fedipod 1.50.2 → 1.56.0

package/README.md

@@ -52,7 +52,8 @@ Akkoma, Pixelfed or Friendica, connect it from the manage page and read it
 here. Its home timeline and notifications join the feed you already read,
 interleaved by time, and a post both accounts see appears once. Favouriting,
 boosting and replying act as the account the post came through. The token it
-hands back stays in your browser unless you choose to keep it on your pod.
+hands back is kept on your pod, so the account follows you to any browser you
+sign in from.
 
 **Moving in.** Mastodon-format exports of follows, blocks, mutes, lists and
 domain blocks import from the manage page. Your old account can be listed as

package/gateway.md

@@ -240,6 +240,19 @@ An app checks for new posts every minute or so while it is open; there are no
 live updates. Accounts are made on the fedipod.net front page, with a pod, not
 from an app.
 
+**Your connected accounts, with FediPod closed.** FediPod open in a browser
+reads the Mastodon and Bluesky accounts you connected every five minutes.
+While it is closed and an app is in use, fedipod.net reads them instead, at
+most every five minutes, when the app checks your timeline or notifications.
+Their logins are read from your pod for each read and are not kept at
+fedipod.net. An account you have just connected can take up to an hour to be
+read here.
+
+**Hashtags.** The hashtags you follow are one list, in FediPod and in an app:
+following or unfollowing one in either changes it in both. FediPod brings in
+the posts for them, while it is open. **hashtag posts in home** on your manage
+page keeps them out of your home timeline, in FediPod and in an app alike.
+
 **Notifications on your phone.** An app that offers notifications can sign up
 for them here. A mention, a reply, a direct message, a follow, or a like, boost
 or reaction to your own post then reaches your phone as it arrives, whether
@@ -281,6 +294,18 @@ removes them at `/notices`, signed in as the admin the way the roster is.
 A notice is a title and plain text: a blank line starts a paragraph, and a
 web address becomes a link.
 
+## When mail does not get through
+
+When FediPod cannot read a piece of your mail, a red line across the top of
+its pages says so until you open Show dead letters on your manage page. Your
+phone hears too, at most once an hour, if a Mastodon app on it is signed in at
+the gateway with notifications on.
+
+The gateway's admin also gets a test letter every six hours, sent to their own
+account through the same door every server uses. FediPod takes it in and shows
+it nowhere. If FediPod has been open for an hour and the letter has not
+arrived, the admin's phone is told and the red line goes up.
+
 ## What the gateway can see
 
 It reads only public data to decide what concerns you: your published

package/gui.md

@@ -3,7 +3,7 @@
 In the browser version at fedipod.net, `manage`, in the bar's account group, opens this
 same page for your account. The rest of this page describes it as the
 DeviceAgent serves it; the controls are the same, minus the manual inbox
-drain and the local log, which a browser does not have.
+drain, which a browser does not have.
 
 Open `https://localhost:8030/` while any agent is running — it forwards you to the agent — then choose `manage` in the bar's account group and select the actor you want from the local actors dropdown.
 Picking an actor marked "(stopped)" starts its agent, then opens its page.
@@ -48,8 +48,7 @@ its own port.
 
 Each identity has a page anyone can open, at `ap/profile.html` under its pod
 — for example `https://your-pod.example/fedipod/ap/profile.html`
-(the `fedipod` container is wherever you put it at setup; the manage page's
-"stored at" row says where). It
+(the `fedipod` container is wherever you put it at setup). It
 shows the name, bio and address, and offers a Follow box: a visitor types
 their own server and lands on that server's follow screen. Hand out that
 link, or the `@name@host` address itself, which works in the search box of
@@ -96,6 +95,15 @@ Disconnecting stops the reading and removes the stored token; nothing already
 posted is touched. If the other server stops accepting the token, the account
 is marked **sign in again** rather than quietly dropped.
 
+## Hashtag posts in your home timeline
+
+The posts brought in for the hashtags you follow appear in your home timeline.
+Set **hashtag posts in home** to *hidden* and they appear only on the public
+timeline and on each hashtag's page; they are still brought in. A hashtag post
+that one of your connected accounts also brought in is from someone you follow
+there, and stays. An app already showing them keeps them on screen until it
+reloads.
+
 ## Handling follow requests
 
 New followers are accepted automatically. Set **new followers** to *wait for

package/lib/client/masto/timelines.mjs

@@ -18,6 +18,10 @@ export async function handle(api, ctx) {
   if (pathname === '/api/v1/timelines/home' || pathname === '/api/v1/timelines/public'
     || pathname === '/api/v1/trends/statuses') {
     const localOnly = pathname === '/api/v1/timelines/public' && url.searchParams.get('local') === 'true';
+    // The owner can keep hashtag posts out of Home (`tagsInHome: false`); they
+    // stay on the public timeline, their hashtags' pages and trends. One a
+    // connected account also brought in is from someone followed there.
+    const hideTags = pathname === '/api/v1/timelines/home' && api.store.getConfig?.()?.tagsInHome === false;
     // The UNFILTERED list, both as the source and as the reply-count corpus:
     // a reply can be a mention, and mentions are filtered out of timelines
     // below — counting against the filtered set would undercount them.
@@ -31,6 +35,7 @@ export async function handle(api, ctx) {
       .filter(s => s.kind !== 'remote' && s.kind !== 'mention')
       .filter(s => !s.direct && s.visibility !== 'direct')
       .filter(s => !muted.has(s.actor) && !muted.has(s.via))
+      .filter(s => !hideTags || s.kind !== 'tag' || s.sourceAccts?.length)
       .filter(s => !localOnly || (s.kind === 'post' && s.visibility !== 'private'))
       .sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
     const { items: page, headers } = api.page(items, url);

package/lib/connections/acctfeed.mjs

@@ -145,8 +145,11 @@ export class AcctFeed {
     return map;
   }
 
+  // A server that does not say what is left (not every Mastodon-API server
+  // does) is not taken to have nothing left.
   _rateGuard(id, handle, res) {
-    const left = Number(res.headers.get('x-ratelimit-remaining'));
+    const said = res.headers.get('x-ratelimit-remaining');
+    const left = said == null || said.trim() === '' ? NaN : Number(said);
     if (!Number.isFinite(left) || left > RATE_FLOOR) return false;
     const reset = Date.parse(res.headers.get('x-ratelimit-reset') || '');
     const wait = Number.isFinite(reset) ? Math.max(0, reset - Date.now()) : BACKOFF_MIN_MS;

package/lib/connections/tagfeed.mjs

@@ -81,8 +81,11 @@ export class TagFeed {
     if (Array.isArray(patch.tags)) clean.tags = patch.tags.map(t => String(t).replace(/^#/, '').trim()).filter(Boolean);
     if (patch.intervalMin) clean.intervalMin = Math.max(5, Number(patch.intervalMin) || DEFAULTS.intervalMin);
     this.store.write('tagfeed.json', { ...this.config(), ...clean });
+    // A feed that sweeps starts again on the new list; one that only answers
+    // for the list (fedipod.net, for an app) was never started and is not now.
+    const sweeping = this.stopped === false;
     this.stop();
-    this.start();
+    if (sweeping) this.start();
     return this.config();
   }
 

package/lib/core/intake/index.mjs

@@ -151,9 +151,17 @@ export class Intake {
     rec.last = String(message || '').slice(0, 200);
     all[url] = rec;
     this.store.write(ATTEMPTS_DOC, all);
+    if (rec.n === 2) this._trouble('failing', url, message);
     return rec.n;
   }
 
+  // Mail that could not be read, as against mail refused: a second failed try,
+  // or a piece set aside after its last. `onTrouble` tells the owner.
+  _trouble(kind, url, reason) {
+    try { this.onTrouble?.({ kind, url, reason: String(reason || '').slice(0, 200), at: new Date().toISOString() }); }
+    catch { /* telling must never stop the drain */ }
+  }
+
   _clearAttempt(url) {
     const all = this.store.read(ATTEMPTS_DOC, {});
     if (!all[url]) return;
@@ -202,13 +210,25 @@ export class Intake {
         this._drainAgain = false;
         // Paced, not immediate: chained sweeps put a ceiling on work per unit
         // time, so a delivery flood cannot run the drain back-to-back.
-        const t = setTimeout(() => this.drain().catch(e => this.log(`drain: ${e.message}`)), CHAIN_GAP_MS);
-        t.unref?.();
+        this._chainTimer = setTimeout(() => {
+          this._chainTimer = null;
+          this.drain().catch(e => this.log(`drain: ${e.message}`));
+        }, CHAIN_GAP_MS);
+        this._chainTimer.unref?.();
       }
     });
     return this._draining;
   }
 
+  // Resolves once no sweep is running and none is waiting to follow on, so a
+  // browser worker can stay up until the round it started is done.
+  async settled() {
+    while (this._draining || this._chainTimer) {
+      if (this._draining) await this._draining.catch(() => {});
+      else await new Promise((r) => setTimeout(r, 500));
+    }
+  }
+
   // Discard the content waiting in the inbox from before `before`, on the
   // owner's say-so — the admin page asks, this does it. NOT a blind sweep:
   // every item is read, because the type is the only thing that decides its
@@ -447,6 +467,7 @@ export class Intake {
           this.log(`inbox batch ${url} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${e.message}`);
           if (n >= MAX_ITEM_ATTEMPTS) {
             this.store.addDeadLetter({ inboxUrl: url, reason: `failed ${n}x: ${e.message}`, activity: null });
+            this._trouble('set-aside', url, e.message);
             pending.push(url);
           }
         }
@@ -489,6 +510,7 @@ export class Intake {
         this.log(`inbox item ${url} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${e.message}`);
         if (n >= MAX_ITEM_ATTEMPTS) {
           this.store.addDeadLetter({ inboxUrl: url, reason: `failed ${n}x: ${e.message}`, activity: trimActivity(at.activity) });
+          this._trouble('set-aside', url, e.message);
           // The dead letter IS the record of this item — deleting before it is
           // written down would lose the only evidence it ever arrived, so it
           // goes through the same commit-then-delete batch as everything else.
@@ -522,6 +544,14 @@ export class Intake {
     const read = raw ? await readLenient(raw) : null;
     if (read?.degraded) this.log(`inbox item ${url} grounded to read: ${read.degraded}`);
     const activity = at.activity = read?.view ?? read?.doc ?? null;
+    // The gateway's test letter (lib/gateway/check-letter.mjs): read this far
+    // like any mail, then answered, and shown nowhere. An answer that does
+    // not go leaves it to be tried again.
+    const from = typeof activity?.actor === 'string' ? activity.actor : activity?.actor?.id;
+    if (from && this.checkLetters?.actor && from === this.checkLetters.actor) {
+      await this.checkLetters.taken(String(activity.id || ''));
+      return;
+    }
     // What the shapes make of it. This decides NOTHING — the activity is
     // handled either way. It is written down so that which shapes fire on
     // real traffic is a question with an answer, rather than a guess made
@@ -577,6 +607,7 @@ export class Intake {
     const batch = await this._batchEntries(url);
     if (!batch) {
       this.store.addDeadLetter({ inboxUrl: url, reason: 'unreadable batch', activity: null });
+      this._trouble('set-aside', url, 'unreadable batch');
       return { entries: 1, complete: true };
     }
     let complete = true;
@@ -596,6 +627,7 @@ export class Intake {
         this.log(`inbox batch entry ${key} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${err.message}`);
         if (n >= MAX_ITEM_ATTEMPTS) {
           this.store.addDeadLetter({ inboxUrl: key, reason: `failed ${n}x: ${err.message}`, activity: trimActivity(at.activity) });
+          this._trouble('set-aside', key, err.message);
         } else {
           complete = false;
         }
@@ -635,6 +667,7 @@ export class Intake {
           this.log(`held delivery ${key} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${err.message}`);
           if (n >= MAX_ITEM_ATTEMPTS) {
             this.store.addDeadLetter({ inboxUrl: key, reason: `failed ${n}x: ${err.message}`, activity: trimActivity(at.activity) });
+            this._trouble('set-aside', key, err.message);
             done.push(e.name);
           }
         }

package/lib/core/intake/verify.mjs

@@ -138,8 +138,10 @@ export function receiptVouchesFor(intake, receipt, actor) {
 // Delete is verified — the same verify-by-dereference the rest of intake uses.
 export async function isGone(intake, url) {
   let res;
+  // A deliverer that throws on a refusal (the browser's relay) still carries
+  // the origin's answer: 404 or 410 from the origin itself is gone.
   try { res = await intake.deliverer.signedFetch(url, { headers: { accept: ACCEPT_AP } }); }
-  catch { return null; }
+  catch (e) { return e?.answered && (e.status === 404 || e.status === 410) ? true : null; }
   if (res.status === 404 || res.status === 410) return true;
   if (res.status < 400) {
     // A Tombstone answers 200 and still means deleted.

package/lib/core/pod-only.mjs

@@ -1,4 +1,6 @@
 // pod-only.mjs — what stays on the pod, and only there, when an account works
 // from a copy kept at its gateway (lib/gateway/copy.mjs): the signing key, the
-// pod's own lease, and the passwords and tokens of accounts on other servers.
-export const podOnly = (name) => name === 'keys.json' || name === 'lease.json' || name.startsWith('conn-');
+// pod's own lease, and the passwords and tokens of accounts on other servers
+// (`conn-*` as the vault names them, and the browser's two documents).
+const CONNECTED = new Set(['fediaccts.json', 'atproto.json']);
+export const podOnly = (name) => name === 'keys.json' || name === 'lease.json' || name.startsWith('conn-') || CONNECTED.has(name);

package/lib/core/publisher/index.mjs

@@ -99,13 +99,26 @@ export class Publisher {
   // `clientOrigin` is overridden only by the agent serving a client its own
   // local actor: standalone, the published document cannot name a loopback
   // address, but a client already talking to that address can be told it.
+  // Whether follows wait for the owner, from the setting as saved now: this
+  // config is a copy taken when the agent started, and the saved one may have
+  // changed since.
+  approvesByHand() {
+    const saved = this.store?.getConfig?.() || {};
+    return wire.followsNeedApproval({ ...this.config,
+      ...('autoAcceptFollows' in saved ? { autoAcceptFollows: saved.autoAcceptFollows } : {}),
+      ...('approveJoins' in saved ? { approveJoins: saved.approveJoins } : {}) });
+  }
+
+  // Whether the profile last published says what the setting says.
+  profileAgrees() { return this.store.read('published.json', {}).approvesByHand === this.approvesByHand(); }
+
   actorDocFor({ priv = false, moderators = null, inbox = null, movedTo = this.config.movedTo || null,
     clientOrigin = this.clientOrigin } = {}) {
     const { urls } = this;
     return wire.actorDoc({
       urls, handle: wire.publicHandle(this.config), name: this.config.name, publicKeyPem: this.publicKeyPem,
       movedTo, kind: this.config.kind,
-      approveJoins: wire.followsNeedApproval(this.config),
+      approveJoins: this.approvesByHand(),
       assertionKey: this.assertionKey,
       summary: this.config.summary || null, icon: this.config.icon || null,
       image: this.config.image || null, fields: this.config.fields || [],
@@ -283,10 +296,11 @@ export class Publisher {
     // one the operator makes because the first did not work — was skipped as a
     // no-op and reported success. The digest is a record of what is up there,
     // and an unreachable document is not up there.
-    if (!unreachable.length) {
-      this.store.write('published.json',
-        { ...this.store.read('published.json', {}), surfaceDigest: surface });
-    }
+    // What the actor now says about followers is recorded whatever else was
+    // unreachable: it was written, and a start that finds it disagreeing
+    // writes it again (profileAgrees).
+    this.store.write('published.json', { ...this.store.read('published.json', {}),
+      ...(!unreachable.length ? { surfaceDigest: surface } : {}), approvesByHand: !!actorDoc.manuallyApprovesFollowers });
     // Named as the fediverse sees it: a fronted actor's name and host are the
     // front's, not the pod's.
     const pubName = wire.publicHandle(this.config);

package/lib/gateway/account-agent.mjs

@@ -18,6 +18,7 @@ import { Deliverer } from '../core/deliver.mjs';
 import { Publisher } from '../core/publisher/index.mjs';
 import { Intake } from '../core/intake/index.mjs';
 import { C2S } from '../client/c2s.mjs';
+import { TagFeed } from '../connections/tagfeed.mjs';
 import { keeperSession } from './keeper-session.mjs';
 import { CopyStorage, copyMeta, copyLease, keptBefore, holdOn, GATEWAY_HOLDER } from './copy.mjs';
 import { makeCopy } from './state-api.mjs';
@@ -76,14 +77,15 @@ export async function settle(ctx, handle, rec, at, { log = console.log } = {}) {
 
 /**
  * The account's state store and lease, as `holder`: over the copy when there
- * is one, else over the pod.
+ * is one, else over the pod. `podNames`: what of the pod-only documents the
+ * store loads with the copy.
  */
-export function stateAndLease(ctx, handle, at, { log = console.log, holder = GATEWAY_HOLDER } = {}) {
+export function stateAndLease(ctx, handle, at, { log = console.log, holder = GATEWAY_HOLDER, podNames = ['keys.json'] } = {}) {
   const podState = new HttpStorage(at.urls.state, at.podFetch);
   if (at.inCopy) {
     return {
-      // Of what stays on the pod, only the key: one read per piece of work.
-      store: new PodStore({ storage: new CopyStorage(ctx.copyKv, handle, { holder, pod: podState, podNames: ['keys.json'] }), log }),
+      // Of what stays on the pod, only the key, by default: one read per piece of work.
+      store: new PodStore({ storage: new CopyStorage(ctx.copyKv, handle, { holder, pod: podState, podNames }), log }),
       lease: copyLease(ctx.copyKv, handle, { id: holder, log }),
     };
   }
@@ -99,7 +101,7 @@ export function stateAndLease(ctx, handle, at, { log = console.log, holder = GAT
  * back onto the pod), the key from the pod, a deliverer that sends only when
  * asked, a publisher, and the intake. Returns the agent, or { skipped }.
  */
-export async function actingAgent(at, store, lease, { log = console.log, push = false } = {}) {
+export async function actingAgent(at, store, lease, { log = console.log, push = false, checkLetters = null } = {}) {
   const config = store.getConfig();
   if (!config) return { skipped: 'no account on the pod' };
   const publicBase = config.gateway?.frontActor ? config.gateway.frontActor.replace(/ap\/actor\/?$/u, '') : null;
@@ -115,6 +117,8 @@ export async function actingAgent(at, store, lease, { log = console.log, push =
   // What the owner's own posts, taken at the outbox door, need of an agent.
   const agent = {
     store, publisher, deliverer, remote: at.remote, urls, config, lease, intake: null, viewer: false,
+    // The hashtags followed, changed from an app; FediPod in the browser reads them.
+    tagfeed: new TagFeed({ store, intake: null, log }),
     configured: () => true, requestTakeover: async () => true,
   };
   const c2s = new C2S({ agent, log });
@@ -122,6 +126,8 @@ export async function actingAgent(at, store, lease, { log = console.log, push =
     config, urls, remote: at.remote, store, deliverer, publisher, log, lease, push,
     ownerPost: (a, o) => c2s.dispatch(a, o),
   });
+  // The gateway's test letter, taken in here and answered (check-letter.mjs).
+  agent.intake.checkLetters = checkLetters;
   publisher.resolveActor = (u) => agent.intake.fetchAP(u);
   return agent;
 }

package/lib/gateway/check-letter.mjs

@@ -0,0 +1,123 @@
+// check-letter.mjs — the gateway's test letter. Every six hours it writes to
+// its admin's own account through the account's door, as any server would,
+// and FediPod answers once it has taken the letter in (POST /api/check), or
+// the gateway's own reader does when it reads held mail (account-agent.mjs).
+// A letter still unanswered after FediPod has been open an hour means mail is
+// not getting through, and the owner's phones are told. The letter itself is
+// shown nowhere (lib/core/intake: checkLetters).
+import crypto from 'node:crypto';
+import { PRESENT_MS } from './held-mail.mjs';
+
+export const LETTER_EVERY_MS = 6 * 3600_000;
+export const ANSWER_WITHIN_MS = 3600_000;
+const LETTER_ID = /^https?:\/\/[^/]+\/check\/letters\/[0-9a-f]{24}$/u;
+
+const base = (origin) => String(origin || '').replace(/\/$/u, '');
+export const checkActor = (origin) => `${base(origin)}/check/actor`;
+const stateKey = (handle) => `check/${handle}`;
+const read = async (kv, handle) => { try { return JSON.parse((await kv.get(stateKey(handle)))?.text || 'null') || {}; } catch { return {}; } };
+const save = (kv, handle, st) => kv.set(stateKey(handle), JSON.stringify(st));
+
+// Who gets letters: the admin's own browser accounts, still at this gateway.
+const checked = (ctx, rec) => !!(ctx.adminWebId && rec?.openedAt && rec.actorUrl && rec.webId === ctx.adminWebId && !rec.movedTo);
+
+/** The letter, as the door takes it: a direct note to the account. */
+export function letterFor(origin, letter, to) {
+  const actor = checkActor(origin);
+  return {
+    '@context': 'https://www.w3.org/ns/activitystreams',
+    id: letter, type: 'Create', actor, to: [to],
+    object: { id: `${letter}#note`, type: 'Note', attributedTo: actor, to: [to], content: '<p>A test letter from this gateway.</p>' },
+  };
+}
+
+/**
+ * The round's part: for each account checked, a letter unanswered after an
+ * hour of FediPod open is alerted once, and a new one goes when none is
+ * waiting and six hours have passed since the last. `send(handle, rec, doc)`
+ * delivers a letter; `alert(handle, text)` tells the owner's phones.
+ */
+export async function roundChecks(ctx, { kv = ctx.mastoKv, now = Date.now(), send, alert, log = console.log } = {}) {
+  if (!kv || !ctx.adminWebId || !ctx.listDirectory || !ctx.frontOrigin) return;
+  const rows = await ctx.listDirectory();
+  for (const [handle, rec] of Object.entries(rows || {})) {
+    if (!checked(ctx, rec)) continue;
+    const st = await read(kv, handle);
+    const presentAt = Number(await ctx.presentAt?.(handle).catch(() => 0)) || 0;
+    const open = !!presentAt && now - presentAt < PRESENT_MS;
+    const waiting = st.letter && !st.answeredAt && !st.alertedAt;
+    if (waiting) {
+      // Open since this round, or since an earlier one; closed starts it again.
+      st.openSince = open ? (st.openSince ?? now) : null;
+      if (open && now - st.openSince >= ANSWER_WITHIN_MS) {
+        st.alertedAt = now;
+        await alert(handle, 'Its test letter has not reached your FediPod after an hour with FediPod open. Mail may not be getting through.')
+          .catch((e) => log(`check @${handle}: alert not sent: ${e?.message || e}`));
+        log(`check @${handle}: letter not answered after an hour open — owner told`);
+      }
+      await save(kv, handle, st);
+      continue;
+    }
+    if (typeof st.sentAt === 'number' && now - st.sentAt < LETTER_EVERY_MS) continue;
+    const letter = `${base(ctx.frontOrigin)}/check/letters/${crypto.randomBytes(12).toString('hex')}`;
+    const status = await send(handle, rec, letterFor(ctx.frontOrigin, letter, rec.actorUrl)).catch((e) => { log(`check @${handle}: letter not sent: ${e?.message || e}`); return 0; });
+    if (status !== 202) { log(`check @${handle}: the door answered ${status} to the letter`); continue; }
+    await save(kv, handle, { letter, sentAt: now });
+    log(`check @${handle}: letter sent`);
+  }
+}
+
+/** The letter taken in: true when it is the one waiting. */
+export async function answerLetter(kv, handle, letter, { now = Date.now() } = {}) {
+  if (!kv || !LETTER_ID.test(String(letter || ''))) return false;
+  const st = await read(kv, handle);
+  if (st.letter !== letter) return false;
+  if (!st.answeredAt) await save(kv, handle, { ...st, answeredAt: now });
+  return true;
+}
+
+/** When the letter waiting was alerted and is still unanswered, its time; else null. */
+export async function missingLetter(kv, handle) {
+  if (!kv) return null;
+  const st = await read(kv, handle);
+  return st.alertedAt && !st.answeredAt ? new Date(st.alertedAt).toISOString() : null;
+}
+
+/** What the gateway's reader needs to take a letter in at the gateway itself. */
+export const checkLettersFor = (ctx, handle) => (ctx?.frontOrigin && ctx.mastoKv
+  ? { actor: checkActor(ctx.frontOrigin), taken: async (letter) => { await answerLetter(ctx.mastoKv, handle, letter); } }
+  : null);
+
+// The letter's sender, for anything that looks it up: an application, whose
+// inbox takes and keeps nothing. Returns a response, or null for other paths.
+export function routeCheckActor(request, pathname, ctx, { j }) {
+  if (pathname === '/check/actor' && (request.method === 'GET' || request.method === 'HEAD')) {
+    const id = checkActor(ctx.frontOrigin || new URL(request.url).origin);
+    return j(200, {
+      '@context': 'https://www.w3.org/ns/activitystreams',
+      id, type: 'Application', preferredUsername: 'check', name: `${ctx.host || new URL(id).host} test letters`,
+      inbox: `${base(new URL(id).origin)}/check/inbox`,
+    }, 'application/activity+json');
+  }
+  if (pathname === '/check/inbox' && request.method === 'POST') return { status: 202, headers: {}, body: null };
+  return null;
+}
+
+// The owner's FediPod, saying it took the letter in, proved like /api/here;
+// and the letter's sender, for anything that looks it up.
+export async function routeCheckApi(request, pathname, ctx, deps) {
+  if (pathname.startsWith('/check/')) return routeCheckActor(request, pathname, ctx, deps);
+  if (pathname !== '/api/check') return null;
+  const { j } = deps;
+  if (request.method === 'OPTIONS') return deps.apiPreflight();
+  if (request.method !== 'POST') return null;
+  let body;
+  try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+  const handle = String(body.handle || '').toLowerCase();
+  const rec = await ctx.lookup(handle);
+  if (!rec) return j(404, { error: 'no such account' });
+  const who = await deps.provedOwner(request, pathname, ctx, rec, deps);
+  if (who.error) return who.error;
+  const answered = await answerLetter(ctx.mastoKv, handle, String(body.letter || ''));
+  return j(200, { ok: true, handle, answered });
+}

package/lib/gateway/connected-feeds.mjs

@@ -0,0 +1,116 @@
+// connected-feeds.mjs — the owner's other accounts read into theirs at the
+// gateway, for an app such as Elk while FediPod is closed in the browser.
+//
+// FediPod in the browser reads the owner's connected Mastodon-API accounts and
+// Bluesky account every five minutes while it is open (acctfeed.mjs,
+// bskyfeed.mjs). Here the same reads are made, at most every five minutes,
+// when an app asks for the home timeline or the notifications and nobody else
+// holds the account. The logins are read from the pod for the one read and are
+// never kept at the gateway (lib/core/pod-only.mjs); a login the far server
+// renews goes back to the pod.
+import { FediAccounts } from '../connections/fediacct.mjs';
+import { AcctFeed } from '../connections/acctfeed.mjs';
+import { Atproto } from '../connections/atproto.mjs';
+import { BskyFeed } from '../connections/bskyfeed.mjs';
+import { safeFetch } from '../shared/safefetch.mjs';
+import { apUrls } from '../core/wire.mjs';
+import { lockCopy, heldByBrowser } from './copy.mjs';
+import { reachAccount, settle, stateAndLease } from './account-agent.mjs';
+
+export const FEEDS_EVERY_MS = 5 * 60_000;
+// An account with nothing connected is looked at again only this often.
+export const NONE_EVERY_MS = 60 * 60_000;
+// Each request to another server is cut short, and Bluesky is not started
+// once this much of the read has gone, so an app's write waiting on the
+// account does not wait long.
+const ASK_MS = 6_000;
+const READ_MS = 15_000;
+const CONNECTED = ['fediaccts.json', 'atproto.json'];
+
+// The logins as FediPod in the browser keeps them: one document for the
+// Mastodon-API accounts, by id, and one for Bluesky.
+function accountsVault(store) {
+  const all = () => store.read('fediaccts.json', {}) || {};
+  return {
+    names: () => Object.keys(all()),
+    read: (id) => all()[id] || null,
+    write: (id, rec) => store.write('fediaccts.json', { ...all(), [id]: { ...rec, storage: 'pod' } }),
+    remove: async () => false,
+  };
+}
+const NO_APPS = { names: () => [], read: () => null, write: () => {}, remove: async () => false };
+function blueskyVault(store) {
+  return {
+    names: () => (store.read('atproto.json', null) ? ['bluesky'] : []),
+    read: () => store.read('atproto.json', null),
+    write: (_, rec) => store.write('atproto.json', { ...rec, storage: 'pod' }),
+    remove: async () => false,
+  };
+}
+
+const dueKey = (handle) => `${handle}/feeds-due`;
+
+/** For an app checking in: when due, and never over FediPod open in a browser. */
+export async function readConnectedForApp(ctx, handle, rec, { log = console.log, fetcher = null, session = null } = {}) {
+  if (!ctx.copyKv) return 0;
+  const due = async () => Date.now() >= Number((await ctx.copyKv.get(dueKey(handle)))?.text || 0);
+  // FediPod open in a browser reads them itself; the pod is not asked.
+  if (!await due() || await heldByBrowser(ctx.copyKv, handle)) return 0;
+  const unlock = await lockCopy(ctx.copyKv, handle, { waitMs: 1000 });
+  if (!unlock) return 0;
+  try {
+    // Another request may have read them while this one waited.
+    if (!await due()) return 0;
+    await ctx.copyKv.set(dueKey(handle), String(Date.now() + FEEDS_EVERY_MS));
+    const out = await readConnected(ctx, handle, rec, { log, fetcher, session });
+    if (out.none) await ctx.copyKv.set(dueKey(handle), String(Date.now() + NONE_EVERY_MS));
+    return out.added || 0;
+  } finally { await unlock(); }
+}
+
+/**
+ * One read of every connected account into the account, by a caller holding
+ * lockCopy. Returns { added } or { none } when nothing is connected.
+ */
+export async function readConnected(ctx, handle, rec, { log = console.log, fetcher = null, session = null } = {}) {
+  const at = await reachAccount(ctx, handle, rec, { log, session });
+  if (at.skipped) return { added: 0 };
+  if (!(await settle(ctx, handle, rec, at, { log })).ok) return { added: 0 };
+  // The key is not needed to read: only the logins come from the pod.
+  const { store, lease } = stateAndLease(ctx, handle, at, { log, podNames: [] });
+  try { await store.refresh(CONNECTED); } catch (e) { log(`@${handle}: connected accounts: ${e.message}`); return { added: 0 }; }
+  const out = fetcher || ctx.fetchImpl || null;
+  const ask = (url, init = {}) => {
+    const cut = { ...init, signal: AbortSignal.timeout(ASK_MS) };
+    return out ? out(url, cut) : safeFetch(url, cut);
+  };
+  const said = (m) => log(`@${handle}: ${m}`);
+  const masto = new FediAccounts({ vault: accountsVault(store), apps: NO_APPS, log: said, fetcher: ask });
+  const bsky = new Atproto({ vault: blueskyVault(store), log: said, fetcher: ask });
+  const bskyOn = () => bsky.connected() && !bsky.read()?.feedPaused;
+  if (!masto.connected() && !bskyOn()) return { none: true };
+  if (!await lease.acquire()) return { added: 0 };
+  try {
+    await store.load();
+    const config = store.getConfig();
+    if (!config || config.quiescedAt) return { added: 0 };
+    // Stamped as FediPod in the browser stamps them, so a login made for
+    // another actor is left alone here too.
+    const publicBase = config.gateway?.frontActor ? config.gateway.frontActor.replace(/ap\/actor\/?$/u, '') : null;
+    masto.actorId = bsky.actorId = apUrls(at.pod, config.root || at.root, { publicBase }).actor;
+    const started = Date.now();
+    let added = 0;
+    if (masto.connected()) {
+      const feed = new AcctFeed({ store, accounts: masto, log: said });
+      await feed.sweep();
+      added += feed.lastAdded;
+    }
+    if (bskyOn() && Date.now() - started < READ_MS) {
+      const feed = new BskyFeed({ store, atproto: bsky, log: said });
+      await feed.sweep();
+      added += feed.lastAdded;
+    }
+    if (!await store.commit()) said('connected accounts read, but not written to the copy');
+    return { added };
+  } finally { await lease.release().catch(() => {}); }
+}

package/lib/gateway/copy.mjs

@@ -375,6 +375,25 @@ export async function flushCopy(kv, h, { pod, log = () => {} }) {
   let changed = false;
   for (const b of docs) {
     const name = b.key.slice(`${h}/d/`.length);
+    // A pod-only document in the copy was put there before it was pod-only.
+    // It goes to the pod unless the pod's is newer (changed since the copy
+    // last wrote it, or made since the copy was), then out of the copy and
+    // its record.
+    if (podOnly(name)) {
+      const got = await kv.get(b.key);
+      const there = typeof pod.read === 'function' ? await pod.read(name).catch(() => null) : null;
+      const podMoved = !!there?.ok && (!flushed[name] || hashOf(there.body) !== flushed[name].hash);
+      if (got && !podMoved && flushed[name]?.hash !== hashOf(got.text)) {
+        const w = await pod.write(name, got.text, 'application/json');
+        if (!w.ok) { log(`copy @${h}: ${name} not written to the pod (${w.why})`); continue; }
+        n++;
+      }
+      await kv.delete(b.key);
+      delete flushed[name];
+      changed = true;
+      log(`copy @${h}: ${name} is kept on the pod only now, and left the copy`);
+      continue;
+    }
     if (flushed[name]?.etag === b.etag) continue;
     const got = await kv.get(b.key);
     if (!got) continue;