Index: test/owner-follow-gate.test.js
===================================================================
--- test/owner-follow-gate.test.js	(revision acbc9fc37db938981585559eac40eda58373493e)
+++ test/owner-follow-gate.test.js	(revision acbc9fc37db938981585559eac40eda58373493e)
@@ -0,0 +1,72 @@
+// De eigenaarspoort (Robins wens, 18-8): met approve_followers aan wordt een
+// inkomende Follow NIET auto-geaccepteerd maar vastgehouden tot de eigenaar
+// beslist op /connect — zodat niemand een klonkt ongevraagd aan een hub of
+// ander verzamelplatform kan hangen. Zonder de instelling verandert er niets.
+//
+// De fetch is gestubd: het gaat om de poort, niet om echte HTTP.
+import { test, after } from 'node:test';
+import assert from 'node:assert/strict';
+
+process.env.DATABASE_PATH = ':memory:';
+process.env.PUBLIC_BASE_URL = 'https://klonkt.test';
+
+const dbMod = await import('../src/config/database.js');
+const db = dbMod.default;
+dbMod.initializeDatabase();
+const APmod = await import('../src/services/ActivityPubService.js');
+const AP = APmod.default;
+const G = await import('../src/services/guardianship/index.js');
+
+db.prepare("INSERT INTO users (id, username, email, password_hash, role) VALUES ('u1','u1','u1@t','x','god')").run();
+db.prepare("INSERT INTO sites (id, slug, title, owner_id, is_public, approve_followers) VALUES ('s1','dev','Dev','u1',1,1)").run();
+db.prepare("INSERT INTO sites (id, slug, title, owner_id, is_public, approve_followers) VALUES ('s2','open','Open','u1',1,0)").run();
+
+// IP-literal: safeFetch slaat dan de DNS-lookup over en de stub vangt de rest.
+const HUB = 'https://203.0.113.77/ap/actor';
+const echteFetch = globalThis.fetch;
+globalThis.fetch = async () => new Response(JSON.stringify({
+  id: HUB, type: 'Application', preferredUsername: 'hub', inbox: `${HUB}/inbox`,
+}), { status: 200, headers: { 'content-type': 'application/activity+json' } });
+after(() => { globalThis.fetch = echteFetch; });
+
+const follow = (slug) => AP.handleInbox({
+  body: {
+    '@context': 'https://www.w3.org/ns/activitystreams',
+    id: `${HUB}#follow-${slug}`, type: 'Follow', actor: HUB,
+    object: `https://klonkt.test/ap/users/${slug}`,
+  },
+  headers: {}, get: () => undefined, socket: {},
+}, slug, { id: HUB });
+
+const volgers = (slug) =>
+  db.prepare('SELECT COUNT(*) c FROM ap_followers WHERE slug = ? AND actor_uri = ?').get(slug, HUB).c;
+
+test('approve_followers aan: de Follow wacht op de eigenaar', async () => {
+  await follow('dev');
+  assert.equal(volgers('dev'), 0, 'geen auto-accept');
+  const wachtend = G.follows.listForWard('dev');
+  assert.equal(wachtend.length, 1);
+  assert.equal(wachtend[0].follower_uri, HUB);
+  assert.equal(wachtend[0].status, 'pending');
+});
+
+test('goedkeuren: volger erbij, wachtrij leeg', async () => {
+  const pending = G.follows.listForWard('dev')[0];
+  await AP.acceptGatedFollow(pending);
+  G.follows.remove(pending.id);
+  assert.equal(volgers('dev'), 1);
+  assert.equal(G.follows.listForWard('dev').length, 0);
+});
+
+test('zonder de instelling blijft auto-accept gewoon werken', async () => {
+  await follow('open');
+  assert.equal(volgers('open'), 1);
+});
+
+test('de actor adverteert manuallyApprovesFollowers eerlijk', () => {
+  const dicht = db.prepare("SELECT * FROM sites WHERE slug = 'dev'").get();
+  const open = db.prepare("SELECT * FROM sites WHERE slug = 'open'").get();
+  const build = APmod.buildActor || AP.buildActor;
+  assert.equal(build('https://klonkt.test', dicht).manuallyApprovesFollowers, true);
+  assert.equal(build('https://klonkt.test', open).manuallyApprovesFollowers, false);
+});