fedipod 1.45.0 → 1.48.0

package/lib/gateway/masto-gateway.mjs

@@ -1,6 +1,7 @@
 // masto-gateway.mjs — Mastodon apps at the gateway's own address: elk.zone,
 // Ivory, Tusky or any other app, signed in to an account the gateway keeps
-// running, reading and writing it from its copy (copy.mjs).
+// running, reading and writing it from its copy (copy.mjs), made from the pod
+// when there is none while the hold is on; with the hold off, from the pod.
 //
 //   POST /api/v1/apps                   an app registers here, for every account
 //   GET  /oauth/authorize               sends the person to the sign-in page
@@ -20,7 +21,8 @@
 // browser sitting open, as one device does another — and reads the signing
 // key from the pod for that one request. Mail that arrived while nobody was
 // reading is read into the copy after an app's timeline or notification check
-// has been answered, at most every thirty seconds.
+// has been answered, at most every thirty seconds; with the hold off, the pod
+// inbox is drained then instead, unless FediPod is open and drains it itself.
 //
 // Phone notifications: an app signs up for them through the account's own
 // facade (/api/v1/push/subscription), with the one push key pair this gateway
@@ -37,10 +39,13 @@ import { PodStore } from '../core/store.mjs';
 import { apUrls } from '../core/wire.mjs';
 import { Publisher } from '../core/publisher/index.mjs';
 import { nextDue } from '../core/scheduled.mjs';
-import { reachAccount, stateAndLease, actingAgent } from './account-agent.mjs';
+import { reachAccount, settle, stateAndLease, actingAgent } from './account-agent.mjs';
 import { ensureCopy } from './state-api.mjs';
-import { CopyStorage, lockCopy, keptNow, keptBefore, GATEWAY_HOLDER } from './copy.mjs';
+import { CopyStorage, lockCopy, keptNow, keptBefore, holdOn, waitOutClosing, GATEWAY_HOLDER } from './copy.mjs';
+import { HttpStorage } from '../core/storage.mjs';
+import * as podInbox from '../pod/inbox.mjs';
 import { heldEntries } from './held-mail.mjs';
+import { noteOpened } from './quiet.mjs';
 import { Push } from '../client/webpush.mjs';
 import webpush from 'web-push';
 
@@ -196,19 +201,65 @@ class GatewayPush extends Push {
 // ---- the account behind a token ----
 
 // Loaded copies, kept while this running copy lives: a check that finds the
-// copy unchanged costs one listing, not every document.
-const reading = new Map();   // handle -> PodStore
+// copy unchanged costs one listing, not every document. With the hold off,
+// the pod's state, read the same way.
+const reading = new Map();   // handle (or pod:handle) -> PodStore
 const noAuthorities = { has: () => false, isLocalRequest: () => false, isLocal: () => false, wsAuthorities: () => [] };
 
-async function readingStore(ctx, handle, log) {
-  let store = reading.get(handle);
-  if (!store) {
-    store = new PodStore({ storage: new CopyStorage(ctx.copyKv, handle, { holder: GATEWAY_HOLDER }), log });
+// What an app reads: the copy, or with the hold off, the pod.
+const stateOf = (ctx, handle, at) => (at.inCopy
+  ? new CopyStorage(ctx.copyKv, handle, { holder: GATEWAY_HOLDER })
+  : new HttpStorage(at.urls.state, at.podFetch));
+
+async function readingStore(ctx, handle, at, log) {
+  const key = at.inCopy ? handle : `pod:${handle}`;
+  let held = reading.get(key);
+  if (!held) {
+    held = { store: new PodStore({ storage: stateOf(ctx, handle, at), log }) };
     if (reading.size > 200) reading.clear();
-    reading.set(handle, store);
+    reading.set(key, held);
   }
-  await store.load();
-  return store;
+  // This request's own sign-in at the pod; the same place, so what is held stays.
+  else held.store.attach(stateOf(ctx, handle, at));
+  held.at = Date.now();
+  await held.store.load();
+  return held.store;
+}
+
+// What this running copy remembers of an account, a loaded copy or an answer,
+// goes once nobody has asked for fifteen minutes, as the copy itself does
+// (copy.mjs: the hold).
+const MEMORY_MS = 15 * 60_000;
+function forgetOld(now = Date.now()) {
+  for (const [k, v] of reading) if (now - v.at > MEMORY_MS) reading.delete(k);
+  for (const [k, v] of answered) if (now - v.at > MEMORY_MS) { answeredBytes -= v.body.length; answered.delete(k); }
+}
+const forget = (handle) => { reading.delete(handle); reading.delete(`pod:${handle}`); };
+
+// An app's repeated check: while the copy's list of documents is as it was
+// and no mail waits, the same question gets the same answer, without opening
+// the copy. Ten minutes at most, for what changes with the clock alone (a
+// poll closing). Kept per token, while this running copy lives.
+const REPEAT_MS = 10 * 60_000;
+const REPEAT_MAX_BYTES = 32 * 1024 * 1024;
+const REPEATABLE = /^\/api\/v[12]\/(timelines\/[^/]+(\/[^/]+)?|notifications(\/unread_count)?|markers|conversations|follow_requests|announcements|accounts\/verify_credentials|lists|filters|preferences)$/u;
+const answered = new Map();   // handle, token hash and the question -> { tag, at, status, headers, body }
+let answeredBytes = 0;
+
+async function repeatAnswer(ctx, handle, key, at) {
+  const had = answered.get(key);
+  if (!had || Date.now() - had.at > REPEAT_MS) return null;
+  const listing = await stateOf(ctx, handle, at).list('', { etag: had.tag }).catch(() => ({ notModified: false }));
+  if (!listing.notModified) return null;
+  if (ctx.listHeld && (await ctx.listHeld(handle)).length) return null;
+  return { status: had.status, headers: { ...had.headers }, body: had.body };
+}
+
+function rememberAnswer(key, tag, status, headers, body) {
+  if (body.length > REPEAT_MAX_BYTES / 64) return;
+  if (answeredBytes + body.length > REPEAT_MAX_BYTES) { answered.clear(); answeredBytes = 0; }
+  answeredBytes += body.length - (answered.get(key)?.body.length || 0);
+  answered.set(key, { tag, at: Date.now(), status, headers, body });
 }
 
 // What an app reading needs of an agent: the store, the account's addresses
@@ -246,19 +297,31 @@ async function notePushSubs(ctx, handle, store) {
 }
 export async function pushWanted(ctx, handle) { return Number((await ctx.mastoKv?.get(`push/${handle}`))?.text || 0) > 0; }
 
+// With the hold off, mail is in the pod inbox, not held here: whether any is
+// waiting, from one listing.
+async function inboxWaiting(at) {
+  const items = await podInbox.list(at.remote, at.urls).catch(() => []);
+  return items.some((e) => !e.url.endsWith('.keep') && !e.url.endsWith('.receipt.json'));
+}
+
 /**
  * Read what was held for an account into its copy, and push each notification
- * that makes to the owner's phones and browsers. `takeover`: act even when a
- * browser that went quiet still holds the lease (a push run); otherwise leave
- * the mail to whoever holds it (an app's check).
+ * that makes to the owner's phones and browsers. With the hold off, what waits
+ * in the pod inbox is drained instead. `takeover`: act even when a browser
+ * that went quiet still holds the lease (a push run); otherwise leave the mail
+ * to whoever holds it (an app's check).
  */
 async function readHeld(ctx, handle, rec, { log = console.log, takeover = false, waitMs = 1000 } = {}) {
-  if (!(await ctx.listHeld(handle)).length) return 0;
+  const held = async () => !!(ctx.listHeld && (await ctx.listHeld(handle)).length);
+  if (holdOn(ctx) && !await held()) return 0;
   const unlock = await lockCopy(ctx.copyKv, handle, { waitMs });
   if (!unlock) return 0;
   try {
     const at = await reachAccount(ctx, handle, rec, { log });
-    if (at.skipped || !at.inCopy) return 0;
+    if (at.skipped) return 0;
+    if (!(await settle(ctx, handle, rec, at, { log })).ok) return 0;
+    const drains = !at.inCopy;
+    if (drains && !await inboxWaiting(at) && !await held()) return 0;
     const { store, lease } = stateAndLease(ctx, handle, at, { log });
     if (!await lease.acquire() && !(takeover && await lease.takeover())) return 0;
     await store.load();
@@ -277,22 +340,23 @@ async function readHeld(ctx, handle, rec, { log = console.log, takeover = false,
         })().catch((e) => log(`push @${handle}: ${e.message}`)));
       };
     }
-    const entries = await heldEntries(ctx, handle);
+    const entries = ctx.listHeld ? await heldEntries(ctx, handle) : [];
     const done = new Set(await agent.intake.takeHeld(entries));
     for (const e of entries) if (done.has(e.name)) for (const n of e.held) await ctx.dropHeld(handle, n);
+    if (drains) await agent.intake.drain();
     await Promise.all(pushes);
     await store.commit();
     await lease.release().catch(() => {});
     await ctx.noteNext?.(handle, nextDue(store)).catch(() => {});
-    reading.delete(handle);
-    if (done.size) log(`@${handle}: ${done.size} held deliveries read into the copy, ${pushes.length} pushed`);
-    return done.size;
+    forget(handle);
+    if (done.size || drains) log(`@${handle}: ${drains ? 'the pod inbox drained' : `${done.size} held deliveries read into the copy`}, ${pushes.length} pushed`);
+    return done.size || (drains ? 1 : 0);
   } finally { await unlock(); }
 }
 
 /** For an app checking in: at most every thirty seconds, never over a browser. */
 export async function readHeldForApp(ctx, handle, rec, { log = console.log } = {}) {
-  if (!ctx.listHeld) return 0;
+  if (!ctx.listHeld && holdOn(ctx)) return 0;
   const key = `${handle}/mail-read-at`;
   const last = Number((await ctx.copyKv.get(key))?.text || 0);
   if (Date.now() - last < MAIL_EVERY_MS) return 0;
@@ -307,7 +371,7 @@ export async function readHeldForApp(ctx, handle, rec, { log = console.log } = {
  * burst of likes is a run or two, not one each.
  */
 export async function pushHeld(ctx, handle, rec, { log = console.log } = {}) {
-  if (!ctx.listHeld || !await pushWanted(ctx, handle)) return 0;
+  if ((!ctx.listHeld && holdOn(ctx)) || !await pushWanted(ctx, handle)) return 0;
   const kv = ctx.mastoKv;
   const wanted = async () => (await kv.get(`pushwant/${handle}`))?.text || null;
   let n = 0;
@@ -326,21 +390,44 @@ export async function pushHeld(ctx, handle, rec, { log = console.log } = {}) {
   return n;
 }
 
-// A request from an app, answered by the account's facade over its copy.
-async function answerForAccount(request, url, ctx, tok, rec, log) {
+// A request from an app, answered by the account's facade over its copy, or
+// with the hold off, over the pod.
+async function answerForAccount(request, url, ctx, tok, rec, log, tokenHash) {
   const handle = tok.handle;
+  forgetOld();
+  const repeatKey = request.method === 'GET' && REPEATABLE.test(url.pathname) ? `${handle}\n${tokenHash}\n${url.pathname}${url.search}` : null;
+  // The copy's listing as it was: the same answer, without opening the copy.
+  // A copy written to the pod and deleted since lists differently.
+  if (repeatKey && holdOn(ctx)) {
+    const again = await repeatAnswer(ctx, handle, repeatKey, { inCopy: true });
+    if (again) return again;
+  }
+  // A copy the round is writing to the pod and deleting is waited out; it is
+  // made again below.
+  await waitOutClosing(ctx.copyKv, handle);
   const at = await reachAccount(ctx, handle, rec, { log });
   if (at.skipped) return json(503, { error: `this account cannot be reached now: ${at.skipped}` });
-  if (!at.inCopy) {
+  const token = { token: 'gateway', scope: tok.scope };
+  const writes = request.method !== 'GET' && request.method !== 'HEAD';
+  if (!writes && !at.inCopy && holdOn(ctx)) {
     const made = await ensureCopy(ctx, handle, rec, log);
     if (!made.ok) return json(made.status === 409 ? 503 : made.status, { error: made.why });
     at.inCopy = true;
   }
-  const token = { token: 'gateway', scope: tok.scope };
-  const writes = request.method !== 'GET' && request.method !== 'HEAD';
+  // New mail read in beside this answer, for the app's next check.
+  if (!writes && /^\/api\/v[12]\/(timelines\/home|notifications)$/u.test(url.pathname)) {
+    ctx.waitUntil?.(readHeldForApp(ctx, handle, rec, { log }).catch((e) => log(`app @${handle}: held mail: ${e.message}`)));
+  }
+  // With the hold off, the pod's listing, after the inbox has been looked at.
+  if (repeatKey && !holdOn(ctx)) {
+    const again = await repeatAnswer(ctx, handle, repeatKey, at);
+    if (again) return again;
+  }
   const b = await bridge(request, url);
   if (!writes) {
-    const store = await readingStore(ctx, handle, log);
+    const store = await readingStore(ctx, handle, at, log);
+    // The copy as this answer reads it: a later check finding the same list repeats it.
+    const tag = store.etags.get('');
     let actingP = null;
     const acting = () => (actingP ||= (async () => {
       const s = stateAndLease(ctx, handle, at, { log });
@@ -353,17 +440,23 @@ async function answerForAccount(request, url, ctx, tok, rec, log) {
     if (!agent) return json(503, { error: 'this account\'s copy holds no account' });
     const api = facade(agent, token, log, await vapidKeys(ctx.mastoKv), pushContact(ctx));
     const handled = await api.handle(b.req, b.res, url.pathname, url);
-    // New mail read in after this answer, for the app's next check.
-    if (/^\/api\/v[12]\/(timelines\/home|notifications)$/u.test(url.pathname)) {
-      ctx.waitUntil?.(readHeldForApp(ctx, handle, rec, { log }).catch((e) => log(`app @${handle}: held mail: ${e.message}`)));
-    }
-    return handled ? b.response() : new Response(JSON.stringify({ error: 'not found' }), { status: 404 });
+    if (!handled) return new Response(JSON.stringify({ error: 'not found' }), { status: 404 });
+    const res = b.response();
+    // An answer that had to act (a fetch from another server) is not repeated.
+    if (!repeatKey || actingP || res.status !== 200 || !tag) return res;
+    const headers = Object.fromEntries(res.headers);
+    const body = await res.text();
+    rememberAnswer(repeatKey, tag, res.status, headers, body);
+    return { status: res.status, headers, body };
   }
   // Acting: this app outranks a browser sitting open, as one device does another.
   const unlock = await lockCopy(ctx.copyKv, handle);
   if (!unlock) return json(503, { error: 'this account is busy; try again' });
   let lease = null;
   try {
+    // Decided under the lock, so the round cannot delete the copy meanwhile.
+    const settled = await settle(ctx, handle, rec, at, { log });
+    if (!settled.ok) return json(settled.status === 409 ? 503 : settled.status || 503, { error: settled.why });
     const s = stateAndLease(ctx, handle, at, { log });
     if (!await s.lease.acquire() && !await s.lease.takeover()) return json(503, { error: 'could not take this account over; try again' });
     lease = s.lease;
@@ -377,7 +470,7 @@ async function answerForAccount(request, url, ctx, tok, rec, log) {
     if (url.pathname === '/api/v1/push/subscription') await notePushSubs(ctx, handle, store);
     agent.publisher.stopPolls?.();
     await ctx.noteNext?.(handle, nextDue(store)).catch(() => {});
-    reading.delete(handle);
+    forget(handle);
     return handled ? b.response() : new Response(JSON.stringify({ error: 'not found' }), { status: 404 });
   } finally {
     // Done acting, however it went: the lease goes back, so a browser sitting
@@ -478,14 +571,17 @@ async function route(request, pathname, ctx, deps, log) {
     if (keptBefore(ctx, rec)) return json(503, { error: MOVING });
     if (!usable(ctx, rec)) return json(409, { error: notReady(rec) });
     if (rec.webId !== webid) return json(403, { error: `you signed in as ${webid}, and this account belongs to ${rec.webId}` });
+    // Signing an app in is the owner being here, as signing in to FediPod is.
+    await noteOpened(ctx, handle, rec, { always: true }).catch((e) => log(`@${handle}: stamp not written: ${e?.message || e}`));
     const app = await appOf(kv, body.client_id);
     if (!app) return json(400, { error: 'this app has not registered here' });
     const redirect = body.redirect_uri || 'urn:ietf:wg:oauth:2.0:oob';
     if (redirect !== 'urn:ietf:wg:oauth:2.0:oob' && !app.redirectUris.includes(redirect)) {
       return json(400, { error: 'this app asked to be sent somewhere it did not register' });
     }
-    // The owner, proved: not an app checking in, so not made to wait.
-    const made = await ensureCopy(ctx, handle, rec, log, { owner: true });
+    // The owner, proved: not an app checking in, so not made to wait. With
+    // the hold off there is no copy to make; the app reads the pod.
+    const made = holdOn(ctx) ? await ensureCopy(ctx, handle, rec, log, { owner: true }) : { ok: true };
     if (!made.ok) return json(made.status === 409 ? 503 : made.status, { error: made.why });
     const code = rand(24);
     await putJson(kv, `code/${sha(code)}`, {
@@ -537,7 +633,8 @@ async function route(request, pathname, ctx, deps, log) {
 
   // Everything else needs a token.
   const bearer = /^Bearer (.+)$/u.exec(request.headers.get('authorization') || '')?.[1];
-  const tok = bearer ? await getJson(kv, `token/${sha(bearer)}`) : null;
+  const tokenHash = bearer ? sha(bearer) : null;
+  const tok = tokenHash ? await getJson(kv, `token/${tokenHash}`) : null;
   if (!tok || Date.now() - tok.at > TOKEN_TTL_MS) {
     // A page of this site asking with a token the gateway never gave out is
     // FediPod's own client in a browser whose worker is not answering yet:
@@ -555,5 +652,8 @@ async function route(request, pathname, ctx, deps, log) {
   // by somebody else is not theirs.
   if (rec && rec.webId === tok.webId && keptBefore(ctx, rec)) return json(503, { error: MOVING });
   if (!usable(ctx, rec) || rec.webId !== tok.webId) return json(401, { error: 'this account is not kept running here any more' });
-  return answerForAccount(request, url, ctx, tok, rec, log);
+  // Using an app is being here: no pause, no closing, for want of opening
+  // FediPod. Hourly at most; see noteOpened.
+  const here = await noteOpened(ctx, tok.handle, rec).catch((e) => { log(`@${tok.handle}: stamp not written: ${e?.message || e}`); return rec; });
+  return answerForAccount(request, url, ctx, tok, here, log, tokenHash);
 }

package/lib/gateway/private-read.mjs

@@ -8,7 +8,9 @@
 //
 // At fedipod.net this works for an account it keeps: the post is read from
 // the pod with the keeper's credential, and the followers list from the
-// account's copy. An account it does not keep gives it nothing to read with,
+// account's copy, or from the pod when there is no copy just then (the hold,
+// copy.mjs). Nothing read is kept. An account it does not keep gives it
+// nothing to read with,
 // so that read is sent on to the pod, as every private read was.
 
 import { verifyHttpSignature, makeSafeLoader } from './httpsig.mjs';
@@ -78,10 +80,15 @@ export async function answerPrivateRead(ctx, rec, { request, handle, podTarget,
   let doc = null;
   try { doc = text ? JSON.parse(text) : null; } catch { doc = null; }
   if (!doc) { say(`refused — the pod did not give it (${actor})`); return nothing(open); }
+  // Who follows: from the account's copy while there is one, else from the pod.
   let followers = [];
   try {
-    const got = await ctx.copyKv.get(`${handle}/contacts.json`);
-    followers = (JSON.parse(got?.text || '{}').followers || []).map((f) => f?.actor).filter(Boolean);
+    let contacts = (await ctx.copyKv.get(`${handle}/d/contacts.json`))?.text || null;
+    if (!contacts) {
+      const res = await podFetch(`${rec.podHome.replace(/\/?$/u, '/')}ap-state/contacts.json`, { headers: { accept: 'application/json' } });
+      if (res.status === 200) contacts = await res.text();
+    }
+    followers = (JSON.parse(contacts || '{}').followers || []).map((f) => f?.actor).filter(Boolean);
   } catch { followers = []; }
   const followersUrls = [rec.podHome + 'ap/followers', base + 'ap/followers'];
   if (!mayRead(doc, actor, { followersUrls, followers })) { say(`refused — ${actor} is not in its audience`); return nothing(open); }

package/lib/gateway/quiet.mjs

@@ -4,7 +4,7 @@
 // public read, stamps noteOpened from the relay, counts noteReceived after
 // a forwarded delivery, and hands /api/open, /api/pause and /api/close here.
 
-import { keptNow } from './copy.mjs';
+import { keptNow, holdOn } from './copy.mjs';
 
 // ---- accounts that go quiet -------------------------------------------------
 //
@@ -144,9 +144,10 @@ export async function routeQuietApi(request, pathname, ctx, deps) {
     if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt, closedBy: before.closedBy });
     rec = await noteOpened(ctx, handle, rec, { always: true });
     // Whom the app would name if its owner lets the gateway act for them while
-    // it is closed, and whether they have (held-mail.mjs, keeper.mjs).
+    // it is closed, and whether they have (held-mail.mjs, keeper.mjs); and
+    // whether the gateway holds a copy of the account at all (copy.mjs).
     return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec),
-      keeper: ctx.keeperWebId || null, kept: keptNow(ctx, rec), keptBy: rec.keeper?.webId || null });
+      keeper: ctx.keeperWebId || null, kept: keptNow(ctx, rec), keptBy: rec.keeper?.webId || null, hold: holdOn(ctx) });
   }
 
   // The owner pausing their own account, or lifting the pause they set.

package/lib/gateway/state-api.mjs

@@ -13,13 +13,21 @@
 //                                    before the owner stops the gateway keeping
 //                                    the account running
 //
+// The hold (copy.mjs): the round writes a person's copy to the pod and deletes
+// it every fifteen minutes. A document asked for after that makes the copy
+// again from the pod, and one asked for while it goes is answered 503, to be
+// asked again in a moment. The copy's lease outlives it. With the hold off,
+// no copy is made: /open answers 501, after writing to the pod and deleting
+// any copy left from before, and the browser works on the pod.
+//
 // The token is the gateway's own, signed with a secret only it knows, and
 // names the account and the WebID that asked; it lasts a day. The signing key
 // and the passwords of accounts elsewhere are refused here: the copy does not
 // hold them, and the browser reads them from the pod.
 import crypto from 'node:crypto';
 import { HttpStorage } from '../core/storage.mjs';
-import { CopyStorage, copyMeta, fillCopy, dropCopy, forgetCopy, holds, lockCopy, kvDocFetch, podOnly, safeName, safeHandle, keptBefore } from './copy.mjs';
+import { CopyStorage, copyMeta, fillCopy, dropCopy, forgetCopy, holds, lockCopy, kvDocFetch, podOnly, safeName, safeHandle, keptBefore, keptNow,
+  holdOn, holdOver, closing } from './copy.mjs';
 
 const TOKEN_MS = 24 * 3600_000;
 const b64 = (s) => Buffer.from(s).toString('base64url');
@@ -79,6 +87,14 @@ const noteFailure = (kv, handle, why = null) => kv.set(`${handle}/fill-failed-at
  * credential has changed since. Returns { ok } or { ok: false, status, why }.
  */
 export async function ensureCopy(ctx, handle, rec, log = console.log, { owner = false } = {}) {
+  if (await copyMeta(ctx.copyKv, handle)) return { ok: true };
+  const unlock = await lockCopy(ctx.copyKv, handle);
+  if (!unlock) return { ok: false, status: 503, why: 'the gateway is busy with this account; try again' };
+  try { return await makeCopy(ctx, handle, rec, log, { owner }); } finally { await unlock(); }
+}
+
+/** ensureCopy, for a caller already holding lockCopy for the account. */
+export async function makeCopy(ctx, handle, rec, log = console.log, { owner = false } = {}) {
   if (await copyMeta(ctx.copyKv, handle)) return { ok: true };
   // The owner too: it is the gateway's credential that has to change.
   const refused = await loginRefused(ctx);
@@ -90,26 +106,41 @@ export async function ensureCopy(ctx, handle, rec, log = console.log, { owner =
   }
   const podFetch = await ctx.keeperFetch();
   if (!podFetch) return { ok: false, status: 501, why: 'this gateway cannot reach pods for accounts' };
-  const unlock = await lockCopy(ctx.copyKv, handle);
-  if (!unlock) return { ok: false, status: 503, why: 'the gateway is busy with this account; try again' };
+  // Marked failed before it starts and cleared when it is done, so an attempt
+  // cut off part way (a request's time running out) counts as failed too.
+  await noteFailure(ctx.copyKv, handle);
+  const stateUrl = stateUrlOf(rec);
+  const made = await fillCopy(ctx.copyKv, handle, { pod: new HttpStorage(stateUrl, podFetch), podFetch, stateUrl, webId: rec.webId, log })
+    .catch((e) => ({ ok: false, why: e.message }));
+  if (made.ok) { await ctx.copyKv.delete(`${handle}/fill-failed-at`).catch(() => {}); return { ok: true }; }
+  await noteFailure(ctx.copyKv, handle, made.why);
+  log(`copy @${handle}: not made: ${made.why}`);
+  if (refusedSignIn(made.why)) {
+    await ctx.copyKv.set(LOGIN_REFUSED, JSON.stringify({ at: Date.now(), mark: ctx.keeperMark || '', why: made.why })).catch(() => {});
+  }
+  return { ok: false, status: /active on another device/.test(made.why) ? 409 : 502, why: made.why };
+}
+
+/**
+ * The end of the hold for one account now, as the round does it: the copy
+ * written to the pod and deleted. Returns { ok } or { ok: false, why }.
+ */
+export async function endHold(ctx, handle, rec, log = console.log, { waitMs = 8_000 } = {}) {
+  if (!await copyMeta(ctx.copyKv, handle)) return { ok: true };
+  const podFetch = await ctx.keeperFetch();
+  if (!podFetch) return { ok: false, why: 'this gateway cannot reach the pod now' };
+  const unlock = await lockCopy(ctx.copyKv, handle, { waitMs });
+  if (!unlock) return { ok: false, why: 'the gateway is busy with this account; try again' };
   try {
-    if (await copyMeta(ctx.copyKv, handle)) return { ok: true };
-    // Marked failed before it starts and cleared when it is done, so an attempt
-    // cut off part way (a request's time running out) counts as failed too.
-    await noteFailure(ctx.copyKv, handle);
     const stateUrl = stateUrlOf(rec);
-    const made = await fillCopy(ctx.copyKv, handle, { pod: new HttpStorage(stateUrl, podFetch), podFetch, stateUrl, webId: rec.webId, log })
-      .catch((e) => ({ ok: false, why: e.message }));
-    if (made.ok) { await ctx.copyKv.delete(`${handle}/fill-failed-at`).catch(() => {}); return { ok: true }; }
-    await noteFailure(ctx.copyKv, handle, made.why);
-    log(`copy @${handle}: not made: ${made.why}`);
-    if (refusedSignIn(made.why)) {
-      await ctx.copyKv.set(LOGIN_REFUSED, JSON.stringify({ at: Date.now(), mark: ctx.keeperMark || '', why: made.why })).catch(() => {});
-    }
-    return { ok: false, status: /active on another device/.test(made.why) ? 409 : 502, why: made.why };
+    return await holdOver(ctx.copyKv, handle, { pod: new HttpStorage(stateUrl, podFetch), podFetch, stateUrl, log });
   } finally { await unlock(); }
 }
 
+// Whether the copy is made again when it is asked for: the hold on, and the
+// account still kept here under this identity.
+const remakes = (ctx, rec) => holdOn(ctx) && keptNow(ctx, rec) && !keptBefore(ctx, rec) && !rec.movedTo && !rec.closedAt;
+
 /** Write the copy to the pod and give it up. Returns { ok } or { ok: false, why }. */
 export async function leaveCopy(ctx, handle, rec, log = console.log) {
   if (!await copyMeta(ctx.copyKv, handle)) return { ok: true };
@@ -155,6 +186,13 @@ export async function routeStateApi(request, pathname, ctx, deps) {
     // owner's rules name it.
     const before = keptBefore(ctx, rec);
     if (before && !await copyMeta(ctx.copyKv, handle)) return j(409, { error: 'kept under the gateway\'s former identity', moving: true });
+    // The hold off: no copy. One left from before goes to the pod first, so
+    // the browser works on a pod that has everything.
+    if (!before && !holdOn(ctx)) {
+      const ended = await endHold(ctx, handle, rec).catch((e) => ({ ok: false, why: e.message }));
+      if (!ended.ok) return j(503, { error: `the account's copy could not be written to the pod: ${ended.why}` });
+      return j(501, { error: 'this gateway keeps no copies of accounts', hold: false });
+    }
     const made = before ? { ok: true } : await ensureCopy(ctx, handle, rec, console.log, { owner: true });
     if (!made.ok) return j(made.status, { error: made.why, busy: made.status === 409 });
     const origin = new URL(request.url).origin;
@@ -177,15 +215,28 @@ export async function routeStateApi(request, pathname, ctx, deps) {
   // by somebody else is not theirs any more.
   const owned = await ctx.lookup(handle);
   if (!owned || owned.webId !== who.webId) return j(401, { error: 'this token is not for this account' });
-  if (!await copyMeta(ctx.copyKv, handle)) return j(404, { error: 'the gateway keeps no copy of this account now', gone: true });
   const kv = ctx.copyKv;
   const noStore = { 'cache-control': 'no-store' };
+  const gone = () => j(404, { error: 'the gateway keeps no copy of this account now', gone: true });
 
+  // No copy, or none now, is nothing to give up.
   if (name === 'leave') {
     if (request.method !== 'POST') return j(405, { error: 'POST' });
     const left = await leaveCopy(ctx, handle, owned).catch((e) => ({ ok: false, why: e.message }));
     return left.ok ? j(200, { ok: true }) : j(502, { error: `the copy could not be written to the pod: ${left.why}` });
   }
+  // The copy's lease outlives each copy the hold makes.
+  if (name === 'lease.json' && !await copyMeta(kv, handle) && !remakes(ctx, owned)) return gone();
+  // Being written to the pod and deleted: asked again in a moment, it is made anew.
+  const comeAgain = () => j(503, { error: 'the account\'s copy is being written to the pod; try again in a moment' });
+  if (name !== 'lease.json') {
+    if (await closing(kv, handle)) return comeAgain();
+    if (!await copyMeta(kv, handle)) {
+      if (!remakes(ctx, owned)) return gone();
+      const made = await ensureCopy(ctx, handle, owned, console.log, { owner: true });
+      if (!made.ok) return j(made.status === 409 ? 503 : made.status, { error: made.why });
+    }
+  }
   // The owner's browser has written the copy to the pod itself (a copy kept
   // under the gateway's former identity, which cannot write it back now).
   // Only the lease's holder may say so, and only for such a copy.
@@ -229,11 +280,15 @@ export async function routeStateApi(request, pathname, ctx, deps) {
     const w = await copy.write(name, await request.text());
     if (w.lost) return j(409, { error: w.why });
     if (!w.ok) return j(503, { error: w.why });
+    // Landed as the round began to write the copy to the pod: perhaps after
+    // it read this document. Sent again, it lands in the copy made next.
+    if (await closing(kv, handle)) return comeAgain();
     return { status: 204, headers: { ...noStore, etag: w.etag }, body: null };
   }
   if (request.method === 'DELETE') {
     if (!holder) return j(400, { error: 'x-fedipod-holder is required' });
-    return (await copy.remove(name)) ? { status: 204, headers: noStore, body: null } : j(409, { error: 'another agent holds this account now' });
+    if (!await copy.remove(name)) return j(409, { error: 'another agent holds this account now' });
+    return (await closing(kv, handle)) ? comeAgain() : { status: 204, headers: noStore, body: null };
   }
   return j(405, { error: 'GET, PUT or DELETE' });
 }

package/lib/pod/notes.mjs

@@ -44,6 +44,31 @@ export const writeReplies = (pod, repliesId, doc) => pod.putJson(repliesId, doc)
 /** One published note, as the pod currently serves it. */
 export const read = (pod, noteId) => pod.getJson(noteId);
 
+/**
+ * A note as the pod serves it, with the version the pod gave it.
+ *
+ * For a write that must not undo somebody else's: an edit or a deletion that
+ * lands between this read and the write below wins, and the writer tries
+ * again later. A pod that names no version gets an unconditional write.
+ */
+export async function readVersioned(pod, noteId) {
+  if (typeof pod.fetch !== 'function') return { doc: await pod.getJson(noteId), version: null };
+  const res = await pod.fetch(noteId, { headers: { accept: 'application/activity+json' } });
+  if (res.status === 404 || res.status === 410) return { doc: null, version: null };
+  if (res.status >= 400) throw new Error(`GET ${noteId} → ${res.status}`);
+  return { doc: await res.json().catch(() => null), version: res.headers?.get?.('etag') || null };
+}
+
+/** Write the note only over the version read. False when it changed meanwhile. */
+export async function writeIfUnchanged(pod, noteId, doc, version) {
+  if (!version || typeof pod.fetch !== 'function') { await pod.putJson(noteId, doc); return true; }
+  const res = await pod.fetch(noteId, { method: 'PUT',
+    headers: { 'content-type': 'application/activity+json', 'if-match': version }, body: JSON.stringify(doc) });
+  if (res.status === 412) return false;
+  if (res.status >= 400) throw new Error(`PUT ${noteId} → ${res.status}`);
+  return true;
+}
+
 /**
  * Replace a note with a Tombstone, and keep it readable.
  *

package/lib/server/embed.mjs

@@ -396,7 +396,7 @@ export async function startEmbeddedAgent({
     basePath: uiPath,
     mount,
     publicOrigin: base,
-    scheme: new URL(base).protocol,
+    scheme: new URL(base).protocol.slice(0, -1),
   });
 
   // A delivery landing in the inbox — through the door, or from any other