Index: CHANGELOG.de.md
===================================================================
--- CHANGELOG.de.md	(revision 513ba827ae08398446f52a46e39142a930250fcf)
+++ CHANGELOG.de.md	(revision 0cea12bab4582ddc1462b7adef282a7c0afdcbcf)
@@ -7,4 +7,8 @@
 
 ### Hinzugefügt
+- **Die Inhaberin kann ihre Inbox über C2S lesen.** Ein GET auf die Inbox mit
+  dem eigenen Bearer liefert aktuelle eingegangene Beiträge (die Konten, denen
+  du folgst) als Create(Note)-Einträge, damit eine verbundene App (Shaer) einen
+  vereinten Feed bauen kann. Für alle anderen bleibt die Inbox write-only.
 - **"Mehr laden" in den Feeds.** Solo (Start), Zirkel, Zeitung und Nachrichten
   laden jetzt in Blöcken von 72 mit einem "Mehr laden"-Button statt einer harten
Index: CHANGELOG.md
===================================================================
--- CHANGELOG.md	(revision 513ba827ae08398446f52a46e39142a930250fcf)
+++ CHANGELOG.md	(revision 0cea12bab4582ddc1462b7adef282a7c0afdcbcf)
@@ -7,4 +7,8 @@
 
 ### Added
+- **The owner can read their inbox over C2S.** A GET on the inbox with the
+  account's own bearer returns recent inbound posts (the accounts you follow)
+  as Create(Note) items, so a connected app (Shaer) can build a unified feed.
+  For everyone else the inbox stays write-only.
 - **"Load more" on the feeds.** Solo (home), Cirkel, News and Messages now page
   in blocks of 72 with a "Load more" button instead of a hard cap, so older
Index: CHANGELOG.nl.md
===================================================================
--- CHANGELOG.nl.md	(revision 513ba827ae08398446f52a46e39142a930250fcf)
+++ CHANGELOG.nl.md	(revision 0cea12bab4582ddc1462b7adef282a7c0afdcbcf)
@@ -7,4 +7,8 @@
 
 ### Toegevoegd
+- **De eigenaar kan zijn inbox lezen via C2S.** Een GET op de inbox met de
+  eigen bearer geeft recente binnengekomen posts (de accounts die je volgt) als
+  Create(Note)-items, zodat een gekoppelde app (Shaer) een unified feed kan
+  bouwen. Voor alle anderen blijft de inbox write-only.
 - **"Meer laden" op de feeds.** Solo (home), Cirkel, Krant en Berichten laden nu
   in blokken van 72 met een "Meer laden"-knop in plaats van een harde limiet, dus
Index: src/routes/activitypub.js
===================================================================
--- src/routes/activitypub.js	(revision 513ba827ae08398446f52a46e39142a930250fcf)
+++ src/routes/activitypub.js	(revision 0cea12bab4582ddc1462b7adef282a7c0afdcbcf)
@@ -84,4 +84,38 @@
 });
 
+// ── Inbox read (owner only, AP C2S) ───────────────────────────────
+// GET on the inbox is part of ActivityPub C2S: the account owner (a bearer
+// scoped to this site) reads recent inbound posts (the timeline: accounts
+// they follow) as Create(Note) items, so an app (Shaer) can build a unified
+// feed. Anyone else gets 403; the inbox stays write-only for the public.
+router.get('/ap/users/:slug/inbox', (req, res) => {
+  const auth = OAuth.verifyBearer(req.headers.authorization);
+  if (!auth || auth.site.slug !== req.params.slug) return res.status(403).end();
+  const base = baseUrl(req);
+  const items = AP.getTimeline(auth.site.slug, 60).map((t) => ({
+    id: `${t.id}#create`,
+    type: 'Create',
+    actor: t.author_uri,
+    published: t.published || t.created_at || undefined,
+    object: {
+      id: t.id,
+      type: 'Note',
+      attributedTo: t.author_uri,
+      content: t.content,
+      url: t.url || undefined,
+      published: t.published || t.created_at || undefined,
+      sensitive: !!t.nsfw,
+      summary: t.cw || undefined,
+    },
+  }));
+  AP.sendAP(res, {
+    '@context': AP.AP_CONTEXT,
+    id: `${base}/ap/users/${auth.site.slug}/inbox`,
+    type: 'OrderedCollection',
+    totalItems: items.length,
+    orderedItems: items,
+  });
+});
+
 // ── Followers (count-only public, full for the owner) ─────────────
 // A C2S bearer scoped to this site (the account owner) gets the real actor
Index: test/c2s-inbox.test.js
===================================================================
--- test/c2s-inbox.test.js	(revision 0cea12bab4582ddc1462b7adef282a7c0afdcbcf)
+++ test/c2s-inbox.test.js	(revision 0cea12bab4582ddc1462b7adef282a7c0afdcbcf)
@@ -0,0 +1,27 @@
+// C2S inbox read (owner only): the route maps ap_timeline rows to Create(Note)
+// items; here we cover the data path (fields the mapping relies on). The
+// bearer gate itself follows the followers-route pattern (verified live).
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+process.env.DATABASE_PATH = ':memory:';
+process.env.PUBLIC_BASE_URL = 'https://klonkt.test';
+
+const dbMod = await import('../src/config/database.js');
+const db = dbMod.default;
+dbMod.initializeDatabase();
+const AP = (await import('../src/services/ActivityPubService.js')).default;
+
+db.prepare(`INSERT INTO ap_timeline (id, slug, author_uri, author_name, content, url, published, nsfw, cw, created_at)
+  VALUES ('https://r.test/n/1','me','https://r.test/u/a','A','<p>hoi</p>','https://r.test/@a/1','2026-07-01T10:00:00Z',1,'let op',CURRENT_TIMESTAMP)`).run();
+
+test('timeline rows carry the fields the inbox mapping needs', () => {
+  const [t] = AP.getTimeline('me', 10);
+  assert.equal(t.id, 'https://r.test/n/1');
+  assert.equal(t.author_uri, 'https://r.test/u/a');
+  assert.equal(t.content, '<p>hoi</p>');
+  assert.equal(t.url, 'https://r.test/@a/1');
+  assert.equal(t.nsfw, 1);
+  assert.equal(t.cw, 'let op');
+  assert.ok(t.published);
+});