fedipod 1.36.6 → 1.40.0

package/lib/core/intake/verify.mjs

@@ -110,6 +110,17 @@ export async function readReceipt(intake, itemUrl) {
   } catch { return null; }
 }
 
+// A receipt carried inside a batch rather than beside its item: the same
+// check, without the read.
+export async function checkReceipt(intake, receipt) {
+  const secret = intake.gatewaySecret();
+  if (!secret || !receipt || typeof receipt !== 'object') return null;
+  try {
+    const { verifyReceipt } = await import('../../gateway/httpsig.mjs');
+    return verifyReceipt(receipt, secret) ? receipt : null;
+  } catch { return null; }
+}
+
 // Whether a receipt says anything about THIS actor. Verified-and-about-someone
 // -else is worth exactly as much as unverified, and is treated the same way:
 // the drain's verify-by-dereference still stands behind it.

package/lib/core/lease.mjs

@@ -149,6 +149,17 @@ export class Lease {
     return true;
   }
 
+  // A restarted browser worker that held the lease a moment ago: one read.
+  // Still ours answers { renewDue }, and when no renewal is due yet the lease
+  // is taken up as it stands, with no write. Not ours, or unreadable, is null.
+  async resume() {
+    const cur = await this.readFresh();
+    if (cur === UNREADABLE || !cur || cur.holder !== this.id || Date.now() >= cur.expiresAt) return null;
+    const renewDue = cur.expiresAt - Date.now() <= TTL_MS - RENEW_MS;
+    if (!renewDue) { this.heldUntil = cur.expiresAt; this.denied = null; }
+    return { renewDue };
+  }
+
   // Self-scheduling rather than setInterval, so each agent's renewals drift
   // apart instead of several beating in lockstep against one pod.
   // Idempotent, like Deliverer.startQueue: startActive reaches this twice on the
@@ -199,8 +210,11 @@ export class Lease {
   // point of the TTL is that after it another agent may start draining.
   stillHeld() { return !this.stopped && (!this.heldUntil || Date.now() < this.heldUntil); }
 
+  // Only while it is still ours: a release landing after another agent took
+  // the lease over would otherwise stand that agent down. Without an ETag to
+  // ask with, as before.
   async release() {
     this.stopRenewal();
-    await this.write({ holder: this.id, expiresAt: 0 }).catch(() => {});
+    await this.write({ holder: this.id, expiresAt: 0 }, this.etag ? { ifMatch: this.etag } : {}).catch(() => {});
   }
 }

package/lib/core/place.mjs

@@ -0,0 +1,82 @@
+// place.mjs — where on a pod a FediPod account lives, and recording it.
+//
+// The account's container is always named `fedipod`, inside a container its
+// owner chose. The choice is recorded in their public type index as an
+// instance of as:Actor (lib/pod/type-index.mjs), and that record is how the
+// account is found again. An account made before the choice existed sits at
+// `<pod>fedipod/` with no record, and is found there.
+
+import * as typeIndex from '../pod/type-index.mjs';
+import { PodTransport } from '../pod/transport.mjs';
+import { rootFromContainer, rootOfActor } from '../pod/location.mjs';
+import { DEFAULT_ROOT } from './wire.mjs';
+
+export { podRootPath } from '../pod/location.mjs';
+
+/** The container someone typed, as the account's root — or why it cannot be. */
+export const chosenRoot = (podBase, typed) => rootFromContainer(podBase, typed, DEFAULT_ROOT);
+
+/**
+ * The roots of the accounts this pod's owner has recorded, then the place an
+ * older account sits without a record. `pod` is a transport acting as the owner.
+ */
+export async function candidateRoots(pod, podBase) {
+  const recorded = await typeIndex.registeredActors(pod, podBase).catch(() => []);
+  const roots = recorded.map(a => rootOfActor(podBase, a)).filter(Boolean);
+  return [...new Set([...roots, DEFAULT_ROOT])];
+}
+
+/**
+ * The account on this pod: the first candidate whose config `read(root)` finds
+ * and `accept(config)` takes. Null when there is none.
+ */
+export async function findAccount(pod, podBase, read, accept = () => true) {
+  for (const root of await candidateRoots(pod, podBase)) {
+    const config = await read(root).catch(() => null);
+    if (config && accept(config)) return { root, config };
+  }
+  return null;
+}
+
+/**
+ * Record the account's place in the owner's public type index. With no index,
+ * one is made only when `create` is true — the person's own yes. Returns what
+ * was done: 'registered', 'already', or 'no-index'.
+ */
+export async function recordPlace(pod, podBase, actorAtPod, { create = false } = {}) {
+  let index = await typeIndex.findPublicIndex(pod, podBase);
+  if (!index) {
+    if (!create) return 'no-index';
+    index = await typeIndex.createPublicIndex(pod, podBase);
+  }
+  return (await typeIndex.register(pod, index, actorAtPod)) ? 'registered' : 'already';
+}
+
+/** Whether this person's profile names a public type index. */
+export async function hasPublicIndex(pod, podBase) {
+  return !!(await typeIndex.findPublicIndex(pod, podBase).catch(() => null));
+}
+
+/**
+ * Whether a pod's owner has a public type index, asked as a stranger before any
+ * credential exists: true, false, or null when the profile could not be read.
+ */
+export async function publicIndexKnown(fetchImpl, podBase, webId = `${podBase}profile/card#me`) {
+  const pod = new PodTransport({ fetch: fetchImpl }, { webId });
+  try { return !!(await typeIndex.findPublicIndex(pod, podBase)); } catch { return null; }
+}
+
+/**
+ * The root for a container typed before the pod's own path was known — a new
+ * pod: the answer is taken as inside the pod's root, whatever it turns out to be.
+ */
+export function chosenRootInNewPod(podBase, typed) {
+  const inner = String(typed ?? '').trim().replace(/^\/+/, '');
+  return chosenRoot(podBase, new URL(podBase).pathname + inner);
+}
+
+/** The error that stops a setup until its person has said yes to a new type index. */
+export function needsIndex(detail) {
+  return Object.assign(new Error(`${detail} FediPod records where your account lives in your public type index, `
+    + 'so it needs one. Say yes to creating it, or nothing is set up.'), { code: 'needs-index' });
+}

package/lib/core/pod-only.mjs

@@ -0,0 +1,4 @@
+// pod-only.mjs — what stays on the pod, and only there, when an account works
+// from a copy kept at its gateway (lib/gateway/copy.mjs): the signing key, the
+// pod's own lease, and the passwords and tokens of accounts on other servers.
+export const podOnly = (name) => name === 'keys.json' || name === 'lease.json' || name.startsWith('conn-');

package/lib/core/publisher/collections.mjs

@@ -9,6 +9,7 @@ import * as podFollowers from '../../pod/followers.mjs';
 import * as podFollowing from '../../pod/following.mjs';
 import * as podFeatured from '../../pod/featured.mjs';
 import * as podPrivate from '../../pod/private.mjs';
+import * as podNotes from '../../pod/notes.mjs';
 
 // The default for publishCollections: the whole public surface, ACLs included.
 // A caller that knows what it changed narrows it; a caller that says nothing
@@ -133,6 +134,9 @@ export function readPublishedFollowers(publisher) { return podFollowers.readPubl
 
 export async function publishCollections(publisher, which = ALL_COLLECTIONS) {
   const { urls } = publisher;
+  // A block takes the blocked out of the followers too (PodStore.setBlocklist),
+  // so the published list changes with it.
+  if (which.blocked) which = { ...which, followers: true };
   const contacts = publisher.store.getContacts();
   if (which.followers) {
     // Reconcile walks the published pages, so — like the outbox — pay for it
@@ -147,7 +151,8 @@ export async function publishCollections(publisher, which = ALL_COLLECTIONS) {
   }
   if (which.following) {
     await podFollowing.write(publisher.remote, urls,
-      wire.orderedCollection(urls.following, contacts.following.filter(f => f.accepted).map(f => f.actor)),
+      // newest first (§5): contacts append as follows are made
+      wire.orderedCollection(urls.following, contacts.following.filter(f => f.accepted).map(f => f.actor).reverse()),
       { publicRead: which.acls });
   }
   if (which.pending) await publisher.publishPending();
@@ -158,6 +163,14 @@ export async function publishCollections(publisher, which = ALL_COLLECTIONS) {
   // reader, a refusal nothing caches, and every server asked again.
   if (which.featured) await publisher.publishFeatured();
   if (which.outbox) {
+    // A group made private takes back what it carried while open, as it goes:
+    // those posts were carried for its members, and a group turned private must
+    // not go on listing them to the world. Taken back, not hidden, so opening
+    // the group again does not put them back.
+    if (publisher.config?.kind === 'group' && publisher.config?.private) {
+      const carry = (i) => i?.type === 'Announce' || i?.type === 'Undo';
+      if (publisher.store.read('outbox.json', []).some(carry)) await unrecordOutbox(publisher, carry);
+    }
     const outbox = publisher.store.read('outbox.json', []);
     // Reconcile reads every published page, which is the expensive part of a
     // profile save. It is worth paying only when we are about to write pages
@@ -206,14 +219,32 @@ export async function recordOutbox(publisher, item) {
   const outbox = publisher.store.read('outbox.json', []);
   outbox.unshift(item);
   publisher.store.write('outbox.json', outbox);
+  await writeEntry(publisher, item);
   await publisher.publishOutbox(outbox);
 }
 
+// An entry kept whole — a boost, an edit, a deletion, an undo — is also written
+// as its own document at its id, beside the posts, so it can be fetched (§3.1).
+// Only for the public record, and only where the id is one of those documents.
+async function writeEntry(publisher, item) {
+  const notes = publisher.urls?.notes;
+  if (!notes || !item || typeof item !== 'object' || typeof item.id !== 'string' || !item.id.startsWith(notes)) return;
+  await podNotes.writeCreate(publisher.remote, item.id, { '@context': wire.AS_CTX, ...item })
+    .catch(e => publisher.log?.(`${item.type} ${item.id} not written as its own document: ${e.message}`));
+}
+
 // Taking something out of the outbox is a DECISION — a post deleted, a boost
 // undone. It leaves a mark for the same reason dropFollower does: the pod's
 // copy is rewritten right after, but a rewrite that fails would otherwise let
 // the next reconcile put the entry back. Bounded, like the follower one.
-export async function unrecordOutbox(publisher, matches) {
+//
+// What took it back goes in its place: a Delete for a deleted post, an Undo for
+// a withdrawn boost. A reader catching up from the outbox otherwise never learns
+// the entry it saw earlier was withdrawn. `record(gone)` names that activity (or
+// several, newest last), or null when nothing it cares about was in the outbox
+// (a private post never was). Both land in the one write, so the outbox is
+// never seen with the entry gone and its reason missing.
+export async function unrecordOutbox(publisher, matches, { record = null } = {}) {
   const before = publisher.store.read('outbox.json', []);
   const outbox = before.filter(i => !matches(i));
   const gone = before.filter(i => matches(i))
@@ -224,8 +255,12 @@ export async function unrecordOutbox(publisher, matches) {
     publisher.store.write('outbox-removed.json',
       [...marks, ...gone.map(id => ({ id, at }))].slice(-500));
   }
+  const reasons = [].concat((gone.length && record ? record(gone) : null) || []);
+  for (const r of reasons) { outbox.unshift(r); await writeEntry(publisher, r); }
   publisher.store.write('outbox.json', outbox);
   await publisher.publishOutbox(outbox);
+  publisher.unrecordOwn?.(matches);
+  return gone;
 }
 
 // The pinned posts, as the actor's featured collection — the one document a

package/lib/core/publisher/index.mjs

@@ -28,6 +28,8 @@ import { ALL_COLLECTIONS } from './collections.mjs';
 import * as restore from './restore.mjs';
 import * as notes from './notes.mjs';
 import * as questions from './questions.mjs';
+import * as own from './own.mjs';
+import { recordPlace } from '../place.mjs';
 
 const AGENT_VERSION = JSON.parse(fs.readFileSync(
   path.join(path.dirname(fileURLToPath(import.meta.url)), '../../../package.json'), 'utf8')).version;
@@ -40,6 +42,8 @@ export class Publisher {
     this.remote = remote;
     this.store = store;
     this.deliverer = deliverer;
+    // Everything this actor sends goes on the outbox its owner reads.
+    if (deliverer) deliverer.onSent = (a) => own.recordOwn(this, a);
     this.publicKeyPem = publicKeyPem;
     this.assertionKey = assertionKey;      // Ed25519 public half, multibase; null = no proofs
     // Where this identity's client surface answers, when that is an address a
@@ -111,6 +115,9 @@ export class Publisher {
       postingRestrictedToMods: this.config.kind === 'group' ? !!this.config.postingRestrictedToMods : null,
       moderators,
       pendingFollowers: priv ? urls.pendingFollowers : null,
+      // Named only where the private folder is proved to keep it private.
+      liked: priv ? urls.liked : null,
+      ownerOutbox: priv ? urls.ownOutbox : null,
       pendingFollowing: priv ? urls.pendingFollowing : null,
       blocked: priv ? urls.blocked : null,
       inbox,
@@ -191,6 +198,8 @@ export class Publisher {
       actor: actorDoc, handle: this.config.handle, host,
       quiesced: !!this.config.quiescedAt, version: AGENT_VERSION,
       moderators: this.config.moderators || [],
+      // Who else the rules name: granting or withdrawing a keeper rewrites them.
+      keepers: this.remote?.keepers || [],
     })).digest('hex').slice(0, 32);
     // The human page has its own gate: it changes with pins and the joined
     // date as well as with the profile, and costs one write when it does.
@@ -244,6 +253,13 @@ export class Publisher {
     } catch (e) {
       this.log(`WebID profile not updated with the actor link: ${e.message}`);
     }
+    // Where the account lives, in the owner's public type index — only where
+    // they already have one; an index is made only on their yes, at sign-up.
+    if (!this.config.forum) {
+      await recordPlace(this.remote, urls.base, urls.home + 'ap/actor')
+        .then((r) => { if (r === 'registered') this.log('the public type index now records where the account lives'); })
+        .catch((e) => this.log(`type index not updated with the account's place: ${e.message}`));
+    }
 
     // inbox: public may only Append; owner (the agent) reads + drains. A
     // quiesced actor keeps its name resolving but takes no more mail, so a
@@ -277,7 +293,7 @@ export class Publisher {
     this.log(this.config.gateway?.frontActor || wire.webfingerHost(urls.base)
       ? `profile published: @${pubName}@${pubHost} → ${urls.actor}`
       : `profile published → ${urls.actor} — NOT discoverable as @${pubName}@${pubHost}: `
-        + 'this pod is a suffix-based host, and WebFinger is only answered at a host root');
+        + 'this pod is suffixed, and WebFinger is only answered for a subdomained pod');
     return { unreachable, updated };
   }
 
@@ -468,6 +484,14 @@ export class Publisher {
   publishBlocked(...a) { return collections.publishBlocked(this, ...a); }
   recordOutbox(...a) { return collections.recordOutbox(this, ...a); }
   unrecordOutbox(...a) { return collections.unrecordOutbox(this, ...a); }
+  recordOwn(...a) { return own.recordOwn(this, ...a); }
+  backfillLiked() { return own.backfillLiked(this); }
+  inboxesFor(...a) { return notes.inboxesFor(this, ...a); }
+  noteToSelf(...a) { return notes.noteToSelf(this, ...a); }
+  updateObject(...a) { return notes.updateObject(this, ...a); }
+  unrecordOwn(...a) { return own.unrecordOwn(this, ...a); }
+  publishOwn(...a) { return own.publishOwn(this, ...a); }
+  ownSettled() { return own.ownSettled(this); }
   publishFeatured(...a) { return collections.publishFeatured(this, ...a); }
 
   // restore.mjs

package/lib/core/publisher/notes.mjs

@@ -79,7 +79,9 @@ export async function mentionsFor(publisher, content, inReplyTo) {
     const doc = await publisher.resolveMention(handle).catch(() => null);
     if (!doc?.id) { publisher.log(`mention @${handle} did not resolve — left as text`); continue; }
     if (!inText.has(handle) && doc.type !== 'Group') continue;   // author trimmed them out
-    mentions.push({ handle, actor: doc.id, page: doc.url || null, inbox: doc.endpoints?.sharedInbox || doc.inbox });
+    // Naming yourself still tags you; it never delivers to your own inbox (§7.1).
+    const self = doc.id === publisher.urls.actor;
+    mentions.push({ handle, actor: doc.id, page: doc.url || null, inbox: self ? null : doc.endpoints?.sharedInbox || doc.inbox });
   }
   return mentions;
 }
@@ -144,12 +146,62 @@ export function assertDirectAddressed(content, mentions) {
 // otherwise the agent mints one as it always has.
 const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
 export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
-async function slugFor(publisher, container, wanted, published) {
+export async function slugFor(publisher, container, wanted, published) {
   const name = safeSlug(wanted);
   if (name && !(await podNotes.read(publisher.remote, container + name).catch(() => null))) return name;
   return published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
 }
 
+// A message from this account to itself, for something its owner must hear
+// and has no other way to: a post an app sent through the outbox door that the
+// account then refused, after the door had already told the app "created".
+// Addressed to the owner alone and kept in the private container, so it shows
+// in the owner's apps as a direct message and a mention, and nowhere else.
+export async function noteToSelf(publisher, text) {
+  const { urls } = publisher;
+  const published = new Date().toISOString();
+  const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+  const id = urls.privateNotes + slug;
+  const content = wire.contentHtml(text);
+  await podNotes.write(publisher.remote, id, { '@context': wire.AS_CTX, id, type: 'Note',
+    attributedTo: urls.actor, to: [urls.actor], published, content })
+    .catch(e => publisher.log(`note to self kept here only — the pod would not take it: ${e.message}`));
+  publisher.store.addStatus({ noteId: id, actor: urls.actor, content, text, published,
+    kind: 'post', visibility: 'direct', slug });
+  publisher.store.addNotification({ type: 'mention', actor: urls.actor, noteId: id });
+  return id;
+}
+
+// An app's edit of an object that is not a Note — an annotation, a poll —
+// changes only the fields it sends (§6.3); a field sent as null is removed.
+// What the object is, who made it and when, where it lives and who it is
+// addressed to stay as they are, and so do a poll's choices and its count.
+const FIXED = new Set(['@context', 'id', 'type', 'attributedTo', 'published', 'to', 'cc', 'bto', 'bcc',
+  'audience', 'oneOf', 'anyOf', 'endTime', 'closed', 'votersCount', 'replies']);
+export async function updateObject(publisher, s, patch, { updated = new Date().toISOString() } = {}) {
+  const { urls } = publisher;
+  const doc = await podNotes.read(publisher.remote, s.noteId);
+  if (!doc?.id) throw new Error('the object is not on the pod to change');
+  const next = { ...doc };
+  for (const [k, v] of Object.entries(patch || {})) {
+    if (FIXED.has(k)) continue;
+    if (v === null) delete next[k]; else next[k] = v;
+  }
+  if (typeof next.content === 'string') next.content = wire.sanitizeHtml(next.content);
+  next.updated = updated;
+  await podNotes.write(publisher.remote, doc.id, next);
+  await podNotes.writeCreate(publisher.remote, wire.createActivityId(doc.id), wire.createActivity(next, urls));
+  publisher.store.updateStatus(s.noteId, { content: rowContent(next), editedAt: updated });
+  const update = wire.updateActivity(next, urls);
+  const inboxes = [...new Set([
+    ...(s.visibility === 'direct' ? [] : publisher.store.getContacts().followers.map(f => f.sharedInbox || f.inbox)),
+    ...(await inboxesFor(publisher, [...(s.addressed || []), ...(s.replyActor ? [s.replyActor] : [])])),
+  ].filter(Boolean))];
+  await publisher.deliverer.deliverToAll(inboxes, update);
+  if (publisher.store.read('outbox.json', []).includes(s.noteId)) await publisher.recordOutbox(update);
+  return update;
+}
+
 // What the author's own timeline shows for an object: its content, else its
 // text under one of the names other vocabularies use, else a link to it.
 export function rowContent(obj) {
@@ -173,7 +225,9 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
   const published = new Date().toISOString();
   const slug = await slugFor(publisher, priv ? urls.privateNotes : urls.notes, wanted, published);
   const mentions = await publisher._mentionsFor(content, inReplyTo);
-  if (visibility === 'direct') assertDirectAddressed(content, mentions);
+  // Addressed by id (a client-to-server post) it is addressed already; only a
+  // post that names nobody but in its text has to name them there.
+  if (visibility === 'direct' && !also.length && !deliverTo.length) assertDirectAddressed(content, mentions);
   const reply = await replyTarget(publisher, inReplyTo, mentions, visibility);
   const selfQuote = quote?.id && quote.actor === urls.actor;
   const quoted = quote?.id ? {
@@ -199,6 +253,11 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
   publisher.store.addStatus({
     noteId: note.id, actor: urls.actor, content: note.content, published, inReplyTo,
     kind: 'post', slug, text: content, visibility,
+    // Everyone a client named, blind copies included: an edit or a deletion
+    // must reach them too. Kept here only, never published. `named` is the
+    // visible part, which an edit addresses again.
+    ...(also.length || deliverTo.length ? { addressed: [...new Set([...also, ...deliverTo])] } : {}),
+    ...(also.length ? { named: [...also] } : {}),
     ...(spoilerText ? { spoiler: spoilerText } : {}),
     ...(note.sensitive ? { sensitive: true } : {}),
     ...(attachments?.length ? { attachments } : {}),
@@ -301,6 +360,8 @@ export async function publishObject(publisher, object, { visibility = 'public',
   publisher.store.addStatus({
     noteId: id, actor: urls.actor, content: rowContent(row), published: row.published || published,
     kind: 'post', slug: name, visibility,
+    ...(also.length || deliverTo.length ? { addressed: [...new Set([...also, ...deliverTo])] } : {}),
+    ...(also.length ? { named: [...also] } : {}),
   });
   if (await publisher.store.commit?.() === false) publisher.log(`object published but its timeline row was refused: ${id}`);
 
@@ -332,16 +393,16 @@ export function rowTags(note) {
   return { ...(mentions.length ? { mentions } : {}), ...(hashtags.length ? { tags: hashtags } : {}) };
 }
 
-export async function updateNote(publisher, s, { content, spoilerText = null, sensitive = null, attachments = null } = {}) {
+export async function updateNote(publisher, s, { content, spoilerText = null, sensitive = null, attachments = null, updated = new Date().toISOString() } = {}) {
   const { urls } = publisher;
-  const updated = new Date().toISOString();
   const inText = new Set(wire.mentionsIn(content));
   const mentions = [];
   for (const handle of inText) {
     if (!publisher.resolveMention) break;
     const doc = await publisher.resolveMention(handle).catch(() => null);
     if (!doc?.id) { publisher.log(`mention @${handle} did not resolve — left as text`); continue; }
-    mentions.push({ handle, actor: doc.id, page: doc.url || null, inbox: doc.endpoints?.sharedInbox || doc.inbox });
+    mentions.push({ handle, actor: doc.id, page: doc.url || null,
+      inbox: doc.id === urls.actor ? null : doc.endpoints?.sharedInbox || doc.inbox });
   }
   const atts = attachments ?? s.attachments ?? [];
   // The note stays in the container its visibility put it in; a recovered
@@ -353,7 +414,7 @@ export async function updateNote(publisher, s, { content, spoilerText = null, se
     urls, slug, content, published: s.published, inReplyTo: s.inReplyTo,
     attachments: atts, mentions, visibility: s.visibility || 'public',
     summary: spoilerText, sensitive: sensitive ?? !!s.sensitive, updated, container,
-    also: reply ? [reply.actor] : [],
+    also: [...new Set([...(s.named || []), ...(reply ? [reply.actor] : [])])],
     quote: rowQuote(s),
   });
   await podNotes.write(publisher.remote, note.id, note);
@@ -372,8 +433,13 @@ export async function updateNote(publisher, s, { content, spoilerText = null, se
     ...(s.visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
     ...mentions.map(m => m.inbox),
     reply?.inbox,
+    // everyone a client named or blind-copied, and a quoted author
+    ...(await inboxesFor(publisher, [...(s.addressed || []), ...(s.quoteRequest?.actor ? [s.quoteRequest.actor] : [])])),
   ].filter(Boolean))];
   await publisher.deliverer.deliverToAll(inboxes, update);
+  // The edit goes on the record beside the Create, for a post the outbox lists:
+  // a reader catching up from the outbox otherwise keeps the words it first saw.
+  if (publisher.store.read('outbox.json', []).includes(s.noteId)) await publisher.recordOutbox(update);
   publisher.log(`note edited: ${note.id} → ${inboxes.length} inbox(es)`);
   return patched;
 }

package/lib/core/publisher/own.mjs

@@ -0,0 +1,143 @@
+// own.mjs — the outbox as its owner reads it, and the owner's liked list.
+//
+// The public outbox is what a stranger may see: posts and boosts, and what
+// withdrew them. ActivityPub's outbox is every message the actor produced,
+// filtered by who is asking (§5.1), so its owner is owed the rest as well —
+// likes, follows, undos, follower decisions, followers-only and direct posts.
+// That view lives in the private container, whose owner-only rule it inherits,
+// and is what the outbox address answers its signed-in owner.
+//
+// Everything this actor sends passes through the deliverer, which hands each
+// fresh activity here (Deliverer.onSent), so nothing has to remember to record
+// itself. What is never sent — a block or a pin posted by a client — is
+// recorded by the client-to-server dispatcher.
+//
+// `liked` (§5.5) is the objects this actor has liked and not taken back,
+// kept beside it under the same rule.
+
+import crypto from 'node:crypto';
+import * as wire from '../wire.mjs';
+import * as collection from '../../pod/collection.mjs';
+
+const OWN = 'outbox-own.json';
+const LIKED = 'liked.json';
+// The owner's view keeps its newest entries; older ones leave the view only —
+// the public outbox, and everything the account did, are untouched.
+export const OWN_MAX = 5000;
+
+// A Create is kept by its object's id, as the public outbox keeps it, so the
+// two can be matched when a post is withdrawn; anything else is kept whole.
+const localForm = (a) => (a?.type === 'Create' && (typeof a.object === 'string' ? a.object : a.object?.id)) || a;
+
+export function recordOwn(publisher, activity) {
+  const { urls, store } = publisher;
+  if (!activity?.type || activity.actor !== urls.actor) return false;
+  const item = localForm(activity);
+  const id = wire.outboxItemId(item);
+  const own = store.read(OWN, []);
+  if (id && own.some(i => wire.outboxItemId(i) === id)) return false;   // a retry, or said twice
+  own.unshift(item);
+  store.write(OWN, own.slice(0, OWN_MAX));
+  if (activity.type === 'Like' || (activity.type === 'Undo' && activity.object?.type === 'Like')) {
+    backfillLiked(publisher);
+    const object = wire.outboxItemId(activity.type === 'Like' ? activity.object : activity.object.object);
+    if (object) {
+      const liked = store.read(LIKED, []).filter(o => o !== object);
+      if (activity.type === 'Like') liked.unshift(object);
+      store.write(LIKED, liked);
+    }
+  }
+  schedule(publisher);
+  return true;
+}
+
+// An account that liked things before the list existed: the likes it still
+// holds (a timeline row marked favourited, with the Like that was sent) are
+// its liked list to begin with. Once only — a list that exists, even empty,
+// is the record from then on.
+export function backfillLiked(publisher) {
+  const { store } = publisher;
+  if (store.read(LIKED, null) !== null) return 0;
+  const liked = (store.getStatuses?.() || [])
+    .filter(s => s.favourited && s.noteId)
+    .sort((x, y) => String(y.published || '').localeCompare(String(x.published || '')))
+    .map(s => s.noteId);
+  store.write(LIKED, [...new Set(liked)]);
+  schedule(publisher);
+  return liked.length;
+}
+
+// A post deleted or a boost withdrawn leaves the owner's view as it leaves the
+// public one; the Delete or Undo that did it is already recorded, having been
+// sent.
+export function unrecordOwn(publisher, matches) {
+  const own = publisher.store.read(OWN, []);
+  const kept = own.filter(i => !matches(i));
+  if (kept.length === own.length) return;
+  publisher.store.write(OWN, kept);
+  schedule(publisher);
+}
+
+// Recording never waits on the pod: a like is answered when it is sent, and
+// the pages follow. One publish at a time, the last one covering every record
+// made while it waited.
+function schedule(publisher) {
+  if (publisher._ownQueued) return;
+  publisher._ownQueued = true;
+  publisher._ownChain = (publisher._ownChain || Promise.resolve()).then(async () => {
+    publisher._ownQueued = false;
+    try { await publishOwn(publisher); }
+    catch (e) { publisher.log?.(`owner's outbox view not published: ${e.message}`); }
+  });
+}
+
+export function ownSettled(publisher) { return publisher._ownChain || Promise.resolve(); }
+
+export async function publishOwn(publisher) {
+  const { urls, store, remote } = publisher;
+  // Written only where the private folder is proved to keep it private — the
+  // same bar the pending and blocked lists clear. Recorded meanwhile, and
+  // published the first time the bar is met.
+  if (publisher.privateReady && await publisher.privateReady() !== true) return;
+  const seen = store.read('published.json', {});
+  const own = store.read(OWN, []);
+  const out = wire.outboxPaging(own, seen.ownIndex || []);
+  const ownPages = await writePages(remote, seen.ownPages, out.pages.map((items, i) => ({
+    id: wire.outboxPageId(urls.ownOutbox, i + 1), doc: wire.outboxPage(urls.ownOutbox, i + 1, items),
+  })));
+  const ownHead = await writeHead(remote, seen.ownHead, urls.ownOutbox, wire.outboxHead(urls.ownOutbox, own.length, out.pages.length));
+
+  const liked = store.read(LIKED, []);
+  // liked.json is newest first; pages are filled from the oldest end.
+  const lk = wire.followersPaging([...liked].reverse(), seen.likedIndex || []);
+  const likedPages = await writePages(remote, seen.likedPages, lk.pages.map((items, i) => ({
+    id: wire.followersPageId(urls.liked, i + 1), doc: wire.followersPage(urls.liked, i + 1, items, lk.pages.length),
+  })));
+  const likedHead = await writeHead(remote, seen.likedHead, urls.liked, wire.followersHead(urls.liked, liked.length, lk.pages.length));
+
+  store.write('published.json', { ...store.read('published.json', {}),
+    ownPages, ownIndex: out.index, ownHead, likedPages, likedIndex: lk.index, likedHead });
+}
+
+// A head is written only when it changed: most records change a page, not the
+// count or the bounds.
+async function writeHead(remote, before, url, doc) {
+  const digest = crypto.createHash('sha256').update(JSON.stringify(doc)).digest('hex').slice(0, 16);
+  if (digest !== before) await collection.writeHead(remote, url, doc);
+  return digest;
+}
+
+// Only the pages that changed, and none past the new end. No rule is written:
+// the private container's owner-only rule is inherited.
+async function writePages(remote, before = {}, pages) {
+  const after = {};
+  for (const [i, { id, doc }] of pages.entries()) {
+    const n = i + 1;
+    after[n] = crypto.createHash('sha256').update(JSON.stringify(doc)).digest('hex').slice(0, 16);
+    if (before[n] !== after[n]) await collection.writePage(remote, id, doc);
+  }
+  for (const n of Object.keys(before).map(Number).filter(n => Number.isFinite(n) && n > pages.length)) {
+    await collection.dropPage(remote, pages[0].id.replace(/-\d+$/u, `-${n}`));
+  }
+  return after;
+}

package/lib/core/publisher/questions.mjs

@@ -9,7 +9,7 @@ import crypto from 'node:crypto';
 import * as wire from '../wire.mjs';
 import * as polls from '../polls.mjs';
 import * as podNotes from '../../pod/notes.mjs';
-import { assertDirectAddressed, replyTarget, rowTags } from './notes.mjs';
+import { assertDirectAddressed, replyTarget, rowTags, slugFor } from './notes.mjs';
 
 // How long a poll gathers votes before its Question is rewritten. Every vote
 // changes a number other servers re-read, and rewriting per vote would make a
@@ -22,7 +22,7 @@ const POLL_REWRITE_MS = 10_000;
  * voter pick more than one, and `expiresAt` is when voting stops.
  */
 export async function publishQuestion(publisher, content, { options = [], multiple = false, expiresAt = null,
-  inReplyTo = undefined, visibility = 'public', spoilerText = null, sensitive = false } = {}) {
+  inReplyTo = undefined, visibility = 'public', spoilerText = null, sensitive = false, slug: wanted = null } = {}) {
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
   if (priv) {
@@ -51,7 +51,9 @@ export async function publishQuestion(publisher, content, { options = [], multip
   }
 
   const published = new Date().toISOString();
-  const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+  // The name the client asked for, when it is plain — the outbox door has
+  // already told the client the address it names.
+  const slug = await slugFor(publisher, priv ? urls.privateNotes : urls.notes, wanted, published);
   const mentions = await publisher._mentionsFor(content, inReplyTo);
   if (visibility === 'direct') assertDirectAddressed(content, mentions);
   const reply = await replyTarget(publisher, inReplyTo, mentions, visibility);