fedipod 1.44.0 → 1.47.0

package/lib/gateway/state-api.mjs

@@ -13,13 +13,21 @@
 //                                    before the owner stops the gateway keeping
 //                                    the account running
 //
+// The hold (copy.mjs): the round writes a person's copy to the pod and deletes
+// it every fifteen minutes. A document asked for after that makes the copy
+// again from the pod, and one asked for while it goes is answered 503, to be
+// asked again in a moment. The copy's lease outlives it. With the hold off,
+// no copy is made: /open answers 501, after writing to the pod and deleting
+// any copy left from before, and the browser works on the pod.
+//
 // The token is the gateway's own, signed with a secret only it knows, and
 // names the account and the WebID that asked; it lasts a day. The signing key
 // and the passwords of accounts elsewhere are refused here: the copy does not
 // hold them, and the browser reads them from the pod.
 import crypto from 'node:crypto';
 import { HttpStorage } from '../core/storage.mjs';
-import { CopyStorage, copyMeta, fillCopy, dropCopy, forgetCopy, holds, lockCopy, kvDocFetch, podOnly, safeName, safeHandle, keptBefore } from './copy.mjs';
+import { CopyStorage, copyMeta, fillCopy, dropCopy, forgetCopy, holds, lockCopy, kvDocFetch, podOnly, safeName, safeHandle, keptBefore, keptNow,
+  holdOn, holdOver, closing } from './copy.mjs';
 
 const TOKEN_MS = 24 * 3600_000;
 const b64 = (s) => Buffer.from(s).toString('base64url');
@@ -79,6 +87,14 @@ const noteFailure = (kv, handle, why = null) => kv.set(`${handle}/fill-failed-at
  * credential has changed since. Returns { ok } or { ok: false, status, why }.
  */
 export async function ensureCopy(ctx, handle, rec, log = console.log, { owner = false } = {}) {
+  if (await copyMeta(ctx.copyKv, handle)) return { ok: true };
+  const unlock = await lockCopy(ctx.copyKv, handle);
+  if (!unlock) return { ok: false, status: 503, why: 'the gateway is busy with this account; try again' };
+  try { return await makeCopy(ctx, handle, rec, log, { owner }); } finally { await unlock(); }
+}
+
+/** ensureCopy, for a caller already holding lockCopy for the account. */
+export async function makeCopy(ctx, handle, rec, log = console.log, { owner = false } = {}) {
   if (await copyMeta(ctx.copyKv, handle)) return { ok: true };
   // The owner too: it is the gateway's credential that has to change.
   const refused = await loginRefused(ctx);
@@ -90,26 +106,41 @@ export async function ensureCopy(ctx, handle, rec, log = console.log, { owner =
   }
   const podFetch = await ctx.keeperFetch();
   if (!podFetch) return { ok: false, status: 501, why: 'this gateway cannot reach pods for accounts' };
-  const unlock = await lockCopy(ctx.copyKv, handle);
-  if (!unlock) return { ok: false, status: 503, why: 'the gateway is busy with this account; try again' };
+  // Marked failed before it starts and cleared when it is done, so an attempt
+  // cut off part way (a request's time running out) counts as failed too.
+  await noteFailure(ctx.copyKv, handle);
+  const stateUrl = stateUrlOf(rec);
+  const made = await fillCopy(ctx.copyKv, handle, { pod: new HttpStorage(stateUrl, podFetch), podFetch, stateUrl, webId: rec.webId, log })
+    .catch((e) => ({ ok: false, why: e.message }));
+  if (made.ok) { await ctx.copyKv.delete(`${handle}/fill-failed-at`).catch(() => {}); return { ok: true }; }
+  await noteFailure(ctx.copyKv, handle, made.why);
+  log(`copy @${handle}: not made: ${made.why}`);
+  if (refusedSignIn(made.why)) {
+    await ctx.copyKv.set(LOGIN_REFUSED, JSON.stringify({ at: Date.now(), mark: ctx.keeperMark || '', why: made.why })).catch(() => {});
+  }
+  return { ok: false, status: /active on another device/.test(made.why) ? 409 : 502, why: made.why };
+}
+
+/**
+ * The end of the hold for one account now, as the round does it: the copy
+ * written to the pod and deleted. Returns { ok } or { ok: false, why }.
+ */
+export async function endHold(ctx, handle, rec, log = console.log, { waitMs = 8_000 } = {}) {
+  if (!await copyMeta(ctx.copyKv, handle)) return { ok: true };
+  const podFetch = await ctx.keeperFetch();
+  if (!podFetch) return { ok: false, why: 'this gateway cannot reach the pod now' };
+  const unlock = await lockCopy(ctx.copyKv, handle, { waitMs });
+  if (!unlock) return { ok: false, why: 'the gateway is busy with this account; try again' };
   try {
-    if (await copyMeta(ctx.copyKv, handle)) return { ok: true };
-    // Marked failed before it starts and cleared when it is done, so an attempt
-    // cut off part way (a request's time running out) counts as failed too.
-    await noteFailure(ctx.copyKv, handle);
     const stateUrl = stateUrlOf(rec);
-    const made = await fillCopy(ctx.copyKv, handle, { pod: new HttpStorage(stateUrl, podFetch), podFetch, stateUrl, webId: rec.webId, log })
-      .catch((e) => ({ ok: false, why: e.message }));
-    if (made.ok) { await ctx.copyKv.delete(`${handle}/fill-failed-at`).catch(() => {}); return { ok: true }; }
-    await noteFailure(ctx.copyKv, handle, made.why);
-    log(`copy @${handle}: not made: ${made.why}`);
-    if (refusedSignIn(made.why)) {
-      await ctx.copyKv.set(LOGIN_REFUSED, JSON.stringify({ at: Date.now(), mark: ctx.keeperMark || '', why: made.why })).catch(() => {});
-    }
-    return { ok: false, status: /active on another device/.test(made.why) ? 409 : 502, why: made.why };
+    return await holdOver(ctx.copyKv, handle, { pod: new HttpStorage(stateUrl, podFetch), podFetch, stateUrl, log });
   } finally { await unlock(); }
 }
 
+// Whether the copy is made again when it is asked for: the hold on, and the
+// account still kept here under this identity.
+const remakes = (ctx, rec) => holdOn(ctx) && keptNow(ctx, rec) && !keptBefore(ctx, rec) && !rec.movedTo && !rec.closedAt;
+
 /** Write the copy to the pod and give it up. Returns { ok } or { ok: false, why }. */
 export async function leaveCopy(ctx, handle, rec, log = console.log) {
   if (!await copyMeta(ctx.copyKv, handle)) return { ok: true };
@@ -155,6 +186,13 @@ export async function routeStateApi(request, pathname, ctx, deps) {
     // owner's rules name it.
     const before = keptBefore(ctx, rec);
     if (before && !await copyMeta(ctx.copyKv, handle)) return j(409, { error: 'kept under the gateway\'s former identity', moving: true });
+    // The hold off: no copy. One left from before goes to the pod first, so
+    // the browser works on a pod that has everything.
+    if (!before && !holdOn(ctx)) {
+      const ended = await endHold(ctx, handle, rec).catch((e) => ({ ok: false, why: e.message }));
+      if (!ended.ok) return j(503, { error: `the account's copy could not be written to the pod: ${ended.why}` });
+      return j(501, { error: 'this gateway keeps no copies of accounts', hold: false });
+    }
     const made = before ? { ok: true } : await ensureCopy(ctx, handle, rec, console.log, { owner: true });
     if (!made.ok) return j(made.status, { error: made.why, busy: made.status === 409 });
     const origin = new URL(request.url).origin;
@@ -177,15 +215,28 @@ export async function routeStateApi(request, pathname, ctx, deps) {
   // by somebody else is not theirs any more.
   const owned = await ctx.lookup(handle);
   if (!owned || owned.webId !== who.webId) return j(401, { error: 'this token is not for this account' });
-  if (!await copyMeta(ctx.copyKv, handle)) return j(404, { error: 'the gateway keeps no copy of this account now', gone: true });
   const kv = ctx.copyKv;
   const noStore = { 'cache-control': 'no-store' };
+  const gone = () => j(404, { error: 'the gateway keeps no copy of this account now', gone: true });
 
+  // No copy, or none now, is nothing to give up.
   if (name === 'leave') {
     if (request.method !== 'POST') return j(405, { error: 'POST' });
     const left = await leaveCopy(ctx, handle, owned).catch((e) => ({ ok: false, why: e.message }));
     return left.ok ? j(200, { ok: true }) : j(502, { error: `the copy could not be written to the pod: ${left.why}` });
   }
+  // The copy's lease outlives each copy the hold makes.
+  if (name === 'lease.json' && !await copyMeta(kv, handle) && !remakes(ctx, owned)) return gone();
+  // Being written to the pod and deleted: asked again in a moment, it is made anew.
+  const comeAgain = () => j(503, { error: 'the account\'s copy is being written to the pod; try again in a moment' });
+  if (name !== 'lease.json') {
+    if (await closing(kv, handle)) return comeAgain();
+    if (!await copyMeta(kv, handle)) {
+      if (!remakes(ctx, owned)) return gone();
+      const made = await ensureCopy(ctx, handle, owned, console.log, { owner: true });
+      if (!made.ok) return j(made.status === 409 ? 503 : made.status, { error: made.why });
+    }
+  }
   // The owner's browser has written the copy to the pod itself (a copy kept
   // under the gateway's former identity, which cannot write it back now).
   // Only the lease's holder may say so, and only for such a copy.
@@ -229,11 +280,15 @@ export async function routeStateApi(request, pathname, ctx, deps) {
     const w = await copy.write(name, await request.text());
     if (w.lost) return j(409, { error: w.why });
     if (!w.ok) return j(503, { error: w.why });
+    // Landed as the round began to write the copy to the pod: perhaps after
+    // it read this document. Sent again, it lands in the copy made next.
+    if (await closing(kv, handle)) return comeAgain();
     return { status: 204, headers: { ...noStore, etag: w.etag }, body: null };
   }
   if (request.method === 'DELETE') {
     if (!holder) return j(400, { error: 'x-fedipod-holder is required' });
-    return (await copy.remove(name)) ? { status: 204, headers: noStore, body: null } : j(409, { error: 'another agent holds this account now' });
+    if (!await copy.remove(name)) return j(409, { error: 'another agent holds this account now' });
+    return (await closing(kv, handle)) ? comeAgain() : { status: 204, headers: noStore, body: null };
   }
   return j(405, { error: 'GET, PUT or DELETE' });
 }

package/lib/pod/notes.mjs

@@ -44,6 +44,31 @@ export const writeReplies = (pod, repliesId, doc) => pod.putJson(repliesId, doc)
 /** One published note, as the pod currently serves it. */
 export const read = (pod, noteId) => pod.getJson(noteId);
 
+/**
+ * A note as the pod serves it, with the version the pod gave it.
+ *
+ * For a write that must not undo somebody else's: an edit or a deletion that
+ * lands between this read and the write below wins, and the writer tries
+ * again later. A pod that names no version gets an unconditional write.
+ */
+export async function readVersioned(pod, noteId) {
+  if (typeof pod.fetch !== 'function') return { doc: await pod.getJson(noteId), version: null };
+  const res = await pod.fetch(noteId, { headers: { accept: 'application/activity+json' } });
+  if (res.status === 404 || res.status === 410) return { doc: null, version: null };
+  if (res.status >= 400) throw new Error(`GET ${noteId} → ${res.status}`);
+  return { doc: await res.json().catch(() => null), version: res.headers?.get?.('etag') || null };
+}
+
+/** Write the note only over the version read. False when it changed meanwhile. */
+export async function writeIfUnchanged(pod, noteId, doc, version) {
+  if (!version || typeof pod.fetch !== 'function') { await pod.putJson(noteId, doc); return true; }
+  const res = await pod.fetch(noteId, { method: 'PUT',
+    headers: { 'content-type': 'application/activity+json', 'if-match': version }, body: JSON.stringify(doc) });
+  if (res.status === 412) return false;
+  if (res.status >= 400) throw new Error(`PUT ${noteId} → ${res.status}`);
+  return true;
+}
+
 /**
  * Replace a note with a Tombstone, and keep it readable.
  *

package/lib/pod/urls.mjs

@@ -52,6 +52,9 @@ export function apUrls(remotePod, root, { publicBase = null } = {}) {
     // reads them there, with a credential the pod checks.
     ownOutbox: home + 'ap/private/outbox',
     liked: home + 'ap/private/liked',
+    // The inbox as its owner reads it (§5.2): what the account received,
+    // kept by the drain as a paged collection beside the archive.
+    ownInbox: home + 'ap/private/inbox',
     profileHtml: face + 'ap/profile.html',
     // Media stays on the pod even when fronted: attachment urls are not
     // identity-checked by remotes, and proxying blobs would be pure cost.

package/lib/server/embed.mjs

@@ -20,6 +20,7 @@ import { Agent } from '../core/agent.mjs';
 import { RemotePod } from '../core/remote.mjs';
 import { apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
 import { handleDelivery } from '../gateway/gateway-core.mjs';
+import { signedReader, mayRead } from '../gateway/private-read.mjs';
 import { writeJsonAtomic } from '../shared/files.mjs';
 import { buildAdminSurface } from '../surface/index.mjs';
 import { FixedAuthorities } from '../shared/guard.mjs';
@@ -260,6 +261,30 @@ export async function deliverToInbox(agent, request, { podPut, gatewayWebId = nu
   return handleDelivery(request, ident, { podPut, fetchImpl });
 }
 
+/**
+ * A signed read of a followers-only or direct post at its address on this
+ * pod (ActivityPub §3.2), answered to a server the post was sent to. The
+ * rule is lib/gateway/private-read.mjs's; here the post is read through the
+ * server's own store and the followers come from the identity's live state.
+ * Returns { status, reason, body }: 200 with the document, else 404 with why.
+ */
+export async function readPrivateForSigner(agent, request, { read, fetchImpl = fetch } = {}) {
+  const u = agent.urls;
+  const toPod = (x) => (u.toPod ? u.toPod(x) : x);
+  const url = request.url.split('?')[0];
+  const { actor, reason } = await signedReader(request, { fetchImpl, origin: new URL(request.url).origin });
+  if (!actor) return { status: 404, reason: `refused — ${reason}` };
+  const text = await Promise.resolve().then(() => read(url)).catch(() => null);
+  let doc = null;
+  try { doc = text ? JSON.parse(text) : null; } catch { doc = null; }
+  if (!doc) return { status: 404, reason: `refused — nothing at ${url} (${actor})` };
+  const followers = (agent.store.getContacts().followers || []).map((f) => f?.actor).filter(Boolean);
+  if (!mayRead(doc, actor, { followersUrls: [u.followers, toPod(u.followers)], followers })) {
+    return { status: 404, reason: `refused — ${actor} is not in its audience` };
+  }
+  return { status: 200, reason: `served to ${actor}`, body: text };
+}
+
 /**
  * Bring one identity up inside the server.
  *

package/lib/surface/routes/owner.mjs

@@ -70,7 +70,7 @@ export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-u
       image: cfg.image || null, fields: cfg.fields || [],
       approveJoins: !!cfg.approveJoins, review: !!cfg.review,
       aliases: cfg.aliases || [],
-      autoAcceptFollows: !!cfg.autoAcceptFollows,
+      autoAcceptFollows: cfg.autoAcceptFollows !== false,
       // never the record itself
       hasUiPassword: !!cfg.uiPassword,
       quiescedAt: cfg.quiescedAt || null, movedTo: cfg.movedTo || null,
@@ -255,7 +255,7 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
           name: cfg.name || null, summary: cfg.summary || null, icon: cfg.icon || null,
       image: cfg.image || null, fields: cfg.fields || [],
           approveJoins: !!cfg.approveJoins, review: !!cfg.review,
-          autoAcceptFollows: !!cfg.autoAcceptFollows,
+          autoAcceptFollows: cfg.autoAcceptFollows !== false,
           ...(isGroup() ? { moderators: cfg.moderators || [] } : {}),
           hasUiPassword: !!cfg.uiPassword,
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.44.0",
+  "version": "1.47.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node packages/fedipod-bb/scripts/link-fedipod.mjs && node --test packages/fedipod-bb/test/*.test.mjs claude/smoke-tests/forum-signup-form.test.mjs && node scripts/check-sizes.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node packages/fedipod-bb/scripts/link-fedipod.mjs && node --test packages/fedipod-bb/test/*.test.mjs claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs && node scripts/check-sizes.mjs && node claude/validation/browser-agent/all.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",

package/web/admin/gateway.js

@@ -19,43 +19,27 @@ async function refreshGateway() {
     GW_OPEN_ATTACH.hidden = true;
     GW_OPEN_DETACH.hidden = false;
     // The account's standing at the gateway — paused, closed. The browser
-    // build's agent reports it; a DeviceAgent's does not, and the pause and
-    // close controls stay hidden.
+    // build's agent reports it; a DeviceAgent's does not, and the keep
+    // control stays hidden.
     const st = g.standing;
     const known = !!st && (st.status === 200 || st.status === 410);
-    $('gateway-pause').hidden = !known || !!st.closed || !!st.paused;
-    $('gateway-resume').hidden = !known || !!st.closed || !st.paused;
-    $('gateway-close').hidden = !known || !!st.closed;
     if (known && st.closed) GATEWAY_WORD.textContent += ' — this address is closed';
     else if (known && st.paused) GATEWAY_WORD.textContent += st.pausedBy === 'owner' ? ' — paused by you' : ' — paused';
-    // Whether the gateway keeps the account running while FediPod is closed.
+    // Kept running while FediPod is closed; offered only to an account that is not.
     const kp = g.keeper;
     $('gateway-keep-on').hidden = !kp || !known || !!st.closed || kp.on;
-    $('gateway-keep-off').hidden = !kp || !known || !!st.closed || !kp.on;
-    if (kp?.on && known && !st.closed) GATEWAY_WORD.textContent += ' — kept running while you are away';
   } else {
     GATEWAY_WORD.textContent = '';
     GW_OPEN_ATTACH.hidden = false;
     GW_OPEN_DETACH.hidden = true;
-    for (const id of ['gateway-pause', 'gateway-resume', 'gateway-keep-on', 'gateway-keep-off', 'gateway-close']) $(id).hidden = true;
+    $('gateway-keep-on').hidden = true;
   }
 }
-const setPausedAtGateway = async (paused) => {
-  const r = await write('/gateway/pause', { paused },
-    paused ? 'paused — posts sent to you are not kept until you resume; follows still arrive'
-      : 'resumed — posts sent to you are kept again');
+$('gateway-keep-on').addEventListener('click', async () => {
+  const r = await write('/gateway/keep', { on: true },
+    'kept running — follows, deliveries to try again and scheduled posts are handled while FediPod is closed');
   if (r) refreshGateway();
-};
-$('gateway-pause').addEventListener('click', () => setPausedAtGateway(true));
-$('gateway-resume').addEventListener('click', () => setPausedAtGateway(false));
-const setKept = async (on) => {
-  const r = await write('/gateway/keep', { on },
-    on ? 'kept running — follows, deliveries to try again and scheduled posts are handled while FediPod is closed'
-      : 'stopped — your account acts only while FediPod is open');
-  if (r) refreshGateway();
-};
-$('gateway-keep-on').addEventListener('click', () => setKept(true));
-$('gateway-keep-off').addEventListener('click', () => setKept(false));
+});
 const gwShape = () => document.querySelector('input[name=gwShape]:checked')?.value || 'pod';
 function gwPreviews() {
   $('gw-pod-preview').textContent = config?.address || `@${config?.handle || 'you'}@your.pod`;

package/web/admin/index.html

@@ -340,16 +340,8 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     title="   Go back to your pod's own inbox">Detach from gateway</button>
   <!-- Shown only when the agent reports the account's standing at the gateway
        (the browser build does; a DeviceAgent's admin does not). -->
-  <button type="button" id="gateway-pause" class="inline" hidden
-    title="   Stop keeping the posts sent to you until you resume; follows still arrive">Pause my account</button>
-  <button type="button" id="gateway-resume" class="inline" hidden
-    title="   Keep the posts sent to you again">Resume my account</button>
   <button type="button" id="gateway-keep-on" class="inline" hidden
     title="   Let this gateway accept follows, try again what failed to go out and publish scheduled posts while FediPod is closed">Keep my account running while I'm away</button>
-  <button type="button" id="gateway-keep-off" class="inline" hidden
-    title="   Act only while FediPod is open; the rule naming this gateway comes off your pod">Stop keeping it running</button>
-  <button type="button" id="gateway-close" class="inline danger" hidden data-confirm="close-address"
-    title="   Close your address at this gateway for good; nothing on your pod is touched">Close this address</button>
 </span>
 
 <section id="pane-group" hidden>
@@ -545,14 +537,6 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     <label for="confirm-handle">Type the handle to confirm</label>
     <input type="text" id="confirm-handle" autocomplete="off">
   </div>
-  <div id="warn-close-address" class="warn" hidden>
-    <p><strong>This cannot be undone.</strong> Your address at the gateway is closed for good:
-      mail to it is turned away, other servers drop the account the next time they look, and
-      nobody can take the name. Nothing on your pod is touched — your posts, key and data stay
-      where they are.</p>
-    <label for="confirm-handle-close">Type the handle to confirm</label>
-    <input type="text" id="confirm-handle-close" autocomplete="off">
-  </div>
   <!-- "Move private data" (POST /state-move) had a panel here and no way to
        open it: nothing in this page has ever carried data-confirm="move-state",
        so the panel was only ever hidden. Removed 2026-09-09 rather than left as

package/web/admin/record.js

@@ -94,7 +94,6 @@ function resetConfirm() {
   for (const k of Object.keys(LIFECYCLE)) $(`warn-${k}`)?.hidden !== undefined && ($(`warn-${k}`).hidden = true);
   $('confirm-handle').value = '';
   $('confirm-handle-move').value = '';
-  $('confirm-handle-close').value = '';
   $('move-target').value = '';
 }
 function closePanels(keep = null) {
@@ -325,7 +324,7 @@ function render() {
       dd.textContent = '';
       dd.append(FOLLOWS_CTL);
       FOLLOWS_CTL.hidden = false;
-      FOLLOWS_PICK.value = config.autoAcceptFollows ? 'auto' : 'approve';
+      FOLLOWS_PICK.value = config.autoAcceptFollows !== false ? 'auto' : 'approve';
     }
     if (k === 'gateway') {
       dd.textContent = '';

package/web/admin/upkeep.js

@@ -76,9 +76,6 @@ const LIFECYCLE = {
   retire: { path: '/retire', title: 'Retire this identity', go: 'Retire it', danger: true, done: (r) => `retired ${r.deletedAt}: Delete delivered to ${r.inboxes} inbox(es)` },
   move: { path: '/move', title: 'Transfer this account away', go: 'Transfer it', focus: 'move-target',
     done: (r) => `transferred to ${r.target}: Move delivered to ${r.inboxes} inbox(es), unfollowed ${r.unfollowed}/${r.following}` },
-  // The address at the gateway, not the identity: the pod keeps everything.
-  'close-address': { path: '/gateway/close', title: 'Close this address', go: 'Close it', danger: true, focus: 'confirm-handle-close',
-    done: (r) => (r.closed ? 'closed — this address is gone for good; everything on your pod is untouched' : 'not closed') },
 };
 let pending = null;
 
@@ -122,8 +119,7 @@ $('confirm-form').addEventListener('submit', async (ev) => {
   const what = pending;
   const body = what === 'retire' ? { confirm: $('confirm-handle').value.trim() }
     : what === 'move' ? { target: $('move-target').value.trim(), confirm: $('confirm-handle-move').value.trim() }
-      : what === 'close-address' ? { confirm: $('confirm-handle-close').value.trim() }
-        : {};
+      : {};
   if (what === 'move' && !body.target) { say('name the account to transfer to', 'err'); return; }
   $('confirm-go').disabled = true;
   say(`${what} — this talks to the pod and to other servers, so it takes a moment`);

package/web/app/admin-facade.mjs

@@ -120,7 +120,7 @@ export class AdminFacade {
             name: cfg.name || null, summary: cfg.summary || null, icon: cfg.icon || null,
             image: cfg.image || null, fields: cfg.fields || [],
             aliases: cfg.aliases || [],
-            autoAcceptFollows: !!cfg.autoAcceptFollows,
+            autoAcceptFollows: cfg.autoAcceptFollows !== false,
             hasUiPassword: !!cfg.uiPassword,
             quiescedAt: cfg.quiescedAt || null, movedTo: cfg.movedTo || null,
             mode: a.status().mode,

package/web/app/agent.mjs

@@ -13,7 +13,6 @@ import { findAccount } from '../../lib/core/place.mjs';
 import * as containers from '../../lib/pod/containers.mjs';
 import * as podState from '../../lib/pod/state.mjs';
 import { PodStore } from '../../lib/core/store.mjs';
-import { HttpStorage } from '../../lib/core/storage.mjs';
 import { Publisher } from '../../lib/core/publisher/index.mjs';
 import { Intake } from '../../lib/core/intake/index.mjs';
 import { C2S } from '../../lib/client/c2s.mjs';
@@ -34,7 +33,8 @@ import { AcctFeed } from '../../lib/connections/acctfeed.mjs';
 import { followActor, unfollowActor, resolveHandle } from '../../lib/core/social.mjs';
 import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { ImportWorker } from '../../lib/connections/import.mjs';
-import { openCopy, copyStorage, copyLeaseOf, moveIntoCopy, leaveCopy, renewCopyToken, standDown, ensureCopyLease, handOverCopy, forgetFailedOpen } from './copy-mode.mjs';
+import { openCopy, copyStorage, copyLeaseOf, moveIntoCopy, leaveCopy, renewCopyToken, standDown, ensureCopyLease, handOverCopy, forgetFailedOpen,
+  podStorageOf, fencePod, followHold } from './copy-mode.mjs';
 
 // The authorities this identity answers on: exactly one, this origin. The Node
 // agent gets this from lib/guard.mjs, which is not in the browser bundle and
@@ -129,13 +129,19 @@ export class BrowserAgent {
 
   configured() { return !!this.store?.getConfig(); }
 
+  // Whether the gateway acts on this account's state too: its copy there, or
+  // with the gateway's hold off, its pod (copy-mode.mjs). An action here then
+  // makes sure of the lease first (requestTakeover).
+  get sharesState() { return !!(this.copy || this._fenced); }
+
   // Asked by every write / destructive path before it acts. If we already hold
   // the lease, proceed. If we are a viewer, the owner acting HERE outranks the
   // idle active device: claim the lease outright and become active.
   async requestTakeover() {
-    // Working from the copy, an app at the gateway may have taken the lease
-    // since this browser last looked: asked now, before acting (copy-mode.mjs).
-    if (!this.viewer && this.copy) await ensureCopyLease(this);
+    // Working from the copy, or on the pod with the hold off, an app at the
+    // gateway may have taken the lease since this browser last looked: asked
+    // now, before acting (copy-mode.mjs).
+    if (!this.viewer && this.sharesState) await ensureCopyLease(this);
     if (!this.viewer) return true;
     if (!(await this.lease.takeover())) return false;
     clearTimeout(this._viewerTimer); this._viewerTimer = null;
@@ -182,6 +188,7 @@ export class BrowserAgent {
       const said = await this.tellGateway('keeper', { handle: this.doorKey, on: false });
       if (said?.status !== 200) return said || { status: 502 };
       this._keeper.kept = false;
+      fencePod(this);
       if (this.masto) this.masto.scheduling = false;
     }
     this.remote.keepers = on ? [webId] : [];
@@ -194,6 +201,7 @@ export class BrowserAgent {
       // A copy that could not be had while the account was not kept may be now.
       await forgetFailedOpen(this, this.frontOrigin);
       this._keeper.kept = true;
+      fencePod(this);
       if (this.masto) this.masto.scheduling = true;
       this.log('the gateway keeps this account running while the app is closed');
     }
@@ -211,6 +219,10 @@ export class BrowserAgent {
   async hereAtGateway() {
     const said = await this.tellGateway('here', { handle: this.doorKey, nextAt: this.store ? nextDue(this.store) : null });
     if (said?.status === 200) saveMeta(this.webId, { hereAt: Date.now() }).catch(() => {});
+    // The gateway's admin may have turned the hold off or on (copy-mode.mjs).
+    if (said?.status === 200 && typeof said.hold === 'boolean') {
+      await followHold(this, this.frontOrigin, said.hold).catch((e) => this.log(`the gateway's hold: ${e.message}`));
+    }
     return said;
   }
 
@@ -244,9 +256,10 @@ export class BrowserAgent {
     // Reading here is being here: the gateway hears so once an hour.
     clearInterval(this._openTimer);
     this._openTimer = setInterval(() => { this.checkInAtGateway(); }, BrowserAgent.OPEN_EVERY_MS);
-    // Working from the copy, an app at the gateway takes the lease only while
-    // it acts, and this browser takes it back (copy-mode.mjs).
-    this.lease.onLost = () => (this.copy ? standDown(this) : this.demote());
+    // Working from the copy, or on the pod with the hold off, an app at the
+    // gateway takes the lease only while it acts, and this browser takes it
+    // back (copy-mode.mjs).
+    this.lease.onLost = () => (this.sharesState ? standDown(this) : this.demote());
     this.lease.startRenewal();
     try {
       // Forced, not revalidated, when this device WATCHED first: the active
@@ -441,7 +454,8 @@ export class BrowserAgent {
     // the deletion deny-list that every other write on this agent observes.
     // The Node agent has always passed remote.fetch here.
     const podFetch = (u, i) => this.remote.fetch(u, i);
-    const podStateStorage = new HttpStorage(this.urls.state, podFetch);
+    // Fenced once the gateway is known to act on the pod too (fencePod below).
+    const podStateStorage = podStorageOf(this);
     this.store = new PodStore({ storage: this.copy ? copyStorage(this, podStateStorage) : podStateStorage, log: this.log });
     keepInStep(this.store, webId, this.log);
     // Single-active-agent lease (lib/lease.mjs): the inbox drain is a
@@ -545,8 +559,11 @@ export class BrowserAgent {
     // The gateway's own pod identity, when it can act for this account while
     // the app is closed (lib/gateway/keeper.mjs). Unless the owner turned that
     // off, every rule this agent writes names it beside the owner.
-    this._keeper = standing?.keeper ? { webId: standing.keeper, kept: !!standing.kept, keptBy: standing.keptBy || null } : null;
+    // `hold`: whether it keeps a copy of the account at all (copy-mode.mjs).
+    this._keeper = standing?.keeper
+      ? { webId: standing.keeper, kept: !!standing.kept, keptBy: standing.keptBy || null, hold: standing.hold !== false } : null;
     if (this._keeper && !this.store.getConfig()?.keeperOff) this.remote.keepers = [this._keeper.webId];
+    fencePod(this);
 
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,