fedipod 1.39.0 → 1.42.0

package/README.md

@@ -4,7 +4,9 @@
 
 FediPod gives you a Fediverse account whose data lives on a Solid pod. You
 follow people on Mastodon, Bluesky, and other Fediverse or ATProto servers in
-one timeline. Your posts, followers and settings stay on your pod.
+one timeline. Your posts, followers and settings are kept on your pod. While fedipod.net
+keeps your account running, it works from a copy of them and writes it to your
+pod every fifteen minutes; your signing key never leaves your pod.
 
 The easiest way to run FediPod is to use it in any browser at https://fedipod.net. Nothing to install. Sign-up points you to a pod provider if you need a pod, then attaches a Fediverse identity to the pod you sign in with.
 
@@ -80,6 +82,11 @@ If your account turns a post down when it runs, you get a direct message from
 yourself saying what was refused and why. Signed in, your outbox shows you
 everything you've done, likes and follows included; everyone else sees only
 your public posts.
+While fedipod.net keeps your account running, a post from such an app goes out
+in a moment, whether or not FediPod is open.
+A comment you post from dokieli names nobody to send it to, so it goes to
+nobody. It is kept on your pod at its own address, where the page you
+commented on points to it. Your own timeline shows it as a private post.
 
 **The manage page.** `manage`, in the bar's account group, opens it: your profile,
 aliases, the gateway, key rotation, recovering posts, parking, moving to
@@ -92,14 +99,16 @@ there it takes over; the first drops back to reading.
 
 ## What the browser version does not do
 
-- **Scheduled posts.** Nothing runs between now and the time you picked, so
+- **Scheduled posts, if you stop fedipod.net keeping your account running.**
+  It does by default, and publishes them while FediPod is closed. Turned off
+  on the manage page, nothing runs between now and the time you picked, so
   the composer refuses one rather than dropping it later.
-- **Notifications while the client is closed.** There is no push service.
-  Open the tab and they are there.
+- **Notifications, and other clients, if you stop fedipod.net keeping your
+  account running.** While it does (the default), any Mastodon app, phone or
+  desktop, can use your account with `fedipod.net` as its server, and an app
+  that offers notifications gets them on your phone with everything closed.
 - **Live updates.** The client refreshes by polling.
 - **Hosting a group.** Joining one works.
-- **Other clients.** A phone app or desktop client has nothing on the network
-  to connect to.
 
 For these, see [Other ways to run FediPod](#other-ways-to-run-fedipod).
 
@@ -108,6 +117,10 @@ For these, see [Other ways to run FediPod](#other-ways-to-run-fedipod).
 Everything you publish and everything you read is stored on your pod. Your
 signing key is stored there too, in a container only you can read through
 your pod's login.
+While fedipod.net keeps your account running, its own pod identity can read
+that container too, so it can act for you while FediPod is closed, and it
+works from a copy of your account's data that it writes back to your pod every
+fifteen minutes. Your key stays on your pod only.
 It all lives in the `fedipod` container you chose at sign-up. Your pod's
 public type index records it, as an ActivityStreams actor, which is how
 FediPod and other Solid apps find your account again.
@@ -119,7 +132,7 @@ not change.
 
 ## Other ways to use FediPod
 
-- [fediverse-account]() - an ESM library that supports both Solid-based and regular Fediverse accounts with methods to login, reply, boost, etc.
+- [fediverse-session](lib/session/README.md) - an ESM library that supports both Solid-based and regular Fediverse accounts with methods to login, reply, boost, etc.
 - [FediPod Server](packages/fedipod-server/README.md): a full ActivityPub
   server as a Community Solid Server component, giving every pod on the server
   the option of a Fediverse account.

package/architecture.md

@@ -16,13 +16,19 @@ and forwards the rest to the pod inbox with a receipt. It holds no key. The
 browser version always has one; the DeviceAgent may use one. Any
 lightweight host will do, Netlify included.
 
+A gateway can also keep a browser account running. It then acts as that
+account's agent whenever FediPod is closed, under a pod identity of its own
+that the owner's rules name, reading the signing key from the pod when it
+needs it. The account's state documents live in a working copy at the
+gateway, which FediPod in the browser, the gateway and any Mastodon app all
+work from, and which the gateway writes to the pod every fifteen minutes. See
+[the gateway](gateway.md).
+
 [FediPod Server](packages/fedipod-server/README.md) puts the agent inside a
 Community Solid Server, so anyone with a pod on that server can opt in to a
 Fediverse account fed by the server itself.
 
-![The browser version](https://raw.githubusercontent.com/jeff-zucker/FediPod/main/browser.svg)
-
-![The DeviceAgent, with a gateway](https://raw.githubusercontent.com/jeff-zucker/FediPod/main/architecture.svg)
+![FediPod: the BrowserAgent and the Gateway, with your pod, Mastodon apps and C2S apps](https://raw.githubusercontent.com/jeff-zucker/FediPod/main/architecture.svg)
 
 ## Protocol conformance
 

package/architecture.svg

@@ -1,89 +1,97 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1290 800" width="1290" height="800" font-family="system-ui, sans-serif">
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1300 680" font-family="Arial, Helvetica, sans-serif">
   <defs>
-    <marker id="arr" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
-      <path d="M0,0 L10,5 L0,10 z" fill="#555"/>
+    <marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="8" markerHeight="8" orient="auto-start-reverse">
+      <path d="M0,0 L10,5 L0,10 z" fill="#333"/>
     </marker>
   </defs>
-  <style>
-    .t   { font-size: 18px; font-weight: 600; fill: #1a1a19; }
-    .d   { font-size: 16px; fill: #333; }
-    .sub { font-size: 15px; fill: #666; }
-    .lbl { font-size: 15px; fill: #555; }
-    .cc  { font-size: 11px; font-weight: 400; font-style: italic; fill: #555; }
-    .arrow  { stroke: #555; stroke-width: 2; fill: none; marker-end: url(#arr); }
-    .arrow2 { stroke: #555; stroke-width: 2; fill: none; marker-end: url(#arr); marker-start: url(#arr); }
-  </style>
-
-  <rect width="1290" height="800" fill="#ffffff"/>
-
-  <!-- The open social web -->
-  <rect x="210" y="30" width="870" height="92" rx="12" fill="#eef1f8" stroke="#7a88b8"/>
-  <text class="t" x="645" y="64" text-anchor="middle">The open social web</text>
-  <text class="d" x="645" y="94" text-anchor="middle">other servers: deliver mail to us, read what we publish</text>
-
-  <!-- FediPod gateway -->
-  <rect x="210" y="180" width="870" height="134" rx="12" fill="#f2ece0" stroke="#b09a5e" stroke-dasharray="7 5"/>
-  <text class="t" x="645" y="214" text-anchor="middle">FediPod gateway</text>
-  <text class="d" x="645" y="240" text-anchor="middle">(optional — Netlify or any always on box)</text>
-  <text class="d" x="645" y="266" text-anchor="middle">checks each delivery's signature at the door;</text>
-  <text class="d" x="645" y="288" text-anchor="middle">drops spam and forgeries before the pod</text>
-
-  <!-- Pod -->
-  <rect x="210" y="375" width="360" height="197" rx="12" fill="#e7f2e7" stroke="#6a9a6a"/>
-  <text class="t" x="390" y="407" text-anchor="middle">Tamara's pod</text>
-  <text class="sub" x="390" y="431" text-anchor="middle">any https, sub-domained, always on pod</text>
-  <text class="d" x="390" y="459" text-anchor="middle">stores &amp; serves her public</text>
-  <text class="d" x="390" y="481" text-anchor="middle">record in S2S AS2 format —</text>
-  <text class="d" x="390" y="503" text-anchor="middle">actor, posts, collections;</text>
-  <text class="d" x="390" y="525" text-anchor="middle">her inbox buffers mail</text>
-  <text class="d" x="390" y="547" text-anchor="middle">even when her agent is off</text>
-
-  <!-- Agent -->
-  <rect x="720" y="375" width="360" height="197" rx="12" fill="#fdeeee" stroke="#b87a7a"/>
-  <text class="t" x="900" y="407" text-anchor="middle">Tamara's FediPod Agent</text>
-  <text class="sub" x="900" y="431" text-anchor="middle">on local device</text>
-  <text class="d" x="900" y="459" text-anchor="middle">does the thinking:</text>
-  <text class="d" x="900" y="481" text-anchor="middle">reads the buffered mail,</text>
-  <text class="d" x="900" y="503" text-anchor="middle">accepts follows, builds her</text>
-  <text class="d" x="900" y="525" text-anchor="middle">timeline, signs &amp; delivers</text>
-  <text class="d" x="900" y="547" text-anchor="middle">everything she says</text>
-
-  <!-- Client -->
-  <rect x="720" y="628" width="360" height="136" rx="12" fill="#f0e9f5" stroke="#9a7ab0"/>
-  <text class="t" x="900" y="662" text-anchor="middle">Browser or Native App</text>
-  <text class="sub" x="900" y="686" text-anchor="middle">(Phanpy, Whalebird, …)</text>
-  <text class="d" x="900" y="714" text-anchor="middle">where she reads and posts;</text>
-  <text class="d" x="900" y="736" text-anchor="middle">talks only to her agent</text>
-
-  <!-- open social web -> gateway -->
-  <path class="arrow" d="M 645 124 L 645 176"/>
-  <text class="lbl" x="657" y="155">deliveries in</text>
-
-  <!-- gateway -> pod -->
-  <path class="arrow" d="M 390 316 L 390 371"/>
-  <text class="lbl" x="402" y="336">verified mail</text>
-  <text class="lbl" x="402" y="357">+ receipt</text>
-
-  <!-- pod <-> agent -->
-  <path class="arrow2" d="M 572 473 L 718 473"/>
-  <text class="lbl" x="645" y="455" text-anchor="middle">drains mail,</text>
-  <text class="lbl" x="645" y="497" text-anchor="middle">writes the record</text>
-
-  <!-- agent <-> client -->
-  <path class="arrow2" d="M 900 574 L 900 626"/>
-  <text class="lbl" x="912" y="605">read / post</text>
-
-  <!-- pod -> open social web: read directly, never through the gateway -->
-  <path class="arrow" d="M 208 440 L 70 440 C 45 440, 38 400, 38 330 C 38 210, 88 100, 206 100"/>
-  <text class="lbl" x="188" y="412" text-anchor="end">reads her record</text>
-
-  <!-- agent -> open social web: delivers her own posts, never through the gateway -->
-  <path class="arrow" d="M 1082 440 L 1220 440 C 1245 440, 1252 400, 1252 330 C 1252 210, 1202 78, 1084 78"/>
-  <text class="lbl" x="1102" y="412">signed deliveries out</text>
-
-  <text class="d" x="45" y="716">The gateway stops unwanted mail from reaching the pod.</text>
-  <text class="d" x="45" y="740">The agent prevents mail buildup and does the mail processing.</text>
-  <text class="d" x="45" y="764">This leaves the pod with the minimal possible load.</text>
-
-  <text class="cc" x="1245" y="764" text-anchor="end">(cc) 4.0 By, Jeff Zucker, 2026</text>
+  <rect x="0" y="0" width="1300" height="680" fill="#ffffff"/>
+
+  <!-- boxes (draw.io palette, as browser.svg) -->
+  <g stroke-width="1.5">
+    <rect x="450"  y="24"  width="280" height="84"  rx="6"  fill="#dae8fc" stroke="#6c8ebf"/>
+    <rect x="260"  y="175" width="650" height="215" rx="10" fill="#f5f5f5" stroke="#666666" stroke-dasharray="8 6"/>
+    <rect x="285"  y="230" width="230" height="130" rx="6"  fill="#d5e8d4" stroke="#82b366"/>
+    <rect x="665"  y="230" width="230" height="130" rx="6"  fill="#e1d5e7" stroke="#9673a6"/>
+    <rect x="40"   y="500" width="300" height="110" rx="6"  fill="#f8cecc" stroke="#b85450"/>
+    <rect x="780"  y="500" width="300" height="110" rx="6"  fill="#fff2cc" stroke="#d6b656"/>
+    <rect x="1040" y="250" width="220" height="95"  rx="6"  fill="#ffe6cc" stroke="#d79b00"/>
+  </g>
+
+  <!-- box labels -->
+  <g fill="#111" text-anchor="middle">
+    <text x="590" y="60"  font-size="20" font-weight="bold">Open Social Web</text>
+    <text x="590" y="88"  font-size="16">Mastodon · Pixelfed · Bluesky …</text>
+
+    <text x="280" y="206" font-size="22" font-weight="bold" text-anchor="start">FediPod</text>
+
+    <text x="400" y="266" font-size="20" font-weight="bold">BrowserAgent</text>
+    <text x="400" y="294" font-size="16">FediPod in any browser,</text>
+    <text x="400" y="318" font-size="16">with Sengi or Phanpy</text>
+
+    <text x="780" y="266" font-size="20" font-weight="bold">Gateway</text>
+    <text x="780" y="294" font-size="16">at fedipod.net, keeps</text>
+    <text x="780" y="318" font-size="16">your account running</text>
+    <text x="780" y="342" font-size="16">from a working copy</text>
+
+    <text x="190" y="536" font-size="20" font-weight="bold">Your Pod</text>
+    <text x="190" y="564" font-size="16">your key, your posts</text>
+    <text x="190" y="588" font-size="16">and your account's data</text>
+
+    <text x="930" y="536" font-size="20" font-weight="bold">Mastodon Apps</text>
+    <text x="930" y="564" font-size="16">Elk · Ivory · Tusky · Fedilab</text>
+    <text x="930" y="588" font-size="16">on your phone or desktop</text>
+
+    <text x="1150" y="289" font-size="20" font-weight="bold">C2S Apps</text>
+    <text x="1150" y="317" font-size="16">box, Dokieli</text>
+  </g>
+
+  <!-- arrows -->
+  <g stroke="#333" stroke-width="1.6" fill="none">
+    <!-- Open Social Web <-> BrowserAgent (ATProto, Bluesky) -->
+    <line x1="520" y1="108" x2="410" y2="230" marker-start="url(#arrow)" marker-end="url(#arrow)"/>
+    <!-- Open Social Web <-> Gateway (ActivityPub mail) -->
+    <line x1="660" y1="108" x2="770" y2="230" marker-start="url(#arrow)" marker-end="url(#arrow)"/>
+    <!-- BrowserAgent <-> Gateway -->
+    <line x1="515" y1="298" x2="665" y2="298" marker-start="url(#arrow)" marker-end="url(#arrow)"/>
+    <!-- Your Pod -> Open Social Web (public posts and profile) -->
+    <path d="M100,500 C0,400 0,110 450,70" marker-end="url(#arrow)"/>
+    <!-- BrowserAgent <-> Your Pod (Solid) -->
+    <line x1="350" y1="360" x2="230" y2="500" marker-start="url(#arrow)" marker-end="url(#arrow)"/>
+    <!-- Gateway <-> Your Pod (stores the account's data) -->
+    <line x1="720" y1="360" x2="340" y2="560" marker-start="url(#arrow)" marker-end="url(#arrow)"/>
+    <!-- Mastodon Apps <-> Gateway -->
+    <line x1="900" y1="500" x2="840" y2="360" marker-start="url(#arrow)" marker-end="url(#arrow)"/>
+    <!-- C2S Apps <-> Gateway -->
+    <line x1="1040" y1="298" x2="895" y2="298" marker-start="url(#arrow)" marker-end="url(#arrow)"/>
+  </g>
+
+  <!-- arrow labels -->
+  <g fill="#333" font-size="16">
+    <text x="470" y="140" text-anchor="end" font-weight="bold" fill="#111">ATProto Protocol</text>
+    <text x="470" y="160" text-anchor="end">for Bluesky</text>
+
+    <text x="712" y="140" text-anchor="start" font-weight="bold" fill="#111">S2S Protocol</text>
+    <text x="712" y="160" text-anchor="start">mail in, posts out</text>
+
+    <text x="590" y="286" text-anchor="middle">serves the app</text>
+    <text x="590" y="320" text-anchor="middle">posts out</text>
+
+    <text x="968" y="286" text-anchor="middle" font-weight="bold" fill="#111">C2S Protocol</text>
+
+    <text x="85" y="250" text-anchor="start">other servers read</text>
+    <text x="85" y="270" text-anchor="start">your public posts</text>
+    <text x="85" y="290" text-anchor="start">and profile</text>
+
+    <text x="272" y="420" text-anchor="end" font-weight="bold" fill="#111">Solid Protocol</text>
+    <text x="272" y="440" text-anchor="end">reads &amp; writes your pod</text>
+
+    <text x="520" y="490" text-anchor="start">stores the working copy</text>
+    <text x="520" y="510" text-anchor="start">on your pod</text>
+
+    <text x="894" y="415" text-anchor="start" font-weight="bold" fill="#111">Mastodon client API</text>
+    <text x="894" y="435" text-anchor="start">sign in at fedipod.net;</text>
+    <text x="894" y="455" text-anchor="start">notifications to your phone</text>
+  </g>
+
+  <text x="1260" y="660" text-anchor="end" font-size="16" fill="#555">© 2026 Jeff Zucker · CC BY-SA 4.0</text>
 </svg>

package/gateway.md

@@ -6,13 +6,16 @@ each delivery's signature where the headers still exist, drops forgeries and
 junk before they ever touch your pod, and passes the rest on with a receipt
 saying it checked.
 
-Your name, your signing key and your data stay on your own pod. The gateway is
+Your name, your signing key and your data are kept on your own pod. The gateway is
 **keyless** — it never holds the key you sign with, so it cannot post as you,
 read your private things, or be you anywhere. The worst a broken one can do is
 push items into your inbox, and those still face your agent's own checks.
 With the outbox door below, a gateway can also hand your agent a post marked as
 yours, which your agent then signs and sends. It still holds no key, but what you
-trust it with grows by that much.
+trust it with grows by that much. A browser account is also kept running by
+the gateway (below). That gives the gateway your key while it works, so it can
+post as you, as any Fediverse server can, and your account's working data is
+kept at the gateway too and written to your pod every fifteen minutes.
 
 A FediPod install works without any gateway at all. Deliveries go straight to
 your pod inbox, which holds them whether your agent is running or not.
@@ -114,6 +117,11 @@ there, signed in at your pod. The door checks that the token is yours, puts the
 post in your inbox marked as yours, and answers with the address the post will
 have. Your agent publishes it and sends it to your followers the next time it
 runs: for a browser account, the next time you open the site.
+While the gateway keeps a browser account running, it starts the account's
+keeper as the post arrives, so the post goes out in a moment.
+A comment from dokieli names nobody to send it to, so it is sent to nobody. It
+is kept at its own address for the page it is on to point at, and only your
+own outbox lists it.
 
 A post with no audience of its own goes out as a public post. A post that is
 not a note, an annotation say, is kept as the app sent it, under your name.
@@ -153,10 +161,61 @@ on the setup page). Setup reads the account on the pod, keeps its state and
 key there, attaches at the new gateway, and completes the move when the
 agent first acts. See [the DeviceAgent](device-agent.md).
 
+## While your app is closed
+
+A browser account runs only while FediPod is open somewhere. While it is
+closed, fedipod.net does two things for it.
+
+**Your mail waits at the gateway.** Deliveries are kept there, not written to
+your pod one by one, and reach your pod in batches of up to a hundred: when you
+open FediPod, or every fifteen minutes otherwise. While FediPod is open, mail
+goes straight to your pod as before. A DeviceAgent's mail always goes straight
+to its pod.
+
+**The gateway keeps your account running.** Unless you turn it off, the
+gateway accepts your follows, tries again what failed to go out, and publishes
+the posts you scheduled, all while FediPod is closed. Other mail waits on your
+pod for FediPod to open, as before. It works under its own pod identity, which your app
+names in the access rules on your FediPod folder. It reads your signing key
+from your pod when it needs it, so it can post as you, and keeps no copy of the
+key. **Stop keeping it running** on the manage page takes it out of the rules.
+If fedipod.net ever changes its own pod identity, your FediPod moves your
+account over the next time you open it, with nothing for you to do.
+Scheduling a post is offered only while this is on, because otherwise nothing
+would be running when the time came.
+
+**Your account's working data is kept at the gateway.** While the gateway
+keeps your account running, your timeline, notifications, followers, settings
+and the rest of your FediPod state are kept at fedipod.net, and FediPod in your
+browser, the gateway and any app you use all work from that one copy, so they
+never disagree. fedipod.net writes what changed to your pod every fifteen
+minutes, and everything at once when you stop it keeping your account running,
+move your address or close it. Your signing key and the passwords of accounts
+you connected elsewhere are never in the copy; they stay on your pod only.
+
+## Using any Mastodon app
+
+While the gateway keeps your account running, any Mastodon app can use it:
+elk.zone, Ivory, Tusky, Phanpy and the rest. In the app, give `fedipod.net` as
+your server. The app sends you to a fedipod.net page that asks for your
+Fediverse address or your WebID and signs you in at your own pod; no password
+is typed on fedipod.net. The app then reads your timeline and notifications from your
+account's copy at the gateway, and posts, boosts, likes and follows as you.
+
+An app checks for new posts every minute or so while it is open; there are no
+live updates. Accounts are made on the fedipod.net front page, with a pod, not
+from an app.
+
+**Notifications on your phone.** An app that offers notifications can sign up
+for them here. A mention, a reply, a direct message, a follow, or a like, boost
+or reaction to your own post then reaches your phone as it arrives, while
+FediPod and the app are closed. While FediPod is open in a browser, it reads
+your mail itself, and those arrivals are not pushed.
+
 ## Accounts that go quiet
 
-A gateway holds no mail. Every delivery it accepts is written into your pod
-inbox, and your agent reads it from there. A BrowserAgent reads only while
+Every delivery the gateway accepts ends up in your pod inbox, and your agent
+reads it from there. A BrowserAgent reads only while
 its page is open, so an account nobody opens grows on its pod without limit
 and comes back to a drain of everything at once. fedipod.net keeps two facts
 about each browser account — when its owner last signed in or posted, and
@@ -194,9 +253,16 @@ web address becomes a link.
 
 It reads only public data to decide what concerns you: your published
 followers and following, and a small public policy document your agent writes
-with a mirror of your blocklist. Nothing private leaves your pod. Publishing
-that mirror does make your blocklist public, which is part of the bargain of
-running behind a door.
+with a mirror of your blocklist. Publishing that mirror does make your
+blocklist public, which is part of the bargain of running behind a door.
+
+Three things go further, all for browser accounts only. Mail that waits at
+the gateway while your app is closed, direct messages included, is stored there
+until it reaches your pod. A gateway keeping your account running can read and
+write everything in your FediPod folder, your signing key included, while it
+works; nothing else on your pod is open to it. And it keeps your account's
+working data — your timeline, notifications and direct messages among it — for
+as long as it keeps your account running.
 
 ## Running a gateway
 

package/lib/client/c2s.mjs

@@ -48,6 +48,10 @@ const ACTIVITY_TYPES = new Set([
 
 const arr = (v) => (v === undefined || v === null ? [] : Array.isArray(v) ? v : [v]);
 const idOf = (v) => (typeof v === 'string' ? v : v?.id || null);
+// An audience address. The public collection has three valid spellings
+// (ActivityPub §5.6); reading a post as JSON-LD can yield the short one.
+const PUBLIC_SPELLINGS = new Set(['Public', 'as:Public']);
+const audienceOf = (v) => { const id = idOf(v); return PUBLIC_SPELLINGS.has(id) ? wire.PUBLIC : id; };
 
 function readBody(req) {
   return new Promise((resolve, reject) => {
@@ -63,6 +67,9 @@ function readBody(req) {
   });
 }
 
+const isAnnotation = (o) => arr(o?.type).some((t) => t === 'Annotation' || t === 'oa:Annotation'
+  || t === 'http://www.w3.org/ns/oa#Annotation');
+
 export class C2S {
   constructor({ agent, log = console.log, auth, scheme = null, mount = '' }) {
     this.agent = agent;
@@ -345,8 +352,8 @@ export class C2S {
   // every client means by a post with no audience chosen, and what a client
   // that never addresses (dokieli's annotations) needs.
   visibilityOf(activity, object) {
-    const to = arr(activity.to ?? object?.to).map(idOf);
-    const cc = arr(activity.cc ?? object?.cc).map(idOf);
+    const to = arr(activity.to ?? object?.to).map(audienceOf);
+    const cc = arr(activity.cc ?? object?.cc).map(audienceOf);
     // Blind copies alone are still an audience: a post for them and nobody
     // else is direct, never public.
     const blind = arr(activity.bto ?? object?.bto).length + arr(activity.bcc ?? object?.bcc).length;
@@ -386,7 +393,7 @@ export class C2S {
   // in to/cc are listed and delivered to; the ones in bto/bcc are delivered
   // to and never listed (§6).
   addressedActors(activity, object) {
-    const pick = (...fields) => [...new Set(fields.flatMap((f) => arr(activity[f] ?? object?.[f]).map(idOf)))]
+    const pick = (...fields) => [...new Set(fields.flatMap((f) => arr(activity[f] ?? object?.[f]).map(audienceOf)))]
       .filter((a) => typeof a === 'string' && /^https?:\/\//u.test(a)
         && a !== wire.PUBLIC && a !== this.urls.followers && a !== this.urls.actor);
     // `audience` is who the post is for, a group most often: delivered to and
@@ -417,12 +424,16 @@ export class C2S {
         const visibility = this.visibilityOf(activity, object);
         const { also, deliverTo } = this.addressedActors(activity, object);
         // Not a Note and not a poll: stored as sent, under this actor, and
-        // the Create around it delivered — a Web Annotation, for one.
+        // the Create around it delivered — a Web Annotation, for one. An
+        // annotation addressed to nobody, as dokieli sends one, is delivered
+        // to nobody: kept at its address for the page it is on to point at.
         if (makes !== 'Note' && makes !== 'Question') {
           const asSent = raw && typeof raw === 'object' && !Array.isArray(raw)
             ? (ACTIVITY_TYPES.has(raw.type) ? (raw.object && typeof raw.object === 'object' ? raw.object : null) : raw)
             : null;
-          const made = await agent.publisher.publishObject(asSent || object, { visibility, slug, also, deliverTo });
+          const unaddressed = isAnnotation(asSent || object)
+            && ['to', 'cc', 'bto', 'bcc', 'audience'].every((f) => !arr(activity[f] ?? object[f]).length);
+          const made = await agent.publisher.publishObject(asSent || object, { visibility, slug, also, deliverTo, unaddressed });
           return reply(201, { id: made.createId, object: made.id }, { location: made.createId });
         }
         // `source.content` is the client's plain text when it sends one; bare

package/lib/client/masto/bridge.mjs

@@ -0,0 +1,61 @@
+// bridge.mjs — a fetch Request handed to code written for Node's request and
+// response: the Mastodon facade and the admin surface. The browser worker
+// answers its own client through it (web/app/sw-src.mjs), and the gateway
+// answers Mastodon apps through it (lib/gateway/masto-gateway.mjs).
+//
+// Returns { req, res, bodyBytes, bodyText, response() }: `response()` is what
+// the handler wrote, as a fetch Response.
+export async function bridge(request, url, { sameOrigin = false } = {}) {
+  // Bytes, not text. A multipart upload is binary — read as text it comes back
+  // through a UTF-8 round trip that replaces every byte that is not valid UTF-8,
+  // which is most of a JPEG, so the boundary search found nothing and every
+  // media and avatar upload answered "422 file required". readBody() does
+  // `data += chunk`, which decodes a Buffer the same way it always did, so the
+  // JSON and form paths are unchanged.
+  const bodyBytes = (request.method === 'GET' || request.method === 'HEAD')
+    ? null : Buffer.from(new Uint8Array(await request.arrayBuffer()));
+  const bodyText = bodyBytes ? new TextDecoder().decode(bodyBytes) : '';
+  const reqHeaders = {}; for (const [k, v] of request.headers) reqHeaders[k.toLowerCase()] = v;
+  // `host` is a forbidden header name, so a fetch Request never carries one and
+  // the loop above cannot produce it — but it is a header every real request
+  // arrives with, and the agent reads it to say where it lives. Without it the
+  // notifications `Link` header named `https://undefined/`, so a client that
+  // paged by following it (which is how a client is meant to page) walked off
+  // the origin and saw nothing past the first screen.
+  reqHeaders.host = url.host;
+  const listeners = {};
+  // The body's events fire on the next microtask. A route that reads the body
+  // may only register for them after an await or two — the facade dispatches
+  // through its area modules first — so a listener that arrives after the
+  // events have fired is given them at once, in the order it asks.
+  let fired = false;
+  const req = { method: request.method, url: url.pathname + url.search, headers: reqHeaders,
+    // Whether the caller is a page on the agent's own origin. The browser
+    // worker has established that before anything reaches the facade, and
+    // MastoApi asks (through its authorities) whether a request is the owner's
+    // own; a request at the gateway never is.
+    sameOrigin,
+    socket: { encrypted: url.protocol === 'https:' },
+    on(ev, cb) {
+      (listeners[ev] ||= []).push(cb);
+      if (fired) { if (ev === 'data' && bodyBytes?.length) cb(bodyBytes); else if (ev === 'end') cb(); }
+      return req;
+    },
+    destroy() {} };
+  queueMicrotask(() => {
+    fired = true;
+    if (bodyBytes?.length) (listeners.data || []).forEach((cb) => cb(bodyBytes));
+    (listeners.end || []).forEach((cb) => cb());
+  });
+  let status = 200; const outHeaders = {}; const chunks = [];
+  const res = {
+    writeHead(s, h) { status = s; if (h) Object.assign(outHeaders, h); return res; },
+    setHeader(k, v) { outHeaders[k] = v; }, getHeader(k) { return outHeaders[k]; },
+    write(c) { chunks.push(c); }, end(c) { if (c) chunks.push(c); },
+  };
+  return {
+    req, res, bodyBytes, bodyText,
+    get status() { return status; },
+    response: () => new Response(chunks.join(''), { status, headers: { 'content-type': 'application/json', ...outHeaders } }),
+  };
+}

package/lib/client/masto/index.mjs

@@ -149,7 +149,10 @@ export class MastoApi {
     // A viewer-mode agent (another agent holds the drain lease) may not act —
     // but a user acting HERE outranks the idle active agent elsewhere, so a
     // write attempt claims the lease and proceeds. Only a failed claim 503s.
-    if (this.agent.viewer && req.method !== 'GET' && req.method !== 'HEAD') {
+    // An agent working from a copy its gateway shares (the browser build,
+    // web/app/copy-mode.mjs) asks every time, since an app at the gateway may
+    // have taken the lease without it hearing yet.
+    if ((this.agent.viewer || this.agent.copy) && req.method !== 'GET' && req.method !== 'HEAD') {
       const took = await this.agent.requestTakeover?.();
       if (!took) return send(503, { error: 'another agent is active for this pod — takeover failed, try again' });
     }

package/lib/client/masto/oauth.mjs

@@ -45,7 +45,7 @@ const parseRedirects = (v) => (Array.isArray(v) ? v : String(v || '').split(/\s+
 // The sign-in page for an account whose owner signs in at their pod: no
 // password of ours exists, and none is asked for. The page carries the
 // client's request in its address, signs the owner in at the pod with the
-// fediverse-account library, and proves that sign-in back to /oauth/authorize.
+// fediverse-session library, and proves that sign-in back to /oauth/authorize.
 function sendPodSigninPage(res, client, webId, mount = '') {
   let asking = '';
   if (client && (client.name || client.redirect)) {
@@ -53,7 +53,7 @@ function sendPodSigninPage(res, client, webId, mount = '') {
     try { where = client.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
     const who = client.name ? escapeHtml(client.name) : (where ? escapeHtml(where) : 'A client');
     asking = `<p><strong>${who}</strong> is asking to use your account`
-      + `${where ? `, and will be sent back to <code>${escapeHtml(where)}</code>` : ''}.</p>`;
+      + `${where ? `, and you will be sent back to <code>${escapeHtml(where)}</code>` : ''}.</p>`;
   }
   res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' });
   res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">

package/lib/client/masto/statuses.mjs

@@ -112,6 +112,9 @@ export async function handle(api, ctx) {
       };
       sched.push(entry);
       api.store.setScheduled(sched);
+      // Whatever keeps the time for this agent hears of it (a browser app
+      // tells its gateway, which publishes it if the app has closed by then).
+      api.agent.onScheduled?.();
       return send(200, api.scheduledJson(entry));
     }
     let note;

package/lib/connections/acctfeed.mjs

@@ -55,18 +55,22 @@ export class AcctFeed {
     });
   }
 
-  start() {
+  // `lastSweptAt` and `onSwept`: see TagFeed.start — a restarted browser
+  // worker sweeps only when the interval is due.
+  start({ lastSweptAt = 0, onSwept = null } = {}) {
     this.stopped = false;
-    this.sweep().catch(e => this.log(`acctfeed: ${e.message}`));
-    const tick = () => {
-      this.timer = setTimeout(() => {
-        this.sweep()
-          .catch(e => this.log(`acctfeed: ${e.message}`))
-          .finally(() => { if (!this.stopped) tick(); });
-      }, Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3)));
+    const sweep = () => this.sweep()
+      .catch(e => this.log(`acctfeed: ${e.message}`))
+      .finally(() => onSwept?.(Date.now()));
+    const every = () => Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3));
+    const tick = (ms) => {
+      this.timer = setTimeout(() => { sweep().finally(() => { if (!this.stopped) tick(every()); }); }, ms);
       this.timer.unref?.();
     };
-    tick();
+    const due = lastSweptAt + this.config().intervalMin * 60_000 - Date.now();
+    if (due > 0) { tick(due); return; }
+    sweep();
+    tick(every());
   }
 
   stop() { this.stopped = true; clearTimeout(this.timer); }