fedipod 1.57.0 → 1.57.5

package/gateway.md

@@ -171,11 +171,10 @@ A browser account runs only while FediPod is open somewhere. While it is
 closed, fedipod.net does two things for it.
 
 **Your mail waits at the gateway.** Deliveries are kept there, not written to
-your pod one by one, and reach your pod in batches of up to a hundred: when you
-open FediPod, or every fifteen minutes otherwise. While FediPod is open, mail
-goes straight to your pod as before. A DeviceAgent's mail always goes straight
-to its pod. On a gateway whose admin has turned the hold off (below), mail
-always goes straight to your pod.
+your pod one by one, and reach your pod in batches of up to a hundred: all of
+them when you open FediPod, or one batch every fifteen minutes otherwise. While
+FediPod is open, mail goes straight to your pod as before. On a gateway whose
+admin has turned the hold off (below), mail always goes straight to your pod.
 
 **The gateway keeps your account running.** It accepts your follows, tries
 again what failed to go out, and publishes the posts you scheduled, all while FediPod is closed. Other mail waits on your
@@ -193,7 +192,8 @@ browser, the gateway and any app you use all work from one copy of your
 timeline, notifications, followers, settings and the rest of your FediPod
 state, made at fedipod.net from your pod, so they never disagree. Every
 fifteen minutes, whatever is happening, fedipod.net writes that copy to your
-pod and deletes it. The next time anything needs your account (FediPod, an
+pod and deletes it. If your pod will not take it, the copy stays at
+fedipod.net and is tried again an hour later. The next time anything needs your account (FediPod, an
 app, or the gateway's own work while you're away), the copy is made again from
 your pod. You don't notice, except that an app's first check after a deletion
 can take a few seconds longer. When your address moves or is closed, the copy
@@ -207,7 +207,8 @@ with one setting, `FEDIPOD_HOLD` ([netlify/README.md](netlify/README.md)).
 
 - **On**, the default and fedipod.net's choice: as above. Mail waits at the
   gateway for up to fifteen minutes, and each account's copy is written to its
-  pod and deleted every fifteen minutes.
+  pod and deleted every fifteen minutes. A pod that refuses its copy is asked
+  again an hour later.
 - **Off**: the gateway keeps no copy of anyone's account and holds no mail.
   Mail goes straight to the pod as it arrives, an app's every check reads the
   pod, and FediPod in the browser works on the pod, taking turns with the
@@ -278,10 +279,10 @@ door answer 410 Gone, other servers drop the account the next time they look,
 and nobody can take the name. Nothing on your pod is touched. An address that
 had already moved to another gateway keeps answering as moved.
 
-Only accounts opened from a browser are counted. A DeviceAgent behind the
-gateway drains its own inbox as it runs, and is never paused or closed by
-time. Accounts from before this was built are counted from their next
-sign-in. A gateway operator sets the cap and the window with
+Every person's account is counted: from the last time its owner signed in or
+posted, or from the day it was set up if they never have. An account with no
+day on record is counted from 23 September 2026. A forum, its categories and a
+group are not counted. A gateway operator sets the cap and the window with
 `FEDIPOD_PAUSE_ITEMS` and `FEDIPOD_CLOSE_DAYS`.
 
 ## Notices

package/lib/core/intake/group.mjs

@@ -19,9 +19,11 @@ export function isModerationAsk(intake, activity) {
   if (activity.type === 'Delete') {
     const id = typeof activity.object === 'string' ? activity.object : activity.object?.id;
     const s = id && intake.store.getStatuses().find(x => x.noteId === id);
-    // Only a post the group holds and did not author — removing those is
-    // moderation; everything else is the author's own Delete.
-    return !!s && s.kind !== 'post';
+    const by = typeof activity.actor === 'string' ? activity.actor : activity.actor?.id;
+    // Only a post the group holds, written by neither the group nor whoever
+    // is deleting it: removing those is moderation. Everything else is the
+    // author's own Delete, a moderator's of their own post included.
+    return !!s && s.kind !== 'post' && s.actor !== by;
   }
   if (activity.type === 'Add' || activity.type === 'Remove') {
     const target = typeof activity.target === 'string' ? activity.target : activity.target?.id;

package/lib/core/intake/index.mjs

@@ -370,6 +370,9 @@ export class Intake {
   }
 
   async _drainOnce() {
+    // Whether this sweep took mail in and left more in the inbox: a caller that
+    // runs one sweep and stops (a forum kept by a gateway) asks to come back.
+    this.moreWaiting = false;
     this._sweepGen = this.store.generation;
     const cooling = this.drainCooldownUntil - Date.now();
     if (cooling > 0) {
@@ -452,9 +455,10 @@ export class Intake {
     };
 
     let spent = 0;                   // deliveries taken this sweep, a batch counting each of its own
+    let cut = false;                 // stopped at the cap with the listing not finished
     for (const { url, size, receipt: hasReceipt } of items) {
       if (url.endsWith('.keep')) continue;
-      if (spent >= MAX_ITEMS_PER_DRAIN) { this._drainAgain = handled > 0 || pending.length > 0; break; }
+      if (spent >= MAX_ITEMS_PER_DRAIN) { cut = this._drainAgain = handled > 0 || pending.length > 0; break; }
       if (isBatch(url)) {
         try {
           const took = await this._takeBatch(url);
@@ -531,7 +535,9 @@ export class Intake {
     // Made progress and there is more waiting: go straight round rather than
     // sleeping. Gated on progress so a sweep that achieved nothing — a
     // cooldown, an unwritable store, poison at the head — cannot spin.
-    if (handled > 0 && all.length > items.length && !this.stopped) this._drainAgain = true;
+    const more = handled > 0 && all.length > items.length;
+    this.moreWaiting = more || cut;
+    if (more && !this.stopped) this._drainAgain = true;
   }
 
   // One delivery, alone in the inbox or in a batch: read as JSON-LD, checked

package/lib/gateway/copy.mjs

@@ -258,8 +258,10 @@ export class CopyStorage {
  * Held for `ms` at a time and extended while its holder runs, so a long run
  * keeps it and a holder that died loses it within `ms`.
  */
-export async function lockCopy(kv, h, { ms = 60_000, waitMs = 8_000, by = crypto.randomUUID() } = {}) {
-  const key = `${account(h)}/lock`;
+export const lockCopy = (kv, h, opts) => lockKey(kv, `${account(h)}/lock`, opts);
+
+/** The same lock under any key: the round holds one, so two rounds never run at once. */
+export async function lockKey(kv, key, { ms = 60_000, waitMs = 8_000, by = crypto.randomUUID() } = {}) {
   const give = (etag) => {
     let tag = etag;
     const timer = setInterval(async () => {
@@ -488,6 +490,25 @@ export async function holdOver(kv, h, { pod, podFetch, stateUrl, log = () => {}
   } finally { await kv.delete(`${h}/closing`).catch(() => {}); }
 }
 
+/**
+ * A pod that would not take an account's copy is left alone for COPY_RETRY_MS
+ * before the round asks it again (flush-mail.mjs): asked every round, a pod
+ * that goes on refusing took a quarter of the round. With no wait (`waitMs`
+ * 0), every round asks. `refusedAt` answers when the pod last refused, or 0
+ * when the account is to be tried; `afterTry` records how the try went.
+ */
+export const COPY_RETRY_MS = 3_600_000;
+export async function refusedAt(kv, h, { waitMs = COPY_RETRY_MS, now = Date.now() } = {}) {
+  if (!waitMs) return 0;
+  const at = (await readJson(kv, `${account(h)}/refused`)).doc?.at || 0;
+  return at && now - at < waitMs ? at : 0;
+}
+export async function afterTry(kv, h, ok, { waitMs = COPY_RETRY_MS, now = Date.now() } = {}) {
+  if (!waitMs) return;
+  if (!ok) await kv.set(`${account(h)}/refused`, JSON.stringify({ at: now }));
+  else if (await kv.get(`${h}/refused`)) await kv.delete(`${h}/refused`);
+}
+
 /** A copy listed with no meta is one whose delete was cut off: its documents go. */
 export async function clearLeftover(kv, h, { log = () => {} } = {}) {
   if (await copyMeta(kv, h)) return false;

package/lib/gateway/front-core.mjs

@@ -827,17 +827,17 @@ async function route(request, ctx) {
     const standing = await accountState(ctx, up.handle, rec);
     // A browser account's mail waits here while its app is closed (held-mail.mjs), unless the hold is off.
     const away = mayBeAway(ctx, rec) && !(await isPresent(ctx, up.handle)); const held = away && holdsMail(ctx, rec);
+    const keptForum = !!(ctx.forum?.isForumRow(rec) && rec.keeper); // it acts on no notice that an account was deleted: its door keeps none
     const { status, reason, content, bytes, type, notifies, name, raw, receipt } = await handleDelivery(request, identFor(rec, policy),
       { podPut: held ? holdingPut(ctx, up.handle, rec) : (u, b, ct) => ctx.podPut(up.handle, u, b, ct),
-        fetchImpl: ctx.fetchImpl, paused: standing.paused, origin: ctx.frontOrigin || null });
+        fetchImpl: ctx.fetchImpl, paused: standing.paused, origin: ctx.frontOrigin || null, dropAccountDeleted: keptForum });
     // One line per delivery, so "did it arrive at the door" has an answer.
     console.log(`door @${up.handle}: delivery → ${status} (${reason}${held && status === 202 ? ', held' : ''})`);
     if (status === 202 && content) await noteReceived(ctx, up.handle, rec, bytes);
     if (away && status === 202) await afterHeld(ctx, up.handle, rec, { type, notifies });
-    // A forum fedipod.net keeps: the delivery is placed now, in this request,
-    // and the run that carries it is started. Whatever could not be placed
-    // here is still in the inbox for that run.
-    if (status === 202 && name && ctx.forum?.isForumRow(rec) && rec.keeper) {
+    // The delivery is placed now, in this request, and the run that carries it
+    // is started. Whatever could not be placed is still in the inbox for that run.
+    if (status === 202 && name && keptForum) {
       const placed = await ctx.forum.placeAtDoor(ctx, up.handle, rec, { name, raw, receipt })
         .catch((e) => ({ placed: false, why: e.message }));
       console.log(`door @${up.handle}: ${placed.placed ? 'placed' : `not placed (${placed.why})`}`);

package/lib/gateway/gateway-core.mjs

@@ -115,7 +115,9 @@ export function asSigned(request, bytes, origin) {
 // `admit(verified)`, when given, says whether the inbox has room for this
 // delivery now; one without room is answered 503 and written nowhere, so its
 // sender tries again later. Without it every delivery that passes is written.
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null, admit = null } = {}) {
+// `dropAccountDeleted`: a sender's notice that its own account is gone is
+// answered and written nowhere, for an inbox whose reader acts on none.
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null, admit = null, dropAccountDeleted = false } = {}) {
   // The body, once, as the bytes the sender digested; the text of it is what
   // is filed and hashed, as before.
   let bytes, raw;
@@ -131,6 +133,10 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // Edge drops — silent 202 so a rejected sender does not retry a delivery we
   // will never accept. None of these becomes a pod write.
   if (isBlocked(actor, ident.blocklist)) return { status: 202, reason: 'blocked' };
+  // Mastodon sends one of these to every inbox it knows, for every account it deletes.
+  if (dropAccountDeleted && activity.type === 'Delete' && idOf(activity.object) === actor) {
+    return { status: 202, reason: "an account's deletion, not kept" };
+  }
   const content = !CONTROL.has(activity.type);
   if (content && paused) return { status: 202, reason: 'paused' };
   if (content && !concernsUsAtEdge(activity, ident)) {
@@ -168,12 +174,18 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
     ? signReceipt(makeReceipt(v, { gateway: ident.gatewayWebId }), ident.hmacSecret)
     : null;
   const hash = sha256hex(raw);
-  const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
+  // The item and its receipt together: on a slow pod, one write after the
+  // other outlasted the sender's wait, and the sender sent the item again. A
+  // receipt whose item did not land vouches for nothing, and the reader lets
+  // it go.
+  const [okA] = await Promise.all([
+    inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw),
+    receipt ? inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt) : null,
+  ]);
   // A pod-write failure returns 5xx so the ORIGIN retries over its own ladder —
   // that is what preserves the pod's buffer property without the gateway
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
-  if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
   return { status: 202, reason: v.verified ? 'verified' : failed ? `buffered-unverified: ${failed}` : 'buffered-unverified',
     content, bytes: bytes.byteLength, type: activity.type, notifies: notifies(activity, ident), name: hash, raw, receipt };
 }

package/lib/gateway/held-mail.mjs

@@ -69,40 +69,55 @@ export const holdingPut = (ctx, handle, rec) => async (url, body, ct) => {
  * [{ name, body, receipt, held: [the held names it came from] }]. A receipt
  * whose delivery is not here has nothing to vouch for, and is let go.
  */
-export async function heldEntries(ctx, handle) {
-  const names = await ctx.listHeld(handle);
+// `max`: at most that many deliveries, the first by name, and no more of the
+// pile is listed or read than holds them. Without it, everything.
+export async function heldEntries(ctx, handle, { max = Infinity } = {}) {
+  // A receipt may sit beside each delivery: twice as many names hold them whole.
+  const names = (await ctx.listHeld(handle, Number.isFinite(max) ? { limit: max * 2 } : {})).sort();
   if (!names.length) return [];
   const items = new Map();            // item name -> { body, receipt, held: [names] }
   for (const name of names) {
-    const got = await ctx.readHeld(handle, name);
     const item = name.endsWith(RECEIPT) ? name.slice(0, -RECEIPT.length) : name;
+    if (!items.has(item) && items.size >= max) break;
     const e = items.get(item) || { held: [] };
     e.held.push(name);
-    if (got != null) {
-      if (name.endsWith(RECEIPT)) { try { e.receipt = JSON.parse(got); } catch { e.receipt = null; } } else e.body = got;
-    }
     items.set(item, e);
   }
-  for (const [item, e] of items) {
+  await inTurns([...items], async ([item, e]) => {
+    for (const name of e.held) {
+      const got = await ctx.readHeld(handle, name);
+      if (got == null) continue;
+      if (name.endsWith(RECEIPT)) { try { e.receipt = JSON.parse(got); } catch { e.receipt = null; } } else e.body = got;
+    }
     if (typeof e.body !== 'string') { for (const n of e.held) await ctx.dropHeld(handle, n); items.delete(item); }
-  }
+  });
   return [...items].map(([name, e]) => ({ name, body: e.body, receipt: e.receipt || null, held: e.held }));
 }
 
-// Everything held for one account, written to its pod inbox in batches and
-// then let go. Returns how many deliveries reached the pod. A batch the pod
-// refuses stays held for the next try.
-export async function flushHeld(ctx, handle, rec, { now = Date.now() } = {}) {
-  const all = (await heldEntries(ctx, handle)).map((e) => [e.name, e]);
-  if (!all.length) return 0;
+// A few at a time: a pile is read and let go quickly without asking the store
+// for all of it at once.
+const TOGETHER = 6;
+async function inTurns(list, fn) {
+  for (let i = 0; i < list.length; i += TOGETHER) await Promise.all(list.slice(i, i + TOGETHER).map(fn));
+}
+
+// What is held for one account, written to its pod inbox in batches and then
+// let go: every batch, or `batches` of them. Returns how many deliveries
+// reached the pod. A batch the pod refuses, or does not take within `podMs`
+// where one is given, stays held for the next try.
+export async function flushHeld(ctx, handle, rec, { now = Date.now(), batches = Infinity, podMs = null } = {}) {
   let delivered = 0;
-  for (let i = 0; i < all.length; i += BATCH_MAX) {
-    const chunk = all.slice(i, i + BATCH_MAX);
-    const batch = chunk.map(([name, e]) => ({ name, body: e.body, receipt: e.receipt || null }));
-    const doc = `batch-${now}-${i / BATCH_MAX}-${Math.random().toString(36).slice(2, 8)}.json`;
-    const ok = await ctx.podPut(handle, inboxOf(rec) + doc, JSON.stringify({ batch }), 'application/json');
+  const sent = new Set();
+  for (let i = 0; i < batches; i++) {
+    // A delivery written once is not written again, should letting it go fail.
+    const chunk = (await heldEntries(ctx, handle, { max: BATCH_MAX })).filter((e) => !sent.has(e.name));
+    if (!chunk.length) break;
+    const batch = chunk.map((e) => ({ name: e.name, body: e.body, receipt: e.receipt || null }));
+    const doc = `batch-${now}-${i}-${Math.random().toString(36).slice(2, 8)}.json`;
+    const ok = await ctx.podPut(handle, inboxOf(rec) + doc, JSON.stringify({ batch }), 'application/json', podMs ? { timeoutMs: podMs } : undefined);
     if (!ok) break;
-    for (const [, e] of chunk) for (const n of e.held) await ctx.dropHeld(handle, n);
+    for (const e of chunk) sent.add(e.name);
+    await inTurns(chunk.flatMap((e) => e.held), (n) => ctx.dropHeld(handle, n));
     delivered += chunk.length;
   }
   return delivered;
@@ -132,17 +147,33 @@ export async function afterHeld(ctx, handle, rec, { type, notifies = false } = {
 // is gone, closed or moved has nowhere to deliver to, so its mail is let go.
 // `keep(handle, rec)` answers true when the account's keeper will take its mail
 // itself (lib/gateway/keeper.mjs), which delivers it and then reads it.
+//
+// The round has to end. So an account gets one batch a round, a pod has
+// ROUND_POD_MS to take it, a few accounts are worked on at a time, and each
+// round begins after the account the last one finished with (ctx.roundMark,
+// ctx.setRoundMark): a round cut short leaves out different accounts each time.
+export const ROUND_POD_MS = 10_000;
+const ROUND_TOGETHER = 4;
 export async function flushAll(ctx, { log = console.log, isGone = async () => false, keep = async () => false } = {}) {
-  for (const handle of await ctx.heldAccounts()) {
+  const all = [...await ctx.heldAccounts()].sort();
+  const mark = await ctx.roundMark?.().catch(() => null);
+  const from = mark ? all.findIndex((h) => h > mark) : 0;
+  const order = from > 0 ? [...all.slice(from), ...all.slice(0, from)] : all;
+  const one = async (handle) => {
     const rec = await ctx.lookup(handle);
     if (!rec || rec.movedTo || await isGone(handle, rec)) {
-      for (const n of await ctx.listHeld(handle)) await ctx.dropHeld(handle, n);
+      await inTurns(await ctx.listHeld(handle, { limit: BATCH_MAX * 2 }), (n) => ctx.dropHeld(handle, n));
       log(`held mail @${handle}: let go (no account to deliver to)`);
-      continue;
+      return;
     }
-    if (await keep(handle, rec).catch(() => false)) continue;
-    const n = await flushHeld(ctx, handle, rec).catch((e) => { log(`held mail @${handle}: ${e?.message || e}`); return 0; });
+    if (await keep(handle, rec).catch(() => false)) return;
+    const n = await flushHeld(ctx, handle, rec, { batches: 1, podMs: ROUND_POD_MS });
     if (n) log(`held mail @${handle}: ${n} delivered to the pod`);
+  };
+  for (let i = 0; i < order.length; i += ROUND_TOGETHER) {
+    const turn = order.slice(i, i + ROUND_TOGETHER);
+    await Promise.all(turn.map((h) => one(h).catch((e) => log(`held mail @${h}: ${e?.message || e}`))));
+    await ctx.setRoundMark?.(turn.at(-1)).catch(() => {});
   }
 }
 

package/lib/gateway/keeper-due.mjs

@@ -7,18 +7,30 @@
 // sets it to now, and one that arrives while a run is going is not lost when
 // the run finishes. A run that could not take the account's lease tries again
 // next round; one that failed, in an hour.
+//
+// A time is kept as an ISO string. A run may hand one in as a number of
+// milliseconds (a forum's does), and one stored that way is read the same.
 
 const RETRY_FAILED_MS = 3_600_000;
 
-// The sooner of two times (ISO strings, either of them null).
-export const earliest = (a, b) => (!a ? b || null : !b ? a : Date.parse(a) <= Date.parse(b) ? a : b);
+// A time as an ISO string, or null where there is none to read.
+const iso = (t) => {
+  const ms = typeof t === 'number' ? t : t ? Date.parse(t) : NaN;
+  return Number.isFinite(ms) ? new Date(ms).toISOString() : null;
+};
+
+// The sooner of two times (either of them null).
+export const earliest = (a, b) => {
+  const [x, y] = [iso(a), iso(b)];
+  return !x ? y : !y ? x : Date.parse(x) <= Date.parse(y) ? x : y;
+};
 
 export function keeperBook(store) {
   return {
     async noteKept(handle, out, started = 0, now = Date.now()) {
       const prev = (await store.get(handle)) || {};
       const next = out?.retry === 'soon' ? prev.nextAt
-        : out?.retry === 'later' ? new Date(now + RETRY_FAILED_MS).toISOString() : out?.nextAt;
+        : out?.retry === 'later' ? new Date(now + RETRY_FAILED_MS).toISOString() : iso(out?.nextAt);
       const woken = prev.noted >= started ? prev.nextAt : null;
       await store.set(handle, { at: now, waiting: out?.waiting || 0, skipped: out?.skipped || null,
         nextAt: earliest(next || null, woken) });
@@ -31,7 +43,8 @@ export function keeperBook(store) {
       const due = [];
       for (const key of await store.keys()) {
         const k = (await store.get(key)) || {};
-        if (k.nextAt && Date.parse(k.nextAt) <= now) due.push(key);
+        const at = iso(k.nextAt);
+        if (at && Date.parse(at) <= now) due.push(key);
       }
       return due;
     },

package/lib/gateway/quiet.mjs

@@ -4,7 +4,17 @@
 // public read, stamps noteOpened from the relay, counts noteReceived after
 // a forwarded delivery, and hands /api/open, /api/pause and /api/close here.
 
-import { keptNow, holdOn } from './copy.mjs';
+import { keptNow, holdOn, isPersonal } from './copy.mjs';
+
+// A gateway whose people all run FediPod in a browser gives every person's
+// account a day its owner was last here, so none is left out of what follows:
+// the day it was attached, or the day these dates began for a row that has
+// neither. A forum, a group and a forum's category are nobody's to open.
+export const FIRST_OPENED = '2026-09-23T00:00:00.000Z';
+export function withOpened(rec) {
+  if (!rec || rec.openedAt || !isPersonal(rec)) return rec;
+  return { ...rec, openedAt: rec.attachedAt || FIRST_OPENED };
+}
 
 // ---- accounts that go quiet -------------------------------------------------
 //

package/lib/pod/inbox.mjs

@@ -20,12 +20,15 @@ const RECEIPT_CT = 'application/json';
  * public Append the pod may well allow. This is the one place that gets to
  * decide that, because it lived in two adapters and had to be right in both.
  *
+ * `timeoutMs`, when given, is how long the pod has to answer; a pod that takes
+ * longer counts as one that did not answer.
+ *
  * @returns {Promise<boolean>} whether it landed
  */
-export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch, report = null } = {}) {
+export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch, report = null, timeoutMs = null } = {}) {
   const headers = { 'content-type': contentType,
     ...(appendToken ? { authorization: `Bearer ${appendToken}` } : {}) };
-  const r = await fetchImpl(url, { method: 'PUT', headers, body }).catch(() => null);
+  const r = await fetchImpl(url, { method: 'PUT', headers, body, ...(timeoutMs ? { signal: AbortSignal.timeout(timeoutMs) } : {}) }).catch(() => null);
   // The pod's answer, for a caller that keeps a log: a refused write is
   // otherwise a bare "failed" with the status thrown away.
   report?.(r ? r.status : 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.57.0",
+  "version": "1.57.5",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node claude/smoke-tests/admin-facade-smoke.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs claude/smoke-tests/signin-hardening.test.mjs claude/smoke-tests/load-fixes.test.mjs claude/smoke-tests/unread-docs.test.mjs claude/smoke-tests/post-text-once.test.mjs claude/smoke-tests/connected-pod-only.test.mjs claude/smoke-tests/check-letter.test.mjs claude/smoke-tests/gone-through-relay.test.mjs claude/smoke-tests/connected-feeds.test.mjs claude/smoke-tests/forum-pages.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node claude/smoke-tests/admin-facade-smoke.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs claude/smoke-tests/signin-hardening.test.mjs claude/smoke-tests/load-fixes.test.mjs claude/smoke-tests/unread-docs.test.mjs claude/smoke-tests/post-text-once.test.mjs claude/smoke-tests/connected-pod-only.test.mjs claude/smoke-tests/check-letter.test.mjs claude/smoke-tests/gone-through-relay.test.mjs claude/smoke-tests/connected-feeds.test.mjs claude/smoke-tests/forum-pages.test.mjs claude/smoke-tests/round.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",
@@ -76,7 +76,7 @@
     "@rdfjs/term-set": "^2.0.3",
     "@solid/access-token-verifier": "^2.1.1",
     "clownface": "^2.0.3",
-    "fediverse-session": "^0.2.1",
+    "fediverse-session": "^0.2.2",
     "jose": "^6.2.8",
     "json-canon": "^1.0.1",
     "jsonld": "^9.0.0",

package/scripts/check-netlify-bundles.mjs

@@ -18,9 +18,14 @@ const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'fn-bundles-'));
 let fails = 0;
 const check = (ok, msg) => { console.log(`${ok ? 'PASS' : 'FAIL'}  ${msg}`); if (!ok) fails++; };
 try {
-  // The functions carry the forum as it is in its own folder now.
-  const { bringForum } = await import('./forum-package.mjs');
+  // The functions carry the forum as it is in its own folder now, running on
+  // this folder's FediPod: on an older copy the forum lacked the day's fixes
+  // while every test, which runs it on this folder, passed (1.57.3, 2026-11-14).
+  const { bringForum, forumCoreDiffers } = await import('./forum-package.mjs');
   bringForum();
+  const behind = forumCoreDiffers();
+  check(behind.length === 0, `the forum runs on this folder's FediPod${behind.length
+    ? ` (${behind.length} file(s) under lib/ differ: ${behind.slice(0, 5).join(', ')}${behind.length > 5 ? ', …' : ''})` : ''}`);
   execFileSync('netlify', ['functions:build', '--src', path.join(root, 'netlify/functions'), '--functions', path.join(tmp, 'zips')],
     { cwd: root, stdio: 'ignore' });
   const manifest = JSON.parse(fs.readFileSync(path.join(tmp, 'zips/manifest.json'), 'utf8'));

package/scripts/forum-package.mjs

@@ -5,22 +5,44 @@
 // publish it and put in node_modules without touching FediPod's package list,
 // so nothing FediPod records names a forum version. Staging the site, the
 // bundle check and the app build each bring it first.
+//
+// The forum runs on FediPod, and here that is this folder: packed the same
+// way and installed beside the forum, so the forum's `fedipod` is the code
+// being deployed and not the one the registry has.
 import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path';
 import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
 import { fetchDependent, root } from './dependents.mjs';
 
-/** The forum from its folder, installed in node_modules. Returns its folder and version. */
+/** The forum from its folder, and this folder for it to run on, installed in node_modules. Returns the forum's folder and version. */
 export function bringForum({ log = console.log } = {}) {
   const dir = fetchDependent('fedipod-bb', { log });
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'forum-pack-'));
   try {
-    const packed = JSON.parse(execFileSync('npm', ['pack', dir, '--pack-destination', tmp, '--ignore-scripts', '--json'],
+    const pack = (from) => JSON.parse(execFileSync('npm', ['pack', from, '--pack-destination', tmp, '--ignore-scripts', '--json'],
       { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }))[0];
-    execFileSync('npm', ['install', '--no-save', '--no-audit', '--no-fund', '--ignore-scripts', path.join(tmp, packed.filename)],
-      { cwd: root, stdio: 'ignore' });
-    log(`forum: fedipod-bb ${packed.version} from ${path.relative(root, dir) || dir}`);
-    return { dir, version: packed.version };
+    const forum = pack(dir);
+    const self = pack(root);
+    execFileSync('npm', ['install', '--no-save', '--no-audit', '--no-fund', '--ignore-scripts',
+      path.join(tmp, forum.filename), path.join(tmp, self.filename)], { cwd: root, stdio: 'ignore' });
+    log(`forum: fedipod-bb ${forum.version} from ${path.relative(root, dir) || dir}, on fedipod ${self.version} from this folder`);
+    return { dir, version: forum.version };
   } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
 }
 
+/**
+ * The files under lib/ that the forum's `fedipod` and this folder do not
+ * have the same. Empty when the forum runs on this folder's code.
+ */
+export function forumCoreDiffers() {
+  const theirs = path.join(path.dirname(createRequire(path.join(root, 'node_modules/fedipod-bb/package.json')).resolve('fedipod/package.json')), 'lib');
+  const ours = path.join(root, 'lib');
+  const files = (base) => fs.readdirSync(base, { recursive: true, withFileTypes: true })
+    .filter((e) => e.isFile()).map((e) => path.relative(base, path.join(e.parentPath, e.name)));
+  const same = (rel) => {
+    try { return fs.readFileSync(path.join(ours, rel)).equals(fs.readFileSync(path.join(theirs, rel))); } catch { return false; }
+  };
+  return [...new Set([...files(ours), ...files(theirs)])].filter((rel) => !same(rel)).sort();
+}
+
 if (import.meta.url === `file://${process.argv[1]}`) bringForum();

package/web/app/boot.mjs

@@ -222,9 +222,10 @@ window.fedipodSignin = async ({ address }) => {
 };
 
 // Called on every page load. Returns 'signed-in' | 'restored' | 'anonymous' |
-// 'signup' | 'move-in' — the last two being a return from the pod's login
-// in the middle of creating an account: with no account on the pod yet, or
-// with one whose address lives at another gateway.
+// 'signup' | 'move-in' | 'leaving' — 'signup' and 'move-in' being a return
+// from the pod's login in the middle of creating an account: with no account
+// on the pod yet, or with one whose address lives at another gateway.
+// 'leaving': the page is on its way to the pod's login.
 window.fedipodOnLoad = async () => {
   if (new URLSearchParams(location.search).get('code')) {
     const done = await completeLogin({ currentUrl: location.href });
@@ -240,8 +241,21 @@ window.fedipodOnLoad = async () => {
     await bootWorker({ reset: true });        // this may be a different account
     return 'signed-in';
   }
-  if (await getSession()) { await bootWorker(); return 'restored'; }
-  return 'anonymous';
+  const kept = await getSession();
+  if (!kept) return 'anonymous';
+  // What the browser has stored says a sign-in was made, not that the pod
+  // still honours it. The pod is asked before anything is started on it, and
+  // only when the sign-in's time is up. One the pod has ended goes to the
+  // pod's own login, which the stored sign-in names: nobody is asked to press
+  // a button for it. A pod that cannot be asked is left to the start below.
+  if (await kept.check().catch(() => true) === false) {
+    try {
+      location.href = (await beginLogin({ issuer: kept.issuer, redirectUri: REDIRECT })).authorizationUrl;
+      return 'leaving';
+    } catch { return 'anonymous'; }   // its login cannot be reached: the sign-in page, as for anybody
+  }
+  await bootWorker();
+  return 'restored';
 };
 
 window.fedipodSignOut = async () => {
@@ -366,6 +380,7 @@ if (typeof document !== 'undefined') (async () => {
       const signIn = () => { location.href = '/?add'; };
       const known = {
         'sign-in-refused': { title: 'Your pod refused this sign-in', retry: 'Sign in again', go: signIn },
+        'signed-out': { title: 'Your sign-in has ended', retry: 'Sign in again', go: signIn },
         'pod-busy': { title: 'Your pod is asking for a pause', retry: 'Reload', go: reload, wait: 45 },
         'pod-error': { title: 'Your pod had an error', retry: 'Reload', go: reload, wait: 20 },
         'pod-unreachable': { title: 'Your pod could not be reached', retry: 'Reload', go: reload, wait: 20 },
@@ -440,6 +455,7 @@ if (typeof document !== 'undefined') (async () => {
     // web/admin surface as local). Its own script signs the framed client in on
     // a fresh session and forwards deep links on a returning one, so both a
     // fresh sign-in and a restored session land in the same place.
+    if (state === 'leaving') return;
     if (state === 'signed-in' || state === 'restored') { location.href = '/admin/client/'; return; }
     // Back from the pod's login with no account there yet, or with one to
     // move here: the identity screen, once the form below is wired.