fedipod 1.50.0 → 1.55.2

package/README.md

@@ -52,7 +52,8 @@ Akkoma, Pixelfed or Friendica, connect it from the manage page and read it
 here. Its home timeline and notifications join the feed you already read,
 interleaved by time, and a post both accounts see appears once. Favouriting,
 boosting and replying act as the account the post came through. The token it
-hands back stays in your browser unless you choose to keep it on your pod.
+hands back is kept on your pod, so the account follows you to any browser you
+sign in from.
 
 **Moving in.** Mastodon-format exports of follows, blocks, mutes, lists and
 domain blocks import from the manage page. Your old account can be listed as

package/gateway.md

@@ -240,6 +240,19 @@ An app checks for new posts every minute or so while it is open; there are no
 live updates. Accounts are made on the fedipod.net front page, with a pod, not
 from an app.
 
+**Your connected accounts, with FediPod closed.** FediPod open in a browser
+reads the Mastodon and Bluesky accounts you connected every five minutes.
+While it is closed and an app is in use, fedipod.net reads them instead, at
+most every five minutes, when the app checks your timeline or notifications.
+Their logins are read from your pod for each read and are not kept at
+fedipod.net. An account you have just connected can take up to an hour to be
+read here.
+
+**Hashtags.** The hashtags you follow are one list, in FediPod and in an app:
+following or unfollowing one in either changes it in both. FediPod brings in
+the posts for them, while it is open. **hashtag posts in home** on your manage
+page keeps them out of your home timeline, in FediPod and in an app alike.
+
 **Notifications on your phone.** An app that offers notifications can sign up
 for them here. A mention, a reply, a direct message, a follow, or a like, boost
 or reaction to your own post then reaches your phone as it arrives, whether
@@ -281,6 +294,18 @@ removes them at `/notices`, signed in as the admin the way the roster is.
 A notice is a title and plain text: a blank line starts a paragraph, and a
 web address becomes a link.
 
+## When mail does not get through
+
+When FediPod cannot read a piece of your mail, a red line across the top of
+its pages says so until you open Show dead letters on your manage page. Your
+phone hears too, at most once an hour, if a Mastodon app on it is signed in at
+the gateway with notifications on.
+
+The gateway's admin also gets a test letter every six hours, sent to their own
+account through the same door every server uses. FediPod takes it in and shows
+it nowhere. If FediPod has been open for an hour and the letter has not
+arrived, the admin's phone is told and the red line goes up.
+
 ## What the gateway can see
 
 It reads only public data to decide what concerns you: your published

package/gui.md

@@ -3,7 +3,7 @@
 In the browser version at fedipod.net, `manage`, in the bar's account group, opens this
 same page for your account. The rest of this page describes it as the
 DeviceAgent serves it; the controls are the same, minus the manual inbox
-drain and the local log, which a browser does not have.
+drain, which a browser does not have.
 
 Open `https://localhost:8030/` while any agent is running — it forwards you to the agent — then choose `manage` in the bar's account group and select the actor you want from the local actors dropdown.
 Picking an actor marked "(stopped)" starts its agent, then opens its page.
@@ -48,8 +48,7 @@ its own port.
 
 Each identity has a page anyone can open, at `ap/profile.html` under its pod
 — for example `https://your-pod.example/fedipod/ap/profile.html`
-(the `fedipod` container is wherever you put it at setup; the manage page's
-"stored at" row says where). It
+(the `fedipod` container is wherever you put it at setup). It
 shows the name, bio and address, and offers a Follow box: a visitor types
 their own server and lands on that server's follow screen. Hand out that
 link, or the `@name@host` address itself, which works in the search box of
@@ -96,6 +95,15 @@ Disconnecting stops the reading and removes the stored token; nothing already
 posted is touched. If the other server stops accepting the token, the account
 is marked **sign in again** rather than quietly dropped.
 
+## Hashtag posts in your home timeline
+
+The posts brought in for the hashtags you follow appear in your home timeline.
+Set **hashtag posts in home** to *hidden* and they appear only on the public
+timeline and on each hashtag's page; they are still brought in. A hashtag post
+that one of your connected accounts also brought in is from someone you follow
+there, and stays. An app already showing them keeps them on screen until it
+reloads.
+
 ## Handling follow requests
 
 New followers are accepted automatically. Set **new followers** to *wait for

package/lib/client/masto/render.mjs

@@ -10,6 +10,13 @@ import { sanitizeHtml, followsNeedApproval, publicHandle } from '../../core/wire
 import { profileUrl, postUrl } from '../../connections/bskyfeed.mjs';
 import { htmlToText } from './body.mjs';
 
+// Posts stored from 2026-09-13 to 2026-10-10 hold a Mastodon post's text twice,
+// joined by a comma; shown once.
+export const once = (html) => {
+  const m = (html.length - 1) / 2;
+  return Number.isInteger(m) && html[m] === ',' && html.slice(0, m) === html.slice(m + 1) ? html.slice(0, m) : html;
+};
+
 // 1x1 transparent PNG — placeholder header, and the instance thumbnail. A
 // banner nobody set should take up no room and show nothing; an avatar is a
 // different matter (below).
@@ -273,7 +280,7 @@ export function status(api, s, { all, depth = 0 } = {}) {
     created_at: s.published || new Date().toISOString(),
     in_reply_to_id: s.inReplyTo ? api.store.idFor(s.inReplyTo) : null,
     in_reply_to_account_id: null,
-    sensitive: !!(s.spoiler || s.sensitive), spoiler_text: s.spoiler || '',
+    sensitive: !!(s.spoiler || s.sensitive), spoiler_text: once(s.spoiler || ''),
     visibility: s.visibility || 'public', language: null,
     edited_at: s.editedAt || null,
     uri: s.noteId, url: s.link || s.noteId,
@@ -284,7 +291,7 @@ export function status(api, s, { all, depth = 0 } = {}) {
     favourited: !!s.favourited || (s.sourceAccts || []).some(v => v.favourited),
     reblogged: !!s.reblogged || (s.sourceAccts || []).some(v => v.reblogged),
     muted: false, bookmarked: !!s.bookmarked, pinned: !!s.pinned,
-    content: s.content || '',
+    content: once(s.content || ''),
     reblog: null, application: null,
     account: api.account(s.actor),
     media_attachments: (s.attachments || []).map(a => api.mediaJson(a)),
@@ -323,7 +330,7 @@ export function status(api, s, { all, depth = 0 } = {}) {
 // information it uses to decide anyway.
 export function filtersFor(api, s) {
   const now = Date.now();
-  const hay = `${s.content || ''} ${s.spoiler || ''}`
+  const hay = `${once(s.content || '')} ${once(s.spoiler || '')}`
     .replace(/<[^>]*>/gu, ' ')            // the text, not the markup around it
     .toLowerCase();
   if (!hay.trim()) return [];
@@ -403,7 +410,7 @@ export function pushNotify(api, n) {
   return api.push.notify(n, {
     notification_id: n.id, notification_type: n.type, preferred_locale: 'en',
     title: `${acct.display_name || acct.acct} ${verbs[n.type] || n.type}`,
-    body: s ? htmlToText(s.content || '').slice(0, 140) : '',
+    body: s ? htmlToText(once(s.content || '')).slice(0, 140) : '',
     icon: acct.avatar || '',
   });
 }

package/lib/client/masto/timelines.mjs

@@ -18,6 +18,10 @@ export async function handle(api, ctx) {
   if (pathname === '/api/v1/timelines/home' || pathname === '/api/v1/timelines/public'
     || pathname === '/api/v1/trends/statuses') {
     const localOnly = pathname === '/api/v1/timelines/public' && url.searchParams.get('local') === 'true';
+    // The owner can keep hashtag posts out of Home (`tagsInHome: false`); they
+    // stay on the public timeline, their hashtags' pages and trends. One a
+    // connected account also brought in is from someone followed there.
+    const hideTags = pathname === '/api/v1/timelines/home' && api.store.getConfig?.()?.tagsInHome === false;
     // The UNFILTERED list, both as the source and as the reply-count corpus:
     // a reply can be a mention, and mentions are filtered out of timelines
     // below — counting against the filtered set would undercount them.
@@ -31,6 +35,7 @@ export async function handle(api, ctx) {
       .filter(s => s.kind !== 'remote' && s.kind !== 'mention')
       .filter(s => !s.direct && s.visibility !== 'direct')
       .filter(s => !muted.has(s.actor) && !muted.has(s.via))
+      .filter(s => !hideTags || s.kind !== 'tag' || s.sourceAccts?.length)
       .filter(s => !localOnly || (s.kind === 'post' && s.visibility !== 'private'))
       .sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
     const { items: page, headers } = api.page(items, url);

package/lib/connections/acctfeed.mjs

@@ -145,8 +145,11 @@ export class AcctFeed {
     return map;
   }
 
+  // A server that does not say what is left (not every Mastodon-API server
+  // does) is not taken to have nothing left.
   _rateGuard(id, handle, res) {
-    const left = Number(res.headers.get('x-ratelimit-remaining'));
+    const said = res.headers.get('x-ratelimit-remaining');
+    const left = said == null || said.trim() === '' ? NaN : Number(said);
     if (!Number.isFinite(left) || left > RATE_FLOOR) return false;
     const reset = Date.parse(res.headers.get('x-ratelimit-reset') || '');
     const wait = Number.isFinite(reset) ? Math.max(0, reset - Date.now()) : BACKOFF_MIN_MS;

package/lib/connections/tagfeed.mjs

@@ -81,8 +81,11 @@ export class TagFeed {
     if (Array.isArray(patch.tags)) clean.tags = patch.tags.map(t => String(t).replace(/^#/, '').trim()).filter(Boolean);
     if (patch.intervalMin) clean.intervalMin = Math.max(5, Number(patch.intervalMin) || DEFAULTS.intervalMin);
     this.store.write('tagfeed.json', { ...this.config(), ...clean });
+    // A feed that sweeps starts again on the new list; one that only answers
+    // for the list (fedipod.net, for an app) was never started and is not now.
+    const sweeping = this.stopped === false;
     this.stop();
-    this.start();
+    if (sweeping) this.start();
     return this.config();
   }
 

package/lib/core/graphview.mjs

@@ -227,6 +227,8 @@ function fromLiteral(term) {
   return term.value;
 }
 
+const isTagged = (term) => term.termType === 'Literal' && !!term.language;
+
 function toValue(term, ctx, depth, path) {
   if (term.termType === 'Literal') return fromLiteral(term);
   if (isListHead(term, ctx)) return readList(term.value, ctx, depth, path);
@@ -248,8 +250,14 @@ function readProperty(subject, name, ctx, depth = 0, path = new Set()) {
 
   const term = TERMS.get(name);
   if (!term) return undefined;
-  const values = preds.get(term.iri);
+  let values = preds.get(term.iri);
   if (!values || !values.length) return undefined;
+  // `content` and `contentMap` are one predicate, and Mastodon sends a post's
+  // text both ways. The plain term is the untagged copy, else the first tagged.
+  if (values.some(isTagged)) {
+    const plain = values.filter(v => !isTagged(v));
+    values = plain.length ? plain : [values.find(isTagged)];
+  }
 
   // `items` and `orderedItems` are the same predicate; the list is what tells
   // them apart, so asking for the ordered one only answers when it is ordered.

package/lib/core/intake/index.mjs

@@ -151,9 +151,17 @@ export class Intake {
     rec.last = String(message || '').slice(0, 200);
     all[url] = rec;
     this.store.write(ATTEMPTS_DOC, all);
+    if (rec.n === 2) this._trouble('failing', url, message);
     return rec.n;
   }
 
+  // Mail that could not be read, as against mail refused: a second failed try,
+  // or a piece set aside after its last. `onTrouble` tells the owner.
+  _trouble(kind, url, reason) {
+    try { this.onTrouble?.({ kind, url, reason: String(reason || '').slice(0, 200), at: new Date().toISOString() }); }
+    catch { /* telling must never stop the drain */ }
+  }
+
   _clearAttempt(url) {
     const all = this.store.read(ATTEMPTS_DOC, {});
     if (!all[url]) return;
@@ -202,13 +210,25 @@ export class Intake {
         this._drainAgain = false;
         // Paced, not immediate: chained sweeps put a ceiling on work per unit
         // time, so a delivery flood cannot run the drain back-to-back.
-        const t = setTimeout(() => this.drain().catch(e => this.log(`drain: ${e.message}`)), CHAIN_GAP_MS);
-        t.unref?.();
+        this._chainTimer = setTimeout(() => {
+          this._chainTimer = null;
+          this.drain().catch(e => this.log(`drain: ${e.message}`));
+        }, CHAIN_GAP_MS);
+        this._chainTimer.unref?.();
       }
     });
     return this._draining;
   }
 
+  // Resolves once no sweep is running and none is waiting to follow on, so a
+  // browser worker can stay up until the round it started is done.
+  async settled() {
+    while (this._draining || this._chainTimer) {
+      if (this._draining) await this._draining.catch(() => {});
+      else await new Promise((r) => setTimeout(r, 500));
+    }
+  }
+
   // Discard the content waiting in the inbox from before `before`, on the
   // owner's say-so — the admin page asks, this does it. NOT a blind sweep:
   // every item is read, because the type is the only thing that decides its
@@ -447,6 +467,7 @@ export class Intake {
           this.log(`inbox batch ${url} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${e.message}`);
           if (n >= MAX_ITEM_ATTEMPTS) {
             this.store.addDeadLetter({ inboxUrl: url, reason: `failed ${n}x: ${e.message}`, activity: null });
+            this._trouble('set-aside', url, e.message);
             pending.push(url);
           }
         }
@@ -489,6 +510,7 @@ export class Intake {
         this.log(`inbox item ${url} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${e.message}`);
         if (n >= MAX_ITEM_ATTEMPTS) {
           this.store.addDeadLetter({ inboxUrl: url, reason: `failed ${n}x: ${e.message}`, activity: trimActivity(at.activity) });
+          this._trouble('set-aside', url, e.message);
           // The dead letter IS the record of this item — deleting before it is
           // written down would lose the only evidence it ever arrived, so it
           // goes through the same commit-then-delete batch as everything else.
@@ -522,6 +544,14 @@ export class Intake {
     const read = raw ? await readLenient(raw) : null;
     if (read?.degraded) this.log(`inbox item ${url} grounded to read: ${read.degraded}`);
     const activity = at.activity = read?.view ?? read?.doc ?? null;
+    // The gateway's test letter (lib/gateway/check-letter.mjs): read this far
+    // like any mail, then answered, and shown nowhere. An answer that does
+    // not go leaves it to be tried again.
+    const from = typeof activity?.actor === 'string' ? activity.actor : activity?.actor?.id;
+    if (from && this.checkLetters?.actor && from === this.checkLetters.actor) {
+      await this.checkLetters.taken(String(activity.id || ''));
+      return;
+    }
     // What the shapes make of it. This decides NOTHING — the activity is
     // handled either way. It is written down so that which shapes fire on
     // real traffic is a question with an answer, rather than a guess made
@@ -577,6 +607,7 @@ export class Intake {
     const batch = await this._batchEntries(url);
     if (!batch) {
       this.store.addDeadLetter({ inboxUrl: url, reason: 'unreadable batch', activity: null });
+      this._trouble('set-aside', url, 'unreadable batch');
       return { entries: 1, complete: true };
     }
     let complete = true;
@@ -596,6 +627,7 @@ export class Intake {
         this.log(`inbox batch entry ${key} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${err.message}`);
         if (n >= MAX_ITEM_ATTEMPTS) {
           this.store.addDeadLetter({ inboxUrl: key, reason: `failed ${n}x: ${err.message}`, activity: trimActivity(at.activity) });
+          this._trouble('set-aside', key, err.message);
         } else {
           complete = false;
         }
@@ -635,6 +667,7 @@ export class Intake {
           this.log(`held delivery ${key} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${err.message}`);
           if (n >= MAX_ITEM_ATTEMPTS) {
             this.store.addDeadLetter({ inboxUrl: key, reason: `failed ${n}x: ${err.message}`, activity: trimActivity(at.activity) });
+            this._trouble('set-aside', key, err.message);
             done.push(e.name);
           }
         }

package/lib/core/intake/verify.mjs

@@ -138,8 +138,10 @@ export function receiptVouchesFor(intake, receipt, actor) {
 // Delete is verified — the same verify-by-dereference the rest of intake uses.
 export async function isGone(intake, url) {
   let res;
+  // A deliverer that throws on a refusal (the browser's relay) still carries
+  // the origin's answer: 404 or 410 from the origin itself is gone.
   try { res = await intake.deliverer.signedFetch(url, { headers: { accept: ACCEPT_AP } }); }
-  catch { return null; }
+  catch (e) { return e?.answered && (e.status === 404 || e.status === 410) ? true : null; }
   if (res.status === 404 || res.status === 410) return true;
   if (res.status < 400) {
     // A Tombstone answers 200 and still means deleted.

package/lib/core/pod-only.mjs

@@ -1,4 +1,6 @@
 // pod-only.mjs — what stays on the pod, and only there, when an account works
 // from a copy kept at its gateway (lib/gateway/copy.mjs): the signing key, the
-// pod's own lease, and the passwords and tokens of accounts on other servers.
-export const podOnly = (name) => name === 'keys.json' || name === 'lease.json' || name.startsWith('conn-');
+// pod's own lease, and the passwords and tokens of accounts on other servers
+// (`conn-*` as the vault names them, and the browser's two documents).
+const CONNECTED = new Set(['fediaccts.json', 'atproto.json']);
+export const podOnly = (name) => name === 'keys.json' || name === 'lease.json' || name.startsWith('conn-') || CONNECTED.has(name);

package/lib/core/publisher/index.mjs

@@ -99,13 +99,26 @@ export class Publisher {
   // `clientOrigin` is overridden only by the agent serving a client its own
   // local actor: standalone, the published document cannot name a loopback
   // address, but a client already talking to that address can be told it.
+  // Whether follows wait for the owner, from the setting as saved now: this
+  // config is a copy taken when the agent started, and the saved one may have
+  // changed since.
+  approvesByHand() {
+    const saved = this.store?.getConfig?.() || {};
+    return wire.followsNeedApproval({ ...this.config,
+      ...('autoAcceptFollows' in saved ? { autoAcceptFollows: saved.autoAcceptFollows } : {}),
+      ...('approveJoins' in saved ? { approveJoins: saved.approveJoins } : {}) });
+  }
+
+  // Whether the profile last published says what the setting says.
+  profileAgrees() { return this.store.read('published.json', {}).approvesByHand === this.approvesByHand(); }
+
   actorDocFor({ priv = false, moderators = null, inbox = null, movedTo = this.config.movedTo || null,
     clientOrigin = this.clientOrigin } = {}) {
     const { urls } = this;
     return wire.actorDoc({
       urls, handle: wire.publicHandle(this.config), name: this.config.name, publicKeyPem: this.publicKeyPem,
       movedTo, kind: this.config.kind,
-      approveJoins: wire.followsNeedApproval(this.config),
+      approveJoins: this.approvesByHand(),
       assertionKey: this.assertionKey,
       summary: this.config.summary || null, icon: this.config.icon || null,
       image: this.config.image || null, fields: this.config.fields || [],
@@ -283,10 +296,11 @@ export class Publisher {
     // one the operator makes because the first did not work — was skipped as a
     // no-op and reported success. The digest is a record of what is up there,
     // and an unreachable document is not up there.
-    if (!unreachable.length) {
-      this.store.write('published.json',
-        { ...this.store.read('published.json', {}), surfaceDigest: surface });
-    }
+    // What the actor now says about followers is recorded whatever else was
+    // unreachable: it was written, and a start that finds it disagreeing
+    // writes it again (profileAgrees).
+    this.store.write('published.json', { ...this.store.read('published.json', {}),
+      ...(!unreachable.length ? { surfaceDigest: surface } : {}), approvesByHand: !!actorDoc.manuallyApprovesFollowers });
     // Named as the fediverse sees it: a fronted actor's name and host are the
     // front's, not the pod's.
     const pubName = wire.publicHandle(this.config);

package/lib/core/publisher/restore.mjs

@@ -210,6 +210,7 @@ export async function rebuildStatuses(publisher, { fromNotes = false } = {}) {
 // merge-only rebuild when something is.
 export async function healStatuses(publisher) {
   const { urls, store } = publisher;
+  if (store.unread?.has('statuses.json')) return { missing: 0, recovered: 0 };   // nothing to compare with
   const own = store.read('outbox.json', [])
     .map(i => (typeof i === 'string' ? i : null))
     .filter(id => id && id.startsWith(urls.notes));

package/lib/core/store.mjs

@@ -90,6 +90,10 @@ export class PodStore {
     this._held = 0;
     this.chain = Promise.resolve();  // serialized writes
     this.verdicts = new Map();     // name → did its last write land? (read by commit)
+    // Documents the pod holds that could not be read, and that nothing here
+    // has a copy of. Never written to until they are read: what this store
+    // would send is not the document, and would replace it on the pod.
+    this.unread = new Set();
     // Moves on each time queued writes are dropped (discardPending): work that
     // began in an earlier generation has lost results, whatever a commit says.
     this.generation = 0;
@@ -106,7 +110,7 @@ export class PodStore {
   attach(storage) {
     // A different tree is different state: carrying the old cache and its
     // ETags across would serve one container's documents as another's.
-    if (this.storage && this.storage.base !== storage.base) { this.cache.clear(); this.etags.clear(); this.lastText.clear(); }
+    if (this.storage && this.storage.base !== storage.base) { this.cache.clear(); this.etags.clear(); this.lastText.clear(); this.unread.clear(); }
     this.storage = storage;
   }
 
@@ -137,8 +141,8 @@ export class PodStore {
     if (listing.missing && this.storage.kind === 'pod') {
       throw new Error(`state container missing (HTTP 404) at ${this.base} — pod unreachable or state gone`);
     }
-    this.etags.set('', listing.etag);
     const names = listing.names.filter(n => n.endsWith('.json'));
+    for (const name of this.unread) if (!names.includes(name)) this.unread.delete(name);   // gone: nothing to write over
     let fetched = 0;
     const skipped = [];
     for (const name of names) {
@@ -147,17 +151,20 @@ export class PodStore {
       if (r.notModified) continue;                        // ours is current
       if (!r.ok) {
         // One unreadable document must not restart the whole sweep — skip it,
-        // keep whatever we already hold, and try again next load (no etag is
-        // recorded, so the retry is unconditional). config.json is the
+        // keep whatever we already hold, and try again next load (neither its
+        // etag nor the container's is recorded, so the next load lists and
+        // reads it again). config.json is the
         // exception: without it the caller cannot tell "never set up" from
         // "could not read", and would tell the user to run setup.
         if (name === 'config.json' && !this.cache.has(name)) {
           throw new Error(`state doc ${name} unreadable (HTTP ${r.status})`);
         }
+        if (!this.lastText.has(name)) this.unread.add(name);
         skipped.push(`${name} (HTTP ${r.status})`);
         continue;
       }
       fetched++;
+      this.unread.delete(name);
       this.etags.set(name, r.etag);
       try { this.cache.set(name, JSON.parse(r.body)); this.lastText.set(name, r.body); }
       catch (e) { this.log(`state load ${name}: unparsable (${e.message})`); }
@@ -165,7 +172,12 @@ export class PodStore {
     // Kept for /status: a document skipped here is a timeline or a contact
     // list quietly missing, and the owner should be able to see that.
     this.lastSkipped = skipped;
-    if (skipped.length) this.log(`state load skipped ${skipped.length}: ${skipped.join(', ')}`);
+    // The container's ETag vouches for every document in it, so it is kept
+    // only when every one was read; otherwise the next load would stop at
+    // "not modified" and never retry what was skipped.
+    if (skipped.length) this.etags.delete(''); else this.etags.set('', listing.etag);
+    if (skipped.length) this.log(`state load skipped ${skipped.length}: ${skipped.join(', ')}`
+      + (this.unread.size ? ` — not written until read: ${[...this.unread].join(', ')}` : ''));
     this.log(`state loaded: ${this.cache.size} doc(s) from ${this.base} (${fetched} re-fetched)`);
     this.onLoaded?.();
   }
@@ -177,6 +189,7 @@ export class PodStore {
     for (const { name, text, etag } of docs) {
       try { this.cache.set(name, JSON.parse(text)); } catch { continue; }
       this.lastText.set(name, text);
+      this.unread.delete(name);
       if (etag) this.etags.set(name, etag);
     }
     if (listingEtag) this.etags.set('', listingEtag);
@@ -193,11 +206,12 @@ export class PodStore {
       const r = await this.storage.read(name, etag ? { etag } : undefined);
       if (r.notModified) continue;
       if (r.status === 404) {
-        this.cache.delete(name); this.lastText.delete(name); this.etags.delete(name);
+        this.cache.delete(name); this.lastText.delete(name); this.etags.delete(name); this.unread.delete(name);
       } else if (!r.ok) {
         throw new Error(`state doc ${name} unreadable (HTTP ${r.status})`);
       } else {
         this.cache.set(name, JSON.parse(r.body)); this.lastText.set(name, r.body); this.etags.set(name, r.etag);
+        this.unread.delete(name);
       }
       this.onSettled?.(name);
     }
@@ -216,6 +230,8 @@ export class PodStore {
   write(name, obj) {
     this.cache.set(name, structuredClone(obj));
     if (!this.storage) return;
+    // Not sent: the next commit says it did not land, and reads it first.
+    if (this.unread.has(name)) { this.verdicts.set(name, false); return; }
     // The same bytes the pod already holds are not sent again. A like, a
     // bookmark, a sweep that found nothing new each used to upload the whole
     // timeline index and the whole people cache, unchanged — the largest
@@ -263,6 +279,7 @@ export class PodStore {
   // the returned promise so one failure cannot poison the queue.
   _put(name) {
     const done = this.chain.then(async () => {
+      if (this.unread.has(name)) return false;
       const body = serialise(this.cache.get(name));
       await Promise.resolve(this.onWriting?.(name, body)).catch(() => {});
       for (let attempt = 1; attempt <= PUT_RETRIES; attempt++) {
@@ -313,6 +330,10 @@ export class PodStore {
   // `since`: the generation the caller's work began in. Anything dropped since
   // makes the answer false.
   async commit({ since } = {}) {
+    // A document that could not be read is read now, replacing whatever was
+    // written to it here; those writes already count as not landed, so the
+    // drain keeps its items and takes them again against the real document.
+    if (this.unread.size && this.storage) await this.refresh([...this.unread]).catch(() => {});
     const pending = [];
     // Held names too, or a sweep that suspended the debounce would delete the
     // pod's copy of an item whose result had not been written down — the one

package/lib/gateway/account-agent.mjs

@@ -18,6 +18,7 @@ import { Deliverer } from '../core/deliver.mjs';
 import { Publisher } from '../core/publisher/index.mjs';
 import { Intake } from '../core/intake/index.mjs';
 import { C2S } from '../client/c2s.mjs';
+import { TagFeed } from '../connections/tagfeed.mjs';
 import { keeperSession } from './keeper-session.mjs';
 import { CopyStorage, copyMeta, copyLease, keptBefore, holdOn, GATEWAY_HOLDER } from './copy.mjs';
 import { makeCopy } from './state-api.mjs';
@@ -76,14 +77,15 @@ export async function settle(ctx, handle, rec, at, { log = console.log } = {}) {
 
 /**
  * The account's state store and lease, as `holder`: over the copy when there
- * is one, else over the pod.
+ * is one, else over the pod. `podNames`: what of the pod-only documents the
+ * store loads with the copy.
  */
-export function stateAndLease(ctx, handle, at, { log = console.log, holder = GATEWAY_HOLDER } = {}) {
+export function stateAndLease(ctx, handle, at, { log = console.log, holder = GATEWAY_HOLDER, podNames = ['keys.json'] } = {}) {
   const podState = new HttpStorage(at.urls.state, at.podFetch);
   if (at.inCopy) {
     return {
-      // Of what stays on the pod, only the key: one read per piece of work.
-      store: new PodStore({ storage: new CopyStorage(ctx.copyKv, handle, { holder, pod: podState, podNames: ['keys.json'] }), log }),
+      // Of what stays on the pod, only the key, by default: one read per piece of work.
+      store: new PodStore({ storage: new CopyStorage(ctx.copyKv, handle, { holder, pod: podState, podNames }), log }),
       lease: copyLease(ctx.copyKv, handle, { id: holder, log }),
     };
   }
@@ -99,7 +101,7 @@ export function stateAndLease(ctx, handle, at, { log = console.log, holder = GAT
  * back onto the pod), the key from the pod, a deliverer that sends only when
  * asked, a publisher, and the intake. Returns the agent, or { skipped }.
  */
-export async function actingAgent(at, store, lease, { log = console.log, push = false } = {}) {
+export async function actingAgent(at, store, lease, { log = console.log, push = false, checkLetters = null } = {}) {
   const config = store.getConfig();
   if (!config) return { skipped: 'no account on the pod' };
   const publicBase = config.gateway?.frontActor ? config.gateway.frontActor.replace(/ap\/actor\/?$/u, '') : null;
@@ -115,6 +117,8 @@ export async function actingAgent(at, store, lease, { log = console.log, push =
   // What the owner's own posts, taken at the outbox door, need of an agent.
   const agent = {
     store, publisher, deliverer, remote: at.remote, urls, config, lease, intake: null, viewer: false,
+    // The hashtags followed, changed from an app; FediPod in the browser reads them.
+    tagfeed: new TagFeed({ store, intake: null, log }),
     configured: () => true, requestTakeover: async () => true,
   };
   const c2s = new C2S({ agent, log });
@@ -122,6 +126,8 @@ export async function actingAgent(at, store, lease, { log = console.log, push =
     config, urls, remote: at.remote, store, deliverer, publisher, log, lease, push,
     ownerPost: (a, o) => c2s.dispatch(a, o),
   });
+  // The gateway's test letter, taken in here and answered (check-letter.mjs).
+  agent.intake.checkLetters = checkLetters;
   publisher.resolveActor = (u) => agent.intake.fetchAP(u);
   return agent;
 }