Changeset 6eab7e9 in Klonkt

Timestamp:

07/28/2026 11:22:07 PM (6 weeks ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

0202104

Parents:

6c152a5

Message:

Beschikbaarheid van guardians (FEP-633c 3.6): away, dormant, lapse

De Klonkt-kant van het beschikbaarheidsvoorstel, nagemaakt zoals eerst in de
daemon gevalideerd (shaer-8z7): dezelfde toestanden, dezelfde regels, dezelfde
weigeringen. De spiegel-tests dragen dezelfde namen als de daemon-tests, zodat
drift tussen de twee backends opvalt als een falende test met dezelfde woorden.

De kern is guardianship/availability.js: drie toestanden per (ward, guardian),
met als regel boven alles dat een antwoord alles herstelt, tot en met een
lopende lapse. Elke geverifieerde inbox-activiteit en elke C2S-handeling van
een guardian herstelt hem en annuleert een lapse tegen hem, nog voor er naar de
activiteit gekeken wordt. Bewust achter de handtekening-poort: een ongeverifieerde
bewering oma te zijn mag oma niet wakker maken.

Afwezig komt binnen over beide wegen: S2S als directe note met shaer:away en
endTime van een guardian elders (het gewone geval), en C2S als een guardian
hier zich afmeldt; die note draagt de marker mee naar wards elders en wordt
voor wards op deze instance direct toegepast, want een lokale inbox ontvangt
zijn eigen bezorging niet. Zonder (toekomstig) einde faalt het luid met 400,
precies zoals de daemon weigert.

Slapend volgt alleen uit onbeantwoorde direct geadresseerde verzoeken; de
follow-gating registreert die nu als bewijs. De markering notificeert verplicht
via protocol en de 6-handle, eenmalig op de overgang, centraal bedraad zodat
elke plek waar een promotie kan gebeuren hetzelfde notificeert.

De drempel van 3.5 rekent voortaan over de beschikbare set: de follow-quorums
en de gated settings allebei. De test die het waarom draagt: vijf guardians van
wie twee weg zijn gaven een drempel van drie die de twee levenden nooit haalden;
over de beschikbare set beslissen zij weer.

De lapse loopt over dezelfde draden als de gated settings: een Offer van
shaer:Lapse opent op de server van het kind, Accept/Reject stemt, het venster
loopt altijd vol, en de voltooiing verwijdert de relatie met de
nooit-leeg-grens uit 3.4 als tweede slot eronder. De offers-queue draagt de
lopende lapses en de nieuwe owner-only guardians-queue de beschikbaarheid, in
precies de vorm die de daemon serveert, dus de Shaer-apps van gisteren werken
zonder wijziging.

Changed files:
src/config/database.js

• tabellen ap_guardian_attention, ap_attention_requests, ap_lapses
• kolom ap_outbox.away_until

src/services/guardianship/handshake.js

• Offer van shaer:Lapse (S2S en C2S), lapse-stemmen op Accept/Reject, one-answer op elke C2S-handeling

src/services/guardianship/gated.js

• tally en voortgang over de beschikbare set; een stem is een antwoord

src/services/guardianship/notes.js

• awayProps: shaer:away plus endTime op de uitgaande directe note

src/services/guardianship/delivery.js

• away_until door het directe pad heen

src/services/guardianship/queues.js

• guardiansCollection; offersCollection draagt de lapses

src/services/guardianship/index.js

• exports

src/services/ActivityPubService.js

• one-answer achter de handtekening-poort
• away-ingest op het mention-pad en het C2S-directe pad
• dormancy-bewijs op de follow-gating; quorum over de beschikbare set
• de notificatieplicht van 3.6.2, een keer bedraad
• buildReplyNote draagt awayProps

src/routes/activitypub.js

• owner-only route /queues/guardians

src/routes/guardian.js

• dashboard-besluit is een antwoord; quorum over de beschikbare set

src/services/guardianship/relations.js

• guardians-queue aangekondigd in shaer:queues

test/activitypub-as2.test.js

• guardians toegevoegd aan de queue-sleutels

New file:
src/services/guardianship/availability.js

• de toestandsmachine, de lapse en de endTime-parser

test/availability.test.js

• veertien spiegel-tests van de daemon, tot en met de volle lapse-flow over de S2S-draad en het vijf-guardians-rekenvoorbeeld

remarks: de PWA toont de beschikbaarheid nog niet (chips in het paneel per
kind en een lapse-kaart komen apart); de echte kruis-implementatie-testbank
blijft open op shaer-6d9. Klonkt heeft geen pinbare klok zoals de daemon; de
tests dateren bewijs terug in plaats van de tijd vooruit te zetten, en dat
staat er als kanttekening bij. Niet uitgerold.

-robo
Co-Authored-By: Claude Fable 5 <noreply@…>

Files:

• src/config/database.js (modified) (2 diffs)
• src/routes/activitypub.js (modified) (1 diff)
• src/routes/guardian.js (modified) (1 diff)
• src/services/ActivityPubService.js (modified) (7 diffs)
• src/services/guardianship/availability.js (added)
• src/services/guardianship/delivery.js (modified) (2 diffs)
• src/services/guardianship/gated.js (modified) (3 diffs)
• src/services/guardianship/handshake.js (modified) (6 diffs)
• src/services/guardianship/index.js (modified) (1 diff)
• src/services/guardianship/notes.js (modified) (1 diff)
• src/services/guardianship/queues.js (modified) (3 diffs)
• src/services/guardianship/relations.js (modified) (1 diff)
• test/activitypub-as2.test.js (modified) (1 diff)
• test/availability.test.js (added)

src/config/database.js

@@ -523 +523 @@
       PRIMARY KEY (slug, feature, guardian_uri)
     );
+    -- Guardian availability (FEP-633c 3.6): one guardian's attention as seen
+    -- from one ward on this server. Never public; the ward reads it via the
+    -- owner-only guardians queue. One rule above all: one answer restores
+    -- everything, so every row here is one answer away from disappearing.
+    CREATE TABLE IF NOT EXISTS ap_guardian_attention (
+      ward_slug TEXT NOT NULL,
+      guardian_uri TEXT NOT NULL,
+      state TEXT NOT NULL DEFAULT 'active',  -- 'active' | 'away' | 'dormant'
+      away_until INTEGER,                    -- epoch ms while declared away
+      PRIMARY KEY (ward_slug, guardian_uri)
+    );
+    -- The ONLY admissible dormancy evidence (3.6.2): directly addressed
+    -- requests that went unanswered. Calendar time alone never counts.
+    CREATE TABLE IF NOT EXISTS ap_attention_requests (
+      ward_slug TEXT NOT NULL,
+      guardian_uri TEXT NOT NULL,
+      request_id TEXT NOT NULL,
+      asked_at INTEGER NOT NULL,             -- epoch ms
+      PRIMARY KEY (ward_slug, guardian_uri, request_id)
+    );
+    -- A lapse (3.6.3): the available co-guardians deciding to release a
+    -- dormant one. Irreversible, so the window always runs in full; any sign
+    -- of life from the target cancels it outright.
+    CREATE TABLE IF NOT EXISTS ap_lapses (
+      id TEXT PRIMARY KEY,
+      ward_slug TEXT NOT NULL,
+      ward_uri TEXT NOT NULL,
+      target_uri TEXT NOT NULL,
+      opened_by TEXT NOT NULL,
+      set_json TEXT NOT NULL,                -- the available set at open, target excluded
+      accepts_json TEXT NOT NULL DEFAULT '[]',
+      rejects_json TEXT NOT NULL DEFAULT '[]',
+      opened_at INTEGER NOT NULL,            -- epoch ms
+      window_ms INTEGER NOT NULL,
+      cancelled INTEGER NOT NULL DEFAULT 0,
+      applied INTEGER NOT NULL DEFAULT 0,
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    );
     CREATE TABLE IF NOT EXISTS ap_delivery (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -617 +655 @@
   ensureColumn('ap_mentions', 'help_request', 'INTEGER'); // inbound ward call-for-help (Guardian PWA message centre)
   ensureColumn('ap_outbox', 'wave', 'INTEGER');    // FEP-633c shaer:wave (guardian -> ward nudge)
+  ensureColumn('ap_outbox', 'away_until', 'INTEGER'); // FEP-633c 3.6.1 shaer:away + endTime (epoch ms)
   ensureColumn('ap_mentions', 'wave', 'INTEGER');  // inbound guardian wave
   // FEP-633c §2.2: object hint that the author is a ward. Register-only for now;

src/routes/activitypub.js

@@ -135 +135 @@
 queueRoute('follows', (id) => Guardianship.followsCollection(id));
 queueRoute('wards', (id, slug) => Guardianship.wardsCollection(id, slug));
+// Availability (FEP-633c 3.6.1) is never public: the ward reads its
+// guardians' real states here and nowhere else.
+queueRoute('guardians', (id, slug) => Guardianship.guardiansCollection(id, slug));
 
 // ── Inbox read (owner only, AP C2S) ───────────────────────────────

src/routes/guardian.js

@@ -210 +210 @@
   const pending = Guardianship.follows.getPending(req.params.id);
   if (!pending) return res.status(404).json({ error: 'gone' });
-  const guardians = Guardianship.listGuardians(pending.ward_slug).map((g) => g.other_uri);
-  if (!guardians.includes(me)) return res.status(403).json({ error: 'not_a_guardian' });
+  const allGuardians = Guardianship.listGuardians(pending.ward_slug).map((g) => g.other_uri);
+  if (!allGuardians.includes(me)) return res.status(403).json({ error: 'not_a_guardian' });
+  // Acting from the dashboard is an answer (3.6), and the quorum runs over
+  // the available set (3.5): both applied here, the same as over the wire.
+  Guardianship.availability.oneAnswer(me, Date.now());
+  const guardians = Guardianship.availability.availableSet(pending.ward_slug, allGuardians, Date.now());
   const r = Guardianship.follows.decide(pending.id, me, decision, guardians);
   try {

src/services/ActivityPubService.js

@@ -288 +288 @@
       ...Guardianship.helpRequestProps(post),
       ...Guardianship.waveProps(post),
+      ...Guardianship.awayProps(post),
       // FEP-633c §2.2: object hint that the author is a ward.
       ...Guardianship.hasGuardiansProps(site.slug),
@@ -1365 +1366 @@
       return 401;
     }
+    // One answer restores everything (FEP-633c 3.6): any VERIFIED activity
+    // from an actor that guards someone here restores it to active for those
+    // wards and cancels any lapse running against it, before the activity is
+    // even looked at. Signature-gated on purpose: an unverified claim of
+    // being gran must not wake gran up.
+    try {
+      const ev = Guardianship.availability.oneAnswer(claimedActor, Date.now());
+      if (ev.restored.length) console.log('[AP] guardian restored (one answer, 3.6):', claimedActor, '→', ev.restored.join(', '));
+      for (const c of ev.cancelledLapses) console.log('[AP] lapse cancelled by an answer from its target:', c.id);
+    } catch { /* availability is never load-bearing for delivery */ }
   }
 
@@ -1454 +1465 @@
       const wardKeys = getOrCreateKeys(slug);
       const followObj = { id: followId, type: 'Follow', actor: who, object: wardActor };
+      // Dormancy evidence (FEP-633c 3.6.2): this decision directly addresses
+      // every guardian. The ONLY admissible evidence is a request like this
+      // one going unanswered; recordRequest itself skips a declared absence.
+      for (const g of wardGuardians) {
+        try { Guardianship.availability.recordRequest(slug, g, followId, Date.now()); } catch { /* never load-bearing */ }
+      }
       for (const g of wardGuardians) {
         // Local ONLY when the guardian lives on THIS instance: slugFromActorUrl
@@ -1637 +1654 @@
         const wave = Guardianship.isWave(o);
         const hasG = Guardianship.objectHasGuardians(o);   // §2.2 hint, register-only
+        // FEP-633c 3.6.1: a guardian declares itself away to its ward, on the
+        // same direct note the mention below stores (so the kid also reads it
+        // as an ordinary message). Recorded only from an actual guardian of
+        // the addressed ward, and only with an end: an absence without an end
+        // is logged and dropped, never guessed.
+        if (Guardianship.availability.isAway(o)) {
+          const until = Guardianship.availability.parseEndTime(o.endTime);
+          for (const slug of slugs) {
+            const isG = (() => { try { return Guardianship.listGuardians(slug).some((g) => g.other_uri === actorUri); } catch { return false; } })();
+            if (!isG) continue;
+            if (!until || until <= Date.now()) { console.warn('[AP] away without a (future) end ignored (3.6.1):', actorUri, '→', slug); continue; }
+            Guardianship.availability.declareAway(slug, actorUri, until);
+            console.log('[AP] guardian declared away (3.6.1):', actorUri, '→', slug, 'until', new Date(until).toISOString());
+          }
+        }
         for (const slug of slugs) {
           try {
@@ -2213 +2245 @@
             .filter(Boolean);
           const help = object['shaer:helpRequest'] === true || object.helpRequest === true;
-          const r = await deliverDirectNote(site, { recipients, text: plain, language: object.language || null, inReplyTo: typeof object.inReplyTo === 'string' ? object.inReplyTo : null, attachments: atts, helpRequest: help });
+          // FEP-633c 3.6.1: a guardian here declaring itself away to its
+          // wards. An away without a (future) end fails loudly, exactly as
+          // the daemon refuses it: stored quietly it would be a nominal
+          // guardian holding a seat.
+          let awayUntil = null;
+          if (Guardianship.availability.isAway(object)) {
+            awayUntil = Guardianship.availability.parseEndTime(object.endTime);
+            if (!awayUntil || awayUntil <= Date.now()) return { status: 400, error: 'away_needs_an_end' };
+            // A ward we host ourselves never receives its own delivery
+            // (private ranges, loopback): apply locally, the way the
+            // handshake commit does.
+            const meUri = selfActorId(site.slug);
+            for (const uri of recipients) {
+              const wslug = uri.startsWith(`${base}/`) ? slugFromActorUrl(uri) : null;
+              if (wslug && Guardianship.listGuardians(wslug).some((g) => g.other_uri === meUri)) {
+                Guardianship.availability.declareAway(wslug, meUri, awayUntil);
+              }
+            }
+          }
+          const r = await deliverDirectNote(site, { recipients, text: plain, language: object.language || null, inReplyTo: typeof object.inReplyTo === 'string' ? object.inReplyTo : null, attachments: atts, helpRequest: help, awayUntil });
           if (!r || !r.id) return { status: 502, error: 'direct_failed' };
           return { status: 201, id: r.id, url: `${base}/ap/notes/${r.id}` };
@@ -3439 +3490 @@
   const pending = Guardianship.follows.getPending(followId);
   if (!pending) return false;
-  const guardians = Guardianship.listGuardians(pending.ward_slug).map((g) => g.other_uri);
-  if (!guardians.includes(actorUri)) return false;   // only a real guardian of this ward decides
+  const allGuardians = Guardianship.listGuardians(pending.ward_slug).map((g) => g.other_uri);
+  if (!allGuardians.includes(actorUri)) return false;   // only a real guardian of this ward decides
   const decision = type === 'Reject' ? 'reject' : 'approve';
+  // §3.5: the quorum runs over the AVAILABLE set. The voter itself was
+  // restored by the one-answer rule when its activity arrived, so answering
+  // is exactly what counts a guardian back in.
+  const guardians = Guardianship.availability.availableSet(pending.ward_slug, allGuardians, Date.now());
   const r = Guardianship.follows.decide(followId, actorUri, decision, guardians);
   try {
@@ -3784 +3839 @@
 });
 
+// The notification duty of FEP-633c 3.6.2, wired once for every place a
+// dormancy promotion can happen (queue reads, fan-outs, tallies): marking a
+// guardian dormant MUST notify it, in protocol AND over the §6 handle. The
+// one-answer rule is worthless to someone who does not know an answer is
+// wanted. The handle of a committed guardian is its inbox (§6 minimum), which
+// is the same door this delivery knocks on; both attempts are logged.
+Guardianship.wireAvailability({
+  onDormant: (wardSlug, guardianUri) => {
+    const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
+    const site = db.prepare('SELECT * FROM sites WHERE slug = ?').get(wardSlug);
+    if (!base || !site) return;
+    const me = selfActorId(wardSlug);
+    const note = {
+      id: `${me}/dormant/${Date.now().toString(36)}${rid()}`,
+      type: 'Note', attributedTo: me, to: [guardianUri],
+      'shaer:dormant': true,
+      content: '<p>You have been observed dormant as a guardian. Nothing is wrong and nothing is held against you: one answer restores everything (FEP-633c 3.6.2).</p>',
+    };
+    deliverToActor(site, guardianUri, { id: `${note.id}#create`, type: 'Create', actor: me, to: [guardianUri], object: note })
+      .catch(() => { /* retried by the queue */ });
+    console.log('[AP] guardian observed dormant (3.6.2):', guardianUri, 'ward', wardSlug, '(notified in protocol; the §6 handle is the same inbox)');
+  },
+});
+
 export default {
   AP_CONTEXT, getOrCreateKeys, apWants, sendAP, actorId, noteId,

src/services/guardianship/delivery.js

@@ -40 +40 @@
 // guardian on any instance receives it as a private mention (the ward
 // call-for-help path).
-export async function deliverDirectNote(site, { recipients, text, language, inReplyTo, attachments, helpRequest, wave }) {
+export async function deliverDirectNote(site, { recipients, text, language, inReplyTo, attachments, helpRequest, wave, awayUntil }) {
   const { actorId, fetchActor, deriveHandle, escHtml, linkUrls, linkHashtags,
           getOutboxRow, buildReplyNote, AP_CONTEXT, getOrCreateKeys, deliver, enqueueDelivery } = deps;
@@ -70 +70 @@
     .map((a) => ({ url: a.url, mediaType: String(a.mediaType), name: String(a.name || '').slice(0, 120) }));
   const id = crypto.randomUUID();
-  db.prepare(`INSERT INTO ap_outbox (id, site_slug, post_id, post_slug, in_reply_to, to_actor, to_handle, content, language, attachments, visibility, to_actors, help_request, wave, created_at)
-              VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,CURRENT_TIMESTAMP)`)
-    .run(id, site.slug, '', null, inReplyTo || null, resolved[0].uri, resolved[0].handle, content, lang, media.length ? JSON.stringify(media) : null, 'direct', JSON.stringify(resolved.map((r) => r.uri)), helpRequest ? 1 : 0, wave ? 1 : 0);
+  db.prepare(`INSERT INTO ap_outbox (id, site_slug, post_id, post_slug, in_reply_to, to_actor, to_handle, content, language, attachments, visibility, to_actors, help_request, wave, away_until, created_at)
+              VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,CURRENT_TIMESTAMP)`)
+    .run(id, site.slug, '', null, inReplyTo || null, resolved[0].uri, resolved[0].handle, content, lang, media.length ? JSON.stringify(media) : null, 'direct', JSON.stringify(resolved.map((r) => r.uri)), helpRequest ? 1 : 0, wave ? 1 : 0, awayUntil || null);
   const row = getOutboxRow(id);
   const note = buildReplyNote(base, site, row);

src/services/guardianship/gated.js

@@ -15 +15 @@
 import db from '../../config/database.js';
 import { listGuardians } from './relations.js';
+import * as availability from './availability.js';
 
 /** The window a gated-setting decision stays open. Reversible, so a day. */
@@ -67 +68 @@
   const column = featureColumn(feature);
   if (!column) return { state: 'expired', error: 'unknown_feature' };
-  const guardians = listGuardians(slug).map((g) => g.other_uri);
-  if (!guardians.includes(guardianUri)) return { state: 'expired', error: 'not_a_guardian' };
+  const all = listGuardians(slug).map((g) => g.other_uri);
+  if (!all.includes(guardianUri)) return { state: 'expired', error: 'not_a_guardian' };
+  // A vote is an answer, whatever it is a vote on (§3.6): the voter is
+  // restored first, so it always counts itself back into the set below.
+  availability.oneAnswer(guardianUri, Date.now());
+  // §3.5: the threshold runs over the AVAILABLE set. Membership is checked
+  // against the full list above: any guardian may answer, and answering is
+  // exactly what brings it back in.
+  const guardians = availability.availableSet(slug, all, Date.now());
 
   // The window opens with the first answer, and a stale decision starts over:
@@ -100 +108 @@
   const votes = db.prepare('SELECT guardian_uri, value FROM ap_gated_votes WHERE slug = ? AND feature = ?')
     .all(slug, feature);
-  const guardians = listGuardians(slug).map((g) => g.other_uri);
+  // Progress over the available set (§3.5), like the tally itself.
+  const guardians = availability.availableSet(slug, listGuardians(slug).map((g) => g.other_uri), Date.now());
   return { votes: votes.length, need: thresholdFor(guardians.length), of: guardians.length };
 }

src/services/guardianship/handshake.js

@@ -20 +20 @@
 import * as relations from './relations.js';
 import * as gated from './gated.js';
+import * as availability from './availability.js';
 
 let deps = null;
@@ -194 +195 @@
   if (!['Offer', 'Accept', 'Reject', 'Undo'].includes(type)) return null;
   const me = deps.selfId(site.slug);
+  // One answer restores everything (§3.6): any C2S activity from this actor
+  // is that answer, for every local ward it guards. Runs before anything is
+  // even looked at, so the target of a running lapse cancels it by doing
+  // anything at all — including trying to vote on it.
+  try { availability.oneAnswer(me, Date.now()); } catch { /* never load-bearing */ }
 
   // ── Undo: a guardian ends its own guardianship (§3.2). Same path as the
@@ -206 +212 @@
   // ── Offer: the local site is the guardian-candidate. ───────────────────
   if (type === 'Offer') {
+    // §3.6.3 over C2S: a guardian here proposes releasing a dormant
+    // co-guardian. A ward we host opens locally; a remote ward gets the
+    // proposal delivered, because the ward's server is the one that tallies
+    // and enforces (the §5.6 line: a guardian next door must not have more
+    // say than one far away).
+    const lp = availability.parseLapse(activity.object);
+    if (lp) {
+      const id = `${me}/lapses/${Date.now().toString(36)}${Math.floor(Math.random() * 1e4).toString(36)}`;
+      const wardSlug = deps.localSlug(lp.ward);
+      if (wardSlug) {
+        const r = availability.openLapse({ id, wardSlug, wardUri: lp.ward, target: lp.target, openedBy: me, now: Date.now() });
+        if (r.error) return { status: r.error === 'not_in_available_set' ? 403 : 409, error: r.error };
+        deps.deliverTo(site, lp.target, { id, type: 'Offer', actor: me, to: [lp.target], object: { type: 'shaer:Lapse', 'shaer:ward': lp.ward, object: lp.target } }).catch(() => { /* best-effort */ });
+        notify(wardSlug, { kind: 'lapse_opened', lapse: id, target: lp.target, set: r.set });
+        return { status: 202, id, url: id, 'shaer:set': r.set, 'shaer:threshold': r.threshold };
+      }
+      const offer = { id, type: 'Offer', actor: me, to: [lp.ward], object: { type: 'shaer:Lapse', 'shaer:ward': lp.ward, object: lp.target } };
+      const delivered = await fanout(site, [lp.ward], offer);
+      return { status: 202, id, url: id, delivered };
+    }
     const rel = parseRelationship(activity.object);
     if (!rel) return null;
@@ -231 +257 @@
   const offerId = idOf(activity.object);
   if (!offerId) return { status: 400, error: 'missing_offer' };
+  // A lapse vote over C2S (§3.6.3): the same Accept/Reject wire the offers
+  // and gated follows use, which is exactly why the Shaer clients need no
+  // new verbs for it.
+  if (availability.getLapse(offerId)) {
+    const r = availability.lapseVote(offerId, me, type === 'Accept', Date.now());
+    if (r && r.error) return { status: r.error === 'not_in_set' ? 403 : 409, error: r.error };
+    return { status: 202, id: offerId, url: offerId, 'shaer:outcome': 'open', 'shaer:accepts': r.accepts, 'shaer:threshold': r.threshold };
+  }
   let offer = offers.getOffer(site.slug, offerId);
   if (!offer) return { status: 404, error: 'no_such_offer' };
@@ -273 +307 @@
       const r = gated.recordGatedVote(site.slug, gs.feature, actor, gs.value);
       notify(site.slug, { kind: 'gated_setting', feature: gs.feature, value: gs.value, state: r.state });
+      return true;
+    }
+    // §3.6.3: a co-guardian proposes releasing a dormant guardian of THIS
+    // ward. The ward's server opens, tallies and (after the full window)
+    // executes, exactly as it does for the gated settings above.
+    const lp = availability.parseLapse(activity.object);
+    if (lp) {
+      if (lp.ward !== me) return false;   // not our ward
+      const id = idOf(activity) || `${me}/lapses/${Date.now().toString(36)}${Math.floor(Math.random() * 1e4).toString(36)}`;
+      const r = availability.openLapse({ id, wardSlug: site.slug, wardUri: me, target: lp.target, openedBy: actor, now: Date.now() });
+      if (r.error) {
+        notify(site.slug, { kind: 'lapse_refused', reason: r.error, target: lp.target });
+        return true;   // consumed: the refusal is the answer
+      }
+      // The target is notified like any dormancy marking (§3.6.2): in
+      // protocol (a copy of the Offer, so one answer can cancel it) AND the
+      // §6 handle, which for a committed guardian is its inbox — the same
+      // door this delivery knocks on.
+      deps.deliverTo(site, lp.target, activity).catch(() => { /* best-effort */ });
+      notify(site.slug, { kind: 'lapse_opened', lapse: id, target: lp.target, set: r.set });
       return true;
     }
@@ -304 +358 @@
     return true;
   }
+  // §3.6.3: a set member answering a running lapse. Irreversible, so even a
+  // full tally leaves it open until the window closes (§3.5); the completion
+  // happens lazily on reads (queues) once the window has run.
+  if (availability.getLapse(offerId)) {
+    const r = availability.lapseVote(offerId, actor, type === 'Accept', Date.now());
+    notify(site.slug, { kind: 'lapse_vote', lapse: offerId, by: actor, state: r && !r.error ? 'recorded' : (r && r.error) || 'refused' });
+    return true;
+  }
   let offer = offers.getOffer(site.slug, offerId);
   if (!offer) return false;

src/services/guardianship/index.js

@@ -16 +16 @@
  */
 export { SHAER_CONTEXT, GUARDIAN_RELATIONSHIP, GUARDIAN_RELATIONSHIP_COMPACT, isGuardianRelationship } from './context.js';
-export { helpRequestProps, isHelpRequest, waveProps, isWave, hasGuardiansProps, objectHasGuardians, externalEmbedsAllowed } from './notes.js';
+export { helpRequestProps, isHelpRequest, waveProps, isWave, awayProps, hasGuardiansProps, objectHasGuardians, externalEmbedsAllowed } from './notes.js';
 export { wireDelivery, c2sVisibility, deliverDirectNote } from './delivery.js';
 export { wireHandshake, handleOutbox as handleGuardianshipOutbox, handleInbox as handleGuardianshipInbox, parseRelationship, parseUndoRelationship, endGuardianship } from './handshake.js';
-export { offersCollection, followsCollection, wardsCollection } from './queues.js';
+export { offersCollection, followsCollection, wardsCollection, guardiansCollection } from './queues.js';
+export * as availability from './availability.js';
+export { wireAvailability } from './availability.js';
 export * as follows from './follows.js';
 export { listForParty as listOffersForParty, getOffer, findOfferAnywhere } from './offers.js';

src/services/guardianship/notes.js

@@ -65 +65 @@
 }
 
-export default { helpRequestProps, isHelpRequest, waveProps, isWave, hasGuardiansProps, objectHasGuardians, externalEmbedsAllowed };
+/** shaer:away (3.6.1): a guardian declaring itself away to its ward, with an
+ *  end. Rides a direct note like the help request, so a ward on a plain
+ *  server reads a human message; endTime is plain AS2. */
+export function awayProps(post) {
+  return (post && post.visibility === 'direct' && post.away_until)
+    ? { 'shaer:away': true, endTime: new Date(post.away_until).toISOString() }
+    : {};
+}
+
+export default { helpRequestProps, isHelpRequest, waveProps, isWave, awayProps, hasGuardiansProps, objectHasGuardians, externalEmbedsAllowed };

src/services/guardianship/queues.js

@@ -11 +11 @@
 import * as offers from './offers.js';
 import * as relations from './relations.js';
+import * as availability from './availability.js';
 
 const collection = (id, items) => ({
@@ -16 +17 @@
 });
 
-/** Pending offers where the local site is a party, each with its accept tally. */
+/** Pending offers where the local site is a party, each with its accept
+ *  tally. The same collection carries the running lapses (§3.6.3) this
+ *  account is a party to, exactly as the daemon serves them, so the Shaer
+ *  clients render both without a second fetch. */
 export function offersCollection(id, slug, me) {
   const items = offers.listForParty(slug, me).map((o) => offers.queueItem(o, me));
+  items.push(...availability.lapseQueueItems(slug, me, Date.now()));
   return collection(id, items);
 }
@@ -34 +39 @@
 }
 
-export default { offersCollection, followsCollection, wardsCollection };
+/** The ward's guardians with their availability (§3.6.1: never public,
+ *  owner-only): the real size of the safety net. Same shape as the daemon. */
+export function guardiansCollection(id, slug) {
+  const uris = relations.listGuardians(slug).map((r) => r.other_uri);
+  return collection(id, availability.statusesFor(slug, uris, Date.now()));
+}
+
+export default { offersCollection, followsCollection, wardsCollection, guardiansCollection };

src/services/guardianship/relations.js

@@ -74 +74 @@
       follows: `${id}/queues/follows`,
       wards: `${id}/queues/wards`,
+      guardians: `${id}/queues/guardians`,
     },
   };

test/activitypub-as2.test.js

@@ -34 +34 @@
   // FEP-633c (Guardians): the owner-only dashboard queues on the actor; the
   // sub-keys are the daemon-contract collection names the Shaer clients read.
-  'shaer:queues', 'offers', 'follows', 'wards',
+  // `guardians` is the availability queue (3.6.1: never public, owner-only).
+  'shaer:queues', 'offers', 'follows', 'wards', 'guardians',
   // ActivityPub §4.1 `endpoints` vocabulary (same category as sharedInbox), used for C2S.
   'oauthAuthorizationEndpoint', 'oauthTokenEndpoint', 'uploadMedia',