fedipod 1.57.0 → 1.57.2

package/gateway.md

@@ -171,11 +171,10 @@ A browser account runs only while FediPod is open somewhere. While it is
 closed, fedipod.net does two things for it.
 
 **Your mail waits at the gateway.** Deliveries are kept there, not written to
-your pod one by one, and reach your pod in batches of up to a hundred: when you
-open FediPod, or every fifteen minutes otherwise. While FediPod is open, mail
-goes straight to your pod as before. A DeviceAgent's mail always goes straight
-to its pod. On a gateway whose admin has turned the hold off (below), mail
-always goes straight to your pod.
+your pod one by one, and reach your pod in batches of up to a hundred: all of
+them when you open FediPod, or one batch every fifteen minutes otherwise. While
+FediPod is open, mail goes straight to your pod as before. On a gateway whose
+admin has turned the hold off (below), mail always goes straight to your pod.
 
 **The gateway keeps your account running.** It accepts your follows, tries
 again what failed to go out, and publishes the posts you scheduled, all while FediPod is closed. Other mail waits on your
@@ -278,10 +277,10 @@ door answer 410 Gone, other servers drop the account the next time they look,
 and nobody can take the name. Nothing on your pod is touched. An address that
 had already moved to another gateway keeps answering as moved.
 
-Only accounts opened from a browser are counted. A DeviceAgent behind the
-gateway drains its own inbox as it runs, and is never paused or closed by
-time. Accounts from before this was built are counted from their next
-sign-in. A gateway operator sets the cap and the window with
+Every person's account is counted: from the last time its owner signed in or
+posted, or from the day it was set up if they never have. An account with no
+day on record is counted from 23 September 2026. A forum, its categories and a
+group are not counted. A gateway operator sets the cap and the window with
 `FEDIPOD_PAUSE_ITEMS` and `FEDIPOD_CLOSE_DAYS`.
 
 ## Notices

package/lib/gateway/front-core.mjs

@@ -23,7 +23,7 @@ import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
 import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer, provedOwner } from './quiet.mjs';
-import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi, routePushApi, routeAlertApi } from './held-mail.mjs';
+import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, waitsForRound, routeHereApi, routeKeeperApi, routePushApi, routeAlertApi } from './held-mail.mjs';
 import { routeCheckApi, missingLetter } from './check-letter.mjs';
 import { routeNoticesApi } from './notices.mjs';
 import { routeForumPage } from './forum-pages.mjs';
@@ -827,7 +827,7 @@ async function route(request, ctx) {
     const standing = await accountState(ctx, up.handle, rec);
     // A browser account's mail waits here while its app is closed (held-mail.mjs), unless the hold is off.
     const away = mayBeAway(ctx, rec) && !(await isPresent(ctx, up.handle)); const held = away && holdsMail(ctx, rec);
-    const { status, reason, content, bytes, type, notifies, name, raw, receipt } = await handleDelivery(request, identFor(rec, policy),
+    const { status, reason, content, bytes, type, accountDeleted, notifies, name, raw, receipt } = await handleDelivery(request, identFor(rec, policy),
       { podPut: held ? holdingPut(ctx, up.handle, rec) : (u, b, ct) => ctx.podPut(up.handle, u, b, ct),
         fetchImpl: ctx.fetchImpl, paused: standing.paused, origin: ctx.frontOrigin || null });
     // One line per delivery, so "did it arrive at the door" has an answer.
@@ -836,8 +836,8 @@ async function route(request, ctx) {
     if (away && status === 202) await afterHeld(ctx, up.handle, rec, { type, notifies });
     // A forum fedipod.net keeps: the delivery is placed now, in this request,
     // and the run that carries it is started. Whatever could not be placed
-    // here is still in the inbox for that run.
-    if (status === 202 && name && ctx.forum?.isForumRow(rec) && rec.keeper) {
+    // here is still in the inbox for that run. A notice that an account was deleted waits for the round's run (held-mail.mjs).
+    if (status === 202 && name && ctx.forum?.isForumRow(rec) && rec.keeper && !await waitsForRound(ctx, up.handle, rec, { accountDeleted })) {
       const placed = await ctx.forum.placeAtDoor(ctx, up.handle, rec, { name, raw, receipt })
         .catch((e) => ({ placed: false, why: e.message }));
       console.log(`door @${up.handle}: ${placed.placed ? 'placed' : `not placed (${placed.why})`}`);

package/lib/gateway/gateway-core.mjs

@@ -168,14 +168,23 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
     ? signReceipt(makeReceipt(v, { gateway: ident.gatewayWebId }), ident.hmacSecret)
     : null;
   const hash = sha256hex(raw);
-  const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
+  // The item and its receipt together: on a slow pod, one write after the
+  // other outlasted the sender's wait, and the sender sent the item again. A
+  // receipt whose item did not land vouches for nothing, and the reader lets
+  // it go.
+  const [okA] = await Promise.all([
+    inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw),
+    receipt ? inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt) : null,
+  ]);
   // A pod-write failure returns 5xx so the ORIGIN retries over its own ladder —
   // that is what preserves the pod's buffer property without the gateway
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
-  if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
+  // `accountDeleted`: the sender says its own account is gone. Mastodon sends
+  // one of these to every inbox it knows, for every account it deletes.
   return { status: 202, reason: v.verified ? 'verified' : failed ? `buffered-unverified: ${failed}` : 'buffered-unverified',
-    content, bytes: bytes.byteLength, type: activity.type, notifies: notifies(activity, ident), name: hash, raw, receipt };
+    content, bytes: bytes.byteLength, type: activity.type, accountDeleted: activity.type === 'Delete' && idOf(activity.object) === actor,
+    notifies: notifies(activity, ident), name: hash, raw, receipt };
 }
 
 // The outbox door: the owner's own post, taken on their behalf.

package/lib/gateway/held-mail.mjs

@@ -69,40 +69,55 @@ export const holdingPut = (ctx, handle, rec) => async (url, body, ct) => {
  * [{ name, body, receipt, held: [the held names it came from] }]. A receipt
  * whose delivery is not here has nothing to vouch for, and is let go.
  */
-export async function heldEntries(ctx, handle) {
-  const names = await ctx.listHeld(handle);
+// `max`: at most that many deliveries, the first by name, and no more of the
+// pile is listed or read than holds them. Without it, everything.
+export async function heldEntries(ctx, handle, { max = Infinity } = {}) {
+  // A receipt may sit beside each delivery: twice as many names hold them whole.
+  const names = (await ctx.listHeld(handle, Number.isFinite(max) ? { limit: max * 2 } : {})).sort();
   if (!names.length) return [];
   const items = new Map();            // item name -> { body, receipt, held: [names] }
   for (const name of names) {
-    const got = await ctx.readHeld(handle, name);
     const item = name.endsWith(RECEIPT) ? name.slice(0, -RECEIPT.length) : name;
+    if (!items.has(item) && items.size >= max) break;
     const e = items.get(item) || { held: [] };
     e.held.push(name);
-    if (got != null) {
-      if (name.endsWith(RECEIPT)) { try { e.receipt = JSON.parse(got); } catch { e.receipt = null; } } else e.body = got;
-    }
     items.set(item, e);
   }
-  for (const [item, e] of items) {
+  await inTurns([...items], async ([item, e]) => {
+    for (const name of e.held) {
+      const got = await ctx.readHeld(handle, name);
+      if (got == null) continue;
+      if (name.endsWith(RECEIPT)) { try { e.receipt = JSON.parse(got); } catch { e.receipt = null; } } else e.body = got;
+    }
     if (typeof e.body !== 'string') { for (const n of e.held) await ctx.dropHeld(handle, n); items.delete(item); }
-  }
+  });
   return [...items].map(([name, e]) => ({ name, body: e.body, receipt: e.receipt || null, held: e.held }));
 }
 
-// Everything held for one account, written to its pod inbox in batches and
-// then let go. Returns how many deliveries reached the pod. A batch the pod
-// refuses stays held for the next try.
-export async function flushHeld(ctx, handle, rec, { now = Date.now() } = {}) {
-  const all = (await heldEntries(ctx, handle)).map((e) => [e.name, e]);
-  if (!all.length) return 0;
+// A few at a time: a pile is read and let go quickly without asking the store
+// for all of it at once.
+const TOGETHER = 6;
+async function inTurns(list, fn) {
+  for (let i = 0; i < list.length; i += TOGETHER) await Promise.all(list.slice(i, i + TOGETHER).map(fn));
+}
+
+// What is held for one account, written to its pod inbox in batches and then
+// let go: every batch, or `batches` of them. Returns how many deliveries
+// reached the pod. A batch the pod refuses, or does not take within `podMs`
+// where one is given, stays held for the next try.
+export async function flushHeld(ctx, handle, rec, { now = Date.now(), batches = Infinity, podMs = null } = {}) {
   let delivered = 0;
-  for (let i = 0; i < all.length; i += BATCH_MAX) {
-    const chunk = all.slice(i, i + BATCH_MAX);
-    const batch = chunk.map(([name, e]) => ({ name, body: e.body, receipt: e.receipt || null }));
-    const doc = `batch-${now}-${i / BATCH_MAX}-${Math.random().toString(36).slice(2, 8)}.json`;
-    const ok = await ctx.podPut(handle, inboxOf(rec) + doc, JSON.stringify({ batch }), 'application/json');
+  const sent = new Set();
+  for (let i = 0; i < batches; i++) {
+    // A delivery written once is not written again, should letting it go fail.
+    const chunk = (await heldEntries(ctx, handle, { max: BATCH_MAX })).filter((e) => !sent.has(e.name));
+    if (!chunk.length) break;
+    const batch = chunk.map((e) => ({ name: e.name, body: e.body, receipt: e.receipt || null }));
+    const doc = `batch-${now}-${i}-${Math.random().toString(36).slice(2, 8)}.json`;
+    const ok = await ctx.podPut(handle, inboxOf(rec) + doc, JSON.stringify({ batch }), 'application/json', podMs ? { timeoutMs: podMs } : undefined);
     if (!ok) break;
-    for (const [, e] of chunk) for (const n of e.held) await ctx.dropHeld(handle, n);
+    for (const e of chunk) sent.add(e.name);
+    await inTurns(chunk.flatMap((e) => e.held), (n) => ctx.dropHeld(handle, n));
     delivered += chunk.length;
   }
   return delivered;
@@ -118,6 +133,18 @@ export async function wakesKeeper(ctx, handle, rec, type) {
   return true;
 }
 
+// A notice that an account was deleted, arriving for a forum this gateway
+// keeps, starts no run of its own: the forum is marked as having work, and the
+// round's run reads the notice from the inbox. False where that cannot be
+// noted, so the caller starts the run as for any delivery.
+export async function waitsForRound(ctx, handle, rec, { accountDeleted = false } = {}) {
+  const forum = rec.kind === 'application' ? handle : rec.forum;
+  if (!accountDeleted || !forum || !ctx.noteNext) return false;
+  const noted = await ctx.noteNext(forum, new Date().toISOString(), { earliest: true }).then(() => true, () => false);
+  if (noted) console.log(`door @${handle}: an account's deletion, left for the round's run of @${forum}`);
+  return noted;
+}
+
 // After a delivery is held: a follow wakes the keeper, and anything that
 // becomes a notification is read in and pushed at once to the phones and
 // browsers the owner signed up for notifications (masto-gateway.mjs: pushHeld).
@@ -132,17 +159,33 @@ export async function afterHeld(ctx, handle, rec, { type, notifies = false } = {
 // is gone, closed or moved has nowhere to deliver to, so its mail is let go.
 // `keep(handle, rec)` answers true when the account's keeper will take its mail
 // itself (lib/gateway/keeper.mjs), which delivers it and then reads it.
+//
+// The round has to end. So an account gets one batch a round, a pod has
+// ROUND_POD_MS to take it, a few accounts are worked on at a time, and each
+// round begins after the account the last one finished with (ctx.roundMark,
+// ctx.setRoundMark): a round cut short leaves out different accounts each time.
+export const ROUND_POD_MS = 10_000;
+const ROUND_TOGETHER = 4;
 export async function flushAll(ctx, { log = console.log, isGone = async () => false, keep = async () => false } = {}) {
-  for (const handle of await ctx.heldAccounts()) {
+  const all = [...await ctx.heldAccounts()].sort();
+  const mark = await ctx.roundMark?.().catch(() => null);
+  const from = mark ? all.findIndex((h) => h > mark) : 0;
+  const order = from > 0 ? [...all.slice(from), ...all.slice(0, from)] : all;
+  const one = async (handle) => {
     const rec = await ctx.lookup(handle);
     if (!rec || rec.movedTo || await isGone(handle, rec)) {
-      for (const n of await ctx.listHeld(handle)) await ctx.dropHeld(handle, n);
+      await inTurns(await ctx.listHeld(handle, { limit: BATCH_MAX * 2 }), (n) => ctx.dropHeld(handle, n));
       log(`held mail @${handle}: let go (no account to deliver to)`);
-      continue;
+      return;
     }
-    if (await keep(handle, rec).catch(() => false)) continue;
-    const n = await flushHeld(ctx, handle, rec).catch((e) => { log(`held mail @${handle}: ${e?.message || e}`); return 0; });
+    if (await keep(handle, rec).catch(() => false)) return;
+    const n = await flushHeld(ctx, handle, rec, { batches: 1, podMs: ROUND_POD_MS });
     if (n) log(`held mail @${handle}: ${n} delivered to the pod`);
+  };
+  for (let i = 0; i < order.length; i += ROUND_TOGETHER) {
+    const turn = order.slice(i, i + ROUND_TOGETHER);
+    await Promise.all(turn.map((h) => one(h).catch((e) => log(`held mail @${h}: ${e?.message || e}`))));
+    await ctx.setRoundMark?.(turn.at(-1)).catch(() => {});
   }
 }
 

package/lib/gateway/quiet.mjs

@@ -4,7 +4,17 @@
 // public read, stamps noteOpened from the relay, counts noteReceived after
 // a forwarded delivery, and hands /api/open, /api/pause and /api/close here.
 
-import { keptNow, holdOn } from './copy.mjs';
+import { keptNow, holdOn, isPersonal } from './copy.mjs';
+
+// A gateway whose people all run FediPod in a browser gives every person's
+// account a day its owner was last here, so none is left out of what follows:
+// the day it was attached, or the day these dates began for a row that has
+// neither. A forum, a group and a forum's category are nobody's to open.
+export const FIRST_OPENED = '2026-09-23T00:00:00.000Z';
+export function withOpened(rec) {
+  if (!rec || rec.openedAt || !isPersonal(rec)) return rec;
+  return { ...rec, openedAt: rec.attachedAt || FIRST_OPENED };
+}
 
 // ---- accounts that go quiet -------------------------------------------------
 //

package/lib/pod/inbox.mjs

@@ -20,12 +20,15 @@ const RECEIPT_CT = 'application/json';
  * public Append the pod may well allow. This is the one place that gets to
  * decide that, because it lived in two adapters and had to be right in both.
  *
+ * `timeoutMs`, when given, is how long the pod has to answer; a pod that takes
+ * longer counts as one that did not answer.
+ *
  * @returns {Promise<boolean>} whether it landed
  */
-export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch, report = null } = {}) {
+export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch, report = null, timeoutMs = null } = {}) {
   const headers = { 'content-type': contentType,
     ...(appendToken ? { authorization: `Bearer ${appendToken}` } : {}) };
-  const r = await fetchImpl(url, { method: 'PUT', headers, body }).catch(() => null);
+  const r = await fetchImpl(url, { method: 'PUT', headers, body, ...(timeoutMs ? { signal: AbortSignal.timeout(timeoutMs) } : {}) }).catch(() => null);
   // The pod's answer, for a caller that keeps a log: a refused write is
   // otherwise a bare "failed" with the status thrown away.
   report?.(r ? r.status : 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.57.0",
+  "version": "1.57.2",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node claude/smoke-tests/admin-facade-smoke.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs claude/smoke-tests/signin-hardening.test.mjs claude/smoke-tests/load-fixes.test.mjs claude/smoke-tests/unread-docs.test.mjs claude/smoke-tests/post-text-once.test.mjs claude/smoke-tests/connected-pod-only.test.mjs claude/smoke-tests/check-letter.test.mjs claude/smoke-tests/gone-through-relay.test.mjs claude/smoke-tests/connected-feeds.test.mjs claude/smoke-tests/forum-pages.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node claude/smoke-tests/admin-facade-smoke.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs claude/smoke-tests/signin-hardening.test.mjs claude/smoke-tests/load-fixes.test.mjs claude/smoke-tests/unread-docs.test.mjs claude/smoke-tests/post-text-once.test.mjs claude/smoke-tests/connected-pod-only.test.mjs claude/smoke-tests/check-letter.test.mjs claude/smoke-tests/gone-through-relay.test.mjs claude/smoke-tests/connected-feeds.test.mjs claude/smoke-tests/forum-pages.test.mjs claude/smoke-tests/round.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",