fedipod 1.6.0 → 1.8.0

package/lib/core/contexts/anno.json

@@ -0,0 +1,126 @@
+{
+ "@context": {
+    "oa":      "http://www.w3.org/ns/oa#",
+    "dc":      "http://purl.org/dc/elements/1.1/",
+    "dcterms": "http://purl.org/dc/terms/",
+    "dctypes": "http://purl.org/dc/dcmitype/",
+    "foaf":    "http://xmlns.com/foaf/0.1/",
+    "rdf":     "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
+    "rdfs":    "http://www.w3.org/2000/01/rdf-schema#",
+    "skos":    "http://www.w3.org/2004/02/skos/core#",
+    "xsd":     "http://www.w3.org/2001/XMLSchema#",
+    "iana":    "http://www.iana.org/assignments/relation/",
+    "owl":     "http://www.w3.org/2002/07/owl#",
+    "as":      "http://www.w3.org/ns/activitystreams#",
+    "schema":  "http://schema.org/",
+
+    "id":      {"@type": "@id", "@id": "@id"},
+    "type":    {"@type": "@id", "@id": "@type"},
+
+    "Annotation":           "oa:Annotation",
+    "Dataset":              "dctypes:Dataset",
+    "Image":                "dctypes:StillImage",
+    "Video":                "dctypes:MovingImage",
+    "Audio":                "dctypes:Sound",
+    "Text":                 "dctypes:Text",
+    "TextualBody":          "oa:TextualBody",
+    "ResourceSelection":    "oa:ResourceSelection",
+    "SpecificResource":     "oa:SpecificResource",
+    "FragmentSelector":     "oa:FragmentSelector",
+    "CssSelector":          "oa:CssSelector",
+    "XPathSelector":        "oa:XPathSelector",
+    "TextQuoteSelector":    "oa:TextQuoteSelector",
+    "TextPositionSelector": "oa:TextPositionSelector",
+    "DataPositionSelector": "oa:DataPositionSelector",
+    "SvgSelector":          "oa:SvgSelector",
+    "RangeSelector":        "oa:RangeSelector",
+    "TimeState":            "oa:TimeState",
+    "HttpRequestState":     "oa:HttpRequestState",
+    "CssStylesheet":        "oa:CssStyle",
+    "Choice":               "oa:Choice",
+    "Person":               "foaf:Person",
+    "Software":             "as:Application",
+    "Organization":         "foaf:Organization",
+    "AnnotationCollection": "as:OrderedCollection",
+    "AnnotationPage":       "as:OrderedCollectionPage",
+    "Audience":             "schema:Audience", 
+
+    "Motivation":    "oa:Motivation",
+    "bookmarking":   "oa:bookmarking",
+    "classifying":   "oa:classifying",
+    "commenting":    "oa:commenting",
+    "describing":    "oa:describing",
+    "editing":       "oa:editing",
+    "highlighting":  "oa:highlighting",
+    "identifying":   "oa:identifying",
+    "linking":       "oa:linking",
+    "moderating":    "oa:moderating",
+    "questioning":   "oa:questioning",
+    "replying":      "oa:replying",
+    "reviewing":     "oa:reviewing",
+    "assessing":     "oa:assessing",
+    "tagging":       "oa:tagging",
+
+    "auto":          "oa:autoDirection",
+    "ltr":           "oa:ltrDirection",
+    "rtl":           "oa:rtlDirection",
+
+    "body":          {"@type": "@id", "@id": "oa:hasBody"},
+    "target":        {"@type": "@id", "@id": "oa:hasTarget"},
+    "source":        {"@type": "@id", "@id": "oa:hasSource"},
+    "selector":      {"@type": "@id", "@id": "oa:hasSelector"},
+    "state":         {"@type": "@id", "@id": "oa:hasState"},
+    "scope":         {"@type": "@id", "@id": "oa:hasScope"},
+    "refinedBy":     {"@type": "@id", "@id": "oa:refinedBy"},
+    "startSelector": {"@type": "@id", "@id": "oa:hasStartSelector"},
+    "endSelector":   {"@type": "@id", "@id": "oa:hasEndSelector"},
+    "renderedVia":   {"@type": "@id", "@id": "oa:renderedVia"},
+    "creator":       {"@type": "@id", "@id": "dcterms:creator"},
+    "generator":     {"@type": "@id", "@id": "as:generator"},
+    "rights":        {"@type": "@id", "@id": "dcterms:rights"},
+    "homepage":      {"@type": "@id", "@id": "foaf:homepage"},
+    "via":           {"@type": "@id", "@id": "oa:via"},
+    "canonical":     {"@type": "@id", "@id": "oa:canonical"},
+    "stylesheet":    {"@type": "@id", "@id": "oa:styledBy"},
+    "cached":        {"@type": "@id", "@id": "oa:cachedSource"},
+    "conformsTo":    {"@type": "@id", "@id": "dcterms:conformsTo"},
+    "items":         {"@type": "@id", "@id": "as:items", "@container": "@list"},
+    "partOf":        {"@type": "@id", "@id": "as:partOf"},
+    "first":         {"@type": "@id", "@id": "as:first"},
+    "last":          {"@type": "@id", "@id": "as:last"},
+    "next":          {"@type": "@id", "@id": "as:next"},
+    "prev":          {"@type": "@id", "@id": "as:prev"},
+    "audience":      {"@type": "@id", "@id": "schema:audience"},
+    "motivation":    {"@type": "@vocab", "@id": "oa:motivatedBy"},
+    "purpose":       {"@type": "@vocab", "@id": "oa:hasPurpose"},
+    "textDirection": {"@type": "@vocab", "@id": "oa:textDirection"},
+
+    "accessibility": "schema:accessibilityFeature",
+    "bodyValue":     "oa:bodyValue",
+    "format":        "dc:format",
+    "language":      "dc:language",
+    "processingLanguage": "oa:processingLanguage",
+    "value":         "rdf:value",
+    "exact":         "oa:exact",
+    "prefix":        "oa:prefix",
+    "suffix":        "oa:suffix",
+    "styleClass":    "oa:styleClass",
+    "name":          "foaf:name",
+    "email":         "foaf:mbox",
+    "email_sha1":    "foaf:mbox_sha1sum",
+    "nickname":      "foaf:nick",
+    "label":         "rdfs:label",
+
+    "created":       {"@id": "dcterms:created", "@type": "xsd:dateTime"},
+    "modified":      {"@id": "dcterms:modified", "@type": "xsd:dateTime"},
+    "generated":     {"@id": "dcterms:issued", "@type": "xsd:dateTime"},
+    "sourceDate":    {"@id": "oa:sourceDate", "@type": "xsd:dateTime"},
+    "sourceDateStart": {"@id": "oa:sourceDateStart", "@type": "xsd:dateTime"},
+    "sourceDateEnd": {"@id": "oa:sourceDateEnd", "@type": "xsd:dateTime"},
+
+    "start":         {"@id": "oa:start", "@type": "xsd:nonNegativeInteger"},
+    "end":           {"@id": "oa:end", "@type": "xsd:nonNegativeInteger"},
+    "total":         {"@id": "as:totalItems", "@type": "xsd:nonNegativeInteger"},
+    "startIndex":    {"@id": "as:startIndex", "@type": "xsd:nonNegativeInteger"}
+  }
+}

package/lib/core/contexts/index.mjs

@@ -25,6 +25,9 @@ import ctx10 from './fep-5711.json' with { type: 'json' };
 import ctx11 from './join-lemmy.json' with { type: 'json' };
 import ctx12 from './joinmastodon.json' with { type: 'json' };
 import ctx13 from './miscellany.json' with { type: 'json' };
+// Not from fedify: the W3C Web Annotation context, which a client such as
+// dokieli names on the annotations it posts to the outbox.
+import ctx14 from './anno.json' with { type: 'json' };
 
 /** URL → the context document itself. Nothing outside this map is ever resolved. */
 export const CONTEXTS = {
@@ -42,4 +45,5 @@ export const CONTEXTS = {
   'https://join-lemmy.org/context.json': ctx11,
   'http://joinmastodon.org/ns': ctx12,
   'https://purl.archive.org/miscellany': ctx13,
+  'http://www.w3.org/ns/anno.jsonld': ctx14,
 };

package/lib/core/contexts/map.json

@@ -12,5 +12,6 @@
   "https://w3id.org/fep/5711": "fep-5711.json",
   "https://join-lemmy.org/context.json": "join-lemmy.json",
   "http://joinmastodon.org/ns": "joinmastodon.json",
-  "https://purl.archive.org/miscellany": "miscellany.json"
+  "https://purl.archive.org/miscellany": "miscellany.json",
+  "http://www.w3.org/ns/anno.jsonld": "anno.json"
 }

package/lib/core/intake/index.mjs

@@ -59,8 +59,10 @@ const MAX_ITEM_ATTEMPTS = 5;
 const MAX_ITEMS_PER_DRAIN = 50;
 
 export class Intake {
-  constructor({ config, urls, remote, store, deliverer, publisher, log = console.log, lease = null, archive = null, push = true, pollSeconds = null }) {
-    Object.assign(this, { config, urls, remote, store, deliverer, publisher, log, lease, archive, push, pollSeconds });
+  // `ownerPost(activity, { raw, slug })` is the client-to-server dispatcher,
+  // for an item the Gateway's outbox door took on the owner's behalf.
+  constructor({ config, urls, remote, store, deliverer, publisher, log = console.log, lease = null, archive = null, push = true, pollSeconds = null, ownerPost = null }) {
+    Object.assign(this, { config, urls, remote, store, deliverer, publisher, log, lease, archive, push, pollSeconds, ownerPost });
     this.serial = Date.now();
     this.stopped = false;
     // (attempt counts are kept in pod state — see _bumpAttempt)
@@ -429,9 +431,14 @@ export class Intake {
         // receipt reads as null, which is exactly today's unverified behavior.
         const receipt = activity ? await this._readReceipt(url) : null;
         if (activity && this.gatewaySecret()) this._bumpGatewayStat(!!receipt?.verified);
-        const rejection = activity ? await this.handle(activity, receipt) : 'unparsable JSON';
-        if (!rejection && raw) await this._archive(url, raw, activity);
-        if (!rejection) await this._maybeForward(activity);    // §7.1.2, only what we accepted
+        // The owner's own post, taken at the outbox door: not mail to read
+        // but a write to make. Never archived or forwarded as if received.
+        const owned = activity && this.isOwnerPost(receipt);
+        const rejection = !activity ? 'unparsable JSON'
+          : owned ? await this.ownerPostFrom(activity, raw, receipt)
+            : await this.handle(activity, receipt);
+        if (!rejection && raw && !owned) await this._archive(url, raw, activity);
+        if (!rejection && !owned) await this._maybeForward(activity);    // §7.1.2, only what we accepted
         if (rejection) {
           this.store.addDeadLetter({
             inboxUrl: url, reason: rejection, activity: trimActivity(activity),
@@ -594,6 +601,26 @@ export class Intake {
   gatewaySecret(...a) { return verify.gatewaySecret(this, ...a); }
   _bumpGatewayStat(...a) { return verify.bumpGatewayStat(this, ...a); }
   _readReceipt(...a) { return verify.readReceipt(this, ...a); }
+
+  // A receipt the door stamped `c2s` for THIS actor, and only a receipt whose
+  // HMAC verified (readReceipt returns nothing else). A stranger appending an
+  // item that claims to be ours has no such receipt and is read as mail.
+  isOwnerPost(receipt) {
+    return !!(this.ownerPost && receipt?.verified && receipt.method === 'c2s' && receipt.actor === this.urls.actor);
+  }
+
+  // Publish what the owner posted at the door. The bytes as the client wrote
+  // them go to the dispatcher (an object stored as sent must be the client's
+  // document, not our reading of it); the graph is what it decides from.
+  // Returns null when published, else the reason it was not — a dead letter.
+  async ownerPostFrom(activity, raw, receipt) {
+    let asSent = null;
+    try { asSent = raw ? JSON.parse(raw) : null; } catch { asSent = null; }
+    const r = await this.ownerPost(activity, { raw: asSent, slug: receipt.slug || null });
+    if (!r || r.status >= 300) return `owner post refused (${r?.status || '?'}): ${r?.body?.error || ''}`;
+    this.log(`owner post from the outbox door published: ${r.body?.object || r.body?.id || activity.type}`);
+    return null;
+  }
   receiptVouchesFor(...a) { return verify.receiptVouchesFor(this, ...a); }
   isGone(...a) { return verify.isGone(this, ...a); }
 

package/lib/core/publisher/index.mjs

@@ -76,6 +76,15 @@ export class Publisher {
   // republish button. Without it, an actor lost from the pod would match the
   // digest, be skipped, and leave the agent reporting success while nobody can
   // resolve it.
+  // The Gateway's outbox door for this account, when a Gateway is attached:
+  // beside its inbox door, or under the fronted actor.
+  gatewayOutbox() {
+    const gw = this.config.gateway;
+    if (!(gw && gw.url && gw.mode && gw.mode !== 'off')) return null;
+    if (gw.frontActor) return String(gw.frontActor).replace(/ap\/actor\/?$/u, 'ap/outbox');
+    return String(gw.url).replace(/ap\/inbox\/?$/u, 'ap/outbox');
+  }
+
   async publishProfile({ force = false } = {}) {
     const { urls } = this;
     const host = new URL(urls.base).host;
@@ -105,7 +114,8 @@ export class Publisher {
       inbox: gwActive ? gw.url : null,
       // The agent's own outbox endpoint, where it is reachable: a client
       // following the actor must arrive somewhere that will take a write.
-      outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : null,
+      // Otherwise the Gateway's outbox door, when one is attached.
+      outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : this.gatewayOutbox(),
       // How a client-to-server client finds the way in with nothing configured
       // by hand. Advertised only where the surface is publicly reachable.
       oauthAuthorize: this.clientOrigin ? `${this.clientOrigin}oauth/authorize` : null,
@@ -163,6 +173,8 @@ export class Publisher {
         actorUrl: urls.actor,
         accountName: `@${this.config.handle}@${host}`,
         kind: this.config.kind,
+        // Where a Solid client posts: dokieli reads `as:outbox` off the WebID.
+        outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : this.gatewayOutbox(),
       });
       if (wrote) this.log('WebID profile now lists the actor as a foaf:account');
     } catch (e) {
@@ -400,6 +412,7 @@ export class Publisher {
   reconcileFollowers(...a) { return restore.reconcileFollowers(this, ...a); }
   reconcileOutbox(...a) { return restore.reconcileOutbox(this, ...a); }
   rebuildStatuses(...a) { return restore.rebuildStatuses(this, ...a); }
+  healStatuses(...a) { return restore.healStatuses(this, ...a); }
 
   // notes.mjs
   ensureMediaContainer(...a) { return notes.ensureMediaContainer(this, ...a); }
@@ -408,6 +421,7 @@ export class Publisher {
   privateReady(...a) { return notes.privateReady(this, ...a); }
   _mentionsFor(...a) { return notes.mentionsFor(this, ...a); }
   publishNote(...a) { return notes.publishNote(this, ...a); }
+  publishObject(...a) { return notes.publishObject(this, ...a); }
   updateNote(...a) { return notes.updateNote(this, ...a); }
 
   // questions.mjs

package/lib/core/publisher/notes.mjs

@@ -99,7 +99,28 @@ export function assertDirectAddressed(content, mentions) {
   throw e;
 }
 
-export async function publishNote(publisher, content, { inReplyTo, attachments, visibility = 'public', spoilerText = null } = {}) {
+// A client may name the document it is creating (the Slug of a client-to-server
+// POST). Only a plain name is taken, and only when nothing is there already;
+// otherwise the agent mints one as it always has.
+const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
+export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
+async function slugFor(publisher, container, wanted, published) {
+  const name = safeSlug(wanted);
+  if (name && !(await podNotes.read(publisher.remote, container + name).catch(() => null))) return name;
+  return published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+}
+
+// What the author's own timeline shows for an object: its content, else its
+// text under one of the names other vocabularies use, else a link to it.
+export function rowContent(obj) {
+  if (typeof obj?.content === 'string' && obj.content.trim()) return wire.sanitizeHtml(obj.content);
+  const plain = [obj?.bodyValue, obj?.name, obj?.summary].find((v) => typeof v === 'string' && v.trim());
+  if (plain) return wire.contentHtml(plain);
+  const esc = (v) => String(v).replace(/[&<>"]/gu, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+  return `<p><a href="${esc(obj?.id || '')}">${esc(obj?.type || 'object')}</a></p>`;
+}
+
+export async function publishNote(publisher, content, { inReplyTo, attachments, visibility = 'public', spoilerText = null, slug: wanted = null } = {}) {
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
   if (priv) {
@@ -107,7 +128,7 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
     if (ready !== true) throw new Error(ready);
   }
   const published = new Date().toISOString();
-  const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+  const slug = await slugFor(publisher, priv ? urls.privateNotes : urls.notes, wanted, published);
   const mentions = await publisher._mentionsFor(content, inReplyTo);
   if (visibility === 'direct') assertDirectAddressed(content, mentions);
   const note = wire.noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions,
@@ -127,6 +148,11 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
     ...(attachments?.length ? { attachments } : {}),
     ...(note.tag?.length ? { mentions: note.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
   });
+  // The row is what the author's own timeline reads. Land it before answering
+  // — the same PUT the debounce would send in 300 ms — so a worker killed or a
+  // write refused after the answer cannot leave a post that stands on the pod
+  // and reached followers but never shows to its author.
+  if (await publisher.store.commit?.() === false) publisher.log(`post published but its timeline row was refused: ${note.id}`);
 
   const create = wire.createActivity(note, urls);
   // Published as its own document: a group that carries this post wraps the
@@ -164,6 +190,62 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
 // edit's own stamp. The pod documents are overwritten in place — the Create
 // too, so a group's Announce resolves to the edited text — and an Update
 // goes everywhere the Create went.
+// Any object as a post: what a client-to-server Create carries when it is not
+// a Note or a Question — a Web Annotation, say. Stored as sent, with its own
+// context, under this actor; the Create around it is what followers receive.
+// Servers that know the type show it; the rest ignore it, which is the
+// expected outcome.
+//
+// An object already living on this pod (an id under it) is not copied: the
+// Create names it where it is. Anything else is written into the notes
+// container under the client's slug when it is free, else a minted one.
+export async function publishObject(publisher, object, { visibility = 'public', slug: wanted = null } = {}) {
+  const { urls } = publisher;
+  const priv = visibility === 'private' || visibility === 'direct';
+  if (priv) {
+    const ready = await publisher.privateReady();
+    if (ready !== true) throw new Error(ready);
+  }
+  const published = new Date().toISOString();
+  const container = priv ? urls.privateNotes : urls.notes;
+  const pod = publisher.config?.remotePod || urls.base;
+  const ownId = typeof object.id === 'string' && /^https?:\/\//u.test(object.id) && object.id.startsWith(pod)
+    ? object.id : null;
+  const name = await slugFor(publisher, container, wanted, published);
+  const addressed = wire.addressing(urls, visibility);
+  let doc = null;
+  const id = ownId || container + name;
+  if (!ownId) {
+    doc = { ...object, id, attributedTo: urls.actor, published: object.published || published, to: addressed.to, cc: addressed.cc };
+    if (!doc['@context']) doc['@context'] = wire.AS_CTX;
+    if (typeof doc.content === 'string') doc.content = wire.sanitizeHtml(doc.content);
+    await podNotes.write(publisher.remote, id, doc);
+  }
+  if (!priv) await publisher.recordOutbox(id);
+  const row = doc || object;
+  publisher.store.addStatus({
+    noteId: id, actor: urls.actor, content: rowContent(row), published: row.published || published,
+    kind: 'post', slug: name, visibility,
+  });
+  if (await publisher.store.commit?.() === false) publisher.log(`object published but its timeline row was refused: ${id}`);
+
+  // The Create sits beside the object; for an object living elsewhere on the
+  // pod it sits in the notes container, whose ACL is public Read.
+  const createId = doc ? wire.createActivityId(id) : wire.createActivityId(container + name);
+  const create = {
+    '@context': wire.AS_CTX, id: createId, type: 'Create', actor: urls.actor,
+    published: row.published || published, to: addressed.to, cc: addressed.cc,
+    object: doc || id,
+  };
+  await podNotes.writeCreate(publisher.remote, create.id, create);
+  const contacts = publisher.store.getContacts();
+  const inboxes = visibility === 'direct' ? []
+    : [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  await publisher.deliverer.deliverToAll(inboxes, create);
+  publisher.log(`${row.type || 'object'} published: ${id} → ${inboxes.length} inbox(es)`);
+  return { id, createId, copied: !ownId };
+}
+
 export async function updateNote(publisher, s, { content, spoilerText = null, attachments = null } = {}) {
   const { urls } = publisher;
   const updated = new Date().toISOString();

package/lib/core/publisher/questions.mjs

@@ -82,6 +82,7 @@ export async function publishQuestion(publisher, content, { options = [], multip
     ...(spoilerText ? { spoiler: spoilerText } : {}),
     ...(question.tag?.length ? { mentions: question.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
   });
+  if (await publisher.store.commit?.() === false) publisher.log(`poll published but its timeline row was refused: ${question.id}`);
 
   const create = publisher._pollActivity('Create', question, wire.createActivityId(question.id));
   await podNotes.writeCreate(publisher.remote, create.id, create);

package/lib/core/publisher/restore.mjs

@@ -5,6 +5,7 @@
 import * as wire from '../wire.mjs';
 import * as podNotes from '../../pod/notes.mjs';
 import { readLenient } from '../as2.mjs';
+import { rowContent } from './notes.mjs';
 
 const ACCEPT_AP = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
 const REBUILD_MAX_PER_RUN = 200;
@@ -151,13 +152,14 @@ export async function rebuildStatuses(publisher, { fromNotes = false } = {}) {
     if (have.has(id) || removed.has(id)) continue;
     budget--;
     const note = await podNotes.read(publisher.remote, id).catch(() => null);
-    if (note?.type !== 'Note' || note.id !== id || note.attributedTo !== urls.actor) continue;
+    // Any object of ours: a Note, a poll, or whatever a client posted.
+    if (!note?.type || note.id !== id || note.attributedTo !== urls.actor) continue;
     const attachments = wire.attachmentsOf(note);
     const mentions = (Array.isArray(note.tag) ? note.tag : [])
       .filter(t => t?.type === 'Mention' && t.href)
       .map(t => ({ href: t.href, name: t.name }));
     recovered.push({
-      noteId: note.id, actor: urls.actor, content: note.content || '',
+      noteId: note.id, actor: urls.actor, content: rowContent(note),
       published: note.published || null,
       ...(note.inReplyTo ? { inReplyTo: note.inReplyTo } : {}),
       kind: 'post', slug: note.id.slice(urls.notes.length),
@@ -197,3 +199,26 @@ export async function rebuildStatuses(publisher, { fromNotes = false } = {}) {
     dropped: Math.max(0, merged.length - kept.length),
   };
 }
+
+// Own posts the outbox records and the statuses index does not.
+//
+// The index row is the last thing a post writes, and it goes by a debounced
+// PUT: a worker killed or a write refused after the post was answered leaves a
+// post that stands on the pod and reached followers but never shows on its
+// author's own timeline. Run when an agent becomes active. Cheap when nothing
+// is wrong — two cached documents compared, no request — and the capped,
+// merge-only rebuild when something is.
+export async function healStatuses(publisher) {
+  const { urls, store } = publisher;
+  const own = store.read('outbox.json', [])
+    .map(i => (typeof i === 'string' ? i : null))
+    .filter(id => id && id.startsWith(urls.notes));
+  if (!own.length) return { missing: 0, recovered: 0 };
+  const have = new Set(store.getStatuses().map(s => s.noteId));
+  const removed = new Set(store.read('outbox-removed.json', []).map(r => r.id));
+  const missing = own.filter(id => !have.has(id) && !removed.has(id));
+  if (!missing.length) return { missing: 0, recovered: 0 };
+  const r = await rebuildStatuses(publisher);
+  publisher.log(`timeline index healed: ${missing.length} own post(s) were missing, ${r.recovered} recovered`);
+  return { missing: missing.length, recovered: r.recovered };
+}

package/lib/core/social.mjs

@@ -204,6 +204,7 @@ export async function reblog(agent, s) {
   // missing entry, a failed status write would let a retry announce twice.
   const updated = agent.store.updateStatus(s.noteId, { reblogged: true, announceActivity: act });
   await agent.publisher.recordOutbox(act);
+  if (await agent.store.commit?.() === false) agent.log(`boost sent but its timeline row was refused: ${s.noteId}`);
   return updated;
 }
 

package/lib/core/store.mjs

@@ -74,6 +74,7 @@ export function dropFollower(contacts, actor, why) {
 
 export class PodStore {
   constructor({ storage = null, log = console.log } = {}) {
+    this.lastSkipped = [];        // what the last load could not read, as `name (HTTP n)`
     this.storage = storage;
     this.log = log;
     this.cache = new Map();        // name → parsed value
@@ -146,6 +147,9 @@ export class PodStore {
       try { this.cache.set(name, JSON.parse(r.body)); }
       catch (e) { this.log(`state load ${name}: unparsable (${e.message})`); }
     }
+    // Kept for /status: a document skipped here is a timeline or a contact
+    // list quietly missing, and the owner should be able to see that.
+    this.lastSkipped = skipped;
     if (skipped.length) this.log(`state load skipped ${skipped.length}: ${skipped.join(', ')}`);
     this.log(`state loaded: ${this.cache.size} doc(s) from ${this.base} (${fetched} re-fetched)`);
   }

package/lib/core/wire.mjs

@@ -20,7 +20,10 @@ export { webfingerHost } from '../pod/urls.mjs';
 // contains; the browser build states `fedipod/` on its own configs. A config
 // that names a root is always believed — this is only the answer for one that
 // does not.
-export const DEFAULT_ROOT = 'activitypods-js/';
+// Every build writes its data into a `fedipod/` container in the pod. This is
+// the answer for a config that names no root; a config that names one is always
+// believed. (`activitypods-js/` was an earlier name, now abandoned.)
+export const DEFAULT_ROOT = 'fedipod/';
 
 // The handle the fediverse sees: a fronted identity's name is the front's.
 export function publicHandle(config) {
@@ -602,29 +605,33 @@ export function contentHtml(text, mentions = []) {
   return '<p>' + html.replace(/\n+/g, '</p><p>') + '</p>';
 }
 
-export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
-  visibility = 'public', summary = null, updated = null, container = null }) {
-  const id = (container || urls.notes) + slug;
-  const who = mentions.map(m => m.actor);
-  // Mastodon's four shapes. Public and unlisted are world-readable; private
-  // (followers-only) and direct carry no Public address at all and belong in
-  // the owner-only container. Mastodon addresses mentions in cc (to, for a
-  // direct post) and will not notify anyone it does not find there or in the
-  // tags.
-  const addressing = {
+// Mastodon's four shapes. Public and unlisted are world-readable; private
+// (followers-only) and direct carry no Public address at all and belong in
+// the owner-only container. Mastodon addresses mentions in cc (to, for a
+// direct post) and will not notify anyone it does not find there or in the
+// tags.
+export function addressing(urls, visibility, who = []) {
+  return {
     public: { to: [PUBLIC], cc: [urls.followers, ...who] },
     unlisted: { to: [urls.followers], cc: [PUBLIC, ...who] },
     private: { to: [urls.followers], cc: who },
     direct: { to: who, cc: [] },
   }[visibility] || { to: [PUBLIC], cc: [urls.followers, ...who] };
+}
+
+export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
+  visibility = 'public', summary = null, updated = null, container = null }) {
+  const id = (container || urls.notes) + slug;
+  const who = mentions.map(m => m.actor);
+  const addressed = addressing(urls, visibility, who);
   const note = {
     '@context': AS_CTX,
     id, type: 'Note',
     attributedTo: urls.actor,
     content: contentHtml(content, mentions),
     published,
-    to: addressing.to,
-    cc: addressing.cc,
+    to: addressed.to,
+    cc: addressed.cc,
     replies: repliesId(id),
   };
   if (summary) note.summary = summary;      // the content warning

package/lib/device/admin/routes/gateway.mjs

@@ -47,7 +47,7 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
       };
       const podActorId = () => {
         const base = cfg.remotePod.endsWith('/') ? cfg.remotePod : `${cfg.remotePod}/`;
-        const root = cfg.root ? (cfg.root.endsWith('/') ? cfg.root : `${cfg.root}/`) : 'activitypods-js/';
+        const root = cfg.root ? (cfg.root.endsWith('/') ? cfg.root : `${cfg.root}/`) : 'fedipod/';
         return `${base}${root}ap/actor`;
       };
       // The reply first, the restart a beat later — same shape as /update.