fedipod 1.36.6 → 1.40.0

package/lib/core/scheduled.mjs

@@ -0,0 +1,39 @@
+// scheduled.mjs — what falls due while nobody is looking: scheduled posts
+// whose time has come, and polls whose voting has ended. Any agent that is
+// running when something falls due does it: the owner's app while it is open,
+// the gateway's keeper while it is closed (lib/gateway/keeper.mjs), a
+// DeviceAgent always.
+//
+// A scheduled post is taken off the list before it is published, so a slow
+// publish cannot post twice; one that fails is dropped, with its reason in the
+// log. A poll is shut and everyone holding it is told once
+// (publisher/questions.mjs: closeDuePolls).
+
+/** Publish what has fallen due. Returns how many scheduled posts went out. */
+export async function publishDue(store, publisher, log = () => {}, now = Date.now()) {
+  const due = store.getScheduled().filter((e) => Date.parse(e.scheduledAt) <= now);
+  for (const e of due) {
+    store.setScheduled(store.getScheduled().filter((x) => x.id !== e.id));
+    await publisher.publishNote(e.params.status, {
+      inReplyTo: e.params.inReplyTo, attachments: e.params.attachments,
+      visibility: e.params.visibility, spoilerText: e.params.spoilerText,
+    }).then(() => log(`scheduled post published (${e.id})`))
+      .catch((err) => log(`scheduled post ${e.id} failed: ${err.message} — dropped`));
+  }
+  await publisher.closeDuePolls(now).catch((err) => log(`closing polls: ${err.message}`));
+  return due.length;
+}
+
+/**
+ * When the next thing falls due, or null when nothing is waiting: a scheduled
+ * post, a poll's end, or another try at a delivery that failed.
+ */
+export function nextDue(store) {
+  const at = [
+    ...store.getScheduled().map((e) => Date.parse(e.scheduledAt)),
+    ...(store.getStatuses?.() || []).filter((s) => s.kind === 'post' && s.poll && !s.poll.closed && s.poll.expiresAt)
+      .map((s) => Date.parse(s.poll.expiresAt)),
+    ...(store.getQueue?.() || []).map((q) => Number(q.nextAt)),
+  ].filter(Number.isFinite);
+  return at.length ? new Date(Math.min(...at)).toISOString() : null;
+}

package/lib/core/social.mjs

@@ -126,7 +126,7 @@ async function cacheCounts(agent, doc) {
 
 // `doc` skips the fetch when the caller already resolved the actor; a bulk
 // import passes publish:false and republishes the collections once at the end.
-export async function followActor(agent, actorUrl, { publish = true, doc: fetched = null } = {}) {
+export async function followActor(agent, actorUrl, { publish = true, doc: fetched = null, serial = Date.now() } = {}) {
   const doc = fetched || await agent.intake.fetchAP(actorUrl);
   if (!doc?.inbox) throw new Error(`actor document unusable (${actorUrl})`);
   if (agent.store.isBlocked(doc.id)) throw new Error('actor is blocked');
@@ -136,7 +136,7 @@ export async function followActor(agent, actorUrl, { publish = true, doc: fetche
     rec = { actor: doc.id, inbox: doc.inbox, accepted: false };
     contacts.following.push(rec);
   }
-  const follow = wire.followActivity({ urls: agent.publisher.urls, targetActor: doc.id, serial: Date.now() });
+  const follow = wire.followActivity({ urls: agent.publisher.urls, targetActor: doc.id, serial });
   rec.followActivity = follow;               // kept for a later Undo
   agent.store.setContacts(contacts);
   await agent.deliverer.deliver(doc.inbox, follow);
@@ -144,9 +144,9 @@ export async function followActor(agent, actorUrl, { publish = true, doc: fetche
   return doc;
 }
 
-export async function followHandle(agent, handle) {
+export async function followHandle(agent, handle, { serial = Date.now() } = {}) {
   const doc = await resolveHandle(agent, handle);
-  await followActor(agent, doc.id);
+  await followActor(agent, doc.id, { serial });
   const clean = String(handle || '').replace(/^@/, '');
   const contacts = agent.store.getContacts();
   const rec = contacts.following.find(f => f.actor === doc.id);
@@ -154,13 +154,13 @@ export async function followHandle(agent, handle) {
   return { ok: true, actor: doc.id };
 }
 
-export async function unfollowActor(agent, actor) {
+export async function unfollowActor(agent, actor, { serial = Date.now() } = {}) {
   const contacts = agent.store.getContacts();
   const rec = contacts.following.find(f => f.actor === actor);
   if (!rec) throw new Error('not following that actor');
   if (rec.followActivity) {
     await agent.deliverer.deliver(rec.inbox,
-      wire.undoActivity({ urls: agent.publisher.urls, activity: rec.followActivity, serial: Date.now() }));
+      wire.undoActivity({ urls: agent.publisher.urls, activity: rec.followActivity, serial }));
   }
   contacts.following = contacts.following.filter(f => f.actor !== actor);
   agent.store.setContacts(contacts);
@@ -168,31 +168,31 @@ export async function unfollowActor(agent, actor) {
   return { ok: true };
 }
 
-export async function favourite(agent, s) {
+export async function favourite(agent, s, { serial = Date.now() } = {}) {
   if (s.favourited) return s;
   const doc = await agent.intake.fetchAP(s.actor);
   if (!doc?.inbox) throw new Error('author inbox unavailable');
-  const act = wire.likeActivity({ urls: agent.publisher.urls, noteId: s.noteId, serial: Date.now() });
+  const act = wire.likeActivity({ urls: agent.publisher.urls, noteId: s.noteId, serial, to: s.actor });
   await agent.deliverer.deliver(doc.endpoints?.sharedInbox || doc.inbox, act);
   return agent.store.updateStatus(s.noteId, { favourited: true, likeActivity: act });
 }
 
-export async function unfavourite(agent, s) {
+export async function unfavourite(agent, s, { serial = Date.now() } = {}) {
   if (s.likeActivity) {
     const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
     if (doc?.inbox) {
       await agent.deliverer.deliver(doc.endpoints?.sharedInbox || doc.inbox,
-        wire.undoActivity({ urls: agent.publisher.urls, activity: s.likeActivity, serial: Date.now() }));
+        wire.undoActivity({ urls: agent.publisher.urls, activity: s.likeActivity, serial }));
     }
   }
   return agent.store.updateStatus(s.noteId, { favourited: false, likeActivity: undefined });
 }
 
 // Announce goes to our followers (that's what boosting is) and to the author.
-export async function reblog(agent, s) {
+export async function reblog(agent, s, { serial = Date.now() } = {}) {
   if (s.reblogged) return s;
   const { urls } = agent.publisher;
-  const act = wire.announceActivity({ urls, object: s.noteId, serial: Date.now() });
+  const act = wire.announceActivity({ urls, object: s.noteId, serial });
   const inboxes = new Set(agent.store.getContacts().followers
     .map(f => f.sharedInbox || f.inbox).filter(Boolean));
   if (s.actor !== urls.actor) {
@@ -208,15 +208,15 @@ export async function reblog(agent, s) {
   return updated;
 }
 
-export async function unreblog(agent, s) {
+export async function unreblog(agent, s, { serial = Date.now() } = {}) {
   if (s.announceActivity) {
-    const undo = wire.undoActivity({ urls: agent.publisher.urls, activity: s.announceActivity, serial: Date.now() });
+    const undo = wire.undoActivity({ urls: agent.publisher.urls, activity: s.announceActivity, serial });
     const inboxes = new Set(agent.store.getContacts().followers
       .map(f => f.sharedInbox || f.inbox).filter(Boolean));
     const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
     if (doc?.inbox && s.actor !== agent.publisher.urls.actor) inboxes.add(doc.endpoints?.sharedInbox || doc.inbox);
     await agent.deliverer.deliverToAll([...inboxes], undo);
-    await agent.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id);
+    await agent.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id, { record: () => undo });
   }
   return agent.store.updateStatus(s.noteId, { reblogged: false, announceActivity: undefined });
 }
@@ -260,7 +260,7 @@ export async function ejectFollower(agent, actor) {
 
 // Group: answer a held join request. Admitting is the Accept onFollow would
 // have sent immediately had the group not been gated.
-export async function admitRequest(agent, actor, { publish = true } = {}) {
+export async function admitRequest(agent, actor, { publish = true, serial = Date.now() } = {}) {
   const reqs = agent.store.getRequests();
   const req = reqs.find(r => r.actor === actor);
   if (!req) throw new Error('no such request');
@@ -286,14 +286,14 @@ export async function admitRequest(agent, actor, { publish = true } = {}) {
   // A bulk admit passes publish:false and republishes once for the lot.
   if (publish) await agent.publisher.publishCollections({ followers: true, pending: true });
   await agent.deliverer.deliver(req.inbox, wire.acceptActivity({
-    urls: agent.publisher.urls, followActivity: req.activity, serial: Date.now(),
+    urls: agent.publisher.urls, followActivity: req.activity, serial,
   }));
   return { ok: true, actor };
 }
 
 // Refusing is not a ban: they may ask again, and the queue is where you would
 // see that. Eject is the sticky one, because it mutes.
-export async function refuseRequest(agent, actor) {
+export async function refuseRequest(agent, actor, { serial = Date.now() } = {}) {
   const reqs = agent.store.getRequests();
   const req = reqs.find(r => r.actor === actor);
   if (!req) throw new Error('no such request');
@@ -307,7 +307,7 @@ export async function refuseRequest(agent, actor) {
     return { ok: true, actor };
   }
   await agent.deliverer.deliver(req.inbox, wire.rejectActivity({
-    urls: agent.publisher.urls, followActivity: req.activity, serial: Date.now(),
+    urls: agent.publisher.urls, followActivity: req.activity, serial,
   }));
   return { ok: true, actor };
 }
@@ -375,9 +375,21 @@ export async function votePoll(agent, s, choices) {
 
 export async function deleteNote(agent, s) {
   const { urls } = agent.publisher;
-  const inboxes = agent.store.getContacts().followers
-    .map(f => f.sharedInbox || f.inbox).filter(Boolean);
-  await agent.deliverer.deliverToAll(inboxes, wire.deleteActivity({ urls, noteId: s.noteId }));
+  // The deletion goes where the post went: followers unless it was direct, and
+  // everyone it named or was blind-copied to. Addressed as the post was, read
+  // from the post itself while it is still there.
+  const doc = await Promise.resolve().then(() => podNotes.read(agent.remote, s.noteId)).catch(() => null);
+  const shape = wire.addressing(urls, s.visibility || 'public', (s.mentions || []).map(m => m.href).filter(Boolean));
+  const to = Array.isArray(doc?.to) ? doc.to : shape.to;
+  const cc = Array.isArray(doc?.cc) ? doc.cc : shape.cc;
+  const named = [...to, ...cc, ...(s.addressed || []), ...(s.replyActor ? [s.replyActor] : [])]
+    .filter(a => typeof a === 'string' && a !== wire.PUBLIC && a !== urls.followers && a !== urls.actor);
+  const inboxes = [
+    ...(s.visibility === 'direct' ? [] : agent.store.getContacts().followers.map(f => f.sharedInbox || f.inbox)),
+    ...(agent.publisher.inboxesFor ? await agent.publisher.inboxesFor(named).catch(() => []) : []),
+  ].filter(Boolean);
+  const del = wire.deleteActivity({ urls, noteId: s.noteId, to, cc });
+  await agent.deliverer.deliverToAll(inboxes, del);
 
   // The note is REPLACED with a Tombstone rather than removed, so a peer that
   // dereferences it learns the post was deleted instead of a bare 404 (§7.4).
@@ -386,12 +398,23 @@ export async function deleteNote(agent, s) {
   // not the object, so it is deleted outright.
   const stuck = [];
   const deletedAt = new Date().toISOString();
+  // Only inside the posts folders: an object that lives elsewhere on the pod
+  // (an annotation a client keeps in its own place, or anything it named) is
+  // that client's document, and a deletion here must not overwrite it — the
+  // profile, say — with a Tombstone. Its Create and outbox entry still go.
+  const ours = [urls.notes, urls.privateNotes].some(c => String(s.noteId).startsWith(c));
   try {
-    await podNotes.writeTombstone(agent.remote, s.noteId, wire.noteTombstone(s.noteId, deletedAt));
+    if (ours) await podNotes.writeTombstone(agent.remote, s.noteId, wire.noteTombstone(s.noteId, deletedAt));
   } catch { stuck.push(s.noteId); }
-  if (!await podNotes.dropCreate(agent.remote, wire.createActivityId(s.noteId))) {
-    stuck.push(wire.createActivityId(s.noteId));
-  }
+  // The Create becomes a Tombstone too, not a gap: it embedded the post, so
+  // its words go, and whoever asks for it is told it is gone (410 through the
+  // Gateway) rather than that it never was.
+  // An object kept outside the posts folders has its Create inside them, under
+  // the name it was given (publishObject).
+  const createId = ours ? wire.createActivityId(s.noteId) : (s.slug ? wire.createActivityId(urls.notes + s.slug) : null);
+  try {
+    if (createId) await podNotes.writeTombstone(agent.remote, createId, wire.noteTombstone(createId, deletedAt, 'Create'));
+  } catch { stuck.push(createId); }
   if (stuck.length) {
     agent.log?.(`delete ${s.noteId}: the pod kept ${stuck.length} document(s) — the post is STILL PUBLISHED`);
     return {
@@ -410,8 +433,15 @@ export async function deleteNote(agent, s) {
       .catch(e => agent.log?.(`bluesky mirror not deleted (${e.message}): ${s.atproto.uri}`));
   }
 
-  // The note's outbox entry, and our own boost of it if there was one.
-  await agent.publisher.unrecordOutbox(i => i === s.noteId || (i?.id && i.id === s.announceActivity?.id));
+  // The note's outbox entry, and our own boost of it if there was one. The
+  // Delete takes the post's place — only for a post the outbox listed, so a
+  // private post's deletion stays as private as the post was.
+  const itsOwn = (i) => i === s.noteId || (i?.id && i.id === s.announceActivity?.id)
+    // its edits too: an Update carries the post's words, which must not
+    // outlive the post on the public record
+    || (i?.type === 'Update' && (typeof i.object === 'string' ? i.object : i.object?.id) === s.noteId);
+  await agent.publisher.unrecordOutbox(itsOwn,
+    { record: (gone) => (gone.includes(s.noteId) ? del : null) });
   agent.store.removeStatus(s.noteId);
   return { ok: true };
 }
@@ -436,7 +466,7 @@ export async function announceModeration(agent, activity) {
 // nothing is delivered TO THE BLOCKED PARTY (§6.10). Intake already refuses a
 // blocked author on arrival. A group additionally announces the ban to its
 // members (FEP-1b12) — announceModeration keeps a person's blocks silent.
-export async function blockActor(agent, actorUrl) {
+export async function blockActor(agent, actorUrl, { serial = Date.now() } = {}) {
   if (!/^https?:\/\/\S+$/.test(String(actorUrl || ''))) throw new Error('actor must be a URL');
   const b = agent.store.getBlocklist();
   if (!b.actors.includes(actorUrl)) b.actors.push(actorUrl);
@@ -444,12 +474,12 @@ export async function blockActor(agent, actorUrl) {
   await unfollowActor(agent, actorUrl).catch(() => {});   // not following is fine
   await agent.publisher?.publishCollections({ blocked: true }).catch(() => {});
   await announceModeration(agent,
-    wire.blockActivity({ urls: agent.publisher.urls, targetActor: actorUrl, serial: Date.now() }))
+    wire.blockActivity({ urls: agent.publisher.urls, targetActor: actorUrl, serial }))
     .catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
   return { ok: true, actor: actorUrl };
 }
 
-export async function unblockActor(agent, actorUrl) {
+export async function unblockActor(agent, actorUrl, { serial = Date.now() } = {}) {
   const b = agent.store.getBlocklist();
   b.actors = b.actors.filter(a => a !== actorUrl);
   agent.store.setBlocklist(b);
@@ -459,7 +489,7 @@ export async function unblockActor(agent, actorUrl) {
   await announceModeration(agent, wire.undoActivity({
     urls: agent.publisher.urls,
     activity: { type: 'Block', actor: agent.publisher.urls.actor, object: actorUrl },
-    serial: Date.now(),
+    serial,
   })).catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
   return { ok: true, actor: actorUrl };
 }

package/lib/core/storage.mjs

@@ -14,6 +14,7 @@ import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as $rdf from 'rdflib';
+import { podOnly } from './pod-only.mjs';
 
 const LDP = $rdf.Namespace('http://www.w3.org/ns/ldp#');
 const slash = (u) => (u.endsWith('/') ? u : u + '/');
@@ -170,6 +171,72 @@ export class FileStorage {
   }
 }
 
+export { podOnly };
+
+/**
+ * An account's state kept at its gateway, reached through the gateway's state
+ * API (lib/gateway/state-api.mjs) with the token it handed out. `holder` is
+ * this agent's lease id: the gateway takes a write only from the lease's
+ * holder, and `onRefused` hears when it would not. What stays on the pod is
+ * read and written on `pod`.
+ */
+export class StateApiStorage {
+  constructor(base, { fetchImpl = globalThis.fetch, token, holder, pod = null, onRefused = null }) {
+    this.base = slash(base);
+    this.fetchImpl = fetchImpl;
+    this.token = token;
+    this.holder = holder;
+    this.pod = pod;
+    this.onRefused = onRefused;
+  }
+
+  get kind() { return 'copy'; }
+
+  _ask(p, init = {}) {
+    return this.fetchImpl(this.base + encodeURIComponent(p), {
+      ...init, headers: { authorization: `Bearer ${this.token}`, ...(init.headers || {}) },
+    });
+  }
+
+  async list(sub = '', { etag } = {}) {
+    if (sub) return { notModified: false, names: [], etag: null };
+    const res = await this._ask('', { headers: etag ? { 'if-none-match': etag } : {} });
+    if (res.status === 304) return { notModified: true, names: null, etag };
+    if (res.status >= 400) throw new Error(`the account's copy at the gateway is unreadable (HTTP ${res.status})`);
+    const { names } = await res.json();
+    return { notModified: false, names, etag: res.headers.get('etag') };
+  }
+
+  async read(p, opts = {}) {
+    if (podOnly(p)) return this.pod ? this.pod.read(p, opts) : { ok: false, notModified: false, status: 404, body: null, etag: null };
+    const res = await this._ask(p, { headers: opts.etag ? { 'if-none-match': opts.etag } : {} });
+    if (res.status === 304) return { ok: true, notModified: true, status: 304, body: null, etag: opts.etag };
+    if (res.status >= 400) return { ok: false, notModified: false, status: res.status, body: null, etag: null };
+    return { ok: true, notModified: false, status: res.status, body: await res.text(), etag: res.headers.get('etag') };
+  }
+
+  async write(p, body, contentType = 'application/json') {
+    if (podOnly(p)) return this.pod ? this.pod.write(p, body, contentType) : { ok: false, retry: false, why: 'no pod for this document' };
+    try {
+      const res = await this._ask(p, { method: 'PUT', headers: { 'content-type': contentType, 'x-fedipod-holder': this.holder }, body });
+      if (res.status < 400) return { ok: true, retry: false, why: '' };
+      if (res.status === 409) { this.onRefused?.(); return { ok: false, retry: false, why: 'another agent holds this account now', lost: true }; }
+      return { ok: false, retry: res.status >= 500 || res.status === 429, why: `HTTP ${res.status}`, retryAfterMs: 0 };
+    } catch (e) {
+      return { ok: false, retry: true, why: e.message, retryAfterMs: 0 };
+    }
+  }
+
+  async remove(p) {
+    if (podOnly(p)) return this.pod ? this.pod.remove(p) : false;
+    try {
+      const res = await this._ask(p, { method: 'DELETE', headers: { 'x-fedipod-holder': this.holder } });
+      if (res.status === 409) { this.onRefused?.(); return false; }
+      return res.status < 400 || res.status === 404;
+    } catch { return false; }
+  }
+}
+
 // `file:` (or a bare path) is a directory; anything else is a pod.
 export function storageFor(base, fetchImpl) {
   return /^https?:/i.test(base) ? new HttpStorage(base, fetchImpl) : new FileStorage(base);

package/lib/core/store.mjs

@@ -90,6 +90,15 @@ export class PodStore {
     this._held = 0;
     this.chain = Promise.resolve();  // serialized writes
     this.verdicts = new Map();     // name → did its last write land? (read by commit)
+    // Moves on each time queued writes are dropped (discardPending): work that
+    // began in an earlier generation has lost results, whatever a commit says.
+    this.generation = 0;
+    // Told what the pod now holds: after a load, before and after each document
+    // that is written or removed. A browser keeps its copy between worker
+    // restarts with these; onWriting is awaited, so it is marked before it goes.
+    this.onLoaded = null;          // () => void
+    this.onWriting = null;         // (name, text | null) => Promise
+    this.onSettled = null;         // (name) => void
   }
 
   get base() { return this.storage?.base || null; }
@@ -158,6 +167,36 @@ export class PodStore {
     this.lastSkipped = skipped;
     if (skipped.length) this.log(`state load skipped ${skipped.length}: ${skipped.join(', ')}`);
     this.log(`state loaded: ${this.cache.size} doc(s) from ${this.base} (${fetched} re-fetched)`);
+    this.onLoaded?.();
+  }
+
+  // Take up a copy kept from an earlier load, as the pod held it: each
+  // document's bytes and ETag, and the container's ETag. The next load() then
+  // revalidates instead of downloading.
+  restore({ docs, listingEtag }) {
+    for (const { name, text, etag } of docs) {
+      try { this.cache.set(name, JSON.parse(text)); } catch { continue; }
+      this.lastText.set(name, text);
+      if (etag) this.etags.set(name, etag);
+    }
+    if (listingEtag) this.etags.set('', listingEtag);
+  }
+
+  // Read these documents again, whatever is held: a kept copy caught them
+  // mid-write, so the pod's copy is the one to hold. Throws when one cannot be
+  // read, so the caller can fall back to a full load rather than act without it.
+  async refresh(names) {
+    for (const name of names) {
+      const r = await this.storage.read(name);
+      if (r.status === 404) {
+        this.cache.delete(name); this.lastText.delete(name); this.etags.delete(name);
+      } else if (!r.ok) {
+        throw new Error(`state doc ${name} unreadable (HTTP ${r.status})`);
+      } else {
+        this.cache.set(name, JSON.parse(r.body)); this.lastText.set(name, r.body); this.etags.set(name, r.etag);
+      }
+      this.onSettled?.(name);
+    }
   }
 
   has(name) { return this.cache.has(name); }
@@ -221,12 +260,13 @@ export class PodStore {
   _put(name) {
     const done = this.chain.then(async () => {
       const body = serialise(this.cache.get(name));
+      await Promise.resolve(this.onWriting?.(name, body)).catch(() => {});
       for (let attempt = 1; attempt <= PUT_RETRIES; attempt++) {
         // A storage that throws is a bug, not a hiccup — but it must not
         // escape into the write queue, where it would look like success.
         const r = await this.storage.write(name, body, 'application/json')
           .catch(e => ({ ok: false, retry: false, why: e.message }));
-        if (r.ok) { this.lastText.set(name, body); return true; }
+        if (r.ok) { this.lastText.set(name, body); this.onSettled?.(name); return true; }
         // The storage says whether trying again could possibly help: a pod's
         // 4xx is an answer rather than a hiccup, and a directory's EACCES will
         // still be an EACCES in two seconds.
@@ -255,7 +295,10 @@ export class PodStore {
     clearTimeout(this.timers.get(name));
     this.timers.delete(name);
     if (!this.storage) return true;
-    return this.storage.remove(name);
+    await Promise.resolve(this.onWriting?.(name, null)).catch(() => {});
+    const gone = await this.storage.remove(name);
+    this.onSettled?.(name);
+    return gone;
   }
 
   // Force every pending write out NOW and say whether they all landed.
@@ -263,7 +306,9 @@ export class PodStore {
   // pod's inbox is a destructive read, so it must not happen until the result
   // of handling it is written down. With no storage the store is pure memory
   // and there is nothing to land, so that counts as written.
-  async commit() {
+  // `since`: the generation the caller's work began in. Anything dropped since
+  // makes the answer false.
+  async commit({ since } = {}) {
     const pending = [];
     // Held names too, or a sweep that suspended the debounce would delete the
     // pod's copy of an item whose result had not been written down — the one
@@ -279,7 +324,7 @@ export class PodStore {
     // Every verdict since the last commit, forced and self-fired alike. Cleared
     // once read: a refusal is reported to the caller that can act on it, and
     // does not then condemn every later commit.
-    const landed = [...this.verdicts.values()].every(Boolean);
+    const landed = [...this.verdicts.values()].every(Boolean) && (since === undefined || since === this.generation);
     this.verdicts.clear();
     return landed;
   }
@@ -287,6 +332,23 @@ export class PodStore {
   // Flush pending debounced writes (shutdown path). Same work, result ignored.
   async flush() { await this.commit(); }
 
+  // Forget the writes not yet made, and wait out any in flight. For an agent
+  // whose state another agent has written since those writes were queued (a
+  // copy's lease coming back after an app acted, web/app/copy-mode.mjs): the
+  // next load reads what the other agent wrote, and sending these first would
+  // write over it.
+  // The generation moves on first, before anything is awaited, so a sweep that
+  // began before — the inbox drain above all — finds at its next commit that
+  // its results were not all written down, and deletes nothing on the strength
+  // of them. Work that begins after is not affected.
+  async discardPending() {
+    this.generation += 1;
+    for (const t of this.timers.values()) clearTimeout(t);
+    this.timers.clear();
+    this.dirty.clear();
+    await this.chain.catch(() => {});
+  }
+
   // ---- the domain helpers, unchanged from dk's Store ----
 
   // config: { remotePod, handle, name, issuer }  (credential lives ONLY in
@@ -305,7 +367,17 @@ export class PodStore {
     const b = this.read('blocklist.json', {});
     return { domains: b.domains || [], actors: b.actors || [] };
   }
-  setBlocklist(b) { this.write('blocklist.json', b); }
+  // Blocking someone ends their following as well: a blocked actor, or anyone
+  // on a blocked domain, is no longer delivered to. The mark dropFollower leaves
+  // keeps a reconcile from bringing them back.
+  setBlocklist(b) {
+    this.write('blocklist.json', b);
+    const c = this.getContacts();
+    const gone = c.followers.filter(f => f.actor && this.isBlocked(f.actor)).map(f => f.actor);
+    if (!gone.length) return;
+    for (const actor of gone) dropFollower(c, actor, 'blocked');
+    this.setContacts(c);
+  }
   // Takes an actor URL or an object URL: the actor list only ever matches the
   // former, the domain list matches either.
   isBlocked(url) {