fedipod 1.43.0 → 1.45.0

package/README.md

@@ -34,6 +34,16 @@ This README is about the `FediPod BrowserAgent`. There are also a number of [oth
 
 From now on, anyone can open your profile at `https://fedipod.net/@handle@provider`, signed in or not.
 
+## Getting a forum
+
+The same page makes a forum. Choose **A forum** as the first thing on it. A
+forum has a pod of its own, so make a new pod for it at your provider (or
+sign in with one that holds nothing else), then give the forum a handle, a
+name and its categories, and the address at fedipod.net you will moderate it
+as. fedipod.net runs the forum from then on; nothing runs on your machine.
+Its page is at `https://bb.fedipod.net/<handle>/` and its address is
+`@handle@fedipod.net`, with one address per category.
+
 ## What you can do
 
 There are two clients, both served by fedipod.net:
@@ -141,6 +151,12 @@ not change.
 - [FediPod Groups](groups.md): hosting a discussion group of Fediverse and Bluesky users from a pod.
 - [FediPod Gateway](gateway.md): A thin, always-on door running on Netlify or any small host that provides a middleman between a pod and the single-user agents. (only needed with `BrowserAgent` and `DeviceAgent`)
 
+There are two ways to run FediPod: in a browser at a Gateway such as
+fedipod.net, with nothing installed, or as a Gateway of your own, deployed
+from this repository ([netlify/README.md](netlify/README.md)). Cloning the
+repository and running it is not one of them: `npm start` only says so. The
+DeviceAgent is deprecated; nothing new is built for it.
+
 
 ## Acknowledgements
 

package/gateway.md

@@ -15,7 +15,10 @@ yours, which your agent then signs and sends. It still holds no key, but what yo
 trust it with grows by that much. A browser account is also kept running by
 the gateway (below). That gives the gateway your key while it works, so it can
 post as you, as any Fediverse server can, and your account's working data is
-kept at the gateway too and written to your pod every fifteen minutes.
+kept at the gateway too and written to your pod every fifteen minutes. For
+a kept account the gateway also answers a follower's server asking for one
+of your followers-only posts, and the named person's server asking for a
+direct one, when that server signs its request; nobody else gets them.
 
 A FediPod install works without any gateway at all. Deliveries go straight to
 your pod inbox, which holds them whether your agent is running or not.
@@ -73,8 +76,9 @@ mode says how far you trust the door, and every step is reversible:
 - **locked** — your inbox accepts writes only from the gateway.
 
 In every mode past **off**, the door itself is already filtering: blocked
-actors, content that does not concern you, and forged signatures are dropped
-at the door and never reach the pod. The mode says only how far the agent
+actors and content that does not concern you are dropped at the door and
+never reach the pod; a delivery whose signature does not verify is passed on
+marked unverified, and the agent decides by fetching what it claims to be. The mode says only how far the agent
 believes the door's receipts.
 
 The shadow numbers come from the agent:

package/lib/client/c2s.mjs

@@ -32,11 +32,6 @@ import * as podNotes from '../pod/notes.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
-// How many archived items one page of the inbox will read. A page is one
-// month, and a month with more than this is served short rather than costing
-// the pod an unbounded read; the log says when that happened.
-const MAX_INBOX_PAGE = 500;
-
 // How many recorded activities one page of the locally-served outbox carries.
 const MAX_OUTBOX_PAGE = 50;
 
@@ -99,82 +94,35 @@ export class C2S {
     return iri ? this.store.getStatuses().find((s) => s.noteId === iri) : null;
   }
 
-  /** The months the archive holds, newest first. One container listing. */
-  async archiveMonths() {
-    const archive = this.agent.intake?.archive;
-    if (!archive) return [];
-    const { names } = await archive.list('');
-    return (names || [])
-      .map((n) => n.replace(/\/$/u, ''))
-      .filter((n) => /^\d{4}-\d{2}$/u.test(n))
-      .sort()
-      .reverse();
-  }
-
   /**
-   * The owner's own inbox, §5.2. Paged by month because that is how the
-   * archive is stored, so a page costs one listing and a read per item and no
-   * page is dearer for another month being large.
+   * The owner's own inbox, §5.2: the collection the drain keeps on the pod in
+   * the private container (intake/received.mjs), served under this agent's
+   * address so a client holding no pod credential of its own can read it.
+   * Nothing is built per request; a page is the pod's page.
    */
-  async sendInbox(res, url) {
-    const id = `${this.urls.base}ap/inbox`;
+  async sendInbox(res, url, origin) {
+    const id = `${origin}ap/inbox`;   // named for the client that asked, as the outbox is
+    const own = this.urls.ownInbox;
     const page = url?.searchParams?.get('page') || null;
-    let months;
+    if (page !== null && !/^[1-9]\d{0,6}$/u.test(page)) return this.send(res, 400, { error: 'page is a number' });
+    let doc;
     try {
-      months = await this.archiveMonths();
+      doc = await this.agent.remote.getJson(page ? `${own}-${page}` : own);
     } catch (e) {
-      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
+      return this.send(res, 502, { error: `the inbox collection could not be read: ${e.message}` });
     }
-
-    if (!page) {
-      if (!months.length && this.store.getConfig()?.archiveInbox === false) {
+    if (!doc) {
+      if (page) return this.send(res, 404, { error: 'no such page' });
+      if (this.store.getConfig()?.archiveInbox === false) {
         this.log('inbox read: nothing to show — this identity does not keep what it receives');
       }
-      return this.send(res, 200, {
-        '@context': wire.AS_CTX, id, type: 'OrderedCollection',
-        ...(months.length ? { first: `${id}?page=${months[0]}` } : { orderedItems: [] }),
-      });
-    }
-    if (!/^\d{4}-\d{2}$/u.test(page)) {
-      return this.send(res, 400, { error: 'page names a month, written 2026-09' });
-    }
-
-    const archive = this.agent.intake?.archive;
-    let names = [];
-    try {
-      // The trailing slash matters: without it this names a document, not the
-      // container, and a pod answers about the wrong thing.
-      ({ names } = await archive.list(`${page}/`));
-    } catch (e) {
-      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
-    }
-    const files = (names || []).filter((n) => n.endsWith('.json')).sort();
-    if (files.length > MAX_INBOX_PAGE) {
-      this.log(`inbox read: ${page} holds ${files.length} items; serving the first ${MAX_INBOX_PAGE}`);
+      return this.send(res, 200, { '@context': wire.AS_CTX, id, type: 'OrderedCollection', totalItems: 0, orderedItems: [] });
     }
-    const kept = [];
-    for (const file of files.slice(0, MAX_INBOX_PAGE)) {
-      // Read as written: these records are JSON-LD, and the default read asks
-      // turtle-first, which a server is free to answer with turtle.
-      const read = await archive.read(`${page}/${file}`, { accept: '*/*' });
-      if (!read?.ok || !read.body) continue;
-      try {
-        const record = JSON.parse(read.body);
-        // The record wraps the bytes as they arrived; the activity is those
-        // bytes, not a retelling of them.
-        kept.push({ at: record.receivedAt || '', activity: JSON.parse(record.raw) });
-      } catch { /* a record that will not parse is not one that can be served */ }
-    }
-    kept.sort((a, b) => String(b.at).localeCompare(String(a.at)));
-    const older = months.filter((m) => m < page)[0] || null;
-    return this.send(res, 200, {
-      '@context': wire.AS_CTX,
-      id: `${id}?page=${page}`,
-      type: 'OrderedCollectionPage',
-      partOf: id,
-      ...(older ? { next: `${id}?page=${older}` } : {}),
-      orderedItems: kept.map((k) => k.activity),
-    });
+    // The pod's names become this agent's: the head is `id`, page n is `id?page=n`.
+    const here = (v) => (typeof v === 'string' && v.startsWith(own)
+      ? (v === own ? id : v.replace(`${own}-`, `${id}?page=`)) : v);
+    for (const k of ['id', 'partOf', 'first', 'last', 'next', 'prev']) if (k in doc) doc[k] = here(doc[k]);
+    return this.send(res, 200, doc);
   }
 
   // The actor a client-to-server client on this machine reads. The same
@@ -277,7 +225,7 @@ export class C2S {
       }
       const reader = await this.auth(req, pathname);
       if (!reader.ok) return this.send(res, reader.status, { error: reader.error }, reader.headers || {});
-      return this.sendInbox(res, url);
+      return this.sendInbox(res, url, this.localOrigin(req) || this.urls.base);
     }
     if (req.method === 'GET' || req.method === 'HEAD') {
       // The owner, signed in, reads every message the actor produced (§5.1:

package/lib/core/intake/index.mjs

@@ -28,6 +28,7 @@ import { trimActivity, sameIdentity, sameOrigin, httpUrl, reactionOf, MAX_EMOJIS
 import * as channel from './channel.mjs';
 import * as verify from './verify.mjs';
 import * as group from './group.mjs';
+import * as received from './received.mjs';
 import * as activities from './activities.mjs';
 import * as notes from './notes.mjs';
 import { readLenient } from '../as2.mjs';
@@ -489,6 +490,9 @@ export class Intake {
       if (pending.length >= DELETE_BATCH && !await flush()) return;
     }
     if (!await this._finishSweep(flush)) return;
+    // What this sweep accepted, onto the pod as the owner's inbox collection:
+    // one page write and the head per sweep with mail, never per item.
+    await received.publishReceived(this).catch((e) => this.log(`inbox collection: ${e.message}`));
     // Receipts earlier drains left behind, a few per sweep until none remain.
     for (const stray of podInbox.orphanReceipts(this.remote, this.urls).slice(0, ORPHAN_RECEIPTS_PER_SWEEP)) {
       if (!await podInbox.dropStrayReceipt(this.remote, stray)) break;
@@ -532,7 +536,10 @@ export class Intake {
     const rejection = !activity ? 'unparsable JSON'
       : owned ? await this.ownerPostFrom(activity, raw, receipt)
         : await this.handle(activity, receipt);
-    if (!rejection && raw && !owned) await this._archive(url, raw, activity);
+    if (!rejection && raw && !owned) {
+      await this._archive(url, raw, activity);
+      received.recordReceived(this, activity);   // §5.2: the owner's readable inbox
+    }
     if (!rejection && !owned) await this._maybeForward(activity);    // §7.1.2, only what we accepted
     if (rejection) {
       this.store.addDeadLetter({

package/lib/core/intake/received.mjs

@@ -0,0 +1,78 @@
+// received.mjs — the inbox as its owner reads it (ActivityPub §5.2): every
+// delivery the account accepted, kept on the pod as a paged OrderedCollection
+// in the private container, beside the archive that keeps each delivery's
+// bytes. The door and the agent's own /ap/inbox serve these documents.
+//
+// Pages fill from the oldest end, PAGE_SIZE to a page, and a full page is
+// never written again: an accepted delivery rewrites the newest page and the
+// small head, and nothing else. Activities ride inline, so a reader gets what
+// arrived without a fetch per item — a Like or a Follow has no address its
+// origin answers anyway. Past ITEM_MAX_CHARS the item is the activity's id
+// alone, so one enormous delivery cannot make a page of them enormous.
+//
+// §5.2 also says an activity delivered twice is listed once. The archive
+// already collapses identical bytes; this keeps the last SEEN_MAX ids and
+// drops a repeat that arrived with different addressing.
+//
+// Written only while the archive is on — an owner who chose not to keep what
+// arrives keeps nothing here either — and only once the private container is
+// proved private, the bar every owner-only document clears. Recorded meanwhile,
+// and published the first time the bar is met.
+
+import * as wire from '../wire.mjs';
+import * as collection from '../../pod/collection.mjs';
+
+export const PAGE_SIZE = wire.FOLLOWERS_PAGE_SIZE;
+export const SEEN_MAX = 500;
+export const ITEM_MAX_CHARS = 32 * 1024;
+// Recorded but unpublished items are held in state; past this many the oldest
+// are let go (the archive still has them) rather than growing state forever.
+const HELD_MAX = PAGE_SIZE * 5;
+const RECEIVED = 'received.json';
+
+const fresh = () => ({ sealed: 0, open: [], total: 0, seen: [] });
+
+const keeps = (intake) => !!intake.archive && !!intake.urls?.ownInbox
+  && intake.store.getConfig?.()?.archiveInbox !== false;
+
+/** Record one accepted delivery. False when it was a repeat, or nothing is kept. */
+export function recordReceived(intake, activity) {
+  if (!keeps(intake) || !activity || typeof activity !== 'object') return false;
+  const st = { ...fresh(), ...intake.store.read(RECEIVED, {}) };
+  const id = typeof activity.id === 'string' ? activity.id : null;
+  if (id && st.seen.includes(id)) return false;
+  st.open.push(id && JSON.stringify(activity).length > ITEM_MAX_CHARS ? id : activity);
+  if (st.open.length > HELD_MAX) st.open.splice(0, st.open.length - HELD_MAX);
+  st.total += 1;
+  if (id) {
+    st.seen.push(id);
+    if (st.seen.length > SEEN_MAX) st.seen.splice(0, st.seen.length - SEEN_MAX);
+  }
+  intake.store.write(RECEIVED, st);
+  intake._receivedDirty = true;
+  return true;
+}
+
+/** Write what was recorded since the last publish: the newest page(s) and the head. */
+export async function publishReceived(intake) {
+  if (!intake._receivedDirty || !keeps(intake)) return;
+  const ready = intake.publisher?.privateReady;
+  if (typeof ready === 'function' && await ready.call(intake.publisher) !== true) return;
+  const { remote, urls } = intake;
+  const st = { ...fresh(), ...intake.store.read(RECEIVED, {}) };
+  // Every full page first (several when the bar was met late), then the open one.
+  do {
+    const n = st.sealed + 1;
+    const items = st.open.slice(0, PAGE_SIZE);
+    await collection.writePage(remote, wire.followersPageId(urls.ownInbox, n),
+      wire.followersPage(urls.ownInbox, n, items, n));
+    if (items.length < PAGE_SIZE) break;
+    st.sealed = n;
+    st.open = st.open.slice(PAGE_SIZE);
+    intake.store.write(RECEIVED, st);
+  } while (st.open.length);
+  const pages = Math.max(1, st.sealed + (st.open.length ? 1 : 0));
+  await collection.writeHead(remote, urls.ownInbox, wire.followersHead(urls.ownInbox, st.total, pages));
+  intake.store.write(RECEIVED, st);
+  intake._receivedDirty = false;
+}

package/lib/gateway/front-core.mjs

@@ -28,6 +28,7 @@ import { routeNoticesApi } from './notices.mjs';
 import { withSecurityHeaders } from './headers.mjs';
 import { podTokenVerifier } from './caches.mjs';
 import { claimedWebId } from './token-claims.mjs';
+import { answerPrivateRead } from './private-read.mjs';
 import { announced, overLimit, relayOne } from './relay-extras.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
@@ -740,11 +741,6 @@ async function route(request, ctx) {
     return { status: 200, headers: { 'content-type': 'text/javascript' }, body: ctx.authBundle };
   }
 
-  // The installer:  curl -fsSL https://<host>/install | sh
-  if (pathname === '/install') {
-    if (!ctx.installScript) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/plain; charset=utf-8' }, body: ctx.installScript };
-  }
 
   // WebFinger: acct:<handle>@<host> → the fronted actor. This is what makes
   // @name@fedipod.net a real handle the fediverse can look up.
@@ -804,18 +800,36 @@ async function route(request, ctx) {
   const CLOSED = 'this address is closed';
 
   // Inbox: verify at the door, forward to the user's pod inbox. This is the
-  // gateway, per user.
+  // gateway, per user. A forum's own page posts here from its own host, so the
+  // door answers a browser's preflight and carries the open origin; a delivery
+  // needs no credential, and a browser sends none across origins.
   if (up.rest === 'ap/inbox/' || up.rest === 'ap/inbox') {
+    const doorCors = {
+      'access-control-allow-origin': '*',
+      'access-control-allow-methods': 'POST, OPTIONS',
+      'access-control-allow-headers': 'Content-Type',
+      'access-control-max-age': '86400',
+    };
+    if (request.method === 'OPTIONS') return { status: 204, headers: { ...doorCors, allow: 'POST, OPTIONS' }, body: null };
+    // The owner, signed in, reads the inbox as a collection (§5.2): the drain
+    // keeps it on the pod, under the owner's own rule. The token is only
+    // read, never verified, as at the outbox door: the pod checks it.
+    if ((request.method === 'GET' || request.method === 'HEAD') && request.headers.get('authorization')) {
+      const webid = claimedWebId(request);
+      if (webid && (rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome))) {
+        return { status: 303, headers: { ...doorCors, location: rec.podHome + 'ap/private/inbox', 'cache-control': 'no-store' }, body: '' };
+      }
+    }
     if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
-    if (movedBase) { console.log(`door @${up.handle}: delivery → 410 (moved)`); return gone(); }
-    if (closed) { console.log(`door @${up.handle}: delivery → 410 (closed)`); return gone({}, CLOSED); }
+    if (movedBase) { console.log(`door @${up.handle}: delivery → 410 (moved)`); return gone(doorCors); }
+    if (closed) { console.log(`door @${up.handle}: delivery → 410 (closed)`); return gone(doorCors, CLOSED); }
     const policy = await policyFor(rec, ctx.fetchImpl || fetch);
     const standing = await accountState(ctx, up.handle, rec);
     // A browser account's mail waits here while its app is closed (held-mail.mjs).
     const held = holdsMail(ctx, rec) && !(await isPresent(ctx, up.handle));
     const { status, reason, content, bytes, type, notifies, name, raw, receipt } = await handleDelivery(request, identFor(rec, policy),
       { podPut: held ? holdingPut(ctx, up.handle, rec) : (u, b, ct) => ctx.podPut(up.handle, u, b, ct),
-        fetchImpl: ctx.fetchImpl, paused: standing.paused });
+        fetchImpl: ctx.fetchImpl, paused: standing.paused, origin: ctx.frontOrigin || null });
     // One line per delivery, so "did it arrive at the door" has an answer.
     console.log(`door @${up.handle}: delivery → ${status} (${reason}${held && status === 202 ? ', held' : ''})`);
     if (status === 202 && content) await noteReceived(ctx, up.handle, rec, bytes);
@@ -827,9 +841,15 @@ async function route(request, ctx) {
       const placed = await ctx.forum.placeAtDoor(ctx, up.handle, rec, { name, raw, receipt })
         .catch((e) => ({ placed: false, why: e.message }));
       console.log(`door @${up.handle}: ${placed.placed ? 'placed' : `not placed (${placed.why})`}`);
+      // Placed means written on the pod: the edge's copies of the category's
+      // and the forum's documents go, so the page that posted reads it back.
+      if (placed.placed) {
+        const tags = [`u-${up.handle}`, ...(placed.forum && placed.forum !== up.handle ? [`u-${placed.forum}`] : [])];
+        await ctx.purge?.(tags).catch((e) => console.log(`purge @${up.handle}: ${e?.message || e}`));
+      }
       if (placed.forum && ctx.startKeeper) await ctx.startKeeper(placed.forum).catch((e) => console.log(`keeper @${placed.forum}: not started (${e.message})`));
     }
-    return { status, headers: {}, body: '' };
+    return { status, headers: doorCors, body: '' };
   }
 
   // Outbox: the owner's own post, from any client that speaks ActivityPub
@@ -901,10 +921,9 @@ async function route(request, ctx) {
   const podTarget = rec.podHome + up.rest;
   // The owner's own documents — the full outbox, the liked list, the pending
   // lists — are read at the pod, which decides who may; never held here,
-  // where one reader's answer would be served to the next.
-  if (up.rest.startsWith('ap/private/')) {
-    return { status: 303, headers: { ...open, location: podTarget, 'cache-control': 'no-store' }, body: '' };
-  }
+  // where one reader's answer would be served to the next. A signed read of
+  // a private post by a server it was sent to is answered (private-read.mjs).
+  if (up.rest.startsWith('ap/private/')) return answerPrivateRead(ctx, rec, { request, handle: up.handle, podTarget, base, open, swap });
   // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
   // the id rewrite below turns media links onto the front like every other
   // pod url in a document. Answer those by pointing at the pod: bytes are not

package/lib/gateway/front-pages.mjs

@@ -1,8 +1,7 @@
 // front-pages.mjs — the front's pages and the files they load, read from
 // beside this package: the opt-in page, the roster, the notices page, the
-// new-account page, each page's own script, the sign-in library and the
-// installer. A file that is not there comes back null, and the route it
-// feeds answers 404.
+// root page, each page's own script and the sign-in library. A file that is
+// not there comes back null, and the route it feeds answers 404.
 
 import fs from 'node:fs';
 import path from 'node:path';
@@ -26,6 +25,5 @@ export function frontPages() {
     noticesPage: readOrNull('notices.html'),
     authBundle: readOrNull('solid-oidc-client.js'),
     pageScripts,
-    installScript: readOrNull('install.sh'),
   };
 }

package/lib/gateway/gateway-core.mjs

@@ -91,12 +91,34 @@ export function notifies(activity, ident) {
 // Returns { status, reason } — the adapter turns it into an HTTP response —
 // and, for a delivery that reached the pod, `content` (whether it was
 // content rather than control) and `bytes`, so the caller can keep count.
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false } = {}) {
-  // Read the body once from a clone; the original, unconsumed, goes to the
-  // verifier (which needs the body for the Digest check).
-  let raw;
-  try { raw = await request.clone().text(); } catch { return { status: 400, reason: 'unreadable body' }; }
-  if (Buffer.byteLength(raw) > maxBytes) return { status: 413, reason: 'too large' };
+// The request as the sender signed it. A sender signs the host it delivered
+// to and digests the bytes it sent; what reaches this code has been through
+// an edge that may have rewritten the Host header, the URL's host or both
+// (Netlify does), and a verifier that trusts those fails every honest
+// delivery. So the verifier gets a request rebuilt from the bytes read here,
+// at the door's own origin when the caller names it, else at the host a
+// proxy says it forwarded for, else at the URL's own.
+export function asSigned(request, bytes, origin) {
+  const u = new URL(request.url);
+  let host = null;
+  if (origin) { try { const o = new URL(origin); u.protocol = o.protocol; host = o.host; } catch { /* not an origin: the URL's own */ } }
+  host = host || request.headers.get('x-forwarded-host')?.split(',')[0].trim() || u.host;
+  u.host = host;
+  const headers = new Headers(request.headers);
+  headers.set('host', host);
+  // A GET or HEAD carries no body, and a Request refuses one (a signed read: private-read.mjs).
+  const bodiless = request.method === 'GET' || request.method === 'HEAD';
+  return new Request(u.href, { method: request.method, headers, ...(bodiless ? {} : { body: bytes }) });
+}
+
+// `origin` is the door's own, the one senders address (see asSigned).
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null } = {}) {
+  // The body, once, as the bytes the sender digested; the text of it is what
+  // is filed and hashed, as before.
+  let bytes, raw;
+  try { bytes = new Uint8Array(await request.clone().arrayBuffer()); raw = new TextDecoder().decode(bytes); }
+  catch { return { status: 400, reason: 'unreadable body' }; }
+  if (bytes.byteLength > maxBytes) return { status: 413, reason: 'too large' };
 
   let activity;
   try { activity = JSON.parse(raw); } catch { return { status: 400, reason: 'unparsable JSON' }; }
@@ -114,15 +136,25 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
 
   // The sender's key, kept between deliveries: a server pushing a hundred
   // items is asked for its key once (caches.mjs).
-  const v = await verifyHttpSignature(request, {
+  const v = await verifyHttpSignature(asSigned(request, bytes, origin), {
     documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
   });
-  // A present-but-invalid signature is a forgery — dropped here, so it never
-  // reaches the pod (today it would, drain, and die unapplied). An absent or
-  // unfetchable-key signature is NOT dropped: it forwards unverified and the
-  // drain's verify-by-dereference still stands behind it.
+  // A signature that does not verify is NOT dropped (it was, 2026-08-20 to
+  // 2026-09-28, and for a stretch of that every honest Mastodon delivery was
+  // dropped with it, silently, because of what the edge had done to the
+  // request). It forwards unverified, like an absent or unfetchable-key
+  // signature, and the drain's verify-by-dereference decides; the log says
+  // why it failed and what the request looked like, so the next such
+  // stretch is visible.
+  let failed = null;
   if (v.verified === false && v.reason === 'bad-signature') {
-    return { status: 202, reason: 'forged signature' };
+    const has = (h) => (request.headers.has(h) ? 'yes' : 'no');
+    const fwd = request.headers.get('x-forwarded-host');
+    // The sender's signature parameters — which components it signed, its
+    // key id and algorithm — without the signature value itself.
+    const params = request.headers.get('signature-input')
+      || (request.headers.get('signature') || '').replace(/signature="[^"]*"/u, 'signature="…"');
+    failed = `signature ${v.why} (${v.method}); host ${request.headers.get('host') || 'none'}${fwd ? ` forwarded-for ${fwd}` : ''}, date ${has('date')}, digest ${has('digest') === 'yes' || has('content-digest') === 'yes' ? 'yes' : 'no'}; ${params.slice(0, 300)}`;
   }
 
   // No per-user secret on record = no receipt: the delivery still filters and
@@ -137,8 +169,8 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified', content, bytes: Buffer.byteLength(raw),
-    type: activity.type, notifies: notifies(activity, ident), name: hash, raw, receipt };
+  return { status: 202, reason: v.verified ? 'verified' : failed ? `buffered-unverified: ${failed}` : 'buffered-unverified',
+    content, bytes: bytes.byteLength, type: activity.type, notifies: notifies(activity, ident), name: hash, raw, receipt };
 }
 
 // The outbox door: the owner's own post, taken on their behalf.

package/lib/gateway/held-mail.mjs

@@ -171,6 +171,13 @@ export async function routeKeeperApi(request, pathname, ctx, deps) {
   if (typeof body.forum === 'string' && /^[a-z0-9][a-z0-9._-]{0,60}$/u.test(body.forum)) next.forum = body.forum;
   await ctx.putDirectory(handle, next);
   console.log(`keeper @${handle}: ${on ? 'on' : 'off'}, at the owner's word`);
+  // A forum's own row turned on starts its first run now: the run makes the
+  // copies, mints the keys a new forum has none of, and publishes its actors,
+  // so there is a forum to read before anyone posts to it. Its categories'
+  // rows are turned on before it (setup.mjs in the forum package).
+  if (on && next.kind === 'application' && ctx.forum?.isForumRow(next) && ctx.startKeeper) {
+    await ctx.startKeeper(handle).catch((e) => console.log(`keeper @${handle}: not started (${e.message})`));
+  }
   return j(200, { ok: true, handle, kept: on, keeper: ctx.keeperWebId || null });
 }
 

package/lib/gateway/httpsig.mjs

@@ -49,14 +49,16 @@ export function makeSafeLoader({ getActors = null, fetchImpl = fetch } = {}) {
 export async function verifyHttpSignature(request, { documentLoader, keyCache, timeWindow } = {}) {
   const hadSig = request.headers.get('signature') != null;
   let result = null;
+  let threw = null;
   try {
     result = await verifyRequestDetailed(request, {
       documentLoader,
       ...(keyCache ? { keyCache } : {}),
       timeWindow: timeWindow ?? { hours: 1 },
     });
-  } catch {
+  } catch (e) {
     result = null;   // the library itself failed — no more informative than a bad signature
+    threw = e?.message || String(e);
   }
   // Which signature the sender used: RFC 9421 carries a Signature-Input
   // header beside Signature; the cavage draft carries Signature alone. The
@@ -83,9 +85,12 @@ export async function verifyHttpSignature(request, { documentLoader, keyCache, t
       reason: 'key-unfetchable', checks: { signature: false, keyFetched: false },
     };
   }
+  // `why` is for the log line, not the receipt: the library's own word for
+  // the failure, or that it threw.
   return {
     verified: false, method, keyId: null, actor: null,
     reason: 'bad-signature', checks: { signature: false },
+    why: threw ? `library threw: ${threw.split('\n')[0].slice(0, 120)}` : (kind || 'unknown'),
   };
 }
 

package/lib/gateway/private-read.mjs

@@ -0,0 +1,91 @@
+// private-read.mjs — a followers-only or direct post, read at its address by
+// a server it was sent to (ActivityPub §3.2). The read is signed the way a
+// delivery is; the signer is resolved; and the post is served only to an
+// actor in its audience: a follower for a post sent to followers, a named
+// recipient for a direct one. That is the rule Mastodon applies to its own
+// posts (StatusPolicy#show?). Anyone else learns nothing — 404, as for a
+// document that is not there, which §3.2 allows for a private target.
+//
+// At fedipod.net this works for an account it keeps: the post is read from
+// the pod with the keeper's credential, and the followers list from the
+// account's copy. An account it does not keep gives it nothing to read with,
+// so that read is sent on to the pod, as every private read was.
+
+import { verifyHttpSignature, makeSafeLoader } from './httpsig.mjs';
+import { asSigned } from './gateway-core.mjs';
+import { senderKeys } from './caches.mjs';
+import { keptNow } from './copy.mjs';
+
+const AP_CT = 'application/activity+json';
+const PUBLIC_NAMES = new Set(['https://www.w3.org/ns/activitystreams#Public', 'as:Public', 'Public']);
+const list = (v) => (v == null ? [] : Array.isArray(v) ? v : [v])
+  .map((x) => (typeof x === 'string' ? x : x?.id)).filter((x) => typeof x === 'string');
+
+/** Who a document was sent to: the actors named, and whether followers were. */
+export function audienceOf(doc, followersUrls = []) {
+  const o = doc?.type === 'Create' && doc.object && typeof doc.object === 'object' ? doc.object : doc;
+  const named = new Set(['to', 'cc', 'audience'].flatMap((k) => [...list(doc?.[k]), ...list(o?.[k])]));
+  return {
+    named,
+    isPublic: [...named].some((a) => PUBLIC_NAMES.has(a)),
+    toFollowers: followersUrls.some((f) => named.has(f)),
+  };
+}
+
+/** Whether `actor` may read `doc`: named in its audience, or a follower when it went to followers. */
+export function mayRead(doc, actor, { followersUrls = [], followers = [] } = {}) {
+  if (typeof actor !== 'string' || !actor) return false;
+  const a = audienceOf(doc, followersUrls);
+  if (a.isPublic || a.named.has(actor)) return true;
+  return a.toFollowers && followers.includes(actor);
+}
+
+/**
+ * The actor behind a signed read, or null with why. `origin` is the door's
+ * own (see asSigned in gateway-core.mjs); a GET has no body to digest.
+ */
+export async function signedReader(request, { fetchImpl = fetch, origin = null } = {}) {
+  if (!request.headers.get('signature')) return { actor: null, reason: 'no-signature' };
+  const v = await verifyHttpSignature(asSigned(request, new Uint8Array(0), origin), {
+    documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
+  });
+  return v.verified && typeof v.actor === 'string' ? { actor: v.actor, reason: null } : { actor: null, reason: v.reason };
+}
+
+// Refused reads are told nothing, and never held at the edge.
+const nothing = (open) => ({ status: 404, headers: { ...open, 'cache-control': 'no-store', vary: 'Signature' }, body: '' });
+
+/**
+ * A read under `ap/private/` at the front. Unsigned: sent on to the pod, which
+ * decides (the owner reads there with their own credential). Signed: answered
+ * here for a kept account, to a reader the post was sent to.
+ */
+export async function answerPrivateRead(ctx, rec, { request, handle, podTarget, base, open, swap }) {
+  if (!request.headers.get('signature')) {
+    return { status: 303, headers: { ...open, location: podTarget, 'cache-control': 'no-store' }, body: '' };
+  }
+  const say = (what) => console.log(`private read @${handle}: ${what}`);
+  if (!keptNow(ctx, rec) || typeof ctx.keeperFetch !== 'function' || !ctx.copyKv) { say('refused — account not kept here'); return nothing(open); }
+  const { actor, reason } = await signedReader(request, { fetchImpl: ctx.fetchImpl || fetch, origin: ctx.frontOrigin || null });
+  if (!actor) { say(`refused — ${reason}`); return nothing(open); }
+  const podFetch = await ctx.keeperFetch();
+  if (!podFetch) { say('refused — no keeper credential'); return nothing(open); }
+  let text = null;
+  try {
+    const res = await podFetch(podTarget, { headers: { accept: AP_CT } });
+    if (res.status === 200) text = await res.text();
+  } catch { /* unreachable: nothing to serve */ }
+  let doc = null;
+  try { doc = text ? JSON.parse(text) : null; } catch { doc = null; }
+  if (!doc) { say(`refused — the pod did not give it (${actor})`); return nothing(open); }
+  let followers = [];
+  try {
+    const got = await ctx.copyKv.get(`${handle}/contacts.json`);
+    followers = (JSON.parse(got?.text || '{}').followers || []).map((f) => f?.actor).filter(Boolean);
+  } catch { followers = []; }
+  const followersUrls = [rec.podHome + 'ap/followers', base + 'ap/followers'];
+  if (!mayRead(doc, actor, { followersUrls, followers })) { say(`refused — ${actor} is not in its audience`); return nothing(open); }
+  say(`served to ${actor}`);
+  return { status: 200, headers: { ...open, 'content-type': AP_CT, 'cache-control': 'no-store', vary: 'Signature' },
+    body: request.method === 'HEAD' ? '' : swap(text, rec.podHome, base) };
+}

package/lib/pod/urls.mjs

@@ -52,6 +52,9 @@ export function apUrls(remotePod, root, { publicBase = null } = {}) {
     // reads them there, with a credential the pod checks.
     ownOutbox: home + 'ap/private/outbox',
     liked: home + 'ap/private/liked',
+    // The inbox as its owner reads it (§5.2): what the account received,
+    // kept by the drain as a paged collection beside the archive.
+    ownInbox: home + 'ap/private/inbox',
     profileHtml: face + 'ap/profile.html',
     // Media stays on the pod even when fronted: attachment urls are not
     // identity-checked by remotes, and proxying blobs would be pure cost.