Index: src/routes/guardian.js
===================================================================
--- src/routes/guardian.js	(revision c8e03c6553401711c2e513b26dd53e24cc5a9486)
+++ src/routes/guardian.js	(revision 6d5ce0cde5b3d2911f42fcf2b4cd343d687c8c3b)
@@ -309,7 +309,10 @@
 //    handshake module decides when it commits (§3.1).
 // ── Step away (FEP-633c 3.6.1): the guardian declares itself unavailable ──
-// One direct note with shaer:away and an endTime to every ward, the same
-// path Shaer takes over C2S. Wards on this instance are applied directly (a
-// local inbox never receives its own delivery); the rest travels S2S.
+// One direct note with shaer:away and an endTime to every ward, the same path
+// Shaer takes over C2S, and the only path: a ward on this instance receives
+// that note through the loopback and applies the absence in its own inbox
+// handler, exactly as a ward elsewhere does. This route used to write the
+// local wards itself as well, which meant the wire version could break without
+// anyone here noticing.
 router.post('/api/away', requireAuth, express.json({ limit: '2kb' }), async (req, res) => {
   const site = siteForUser(req);
@@ -320,18 +323,8 @@
   if (!wards.length) return res.status(409).json({ error: 'no_wards' });
   const until = Date.now() + days * 24 * 3600 * 1000;
-  const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
-  const me = AP.actorId(base, site.slug);
-  let applied = 0;
-  for (const uri of wards) {
-    const wslug = uri.startsWith(`${base}/`) ? uri.replace(/\/+$/, '').split('/').pop() : null;
-    if (wslug && Guardianship.listGuardians(wslug).some((g) => g.other_uri === me)) {
-      Guardianship.availability.declareAway(wslug, me, until);
-      applied++;
-    }
-  }
   const L = resolveLang(req);
   const text = i18nT(L, 'guardian.away_msg', { date: new Date(until).toLocaleDateString('nl-NL') });
   const r = await AP.deliverDirectNote(site, { recipients: wards, text, awayUntil: until }).catch(() => null);
-  if (!applied && !(r && r.id)) return res.status(502).json({ error: 'away_failed' });
+  if (!(r && r.id)) return res.status(502).json({ error: 'away_failed' });
   res.json({ ok: true, until });
 });
@@ -508,28 +501,14 @@
   const offerId = `${me}/gated/${Date.now().toString(36)}${Math.floor(Math.random() * 1e4).toString(36)}`;
   const offer = Guardianship.gated.buildGatedOffer(offerId, me, uri, feature, allow);
+  // ONE path, whether the ward lives here or on the other side of the world
+  // (Robins regel, 29-7): propose over the wire and let the ward's server do
+  // what it does for everyone. deliverToActor loops a local recipient back
+  // into the same inbox handler, so co-location changes the transport and
+  // nothing else. The old shortcut recorded the vote here directly, which is
+  // how the remote path stayed broken for a month without anyone noticing.
+  AP.deliverToActor(site, uri, offer).catch(() => { /* queued, best-effort */ });
   const localSlug = (base && uri.startsWith(`${base}/`)) ? uri.replace(/\/+$/, '').split('/').pop() : null;
-  const localWard = localSlug ? db.prepare('SELECT slug FROM sites WHERE slug = ?').get(localSlug) : null;
-  if (localWard) {
-    Guardianship.gated.rememberGatedOffer(offerId, localWard.slug, feature, allow);
-    const r = Guardianship.gated.recordGatedVote(localWard.slug, feature, me, allow);
-    // Same forward as the S2S path: without it the other guardians never learn
-    // the proposal exists and a threshold of two can never be met.
-    if (r.state === 'open') {
-      const wardActor = AP.actorId(base, localWard.slug);
-      for (const g of Guardianship.listGuardians(localWard.slug).map((x) => x.other_uri)) {
-        if (g === me) continue;
-        // Signed by the ward, so the body must say the ward: anything else is
-        // a signer mismatch and the receiver answers 401 (as it should).
-        AP.deliverToActor(
-          db.prepare('SELECT * FROM sites WHERE slug = ?').get(localWard.slug),
-          g,
-          { ...offer, actor: wardActor, to: [g], 'shaer:proposer': me },
-        ).catch(() => { /* queued */ });
-      }
-    }
-    return res.json({ ok: true, allow, state: r.state, need: r.need, of: r.of });
-  }
-  AP.deliverToActor(site, uri, offer).catch(() => { /* queued, best-effort */ });
-  res.json({ ok: true, allow, state: 'open', federated: true });
+  const progress = localSlug ? Guardianship.gated.gatedProgress(localSlug, feature) : null;
+  res.json({ ok: true, allow, state: 'open', ...(progress || { federated: true }) });
 }
 
Index: src/services/ActivityPubService.js
===================================================================
--- src/services/ActivityPubService.js	(revision c8e03c6553401711c2e513b26dd53e24cc5a9486)
+++ src/services/ActivityPubService.js	(revision 6d5ce0cde5b3d2911f42fcf2b4cd343d687c8c3b)
@@ -1345,5 +1345,5 @@
 
 // Handle an incoming inbox POST. slugParam = null for the shared /ap/inbox.
-export async function handleInbox(req, slugParam) {
+export async function handleInbox(req, slugParam, preVerified = null) {
   const act = req.body || {};
   const type = act.type;
@@ -1352,5 +1352,10 @@
   const ip = req.ip || (req.connection && req.connection.remoteAddress) || '?';
   const base = (process.env.PUBLIC_BASE_URL || `${req.protocol}://${req.get('host')}`).replace(/\/+$/, '');
-  const verified = await verifyRequest(req).catch(() => null);
+  // preVerified is the loopback (see deliverToActor): a delivery between two
+  // actors on THIS instance never crosses a socket, so there is no signature to
+  // check — but we do know who signed, because we signed it. Handing that in
+  // keeps everything below identical, including the actor-versus-signer check,
+  // which is exactly the check that must not be skipped for being local.
+  const verified = preVerified || await verifyRequest(req).catch(() => null);
 
   // ENFORCE HTTP signatures: a data-affecting activity must be signed by the very
@@ -1534,6 +1539,12 @@
   const actorUri = typeof act.actor === 'string' ? act.actor : (act.actor && act.actor.id);
   const resolveActor = async (uri) => ((verified && verified.id === uri) ? verified : await fetchActor(uri).catch(() => null));
-  // Activities from our OWN actors are already stored via ap_outbox — don't re-store.
-  const isLocalActor = !!(base && actorUri && actorUri.startsWith(`${base}/ap/users/`));
+  // Our OWN activity is already stored via ap_outbox: don't store it twice.
+  // "Our own" means THIS inbox's owner, not "anyone who happens to live on this
+  // machine". The old reading dropped every activity between two sites on one
+  // instance, so a note from a co-located guardian to its ward was accepted
+  // with a 202 and then quietly thrown away: no mention, no away, no help
+  // request. Neighbours are not us (Robins regel, 29-7: on this machine
+  // everything behaves as if every Klonkt were somewhere else).
+  const isLocalActor = !!(actorUri && slugParam && actorUri === actorId(base, slugParam));
 
   // Inbound reply: a Create whose object replies to one of our notes (post OR comment).
@@ -2253,14 +2264,7 @@
             awayUntil = Guardianship.availability.parseEndTime(object.endTime);
             if (!awayUntil || awayUntil <= Date.now()) return { status: 400, error: 'away_needs_an_end' };
-            // A ward we host ourselves never receives its own delivery
-            // (private ranges, loopback): apply locally, the way the
-            // handshake commit does.
-            const meUri = selfActorId(site.slug);
-            for (const uri of recipients) {
-              const wslug = uri.startsWith(`${base}/`) ? slugFromActorUrl(uri) : null;
-              if (wslug && Guardianship.listGuardians(wslug).some((g) => g.other_uri === meUri)) {
-                Guardianship.availability.declareAway(wslug, meUri, awayUntil);
-              }
-            }
+            // No local shortcut here: the note below reaches a ward on this
+            // instance through the loopback, and its inbox handler applies the
+            // absence like it does for a ward anywhere else. One path.
           }
           const r = await deliverDirectNote(site, { recipients, text: plain, language: object.language || null, inReplyTo: typeof object.inReplyTo === 'string' ? object.inReplyTo : null, attachments: atts, helpRequest: help, awayUntil });
@@ -3807,4 +3811,23 @@
   const keys = getOrCreateKeys(site.slug);
   const payload = { '@context': AP_CONTEXT, ...activity };
+  // Co-location is a TRANSPORT detail, never a decision path (Robins regel,
+  // 29-7). An inbox on this machine is not reachable over HTTP from this
+  // machine, and should not be, so a local recipient is handed the activity
+  // straight into the same inbox handler the wire would reach. Everything
+  // above this line therefore behaves as if every Klonkt were remote: one code
+  // path, exercised by every deployment, including the checks. Two bugs in one
+  // day came from having a second, local-only path that hid a broken remote
+  // one.
+  const localSlug = localSlugOf(actorUri);
+  if (localSlug && db.prepare('SELECT 1 FROM sites WHERE slug = ?').get(localSlug)) {
+    const host = (() => { try { return new URL(selfActorId(site.slug)).host; } catch { return ''; } })();
+    const req = { body: payload, ip: 'loopback', protocol: 'https', get: () => host, headers: {} };
+    // The signer is us, and we say so: the actor-versus-signer check runs
+    // exactly as it does over the wire, so a mismatch fails here too.
+    const status = await handleInbox(req, localSlug, { id: me }).catch(() => 500);
+    const ok = status >= 200 && status < 300;
+    console.log('[AP]', activity.type, ok ? 'delivered (loopback) →' : `got ${status} (loopback) from`, actorUri);
+    return { delivered: ok, inbox: `${actorUri}/inbox`, loopback: true, status };
+  }
   const a = await fetchActor(actorUri).catch(() => null);
   const inbox = a && (a.inbox || (a.endpoints && a.endpoints.sharedInbox));
@@ -3822,8 +3845,25 @@
 }
 Guardianship.wireDelivery({
-  actorId, fetchActor, deriveHandle, escHtml, linkUrls, linkHashtags,
+  actorId, fetchActor, localActor, deliverTo: deliverToActor, deriveHandle, escHtml, linkUrls, linkHashtags,
   getOutboxRow: (id) => iStmts().getO.get(id),
   buildReplyNote, AP_CONTEXT, getOrCreateKeys, deliver, enqueueDelivery,
 });
+/**
+ * The actor document of a site WE host, read straight from the database.
+ * Same shape fetchActor returns for anyone else, plus `local: true` so the
+ * caller can take the loopback instead of a POST to our own hostname.
+ * Null for an actor we do not host: that one really is fetched.
+ */
+function localActor(actorUri) {
+  const slug = localSlugOf(actorUri);
+  if (!slug) return null;
+  const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
+  const site = db.prepare('SELECT * FROM sites WHERE slug = ?').get(slug);
+  if (!site) return null;
+  // primary_slug is what buildActor uses to pick '/' over '/user/<slug>'; the
+  // actor route sets it the same way before building.
+  const p = db.prepare('SELECT slug FROM sites WHERE is_primary = 1').get();
+  try { return { ...buildActor(base, { ...site, primary_slug: p && p.slug }), local: true }; } catch { return null; }
+}
 // Which local site (if any) hosts this actor URI — used by the handshake to
 // apply the local side of a commit and to derive a ward's existing guardians.
Index: src/services/guardianship/delivery.js
===================================================================
--- src/services/guardianship/delivery.js	(revision c8e03c6553401711c2e513b26dd53e24cc5a9486)
+++ src/services/guardianship/delivery.js	(revision 6d5ce0cde5b3d2911f42fcf2b4cd343d687c8c3b)
@@ -41,5 +41,5 @@
 // call-for-help path).
 export async function deliverDirectNote(site, { recipients, text, language, inReplyTo, attachments, helpRequest, wave, awayUntil }) {
-  const { actorId, fetchActor, deriveHandle, escHtml, linkUrls, linkHashtags,
+  const { actorId, fetchActor, localActor, deliverTo, deriveHandle, escHtml, linkUrls, linkHashtags,
           getOutboxRow, buildReplyNote, AP_CONTEXT, getOrCreateKeys, deliver, enqueueDelivery } = deps;
   const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
@@ -50,7 +50,11 @@
   const resolved = [];
   for (const uri of list) {
-    const a = await fetchActor(uri).catch(() => null);
+    // An actor we host is read from our own database, not fetched from our own
+    // hostname: that request has to leave the machine and come back, and when
+    // it does not, the recipient is silently dropped from the note. Everything
+    // that decides anything still runs below, for local and remote alike.
+    const a = (localActor && localActor(uri)) || await fetchActor(uri).catch(() => null);
     if (!a || !(a.inbox || (a.endpoints && a.endpoints.sharedInbox))) continue;
-    resolved.push({ uri, inbox: (a.endpoints && a.endpoints.sharedInbox) || a.inbox, handle: deriveHandle(uri), url: a.url || uri });
+    resolved.push({ uri, inbox: (a.endpoints && a.endpoints.sharedInbox) || a.inbox, local: !!a.local, handle: deriveHandle(uri), url: a.url || uri });
   }
   if (!resolved.length) return null;
@@ -83,5 +87,15 @@
   const keyId = `${me}#main-key`;
   let delivered = 0;
-  for (const inbox of [...new Set(resolved.map((r) => r.inbox))]) {
+  // A recipient on this machine takes the loopback (deliverToActor), which
+  // hands the Create to the same inbox handler an HTTP POST would reach: the
+  // note is stored, the mention is stored, and a shaer:away on it is applied,
+  // all by the code that does it for everyone else. A hairpin POST to our own
+  // hostname is not that code path, it is a second one that only appears to be.
+  for (const r of resolved.filter((x) => x.local)) {
+    const res = await deliverTo(site, r.uri, create).catch(() => null);
+    if (res && res.delivered) delivered++;
+  }
+  // Remote: one POST per inbox, so two guardians on the same server share it.
+  for (const inbox of [...new Set(resolved.filter((x) => !x.local).map((r) => r.inbox))]) {
     let ok = false;
     try { const st = await deliver(inbox, create, keyId, keys.private_pem); ok = st >= 200 && st < 300; } catch { ok = false; }
Index: src/services/guardianship/handshake.js
===================================================================
--- src/services/guardianship/handshake.js	(revision c8e03c6553401711c2e513b26dd53e24cc5a9486)
+++ src/services/guardianship/handshake.js	(revision 6d5ce0cde5b3d2911f42fcf2b4cd343d687c8c3b)
@@ -219,13 +219,9 @@
     const lp = availability.parseLapse(activity.object);
     if (lp) {
+      // ONE path (Robins regel, 29-7): the ward's server opens, tallies and
+      // enforces, wherever it lives. A local ward is reached by the same
+      // deliverTo, which loops back into the inbox handler; co-location is a
+      // transport detail and never a shortcut past the decision.
       const id = `${me}/lapses/${Date.now().toString(36)}${Math.floor(Math.random() * 1e4).toString(36)}`;
-      const wardSlug = deps.localSlug(lp.ward);
-      if (wardSlug) {
-        const r = availability.openLapse({ id, wardSlug, wardUri: lp.ward, target: lp.target, openedBy: me, now: Date.now() });
-        if (r.error) return { status: r.error === 'not_in_available_set' ? 403 : 409, error: r.error };
-        deps.deliverTo(site, lp.target, { id, type: 'Offer', actor: me, to: [lp.target], object: { type: 'shaer:Lapse', 'shaer:ward': lp.ward, object: lp.target } }).catch(() => { /* best-effort */ });
-        notify(wardSlug, { kind: 'lapse_opened', lapse: id, target: lp.target, set: r.set });
-        return { status: 202, id, url: id, 'shaer:set': r.set, 'shaer:threshold': r.threshold };
-      }
       const offer = { id, type: 'Offer', actor: me, to: [lp.ward], object: { type: 'shaer:Lapse', 'shaer:ward': lp.ward, object: lp.target } };
       const delivered = await fanout(site, [lp.ward], offer);