped = false;
-    this.sweep().catch(e => this.log(`bskyfeed: ${e.message}`));
-    const tick = () => {
-      this.timer = setTimeout(() => {
-        this.sweep()
-          .catch(e => this.log(`bskyfeed: ${e.message}`))
-          .finally(() => { if (!this.stopped) tick(); });
-      }, Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3)));
+    const sweep = () => this.sweep()
+      .catch(e => this.log(`bskyfeed: ${e.message}`))
+      .finally(() => onSwept?.(Date.now()));
+    const every = () => Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3));
+    const tick = (ms) => {
+      this.timer = setTimeout(() => { sweep().finally(() => { if (!this.stopped) tick(every()); }); }, ms);
       this.timer.unref?.();
     };
-    tick();
+    const due = lastSweptAt + this.config().intervalMin * 60_000 - Date.now();
+    if (due > 0) { tick(due); return; }
+    sweep();
+    tick(every());
   }
 
   stop() { this.stopped = true; clearTimeout(this.timer); }

package/lib/connections/tagfeed.mjs

@@ -72,20 +72,25 @@ export class TagFeed {
     return this.config();
   }
 
-  start() {
+  // `lastSweptAt` and `onSwept` are for a browser worker the browser stops and
+  // restarts: it keeps the time of its last sweep, so a restart sweeps only
+  // when the interval is due rather than on every wake.
+  start({ lastSweptAt = 0, onSwept = null } = {}) {
     this.stopped = false;                     // restartable, the same way Intake.start is
-    this.sweep().catch(e => this.log(`tagfeed: ${e.message}`));
+    const sweep = () => this.sweep()
+      .catch(e => this.log(`tagfeed: ${e.message}`))
+      .finally(() => onSwept?.(Date.now()));
     // Jittered and self-scheduling: every agent polling the same instance on
     // the same 15-minute boundary is a beat nobody asked for.
-    const tick = () => {
-      this.timer = setTimeout(() => {
-        this.sweep()
-          .catch(e => this.log(`tagfeed: ${e.message}`))
-          .finally(() => { if (!this.stopped) tick(); });
-      }, Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3)));
+    const every = () => Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3));
+    const tick = (ms) => {
+      this.timer = setTimeout(() => { sweep().finally(() => { if (!this.stopped) tick(every()); }); }, ms);
       this.timer.unref?.();
     };
-    tick();
+    const due = lastSweptAt + this.config().intervalMin * 60_000 - Date.now();
+    if (due > 0) { tick(due); return; }
+    sweep();
+    tick(every());
   }
 
   // The flag is what makes this stick. Clearing the timer only cancels a sweep

package/lib/core/deliver.mjs

@@ -187,7 +187,21 @@ export class Deliverer {
     return out;
   }
 
+  // A fresh activity of this actor's, for the outbox its owner reads. Never
+  // allowed to stop a delivery; a retry from the queue is not fresh.
+  _sent(activity) {
+    try { this.onSent?.(activity); } catch (e) { this.log(`owner's outbox record: ${e.message}`); }
+  }
+
+  // An inbox on a blocked domain is never delivered to, whoever still lists it.
+  _blockedInbox(inbox) {
+    try { return !!this.store.getBlocklist?.().domains.length && this.store.isBlocked?.(new URL(inbox).origin + '/'); }
+    catch { return false; }
+  }
+
   async deliver(inbox, activity) {
+    this._sent(activity);
+    if (this._blockedInbox(inbox)) return;
     // Proved before anything else, so the copy that goes on the queue is the
     // copy that was signed — a retry days later must not post a bare activity.
     const signed = await this.proofed(activity);
@@ -250,13 +264,15 @@ export class Deliverer {
   }
 
   async deliverToAll(inboxes, activity) {
+    this._sent(activity);
     // Proved once for the whole fan-out: every recipient gets the same bytes,
     // and one signature is computed rather than one per follower.
     const signed = await this.proofed(activity);
     // Shared inboxes deduplicate fan-out to the same server. Sent in batches
     // of batchSize, and a host found cooling by one batch is not asked again
     // by the next.
-    const targets = [...new Set(inboxes)].map((inbox) => ({ inbox, activity: signed }));
+    const targets = [...new Set(inboxes)].filter((inbox) => !this._blockedInbox(inbox))
+      .map((inbox) => ({ inbox, activity: signed }));
     for (let i = 0; i < targets.length; i += this.batchSize) {
       const chunk = targets.slice(i, i + this.batchSize).filter((t) => !this._queueIfCooling(t.inbox, signed));
       if (!chunk.length) continue;

package/lib/core/intake/activities.mjs

@@ -5,6 +5,9 @@
 import { dropFollower } from '../store.mjs';
 import { emojisOf, pollOf, isContentType, trimActivity, reactionOf, quoteOf, quotePolicyOf, authorOf } from './activity.mjs';
 
+// How long a follower's refollow waits before it is answered again.
+const REACCEPT_MS = 60 * 60 * 1000;
+
 const idOf = (v) => (typeof v === 'string' ? v : v?.id);
 
 // §7.6 Add / §7.9 Remove. The side effect would be to add or remove the object
@@ -98,6 +101,18 @@ export async function onFollow(intake, activity, actor, { trusted = false } = {}
     await intake.republish({ followers: true });
     intake.log(`new follower: ${actor}`);
   }
+  // A refollow from someone already following is answered again — their server
+  // may have lost our Accept — but not every time: the same Follow sent over and
+  // over would otherwise make us send, and record, an Accept for each one.
+  if (existing) {
+    const c = intake.store.getContacts();
+    const f = c.followers.find(x => x.actor === actor);
+    if (f?.acceptedAt && Date.now() - Date.parse(f.acceptedAt) < REACCEPT_MS) {
+      intake.log(`refollow from ${actor} — already accepted within the hour, not answered again`);
+      return;
+    }
+    if (f) { f.acceptedAt = new Date().toISOString(); intake.store.setContacts(c); }
+  }
   const { acceptActivity } = await import('../wire.mjs');
   await intake.deliverer.deliver(doc.inbox,
     acceptActivity({ urls: intake.urls, followActivity: activity, serial: intake.serial++ }));
@@ -370,8 +385,9 @@ export async function onDelete(intake, activity, actor) {
       await intake.forget(s, { collect: retracted });
     }
     if (retracted.length) {
-      const gone = new Set(retracted);
-      await intake.publisher.unrecordOutbox(i => gone.has(i?.id));
+      const gone = new Set(retracted.map(u => u.object.id));
+      await intake.publisher.unrecordOutbox(i => gone.has(i?.id),
+        { record: (was) => (intake.config.private ? null : retracted.filter(u => was.includes(u.object.id))) });
     }
     // Both: an account deletion drops them from followers AND following.
     await intake.republish({ followers: true, following: true });

package/lib/core/intake/group.mjs

@@ -175,7 +175,9 @@ export async function amplify(intake, noteId, { approved = false, activity = nul
   // Marked carried before recorded: a failed outbox write costs one missing
   // entry, a failed status write would carry the same post twice.
   intake.store.updateStatus(noteId, { announcedAt: new Date().toISOString(), announceActivity: act });
-  await intake.publisher.recordOutbox(act);
+  // A private group's carries are written for its members alone, so they go on
+  // its owner's full outbox (recorded as sent) and never on the public one.
+  if (!intake.config.private) await intake.publisher.recordOutbox(act);
   intake.store.setPending(intake.store.getPending().filter(p => p.noteId !== noteId));
   intake.log(`amplified ${noteId} → ${inboxes.length} inbox(es)`);
   // What the group carried is what the group's conversation holds. A forum

package/lib/core/intake/index.mjs

@@ -58,6 +58,11 @@ const ATTEMPTS_DOC = 'intake-attempts.json';
 const ATTEMPTS_TTL_MS = 7 * 24 * 60 * 60_000;
 const MAX_ITEM_ATTEMPTS = 5;
 const MAX_ITEMS_PER_DRAIN = 50;
+// A batch the gateway wrote while the owner's app was closed: at most this many
+// deliveries, read under this cap (lib/gateway/held-mail.mjs writes 100).
+const MAX_BATCH_ENTRIES = 100;
+const MAX_BATCH_BYTES = 8 * 1024 * 1024;
+const isBatch = (url) => /\/batch-[^/]*\.json$/u.test(url);
 
 export class Intake {
   // `ownerPost(activity, { raw, slug })` is the client-to-server dispatcher,
@@ -88,8 +93,10 @@ export class Intake {
   // either case every item drained since the last successful write is gone,
   // and what goes is the mentions, replies, join requests and dead-letter
   // records that nothing else can rebuild.
+  // Against the store's generation when this sweep began: results dropped
+  // since (another agent acted, web/app/copy-mode.mjs) are not written down.
   async _persisted() {
-    return this.store.commit();
+    return this.store.commit({ since: this._sweepGen });
   }
 
   _backOff(why) {
@@ -107,9 +114,11 @@ export class Intake {
     return this.wsState === 'open' || this.wsState === 'in-process' ? POLL_PUSH_OK_MS : POLL_MS;
   }
 
-  async start() {
+  // `drainNow: false` and `subscribe: false` are for a browser worker the
+  // browser restarted: it drained moments ago, and a socket would die with it.
+  async start({ drainNow = true, subscribe = true } = {}) {
     this.stopped = false;                     // restartable across demote/takeover cycles
-    await this.drain().catch(e => this.log(`drain: ${e.message}`));
+    if (drainNow) await this.drain().catch(e => this.log(`drain: ${e.message}`));
     const tick = () => {
       this.pollTimer = setTimeout(() => {
         this.drain().catch(e => this.log(`drain: ${e.message}`)).finally(() => { if (!this.stopped) tick(); });
@@ -119,8 +128,8 @@ export class Intake {
     tick();
     // Embedded in the pod server, a notification socket back to that same
     // server buys nothing — the store's own change events wake the drain.
-    if (this.push) this.subscribe().catch(e => this.log(`subscribe: ${e.message}`));
-    else this.wsState = 'in-process';
+    if (!this.push) this.wsState = 'in-process';
+    else if (subscribe) this.subscribe().catch(e => this.log(`subscribe: ${e.message}`));
   }
 
   stop() { this.stopped = true; clearTimeout(this.pollTimer); clearTimeout(this.resubTimer); this.ws?.close(); }
@@ -208,6 +217,7 @@ export class Intake {
   // us, a mention, a reply to ours, or from someone we follow — and drops the
   // rest.
   async prune({ before, keepConcerning = false } = {}) {
+    this._sweepGen = this.store.generation;
     const cutoff = Date.parse(before);
     if (!Number.isFinite(cutoff)) throw new Error(`"${before}" is not a date`);
     const all = await podInbox.list(this.remote, this.urls);
@@ -217,7 +227,29 @@ export class Intake {
 
     for (const item of older) {
       try {
-        if (item.size > MAX_ITEM_BYTES) {
+        if (isBatch(item.url)) {
+          // Mail the gateway held while the app was closed: the same rule for
+          // each delivery in it, then the batch goes.
+          for (const e of (await this._batchEntries(item.url)) || []) {
+            const read = typeof e?.body === 'string' ? await readLenient(e.body) : null;
+            const activity = read?.view ?? read?.doc ?? null;
+            const receipt = activity ? await this._checkReceipt(e?.receipt) : null;
+            if (keepConcerning) {
+              const rejection = activity ? await this.handle(activity, receipt) : 'unparsable JSON';
+              if (rejection) out.dropped++; else out.applied++;
+            } else if (activity && activity.type !== 'Create') {
+              await this.handle(activity, receipt);
+              out.applied++;
+            } else {
+              out.dropped++;
+            }
+          }
+          if (!await this._persisted()) {
+            this.log('state not written — stopping the prune with a batch left');
+            break;
+          }
+          await podInbox.dropHandledItem(this.remote, item.url);
+        } else if (item.size > MAX_ITEM_BYTES) {
           await podInbox.dropHandledItem(this.remote, item.url);   // unreadable by the drain either way
           out.discarded++;
         } else {
@@ -309,6 +341,7 @@ export class Intake {
   }
 
   async _drainOnce() {
+    this._sweepGen = this.store.generation;
     const cooling = this.drainCooldownUntil - Date.now();
     if (cooling > 0) {
       this.log(`inbox sweep skipped — backing off for another ${Math.ceil(cooling / 1000)}s`);
@@ -389,8 +422,29 @@ export class Intake {
       return true;
     };
 
+    let spent = 0;                   // deliveries taken this sweep, a batch counting each of its own
     for (const { url, size, receipt: hasReceipt } of items) {
       if (url.endsWith('.keep')) continue;
+      if (spent >= MAX_ITEMS_PER_DRAIN) { this._drainAgain = handled > 0 || pending.length > 0; break; }
+      if (isBatch(url)) {
+        try {
+          const took = await this._takeBatch(url);
+          spent += took.entries;
+          if (took.complete) pending.push(url);
+        } catch (e) {
+          // The batch itself could not be read: tried again next sweep, like
+          // any item, and dead-lettered only after as many tries.
+          const n = this._bumpAttempt(url, e.message);
+          this.log(`inbox batch ${url} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${e.message}`);
+          if (n >= MAX_ITEM_ATTEMPTS) {
+            this.store.addDeadLetter({ inboxUrl: url, reason: `failed ${n}x: ${e.message}`, activity: null });
+            pending.push(url);
+          }
+        }
+        if (pending.length >= DELETE_BATCH && !await flush()) return;
+        continue;
+      }
+      spent++;
       if (hasReceipt) withReceipt.add(url);
       // The listing already carries every child's size, so this costs nothing
       // to ask. An activity is a few kB; anything of this order is not one, and
@@ -404,7 +458,7 @@ export class Intake {
         pending.push(url);
         continue;
       }
-      let activity = null;
+      const at = {};
       try {
         const got = await podInbox.readItem(this.remote, url, { maxBytes: MAX_ITEM_BYTES, readCapped });
         // readItem carries the rule that matters here: a pod that would not
@@ -413,56 +467,19 @@ export class Intake {
         // made it "unparsable JSON" — a REJECTION, dead-lettered with both
         // `activity` and `raw` null and then DELETEd, destroying a delivery on
         // a transient fault with no record of what it had been.
-        const raw = got.raw;
-        // Read as JSON-LD, so a document whose terms are aliased means what it
-        // says. A document we cannot read that way is read the way it always
-        // was rather than lost, and the reason is logged.
-        const read = raw ? await readLenient(raw) : null;
-        if (read?.degraded) this.log(`inbox item ${url} grounded to read: ${read.degraded}`);
-        activity = read?.view ?? read?.doc ?? null;
-        // What the shapes make of it. This decides NOTHING — the activity is
-        // handled either way. It is written down so that which shapes fire on
-        // real traffic is a question with an answer, rather than a guess made
-        // in advance about implementations we have not met.
-        if (read?.graph) {
-          const failure = await checkShapes(read.graph);
-          if (failure) {
-            const said = describeShapeFailure(failure);
-            this.log(`inbox item ${url} does not fit its shape: ${said}`);
-            this.store.addDeadLetter({
-              inboxUrl: url, reason: `shape: ${said}`, shapeOnly: true, activity: trimActivity(activity),
-            });
-          }
-        }
         // A gateway that verified this delivery left a receipt beside it. Read
         // it only when a gateway is configured (no config → no fetch, so an
         // install with no gateway pays nothing) and the listing showed one
         // beside this item (`false` is a definite no; a listing that does not
         // say leaves it to the read); a missing or HMAC-invalid receipt reads
         // as null, which is exactly today's unverified behavior.
-        const receipt = activity && hasReceipt !== false ? await this._readReceipt(url) : null;
-        if (activity && this.gatewaySecret()) this._bumpGatewayStat(!!receipt?.verified);
-        // The owner's own post, taken at the outbox door: not mail to read
-        // but a write to make. Never archived or forwarded as if received.
-        const owned = activity && this.isOwnerPost(receipt);
-        const rejection = !activity ? 'unparsable JSON'
-          : owned ? await this.ownerPostFrom(activity, raw, receipt)
-            : await this.handle(activity, receipt);
-        if (!rejection && raw && !owned) await this._archive(url, raw, activity);
-        if (!rejection && !owned) await this._maybeForward(activity);    // §7.1.2, only what we accepted
-        if (rejection) {
-          this.store.addDeadLetter({
-            inboxUrl: url, reason: rejection, activity: trimActivity(activity),
-            ...(activity ? {} : { raw: raw?.slice(0, 2000) ?? null }),
-          });
-          this.log(`rejected (${rejection}) — dead-lettered: ${url}`);
-        }
+        await this._take(url, got.raw, () => (hasReceipt !== false ? this._readReceipt(url) : null), at);
         pending.push(url);
       } catch (e) {
         const n = this._bumpAttempt(url, e.message);
         this.log(`inbox item ${url} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${e.message}`);
         if (n >= MAX_ITEM_ATTEMPTS) {
-          this.store.addDeadLetter({ inboxUrl: url, reason: `failed ${n}x: ${e.message}`, activity: trimActivity(activity) });
+          this.store.addDeadLetter({ inboxUrl: url, reason: `failed ${n}x: ${e.message}`, activity: trimActivity(at.activity) });
           // The dead letter IS the record of this item — deleting before it is
           // written down would lose the only evidence it ever arrived, so it
           // goes through the same commit-then-delete batch as everything else.
@@ -483,6 +500,135 @@ export class Intake {
     if (handled > 0 && all.length > items.length && !this.stopped) this._drainAgain = true;
   }
 
+  // One delivery, alone in the inbox or in a batch: read as JSON-LD, checked
+  // against its receipt, handled, and dead-lettered if refused. Throws when it
+  // could not be handled this time; `at.activity` then says what it was.
+  async _take(url, raw, receiptOf, at = {}) {
+    // Read as JSON-LD, so a document whose terms are aliased means what it
+    // says. A document we cannot read that way is read the way it always
+    // was rather than lost, and the reason is logged.
+    const read = raw ? await readLenient(raw) : null;
+    if (read?.degraded) this.log(`inbox item ${url} grounded to read: ${read.degraded}`);
+    const activity = at.activity = read?.view ?? read?.doc ?? null;
+    // What the shapes make of it. This decides NOTHING — the activity is
+    // handled either way. It is written down so that which shapes fire on
+    // real traffic is a question with an answer, rather than a guess made
+    // in advance about implementations we have not met.
+    if (read?.graph) {
+      const failure = await checkShapes(read.graph);
+      if (failure) {
+        const said = describeShapeFailure(failure);
+        this.log(`inbox item ${url} does not fit its shape: ${said}`);
+        this.store.addDeadLetter({
+          inboxUrl: url, reason: `shape: ${said}`, shapeOnly: true, activity: trimActivity(activity),
+        });
+      }
+    }
+    const receipt = activity ? await receiptOf() : null;
+    if (activity && this.gatewaySecret()) this._bumpGatewayStat(!!receipt?.verified);
+    // The owner's own post, taken at the outbox door: not mail to read
+    // but a write to make. Never archived or forwarded as if received.
+    const owned = activity && this.isOwnerPost(receipt);
+    const rejection = !activity ? 'unparsable JSON'
+      : owned ? await this.ownerPostFrom(activity, raw, receipt)
+        : await this.handle(activity, receipt);
+    if (!rejection && raw && !owned) await this._archive(url, raw, activity);
+    if (!rejection && !owned) await this._maybeForward(activity);    // §7.1.2, only what we accepted
+    if (rejection) {
+      this.store.addDeadLetter({
+        inboxUrl: url, reason: rejection, activity: trimActivity(activity),
+        ...(activity ? {} : { raw: raw?.slice(0, 2000) ?? null }),
+      });
+      this.log(`rejected (${rejection}) — dead-lettered: ${url}`);
+    }
+  }
+
+  // The deliveries in a batch the gateway wrote while the owner's app was
+  // closed (lib/gateway/held-mail.mjs), or null when it holds none. Throws when
+  // the pod would not give it, like readItem.
+  async _batchEntries(url) {
+    const got = await podInbox.readItem(this.remote, url, { maxBytes: MAX_BATCH_BYTES, readCapped });
+    if (got.raw === null) return [];
+    let batch = null;
+    try { batch = JSON.parse(got.raw)?.batch; } catch { batch = null; }
+    return Array.isArray(batch) ? batch.slice(0, MAX_BATCH_ENTRIES) : null;
+  }
+
+  // Each delivery in a batch, taken as if it had arrived alone. `complete` is
+  // false while some entry is to be tried again: the batch then stays, and the
+  // entries already handled are handled again next time, harmlessly, as a
+  // re-delivered activity is.
+  async _takeBatch(url) {
+    const batch = await this._batchEntries(url);
+    if (!batch) {
+      this.store.addDeadLetter({ inboxUrl: url, reason: 'unreadable batch', activity: null });
+      return { entries: 1, complete: true };
+    }
+    let complete = true;
+    for (const [i, e] of batch.entries()) {
+      const key = `${url}#${e?.name || i}`;
+      const body = typeof e?.body === 'string' ? e.body : null;
+      if (body !== null && Buffer.byteLength(body) > MAX_ITEM_BYTES) {
+        this.store.addDeadLetter({ inboxUrl: key, reason: `oversized (${Buffer.byteLength(body)} bytes)`, activity: null });
+        continue;
+      }
+      const at = {};
+      try {
+        await this._take(key, body, () => this._checkReceipt(e?.receipt), at);
+        this._clearAttempt(key);
+      } catch (err) {
+        const n = this._bumpAttempt(key, err.message);
+        this.log(`inbox batch entry ${key} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${err.message}`);
+        if (n >= MAX_ITEM_ATTEMPTS) {
+          this.store.addDeadLetter({ inboxUrl: key, reason: `failed ${n}x: ${err.message}`, activity: trimActivity(at.activity) });
+        } else {
+          complete = false;
+        }
+      }
+    }
+    return { entries: batch.length, complete };
+  }
+
+  /**
+   * Deliveries handed straight in rather than read from the pod's inbox: mail
+   * the gateway held for an account whose copy it keeps (lib/gateway/keeper.mjs).
+   * `entries` are { name, body, receipt }, each taken as if it had arrived
+   * alone. Returns the names that are done with — handled, or refused for good
+   * — once what they changed is written; one to be tried again is left out, so
+   * whoever holds it keeps it for next time.
+   */
+  async takeHeld(entries) {
+    const since = this.store.generation;
+    const done = [];
+    this.store.hold?.();
+    try {
+      for (const e of entries) {
+        const key = `${this.urls.inbox}${e.name}`;
+        const body = typeof e.body === 'string' ? e.body : null;
+        if (body !== null && Buffer.byteLength(body) > MAX_ITEM_BYTES) {
+          this.store.addDeadLetter({ inboxUrl: key, reason: `oversized (${Buffer.byteLength(body)} bytes)`, activity: null });
+          done.push(e.name);
+          continue;
+        }
+        const at = {};
+        try {
+          await this._take(key, body, () => this._checkReceipt(e.receipt), at);
+          this._clearAttempt(key);
+          done.push(e.name);
+        } catch (err) {
+          const n = this._bumpAttempt(key, err.message);
+          this.log(`held delivery ${key} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${err.message}`);
+          if (n >= MAX_ITEM_ATTEMPTS) {
+            this.store.addDeadLetter({ inboxUrl: key, reason: `failed ${n}x: ${err.message}`, activity: trimActivity(at.activity) });
+            done.push(e.name);
+          }
+        }
+      }
+      await this._publishPending();
+    } finally { this.store.release?.(); }
+    return (await this.store.commit({ since })) ? done : [];
+  }
+
   // The end of a sweep: publish whatever the follow graph did ONCE, then flush.
   //
   // publishCollections used to run per handled item — every Follow, Undo,
@@ -643,6 +789,7 @@ export class Intake {
   gatewaySecret(...a) { return verify.gatewaySecret(this, ...a); }
   _bumpGatewayStat(...a) { return verify.bumpGatewayStat(this, ...a); }
   _readReceipt(...a) { return verify.readReceipt(this, ...a); }
+  _checkReceipt(...a) { return verify.checkReceipt(this, ...a); }
 
   // A receipt the door stamped `c2s` for THIS actor, and only a receipt whose
   // HMAC verified (readReceipt returns nothing else). A stranger appending an
@@ -656,10 +803,33 @@ export class Intake {
   // document, not our reading of it); the graph is what it decides from.
   // Returns null when published, else the reason it was not — a dead letter.
   async ownerPostFrom(activity, raw, receipt) {
+    // The receipt names the body it vouches for; a body it does not name is
+    // not the owner's. A body already handled — a replayed request, or an item
+    // the pod would not let us delete — is not published twice.
+    const hash = raw ? await sha256Hex(raw) : null;
+    if (receipt.hash && receipt.hash !== hash) return 'owner post refused: the body is not the one its receipt names';
+    const seen = this.store.read('c2s-seen.json', []);
+    if (hash && seen.includes(hash)) {
+      this.log('owner post already handled — not published again');
+      return null;
+    }
     let asSent = null;
     try { asSent = raw ? JSON.parse(raw) : null; } catch { asSent = null; }
-    const r = await this.ownerPost(activity, { raw: asSent, slug: receipt.slug || null });
-    if (!r || r.status >= 300) return `owner post refused (${r?.status || '?'}): ${r?.body?.error || ''}`;
+    const r = await this.ownerPost(activity, { raw: asSent, slug: receipt.slug || null,
+      // What the door told the client this will be called, when it said.
+      ...(receipt.serial ? { serial: receipt.serial } : {}), ...(receipt.at ? { at: receipt.at } : {}) });
+    // Handled, one way or the other: a second sight of it changes nothing. A
+    // throw above is not handled, and is tried again.
+    if (hash) this.store.write('c2s-seen.json', [hash, ...this.store.read('c2s-seen.json', [])].slice(0, C2S_SEEN_MAX));
+    if (!r || r.status >= 300) {
+      const why = r?.body?.error || 'no reason was given';
+      // The door already answered the app "created"; the owner is the one
+      // left to tell.
+      await this.publisher.noteToSelf?.(`An app asked your account to publish ${article(activity.type)}, `
+        + `and your account refused it: ${why}. Nothing was sent.`)
+        .catch(e => this.log(`could not tell the owner their post was refused: ${e.message}`));
+      return `owner post refused (${r?.status || '?'}): ${why}`;
+    }
     this.log(`owner post from the outbox door published: ${r.body?.object || r.body?.id || activity.type}`);
     return null;
   }
@@ -699,3 +869,11 @@ export class Intake {
   retract(...a) { return notes.retract(this, ...a); }
   addReply(...a) { return notes.addReply(this, ...a); }
 }
+
+// "a Like", "an Update": the kind of activity, as a sentence says it.
+const article = (type) => `${/^[AEIOU]/u.test(String(type)) ? 'an' : 'a'} ${type || 'post'}`;
+
+// Bodies the outbox door handed over that were handled, newest first.
+const C2S_SEEN_MAX = 500;
+const sha256Hex = async (text) => [...new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256',
+  new TextEncoder().encode(text)))].map(b => b.toString(16).padStart(2, '0')).join('');

package/lib/core/intake/notes.mjs

@@ -91,7 +91,11 @@ export async function maybeForward(intake, activity) {
       .filter(Boolean))];
     if (!inboxes.length) return;
     intake._forwardBudget -= 1;
-    await intake.deliverer.deliverToAll(inboxes, activity);
+    // Blind copies are for their sender's delivery alone and never travel on
+    // (§6, §7.1), from the activity or its object.
+    const strip = (o) => { if (!o || typeof o !== 'object') return o; const { bto, bcc, ...rest } = o; return rest; };   // eslint-disable-line no-unused-vars
+    const onward = { ...strip(activity), ...(activity.object && typeof activity.object === 'object' ? { object: strip(activity.object) } : {}) };
+    await intake.deliverer.deliverToAll(inboxes, onward);
     intake.store.write('forwarded.json', [...forwarded, id].slice(-MAX_FORWARDED));
     intake.log(`forwarded ${activity.type} ${id} to ${inboxes.length} follower inbox(es)`);
   } catch (e) {
@@ -319,10 +323,13 @@ export async function retract(intake, noteId, { collect = null } = {}) {
   if (!s.announceActivity) throw new Error('that post was never carried');
   const { undoActivity } = await import('../wire.mjs');
   const inboxes = intake.announceTargets(s.actor);
-  await intake.deliverer.deliverToAll(inboxes,
-    undoActivity({ urls: intake.urls, activity: s.announceActivity, serial: intake.serial++ }));
-  if (collect) collect.push(s.announceActivity.id);
-  else await intake.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id);
+  const undo = undoActivity({ urls: intake.urls, activity: s.announceActivity, serial: intake.serial++ });
+  await intake.deliverer.deliverToAll(inboxes, undo);
+  // The Undo takes the carry's place in the outbox, so a reader catching up
+  // from it learns the carry was withdrawn.
+  if (collect) collect.push(undo);
+  else await intake.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id,
+    { record: () => (intake.config.private ? null : undo) });
   intake.store.updateStatus(noteId, {
     announcedAt: undefined, announceActivity: undefined, retractedAt: new Date().toISOString(),
   });