FEDERATION.md and CLAUDE.md describe follows, likes, boosts and timelines

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB
A remote delete clears what it touched
2026-10-01 11:40:02 +02:00 · 2026-10-01 11:39:45 +02:00 · 2026-10-01 11:39:10 +02:00 · 2026-10-01 11:37:41 +02:00 · 2026-10-01 11:34:35 +02:00 · 2026-10-01 11:32:33 +02:00
92 changed files with 5572 additions and 714 deletions
@@ -37,26 +37,19 @@ actor-scoped route gets a name in the same spirit, agreed with the owner, and a

 | Thing | Route |
 |---|---|
-| Actor | `/peasants/{name}` (`/users/{name}` 301-redirects here) |
+| Actor | `/peasants/{name}` (`/users/{name}` 301-redirects here; browsers are sent to `/@{name}`) |
 | Inbox | `/peasants/{name}/mouth` |
-| Outbox | `/peasants/{name}/anus` |
+| Outbox | `/peasants/{name}/anus` (`?page=true[&max_id=]` for pages) |
 | Shared inbox | `/human-centipede` (also `/peasants/{name}/human-centipede`) |
+| Followers | `/peasants/{name}/groupies` |
+| Following | `/peasants/{name}/stalking` |
+| Notes | `/peasants/{name}/scribbles/{id}` |
+| Activities | `/peasants/{name}/grunts/{id}` (`create-{postId}` resolves) |
+| DM context | `/peasants/{name}/whispers/{id}` |
 | Token refresh | `/clientapi/user/sniff/again` |

-These are agreed for the roadmap and replace the conventional names still in the code today:
-
-| Thing | Route | Replaces |
-|---|---|---|
-| Followers | `/groupies` | `/followers` |
-| Following | `/stalking` | `/following` |
-| Notes | `/scribbles/{id}` | `/posts/{id}` |
-| Activities | `/grunts/{id}` | `/activities/{id}` |
-| Replies, likes, shares | `/gossip`, `/drool`, `/echoes` | |
-| Featured | `/trophies` | |
-| Featured tags | `/tattoos` | |
-| Group members | `/flock` | |
-| Group moderators | `/wardens` | |
-| DM context | `/whispers/{id}` | |
+Agreed for later phases: `/gossip`, `/drool`, `/echoes` (replies, likes, shares), `/trophies` (featured), `/tattoos`
+(featured tags), `/flock` and `/wardens` (group members and moderators).

 Routes other software looks up by name stay conventional:
 - `/.well-known/*` and `/nodeinfo/*`;
@@ -75,6 +68,8 @@ PrivaPub/                         ASP.NET Core Web API, net10.0
                                  Group, Post (posts + DMs), Admin, Data
  Infrastructure/
    Http/                         FederationHttp + SafeHttpHandlerFactory + IpRangeGuard: the only way out
+    Jobs/                         JobQueue (leases), JobWorker, Backoff, HostCircuitBreaker
+    Ids/                          PrivacyIds (day-only ids for personas and groups, published-time ids for remote posts)
    Data/                         Indexes (created at start), EntityMaps.Warm, Migrations/_NNN_*.cs
    Cli/                          AdminCommands (`PrivaPub admin promote|demote <root>`)
    RateLimiting.cs               accounts (per client address) and inbox (per sending origin) policies
@@ -83,13 +78,21 @@ PrivaPub/                         ASP.NET Core Web API, net10.0
                                  WellKnownController (webfinger, nodeinfo), UsersController (redirect)
    Actors/                       LocalActorService (LocalActor, Keys, ReservedName), RemoteActorService
                                  (authoritative fetch, key verification, WebFinger), ActorDocument (parser)
-    Objects/                      Origin (same-origin rules), ContentSanitizer (HtmlSanitizer, Mastodon allowlist)
+    Objects/                      Origin, ActivityJson, NoteParser, Addressing, ContentSanitizer
+    Moderation/                   DomainBlocks (suspend / silence / reject media)
    Signing/                      HttpSignatures (draft-cavage sign/verify)
-    Inbox/                        InboxService (Follow/Undo/Create/Delete/Update)
-    Outbox/                       DeliveryService + DeliveryWorker
-    Rendering/                    ActivityPubRenderer (JsonObject builders)
+    Inbox/                        InboxReceiver (verify, queue, 202) → InboxProcessor (job) → Handlers/{Follow,Accept,Reject,
+                                  Undo,Create,Update,Delete,Like,Announce}; RemotePosts (build, fetch parents, FetchAncestors)
+    Outbox/                       OutboxPublisher (who a post goes to), DeliveryService (queues jobs) + DeliveryJobHandler
+    Rendering/                    ActivityPubRenderer (Mastodon @context, actors, notes, collections)
+  Domain/
+    Content/                      ContentRenderer (Markdown or plain text → HTML with h-card mentions and hashtags)
+    Social/                       FollowService (local in-process, remote Follow/Accept), Notifications
+    Timelines/                    Fanout (TimelineEntry rows, Mastodon's home rules), TimelineService
+    Privacy/                      VisibilityPolicy (IsPublic expression, CanSee)
+  Web/Pages/                      Razor: /@{user}, /@{user}/{id} (public posts only, strict CSP, noindex)
  Services/                       RootUsersService, GroupUsersService, PostsService, AppConfigurationService, …
-  Models/                         Mongo entities: User/, Group/, Post/, Federation/, AppConfiguration
+  Models/                         Mongo entities: User/, Group/, Post/, Federation/, Jobs/, AppConfiguration
  StaticServices/                 DbEntities (Find<T> accessors), AuthTokenManager (JWT), PasswordHasher
  Data/InitDb.cs                  first-run seeding (languages)
 PrivaPub.ClientModels/            DTOs + validation resources shared with clients
@@ -157,8 +160,16 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
 8. **Circles never federate.** A circle's actor, collections, WebFinger and inbox answer 404, and its posts are
   `IsLocalOnly`. Only communities are Group actors.
 9. **A DM joins a conversation only by `DmGroup.ParticipantsKey`**, the exact set of its participants; a remote
-   `context` decides nothing.
-10. **Durable delivery:** activities go out through the delivery queue, never inline in a request.
+   `context` decides nothing. DMs are `Post`s with `Visibility = Direct` and a `ConversationId` (`DmPost` is legacy).
+10. **Nothing slow happens inside a request.** Deliveries and inbox processing are `Job`s (`Infrastructure/Jobs`):
+    leased, retried on Mastodon's curve, at most two per host, paused per host by `RemoteInstance`. The inbox answers
+    202 once it has verified and queued; a handler must be idempotent (unique `ObjectURI`, job `DedupeKey`).
+11. **Every "may anyone see this" goes through `VisibilityPolicy.IsPublic`;** a persona-specific read uses `CanSee`.
+12. **Remote content is stored only when someone here asked for it:** a persona follows the author, is addressed or
+    mentioned, it replies to a local post, or it is addressed to a community the author follows; a public parent is
+    fetched as context. Followers-only is detected by the author's stored `followers` URL.
+13. **Home timelines are written, not computed:** every stored or created post goes through `Fanout.Distribute`, and
+    every delete removes its `TimelineEntry` rows. Local deletes are soft (content cleared, 410 Tombstone).

 ## Privacy invariants

@@ -0,0 +1,100 @@
+# Federation
+
+PrivaPub is an ActivityPub server written in C#. This document follows
+[FEP-67ff](https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md) and describes how it federates.
+
+## Supported federation protocols and standards
+
+- [ActivityPub](https://www.w3.org/TR/activitypub/) (server-to-server)
+- [WebFinger](https://webfinger.net/)
+- [HTTP Signatures](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures), `rsa-sha256` / `hs2019` with RSA keys
+- [NodeInfo](https://nodeinfo.diaspora.software/) 2.0 and 2.1
+
+## Supported FEPs
+
+- [FEP-67ff: FEDERATION.md](https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md)
+- [FEP-f1d5: NodeInfo in Fediverse Software](https://codeberg.org/fediverse/fep/src/branch/main/fep/f1d5/fep-f1d5.md)
+- [FEP-2c59: Discovery of a WebFinger address from an ActivityPub actor](https://codeberg.org/fediverse/fep/src/branch/main/fep/2c59/fep-2c59.md)
+
+Planned: FEP-1b12 (communities), FEP-8fcf (followers synchronisation), FEP-5feb (`indexable`), FEP-7628 (Move),
+FEP-044f (quotes).
+
+## Actors
+
+Every account is an *avatar*: one private login can own several, and they are deliberately unlinkable. Nothing in an
+actor document, a collection, NodeInfo or a delivery relates two avatars of the same login.
+
+| Thing | Address |
+|---|---|
+| Actor (Person, Group, Application) | `/peasants/{name}` (`/users/{name}` redirects) |
+| Inbox | `/peasants/{name}/mouth` |
+| Outbox | `/peasants/{name}/anus` |
+| Shared inbox | `/human-centipede` |
+| Followers / following | `/peasants/{name}/groupies`, `/peasants/{name}/stalking` |
+| Objects | `/peasants/{name}/scribbles/{id}` |
+| Activities | `/peasants/{name}/grunts/{id}` |
+| Direct-message context | `/peasants/{name}/whispers/{id}` |
+| Profile and post pages | `/@{name}`, `/@{name}/{id}` |
+
+The names are the project's own and are stable; resolve actors through WebFinger, not by guessing a path.
+
+- The key is `{actor}#main-key`, RSA 2048, served as SPKI PEM with `owner` set to the actor.
+- `published` on an actor is truncated to the day. `indexable` is `false`.
+- The instance actor is `/peasants/privapub` (type `Application`). It signs every fetch PrivaPub makes, so no avatar's key
+  is used to read another server's content.
+
+## Groups
+
+A group is either a **community** or a **circle**.
+
+- A community is a `Group` actor. It accepts `Follow` and re-shares (`Announce`) posts from its followers that address
+  it. Full FEP-1b12 behaviour (announcing activities, `audience`, moderation) is planned.
+- A circle is private and does not federate yet: its actor, collections and WebFinger answer 404, and its posts are never
+  delivered.
+
+## Activities
+
+Received:
+
+| Activity | Effect |
+|---|---|
+| `Follow` | follows an avatar or community; `Accept` is sent unless the community approves members by hand |
+| `Accept{Follow}`, `Reject{Follow}` | completes or ends a follow an avatar requested |
+| `Undo{Follow, Like, Announce}` | reverses it |
+| `Create{Note, Article, Page, Question, …}` | stored when a local avatar follows the author, is addressed or mentioned, when it replies to a local post, or when it is addressed to a community the author follows; a public parent is fetched to complete the thread |
+| `Update{Note}` | replaces the content; the previous version is kept |
+| `Update{Person}` | refetches the actor |
+| `Like` | counted and notified, on posts the liker could see |
+| `Announce` | counted and notified for local posts; shown to followers of the announcer, with the original refetched from its origin |
+| `Delete` | deletes the object, or the actor and its follows |
+
+Sent: `Follow`, `Undo{Follow}`, `Create{Note}`, `Update{Note}`, `Update{Person}`, `Delete{Tombstone}`, `Accept{Follow}`,
+`Announce` (communities). A deleted post answers 410 with a `Tombstone`.
+
+A `Create`'s `Note` carries Mastodon's `content`, `contentMap`, `summary` and `sensitive`, plus `Mention` and `Hashtag`
+tags. A post's title becomes `name` and is also the first, bold line of `content`, because Mastodon does not show
+`name`. A content warning without its own text uses the title, or "Content warning".
+
+Visibility is expressed in `to`/`cc` the way Mastodon does it: public, unlisted, followers-only and direct. Inbound
+followers-only posts are recognised by the author's own `followers` collection.
+
+## Security rules a peer will notice
+
+- **Signatures.** Inbox POSTs must be signed over `(request-target)`, `host`, `digest` and `date` (or `(created)`). The
+  date may be at most one hour old and fifteen minutes ahead. A bad signature gets 401, malformed input 400, an accepted
+  activity 202, too many requests 429. Activities are processed after the 202.
+- **Origins.** An actor document is accepted only from the address it names as its `id`. A key only if its actor lists
+  it with `owner` set to the actor and on the actor's origin. An activity's `id`, and any object it creates, updates or
+  deletes, must be on its actor's origin. An embedded object from another origin is fetched from that origin.
+- **Fetching.** All fetches are signed by the instance actor. They go only to public addresses, follow at most three
+  redirects and read at most 1 MB.
+- **HTML.** Received HTML is sanitised to Mastodon's allowlist.
+- **Delivery.** Failed deliveries are retried with Mastodon's backoff (16 attempts). A host that keeps failing is paused,
+  starting at an hour and growing to a week.
+
+## Known limitations
+
+- Avatars cannot send likes or boosts yet (that arrives with the Mastodon client API), and media uploads and polls are not
+  implemented.
+- Collections expose counts, not members.
+- Only `rsa-sha256`-style keys are verified. RFC 9421 signatures are planned.
@@ -0,0 +1,33 @@
+using PrivaPub.ClientModels.Resources;
+
+using System.ComponentModel.DataAnnotations;
+
+namespace PrivaPub.ClientModels.Admin
+{
+	public class DomainBlockForm
+	{
+		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
+			StringLength(253, MinimumLength = 3, ErrorMessageResourceName = "StringLengthMinMax", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string Domain { get; set; }
+
+		public bool Suspend { get; set; } = true;
+		public bool RejectMedia { get; set; }
+
+		[StringLength(1000, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string PublicComment { get; set; }
+
+		[StringLength(1000, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string PrivateComment { get; set; }
+	}
+
+	public class ViewDomainBlock
+	{
+		public string Id { get; set; }
+		public string Domain { get; set; }
+		public string Severity { get; set; }
+		public bool RejectMedia { get; set; }
+		public string PublicComment { get; set; }
+		public string PrivateComment { get; set; }
+		public DateTime CreatedAt { get; set; }
+	}
+}
@@ -19,6 +19,32 @@ namespace PrivaPub.ClientModels.Post
 		public string GroupId { get; set; }
 		public string AnsweringToPostId { get; set; }
 		public bool HasContentWarning { get; set; }
+
+		[StringLength(500, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string SpoilerText { get; set; }
+
+		public string Visibility { get; set; }//public (default), unlisted, followersonly
+	}
+
+	public class UpdatePostForm
+	{
+		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string AvatarId { get; set; }
+
+		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string PostId { get; set; }
+
+		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
+			StringLength(5000, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string Text { get; set; }
+
+		[StringLength(200, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string Title { get; set; }
+
+		public bool HasContentWarning { get; set; }
+
+		[StringLength(500, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string SpoilerText { get; set; }
 	}

 	public class InsertDmForm
@@ -8,6 +8,7 @@ namespace PrivaPub.ClientModels.Post
 		public string AuthorActorURI { get; set; }
 		public string GroupId { get; set; }
 		public string DmGroupId { get; set; }
+		public string Visibility { get; set; }
 		public string AnsweringToPostId { get; set; }
 		public string Title { get; set; }
 		public string Text { get; set; }
@@ -15,6 +16,7 @@ namespace PrivaPub.ClientModels.Post
 		public bool HasContentWarning { get; set; }
 		public bool IsFederatedCopy { get; set; }
 		public DateTime CreationDate { get; set; }
+		public ViewPost ReblogOf { get; set; }
 	}

 	public class ViewDmGroup
@@ -0,0 +1,37 @@
+using PrivaPub.ClientModels.Resources;
+
+using System.ComponentModel.DataAnnotations;
+
+namespace PrivaPub.ClientModels.Social
+{
+	public class FollowForm
+	{
+		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string AvatarId { get; set; }
+
+		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
+			StringLength(2048, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string Target { get; set; }//user@host, @user, or an actor URI
+	}
+
+	public class ViewFollowing
+	{
+		public string Id { get; set; }
+		public string TargetActorURI { get; set; }
+		public string TargetAccountId { get; set; }
+		public bool TargetIsLocal { get; set; }
+		public string State { get; set; }
+		public DateTime CreatedAt { get; set; }
+	}
+
+	public class ViewNotification
+	{
+		public string Id { get; set; }
+		public string Type { get; set; }
+		public string FromAccountId { get; set; }
+		public string FromActorURI { get; set; }
+		public string PostId { get; set; }
+		public bool IsRead { get; set; }
+		public DateTime CreatedAt { get; set; }
+	}
+}
@@ -0,0 +1,91 @@
+using PrivaPub.Domain.Content;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.User;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Tests.Domain
+{
+	public class ContentRendererTests
+	{
+		const string Base = "https://privapub.test";
+		readonly ContentRenderer _renderer = new(new StubLocalActors(), new StubRemoteActors());
+
+		[Fact]
+		public async Task Decorates_local_and_remote_mentions_and_hashtags()
+		{
+			var rendered = await _renderer.Markdown("hello @alice and @bob@m.example about #Fedi **now** <script>x</script>", TestContext.Current.CancellationToken);
+
+			Assert.Contains("<span class=\"h-card\" translate=\"no\"><a href=\"https://privapub.test/peasants/alice\" class=\"u-url mention\"", rendered.Html);
+			Assert.Contains("href=\"https://m.example/@bob\"", rendered.Html);
+			Assert.Contains("href=\"https://privapub.test/tags/fedi\" class=\"mention hashtag\"", rendered.Html);
+			Assert.Contains("<strong>now</strong>", rendered.Html);
+			Assert.DoesNotContain("<script>", rendered.Html);
+			Assert.Equal(new[] { "https://m.example/users/bob", "https://privapub.test/peasants/alice" }, rendered.Mentions.Select(m => m.ActorUri).Order(StringComparer.Ordinal));
+			Assert.Equal("fedi", Assert.Single(rendered.Tags));
+		}
+
+		[Theory]
+		[InlineData("`@alice` in code")]
+		[InlineData("mail me@alice.example")]
+		[InlineData("@nobody is unknown")]
+		[InlineData("see https://x.example/page#alice")]
+		public async Task Leaves_what_is_not_a_mention_alone(string text)
+		{
+			var rendered = await _renderer.Markdown(text, TestContext.Current.CancellationToken);
+
+			Assert.Empty(rendered.Mentions);
+			Assert.DoesNotContain("h-card", rendered.Html);
+		}
+
+		[Theory]
+		[InlineData("issue #123")]
+		[InlineData("it&#39;s fine")]
+		[InlineData("[link](https://x.example/#tag)")]
+		public async Task Leaves_what_is_not_a_hashtag_alone(string text) =>
+			Assert.Empty((await _renderer.Markdown(text, TestContext.Current.CancellationToken)).Tags);
+
+		[Fact]
+		public async Task Renders_plain_text_like_mastodon()
+		{
+			var rendered = await _renderer.PlainText("line one\nline <two>\n\nsee https://x.example/a?b=1. #Tag", TestContext.Current.CancellationToken);
+
+			Assert.Equal("<p>line one<br>line &lt;two&gt;</p><p>see <a href=\"https://x.example/a?b=1\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https://x.example/a?b=1</a>. "
+				+ "<a href=\"https://privapub.test/tags/tag\" class=\"mention hashtag\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">#<span>Tag</span></a></p>", rendered.Html);
+		}
+
+		sealed class StubLocalActors : ILocalActorService
+		{
+			public string BaseAddress => Base;
+
+			public Task<LocalActor> FindByUserName(string userName, CancellationToken token) =>
+				Task.FromResult(userName.Equals("alice", StringComparison.OrdinalIgnoreCase)
+					? new LocalActor { Id = "a1", UserName = "alice", BaseAddress = Base, Kind = LocalActorKind.Person }
+					: default);
+
+			public Task<LocalActor> FindById(LocalActorKind kind, string id, CancellationToken token) => throw new NotSupportedException();
+			public Task<LocalActor> FindByUri(string actorUri, CancellationToken token) => throw new NotSupportedException();
+			public Task<LocalActor> GetInstanceActor(CancellationToken token) => throw new NotSupportedException();
+			public Task<bool> IsUserNameTaken(string userName, CancellationToken token) => throw new NotSupportedException();
+			public Task<bool> TryReserveUserName(string userName, LocalActorKind kind, string ownerId, CancellationToken token) => throw new NotSupportedException();
+			public LocalActor FromAvatar(Avatar avatar) => throw new NotSupportedException();
+			public LocalActor FromGroup(GroupEntity group) => throw new NotSupportedException();
+		}
+
+		sealed class StubRemoteActors : IRemoteActorService
+		{
+			public Task<string> ResolveHandle(string handle, CancellationToken token) =>
+				Task.FromResult(handle == "bob@m.example" ? "https://m.example/users/bob" : default);
+
+			public Task<ForeignAvatar> GetActor(string actorUri, bool refresh, CancellationToken token) =>
+				Task.FromResult(actorUri == "https://m.example/users/bob"
+					? new ForeignAvatar { ID = "f1", ActorURI = actorUri, UserName = "bob", Url = "https://m.example/@bob", InboxURL = actorUri + "/inbox" }
+					: default);
+
+			public Task<FetchedJson> FetchObject(string uri, CancellationToken token) => throw new NotSupportedException();
+			public Task<ForeignAvatar> GetActorByKeyId(string keyId, bool refresh, CancellationToken token) => throw new NotSupportedException();
+		}
+	}
+}
@@ -0,0 +1,124 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Domain
+{
+	[Trait("Category", "Integration")]
+	public sealed class FollowTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task A_local_follow_is_accepted_at_once_and_notified()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var (_, bob) = await _harness.Persona("bob");
+
+			var result = await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = "@" + bob.UserName }, token);
+
+			Assert.True(result.IsValid);
+			var following = await DB.Default.Find<Following>().Match(f => f.AvatarId == alice.Id).ExecuteSingleAsync(token);
+			Assert.Equal(FollowState.Accepted, following.State);
+			Assert.True(following.TargetIsLocal);
+			Assert.True((await DB.Default.Find<Follower>().Match(f => f.LocalActorId == bob.Id && f.ActorURI == alice.Uri).ExecuteSingleAsync(token)).IsAccepted);
+			Assert.Equal(NotificationType.Follow, (await DB.Default.Find<Notification>().Match(n => n.AvatarId == bob.Id).ExecuteSingleAsync(token)).Type);
+			Assert.Empty(await _harness.Outgoing(bob.Inbox));
+		}
+
+		[Fact]
+		public async Task Someone_elses_persona_cannot_be_made_to_follow()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var (_, bob) = await _harness.Persona("bob");
+
+			var result = await _harness.Follows.Follow("someone-else", new FollowForm { AvatarId = alice.Id, Target = bob.UserName }, TestContext.Current.CancellationToken);
+
+			Assert.False(result.IsValid);
+			Assert.Equal(404, result.StatusCode);
+		}
+
+		[Fact]
+		public async Task A_remote_follow_is_requested_then_accepted()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = carol.Id }, token);
+
+			var following = await DB.Default.Find<Following>().Match(f => f.AvatarId == alice.Id).ExecuteSingleAsync(token);
+			Assert.Equal(FollowState.Requested, following.State);
+			var follow = Assert.Single(await _harness.Outgoing(carol.Id + "/inbox"));
+			Assert.Equal("Follow", follow["type"]!.GetValue<string>());
+			Assert.Equal(alice.Uri, follow["actor"]!.GetValue<string>());
+			Assert.StartsWith(alice.Uri + "/grunts/follow-", follow["id"]!.GetValue<string>());
+
+			var accept = new JsonObject
+			{
+				["id"] = $"{carol.Id}#accepts/{Guid.NewGuid():N}",
+				["type"] = "Accept",
+				["actor"] = carol.Id,
+				["object"] = follow.DeepClone()
+			};
+			Assert.Equal(202, (await _harness.Deliver(carol, $"/peasants/{alice.UserName}/mouth", accept)).StatusCode);
+			Assert.Equal(FollowState.Accepted, (await DB.Default.Find<Following>().OneAsync(following.ID, token)).State);
+		}
+
+		[Fact]
+		public async Task An_accept_from_someone_else_changes_nothing_and_a_reject_ends_the_request()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = carol.Id }, token);
+			var following = await DB.Default.Find<Following>().Match(f => f.AvatarId == alice.Id).ExecuteSingleAsync(token);
+
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{mallory.Id}#accepts/{Guid.NewGuid():N}", ["type"] = "Accept", ["actor"] = mallory.Id, ["object"] = following.FollowActivityURI
+			});
+			Assert.Equal(FollowState.Requested, (await DB.Default.Find<Following>().OneAsync(following.ID, token)).State);
+
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{carol.Id}#rejects/{Guid.NewGuid():N}", ["type"] = "Reject", ["actor"] = carol.Id, ["object"] = following.FollowActivityURI
+			});
+			Assert.Null(await DB.Default.Find<Following>().OneAsync(following.ID, token));
+		}
+
+		[Fact]
+		public async Task Unfollowing_a_remote_account_sends_an_undo()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = carol.Id }, token);
+
+			await _harness.Follows.Unfollow(root, new FollowForm { AvatarId = alice.Id, Target = carol.Id }, token);
+
+			Assert.False(await DB.Default.Find<Following>().Match(f => f.AvatarId == alice.Id).ExecuteAnyAsync(token));
+			var undo = (await _harness.Outgoing(carol.Id + "/inbox")).Single(a => a["type"]!.GetValue<string>() == "Undo");
+			Assert.Equal("Follow", undo["object"]!["type"]!.GetValue<string>());
+		}
+	}
+}
@@ -0,0 +1,92 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.ClientModels;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+
+namespace PrivaPub.Tests.Domain
+{
+	[Trait("Category", "Integration")]
+	public sealed class OutboxTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		async Task<ForeignAvatar> Known(RemoteActor actor) =>
+			await _harness.Remote.GetActor(actor.Id, refresh: false, TestContext.Current.CancellationToken);
+
+		[Fact]
+		public async Task The_audience_follows_mastodons_table()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var follower = new RemoteActor(_harness.Peer, "follower");
+			var mentioned = await Known(new RemoteActor(_harness.Peer, "mentioned"));
+			var parentAuthor = await Known(new RemoteActor(_harness.Peer, "parent"));
+			await _harness.FollowedBy(alice, follower);
+			var mention = new PostMention { ActorURI = mentioned.ActorURI };
+
+			async Task<IReadOnlyList<string>> Audience(PostVisibility visibility, string replyTo = default) =>
+				await _harness.Outbox.Audience(alice, new Post { Visibility = visibility, Mentions = new() { mention }, To = new() { mentioned.ActorURI }, InReplyToAccountId = replyTo }, token);
+
+			Assert.Equal(new[] { follower.SharedInbox, mentioned.InboxURL }, await Audience(PostVisibility.Public));
+			Assert.Equal(new[] { follower.SharedInbox, mentioned.InboxURL, parentAuthor.InboxURL }, await Audience(PostVisibility.Unlisted, parentAuthor.ID));
+			Assert.Equal(new[] { follower.SharedInbox, mentioned.InboxURL }, await Audience(PostVisibility.FollowersOnly));
+			Assert.Equal(new[] { mentioned.InboxURL }, await Audience(PostVisibility.Direct, parentAuthor.ID));
+			Assert.Empty(await Audience(PostVisibility.Circle));
+		}
+
+		[Fact]
+		public async Task A_post_is_created_edited_and_deleted_for_its_audience()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var follower = new RemoteActor(_harness.Peer, "follower");
+			await _harness.FollowedBy(alice, follower);
+
+			var created = await _harness.Posts.InsertPost(root, new InsertPostForm { AvatarId = alice.Id, Text = "first", Visibility = "followersonly" }, token);
+			var postId = ((ViewPost)created.Data).Id;
+			await _harness.Posts.UpdatePost(root, new UpdatePostForm { AvatarId = alice.Id, PostId = postId, Text = "second", SpoilerText = "cw" }, token);
+			await _harness.Posts.DeletePost(root, new DeletePostForm { AvatarId = alice.Id, PostId = postId }, token);
+
+			var sent = await _harness.Outgoing(follower.SharedInbox);
+			Assert.Equal(new[] { "Create", "Update", "Delete" }, sent.Select(a => a["type"]!.GetValue<string>()));
+			Assert.DoesNotContain(sent[0]["to"]!.AsArray(), n => n!.GetValue<string>().EndsWith("#Public"));
+			Assert.Equal("cw", sent[1]["object"]!["summary"]!.GetValue<string>());
+			Assert.NotNull(sent[1]["object"]!["updated"]);
+			Assert.Equal(sent[0]["to"]!.ToJsonString(), sent[2]["to"]!.ToJsonString());
+
+			var stored = await DB.Default.Find<Post>().OneAsync(postId, token);
+			Assert.NotNull(stored.DeletedAt);
+			Assert.Null(stored.ContentHtml);
+			Assert.Empty(stored.Revisions);
+		}
+
+		[Fact]
+		public async Task Someone_elses_post_cannot_be_edited()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var (otherRoot, bob) = await _harness.Persona("bob");
+			var created = await _harness.Posts.InsertPost(root, new InsertPostForm { AvatarId = alice.Id, Text = "mine" }, token);
+
+			var result = await _harness.Posts.UpdatePost(otherRoot, new UpdatePostForm { AvatarId = bob.Id, PostId = ((ViewPost)created.Data).Id, Text = "yours" }, token);
+
+			Assert.False(result.IsValid);
+			Assert.Equal(404, result.StatusCode);
+		}
+	}
+}
@@ -0,0 +1,162 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Domain
+{
+	[Trait("Category", "Integration")]
+	public sealed class TimelineTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		async Task<List<ViewPost>> Home(string root, string avatarId) =>
+			(List<ViewPost>)(await _harness.Timelines.Home(root, avatarId, default, 40, TestContext.Current.CancellationToken)).Data;
+
+		async Task Accepted(string root, string avatarId, RemoteActor target)
+		{
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = avatarId, Target = target.Id }, TestContext.Current.CancellationToken);
+			await DB.Default.Update<Following>().Match(f => f.AvatarId == avatarId && f.TargetActorURI == target.Id)
+				.Modify(f => f.State, FollowState.Accepted).ExecuteAsync(TestContext.Current.CancellationToken);
+		}
+
+		static JsonObject Create(RemoteActor author, string inReplyTo = default, string text = "hello", params (string Uri, string Name)[] mentions)
+		{
+			var origin = new Uri(author.Id).GetLeftPart(UriPartial.Authority);
+			var note = new JsonObject
+			{
+				["id"] = $"{origin}/notes/{Guid.NewGuid():N}",
+				["type"] = "Note",
+				["attributedTo"] = author.Id,
+				["content"] = $"<p>{text}</p>",
+				["to"] = new JsonArray(Addressing.Public),
+				["cc"] = new JsonArray(mentions.Select(m => (JsonNode)m.Uri).Prepend(author.Id + "/followers").ToArray()),
+				["tag"] = new JsonArray(mentions.Select(m => (JsonNode)new JsonObject { ["type"] = "Mention", ["href"] = m.Uri, ["name"] = m.Name }).ToArray())
+			};
+			if (inReplyTo != default)
+				note["inReplyTo"] = inReplyTo;
+			return new JsonObject { ["id"] = $"{origin}/activities/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = author.Id, ["object"] = note };
+		}
+
+		[Fact]
+		public async Task A_local_post_reaches_the_author_and_local_followers_only()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (aliceRoot, alice) = await _harness.Persona("alice");
+			var (bobRoot, bob) = await _harness.Persona("bob");
+			var (carolRoot, carol) = await _harness.Persona("carol");
+			await _harness.Follows.Follow(bobRoot, new FollowForm { AvatarId = bob.Id, Target = alice.UserName }, token);
+
+			await _harness.Posts.InsertPost(aliceRoot, new InsertPostForm { AvatarId = alice.Id, Text = "for my followers" }, token);
+
+			Assert.Single(await Home(aliceRoot, alice.Id));
+			Assert.Equal("<p>for my followers</p>", Assert.Single(await Home(bobRoot, bob.Id)).ContentHtml);
+			Assert.Empty(await Home(carolRoot, carol.Id));
+			Assert.Equal(404, (await _harness.Timelines.Home(carolRoot, bob.Id, default, 20, token)).StatusCode);
+		}
+
+		[Fact]
+		public async Task A_followed_remote_account_is_kept_and_its_replies_follow_mastodons_rule()
+		{
+			var (bobRoot, bob) = await _harness.Persona("bob");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			var dave = new RemoteActor(_harness.Peer, "dave");
+			await Accepted(bobRoot, bob.Id, carol);
+
+			var top = Create(carol, text: "top");
+			await _harness.Deliver(carol, "/human-centipede", top);
+			await _harness.Deliver(carol, "/human-centipede", Create(carol, top["object"]!["id"]!.GetValue<string>(), "self reply"));
+			await _harness.Deliver(dave, "/human-centipede", Create(dave, text: "dave alone"));
+			var daveRoot = Create(dave, text: "unfollowed root");
+			await _harness.Deliver(carol, "/human-centipede", Create(carol, $"{new Uri(dave.Id).GetLeftPart(UriPartial.Authority)}/notes/unknown", "reply to a stranger"));
+
+			var home = (await Home(bobRoot, bob.Id)).Select(p => p.ContentHtml).ToList();
+			Assert.Contains("<p>top</p>", home);
+			Assert.Contains("<p>self reply</p>", home);
+			Assert.DoesNotContain("<p>dave alone</p>", home);
+			Assert.DoesNotContain("<p>reply to a stranger</p>", home);
+		}
+
+		[Fact]
+		public async Task A_reply_brings_its_public_parent_and_the_grandparent_is_queued()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (bobRoot, bob) = await _harness.Persona("bob");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			var dave = new RemoteActor(_harness.Peer, "dave");
+			await Accepted(bobRoot, bob.Id, carol);
+			var origin = new Uri(dave.Id).GetLeftPart(UriPartial.Authority);
+			var grandparentId = $"{origin}/notes/{Guid.NewGuid():N}";
+			var parentId = $"{origin}/notes/{Guid.NewGuid():N}";
+			_harness.Peer.Serve(new Uri(parentId).AbsolutePath, new JsonObject
+			{
+				["id"] = parentId, ["type"] = "Note", ["attributedTo"] = dave.Id, ["content"] = "<p>parent</p>",
+				["to"] = new JsonArray(Addressing.Public), ["inReplyTo"] = grandparentId
+			}.ToJsonString());
+
+			await _harness.Deliver(carol, "/human-centipede", Create(carol, parentId, "reply to dave"));
+
+			var parent = await DB.Default.Find<PrivaPub.Models.Post.Post>().Match(p => p.ObjectURI == parentId).ExecuteSingleAsync(token);
+			var reply = await DB.Default.Find<PrivaPub.Models.Post.Post>().Match(p => p.InReplyToURI == parentId).ExecuteSingleAsync(token);
+			Assert.Equal(parent.ID, reply.AnsweringToPostId);
+			Assert.Equal(parent.AuthorAccountId, reply.InReplyToAccountId);
+			Assert.True(await DB.Default.Find<PrivaPub.Models.Jobs.Job>().Match(j => j.DedupeKey == "ancestors|" + parent.ID).ExecuteAnyAsync(token));
+			Assert.DoesNotContain("<p>reply to dave</p>", (await Home(bobRoot, bob.Id)).Select(p => p.ContentHtml));
+			Assert.DoesNotContain("<p>parent</p>", (await Home(bobRoot, bob.Id)).Select(p => p.ContentHtml));
+		}
+
+		[Fact]
+		public async Task A_remote_delete_takes_the_post_out_of_home()
+		{
+			var (bobRoot, bob) = await _harness.Persona("bob");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			await Accepted(bobRoot, bob.Id, carol);
+			var create = Create(carol, text: "soon gone");
+			await _harness.Deliver(carol, "/human-centipede", create);
+			Assert.Single(await Home(bobRoot, bob.Id));
+
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{new Uri(carol.Id).GetLeftPart(UriPartial.Authority)}/deletes/{Guid.NewGuid():N}", ["type"] = "Delete", ["actor"] = carol.Id,
+				["object"] = new JsonObject { ["id"] = create["object"]!["id"]!.GetValue<string>(), ["type"] = "Tombstone" }
+			});
+
+			Assert.Empty(await Home(bobRoot, bob.Id));
+			Assert.False(await DB.Default.Find<TimelineEntry>().Match(e => e.AvatarId == bob.Id).ExecuteAnyAsync(TestContext.Current.CancellationToken));
+		}
+
+		[Fact]
+		public async Task A_mention_notifies_the_persona()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (bobRoot, bob) = await _harness.Persona("bob");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+
+			await _harness.Deliver(carol, "/human-centipede", Create(carol, mentions: (bob.Uri, "@" + bob.Handle)));
+
+			var notifications = (List<ViewNotification>)(await _harness.Timelines.Notifications(bobRoot, bob.Id, default, 20, token)).Data;
+			var mention = Assert.Single(notifications);
+			Assert.Equal("Mention", mention.Type);
+			Assert.Equal(carol.Id, mention.FromActorURI);
+			await _harness.Timelines.MarkNotificationsRead(bobRoot, bob.Id, token);
+			Assert.True(((List<ViewNotification>)(await _harness.Timelines.Notifications(bobRoot, bob.Id, default, 20, token)).Data).Single().IsRead);
+		}
+	}
+}
@@ -0,0 +1,42 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Tests.Domain
+{
+	[Trait("Category", "Integration")]
+	public class VisibilityPolicyTests
+	{
+		[Fact]
+		public async Task Who_sees_what()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			var token = TestContext.Current.CancellationToken;
+			var conversation = new DmGroup { Members = new() { new GroupMember { AvatarId = "alice" }, new GroupMember { AvatarId = "https://r.example/u/bob", IsForeign = true } } };
+			var circle = new GroupEntity { UserName = $"c{Guid.NewGuid():N}"[..20], Members = new() { new GroupMember { AvatarId = "carol" } } };
+			await DB.Default.SaveAsync(conversation, token);
+			await DB.Default.SaveAsync(circle, token);
+
+			var direct = new Post { Visibility = PostVisibility.Direct, ConversationId = conversation.ID, GroupUserId = "dave" };
+			var circlePost = new Post { Visibility = PostVisibility.Circle, GroupId = circle.ID };
+			var followersOnly = new Post { Visibility = PostVisibility.FollowersOnly, Mentions = new() { new PostMention { IsLocal = true, AccountId = "erin" } } };
+			var deleted = new Post { Visibility = PostVisibility.Public, DeletedAt = DateTime.UtcNow };
+
+			Assert.True(await VisibilityPolicy.CanSee(new Post(), default, token));
+			Assert.True(await VisibilityPolicy.CanSee(direct, "alice", token));
+			Assert.True(await VisibilityPolicy.CanSee(direct, "dave", token));
+			Assert.False(await VisibilityPolicy.CanSee(direct, "carol", token));
+			Assert.False(await VisibilityPolicy.CanSee(direct, default, token));
+			Assert.True(await VisibilityPolicy.CanSee(circlePost, "carol", token));
+			Assert.False(await VisibilityPolicy.CanSee(circlePost, "alice", token));
+			Assert.True(await VisibilityPolicy.CanSee(followersOnly, "erin", token));
+			Assert.False(await VisibilityPolicy.CanSee(followersOnly, "alice", token));
+			Assert.False(await VisibilityPolicy.CanSee(deleted, "alice", token));
+		}
+	}
+}
@@ -3,13 +3,20 @@ using Microsoft.Extensions.Logging.Abstractions;

 using MongoDB.Entities;

+using PrivaPub.Domain.Timelines;
 using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Inbox.Handlers;
 using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Moderation;
+using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Outbox;
-using PrivaPub.Models;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Federation;
 using PrivaPub.Models.Group;
+using PrivaPub.Models.Jobs;
 using PrivaPub.Models.Post;
 using PrivaPub.Models.User;
+using PrivaPub.Models;
 using PrivaPub.StaticServices;
 using PrivaPub.Tests.Support;

@@ -27,7 +34,9 @@ namespace PrivaPub.Tests.Federation

 		Peer _peer;
 		LocalActorService _local;
-		InboxService _inbox;
+		InboxReceiver _receiver;
+		InboxProcessor _processor;
+		DomainBlocks _blocks;

 		public async ValueTask InitializeAsync()
 		{
@@ -36,7 +45,19 @@ namespace PrivaPub.Tests.Federation
 			var cache = new MemoryCache(new MemoryCacheOptions());
 			_local = new LocalActorService(new DbEntities(), new StaticOptions<AppConfiguration>(new AppConfiguration { BackendBaseAddress = Base }));
 			var remote = new RemoteActorService(Peer.Http(cache), _local, cache, new DbEntities());
-			_inbox = new InboxService(new DbEntities(), _local, remote, new DeliveryService(new DbEntities()), NullLogger<InboxService>.Instance);
+			var queue = new JobQueue();
+			var delivery = new DeliveryService(new DbEntities(), queue);
+			var db = new DbEntities();
+			_blocks = new DomainBlocks(NullLogger<DomainBlocks>.Instance);
+			_receiver = new InboxReceiver(_local, remote, queue, _blocks, NullLogger<InboxReceiver>.Instance);
+			_processor = new InboxProcessor(remote, new IActivityHandler[]
+			{
+				new FollowHandler(db, _local, remote, delivery),
+				new UndoHandler(db, _local),
+				new CreateHandler(db, _local, remote, delivery, _blocks, new Fanout(db), new RemotePosts(db, _local, remote, _blocks, queue)),
+				new DeleteHandler(db, _local, remote, delivery),
+				new UpdateHandler(db, _local, remote)
+			}, NullLogger<InboxProcessor>.Instance);
 		}

 		public async ValueTask DisposeAsync()
@@ -77,6 +98,17 @@ namespace PrivaPub.Tests.Federation
 			};
 		}

+		async Task<InboxResult> Deliver(RemoteActor sender, string path, JsonNode activity)
+		{
+			var token = TestContext.Current.CancellationToken;
+			var result = await _receiver.Receive(sender.Post(Host, path, activity), default, token);
+			var dedupe = "inbox|" + (activity is JsonObject ? activity["id"]?.GetValue<string>() : default);
+			var job = await DB.Default.Find<Job>().Match(j => j.DedupeKey == dedupe).ExecuteFirstAsync(token);
+			if (job != default)
+				Assert.Equal(JobResult.Done, (await _processor.Handle(job, token)).Result);
+			return result;
+		}
+
 		static string Origin(string uri) => new Uri(uri).GetLeftPart(UriPartial.Authority);

 		[Fact]
@@ -88,15 +120,15 @@ namespace PrivaPub.Tests.Federation
 			var mallory = new RemoteActor(_peer, "mallory");
 			var context = $"{_peer.A}/contexts/{Guid.NewGuid():N}";

-			var first = await _inbox.Receive(bob.Post(Host, $"/peasants/{alice.UserName}/mouth", DirectCreate(bob, alice.Uri, context)), alice, token);
-			var injected = await _inbox.Receive(mallory.Post(Host, $"/peasants/{alice.UserName}/mouth", DirectCreate(mallory, alice.Uri, context)), alice, token);
+			var first = await Deliver(bob, $"/peasants/{alice.UserName}/mouth", DirectCreate(bob, alice.Uri, context));
+			var injected = await Deliver(mallory, $"/peasants/{alice.UserName}/mouth", DirectCreate(mallory, alice.Uri, context));

 			Assert.Equal(202, first.StatusCode);
 			Assert.Equal(202, injected.StatusCode);
-			var bobDm = await DB.Default.Find<DmPost>().Match(p => p.ActorURI == bob.Id).ExecuteSingleAsync(token);
-			var malloryDm = await DB.Default.Find<DmPost>().Match(p => p.ActorURI == mallory.Id).ExecuteSingleAsync(token);
-			Assert.NotEqual(bobDm.GroupId, malloryDm.GroupId);
-			var bobConversation = await DB.Default.Find<DmGroup>().OneAsync(bobDm.GroupId, token);
+			var bobDm = await DB.Default.Find<Post>().Match(p => p.ActorURI == bob.Id && p.Visibility == PostVisibility.Direct).ExecuteSingleAsync(token);
+			var malloryDm = await DB.Default.Find<Post>().Match(p => p.ActorURI == mallory.Id).ExecuteSingleAsync(token);
+			Assert.NotEqual(bobDm.ConversationId, malloryDm.ConversationId);
+			var bobConversation = await DB.Default.Find<DmGroup>().OneAsync(bobDm.ConversationId, token);
 			Assert.DoesNotContain(bobConversation.Members, m => m.AvatarId == mallory.Id);
 		}

@@ -107,12 +139,12 @@ namespace PrivaPub.Tests.Federation
 			var alice = await LocalAvatar("alice");
 			var bob = new RemoteActor(_peer, "bob");

-			await _inbox.Receive(bob.Post(Host, $"/peasants/{alice.UserName}/mouth", DirectCreate(bob, alice.Uri)), alice, token);
-			await _inbox.Receive(bob.Post(Host, $"/peasants/{alice.UserName}/mouth", DirectCreate(bob, alice.Uri)), alice, token);
+			await Deliver(bob, $"/peasants/{alice.UserName}/mouth", DirectCreate(bob, alice.Uri));
+			await Deliver(bob, $"/peasants/{alice.UserName}/mouth", DirectCreate(bob, alice.Uri));

-			var dms = await DB.Default.Find<DmPost>().Match(p => p.ActorURI == bob.Id).ExecuteAsync(token);
+			var dms = await DB.Default.Find<Post>().Match(p => p.ActorURI == bob.Id && p.Visibility == PostVisibility.Direct).ExecuteAsync(token);
 			Assert.Equal(2, dms.Count);
-			Assert.Single(dms.Select(d => d.GroupId).Distinct());
+			Assert.Single(dms.Select(d => d.ConversationId).Distinct());
 		}

 		[Fact]
@@ -124,7 +156,7 @@ namespace PrivaPub.Tests.Federation
 			var create = DirectCreate(mallory, alice.Uri);
 			create["id"] = $"{_peer.B}/activities/{Guid.NewGuid():N}";

-			var result = await _inbox.Receive(mallory.Post(Host, $"/peasants/{alice.UserName}/mouth", create), alice, token);
+			var result = await Deliver(mallory, $"/peasants/{alice.UserName}/mouth", create);

 			Assert.Equal(400, result.StatusCode);
 		}
@@ -137,11 +169,10 @@ namespace PrivaPub.Tests.Federation
 			var mallory = new RemoteActor(_peer, "mallory");
 			var victim = new RemoteActor(_peer, "victim");

-			var result = await _inbox.Receive(mallory.Post(Host, $"/peasants/{alice.UserName}/mouth",
-				DirectCreate(mallory, alice.Uri, attributedTo: victim.Id)), alice, token);
+			var result = await Deliver(mallory, $"/peasants/{alice.UserName}/mouth", DirectCreate(mallory, alice.Uri, attributedTo: victim.Id));

 			Assert.Equal(400, result.StatusCode);
-			Assert.False(await DB.Default.Find<DmPost>().Match(p => p.ActorURI == victim.Id).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ActorURI == victim.Id).ExecuteAnyAsync(token));
 		}

 		[Fact]
@@ -151,11 +182,121 @@ namespace PrivaPub.Tests.Federation
 			var alice = await LocalAvatar("alice");
 			var mallory = new RemoteActor(_peer, "mallory");

-			var result = await _inbox.Receive(mallory.Post(Host, $"/peasants/{alice.UserName}/mouth",
-				DirectCreate(mallory, alice.Uri, objectOrigin: _peer.B)), alice, token);
+			var result = await Deliver(mallory, $"/peasants/{alice.UserName}/mouth", DirectCreate(mallory, alice.Uri, objectOrigin: _peer.B));

 			Assert.Equal(202, result.StatusCode);
-			Assert.False(await DB.Default.Find<DmPost>().Match(p => p.ActorURI == mallory.Id).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ActorURI == mallory.Id).ExecuteAnyAsync(token));
+		}
+
+		static JsonObject PublicCreate(RemoteActor author, string inReplyTo = default, params string[] cc)
+		{
+			var id = $"{Origin(author.Id)}/notes/{Guid.NewGuid():N}";
+			var note = new JsonObject
+			{
+				["id"] = id,
+				["type"] = "Note",
+				["attributedTo"] = author.Id,
+				["content"] = "<p>hello</p>",
+				["to"] = new JsonArray(Addressing.Public),
+				["cc"] = new JsonArray(cc.Prepend(author.Id + "/followers").Select(c => (JsonNode)c).ToArray())
+			};
+			if (inReplyTo != default)
+				note["inReplyTo"] = inReplyTo;
+			return new JsonObject
+			{
+				["id"] = $"{Origin(author.Id)}/activities/{Guid.NewGuid():N}",
+				["type"] = "Create",
+				["actor"] = author.Id,
+				["object"] = note
+			};
+		}
+
+		[Fact]
+		public async Task A_public_reply_to_a_local_post_is_kept_and_counted()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var alice = await LocalAvatar("alice");
+			var parent = new Post { GroupUserId = alice.Id, AuthorAccountId = alice.Id, ActorURI = alice.Uri, Text = "hi" };
+			parent.ID = (string)parent.GenerateNewID();
+			parent.ObjectURI = alice.PostUri(parent.ID);
+			await DB.Default.SaveAsync(parent, token);
+			var bob = new RemoteActor(_peer, "bob");
+
+			await Deliver(bob, "/human-centipede", PublicCreate(bob, parent.ObjectURI));
+
+			var reply = await DB.Default.Find<Post>().Match(p => p.ActorURI == bob.Id).ExecuteSingleAsync(token);
+			Assert.Equal(PostVisibility.Public, reply.Visibility);
+			Assert.Equal(parent.ID, reply.AnsweringToPostId);
+			Assert.Equal(alice.Id, reply.InReplyToAccountId);
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(parent.ID, token)).RepliesCount);
+		}
+
+		[Fact]
+		public async Task A_public_post_nobody_here_asked_for_is_dropped()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var bob = new RemoteActor(_peer, "bob");
+
+			await Deliver(bob, "/human-centipede", PublicCreate(bob));
+
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ActorURI == bob.Id).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_mention_is_kept_and_linked_to_the_local_persona()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var alice = await LocalAvatar("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var create = PublicCreate(bob, default, alice.Uri);
+			create["object"]!["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@" + alice.Handle });
+
+			await Deliver(bob, "/human-centipede", create);
+
+			var post = await DB.Default.Find<Post>().Match(p => p.ActorURI == bob.Id).ExecuteSingleAsync(token);
+			var mention = Assert.Single(post.Mentions);
+			Assert.True(mention.IsLocal);
+			Assert.Equal(alice.Id, mention.AccountId);
+		}
+
+		[Fact]
+		public async Task A_suspended_domain_is_dropped_before_its_key_is_fetched()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var alice = await LocalAvatar("alice");
+			var bob = new RemoteActor(_peer, "bob", _peer.B);
+			await DB.Default.SaveAsync(new DomainBlock { Domain = "localhost", Severity = DomainBlockSeverity.Suspend }, token);
+			try
+			{
+				await _blocks.Reload(token);
+				var before = _peer.Requests.Count;
+
+				var result = await Deliver(bob, $"/peasants/{alice.UserName}/mouth", DirectCreate(bob, alice.Uri));
+
+				Assert.Equal(202, result.StatusCode);
+				Assert.Equal(before, _peer.Requests.Count);
+				Assert.False(await DB.Default.Find<Post>().Match(p => p.ActorURI == bob.Id).ExecuteAnyAsync(token));
+			}
+			finally
+			{
+				await DB.Default.DeleteAsync<DomainBlock>(b => b.Domain == "localhost");
+				await _blocks.Reload(token);
+			}
+		}
+
+		[Fact]
+		public void A_block_covers_subdomains_but_not_lookalikes()
+		{
+			var blocks = new DomainBlocks(NullLogger<DomainBlocks>.Instance);
+			typeof(DomainBlocks).GetField("_blocks", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+				.SetValue(blocks, new Dictionary<string, DomainBlock> { ["evil.example"] = new() { Domain = "evil.example", Severity = DomainBlockSeverity.Silence } });
+			typeof(DomainBlocks).GetField("_loadedAt", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+				.SetValue(blocks, DateTime.UtcNow);
+
+			Assert.NotNull(blocks.Find("evil.example"));
+			Assert.NotNull(blocks.Find("A.Evil.Example."));
+			Assert.Null(blocks.Find("notevil.example"));
+			Assert.False(blocks.IsSuspended("evil.example"));
 		}

 		[Fact]
@@ -167,7 +308,7 @@ namespace PrivaPub.Tests.Federation
 			var request = mallory.Post(Host, $"/peasants/{alice.UserName}/mouth", DirectCreate(mallory, alice.Uri));
 			request.Headers["Signature"] = request.Headers["Signature"].ToString().Replace("signature=\"", "signature=\"AAAA");

-			Assert.Equal(401, (await _inbox.Receive(request, alice, token)).StatusCode);
+			Assert.Equal(401, (await _receiver.Receive(request, alice, token)).StatusCode);
 		}

 		[Fact]
@@ -178,7 +319,7 @@ namespace PrivaPub.Tests.Federation
 			var mallory = new RemoteActor(_peer, "mallory");

 			foreach (var junk in new JsonNode[] { new JsonArray(1, 2), JsonValue.Create("x"), new JsonObject { ["type"] = "Create" } })
-				Assert.Equal(400, (await _inbox.Receive(mallory.Post(Host, $"/peasants/{alice.UserName}/mouth", junk), alice, token)).StatusCode);
+				Assert.Equal(400, (await Deliver(mallory, $"/peasants/{alice.UserName}/mouth", junk)).StatusCode);
 		}

 		[Fact]
@@ -199,7 +340,7 @@ namespace PrivaPub.Tests.Federation
 			};

 			Assert.False(actor.IsFederated);
-			Assert.Equal(404, (await _inbox.Receive(bob.Post(Host, "/human-centipede", follow), default, token)).StatusCode);
+			Assert.Equal(404, (await Deliver(bob, "/human-centipede", follow)).StatusCode);
 		}
 	}
 }
@@ -0,0 +1,137 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class InteractionTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		async Task<(string Root, Post Post)> LocalPost(string visibility = default)
+		{
+			var (root, alice) = await _harness.Persona("alice");
+			var view = (ViewPost)(await _harness.Posts.InsertPost(root, new InsertPostForm { AvatarId = alice.Id, Text = "like me", Visibility = visibility },
+				TestContext.Current.CancellationToken)).Data;
+			return (root, await DB.Default.Find<Post>().OneAsync(view.Id));
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		[Fact]
+		public async Task A_like_counts_once_notifies_and_can_be_undone()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, post) = await LocalPost();
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			var like = new JsonObject { ["id"] = $"{Origin(carol)}/likes/{Guid.NewGuid():N}", ["type"] = "Like", ["actor"] = carol.Id, ["object"] = post.ObjectURI };
+
+			await _harness.Deliver(carol, "/human-centipede", like);
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject { ["id"] = $"{Origin(carol)}/likes/{Guid.NewGuid():N}", ["type"] = "Like", ["actor"] = carol.Id, ["object"] = post.ObjectURI });
+
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+			Assert.Equal(NotificationType.Favourite, (await DB.Default.Find<Notification>().Match(n => n.AvatarId == post.GroupUserId).ExecuteSingleAsync(token)).Type);
+
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/undos/{Guid.NewGuid():N}", ["type"] = "Undo", ["actor"] = carol.Id, ["object"] = like
+			});
+			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+		}
+
+		[Fact]
+		public async Task A_stranger_cannot_like_a_followers_only_post()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, post) = await LocalPost("followersonly");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(mallory)}/likes/{Guid.NewGuid():N}", ["type"] = "Like", ["actor"] = mallory.Id, ["object"] = post.ObjectURI
+			});
+
+			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+		}
+
+		[Fact]
+		public async Task A_boost_of_a_local_post_counts_notifies_and_can_be_undone()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, post) = await LocalPost();
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			var announce = new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/announces/{Guid.NewGuid():N}", ["type"] = "Announce", ["actor"] = carol.Id, ["object"] = post.ObjectURI,
+				["to"] = new JsonArray(Addressing.Public), ["cc"] = new JsonArray(carol.Id + "/followers")
+			};
+
+			await _harness.Deliver(carol, "/human-centipede", announce);
+
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).ReblogsCount);
+			Assert.Equal(NotificationType.Reblog, (await DB.Default.Find<Notification>().Match(n => n.AvatarId == post.GroupUserId).ExecuteSingleAsync(token)).Type);
+
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/undos/{Guid.NewGuid():N}", ["type"] = "Undo", ["actor"] = carol.Id, ["object"] = announce["id"]!.GetValue<string>()
+			});
+			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).ReblogsCount);
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ObjectURI == announce["id"]!.GetValue<string>()).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_followed_account_boosting_a_remote_post_puts_it_in_home()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (bobRoot, bob) = await _harness.Persona("bob");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			var dave = new RemoteActor(_harness.Peer, "dave");
+			var stranger = new RemoteActor(_harness.Peer, "stranger");
+			await _harness.Follows.Follow(bobRoot, new FollowForm { AvatarId = bob.Id, Target = carol.Id }, token);
+			await DB.Default.Update<Following>().Match(f => f.AvatarId == bob.Id).Modify(f => f.State, FollowState.Accepted).ExecuteAsync(token);
+			var noteId = $"{Origin(dave)}/notes/{Guid.NewGuid():N}";
+			_harness.Peer.Serve(new Uri(noteId).AbsolutePath, new JsonObject
+			{
+				["id"] = noteId, ["type"] = "Note", ["attributedTo"] = dave.Id, ["content"] = "<p>worth sharing</p>", ["to"] = new JsonArray(Addressing.Public)
+			}.ToJsonString());
+
+			await _harness.Deliver(stranger, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(stranger)}/announces/{Guid.NewGuid():N}", ["type"] = "Announce", ["actor"] = stranger.Id, ["object"] = noteId,
+				["to"] = new JsonArray(Addressing.Public)
+			});
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteAnyAsync(token));
+
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/announces/{Guid.NewGuid():N}", ["type"] = "Announce", ["actor"] = carol.Id, ["object"] = noteId,
+				["to"] = new JsonArray(Addressing.Public)
+			});
+
+			var home = (List<ViewPost>)(await _harness.Timelines.Home(bobRoot, bob.Id, default, 20, token)).Data;
+			var boosted = Assert.Single(home);
+			Assert.Equal("<p>worth sharing</p>", boosted.ReblogOf.ContentHtml);
+			Assert.Equal(carol.Id, boosted.AuthorActorURI);
+		}
+	}
+}
@@ -0,0 +1,114 @@
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class NoteParserTests
+	{
+		const string MastodonNote = """
+			{
+				"id": "https://m.example/users/alice/statuses/1",
+				"type": "Note",
+				"summary": "spoilers",
+				"inReplyTo": "https://privapub.test/peasants/bob/posts/abc",
+				"published": "2026-09-30T10:00:00Z",
+				"url": "https://m.example/@alice/1",
+				"attributedTo": "https://m.example/users/alice",
+				"to": ["https://www.w3.org/ns/activitystreams#Public"],
+				"cc": ["https://m.example/users/alice/followers", "https://privapub.test/peasants/bob"],
+				"sensitive": true,
+				"conversation": "tag:m.example,2026-09-30:objectId=1:objectType=Conversation",
+				"context": "https://m.example/contexts/1",
+				"content": "<p><span class=\"h-card\"><a href=\"https://privapub.test/peasants/bob\" class=\"u-url mention\">@<span>bob</span></a></span> hi <a href=\"https://m.example/tags/Fedi\" class=\"mention hashtag\" rel=\"tag\">#<span>Fedi</span></a><script>x</script></p>",
+				"contentMap": { "en": "<p>hi</p>" },
+				"attachment": [{
+					"type": "Document", "mediaType": "image/png", "url": "https://files.m.example/a.png",
+					"name": "a cat", "blurhash": "UBL_:rOpGG-oBUNG,qRj2so|=eE1w^n4S5NH", "focalPoint": [0.5, -2.0], "width": 640, "height": 480
+				}],
+				"tag": [
+					{ "type": "Mention", "href": "https://privapub.test/peasants/bob", "name": "@bob@privapub.test" },
+					{ "type": "Hashtag", "href": "https://m.example/tags/fedi", "name": "#Fedi" },
+					{ "type": "Emoji", "name": ":blob:", "icon": { "type": "Image", "url": "https://files.m.example/blob.png" } }
+				]
+			}
+			""";
+
+		[Fact]
+		public void Reads_a_mastodon_note()
+		{
+			var note = NoteParser.Parse(JsonNode.Parse(MastodonNote));
+
+			Assert.Equal("https://m.example/users/alice", note.AttributedTo);
+			Assert.Equal("spoilers", note.SpoilerText);
+			Assert.True(note.Sensitive);
+			Assert.Equal("en", note.Language);
+			Assert.Equal("https://m.example/@alice/1", note.Url);
+			Assert.Equal("https://m.example/contexts/1", note.Context);
+			Assert.DoesNotContain("<script>", note.ContentHtml);
+			Assert.Contains("u-url mention", note.ContentHtml);
+			Assert.Equal("https://privapub.test/peasants/bob", Assert.Single(note.Mentions).ActorURI);
+			Assert.Equal("fedi", Assert.Single(note.Tags));
+			var media = Assert.Single(note.Attachments);
+			Assert.Equal("a cat", media.Description);
+			Assert.Equal(new[] { 0.5f, -1f }, media.Focus);
+			Assert.Equal(new DateTime(2026, 9, 30, 10, 0, 0, DateTimeKind.Utc), note.Published);
+		}
+
+		[Fact]
+		public void Reads_a_lemmy_page_with_a_title()
+		{
+			var note = NoteParser.Parse(JsonNode.Parse("""
+				{
+					"id": "https://l.example/post/7", "type": "Page", "name": "A title",
+					"attributedTo": "https://l.example/u/carol", "audience": "https://l.example/c/cats",
+					"content": "<p>body</p>", "to": ["https://l.example/c/cats", "https://www.w3.org/ns/activitystreams#Public"],
+					"published": "2026-09-30T10:00:00.123456+00:00"
+				}
+				"""));
+
+			Assert.Equal("A title", note.Title);
+			Assert.Equal("https://l.example/c/cats", note.Audience);
+			Assert.False(note.Sensitive);
+		}
+
+		[Fact]
+		public void Falls_back_to_misskey_content_and_takes_the_person_from_a_peertube_attribution()
+		{
+			var note = NoteParser.Parse(JsonNode.Parse("""
+				{
+					"id": "https://k.example/notes/9", "type": "Note",
+					"attributedTo": [{ "type": "Group", "id": "https://k.example/c/chan" }, { "type": "Person", "id": "https://k.example/users/9" }],
+					"_misskey_content": "hello <b>there</b>\nnext", "_misskey_quote": "https://k.example/notes/8"
+				}
+				"""));
+
+			Assert.Equal("https://k.example/users/9", note.AttributedTo);
+			Assert.Equal("hello &lt;b&gt;there&lt;/b&gt;<br>next", note.ContentHtml);
+			Assert.Equal("https://k.example/notes/8", note.QuoteUri);
+		}
+
+		[Theory]
+		[InlineData("""{ "id": "https://x.example/1", "type": "Person" }""")]
+		[InlineData("""{ "id": "not a uri", "type": "Note" }""")]
+		[InlineData("""[1, 2]""")]
+		public void Refuses_what_is_not_a_note(string json) =>
+			Assert.Null(NoteParser.Parse(JsonNode.Parse(json)));
+	}
+
+	public class AddressingTests
+	{
+		const string Followers = "https://m.example/users/alice/followers";
+
+		[Theory]
+		[InlineData(new[] { Addressing.Public }, new[] { Followers }, PostVisibility.Public)]
+		[InlineData(new[] { "as:Public" }, new string[0], PostVisibility.Public)]
+		[InlineData(new[] { Followers }, new[] { Addressing.Public }, PostVisibility.Unlisted)]
+		[InlineData(new[] { Followers }, new[] { "https://privapub.test/peasants/bob" }, PostVisibility.FollowersOnly)]
+		[InlineData(new[] { "https://privapub.test/peasants/bob" }, new string[0], PostVisibility.Direct)]
+		[InlineData(new[] { "https://m.example/users/mallory/followers" }, new string[0], PostVisibility.Direct)]
+		public void Classifies_like_mastodon(string[] to, string[] cc, PostVisibility expected) =>
+			Assert.Equal(expected, Addressing.Classify(to, cc, Followers));
+	}
+}
@@ -0,0 +1,103 @@
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class RendererTests
+	{
+		static readonly LocalActor Alice = new()
+		{
+			Id = "a1",
+			Kind = LocalActorKind.Person,
+			UserName = "alice",
+			Name = "Alice",
+			Summary = "I **like** <b>cats</b>",
+			PublicKeyPem = Keys.NewKeyPair().PublicKeyPem,
+			Published = new DateTime(2026, 9, 30, 17, 45, 12, DateTimeKind.Utc),
+			Fields = new Dictionary<string, string> { ["site"] = "https://alice.example", ["mood"] = "<i>ok</i>" },
+			BaseAddress = "https://privapub.test"
+		};
+
+		[Fact]
+		public void An_actor_looks_like_a_mastodon_actor_with_our_route_names()
+		{
+			var actor = ActivityPubRenderer.Actor(Alice);
+
+			Assert.Equal("https://privapub.test/peasants/alice", actor["id"]!.GetValue<string>());
+			Assert.Equal("https://privapub.test/@alice", actor["url"]!.GetValue<string>());
+			Assert.Equal("https://privapub.test/peasants/alice/mouth", actor["inbox"]!.GetValue<string>());
+			Assert.Equal("https://privapub.test/peasants/alice/anus", actor["outbox"]!.GetValue<string>());
+			Assert.Equal("https://privapub.test/peasants/alice/groupies", actor["followers"]!.GetValue<string>());
+			Assert.Equal("https://privapub.test/peasants/alice/stalking", actor["following"]!.GetValue<string>());
+			Assert.Equal("https://privapub.test/human-centipede", actor["endpoints"]!["sharedInbox"]!.GetValue<string>());
+			Assert.Equal("2026-09-30T00:00:00Z", actor["published"]!.GetValue<string>());
+			Assert.Equal("alice@privapub.test", actor["webfinger"]!.GetValue<string>());
+			Assert.False(actor["indexable"]!.GetValue<bool>());
+			Assert.Equal("<p>I <strong>like</strong> &lt;b&gt;cats&lt;/b&gt;</p>", actor["summary"]!.GetValue<string>());
+			var fields = actor["attachment"]!.AsArray();
+			Assert.Contains("rel=\"nofollow noopener noreferrer me\"", fields[0]!["value"]!.GetValue<string>());
+			Assert.Equal("&lt;i&gt;ok&lt;/i&gt;", fields[1]!["value"]!.GetValue<string>());
+			Assert.Equal("https://privapub.test/peasants/alice#main-key", actor["publicKey"]!["id"]!.GetValue<string>());
+			Assert.Equal(actor["id"]!.GetValue<string>(), actor["publicKey"]!["owner"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public void A_titled_post_with_a_warning_keeps_the_title_visible_on_mastodon()
+		{
+			var post = new Post
+			{
+				ID = "p1",
+				Title = "On <cats>",
+				ContentHtml = "<p>body</p>",
+				HasContentWarning = true,
+				Language = "en",
+				Mentions = new() { new PostMention { ActorURI = "https://m.example/users/bob", Handle = "@bob@m.example" } },
+				Tags = new() { "cats" },
+				CreationDate = new DateTime(2026, 9, 30, 17, 45, 12, DateTimeKind.Utc)
+			};
+
+			var note = ActivityPubRenderer.Note(post, Alice, default, "https://m.example/users/bob/statuses/1");
+
+			Assert.Equal("https://privapub.test/peasants/alice/scribbles/p1", note["id"]!.GetValue<string>());
+			Assert.Equal("https://privapub.test/@alice/p1", note["url"]!.GetValue<string>());
+			Assert.Equal("<p><strong>On &lt;cats&gt;</strong></p><p>body</p>", note["content"]!.GetValue<string>());
+			Assert.Equal("On <cats>", note["summary"]!.GetValue<string>());
+			Assert.True(note["sensitive"]!.GetValue<bool>());
+			Assert.Equal("2026-09-30T17:45:12Z", note["published"]!.GetValue<string>());
+			Assert.Equal(new[] { ActivityPubRenderer.Public }, note["to"]!.AsArray().Select(n => n!.GetValue<string>()));
+			Assert.Equal(new[] { Alice.Followers, "https://m.example/users/bob" }, note["cc"]!.AsArray().Select(n => n!.GetValue<string>()));
+			var tags = note["tag"]!.AsArray();
+			Assert.Equal("@bob@m.example", tags[0]!["name"]!.GetValue<string>());
+			Assert.Equal("https://privapub.test/tags/cats", tags[1]!["href"]!.GetValue<string>());
+			Assert.Equal("https://m.example/users/bob/statuses/1", note["inReplyTo"]!.GetValue<string>());
+			Assert.NotNull(note["contentMap"]!["en"]);
+		}
+
+		[Fact]
+		public void A_warning_without_a_title_or_spoiler_gets_a_generic_summary()
+		{
+			var note = ActivityPubRenderer.Note(new Post { ID = "p2", ContentHtml = "<p>x</p>", HasContentWarning = true }, Alice, default, default);
+
+			Assert.Equal(ActivityPubRenderer.ContentWarning, note["summary"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public void A_direct_note_is_addressed_to_its_recipients_only()
+		{
+			var post = new Post { ID = "p3", ContentHtml = "<p>psst</p>", Visibility = PostVisibility.Direct };
+
+			var note = ActivityPubRenderer.DirectNote(post, Alice, new[] { ("https://m.example/users/bob", "bob@m.example") },
+				Alice.ConversationUri("c1"));
+
+			Assert.Equal(new[] { "https://m.example/users/bob" }, note["to"]!.AsArray().Select(n => n!.GetValue<string>()));
+			Assert.Empty(note["cc"]!.AsArray());
+			Assert.Equal("https://privapub.test/peasants/alice/whispers/c1", note["context"]!.GetValue<string>());
+			Assert.StartsWith("<p><span class=\"h-card\"", note["content"]!.GetValue<string>());
+			Assert.Equal("Mention", note["tag"]![0]!["type"]!.GetValue<string>());
+		}
+	}
+}
@@ -6,7 +6,9 @@ using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;

+using PrivaPub.Federation.Moderation;
 using PrivaPub.Infrastructure.Http;
+using PrivaPub.Models.Federation;

 namespace PrivaPub.Tests.Infrastructure
 {
@@ -39,7 +41,7 @@ namespace PrivaPub.Tests.Infrastructure
 				.ConfigurePrimaryHttpMessageHandler(() => SafeHttpHandlerFactory.Create(options));
 			var provider = services.BuildServiceProvider();
 			return new FederationHttp(provider.GetRequiredService<IHttpClientFactory>(), new MemoryCache(new MemoryCacheOptions()),
-				new StaticOptionsMonitor(options), NullLogger<FederationHttp>.Instance);
+				new StaticOptionsMonitor(options), new StaticBlocks(), NullLogger<FederationHttp>.Instance);
 		}

 		[Fact]
@@ -91,6 +93,29 @@ namespace PrivaPub.Tests.Infrastructure
 		public void IsAllowed_takes_https_dns_names_only(string url, bool allowed) =>
 			Assert.Equal(allowed, Client(allowTestNetwork: false).IsAllowed(new Uri(url)));

+		[Fact]
+		public void IsAllowed_refuses_a_suspended_domain_and_its_subdomains()
+		{
+			var http = new FederationHttp(new ServiceCollection().AddHttpClient().BuildServiceProvider().GetRequiredService<IHttpClientFactory>(),
+				new MemoryCache(new MemoryCacheOptions()), new StaticOptionsMonitor(new FederationOptions()), new StaticBlocks("evil.example"),
+				NullLogger<FederationHttp>.Instance);
+
+			Assert.False(http.IsAllowed(new Uri("https://evil.example/users/x")));
+			Assert.False(http.IsAllowed(new Uri("https://cdn.evil.example/a.png")));
+			Assert.True(http.IsAllowed(new Uri("https://notevil.example/users/x")));
+		}
+
+		sealed class StaticBlocks : IDomainBlocks
+		{
+			readonly string[] _suspended;
+			public StaticBlocks(params string[] suspended) => _suspended = suspended;
+			public DomainBlock Find(string host) => _suspended.Any(s => host == s || host.EndsWith("." + s))
+				? new DomainBlock { Domain = host, Severity = DomainBlockSeverity.Suspend }
+				: default;
+			public bool IsSuspended(string host) => Find(host) != default;
+			public Task Reload(CancellationToken token) => Task.CompletedTask;
+		}
+
 		sealed class StaticOptionsMonitor : IOptionsMonitor<FederationOptions>
 		{
 			public StaticOptionsMonitor(FederationOptions value) => CurrentValue = value;
@@ -20,6 +20,8 @@ namespace PrivaPub.Tests.Infrastructure
 		{
 			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
 			var token = TestContext.Current.CancellationToken;
+			await DB.Default.Index<ForeignAvatar>().DropAllAsync(token);
+			await DB.Default.Index<Follower>().DropAllAsync(token);
 			var actorUri = $"https://r.example/users/{Guid.NewGuid():N}";
 			var localId = Guid.NewGuid().ToString("N")[..24];
 			await DB.Default.SaveAsync(new[]
@@ -48,7 +50,6 @@ namespace PrivaPub.Tests.Infrastructure
 		{
 			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
 			var token = TestContext.Current.CancellationToken;
-			await Indexes.Create(token);
 			var local = new LocalActorService(new DbEntities(), new StaticOptions<AppConfiguration>(new AppConfiguration { BackendBaseAddress = "https://privapub.test" }));
 			var name = $"n{Guid.NewGuid():N}"[..20];

@@ -0,0 +1,145 @@
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Infrastructure
+{
+	public class BackoffTests
+	{
+		[Fact]
+		public void Grows_like_mastodons()
+		{
+			Assert.InRange(Backoff.After(1).TotalSeconds, 16, 16 + 9 * 2);
+			Assert.InRange(Backoff.After(10).TotalSeconds, 10015, 10015 + 9 * 11);
+		}
+
+		[Fact]
+		public void Quarantines_a_host_only_past_the_threshold()
+		{
+			Assert.Equal(TimeSpan.Zero, Backoff.HostQuarantine(9, 10));
+			Assert.Equal(TimeSpan.FromHours(1), Backoff.HostQuarantine(10, 10));
+			Assert.Equal(TimeSpan.FromHours(4), Backoff.HostQuarantine(12, 10));
+			Assert.Equal(TimeSpan.FromDays(7), Backoff.HostQuarantine(40, 10));
+		}
+	}
+
+	[Trait("Category", "Integration")]
+	public sealed class JobQueueTests : IAsyncLifetime
+	{
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		static Job NewJob(string host = default, string dedupe = default) => new()
+		{
+			Kind = (JobKind)99,
+			Host = host,
+			DedupeKey = dedupe,
+			Payload = "{}"
+		};
+
+		[Fact]
+		public async Task A_dedupe_key_is_queued_once()
+		{
+			var queue = new JobQueue();
+			var key = Guid.NewGuid().ToString("N");
+
+			var inserted = await queue.EnqueueMany(new[] { NewJob(dedupe: key), NewJob(dedupe: key) }, TestContext.Current.CancellationToken);
+
+			Assert.Equal(1, inserted);
+		}
+
+		[Fact]
+		public async Task A_busy_host_is_skipped_and_a_failed_job_backs_off()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var queue = new JobQueue();
+			var kind = (JobKind)(100 + Random.Shared.Next(1000));
+			var busy = $"busy{Guid.NewGuid():N}.example";
+			var free = $"free{Guid.NewGuid():N}.example";
+			await queue.EnqueueMany(new[] { new Job { Kind = kind, Host = busy }, new Job { Kind = kind, Host = free } }, token);
+
+			var leased = await queue.Lease(kind, new[] { busy }, token);
+			Assert.Equal(free, leased.Host);
+			Assert.Equal(1, leased.Attempts);
+
+			await queue.Finish(leased, JobOutcome.Retry("boom"), maxAttempts: 3, token);
+			var after = await DB.Default.Find<Job>().OneAsync(leased.ID, token);
+			Assert.Equal(JobState.Pending, after.State);
+			Assert.True(after.RunAt > DateTime.UtcNow.AddSeconds(10));
+
+			leased.Attempts = 3;
+			await queue.Finish(leased, JobOutcome.Retry("boom"), maxAttempts: 3, token);
+			Assert.Equal(JobState.Dead, (await DB.Default.Find<Job>().OneAsync(leased.ID, token)).State);
+		}
+
+		[Fact]
+		public async Task An_expired_lease_returns_to_the_queue()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var job = new Job { Kind = (JobKind)98, State = JobState.Running, LeasedUntil = DateTime.UtcNow.AddMinutes(-1) };
+			await DB.Default.SaveAsync(job, token);
+
+			await new JobQueue().Reap(token);
+
+			Assert.Equal(JobState.Pending, (await DB.Default.Find<Job>().OneAsync(job.ID, token)).State);
+		}
+
+		[Fact]
+		public async Task A_dead_host_does_not_hold_up_deliveries_to_live_ones()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (privateKey, publicKey) = Keys.NewKeyPair();
+			var avatar = new Avatar { UserName = $"sender{Guid.NewGuid():N}"[..20], PrivateKey = privateKey, PublicKey = publicKey };
+			await DB.Default.SaveAsync(avatar, token);
+			var local = new LocalActorService(new DbEntities(), new StaticOptions<AppConfiguration>(new AppConfiguration { BackendBaseAddress = "https://privapub.test" }));
+			var sender = local.FromAvatar(avatar);
+			var queue = new JobQueue();
+			var delivery = new DeliveryService(new DbEntities(), queue);
+			_peer.Answer("/dead/inbox", 503, TimeSpan.FromMilliseconds(300));
+			_peer.Answer("/live/inbox", 202);
+
+			var deadInboxes = Enumerable.Range(0, 60).Select(i => $"{_peer.B}/dead/inbox?{i}");
+			await delivery.Enqueue(sender, deadInboxes, new JsonObject { ["id"] = $"https://privapub.test/a/{Guid.NewGuid():N}", ["type"] = "Create" }, token);
+			await delivery.Enqueue(sender, new[] { $"{_peer.A}/live/inbox" }, new JsonObject { ["id"] = $"https://privapub.test/a/{Guid.NewGuid():N}", ["type"] = "Create" }, token);
+
+			var handler = new DeliveryJobHandler(local, Peer.Http(), new HostCircuitBreaker(new MemoryCache(new MemoryCacheOptions())), NullLogger<DeliveryJobHandler>.Instance);
+			using var worker = new JobWorker(queue, new IJobHandler[] { handler }, NullLogger<JobWorker>.Instance);
+			await worker.StartAsync(token);
+			var deadline = DateTime.UtcNow.AddSeconds(5);
+			while (DateTime.UtcNow < deadline && !_peer.Requests.Any(r => r.Path == "/live/inbox"))
+				await Task.Delay(50, token);
+			var live = Assert.Single(_peer.Requests, r => r.Path == "/live/inbox");
+			Assert.True(_peer.Requests.Count(r => r.Path == "/dead/inbox") < 10);
+			while (DateTime.UtcNow < deadline && !await DB.Default.Find<RemoteInstance>().Match(i => i.Host == "localhost").ExecuteAnyAsync(token))
+				await Task.Delay(50, token);
+			await worker.StopAsync(token);
+
+			Assert.Contains($"keyId=\"{sender.KeyId}\"", live.Signature);
+			var instance = await DB.Default.Find<RemoteInstance>().Match(i => i.Host == "localhost").ExecuteFirstAsync(token);
+			Assert.True(instance.ConsecutiveFailures > 0);
+		}
+	}
+}
@@ -29,5 +29,21 @@ namespace PrivaPub.Tests.Infrastructure
 			Assert.Equal("<p><strong>bold</strong> &lt;b&gt;raw&lt;/b&gt;</p>", migratedLocal.ContentHtml);
 			Assert.Equal(ContentFormat.Markdown, migratedLocal.ContentFormat);
 		}
+	
+		[Fact]
+		public async Task Direct_posts_move_into_posts_with_their_conversation()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			var token = TestContext.Current.CancellationToken;
+			var dm = new DmPost { GroupId = "conversation1", Text = "psst", ObjectURI = $"https://privapub.test/{Guid.NewGuid():N}", GroupUserId = "a1" };
+			await DB.Default.SaveAsync(dm, token);
+
+			await new _005_direct_posts_join_posts().UpgradeAsync();
+
+			var post = await DB.Default.Find<Post>().OneAsync(dm.ID, token);
+			Assert.Equal(PostVisibility.Direct, post.Visibility);
+			Assert.Equal("conversation1", post.ConversationId);
+			Assert.Equal("a1", post.AuthorAccountId);
+		}
 	}
 }
@@ -0,0 +1,40 @@
+using MongoDB.Bson;
+
+using PrivaPub.Infrastructure.Ids;
+using PrivaPub.Models.User;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Tests.Infrastructure
+{
+	public class PrivacyIdsTests
+	{
+		[Fact]
+		public void Persona_ids_carry_only_the_day_and_share_nothing_else()
+		{
+			var first = (string)new Avatar().GenerateNewID();
+			var second = (string)new Avatar().GenerateNewID();
+
+			Assert.True(ObjectId.TryParse(first, out var a));
+			Assert.True(ObjectId.TryParse(second, out var b));
+			Assert.Equal(DateTime.UtcNow.Date, a.CreationTime);
+			Assert.Equal(a.CreationTime, b.CreationTime);
+			Assert.NotEqual(first[8..14], second[8..14]);
+			Assert.Equal(DateTime.UtcNow.Date, ObjectId.Parse((string)new GroupEntity().GenerateNewID()).CreationTime);
+		}
+
+		[Fact]
+		public void A_remote_post_id_sorts_by_its_published_time()
+		{
+			var older = PrivacyIds.At(new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc));
+			var newer = PrivacyIds.At(new DateTime(2025, 1, 2, 0, 0, 0, DateTimeKind.Utc));
+
+			Assert.True(string.CompareOrdinal(older, newer) < 0);
+			Assert.Equal(new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc), ObjectId.Parse(older).CreationTime);
+		}
+
+		[Fact]
+		public void A_published_time_in_the_future_is_clamped() =>
+			Assert.True(ObjectId.Parse(PrivacyIds.At(DateTime.UtcNow.AddYears(50))).CreationTime < DateTime.UtcNow.AddDays(2));
+	}
+}
@@ -0,0 +1,126 @@
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Localization;
+using Microsoft.Extensions.Logging.Abstractions;
+
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Content;
+using PrivaPub.Domain.Social;
+using PrivaPub.Domain.Timelines;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Inbox.Handlers;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.User;
+using PrivaPub.Resources;
+using PrivaPub.Services;
+using PrivaPub.StaticServices;
+
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Support
+{
+	public sealed class Harness : IAsyncDisposable
+	{
+		public const string Host = "privapub.test";
+		public const string Base = "https://" + Host;
+
+		Harness(Peer peer)
+		{
+			Peer = peer;
+			var cache = new MemoryCache(new MemoryCacheOptions());
+			Local = new LocalActorService(Db, new StaticOptions<AppConfiguration>(new AppConfiguration { BackendBaseAddress = Base }));
+			Remote = new RemoteActorService(Peer.Http(cache), Local, cache, Db);
+			Delivery = new DeliveryService(Db, Queue);
+			Fanout = new Fanout(Db);
+			RemotePosts = new RemotePosts(Db, Local, Remote, new NoBlocks(), Queue);
+			Receiver = new InboxReceiver(Local, Remote, Queue, new NoBlocks(), NullLogger<InboxReceiver>.Instance);
+			Processor = new InboxProcessor(Remote, new IActivityHandler[]
+			{
+				new FollowHandler(Db, Local, Remote, Delivery),
+				new AcceptHandler(Db, Local),
+				new RejectHandler(Db, Local),
+				new UndoHandler(Db, Local),
+				new LikeHandler(Db),
+				new AnnounceHandler(Db, Local, RemotePosts, Fanout),
+				new CreateHandler(Db, Local, Remote, Delivery, new NoBlocks(), Fanout, RemotePosts),
+				new DeleteHandler(Db, Local, Remote, Delivery),
+				new UpdateHandler(Db, Local, Remote)
+			}, NullLogger<InboxProcessor>.Instance);
+			Follows = new FollowService(Db, Local, Remote, Delivery, new KeyLocalizer<GenericRes>(), NullLogger<FollowService>.Instance);
+			Content = new ContentRenderer(Local, Remote);
+			Outbox = new OutboxPublisher(Db, Local, Delivery);
+			Posts = new PostsService(Db, Local, Remote, Delivery, Content, Outbox, Fanout, new KeyLocalizer<GenericRes>(), NullLogger<PostsService>.Instance);
+			Timelines = new TimelineService(Db, new KeyLocalizer<GenericRes>());
+		}
+
+		public Peer Peer { get; }
+		public DbEntities Db { get; } = new();
+		public JobQueue Queue { get; } = new();
+		public LocalActorService Local { get; }
+		public RemoteActorService Remote { get; }
+		public DeliveryService Delivery { get; }
+		public InboxReceiver Receiver { get; }
+		public InboxProcessor Processor { get; }
+		public FollowService Follows { get; }
+		public ContentRenderer Content { get; }
+		public OutboxPublisher Outbox { get; }
+		public PostsService Posts { get; }
+		public Fanout Fanout { get; }
+		public RemotePosts RemotePosts { get; }
+		public TimelineService Timelines { get; }
+
+		public async Task FollowedBy(LocalActor local, RemoteActor follower) =>
+			await DB.Default.SaveAsync(new Follower
+			{
+				LocalActorId = local.Id,
+				LocalActorKind = local.Kind,
+				ActorURI = follower.Id,
+				InboxURL = follower.Id + "/inbox",
+				SharedInboxURL = follower.SharedInbox
+			});
+
+		public static async Task<Harness> Start() => new(await Peer.Start());
+
+		public async Task<(string RootId, LocalActor Avatar)> Persona(string name, string rootId = default)
+		{
+			rootId ??= Guid.NewGuid().ToString("N")[..24];
+			var (privateKey, publicKey) = Keys.NewKeyPair();
+			var avatar = new Avatar { UserName = $"{name}{Guid.NewGuid():N}"[..20], Name = name, PrivateKey = privateKey, PublicKey = publicKey };
+			await DB.Default.SaveAsync(avatar);
+			await DB.Default.SaveAsync(new RootToAvatar { RootId = rootId, AvatarId = avatar.ID });
+			return (rootId, Local.FromAvatar(avatar));
+		}
+
+		public async Task<InboxResult> Deliver(RemoteActor sender, string path, JsonNode activity)
+		{
+			var result = await Receiver.Receive(sender.Post(Host, path, activity), default, CancellationToken.None);
+			var dedupe = "inbox|" + (activity is JsonObject ? activity["id"]?.GetValue<string>() : default);
+			var job = await DB.Default.Find<Job>().Match(j => j.DedupeKey == dedupe).ExecuteFirstAsync();
+			if (job != default)
+				Assert.Equal(JobResult.Done, (await Processor.Handle(job, CancellationToken.None)).Result);
+			return result;
+		}
+
+		public async Task<List<JsonObject>> Outgoing(string inbox) =>
+			(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.Deliver).ExecuteAsync())
+				.Select(j => JsonSerializer.Deserialize<DeliveryPayload>(j.Payload))
+				.Where(p => p.Inbox == inbox)
+				.Select(p => JsonNode.Parse(p.Body)!.AsObject())
+				.ToList();
+
+		public async ValueTask DisposeAsync() => await Peer.DisposeAsync();
+	}
+
+	public sealed class KeyLocalizer<T> : IStringLocalizer<T>
+	{
+		public LocalizedString this[string name] => new(name, name);
+		public LocalizedString this[string name, params object[] arguments] => new(name, string.Format(name, arguments));
+		public IEnumerable<LocalizedString> GetAllStrings(bool includeParentCultures) => Enumerable.Empty<LocalizedString>();
+	}
+}
@@ -32,6 +32,7 @@ namespace PrivaPub.Tests.Support
 			var connection = Environment.GetEnvironmentVariable("PRIVAPUB_TEST_MONGO") ?? "mongodb://127.0.0.1:27017";
 			await DB.InitAsync(Database, MongoClientSettings.FromConnectionString(connection));
 			EntityMaps.Warm();
+			await Indexes.Create();
 		}

 		public async ValueTask DisposeAsync()
@@ -6,7 +6,9 @@ using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;

+using PrivaPub.Federation.Moderation;
 using PrivaPub.Infrastructure.Http;
+using PrivaPub.Models.Federation;

 using System.Collections.Concurrent;

@@ -16,6 +18,7 @@ namespace PrivaPub.Tests.Support
 	{
 		readonly WebApplication _app;
 		readonly ConcurrentDictionary<string, string> _documents = new();
+		readonly ConcurrentDictionary<string, (int Status, TimeSpan Delay)> _answers = new();

 		public int Port { get; }
 		public string A => $"http://127.0.0.1:{Port}";
@@ -38,6 +41,13 @@ namespace PrivaPub.Tests.Support
 			{
 				peer.Requests.Enqueue(new(context.Request.Method, context.Request.Path, context.Request.Headers["Signature"].ToString()));
 				var key = context.Request.Path.Value;
+				if (peer._answers.TryGetValue(key, out var answer))
+				{
+					if (answer.Delay > TimeSpan.Zero)
+						await Task.Delay(answer.Delay);
+					context.Response.StatusCode = answer.Status;
+					return;
+				}
 				if (!peer._documents.TryGetValue(key, out var document))
 				{
 					context.Response.StatusCode = StatusCodes.Status404NotFound;
@@ -53,7 +63,9 @@ namespace PrivaPub.Tests.Support

 		public void Serve(string path, string json) => _documents[path] = json;

-		public static FederationHttp Http(IMemoryCache cache = default)
+		public void Answer(string path, int status, TimeSpan delay = default) => _answers[path] = (status, delay);
+
+		public static FederationHttp Http(IMemoryCache cache = default, IDomainBlocks blocks = default)
 		{
 			var options = new FederationOptions { AllowPrivateNetworks = true, AllowPlainHttp = true };
 			var services = new ServiceCollection();
@@ -61,12 +73,19 @@ namespace PrivaPub.Tests.Support
 				.ConfigurePrimaryHttpMessageHandler(() => SafeHttpHandlerFactory.Create(options));
 			return new FederationHttp(services.BuildServiceProvider().GetRequiredService<IHttpClientFactory>(),
 				cache ?? new MemoryCache(new MemoryCacheOptions()), new StaticOptions<FederationOptions>(options),
-				NullLogger<FederationHttp>.Instance);
+				blocks ?? new NoBlocks(), NullLogger<FederationHttp>.Instance);
 		}

 		public async ValueTask DisposeAsync() => await _app.DisposeAsync();
 	}

+	public sealed class NoBlocks : IDomainBlocks
+	{
+		public DomainBlock Find(string host) => default;
+		public bool IsSuspended(string host) => false;
+		public Task Reload(CancellationToken token) => Task.CompletedTask;
+	}
+
 	public sealed record HttpRequestRecord(string Method, string Path, string Signature);

 	public sealed class StaticOptions<T> : IOptionsMonitor<T>
@@ -24,6 +24,7 @@ namespace PrivaPub.Tests.Support
 		public string Name { get; }
 		public string Id { get; }
 		public string KeyId => Id + "#main-key";
+		public string SharedInbox => Id.Split("/users/")[0] + "/inbox";

 		public JsonObject Document() => new()
 		{
@@ -0,0 +1,74 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Localization;
+
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels;
+using PrivaPub.ClientModels.Admin;
+using PrivaPub.Federation.Moderation;
+using PrivaPub.Models.Federation;
+using PrivaPub.Resources;
+
+namespace PrivaPub.Controllers.ClientToServer
+{
+	[ApiController,
+		Route("clientapi/admin/domainblocks"),
+		Authorize(Policy = Policies.IsAdmin)]
+	public class DomainBlockController : ControllerBase
+	{
+		readonly IDomainBlocks _domainBlocks;
+		readonly IStringLocalizer _localizer;
+
+		public DomainBlockController(IDomainBlocks domainBlocks, IStringLocalizer<GenericRes> localizer)
+		{
+			_domainBlocks = domainBlocks;
+			_localizer = localizer;
+		}
+
+		[HttpGet, Route("/clientapi/admin/domainblocks/list")]
+		public async Task<IActionResult> List(CancellationToken token) =>
+			Ok((await DB.Default.Find<DomainBlock>().Sort(b => b.Domain, Order.Ascending).ExecuteAsync(token)).Select(ToView).ToList());
+
+		[HttpPost, Route("/clientapi/admin/domainblocks/insert")]
+		public async Task<IActionResult> Insert(DomainBlockForm form, CancellationToken token)
+		{
+			var domain = DomainBlocks.Normalise(form.Domain);
+			if (!ModelState.IsValid || Uri.CheckHostName(domain) != UriHostNameType.Dns)
+				return BadRequest(new WebResult().Invalidate(_localizer["Invalid model."]));
+
+			var block = await DB.Default.UpdateAndGet<DomainBlock>()
+				.Match(b => b.Domain == domain)
+				.Modify(b => b.Domain, domain)
+				.Modify(b => b.Severity, form.Suspend ? DomainBlockSeverity.Suspend : DomainBlockSeverity.Silence)
+				.Modify(b => b.RejectMedia, form.RejectMedia)
+				.Modify(b => b.PublicComment, form.PublicComment)
+				.Modify(b => b.PrivateComment, form.PrivateComment)
+				.Modify(b => b.SetOnInsert(x => x.CreatedAt, DateTime.UtcNow))
+				.Option(o => o.IsUpsert = true)
+				.ExecuteAsync(token);
+			await _domainBlocks.Reload(token);
+			return Ok(ToView(block));
+		}
+
+		[HttpPost, Route("/clientapi/admin/domainblocks/delete")]
+		public async Task<IActionResult> Delete([FromQuery] string domain, CancellationToken token)
+		{
+			domain = DomainBlocks.Normalise(domain);
+			await DB.Default.DeleteAsync<DomainBlock>(b => b.Domain == domain);
+			await _domainBlocks.Reload(token);
+			return Ok();
+		}
+
+		static ViewDomainBlock ToView(DomainBlock block) => new()
+		{
+			Id = block.ID,
+			Domain = block.Domain,
+			Severity = block.Severity.ToString(),
+			RejectMedia = block.RejectMedia,
+			PublicComment = block.PublicComment,
+			PrivateComment = block.PrivateComment,
+			CreatedAt = block.CreatedAt
+		};
+	}
+}
@@ -32,6 +32,10 @@ namespace PrivaPub.Controllers.ClientToServer
 		public async Task<IActionResult> Insert(InsertPostForm form, CancellationToken token) =>
 			!ModelState.IsValid ? Invalid() : Answer(await _postsService.InsertPost(User.GetUserId(), form, token));

+		[HttpPost, Route("/clientapi/post/update")]
+		public async Task<IActionResult> Update(UpdatePostForm form, CancellationToken token) =>
+			!ModelState.IsValid ? Invalid() : Answer(await _postsService.UpdatePost(User.GetUserId(), form, token));
+
 		[HttpPost, Route("/clientapi/post/delete")]
 		public async Task<IActionResult> Delete(DeletePostForm form, CancellationToken token) =>
 			!ModelState.IsValid ? Invalid() : Answer(await _postsService.DeletePost(User.GetUserId(), form, token));
@@ -0,0 +1,43 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Localization;
+
+using PrivaPub.ClientModels;
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Domain.Social;
+using PrivaPub.Extensions;
+using PrivaPub.Resources;
+
+namespace PrivaPub.Controllers.ClientToServer
+{
+	[ApiController,
+		Route("clientapi/social"),
+		Authorize(Policy = Policies.IsUser)]
+	public class SocialController : ControllerBase
+	{
+		readonly IFollowService _follows;
+		readonly IStringLocalizer _localizer;
+
+		public SocialController(IFollowService follows, IStringLocalizer<GenericRes> localizer)
+		{
+			_follows = follows;
+			_localizer = localizer;
+		}
+
+		[HttpPost, Route("/clientapi/follow")]
+		public async Task<IActionResult> Follow(FollowForm form, CancellationToken token) =>
+			!ModelState.IsValid ? Invalid() : Answer(await _follows.Follow(User.GetUserId(), form, token));
+
+		[HttpPost, Route("/clientapi/unfollow")]
+		public async Task<IActionResult> Unfollow(FollowForm form, CancellationToken token) =>
+			!ModelState.IsValid ? Invalid() : Answer(await _follows.Unfollow(User.GetUserId(), form, token));
+
+		[HttpGet, Route("/clientapi/following")]
+		public async Task<IActionResult> Following([FromQuery] string avatarId, CancellationToken token) =>
+			Answer(await _follows.Followings(User.GetUserId(), avatarId, token));
+
+		IActionResult Invalid() => BadRequest(new WebResult().Invalidate(_localizer["Invalid model."]));
+
+		IActionResult Answer(WebResult result) => result.IsValid ? Ok(result.Data) : StatusCode(result.StatusCode, result);
+	}
+}
@@ -0,0 +1,38 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+using PrivaPub.ClientModels;
+using PrivaPub.Domain.Timelines;
+using PrivaPub.Extensions;
+
+namespace PrivaPub.Controllers.ClientToServer
+{
+	[ApiController,
+		Route("clientapi/timeline"),
+		Authorize(Policy = Policies.IsUser)]
+	public class TimelineController : ControllerBase
+	{
+		readonly ITimelineService _timelines;
+
+		public TimelineController(ITimelineService timelines)
+		{
+			_timelines = timelines;
+		}
+
+		[HttpGet, Route("/clientapi/timeline/home")]
+		public async Task<IActionResult> Home([FromQuery] string avatarId, [FromQuery(Name = "max_id")] string maxId, [FromQuery] int limit = 20,
+			CancellationToken token = default) =>
+			Answer(await _timelines.Home(User.GetUserId(), avatarId, maxId, limit, token));
+
+		[HttpGet, Route("/clientapi/notifications")]
+		public async Task<IActionResult> Notifications([FromQuery] string avatarId, [FromQuery(Name = "max_id")] string maxId, [FromQuery] int limit = 20,
+			CancellationToken token = default) =>
+			Answer(await _timelines.Notifications(User.GetUserId(), avatarId, maxId, limit, token));
+
+		[HttpPost, Route("/clientapi/notifications/read")]
+		public async Task<IActionResult> Read([FromQuery] string avatarId, CancellationToken token) =>
+			Answer(await _timelines.MarkNotificationsRead(User.GetUserId(), avatarId, token));
+
+		IActionResult Answer(WebResult result) => result.IsValid ? Ok(result.Data) : StatusCode(result.StatusCode, result);
+	}
+}
@@ -0,0 +1,150 @@
+using AngleSharp.Dom;
+using AngleSharp.Html.Parser;
+
+using Markdig;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Federation;
+
+using System.Net;
+using System.Text.RegularExpressions;
+
+namespace PrivaPub.Domain.Content
+{
+	public sealed record ResolvedMention(string ActorUri, string UserName, string Domain, string ProfileUrl, bool IsLocal, string AccountId, string Inbox)
+	{
+		public string Handle => $"{UserName}@{Domain}";
+	}
+
+	public sealed record RenderedContent(string Html, IReadOnlyList<ResolvedMention> Mentions, IReadOnlyList<string> Tags);
+
+	public interface IContentRenderer
+	{
+		Task<RenderedContent> Markdown(string text, CancellationToken token);
+		Task<RenderedContent> PlainText(string text, CancellationToken token);
+		string TagUrl(string tag);
+	}
+
+	public partial class ContentRenderer : IContentRenderer
+	{
+		const int MaxMentions = 20;
+		static readonly MarkdownPipeline Pipeline = new MarkdownPipelineBuilder().DisableHtml().UseAutoLinks().UseEmphasisExtras().Build();
+		static readonly HtmlParser Parser = new();
+
+		readonly ILocalActorService _localActors;
+		readonly IRemoteActorService _remoteActors;
+
+		public ContentRenderer(ILocalActorService localActors, IRemoteActorService remoteActors)
+		{
+			_localActors = localActors;
+			_remoteActors = remoteActors;
+		}
+
+		public string TagUrl(string tag) => $"{_localActors.BaseAddress}/tags/{Uri.EscapeDataString(tag)}";
+
+		public Task<RenderedContent> Markdown(string text, CancellationToken token) =>
+			Decorate(string.IsNullOrWhiteSpace(text) ? string.Empty : Markdig.Markdown.ToHtml(text, Pipeline), token);
+
+		public Task<RenderedContent> PlainText(string text, CancellationToken token)
+		{
+			if (string.IsNullOrWhiteSpace(text))
+				return Decorate(string.Empty, token);
+			var paragraphs = Regex.Split(text.Replace("\r\n", "\n").Trim(), "\n{2,}")
+				.Select(p => "<p>" + Linkify(WebUtility.HtmlEncode(p)).Replace("\n", "<br>") + "</p>");
+			return Decorate(string.Concat(paragraphs), token);
+		}
+
+		async Task<RenderedContent> Decorate(string html, CancellationToken token)
+		{
+			var document = Parser.ParseDocument($"<body>{html}</body>");
+			var textNodes = document.Body.Descendants<IText>()
+				.Where(node => !node.Ancestors<IElement>().Any(e => e.LocalName is "a" or "code" or "pre"))
+				.ToList();
+
+			var handles = textNodes.SelectMany(node => MentionPattern().Matches(node.Data).Select(m => m.Value))
+				.Distinct(StringComparer.OrdinalIgnoreCase)
+				.Take(MaxMentions)
+				.ToList();
+			var mentions = new Dictionary<string, ResolvedMention>(StringComparer.OrdinalIgnoreCase);
+			foreach (var handle in handles)
+			{
+				var resolved = await Resolve(handle, token);
+				if (resolved != default)
+					mentions[handle] = resolved;
+			}
+
+			var tags = new List<string>();
+			foreach (var node in textNodes)
+			{
+				var replaced = Replace(node.Data, mentions, tags);
+				if (replaced == default)
+					continue;
+				var fragment = Parser.ParseFragment(replaced, node.ParentElement);
+				foreach (var child in fragment.ToList())
+					node.Parent.InsertBefore(child, node);
+				node.Parent.RemoveChild(node);
+			}
+
+			return new RenderedContent(
+				ContentSanitizer.Html(document.Body.InnerHtml),
+				mentions.Values.DistinctBy(m => m.ActorUri).ToList(),
+				tags.Distinct().ToList());
+		}
+
+		string Replace(string text, IReadOnlyDictionary<string, ResolvedMention> mentions, List<string> tags)
+		{
+			var changed = false;
+			var encoded = WebUtility.HtmlEncode(text);
+			encoded = MentionPattern().Replace(encoded, match =>
+			{
+				if (!mentions.TryGetValue(WebUtility.HtmlDecode(match.Value), out var mention))
+					return match.Value;
+				changed = true;
+				return $"<span class=\"h-card\" translate=\"no\"><a href=\"{WebUtility.HtmlEncode(mention.ProfileUrl)}\" class=\"u-url mention\">@<span>{WebUtility.HtmlEncode(mention.UserName)}</span></a></span>";
+			});
+			encoded = HashtagPattern().Replace(encoded, match =>
+			{
+				var tag = match.Groups["tag"].Value;
+				if (tag.All(char.IsDigit))
+					return match.Value;
+				changed = true;
+				tags.Add(tag.ToLowerInvariant());
+				return $"{match.Groups["lead"].Value}<a href=\"{WebUtility.HtmlEncode(TagUrl(tag.ToLowerInvariant()))}\" class=\"mention hashtag\" rel=\"tag\">#<span>{tag}</span></a>";
+			});
+			return changed ? encoded : default;
+		}
+
+		async Task<ResolvedMention> Resolve(string handle, CancellationToken token)
+		{
+			var parts = handle.TrimStart('@').Split('@');
+			var localDomain = new Uri(_localActors.BaseAddress).Authority;
+			if (parts.Length == 1 || parts[1].Equals(localDomain, StringComparison.OrdinalIgnoreCase))
+			{
+				var local = await _localActors.FindByUserName(parts[0], token);
+				return local is { IsFederated: true, Kind: not LocalActorKind.Application }
+					? new ResolvedMention(local.Uri, local.UserName, local.Domain, local.Uri, true, local.Id, local.Inbox)
+					: default;
+			}
+
+			var actorUri = await _remoteActors.ResolveHandle($"{parts[0]}@{parts[1]}", token);
+			var actor = actorUri == default ? default : await _remoteActors.GetActor(actorUri, refresh: false, token);
+			return actor == default
+				? default
+				: new ResolvedMention(actor.ActorURI, actor.UserName ?? parts[0], parts[1].ToLowerInvariant(), actor.Url ?? actor.ActorURI, false, actor.ID,
+					actor.InboxURL);
+		}
+
+		static string Linkify(string encoded) =>
+			UrlPattern().Replace(encoded, match => $"<a href=\"{match.Value}\">{match.Value}</a>");
+
+		[GeneratedRegex(@"(?<![\w@/.])@[a-zA-Z0-9_]+(?:@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)+(?::\d+)?)?(?![\w@])")]
+		private static partial Regex MentionPattern();
+
+		[GeneratedRegex(@"(?<lead>^|[^\w&#/])#(?<tag>[\p{L}\p{N}_]{1,100})(?![\p{L}\p{N}_])")]
+		private static partial Regex HashtagPattern();
+
+		[GeneratedRegex(@"https?://[^\s<]+[^\s<.,;:!?)\]'""]")]
+		private static partial Regex UrlPattern();
+	}
+}
@@ -0,0 +1,42 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Group;
+using PrivaPub.Models.Post;
+
+using System.Linq.Expressions;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Domain.Privacy
+{
+	public static class VisibilityPolicy
+	{
+		public static readonly Expression<Func<Post, bool>> IsPublic = p =>
+			!p.DeletedAt.HasValue && (p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted);
+
+		static readonly Func<Post, bool> IsPublicCompiled = IsPublic.Compile();
+
+		public static async Task<bool> CanSee(Post post, string viewerAvatarId, CancellationToken token)
+		{
+			if (post == default || post.DeletedAt.HasValue)
+				return false;
+			if (IsPublicCompiled(post))
+				return true;
+			if (string.IsNullOrEmpty(viewerAvatarId))
+				return false;
+			if (post.GroupUserId == viewerAvatarId || post.Mentions.Any(m => m.IsLocal && m.AccountId == viewerAvatarId))
+				return true;
+
+			return post.Visibility switch
+			{
+				PostVisibility.Direct => !string.IsNullOrEmpty(post.ConversationId) && await DB.Default.Find<DmGroup>()
+					.Match(g => g.ID == post.ConversationId && g.Members.Any(m => !m.IsForeign && m.AvatarId == viewerAvatarId))
+					.ExecuteAnyAsync(token),
+				PostVisibility.Circle => !string.IsNullOrEmpty(post.GroupId) && await DB.Default.Find<GroupEntity>()
+					.Match(g => g.ID == post.GroupId && g.Members.Any(m => !m.IsForeign && m.AvatarId == viewerAvatarId))
+					.ExecuteAnyAsync(token),
+				_ => false
+			};
+		}
+	}
+}
@@ -0,0 +1,235 @@
+using Microsoft.Extensions.Localization;
+
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels;
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.Resources;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Domain.Social
+{
+	public interface IFollowService
+	{
+		Task<WebResult> Follow(string rootUserId, FollowForm form, CancellationToken token);
+		Task<WebResult> Unfollow(string rootUserId, FollowForm form, CancellationToken token);
+		Task<WebResult> Followings(string rootUserId, string avatarId, CancellationToken token);
+	}
+
+	public class FollowService : IFollowService
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IRemoteActorService _remoteActors;
+		readonly IDeliveryService _delivery;
+		readonly IStringLocalizer<GenericRes> _localizer;
+		readonly ILogger<FollowService> _logger;
+
+		public FollowService(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery,
+			IStringLocalizer<GenericRes> localizer, ILogger<FollowService> logger)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_remoteActors = remoteActors;
+			_delivery = delivery;
+			_localizer = localizer;
+			_logger = logger;
+		}
+
+		public async Task<WebResult> Follow(string rootUserId, FollowForm form, CancellationToken token)
+		{
+			var result = new WebResult();
+			try
+			{
+				var follower = await OwnedAvatar(rootUserId, form.AvatarId, token);
+				if (follower == default)
+					return result.Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound);
+
+				var (local, remote) = await ResolveTarget(form.Target, token);
+				if (local == default && remote == default)
+					return result.Invalidate(_localizer["Account not found."], StatusCodes.Status404NotFound);
+				if (local != default && (local.Id == follower.Id || !local.IsFederated || local.Kind == LocalActorKind.Application))
+					return result.Invalidate(_localizer["Account not found."], StatusCodes.Status404NotFound);
+
+				var targetUri = local?.Uri ?? remote.ActorURI;
+				var existing = await _dbEntities.Followings.Match(f => f.AvatarId == follower.Id && f.TargetActorURI == targetUri).ExecuteFirstAsync(token);
+				if (existing != default)
+				{
+					result.Data = ToView(existing);
+					return result;
+				}
+
+				var following = new Following
+				{
+					AvatarId = follower.Id,
+					TargetActorURI = targetUri,
+					TargetAccountId = local?.Id ?? remote.ID,
+					TargetIsLocal = local != default,
+					TargetInboxURL = local?.Inbox ?? remote.InboxURL,
+					State = local is { ManuallyApprovesFollowers: false } ? FollowState.Accepted : FollowState.Requested
+				};
+				following.ID = (string)following.GenerateNewID();
+				following.FollowActivityURI = follower.ActivityUri($"follow-{following.ID}");
+				try
+				{
+					await DB.Default.SaveAsync(following, token);
+				}
+				catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+				{
+					result.Data = ToView(await _dbEntities.Followings.Match(f => f.AvatarId == follower.Id && f.TargetActorURI == targetUri).ExecuteFirstAsync(token));
+					return result;
+				}
+
+				if (local != default)
+					await FollowLocally(follower, local, following, token);
+				else
+					await _delivery.Enqueue(follower, new[] { remote.InboxURL }, FollowActivity(follower, following), token);
+
+				result.Data = ToView(following);
+				return result;
+			}
+			catch (Exception ex)
+			{
+				_logger.LogError(ex, $"{nameof(FollowService)}.{nameof(Follow)}");
+				return result.Invalidate(_localizer["Something went wrong."], exception: ex);
+			}
+		}
+
+		public async Task<WebResult> Unfollow(string rootUserId, FollowForm form, CancellationToken token)
+		{
+			var result = new WebResult();
+			try
+			{
+				var follower = await OwnedAvatar(rootUserId, form.AvatarId, token);
+				if (follower == default)
+					return result.Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound);
+
+				var (local, remote) = await ResolveTarget(form.Target, token);
+				var targetUri = local?.Uri ?? remote?.ActorURI ?? form.Target;
+				var following = await _dbEntities.Followings.Match(f => f.AvatarId == follower.Id && f.TargetActorURI == targetUri).ExecuteFirstAsync(token);
+				if (following == default)
+					return result;
+
+				await DB.Default.DeleteAsync<Following>(following.ID);
+				if (following.TargetIsLocal)
+				{
+					await DB.Default.DeleteAsync<Follower>(f => f.LocalActorId == following.TargetAccountId && f.ActorURI == follower.Uri);
+					await DB.Default.Update<GroupEntity>().MatchID(following.TargetAccountId)
+						.Modify(b => b.PullFilter(g => g.Members, m => !m.IsForeign && m.AvatarId == follower.Id && m.Role == GroupRole.Member))
+						.ExecuteAsync(token);
+				}
+				else
+				{
+					var undo = new JsonObject
+					{
+						["@context"] = ActivityPubRenderer.ActivityStreams,
+						["id"] = follower.ActivityUri($"undo-follow-{following.ID}"),
+						["type"] = "Undo",
+						["actor"] = follower.Uri,
+						["object"] = FollowActivity(follower, following)
+					};
+					await _delivery.Enqueue(follower, new[] { following.TargetInboxURL }, undo, token);
+				}
+				return result;
+			}
+			catch (Exception ex)
+			{
+				_logger.LogError(ex, $"{nameof(FollowService)}.{nameof(Unfollow)}");
+				return result.Invalidate(_localizer["Something went wrong."], exception: ex);
+			}
+		}
+
+		public async Task<WebResult> Followings(string rootUserId, string avatarId, CancellationToken token)
+		{
+			var result = new WebResult();
+			var follower = await OwnedAvatar(rootUserId, avatarId, token);
+			if (follower == default)
+				return result.Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound);
+			result.Data = (await _dbEntities.Followings.Match(f => f.AvatarId == follower.Id).Sort(f => f.ID, Order.Descending).ExecuteAsync(token))
+				.Select(ToView).ToList();
+			return result;
+		}
+
+		async Task FollowLocally(LocalActor follower, LocalActor target, Following following, CancellationToken token)
+		{
+			await DB.Default.Update<Follower>()
+				.Match(f => f.LocalActorId == target.Id && f.LocalActorKind == target.Kind && f.ActorURI == follower.Uri)
+				.Modify(f => f.InboxURL, follower.Inbox)
+				.Modify(f => f.SharedInboxURL, follower.SharedInbox)
+				.Modify(f => f.FollowActivityURI, following.FollowActivityURI)
+				.Modify(f => f.IsAccepted, following.State == FollowState.Accepted)
+				.Modify(b => b.SetOnInsert(f => f.CreationDate, DateTime.UtcNow))
+				.Option(o => o.IsUpsert = true)
+				.ExecuteAsync(token);
+
+			if (target.Kind == LocalActorKind.Group && following.State == FollowState.Accepted)
+				await DB.Default.Update<GroupEntity>()
+					.Match(g => g.ID == target.Id && !g.Members.Any(m => !m.IsForeign && m.AvatarId == follower.Id))
+					.Modify(b => b.Push(g => g.Members, new GroupMember { AvatarId = follower.Id }))
+					.ExecuteAsync(token);
+			if (target.Kind == LocalActorKind.Person)
+				await Notifications.Add(target.Id, following.State == FollowState.Accepted ? NotificationType.Follow : NotificationType.FollowRequest,
+					follower.Id, follower.Uri, default, token);
+		}
+
+		async Task<(LocalActor Local, ForeignAvatar Remote)> ResolveTarget(string target, CancellationToken token)
+		{
+			target = target?.Trim();
+			if (string.IsNullOrEmpty(target))
+				return default;
+			if (target.StartsWith("https://", StringComparison.OrdinalIgnoreCase) || target.StartsWith("http://", StringComparison.OrdinalIgnoreCase))
+			{
+				var byUri = await _localActors.FindByUri(target, token);
+				return byUri != default ? (byUri, default) : (default, await _remoteActors.GetActor(target, refresh: false, token));
+			}
+
+			var parts = target.TrimStart('@').Split('@');
+			var localDomain = new Uri(_localActors.BaseAddress).Authority;
+			if (parts.Length == 1 || parts[1].Equals(localDomain, StringComparison.OrdinalIgnoreCase))
+				return (await _localActors.FindByUserName(parts[0], token), default);
+
+			var actorUri = await _remoteActors.ResolveHandle($"{parts[0]}@{parts[1]}", token);
+			return (default, actorUri == default ? default : await _remoteActors.GetActor(actorUri, refresh: false, token));
+		}
+
+		static JsonObject FollowActivity(LocalActor follower, Following following) => new()
+		{
+			["@context"] = ActivityPubRenderer.ActivityStreams,
+			["id"] = following.FollowActivityURI,
+			["type"] = "Follow",
+			["actor"] = follower.Uri,
+			["object"] = following.TargetActorURI
+		};
+
+		async Task<LocalActor> OwnedAvatar(string rootUserId, string avatarId, CancellationToken token)
+		{
+			if (string.IsNullOrEmpty(rootUserId) || string.IsNullOrEmpty(avatarId))
+				return default;
+			if (!await _dbEntities.RootToAvatars.Match(ra => ra.RootId == rootUserId && ra.AvatarId == avatarId).ExecuteAnyAsync(token))
+				return default;
+			return await _localActors.FindById(LocalActorKind.Person, avatarId, token);
+		}
+
+		static ViewFollowing ToView(Following following) => new()
+		{
+			Id = following.ID,
+			TargetActorURI = following.TargetActorURI,
+			TargetAccountId = following.TargetAccountId,
+			TargetIsLocal = following.TargetIsLocal,
+			State = following.State.ToString(),
+			CreatedAt = following.CreatedAt
+		};
+	}
+}
@@ -0,0 +1,32 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Models.Social;
+
+namespace PrivaPub.Domain.Social
+{
+	public static class Notifications
+	{
+		public static async Task Add(string avatarId, NotificationType type, string fromAccountId, string fromActorUri, string postId,
+			CancellationToken token)
+		{
+			if (string.IsNullOrEmpty(avatarId) || avatarId == fromAccountId)
+				return;
+			try
+			{
+				await DB.Default.SaveAsync(new Notification
+				{
+					AvatarId = avatarId,
+					Type = type,
+					FromAccountId = fromAccountId,
+					FromActorURI = fromActorUri,
+					PostId = postId,
+					DedupeKey = $"{type}|{avatarId}|{fromActorUri}|{postId}"
+				}, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+			}
+		}
+	}
+}
@@ -0,0 +1,93 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Social;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.StaticServices;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Domain.Timelines
+{
+	public interface IFanout
+	{
+		Task Distribute(Post post, CancellationToken token);
+	}
+
+	public class Fanout : IFanout
+	{
+		readonly DbEntities _dbEntities;
+
+		public Fanout(DbEntities dbEntities)
+		{
+			_dbEntities = dbEntities;
+		}
+
+		public async Task Distribute(Post post, CancellationToken token)
+		{
+			var recipients = new HashSet<string>(StringComparer.Ordinal);
+			if (!post.IsFederatedCopy && !string.IsNullOrEmpty(post.GroupUserId))
+				recipients.Add(post.GroupUserId);
+
+			switch (post.Visibility)
+			{
+				case PostVisibility.Public or PostVisibility.Unlisted or PostVisibility.FollowersOnly:
+					var followers = post.IsFederatedCopy
+						? await _dbEntities.Followings.Match(f => f.TargetActorURI == post.ActorURI && f.State == FollowState.Accepted).ExecuteAsync(token)
+						: await _dbEntities.Followings.Match(f => f.TargetAccountId == post.GroupUserId && f.TargetIsLocal && f.State == FollowState.Accepted).ExecuteAsync(token);
+					foreach (var following in followers)
+						if (await Shows(following, post, token))
+							recipients.Add(following.AvatarId);
+					break;
+				case PostVisibility.Direct when !string.IsNullOrEmpty(post.ConversationId):
+					var conversation = await _dbEntities.DmGroups.MatchID(post.ConversationId).ExecuteFirstAsync(token);
+					foreach (var member in conversation?.Members.Where(m => !m.IsForeign) ?? Enumerable.Empty<GroupMember>())
+						recipients.Add(member.AvatarId);
+					break;
+				case PostVisibility.Circle when !string.IsNullOrEmpty(post.GroupId):
+					var circle = await DB.Default.Find<GroupEntity>().MatchID(post.GroupId).ExecuteFirstAsync(token);
+					foreach (var member in circle?.Members.Where(m => !m.IsForeign) ?? Enumerable.Empty<GroupMember>())
+						recipients.Add(member.AvatarId);
+					break;
+			}
+
+			foreach (var avatarId in recipients)
+			{
+				try
+				{
+					await DB.Default.SaveAsync(new TimelineEntry
+					{
+						AvatarId = avatarId,
+						PostId = post.ID,
+						AuthorAccountId = post.AuthorAccountId ?? post.GroupUserId,
+						ReblogOfPostId = post.ReblogOfPostId
+					}, token);
+				}
+				catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+				{
+				}
+			}
+
+			if (string.IsNullOrEmpty(post.ReblogOfPostId))
+				foreach (var mention in post.Mentions.Where(m => m.IsLocal && !string.IsNullOrEmpty(m.AccountId)))
+					await Notifications.Add(mention.AccountId, NotificationType.Mention, post.AuthorAccountId ?? post.GroupUserId, post.ActorURI, post.ID, token);
+		}
+
+		async Task<bool> Shows(Following following, Post post, CancellationToken token)
+		{
+			if (!string.IsNullOrEmpty(post.ReblogOfPostId))
+				return following.ShowReblogs;
+			var repliedTo = post.InReplyToAccountId;
+			var author = post.AuthorAccountId ?? post.GroupUserId;
+			if (string.IsNullOrEmpty(post.InReplyToURI) || repliedTo == author || repliedTo == following.AvatarId)
+				return true;
+			if (string.IsNullOrEmpty(repliedTo))
+				return false;
+			return await _dbEntities.Followings
+				.Match(f => f.AvatarId == following.AvatarId && f.TargetAccountId == repliedTo && f.State == FollowState.Accepted)
+				.ExecuteAnyAsync(token);
+		}
+	}
+}
@@ -0,0 +1,119 @@
+using Microsoft.Extensions.Localization;
+
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels;
+using PrivaPub.ClientModels.Post;
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Resources;
+using PrivaPub.StaticServices;
+
+namespace PrivaPub.Domain.Timelines
+{
+	public interface ITimelineService
+	{
+		Task<WebResult> Home(string rootUserId, string avatarId, string maxId, int limit, CancellationToken token);
+		Task<WebResult> Notifications(string rootUserId, string avatarId, string maxId, int limit, CancellationToken token);
+		Task<WebResult> MarkNotificationsRead(string rootUserId, string avatarId, CancellationToken token);
+	}
+
+	public class TimelineService : ITimelineService
+	{
+		const int MaxLimit = 40;
+
+		readonly DbEntities _dbEntities;
+		readonly IStringLocalizer<GenericRes> _localizer;
+
+		public TimelineService(DbEntities dbEntities, IStringLocalizer<GenericRes> localizer)
+		{
+			_dbEntities = dbEntities;
+			_localizer = localizer;
+		}
+
+		public async Task<WebResult> Home(string rootUserId, string avatarId, string maxId, int limit, CancellationToken token)
+		{
+			var result = new WebResult();
+			if (!await Owns(rootUserId, avatarId, token))
+				return result.Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound);
+
+			var query = _dbEntities.TimelineEntries.Match(e => e.AvatarId == avatarId);
+			if (!string.IsNullOrEmpty(maxId))
+				query.Match(f => f.Lt(e => e.PostId, maxId));
+			var entries = await query.Sort(e => e.PostId, Order.Descending).Limit(Math.Clamp(limit, 1, MaxLimit)).ExecuteAsync(token);
+
+			var ids = entries.Select(e => e.PostId).Concat(entries.Where(e => e.ReblogOfPostId != default).Select(e => e.ReblogOfPostId)).Distinct().ToList();
+			var posts = ids.Count == 0
+				? new Dictionary<string, Post>()
+				: (await _dbEntities.Posts.Match(p => ids.Contains(p.ID) && !p.DeletedAt.HasValue).ExecuteAsync(token)).ToDictionary(p => p.ID);
+
+			result.Data = entries
+				.Where(e => posts.ContainsKey(e.PostId) && (e.ReblogOfPostId == default || posts.ContainsKey(e.ReblogOfPostId)))
+				.Select(e =>
+				{
+					var view = ToView(posts[e.PostId]);
+					if (e.ReblogOfPostId != default)
+						view.ReblogOf = ToView(posts[e.ReblogOfPostId]);
+					return view;
+				})
+				.ToList();
+			return result;
+		}
+
+		public async Task<WebResult> Notifications(string rootUserId, string avatarId, string maxId, int limit, CancellationToken token)
+		{
+			var result = new WebResult();
+			if (!await Owns(rootUserId, avatarId, token))
+				return result.Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound);
+
+			var query = _dbEntities.Notifications.Match(n => n.AvatarId == avatarId);
+			if (!string.IsNullOrEmpty(maxId))
+				query.Match(f => f.Lt(n => n.ID, maxId));
+			result.Data = (await query.Sort(n => n.ID, Order.Descending).Limit(Math.Clamp(limit, 1, MaxLimit)).ExecuteAsync(token))
+				.Select(n => new ViewNotification
+				{
+					Id = n.ID,
+					Type = n.Type.ToString(),
+					FromAccountId = n.FromAccountId,
+					FromActorURI = n.FromActorURI,
+					PostId = n.PostId,
+					IsRead = n.IsRead,
+					CreatedAt = n.CreatedAt
+				})
+				.ToList();
+			return result;
+		}
+
+		public async Task<WebResult> MarkNotificationsRead(string rootUserId, string avatarId, CancellationToken token)
+		{
+			var result = new WebResult();
+			if (!await Owns(rootUserId, avatarId, token))
+				return result.Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound);
+			await DB.Default.Update<Notification>().Match(n => n.AvatarId == avatarId && !n.IsRead).Modify(n => n.IsRead, true).ExecuteAsync(token);
+			return result;
+		}
+
+		async Task<bool> Owns(string rootUserId, string avatarId, CancellationToken token) =>
+			!string.IsNullOrEmpty(rootUserId) && !string.IsNullOrEmpty(avatarId)
+			&& await _dbEntities.RootToAvatars.Match(ra => ra.RootId == rootUserId && ra.AvatarId == avatarId).ExecuteAnyAsync(token);
+
+		static ViewPost ToView(Post post) => new()
+		{
+			Id = post.ID,
+			ObjectURI = post.ObjectURI,
+			AuthorAvatarId = post.IsFederatedCopy ? default : post.GroupUserId,
+			AuthorActorURI = post.ActorURI,
+			GroupId = post.GroupId,
+			DmGroupId = post.ConversationId,
+			Visibility = post.Visibility.ToString(),
+			AnsweringToPostId = post.AnsweringToPostId,
+			Title = post.Title,
+			Text = post.Text,
+			ContentHtml = post.ContentHtml,
+			HasContentWarning = post.HasContentWarning,
+			IsFederatedCopy = post.IsFederatedCopy,
+			CreationDate = post.CreationDate
+		};
+	}
+}
@@ -18,6 +18,8 @@ namespace PrivaPub.Federation.Actors
 		public string Url { get; init; }
 		public string Inbox { get; init; }
 		public string Outbox { get; init; }
+		public string Followers { get; init; }
+		public string Following { get; init; }
 		public string SharedInbox { get; init; }
 		public string Icon { get; init; }
 		public bool Discoverable { get; init; } = true;
@@ -45,6 +47,8 @@ namespace PrivaPub.Federation.Actors
 				Url = RemoteActorService.Text(root, "url") ?? id,
 				Inbox = Origin.Same(inbox, id) ? inbox : default,
 				Outbox = RemoteActorService.Text(root, "outbox"),
+				Followers = RemoteActorService.Text(root, "followers"),
+				Following = RemoteActorService.Text(root, "following"),
 				SharedInbox = root.TryGetProperty("endpoints", out var endpoints) ? RemoteActorService.Text(endpoints, "sharedInbox") : default,
 				Icon = root.TryGetProperty("icon", out var icon) ? RemoteActorService.Text(icon, "url") : default,
 				Discoverable = !root.TryGetProperty("discoverable", out var discoverable) || discoverable.ValueKind != JsonValueKind.False,
@@ -31,18 +31,22 @@ namespace PrivaPub.Federation.Actors
 		public bool IsFederated { get; init; } = true;
 		public DateTime Published { get; init; }
 		public string BaseAddress { get; init; }
+		public IReadOnlyDictionary<string, string> Fields { get; init; } = new Dictionary<string, string>();

 		public string Uri => $"{BaseAddress}/peasants/{UserName}";
 		public string KeyId => $"{Uri}#main-key";
 		public string Inbox => $"{Uri}/mouth";
 		public string Outbox => $"{Uri}/anus";
-		public string Followers => $"{Uri}/followers";
-		public string Following => $"{Uri}/following";
+		public string Followers => $"{Uri}/groupies";
+		public string Following => $"{Uri}/stalking";
 		public string SharedInbox => $"{BaseAddress}/human-centipede";
 		public string Domain => new Uri(BaseAddress).Authority;
 		public string Handle => $"{UserName}@{Domain}";
-		public string PostUri(string postId) => $"{Uri}/posts/{postId}";
-		public string ActivityUri(string activityId) => $"{Uri}/activities/{activityId}";
+		public string HtmlUrl => $"{BaseAddress}/@{UserName}";
+		public string PostUri(string postId) => $"{Uri}/scribbles/{postId}";
+		public string PostHtmlUrl(string postId) => $"{HtmlUrl}/{postId}";
+		public string ActivityUri(string activityId) => $"{Uri}/grunts/{activityId}";
+		public string ConversationUri(string conversationId) => $"{Uri}/whispers/{conversationId}";
 	}

 	public interface ILocalActorService
@@ -190,6 +194,7 @@ namespace PrivaPub.Federation.Actors
 			PrivateKeyPem = avatar.PrivateKey,
 			PublicKeyPem = avatar.PublicKey,
 			Published = avatar.CreatedAt,
+			Fields = avatar.Fields ?? new Dictionary<string, string>(),
 			BaseAddress = BaseAddress
 		};

@@ -163,6 +163,8 @@ namespace PrivaPub.Federation.Actors
 				.Modify(a => a.Domain, new Uri(actor.Id).Authority)
 				.Modify(a => a.InboxURL, actor.Inbox)
 				.Modify(a => a.OutboxURL, actor.Outbox)
+				.Modify(a => a.FollowersURL, actor.Followers)
+				.Modify(a => a.FollowingURL, actor.Following)
 				.Modify(a => a.SharedInboxURL, actor.SharedInbox)
 				.Modify(a => a.PictureURL, actor.Icon)
 				.Modify(a => a.IsDiscoverable, actor.Discoverable)
@@ -4,11 +4,13 @@ using Microsoft.AspNetCore.RateLimiting;
 using MongoDB.Entities;

 using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
 using PrivaPub.StaticServices;

 using System.Text.Json.Nodes;

 using PostEntity = PrivaPub.Models.Post.Post;
+using PrivaPub.Domain.Privacy;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Rendering;
 using PrivaPub.Federation.Inbox;
@@ -23,11 +25,11 @@ namespace PrivaPub.Federation.Controllers
 		const int OutboxSize = 20;

 		readonly ILocalActorService _localActors;
-		readonly IInboxService _inbox;
+		readonly IInboxReceiver _inbox;
 		readonly DbEntities _dbEntities;
 		readonly ILogger<PeasantsController> _logger;

-		public PeasantsController(ILocalActorService localActors, IInboxService inbox, DbEntities dbEntities,
+		public PeasantsController(ILocalActorService localActors, IInboxReceiver inbox, DbEntities dbEntities,
 			ILogger<PeasantsController> logger)
 		{
 			_localActors = localActors;
@@ -40,26 +42,35 @@ namespace PrivaPub.Federation.Controllers
 		public async Task<IActionResult> GetActor(string actor, CancellationToken token)
 		{
 			var local = await _localActors.FindByUserName(actor, token);
-			return local is not { IsFederated: true } ? NotFound() : Activity(ActivityPubRenderer.Actor(local));
+			if (local is not { IsFederated: true })
+				return NotFound();
+			if (WantsHtml() && local.Kind != LocalActorKind.Application)
+				return Redirect(local.HtmlUrl);
+			return Activity(ActivityPubRenderer.Actor(local));
 		}

 		[HttpGet, Route("{actor}/anus")]
-		public async Task<IActionResult> Outbox(string actor, CancellationToken token)
+		public async Task<IActionResult> Outbox(string actor, [FromQuery] bool page, [FromQuery(Name = "max_id")] string maxId,
+			CancellationToken token)
 		{
 			var local = await _localActors.FindByUserName(actor, token);
 			if (local is not { IsFederated: true })
 				return NotFound();

-			var total = local.Kind == LocalActorKind.Group
-				? await DB.Default.CountAsync<PostEntity>(p => p.GroupId == local.Id && !p.IsLocalOnly, token)
-				: await DB.Default.CountAsync<PostEntity>(p => p.GroupUserId == local.Id && !p.IsFederatedCopy && !p.IsLocalOnly, token);
+			if (!page)
+			{
+				var total = local.Kind == LocalActorKind.Group
+					? await DB.Default.CountAsync<PostEntity>(f => f.Where(p => p.GroupId == local.Id) & f.Where(VisibilityPolicy.IsPublic), token)
+					: await DB.Default.CountAsync<PostEntity>(f => f.Where(p => p.GroupUserId == local.Id && !p.IsFederatedCopy) & f.Where(VisibilityPolicy.IsPublic), token);
+				return Activity(ActivityPubRenderer.OrderedCollection(local.Outbox, (int)total, default, $"{local.Outbox}?page=true"));
+			}

-			var latest = await (local.Kind == LocalActorKind.Group
-					? _dbEntities.Posts.Match(p => p.GroupId == local.Id && !p.IsLocalOnly)
-					: _dbEntities.Posts.Match(p => p.GroupUserId == local.Id && !p.IsFederatedCopy && !p.IsLocalOnly))
-				.Sort(p => p.CreationDate, Order.Descending)
-				.Limit(OutboxSize)
-				.ExecuteAsync(token);
+			var query = local.Kind == LocalActorKind.Group
+				? _dbEntities.Posts.Match(p => p.GroupId == local.Id).Match(VisibilityPolicy.IsPublic)
+				: _dbEntities.Posts.Match(p => p.GroupUserId == local.Id && !p.IsFederatedCopy).Match(VisibilityPolicy.IsPublic);
+			if (!string.IsNullOrEmpty(maxId))
+				query.Match(f => f.Lt(p => p.ID, maxId));
+			var latest = await query.Sort(p => p.ID, Order.Descending).Limit(OutboxSize).ExecuteAsync(token);

 			var items = new List<JsonNode>();
 			foreach (var post in latest)
@@ -69,15 +80,15 @@ namespace PrivaPub.Federation.Controllers
 					items.Add(ActivityPubRenderer.Announce(local, post.ObjectURI, $"announce-{post.ID}"));
 					continue;
 				}
-				var group = string.IsNullOrEmpty(post.GroupId) ? default : await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
-				var note = ActivityPubRenderer.Note(post, local, group, default);
-				items.Add(ActivityPubRenderer.Create(local, note, $"create-{post.ID}"));
+				items.Add(await CreateFor(post, local, token));
 			}

-			return Activity(ActivityPubRenderer.OrderedCollection(local.Outbox, (int)total, items));
+			var pageId = string.IsNullOrEmpty(maxId) ? $"{local.Outbox}?page=true" : $"{local.Outbox}?page=true&max_id={maxId}";
+			var next = latest.Count == OutboxSize ? $"{local.Outbox}?page=true&max_id={latest[^1].ID}" : default;
+			return Activity(ActivityPubRenderer.OrderedCollectionPage(pageId, local.Outbox, items, next, default));
 		}

-		[HttpGet, Route("{actor}/followers")]
+		[HttpGet, Route("{actor}/groupies")]
 		public async Task<IActionResult> Followers(string actor, CancellationToken token)
 		{
 			var local = await _localActors.FindByUserName(actor, token);
@@ -88,33 +99,37 @@ namespace PrivaPub.Federation.Controllers
 			return Activity(ActivityPubRenderer.OrderedCollection(local.Followers, (int)count, default));
 		}

-		[HttpGet, Route("{actor}/following")]
+		[HttpGet, Route("{actor}/stalking")]
 		public async Task<IActionResult> Following(string actor, CancellationToken token)
 		{
 			var local = await _localActors.FindByUserName(actor, token);
-			return local is not { IsFederated: true } ? NotFound() : Activity(ActivityPubRenderer.OrderedCollection(local.Following, 0, Enumerable.Empty<JsonNode>()));
+			return local is not { IsFederated: true } ? NotFound() : Activity(ActivityPubRenderer.OrderedCollection(local.Following, 0, default));
 		}

-		[HttpGet, Route("{actor}/posts/{postId}")]
+		[HttpGet, Route("{actor}/scribbles/{postId}")]
 		public async Task<IActionResult> Post(string actor, string postId, CancellationToken token)
 		{
-			var local = await _localActors.FindByUserName(actor, token);
-			if (local == default || local.Kind != LocalActorKind.Person)
-				return NotFound();
-
-			var post = await _dbEntities.Posts
-				.Match(p => p.ID == postId && p.GroupUserId == local.Id && !p.IsFederatedCopy && !p.IsLocalOnly)
-				.ExecuteFirstAsync(token);
+			var (local, post) = await PublicPost(actor, postId, token);
 			if (post == default)
-				return NotFound();
+				return await Tombstone(actor, postId, token) ?? NotFound();
+			if (WantsHtml())
+				return Redirect(local.PostHtmlUrl(post.ID));

 			var group = string.IsNullOrEmpty(post.GroupId) ? default : await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
-			var replyTo = await ReplyTarget(post.AnsweringToPostId, token);
-			var note = ActivityPubRenderer.Note(post, local, group, replyTo);
-			note["@context"] = ActivityPubRenderer.ActivityStreams;
+			var note = ActivityPubRenderer.Note(post, local, group, post.InReplyToURI);
+			note["@context"] = ActivityPubRenderer.Context();
 			return Activity(note);
 		}

+		[HttpGet, Route("{actor}/grunts/{activityId}")]
+		public async Task<IActionResult> Grunt(string actor, string activityId, CancellationToken token)
+		{
+			if (!activityId.StartsWith("create-", StringComparison.Ordinal))
+				return NotFound();
+			var (local, post) = await PublicPost(actor, activityId["create-".Length..], token);
+			return post == default ? NotFound() : Activity(await CreateFor(post, local, token));
+		}
+
 		[HttpPost, Route("{actor}/mouth"), EnableRateLimiting(RateLimiting.Inbox)]
 		public async Task<IActionResult> Inbox(string actor, CancellationToken token)
 		{
@@ -132,13 +147,53 @@ namespace PrivaPub.Federation.Controllers
 		public async Task<IActionResult> SharedInbox(CancellationToken token) =>
 			Answer(await _inbox.Receive(Request, default, token));

-		async Task<string> ReplyTarget(string answeringToPostId, CancellationToken token)
+		async Task<(LocalActor Actor, PostEntity Post)> PublicPost(string actor, string postId, CancellationToken token)
 		{
-			if (string.IsNullOrEmpty(answeringToPostId))
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local is not { IsFederated: true, Kind: LocalActorKind.Person })
 				return default;
-			if (answeringToPostId.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
-				return answeringToPostId;
-			return (await _dbEntities.Posts.MatchID(answeringToPostId).ExecuteFirstAsync(token))?.ObjectURI;
+			var post = await _dbEntities.Posts
+				.Match(p => p.ID == postId && p.GroupUserId == local.Id && !p.IsFederatedCopy)
+				.Match(VisibilityPolicy.IsPublic)
+				.ExecuteFirstAsync(token);
+			return (local, post);
+		}
+
+		async Task<IActionResult> Tombstone(string actor, string postId, CancellationToken token)
+		{
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local is not { IsFederated: true, Kind: LocalActorKind.Person })
+				return default;
+			var deleted = await _dbEntities.Posts
+				.Match(p => p.ID == postId && p.GroupUserId == local.Id && !p.IsFederatedCopy && p.DeletedAt.HasValue
+					&& (p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted))
+				.ExecuteFirstAsync(token);
+			if (deleted == default)
+				return default;
+			var tombstone = new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.ActivityStreams,
+				["id"] = local.PostUri(deleted.ID),
+				["type"] = "Tombstone",
+				["formerType"] = "Note",
+				["deleted"] = ActivityPubRenderer.Timestamp(deleted.DeletedAt.Value)
+			};
+			return new ContentResult { Content = tombstone.ToJsonString(), ContentType = ActivityContentType, StatusCode = StatusCodes.Status410Gone };
+		}
+
+		async Task<JsonObject> CreateFor(PostEntity post, LocalActor author, CancellationToken token)
+		{
+			var group = string.IsNullOrEmpty(post.GroupId) ? default : await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
+			var note = ActivityPubRenderer.Note(post, author, group, post.InReplyToURI);
+			return ActivityPubRenderer.Create(author, note, $"create-{post.ID}");
+		}
+
+		bool WantsHtml()
+		{
+			var accept = Request.Headers.Accept.ToString();
+			return accept.Contains("text/html", StringComparison.OrdinalIgnoreCase)
+				&& !accept.Contains("activity+json", StringComparison.OrdinalIgnoreCase)
+				&& !accept.Contains("ld+json", StringComparison.OrdinalIgnoreCase);
 		}

 		IActionResult Answer(InboxResult result)
@@ -3,12 +3,14 @@ using Microsoft.AspNetCore.Mvc;
 using MongoDB.Entities;

 using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
 using PrivaPub.Models.User;
 using PrivaPub.StaticServices;

 using System.Text.Json.Nodes;

 using PostEntity = PrivaPub.Models.Post.Post;
+using PrivaPub.Domain.Privacy;
 using PrivaPub.Federation.Actors;

 namespace PrivaPub.Federation.Controllers
@@ -49,10 +51,12 @@ namespace PrivaPub.Federation.Controllers
 			var document = new JsonObject
 			{
 				["subject"] = $"acct:{actor.Handle}",
-				["aliases"] = new JsonArray(actor.Uri),
-				["links"] = new JsonArray(
-					new JsonObject { ["rel"] = "self", ["type"] = "application/activity+json", ["href"] = actor.Uri },
-					new JsonObject { ["rel"] = "http://webfinger.net/rel/profile-page", ["type"] = "text/html", ["href"] = actor.Uri })
+				["aliases"] = actor.Kind == LocalActorKind.Application ? new JsonArray(actor.Uri) : new JsonArray(actor.HtmlUrl, actor.Uri),
+				["links"] = actor.Kind == LocalActorKind.Application
+					? new JsonArray(new JsonObject { ["rel"] = "self", ["type"] = "application/activity+json", ["href"] = actor.Uri })
+					: new JsonArray(
+						new JsonObject { ["rel"] = "http://webfinger.net/rel/profile-page", ["type"] = "text/html", ["href"] = actor.HtmlUrl },
+						new JsonObject { ["rel"] = "self", ["type"] = "application/activity+json", ["href"] = actor.Uri })
 			};
 			return Content(document.ToJsonString(), "application/jrd+json; charset=utf-8");
 		}
@@ -62,24 +66,36 @@ namespace PrivaPub.Federation.Controllers
 		{
 			var document = new JsonObject
 			{
-				["links"] = new JsonArray(new JsonObject
-				{
-					["rel"] = "http://nodeinfo.diaspora.software/ns/schema/2.0",
-					["href"] = $"{_localActors.BaseAddress}/nodeinfo/2.0"
-				})
+				["links"] = new JsonArray(
+					new JsonObject
+					{
+						["rel"] = "http://nodeinfo.diaspora.software/ns/schema/2.1",
+						["href"] = $"{_localActors.BaseAddress}/nodeinfo/2.1"
+					},
+					new JsonObject
+					{
+						["rel"] = "http://nodeinfo.diaspora.software/ns/schema/2.0",
+						["href"] = $"{_localActors.BaseAddress}/nodeinfo/2.0"
+					})
 			};
 			return Content(document.ToJsonString(), "application/json; charset=utf-8");
 		}

-		[HttpGet, Route("/nodeinfo/2.0")]
-		public async Task<IActionResult> NodeInfo(CancellationToken token)
+		[HttpGet, Route("/nodeinfo/{version:regex(^2\\.[[01]]$)}")]
+		public async Task<IActionResult> NodeInfo(string version, CancellationToken token)
 		{
 			var users = await DB.Default.CountAsync<Avatar>(a => !a.DeletionAt.HasValue, token);
-			var posts = await DB.Default.CountAsync<PostEntity>(p => !p.IsFederatedCopy, token);
+			var posts = await DB.Default.CountAsync<PostEntity>(f => f.Where(p => !p.IsFederatedCopy) & f.Where(VisibilityPolicy.IsPublic), token);
+			var software = new JsonObject { ["name"] = "privapub", ["version"] = BuildInfo.Ref };
+			if (version == "2.1")
+			{
+				software["repository"] = "https://git.thepra.dev/thepra/SocialPub";
+				software["homepage"] = "https://git.thepra.dev/thepra/SocialPub";
+			}
 			var document = new JsonObject
 			{
-				["version"] = "2.0",
-				["software"] = new JsonObject { ["name"] = "privapub", ["version"] = BuildInfo.Ref },
+				["version"] = version,
+				["software"] = software,
 				["protocols"] = new JsonArray("activitypub"),
 				["services"] = new JsonObject { ["inbound"] = new JsonArray(), ["outbound"] = new JsonArray() },
 				["openRegistrations"] = true,
@@ -88,9 +104,15 @@ namespace PrivaPub.Federation.Controllers
 					["users"] = new JsonObject { ["total"] = users },
 					["localPosts"] = posts
 				},
-				["metadata"] = new JsonObject()
+				["metadata"] = new JsonObject
+				{
+					["nodeName"] = "PrivaPub",
+					["nodeDescription"] = "A small ActivityPub server where one private login keeps several unlinkable public personas.",
+					["federation"] = new JsonObject { ["document"] = "https://git.thepra.dev/thepra/SocialPub/src/branch/master/FEDERATION.md" }
+				}
 			};
-			return Content(document.ToJsonString(), "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.0#\"; charset=utf-8");
+			return Content(document.ToJsonString(),
+				$"application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/{version}#\"; charset=utf-8");
 		}
 	}
 }
@@ -0,0 +1,37 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Federation.Inbox
+{
+	public static class ForeignMembers
+	{
+		public static async Task<bool> IsAcceptedFollower(LocalActor group, string actorUri, CancellationToken token) =>
+			await DB.Default.Find<Follower>()
+				.Match(f => f.LocalActorId == group.Id && f.LocalActorKind == LocalActorKind.Group && f.ActorURI == actorUri && f.IsAccepted)
+				.ExecuteAnyAsync(token);
+
+		public static async Task AddForeignMember(string groupId, string actorUri, CancellationToken token)
+		{
+			var group = await DB.Default.Find<GroupEntity>().MatchID(groupId).ExecuteFirstAsync(token);
+			if (group == default || group.Members.Any(m => m.IsForeign && m.AvatarId == actorUri))
+				return;
+			group.Members.Add(new GroupMember { AvatarId = actorUri, IsForeign = true });
+			group.UpdatedAt = DateTime.UtcNow;
+			await DB.Default.SaveAsync(group, token);
+		}
+
+		public static async Task RemoveForeignMember(string groupId, string actorUri, CancellationToken token)
+		{
+			var group = await DB.Default.Find<GroupEntity>().MatchID(groupId).ExecuteFirstAsync(token);
+			if (group == default || group.Members.RemoveAll(m => m.IsForeign && m.AvatarId == actorUri) == 0)
+				return;
+			group.UpdatedAt = DateTime.UtcNow;
+			await DB.Default.SaveAsync<GroupEntity>(group, token);
+		}
+	}
+}
@@ -0,0 +1,67 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class AcceptHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+
+		public AcceptHandler(DbEntities dbEntities, ILocalActorService localActors)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+		}
+
+		public virtual string Type => "Accept";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var following = await FindFollowing(activity["object"], actor, _dbEntities, _localActors, token);
+			if (following == default)
+				return;
+			await Apply(following, token);
+		}
+
+		protected virtual Task Apply(Following following, CancellationToken token) =>
+			DB.Default.Update<Following>().MatchID(following.ID).Modify(f => f.State, FollowState.Accepted).ExecuteAsync(token);
+
+		public static async Task<Following> FindFollowing(JsonNode follow, ForeignAvatar target, DbEntities dbEntities, ILocalActorService localActors,
+			CancellationToken token)
+		{
+			if (follow is JsonObject && Value(follow, "type") is { } type && type != "Follow")
+				return default;
+			var followId = Id(follow);
+			var byId = followId == default
+				? default
+				: await dbEntities.Followings.Match(f => f.FollowActivityURI == followId && f.TargetActorURI == target.ActorURI).ExecuteFirstAsync(token);
+			if (byId != default || follow is not JsonObject)
+				return byId;
+
+			var follower = await localActors.FindByUri(Id(follow["actor"]), token);
+			return follower == default
+				? default
+				: await dbEntities.Followings.Match(f => f.AvatarId == follower.Id && f.TargetActorURI == target.ActorURI).ExecuteFirstAsync(token);
+		}
+	}
+
+	public class RejectHandler : AcceptHandler
+	{
+		public RejectHandler(DbEntities dbEntities, ILocalActorService localActors) : base(dbEntities, localActors)
+		{
+		}
+
+		public override string Type => "Reject";
+
+		protected override Task Apply(Following following, CancellationToken token) => DB.Default.DeleteAsync<Following>(following.ID);
+	}
+}
@@ -0,0 +1,106 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Social;
+using PrivaPub.Domain.Timelines;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Infrastructure.Ids;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Globalization;
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class AnnounceHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IRemotePosts _remotePosts;
+		readonly IFanout _fanout;
+
+		public AnnounceHandler(DbEntities dbEntities, ILocalActorService localActors, IRemotePosts remotePosts, IFanout fanout)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_remotePosts = remotePosts;
+			_fanout = fanout;
+		}
+
+		public string Type => "Announce";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var inner = activity["object"];
+			if (inner is JsonObject && Value(inner, "type") is "Create" or "Update" or "Delete" or "Like" or "Dislike" or "Undo" or "Add" or "Remove" or "Block")
+				return;
+			var objectUri = Id(inner);
+			var announceId = Id(activity);
+			if (objectUri == default || announceId == default)
+				return;
+			if (await _dbEntities.Posts.Match(p => p.ObjectURI == announceId).ExecuteAnyAsync(token))
+				return;
+
+			var isLocal = objectUri.StartsWith(_localActors.BaseAddress + "/", StringComparison.OrdinalIgnoreCase);
+			var original = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
+			var followed = await _dbEntities.Followings.Match(f => f.TargetActorURI == actor.ActorURI && f.State == FollowState.Accepted).ExecuteAnyAsync(token);
+			if (original is not { IsFederatedCopy: false } && !followed)
+				return;
+			if (original == default && !isLocal)
+				original = await _remotePosts.StoreContext(objectUri, 0, token);
+			if (original == default || original.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted))
+				return;
+
+			var to = Strings(activity["to"]);
+			var cc = Strings(activity["cc"]);
+			var published = DateTimeOffset.TryParse(Value(activity, "published"), CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal, out var at)
+				? at.UtcDateTime
+				: DateTime.UtcNow;
+			var reblog = new PostEntity
+			{
+				ID = PrivacyIds.At(published),
+				ObjectURI = announceId,
+				ActivityURI = announceId,
+				ActorURI = actor.ActorURI,
+				AuthorAccountId = actor.ID,
+				ReblogOfPostId = original.ID,
+				Visibility = Addressing.Classify(to, cc, actor.FollowersURL),
+				To = to,
+				Cc = cc,
+				IsFederatedCopy = true,
+				CreationDate = published,
+				UpdateDate = published
+			};
+			if (reblog.Visibility == PostVisibility.Direct)
+				return;
+			try
+			{
+				await DB.Default.SaveAsync(reblog, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return;
+			}
+
+			await DB.Default.Update<PostEntity>().MatchID(original.ID).Modify(b => b.Inc(p => p.ReblogsCount, 1)).ExecuteAsync(token);
+			if (!original.IsFederatedCopy)
+				await Notifications.Add(original.GroupUserId, NotificationType.Reblog, actor.ID, actor.ActorURI, original.ID, token);
+			await _fanout.Distribute(reblog, token);
+		}
+
+		static List<string> Strings(JsonNode node) => node switch
+		{
+			JsonArray array => array.Select(Id).Where(id => id != default).ToList(),
+			JsonNode single when Id(single) is { } id => new List<string> { id },
+			_ => new List<string>()
+		};
+	}
+}
@@ -0,0 +1,171 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Timelines;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Moderation;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Infrastructure.Ids;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Inbox.ForeignMembers;
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class CreateHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IRemoteActorService _remoteActors;
+		readonly IDeliveryService _delivery;
+		readonly IDomainBlocks _domainBlocks;
+		readonly IFanout _fanout;
+		readonly IRemotePosts _remotePosts;
+
+		public CreateHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery,
+			IDomainBlocks domainBlocks, IFanout fanout, IRemotePosts remotePosts)
+		{
+			_fanout = fanout;
+			_remotePosts = remotePosts;
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_remoteActors = remoteActors;
+			_delivery = delivery;
+			_domainBlocks = domainBlocks;
+		}
+
+		public string Type => "Create";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar author, CancellationToken token)
+		{
+			var node = activity["object"];
+			if (node is not JsonObject || !Origin.Same(Id(node), author.ActorURI))
+			{
+				using var fetched = await _remoteActors.FetchObject(Id(node), token);
+				node = fetched == default ? default : JsonNode.Parse(fetched.Root.GetRawText());
+			}
+			var note = NoteParser.Parse(node);
+			if (note == default || note.AttributedTo != author.ActorURI)
+				return;
+			if (await _dbEntities.Posts.Match(p => p.ObjectURI == note.Id).ExecuteAnyAsync(token))
+				return;
+
+			var to = note.To.Concat(Strings(activity["to"])).Distinct(StringComparer.Ordinal).ToList();
+			var cc = note.Cc.Concat(Strings(activity["cc"])).Distinct(StringComparer.Ordinal).ToList();
+			var visibility = Addressing.Classify(to, cc, author.FollowersURL);
+
+			var addressed = to.Concat(cc)
+				.Concat(Addresses(activity))
+				.Concat(note.Mentions.Select(m => m.ActorURI))
+				.Append(note.Audience)
+				.Where(a => a != default && !Addressing.IsPublic(a) && a != author.FollowersURL)
+				.Distinct(StringComparer.Ordinal)
+				.ToList();
+			var localTargets = new List<LocalActor>();
+			foreach (var uri in addressed)
+			{
+				var local = await _localActors.FindByUri(uri, token);
+				if (local is { IsFederated: true } && localTargets.All(l => l.Id != local.Id))
+					localTargets.Add(local);
+			}
+			var persons = localTargets.Where(t => t.Kind == LocalActorKind.Person).ToList();
+
+			var parent = string.IsNullOrEmpty(note.InReplyTo)
+				? default
+				: await _dbEntities.Posts.Match(p => p.ObjectURI == note.InReplyTo && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			var group = visibility is PostVisibility.Public or PostVisibility.Unlisted
+				? localTargets.FirstOrDefault(t => t.Kind == LocalActorKind.Group)
+				: default;
+			if (group != default && !await IsAcceptedFollower(group, author.ActorURI, token))
+				group = default;
+
+			var repliesToLocal = parent is { IsFederatedCopy: false } && visibility != PostVisibility.Direct;
+			var followed = visibility != PostVisibility.Direct && await _dbEntities.Followings
+				.Match(f => f.TargetActorURI == author.ActorURI && f.State == FollowState.Accepted)
+				.ExecuteAnyAsync(token);
+			if (visibility == PostVisibility.Direct ? persons.Count == 0 : group == default && persons.Count == 0 && !repliesToLocal && !followed)
+				return;
+			if (parent == default && visibility != PostVisibility.Direct)
+				parent = await _remotePosts.Parent(note.InReplyTo, 1, token);
+
+			DmGroup conversation = default;
+			if (visibility == PostVisibility.Direct)
+			{
+				var participants = persons.Select(p => p.Uri)
+					.Concat(addressed.Where(a => !IsCollection(a)))
+					.Append(author.ActorURI)
+					.ToList();
+				conversation = await FindOrCreateConversation(participants, Origin.Same(note.Context, author.ActorURI) ? note.Context : default, token);
+			}
+
+			var post = await _remotePosts.Build(note, author, visibility, to, cc, parent, token);
+			post.ActivityURI = Id(activity);
+			post.GroupId = group?.Id;
+			post.ConversationId = conversation?.ID;
+			try
+			{
+				await DB.Default.SaveAsync(post, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return;
+			}
+
+			if (parent != default)
+				await DB.Default.Update<PostEntity>().MatchID(parent.ID).Modify(b => b.Inc(p => p.RepliesCount, 1)).ExecuteAsync(token);
+			await _fanout.Distribute(post, token);
+			if (conversation != default)
+				await DB.Default.Update<DmGroup>().MatchID(conversation.ID).Modify(g => g.UpdatedAt, DateTime.UtcNow).ExecuteAsync(token);
+			if (group != default)
+			{
+				var announce = ActivityPubRenderer.Announce(group, note.Id, $"announce-{post.ID}");
+				await _delivery.EnqueueToFollowers(group, announce, token);
+			}
+		}
+
+		async Task<DmGroup> FindOrCreateConversation(List<string> participantUris, string context, CancellationToken token)
+		{
+			var members = new List<GroupMember>();
+			foreach (var uri in participantUris.Distinct(StringComparer.Ordinal))
+			{
+				var local = await _localActors.FindByUri(uri, token);
+				var member = local != default && local.Kind == LocalActorKind.Person
+					? new GroupMember { AvatarId = local.Id }
+					: new GroupMember { AvatarId = uri, IsForeign = true };
+				if (members.All(m => m.AvatarId != member.AvatarId || m.IsForeign != member.IsForeign))
+					members.Add(member);
+			}
+
+			var key = DmGroup.KeyOf(members);
+			var match = await _dbEntities.DmGroups.Match(g => g.ParticipantsKey == key && !g.DeletionAt.HasValue).ExecuteFirstAsync(token);
+			if (match != default)
+				return match;
+
+			var conversation = new DmGroup { Members = members, ConversationURI = context, ParticipantsKey = key };
+			await DB.Default.SaveAsync(conversation, token);
+			return conversation;
+		}
+
+		static bool IsCollection(string uri) =>
+			uri.EndsWith("/followers", StringComparison.Ordinal) || uri.EndsWith("/following", StringComparison.Ordinal);
+
+		static IEnumerable<string> Strings(JsonNode node) => node switch
+		{
+			JsonArray array => array.Select(Id).Where(id => id != default),
+			JsonNode single when Id(single) is { } id => new[] { id },
+			_ => Enumerable.Empty<string>()
+		};
+	}
+}
@@ -0,0 +1,75 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Inbox.ForeignMembers;
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class DeleteHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IRemoteActorService _remoteActors;
+		readonly IDeliveryService _delivery;
+
+		public DeleteHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_remoteActors = remoteActors;
+			_delivery = delivery;
+		}
+
+		public string Type => "Delete";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var delete = activity;
+
+			var objectUri = Id(delete["object"]);
+			if (!Origin.Same(objectUri, actor.ActorURI))
+				return;
+
+			if (objectUri == actor.ActorURI)
+			{
+				actor.DeletionAt = DateTime.UtcNow;
+				actor.AccountState = AvatarAccountState.Deleted;
+				await DB.Default.SaveAsync(actor, token);
+				var followers = await _dbEntities.Followers.Match(f => f.ActorURI == actor.ActorURI).ExecuteAsync(token);
+				foreach (var follower in followers)
+				{
+					await DB.Default.DeleteAsync<Follower>(follower.ID);
+					if (follower.LocalActorKind == LocalActorKind.Group)
+						await RemoveForeignMember(follower.LocalActorId, actor.ActorURI, token);
+				}
+				await DB.Default.DeleteAsync<Following>(f => f.TargetActorURI == actor.ActorURI);
+				await DB.Default.DeleteAsync<TimelineEntry>(e => e.AuthorAccountId == actor.ID);
+				return;
+			}
+
+			var post = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && p.ActorURI == actor.ActorURI).ExecuteFirstAsync(token);
+			if (post == default)
+				return;
+			await DB.Default.DeleteAsync<PostEntity>(post.ID);
+			await DB.Default.DeleteAsync<TimelineEntry>(e => e.PostId == post.ID || e.ReblogOfPostId == post.ID);
+			await DB.Default.DeleteAsync<PostEntity>(p => p.ReblogOfPostId == post.ID);
+			if (!string.IsNullOrEmpty(post.AnsweringToPostId))
+				await DB.Default.Update<PostEntity>().MatchID(post.AnsweringToPostId).Modify(b => b.Inc(p => p.RepliesCount, -1)).ExecuteAsync(token);
+		}
+	}
+}
@@ -0,0 +1,79 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Social;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Models.Social;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Inbox.ForeignMembers;
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class FollowHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IRemoteActorService _remoteActors;
+		readonly IDeliveryService _delivery;
+
+		public FollowHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_remoteActors = remoteActors;
+			_delivery = delivery;
+		}
+
+		public string Type => "Follow";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var follow = activity;
+			var follower = actor;
+
+			var target = await _localActors.FindByUri(Id(follow["object"]), token);
+			if (target is not { IsFederated: true } || target.Kind == LocalActorKind.Application)
+				return;
+
+			var existing = await _dbEntities.Followers
+				.Match(f => f.LocalActorId == target.Id && f.LocalActorKind == target.Kind && f.ActorURI == follower.ActorURI)
+				.ExecuteFirstAsync(token);
+			var record = existing ?? new Follower
+			{
+				LocalActorId = target.Id,
+				LocalActorKind = target.Kind,
+				ActorURI = follower.ActorURI
+			};
+			record.InboxURL = follower.InboxURL;
+			record.SharedInboxURL = follower.SharedInboxURL;
+			record.FollowActivityURI = Id(follow);
+			record.IsAccepted = existing?.IsAccepted == true || !target.ManuallyApprovesFollowers;
+			await DB.Default.SaveAsync(record, token);
+
+			if (target.Kind == LocalActorKind.Person)
+				await Notifications.Add(target.Id, record.IsAccepted ? NotificationType.Follow : NotificationType.FollowRequest,
+					follower.ID, follower.ActorURI, default, token);
+			if (!record.IsAccepted)
+				return;
+
+			if (target.Kind == LocalActorKind.Group)
+				await AddForeignMember(target.Id, follower.ActorURI, token);
+
+			var accept = ActivityPubRenderer.Accept(target, follow, $"accept-{record.ID}-{DateTime.UtcNow.Ticks}");
+			await _delivery.Enqueue(target, new[] { follower.InboxURL }, accept, token);
+			return;
+				}
+	}
+}
@@ -0,0 +1,56 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Social;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class LikeHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+
+		public LikeHandler(DbEntities dbEntities)
+		{
+			_dbEntities = dbEntities;
+		}
+
+		public string Type => "Like";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var objectUri = Id(activity["object"]);
+			var post = objectUri == default
+				? default
+				: await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
+			if (post == default || !MaySee(post, actor))
+				return;
+
+			try
+			{
+				await DB.Default.SaveAsync(new Favourite { AccountId = actor.ID, ActorURI = actor.ActorURI, PostId = post.ID, ActivityURI = Id(activity) }, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return;
+			}
+			await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(b => b.Inc(p => p.FavouritesCount, 1)).ExecuteAsync(token);
+			if (!post.IsFederatedCopy)
+				await Notifications.Add(post.GroupUserId, NotificationType.Favourite, actor.ID, actor.ActorURI, post.ID, token);
+		}
+
+		public static bool MaySee(PostEntity post, ForeignAvatar actor) =>
+			post.Visibility is PostVisibility.Public or PostVisibility.Unlisted
+			|| post.Visibility is PostVisibility.FollowersOnly or PostVisibility.Direct
+				&& (post.To.Contains(actor.ActorURI) || post.Cc.Contains(actor.ActorURI) || post.Mentions.Any(m => m.ActorURI == actor.ActorURI));
+	}
+}
@@ -0,0 +1,95 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Inbox.ForeignMembers;
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class UndoHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+
+		public UndoHandler(DbEntities dbEntities, ILocalActorService localActors)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+		}
+
+		public string Type => "Undo";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var inner = activity["object"];
+			var innerType = inner is JsonObject ? Value(inner, "type") : default;
+			var innerId = Id(inner);
+
+			if (innerType is null or "Follow")
+				await UndoFollow(inner, innerId, actor, token);
+			if (innerType is null or "Like")
+				await UndoLike(inner, innerId, actor, token);
+			if (innerType is null or "Announce")
+				await UndoAnnounce(innerId, actor, token);
+		}
+
+		async Task UndoFollow(JsonNode inner, string innerId, ForeignAvatar actor, CancellationToken token)
+		{
+			var followers = await _dbEntities.Followers.Match(f => f.ActorURI == actor.ActorURI).ExecuteAsync(token);
+			var targetUri = inner is JsonObject ? Id(inner["object"]) : default;
+			var target = targetUri == default ? default : await _localActors.FindByUri(targetUri, token);
+			foreach (var follower in followers)
+			{
+				var matchesActivity = innerId != default && follower.FollowActivityURI == innerId;
+				var matchesTarget = target != default && target.Id == follower.LocalActorId && target.Kind == follower.LocalActorKind;
+				if (!matchesActivity && !matchesTarget)
+					continue;
+
+				await DB.Default.DeleteAsync<Follower>(follower.ID);
+				if (follower.LocalActorKind == LocalActorKind.Group)
+					await RemoveForeignMember(follower.LocalActorId, actor.ActorURI, token);
+			}
+		}
+
+		async Task UndoLike(JsonNode inner, string innerId, ForeignAvatar actor, CancellationToken token)
+		{
+			var favourite = innerId == default
+				? default
+				: await _dbEntities.Favourites.Match(f => f.ActivityURI == innerId && f.ActorURI == actor.ActorURI).ExecuteFirstAsync(token);
+			if (favourite == default && inner is JsonObject && Id(inner["object"]) is { } objectUri)
+			{
+				var post = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteFirstAsync(token);
+				favourite = post == default
+					? default
+					: await _dbEntities.Favourites.Match(f => f.PostId == post.ID && f.ActorURI == actor.ActorURI).ExecuteFirstAsync(token);
+			}
+			if (favourite == default)
+				return;
+			await DB.Default.DeleteAsync<Favourite>(favourite.ID);
+			await DB.Default.Update<PostEntity>().MatchID(favourite.PostId).Modify(b => b.Inc(p => p.FavouritesCount, -1)).ExecuteAsync(token);
+		}
+
+		async Task UndoAnnounce(string innerId, ForeignAvatar actor, CancellationToken token)
+		{
+			if (innerId == default)
+				return;
+			var reblog = await _dbEntities.Posts
+				.Match(p => p.ObjectURI == innerId && p.ActorURI == actor.ActorURI && p.ReblogOfPostId != null)
+				.ExecuteFirstAsync(token);
+			if (reblog == default)
+				return;
+			await DB.Default.DeleteAsync<PostEntity>(reblog.ID);
+			await DB.Default.DeleteAsync<TimelineEntry>(e => e.PostId == reblog.ID);
+			await DB.Default.Update<PostEntity>().MatchID(reblog.ReblogOfPostId).Modify(b => b.Inc(p => p.ReblogsCount, -1)).ExecuteAsync(token);
+		}
+	}
+}
@@ -0,0 +1,84 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class UpdateHandler : IActivityHandler
+	{
+		const int MaxRevisions = 20;
+
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IRemoteActorService _remoteActors;
+
+		public UpdateHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_remoteActors = remoteActors;
+		}
+
+		public string Type => "Update";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var inner = activity["object"];
+			if (Id(inner) == actor.ActorURI)
+			{
+				await _remoteActors.GetActor(actor.ActorURI, refresh: true, token);
+				return;
+			}
+			if (inner is not JsonObject || !Origin.Same(Id(inner), actor.ActorURI))
+				return;
+			var note = NoteParser.Parse(inner);
+			if (note == default || note.AttributedTo != actor.ActorURI)
+				return;
+
+			var post = await _dbEntities.Posts.Match(p => p.ObjectURI == note.Id && p.ActorURI == actor.ActorURI).ExecuteFirstAsync(token);
+			if (post == default || post.DeletedAt.HasValue)
+				return;
+
+			post.Revisions.Add(new PostRevision
+			{
+				Title = post.Title,
+				SpoilerText = post.SpoilerText,
+				ContentHtml = post.ContentHtml,
+				HasContentWarning = post.HasContentWarning,
+				EditedAt = post.EditedAt ?? post.CreationDate
+			});
+			if (post.Revisions.Count > MaxRevisions)
+				post.Revisions.RemoveRange(0, post.Revisions.Count - MaxRevisions);
+
+			var mentions = new List<PostMention>();
+			foreach (var mention in note.Mentions)
+			{
+				var local = await _localActors.FindByUri(mention.ActorURI, token);
+				mentions.Add(new PostMention { ActorURI = mention.ActorURI, Handle = mention.Handle, IsLocal = local != default, AccountId = local?.Id });
+			}
+
+			post.Title = note.Title;
+			post.SpoilerText = note.SpoilerText;
+			post.HasContentWarning = note.Sensitive;
+			post.Text = note.ContentHtml;
+			post.ContentHtml = note.ContentHtml;
+			post.Language = note.Language;
+			post.Tags = note.Tags.ToList();
+			post.Mentions = mentions;
+			post.Media = note.Attachments.ToList();
+			post.EditedAt = note.Updated ?? DateTime.UtcNow;
+			post.UpdateDate = DateTime.UtcNow;
+			await DB.Default.SaveAsync(post, token);
+		}
+	}
+}
@@ -0,0 +1,54 @@
+using PrivaPub.Federation.Actors;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.User;
+
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+namespace PrivaPub.Federation.Inbox
+{
+	public interface IActivityHandler
+	{
+		string Type { get; }
+		Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token);
+	}
+
+	public class InboxProcessor : IJobHandler
+	{
+		readonly IRemoteActorService _remoteActors;
+		readonly IReadOnlyDictionary<string, IActivityHandler> _handlers;
+		readonly ILogger<InboxProcessor> _logger;
+
+		public InboxProcessor(IRemoteActorService remoteActors, IEnumerable<IActivityHandler> handlers, ILogger<InboxProcessor> logger)
+		{
+			_remoteActors = remoteActors;
+			_handlers = handlers.ToDictionary(h => h.Type, StringComparer.Ordinal);
+			_logger = logger;
+		}
+
+		public JobKind Kind => JobKind.ProcessInbox;
+		public int Concurrency => 2;
+		public int MaxAttempts => 8;
+		public int PerHostLimit => 2;
+
+		public async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			var payload = JsonSerializer.Deserialize<InboxPayload>(job.Payload);
+			var activity = payload == default ? default : JsonNode.Parse(payload.Activity);
+			var type = Value(activity, "type");
+			if (type == default || !_handlers.TryGetValue(type, out var handler))
+				return JobOutcome.Done;
+
+			var actor = await _remoteActors.GetActor(payload.ActorURI, refresh: false, token);
+			if (actor == default)
+				return JobOutcome.Retry("the actor could not be loaded");
+
+			await handler.Handle(activity, actor, token);
+			_logger.LogInformation("Processed {Type} {Id} from {Actor}", type, Id(activity), actor.ActorURI);
+			return JobOutcome.Done;
+		}
+	}
+}
@@ -0,0 +1,134 @@
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Moderation;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Signing;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+namespace PrivaPub.Federation.Inbox
+{
+	public sealed record InboxResult(int StatusCode, string Error = default);
+
+	public sealed record InboxPayload(string ActorURI, string Activity);
+
+	public interface IInboxReceiver
+	{
+		Task<InboxResult> Receive(HttpRequest request, LocalActor recipient, CancellationToken token);
+	}
+
+	public class InboxReceiver : IInboxReceiver
+	{
+		const int MaxBodyBytes = 1024 * 1024;
+
+		readonly ILocalActorService _localActors;
+		readonly IRemoteActorService _remoteActors;
+		readonly IJobQueue _queue;
+		readonly IDomainBlocks _domainBlocks;
+		readonly ILogger<InboxReceiver> _logger;
+
+		public InboxReceiver(ILocalActorService localActors, IRemoteActorService remoteActors, IJobQueue queue, IDomainBlocks domainBlocks,
+			ILogger<InboxReceiver> logger)
+		{
+			_localActors = localActors;
+			_remoteActors = remoteActors;
+			_queue = queue;
+			_domainBlocks = domainBlocks;
+			_logger = logger;
+		}
+
+		public async Task<InboxResult> Receive(HttpRequest request, LocalActor recipient, CancellationToken token)
+		{
+			if (request.ContentLength > MaxBodyBytes)
+				return new(StatusCodes.Status413PayloadTooLarge);
+
+			using var buffer = new MemoryStream();
+			await request.Body.CopyToAsync(buffer, token);
+			if (buffer.Length > MaxBodyBytes)
+				return new(StatusCodes.Status413PayloadTooLarge);
+			var body = buffer.ToArray();
+
+			JsonNode activity;
+			try
+			{
+				activity = JsonNode.Parse(body);
+			}
+			catch (JsonException)
+			{
+				return new(StatusCodes.Status400BadRequest, "the body is not JSON");
+			}
+			if (activity is not JsonObject)
+				return new(StatusCodes.Status400BadRequest, "the body is not an activity");
+
+			var type = Value(activity, "type");
+			var actorUri = Id(activity["actor"]);
+			if (string.IsNullOrEmpty(type) || string.IsNullOrEmpty(actorUri))
+				return new(StatusCodes.Status400BadRequest, "type and actor are required");
+
+			var parameters = HttpSignatures.Parse(request.Headers["Signature"].ToString());
+			if (parameters == default)
+				return new(StatusCodes.Status401Unauthorized, "missing or unreadable Signature header");
+			if (_domainBlocks.IsSuspended(HostOf(parameters.KeyId)) || _domainBlocks.IsSuspended(HostOf(actorUri)))
+				return new(StatusCodes.Status202Accepted);
+
+			var requestProblem = HttpSignatures.CheckRequest(request, parameters, body);
+			if (requestProblem != default)
+				return new(StatusCodes.Status401Unauthorized, requestProblem);
+
+			var signingString = HttpSignatures.SigningString(request, parameters);
+			var keyOwner = await _remoteActors.GetActorByKeyId(parameters.KeyId, refresh: false, token);
+			if (keyOwner == default && type == "Delete" && Id(activity["object"]) == actorUri)
+				return new(StatusCodes.Status202Accepted);
+			if (keyOwner == default || !HttpSignatures.Verify(keyOwner.PublicKey, signingString, parameters.Signature))
+			{
+				keyOwner = await _remoteActors.GetActorByKeyId(parameters.KeyId, refresh: true, token);
+				if (keyOwner == default || !HttpSignatures.Verify(keyOwner.PublicKey, signingString, parameters.Signature))
+					return new(StatusCodes.Status401Unauthorized, "the signature does not verify");
+			}
+
+			if (!string.Equals(keyOwner.ActorURI, actorUri, StringComparison.Ordinal))
+				return new(StatusCodes.Status401Unauthorized, "the activity's actor is not the key's owner");
+
+			var shapeProblem = await ShapeProblem(type, activity, actorUri, token);
+			if (shapeProblem != default)
+				return shapeProblem;
+
+			var activityId = Id(activity);
+			await _queue.Enqueue(JobKind.ProcessInbox, JsonSerializer.Serialize(new InboxPayload(actorUri, activity.ToJsonString())),
+				new Uri(actorUri).Host.ToLowerInvariant(), activityId == default ? default : "inbox|" + activityId, token);
+			_logger.LogInformation("Inbox {Recipient}: {Type} from {Actor} queued", recipient?.Handle ?? "shared", type, actorUri);
+			return new(StatusCodes.Status202Accepted);
+		}
+
+		static string HostOf(string uri) => Uri.TryCreate(uri, UriKind.Absolute, out var parsed) ? parsed.Host : default;
+
+		async Task<InboxResult> ShapeProblem(string type, JsonNode activity, string actorUri, CancellationToken token)
+		{
+			var activityId = Id(activity);
+			if (activityId != default && !Origin.Same(activityId, actorUri))
+				return new(StatusCodes.Status400BadRequest, "the activity's id is not on its actor's origin");
+
+			var inner = activity["object"];
+			switch (type)
+			{
+				case "Follow":
+					var target = await _localActors.FindByUri(Id(inner), token);
+					if (target is not { IsFederated: true } || target.Kind == LocalActorKind.Application)
+						return new(StatusCodes.Status404NotFound, "no such local actor");
+					break;
+				case "Undo" when inner is JsonObject && Id(inner["actor"]) != actorUri:
+					return new(StatusCodes.Status400BadRequest, "an actor can only undo its own activities");
+				case "Create" or "Update" when inner is JsonObject && Origin.Same(Id(inner), actorUri)
+					&& inner["attributedTo"] != default && Id(inner["attributedTo"]) != actorUri
+					&& Value(inner, "type") is not ("Person" or "Service" or "Application" or "Group" or "Organization"):
+					return new(StatusCodes.Status400BadRequest, "the object is not attributed to the actor");
+			}
+			return default;
+		}
+	}
+}
@@ -1,413 +0,0 @@
-using MongoDB.Entities;
-
-using PrivaPub.Models.Federation;
-using PrivaPub.Models.Group;
-using PrivaPub.Models.Post;
-using PrivaPub.Models.User;
-using PrivaPub.StaticServices;
-
-using System.Text.Json;
-using System.Text.Json.Nodes;
-
-using DmPostEntity = PrivaPub.Models.Post.DmPost;
-using GroupEntity = PrivaPub.Models.Group.Group;
-using PostEntity = PrivaPub.Models.Post.Post;
-using PrivaPub.Federation.Actors;
-using PrivaPub.Federation.Signing;
-using PrivaPub.Federation.Rendering;
-using PrivaPub.Federation.Objects;
-using PrivaPub.Federation.Outbox;
-
-namespace PrivaPub.Federation.Inbox
-{
-	public sealed record InboxResult(int StatusCode, string Error = default);
-
-	public interface IInboxService
-	{
-		Task<InboxResult> Receive(HttpRequest request, LocalActor recipient, CancellationToken token);
-	}
-
-	public class InboxService : IInboxService
-	{
-		const int MaxBodyBytes = 1024 * 1024;
-
-		readonly DbEntities _dbEntities;
-		readonly ILocalActorService _localActors;
-		readonly IRemoteActorService _remoteActors;
-		readonly IDeliveryService _delivery;
-		readonly ILogger<InboxService> _logger;
-
-		public InboxService(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors,
-			IDeliveryService delivery, ILogger<InboxService> logger)
-		{
-			_dbEntities = dbEntities;
-			_localActors = localActors;
-			_remoteActors = remoteActors;
-			_delivery = delivery;
-			_logger = logger;
-		}
-
-		public async Task<InboxResult> Receive(HttpRequest request, LocalActor recipient, CancellationToken token)
-		{
-			if (request.ContentLength > MaxBodyBytes)
-				return new(StatusCodes.Status413PayloadTooLarge);
-
-			using var buffer = new MemoryStream();
-			await request.Body.CopyToAsync(buffer, token);
-			if (buffer.Length > MaxBodyBytes)
-				return new(StatusCodes.Status413PayloadTooLarge);
-			var body = buffer.ToArray();
-
-			JsonNode activity;
-			try
-			{
-				activity = JsonNode.Parse(body);
-			}
-			catch (JsonException)
-			{
-				return new(StatusCodes.Status400BadRequest, "the body is not JSON");
-			}
-			if (activity is not JsonObject)
-				return new(StatusCodes.Status400BadRequest, "the body is not an activity");
-
-			var type = Value(activity, "type");
-			var actorUri = Id(activity["actor"]);
-			if (string.IsNullOrEmpty(type) || string.IsNullOrEmpty(actorUri))
-				return new(StatusCodes.Status400BadRequest, "type and actor are required");
-
-			var parameters = HttpSignatures.Parse(request.Headers["Signature"].ToString());
-			if (parameters == default)
-				return new(StatusCodes.Status401Unauthorized, "missing or unreadable Signature header");
-
-			var requestProblem = HttpSignatures.CheckRequest(request, parameters, body);
-			if (requestProblem != default)
-				return new(StatusCodes.Status401Unauthorized, requestProblem);
-
-			var signingString = HttpSignatures.SigningString(request, parameters);
-			var keyOwner = await _remoteActors.GetActorByKeyId(parameters.KeyId, refresh: false, token);
-			if (keyOwner == default && type == "Delete" && Id(activity["object"]) == actorUri)
-				return new(StatusCodes.Status202Accepted);
-			if (keyOwner == default || !HttpSignatures.Verify(keyOwner.PublicKey, signingString, parameters.Signature))
-			{
-				keyOwner = await _remoteActors.GetActorByKeyId(parameters.KeyId, refresh: true, token);
-				if (keyOwner == default || !HttpSignatures.Verify(keyOwner.PublicKey, signingString, parameters.Signature))
-					return new(StatusCodes.Status401Unauthorized, "the signature does not verify");
-			}
-
-			if (!string.Equals(keyOwner.ActorURI, actorUri, StringComparison.Ordinal))
-				return new(StatusCodes.Status401Unauthorized, "the activity's actor is not the key's owner");
-
-			var activityId = Id(activity);
-			if (activityId != default && !Origin.Same(activityId, actorUri))
-				return new(StatusCodes.Status400BadRequest, "the activity's id is not on its actor's origin");
-
-			_logger.LogInformation("Inbox {Recipient}: {Type} from {Actor}", recipient?.Handle ?? "shared", type, actorUri);
-
-			return type switch
-			{
-				"Follow" => await Follow(activity, keyOwner, token),
-				"Undo" => await Undo(activity, keyOwner, token),
-				"Create" => await Create(activity, keyOwner, token),
-				"Delete" => await Delete(activity, keyOwner, token),
-				"Update" => await Update(activity, keyOwner, token),
-				_ => new(StatusCodes.Status202Accepted)
-			};
-		}
-
-		async Task<InboxResult> Follow(JsonNode follow, ForeignAvatar follower, CancellationToken token)
-		{
-			var target = await _localActors.FindByUri(Id(follow["object"]), token);
-			if (target is not { IsFederated: true } || target.Kind == LocalActorKind.Application)
-				return new(StatusCodes.Status404NotFound, "no such local actor");
-
-			var existing = await _dbEntities.Followers
-				.Match(f => f.LocalActorId == target.Id && f.LocalActorKind == target.Kind && f.ActorURI == follower.ActorURI)
-				.ExecuteFirstAsync(token);
-			var record = existing ?? new Follower
-			{
-				LocalActorId = target.Id,
-				LocalActorKind = target.Kind,
-				ActorURI = follower.ActorURI
-			};
-			record.InboxURL = follower.InboxURL;
-			record.SharedInboxURL = follower.SharedInboxURL;
-			record.FollowActivityURI = Id(follow);
-			record.IsAccepted = existing?.IsAccepted == true || !target.ManuallyApprovesFollowers;
-			await DB.Default.SaveAsync(record, token);
-
-			if (!record.IsAccepted)
-				return new(StatusCodes.Status202Accepted);
-
-			if (target.Kind == LocalActorKind.Group)
-				await AddForeignMember(target.Id, follower.ActorURI, token);
-
-			var accept = ActivityPubRenderer.Accept(target, follow, $"accept-{record.ID}-{DateTime.UtcNow.Ticks}");
-			await _delivery.Enqueue(target, new[] { follower.InboxURL }, accept, token);
-			return new(StatusCodes.Status202Accepted);
-		}
-
-		async Task<InboxResult> Undo(JsonNode undo, ForeignAvatar actor, CancellationToken token)
-		{
-			var inner = undo["object"];
-			var innerType = inner is JsonObject ? Value(inner, "type") : default;
-			var innerId = Id(inner);
-
-			if (inner is JsonObject && Id(inner["actor"]) != actor.ActorURI)
-				return new(StatusCodes.Status400BadRequest, "an actor can only undo its own activities");
-			if (innerType is not (null or "Follow"))
-				return new(StatusCodes.Status202Accepted);
-
-			var followers = await _dbEntities.Followers.Match(f => f.ActorURI == actor.ActorURI).ExecuteAsync(token);
-			var targetUri = inner is JsonObject ? Id(inner["object"]) : default;
-			foreach (var follower in followers)
-			{
-				var matchesActivity = innerId != default && follower.FollowActivityURI == innerId;
-				var target = targetUri == default ? default : await _localActors.FindByUri(targetUri, token);
-				var matchesTarget = target != default && target.Id == follower.LocalActorId && target.Kind == follower.LocalActorKind;
-				if (!matchesActivity && !matchesTarget)
-					continue;
-
-				await DB.Default.DeleteAsync<Follower>(follower.ID);
-				if (follower.LocalActorKind == LocalActorKind.Group)
-					await RemoveForeignMember(follower.LocalActorId, actor.ActorURI, token);
-			}
-			return new(StatusCodes.Status202Accepted);
-		}
-
-		async Task<InboxResult> Create(JsonNode create, ForeignAvatar author, CancellationToken token)
-		{
-			var note = create["object"];
-			if (note is not JsonObject || !Origin.Same(Id(note), author.ActorURI))
-			{
-				using var fetched = await _remoteActors.FetchObject(Id(note), token);
-				note = fetched == default ? default : JsonNode.Parse(fetched.Root.GetRawText());
-			}
-			if (note is not JsonObject || Value(note, "type") is not ("Note" or "Article" or "Page" or "Question"))
-				return new(StatusCodes.Status202Accepted);
-
-			var objectUri = Id(note);
-			if (string.IsNullOrEmpty(objectUri) || Id(note["attributedTo"]) != author.ActorURI)
-				return new(StatusCodes.Status400BadRequest, "the object is not attributed to the actor");
-
-			var addressed = Addresses(note).Concat(Addresses(create)).Distinct(StringComparer.Ordinal).ToList();
-			var isPublic = addressed.Contains(ActivityPubRenderer.Public) || addressed.Contains("as:Public") || addressed.Contains("Public");
-			var inReplyTo = Id(note["inReplyTo"]);
-
-			var localTargets = new List<LocalActor>();
-			foreach (var uri in addressed.Concat(new[] { Id(note["audience"]) }).Where(u => u != default).Distinct())
-			{
-				var local = await _localActors.FindByUri(uri, token);
-				if (local is { IsFederated: true } && localTargets.All(l => l.Id != local.Id))
-					localTargets.Add(local);
-			}
-
-			if (isPublic || addressed.Any(a => a == author.ActorURI + "/followers" || a.EndsWith("/followers")))
-			{
-				var group = localTargets.FirstOrDefault(t => t.Kind == LocalActorKind.Group);
-				if (group != default && !await IsAcceptedFollower(group, author.ActorURI, token))
-					group = default;
-				if (group == default && localTargets.All(t => t.Kind != LocalActorKind.Person))
-					return new(StatusCodes.Status202Accepted);
-
-				if (await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteAnyAsync(token))
-					return new(StatusCodes.Status202Accepted);
-
-				var html = ContentSanitizer.Html(Value(note, "content"));
-				var post = new PostEntity
-				{
-					ObjectURI = objectUri,
-					ActorURI = author.ActorURI,
-					GroupId = group?.Id,
-					Title = Value(note, "summary") ?? Value(note, "name"),
-					Text = html,
-					ContentHtml = html,
-					ContentFormat = ContentFormat.Html,
-					HasContentWarning = note["sensitive"] is JsonValue sensitive && sensitive.TryGetValue<bool>(out var s) && s,
-					AnsweringToPostId = await LocalPostId(inReplyTo, token) ?? inReplyTo,
-					IsFederatedCopy = true,
-					CreationDate = DateTime.TryParse(Value(note, "published"), out var published) ? published.ToUniversalTime() : DateTime.UtcNow
-				};
-				await DB.Default.SaveAsync(post, token);
-
-				if (group != default)
-				{
-					var announce = ActivityPubRenderer.Announce(group, objectUri, $"announce-{post.ID}");
-					await _delivery.EnqueueToFollowers(group, announce, token);
-				}
-				return new(StatusCodes.Status202Accepted);
-			}
-
-			var recipients = localTargets.Where(t => t.Kind == LocalActorKind.Person).ToList();
-			if (recipients.Count == 0)
-				return new(StatusCodes.Status202Accepted);
-			if (await _dbEntities.DmPosts.Match(p => p.ObjectURI == objectUri).ExecuteAnyAsync(token))
-				return new(StatusCodes.Status202Accepted);
-
-			var participants = recipients.Select(r => r.Uri)
-				.Concat(addressed.Where(a => a != ActivityPubRenderer.Public && !a.EndsWith("/followers") && !a.EndsWith("/following")))
-				.Append(author.ActorURI)
-				.ToList();
-			var context = Value(note, "context") ?? Value(note, "conversation");
-			var dmGroup = await FindOrCreateDmGroup(participants, Origin.Same(context, author.ActorURI) ? context : default, token);
-			var dmHtml = ContentSanitizer.Html(Value(note, "content"));
-			var dm = new DmPostEntity
-			{
-				ObjectURI = objectUri,
-				ActorURI = author.ActorURI,
-				GroupId = dmGroup.ID,
-				Title = Value(note, "summary"),
-				Text = dmHtml,
-				ContentHtml = dmHtml,
-				ContentFormat = ContentFormat.Html,
-				HasContentWarning = note["sensitive"] is JsonValue dmSensitive && dmSensitive.TryGetValue<bool>(out var ds) && ds,
-				AnsweringToPostId = inReplyTo,
-				IsFederatedCopy = true,
-				CreationDate = DateTime.TryParse(Value(note, "published"), out var dmPublished) ? dmPublished.ToUniversalTime() : DateTime.UtcNow
-			};
-			await DB.Default.SaveAsync(dm, token);
-			await DB.Default.Update<DmGroup>().MatchID(dmGroup.ID).Modify(g => g.UpdatedAt, DateTime.UtcNow).ExecuteAsync(token);
-			return new(StatusCodes.Status202Accepted);
-		}
-
-		async Task<InboxResult> Delete(JsonNode delete, ForeignAvatar actor, CancellationToken token)
-		{
-			var objectUri = Id(delete["object"]);
-			if (!Origin.Same(objectUri, actor.ActorURI))
-				return new(StatusCodes.Status202Accepted);
-
-			if (objectUri == actor.ActorURI)
-			{
-				actor.DeletionAt = DateTime.UtcNow;
-				actor.AccountState = AvatarAccountState.Deleted;
-				await DB.Default.SaveAsync(actor, token);
-				var followers = await _dbEntities.Followers.Match(f => f.ActorURI == actor.ActorURI).ExecuteAsync(token);
-				foreach (var follower in followers)
-				{
-					await DB.Default.DeleteAsync<Follower>(follower.ID);
-					if (follower.LocalActorKind == LocalActorKind.Group)
-						await RemoveForeignMember(follower.LocalActorId, actor.ActorURI, token);
-				}
-				return new(StatusCodes.Status202Accepted);
-			}
-
-			await DB.Default.DeleteAsync<PostEntity>(p => p.ObjectURI == objectUri && p.ActorURI == actor.ActorURI);
-			await DB.Default.DeleteAsync<DmPostEntity>(p => p.ObjectURI == objectUri && p.ActorURI == actor.ActorURI);
-			return new(StatusCodes.Status202Accepted);
-		}
-
-		async Task<InboxResult> Update(JsonNode update, ForeignAvatar actor, CancellationToken token)
-		{
-			var inner = update["object"];
-			if (Id(inner) == actor.ActorURI)
-			{
-				await _remoteActors.GetActor(actor.ActorURI, refresh: true, token);
-				return new(StatusCodes.Status202Accepted);
-			}
-			if (inner is not JsonObject || Id(inner["attributedTo"]) != actor.ActorURI || !Origin.Same(Id(inner), actor.ActorURI))
-				return new(StatusCodes.Status202Accepted);
-
-			var objectUri = Id(inner);
-			var text = ContentSanitizer.Html(Value(inner, "content"));
-			await DB.Default.Update<PostEntity>()
-				.Match(p => p.ObjectURI == objectUri && p.ActorURI == actor.ActorURI)
-				.Modify(p => p.Text, text)
-				.Modify(p => p.ContentHtml, text)
-				.Modify(p => p.UpdateDate, DateTime.UtcNow)
-				.ExecuteAsync(token);
-			await DB.Default.Update<DmPostEntity>()
-				.Match(p => p.ObjectURI == objectUri && p.ActorURI == actor.ActorURI)
-				.Modify(p => p.Text, text)
-				.Modify(p => p.ContentHtml, text)
-				.Modify(p => p.UpdateDate, DateTime.UtcNow)
-				.ExecuteAsync(token);
-			return new(StatusCodes.Status202Accepted);
-		}
-
-		async Task<bool> IsAcceptedFollower(LocalActor group, string actorUri, CancellationToken token) =>
-			await _dbEntities.Followers
-				.Match(f => f.LocalActorId == group.Id && f.LocalActorKind == LocalActorKind.Group && f.ActorURI == actorUri && f.IsAccepted)
-				.ExecuteAnyAsync(token);
-
-		async Task AddForeignMember(string groupId, string actorUri, CancellationToken token)
-		{
-			var group = await _dbEntities.Groups.MatchID(groupId).ExecuteFirstAsync(token);
-			if (group == default || group.Members.Any(m => m.IsForeign && m.AvatarId == actorUri))
-				return;
-			group.Members.Add(new GroupMember { AvatarId = actorUri, IsForeign = true });
-			group.UpdatedAt = DateTime.UtcNow;
-			await DB.Default.SaveAsync(group, token);
-		}
-
-		async Task RemoveForeignMember(string groupId, string actorUri, CancellationToken token)
-		{
-			var group = await _dbEntities.Groups.MatchID(groupId).ExecuteFirstAsync(token);
-			if (group == default || group.Members.RemoveAll(m => m.IsForeign && m.AvatarId == actorUri) == 0)
-				return;
-			group.UpdatedAt = DateTime.UtcNow;
-			await DB.Default.SaveAsync<GroupEntity>(group, token);
-		}
-
-		async Task<DmGroup> FindOrCreateDmGroup(List<string> participantUris, string context, CancellationToken token)
-		{
-			var members = new List<GroupMember>();
-			foreach (var uri in participantUris.Distinct(StringComparer.Ordinal))
-			{
-				var local = await _localActors.FindByUri(uri, token);
-				var member = local != default && local.Kind == LocalActorKind.Person
-					? new GroupMember { AvatarId = local.Id }
-					: new GroupMember { AvatarId = uri, IsForeign = true };
-				if (members.All(m => m.AvatarId != member.AvatarId || m.IsForeign != member.IsForeign))
-					members.Add(member);
-			}
-
-			var key = DmGroup.KeyOf(members);
-			var match = await _dbEntities.DmGroups.Match(g => g.ParticipantsKey == key && !g.DeletionAt.HasValue).ExecuteFirstAsync(token);
-			if (match != default)
-				return match;
-
-			var dmGroup = new DmGroup { Members = members, ConversationURI = context, ParticipantsKey = key };
-			await DB.Default.SaveAsync(dmGroup, token);
-			return dmGroup;
-		}
-
-		async Task<string> LocalPostId(string uri, CancellationToken token)
-		{
-			if (string.IsNullOrEmpty(uri) || !uri.StartsWith(_localActors.BaseAddress + "/peasants/", StringComparison.OrdinalIgnoreCase))
-				return default;
-			var id = uri[(uri.LastIndexOf('/') + 1)..];
-			return await _dbEntities.Posts.MatchID(id).ExecuteAnyAsync(token) ? id : default;
-		}
-
-		static IEnumerable<string> Addresses(JsonNode node)
-		{
-			foreach (var field in new[] { "to", "cc", "bto", "bcc", "audience" })
-			{
-				switch (node[field])
-				{
-					case JsonArray array:
-						foreach (var item in array)
-						{
-							var id = Id(item);
-							if (id != default)
-								yield return id;
-						}
-						break;
-					case JsonNode single when Id(single) is { } id:
-						yield return id;
-						break;
-				}
-			}
-		}
-
-		public static string Id(JsonNode node) => node switch
-		{
-			JsonValue value when value.TryGetValue<string>(out var text) => text,
-			JsonObject obj => Value(obj, "id") ?? Value(obj, "href"),
-			JsonArray array => array.Select(Id).FirstOrDefault(i => i != default),
-			_ => default
-		};
-
-		public static string Value(JsonNode node, string property) =>
-			node is JsonObject obj && obj[property] is JsonValue value && value.TryGetValue<string>(out var text) ? text : default;
-	}
-}
@@ -0,0 +1,173 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Moderation;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Infrastructure.Ids;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Inbox
+{
+	public sealed record AncestorsPayload(string PostId, int Depth);
+
+	public interface IRemotePosts
+	{
+		Task<PostEntity> Build(NoteDocument note, ForeignAvatar author, PostVisibility visibility, IReadOnlyList<string> to, IReadOnlyList<string> cc,
+			PostEntity parent, CancellationToken token);
+		Task<PostEntity> Parent(string inReplyTo, int depth, CancellationToken token);
+		Task<PostEntity> StoreContext(string objectUri, int depth, CancellationToken token);
+	}
+
+	public class RemotePosts : IRemotePosts
+	{
+		public const int MaxDepth = 10;
+
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IRemoteActorService _remoteActors;
+		readonly IDomainBlocks _domainBlocks;
+		readonly IJobQueue _queue;
+
+		public RemotePosts(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDomainBlocks domainBlocks,
+			IJobQueue queue)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_remoteActors = remoteActors;
+			_domainBlocks = domainBlocks;
+			_queue = queue;
+		}
+
+		public async Task<PostEntity> Build(NoteDocument note, ForeignAvatar author, PostVisibility visibility, IReadOnlyList<string> to,
+			IReadOnlyList<string> cc, PostEntity parent, CancellationToken token)
+		{
+			var mentions = new List<PostMention>();
+			foreach (var mention in note.Mentions)
+			{
+				var local = await _localActors.FindByUri(mention.ActorURI, token);
+				mentions.Add(new PostMention { ActorURI = mention.ActorURI, Handle = mention.Handle, IsLocal = local != default, AccountId = local?.Id });
+			}
+
+			return new PostEntity
+			{
+				ID = PrivacyIds.At(note.Published),
+				ObjectURI = note.Id,
+				ActorURI = author.ActorURI,
+				AuthorAccountId = author.ID,
+				Visibility = visibility,
+				To = to.ToList(),
+				Cc = cc.ToList(),
+				Url = note.Url,
+				ContextURI = note.Context,
+				QuoteURI = note.QuoteUri,
+				Title = note.Title,
+				SpoilerText = note.SpoilerText,
+				HasContentWarning = note.Sensitive,
+				Text = note.ContentHtml,
+				ContentHtml = note.ContentHtml,
+				ContentFormat = ContentFormat.Html,
+				Language = note.Language,
+				Mentions = mentions,
+				Tags = note.Tags.ToList(),
+				Media = _domainBlocks.Find(new Uri(author.ActorURI).Host)?.RejectMedia == true ? new() : note.Attachments.ToList(),
+				InReplyToURI = note.InReplyTo,
+				AnsweringToPostId = parent?.ID,
+				InReplyToAccountId = parent?.AuthorAccountId ?? parent?.GroupUserId,
+				IsFederatedCopy = true,
+				CreationDate = note.Published,
+				UpdateDate = note.Updated ?? note.Published,
+				EditedAt = note.Updated
+			};
+		}
+
+		public async Task<PostEntity> Parent(string inReplyTo, int depth, CancellationToken token)
+		{
+			if (string.IsNullOrEmpty(inReplyTo))
+				return default;
+			var known = await _dbEntities.Posts.Match(p => p.ObjectURI == inReplyTo && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			if (known != default || inReplyTo.StartsWith(_localActors.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+				return known;
+			return await StoreContext(inReplyTo, depth, token);
+		}
+
+		public async Task<PostEntity> StoreContext(string objectUri, int depth, CancellationToken token)
+		{
+			var existing = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteFirstAsync(token);
+			if (existing != default || depth > MaxDepth)
+				return existing;
+
+			using var fetched = await _remoteActors.FetchObject(objectUri, token);
+			var note = fetched == default ? default : NoteParser.Parse(JsonNode.Parse(fetched.Root.GetRawText()));
+			if (note == default || !Origin.Same(note.Id, note.AttributedTo))
+				return default;
+			var visibility = Addressing.Classify(note.To, note.Cc, default);
+			if (visibility is not (PostVisibility.Public or PostVisibility.Unlisted))
+				return default;
+			var author = await _remoteActors.GetActor(note.AttributedTo, refresh: false, token);
+			if (author == default)
+				return default;
+
+			var grandparent = string.IsNullOrEmpty(note.InReplyTo)
+				? default
+				: await _dbEntities.Posts.Match(p => p.ObjectURI == note.InReplyTo && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			var post = await Build(note, author, visibility, note.To, note.Cc, grandparent, token);
+			try
+			{
+				await DB.Default.SaveAsync(post, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteFirstAsync(token);
+			}
+
+			if (grandparent == default && !string.IsNullOrEmpty(note.InReplyTo) && depth < MaxDepth)
+				await _queue.Enqueue(JobKind.FetchAncestors, JsonSerializer.Serialize(new AncestorsPayload(post.ID, depth + 1)), new Uri(note.InReplyTo).Host,
+					"ancestors|" + post.ID, token);
+			return post;
+		}
+	}
+
+	public class AncestorsJobHandler : IJobHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly IRemotePosts _remotePosts;
+
+		public AncestorsJobHandler(DbEntities dbEntities, IRemotePosts remotePosts)
+		{
+			_dbEntities = dbEntities;
+			_remotePosts = remotePosts;
+		}
+
+		public JobKind Kind => JobKind.FetchAncestors;
+		public int Concurrency => 1;
+		public int MaxAttempts => 3;
+		public int PerHostLimit => 1;
+
+		public async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			var payload = JsonSerializer.Deserialize<AncestorsPayload>(job.Payload);
+			var child = await _dbEntities.Posts.MatchID(payload.PostId).ExecuteFirstAsync(token);
+			if (child == default || string.IsNullOrEmpty(child.InReplyToURI) || !string.IsNullOrEmpty(child.AnsweringToPostId))
+				return JobOutcome.Done;
+
+			var parent = await _remotePosts.Parent(child.InReplyToURI, payload.Depth, token);
+			if (parent == default)
+				return JobOutcome.Done;
+			await DB.Default.Update<PostEntity>().MatchID(child.ID)
+				.Modify(p => p.AnsweringToPostId, parent.ID)
+				.Modify(p => p.InReplyToAccountId, parent.AuthorAccountId ?? parent.GroupUserId)
+				.ExecuteAsync(token);
+			return JobOutcome.Done;
+		}
+	}
+}
@@ -0,0 +1,77 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Federation;
+
+namespace PrivaPub.Federation.Moderation
+{
+	public interface IDomainBlocks
+	{
+		DomainBlock Find(string host);
+		bool IsSuspended(string host);
+		Task Reload(CancellationToken token);
+	}
+
+	public class DomainBlocks : IDomainBlocks
+	{
+		static readonly TimeSpan Staleness = TimeSpan.FromMinutes(5);
+
+		readonly ILogger<DomainBlocks> _logger;
+		IReadOnlyDictionary<string, DomainBlock> _blocks = new Dictionary<string, DomainBlock>();
+		DateTime _loadedAt = DateTime.MinValue;
+		int _reloading;
+
+		public DomainBlocks(ILogger<DomainBlocks> logger)
+		{
+			_logger = logger;
+		}
+
+		public static string Normalise(string domain) => domain?.Trim().Trim('.').ToLowerInvariant();
+
+		public DomainBlock Find(string host)
+		{
+			RefreshIfStale();
+			host = Normalise(host);
+			var blocks = _blocks;
+			while (!string.IsNullOrEmpty(host))
+			{
+				if (blocks.TryGetValue(host, out var block))
+					return block;
+				var dot = host.IndexOf('.');
+				host = dot < 0 ? default : host[(dot + 1)..];
+			}
+			return default;
+		}
+
+		public bool IsSuspended(string host) => Find(host)?.Severity == DomainBlockSeverity.Suspend;
+
+		public async Task Reload(CancellationToken token)
+		{
+			var blocks = await DB.Default.Find<DomainBlock>().ExecuteAsync(token);
+			_blocks = blocks.Where(b => !string.IsNullOrEmpty(b.Domain))
+				.GroupBy(b => Normalise(b.Domain))
+				.ToDictionary(g => g.Key, g => g.First());
+			_loadedAt = DateTime.UtcNow;
+		}
+
+		void RefreshIfStale()
+		{
+			if (DateTime.UtcNow - _loadedAt < Staleness || Interlocked.Exchange(ref _reloading, 1) == 1)
+				return;
+			_ = Task.Run(async () =>
+			{
+				try
+				{
+					await Reload(CancellationToken.None);
+				}
+				catch (Exception ex)
+				{
+					_logger.LogWarning(ex, "Domain blocks could not be reloaded");
+				}
+				finally
+				{
+					Interlocked.Exchange(ref _reloading, 0);
+				}
+			});
+		}
+	}
+}
@@ -0,0 +1,39 @@
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Federation.Objects
+{
+	public static class ActivityJson
+	{
+		public static string Id(JsonNode node) => node switch
+		{
+			JsonValue value when value.TryGetValue<string>(out var text) => text,
+			JsonObject obj => Value(obj, "id") ?? Value(obj, "href"),
+			JsonArray array => array.Select(Id).FirstOrDefault(i => i != default),
+			_ => default
+		};
+
+		public static string Value(JsonNode node, string property) =>
+			node is JsonObject obj && obj[property] is JsonValue value && value.TryGetValue<string>(out var text) ? text : default;
+
+		public static IEnumerable<string> Addresses(JsonNode node)
+		{
+			foreach (var field in new[] { "to", "cc", "bto", "bcc", "audience" })
+			{
+				switch (node[field])
+				{
+					case JsonArray array:
+						foreach (var item in array)
+						{
+							var id = Id(item);
+							if (id != default)
+								yield return id;
+						}
+						break;
+					case JsonNode single when Id(single) is { } id:
+						yield return id;
+						break;
+				}
+			}
+		}
+	}
+}
@@ -0,0 +1,22 @@
+using PrivaPub.Models.Post;
+
+namespace PrivaPub.Federation.Objects
+{
+	public static class Addressing
+	{
+		public const string Public = "https://www.w3.org/ns/activitystreams#Public";
+
+		public static bool IsPublic(string address) => address is Public or "as:Public" or "Public";
+
+		public static PostVisibility Classify(IReadOnlyCollection<string> to, IReadOnlyCollection<string> cc, string authorFollowers)
+		{
+			if (to.Any(IsPublic))
+				return PostVisibility.Public;
+			if (cc.Any(IsPublic))
+				return PostVisibility.Unlisted;
+			if (!string.IsNullOrEmpty(authorFollowers) && (to.Contains(authorFollowers) || cc.Contains(authorFollowers)))
+				return PostVisibility.FollowersOnly;
+			return PostVisibility.Direct;
+		}
+	}
+}
@@ -0,0 +1,179 @@
+using PrivaPub.Models.Post;
+
+using System.Globalization;
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+namespace PrivaPub.Federation.Objects
+{
+	public sealed class NoteDocument
+	{
+		public string Id { get; init; }
+		public string Type { get; init; }
+		public string AttributedTo { get; init; }
+		public string ContentHtml { get; init; }
+		public string Title { get; init; }
+		public string SpoilerText { get; init; }
+		public bool Sensitive { get; init; }
+		public string Language { get; init; }
+		public string Url { get; init; }
+		public string InReplyTo { get; init; }
+		public string Context { get; init; }
+		public string Audience { get; init; }
+		public string QuoteUri { get; init; }
+		public DateTime Published { get; init; }
+		public DateTime? Updated { get; init; }
+		public IReadOnlyList<string> To { get; init; } = Array.Empty<string>();
+		public IReadOnlyList<string> Cc { get; init; } = Array.Empty<string>();
+		public IReadOnlyList<PostMention> Mentions { get; init; } = Array.Empty<PostMention>();
+		public IReadOnlyList<string> Tags { get; init; } = Array.Empty<string>();
+		public IReadOnlyList<PostMedia> Attachments { get; init; } = Array.Empty<PostMedia>();
+	}
+
+	public static class NoteParser
+	{
+		static readonly string[] NoteTypes = { "Note", "Article", "Page", "Question", "Event", "Video", "Audio", "Image" };
+		const int MaxAttachments = 16;
+		const int MaxTags = 64;
+
+		public static NoteDocument Parse(JsonNode node)
+		{
+			if (node is not JsonObject note)
+				return default;
+			var type = Value(note, "type");
+			var id = Id(note);
+			if (!NoteTypes.Contains(type) || Origin.Of(id) == default)
+				return default;
+
+			var (contentHtml, language) = Content(note);
+			var summary = Value(note, "summary");
+			return new NoteDocument
+			{
+				Id = id,
+				Type = type,
+				AttributedTo = Attribution(note["attributedTo"]),
+				ContentHtml = ContentSanitizer.Html(contentHtml),
+				Title = Plain(Value(note, "name"), 500),
+				SpoilerText = Plain(summary, 500),
+				Sensitive = note["sensitive"] is JsonValue sensitive && sensitive.TryGetValue<bool>(out var s) && s
+					|| !string.IsNullOrWhiteSpace(summary),
+				Language = language,
+				Url = UrlOf(note["url"]) ?? id,
+				InReplyTo = Id(note["inReplyTo"]),
+				Context = Id(note["context"]) ?? Value(note, "conversation"),
+				Audience = Id(note["audience"]),
+				QuoteUri = Value(note, "quote") ?? Value(note, "quoteUrl") ?? Value(note, "quoteUri") ?? Value(note, "_misskey_quote"),
+				Published = Time(Value(note, "published")) ?? DateTime.UtcNow,
+				Updated = Time(Value(note, "updated")),
+				To = List(note["to"]),
+				Cc = List(note["cc"]),
+				Mentions = Tags(note, "Mention").Select(t => new PostMention { ActorURI = Value(t, "href"), Handle = Value(t, "name") })
+					.Where(m => Origin.Of(m.ActorURI) != default)
+					.DistinctBy(m => m.ActorURI)
+					.Take(MaxTags)
+					.ToList(),
+				Tags = Tags(note, "Hashtag").Select(t => Value(t, "name")?.TrimStart('#').ToLowerInvariant())
+					.Where(t => !string.IsNullOrEmpty(t))
+					.Distinct()
+					.Take(MaxTags)
+					.ToList(),
+				Attachments = Attachments(note)
+			};
+		}
+
+		static (string Html, string Language) Content(JsonObject note)
+		{
+			var content = Value(note, "content");
+			string language = default;
+			if (note["contentMap"] is JsonObject map && map.Count > 0)
+			{
+				var first = map.First();
+				language = first.Key;
+				if (string.IsNullOrEmpty(content) && first.Value is JsonValue value && value.TryGetValue<string>(out var mapped))
+					content = mapped;
+			}
+			if (string.IsNullOrEmpty(content) && Value(note, "_misskey_content") is { } misskey)
+				content = System.Net.WebUtility.HtmlEncode(misskey).Replace("\n", "<br>");
+			return (content, language);
+		}
+
+		static string Attribution(JsonNode node) => node switch
+		{
+			JsonArray array => array.OfType<JsonObject>().Where(o => Value(o, "type") is "Person" or "Service" or "Application" or "Organization").Select(Id)
+				.Concat(array.OfType<JsonValue>().Select(Id))
+				.Concat(array.OfType<JsonObject>().Where(o => Value(o, "type") == "Group").Select(Id))
+				.FirstOrDefault(id => id != default),
+			_ => Id(node)
+		};
+
+		static IEnumerable<JsonObject> Tags(JsonObject note, string type) =>
+			(note["tag"] switch
+			{
+				JsonArray array => array.OfType<JsonObject>(),
+				JsonObject single => new[] { single },
+				_ => Enumerable.Empty<JsonObject>()
+			}).Where(t => Value(t, "type") == type);
+
+		static List<PostMedia> Attachments(JsonObject note)
+		{
+			var items = note["attachment"] switch
+			{
+				JsonArray array => array.OfType<JsonObject>(),
+				JsonObject single => new[] { single },
+				_ => Enumerable.Empty<JsonObject>()
+			};
+			return items
+				.Where(a => Value(a, "type") is "Document" or "Image" or "Video" or "Audio")
+				.Select(a => new PostMedia
+				{
+					RemoteURL = UrlOf(a["url"]),
+					ContentType = Value(a, "mediaType"),
+					Description = Plain(Value(a, "name") ?? Value(a, "summary"), 1500),
+					Blurhash = Value(a, "blurhash"),
+					Width = Int(a["width"]),
+					Height = Int(a["height"]),
+					Focus = a["focalPoint"] is JsonArray focus && focus.Count == 2
+						? focus.Select(f => f is JsonValue v && v.TryGetValue<double>(out var d) ? (float)Math.Clamp(d, -1, 1) : 0f).ToArray()
+						: default
+				})
+				.Where(m => Origin.Of(m.RemoteURL) != default)
+				.Take(MaxAttachments)
+				.ToList();
+		}
+
+		static string UrlOf(JsonNode node) => node switch
+		{
+			JsonValue value when value.TryGetValue<string>(out var text) => text,
+			JsonObject obj => Value(obj, "href") ?? Value(obj, "id"),
+			JsonArray array => array.Select(item => item is JsonObject link && Value(link, "mediaType") is { } mediaType && !mediaType.StartsWith("text/html")
+					? default
+					: UrlOf(item))
+				.FirstOrDefault(url => url != default) ?? array.Select(UrlOf).FirstOrDefault(url => url != default),
+			_ => default
+		};
+
+		static IReadOnlyList<string> List(JsonNode node) => node switch
+		{
+			JsonArray array => array.Select(Id).Where(id => id != default).Distinct(StringComparer.Ordinal).ToList(),
+			JsonNode single when Id(single) is { } id => new[] { id },
+			_ => Array.Empty<string>()
+		};
+
+		static DateTime? Time(string value) =>
+			DateTimeOffset.TryParse(value, CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal, out var parsed)
+				? parsed.UtcDateTime
+				: default;
+
+		static int? Int(JsonNode node) =>
+			node is JsonValue value && value.TryGetValue<int>(out var number) && number is > 0 and < 100_000 ? number : default;
+
+		static string Plain(string value, int max)
+		{
+			if (string.IsNullOrWhiteSpace(value))
+				return default;
+			value = value.Trim();
+			return value.Length <= max ? value : value[..max];
+		}
+	}
+}
@@ -10,6 +10,10 @@ using System.Text.Json.Nodes;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Signing;
 using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+
+using System.Text.Json;

 namespace PrivaPub.Federation.Outbox
 {
@@ -20,31 +24,38 @@ namespace PrivaPub.Federation.Outbox
 		Task<IReadOnlyList<string>> FollowerInboxes(LocalActor actor, CancellationToken token);
 	}

+	public sealed record DeliveryPayload(string SignerId, LocalActorKind SignerKind, string Inbox, string Body);
+
 	public class DeliveryService : IDeliveryService
 	{
 		readonly DbEntities _dbEntities;
+		readonly IJobQueue _queue;

-		public DeliveryService(DbEntities dbEntities)
+		public DeliveryService(DbEntities dbEntities, IJobQueue queue)
 		{
 			_dbEntities = dbEntities;
+			_queue = queue;
 		}

 		public async Task Enqueue(LocalActor signer, IEnumerable<string> inboxes, JsonObject activity, CancellationToken token)
 		{
 			var body = activity.ToJsonString();
-			var deliveries = inboxes
+			var activityId = activity["id"] is JsonValue id && id.TryGetValue<string>(out var text) ? text : default;
+			var jobs = inboxes
 				.Where(i => !string.IsNullOrEmpty(i) && !i.StartsWith(signer.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
 				.Distinct(StringComparer.Ordinal)
-				.Select(inbox => new Delivery
+				.Select(inbox => Uri.TryCreate(inbox, UriKind.Absolute, out var uri) ? (inbox, uri) : default)
+				.Where(target => target.uri != default)
+				.Select(target => new Job
 				{
-					SignerId = signer.Id,
-					SignerKind = signer.Kind,
-					InboxURL = inbox,
-					Body = body
+					Kind = JobKind.Deliver,
+					Host = target.uri.Host.ToLowerInvariant(),
+					DedupeKey = activityId == default ? default : $"{activityId}|{target.inbox}",
+					Payload = JsonSerializer.Serialize(new DeliveryPayload(signer.Id, signer.Kind, target.inbox, body))
 				})
 				.ToList();
-			if (deliveries.Count > 0)
-				await DB.Default.SaveAsync(deliveries, token);
+			if (jobs.Count > 0)
+				await _queue.EnqueueMany(jobs, token);
 		}

 		public async Task EnqueueToFollowers(LocalActor signer, JsonObject activity, CancellationToken token, IEnumerable<string> extraInboxes = default)
@@ -64,118 +75,81 @@ namespace PrivaPub.Federation.Outbox
 		}
 	}

-	public class DeliveryWorker : BackgroundService
+	public class DeliveryJobHandler : IJobHandler
 	{
-		const int MaxAttempts = 8;
-		static readonly TimeSpan Poll = TimeSpan.FromSeconds(3);
-
-		readonly IServiceProvider _services;
+		readonly ILocalActorService _actors;
 		readonly IFederationHttp _http;
-		readonly ILogger<DeliveryWorker> _logger;
+		readonly IHostCircuitBreaker _breaker;
+		readonly ILogger<DeliveryJobHandler> _logger;

-		public DeliveryWorker(IServiceProvider services, IFederationHttp http, ILogger<DeliveryWorker> logger)
+		public DeliveryJobHandler(ILocalActorService actors, IFederationHttp http, IHostCircuitBreaker breaker, ILogger<DeliveryJobHandler> logger)
 		{
-			_services = services;
+			_actors = actors;
 			_http = http;
+			_breaker = breaker;
 			_logger = logger;
 		}

-		protected override async Task ExecuteAsync(CancellationToken stoppingToken)
-		{
-			while (!stoppingToken.IsCancellationRequested)
-			{
-				try
-				{
-					await DeliverDue(stoppingToken);
-				}
-				catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
-				{
-					return;
-				}
-				catch (Exception ex)
-				{
-					_logger.LogError(ex, "{Worker} pass failed", nameof(DeliveryWorker));
-				}
-				await Task.Delay(Poll, stoppingToken);
-			}
-		}
+		public JobKind Kind => JobKind.Deliver;
+		public int Concurrency => 8;
+		public int MaxAttempts => 16;
+		public int PerHostLimit => 2;

-		async Task DeliverDue(CancellationToken token)
+		public async Task<JobOutcome> Handle(Job job, CancellationToken token)
 		{
-			using var scope = _services.CreateScope();
-			var dbEntities = scope.ServiceProvider.GetRequiredService<DbEntities>();
-			var actors = scope.ServiceProvider.GetRequiredService<ILocalActorService>();
-			var now = DateTime.UtcNow;
-			var due = await dbEntities.Deliveries
-				.Match(d => !d.DeliveredAt.HasValue && !d.AbandonedAt.HasValue && d.NextAttemptAt <= now)
-				.Sort(d => d.NextAttemptAt, Order.Ascending)
-				.Limit(20)
-				.ExecuteAsync(token);
+			var payload = JsonSerializer.Deserialize<DeliveryPayload>(job.Payload);
+			if (payload == default || !Uri.TryCreate(payload.Inbox, UriKind.Absolute, out var inbox) || !_http.IsAllowed(inbox))
+				return JobOutcome.Dead("not a deliverable inbox");

-			foreach (var delivery in due)
-			{
-				var signer = await actors.FindById(delivery.SignerKind, delivery.SignerId, token);
-				if (signer == default)
-				{
-					delivery.AbandonedAt = DateTime.UtcNow;
-					delivery.LastError = "the signing actor no longer exists";
-					await DB.Default.SaveAsync(delivery, token);
-					continue;
-				}
-				await Deliver(delivery, signer, token);
-				await DB.Default.SaveAsync(delivery, token);
-			}
-		}
+			var unavailableUntil = await _breaker.UnavailableUntil(job.Host, token);
+			if (unavailableUntil.HasValue)
+				return JobOutcome.Defer(unavailableUntil.Value, "the host is unavailable");
+
+			var signer = await _actors.FindById(payload.SignerKind, payload.SignerId, token);
+			if (signer == default)
+				return JobOutcome.Dead("the signing actor no longer exists");
+
+			var body = Encoding.UTF8.GetBytes(payload.Body);
+			using var request = new HttpRequestMessage(HttpMethod.Post, inbox) { Content = new ByteArrayContent(body) };
+			request.Content.Headers.ContentType = MediaTypeHeaderValue.Parse(RemoteActorService.ActivityJson);
+			HttpSignatures.Sign(request, signer, body);

-		async Task Deliver(Delivery delivery, LocalActor signer, CancellationToken token)
-		{
-			delivery.Attempts++;
 			try
 			{
-				if (!Uri.TryCreate(delivery.InboxURL, UriKind.Absolute, out var inbox) || !_http.IsAllowed(inbox))
-				{
-					delivery.AbandonedAt = DateTime.UtcNow;
-					delivery.LastError = "not a deliverable inbox";
-					return;
-				}
-
-				var body = Encoding.UTF8.GetBytes(delivery.Body);
-				using var request = new HttpRequestMessage(HttpMethod.Post, inbox)
-				{
-					Content = new ByteArrayContent(body)
-				};
-				request.Content.Headers.ContentType = MediaTypeHeaderValue.Parse(RemoteActorService.ActivityJson);
-				HttpSignatures.Sign(request, signer, body);
-
 				using var response = await _http.Send(request, token);
+				var status = (int)response.StatusCode;
 				if (response.IsSuccessStatusCode)
 				{
-					delivery.DeliveredAt = DateTime.UtcNow;
-					delivery.LastError = default;
-					return;
+					await _breaker.Succeeded(job.Host, token);
+					return JobOutcome.Done;
 				}
-
-				delivery.LastError = $"{(int)response.StatusCode} {response.ReasonPhrase}";
-				if (response.StatusCode is HttpStatusCode.Gone or HttpStatusCode.NotFound or HttpStatusCode.BadRequest or HttpStatusCode.Forbidden)
+				if (response.StatusCode == HttpStatusCode.TooManyRequests)
 				{
-					delivery.AbandonedAt = DateTime.UtcNow;
-					_logger.LogWarning("Delivery {Id} to {Inbox} abandoned: {Status}", delivery.ID, delivery.InboxURL, delivery.LastError);
-					return;
+					var retryAfter = response.Headers.RetryAfter?.Delta ?? (response.Headers.RetryAfter?.Date - DateTimeOffset.UtcNow);
+					return retryAfter > TimeSpan.Zero
+						? JobOutcome.Defer(DateTime.UtcNow + Min(retryAfter.Value, TimeSpan.FromHours(6)), "429")
+						: JobOutcome.Retry("429");
 				}
+				if (status is >= 400 and < 500 && status != 408)
+				{
+					await _breaker.Succeeded(job.Host, token);
+					_logger.LogInformation("Delivery to {Inbox} refused with {Status}", payload.Inbox, status);
+					return JobOutcome.Dead($"{status} {response.ReasonPhrase}");
+				}
+				await _breaker.Failed(job.Host, $"{status}", token);
+				return JobOutcome.Retry($"{status} {response.ReasonPhrase}");
 			}
-			catch (Exception ex) when (ex is HttpRequestException or BlockedDestinationException or TaskCanceledException && !token.IsCancellationRequested)
+			catch (BlockedDestinationException ex)
 			{
-				delivery.LastError = ex.Message;
+				return JobOutcome.Dead(ex.Message);
 			}
-
-			if (delivery.Attempts >= MaxAttempts)
+			catch (Exception ex) when (ex is HttpRequestException or TaskCanceledException && !token.IsCancellationRequested)
 			{
-				delivery.AbandonedAt = DateTime.UtcNow;
-				_logger.LogWarning("Delivery {Id} to {Inbox} abandoned after {Attempts} attempts: {Error}",
-					delivery.ID, delivery.InboxURL, delivery.Attempts, delivery.LastError);
-				return;
+				await _breaker.Failed(job.Host, ex.GetType().Name, token);
+				return JobOutcome.Retry(ex.Message);
 			}
-			delivery.NextAttemptAt = DateTime.UtcNow.AddMinutes(Math.Pow(2, delivery.Attempts));
 		}
+
+		static TimeSpan Min(TimeSpan a, TimeSpan b) => a < b ? a : b;
 	}
 }
@@ -0,0 +1,95 @@
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Outbox
+{
+	public interface IOutboxPublisher
+	{
+		Task<IReadOnlyList<string>> Audience(LocalActor author, PostEntity post, CancellationToken token);
+		Task Publish(LocalActor author, PostEntity post, JsonObject activity, CancellationToken token);
+		Task PublishProfile(LocalActor actor, CancellationToken token);
+	}
+
+	public class OutboxPublisher : IOutboxPublisher
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IDeliveryService _delivery;
+
+		public OutboxPublisher(DbEntities dbEntities, ILocalActorService localActors, IDeliveryService delivery)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_delivery = delivery;
+		}
+
+		public async Task<IReadOnlyList<string>> Audience(LocalActor author, PostEntity post, CancellationToken token)
+		{
+			if (post.Visibility is PostVisibility.Circle or PostVisibility.LocalGeo || post.IsLocalOnly)
+				return Array.Empty<string>();
+
+			var inboxes = new List<string>();
+			if (post.Visibility is PostVisibility.Public or PostVisibility.Unlisted or PostVisibility.FollowersOnly)
+				inboxes.AddRange(await _delivery.FollowerInboxes(author, token));
+
+			var addressed = post.Mentions.Where(m => !m.IsLocal).Select(m => m.ActorURI)
+				.Concat(post.Visibility == PostVisibility.Direct ? post.To.Concat(post.Cc) : Enumerable.Empty<string>())
+				.Where(uri => !uri.StartsWith(author.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+				.Distinct(StringComparer.Ordinal)
+				.ToList();
+			foreach (var uri in addressed)
+			{
+				var actor = await _dbEntities.ForeignAvatars.Match(a => a.ActorURI == uri).ExecuteFirstAsync(token);
+				if (actor != default && !string.IsNullOrEmpty(actor.InboxURL))
+					inboxes.Add(actor.InboxURL);
+			}
+
+			if (post.Visibility != PostVisibility.Direct && !string.IsNullOrEmpty(post.InReplyToAccountId))
+			{
+				var parentAuthor = await _dbEntities.ForeignAvatars.MatchID(post.InReplyToAccountId).ExecuteFirstAsync(token);
+				if (parentAuthor != default && !string.IsNullOrEmpty(parentAuthor.InboxURL))
+					inboxes.Add(parentAuthor.InboxURL);
+			}
+
+			if (!string.IsNullOrEmpty(post.GroupId) && post.Visibility is PostVisibility.Public or PostVisibility.Unlisted)
+			{
+				var group = await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
+				if (group is { IsFederated: true })
+					inboxes.AddRange(await _delivery.FollowerInboxes(group, token));
+			}
+
+			return inboxes.Where(i => !string.IsNullOrEmpty(i)).Distinct(StringComparer.Ordinal).ToList();
+		}
+
+		public async Task Publish(LocalActor author, PostEntity post, JsonObject activity, CancellationToken token)
+		{
+			var inboxes = await Audience(author, post, token);
+			if (inboxes.Count > 0)
+				await _delivery.Enqueue(author, inboxes, activity, token);
+		}
+
+		public async Task PublishProfile(LocalActor actor, CancellationToken token)
+		{
+			var document = ActivityPubRenderer.Actor(actor);
+			document.Remove("@context");
+			var update = new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.Context(),
+				["id"] = actor.ActivityUri($"update-profile-{DateTimeOffset.UtcNow.ToUnixTimeMilliseconds()}"),
+				["type"] = "Update",
+				["actor"] = actor.Uri,
+				["to"] = new JsonArray(ActivityPubRenderer.Public),
+				["cc"] = new JsonArray(actor.Followers),
+				["object"] = document
+			};
+			await _delivery.EnqueueToFollowers(actor, update, token);
+		}
+	}
+}
@@ -1,34 +1,65 @@
 using Markdig;

+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Objects;
 using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;

 using System.Globalization;
+using System.Net;
 using System.Text.Json.Nodes;

 using PostEntity = PrivaPub.Models.Post.Post;
-using DmPostEntity = PrivaPub.Models.Post.DmPost;
-using PrivaPub.Federation.Actors;

 namespace PrivaPub.Federation.Rendering
 {
 	public static class ActivityPubRenderer
 	{
 		public const string ActivityStreams = "https://www.w3.org/ns/activitystreams";
-		public const string Public = "https://www.w3.org/ns/activitystreams#Public";
+		public const string Public = Addressing.Public;
+		public const string ContentWarning = "Content warning";

 		static readonly MarkdownPipeline Pipeline = new MarkdownPipelineBuilder().DisableHtml().Build();

+		public static JsonArray Context() => new(
+			ActivityStreams,
+			"https://w3id.org/security/v1",
+			new JsonObject
+			{
+				["manuallyApprovesFollowers"] = "as:manuallyApprovesFollowers",
+				["sensitive"] = "as:sensitive",
+				["Hashtag"] = "as:Hashtag",
+				["alsoKnownAs"] = new JsonObject { ["@id"] = "as:alsoKnownAs", ["@type"] = "@id" },
+				["movedTo"] = new JsonObject { ["@id"] = "as:movedTo", ["@type"] = "@id" },
+				["toot"] = "http://joinmastodon.org/ns#",
+				["featured"] = new JsonObject { ["@id"] = "toot:featured", ["@type"] = "@id" },
+				["featuredTags"] = new JsonObject { ["@id"] = "toot:featuredTags", ["@type"] = "@id" },
+				["discoverable"] = "toot:discoverable",
+				["indexable"] = "toot:indexable",
+				["blurhash"] = "toot:blurhash",
+				["focalPoint"] = new JsonObject { ["@container"] = "@list", ["@id"] = "toot:focalPoint" },
+				["schema"] = "http://schema.org#",
+				["PropertyValue"] = "schema:PropertyValue",
+				["value"] = "schema:value",
+				["webfinger"] = "https://purl.archive.org/socialweb/webfinger#webfinger"
+			});
+
 		public static string Html(string markdown) =>
 			string.IsNullOrEmpty(markdown) ? string.Empty : Markdown.ToHtml(markdown, Pipeline).Trim();

 		public static string Timestamp(DateTime value) =>
 			DateTime.SpecifyKind(value, DateTimeKind.Utc).ToString("yyyy-MM-ddTHH:mm:ssZ", CultureInfo.InvariantCulture);

+		public static string Day(DateTime value) =>
+			DateTime.SpecifyKind(value, DateTimeKind.Utc).Date.ToString("yyyy-MM-ddT00:00:00Z", CultureInfo.InvariantCulture);
+
+		public static string TagUrl(string baseAddress, string tag) => $"{baseAddress}/tags/{Uri.EscapeDataString(tag)}";
+
 		public static JsonObject Actor(LocalActor actor)
 		{
 			var document = new JsonObject
 			{
-				["@context"] = new JsonArray(ActivityStreams, "https://w3id.org/security/v1"),
+				["@context"] = Context(),
 				["id"] = actor.Uri,
 				["type"] = actor.Kind switch
 				{
@@ -39,21 +70,29 @@ namespace PrivaPub.Federation.Rendering
 				["preferredUsername"] = actor.UserName,
 				["name"] = actor.Name,
 				["summary"] = Html(actor.Summary),
-				["url"] = actor.Uri,
+				["url"] = actor.Kind == LocalActorKind.Application ? actor.Uri : actor.HtmlUrl,
 				["inbox"] = actor.Inbox,
 				["outbox"] = actor.Outbox,
 				["followers"] = actor.Followers,
 				["following"] = actor.Following,
-				["published"] = Timestamp(actor.Published),
+				["published"] = Day(actor.Published),
 				["manuallyApprovesFollowers"] = actor.ManuallyApprovesFollowers,
 				["discoverable"] = actor.Discoverable,
+				["indexable"] = false,
+				["webfinger"] = actor.Handle,
 				["endpoints"] = new JsonObject { ["sharedInbox"] = actor.SharedInbox },
 				["publicKey"] = new JsonObject
 				{
 					["id"] = actor.KeyId,
 					["owner"] = actor.Uri,
 					["publicKeyPem"] = Keys.ToSubjectPublicKeyInfoPem(actor.PublicKeyPem)
-				}
+				},
+				["attachment"] = new JsonArray(actor.Fields.Select(field => (JsonNode)new JsonObject
+				{
+					["type"] = "PropertyValue",
+					["name"] = field.Key,
+					["value"] = FieldValue(field.Value)
+				}).ToArray())
 			};
 			if (!string.IsNullOrEmpty(actor.PictureURL))
 				document["icon"] = new JsonObject { ["type"] = "Image", ["url"] = actor.PictureURL };
@@ -64,63 +103,104 @@ namespace PrivaPub.Federation.Rendering

 		public static JsonObject Note(PostEntity post, LocalActor author, LocalActor group, string inReplyTo)
 		{
-			var to = new JsonArray(Public);
-			var cc = new JsonArray(author.Followers);
+			var mentions = post.Mentions.Select(m => (JsonNode)m.ActorURI).ToArray();
+			var (to, cc) = post.Visibility switch
+			{
+				PostVisibility.Unlisted => (new JsonArray(author.Followers), new JsonArray(mentions.Prepend(Public).ToArray())),
+				PostVisibility.FollowersOnly => (new JsonArray(author.Followers), new JsonArray(mentions)),
+				PostVisibility.Direct => (new JsonArray(mentions), new JsonArray()),
+				_ => (new JsonArray(Public), new JsonArray(mentions.Prepend(author.Followers).ToArray()))
+			};
 			if (group != default)
 				cc.Add(group.Uri);

-			var note = NoteBody(author.PostUri(post.ID), author, post.Title, post.Text, post.HasContentWarning,
-				post.CreationDate, to, cc, inReplyTo);
+			var note = NoteBody(post, author, to, cc, inReplyTo);
 			if (group != default)
 				note["audience"] = group.Uri;
 			return note;
 		}

-		public static JsonObject DirectNote(DmPostEntity post, LocalActor author, IReadOnlyList<(string Uri, string Handle)> recipients,
+		public static JsonObject DirectNote(PostEntity post, LocalActor author, IReadOnlyList<(string Uri, string Handle)> recipients,
 			string context)
 		{
-			var note = NoteBody(author.PostUri(post.ID), author, post.Title, post.Text, post.HasContentWarning,
-				post.CreationDate, new JsonArray(recipients.Select(r => (JsonNode)r.Uri).ToArray()), new JsonArray(), default);
-			note["tag"] = new JsonArray(recipients.Select(r => (JsonNode)new JsonObject
-			{
-				["type"] = "Mention",
-				["href"] = r.Uri,
-				["name"] = "@" + r.Handle
-			}).ToArray());
-			note["content"] = string.Join(" ", recipients.Select(r => $"<span class=\"h-card\"><a href=\"{r.Uri}\" class=\"u-url mention\">@{r.Handle}</a></span>"))
-				+ " " + note["content"]!.GetValue<string>();
+			var note = NoteBody(post, author, new JsonArray(recipients.Select(r => (JsonNode)r.Uri).ToArray()), new JsonArray(), post.InReplyToURI);
+			var named = post.Mentions.Select(m => m.ActorURI).ToHashSet();
+			var tags = note["tag"]!.AsArray();
+			foreach (var recipient in recipients.Where(r => !named.Contains(r.Uri)))
+				tags.Add(new JsonObject { ["type"] = "Mention", ["href"] = recipient.Uri, ["name"] = "@" + recipient.Handle });
+			var unmentioned = recipients.Where(r => !named.Contains(r.Uri)).ToList();
+			if (unmentioned.Count > 0)
+				note["content"] = "<p>" + string.Join(" ", unmentioned.Select(r =>
+						$"<span class=\"h-card\" translate=\"no\"><a href=\"{WebUtility.HtmlEncode(r.Uri)}\" class=\"u-url mention\">@<span>{WebUtility.HtmlEncode(r.Handle.Split('@')[0])}</span></a></span>"))
+					+ "</p>" + note["content"]!.GetValue<string>();
 			if (!string.IsNullOrEmpty(context))
 				note["context"] = context;
 			return note;
 		}

-		static JsonObject NoteBody(string id, LocalActor author, string title, string text, bool sensitive,
-			DateTime published, JsonArray to, JsonArray cc, string inReplyTo)
+		static JsonObject NoteBody(PostEntity post, LocalActor author, JsonArray to, JsonArray cc, string inReplyTo)
 		{
+			var content = post.ContentHtml ?? Html(post.Text);
+			if (!string.IsNullOrEmpty(post.Title))
+				content = $"<p><strong>{WebUtility.HtmlEncode(post.Title)}</strong></p>{content}";
+
 			var note = new JsonObject
 			{
-				["id"] = id,
+				["id"] = author.PostUri(post.ID),
 				["type"] = "Note",
 				["attributedTo"] = author.Uri,
-				["content"] = Html(text),
-				["published"] = Timestamp(published),
-				["url"] = id,
+				["content"] = content,
+				["published"] = Timestamp(post.CreationDate),
+				["url"] = author.PostHtmlUrl(post.ID),
 				["to"] = to,
 				["cc"] = cc,
-				["sensitive"] = sensitive
+				["sensitive"] = post.HasContentWarning,
+				["tag"] = new JsonArray(post.Mentions
+					.Select(m => (JsonNode)new JsonObject { ["type"] = "Mention", ["href"] = m.ActorURI, ["name"] = MentionName(m) })
+					.Concat(post.Tags.Select(t => (JsonNode)new JsonObject
+					{
+						["type"] = "Hashtag",
+						["href"] = TagUrl(author.BaseAddress, t),
+						["name"] = "#" + t
+					}))
+					.ToArray())
 			};
-			if (sensitive && !string.IsNullOrEmpty(title))
-				note["summary"] = title;
-			else if (!string.IsNullOrEmpty(title))
-				note["name"] = title;
+			if (!string.IsNullOrEmpty(post.Language))
+				note["contentMap"] = new JsonObject { [post.Language] = content };
+			if (!string.IsNullOrEmpty(post.Title))
+				note["name"] = post.Title;
+			var summary = post.SpoilerText ?? (post.HasContentWarning ? post.Title ?? ContentWarning : default);
+			if (!string.IsNullOrEmpty(summary))
+			{
+				note["summary"] = summary;
+				note["sensitive"] = true;
+			}
 			if (!string.IsNullOrEmpty(inReplyTo))
 				note["inReplyTo"] = inReplyTo;
+			if (post.EditedAt.HasValue)
+				note["updated"] = Timestamp(post.EditedAt.Value);
 			return note;
 		}

+		static string MentionName(PostMention mention)
+		{
+			var handle = mention.Handle?.TrimStart('@');
+			if (string.IsNullOrEmpty(handle))
+				return "@" + mention.ActorURI;
+			return "@" + (handle.Contains('@') ? handle : $"{handle}@{new Uri(mention.ActorURI).Authority}");
+		}
+
+		static string FieldValue(string value)
+		{
+			var encoded = WebUtility.HtmlEncode(value ?? string.Empty);
+			return Uri.TryCreate(value, UriKind.Absolute, out var link) && link.Scheme is "https" or "http"
+				? $"<a href=\"{encoded}\" target=\"_blank\" rel=\"nofollow noopener noreferrer me\" translate=\"no\">{encoded}</a>"
+				: encoded;
+		}
+
 		public static JsonObject Create(LocalActor actor, JsonObject note, string activityId) => new()
 		{
-			["@context"] = ActivityStreams,
+			["@context"] = Context(),
 			["id"] = actor.ActivityUri(activityId),
 			["type"] = "Create",
 			["actor"] = actor.Uri,
@@ -162,7 +242,7 @@ namespace PrivaPub.Federation.Rendering
 			["object"] = follow.DeepClone()
 		};

-		public static JsonObject OrderedCollection(string id, int totalItems, IEnumerable<JsonNode> items)
+		public static JsonObject OrderedCollection(string id, int totalItems, IEnumerable<JsonNode> items, string first = default)
 		{
 			var collection = new JsonObject
 			{
@@ -171,9 +251,28 @@ namespace PrivaPub.Federation.Rendering
 				["type"] = "OrderedCollection",
 				["totalItems"] = totalItems
 			};
+			if (first != default)
+				collection["first"] = first;
 			if (items != default)
 				collection["orderedItems"] = new JsonArray(items.ToArray());
 			return collection;
 		}
+
+		public static JsonObject OrderedCollectionPage(string id, string partOf, IEnumerable<JsonNode> items, string next, string prev)
+		{
+			var page = new JsonObject
+			{
+				["@context"] = Context(),
+				["id"] = id,
+				["type"] = "OrderedCollectionPage",
+				["partOf"] = partOf,
+				["orderedItems"] = new JsonArray(items.ToArray())
+			};
+			if (next != default)
+				page["next"] = next;
+			if (prev != default)
+				page["prev"] = prev;
+			return page;
+		}
 	}
 }
@@ -4,7 +4,9 @@ using MongoDB.Entities;

 using PrivaPub.Models.Federation;
 using PrivaPub.Models.Group;
+using PrivaPub.Models.Jobs;
 using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
 using PrivaPub.Models.User;

 namespace PrivaPub.Infrastructure.Data
@@ -17,6 +19,8 @@ namespace PrivaPub.Infrastructure.Data
 			await Plain<Post>(token, p => p.GroupUserId, p => p.ID);
 			await Plain<Post>(token, p => p.GroupId, p => p.ID);
 			await Plain<Post>(token, p => p.ActorURI);
+			await Plain<Post>(token, p => p.ConversationId, p => p.ID);
+			await Plain<Post>(token, p => p.InReplyToURI);

 			await Unique<DmPost>(p => p.ObjectURI, Builders<DmPost>.Filter.Type(p => p.ObjectURI, BsonType.String), token);
 			await Plain<DmPost>(token, p => p.GroupId, p => p.ID);
@@ -48,6 +52,38 @@ namespace PrivaPub.Infrastructure.Data
 			await Plain<DmGroup>(token, g => g.ParticipantsKey);

 			await Plain<Delivery>(token, d => d.DeliveredAt, d => d.AbandonedAt, d => d.NextAttemptAt);
+
+			await Plain<Job>(token, j => j.Kind, j => j.State, j => j.RunAt);
+			await Plain<Job>(token, j => j.State, j => j.LeasedUntil);
+			await Unique<Job>(j => j.DedupeKey, Builders<Job>.Filter.Type(j => j.DedupeKey, BsonType.String), token);
+			await DB.Default.Index<Job>()
+				.Key(j => j.FinishedAt, KeyType.Ascending)
+				.Option(o => o.ExpireAfter = TimeSpan.FromDays(7))
+				.CreateAsync(token);
+			await DB.Default.Index<Following>()
+				.Key(f => f.AvatarId, KeyType.Ascending)
+				.Key(f => f.TargetActorURI, KeyType.Ascending)
+				.Option(o => o.Unique = true)
+				.CreateAsync(token);
+			await Plain<Following>(token, f => f.TargetActorURI, f => f.State);
+			await Plain<Following>(token, f => f.TargetAccountId, f => f.State);
+			await Plain<Following>(token, f => f.FollowActivityURI);
+			await DB.Default.Index<TimelineEntry>()
+				.Key(e => e.AvatarId, KeyType.Ascending)
+				.Key(e => e.PostId, KeyType.Ascending)
+				.Option(o => o.Unique = true)
+				.CreateAsync(token);
+			await Plain<TimelineEntry>(token, e => e.PostId);
+			await Unique<Notification>(n => n.DedupeKey, Builders<Notification>.Filter.Type(n => n.DedupeKey, BsonType.String), token);
+			await Plain<Notification>(token, n => n.AvatarId, n => n.ID);
+			await DB.Default.Index<Favourite>()
+				.Key(f => f.AccountId, KeyType.Ascending)
+				.Key(f => f.PostId, KeyType.Ascending)
+				.Option(o => o.Unique = true)
+				.CreateAsync(token);
+			await Plain<Favourite>(token, f => f.ActivityURI);
+			await Unique<DomainBlock>(b => b.Domain, Builders<DomainBlock>.Filter.Type(b => b.Domain, BsonType.String), token);
+			await Unique<RemoteInstance>(i => i.Host, Builders<RemoteInstance>.Filter.Type(i => i.Host, BsonType.String), token);
 		}

 		static async Task Unique<T>(System.Linq.Expressions.Expression<Func<T, object>> key, FilterDefinition<T> partial,
@@ -0,0 +1,43 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Infrastructure.Data.Migrations
+{
+	public class _004_pending_deliveries_become_jobs : IMigration
+	{
+		public async Task UpgradeAsync()
+		{
+			var pending = await DB.Default.Find<Delivery>()
+				.Match(d => !d.DeliveredAt.HasValue && !d.AbandonedAt.HasValue)
+				.ExecuteAsync();
+			foreach (var delivery in pending)
+			{
+				if (Uri.TryCreate(delivery.InboxURL, UriKind.Absolute, out var inbox))
+				{
+					var activityId = JsonNode.Parse(delivery.Body)?["id"]?.GetValue<string>();
+					var job = new Job
+					{
+						Kind = JobKind.Deliver,
+						Host = inbox.Host.ToLowerInvariant(),
+						DedupeKey = activityId == default ? default : $"{activityId}|{delivery.InboxURL}",
+						Attempts = delivery.Attempts,
+						RunAt = delivery.NextAttemptAt,
+						Payload = JsonSerializer.Serialize(new DeliveryPayload(delivery.SignerId, delivery.SignerKind, delivery.InboxURL, delivery.Body))
+					};
+					if (!await DB.Default.Find<Job>().Match(j => j.DedupeKey == job.DedupeKey && job.DedupeKey != null).ExecuteAnyAsync())
+						await DB.Default.SaveAsync(job);
+				}
+				await DB.Default.Update<Delivery>().MatchID(delivery.ID)
+					.Modify(d => d.AbandonedAt, DateTime.UtcNow)
+					.Modify(d => d.LastError, "moved to the job queue")
+					.ExecuteAsync();
+			}
+		}
+	}
+}
@@ -0,0 +1,67 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Post;
+using PrivaPub.Models.User;
+
+namespace PrivaPub.Infrastructure.Data.Migrations
+{
+	public class _005_direct_posts_join_posts : IMigration
+	{
+		public async Task UpgradeAsync()
+		{
+			foreach (var dm in await DB.Default.Find<DmPost>().ExecuteAsync())
+			{
+				if (await DB.Default.Find<Post>().Match(p => p.ID == dm.ID || p.ObjectURI == dm.ObjectURI).ExecuteAnyAsync())
+					continue;
+				await DB.Default.SaveAsync(new Post
+				{
+					ID = dm.ID,
+					GroupUserId = dm.GroupUserId,
+					AuthorAccountId = dm.IsFederatedCopy ? await ForeignAccountId(dm.ActorURI) : dm.GroupUserId,
+					ConversationId = dm.GroupId,
+					Visibility = PostVisibility.Direct,
+					AnsweringToPostId = Local(dm.AnsweringToPostId),
+					InReplyToURI = Remote(dm.AnsweringToPostId),
+					Title = dm.Title,
+					Text = dm.Text,
+					ContentHtml = dm.ContentHtml,
+					ContentFormat = dm.ContentFormat,
+					Media = dm.Media,
+					HasContentWarning = dm.HasContentWarning,
+					IsFederatedCopy = dm.IsFederatedCopy,
+					ObjectURI = dm.ObjectURI,
+					ActorURI = dm.ActorURI,
+					Url = dm.ObjectURI,
+					CreationDate = dm.CreationDate,
+					UpdateDate = dm.UpdateDate
+				});
+			}
+
+			foreach (var post in await DB.Default.Find<Post>().Match(p => p.Visibility != PostVisibility.Direct).ExecuteAsync())
+			{
+				var parent = Local(post.AnsweringToPostId) is { } parentId
+					? await DB.Default.Find<Post>().OneAsync(parentId)
+					: Remote(post.AnsweringToPostId) is { } parentUri
+						? await DB.Default.Find<Post>().Match(p => p.ObjectURI == parentUri).ExecuteFirstAsync()
+						: default;
+				await DB.Default.Update<Post>().MatchID(post.ID)
+					.Modify(p => p.Visibility, post.IsLocalOnly ? PostVisibility.Circle : PostVisibility.Public)
+					.Modify(p => p.AuthorAccountId, post.IsFederatedCopy ? await ForeignAccountId(post.ActorURI) : post.GroupUserId)
+					.Modify(p => p.AnsweringToPostId, parent?.ID)
+					.Modify(p => p.InReplyToURI, parent?.ObjectURI ?? Remote(post.AnsweringToPostId))
+					.Modify(p => p.InReplyToAccountId, parent?.AuthorAccountId ?? parent?.GroupUserId)
+					.Modify(p => p.Url, post.Url ?? post.ObjectURI)
+					.ExecuteAsync();
+			}
+		}
+
+		static string Local(string reference) =>
+			string.IsNullOrEmpty(reference) || reference.Contains("://") ? default : reference;
+
+		static string Remote(string reference) =>
+			reference != default && reference.Contains("://") ? reference : default;
+
+		static async Task<string> ForeignAccountId(string actorUri) =>
+			(await DB.Default.Find<ForeignAvatar>().Match(a => a.ActorURI == actorUri).ExecuteFirstAsync())?.ID;
+	}
+}
@@ -1,6 +1,8 @@
 using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Options;

+using PrivaPub.Federation.Moderation;
+
 using System.Net;
 using System.Text.Json;

@@ -41,14 +43,16 @@ namespace PrivaPub.Infrastructure.Http
 		readonly IHttpClientFactory _httpClientFactory;
 		readonly IMemoryCache _cache;
 		readonly IOptionsMonitor<FederationOptions> _options;
+		readonly IDomainBlocks _domainBlocks;
 		readonly ILogger<FederationHttp> _logger;

 		public FederationHttp(IHttpClientFactory httpClientFactory, IMemoryCache cache, IOptionsMonitor<FederationOptions> options,
-			ILogger<FederationHttp> logger)
+			IDomainBlocks domainBlocks, ILogger<FederationHttp> logger)
 		{
 			_httpClientFactory = httpClientFactory;
 			_cache = cache;
 			_options = options;
+			_domainBlocks = domainBlocks;
 			_logger = logger;
 		}

@@ -56,6 +60,8 @@ namespace PrivaPub.Infrastructure.Http
 		{
 			if (target is not { IsAbsoluteUri: true } || !string.IsNullOrEmpty(target.UserInfo))
 				return false;
+			if (_domainBlocks?.IsSuspended(target.Host) == true)
+				return false;
 			var options = _options.CurrentValue;
 			if (target.Scheme != Uri.UriSchemeHttps && !(options.AllowPlainHttp && target.Scheme == Uri.UriSchemeHttp))
 				return false;
@@ -0,0 +1,20 @@
+using System.Buffers.Binary;
+using System.Security.Cryptography;
+
+namespace PrivaPub.Infrastructure.Ids
+{
+	public static class PrivacyIds
+	{
+		public static string ForDay(DateTime when) => At(DateTime.SpecifyKind(when, DateTimeKind.Utc).Date);
+
+		public static string At(DateTime when)
+		{
+			var seconds = Math.Clamp(new DateTimeOffset(DateTime.SpecifyKind(when, DateTimeKind.Utc)).ToUnixTimeSeconds(), 0,
+				DateTimeOffset.UtcNow.AddDays(1).ToUnixTimeSeconds());
+			Span<byte> bytes = stackalloc byte[12];
+			BinaryPrimitives.WriteInt32BigEndian(bytes, (int)seconds);
+			RandomNumberGenerator.Fill(bytes[4..]);
+			return Convert.ToHexStringLower(bytes);
+		}
+	}
+}
@@ -0,0 +1,13 @@
+namespace PrivaPub.Infrastructure.Jobs
+{
+	public static class Backoff
+	{
+		public static TimeSpan After(int attempt) =>
+			TimeSpan.FromSeconds(Math.Pow(attempt, 4) + 15 + Random.Shared.Next(10) * (attempt + 1));
+
+		public static TimeSpan HostQuarantine(int consecutiveFailures, int threshold) =>
+			consecutiveFailures < threshold
+				? TimeSpan.Zero
+				: TimeSpan.FromHours(Math.Min(Math.Pow(2, consecutiveFailures - threshold), 24 * 7));
+	}
+}
@@ -0,0 +1,76 @@
+using Microsoft.Extensions.Caching.Memory;
+
+using MongoDB.Entities;
+
+using PrivaPub.Models.Jobs;
+
+namespace PrivaPub.Infrastructure.Jobs
+{
+	public interface IHostCircuitBreaker
+	{
+		Task<DateTime?> UnavailableUntil(string host, CancellationToken token);
+		Task Succeeded(string host, CancellationToken token);
+		Task Failed(string host, string error, CancellationToken token);
+	}
+
+	public class HostCircuitBreaker : IHostCircuitBreaker
+	{
+		public const int Threshold = 10;
+		static readonly TimeSpan CacheLifetime = TimeSpan.FromSeconds(30);
+
+		readonly IMemoryCache _cache;
+
+		public HostCircuitBreaker(IMemoryCache cache)
+		{
+			_cache = cache;
+		}
+
+		public async Task<DateTime?> UnavailableUntil(string host, CancellationToken token)
+		{
+			var instance = await Instance(host, token);
+			return instance?.UnavailableUntil > DateTime.UtcNow ? instance.UnavailableUntil : default;
+		}
+
+		public async Task Succeeded(string host, CancellationToken token)
+		{
+			var instance = await Instance(host, token);
+			if (instance is not { ConsecutiveFailures: > 0 } && instance?.LastSuccessAt > DateTime.UtcNow.AddHours(-1))
+				return;
+			await DB.Default.Update<RemoteInstance>()
+				.Match(i => i.Host == host)
+				.Modify(i => i.ConsecutiveFailures, 0)
+				.Modify(i => i.UnavailableUntil, null)
+				.Modify(i => i.LastSuccessAt, DateTime.UtcNow)
+				.Option(o => o.IsUpsert = true)
+				.ExecuteAsync(token);
+			_cache.Remove(Key(host));
+		}
+
+		public async Task Failed(string host, string error, CancellationToken token)
+		{
+			var now = DateTime.UtcNow;
+			var instance = await DB.Default.UpdateAndGet<RemoteInstance>()
+				.Match(i => i.Host == host)
+				.Modify(b => b.Inc(i => i.ConsecutiveFailures, 1))
+				.Modify(i => i.LastFailureAt, now)
+				.Modify(i => i.LastError, error)
+				.Option(o => o.IsUpsert = true)
+				.ExecuteAsync(token);
+			var quarantine = Backoff.HostQuarantine(instance.ConsecutiveFailures, Threshold);
+			if (quarantine > TimeSpan.Zero)
+				await DB.Default.Update<RemoteInstance>().MatchID(instance.ID)
+					.Modify(i => i.UnavailableUntil, now + quarantine)
+					.ExecuteAsync(token);
+			_cache.Remove(Key(host));
+		}
+
+		async Task<RemoteInstance> Instance(string host, CancellationToken token) =>
+			await _cache.GetOrCreateAsync(Key(host), async entry =>
+			{
+				entry.AbsoluteExpirationRelativeToNow = CacheLifetime;
+				return await DB.Default.Find<RemoteInstance>().Match(i => i.Host == host).ExecuteFirstAsync(token);
+			});
+
+		static string Key(string host) => "remote-instance:" + host;
+	}
+}
@@ -0,0 +1,142 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Models.Jobs;
+
+using System.Collections.Concurrent;
+
+namespace PrivaPub.Infrastructure.Jobs
+{
+	public sealed record JobOutcome(JobResult Result, string Error = default, DateTime? RetryAt = default)
+	{
+		public static readonly JobOutcome Done = new(JobResult.Done);
+		public static JobOutcome Retry(string error) => new(JobResult.Retry, error);
+		public static JobOutcome Dead(string error) => new(JobResult.Dead, error);
+		public static JobOutcome Defer(DateTime until, string error) => new(JobResult.Defer, error, until);
+	}
+
+	public enum JobResult
+	{
+		Done,
+		Retry,
+		Dead,
+		Defer
+	}
+
+	public interface IJobQueue
+	{
+		Task<bool> Enqueue(JobKind kind, string payload, string host, string dedupeKey, CancellationToken token);
+		Task<int> EnqueueMany(IEnumerable<Job> jobs, CancellationToken token);
+		Task<Job> Lease(JobKind kind, IReadOnlyCollection<string> busyHosts, CancellationToken token);
+		Task Finish(Job job, JobOutcome outcome, int maxAttempts, CancellationToken token);
+		Task<long> Reap(CancellationToken token);
+		Task WaitForWork(JobKind kind, TimeSpan poll, CancellationToken token);
+	}
+
+	public class JobQueue : IJobQueue
+	{
+		public static readonly TimeSpan LeaseTime = TimeSpan.FromMinutes(2);
+
+		readonly string _owner = $"{Environment.MachineName}:{Environment.ProcessId}";
+		readonly ConcurrentDictionary<JobKind, SemaphoreSlim> _signals = new();
+
+		public async Task<bool> Enqueue(JobKind kind, string payload, string host, string dedupeKey, CancellationToken token) =>
+			await EnqueueMany(new[] { new Job { Kind = kind, Payload = payload, Host = host, DedupeKey = dedupeKey } }, token) == 1;
+
+		public async Task<int> EnqueueMany(IEnumerable<Job> jobs, CancellationToken token)
+		{
+			var inserted = 0;
+			foreach (var job in jobs)
+			{
+				try
+				{
+					await DB.Default.SaveAsync(job, token);
+					inserted++;
+					Signal(job.Kind);
+				}
+				catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+				{
+				}
+			}
+			return inserted;
+		}
+
+		public async Task<Job> Lease(JobKind kind, IReadOnlyCollection<string> busyHosts, CancellationToken token)
+		{
+			var now = DateTime.UtcNow;
+			var busy = busyHosts?.ToList() ?? new List<string>();
+			return await DB.Default.UpdateAndGet<Job>()
+				.Match(j => j.Kind == kind && j.State == JobState.Pending && j.RunAt <= now && !busy.Contains(j.Host))
+				.Modify(j => j.State, JobState.Running)
+				.Modify(j => j.LeasedUntil, now + LeaseTime)
+				.Modify(j => j.LeaseOwner, _owner)
+				.Modify(b => b.Inc(j => j.Attempts, 1))
+				.Option(o => o.Sort = Builders<Job>.Sort.Ascending(j => j.RunAt))
+				.ExecuteAsync(token);
+		}
+
+		public async Task Finish(Job job, JobOutcome outcome, int maxAttempts, CancellationToken token)
+		{
+			var now = DateTime.UtcNow;
+			var update = DB.Default.Update<Job>().MatchID(job.ID)
+				.Modify(j => j.LeasedUntil, null)
+				.Modify(j => j.LeaseOwner, null)
+				.Modify(j => j.LastError, outcome.Error);
+			switch (outcome.Result)
+			{
+				case JobResult.Done:
+					update.Modify(j => j.State, JobState.Done).Modify(j => j.FinishedAt, now);
+					break;
+				case JobResult.Retry when job.Attempts < maxAttempts:
+					update.Modify(j => j.State, JobState.Pending).Modify(j => j.RunAt, now + Backoff.After(job.Attempts));
+					break;
+				case JobResult.Defer:
+					update.Modify(j => j.State, JobState.Pending)
+						.Modify(j => j.RunAt, outcome.RetryAt ?? now + Backoff.After(job.Attempts))
+						.Modify(b => b.Inc(j => j.Attempts, -1));
+					break;
+				default:
+					update.Modify(j => j.State, JobState.Dead).Modify(j => j.FinishedAt, now);
+					break;
+			}
+			await update.ExecuteAsync(token);
+		}
+
+		public async Task<long> Reap(CancellationToken token)
+		{
+			var now = DateTime.UtcNow;
+			var result = await DB.Default.Update<Job>()
+				.Match(j => j.State == JobState.Running && j.LeasedUntil < now)
+				.Modify(j => j.State, JobState.Pending)
+				.Modify(j => j.RunAt, now)
+				.Modify(j => j.LeasedUntil, null)
+				.Modify(j => j.LeaseOwner, null)
+				.ExecuteAsync(token);
+			return result.ModifiedCount;
+		}
+
+		public async Task WaitForWork(JobKind kind, TimeSpan poll, CancellationToken token)
+		{
+			try
+			{
+				await SignalFor(kind).WaitAsync(poll, token);
+			}
+			catch (OperationCanceledException) when (token.IsCancellationRequested)
+			{
+			}
+		}
+
+		void Signal(JobKind kind)
+		{
+			try
+			{
+				SignalFor(kind).Release();
+			}
+			catch (SemaphoreFullException)
+			{
+			}
+		}
+
+		SemaphoreSlim SignalFor(JobKind kind) => _signals.GetOrAdd(kind, _ => new SemaphoreSlim(0, 64));
+	}
+}
@@ -0,0 +1,137 @@
+using PrivaPub.Models.Jobs;
+
+using System.Collections.Concurrent;
+
+namespace PrivaPub.Infrastructure.Jobs
+{
+	public interface IJobHandler
+	{
+		JobKind Kind { get; }
+		int Concurrency { get; }
+		int MaxAttempts { get; }
+		int PerHostLimit { get; }
+		Task<JobOutcome> Handle(Job job, CancellationToken token);
+	}
+
+	public class JobWorker : BackgroundService
+	{
+		static readonly TimeSpan Poll = TimeSpan.FromSeconds(5);
+		static readonly TimeSpan ReapInterval = TimeSpan.FromSeconds(30);
+
+		readonly IJobQueue _queue;
+		readonly IEnumerable<IJobHandler> _handlers;
+		readonly ILogger<JobWorker> _logger;
+
+		public JobWorker(IJobQueue queue, IEnumerable<IJobHandler> handlers, ILogger<JobWorker> logger)
+		{
+			_queue = queue;
+			_handlers = handlers;
+			_logger = logger;
+		}
+
+		protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+		{
+			var loops = _handlers.SelectMany(handler =>
+			{
+				var inFlight = new ConcurrentDictionary<string, int>(StringComparer.OrdinalIgnoreCase);
+				return Enumerable.Range(0, handler.Concurrency).Select(_ => Run(handler, inFlight, stoppingToken));
+			}).Append(Reap(stoppingToken));
+			await Task.WhenAll(loops);
+		}
+
+		async Task Run(IJobHandler handler, ConcurrentDictionary<string, int> inFlight, CancellationToken stoppingToken)
+		{
+			while (!stoppingToken.IsCancellationRequested)
+			{
+				Job job;
+				try
+				{
+					var busy = inFlight.Where(h => h.Value >= handler.PerHostLimit).Select(h => h.Key).ToList();
+					job = await _queue.Lease(handler.Kind, busy, stoppingToken);
+				}
+				catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+				{
+					return;
+				}
+				catch (Exception ex)
+				{
+					_logger.LogError(ex, "{Worker} could not lease a {Kind} job", nameof(JobWorker), handler.Kind);
+					await Delay(Poll, stoppingToken);
+					continue;
+				}
+
+				if (job == default)
+				{
+					await _queue.WaitForWork(handler.Kind, Poll, stoppingToken);
+					continue;
+				}
+
+				var host = job.Host ?? string.Empty;
+				inFlight.AddOrUpdate(host, 1, (_, count) => count + 1);
+				try
+				{
+					JobOutcome outcome;
+					try
+					{
+						outcome = await handler.Handle(job, stoppingToken);
+					}
+					catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+					{
+						return;
+					}
+					catch (Exception ex)
+					{
+						_logger.LogError(ex, "{Kind} job {Id} threw", handler.Kind, job.ID);
+						outcome = JobOutcome.Retry(ex.GetType().Name);
+					}
+
+					if (outcome.Result != JobResult.Done && job.Attempts >= handler.MaxAttempts && outcome.Result == JobResult.Retry)
+						_logger.LogWarning("{Kind} job {Id} for {Host} is dead after {Attempts} attempts: {Error}",
+							handler.Kind, job.ID, job.Host, job.Attempts, outcome.Error);
+					await _queue.Finish(job, outcome, handler.MaxAttempts, CancellationToken.None);
+				}
+				catch (Exception ex)
+				{
+					_logger.LogError(ex, "{Kind} job {Id} could not be finished; its lease will expire", handler.Kind, job.ID);
+				}
+				finally
+				{
+					inFlight.AddOrUpdate(host, 0, (_, count) => count - 1);
+				}
+			}
+		}
+
+		async Task Reap(CancellationToken stoppingToken)
+		{
+			while (!stoppingToken.IsCancellationRequested)
+			{
+				try
+				{
+					var reaped = await _queue.Reap(stoppingToken);
+					if (reaped > 0)
+						_logger.LogWarning("{Worker} returned {Count} expired leases to the queue", nameof(JobWorker), reaped);
+				}
+				catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+				{
+					return;
+				}
+				catch (Exception ex)
+				{
+					_logger.LogError(ex, "{Worker} reaper failed", nameof(JobWorker));
+				}
+				await Delay(ReapInterval, stoppingToken);
+			}
+		}
+
+		static async Task Delay(TimeSpan delay, CancellationToken token)
+		{
+			try
+			{
+				await Task.Delay(delay, token);
+			}
+			catch (OperationCanceledException)
+			{
+			}
+		}
+	}
+}
@@ -14,7 +14,13 @@ using PrivaPub.Services.ClientToServer.Public;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Outbox;
 using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Moderation;
+using PrivaPub.Federation.Inbox.Handlers;
+using PrivaPub.Domain.Content;
+using PrivaPub.Domain.Social;
+using PrivaPub.Domain.Timelines;
 using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Jobs;
 using Microsoft.Extensions.Options;

 namespace PrivaPub.Middleware
@@ -47,11 +53,30 @@ namespace PrivaPub.Middleware
 					SafeHttpHandlerFactory.Create(provider.GetRequiredService<IOptions<FederationOptions>>().Value));
 			return service
 				.AddSingleton<IFederationHttp, FederationHttp>()
+				.AddSingleton<IDomainBlocks, DomainBlocks>()
+				.AddSingleton<IContentRenderer, ContentRenderer>()
 				.AddSingleton<ILocalActorService, LocalActorService>()
 				.AddSingleton<IRemoteActorService, RemoteActorService>()
 				.AddSingleton<IDeliveryService, DeliveryService>()
-				.AddTransient<IInboxService, InboxService>()
-				.AddHostedService<DeliveryWorker>();
+				.AddSingleton<IOutboxPublisher, OutboxPublisher>()
+				.AddSingleton<IFanout, Fanout>()
+				.AddSingleton<IInboxReceiver, InboxReceiver>()
+				.AddSingleton<IActivityHandler, FollowHandler>()
+				.AddSingleton<IActivityHandler, AcceptHandler>()
+				.AddSingleton<IActivityHandler, RejectHandler>()
+				.AddSingleton<IActivityHandler, UndoHandler>()
+				.AddSingleton<IActivityHandler, LikeHandler>()
+				.AddSingleton<IActivityHandler, AnnounceHandler>()
+				.AddSingleton<IActivityHandler, CreateHandler>()
+				.AddSingleton<IActivityHandler, DeleteHandler>()
+				.AddSingleton<IActivityHandler, UpdateHandler>()
+				.AddSingleton<IJobHandler, InboxProcessor>()
+				.AddSingleton<IRemotePosts, RemotePosts>()
+				.AddSingleton<IJobHandler, AncestorsJobHandler>()
+				.AddSingleton<IJobQueue, JobQueue>()
+				.AddSingleton<IHostCircuitBreaker, HostCircuitBreaker>()
+				.AddSingleton<IJobHandler, DeliveryJobHandler>()
+				.AddHostedService<JobWorker>();
 		}
 		public static IServiceCollection PrivaPubAuthServicesConfiguration(this IServiceCollection service, IConfiguration configuration)
 		{
@@ -103,6 +128,8 @@ namespace PrivaPub.Middleware
 				.AddTransient<IPrivateAvatarUsersService, PrivateAvatarUsersService>()
 				.AddTransient<IGroupUsersService, GroupUsersService>()
 				.AddTransient<IPostsService, PostsService>()
+				.AddTransient<IFollowService, FollowService>()
+				.AddTransient<ITimelineService, TimelineService>()
 				.AddSingleton<AppConfigurationService>()
 				.AddHttpContextAccessor()
 				.AddMemoryCache()
@@ -129,6 +156,8 @@ namespace PrivaPub.Middleware
 						[new OpenApiSecuritySchemeReference("Bearer", document)] = []
 					});
 				})
+				.AddRazorPages(options => options.RootDirectory = "/Web/Pages")
+				.Services
 				.AddControllers(options => { options.Filters.Add<OperationCancelledExceptionFilter>(); })
 				.AddJsonOptions(options =>
 				{
@@ -0,0 +1,21 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Federation
+{
+	public class DomainBlock : Entity
+	{
+		public string Domain { get; set; }
+		public DomainBlockSeverity Severity { get; set; }
+		public bool RejectMedia { get; set; }
+		public string PublicComment { get; set; }
+		public string PrivateComment { get; set; }
+		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+	}
+
+	public enum DomainBlockSeverity
+	{
+		None,
+		Silence,
+		Suspend
+	}
+}
@@ -1,5 +1,7 @@
 using MongoDB.Entities;

+using PrivaPub.Infrastructure.Ids;
+
 namespace PrivaPub.Models.Group
 {
 	public class Group : Entity
@@ -29,6 +31,8 @@ namespace PrivaPub.Models.Group
 		public DateTime CreationDate { get; set; } = DateTime.UtcNow;
 		public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime? DeletionAt { get; set; }
+
+		public override object GenerateNewID() => PrivacyIds.ForDay(DateTime.UtcNow);
 	}

 	public class GroupMember
@@ -0,0 +1,35 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Jobs
+{
+	public class Job : Entity
+	{
+		public JobKind Kind { get; set; }
+		public JobState State { get; set; }
+		public string Payload { get; set; }
+		public string Host { get; set; }
+		public string DedupeKey { get; set; }
+		public int Attempts { get; set; }
+		public DateTime RunAt { get; set; } = DateTime.UtcNow;
+		public DateTime? LeasedUntil { get; set; }
+		public string LeaseOwner { get; set; }
+		public string LastError { get; set; }
+		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+		public DateTime? FinishedAt { get; set; }
+	}
+
+	public enum JobKind
+	{
+		Deliver,
+		ProcessInbox,
+		FetchAncestors
+	}
+
+	public enum JobState
+	{
+		Pending,
+		Running,
+		Done,
+		Dead
+	}
+}
@@ -0,0 +1,14 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Jobs
+{
+	public class RemoteInstance : Entity
+	{
+		public string Host { get; set; }
+		public int ConsecutiveFailures { get; set; }
+		public DateTime? UnavailableUntil { get; set; }
+		public DateTime? LastSuccessAt { get; set; }
+		public DateTime? LastFailureAt { get; set; }
+		public string LastError { get; set; }
+	}
+}
@@ -4,13 +4,23 @@ namespace PrivaPub.Models.Post
 {
 	public class Post : Entity
 	{
-		public string GroupUserId { get; set; }
-		public string AnsweringToPostId { get; set; }
+		public string GroupUserId { get; set; }//local author's Avatar.ID
+		public string AuthorAccountId { get; set; }//Avatar.ID or ForeignAvatar.ID
+		public string AnsweringToPostId { get; set; }//the parent's Post.ID when we hold it
+		public string InReplyToURI { get; set; }
+		public string InReplyToAccountId { get; set; }
 		public string GroupId { get; set; }
+		public string ConversationId { get; set; }//DmGroup.ID of a direct post
+		public string ReblogOfPostId { get; set; }
+		public PostVisibility Visibility { get; set; }
 		public string Title { get; set; }
+		public string SpoilerText { get; set; }
 		public string Text { get; set; }
 		public string ContentHtml { get; set; }
 		public ContentFormat ContentFormat { get; set; }
+		public string Language { get; set; }
+		public List<PostMention> Mentions { get; set; } = new();
+		public List<string> Tags { get; set; } = new();
 		public List<PostMedia> Media { get; set; } = new();
 		public List<float> Location { get; set; } = new();
 		public float RangeKm { get; set; } = 5.0f;
@@ -19,10 +29,50 @@ namespace PrivaPub.Models.Post

 		public bool IsFederatedCopy { get; set; }
 		public string ObjectURI { get; set; }//the Note's id
+		public string ActivityURI { get; set; }//the Create's id
 		public string ActorURI { get; set; }//attributedTo
+		public string Url { get; set; }
+		public string ContextURI { get; set; }
+		public string QuoteURI { get; set; }
+		public List<string> To { get; set; } = new();
+		public List<string> Cc { get; set; } = new();
+
+		public int RepliesCount { get; set; }
+		public int FavouritesCount { get; set; }
+		public int ReblogsCount { get; set; }
+		public List<PostRevision> Revisions { get; set; } = new();

 		public DateTime CreationDate { get; set; } = DateTime.UtcNow;
 		public DateTime? UpdateDate { get; set; } = DateTime.UtcNow;
+		public DateTime? EditedAt { get; set; }
+		public DateTime? DeletedAt { get; set; }
 		public string UpdateReason { get; set; }
 	}
+
+	public enum PostVisibility
+	{
+		Public,
+		Unlisted,
+		FollowersOnly,
+		Direct,
+		Circle,
+		LocalGeo
+	}
+
+	public class PostMention
+	{
+		public string ActorURI { get; set; }
+		public string AccountId { get; set; }
+		public string Handle { get; set; }
+		public bool IsLocal { get; set; }
+	}
+
+	public class PostRevision
+	{
+		public string Title { get; set; }
+		public string SpoilerText { get; set; }
+		public string ContentHtml { get; set; }
+		public bool HasContentWarning { get; set; }
+		public DateTime EditedAt { get; set; }
+	}
 }
@@ -1,4 +1,4 @@
-namespace PrivaPub.Models.Post
+namespace PrivaPub.Models.Post
 {
 	public class PostMedia
 	{
@@ -8,5 +8,11 @@
 		public string Extension { get; set; }
 		public string Path { get; set; }
 		public string URL { get; set; }
+		public string RemoteURL { get; set; }
+		public string Description { get; set; }
+		public string Blurhash { get; set; }
+		public int? Width { get; set; }
+		public int? Height { get; set; }
+		public float[] Focus { get; set; }
 	}
 }
@@ -0,0 +1,13 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Social
+{
+	public class Favourite : Entity
+	{
+		public string AccountId { get; set; }//Avatar.ID or ForeignAvatar.ID
+		public string ActorURI { get; set; }
+		public string PostId { get; set; }
+		public string ActivityURI { get; set; }
+		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+	}
+}
@@ -0,0 +1,23 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Social
+{
+	public class Following : Entity
+	{
+		public string AvatarId { get; set; }//the local follower
+		public string TargetActorURI { get; set; }
+		public string TargetAccountId { get; set; }//Avatar.ID, Group.ID or ForeignAvatar.ID
+		public bool TargetIsLocal { get; set; }
+		public string TargetInboxURL { get; set; }
+		public FollowState State { get; set; }
+		public string FollowActivityURI { get; set; }
+		public bool ShowReblogs { get; set; } = true;
+		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+	}
+
+	public enum FollowState
+	{
+		Requested,
+		Accepted
+	}
+}
@@ -0,0 +1,26 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Social
+{
+	public class Notification : Entity
+	{
+		public string AvatarId { get; set; }
+		public NotificationType Type { get; set; }
+		public string FromAccountId { get; set; }
+		public string FromActorURI { get; set; }
+		public string PostId { get; set; }
+		public string DedupeKey { get; set; }
+		public bool IsRead { get; set; }
+		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+	}
+
+	public enum NotificationType
+	{
+		Mention,
+		Follow,
+		FollowRequest,
+		Favourite,
+		Reblog,
+		Update
+	}
+}
@@ -0,0 +1,12 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Social
+{
+	public class TimelineEntry : Entity
+	{
+		public string AvatarId { get; set; }
+		public string PostId { get; set; }//the post shown: a reblog row's id for a reblog
+		public string AuthorAccountId { get; set; }
+		public string ReblogOfPostId { get; set; }
+	}
+}
@@ -1,5 +1,7 @@
 using MongoDB.Entities;

+using PrivaPub.Infrastructure.Ids;
+
 namespace PrivaPub.Models.User
 {
 	public class Avatar : Entity
@@ -34,6 +36,8 @@ namespace PrivaPub.Models.User
 		public DateTime? SuspendedAt { get; set; }
 		public DateTime? BannedAt { get; set; }
 		public DateTime? DeletionAt { get; set; }
+
+		public override object GenerateNewID() => PrivacyIds.ForDay(DateTime.UtcNow);
 	}

 	public class ForeignAvatar : Entity
@@ -57,6 +61,8 @@ namespace PrivaPub.Models.User

 		public string ActorURI { get; set; }//id
 		public string PublicKeyId { get; set; }
+		public string FollowersURL { get; set; }
+		public string FollowingURL { get; set; }
 		public string SharedInboxURL { get; set; }
 		public string InboxURL { get; set; }
 		public string OutboxURL { get; set; }
@@ -139,6 +139,7 @@ try
 			builtAt = BuildInfo.BuiltAt,
 		}));
 		app.MapControllers();
+		app.MapRazorPages();
 		//app.MapFallbackToFile("index.html");
 	}
 	catch (Exception ex)
@@ -153,6 +154,7 @@ try
 		var dbClient = app.Services.GetService(typeof(DbEntities)) as DbEntities;
 		var passwordHasher = app.Services.GetService(typeof(IPasswordHasher)) as IPasswordHasher;
 		await dbClient.Init(passwordHasher);
+		await app.Services.GetRequiredService<PrivaPub.Federation.Moderation.IDomainBlocks>().Reload(CancellationToken.None);
 	}
 	catch (Exception ex)
 	{
@@ -10,6 +10,7 @@ using PrivaPub.Models.User;
 using PrivaPub.Resources;
 using PrivaPub.StaticServices;
 using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Outbox;

 namespace PrivaPub.Services.ClientToServer.Private
 {
@@ -23,16 +24,19 @@ namespace PrivaPub.Services.ClientToServer.Private
 	public class PrivateAvatarUsersService : IPrivateAvatarUsersService
 	{
 		readonly ILocalActorService _localActors;
+		readonly IOutboxPublisher _outbox;
 		readonly DbEntities _dbEntities;
 		readonly IStringLocalizer<GenericRes> _localizer;
 		readonly ILogger<PrivateAvatarUsersService> _logger;

 		public PrivateAvatarUsersService(ILocalActorService localActors,
+			IOutboxPublisher outbox,
 			DbEntities dbEntities,
 			IStringLocalizer<GenericRes> localizer,
 			ILogger<PrivateAvatarUsersService> logger)
 		{
 			_localActors = localActors;
+			_outbox = outbox;
 			_dbEntities = dbEntities;
 			_localizer = localizer;
 			_logger = logger;
@@ -115,6 +119,7 @@ namespace PrivaPub.Services.ClientToServer.Private
 					avatar.Settings = ToSettings(form.Settings);
 				avatar.UpdatedAt = DateTime.UtcNow;
 				await DB.Default.SaveAsync(avatar);
+				await _outbox.PublishProfile(_localActors.FromAvatar(avatar), default);

 				result.Data = ToView(avatar);
 				return result;
@@ -7,13 +7,15 @@ using PrivaPub.ClientModels.Post;
 using PrivaPub.Models.Federation;
 using PrivaPub.Models.Group;
 using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
 using PrivaPub.Resources;
 using PrivaPub.StaticServices;

 using System.Text.Json.Nodes;

-using DmPostEntity = PrivaPub.Models.Post.DmPost;
 using PostEntity = PrivaPub.Models.Post.Post;
+using PrivaPub.Domain.Content;
+using PrivaPub.Domain.Timelines;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Rendering;
 using PrivaPub.Federation.Outbox;
@@ -24,6 +26,7 @@ namespace PrivaPub.Services
 	{
 		Task<WebResult> InsertPost(string rootUserId, InsertPostForm form, CancellationToken token);
 		Task<WebResult> DeletePost(string rootUserId, DeletePostForm form, CancellationToken token);
+		Task<WebResult> UpdatePost(string rootUserId, UpdatePostForm form, CancellationToken token);
 		Task<WebResult> GetPosts(string rootUserId, string avatarId, string groupId, CancellationToken token);
 		Task<WebResult> InsertDm(string rootUserId, InsertDmForm form, CancellationToken token);
 		Task<WebResult> GetDms(string rootUserId, string avatarId, string dmGroupId, CancellationToken token);
@@ -37,6 +40,9 @@ namespace PrivaPub.Services
 		readonly ILocalActorService _localActors;
 		readonly IRemoteActorService _remoteActors;
 		readonly IDeliveryService _delivery;
+		readonly IContentRenderer _content;
+		readonly IOutboxPublisher _outbox;
+		readonly IFanout _fanout;
 		readonly IStringLocalizer<GenericRes> _localizer;
 		readonly ILogger<PostsService> _logger;

@@ -44,6 +50,9 @@ namespace PrivaPub.Services
 			ILocalActorService localActors,
 			IRemoteActorService remoteActors,
 			IDeliveryService delivery,
+			IContentRenderer content,
+			IOutboxPublisher outbox,
+			IFanout fanout,
 			IStringLocalizer<GenericRes> localizer,
 			ILogger<PostsService> logger)
 		{
@@ -51,6 +60,9 @@ namespace PrivaPub.Services
 			_localActors = localActors;
 			_remoteActors = remoteActors;
 			_delivery = delivery;
+			_content = content;
+			_outbox = outbox;
+			_fanout = fanout;
 			_localizer = localizer;
 			_logger = logger;
 		}
@@ -76,34 +88,52 @@ namespace PrivaPub.Services
 					isLocalOnly = !group.IsFederated;
 				}

+				var parent = await Parent(form.AnsweringToPostId, token);
+				var rendered = await _content.Markdown(form.Text, token);
 				var post = new PostEntity
 				{
 					GroupUserId = author.Id,
+					AuthorAccountId = author.Id,
 					GroupId = group?.Id,
+					Visibility = isLocalOnly ? PostVisibility.Circle : LocalVisibility(form.Visibility),
 					Title = form.Title,
+					SpoilerText = string.IsNullOrWhiteSpace(form.SpoilerText) ? default : form.SpoilerText.Trim(),
 					Text = form.Text,
-					ContentHtml = ActivityPubRenderer.Html(form.Text),
+					ContentHtml = rendered.Html,
 					ContentFormat = ContentFormat.Markdown,
-					HasContentWarning = form.HasContentWarning,
-					AnsweringToPostId = form.AnsweringToPostId,
+					Mentions = rendered.Mentions.Select(ToMention).ToList(),
+					Tags = rendered.Tags.ToList(),
+					HasContentWarning = form.HasContentWarning || !string.IsNullOrWhiteSpace(form.SpoilerText),
+					AnsweringToPostId = parent?.ID,
+					InReplyToURI = parent?.ObjectURI ?? RemoteUri(form.AnsweringToPostId),
+					InReplyToAccountId = parent?.AuthorAccountId ?? parent?.GroupUserId,
 					IsLocalOnly = isLocalOnly,
 					ActorURI = author.Uri
 				};
 				post.ID = (string)post.GenerateNewID();
 				post.ObjectURI = author.PostUri(post.ID);
-				await DB.Default.SaveAsync(post, token);
+				post.Url = author.PostHtmlUrl(post.ID);

 				if (isLocalOnly)
 				{
+					await DB.Default.SaveAsync(post, token);
+					await _fanout.Distribute(post, token);
 					result.Data = ToView(post);
 					return result;
 				}

-				var inReplyTo = await ReplyTarget(form.AnsweringToPostId, token);
-				var note = ActivityPubRenderer.Note(post, author, group, inReplyTo);
+				var note = ActivityPubRenderer.Note(post, author, group, post.InReplyToURI);
 				var create = ActivityPubRenderer.Create(author, note, $"create-{post.ID}");
-				await _delivery.EnqueueToFollowers(author, create, token);
-				if (group != default)
+				post.ActivityURI = create["id"]!.GetValue<string>();
+				post.To = Strings(note["to"]);
+				post.Cc = Strings(note["cc"]);
+				await DB.Default.SaveAsync(post, token);
+				if (parent != default)
+					await DB.Default.Update<PostEntity>().MatchID(parent.ID).Modify(b => b.Inc(p => p.RepliesCount, 1)).ExecuteAsync(token);
+
+				await _fanout.Distribute(post, token);
+				await _outbox.Publish(author, post, create, token);
+				if (group is { IsFederated: true } && post.Visibility is PostVisibility.Public or PostVisibility.Unlisted)
 					await _delivery.EnqueueToFollowers(group, ActivityPubRenderer.Announce(group, post.ObjectURI, $"announce-{post.ID}"), token);

 				result.Data = ToView(post);
@@ -131,20 +161,28 @@ namespace PrivaPub.Services
 				if (post == default)
 					return result.Invalidate(_localizer["Post not found."], StatusCodes.Status404NotFound);

-				await DB.Default.DeleteAsync<PostEntity>(post.ID);
-				if (post.IsLocalOnly)
+				if (post.DeletedAt.HasValue)
 					return result;
+				var audience = await _outbox.Audience(author, post, token);
+				await DB.Default.Update<PostEntity>().MatchID(post.ID)
+					.Modify(p => p.DeletedAt, DateTime.UtcNow)
+					.Modify(p => p.Text, null)
+					.Modify(p => p.ContentHtml, null)
+					.Modify(p => p.Title, null)
+					.Modify(p => p.SpoilerText, null)
+					.Modify(p => p.Media, new List<PostMedia>())
+					.Modify(p => p.Revisions, new List<PostRevision>())
+					.ExecuteAsync(token);
+				await DB.Default.DeleteAsync<TimelineEntry>(e => e.PostId == post.ID);
+				if (!string.IsNullOrEmpty(post.AnsweringToPostId))
+					await DB.Default.Update<PostEntity>().MatchID(post.AnsweringToPostId).Modify(b => b.Inc(p => p.RepliesCount, -1)).ExecuteAsync(token);

-				var delete = ActivityPubRenderer.Delete(author, post.ObjectURI, $"delete-{post.ID}",
-					new JsonArray(ActivityPubRenderer.Public), new JsonArray(author.Followers));
-				var extraInboxes = Enumerable.Empty<string>();
-				if (!string.IsNullOrEmpty(post.GroupId))
+				if (audience.Count > 0)
 				{
-					var group = await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
-					if (group != default)
-						extraInboxes = await _delivery.FollowerInboxes(group, token);
+					var delete = ActivityPubRenderer.Delete(author, post.ObjectURI, $"delete-{post.ID}",
+						new JsonArray(post.To.Select(t => (JsonNode)t).ToArray()), new JsonArray(post.Cc.Select(c => (JsonNode)c).ToArray()));
+					await _delivery.Enqueue(author, audience, delete, token);
 				}
-				await _delivery.EnqueueToFollowers(author, delete, token, extraInboxes);
 				return result;
 			}
 			catch (Exception ex)
@@ -154,6 +192,73 @@ namespace PrivaPub.Services
 			}
 		}

+		public async Task<WebResult> UpdatePost(string rootUserId, UpdatePostForm form, CancellationToken token)
+		{
+			var result = new WebResult();
+			try
+			{
+				var author = await OwnedAvatar(rootUserId, form.AvatarId, token);
+				if (author == default)
+					return result.Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound);
+				var post = await _dbEntities.Posts
+					.Match(p => p.ID == form.PostId && p.GroupUserId == author.Id && !p.IsFederatedCopy && !p.DeletedAt.HasValue)
+					.ExecuteFirstAsync(token);
+				if (post == default)
+					return result.Invalidate(_localizer["Post not found."], StatusCodes.Status404NotFound);
+
+				post.Revisions.Add(new PostRevision
+				{
+					Title = post.Title,
+					SpoilerText = post.SpoilerText,
+					ContentHtml = post.ContentHtml,
+					HasContentWarning = post.HasContentWarning,
+					EditedAt = post.EditedAt ?? post.CreationDate
+				});
+				var rendered = await _content.Markdown(form.Text, token);
+				post.Title = form.Title;
+				post.SpoilerText = string.IsNullOrWhiteSpace(form.SpoilerText) ? default : form.SpoilerText.Trim();
+				post.HasContentWarning = form.HasContentWarning || post.SpoilerText != default;
+				post.Text = form.Text;
+				post.ContentHtml = rendered.Html;
+				post.Mentions = post.Visibility == PostVisibility.Direct
+					? post.Mentions.Concat(rendered.Mentions.Select(ToMention)).DistinctBy(m => m.ActorURI).ToList()
+					: rendered.Mentions.Select(ToMention).ToList();
+				post.Tags = rendered.Tags.ToList();
+				post.EditedAt = DateTime.UtcNow;
+				post.UpdateDate = post.EditedAt;
+				await DB.Default.SaveAsync(post, token);
+
+				if (!post.IsLocalOnly)
+				{
+					var group = string.IsNullOrEmpty(post.GroupId) ? default : await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
+					var note = post.Visibility == PostVisibility.Direct
+						? ActivityPubRenderer.DirectNote(post, author, Array.Empty<(string, string)>(), post.ContextURI)
+						: ActivityPubRenderer.Note(post, author, group, post.InReplyToURI);
+					note["to"] = new JsonArray(post.To.Select(t => (JsonNode)t).ToArray());
+					note["cc"] = new JsonArray(post.Cc.Select(c => (JsonNode)c).ToArray());
+					var update = new JsonObject
+					{
+						["@context"] = ActivityPubRenderer.Context(),
+						["id"] = author.ActivityUri($"update-{post.ID}-{new DateTimeOffset(post.EditedAt.Value).ToUnixTimeSeconds()}"),
+						["type"] = "Update",
+						["actor"] = author.Uri,
+						["to"] = note["to"]!.DeepClone(),
+						["cc"] = note["cc"]!.DeepClone(),
+						["object"] = note
+					};
+					await _outbox.Publish(author, post, update, token);
+				}
+
+				result.Data = ToView(post);
+				return result;
+			}
+			catch (Exception ex)
+			{
+				_logger.LogError(ex, $"{nameof(PostsService)}.{nameof(UpdatePost)}");
+				return result.Invalidate(_localizer["Something went wrong."], exception: ex);
+			}
+		}
+
 		public async Task<WebResult> GetPosts(string rootUserId, string avatarId, string groupId, CancellationToken token)
 		{
 			var result = new WebResult();
@@ -165,7 +270,7 @@ namespace PrivaPub.Services

 				var query = _dbEntities.Posts;
 				if (string.IsNullOrEmpty(groupId))
-					query.Match(p => p.GroupUserId == avatar.Id);
+					query.Match(p => p.GroupUserId == avatar.Id && p.Visibility != PostVisibility.Direct);
 				else
 				{
 					var isMember = await _dbEntities.Groups
@@ -222,25 +327,27 @@ namespace PrivaPub.Services
 					{
 						dmGroup = new DmGroup { Members = members, ParticipantsKey = key };
 						dmGroup.ID = (string)dmGroup.GenerateNewID();
-						dmGroup.ConversationURI = $"{author.Uri}/conversations/{dmGroup.ID}";
+						dmGroup.ConversationURI = author.ConversationUri(dmGroup.ID);
 						await DB.Default.SaveAsync(dmGroup, token);
 					}
 				}

-				var dm = new DmPostEntity
+				var dm = new PostEntity
 				{
 					GroupUserId = author.Id,
-					GroupId = dmGroup.ID,
+					AuthorAccountId = author.Id,
+					ConversationId = dmGroup.ID,
+					Visibility = PostVisibility.Direct,
+					ContextURI = dmGroup.ConversationURI,
 					Text = form.Text,
-					ContentHtml = ActivityPubRenderer.Html(form.Text),
+					ContentHtml = (await _content.Markdown(form.Text, token)).Html,
 					ContentFormat = ContentFormat.Markdown,
 					HasContentWarning = form.HasContentWarning,
 					ActorURI = author.Uri
 				};
 				dm.ID = (string)dm.GenerateNewID();
 				dm.ObjectURI = author.PostUri(dm.ID);
-				await DB.Default.SaveAsync(dm, token);
-				await DB.Default.Update<DmGroup>().MatchID(dmGroup.ID).Modify(g => g.UpdatedAt, DateTime.UtcNow).ExecuteAsync(token);
+				dm.Url = author.PostHtmlUrl(dm.ID);

 				var remote = new List<(string Uri, string Handle)>();
 				var inboxes = new List<string>();
@@ -259,12 +366,16 @@ namespace PrivaPub.Services
 						remote.Add((local.Uri, local.Handle));
 				}

+				var directNote = ActivityPubRenderer.DirectNote(dm, author, remote, dmGroup.ConversationURI);
+				var directCreate = ActivityPubRenderer.Create(author, directNote, $"create-{dm.ID}");
+				dm.ActivityURI = directCreate["id"]!.GetValue<string>();
+				dm.To = Strings(directNote["to"]);
+				dm.Mentions = remote.Select(r => new PostMention { ActorURI = r.Uri, Handle = "@" + r.Handle, IsLocal = r.Uri.StartsWith(author.BaseAddress + "/") }).ToList();
+				await DB.Default.SaveAsync(dm, token);
+				await DB.Default.Update<DmGroup>().MatchID(dmGroup.ID).Modify(g => g.UpdatedAt, DateTime.UtcNow).ExecuteAsync(token);
+				await _fanout.Distribute(dm, token);
 				if (inboxes.Count > 0)
-				{
-					var note = ActivityPubRenderer.DirectNote(dm, author, remote, dmGroup.ConversationURI);
-					var create = ActivityPubRenderer.Create(author, note, $"create-{dm.ID}");
-					await _delivery.Enqueue(author, inboxes, create, token);
-				}
+					await _delivery.Enqueue(author, inboxes, directCreate, token);

 				result.Data = ToView(dm);
 				return result;
@@ -306,8 +417,8 @@ namespace PrivaPub.Services
 				if (!isMember)
 					return result.Invalidate(_localizer["Conversation not found."], StatusCodes.Status404NotFound);

-				var dms = await _dbEntities.DmPosts
-					.Match(p => p.GroupId == dmGroupId)
+				var dms = await _dbEntities.Posts
+					.Match(p => p.ConversationId == dmGroupId && p.Visibility == PostVisibility.Direct)
 					.Sort(p => p.CreationDate, Order.Descending)
 					.Limit(PageSize)
 					.ExecuteAsync(token);
@@ -337,16 +448,36 @@ namespace PrivaPub.Services
 			return foreign == default ? default : new GroupMember { AvatarId = foreign.ActorURI, IsForeign = true };
 		}

-		async Task<string> ReplyTarget(string answeringToPostId, CancellationToken token)
+		async Task<PostEntity> Parent(string answeringTo, CancellationToken token)
 		{
-			if (string.IsNullOrEmpty(answeringToPostId))
+			if (string.IsNullOrEmpty(answeringTo))
 				return default;
-			if (answeringToPostId.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
-				return answeringToPostId;
-			var parent = await _dbEntities.Posts.MatchID(answeringToPostId).ExecuteFirstAsync(token);
-			return parent?.ObjectURI;
+			return answeringTo.StartsWith("https://", StringComparison.OrdinalIgnoreCase)
+				? await _dbEntities.Posts.Match(p => p.ObjectURI == answeringTo).ExecuteFirstAsync(token)
+				: await _dbEntities.Posts.MatchID(answeringTo).ExecuteFirstAsync(token);
 		}

+		static PostVisibility LocalVisibility(string requested) => requested?.ToLowerInvariant() switch
+		{
+			"unlisted" => PostVisibility.Unlisted,
+			"followersonly" or "private" => PostVisibility.FollowersOnly,
+			_ => PostVisibility.Public
+		};
+
+		static PostMention ToMention(ResolvedMention mention) => new()
+		{
+			ActorURI = mention.ActorUri,
+			Handle = "@" + mention.Handle,
+			IsLocal = mention.IsLocal,
+			AccountId = mention.AccountId
+		};
+
+		static string RemoteUri(string answeringTo) =>
+			answeringTo != default && answeringTo.StartsWith("https://", StringComparison.OrdinalIgnoreCase) ? answeringTo : default;
+
+		static List<string> Strings(JsonNode node) =>
+			node is JsonArray array ? array.Select(n => n?.GetValue<string>()).Where(s => s != default).ToList() : new List<string>();
+
 		async Task<LocalActor> OwnedAvatar(string rootUserId, string avatarId, CancellationToken token)
 		{
 			if (string.IsNullOrEmpty(rootUserId) || string.IsNullOrEmpty(avatarId))
@@ -363,22 +494,8 @@ namespace PrivaPub.Services
 			AuthorAvatarId = post.IsFederatedCopy ? default : post.GroupUserId,
 			AuthorActorURI = post.ActorURI,
 			GroupId = post.GroupId,
-			AnsweringToPostId = post.AnsweringToPostId,
-			Title = post.Title,
-			Text = post.Text,
-			ContentHtml = post.ContentHtml,
-			HasContentWarning = post.HasContentWarning,
-			IsFederatedCopy = post.IsFederatedCopy,
-			CreationDate = post.CreationDate
-		};
-
-		static ViewPost ToView(DmPostEntity post) => new()
-		{
-			Id = post.ID,
-			ObjectURI = post.ObjectURI,
-			AuthorAvatarId = post.IsFederatedCopy ? default : post.GroupUserId,
-			AuthorActorURI = post.ActorURI,
-			DmGroupId = post.GroupId,
+			DmGroupId = post.ConversationId,
+			Visibility = post.Visibility.ToString(),
 			AnsweringToPostId = post.AnsweringToPostId,
 			Title = post.Title,
 			Text = post.Text,
@@ -5,6 +5,7 @@ using PrivaPub.Models.Data;
 using PrivaPub.Models.Federation;
 using PrivaPub.Models.Group;
 using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
 using PrivaPub.Models.User;

 namespace PrivaPub.StaticServices
@@ -32,5 +33,10 @@ namespace PrivaPub.StaticServices
 		public Find<Follower> Followers { get { return DB.Default.Find<Follower>(); } }
 		public Find<Delivery> Deliveries { get { return DB.Default.Find<Delivery>(); } }
 		public Find<InstanceActor> InstanceActors { get { return DB.Default.Find<InstanceActor>(); } }
+
+		public Find<Following> Followings { get { return DB.Default.Find<Following>(); } }
+		public Find<TimelineEntry> TimelineEntries { get { return DB.Default.Find<TimelineEntry>(); } }
+		public Find<Notification> Notifications { get { return DB.Default.Find<Notification>(); } }
+		public Find<Favourite> Favourites { get { return DB.Default.Find<Favourite>(); } }
 	}
 }
@@ -0,0 +1,129 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.RazorPages;
+
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+using PrivaPub.StaticServices;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Web.Pages
+{
+	public sealed record PostView(string Title, string Warning, string ContentHtml, string Url, DateTime Published, bool Edited)
+	{
+		public static PostView From(PostEntity post, LocalActor author) => new(
+			post.Title,
+			post.SpoilerText ?? (post.HasContentWarning ? ActivityPubRenderer.ContentWarning : default),
+			post.ContentHtml ?? ActivityPubRenderer.Html(post.Text),
+			author.PostHtmlUrl(post.ID),
+			DateTime.SpecifyKind(post.CreationDate, DateTimeKind.Utc),
+			post.EditedAt.HasValue);
+	}
+
+	public abstract class PublicPageModel : PageModel
+	{
+		protected bool WantsActivityJson()
+		{
+			var accept = Request.Headers.Accept.ToString();
+			return accept.Contains("activity+json", StringComparison.OrdinalIgnoreCase) || accept.Contains("ld+json", StringComparison.OrdinalIgnoreCase);
+		}
+
+		protected void Harden()
+		{
+			Response.Headers["Content-Security-Policy"] = "default-src 'none'; style-src 'unsafe-inline'; img-src https: data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
+			Response.Headers["Referrer-Policy"] = "no-referrer";
+			Response.Headers["X-Content-Type-Options"] = "nosniff";
+		}
+	}
+
+	public class ProfileModel : PublicPageModel
+	{
+		const int PageSize = 20;
+
+		readonly ILocalActorService _localActors;
+		readonly DbEntities _dbEntities;
+
+		public ProfileModel(ILocalActorService localActors, DbEntities dbEntities)
+		{
+			_localActors = localActors;
+			_dbEntities = dbEntities;
+		}
+
+		public LocalActor Actor { get; private set; }
+		public string BiographyHtml { get; private set; }
+		public IReadOnlyList<PostView> Posts { get; private set; } = Array.Empty<PostView>();
+
+		public async Task<IActionResult> OnGetAsync(string user, CancellationToken token)
+		{
+			Actor = await _localActors.FindByUserName(user, token);
+			if (Actor is not { IsFederated: true } || Actor.Kind == LocalActorKind.Application)
+				return NotFound();
+			if (WantsActivityJson())
+				return Redirect(Actor.Uri);
+
+			Harden();
+			BiographyHtml = ActivityPubRenderer.Html(Actor.Summary);
+			var posts = await (Actor.Kind == LocalActorKind.Group
+					? _dbEntities.Posts.Match(p => p.GroupId == Actor.Id)
+					: _dbEntities.Posts.Match(p => p.GroupUserId == Actor.Id && !p.IsFederatedCopy))
+				.Match(VisibilityPolicy.IsPublic)
+				.Sort(p => p.ID, Order.Descending)
+				.Limit(PageSize)
+				.ExecuteAsync(token);
+			var authors = new Dictionary<string, LocalActor> { [Actor.Id] = Actor };
+			var views = new List<PostView>();
+			foreach (var post in posts)
+			{
+				if (post.IsFederatedCopy)
+					continue;
+				if (!authors.TryGetValue(post.GroupUserId, out var author))
+					authors[post.GroupUserId] = author = await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
+				if (author != default)
+					views.Add(PostView.From(post, author));
+			}
+			Posts = views;
+			return Page();
+		}
+	}
+
+	public class StatusModel : PublicPageModel
+	{
+		readonly ILocalActorService _localActors;
+		readonly DbEntities _dbEntities;
+
+		public StatusModel(ILocalActorService localActors, DbEntities dbEntities)
+		{
+			_localActors = localActors;
+			_dbEntities = dbEntities;
+		}
+
+		public LocalActor Actor { get; private set; }
+		public PostView Post { get; private set; }
+		public string ObjectUri { get; private set; }
+
+		public async Task<IActionResult> OnGetAsync(string user, string id, CancellationToken token)
+		{
+			Actor = await _localActors.FindByUserName(user, token);
+			if (Actor is not { IsFederated: true, Kind: LocalActorKind.Person })
+				return NotFound();
+			var post = await _dbEntities.Posts
+				.Match(p => p.ID == id && p.GroupUserId == Actor.Id && !p.IsFederatedCopy)
+				.Match(VisibilityPolicy.IsPublic)
+				.ExecuteFirstAsync(token);
+			if (post == default)
+				return NotFound();
+			ObjectUri = Actor.PostUri(post.ID);
+			if (WantsActivityJson())
+				return Redirect(ObjectUri);
+
+			Harden();
+			Post = PostView.From(post, Actor);
+			return Page();
+		}
+	}
+}
@@ -0,0 +1,36 @@
+@page "/@{user}"
+@model PrivaPub.Web.Pages.ProfileModel
+@{
+	ViewData["Title"] = $"{Model.Actor.Name} (@{Model.Actor.Handle})";
+	ViewData["Alternate"] = Model.Actor.Uri;
+}
+<header>
+	<h1>@Model.Actor.Name</h1>
+	<div class="handle">@@@Model.Actor.Handle</div>
+</header>
+<div class="bio">@Html.Raw(Model.BiographyHtml)</div>
+@if (Model.Actor.Fields.Count > 0)
+{
+	<dl class="fields">
+		@foreach (var field in Model.Actor.Fields)
+		{
+			<dt>@field.Key</dt>
+			<dd>@if (Uri.TryCreate(field.Value, UriKind.Absolute, out var link) && link.Scheme is "https" or "http")
+				{
+					<a href="@field.Value" rel="nofollow noopener noreferrer me">@field.Value</a>
+				}
+				else
+				{
+					@field.Value
+				}</dd>
+		}
+	</dl>
+}
+@foreach (var post in Model.Posts)
+{
+	<partial name="_Post" model="post" />
+}
+@if (Model.Posts.Count == 0)
+{
+	<p class="meta">Nothing public yet.</p>
+}
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+	<meta charset="utf-8">
+	<meta name="viewport" content="width=device-width, initial-scale=1">
+	<meta name="robots" content="noindex, noarchive, nofollow">
+	<title>@ViewData["Title"]</title>
+	@if (ViewData["Alternate"] is string alternate)
+	{
+		<link rel="alternate" type="application/activity+json" href="@alternate">
+	}
+	<style>
+		:root { --bg: #fafaf8; --fg: #1d1d1b; --muted: #6b6b66; --line: #deded8; --accent: #6b3fa0; }
+		@@media (prefers-color-scheme: dark) { :root { --bg: #17161a; --fg: #ecebe6; --muted: #9a99a2; --line: #2e2c33; --accent: #b794e6; } }
+		body { margin: 0; background: var(--bg); color: var(--fg); font: 16px/1.5 system-ui, sans-serif; }
+		main { max-width: 640px; margin: 0 auto; padding: 24px 16px; }
+		a { color: var(--accent); }
+		header h1 { margin: 0; font-size: 1.5rem; }
+		.handle, .meta { color: var(--muted); font-size: .9rem; }
+		.bio { margin: 12px 0; }
+		dl.fields { display: grid; grid-template-columns: max-content 1fr; gap: 4px 12px; margin: 12px 0; }
+		dl.fields dt { color: var(--muted); }
+		dl.fields dd { margin: 0; overflow-wrap: anywhere; }
+		article { border-top: 1px solid var(--line); padding: 16px 0; overflow-wrap: anywhere; }
+		article h2 { font-size: 1.1rem; margin: 0 0 8px; }
+		.invisible { display: none; }
+		.ellipsis::after { content: "…"; }
+		summary { cursor: pointer; }
+		footer { color: var(--muted); font-size: .8rem; margin-top: 32px; }
+	</style>
+</head>
+<body>
+	<main>
+		@RenderBody()
+		<footer>PrivaPub</footer>
+	</main>
+</body>
+</html>
@@ -0,0 +1,19 @@
+@model PrivaPub.Web.Pages.PostView
+<article>
+	@if (!string.IsNullOrEmpty(Model.Title))
+	{
+		<h2>@Model.Title</h2>
+	}
+	@if (!string.IsNullOrEmpty(Model.Warning))
+	{
+		<details>
+			<summary>@Model.Warning</summary>
+			@Html.Raw(Model.ContentHtml)
+		</details>
+	}
+	else
+	{
+		@Html.Raw(Model.ContentHtml)
+	}
+	<div class="meta"><a href="@Model.Url"><time datetime="@Model.Published.ToString("O")">@Model.Published.ToString("yyyy-MM-dd HH:mm") UTC</time></a>@(Model.Edited ? " · edited" : "")</div>
+</article>
@@ -0,0 +1,11 @@
+@page "/@{user}/{id}"
+@model PrivaPub.Web.Pages.StatusModel
+@{
+	ViewData["Title"] = $"{Model.Actor.Name}: {Model.Post.Title ?? "post"}";
+	ViewData["Alternate"] = Model.ObjectUri;
+}
+<header>
+	<h1><a href="@Model.Actor.HtmlUrl">@Model.Actor.Name</a></h1>
+	<div class="handle">@@@Model.Actor.Handle</div>
+</header>
+<partial name="_Post" model="Model.Post" />
@@ -0,0 +1,3 @@
+@using PrivaPub.Web.Pages
+@namespace PrivaPub.Web.Pages
+@addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers
@@ -0,0 +1,3 @@
+@{
+	Layout = "_Layout";
+}
@@ -4,8 +4,8 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati

 ## Status

- [ ] P0 Security baseline
- [ ] P1.1 Infrastructure and content model
+- [x] P0 Security baseline: v1.1.0, deployed and verified 2026-10-01
+- [x] P1.1 Infrastructure and content model: v1.2.0, deployed and verified 2026-10-01
 - [ ] P1.2 Social graph and timelines
 - [ ] P2 Mastodon client API
 - [ ] P3 Social features
Author	SHA1	Message	Date
thepraandClaude Opus 5.5	7ff3a61e75	FEDERATION.md and CLAUDE.md describe follows, likes, boosts and timelines Build / Build (push) Successful in 30s Details Deploy / privapub.thepra.dev (push) Successful in 45s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:40:02 +02:00
thepraandClaude Opus 5.5	afd2e727d0	A remote delete clears what it touched Deleting a remote post now removes its timeline entries and the reblogs of it and lowers its parent's reply count; deleting a remote actor also drops the follows pointing at it and its entries in home timelines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:39:45 +02:00
thepraandClaude Opus 5.5	b34c71775c	Likes and boosts arrive, count, notify, and can be taken back - Like: a Favourite per account and post (unique), the post's counter, a Favourite notification for a local author; only on posts the liker could see (public and unlisted, or followers-only and direct when they were addressed). - Announce: the original is always refetched from its own origin (or is ours), and must be public or unlisted. A boost of a local post counts and notifies; a boost by an account a persona follows is stored as a reblog row and fanned out to its followers' home timelines (as a reblog, where reblogs are wanted). A boost by a stranger of a stranger's post is ignored. FEP-1b12 group announces of activities wait for P4. - Undo of a Like or an Announce reverses each of them; an Undo naming only an id is matched against follows, likes and boosts in turn. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:39:10 +02:00
thepraandClaude Opus 5.5	e99b76dbd7	Home timelines, mention notifications, and threads that fetch their parents Fanout writes a TimelineEntry for every persona a post should reach: the author, local followers of a local author, local followers of a remote one, the members of a direct conversation or a circle. Mastodon's home rules apply when it is written: a reply shows only to followers of both sides (or to the one replied to), a reblog only where reblogs are wanted. A mention of a local persona becomes a Mention notification. Inbound posts are now also kept when a persona follows their author. RemotePosts holds what CreateHandler and backfill share: building a Post from a note, and fetching a public parent the first time a reply to it arrives, so its author is known (a reply to an unknown or non-public parent stays out of home timelines). Each fetched ancestor queues a FetchAncestors job for the next one, up to ten deep. /clientapi/timeline/home and /clientapi/notifications (with /notifications/read) page by max_id for the persona's own root only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:37:41 +02:00
thepraandClaude Opus 5.5	a76cc34557	Posts reach their audience, edits follow them, deletes leave a tombstone OutboxPublisher works out who a post goes to, Mastodon's way: followers' shared inboxes for public, unlisted and followers-only; every mentioned remote account's own inbox; the recipients only for direct; the parent's author for a reply; a community's followers for a post in it; nobody for a circle. Creates, updates and deletes all use it. - Local posts take a visibility (public, unlisted, followers-only) and a spoiler text next to the content-warning flag. - /clientapi/post/update keeps the previous version as a revision, re-renders, and sends Update{Note} with `updated` to the same to/cc. - Deleting is now soft: the content, title, spoiler, media and revisions are cleared, timeline entries removed, the parent's reply count goes down, Delete goes to the stored audience, and the object answers 410 with a Tombstone instead of 404. - Editing a persona's profile sends Update{Person} to its followers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:34:35 +02:00
thepraandClaude Opus 5.5	61f6ca0676	Personas can follow: locally at once, remotely by Follow and Accept Following records what a local persona follows, local or remote, with its state and the Follow activity's id. FollowService (behind /clientapi/follow, /clientapi/unfollow and /clientapi/following): - resolves @user, user@host or an actor URI; - a local account is followed in-process: accepted unless it approves followers by hand, a Follower row on the other side, a community gains the persona as a member, and a Follow or FollowRequest notification; - a remote account gets a Follow signed by the persona, at /grunts/follow-{id}, and stays Requested until an Accept; - unfollowing deletes the rows, or sends Undo{Follow} to a remote account. Inbound Accept and Reject are matched to the Follow by its id (or, for an embedded Follow without one, by its actor), and only from the account that was followed. A remote Follow now notifies the persona too. Notification is the per-persona record P1.2 builds on, deduplicated by type, persona, sender and post. TimelineEntry and Favourite are created with their indexes for the next commits. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:32:33 +02:00
thepraandClaude Opus 5.5	8af50dad9c	P1.1 is deployed and verified Build / Build (push) Successful in 33s Details v1.2.0 serves the themed routes, NodeInfo 2.0 and 2.1 and the day-cut actor; migrations 1-5 ran and the job queue's indexes exist. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:31:26 +02:00
thepraandClaude Opus 5.5	60bf21b019	CLAUDE.md describes the code after P1.1 Build / Build (push) Successful in 1m7s Details Deploy / privapub.thepra.dev (push) Successful in 1m1s Details The route table lists the themed names now in use, the repo map gains Jobs, Ids, Moderation, Domain and Web, and the invariants add the job queue, VisibilityPolicy and the rule for which remote posts are stored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:28:37 +02:00
thepraandClaude Opus 5.5	1c78da34a9	One visibility rule for every public read VisibilityPolicy.IsPublic is the single expression for "anyone may see this" (Public or Unlisted, not deleted); the outbox, the object and activity endpoints, the HTML pages and NodeInfo all use it instead of spelling it out. CanSee answers for a persona: the author, a mentioned local persona, a conversation member for Direct, a circle member for Circle; followers-only waits for P1.2's follows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:26:51 +02:00
thepraandClaude Opus 5.5	5a13597c00	Persona and group ids say which day, nothing more An ObjectId carries its creation second and a per-process counter, so two avatars made one after the other by the same login got ids a few counts apart: a link between personas that every Mastodon client would have seen. Avatar and Group now generate ids from the UTC day plus eight random bytes (still valid ObjectIds), and a remote post's id is made from its published time with a random tail, so posts page in the order they were written rather than the order they arrived. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:25:48 +02:00
thepraandClaude Opus 5.5	e6a362c0b8	Domain blocks: suspend, silence, reject media DomainBlock (domain, severity, reject-media, public and private comment) covers the domain and its subdomains. Admins manage them under /clientapi/admin/domainblocks/{list,insert,delete}; the set is kept in memory, reloaded on every change and at most five minutes stale. A suspended domain is refused by FederationHttp.IsAllowed, so nothing is fetched from it and no job delivers to it, and the inbox drops its activities with a 202 before fetching any key. Reject-media strips the attachments of posts from that domain. Silence is recorded for the timelines and notifications that arrive in P1.2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:25:05 +02:00
thepraandClaude Opus 5.5	9ec1f9930b	Profile and post pages, NodeInfo 2.1, and FEDERATION.md /@user and /@user/{id} are Razor pages showing an avatar's or community's public and unlisted posts: no scripts, a strict CSP, no-referrer, noindex, and an alternate link to the ActivityPub document. A client asking them for activity+json is redirected to the actor or note, and the actor and note redirect browsers here. NodeInfo answers 2.1 as well as 2.0 (repository, homepage, a link to FEDERATION.md) and counts only public local posts. FEDERATION.md (FEP-67ff) lists the protocols, FEPs, route names, activities and the security rules a peer will notice. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:23:03 +02:00
thepraandClaude Opus 5.5	e54e17708f	Outbound documents speak Mastodon's dialect under PrivaPub's route names Local text (Domain/Content/ContentRenderer): Markdig with raw HTML off and autolinks, or plain text for API clients; then @user and @user@host are resolved (locally or through WebFinger) into Mastodon's h-card markup and #tags into hashtag links, skipping code, links and e-mail addresses. A post stores the result, its mentions and its tags, and is delivered to the mentioned actors and the parent's author as well as to followers. Renderer: - Mastodon's @context (toot, schema PropertyValue, discoverable, indexable, blurhash, focalPoint, featured, alsoKnownAs, movedTo) and FEP-2c59's webfinger; - an actor's url is its HTML page, its fields are PropertyValue attachments, published is cut to the day and indexable is false; - a note's content is the stored rendering; a title becomes name and a bold first line, a content warning without its own text is summarised by the title or "Content warning"; Mention and Hashtag tags, contentMap, updated, and to/cc by visibility. Routes take the agreed names: /groupies, /stalking, /scribbles/{id}, /grunts/{id} (a Create resolves), /whispers/{id} for a DM's context. The outbox is a collection with a first page, paged by max_id. A browser asking for an actor or a note is redirected to /@user, and WebFinger's profile-page points there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:21:31 +02:00
thepraandClaude Opus 5.5	e9529310fe	One Post model for every visibility, read from notes the way peers write them Post gains what federation and the Mastodon API need: Visibility (Public, Unlisted, FollowersOnly, Direct, Circle, LocalGeo), the author's account id, to/cc, the Create's id, url, context, quote, InReplyToURI and the parent's author, a separate SpoilerText next to the title, language, mentions, hashtags, remote attachments (alt text, blurhash, focus, size), reply/favourite/reblog counters, revisions, EditedAt and DeletedAt. Direct messages are Posts with Visibility Direct and a ConversationId; migration _005 copies DmPost rows across with their ids and fills the new fields of existing posts. DmPost is left in place so a rollback still sees the old messages. Inbound: - NoteParser reads Note, Article, Page, Question and media types: content, then contentMap, then _misskey_content; summary as the spoiler and name as the title; Mention and Hashtag tags; attachments; a PeerTube-style list attribution prefers the person over the channel; quote URIs. - Addressing classifies like Mastodon, finding followers-only by the author's own followers URL (now stored on ForeignAvatar), not by a "/followers" suffix. - Create keeps a post when a local persona is addressed or mentioned, when it replies to a local post (the parent's reply count goes up) or when a community it follows is addressed; an unsolicited public post is not stored. Update keeps the previous version as a revision. The outbox and object endpoints serve only Public and Unlisted posts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:17:14 +02:00
thepraandClaude Opus 5.5	796f06acf4	The inbox answers once it has verified, and processes from the job queue InboxService is split the way the roadmap lays out Federation/Inbox: - InboxReceiver reads and verifies the request exactly as before, runs the checks that need no fetch (the activity id's origin, a Follow of a missing or local-only actor, an Undo of someone else's activity, an embedded object attributed to someone else), queues a ProcessInbox job and answers 202. The job's dedupe key is the activity id, so a peer that delivers the same activity twice is processed once. - InboxProcessor (two at a time, eight attempts) loads the verified actor and hands the activity to the handler for its type. - Handlers/{Follow,Undo,Create,Delete,Update}Handler are the old methods, unchanged except that they no longer produce status codes; the JSON helpers live in Objects/ActivityJson and the group membership helpers in Inbox/ForeignMembers. A slow fetch of an object or a remote actor now delays the job, not the sender's HTTP request. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:12:34 +02:00
thepraandClaude Opus 5.5	d1a91c40c4	Deliveries run on a Mongo job queue with leases, backoff and per-host limits The single serial DeliveryWorker is replaced by Infrastructure/Jobs: - Job rows are leased with one FindOneAndUpdate (oldest RunAt first, a two-minute lease) and a reaper returns expired leases every 30 s; - enqueueing wakes the workers, which otherwise poll every five seconds; - delivery runs eight at a time with at most two per host, so a slow or dead server holds two slots, not the queue; - a failure waits n^4 + 15 + jitter seconds (Mastodon's curve) for up to 16 attempts; a 4xx other than 408/429 is final, a 429 honours Retry-After; - RemoteInstance is a per-host circuit breaker: ten consecutive failures quarantine a host for an hour, doubling to a week, and its jobs wait without spending attempts; - a delivery is queued once per activity and inbox (unique DedupeKey), and finished jobs expire after seven days (TTL on FinishedAt). Migration _004 moves pending Delivery rows into jobs and marks them abandoned, so a rollback to the old worker cannot send them twice. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:09:35 +02:00
thepraandClaude Opus 5.5	934b6fe687	P0 is deployed and verified Build / Build (push) Successful in 25s Details v1.1.0 serves the actor, NodeInfo and WebFinger, answers Swagger with 404 and inbox junk with 400 and 401; migrations 1-3 ran and the unique indexes exist. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 11:07:23 +02:00