fedipod 1.45.0 → 1.48.0

package/README.md

@@ -5,8 +5,9 @@
 FediPod gives you a Fediverse account whose data lives on a Solid pod. You
 follow people on Mastodon, Bluesky, and other Fediverse or ATProto servers in
 one timeline. Your posts, followers and settings are kept on your pod. While fedipod.net
-keeps your account running, it works from a copy of them and writes it to your
-pod every fifteen minutes; your signing key never leaves your pod.
+keeps your account running, it works from a copy of them, and every fifteen
+minutes it writes that copy to your pod and deletes it; your signing key never
+leaves your pod.
 
 The easiest way to run FediPod is to use it in any browser at https://fedipod.net. Nothing to install. Sign-up points you to a pod provider if you need a pod, then attaches a Fediverse identity to the pod you sign in with.
 
@@ -109,14 +110,6 @@ there it takes over; the first drops back to reading.
 
 ## What the browser version does not do
 
-- **Scheduled posts, if you stop fedipod.net keeping your account running.**
-  It does by default, and publishes them while FediPod is closed. Turned off
-  on the manage page, nothing runs between now and the time you picked, so
-  the composer refuses one rather than dropping it later.
-- **Notifications, and other clients, if you stop fedipod.net keeping your
-  account running.** While it does (the default), any Mastodon app, phone or
-  desktop, can use your account with `fedipod.net` as its server, and an app
-  that offers notifications gets them on your phone with everything closed.
 - **Live updates.** The client refreshes by polling.
 - **Hosting a group.** Joining one works.
 
@@ -128,9 +121,11 @@ Everything you publish and everything you read is stored on your pod. Your
 signing key is stored there too, in a container only you can read through
 your pod's login.
 While fedipod.net keeps your account running, its own pod identity can read
-that container too, so it can act for you while FediPod is closed, and it
-works from a copy of your account's data that it writes back to your pod every
-fifteen minutes. Your key stays on your pod only.
+that container too, so it can act for you while FediPod is closed. It works
+from a copy of your account's data, and every fifteen minutes it writes that
+copy to your pod and deletes it, so none of your data stays at fedipod.net
+longer than that. The next time anything needs your account, the copy is made
+again from your pod. Your key stays on your pod only.
 It all lives in the `fedipod` container you chose at sign-up. Your pod's
 public type index records it, as an ActivityStreams actor, which is how
 FediPod and other Solid apps find your account again.
@@ -142,11 +137,11 @@ not change.
 
 ## Other ways to use FediPod
 
-- [fediverse-session](lib/session/README.md) - an ESM library that supports both Solid-based and regular Fediverse accounts with methods to login, reply, boost, etc.
-- [FediPod Server](packages/fedipod-server/README.md): a full ActivityPub
+- [fediverse-session](https://github.com/jeff-zucker/fediverse-session) - an ESM library that supports both Solid-based and regular Fediverse accounts with methods to login, reply, boost, etc.
+- [FediPod Server](https://github.com/jeff-zucker/fedipod-server): a full ActivityPub
   server as a Community Solid Server component, giving every pod on the server
   the option of a Fediverse account.
-- [FediPod BB](packages/fedipod-bb/README.md) - A Lemmy-like  bulletin board forum with the structure stored on a group pod and users' data stored on their own pod or on their Fediverse server if they don't have a pod.
+- [FediPod BB](https://github.com/jeff-zucker/fedipod-bb) - A Lemmy-like  bulletin board forum with the structure stored on a group pod and users' data stored on their own pod or on their Fediverse server if they don't have a pod.
 - [FediPod DeviceAgent](device-agent.md) a single-user AP server that lives partly in a gateway, partly on a local device, with all data stored on your pod.
 - [FediPod Groups](groups.md): hosting a discussion group of Fediverse and Bluesky users from a pod.
 - [FediPod Gateway](gateway.md): A thin, always-on door running on Netlify or any small host that provides a middleman between a pod and the single-user agents. (only needed with `BrowserAgent` and `DeviceAgent`)

package/architecture.md

@@ -21,10 +21,13 @@ account's agent whenever FediPod is closed, under a pod identity of its own
 that the owner's rules name, reading the signing key from the pod when it
 needs it. The account's state documents live in a working copy at the
 gateway, which FediPod in the browser, the gateway and any Mastodon app all
-work from, and which the gateway writes to the pod every fifteen minutes. See
-[the gateway](gateway.md).
+work from. Every fifteen minutes the gateway writes the copy to the pod and
+deletes it, and makes it again from the pod when something next needs it (the
+hold). A gateway's admin may turn the hold off: then there is no copy, and
+everything works on the pod, the browser and the gateway taking turns by the
+pod's lease. See [the gateway](gateway.md).
 
-[FediPod Server](packages/fedipod-server/README.md) puts the agent inside a
+[FediPod Server](https://github.com/jeff-zucker/fedipod-server) puts the agent inside a
 Community Solid Server, so anyone with a pod on that server can opt in to a
 Fediverse account fed by the server itself.
 

package/gateway.md

@@ -15,7 +15,7 @@ yours, which your agent then signs and sends. It still holds no key, but what yo
 trust it with grows by that much. A browser account is also kept running by
 the gateway (below). That gives the gateway your key while it works, so it can
 post as you, as any Fediverse server can, and your account's working data is
-kept at the gateway too and written to your pod every fifteen minutes. For
+held at the gateway while it works, for at most fifteen minutes at a time. For
 a kept account the gateway also answers a follower's server asking for one
 of your followers-only posts, and the named person's server asking for a
 direct one, when that server signs its request; nobody else gets them.
@@ -174,28 +174,57 @@ closed, fedipod.net does two things for it.
 your pod one by one, and reach your pod in batches of up to a hundred: when you
 open FediPod, or every fifteen minutes otherwise. While FediPod is open, mail
 goes straight to your pod as before. A DeviceAgent's mail always goes straight
-to its pod.
+to its pod. On a gateway whose admin has turned the hold off (below), mail
+always goes straight to your pod.
 
-**The gateway keeps your account running.** Unless you turn it off, the
-gateway accepts your follows, tries again what failed to go out, and publishes
-the posts you scheduled, all while FediPod is closed. Other mail waits on your
+**The gateway keeps your account running.** It accepts your follows, tries
+again what failed to go out, and publishes the posts you scheduled, all while FediPod is closed. Other mail waits on your
 pod for FediPod to open, as before. It works under its own pod identity, which your app
 names in the access rules on your FediPod folder. It reads your signing key
 from your pod when it needs it, so it can post as you, and keeps no copy of the
-key. **Stop keeping it running** on the manage page takes it out of the rules.
-If fedipod.net ever changes its own pod identity, your FediPod moves your
+key. If fedipod.net ever changes its own pod identity, your FediPod moves your
 account over the next time you open it, with nothing for you to do.
 Scheduling a post is offered only while this is on, because otherwise nothing
 would be running when the time came.
 
-**Your account's working data is kept at the gateway.** While the gateway
-keeps your account running, your timeline, notifications, followers, settings
-and the rest of your FediPod state are kept at fedipod.net, and FediPod in your
-browser, the gateway and any app you use all work from that one copy, so they
-never disagree. fedipod.net writes what changed to your pod every fifteen
-minutes, and everything at once when you stop it keeping your account running,
-move your address or close it. Your signing key and the passwords of accounts
-you connected elsewhere are never in the copy; they stay on your pod only.
+**Your account's working data is held at the gateway for at most fifteen
+minutes.** While the gateway keeps your account running, FediPod in your
+browser, the gateway and any app you use all work from one copy of your
+timeline, notifications, followers, settings and the rest of your FediPod
+state, made at fedipod.net from your pod, so they never disagree. Every
+fifteen minutes, whatever is happening, fedipod.net writes that copy to your
+pod and deletes it. The next time anything needs your account (FediPod, an
+app, or the gateway's own work while you're away), the copy is made again from
+your pod. You don't notice, except that an app's first check after a deletion
+can take a few seconds longer. When your address moves or is closed, the copy
+goes to your pod at once. Your signing key and the passwords of accounts you
+connected elsewhere are never in the copy; they stay on your pod only.
+
+## The hold, for a gateway's admin
+
+Whoever runs a gateway decides whether it holds copies of accounts at all,
+with one setting, `FEDIPOD_HOLD` ([netlify/README.md](netlify/README.md)).
+
+- **On**, the default and fedipod.net's choice: as above. Mail waits at the
+  gateway for up to fifteen minutes, and each account's copy is written to its
+  pod and deleted every fifteen minutes.
+- **Off**: the gateway keeps no copy of anyone's account and holds no mail.
+  Mail goes straight to the pod as it arrives, an app's every check reads the
+  pod, and FediPod in the browser works on the pod, taking turns with the
+  gateway when an app acts. None of anyone's mail, timeline or direct messages
+  is ever stored at the gateway. It costs more: roughly two to four times the
+  gateway's hosting per account, and about ten times the requests on each pod.
+  Apps are slower, and on a pod provider that limits traffic they can show
+  errors at busy times.
+
+A change takes effect within fifteen minutes. Off to on: an account's copy is
+made the next time anything uses it. On to off: every copy is written to its
+pod and deleted, at the next round, or by FediPod itself within five minutes
+where it is open, so nothing it is writing is lost.
+
+Either way the gateway keeps app sign-ins (as fingerprints), phone-notification
+sign-ups, each account's record (with its door secret), the time an account's
+next scheduled post is due, and public copies of posts for up to an hour.
 
 ## Using any Mastodon app
 
@@ -204,7 +233,8 @@ elk.zone, Ivory, Tusky, Phanpy and the rest. In the app, give `fedipod.net` as
 your server. The app sends you to a fedipod.net page that asks for your
 Fediverse address or your WebID and signs you in at your own pod; no password
 is typed on fedipod.net. The app then reads your timeline and notifications from your
-account's copy at the gateway, and posts, boosts, likes and follows as you.
+account's copy at the gateway (from your pod, on a gateway with the hold off),
+and posts, boosts, likes and follows as you.
 
 An app checks for new posts every minute or so while it is open; there are no
 live updates. Accounts are made on the fedipod.net front page, with a pod, not
@@ -226,13 +256,11 @@ about each browser account — when its owner last signed in or posted, and
 how much content has arrived since — and acts on them.
 
 **Paused.** After about 5,000 posts, replies, likes, boosts and edits since
-you were last here, or when you say so on the manage page, the door accepts
-content and discards it. Follows, unfollows, account moves, deletions and
-blocks still reach your pod. Signing in ends an automatic pause by itself; a
-pause you set lasts until you lift it.
+you were last here, the door accepts content and discards it. Follows,
+unfollows, account moves, deletions and blocks still reach your pod. Signing
+in ends the pause.
 
-**Closed.** After six months without a sign-in, or when you say so on the
-manage page, the address is closed for good: its handle, its actor and its
+**Closed.** After six months without a sign-in, the address is closed for good: its handle, its actor and its
 door answer 410 Gone, other servers drop the account the next time they look,
 and nobody can take the name. Nothing on your pod is touched. An address that
 had already moved to another gateway keeps answering as moved.
@@ -280,7 +308,7 @@ Two ways are ready to use:
   [netlify/README.md](netlify/README.md) for the deployment specifics.
 - **On any box of your own**, with your own adapter around the same core.
 - **Inside a Community Solid Server**, as the same door run in-process by the
-  CSS component — see [packages/fedipod-server](packages/fedipod-server/README.md).
+  CSS component — see [fedipod-server](https://github.com/jeff-zucker/fedipod-server).
 
 ### Offering accounts to other people
 

package/gui.md

@@ -97,8 +97,9 @@ is marked **sign in again** rather than quietly dropped.
 
 ## Handling follow requests
 
-New followers appear under **Follow requests** with **Accept** and **Refuse**
-beside them; nothing is accepted without you.
+New followers are accepted automatically. Set **new followers** to *wait for
+approval* and they appear under **Follow requests** instead, with **Accept**
+and **Refuse** beside them; nothing is accepted without you.
 They show in any Mastodon client as well, now that the client API serves the
 queue and takes both answers.
 Groups are different — joining

package/lib/client/c2s.mjs

@@ -260,7 +260,8 @@ export class C2S {
     // A viewer (another agent holds the lease) may not act — but the user
     // acting HERE outranks an idle active agent elsewhere, exactly as on the
     // facade: a write attempt claims the lease, and only a failed claim 503s.
-    if (this.agent.viewer) {
+    // So does an agent whose state its gateway acts on too (sharesState).
+    if (this.agent.viewer || this.agent.sharesState) {
       const took = await this.agent.requestTakeover?.();
       if (!took) return this.send(res, 503, { error: 'another agent is active for this pod — takeover failed, try again' });
     }

package/lib/client/masto/index.mjs

@@ -149,10 +149,11 @@ export class MastoApi {
     // A viewer-mode agent (another agent holds the drain lease) may not act —
     // but a user acting HERE outranks the idle active agent elsewhere, so a
     // write attempt claims the lease and proceeds. Only a failed claim 503s.
-    // An agent working from a copy its gateway shares (the browser build,
-    // web/app/copy-mode.mjs) asks every time, since an app at the gateway may
-    // have taken the lease without it hearing yet.
-    if ((this.agent.viewer || this.agent.copy) && req.method !== 'GET' && req.method !== 'HEAD') {
+    // An agent whose state its gateway acts on too — its copy there, or with
+    // the gateway's hold off, its pod (the browser build, web/app/copy-mode.mjs)
+    // — asks every time, since an app at the gateway may have taken the lease
+    // without it hearing yet.
+    if ((this.agent.viewer || this.agent.sharesState) && req.method !== 'GET' && req.method !== 'HEAD') {
       const took = await this.agent.requestTakeover?.();
       if (!took) return send(503, { error: 'another agent is active for this pod — takeover failed, try again' });
     }

package/lib/client/masto/render.mjs

@@ -4,6 +4,7 @@
 // the three actions that answer as a connected account rather than the pod
 // actor (a Bluesky reply, a connected-account reply, a like or boost there).
 
+import { totalsFor } from '../../core/intake/counts.mjs';
 import * as social from '../../core/social.mjs';
 import { sanitizeHtml, followsNeedApproval, publicHandle } from '../../core/wire.mjs';
 import { profileUrl, postUrl } from '../../connections/bskyfeed.mjs';
@@ -265,6 +266,8 @@ export function quoteApproval(api, s) {
 
 export function status(api, s, { all, depth = 0 } = {}) {
   const replies = (all || api.store.getStatuses()).filter(x => x.inReplyTo === s.noteId).length;
+  // The owner's own posts: what others did to them. Zero for anyone else's.
+  const counted = totalsFor(api.store, s.noteId);
   return {
     id: api.store.idFor(s.noteId),
     created_at: s.published || new Date().toISOString(),
@@ -274,7 +277,7 @@ export function status(api, s, { all, depth = 0 } = {}) {
     visibility: s.visibility || 'public', language: null,
     edited_at: s.editedAt || null,
     uri: s.noteId, url: s.link || s.noteId,
-    replies_count: replies, reblogs_count: 0, favourites_count: 0,
+    replies_count: replies, reblogs_count: counted.shares, favourites_count: counted.likes,
     // True when ANY of the owner's accounts holds it. The flag is really
     // what the next tap will do: an empty star on a post one account has
     // already liked invites a second outward like from a second identity.

package/lib/core/intake/activities.mjs

@@ -2,6 +2,7 @@
 // from Intake.handle() after the sender passed the door checks, and returns a
 // rejection reason or nothing.
 
+import { withdrawReaction } from './counts.mjs';
 import { dropFollower } from '../store.mjs';
 import { emojisOf, pollOf, isContentType, trimActivity, reactionOf, quoteOf, quotePolicyOf, authorOf } from './activity.mjs';
 
@@ -40,20 +41,17 @@ export async function onFollow(intake, activity, actor, { trusted = false } = {}
   // anyone at all, and we would sign an Accept, deliver it to that person,
   // and send them everything published from then on.
   //
-  // Until deliveries terminate somewhere their signature survives, a follow
-  // we cannot verify is a REQUEST, waiting in the same queue a gated group
-  // uses. The requester's client shows "Requested", which is the ordinary
-  // locked-account state that manuallyApprovesFollowers tells it to expect.
-  // `autoAcceptFollows: true` in config restores the old behaviour.
-  // A GROUP is left alone: `approveJoins: false` is its operator saying, in
-  // as many words, that anyone may join, and mute/eject are the remedy there.
-  // A person has no such setting, so this is their default.
+  // A person who set `autoAcceptFollows: false` sees such a follow as a
+  // REQUEST, waiting in the same queue a gated group uses; the requester's
+  // client shows "Requested", the locked-account state manuallyApprovesFollowers
+  // tells it to expect. Otherwise it is accepted, as a group's is:
+  // `approveJoins: false` is its operator saying anyone may join.
   //
   // A gateway-verified Follow (trust mode) is no longer unverifiable — the
   // door proved the sender — so it does not need the OK that unverifiability
   // alone demanded. An explicit `approveJoins` still holds: verified or not,
   // the operator asked to see joins.
-  const unverifiedNeedsOk = intake.config.kind !== 'group' && !intake.config.autoAcceptFollows && !trusted;
+  const unverifiedNeedsOk = intake.config.kind !== 'group' && intake.config.autoAcceptFollows === false && !trusted;
   const mustApprove = intake.config.approveJoins || unverifiedNeedsOk;
   if (mustApprove && !existing) {
     const reqs = intake.store.getRequests();
@@ -319,6 +317,7 @@ export async function onUndoReaction(intake, inner, actor, { trusted = false } =
     const type = inner.type === 'Like' ? 'favourite' : 'reblog';
     const gone = intake.store.removeNotifications(n => n.type === type && n.actor === actor && n.noteId === objectId);
     if (gone) intake.log(`${inner.type} withdrawn by ${actor} on ${objectId}`);
+    withdrawReaction(intake.store, inner.type, objectId, actor);
     return;
   }
   if (inner.type !== 'Announce') return;

package/lib/core/intake/counts.mjs

@@ -0,0 +1,143 @@
+// counts.mjs — how many liked and boosted each of the owner's posts, and the
+// totals on the post itself (ActivityPub §5.7, §5.8), so a server showing the
+// post shows its real numbers instead of none.
+//
+// Who liked is kept here, in state, only to tell a repeat from a new one and
+// to take back the right one on an Undo; the post says the total and names
+// nobody. Past MAX_NAMED on one post the total still grows, but a repeat by
+// someone past the cap can no longer be told apart.
+//
+// The first sweep that finds no totals kept starts them from the account's
+// notifications, which hold its recent likes and boosts; older ones are gone.
+//
+// The post is rewritten once per sweep for every post whose totals changed,
+// and only over the version it was read at: an edit or a deletion made in
+// between wins, and the totals are written on a later sweep. The posts left
+// to rewrite are kept in state, so a restart does not lose them.
+
+import * as podNotes from '../../pod/notes.mjs';
+import * as wire from '../wire.mjs';
+
+export const MAX_NAMED = 1000;
+export const MAX_POSTS = 2000;
+export const REWRITES_PER_SWEEP = 20;
+const COUNTS = 'counts.json';
+const KIND = { Like: 'likes', Announce: 'shares' };
+const MORE = { likes: 'moreLikes', shares: 'moreShares' };
+
+const load = (store) => {
+  const st = typeof store?.read === 'function' ? store.read(COUNTS, null) : null;
+  return st && typeof st === 'object' && st.posts && typeof st.posts === 'object'
+    ? { posts: st.posts, dirty: Array.isArray(st.dirty) ? st.dirty : [] }
+    : { posts: {}, dirty: [] };
+};
+
+const totals = (p) => ({
+  likes: (p?.likes?.length || 0) + (p?.moreLikes || 0),
+  shares: (p?.shares?.length || 0) + (p?.moreShares || 0),
+});
+
+/** The totals for one post. Zero for a post nobody liked or boosted. */
+export function totalsFor(store, noteId) {
+  // Read without a copy: the Mastodon API asks this for every post it lists.
+  const st = store?.cache?.get?.(COUNTS) ?? store?.read?.(COUNTS, null);
+  return totals(st?.posts?.[noteId]);
+}
+
+function save(store, st, noteId) {
+  if (typeof store?.write !== 'function') return;
+  if (noteId && !st.dirty.includes(noteId)) st.dirty.push(noteId);
+  const ids = Object.keys(st.posts);
+  if (ids.length > MAX_POSTS) {
+    // The posts touched longest ago go first.
+    ids.sort((a, b) => String(st.posts[a].at || '').localeCompare(String(st.posts[b].at || '')));
+    for (const id of ids.slice(0, ids.length - MAX_POSTS)) delete st.posts[id];
+    st.dirty = st.dirty.filter(id => st.posts[id]);
+  }
+  store.write(COUNTS, st);
+}
+
+/** A Like or an Announce of one of the owner's posts. True when a total changed. */
+export function recordReaction(store, type, noteId, actor) {
+  const kind = KIND[type];
+  if (!kind || !noteId || !actor) return false;
+  const st = load(store);
+  const p = st.posts[noteId] || { likes: [], shares: [] };
+  const named = p[kind] || [];
+  if (named.includes(actor)) return false;
+  if (named.length >= MAX_NAMED) p[MORE[kind]] = (p[MORE[kind]] || 0) + 1;
+  else p[kind] = [...named, actor];
+  p.at = new Date().toISOString();
+  st.posts[noteId] = p;
+  save(store, st, noteId);
+  return true;
+}
+
+/** An Undo of one. True when a total changed. */
+export function withdrawReaction(store, type, noteId, actor) {
+  const kind = KIND[type];
+  if (!kind || !noteId || !actor) return false;
+  const st = load(store);
+  const p = st.posts[noteId];
+  if (!p) return false;
+  const named = p[kind] || [];
+  if (named.includes(actor)) p[kind] = named.filter(a => a !== actor);
+  else if (p[MORE[kind]] > 0) p[MORE[kind]] -= 1;
+  else return false;
+  p.at = new Date().toISOString();
+  save(store, st, noteId);
+  return true;
+}
+
+/** A deleted post keeps no totals. */
+export function forgetCounts(store, noteId) {
+  const st = load(store);
+  if (!st.posts[noteId] && !st.dirty.includes(noteId)) return;
+  delete st.posts[noteId];
+  st.dirty = st.dirty.filter(id => id !== noteId);
+  save(store, st, null);
+}
+
+// Totals from before they were kept: the likes and boosts still in the
+// notifications. Runs once, the first time there are no totals at all.
+function seed(intake) {
+  const { store } = intake;
+  if (typeof store?.read !== 'function' || store.read(COUNTS, null)) return;
+  const notes = intake.urls?.notes;
+  const all = typeof store.getNotifications === 'function' ? store.getNotifications() : [];
+  for (const n of [...all].reverse()) {                    // oldest first, as they arrived
+    if (!notes || !String(n?.noteId || '').startsWith(notes)) continue;
+    if (n.type === 'favourite') recordReaction(store, 'Like', n.noteId, n.actor);
+    else if (n.type === 'reblog') recordReaction(store, 'Announce', n.noteId, n.actor);
+  }
+  if (!store.read(COUNTS, null)) store.write(COUNTS, { posts: {}, dirty: [] });
+}
+
+/**
+ * Write the changed totals onto the posts. Returns how many posts were
+ * rewritten. A post the pod no longer has, or has as a Tombstone, is dropped.
+ */
+export async function publishCounts(intake) {
+  seed(intake);
+  const st = load(intake.store);
+  if (!st.dirty.length) return 0;
+  const left = [];
+  let wrote = 0;
+  for (const noteId of st.dirty.slice(0, REWRITES_PER_SWEEP)) {
+    try {
+      const { doc, version } = await podNotes.readVersioned(intake.remote, noteId);
+      if (!doc || typeof doc !== 'object' || !doc.id || doc.type === 'Tombstone') { delete st.posts[noteId]; continue; }
+      const t = totals(st.posts[noteId]);
+      const next = { ...doc, ...wire.reactionCounts(t.likes, t.shares) };
+      if (JSON.stringify([next.likes, next.shares]) === JSON.stringify([doc.likes, doc.shares])) continue;
+      if (await podNotes.writeIfUnchanged(intake.remote, doc.id, next, version)) wrote++;
+      else left.push(noteId);            // changed under us: the next sweep reads it again
+    } catch (e) {
+      intake.log?.(`like and boost totals for ${noteId}: ${e.message}`);
+      left.push(noteId);
+    }
+  }
+  st.dirty = [...left, ...st.dirty.slice(REWRITES_PER_SWEEP)].filter(id => st.posts[id]);
+  intake.store.write(COUNTS, st);
+  return wrote;
+}

package/lib/core/intake/index.mjs

@@ -29,6 +29,7 @@ import * as channel from './channel.mjs';
 import * as verify from './verify.mjs';
 import * as group from './group.mjs';
 import * as received from './received.mjs';
+import * as counts from './counts.mjs';
 import * as activities from './activities.mjs';
 import * as notes from './notes.mjs';
 import { readLenient } from '../as2.mjs';
@@ -188,6 +189,8 @@ export class Intake {
     this._draining = this._drainOnce().finally(async () => {
       this._inSweep = false;
       await this._publishPending();
+      // Likes and boosts this sweep took, onto the posts: one write per post.
+      await counts.publishCounts(this).catch((e) => this.log(`like and boost totals: ${e.message}`));
       this.store.release?.();
       this._draining = null;
       if (this._drainAgain) {
@@ -767,6 +770,7 @@ export class Intake {
             type: activity.type === 'Like' ? 'favourite' : 'reblog', actor, noteId: objectId,
             ...(this.known(actor) ? {} : { unverified: true }),
           });
+          counts.recordReaction(this.store, activity.type, objectId, actor);   // §5.7, §5.8
           return;
         }
         if (activity.type === 'Announce') return this.onAnnounce(activity, actor, objectId);

package/lib/core/publisher/notes.mjs

@@ -7,6 +7,7 @@ import * as wire from '../wire.mjs';
 import * as wireQuotes from '../wire-quotes.mjs';
 import * as containers from '../../pod/containers.mjs';
 import * as podNotes from '../../pod/notes.mjs';
+import { totalsFor } from '../intake/counts.mjs';
 
 // Media container on the remote pod — public-Read like notes, created lazily
 // at first upload (idempotent; the flag only saves round-trips).
@@ -177,7 +178,7 @@ export async function noteToSelf(publisher, text) {
 // What the object is, who made it and when, where it lives and who it is
 // addressed to stay as they are, and so do a poll's choices and its count.
 const FIXED = new Set(['@context', 'id', 'type', 'attributedTo', 'published', 'to', 'cc', 'bto', 'bcc',
-  'audience', 'oneOf', 'anyOf', 'endTime', 'closed', 'votersCount', 'replies']);
+  'audience', 'oneOf', 'anyOf', 'endTime', 'closed', 'votersCount', 'replies', 'likes', 'shares']);
 export async function updateObject(publisher, s, patch, { updated = new Date().toISOString() } = {}) {
   const { urls } = publisher;
   const doc = await podNotes.read(publisher.remote, s.noteId);
@@ -485,6 +486,7 @@ export async function updateNote(publisher, s, { content, spoilerText = null, se
     summary: spoilerText, sensitive: sensitive ?? !!s.sensitive, updated, container,
     also: [...new Set([...(s.named || []), ...(reply ? [reply.actor] : [])])],
     quote: rowQuote(s),
+    ...totalsFor(publisher.store, s.noteId),
   });
   await podNotes.write(publisher.remote, note.id, note);
   await podNotes.writeCreate(publisher.remote, wire.createActivityId(note.id), wire.createActivity(note, urls));
@@ -537,6 +539,7 @@ async function restateNote(publisher, s, { quote }) {
     summary: s.spoiler || null, sensitive: !!s.sensitive, updated: s.editedAt || null, container,
     also: [...(reply ? [reply.actor] : []), ...(s.quoteRequest?.actor ? [s.quoteRequest.actor] : [])],
     quote,
+    ...totalsFor(publisher.store, s.noteId),
   });
   await podNotes.write(publisher.remote, note.id, note);
   await podNotes.writeCreate(publisher.remote, wire.createActivityId(note.id), wire.createActivity(note, urls));

package/lib/core/social.mjs

@@ -3,6 +3,7 @@
 // the activity and mirrors state into the store; the store keeps the
 // activity a later Undo must name.
 
+import { forgetCounts } from './intake/counts.mjs';
 import crypto from 'node:crypto';
 import * as wire from './wire.mjs';
 import * as podNotes from '../pod/notes.mjs';
@@ -424,6 +425,7 @@ export async function deleteNote(agent, s) {
   }
   // Empty, and referenced by nothing once the note is gone.
   await podNotes.dropReplies(agent.remote, wire.repliesId(s.noteId));
+  forgetCounts(agent.store, s.noteId);
 
   // The Bluesky mirror goes with the post. Best-effort: a mirror the far side
   // already lost is not a reason to keep the post here.

package/lib/core/storage.mjs

@@ -177,21 +177,31 @@ export { podOnly };
  * An account's state kept at its gateway, reached through the gateway's state
  * API (lib/gateway/state-api.mjs) with the token it handed out. `holder` is
  * this agent's lease id: the gateway takes a write only from the lease's
- * holder, and `onRefused` hears when it would not. What stays on the pod is
- * read and written on `pod`.
+ * holder, and `onRefused` hears when it would not. `onGone` hears when the
+ * gateway keeps no copy of the account any more and will make none. What
+ * stays on the pod is read and written on `pod`.
  */
 export class StateApiStorage {
-  constructor(base, { fetchImpl = globalThis.fetch, token, holder, pod = null, onRefused = null }) {
+  constructor(base, { fetchImpl = globalThis.fetch, token, holder, pod = null, onRefused = null, onGone = null }) {
     this.base = slash(base);
     this.fetchImpl = fetchImpl;
     this.token = token;
     this.holder = holder;
     this.pod = pod;
     this.onRefused = onRefused;
+    this.onGone = onGone;
   }
 
   get kind() { return 'copy'; }
 
+  async _gone(res) {
+    if (res.status !== 404 || !this.onGone) return false;
+    const said = await res.clone().json().catch(() => null);
+    if (!said?.gone) return false;
+    this.onGone();
+    return true;
+  }
+
   _ask(p, init = {}) {
     return this.fetchImpl(this.base + encodeURIComponent(p), {
       ...init, headers: { authorization: `Bearer ${this.token}`, ...(init.headers || {}) },
@@ -202,7 +212,7 @@ export class StateApiStorage {
     if (sub) return { notModified: false, names: [], etag: null };
     const res = await this._ask('', { headers: etag ? { 'if-none-match': etag } : {} });
     if (res.status === 304) return { notModified: true, names: null, etag };
-    if (res.status >= 400) throw new Error(`the account's copy at the gateway is unreadable (HTTP ${res.status})`);
+    if (res.status >= 400) { await this._gone(res); throw new Error(`the account's copy at the gateway is unreadable (HTTP ${res.status})`); }
     const { names } = await res.json();
     return { notModified: false, names, etag: res.headers.get('etag') };
   }
@@ -211,7 +221,7 @@ export class StateApiStorage {
     if (podOnly(p)) return this.pod ? this.pod.read(p, opts) : { ok: false, notModified: false, status: 404, body: null, etag: null };
     const res = await this._ask(p, { headers: opts.etag ? { 'if-none-match': opts.etag } : {} });
     if (res.status === 304) return { ok: true, notModified: true, status: 304, body: null, etag: opts.etag };
-    if (res.status >= 400) return { ok: false, notModified: false, status: res.status, body: null, etag: null };
+    if (res.status >= 400) { await this._gone(res); return { ok: false, notModified: false, status: res.status, body: null, etag: null }; }
     return { ok: true, notModified: false, status: res.status, body: await res.text(), etag: res.headers.get('etag') };
   }
 
@@ -221,6 +231,7 @@ export class StateApiStorage {
       const res = await this._ask(p, { method: 'PUT', headers: { 'content-type': contentType, 'x-fedipod-holder': this.holder }, body });
       if (res.status < 400) return { ok: true, retry: false, why: '' };
       if (res.status === 409) { this.onRefused?.(); return { ok: false, retry: false, why: 'another agent holds this account now', lost: true }; }
+      if (await this._gone(res)) return { ok: false, retry: false, why: 'the gateway keeps no copy of this account now', lost: true };
       return { ok: false, retry: res.status >= 500 || res.status === 429, why: `HTTP ${res.status}`, retryAfterMs: 0 };
     } catch (e) {
       return { ok: false, retry: true, why: e.message, retryAfterMs: 0 };
@@ -232,11 +243,49 @@ export class StateApiStorage {
     try {
       const res = await this._ask(p, { method: 'DELETE', headers: { 'x-fedipod-holder': this.holder } });
       if (res.status === 409) { this.onRefused?.(); return false; }
+      if (await this._gone(res)) return false;
       return res.status < 400 || res.status === 404;
     } catch { return false; }
   }
 }
 
+/**
+ * A pod's state container that more than one agent may act on: the owner's
+ * browser, and the gateway acting for an app while the hold is off. With a
+ * `fence` set, every write first asks it whether this agent still holds the
+ * account, and a "no" is refused and told to `onRefused`, as the gateway's
+ * copy refuses a write from anyone but its lease's holder. Without one, it is
+ * the storage it wraps.
+ */
+export class FencedStorage {
+  constructor(inner, { fence = null, onRefused = null } = {}) {
+    this.inner = inner;
+    this.fence = fence;
+    this.onRefused = onRefused;
+  }
+
+  get kind() { return this.inner.kind; }
+  get base() { return this.inner.base; }
+  list(sub, opts) { return this.inner.list(sub, opts); }
+  read(p, opts) { return this.inner.read(p, opts); }
+
+  async _refused() {
+    if (!this.fence || await this.fence().catch(() => true)) return false;
+    this.onRefused?.();
+    return true;
+  }
+
+  async write(p, body, contentType) {
+    if (await this._refused()) return { ok: false, retry: false, why: 'another agent holds this account now', lost: true };
+    return this.inner.write(p, body, contentType);
+  }
+
+  async remove(p) {
+    if (await this._refused()) return false;
+    return this.inner.remove(p);
+  }
+}
+
 // `file:` (or a bare path) is a directory; anything else is a pod.
 export function storageFor(base, fetchImpl) {
   return /^https?:/i.test(base) ? new HttpStorage(base, fetchImpl) : new FileStorage(base);