fedipod 1.50.0 → 1.55.2

package/web/admin/bar.js

@@ -4,6 +4,22 @@
 // relationship.
 
 (() => {
+  // A page loaded past its worker (a hard reload does that) leaves FediPod's
+  // own part asleep in the browser: nothing the page asks reaches it. Loaded
+  // again, normally, the worker answers. Once per tab, in case it cannot.
+  try {
+    const sw = navigator.serviceWorker;
+    const reloaded = performance.getEntriesByType?.('navigation')?.[0]?.type === 'reload';
+    if (sw?.controller) sessionStorage.removeItem('fedipod-reattached');
+    else if (sw && reloaded && !sessionStorage.getItem('fedipod-reattached')) {
+      sw.getRegistration().then((reg) => {
+        if (!reg?.active) return;
+        sessionStorage.setItem('fedipod-reattached', '1');
+        location.reload();
+      }).catch(() => {});
+    }
+  } catch { /* no storage to guard a second try: leave the page as it is */ }
+
   // The three destinations are <a href> now: they are navigations, so they
   // belong in a screen reader's links list, and middle-click and open-in-new-tab
   // work the way they do everywhere else. Nothing here has to drive them.
@@ -28,6 +44,7 @@
     // leaves the account looking broken from outside. Say so where the
     // account is, and let the owner take it back from here.
     if (s?.mode === 'viewer') viewerBanner();
+    if (s?.trouble?.count > 0) troubleBanner(s.trouble.count);
   }).catch(() => { /* not up yet; the bar still works */ });
 
   // The actors dropdown, on a page whose bar carries one. The record page
@@ -64,6 +81,34 @@
   }
 })();
 
+// Mail FediPod could not read, until its owner opens the dead letters
+// (upkeep.js), on every page with the bar.
+function troubleBanner(count) {
+  if (document.getElementById('trouble-banner')) return;
+  const base = location.pathname.replace(/\/admin\/.*$/u, '');
+  const onManage = !!document.getElementById('do-deadletter');
+  const box = document.createElement('div');
+  box.id = 'trouble-banner';
+  box.setAttribute('role', 'alert');
+  box.style.cssText = 'padding:.7rem 1rem;background:var(--field-bg,#ececec);color:var(--fg,#1a1a1a);'
+    + 'border-bottom:3px solid var(--err,#b00020);border-left:6px solid var(--err,#b00020);font:inherit';
+  const head = document.createElement('strong');
+  head.style.color = 'var(--err,#b00020)';
+  head.textContent = 'Mail not read. ';
+  const said = document.createElement('span');
+  said.textContent = `FediPod could not read ${count === 1 ? 'a piece' : `${count} pieces`} of your mail. `;
+  box.append(head, said);
+  if (onManage) {
+    box.append('Show dead letters lists what it gave up on.');
+  } else {
+    const go = document.createElement('a');
+    go.href = base + '/admin/';
+    go.textContent = 'See them on your manage page';
+    box.append(go);
+  }
+  document.body.prepend(box);
+}
+
 // "Another device is active": what it means for this account, and the way out.
 // The lease is a document on the pod with a five-minute life; a browser that
 // was closed leaves one behind that nothing renews, and every reload asks

package/web/admin/group.js

@@ -110,6 +110,23 @@ const setAutoAccept = async (auto) => {
 onPick(FOLLOWS_PICK, (v) => setAutoAccept(v === 'auto'),
   () => { FOLLOWS_PICK.value = config?.autoAcceptFollows ? 'auto' : 'approve'; });
 
+// Hashtag posts in the home timeline, or only on the public timeline and each
+// hashtag's page. FediPod goes on bringing them in either way.
+let homeTagsBusy = false;
+const setTagsInHome = async (show) => {
+  if (homeTagsBusy || show === (config.tagsInHome !== false)) return;
+  homeTagsBusy = true;
+  try {
+    if (await write('/config', { tagsInHome: show },
+      show ? 'hashtag posts are shown in your home timeline' : 'hashtag posts are kept out of your home timeline')) {
+      config.tagsInHome = show;
+    }
+    HOME_TAGS_PICK.value = config.tagsInHome !== false ? 'show' : 'hide';
+  } finally { homeTagsBusy = false; }
+};
+onPick(HOME_TAGS_PICK, (v) => setTagsInHome(v === 'show'),
+  () => { HOME_TAGS_PICK.value = config?.tagsInHome !== false ? 'show' : 'hide'; });
+
 // One row: what it is, then what can be done to it.
 function row(text, sub, actions) {
   const li = document.createElement('li');

package/web/admin/index.html

@@ -129,11 +129,10 @@ dd { margin: 0; min-width: 0; overflow-wrap: anywhere; }
 .muted { color: var(--muted); }
 /* The actors dropdown rides the bar, at the bar's own text scale. */
 #bar select { font-size: .95rem; }
-/* The per-account Options disclosure: only where storage is not a real choice
-   (the Node agent's Bluesky, cross-post instead) — a summary opening
-   Show/Hide in Feed, Cross-post On/Off, Connected/Disconnect. Where storage
-   IS a choice, two dropdowns sit in the row directly instead (admin.js
-   connectionControls). */
+/* The per-account Options disclosure, for the Node agent's Bluesky — a
+   summary opening Show/Hide in Feed, Cross-post On/Off, Connected/Disconnect.
+   A browser-build account's dropdown sits in the row directly instead
+   (record.js connectionControls). */
 details.opts { display: inline-block; }
 details.opts > summary { cursor: pointer; color: var(--link); list-style: none; }
 details.opts > summary::-webkit-details-marker { display: none; }
@@ -143,9 +142,8 @@ details.opts > div { margin: .4rem 0 .2rem; padding: .5rem .6rem; display: flex;
   gap: .4rem; align-items: stretch; border: 1px solid var(--line); border-radius: .3rem;
   background: var(--raised); min-width: 11rem; }
 details.opts > div select { width: 100%; }
-.opt-hint { color: var(--muted); font-size: .9rem; margin: -.1rem 0 .1rem; }
-/* The connection and storage dropdowns that sit in the row itself (admin.js
-   connectionControls) — extra room from the account name before them. */
+/* The connection dropdown that sits in the row itself (record.js
+   connectionControls) — extra room from the account name before it. */
 .conn-controls { display: inline-flex; align-items: center; gap: .4rem; margin-left: 1rem; }
 /* The alias row inside the Transfer-an-account-here panel. */
 #alias-ctl { display: flex; gap: .5rem; align-items: center; margin-top: .3rem; }
@@ -327,6 +325,12 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
       <option value="auto">accepted automatically</option>
     </select>
   </span>
+  <span id="home-tags-ctl" hidden>
+    <select id="home-tags-pick" aria-label="Hashtag posts in your home timeline" title="   Whether posts brought in for the hashtags you follow appear in your home timeline; hidden, they stay on the public timeline and on each hashtag's page">
+      <option value="show">shown</option>
+      <option value="hide">hidden</option>
+    </select>
+  </span>
   <span id="ident-ctl" hidden>
     <button type="button" id="ident-open" class="inline" title="   Connect an account you hold on another network, so its timeline joins the one you read here">Connect an identity</button>
   </span>

package/web/admin/record.js

@@ -17,6 +17,8 @@ const STATUS_PICK = $('status-pick');   // held: getElementById can't see it mid
 const IDENT_CTL = $('ident-ctl');
 const FOLLOWS_CTL = $('follows-ctl');
 const FOLLOWS_PICK = $('follows-pick');
+const HOME_TAGS_CTL = $('home-tags-ctl');
+const HOME_TAGS_PICK = $('home-tags-pick');
 const UPDATE_CTL = $('update-ctl');
 const UPDATE_WORD = $('update-word');
 const UPDATE_GO = $('update-go');
@@ -130,7 +132,6 @@ function identityRows() {
     crossPost: 'crossPost' in config.atproto ? config.atproto.crossPost : null,
     feed: (paused) => ['/atproto', { feedPaused: paused }],
     cross: (on) => ['/atproto', { crossPost: on }],
-    store: (w) => ['/atproto', { storage: w }],
     off: () => ['/atproto/disconnect', {}],
   });
   for (const acct of config.fediAccounts || []) accounts.push({
@@ -141,7 +142,6 @@ function identityRows() {
     feedPaused: !acct.enabled,
     crossPost: null,
     feed: (paused) => ['/fediacct', { id: acct.id, enabled: !paused }],
-    store: (w) => ['/fediacct', { id: acct.id, storage: w }],
     off: () => ['/fediacct/disconnect', { id: acct.id }],
   });
   for (const acct of accounts) {
@@ -149,18 +149,16 @@ function identityRows() {
     name.textContent = acct.handle;
     if (acct.href) { name.href = acct.href; name.target = '_blank'; name.rel = 'noopener'; name.title = '   Open this account elsewhere in a new tab'; }
     if (acct.warn) name.className = 'warn';
-    // Where storage is a real choice (every browser-build account today), two
-    // dropdowns sit in the row itself. Where it isn't (the Node agent's
-    // Bluesky, which shows a cross-post toggle instead), the Options
-    // disclosure it always has is unchanged.
+    // A browser-build account (it says where it is stored) gets its dropdown
+    // in the row itself. The Node agent's Bluesky, which shows a cross-post
+    // toggle instead, keeps the Options disclosure it always has.
     row(acct.label, name, ' ', ...(acct.storage ? connectionControls(acct) : [optionsMenu(acct)]));
   }
   return out;
 }
 
-// Connected, Paused or Disconnected, and where the key lives — one dropdown
-// each, in the row. Replaces the separate feed and connect dropdowns that used
-// to sit behind an Options disclosure; only reached where acct.storage is set.
+// Connected, Paused or Disconnected, as one dropdown in the row; only reached
+// where acct.storage is set. The key is kept on the pod, with no choice to make.
 function connectionControls(acct) {
   const send = async ([path, payload], msg) => { if (await write(path, payload, msg)) await load(); };
   const pick = (opts, current, onChange, title) => {
@@ -177,23 +175,14 @@ function connectionControls(acct) {
       ? send(acct.off(), 'disconnected')
       : send(acct.feed(v === 'paused'), v === 'paused' ? 'paused adding to your feed' : 'added to your home feed')),
     '   Connected feeds this account into your home feed here; Paused keeps the account but stops adding its posts; Disconnected removes it.');
-  const storage = pick(
-    [['pod', 'Store key on Pod'], ['browser', 'Store key in Browser']],
-    acct.storage,
-    (v) => {
-      if (v === 'pod' && !confirm('Store this account on your pod?\n\nIt will follow you to any browser you sign in from — but a full-access token to that account then lives on your pod.')) { load(); return; }
-      send(acct.store(v), v === 'pod' ? 'stored on your pod' : 'stored in this browser');
-    },
-    '   On your pod the key follows you to any browser you sign in from, and a full-access token then lives there; in this browser the token never leaves this device.');
   const wrap = document.createElement('span');
   wrap.className = 'conn-controls';
-  wrap.append(conn, ' ', storage);
+  wrap.append(conn);
   return [wrap];
 }
 
-// Every connected account without a storage choice carries an Options menu
-// instead: pause its feed, its cross-post toggle (the Node agent's Bluesky),
-// disconnect.
+// The Node agent's Bluesky carries an Options menu instead: pause its feed,
+// its cross-post toggle, disconnect.
 function optionsMenu(acct) {
   const d = document.createElement('details');
   d.className = 'opts';
@@ -218,14 +207,8 @@ function optionsMenu(acct) {
     pick([['show', 'Add to home feed'], ['hide', 'Pause adding to home feed']], acct.feedPaused ? 'hide' : 'show',
       (v) => send(acct.feed(v === 'hide'), v === 'hide' ? 'paused adding to your feed' : 'added to your home feed'));
   }
-  // Storage where the browser offers the choice; the Node agent's Bluesky shows
-  // its cross-post toggle in the same slot instead.
-  if (acct.storage) {
-    pick([['browser', 'Store key in Browser'], ['pod', 'Store key on Pod']], acct.storage, (v) => {
-      if (v === 'pod' && !confirm('Store this account on your pod?\n\nIt will follow you to any browser you sign in from — but a full-access token to that account then lives on your pod.')) { load(); return; }
-      send(acct.store(v), v === 'pod' ? 'stored on your pod' : 'stored in this browser');
-    });
-  } else if (acct.crossPost !== null) {
+  // The Node agent's Bluesky: its cross-post toggle.
+  if (acct.crossPost !== null) {
     pick([['on', 'Cross-post On'], ['off', 'Cross-post Off']], acct.crossPost ? 'on' : 'off',
       (v) => send(acct.cross(v === 'on'), ''));
   }
@@ -233,14 +216,6 @@ function optionsMenu(acct) {
   pick([['connected', 'Connected'], ['disconnect', 'Disconnect']], 'connected',
     (v) => { if (v === 'disconnect') send(acct.off(), 'disconnected'); else load(); });
 
-  // The storage consequence, at the bottom of the box under every dropdown.
-  if (acct.storage) {
-    const hint = document.createElement('p'); hint.className = 'opt-hint';
-    hint.textContent = acct.storage === 'pod'
-      ? 'Follows you to every browser you sign in from; a full-access token lives on your pod.'
-      : 'Stays in this browser; the token never leaves this device.';
-    body.appendChild(hint);
-  }
   return d;
 }
 
@@ -265,9 +240,6 @@ function render() {
     ['Fediverse identity', config.address || `@${config.handle} — no resolvable address`,
       config.accountId && config.address ? { href: `/admin/client/#/a/${config.accountId}` } : null],
     ['Solid identity', config.webId, config.remotePod ? { href: config.remotePod, blank: true } : null],
-    // Where on the pod the account's data lives: the container its owner chose.
-    ['stored at', config.remotePod && config.root ? config.remotePod + config.root : null,
-      config.remotePod && config.root ? { href: config.remotePod + config.root, blank: true } : null],
     ['Other identities', 'ctl'],
     ['local store', config.home],
     // The address you actually open, not the bare number — the named origin when
@@ -282,7 +254,7 @@ function render() {
   if (config.movedTo) rows.push(['moved to', config.movedTo]);
   // A person gates followers here; a group's gate is the joins control on its
   // kind row, so the row would be a second switch for the same thing.
-  if (config.kind !== 'group') rows.splice(2, 0, ['new followers', 'ctl']);
+  if (config.kind !== 'group') rows.splice(2, 0, ['new followers', 'ctl'], ['hashtag posts in home', 'ctl']);
   // Rows that belong under the one being written, appended after it.
   let kids = null;
   for (const [k, v, link] of rows) {
@@ -323,6 +295,12 @@ function render() {
       FOLLOWS_CTL.hidden = false;
       FOLLOWS_PICK.value = config.autoAcceptFollows !== false ? 'auto' : 'approve';
     }
+    if (k === 'hashtag posts in home') {
+      dd.textContent = '';
+      dd.append(HOME_TAGS_CTL);
+      HOME_TAGS_CTL.hidden = false;
+      HOME_TAGS_PICK.value = config.tagsInHome !== false ? 'show' : 'hide';
+    }
     if (k === 'gateway') {
       dd.textContent = '';
       dd.append(GATEWAY_CTL);

package/web/admin/upkeep.js

@@ -64,6 +64,9 @@ $('do-deadletter').addEventListener('click', async () => {
   if (showingFrom('deadletter')) { closePanels(); return; }
   const { json } = await api('/deadletter');
   output(json?.items?.length ? json.items : 'no dead letters', 'deadletter');
+  // Looked at: the bar stops saying mail was not read.
+  const seen = await postJson('/trouble', { seen: true }).catch(() => null);
+  if (seen?.status === 200) document.getElementById('trouble-banner')?.remove();
 });
 
 // ---- lifecycle ----

package/web/app/README.md

@@ -41,9 +41,9 @@ worker answers the data endpoints it calls. See
 | file | what |
 |---|---|
 | `admin-facade.mjs` | Answers the owner/manage endpoints (`/status`, `/config`, `/gateway`, `/alias`, `/rotate-key`, `/rebuild`, `/move`, `/retire`, `/inbox/prune`, `/deadletter`, `/blocks`, `/atproto*`, `/fediacct*`) over the browser agent, mirroring `lib/device/admin.mjs`. Personal only. |
-| `atproto-browser.mjs` | The Bluesky connection (`lib/connections/atproto.mjs`) with a per-connection storage choice — IndexedDB (this browser) or owner-only pod state — plus pause. |
-| `fediacct-browser.mjs` | Connections to fediverse accounts on other servers (`lib/connections/fediacct.mjs`): the OAuth dance, the same storage choice, and a best-effort server-side revoke on disconnect. |
-| `idb-kv.mjs` | The per-origin IndexedDB key/value store the two connectors use for "on this device, never the pod" credentials. |
+| `atproto-browser.mjs` | The Bluesky connection (`lib/connections/atproto.mjs`), its credential kept in the owner-only pod state and nowhere else, plus pause. A record found in IndexedDB moves to the pod. |
+| `fediacct-browser.mjs` | Connections to fediverse accounts on other servers (`lib/connections/fediacct.mjs`): the OAuth dance, the credential kept on the pod the same way, and a best-effort server-side revoke on disconnect. |
+| `idb-kv.mjs` | The per-origin IndexedDB key/value store the two connectors use for app registrations, the OAuth pending state, and any credential found there, until it moves to the pod. |
 
 `agent.mjs` also holds the single-active-agent **lease** (`lib/core/lease.mjs`) — a
 second device runs read-only until it takes over — and starts the drain/mirrors

package/web/app/admin-facade.mjs

@@ -22,14 +22,14 @@ import { followActor, followHandle } from '../../lib/core/social.mjs';
 // The identity itself — changing any means a different actor, i.e. a new setup.
 const PERMANENT_CONFIG = ['handle', 'remotePod', 'issuer', 'root', 'kind'];
 // Carried in the actor document, so a change is not live until republished.
-const WIRE_CONFIG = ['name', 'summary', 'icon', 'image', 'fields', 'aliases'];
+const WIRE_CONFIG = ['name', 'summary', 'icon', 'image', 'fields', 'aliases', 'autoAcceptFollows'];
 
 // The data endpoints this agent answers at the origin root (the page computes
 // its base as the origin, so it asks for /status, not /admin/status). Anything
 // not here falls through to the network as a static file or the gateway.
 export const ADMIN_PATHS = new Set([
   '/status', '/config', '/gateway', '/alias', '/rotate-key', '/import',
-  '/deadletter', '/blocks', '/profiles', '/modqueue', '/log', '/fediacct', '/describe', '/follow',
+  '/deadletter', '/trouble', '/blocks', '/profiles', '/modqueue', '/log', '/fediacct', '/describe', '/follow',
   '/atproto', '/atproto/connect', '/atproto/disconnect',
   '/rebuild', '/move', '/retire', '/inbox/prune', '/park', '/revive', '/takeover',
   '/gateway/pause', '/gateway/keep', '/gateway/close',
@@ -120,6 +120,7 @@ export class AdminFacade {
             image: cfg.image || null, fields: cfg.fields || [],
             aliases: cfg.aliases || [],
             autoAcceptFollows: cfg.autoAcceptFollows !== false,
+            tagsInHome: cfg.tagsInHome !== false,
             quiescedAt: cfg.quiescedAt || null, movedTo: cfg.movedTo || null,
             mode: a.status().mode,
             // Live from the credential's actual backend on THIS browser (a
@@ -162,7 +163,7 @@ export class AdminFacade {
           });
         }
         case '/modqueue': return json(200, []);           // person: no moderation queue
-        case '/log': return json(200, { lines: [] });     // no local log file in the browser
+        case '/log': return json(200, { lines: (await a.recentLog?.()) || [] });
         case '/fediacct': return json(200, { accounts: a.fediaccts?.status() || [] });
         case '/import':
           return json(200, a.importer ? a.importer.progress() : { running: false, total: 0, done: 0 });
@@ -194,6 +195,13 @@ export class AdminFacade {
 
     // ---- writes ----
     switch (p) {
+      // The owner has opened the dead letters: the bar stops saying so.
+      case '/trouble': {
+        if (body.seen !== true) return json(400, { error: 'seen: true is the only thing to say here' });
+        a.troubleSeen?.();
+        await a.store.flush();
+        return json(200, { ok: true, trouble: a.status().trouble });
+      }
       case '/config': {
         const fixed = PERMANENT_CONFIG.filter(k => k in body);
         if (fixed.length) return json(400, { error: `${fixed.join(', ')} cannot be changed — that is the identity itself` });
@@ -216,6 +224,7 @@ export class AdminFacade {
             .map(f => ({ name: String(f.name).trim(), value: String(f.value ?? '').trim() }));
         }
         if ('autoAcceptFollows' in body) cfg.autoAcceptFollows = !!body.autoAcceptFollows;
+        if ('tagsInHome' in body) cfg.tagsInHome = !!body.tagsInHome;
         const republish = WIRE_CONFIG.some(k => k in body);
         a.store.setConfig(cfg);
         if ('autoAcceptFollows' in body && a.publisher) a.publisher.config.autoAcceptFollows = cfg.autoAcceptFollows;
@@ -511,21 +520,18 @@ export class AdminFacade {
         await a.store.flush();
         return json(200, { ok: true });
       }
-      // Bluesky settings: pause/resume the mirror, and move the credential
-      // between this browser and the pod. Cross-post is default-on, not toggled.
+      // Bluesky settings: pause/resume the mirror. Cross-post is default-on, not
+      // toggled. The credential is kept on the pod, with nowhere else to move.
       case '/atproto': {
         if (!a.atproto?.connected()) return json(400, { error: 'no bluesky account connected' });
+        if ('storage' in body) return json(400, { error: 'a connected account is kept on your pod' });
         if ('feedPaused' in body) { a.atproto.setFeedPaused(!!body.feedPaused); a.restartBsky?.(); }
-        if ('storage' in body) {
-          if (!['pod', 'browser'].includes(body.storage)) return json(400, { error: 'storage must be pod or browser' });
-          a.atproto.setStorage(body.storage);
-        }
         return json(200, { ok: true, ...a.atproto.status() });
       }
 
       // Connect a fediverse account on another server: start its OAuth at that
       // server. The browser is then sent to `authorize`; the code comes back to
-      // GET /fediacct/callback (above). The token never touches the pod.
+      // GET /fediacct/callback (above). The token is kept on the pod.
       case '/fediacct/connect': {
         if (!body.host) return json(400, { error: 'the address of the server is required' });
         try {
@@ -540,14 +546,11 @@ export class AdminFacade {
         a.restartAccts?.();
         return json(200, { ok: true });
       }
-      // Pause/resume the mirror, or move the credential between browser and pod.
+      // Pause/resume the mirror. The credential is kept on the pod.
       case '/fediacct': {
         if (!body.id) return json(400, { error: 'id required' });
-        let row;
-        if ('storage' in body) {
-          if (!['pod', 'browser'].includes(body.storage)) return json(400, { error: 'storage must be pod or browser' });
-          row = a.fediaccts.setStorage(body.id, body.storage);
-        } else row = a.fediaccts.setEnabled(body.id, !!body.enabled);
+        if ('storage' in body) return json(400, { error: 'a connected account is kept on your pod' });
+        const row = a.fediaccts.setEnabled(body.id, !!body.enabled);
         if (!row) return json(404, { error: 'no such account' });
         a.restartAccts?.();
         return json(200, { ok: true, account: row });

package/web/app/agent.mjs

@@ -183,6 +183,34 @@ export class BrowserAgent {
   // (lib/gateway/held-mail.mjs: /api/push). Named a moment later, once written,
   // so a burst is one call. One from another network is not pushed.
   static PUSH_AFTER_MS = 2_000;
+
+  // Mail FediPod could not read: counted until its owner opens the dead
+  // letters, shown in the bar meanwhile, and told to their phones at most
+  // once an hour (lib/gateway/held-mail.mjs: /api/alert).
+  static TROUBLE_ALERT_MS = 60 * 60_000;
+  noteTrouble(t, { tell = true } = {}) {
+    const had = this.store.read('trouble.json', null) || { count: 0 };
+    const now = Date.now();
+    const due = tell && now - (had.alertedAt ? Date.parse(had.alertedAt) : 0) >= BrowserAgent.TROUBLE_ALERT_MS;
+    const next = { ...had, count: (had.count || 0) + 1, firstAt: had.firstAt || t.at, lastAt: t.at,
+      last: { kind: t.kind, reason: t.reason }, ...(due ? { alertedAt: new Date(now).toISOString() } : {}) };
+    this.store.write('trouble.json', next);
+    this.log(`could not read mail (${t.kind}): ${t.reason}`);
+    if (due) {
+      const many = next.count === 1 ? 'a piece of your mail' : `${next.count} pieces of your mail`;
+      this.tellGateway('alert', { handle: this.doorKey, text: `Could not read ${many}. Show dead letters on your manage page lists what it gave up on.` }, { standing: false })
+        .catch(() => {});
+    }
+  }
+  // The owner has looked: the count starts again, and the hourly limit stands.
+  troubleSeen() {
+    const had = this.store.read('trouble.json', null);
+    if (had?.count) {
+      this.store.write('trouble.json', { count: 0, ...(had.alertedAt ? { alertedAt: had.alertedAt } : {}),
+        ...(had.letterMissing ? { letterMissing: had.letterMissing } : {}) });
+    }
+  }
+
   notePush(n) {
     if (!this.gatewayApi || n?.bsky || n?.via) return;
     if (!Object.keys(this.store.read('webpush.json', { subs: {} }).subs || {}).length) return;
@@ -243,6 +271,12 @@ export class BrowserAgent {
   async hereAtGateway() {
     const said = await this.tellGateway('here', { handle: this.doorKey, nextAt: this.store ? nextDue(this.store) : null });
     if (said?.status === 200) saveMeta(this.webId, { hereAt: Date.now() }).catch(() => {});
+    // The gateway's test letter has not arrived: the bar says so, once per
+    // letter. The gateway has told the phones itself.
+    if (said?.status === 200 && said.missingLetter && this.store?.read('trouble.json', null)?.letterMissing !== said.missingLetter) {
+      this.noteTrouble({ kind: 'test-letter', reason: "the gateway's test letter has not arrived", at: new Date().toISOString() }, { tell: false });
+      this.store.write('trouble.json', { ...this.store.read('trouble.json', {}), letterMissing: said.missingLetter });
+    }
     // The gateway's admin may have turned the hold off or on (copy-mode.mjs).
     if (said?.status === 200 && typeof said.hold === 'boolean') {
       await followHold(this, this.frontOrigin, said.hold).catch((e) => this.log(`the gateway's hold: ${e.message}`));
@@ -329,6 +363,14 @@ export class BrowserAgent {
         }
       }
       this.store.onEvent = (type, n) => { if (type === 'notification') this.notePush(n); };
+      // A profile that says otherwise than the follower setting (written by an
+      // older FediPod, or before the setting changed) is written again.
+      // Tried at most hourly, so a pod that refuses it is not asked at every wake.
+      const tried = this.store.read('published.json', {}).healTriedAt;
+      if (!this.publisher.profileAgrees() && !(tried && Date.now() - Date.parse(tried) < 60 * 60_000)) {
+        this.store.write('published.json', { ...this.store.read('published.json', {}), healTriedAt: new Date().toISOString() });
+        await this.publisher.publishProfile({ force: true }).catch((e) => this.log(`profile: ${e.message}`));
+      }
       const now = Date.now();
       // Said before the drain starts, so held mail is in the inbox to be read.
       const hereDue = !warm || now - (warm.hereAt || 0) >= BrowserAgent.HERE_EVERY_MS;
@@ -343,6 +385,9 @@ export class BrowserAgent {
       this._schedTimer = setInterval(() => { publishDue(this.store, this.publisher, this.log).catch(() => {}); }, 30_000);
       const drainNow = !warm || now - (warm.drainedAt || 0) >= DRAIN_EVERY_MS || here?.flushed > 0;
       await this.intake.start({ drainNow, subscribe: !warm || !!warm.resubscribe });
+      // Connected accounts still kept in this browser go to the pod.
+      await this.atproto.moveToPod?.().catch((e) => this.log(`Bluesky account to the pod: ${e.message}`));
+      await this.fediaccts.moveToPod?.().catch((e) => this.log(`connected accounts to the pod: ${e.message}`));
       this.startBsky();
       this.startAccts();
       this.tagfeed?.start(this.mirrorStart('tags'));
@@ -516,7 +561,9 @@ export class BrowserAgent {
     let unread = null;
     const fullLoad = () => this.store.load().catch((e) => { unread = e; });
     // Warm: only documents caught mid-write are read again, else a full load.
-    if (this._warm) await this.store.refresh(this._warm.pending).catch(fullLoad);
+    // A kept copy without the container's ETag is one whose last load could
+    // not read everything: what it lacks is still on the pod, unread.
+    if (this._warm && warmFrom.listingEtag) await this.store.refresh(this._warm.pending).catch(fullLoad);
     else await fullLoad();
     // Config: handed in on sign-up, or read from the pod on a returning sign-in.
     const cfg = config || this.store.getConfig();
@@ -632,6 +679,17 @@ export class BrowserAgent {
       store: this.store, deliverer: this.deliverer, publisher: this.publisher, log: this.log, push: true, lease: this.lease,
       ownerPost: (a, o) => this.c2s.dispatch(a, o),
     });
+    this.intake.onTrouble = (t) => this.noteTrouble(t);
+    // The gateway's test letter: answered when taken in, and shown nowhere.
+    if (this.gatewayApi) {
+      this.intake.checkLetters = {
+        actor: `${this.frontOrigin.replace(/\/$/u, '')}/check/actor`,
+        taken: async (letter) => {
+          const said = await this.tellGateway('check', { handle: this.doorKey, letter }, { standing: false });
+          if (said?.status !== 200) throw new Error(`the gateway did not take the answer to its test letter (${said?.status || 'no answer'})`);
+        },
+      };
+    }
     // The Mastodon facade the service worker serves.
     //
     // It used to be handed `allowed: null`, which reads as "no policy" — and
@@ -683,8 +741,14 @@ export class BrowserAgent {
       // its last full start.
       if (!this._warm) await containers.provisionPrivate(this.remote, this.urls);
       // Connected-account records are reads — safe whether we act or view.
-      await this.atproto.load();      // the Bluesky credential, if it is browser-stored
-      await this.fediaccts.load();    // connected fediverse accounts, from both backends
+      // Connected accounts: their records stay on the pod only, so no listing
+      // of the gateway's copy names them; read at every full start, and at the
+      // first quick one that has not had them. A Bluesky credential or
+      // fediverse accounts still kept in this browser are read as well.
+      const readConn = !this._warm || !this._warm.connRead;
+      await this.atproto.load({ fromPod: readConn });
+      await this.fediaccts.load({ fromPod: readConn });
+      if (readConn) saveMeta(this.webId, { connRead: true }).catch(() => {});
       // The lease decides: this device ACTS on the pod, or reads it read-only.
       // A warm restart already holds it, and writes it only when renewal is due.
       this.viewer = !(this._warm && !this._warm.renewDue ? true : await this.lease.acquire());
@@ -732,6 +796,7 @@ export class BrowserAgent {
       update: null,
       inboxCooldownFor: 0,
       stateSkipped: this.store?.lastSkipped || [],
+      trouble: this.store?.read('trouble.json', null) || null,
     };
   }
 

package/web/app/atproto-browser.mjs

@@ -2,16 +2,15 @@
 //
 // Same Atproto client the Node agent uses (lib/atproto.mjs). Two browser edges:
 //
-//  1. Storage is the owner's choice, per connection. "browser" keeps the
-//     credential in IndexedDB on this device (default — a full-access token
-//     stays here); "pod" keeps it in the owner-only pod state so it follows the
-//     owner to any browser they sign in from. The record carries which, and
-//     read/write route to that backend; moving between them is just a re-write.
+//  1. The credential lives in the owner-only pod state, on the pod only
+//     (lib/core/pod-only.mjs), so it follows the owner to any browser they sign
+//     in from. A record an earlier build kept in this browser's IndexedDB is
+//     still read, and moveToPod() takes it to the pod.
 //  2. The mirror can be paused (feedPaused) without disconnecting.
 //
 // Bluesky's API answers CORS, so the fetches go direct, not through the relay.
 import { Atproto } from '../../lib/connections/atproto.mjs';
-import { kvGet, kvPut, kvDel } from './idb-kv.mjs';
+import { kvGet, kvDel } from './idb-kv.mjs';
 
 const IDB_KEY = 'atproto';
 const POD_DOC = 'atproto.json';
@@ -20,19 +19,24 @@ export class BrowserAtproto extends Atproto {
   constructor({ store, actorId = null, log = console.log } = {}) {
     super({ localDir: '/atproto', actorId, log });   // localDir unused; storage below
     this.store = store;
-    this._idbRec = null;     // the browser-stored record, cached at boot
+    this._idbRec = null;     // a record still in this browser, cached at boot
   }
 
   // The IndexedDB copy into memory, so read() stays synchronous as the base
   // class expects. The pod copy is already in the loaded store.
-  async load() { this._idbRec = await kvGet(IDB_KEY).catch(() => null); return this; }
+  // `fromPod`: the pod's record read as well (agent.mjs says when).
+  async load({ fromPod = false } = {}) {
+    this._idbRec = await kvGet(IDB_KEY).catch(() => null);
+    if (fromPod) await this.store.refresh?.([POD_DOC], { ifChanged: true }).catch((e) => this.log(`Bluesky account: ${e.message}`));
+    return this;
+  }
 
   // Whichever backend holds it, tagged with where it lives. The stamped-record
   // guard is the base class's.
   read() {
     let rec = null; let where = null;
-    if (this._idbRec) { rec = this._idbRec; where = 'browser'; }
-    else { const p = this.store.read(POD_DOC, null); if (p) { rec = p; where = 'pod'; } }
+    const p = this.store.read(POD_DOC, null);
+    if (p) { rec = p; where = 'pod'; } else if (this._idbRec) { rec = this._idbRec; where = 'browser'; }
     if (!rec) return null;
     if (rec.mintedFor && this.actorId && rec.mintedFor !== this.actorId) {
       this.log(`atproto belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
@@ -41,18 +45,22 @@ export class BrowserAtproto extends Atproto {
     return { ...rec, storage: where };
   }
 
-  // Write to the record's chosen backend (default browser), and clear the other
-  // so a moved credential leaves no copy behind.
   write(rec) {
-    const where = rec.storage || 'browser';
-    const clean = { ...rec, storage: where };
-    if (where === 'pod') {
-      this.store.write(POD_DOC, clean); this.store.flush?.().catch(() => {});
-      this._idbRec = null; kvDel(IDB_KEY).catch(() => {});
-    } else {
-      this._idbRec = clean; kvPut(IDB_KEY, clean).catch((e) => this.log(`atproto persist: ${e.message}`));
-      this.store.write(POD_DOC, null); this.store.flush?.().catch(() => {});
+    this.store.write(POD_DOC, { ...rec, storage: 'pod' }); this.store.flush?.().catch(() => {});
+  }
+
+  // A record still in this browser, onto the pod, and out of the browser once
+  // the pod has it. One the pod already holds is newer there.
+  async moveToPod() {
+    const rec = this._idbRec;
+    if (!rec || (rec.mintedFor && this.actorId && rec.mintedFor !== this.actorId)) return false;
+    if (!this.store.read(POD_DOC, null)) {
+      this.store.write(POD_DOC, { ...rec, storage: 'pod' });
+      if (!await this.store.commit()) return false;
     }
+    this._idbRec = null; await kvDel(IDB_KEY).catch(() => {});
+    this.log('the Bluesky account moved from this browser to the pod');
+    return true;
   }
 
   status() {
@@ -69,8 +77,6 @@ export class BrowserAtproto extends Atproto {
   feedActive() { return this.connected() && !this.read()?.feedPaused; }
   setFeedPaused(on) { const rec = this.read(); if (rec) this.write({ ...rec, feedPaused: !!on }); }
 
-  // Move the credential between backends (the Options menu's Storage control).
-  setStorage(where) { const rec = this.read(); if (rec && (where === 'pod' || where === 'browser')) this.write({ ...rec, storage: where }); }
 
   async disconnect() {
     const rec = this.read();

package/web/app/deliver-relay.mjs

@@ -105,7 +105,8 @@ export class RelayDeliverer extends Deliverer {
     const status = r0.status || 0;
     if (status === 0) { const err = new Error(r0.error || 'relay could not send'); err.status = 502; throw err; }
     if (status >= 400) {
-      const err = new Error(`${method} ${url} → ${status}`); err.status = status;
+      // `answered`: the far server's own answer, as against the relay's.
+      const err = new Error(`${method} ${url} → ${status}`); err.status = status; err.answered = true;
       // The receiving server's own answer to "when should I try again", carried
       // through the relay (lib/front-core.mjs). Spelled `retryAfterMs`, which is
       // what the delivery queue reads (lib/deliver.mjs) — the queue's ladder is