fedipod 1.44.0 → 1.47.0

package/README.md

@@ -5,8 +5,9 @@
 FediPod gives you a Fediverse account whose data lives on a Solid pod. You
 follow people on Mastodon, Bluesky, and other Fediverse or ATProto servers in
 one timeline. Your posts, followers and settings are kept on your pod. While fedipod.net
-keeps your account running, it works from a copy of them and writes it to your
-pod every fifteen minutes; your signing key never leaves your pod.
+keeps your account running, it works from a copy of them, and every fifteen
+minutes it writes that copy to your pod and deletes it; your signing key never
+leaves your pod.
 
 The easiest way to run FediPod is to use it in any browser at https://fedipod.net. Nothing to install. Sign-up points you to a pod provider if you need a pod, then attaches a Fediverse identity to the pod you sign in with.
 
@@ -109,14 +110,6 @@ there it takes over; the first drops back to reading.
 
 ## What the browser version does not do
 
-- **Scheduled posts, if you stop fedipod.net keeping your account running.**
-  It does by default, and publishes them while FediPod is closed. Turned off
-  on the manage page, nothing runs between now and the time you picked, so
-  the composer refuses one rather than dropping it later.
-- **Notifications, and other clients, if you stop fedipod.net keeping your
-  account running.** While it does (the default), any Mastodon app, phone or
-  desktop, can use your account with `fedipod.net` as its server, and an app
-  that offers notifications gets them on your phone with everything closed.
 - **Live updates.** The client refreshes by polling.
 - **Hosting a group.** Joining one works.
 
@@ -128,9 +121,11 @@ Everything you publish and everything you read is stored on your pod. Your
 signing key is stored there too, in a container only you can read through
 your pod's login.
 While fedipod.net keeps your account running, its own pod identity can read
-that container too, so it can act for you while FediPod is closed, and it
-works from a copy of your account's data that it writes back to your pod every
-fifteen minutes. Your key stays on your pod only.
+that container too, so it can act for you while FediPod is closed. It works
+from a copy of your account's data, and every fifteen minutes it writes that
+copy to your pod and deletes it, so none of your data stays at fedipod.net
+longer than that. The next time anything needs your account, the copy is made
+again from your pod. Your key stays on your pod only.
 It all lives in the `fedipod` container you chose at sign-up. Your pod's
 public type index records it, as an ActivityStreams actor, which is how
 FediPod and other Solid apps find your account again.

package/architecture.md

@@ -21,8 +21,11 @@ account's agent whenever FediPod is closed, under a pod identity of its own
 that the owner's rules name, reading the signing key from the pod when it
 needs it. The account's state documents live in a working copy at the
 gateway, which FediPod in the browser, the gateway and any Mastodon app all
-work from, and which the gateway writes to the pod every fifteen minutes. See
-[the gateway](gateway.md).
+work from. Every fifteen minutes the gateway writes the copy to the pod and
+deletes it, and makes it again from the pod when something next needs it (the
+hold). A gateway's admin may turn the hold off: then there is no copy, and
+everything works on the pod, the browser and the gateway taking turns by the
+pod's lease. See [the gateway](gateway.md).
 
 [FediPod Server](packages/fedipod-server/README.md) puts the agent inside a
 Community Solid Server, so anyone with a pod on that server can opt in to a

package/gateway.md

@@ -15,7 +15,10 @@ yours, which your agent then signs and sends. It still holds no key, but what yo
 trust it with grows by that much. A browser account is also kept running by
 the gateway (below). That gives the gateway your key while it works, so it can
 post as you, as any Fediverse server can, and your account's working data is
-kept at the gateway too and written to your pod every fifteen minutes.
+held at the gateway while it works, for at most fifteen minutes at a time. For
+a kept account the gateway also answers a follower's server asking for one
+of your followers-only posts, and the named person's server asking for a
+direct one, when that server signs its request; nobody else gets them.
 
 A FediPod install works without any gateway at all. Deliveries go straight to
 your pod inbox, which holds them whether your agent is running or not.
@@ -73,8 +76,9 @@ mode says how far you trust the door, and every step is reversible:
 - **locked** — your inbox accepts writes only from the gateway.
 
 In every mode past **off**, the door itself is already filtering: blocked
-actors, content that does not concern you, and forged signatures are dropped
-at the door and never reach the pod. The mode says only how far the agent
+actors and content that does not concern you are dropped at the door and
+never reach the pod; a delivery whose signature does not verify is passed on
+marked unverified, and the agent decides by fetching what it claims to be. The mode says only how far the agent
 believes the door's receipts.
 
 The shadow numbers come from the agent:
@@ -170,28 +174,57 @@ closed, fedipod.net does two things for it.
 your pod one by one, and reach your pod in batches of up to a hundred: when you
 open FediPod, or every fifteen minutes otherwise. While FediPod is open, mail
 goes straight to your pod as before. A DeviceAgent's mail always goes straight
-to its pod.
+to its pod. On a gateway whose admin has turned the hold off (below), mail
+always goes straight to your pod.
 
-**The gateway keeps your account running.** Unless you turn it off, the
-gateway accepts your follows, tries again what failed to go out, and publishes
-the posts you scheduled, all while FediPod is closed. Other mail waits on your
+**The gateway keeps your account running.** It accepts your follows, tries
+again what failed to go out, and publishes the posts you scheduled, all while FediPod is closed. Other mail waits on your
 pod for FediPod to open, as before. It works under its own pod identity, which your app
 names in the access rules on your FediPod folder. It reads your signing key
 from your pod when it needs it, so it can post as you, and keeps no copy of the
-key. **Stop keeping it running** on the manage page takes it out of the rules.
-If fedipod.net ever changes its own pod identity, your FediPod moves your
+key. If fedipod.net ever changes its own pod identity, your FediPod moves your
 account over the next time you open it, with nothing for you to do.
 Scheduling a post is offered only while this is on, because otherwise nothing
 would be running when the time came.
 
-**Your account's working data is kept at the gateway.** While the gateway
-keeps your account running, your timeline, notifications, followers, settings
-and the rest of your FediPod state are kept at fedipod.net, and FediPod in your
-browser, the gateway and any app you use all work from that one copy, so they
-never disagree. fedipod.net writes what changed to your pod every fifteen
-minutes, and everything at once when you stop it keeping your account running,
-move your address or close it. Your signing key and the passwords of accounts
-you connected elsewhere are never in the copy; they stay on your pod only.
+**Your account's working data is held at the gateway for at most fifteen
+minutes.** While the gateway keeps your account running, FediPod in your
+browser, the gateway and any app you use all work from one copy of your
+timeline, notifications, followers, settings and the rest of your FediPod
+state, made at fedipod.net from your pod, so they never disagree. Every
+fifteen minutes, whatever is happening, fedipod.net writes that copy to your
+pod and deletes it. The next time anything needs your account (FediPod, an
+app, or the gateway's own work while you're away), the copy is made again from
+your pod. You don't notice, except that an app's first check after a deletion
+can take a few seconds longer. When your address moves or is closed, the copy
+goes to your pod at once. Your signing key and the passwords of accounts you
+connected elsewhere are never in the copy; they stay on your pod only.
+
+## The hold, for a gateway's admin
+
+Whoever runs a gateway decides whether it holds copies of accounts at all,
+with one setting, `FEDIPOD_HOLD` ([netlify/README.md](netlify/README.md)).
+
+- **On**, the default and fedipod.net's choice: as above. Mail waits at the
+  gateway for up to fifteen minutes, and each account's copy is written to its
+  pod and deleted every fifteen minutes.
+- **Off**: the gateway keeps no copy of anyone's account and holds no mail.
+  Mail goes straight to the pod as it arrives, an app's every check reads the
+  pod, and FediPod in the browser works on the pod, taking turns with the
+  gateway when an app acts. None of anyone's mail, timeline or direct messages
+  is ever stored at the gateway. It costs more: roughly two to four times the
+  gateway's hosting per account, and about ten times the requests on each pod.
+  Apps are slower, and on a pod provider that limits traffic they can show
+  errors at busy times.
+
+A change takes effect within fifteen minutes. Off to on: an account's copy is
+made the next time anything uses it. On to off: every copy is written to its
+pod and deleted, at the next round, or by FediPod itself within five minutes
+where it is open, so nothing it is writing is lost.
+
+Either way the gateway keeps app sign-ins (as fingerprints), phone-notification
+sign-ups, each account's record (with its door secret), the time an account's
+next scheduled post is due, and public copies of posts for up to an hour.
 
 ## Using any Mastodon app
 
@@ -200,7 +233,8 @@ elk.zone, Ivory, Tusky, Phanpy and the rest. In the app, give `fedipod.net` as
 your server. The app sends you to a fedipod.net page that asks for your
 Fediverse address or your WebID and signs you in at your own pod; no password
 is typed on fedipod.net. The app then reads your timeline and notifications from your
-account's copy at the gateway, and posts, boosts, likes and follows as you.
+account's copy at the gateway (from your pod, on a gateway with the hold off),
+and posts, boosts, likes and follows as you.
 
 An app checks for new posts every minute or so while it is open; there are no
 live updates. Accounts are made on the fedipod.net front page, with a pod, not
@@ -222,13 +256,11 @@ about each browser account — when its owner last signed in or posted, and
 how much content has arrived since — and acts on them.
 
 **Paused.** After about 5,000 posts, replies, likes, boosts and edits since
-you were last here, or when you say so on the manage page, the door accepts
-content and discards it. Follows, unfollows, account moves, deletions and
-blocks still reach your pod. Signing in ends an automatic pause by itself; a
-pause you set lasts until you lift it.
+you were last here, the door accepts content and discards it. Follows,
+unfollows, account moves, deletions and blocks still reach your pod. Signing
+in ends the pause.
 
-**Closed.** After six months without a sign-in, or when you say so on the
-manage page, the address is closed for good: its handle, its actor and its
+**Closed.** After six months without a sign-in, the address is closed for good: its handle, its actor and its
 door answer 410 Gone, other servers drop the account the next time they look,
 and nobody can take the name. Nothing on your pod is touched. An address that
 had already moved to another gateway keeps answering as moved.

package/gui.md

@@ -97,8 +97,9 @@ is marked **sign in again** rather than quietly dropped.
 
 ## Handling follow requests
 
-New followers appear under **Follow requests** with **Accept** and **Refuse**
-beside them; nothing is accepted without you.
+New followers are accepted automatically. Set **new followers** to *wait for
+approval* and they appear under **Follow requests** instead, with **Accept**
+and **Refuse** beside them; nothing is accepted without you.
 They show in any Mastodon client as well, now that the client API serves the
 queue and takes both answers.
 Groups are different — joining

package/lib/client/c2s.mjs

@@ -32,11 +32,6 @@ import * as podNotes from '../pod/notes.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
-// How many archived items one page of the inbox will read. A page is one
-// month, and a month with more than this is served short rather than costing
-// the pod an unbounded read; the log says when that happened.
-const MAX_INBOX_PAGE = 500;
-
 // How many recorded activities one page of the locally-served outbox carries.
 const MAX_OUTBOX_PAGE = 50;
 
@@ -99,82 +94,35 @@ export class C2S {
     return iri ? this.store.getStatuses().find((s) => s.noteId === iri) : null;
   }
 
-  /** The months the archive holds, newest first. One container listing. */
-  async archiveMonths() {
-    const archive = this.agent.intake?.archive;
-    if (!archive) return [];
-    const { names } = await archive.list('');
-    return (names || [])
-      .map((n) => n.replace(/\/$/u, ''))
-      .filter((n) => /^\d{4}-\d{2}$/u.test(n))
-      .sort()
-      .reverse();
-  }
-
   /**
-   * The owner's own inbox, §5.2. Paged by month because that is how the
-   * archive is stored, so a page costs one listing and a read per item and no
-   * page is dearer for another month being large.
+   * The owner's own inbox, §5.2: the collection the drain keeps on the pod in
+   * the private container (intake/received.mjs), served under this agent's
+   * address so a client holding no pod credential of its own can read it.
+   * Nothing is built per request; a page is the pod's page.
    */
-  async sendInbox(res, url) {
-    const id = `${this.urls.base}ap/inbox`;
+  async sendInbox(res, url, origin) {
+    const id = `${origin}ap/inbox`;   // named for the client that asked, as the outbox is
+    const own = this.urls.ownInbox;
     const page = url?.searchParams?.get('page') || null;
-    let months;
+    if (page !== null && !/^[1-9]\d{0,6}$/u.test(page)) return this.send(res, 400, { error: 'page is a number' });
+    let doc;
     try {
-      months = await this.archiveMonths();
+      doc = await this.agent.remote.getJson(page ? `${own}-${page}` : own);
     } catch (e) {
-      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
+      return this.send(res, 502, { error: `the inbox collection could not be read: ${e.message}` });
     }
-
-    if (!page) {
-      if (!months.length && this.store.getConfig()?.archiveInbox === false) {
+    if (!doc) {
+      if (page) return this.send(res, 404, { error: 'no such page' });
+      if (this.store.getConfig()?.archiveInbox === false) {
         this.log('inbox read: nothing to show — this identity does not keep what it receives');
       }
-      return this.send(res, 200, {
-        '@context': wire.AS_CTX, id, type: 'OrderedCollection',
-        ...(months.length ? { first: `${id}?page=${months[0]}` } : { orderedItems: [] }),
-      });
-    }
-    if (!/^\d{4}-\d{2}$/u.test(page)) {
-      return this.send(res, 400, { error: 'page names a month, written 2026-09' });
-    }
-
-    const archive = this.agent.intake?.archive;
-    let names = [];
-    try {
-      // The trailing slash matters: without it this names a document, not the
-      // container, and a pod answers about the wrong thing.
-      ({ names } = await archive.list(`${page}/`));
-    } catch (e) {
-      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
-    }
-    const files = (names || []).filter((n) => n.endsWith('.json')).sort();
-    if (files.length > MAX_INBOX_PAGE) {
-      this.log(`inbox read: ${page} holds ${files.length} items; serving the first ${MAX_INBOX_PAGE}`);
+      return this.send(res, 200, { '@context': wire.AS_CTX, id, type: 'OrderedCollection', totalItems: 0, orderedItems: [] });
     }
-    const kept = [];
-    for (const file of files.slice(0, MAX_INBOX_PAGE)) {
-      // Read as written: these records are JSON-LD, and the default read asks
-      // turtle-first, which a server is free to answer with turtle.
-      const read = await archive.read(`${page}/${file}`, { accept: '*/*' });
-      if (!read?.ok || !read.body) continue;
-      try {
-        const record = JSON.parse(read.body);
-        // The record wraps the bytes as they arrived; the activity is those
-        // bytes, not a retelling of them.
-        kept.push({ at: record.receivedAt || '', activity: JSON.parse(record.raw) });
-      } catch { /* a record that will not parse is not one that can be served */ }
-    }
-    kept.sort((a, b) => String(b.at).localeCompare(String(a.at)));
-    const older = months.filter((m) => m < page)[0] || null;
-    return this.send(res, 200, {
-      '@context': wire.AS_CTX,
-      id: `${id}?page=${page}`,
-      type: 'OrderedCollectionPage',
-      partOf: id,
-      ...(older ? { next: `${id}?page=${older}` } : {}),
-      orderedItems: kept.map((k) => k.activity),
-    });
+    // The pod's names become this agent's: the head is `id`, page n is `id?page=n`.
+    const here = (v) => (typeof v === 'string' && v.startsWith(own)
+      ? (v === own ? id : v.replace(`${own}-`, `${id}?page=`)) : v);
+    for (const k of ['id', 'partOf', 'first', 'last', 'next', 'prev']) if (k in doc) doc[k] = here(doc[k]);
+    return this.send(res, 200, doc);
   }
 
   // The actor a client-to-server client on this machine reads. The same
@@ -277,7 +225,7 @@ export class C2S {
       }
       const reader = await this.auth(req, pathname);
       if (!reader.ok) return this.send(res, reader.status, { error: reader.error }, reader.headers || {});
-      return this.sendInbox(res, url);
+      return this.sendInbox(res, url, this.localOrigin(req) || this.urls.base);
     }
     if (req.method === 'GET' || req.method === 'HEAD') {
       // The owner, signed in, reads every message the actor produced (§5.1:
@@ -312,7 +260,8 @@ export class C2S {
     // A viewer (another agent holds the lease) may not act — but the user
     // acting HERE outranks an idle active agent elsewhere, exactly as on the
     // facade: a write attempt claims the lease, and only a failed claim 503s.
-    if (this.agent.viewer) {
+    // So does an agent whose state its gateway acts on too (sharesState).
+    if (this.agent.viewer || this.agent.sharesState) {
       const took = await this.agent.requestTakeover?.();
       if (!took) return this.send(res, 503, { error: 'another agent is active for this pod — takeover failed, try again' });
     }

package/lib/client/masto/index.mjs

@@ -149,10 +149,11 @@ export class MastoApi {
     // A viewer-mode agent (another agent holds the drain lease) may not act —
     // but a user acting HERE outranks the idle active agent elsewhere, so a
     // write attempt claims the lease and proceeds. Only a failed claim 503s.
-    // An agent working from a copy its gateway shares (the browser build,
-    // web/app/copy-mode.mjs) asks every time, since an app at the gateway may
-    // have taken the lease without it hearing yet.
-    if ((this.agent.viewer || this.agent.copy) && req.method !== 'GET' && req.method !== 'HEAD') {
+    // An agent whose state its gateway acts on too — its copy there, or with
+    // the gateway's hold off, its pod (the browser build, web/app/copy-mode.mjs)
+    // — asks every time, since an app at the gateway may have taken the lease
+    // without it hearing yet.
+    if ((this.agent.viewer || this.agent.sharesState) && req.method !== 'GET' && req.method !== 'HEAD') {
       const took = await this.agent.requestTakeover?.();
       if (!took) return send(503, { error: 'another agent is active for this pod — takeover failed, try again' });
     }

package/lib/client/masto/render.mjs

@@ -4,6 +4,7 @@
 // the three actions that answer as a connected account rather than the pod
 // actor (a Bluesky reply, a connected-account reply, a like or boost there).
 
+import { totalsFor } from '../../core/intake/counts.mjs';
 import * as social from '../../core/social.mjs';
 import { sanitizeHtml, followsNeedApproval, publicHandle } from '../../core/wire.mjs';
 import { profileUrl, postUrl } from '../../connections/bskyfeed.mjs';
@@ -265,6 +266,8 @@ export function quoteApproval(api, s) {
 
 export function status(api, s, { all, depth = 0 } = {}) {
   const replies = (all || api.store.getStatuses()).filter(x => x.inReplyTo === s.noteId).length;
+  // The owner's own posts: what others did to them. Zero for anyone else's.
+  const counted = totalsFor(api.store, s.noteId);
   return {
     id: api.store.idFor(s.noteId),
     created_at: s.published || new Date().toISOString(),
@@ -274,7 +277,7 @@ export function status(api, s, { all, depth = 0 } = {}) {
     visibility: s.visibility || 'public', language: null,
     edited_at: s.editedAt || null,
     uri: s.noteId, url: s.link || s.noteId,
-    replies_count: replies, reblogs_count: 0, favourites_count: 0,
+    replies_count: replies, reblogs_count: counted.shares, favourites_count: counted.likes,
     // True when ANY of the owner's accounts holds it. The flag is really
     // what the next tap will do: an empty star on a post one account has
     // already liked invites a second outward like from a second identity.

package/lib/core/intake/activities.mjs

@@ -2,6 +2,7 @@
 // from Intake.handle() after the sender passed the door checks, and returns a
 // rejection reason or nothing.
 
+import { withdrawReaction } from './counts.mjs';
 import { dropFollower } from '../store.mjs';
 import { emojisOf, pollOf, isContentType, trimActivity, reactionOf, quoteOf, quotePolicyOf, authorOf } from './activity.mjs';
 
@@ -40,20 +41,17 @@ export async function onFollow(intake, activity, actor, { trusted = false } = {}
   // anyone at all, and we would sign an Accept, deliver it to that person,
   // and send them everything published from then on.
   //
-  // Until deliveries terminate somewhere their signature survives, a follow
-  // we cannot verify is a REQUEST, waiting in the same queue a gated group
-  // uses. The requester's client shows "Requested", which is the ordinary
-  // locked-account state that manuallyApprovesFollowers tells it to expect.
-  // `autoAcceptFollows: true` in config restores the old behaviour.
-  // A GROUP is left alone: `approveJoins: false` is its operator saying, in
-  // as many words, that anyone may join, and mute/eject are the remedy there.
-  // A person has no such setting, so this is their default.
+  // A person who set `autoAcceptFollows: false` sees such a follow as a
+  // REQUEST, waiting in the same queue a gated group uses; the requester's
+  // client shows "Requested", the locked-account state manuallyApprovesFollowers
+  // tells it to expect. Otherwise it is accepted, as a group's is:
+  // `approveJoins: false` is its operator saying anyone may join.
   //
   // A gateway-verified Follow (trust mode) is no longer unverifiable — the
   // door proved the sender — so it does not need the OK that unverifiability
   // alone demanded. An explicit `approveJoins` still holds: verified or not,
   // the operator asked to see joins.
-  const unverifiedNeedsOk = intake.config.kind !== 'group' && !intake.config.autoAcceptFollows && !trusted;
+  const unverifiedNeedsOk = intake.config.kind !== 'group' && intake.config.autoAcceptFollows === false && !trusted;
   const mustApprove = intake.config.approveJoins || unverifiedNeedsOk;
   if (mustApprove && !existing) {
     const reqs = intake.store.getRequests();
@@ -319,6 +317,7 @@ export async function onUndoReaction(intake, inner, actor, { trusted = false } =
     const type = inner.type === 'Like' ? 'favourite' : 'reblog';
     const gone = intake.store.removeNotifications(n => n.type === type && n.actor === actor && n.noteId === objectId);
     if (gone) intake.log(`${inner.type} withdrawn by ${actor} on ${objectId}`);
+    withdrawReaction(intake.store, inner.type, objectId, actor);
     return;
   }
   if (inner.type !== 'Announce') return;

package/lib/core/intake/counts.mjs

@@ -0,0 +1,143 @@
+// counts.mjs — how many liked and boosted each of the owner's posts, and the
+// totals on the post itself (ActivityPub §5.7, §5.8), so a server showing the
+// post shows its real numbers instead of none.
+//
+// Who liked is kept here, in state, only to tell a repeat from a new one and
+// to take back the right one on an Undo; the post says the total and names
+// nobody. Past MAX_NAMED on one post the total still grows, but a repeat by
+// someone past the cap can no longer be told apart.
+//
+// The first sweep that finds no totals kept starts them from the account's
+// notifications, which hold its recent likes and boosts; older ones are gone.
+//
+// The post is rewritten once per sweep for every post whose totals changed,
+// and only over the version it was read at: an edit or a deletion made in
+// between wins, and the totals are written on a later sweep. The posts left
+// to rewrite are kept in state, so a restart does not lose them.
+
+import * as podNotes from '../../pod/notes.mjs';
+import * as wire from '../wire.mjs';
+
+export const MAX_NAMED = 1000;
+export const MAX_POSTS = 2000;
+export const REWRITES_PER_SWEEP = 20;
+const COUNTS = 'counts.json';
+const KIND = { Like: 'likes', Announce: 'shares' };
+const MORE = { likes: 'moreLikes', shares: 'moreShares' };
+
+const load = (store) => {
+  const st = typeof store?.read === 'function' ? store.read(COUNTS, null) : null;
+  return st && typeof st === 'object' && st.posts && typeof st.posts === 'object'
+    ? { posts: st.posts, dirty: Array.isArray(st.dirty) ? st.dirty : [] }
+    : { posts: {}, dirty: [] };
+};
+
+const totals = (p) => ({
+  likes: (p?.likes?.length || 0) + (p?.moreLikes || 0),
+  shares: (p?.shares?.length || 0) + (p?.moreShares || 0),
+});
+
+/** The totals for one post. Zero for a post nobody liked or boosted. */
+export function totalsFor(store, noteId) {
+  // Read without a copy: the Mastodon API asks this for every post it lists.
+  const st = store?.cache?.get?.(COUNTS) ?? store?.read?.(COUNTS, null);
+  return totals(st?.posts?.[noteId]);
+}
+
+function save(store, st, noteId) {
+  if (typeof store?.write !== 'function') return;
+  if (noteId && !st.dirty.includes(noteId)) st.dirty.push(noteId);
+  const ids = Object.keys(st.posts);
+  if (ids.length > MAX_POSTS) {
+    // The posts touched longest ago go first.
+    ids.sort((a, b) => String(st.posts[a].at || '').localeCompare(String(st.posts[b].at || '')));
+    for (const id of ids.slice(0, ids.length - MAX_POSTS)) delete st.posts[id];
+    st.dirty = st.dirty.filter(id => st.posts[id]);
+  }
+  store.write(COUNTS, st);
+}
+
+/** A Like or an Announce of one of the owner's posts. True when a total changed. */
+export function recordReaction(store, type, noteId, actor) {
+  const kind = KIND[type];
+  if (!kind || !noteId || !actor) return false;
+  const st = load(store);
+  const p = st.posts[noteId] || { likes: [], shares: [] };
+  const named = p[kind] || [];
+  if (named.includes(actor)) return false;
+  if (named.length >= MAX_NAMED) p[MORE[kind]] = (p[MORE[kind]] || 0) + 1;
+  else p[kind] = [...named, actor];
+  p.at = new Date().toISOString();
+  st.posts[noteId] = p;
+  save(store, st, noteId);
+  return true;
+}
+
+/** An Undo of one. True when a total changed. */
+export function withdrawReaction(store, type, noteId, actor) {
+  const kind = KIND[type];
+  if (!kind || !noteId || !actor) return false;
+  const st = load(store);
+  const p = st.posts[noteId];
+  if (!p) return false;
+  const named = p[kind] || [];
+  if (named.includes(actor)) p[kind] = named.filter(a => a !== actor);
+  else if (p[MORE[kind]] > 0) p[MORE[kind]] -= 1;
+  else return false;
+  p.at = new Date().toISOString();
+  save(store, st, noteId);
+  return true;
+}
+
+/** A deleted post keeps no totals. */
+export function forgetCounts(store, noteId) {
+  const st = load(store);
+  if (!st.posts[noteId] && !st.dirty.includes(noteId)) return;
+  delete st.posts[noteId];
+  st.dirty = st.dirty.filter(id => id !== noteId);
+  save(store, st, null);
+}
+
+// Totals from before they were kept: the likes and boosts still in the
+// notifications. Runs once, the first time there are no totals at all.
+function seed(intake) {
+  const { store } = intake;
+  if (typeof store?.read !== 'function' || store.read(COUNTS, null)) return;
+  const notes = intake.urls?.notes;
+  const all = typeof store.getNotifications === 'function' ? store.getNotifications() : [];
+  for (const n of [...all].reverse()) {                    // oldest first, as they arrived
+    if (!notes || !String(n?.noteId || '').startsWith(notes)) continue;
+    if (n.type === 'favourite') recordReaction(store, 'Like', n.noteId, n.actor);
+    else if (n.type === 'reblog') recordReaction(store, 'Announce', n.noteId, n.actor);
+  }
+  if (!store.read(COUNTS, null)) store.write(COUNTS, { posts: {}, dirty: [] });
+}
+
+/**
+ * Write the changed totals onto the posts. Returns how many posts were
+ * rewritten. A post the pod no longer has, or has as a Tombstone, is dropped.
+ */
+export async function publishCounts(intake) {
+  seed(intake);
+  const st = load(intake.store);
+  if (!st.dirty.length) return 0;
+  const left = [];
+  let wrote = 0;
+  for (const noteId of st.dirty.slice(0, REWRITES_PER_SWEEP)) {
+    try {
+      const { doc, version } = await podNotes.readVersioned(intake.remote, noteId);
+      if (!doc || typeof doc !== 'object' || !doc.id || doc.type === 'Tombstone') { delete st.posts[noteId]; continue; }
+      const t = totals(st.posts[noteId]);
+      const next = { ...doc, ...wire.reactionCounts(t.likes, t.shares) };
+      if (JSON.stringify([next.likes, next.shares]) === JSON.stringify([doc.likes, doc.shares])) continue;
+      if (await podNotes.writeIfUnchanged(intake.remote, doc.id, next, version)) wrote++;
+      else left.push(noteId);            // changed under us: the next sweep reads it again
+    } catch (e) {
+      intake.log?.(`like and boost totals for ${noteId}: ${e.message}`);
+      left.push(noteId);
+    }
+  }
+  st.dirty = [...left, ...st.dirty.slice(REWRITES_PER_SWEEP)].filter(id => st.posts[id]);
+  intake.store.write(COUNTS, st);
+  return wrote;
+}

package/lib/core/intake/index.mjs

@@ -28,6 +28,8 @@ import { trimActivity, sameIdentity, sameOrigin, httpUrl, reactionOf, MAX_EMOJIS
 import * as channel from './channel.mjs';
 import * as verify from './verify.mjs';
 import * as group from './group.mjs';
+import * as received from './received.mjs';
+import * as counts from './counts.mjs';
 import * as activities from './activities.mjs';
 import * as notes from './notes.mjs';
 import { readLenient } from '../as2.mjs';
@@ -187,6 +189,8 @@ export class Intake {
     this._draining = this._drainOnce().finally(async () => {
       this._inSweep = false;
       await this._publishPending();
+      // Likes and boosts this sweep took, onto the posts: one write per post.
+      await counts.publishCounts(this).catch((e) => this.log(`like and boost totals: ${e.message}`));
       this.store.release?.();
       this._draining = null;
       if (this._drainAgain) {
@@ -489,6 +493,9 @@ export class Intake {
       if (pending.length >= DELETE_BATCH && !await flush()) return;
     }
     if (!await this._finishSweep(flush)) return;
+    // What this sweep accepted, onto the pod as the owner's inbox collection:
+    // one page write and the head per sweep with mail, never per item.
+    await received.publishReceived(this).catch((e) => this.log(`inbox collection: ${e.message}`));
     // Receipts earlier drains left behind, a few per sweep until none remain.
     for (const stray of podInbox.orphanReceipts(this.remote, this.urls).slice(0, ORPHAN_RECEIPTS_PER_SWEEP)) {
       if (!await podInbox.dropStrayReceipt(this.remote, stray)) break;
@@ -532,7 +539,10 @@ export class Intake {
     const rejection = !activity ? 'unparsable JSON'
       : owned ? await this.ownerPostFrom(activity, raw, receipt)
         : await this.handle(activity, receipt);
-    if (!rejection && raw && !owned) await this._archive(url, raw, activity);
+    if (!rejection && raw && !owned) {
+      await this._archive(url, raw, activity);
+      received.recordReceived(this, activity);   // §5.2: the owner's readable inbox
+    }
     if (!rejection && !owned) await this._maybeForward(activity);    // §7.1.2, only what we accepted
     if (rejection) {
       this.store.addDeadLetter({
@@ -760,6 +770,7 @@ export class Intake {
             type: activity.type === 'Like' ? 'favourite' : 'reblog', actor, noteId: objectId,
             ...(this.known(actor) ? {} : { unverified: true }),
           });
+          counts.recordReaction(this.store, activity.type, objectId, actor);   // §5.7, §5.8
           return;
         }
         if (activity.type === 'Announce') return this.onAnnounce(activity, actor, objectId);