fedipod 1.44.0 → 1.47.0

package/lib/core/intake/received.mjs

@@ -0,0 +1,78 @@
+// received.mjs — the inbox as its owner reads it (ActivityPub §5.2): every
+// delivery the account accepted, kept on the pod as a paged OrderedCollection
+// in the private container, beside the archive that keeps each delivery's
+// bytes. The door and the agent's own /ap/inbox serve these documents.
+//
+// Pages fill from the oldest end, PAGE_SIZE to a page, and a full page is
+// never written again: an accepted delivery rewrites the newest page and the
+// small head, and nothing else. Activities ride inline, so a reader gets what
+// arrived without a fetch per item — a Like or a Follow has no address its
+// origin answers anyway. Past ITEM_MAX_CHARS the item is the activity's id
+// alone, so one enormous delivery cannot make a page of them enormous.
+//
+// §5.2 also says an activity delivered twice is listed once. The archive
+// already collapses identical bytes; this keeps the last SEEN_MAX ids and
+// drops a repeat that arrived with different addressing.
+//
+// Written only while the archive is on — an owner who chose not to keep what
+// arrives keeps nothing here either — and only once the private container is
+// proved private, the bar every owner-only document clears. Recorded meanwhile,
+// and published the first time the bar is met.
+
+import * as wire from '../wire.mjs';
+import * as collection from '../../pod/collection.mjs';
+
+export const PAGE_SIZE = wire.FOLLOWERS_PAGE_SIZE;
+export const SEEN_MAX = 500;
+export const ITEM_MAX_CHARS = 32 * 1024;
+// Recorded but unpublished items are held in state; past this many the oldest
+// are let go (the archive still has them) rather than growing state forever.
+const HELD_MAX = PAGE_SIZE * 5;
+const RECEIVED = 'received.json';
+
+const fresh = () => ({ sealed: 0, open: [], total: 0, seen: [] });
+
+const keeps = (intake) => !!intake.archive && !!intake.urls?.ownInbox
+  && intake.store.getConfig?.()?.archiveInbox !== false;
+
+/** Record one accepted delivery. False when it was a repeat, or nothing is kept. */
+export function recordReceived(intake, activity) {
+  if (!keeps(intake) || !activity || typeof activity !== 'object') return false;
+  const st = { ...fresh(), ...intake.store.read(RECEIVED, {}) };
+  const id = typeof activity.id === 'string' ? activity.id : null;
+  if (id && st.seen.includes(id)) return false;
+  st.open.push(id && JSON.stringify(activity).length > ITEM_MAX_CHARS ? id : activity);
+  if (st.open.length > HELD_MAX) st.open.splice(0, st.open.length - HELD_MAX);
+  st.total += 1;
+  if (id) {
+    st.seen.push(id);
+    if (st.seen.length > SEEN_MAX) st.seen.splice(0, st.seen.length - SEEN_MAX);
+  }
+  intake.store.write(RECEIVED, st);
+  intake._receivedDirty = true;
+  return true;
+}
+
+/** Write what was recorded since the last publish: the newest page(s) and the head. */
+export async function publishReceived(intake) {
+  if (!intake._receivedDirty || !keeps(intake)) return;
+  const ready = intake.publisher?.privateReady;
+  if (typeof ready === 'function' && await ready.call(intake.publisher) !== true) return;
+  const { remote, urls } = intake;
+  const st = { ...fresh(), ...intake.store.read(RECEIVED, {}) };
+  // Every full page first (several when the bar was met late), then the open one.
+  do {
+    const n = st.sealed + 1;
+    const items = st.open.slice(0, PAGE_SIZE);
+    await collection.writePage(remote, wire.followersPageId(urls.ownInbox, n),
+      wire.followersPage(urls.ownInbox, n, items, n));
+    if (items.length < PAGE_SIZE) break;
+    st.sealed = n;
+    st.open = st.open.slice(PAGE_SIZE);
+    intake.store.write(RECEIVED, st);
+  } while (st.open.length);
+  const pages = Math.max(1, st.sealed + (st.open.length ? 1 : 0));
+  await collection.writeHead(remote, urls.ownInbox, wire.followersHead(urls.ownInbox, st.total, pages));
+  intake.store.write(RECEIVED, st);
+  intake._receivedDirty = false;
+}

package/lib/core/publisher/notes.mjs

@@ -7,6 +7,7 @@ import * as wire from '../wire.mjs';
 import * as wireQuotes from '../wire-quotes.mjs';
 import * as containers from '../../pod/containers.mjs';
 import * as podNotes from '../../pod/notes.mjs';
+import { totalsFor } from '../intake/counts.mjs';
 
 // Media container on the remote pod — public-Read like notes, created lazily
 // at first upload (idempotent; the flag only saves round-trips).
@@ -177,7 +178,7 @@ export async function noteToSelf(publisher, text) {
 // What the object is, who made it and when, where it lives and who it is
 // addressed to stay as they are, and so do a poll's choices and its count.
 const FIXED = new Set(['@context', 'id', 'type', 'attributedTo', 'published', 'to', 'cc', 'bto', 'bcc',
-  'audience', 'oneOf', 'anyOf', 'endTime', 'closed', 'votersCount', 'replies']);
+  'audience', 'oneOf', 'anyOf', 'endTime', 'closed', 'votersCount', 'replies', 'likes', 'shares']);
 export async function updateObject(publisher, s, patch, { updated = new Date().toISOString() } = {}) {
   const { urls } = publisher;
   const doc = await podNotes.read(publisher.remote, s.noteId);
@@ -485,6 +486,7 @@ export async function updateNote(publisher, s, { content, spoilerText = null, se
     summary: spoilerText, sensitive: sensitive ?? !!s.sensitive, updated, container,
     also: [...new Set([...(s.named || []), ...(reply ? [reply.actor] : [])])],
     quote: rowQuote(s),
+    ...totalsFor(publisher.store, s.noteId),
   });
   await podNotes.write(publisher.remote, note.id, note);
   await podNotes.writeCreate(publisher.remote, wire.createActivityId(note.id), wire.createActivity(note, urls));
@@ -537,6 +539,7 @@ async function restateNote(publisher, s, { quote }) {
     summary: s.spoiler || null, sensitive: !!s.sensitive, updated: s.editedAt || null, container,
     also: [...(reply ? [reply.actor] : []), ...(s.quoteRequest?.actor ? [s.quoteRequest.actor] : [])],
     quote,
+    ...totalsFor(publisher.store, s.noteId),
   });
   await podNotes.write(publisher.remote, note.id, note);
   await podNotes.writeCreate(publisher.remote, wire.createActivityId(note.id), wire.createActivity(note, urls));

package/lib/core/social.mjs

@@ -3,6 +3,7 @@
 // the activity and mirrors state into the store; the store keeps the
 // activity a later Undo must name.
 
+import { forgetCounts } from './intake/counts.mjs';
 import crypto from 'node:crypto';
 import * as wire from './wire.mjs';
 import * as podNotes from '../pod/notes.mjs';
@@ -424,6 +425,7 @@ export async function deleteNote(agent, s) {
   }
   // Empty, and referenced by nothing once the note is gone.
   await podNotes.dropReplies(agent.remote, wire.repliesId(s.noteId));
+  forgetCounts(agent.store, s.noteId);
 
   // The Bluesky mirror goes with the post. Best-effort: a mirror the far side
   // already lost is not a reason to keep the post here.

package/lib/core/storage.mjs

@@ -177,21 +177,31 @@ export { podOnly };
  * An account's state kept at its gateway, reached through the gateway's state
  * API (lib/gateway/state-api.mjs) with the token it handed out. `holder` is
  * this agent's lease id: the gateway takes a write only from the lease's
- * holder, and `onRefused` hears when it would not. What stays on the pod is
- * read and written on `pod`.
+ * holder, and `onRefused` hears when it would not. `onGone` hears when the
+ * gateway keeps no copy of the account any more and will make none. What
+ * stays on the pod is read and written on `pod`.
  */
 export class StateApiStorage {
-  constructor(base, { fetchImpl = globalThis.fetch, token, holder, pod = null, onRefused = null }) {
+  constructor(base, { fetchImpl = globalThis.fetch, token, holder, pod = null, onRefused = null, onGone = null }) {
     this.base = slash(base);
     this.fetchImpl = fetchImpl;
     this.token = token;
     this.holder = holder;
     this.pod = pod;
     this.onRefused = onRefused;
+    this.onGone = onGone;
   }
 
   get kind() { return 'copy'; }
 
+  async _gone(res) {
+    if (res.status !== 404 || !this.onGone) return false;
+    const said = await res.clone().json().catch(() => null);
+    if (!said?.gone) return false;
+    this.onGone();
+    return true;
+  }
+
   _ask(p, init = {}) {
     return this.fetchImpl(this.base + encodeURIComponent(p), {
       ...init, headers: { authorization: `Bearer ${this.token}`, ...(init.headers || {}) },
@@ -202,7 +212,7 @@ export class StateApiStorage {
     if (sub) return { notModified: false, names: [], etag: null };
     const res = await this._ask('', { headers: etag ? { 'if-none-match': etag } : {} });
     if (res.status === 304) return { notModified: true, names: null, etag };
-    if (res.status >= 400) throw new Error(`the account's copy at the gateway is unreadable (HTTP ${res.status})`);
+    if (res.status >= 400) { await this._gone(res); throw new Error(`the account's copy at the gateway is unreadable (HTTP ${res.status})`); }
     const { names } = await res.json();
     return { notModified: false, names, etag: res.headers.get('etag') };
   }
@@ -211,7 +221,7 @@ export class StateApiStorage {
     if (podOnly(p)) return this.pod ? this.pod.read(p, opts) : { ok: false, notModified: false, status: 404, body: null, etag: null };
     const res = await this._ask(p, { headers: opts.etag ? { 'if-none-match': opts.etag } : {} });
     if (res.status === 304) return { ok: true, notModified: true, status: 304, body: null, etag: opts.etag };
-    if (res.status >= 400) return { ok: false, notModified: false, status: res.status, body: null, etag: null };
+    if (res.status >= 400) { await this._gone(res); return { ok: false, notModified: false, status: res.status, body: null, etag: null }; }
     return { ok: true, notModified: false, status: res.status, body: await res.text(), etag: res.headers.get('etag') };
   }
 
@@ -221,6 +231,7 @@ export class StateApiStorage {
       const res = await this._ask(p, { method: 'PUT', headers: { 'content-type': contentType, 'x-fedipod-holder': this.holder }, body });
       if (res.status < 400) return { ok: true, retry: false, why: '' };
       if (res.status === 409) { this.onRefused?.(); return { ok: false, retry: false, why: 'another agent holds this account now', lost: true }; }
+      if (await this._gone(res)) return { ok: false, retry: false, why: 'the gateway keeps no copy of this account now', lost: true };
       return { ok: false, retry: res.status >= 500 || res.status === 429, why: `HTTP ${res.status}`, retryAfterMs: 0 };
     } catch (e) {
       return { ok: false, retry: true, why: e.message, retryAfterMs: 0 };
@@ -232,11 +243,49 @@ export class StateApiStorage {
     try {
       const res = await this._ask(p, { method: 'DELETE', headers: { 'x-fedipod-holder': this.holder } });
       if (res.status === 409) { this.onRefused?.(); return false; }
+      if (await this._gone(res)) return false;
       return res.status < 400 || res.status === 404;
     } catch { return false; }
   }
 }
 
+/**
+ * A pod's state container that more than one agent may act on: the owner's
+ * browser, and the gateway acting for an app while the hold is off. With a
+ * `fence` set, every write first asks it whether this agent still holds the
+ * account, and a "no" is refused and told to `onRefused`, as the gateway's
+ * copy refuses a write from anyone but its lease's holder. Without one, it is
+ * the storage it wraps.
+ */
+export class FencedStorage {
+  constructor(inner, { fence = null, onRefused = null } = {}) {
+    this.inner = inner;
+    this.fence = fence;
+    this.onRefused = onRefused;
+  }
+
+  get kind() { return this.inner.kind; }
+  get base() { return this.inner.base; }
+  list(sub, opts) { return this.inner.list(sub, opts); }
+  read(p, opts) { return this.inner.read(p, opts); }
+
+  async _refused() {
+    if (!this.fence || await this.fence().catch(() => true)) return false;
+    this.onRefused?.();
+    return true;
+  }
+
+  async write(p, body, contentType) {
+    if (await this._refused()) return { ok: false, retry: false, why: 'another agent holds this account now', lost: true };
+    return this.inner.write(p, body, contentType);
+  }
+
+  async remove(p) {
+    if (await this._refused()) return false;
+    return this.inner.remove(p);
+  }
+}
+
 // `file:` (or a bare path) is a directory; anything else is a pod.
 export function storageFor(base, fetchImpl) {
   return /^https?:/i.test(base) ? new HttpStorage(base, fetchImpl) : new FileStorage(base);

package/lib/core/wire.mjs

@@ -70,13 +70,13 @@ export function jrd({ handle, host, actor, aliases = [], page = null }) {
 // `kind: 'group'` publishes a Group rather than a Person, which is what makes
 // Mastodon and Lemmy treat the actor as a community you join.
 // Whether a follow will be held for the operator instead of accepted on
-// arrival. A person's follows wait unless `autoAcceptFollows` says otherwise,
-// because a delivery on its own proves nothing about who sent it; a group is
-// open unless its operator asked to see joins. The actor document has to say
+// arrival. A person's follows are accepted unless `autoAcceptFollows: false`
+// asks to see them; a group is open unless its operator asked to see joins.
+// The actor document has to say
 // the same thing, or a remote server shows "Following" for a follow that is
 // in fact still waiting, and nothing ever tells it otherwise.
 export function followsNeedApproval(config = {}) {
-  return !!config.approveJoins || (config.kind !== 'group' && !config.autoAcceptFollows);
+  return !!config.approveJoins || (config.kind !== 'group' && config.autoAcceptFollows === false);
 }
 
 export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
@@ -654,6 +654,16 @@ export function quotePolicy(visibility) {
   return { canQuote: { automaticApproval: open ? [PUBLIC] : [], manualApproval: [] } };
 }
 
+// How many liked a post and how many boosted it (§5.7, §5.8): the totals,
+// with nobody named. Both sections let a collection be filtered for whoever
+// asks, and a total with no names is how Mastodon serves them too.
+export function reactionCounts(likes = 0, shares = 0) {
+  return {
+    likes: { type: 'Collection', totalItems: Math.max(0, Number(likes) || 0) },
+    shares: { type: 'Collection', totalItems: Math.max(0, Number(shares) || 0) },
+  };
+}
+
 // `also`: actors addressed without being mentioned — the parent's author on
 // a reply. In cc but not in tag, so their server receives the post and does
 // not notify them. A direct post names its audience in the text alone.
@@ -661,7 +671,7 @@ export function quotePolicy(visibility) {
 // authorization is the quoted author's QuoteAuthorization, once granted.
 export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
   visibility = 'public', summary = null, sensitive = false, updated = null, container = null, also = [],
-  quote = null }) {
+  quote = null, likes = 0, shares = 0 }) {
   const id = (container || urls.notes) + slug;
   const who = mentions.map(m => m.actor);
   const extra = visibility === 'direct' ? [] : also.filter(a => a && !who.includes(a));
@@ -676,6 +686,7 @@ export function noteDoc({ urls, slug, content, published, inReplyTo, attachments
     to: addressed.to,
     cc: addressed.cc,
     replies: repliesId(id),
+    ...reactionCounts(likes, shares),
     interactionPolicy: quotePolicy(visibility),
   };
   if (quote?.id) {

package/lib/gateway/account-agent.mjs

@@ -4,9 +4,9 @@
 //
 // It works with the gateway's own pod identity and nothing else, which the
 // owner's app named in the rules on the account's folder. The account's state
-// is its copy at the gateway when there is one (copy.mjs), and the pod when
-// there is not. The signing key is read from the pod when it is needed, never
-// kept, never made.
+// is its copy at the gateway when there is one (copy.mjs), made from the pod
+// while the hold is on, and the pod when the hold is off. The signing key is
+// read from the pod when it is needed, never kept, never made.
 import crypto from 'node:crypto';
 import { PodTransport } from '../pod/transport.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
@@ -19,7 +19,8 @@ import { Publisher } from '../core/publisher/index.mjs';
 import { Intake } from '../core/intake/index.mjs';
 import { C2S } from '../client/c2s.mjs';
 import { keeperSession } from './keeper-session.mjs';
-import { CopyStorage, copyMeta, copyLease, keptBefore, GATEWAY_HOLDER } from './copy.mjs';
+import { CopyStorage, copyMeta, copyLease, keptBefore, holdOn, GATEWAY_HOLDER } from './copy.mjs';
+import { makeCopy } from './state-api.mjs';
 
 const RSA_ALG = { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' };
 
@@ -58,6 +59,21 @@ export async function reachAccount(ctx, handle, rec, { log = console.log, sessio
   return { remote, podFetch: (u, i) => remote.fetch(u, i), pod, root, urls: apUrls(pod, root), inCopy };
 }
 
+/**
+ * Where this piece of work reads and writes the account, decided by a caller
+ * holding lockCopy, so the round cannot delete the copy in between: a copy
+ * that is here is used; none, while the hold is on, is made from the pod; with
+ * the hold off, the pod. Sets `at.inCopy`; returns { ok } or { ok: false,
+ * status, why }.
+ */
+export async function settle(ctx, handle, rec, at, { log = console.log } = {}) {
+  at.inCopy = !!(ctx.copyKv && await copyMeta(ctx.copyKv, handle));
+  if (at.inCopy || !ctx.copyKv || !holdOn(ctx)) return { ok: true };
+  const made = await makeCopy(ctx, handle, rec, log);
+  at.inCopy = made.ok;
+  return made;
+}
+
 /**
  * The account's state store and lease, as `holder`: over the copy when there
  * is one, else over the pod.

package/lib/gateway/copy.mjs

@@ -3,11 +3,17 @@
 // While the gateway keeps an account running, the account's state documents
 // (everything under ap-state/) live here, and every agent works from this copy:
 // the owner's browser (through the state API, state-api.mjs), the keeper and
-// the gateway's Mastodon API (in process). The pod is written from it every
-// fifteen minutes (flushCopy), and at once when the copy is given up
-// (dropCopy). What only the pod may hold never comes here: the signing key,
-// the pod's own lease document, and the passwords and tokens of accounts on
-// other servers.
+// the gateway's Mastodon API (in process). What only the pod may hold never
+// comes here: the signing key, the pod's own lease document, and the passwords
+// and tokens of accounts on other servers.
+//
+// The hold: a person's copy is made from the pod when something needs it, and
+// every fifteen minutes, whatever is happening, it is written to the pod and
+// deleted (holdOver); the next use makes it again. So nothing private stays
+// here longer than that. A gateway's admin may turn the hold off
+// (FEDIPOD_HOLD=off): then no copy is made at all, and everything works on the
+// pod directly. A forum's copy is kept all the time, and written to its pod
+// every fifteen minutes (flushCopy), as before.
 //
 // The lease that decides which agent acts lives in the copy too, and the copy
 // is what enforces it: a state document is written only by the lease's holder.
@@ -89,6 +95,30 @@ const readJson = async (kv, key) => {
 export const keptNow = (ctx, rec) => !!(rec?.keeper && ctx.keeperWebId && (rec.keeper.webId || ctx.keeperWebId) === ctx.keeperWebId);
 export const keptBefore = (ctx, rec) => !!(rec?.keeper?.webId && ctx.keeperWebId && rec.keeper.webId !== ctx.keeperWebId);
 
+// A person's account, as against a forum or one of its categories.
+export const isPersonal = (rec) => !!rec && (rec.kind || 'person') === 'person' && !rec.forum;
+
+// The admin's setting: the hold is on unless FEDIPOD_HOLD says off.
+export const holdFrom = (v) => !/^(off|no|false|0)$/iu.test(String(v ?? '').trim());
+export const holdOn = (ctx) => ctx?.hold !== false;
+
+// While the round writes a copy to the pod and deletes it: the state API asks
+// its callers to try again in a moment, and the gateway's readers wait.
+const CLOSING_MS = 2 * 60_000;
+export async function closing(kv, h) {
+  const at = Number((await kv.get(`${account(h)}/closing`))?.text || 0);
+  return !!at && Date.now() - at < CLOSING_MS;
+}
+/** Wait, up to `waitMs`, for a copy being written and deleted to be gone. */
+export async function waitOutClosing(kv, h, { waitMs = 10_000 } = {}) {
+  const until = Date.now() + waitMs;
+  while (await closing(kv, h)) {
+    if (Date.now() > until) return false;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+  return true;
+}
+
 /**
  * Forget a copy its owner has written to the pod themselves: no write-back, no
  * pod lease to free (the owner took it). Asked only by the lease's holder.
@@ -135,6 +165,12 @@ export function copyLease(kv, h, { id, log = () => {} }) {
   return new Lease({ url: `copy:${account(h)}/lease`, fetchImpl: kvDocFetch(kv, `${h}/lease`), log, id });
 }
 
+/** Whether a browser, as against the gateway, holds the copy's lease now. */
+export async function heldByBrowser(kv, h) {
+  const { doc } = await readJson(kv, `${account(h)}/lease`);
+  return !!doc && doc.holder !== GATEWAY_HOLDER && Date.now() < doc.expiresAt;
+}
+
 /** Whether `holder` holds the copy's lease now. */
 export async function holds(kv, h, holder) {
   const { doc } = await readJson(kv, `${account(h)}/lease`);
@@ -275,10 +311,14 @@ export async function fillCopy(kv, h, { pod, podFetch, stateUrl, webId = null, l
   }
   const undo = async (why) => {
     for (const b of await kv.list(`${h}/d/`).catch(() => [])) await kv.delete(b.key).catch(() => {});
+    await kv.delete(`_copies/${h}`).catch(() => {});
     await podLease.release().catch(() => {});
     return { ok: false, why };
   };
   try {
+    // Listed from the start, so a making cut off part way is found by the
+    // round and its documents deleted (clearLeftover).
+    await kv.set(`_copies/${h}`, String(Date.now()));
     // Whatever an interrupted give-up left behind is not this copy.
     for (const b of await kv.list(`${h}/d/`)) await kv.delete(b.key);
     const listing = await pod.list('');
@@ -388,3 +428,53 @@ export async function dropCopy(kv, h, { pod, podFetch, stateUrl, log = () => {}
   log(`copy @${h}: given up; the pod holds everything`);
   return { ok: true };
 }
+
+/**
+ * The end of the hold, for a person's copy: everything written to the pod, the
+ * pod's lease freed, and the copy deleted. Unlike giving the copy up
+ * (dropCopy), the copy's lease stays, so the browser holding it goes on holding
+ * it in the copy made next. Asked by the round, which holds lockCopy. Writes
+ * that reach the state API meanwhile are asked to come again (closing), and
+ * the next one finds the copy made again from the pod. Returns { ok } or
+ * { ok: false, why }; nothing is deleted unless the pod has it all.
+ */
+export async function holdOver(kv, h, { pod, podFetch, stateUrl, log = () => {} }) {
+  const meta = await copyMeta(kv, h);
+  if (!meta) return { ok: true, already: true };
+  await kv.set(`${account(h)}/closing`, String(Date.now()));
+  try {
+    // Again, twice at most, for a write that landed while the first went: the
+    // marker stops any more coming.
+    let behind = [];
+    for (let i = 0; i < 3; i++) {
+      await flushCopy(kv, h, { pod, log });
+      const { doc: flushed } = await readJson(kv, `${h}/flushed`);
+      behind = (await kv.list(`${h}/d/`)).filter((b) => flushed?.[b.key.slice(`${h}/d/`.length)]?.etag !== b.etag);
+      if (!behind.length) break;
+    }
+    if (behind.length) return { ok: false, why: `${behind.length} document(s) could not be written to the pod` };
+    const podLease = new Lease({ url: (stateUrl || meta.stateUrl) + 'lease.json', fetchImpl: podFetch, log, id: POD_HOLDER });
+    try { await podLease.write({ holder: POD_HOLDER, expiresAt: 0 }); } catch (e) {
+      return { ok: false, why: `the pod's lease could not be freed (${e.message})` };
+    }
+    // The copy is gone the moment its meta is. Its listing goes last, so a
+    // delete cut off part way is found and finished by the next round
+    // (clearLeftover).
+    await kv.delete(`${h}/meta`);
+    await kv.delete(`${h}/flushed`);
+    for (const b of await kv.list(`${h}/d/`)) await kv.delete(b.key);
+    await kv.delete(`_copies/${h}`);
+    log(`copy @${h}: written to the pod and deleted (the hold)`);
+    return { ok: true };
+  } finally { await kv.delete(`${h}/closing`).catch(() => {}); }
+}
+
+/** A copy listed with no meta is one whose delete was cut off: its documents go. */
+export async function clearLeftover(kv, h, { log = () => {} } = {}) {
+  if (await copyMeta(kv, h)) return false;
+  const left = await kv.list(`${account(h)}/d/`);
+  for (const b of left) await kv.delete(b.key);
+  await kv.delete(`_copies/${h}`);
+  if (left.length) log(`copy @${h}: ${left.length} document(s) left by a cut-off delete, deleted`);
+  return true;
+}

package/lib/gateway/front-core.mjs

@@ -23,11 +23,12 @@ import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
 import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer, provedOwner } from './quiet.mjs';
-import { holdsMail, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi } from './held-mail.mjs';
+import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi } from './held-mail.mjs';
 import { routeNoticesApi } from './notices.mjs';
 import { withSecurityHeaders } from './headers.mjs';
 import { podTokenVerifier } from './caches.mjs';
 import { claimedWebId } from './token-claims.mjs';
+import { answerPrivateRead } from './private-read.mjs';
 import { announced, overLimit, relayOne } from './relay-extras.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
@@ -810,20 +811,29 @@ async function route(request, ctx) {
       'access-control-max-age': '86400',
     };
     if (request.method === 'OPTIONS') return { status: 204, headers: { ...doorCors, allow: 'POST, OPTIONS' }, body: null };
+    // The owner, signed in, reads the inbox as a collection (§5.2): the drain
+    // keeps it on the pod, under the owner's own rule. The token is only
+    // read, never verified, as at the outbox door: the pod checks it.
+    if ((request.method === 'GET' || request.method === 'HEAD') && request.headers.get('authorization')) {
+      const webid = claimedWebId(request);
+      if (webid && (rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome))) {
+        return { status: 303, headers: { ...doorCors, location: rec.podHome + 'ap/private/inbox', 'cache-control': 'no-store' }, body: '' };
+      }
+    }
     if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
     if (movedBase) { console.log(`door @${up.handle}: delivery → 410 (moved)`); return gone(doorCors); }
     if (closed) { console.log(`door @${up.handle}: delivery → 410 (closed)`); return gone(doorCors, CLOSED); }
     const policy = await policyFor(rec, ctx.fetchImpl || fetch);
     const standing = await accountState(ctx, up.handle, rec);
-    // A browser account's mail waits here while its app is closed (held-mail.mjs).
-    const held = holdsMail(ctx, rec) && !(await isPresent(ctx, up.handle));
+    // A browser account's mail waits here while its app is closed (held-mail.mjs), unless the hold is off.
+    const away = mayBeAway(ctx, rec) && !(await isPresent(ctx, up.handle)); const held = away && holdsMail(ctx, rec);
     const { status, reason, content, bytes, type, notifies, name, raw, receipt } = await handleDelivery(request, identFor(rec, policy),
       { podPut: held ? holdingPut(ctx, up.handle, rec) : (u, b, ct) => ctx.podPut(up.handle, u, b, ct),
-        fetchImpl: ctx.fetchImpl, paused: standing.paused });
+        fetchImpl: ctx.fetchImpl, paused: standing.paused, origin: ctx.frontOrigin || null });
     // One line per delivery, so "did it arrive at the door" has an answer.
     console.log(`door @${up.handle}: delivery → ${status} (${reason}${held && status === 202 ? ', held' : ''})`);
     if (status === 202 && content) await noteReceived(ctx, up.handle, rec, bytes);
-    if (held && status === 202) await afterHeld(ctx, up.handle, rec, { type, notifies });
+    if (away && status === 202) await afterHeld(ctx, up.handle, rec, { type, notifies });
     // A forum fedipod.net keeps: the delivery is placed now, in this request,
     // and the run that carries it is started. Whatever could not be placed
     // here is still in the inbox for that run.
@@ -911,10 +921,9 @@ async function route(request, ctx) {
   const podTarget = rec.podHome + up.rest;
   // The owner's own documents — the full outbox, the liked list, the pending
   // lists — are read at the pod, which decides who may; never held here,
-  // where one reader's answer would be served to the next.
-  if (up.rest.startsWith('ap/private/')) {
-    return { status: 303, headers: { ...open, location: podTarget, 'cache-control': 'no-store' }, body: '' };
-  }
+  // where one reader's answer would be served to the next. A signed read of
+  // a private post by a server it was sent to is answered (private-read.mjs).
+  if (up.rest.startsWith('ap/private/')) return answerPrivateRead(ctx, rec, { request, handle: up.handle, podTarget, base, open, swap });
   // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
   // the id rewrite below turns media links onto the front like every other
   // pod url in a document. Answer those by pointing at the pod: bytes are not

package/lib/gateway/gateway-core.mjs

@@ -91,12 +91,34 @@ export function notifies(activity, ident) {
 // Returns { status, reason } — the adapter turns it into an HTTP response —
 // and, for a delivery that reached the pod, `content` (whether it was
 // content rather than control) and `bytes`, so the caller can keep count.
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false } = {}) {
-  // Read the body once from a clone; the original, unconsumed, goes to the
-  // verifier (which needs the body for the Digest check).
-  let raw;
-  try { raw = await request.clone().text(); } catch { return { status: 400, reason: 'unreadable body' }; }
-  if (Buffer.byteLength(raw) > maxBytes) return { status: 413, reason: 'too large' };
+// The request as the sender signed it. A sender signs the host it delivered
+// to and digests the bytes it sent; what reaches this code has been through
+// an edge that may have rewritten the Host header, the URL's host or both
+// (Netlify does), and a verifier that trusts those fails every honest
+// delivery. So the verifier gets a request rebuilt from the bytes read here,
+// at the door's own origin when the caller names it, else at the host a
+// proxy says it forwarded for, else at the URL's own.
+export function asSigned(request, bytes, origin) {
+  const u = new URL(request.url);
+  let host = null;
+  if (origin) { try { const o = new URL(origin); u.protocol = o.protocol; host = o.host; } catch { /* not an origin: the URL's own */ } }
+  host = host || request.headers.get('x-forwarded-host')?.split(',')[0].trim() || u.host;
+  u.host = host;
+  const headers = new Headers(request.headers);
+  headers.set('host', host);
+  // A GET or HEAD carries no body, and a Request refuses one (a signed read: private-read.mjs).
+  const bodiless = request.method === 'GET' || request.method === 'HEAD';
+  return new Request(u.href, { method: request.method, headers, ...(bodiless ? {} : { body: bytes }) });
+}
+
+// `origin` is the door's own, the one senders address (see asSigned).
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null } = {}) {
+  // The body, once, as the bytes the sender digested; the text of it is what
+  // is filed and hashed, as before.
+  let bytes, raw;
+  try { bytes = new Uint8Array(await request.clone().arrayBuffer()); raw = new TextDecoder().decode(bytes); }
+  catch { return { status: 400, reason: 'unreadable body' }; }
+  if (bytes.byteLength > maxBytes) return { status: 413, reason: 'too large' };
 
   let activity;
   try { activity = JSON.parse(raw); } catch { return { status: 400, reason: 'unparsable JSON' }; }
@@ -114,15 +136,25 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
 
   // The sender's key, kept between deliveries: a server pushing a hundred
   // items is asked for its key once (caches.mjs).
-  const v = await verifyHttpSignature(request, {
+  const v = await verifyHttpSignature(asSigned(request, bytes, origin), {
     documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
   });
-  // A present-but-invalid signature is a forgery — dropped here, so it never
-  // reaches the pod (today it would, drain, and die unapplied). An absent or
-  // unfetchable-key signature is NOT dropped: it forwards unverified and the
-  // drain's verify-by-dereference still stands behind it.
+  // A signature that does not verify is NOT dropped (it was, 2026-08-20 to
+  // 2026-09-28, and for a stretch of that every honest Mastodon delivery was
+  // dropped with it, silently, because of what the edge had done to the
+  // request). It forwards unverified, like an absent or unfetchable-key
+  // signature, and the drain's verify-by-dereference decides; the log says
+  // why it failed and what the request looked like, so the next such
+  // stretch is visible.
+  let failed = null;
   if (v.verified === false && v.reason === 'bad-signature') {
-    return { status: 202, reason: 'forged signature' };
+    const has = (h) => (request.headers.has(h) ? 'yes' : 'no');
+    const fwd = request.headers.get('x-forwarded-host');
+    // The sender's signature parameters — which components it signed, its
+    // key id and algorithm — without the signature value itself.
+    const params = request.headers.get('signature-input')
+      || (request.headers.get('signature') || '').replace(/signature="[^"]*"/u, 'signature="…"');
+    failed = `signature ${v.why} (${v.method}); host ${request.headers.get('host') || 'none'}${fwd ? ` forwarded-for ${fwd}` : ''}, date ${has('date')}, digest ${has('digest') === 'yes' || has('content-digest') === 'yes' ? 'yes' : 'no'}; ${params.slice(0, 300)}`;
   }
 
   // No per-user secret on record = no receipt: the delivery still filters and
@@ -137,8 +169,8 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified', content, bytes: Buffer.byteLength(raw),
-    type: activity.type, notifies: notifies(activity, ident), name: hash, raw, receipt };
+  return { status: 202, reason: v.verified ? 'verified' : failed ? `buffered-unverified: ${failed}` : 'buffered-unverified',
+    content, bytes: bytes.byteLength, type: activity.type, notifies: notifies(activity, ident), name: hash, raw, receipt };
 }
 
 // The outbox door: the owner's own post, taken on their behalf.