Deliver Join and Leave to the app's inbox instead of an unaddressed outbox post

A participation activity is now addressed to the Festipod app actor alone and handled on reception in the app's inbox, the way the ActivityPods developer advised: use the ActivityPub protocol rather than a side channel. Any compatible sender may deliver; the inbox accepts only the activity's own signer, and the backend still requires the activity to lie in that actor's pod and acts on the stored copy. The meeting point is read again in its creator's pod before anything is written: read through the participant's pod, a foreign server's proxy chose the attendee list and the notification's name. Confidentiality is unchanged: the Join stays readable by its author and the app only. Recorded in decision_2026-11-03_participation-delivered-to-the-app, a named exception to festipod-only-reference-app-patterns.
Load the backend's env files from its own directory
2026-11-03 18:31:24 +01:00 · 2026-11-02 21:50:24 +01:00 · 2026-11-02 21:46:37 +01:00 · 2026-11-01 11:40:27 +01:00 · 2026-10-30 17:06:38 +01:00 · 2026-10-19 17:52:15 +02:00
158 changed files with 9054 additions and 3825 deletions
@@ -1,7 +1,7 @@
 # Festipod — variables d'environnement (exemple)
 #
 # Copier en `.env` et renseigner les valeurs.
-# En dev (`bun run dev`) ET en prod (`bun run start`), l'app sert depuis src/ et
+# En dev (`pnpm dev`) ET en prod (`bun run start`), l'app sert depuis src/ et
 # lit ces variables au RUNTIME (via l'endpoint /festipod-config.json de src/index.ts).
 #
 # REQUIS POUR LES TESTS. La suite Cucumber tourne sous `node` (pas sous Bun), qui
@@ -37,48 +37,23 @@ FESTIPOD_SHARED_WALLET_FILE_BASE64=
 FESTIPOD_AUTO_SEED=

 # ── Serveur ────────────────────────────────────────────────────────────────
-# Port HTTP du serveur (4000 : l'app est servie sur l'origine :4000 de la pile locale).
-PORT=4000
+# Port HTTP du serveur (4005 : l'app Festipod, paire 3005/4005 des apps sœurs).
+PORT=4005

 # NODE_ENV=production bascule `bun run start` (pas de HMR). En dev, laisser vide.
 NODE_ENV=

-# ── Backend ActivityPods ───────────────────────────────────────────────────
-# URL publique du backend Festipod (écoute sur le port 3003).
-SEMAPPS_HOME_URL=http://localhost:3003
+# Le backend lit son propre backend/.env (voir backend/.env.example).

-# URL publique du frontend (utilisée par le backend pour les OIDC redirects, etc.)
-SEMAPPS_FRONT_URL=http://localhost:4000
-
-# Endpoint SPARQL du Fuseki auquel se connecte le backend.
-SEMAPPS_SPARQL_ENDPOINT=http://localhost:3030/
-
-# Dataset Jena/Fuseki principal utilisé par le backend.
-SEMAPPS_MAIN_DATASET=settings
-
-# Identifiants Jena/Fuseki.
-SEMAPPS_JENA_USER=admin
-SEMAPPS_JENA_PASSWORD=admin
-
-# Redis : cache (db 3) et file des jobs (db 4).
-SEMAPPS_REDIS_CACHE_URL=redis://localhost:6390/3
-SEMAPPS_QUEUE_SERVICE_URL=redis://localhost:6390/4
-
-# Dataset utilisé par le service auth.account.
-SEMAPPS_AUTH_ACCOUNTS_DATASET_NAME=settings
-
-# Dépôt de shapes/shapetrees utilisé pour déclarer les besoins d'accès.
-SEMAPPS_SHAPE_REPOSITORY_URL=https://shapes.activitypods.org/
-
-# Nom et description de l'application (backend).
-SEMAPPS_APP_NAME=Festipod
-SEMAPPS_APP_DESCRIPTION=Points de rencontre sur les événements publics
-SEMAPPS_APP_LANG=en,fr
-SEMAPPS_PORT=3003
+# ── Infrastructure locale (`make start`) ───────────────────────────────────
+# docker compose lit aussi ce fichier. Port hôte du Redis de docker-compose-dev.yml,
+# vide = 6379. Le changer si un autre Redis occupe ce port, et reporter la même
+# valeur dans SEMAPPS_QUEUE_SERVICE_URL de backend/.env.
+REDIS_PORT=

 # ── Frontend / Backend coupling ────────────────────────────────────────────
 # URL du backend telle que vue par le navigateur.
-VITE_BACKEND_URL=http://localhost:3003
+VITE_BACKEND_URL=http://localhost:3005

 # Client ID OAuth/Solid du backend (laisser vide pour dériver `${VITE_BACKEND_URL}/as/actor/app`).
 # Le client_id DOIT être l'URI de l'acteur app : le pod enregistre l'app sous cette URI et
@@ -45,5 +45,8 @@ dist-staging/
 *.ngw
 .tasks/

+# Local data of the dev stack (docker-compose-dev.yml): fuseki, redis, pod provider
+/data
+
 # Per-developer contract access map (canonical provider → local checkout) — never committed.
 .project/contracts.local.yaml
@@ -0,0 +1,15 @@
+---
+type: knowledge
+summary: Signed in on a Pod, the app is held behind ProfileCompletionGate — a profile with an empty name shows the profile form in onboarding mode, a Pod with no readable profile shows an explanatory message; the only completion flag is the presence of a name
+---
+
+# Profile completion gate
+
+`FestipodDataContextValue.profileStatus` (`'loading' | 'ready' | 'missing'`, absent on providers where it does not apply) is computed by the refine provider from the actor document and the profile read. `ProfileCompletionGate` (in the app shell, inside the data provider) uses it:
+
+- `loading` → nothing is rendered yet;
+- `missing` → a blocking, honest message: the Pod links no readable profile and Festipod cannot create or link one (outside the pinned contract);
+- `ready` with an empty `currentUser.name` → `UpdateProfileScreen` in `onboarding` mode (explanation, no way out until saved, no pre-filled fiction);
+- otherwise the routed screen.
+
+The flag is the name itself — nothing is stored locally, so the form disappears for good once a name is saved and the profile re-read.
@@ -39,6 +39,7 @@ export function MyScreen() {              // named function, NEVER any props
 - **Zero props, no exception left**: every registered screen receives nothing; everything comes from context/hooks (`useFestipodData`, `useNavigate`, `useParams`). `WelcomeScreen` does not use `useFestipodData` (intro) — but still takes no props. (`LoginScreen`/`ConnexionScreen`/`AccessGateScreen` no longer exist — Festipod renders no access screen of its own; see [[knowledge_screens]] and [[knowledge_app-shell]].)
 - **Identity: the current user may not be there yet.** `currentUserId` is the NURI of the profile document this session **owns**, so it is **empty until that document resolves** — see [[caveat_identity-ids-in-screens]] before keying anything on it.
 - **The confirmation FOLLOWS the write.** Mutations reject rather than returning quietly, so a screen must `await` (or `.then`) before announcing anything: success toast and navigation on resolve, an error toast on reject, and the user kept on their edits. A toast fired beside the call announces a write that may never have happened — the pattern that had to be corrected on the event and profile edit screens.
+- **Reading what the session has not read yet is asked for from an effect.** A screen about one event calls `openEvent(eventId)`, a screen about someone else's events calls `openUserEvents(userId)` (`UserProfileScreen`); both are state changes, so they run in a `useEffect` keyed on the id, never during render, and the getters (`getEvent`, `getUserEvents`) answer with what has landed. They are idempotent and are no-ops on providers whose read set is already complete (local fixtures); `openUserEvents` is also a no-op for oneself and for anyone who is not a contact. Verified in `festipodDataBase.ts` (the context contract), `refineData.tsx` (the ActivityPods implementation).
 - **A write affordance is decided by ownership, in three states.** Both the control that *offers* the write and the screen that *performs* it consult the same answer (`data-layer` → [[knowledge_write-rights-are-ownership]]). `unknown` is never folded into either side: showing the form lets a non-owner edit on a guess, and bouncing them out tells a genuine owner their thing is not theirs. Render it as its own pending state.
 - **Layout**: full-height flex column; `Header` at the top, content at `flex:1; overflow:auto`, `BottomNav` at the bottom **only for hub screens** (Home, Events, Profile, Friends). Flow screens (creation, editing, detail) have no `BottomNav`.
 - **Feedback**: `showToast(message, 'success'|'info'|'error')` (`ToastContainer` mechanism exported by `sketchy/`).
@@ -0,0 +1,12 @@
+---
+type: rule
+summary: Tests are free in what they exercise — attacks, forged or spoofed activities included — with one restriction: nothing a test does may break the dev environment (pod provider and its datasets, the backend's datasets, Redis, persistent test accounts)
+---
+
+# Tests never break the dev environment
+
+**Rule:** (user directive 2026-10-30) A test may exercise anything, attacks included — a forged `Accept`, a spoofed or malformed activity, a crafted write — as long as it cannot break the dev environment. Concretely: an attack runs only between the throwaway accounts the run creates, and the run still deletes them; a test never writes another user's data, never alters a persistent account (the smoke's `alice`) beyond what the app itself does, never deletes, recreates or flushes a Fuseki dataset or Redis, and leaves the stack as it found it.
+
+**Why:** the local stack is the shared state every suite and every manual session rely on; a broken pod provider, dataset or cache costs a reset (slow sign-ups, lost app registrations). An earlier reading — "no forged activity is ever sent to the stack" — was stricter than intended and left real attack paths unproven: the forged-contact line of the rights matrix is the only live proof that the participations audience resists a forged contact ([[decision_2026-10-29_participation-privacy-mechanism]]).
+
+**How to apply:** before adding an attack line, check its blast radius: it touches only accounts created in this run, and its cleanup still runs when it fails. A MANUAL-CHECK line that is manual only because it would forge an activity may be promoted to a live line under the same condition. Read through the user's rules-allow-judgment: what is protected is the environment's integrity, not a list of forbidden activity types.
@@ -8,7 +8,7 @@ against: 66616484b96fb2227cd8cdf02321aacfb4811365

 Festipod is a mobile-first web application: users create **meeting points** grafted onto public events, and sign up to them. Its entire persistence goes through Refine, behind a **backend seam** that exists so the app can support several Refine backends and let the user switch between them at runtime. This package is one of the two backends targeted; the other is a Refine provider over NextGraph plus its polyfill. The seam's own contract — what a backend must answer before it can be added — lives in code, in `src/shared/refine/providers/types.ts`.

-The seam is wired since 2026-10-09 (T04.e): this backend is the registered default, and Festipod reads and writes through it — `useList` over the shared `as:Event` container (split into events and meeting points by the bindings' `isInstance`), creates and updates through the data provider, and the embedded `apods:attendees` collection through the participation binding's `membersOf`. Joins/leaves are the one write beside Refine (the package implements no `custom`): an `as:Join`/`as:Leave` posted to the user's own outbox by `src/shared/data/outbox.ts`, per the platform flow recorded in the 2026-10-09 brief. What the list below declares is therefore measured where a runtime check exists and declared elsewhere; `against:` names the observation's commit, and the package publishes no engagement, so there is nothing to pull and nothing that can drift — what is recorded here is read against our own reconstruction, and re-read when it is re-stamped.
+The seam is wired since 2026-10-09 (T04.e): this backend is the registered default, and Festipod reads and writes through it — `useList` over the shared `as:Event` container (split into events and meeting points by the bindings' `isInstance`), creates and updates through the data provider, and the embedded `apods:attendees` collection through the participation binding's `membersOf`. Joins/leaves are the one write beside Refine (the package implements no `custom`): an `as:Join`/`as:Leave` posted to the user's own outbox by `src/shared/data/outbox.ts`, naming the meeting point and addressed to the Festipod app actor alone, so that only its author and the app can read it; the pod delivers it to the app's inbox. What the list below declares is therefore measured where a runtime check exists and declared elsewhere; `against:` names the observation's commit, and the package publishes no engagement, so there is nothing to pull and nothing that can drift — what is recorded here is read against our own reconstruction, and re-read when it is re-stamped.

 ## Consumed surface

@@ -32,6 +32,8 @@ Four resources, one per persisted entity: **events**, **meeting points**, **part

 Through Refine's hooks only, never the provider directly: `useList` → `getList`, `useCreate` → `create`, `useUpdate` → `update`, `useDelete` → `deleteOne`. `getOne` is reached by Refine's cache plumbing rather than an explicit call. The app mounts Refine with `liveMode: 'auto'` and `mutationMode: 'optimistic'`.

+`update` of the own profile is also how the participation secret is stored: before the first Join the app re-reads its profile explicitly (`getOne`, refetched, never trusting a cached copy), and when no secret is there writes `http://festipod.org/participationSecret` through `update` with the **full IRI** as the key, then reads the stored value back from the answer. The pod stores and returns such a predicate under the full IRI (verified live 2026-10-29 with the app's token), whatever the `fp` prefix registration.
+
 `create` of an event or a meeting point carries `to: as:Public` among its variables: Festipod's declaration that the record is public, on which the Festipod backend's public read and discovery listing depend. See constraint 10.

 ### Record handling
@@ -51,7 +53,7 @@ What must keep holding for this backend to serve the app.
 1. **Festipod's own vocabulary, not ActivityStreams.** The four entities are Festipod domain types defined by SHEX shapes this repo holds; none is an ActivityStreams type. A caller-supplied `jsonContext` and caller-supplied `types` are what make that possible, and both must stay caller-supplied.
 2. **The identifier a record is addressed by must stay the identifier other records reference.** The seam carries the two separately because they differ on the other targeted backend; here they coincide, and the app relies on that. Splitting them later would break every cross-entity reference silently.
 3. **A partial update must stay partial.** The app sends only changed fields. A move to replacing the resource would drop every field omitted, with no error.
-4. **Every participation must be readable by every user.** The participant count is the number of participations of an event, counted with no filtering. What is confidential is the **link between a participation and a person** — only a connection can read the profile a participation points at and recognise who it is — never the participation record itself. The provider alone cannot satisfy it (need 1).
+4. **Every participation must be readable by every user.** The participant count is the number of participations of an event, counted with no filtering. What is confidential is the **link between a participation and a person**: an attendee list holds opaque member URNs, and only a connection, who reads the secret on the person's profile, can recognise who a URN is — never the list itself. The provider alone cannot satisfy it (need 1).
 5. **The count is never a stored, incremented field.** Reading a counter, adding one and writing it back derives each write from a read of the previous one and races itself through any data provider. This is measured, not theoretical, and it is why the app derives the count from the participation list at read time.
 6. **Changes must be pushed, not polled.** Neither the app nor its BDD suites has a polling loop, and adding one is ruled out by project doctrine. `liveMode: 'auto'` is mounted on that basis.
 7. **No process-global state that outlives a remount.** Two backends coexist in one page and the user switches between them at runtime; switching remounts Refine to discard the cache of the backend being left. Building this backend's providers must have no side effect that accumulates across switches — see friction 1, which is where this currently bites.
@@ -65,7 +67,7 @@ What must keep holding for this backend to serve the app.
 2. **`getList` fetches the whole container on every call.** Filtering, sorting and pagination run in memory afterwards, so the cost of listing an event's participations grows with the user's total number of participations rather than with the event. No workaround; it is why a filter on a `getList` buys nothing beyond convenience.
 3. **A list subscription reports membership only.** A container channel delivers `Add`/`Remove`, not a member's own fields changing, so a list of events does not refresh when an event's title, place or time is edited. Watching each record instead would open one channel per row. The event list is exactly the screen where this is visible.
 4. **`types` takes precedence over `shapeTreeUri`, the opposite of what the configuration type documents.** The declared behaviour is that `types` is "only used as a fallback when `shapeTreeUri` is not set"; a resource setting both is in fact resolved from `types`. Establishing which one actually wins cost a read of the resolution path. Configuring exactly one avoids it, but the documentation should say which wins.
-5. **The member shape of an `apods:attendees` collection is not pinned anywhere Festipod may read at work time.** The reconstruction documents the container discovery, not what a membership record is: a bare actor URI, or an object carrying event/participant/status. The project reconnaissance records only that a join "adds the actor to the collection" and that members come back "as full objects for a reader who is allowed, and as URIs otherwise". The ActivityPods backend's participation binding is designed against that: a member maps to `{ id, userId, isConfirmed: true }` (membership IS the attendance), with `eventId` supplied by the reader — the event the collection was read from — because a member carries no event link. The first runtime read against the local platform (T04.g) must confirm or correct this mapping.
+5. **The member shape of an `apods:attendees` collection is not pinned anywhere Festipod may read at work time.** The reconstruction documents the container discovery, not what a membership record is. Read against a local platform (verified 2026-10-12), the collection is its own resource, linked from the meeting point by URI and never embedded; its items are, in Festipod, opaque member URNs recorded by the Festipod backend, and the participation binding maps each to `{ id, userId, isConfirmed: true }` (membership IS the attendance), `eventId` being supplied by the reader — the meeting point the collection was read from. The `userId` of such a record is a member URN, not a person: a person is recognised only by hashing (see constraint 4).

 6. **The live provider's `subscribe` rejects with an uncaught `Forbidden` when the Pod refuses its push channel.** On this platform the channel creation (`POST /.notifications/WebSocketChannel2023`) answers 403 for the app's session, and each refusal surfaces as one unhandled rejection in the page — raised inside the provider, where the app cannot catch it; Festipod's end-to-end checks recognise it by its throw site. Reporting the refusal through the subscription's error path would let the app handle it.

@@ -1,97 +0,0 @@
---
-type: brief
-summary: Target model for sign-ups — a Participation READABLE by everyone (event ref + `active` boolean + a key-less reference to the participant's profile), deposited into the event's inbox; the creator processes the inbox, dedups WITHOUT knowing who, files the reference into a Set on the event and PURGES the cancelled ones; count = Set.size with no filtering (accepted upper bound); only connections can read the profile and recognize the person. Supersedes the mutated counter + plaintext userId.
---
-
-# Brief (2026-07-20, revised 2026-07-27) — Set-based sign-ups
-
-## The model
-
-Laid down and refined by the PO on 2026-07-27. Everything is **keys and URLs** — no roles, no membership, no allow-list.
-
-1. The participant creates a **Participation** object, **readable by everyone**, holding: the **reference to the event**, an **`active` boolean**, and a **reference to their *protected* profile that carries no key**. **Nothing else** — no description for now.
-2. They deposit the **Participation's reference** into the **event's inbox**.
-3. The **creator** processes their inbox **automatically**, as soon as they are online.
-4. They **dedup** (see below) — **without knowing who the participant is**: they hold a name for the profile, not the key to read it.
-5. They file a **reference** to the Participation into a **Set** carried by the event's document.
-6. Anyone reads **`Set.size`** → the number of participants.
-7. Someone **connected** to the participant holds their profile's cap, reads it, and **recognizes** the person.
-
-**Withdrawal**: the participant sets `active` to false **on their own object**. The creator sees it when reading, and **purges** — removing the reference from the Set.
-
-Three properties follow: **anonymous attendance by default** (even the creator cannot see who); **nobody modifies anyone else's sign-up** (only the participant holds the write key to their own object); **no plaintext `userId`** ever travels.
-
-### The principle that holds it all together: the truth is in the object, messages are only hints
-
-The object **controlled by the participant** is what counts. Any message — an inbox deposit, a purge notification — is only a **hint** that triggers a check, never an authority.
-
-Consequence: **forgery becomes structurally harmless**. A fake « purge X » leads the creator to read X, find it still active, and do nothing. That is why inbox deposits **need not be signed** — which is just as well, since the contract promises no authenticated sender.
-
-### Why a flag rather than a deletion
-
-Without the read key, a **deletion** cannot be told apart from "nothing was ever there". A **readable** object carrying a **flag** transforms the problem: the cancellation no longer has to be *detected*, it is simply *read*. The blocker disappears instead of being worked around with a forgeable message.
-
-### Why the identity pointer targets the existing profile
-
-No need for a second document per participation: the participant's **protected profile** already plays that role, and their connections **already** hold the key to read it — that is the very definition of being connected. A third party sees an opaque reference.
-
-The advantage over an encrypted field inside the Participation: **adding a connection rewrites nothing**. The profile is shared with a new connection once, durably (and irreversibly — the contract publishes no revocation). An encrypted field would require re-encrypting to N recipients and rewriting the Participation on every new connection.
-
-## What this rests on
-
-Two guarantees the contract publishes, and one thing it does not.
-
-| What the model needs | Where it stands |
-|---|---|
-| A reference can **name without granting read access** | Published: *"A returned reference carries no key… A reference found inside a document yields a name, not a key."* |
-| Sharing is **per document, durable and one-way** | Published: `inbox.share(doc, toUser)` — one act, no revocation, nothing per reader on a public document |
-| **Anyone may deposit, only the owner reads** the inbox | Published: `inbox.postToDocument` / `inbox.read` |
-| A **dedup key** letting the creator count distinct people without reading them | **NOT published.** See below — this is the open dependency. |
-
-## The dedup: the requirement, and the gap
-
-**The requirement, validated by the PO (2026-07-27)**: the creator must be able to tell two references from the *same* person apart from two references from *different* people, **without ever knowing who** — otherwise the count is not a count of people, and a participant could inflate it by creating several Participations.
-
-**The contract publishes nothing that does this.** A reference "yields a name, not a key", and no call answers "do these two references belong to one person?". So the mechanism is **not Festipod's to specify**: it is a **gap to raise with the provider**, stated as a need — *a stable, per-person discriminator that can be compared without reading the referenced document*.
-
-Design consequence, whatever the mechanism turns out to be: the Set is **keyed by that discriminator** — at most one reference per person. `Set.size` = the number of distinct people.
-
-### The reservation that must outlive this brief
-
-Any such discriminator is by construction a **pseudonym**: it does not say *who*, but it is comparable across contexts, so whoever collects references can link them. **Never present a Festipod action as "anonymous"** when it circulates one — the contract guarantees no anonymity, and making the Participation public widens the surface on which it is collected. Whether the pseudonym can be rotated, or scoped, is part of the gap above.
-
-## Trade-offs deliberately accepted (PO, 2026-07-27)
-
- **No filtering on read.** The count is `Set.size`, **without** checking the `active` flags. We accept the **staleness risk**: a cancelled participation still counts until the creator has purged. `Set.size` is therefore an **upper bound**, exact once purged. *Rationale: keep reads simple and O(1).*
- **Purging is the creator's job.** No curator service, no catch-up by readers.
- **No description** in the Participation for now. *(To be reopened when the need arises: whatever we put there would become public.)*
- **Creator offline**: the Set does not move until they have processed their inbox. Accepted.
-
-## What changes vs the current implementation
-
-What exists today ([[knowledge_context-internals]] §participantCount) derives a `participantCount` **written by the owner** from inbox markers carrying the **plaintext `userId`**.
-
- **Drop the `userId`** from inbox deposits → only the **Participation's reference** remains.
- **Count distinct people** through the discriminator above, no longer `userId`s.
- **`event.participantCount` goes away**, replaced by `Set.size`.
- **Identity resolution** now goes through **reading the profile** (hence through being connected), no longer through the marker.
- **Withdrawal stops being a deletion** → `active` set to false + a purge by the creator. See [[caveat_participation-deletion]], whose requirement (« authoritative, must not come back ») still holds but changes mechanism.
-
-Still valid as-is: **reactive reads**, **re-arming on reconnection**, and the **id-space fix** already shipped.
-
-## Open points
-
- **Participation scope** — it becomes **public**, whereas current product doctrine places it in *protected* ([[knowledge_data-scopes-and-discovery]], concept `functional-domain`). That leaf describes **what is implemented**: do not change it until this brief has graduated, but **do update it at that point**.
- **Recognition by connections** (step 7) — and what happens to a broken connection: the contract publishes **no revocation**, so sharing a profile is permanent. Explicitly deferred to a second stage.
- **Public reads are not recursive** — this is the principle the whole model rests on, and it deserves to be stated on its own: *an item in the **public** store is public — whoever has the URL reads the content.* But **not recursively**: public content may **reference** private content, and **that is exactly our case**. So the creator reads the Participation (public) and **cannot** follow the reference to the profile (protected). That is what yields both readability by the creator and anonymity towards them — with no additional mechanism.
-
-## Dependencies
-
- **Blocking — a contract gap**: no published way to **dedup without reading** (see above). Until the contract answers it, coding this model would produce a count that **claims** to be a count of people without being one. Raise it with the provider; do not emulate it here.
- **Parked**: **identity terminology** (wallet / user / profile) — see `.project/to-discuss.md`.
-
-## Status: model settled, implementation gated
-
-The model is **settled** (PO, 2026-07-27). What remains gated is the **implementation**, waiting on the dependency above. **Do not remove the current owner-derived counter** in the meantime ([[knowledge_context-internals]]).
-
-Links: [[caveat_participation-deletion]], [[rule_document-per-entity]], [[rule_app-uses-sdk-surface-only]], app-security ([[brief_2026-05-18_authorization-matrix]], [[knowledge_trust-model]]).
@@ -1,100 +0,0 @@
---
-type: brief
-summary: One persisted shape holding on BOTH backends — NextGraph (per-document encryption) and ActivityPods (WAC) — references rather than embedded content, no stored counter, with the acl:Append behaviour and the deduplication gap left open
---
-
-# Brief (2026-10-03) — One data shape for two rights models
-
-Festipod puts all its persistence behind interchangeable Refine backends (the seam's own contract is in code, `src/shared/refine/providers/types.ts`). Two are targeted: NextGraph plus its polyfill, and `@activitypods/refine-providers`, whose reconstructed observation is pinned beside this leaf ([[contract_activitypods-providers]]). The question this brief answers: what structure survives both rights models unchanged.
-
-## The primitives, side by side
-
-| What is needed | ActivityPods | NextGraph |
-|---|---|---|
-| Unit of rights | LDP resource + WAC | **document** |
-| List attached to a resource | `as:Collection` attached by a predicate, `semapps:dereferenceItems` | a Set inside the document |
-| Let a third party contribute | `acl:Append`, or `apods:PostOutbox` to the recipient's inbox | `inbox.postToDocument` |
-| Grant "my connections" | `acl:agentGroup` + a WAC group | per-document sharing, once per connection |
-| Name without granting access | reference + WAC refuses the GET | reference carrying no key |
-| Revoke | `pod-permissions.remove` exists | not published |
-| Write offline | no (client-server) | yes (local-first) |
-
-## The design rule that follows
-
-**The common denominator is NextGraph**, whose model is the strict subset: no groups, no revocation, sharing wholesale per document. So structure for NextGraph and ActivityPods will serve that structure — more cheaply even, with groups. The converse does not hold: any structure that needs a server-side projection or a revocation is untenable on NextGraph.
-
-## The structure
-
-```
-Event                      own document, public, written by its creator
-  └─ participations        an attached list of REFERENCES (never embedded content)
-Participation              own document, owned by THE PARTICIPANT
-  ├─ event       → ref
-  ├─ active      → boolean
-  └─ participant → ref to the Profile
-Profile                    own document, protected
-```
-
-## Why references and not embedded content — three facts
-
-1. **Ownership.** The participation must be writable by its participant and by nobody else (withdrawal must be authoritative — [[caveat_participation-deletion]]). On NextGraph write access is granted per document, so the participation **must be** a document; embedded in the event it would be writable only by the event's creator.
-2. **Per-reader variation is impossible inside a single document on NextGraph**, because encryption and sharing are per document. It is obtained by **indirection**: the reference is always present, and what varies is the ability to **follow** it.
-3. [[rule_document-per-entity]] already says this, and says it for exactly this reason.
-
-## The non-visibility mechanism differs — PO precision, 2026-10-03
-
-On NextGraph the target is **undecipherable** for want of a key: nothing is absent, the reference itself is readable. On ActivityPods it is either inaccessible (WAC refuses the GET) or the reference is omitted by server-side projection. Both land on the same application state: **a reference one may or may not resolve.**
-
-## Consequence on the domain types
-
-The type models the NextGraph shape, where everything is present:
-
-```ts
-interface FpParticipationData {
-  id: string;
-  event: string;
-  active: boolean;       // NOT optional — the participation is readable by everyone
-  participant: string;   // NOT optional — a reference, which names without granting access
-}
-```
-
-Resolution alone may fail: `resolveParticipant(ref)` yields `FpUserData | undefined`, where `undefined` means "not a connection". ActivityPods' omission is a **degradation the binding absorbs**: it reports "a participation whose participant does not resolve" — the same state as "I do not hold the key".
-
-An error made in session and corrected here: `active?` and `participant?` were proposed first, which lifted the ActivityPods adaptation into the common model.
-
-## The count
-
-**No stored counter, ever.** The number of participants is `participations.length`. `knownParticipants` is the participations whose participant resolves — a presence test, not an access check. Withdrawal is `active: false` on one's own document.
-
-## The three invariants that make the app platform-indifferent
-
-1. One document per entity; never embedded content.
-2. A reference may be unresolvable, and that is a **normal state** — neither an error nor an absence (the app shows "someone").
-3. The list is an **upper bound that converges**; never assume it is complete at the instant (already documented by [[caveat_participant-count-one-connection-lag]]).
-
-## Open points
-
-### NOT VERIFIED — does `acl:Append` on a collection let a third party insert an item without being able to remove one?
-
-WAC mode enforcement lives in `@semapps/webacl`, absent from the ActivityPods checkout consulted and not installed. The mode is real and genuinely used (`tests/apps/example.app.js` declares `accessMode: ['acl:Read', 'acl:Append']`), but its behaviour on a SparqlPatch `INSERT DATA` / `DELETE DATA` was not observed.
-
-**The structure does not depend on the answer.** If Append works that way, the participant appends directly and the count is immediate. Otherwise the route is `apods:PostOutbox` to the creator's inbox, whose app adds the reference — which is exactly the NextGraph shape. Only the latency changes.
-
-### OPEN — deduplication: neither platform counts people, and the implementation here does not either
-
-[[brief_2026-07-20_attendance-set-model]] requires that the creator tell two references from the *same* person apart from two references from different people, **without knowing who** — otherwise the count is not a count of people and a participant can inflate it. **The code here does not do that** (verified 2026-10-05). A different problem is solved, and solved well: `materializeAttendance` (`src/shared/data/registration.ts`) keys its active set by a **per-deposit** `uid` minted from time plus randomness, so a broker re-sync replaying the same deposits converges instead of double-counting — that is **replay idempotence**, not person identity. The count is therefore a count of **deposits**: the same person joining twice counts twice. Three further findings about the current implementation:
-
- **The plaintext `userId` travels in the deposit**, and the cancellation fallback depends on it — a leave without a known `regUid` cancels the earliest still-active join carrying that `userId`, so N leaves cancel N joins. The attendance-set brief's own change *"drop the `userId` from inbox deposits"* was never made, so the creator **does** know who and the anonymity property does not hold today. The privacy-preserving discriminator was never needed because the privacy was never implemented.
- **Participations live in the protected scope**, not public, and withdrawal is still a deletion ([[caveat_participation-deletion]]) — so the target model is not in place either. The attendance-set brief's own status line, *model settled / implementation gated*, still holds.
- **The gap was never raised through the declared channel.** The five frictions in this app's polyfill declaration (`polyfill-surface/usage_festipod.md`) cover inbox idempotence, the absence of a push on one's own deposit, the reactive read not seeing one's own write, the impossibility of resetting the test wallet, and a wrong published signature. None asks for a per-person discriminator.
-
-So the divergence is not "NextGraph has an upstream gap while ActivityPods does not": **both count deposits rather than people.** ActivityPods could arbitrate server-side because the server sees everything; NextGraph awaits a primitive. And the gap sits in **neither Refine provider** — it is in the polyfill on one side and the server on the other, which is what matters when deciding what to contribute where. The upper bound remains the common fallback position, already accepted by the PO.
-
-## Two ActivityPods constraints not to rediscover later
-
- **The Refine providers cover CRUD only.** Creating the collection, setting WAC, creating a group, posting to the outbox are not in the data provider, which does not implement Refine's `custom` either — so there is no escape hatch through Refine and those calls happen beside it.
- **A custom ontology prefix must be registered at prefix.cc**, the Pod provider requiring every ontology to have a known prefix; this concerns our `fp:`. Shape trees must also sit at a public URL, one per entity, since they cannot reference other shapes — no sharing cascade.
-
-## Reservation to keep alive
-
-The reference to the profile is readable by everyone and therefore collectable: it is a **correlatable pseudonym, not anonymity**, and must never be presented as such. The reservation comes from the attendance-set-model brief, and the 2026-10-03 precision reactivates it.
@@ -18,26 +18,23 @@ Directives recorded at the resumption of the hand-off (`.project/handoff/refine-

 Reading these at this stage is adoption-time reading, explicitly directed — the standing constraint against reading provider sources at work time is unaffected (`@activitypods/refine-providers` remains specified by its pinned reconstruction, `activitypods-providers/contract_activitypods-providers.md`).

- **Example apps** — `/home/sylvain/projects/reconnexion/welcometomyplace` and `/home/sylvain/projects/reconnexion/mutual-aid.app`: working integrations to mine for provider configuration, resources, and the on-behalf backend pattern.
+- **Example apps** — the reference apps under `~/projects/activitypods/` (`welcometomyplace`, `mutual-aid.app`, `portejunes`), the only allowed source of pod-interaction patterns (project rule `festipod-only-reference-app-patterns`).
 - **ActivityPods platform source** — `/home/sylvain/projects/activitypods/activitypods`; Semapps lives in a sibling folder.
 - **Shapes** — `/home/sylvain/projects/activitypods/shapes`: readily usable, and **evolvable by us** if Festipod's entities require it (that repo is ours to adapt).

-## Constraints already on record (see the 2026-10-03 brief and the reconstruction)
+## Constraints on record

- `fp:` must be registered at prefix.cc; shape trees must sit at public URLs, one per entity, no sharing cascade.
+- A Festipod CLASS with its own shape tree needs `fp:` registered at prefix.cc: the pod registers the ontology of every class it creates a data registration for, and refuses one whose prefix it cannot find (`registerOntologyFromClass` in the pod provider). Shape trees must sit at public URLs, one per entity, no sharing cascade. A Festipod PREDICATE on an existing resource does not need it: the pod stored and returned a `http://festipod.org/` predicate on a profile, `fp` unregistered (verified live 2026-10-29: written with the app's token, returned under the full IRI).
 - The Refine providers cover CRUD only; `custom` is not implemented — no escape hatch through Refine.
 - `getMany` silently drops failed fetches — it erases the "unreadable reference" state the model needs (a candidate contribution).
- `acl:Append` third-party insert-without-remove behaviour is NOT VERIFIED; the structure does not depend on the answer.

 ## Reconnaissance answers (2026-10-09)

 - **On-behalf mechanism — ANSWERED.** An app backend is an ActivityPub actor (`@activitypods/app` `AppService`, Moleculer); it signs pod requests as the app actor and the pod impersonates the user after checking registration + grants. Frontend calls use the Solid-OIDC dual-identity token instead. No unattended per-user backend token exists.
- **Registration/Participation — production precedent found.** welcometomyplace persists NO registration resource: a join is an `as:Join` activity posted to the user's outbox, the backend service handles it and adds the actor to the event's `apods:attendees` collection (attached via `attachPredicate`, `PodCollectionsHandlerMixin`); a leave is `as:Leave`, same path in reverse. Membership is read via `pod-collections.getItems`. mutual-aid uses none of this (comments, likes, announces only).
+- **Registration/Participation — production precedent found.** welcometomyplace persists NO registration resource: a join is an `as:Join` activity posted to the user's outbox, the backend service handles it and adds the actor to the event's `apods:attendees` collection (attached via `attachPredicate`, `PodCollectionsHandlerMixin`); a leave is `as:Leave`, same path in reverse. Membership is read via `pod-collections.getItems`. mutual-aid uses none of this (comments, likes, announces only). Festipod's adaptation, where participants must stay unidentifiable to non-contacts: [[decision_2026-10-29_participation-privacy-mechanism]].
 - **Event-in-event — feasible without touching any shape.** The `as/Event` and `as/Profile` SHACL shapes are open (no `sh:closed`), and the generic ActivityStreams vocabulary already defines `as:context`, `as:partOf`, `as:inReplyTo`. A meeting point is a plain `as/Event` carrying an `as:context` link to its parent event — the presence of the link is what distinguishes it, nothing else. Shapes are consumed for access needs and container setup, not server-side resource validation, so nothing breaks.

 ## Open questions

- Participation topology — the one real divergence from the 2026-10-03 structure: welcometomyplace keeps the canonical list creator-side (an `apods:attendees` collection on the event, writes backend-mediated), where the two-rights-models structure makes each participation a participant-owned document. Both land on the same application state (a reference that may or may not resolve); the choice is who owns the write path. **Arbitration route decided 2026-10-09: the implementation plan evaluates both against the concrete screens (count, withdrawal, discovery, reference non-resolution) and submits an argued recommendation before anything is frozen.**
- `as:Join` has a shape but no shape tree: if participations must be addressable as resources in access needs, adding `shapetrees/as/Join.ttl` for an already-existing AS type is the minimal move — or the collection pattern makes it unnecessary.
 - The backend's deployment shape (service alongside the app? a platform app?).
- Whether the four pointed-to provider contributions (from the hand-off) are still the right set once the backend exists — some may move from "contribution to the providers" to "our backend's job".
+- Whether the three pointed-to provider contributions (from the hand-off) are still the right set once the backend exists — some may move from "contribution to the providers" to "our backend's job".
@@ -0,0 +1,16 @@
+---
+type: caveat
+summary: Several coherence-pass features were built and unit-tested but never played against a real pod — invitations, image upload, bio/city/photo round trip, profile completion — plus a few known limits of the read side
+last_checked: 2026-10-21
+---
+
+# Caveat: built but not verified on a real pod
+
+Unit and UI-layer tests are green; none of the following has run against a live ActivityPods stack. Treat as unverified, and re-check at the first run on a pod:
+
+- **Invitations**: that the `Announce` is delivered to the chosen contacts' Pods.
+- **Image upload** ([[decision_2026-10-21_images-are-uploaded-to-the-pod]]): container resolution, the `Location` header, the public-read grant, and the re-consent for the File access need.
+- **Profile round trip**: bio, city and photo (`image`) written and read back through the provider.
+- **Profile completion**: the onboarding gate on a pod whose profile has an empty name; a pod linking no profile at all only gets a message, since creating and linking an `as:Profile` is outside the pinned contract.
+
+Known limits of the read side, by design or by backend: catalogue entries carry no participant count (so cards of events never opened show none, and gain one once opened); an empty catalogue is indistinguishable from an unreachable one; another person's events are not listable (`getUserEvents` answers for the signed-in user only).
@@ -5,19 +5,34 @@ summary: Bring up a local ActivityPods pod provider for Festipod development —

 # Cookbook — Local ActivityPods platform

-Platform checkout: `/home/sylvain/projects/activitypods/activitypods` (never modify it; verified pristine 2026-10-09). Everything runs from `pod-provider/`.
+Festipod's local setup follows the sibling ActivityPods apps (welcometomyplace, mutual-aid.app, portejunes): a local pod provider and its infrastructure run from images through `make start`, and the app's own backend and frontend run outside Docker, one command each.

 ## Ports

-pod provider 3000 (OpenID + `/auth` signup/login), pod provider frontend 5000, Festipod backend 3003, Festipod app 4000, fuseki 3030 (admin/admin), mailcatcher 1080, redis 6390, arena 4567, tripleadmin 3033. The pod provider frontend on :5000 must run whenever Festipod signs a user in through the browser: the pod's login and app-consent screens are its pages (the UI smoke spawns its own app and does not need it; `test:e2e-flow`, `test:e2e-rights` and `test:e2e-revocation` do). The Festipod app stays on :4000, the only registered OIDC redirect origin.
+One fixed port pair per app on localhost, the pod provider keeping 3000/5000:
+
+| Service | Port |
+|---|---|
+| pod provider (OpenID + `/auth` signup/login) / its frontend | 3000 / 5000 |
+| welcometomyplace backend / frontend | 3002 / 4002 |
+| mutual-aid backend / frontend | 3003 / 4003 |
+| portejunes backend / frontend | 3004 / 4004 |
+| **Festipod backend / app** (committed defaults) | **3005 / 4005** |
+| fuseki (admin/admin) | 3030 |
+| redis | 6379 (`REDIS_PORT`) |
+| mailcatcher | 1080 (SMTP 1025) |
+| arena | 4567 |
+
+A developer whose ports differ overrides them in the two gitignored env files, never in committed code: `backend/.env` (`SEMAPPS_PORT`, `SEMAPPS_HOME_URL`, `SEMAPPS_FRONT_URL`, the Redis and Fuseki endpoints) and the root `.env` (`PORT` for the app, `VITE_BACKEND_URL`, `VITE_POD_PROVIDER_URL`, and `REDIS_PORT`, which docker compose reads from that file). The e2e suites and `scripts/validate.ts` read the same values from the environment (`PORT` → app URL, `VITE_BACKEND_URL`, `VITE_POD_PROVIDER_URL`), falling back to 3005 / 4005 / 3000. The app origin (`FRONT_URL`) is the only registered OIDC redirect origin, so the app must be served exactly there. The pod provider frontend on :5000 must run whenever Festipod signs a user in through the browser: the pod's login and app-consent screens are its pages (the UI smoke spawns its own app and does not need it; `test:e2e-flow`, `test:e2e-rights` and `test:e2e-revocation` do).

 ## Bring up

-1. Infra: `cd pod-provider && docker compose up -d`. If host port 6379 is already taken, add an override file publishing redis on another port (6390 was used) and pass `SEMAPPS_QUEUE_SERVICE_URL=redis://localhost:6390/1` and `SEMAPPS_REDIS_OIDC_PROVIDER_URL=redis://localhost:6390/2` when starting the backend — dotenv-flow does not override the process environment.
-2. Install once: `cd backend && COREPACK_ENABLE_AUTO_PIN=0 corepack yarn install --frozen-lockfile`, same in `frontend/`. Keep `COREPACK_ENABLE_AUTO_PIN=0`: corepack auto-pin rewrites `packageManager` in package.json. Note: the pod-provider README says `yarn start` for the frontend; only the `dev` script exists — use `BROWSER=none corepack yarn dev`.
-3. Backend: `cd backend && corepack yarn start`. Wait for "ServiceBroker with ... service(s) started successfully" (~11 s).
-4. Frontend: `cd frontend && VITE_CONFIG_URL=http://localhost:3000/.well-known/config.js BROWSER=none corepack yarn dev`. Without `VITE_CONFIG_URL` the page's `window.CONFIG` stays undefined and the consent flow dies with an opaque "Failed to fetch". Verify: `GET http://localhost:5000/` → 200 and `GET http://localhost:3000/.well-known/config.js` → 200.
-5. Festipod stack (this repo root): `cp backend/.env.example backend/.env` before `docker compose up`. The compose reads `backend/.env` as an optional `env_file`; on a fresh clone the file is gitignored and absent, so this copy is what feeds the backend its ActivityPods settings. With the coherent layout the app is served on :4000 and the Festipod backend on :3003 (the pod provider frontend keeps :5000 and must run for any browser sign-in, see Ports). To serve the app manually (`bun run start` on :4000) ALSO copy the root env: `cp .env.example .env` — without `VITE_BACKEND_URL` the config route serves an empty backend URL and the app deliberately falls back to the local demo (seeded data, no login).
+1. Once: `cp backend/.env.example backend/.env` and `cp .env.example .env` (both gitignored; fill the shared-wallet values in the root one), then `pnpm install` at the root and in `backend/`.
+2. Pod provider and infrastructure: `make start` (`docker-compose-dev.yml`: `activitypods/backend` in host network mode on 3000, `activitypods/frontend` on 5000, `semapps/jena-fuseki-webacl` on 3030 with `./data/fuseki`, `redis` on `REDIS_PORT` (6379 by default) with `./data/redis`, mailcatcher, `activitypods/arena` configured by `docker/arena-dev.json`). Other targets: `make stop`, `make config`, `make upgrade`, `make attach-activitypods`. `./data/` is gitignored.
+3. Festipod backend: `cd backend && pnpm dev`. Wait for "ServiceBroker with ... service(s) started successfully" (~11 s). `pnpm dev` hot-reloads a changed service file; restart the backend after editing one instead of trusting the reload. After a reload of `services/app.service.js`, pod webhooks still answered 200 but were no longer processed (no attendees collection, no Join handling; observed 2026-11-02, cause not established).
+4. Festipod app: `pnpm dev` at the root (the frontend lives at the root, not in a `frontend/` directory; the root scripts run Bun, pnpm only launches them).
+
+`backend/.env` follows the sibling layout: own dataset `festipod` and accounts dataset `settings-festipod`, `SEMAPPS_REDIS_CACHE_URL=` empty (no cache locally), queue on `redis://localhost:6379/15` (the siblings use dbs 12, 13 and 14). dotenv-flow does not override the process environment, so a variable exported in the shell wins over the file. If host port 6379 is already taken, set `REDIS_PORT` in the root `.env` and put the same port in `SEMAPPS_QUEUE_SERVICE_URL` of `backend/.env`. The compose publishes redis on that port and points the pod provider's queue and OIDC URLs at it. The pod provider runs in host network mode, so it reaches redis only through the host port: its image's own default is `localhost:6379`, which the compose replaces with `REDIS_PORT`.

 ## Account and resource flow (all VERIFIED 2026-10-09)

@@ -31,8 +46,28 @@ pod provider 3000 (OpenID + `/auth` signup/login), pod provider frontend 5000, F

 On a fresh pod, an `as:Event` POST lands at the pod root (`/alice/data/<uuid>`): typed containers such as `/alice/data/as/event` exist only after a user installs an app whose access needs declare that shape tree. Do not expect typed containers before app registration.

+## Data location (hard-won, 2026-10-26)
+
+- **Fuseki's data dir (`./data/fuseki`) must stay on the SSD** (`/home`, NVMe). Measured: a signup is ~10 s on the SSD, 150–200 s on the spinning HDD (`/hdd-home`) — TDB2 fsyncs per write and the seek time dominates. The HDD mount also hosts the bulk of the host's files; keep fuseki off it.
+- **Never replace `data/fuseki` with a symlink after the container exists.** Docker resolves the bind source when the container is CREATED; moving the data away and leaving a link behind leaves the running container with a broken/empty mount (symptom: signup 500 « Error when creating secure dataset … FileNotFoundException: /fuseki/system_files/… »). `docker restart fuseki` re-resolves and heals — until the next behind-its-back move.
+- The e2e suites delete the accounts they create at the end of every run (user decision 2026-10-26): `DELETE http://localhost:3000/.account/:username` with the user's token (a user may delete only their own account). The platform tombstones the account, sends the Delete activity, and drops the fuseki dataset on a delay — so test data no longer accumulates and the periodic full wipe is no longer needed. `diag-invite.ts` is the only suite left without cleanup (manual diagnostic).
+- The pod provider deletes files from disk, at its image's `SEMAPPS_FUSEKI_BASE` (`../data/fuseki`, i.e. `/app/data/fuseki` in the container):
+  - at once, the account's backups (`backups/`);
+  - 24 h later, its secure dataset (`databases/<user>`, `<user>Acl`, `<user>Mirror`, `configuration/<user>.ttl`), since Fuseki's own delete leaves those files behind.
+
+  `docker-compose-dev.yml` therefore mounts all of `./data/fuseki` there. Without any mount, every deletion answers 500 (`ENOENT … scandir '../data/fuseki/backups'`, VERIFIED 2026-11-02), the account stays tombstoned with its dataset in place, and the suites still pass. With only `backups/` mounted, the deletion answers 200 but the dataset files stay on disk (about 40 MB per test account).
+- Never sign up a local pod account named after an existing dataset (`festipod`, `settings-festipod`, another app's): per the pod provider's code, the pod is written into that dataset, and deleting the account deletes the dataset's files and backups. The provider reserves `sparql`, `auth`, `common`, `data` and `settings`: of the dataset names, only `settings` is protected.
+
+## Backend fresh-boot note
+
+The Festipod backend has its OWN datasets, `festipod` (main, created SECURE at first boot — WebACL is on) and `settings-festipod` (accounts), named like the sibling apps' (`welcometomyplace`/`settings-wtmp`…). Never point it at the pod provider's `settings` dataset, and never delete or recreate `settings`: it holds the pod provider's accounts. A backend dataset reset: delete the two datasets and the secure dataset's files on disk (`./data/fuseki`), and empty the backend's Redis queue database. After a reset, pod accounts that had installed the app must install it again: the new backend knows none of their registrations. A deleted dataset re-created under the same name needs a Fuseki restart in between (`docker restart fuseki`), else every query fails with `ClosedException: already closed`. Changing `SEMAPPS_HOME_URL` (a new port, say) changes the app actor's URI, hence the app's identity: a persistent account keeps a participations collection whose `acl:Control` belongs to the previous app actor, so the backend refuses every Join of that account ("the pod refused the read grant of the contacts group…") — remove the `http://festipod.org/participations` link from that account's profile with its own token (`DELETE DATA` of the exact triple; `DELETE WHERE` answers 400) and the next Join creates a new collection.
+
+`GET /app` serves a snapshot of the app actor that the `@activitypods/app` mixin takes at boot BEFORE it creates or replaces the access-need group (VERIFIED 2026-11-02 in the mixin's code and live). On a fresh dataset (first boot, or after a wipe), that snapshot lacks `interop:hasAccessNeedGroup`, even though the store has it. On a boot that changes the access needs, it names the group just deleted, which answers 404. Either way it stayed wrong until the next restart. On the first `make start` stack, the smoke and the rights matrix failed on their "access-need group" prerequisites. `backend/services/app.service.js` refreshes the snapshot from the store at the end of its own `started()`.
+
+The same handler first checks the link in the store and attaches the group when it is missing, polling up to 60 s. On a fresh dataset (2026-10-26), consents registered zero grants and `GET /app` linked a group that 404s. A one-shot version of that check found no group. The cause was not established: the mixin creates the actor, then the group, one after the other. The 404 matches the stale snapshot above. Before running consented flows on a fresh dataset, check that `GET /app` links a group that resolves 200.
+
 ## Teardown

-`pkill -f moleculer-runner; pkill -f react-scripts`, then `docker compose down` in `pod-provider/`. Data persists in `pod-provider/data/` (gitignored); delete that directory to fully reset.
+Stop the two dev processes (`pkill -f moleculer-runner`, and the app's `bun --hot`), then `make stop`. Data persists in `./data/` (gitignored); delete that directory to fully reset. With the suites cleaning up after themselves (above), a full reset should now be a rare event, not a maintenance ritual.

 Current stack test account: `alice` / `Test1test` on localhost:3000.
@@ -0,0 +1,26 @@
+---
+type: decision
+summary: Festipod keeps no friend model; contacts are the Pod's own apods:contacts collection, a contact request is an Offer{Add{my profile}} posted from the browser to my own outbox, invitations are Announce{event} activities, and nothing is built for acceptance or push
+---
+
+# Decision (2026-10-21): contacts are the Pod's social graph
+
+## Decision
+
+- **No home-made friend model.** A user's network is the `apods:contacts` collection linked from their actor document (the app falls back to the profile record), managed by the Pod — mutual when both went through the request/accept flow, though not guaranteed (see the platform defects below). In the app, `friendships` is only a mirror of that collection and `getFriends` reads it. Contacts are resolved to profiles through the same path as event participants.
+- **Contact request** (`addFriend`): an `Offer{ object: Add{ object: { id, type: 'Profile' } }, to, target }` addressed to the other person's actor, posted to the requester's **own outbox with their own token**, from the browser (`src/shared/data/contacts.ts`). The `type: 'Profile'` is embedded in the activity: the platform's `CONTACT_REQUEST` matcher requires it, and it must not dereference the profile — a protected profile 403s anonymously and a bare-URI object was silently ignored (fixed 2026-10-22). The recipient lands it in `apods:contactRequests` and accepts on their Pod provider's own network page. **Festipod builds no acceptance screen.**
+- **Sharing my connection** (the primary flow — see [[decision_2026-10-22_connection-sharing-is-the-invite-capability]]): an **invite capability** (VerifiableCredential) issued by the Pod (`POST {webId}/vc/v0.3/credentials/issue`), shared as `{frontendUrl}/invite/{capability}`; the recipient's contact request carries a VerifiablePresentation of it and is **auto-accepted** by the inviter's Pod. Strictly better than the bare request: no manual acceptance, and the invitee sees the inviter's profile (name, photo) through the grant.
+- **Invitation to an event** (`inviteToEvent`): an `Announce{ object: <event>, to: [chosen contacts] }` posted the same way. The invitable set is the real contacts only.
+- **No backend service added.** A user-initiated request needs nothing the browser cannot do; a backend handler (notifications for people without the app) would be speculative without a pod to test it on. Push notifications stay the Pod provider's job.
+- Providers with no Pod (the disconnected demo, the suspended NextGraph path) **reject** `addFriend` and `inviteToEvent` instead of simulating state.
+
+## Channels
+
+Participations are **public objects** (anyone sees that there are participants), but the **identity link** is protected — the profile is readable by contacts only, and the carved rule [[behavior_participation-listing-is-contacts-only]] reserves listing a person's events to their contacts, for every client. How contacts recognise participants and list a contact's events is [[decision_2026-10-29_participation-privacy-mechanism]]; the app reads no one else's outbox.
+
+## Consequences
+
+- "Demande envoyée" is session-local: the target's request collection is not readable by the sender, so after a reload the button offers the request again.
+- There is no `removeFriend`.
+- The `apods:contacts` list is a display, not a grant: the pod adds the sender of a received `Accept` of a contact request without checking a request was sent (a sender whose profile it cannot read is turned away; one who first sent a request of their own is added — verified live 2026-10-29), and keeps a removed contact in the `/contacts` WAC group (both platform defects reported upstream 2026-10-29). Festipod never derives a read right from the list — rights follow the group, see [[decision_2026-10-29_participation-privacy-mechanism]].
+- The request/accept round trip is verified live by the rights matrix (2026-10-29): the request posted from the requester's outbox, its acceptance naming the stored `Offer`, both lists then naming each other.
@@ -0,0 +1,18 @@
+---
+type: decision
+summary: Images (event cover, profile photo) are uploaded as binary LDP resources to the Pod's file container from the browser, then made publicly readable; the URL is stored in coverImage / photo; existing users must re-consent for the new File access need
+---
+
+# Decision (2026-10-21): images live in the user's Pod
+
+## Decision
+
+- `useUploadImage` (`src/shared/hooks/`) resolves the Pod's `file` container, POSTs the file binary with the user's token and reads the new URL from the `Location` header, then calls `grantPublicRead` (`src/shared/utils/`): a best-effort WAC ACL PATCH granting `foaf:Agent` read. Without the grant, an image nobody else can read is a dead feature. Without a session (the demo) the upload rejects.
+- The URL is stored as `coverImage` on an event and `photo` on a profile. On ActivityPods the cover maps to the AS2 term `image` and the profile photo to `vcard:photo` — the term both reference apps read (mutual-aid, welcometomyplace), after verifying the `vcard:` prefix is present in the platform context. Interop cross-apps : une photo stockée sur un autre vocabulaire serait invisible partout.
+- The app declares the `shapetrees/File` access need (read + write) in `backend/services/app.service.js`. **Users who registered the app before this change must re-consent** for uploads to be allowed.
+- `resolveContainerUri` and `fetchJson` come from `@activitypods/refine-providers/utils`, which the pinned contract does not list: this use is outside the contract and must be declared in the usage declaration / raised to the provider.
+- The event cover falls back to a neutral gradient; the old stock-photo map is gone.
+
+## Consequences
+
+Covers and avatars are visible to anyone who can read the event or profile record, as the `grantPublicRead` makes the file itself public. Never verified end to end on a real pod — see [[caveat_t06-unverified-on-a-real-pod]].
@@ -55,9 +55,6 @@ Mutations on the create/participate path **reject** rather than returning quietl
 A `Participation` written **today** carries the profile document's NURI in `fp:user`, so the direct join `u.id === userId` matches. Participations written under the **earlier** scheme carry `urn:festipod:user:<normalized-handle>`, which matches nothing directly.

 **`resolveParticipantUser`** is the single join point and tries, in order: (1) the direct id match — today's writes, and the demo seed's bare `user-1` space; (2) failing that, strip `USER_PRINCIPAL_PREFIX` and compare the remainder to `normalizeIdentifier(profile.username)`. Never join by direct comparison at a call site: getting it wrong renders every participant as « participant inconnu », which shipped once. `USER_PRINCIPAL_PREFIX` is **read-side only** — nothing mints it any more; it is not a shape to write against. The inbox deposit `uid` (`mint…`) is a third space that takes **no** part: it identifies a deposit for the counter, never a user.
-
-> **Horizon.** The target model drops the plaintext `userId` and resolves identity by reading the profile — [[brief_2026-07-20_attendance-set-model]], gated. The id-space fix is noted there as still valid: do not undo it in anticipation.
-
 ## Reads = `watchShape`, writes = an optimistic overlay

 Reads go through `useShapeQuery(shape, scope)` — three scoped reads (events/public, profiles/protected, participations/protected) mapped by `shapeAdapters.ts`; `ready` combines their `isSuccess` flags. The app resolves, lists and re-queries nothing ([[rule_document-per-entity]] §Reads).
@@ -90,6 +87,10 @@ Two measurement points are laid down **as a pair**: the owner's materializer log

 The app settles its identity once, before anything renders, and offers no way to change it (`app-security` → [[decision_2026-08-10_the-barrier-names-no-identity]]). One page hosts exactly one identity for its whole life, so there is no identity-change reset: no `useEffect([identifier])`, no cap reset, no registry-cache reset. Do not reintroduce a reset for a transition that cannot happen. Cross-identity **isolation** is still a real requirement, but proving it needs two genuinely separate browser contexts (`bdd-testing` → [[rule_tests-validate-festipod-not-the-sdk]]).

+## On ActivityPods the context is `refineData.tsx`, and read-your-writes is confirmed by a collection
+
+The ActivityPods implementation of the same context (`src/shared/context/refineData.tsx`) holds a join or leave as a pending act on top of the reads and releases it only when a read issued after the act confirms it — the person's own participations collection for membership, the meeting point's attendee list for the count — or when a bounded re-read schedule runs out (verified in code). A read that merely shows the asserted state is not a confirmation: it may predate the act. Details: [[decision_2026-10-29_participation-privacy-mechanism]].
+
 ## Mutations are no-ops in local mode

 In local/demo mode (`useLocalData`), `createEvent`/`joinEvent`/`leaveEvent`/`updateEvent` are **no-ops** (a log, no state change) — yet the screens still show a success toast. Misleading UX, unchanged. See [[knowledge_data-modes]].
@@ -1,6 +1,6 @@
 ---
 type: knowledge
-summary: The Fp* app types and their SHEX shapes — Event (no host), UserProfile, Participation, MeetingPoint and Notification are persisted, Friendship stays local-only; the generated ORM names carry NO Fp prefix and are aliased at the import sites
+summary: The Fp* app types and their SHEX shapes — Event (no host), UserProfile, Participation, MeetingPoint and Notification are persisted, Friendship has no shape of its own; the generated ORM names carry NO Fp prefix and are aliased at the import sites
 last_checked: 2026-08-17
 ---

@@ -11,11 +11,13 @@ last_checked: 2026-08-17
 | Type | Persistence | Key fields |
 |---|---|---|
 | `FpEventData` | SDK (Event shape) | title, date, startDate, endDate, startTime, endTime, location, distance, participantCount, coverImage |
-| `FpUserData` | SDK (UserProfile shape) | name, initials, username, role, isPublic |
+| `FpUserData` | SDK (UserProfile shape) | name, initials, username, role, isPublic, bio, city, photo (all optional; on ActivityPods `photo` is the AS2 `image`) |
 | `FpParticipationData` | SDK (Participation shape) | event + user + isConfirmed |
 | `FpMeetingPointData` | SDK (MeetingPoint shape) | event, host, title, place, time |
 | `FpNotificationData` | SDK (Notification shape) | recipient, type, ref, payload, timestamp, isRead |
-| `FpFriendshipData` | **local-only** | userId + friendId |
+| `FpFriendshipData` | **derived** on ActivityPods (mirror of the Pod's `apods:contacts`, see [[decision_2026-10-21_contacts-are-the-pod-social-graph]]); absent elsewhere | userId + friendId |
+
+**On ActivityPods the participation is not a document of its own.** A sign-up is a member URN in the meeting point's `apods:attendees` collection plus the meeting point's URI in the person's participations collection (linked from the profile as `http://festipod.org/participations`); the person's `http://festipod.org/participationSecret` on the profile is what lets their contacts recognise the URN. No shape describes any of these — see [[decision_2026-10-29_participation-privacy-mechanism]] and `src/shared/data/participationPrivacy.ts` (verified in code).

 **An event has no host.** `hostName`/`hostInitials` are gone from the type and the shape alike — the event is only the anchor, and the host lives one level down on the meeting point (`FpMeetingPointData.hostId`, SHEX `fp:MeetingPoint.host`). See concept `functional-domain`, [[knowledge_actors-and-concepts]].

@@ -2,7 +2,7 @@
 type: _overview
 summary: Festipod's product model — the meeting point grafted onto a public event as the unit of value, its actors, its business concepts, and the confidentiality scopes (public/protected/private) per entity
 triggers:
-  keywords: [point de rencontre, rencontre, greffe, greffer, événement, déclarant, hôte, inscrit, inscription, communauté, connexion, festival, déduplication, découverte, périmètre, scope, public, protected, privé]
+  keywords: [point de rencontre, rencontre, greffe, greffer, événement, déclarant, hôte, inscrit, inscription, participation, participer, communauté, connexion, festival, déduplication, découverte, périmètre, scope, public, protected, privé]
  paths: ["src/modules/*/features/**"]
 ---

@@ -18,12 +18,14 @@ Festipod lets users create **meeting points** that *graft* themselves onto exist

 ## Scope & confidentiality

-The product model of **who sees what** — personal data reserved to one's network, public events/meeting points, identified-or-anonymous sign-up notification — is a business fact: see [[knowledge_data-scopes-and-discovery]]. The detailed authorization matrix (actor × verb) and its incubation live in the `app-security` concept ([[brief_2026-05-18_authorization-matrix]]).
+The product model of **who sees what** — personal data reserved to one's network, public events/meeting points, an anonymous sign-up notification to the host — is a business fact: see [[knowledge_data-scopes-and-discovery]]. The detailed authorization matrix (actor × verb) and its incubation live in the `app-security` concept ([[brief_2026-05-18_authorization-matrix]]).

 ## Links

 - [[knowledge_business-model]] — the event / meeting point inversion
 - [[knowledge_actors-and-concepts]] — reference for actors and business concepts
 - [[knowledge_data-scopes-and-discovery]] — public/protected/private scopes per entity + discovery
+- [[behavior_participation-listing-is-contacts-only]] — the carved-in-stone rule: listing someone's events is contacts-only
+- [[decision_2026-10-29_participation-privacy-mechanism]] — the mechanism enforcing it on ActivityPods (private Join, hashed member URNs, contacts-readable participations collection)
 - [[knowledge_roadmap]] — current features vs upcoming evolutions
 - [[brief_2026-06-15_event-deduplication]] — open challenge of deduplicating events in P2P
@@ -0,0 +1,33 @@
+---
+type: behavior
+summary: The link between a person and the events they participate in is personal data — listing someone's events is reserved to their contacts; the person themself always can, anyone else never
+---
+
+# Participation listing is contacts-only
+
+> **La règle (canonical statement, French):** *« On ne doit pouvoir lister les événements auxquels participe une personne que si on est en contact avec elle. »*
+
+A **product invariant**, carved in stone (user decision 2026-10-23). It governs any feature, screen, query or data-layer mechanism that surfaces *which events a given person participates in* — whoever asks, whichever channel.
+
+## What it protects
+
+The set of events someone attends reveals where they go, when, and with whom — it is **personal data**, in the same class as the profile itself. The event and the meeting point are public; the *link person ↔ participation* is not. An ordinary user must learn nothing from it; only a **connection** (bilateral contact) may.
+
+## The three outcomes
+
+| Who asks | Answer |
+|---|---|
+| The person themself | always listable — their own acts are theirs |
+| A contact (bilateral connection) | listable — being a contact IS the grant |
+| Anyone else | **never** — no listing, no count of *their* events, no cross-event correlation |
+
+## Deliberately mechanism-free
+
+The rule states the **what**, never the **how** — and that is intended. Which resource carries the link, how contacts read it, what the data layer exposes: all free, and all **constrained**. Any implementation choice — an attendees collection, an outbox read, an index, a grant — is acceptable **only while** the rule holds for every client, not just the Festipod app. A mechanism that lets a foreign client enumerate one person's events (correlatable IDs, scannable public collections) violates the rule even if the app's own UI behaves.
+
+## Related
+
+- [[knowledge_data-scopes-and-discovery]] — the scopes model this rule tightens (participation: public as an object, the identity link is protected)
+- [[decision_2026-10-29_participation-privacy-mechanism]] — the mechanism enforcing this rule on ActivityPods (private Join, hashed member URNs, contacts-readable participations collection)
+- [[decision_2026-11-03_participation-delivered-to-the-app]] — how that private Join reaches the backend: addressed to the app actor alone, delivered to the app's inbox
+- [[decision_2026-10-21_contacts-are-the-pod-social-graph]] — what "contact" means (the Pod's bilateral `apods:contacts`)
@@ -0,0 +1,12 @@
+---
+type: decision
+summary: The meeting-point creation form carries a title (optional) and a place (required) only; free-text "when", duration and invitees were removed because the Pod vocabulary has no slot for them, and creation is announced only once it happened
+---
+
+# Decision (2026-10-21): the meeting-point form asks only what can be stored
+
+- Fields: **title** (optional, the intent) and **place** (required, stored as `location`). Nothing is merged into another field any more.
+- **When**, **duration** and **invitees** were removed from the form: ActivityStreams has no term for a free-text moment or a free-text duration (`startTime` and `duration` are structured values), and the app has no invitee model. A field that vanishes after submit is worse than no field. `time` stays unmapped on ActivityPods; screens show it only when a record carries one, and the invented "~60 min" is gone.
+- Reopening this needs a slot offered by the provider (or a structured time/duration input), not a new free-text field.
+- `addMeetingPoint` returns a promise: the refine provider propagates the write, the disconnected demo rejects. The screen toasts success only after resolution and an error otherwise.
+- Titles may be absent: cards show the place alone, and the title line only when there is one.
@@ -0,0 +1,20 @@
+---
+type: decision
+summary: Sharing my connection means creating an invite capability (VerifiableCredential issued by the Pod) and sharing the pod provider's /invite/<capability> page — the recipient's contact request carries a VerifiablePresentation of the capability and is auto-accepted; no QR, no profile-url page
+---
+
+# Decision (2026-10-22): connection sharing is the invite capability
+
+## Decision
+
+- **No QR code.** Neither the reference apps nor the platform need one (kept from the 2026-10-21 arbitration).
+- **The shared link is the platform's invite page, not a profile page.** Festipod creates an **invite capability** — a `VerifiableCredential` issued by the user's own Pod at `POST {webId}/vc/v0.3/credentials/issue` (name "Invite Link"; `apods:hasActivityGrant` = the contact-request shape; `apods:hasAuthorization` = Read on the profile document) — and shares `{frontendUrl}/invite/{encodeURIComponent(capabilityUri)}`. Implementation: `src/shared/utils/inviteLink.ts`, `src/shared/hooks/useInviteLink.ts`.
+- **Why this and not the `/network/@user@host` page**: a bare profile link fails exactly for the person it is shared with — the not-yet-contact, who gets an empty public view and a manual-accept round trip on the Pod provider. The invite page instead reads the inviter's profile **through the capability** (rich name/photo) and its Connect button posts the contact request **with a VerifiablePresentation of the capability**, which the inviter's Pod verifies and **auto-accepts** (`inviteLinkContactRequest` in the pod provider backend). The capability IS the proof of invitation.
+- The `frontendUrl` (host of the invite page) is discovered via nodeinfo of the viewer's pod host, as before.
+- The earlier `decision_2026-10-21_profile-link-not-qr` is **superseded by this one** (link target changed from the network page to the invite page).
+
+## Consequences
+
+- The ActivityPods pod-provider frontend fix of 2026-10-22 (public view of `/network` no longer fetching the private profile) is no longer on Festipod's contact path; it remains a standalone correctness fix there, uncommitted.
+- Invite capabilities are created on demand; several valid ones may coexist (each grants the same profile read). Revocation is the Pod provider's job.
+- Not yet verified end to end on a real pod pair — same caveat as the contacts decision.
@@ -0,0 +1,59 @@
+---
+type: decision
+summary: How sign-ups stay unlinkable on ActivityPods — a private Join handled by the backend on emission; attendee lists of member URNs hashed with a secret kept in the profile, so only contacts recognise anyone; a participations collection per person readable by their contacts group; the creator notified anonymously
+---
+
+# Decision (2026-10-29): the participation privacy mechanism
+
+User-validated 2026-10-29. Enforces [[behavior_participation-listing-is-contacts-only]] on the ActivityPods backend, using only patterns of the reference apps (project rule `festipod-only-reference-app-patterns`). ActivityPods itself is never modified.
+
+## What it protects: two links
+
+- **Event → participants.** From an event (always public) anyone can count the participations, but nobody learns *who* participates — no name, no WebID — unless a contact.
+- **Person → events.** Nobody can list the events a person participates in, unless a contact. Nothing published on a person's behalf identifies an event.
+
+The **creator of a meeting point has no particular read right**: for these two links they are "anyone else" unless a contact of the participant. The **Festipod backend** is not a person: it acts (records, notifies) and shows nothing to anyone.
+
+"Contact" is the audience the platform itself shares the profile with: the person's `/contacts` WAC group. The pod puts someone in it only through the person's own acts — the target of a contact request they send, the requester of a request they accept, whoever presents an invite link they issued (accepted automatically, so a forwarded link admits its holder) — never through an activity a stranger sends.
+
+| Who | From an event | From a person |
+|---|---|---|
+| The person themself | sees themself | lists their events |
+| A contact (current or future) | recognises which of their contacts participate | lists the person's events, past ones included |
+| Anyone else, the creator included | a count of participations, opaque member URNs | nothing |
+
+## The mechanism
+
+1. **Sign-up.** The participant posts an `as:Join` (withdrawal: `as:Leave`) to their own outbox, naming the **meeting point directly**, **not public and not addressed to anyone**. The outbox is filtered by read rights: a non-public activity is readable only by its recipients and its author (verified 2026-10-29 on the local pod — absent from the anonymous listing, direct GET refused 403), so the target stays hidden from strangers with no intermediate object.
+2. **The backend acts on emission** — `onEmit` of the participant's outbox, the welcometomyplace registration pattern (`PodActivitiesHandlerMixin`); the app reads the outbox through `apods:ReadOutbox`. The creator's inbox receives no activity of the participant.
+3. **The member URN.** `urn:festipod:userref:<lowercase-hex sha256("<participant WebID> <event URI> <secret>")>`, where the event URI is the meeting point's anchor (`as:context`). The backend computes it from the participant's secret and records it in the meeting point's `apods:attendees` collection (in the creator's pod). Properties: the same for one person across all meeting points of one event (the per-event count is the number of **distinct** URNs, publicly computable); unrelated from one event to another; computable only by whoever can read the secret — the person, their contacts, the app. A client never supplies a URN, and the backend's ledger assigns one URN per (meeting point, participant), persisted before any write: every later act on that pair — after a failure or a rewrite of the secret — uses it, so one person never holds two entries in one list. Every collection write is verified by reading the collection back: a refused write or a failed read leaves the act unrecorded and unnotified, so the next act retries it.
+4. **The secret** lives in the participant's `as:Profile`, under the Festipod predicate `http://festipod.org/participationSecret` (32 random bytes, hex), so it has exactly the profile's audience: the app and the person's contacts. The participant's browser generates it at the first sign-up when absent and writes it through the ordinary profile update, before posting the Join. A Join whose author's profile carries no usable secret is refused by the backend (nothing recorded). Verified live 2026-10-29: the pod stores this predicate written with the app's token and returns it under its full IRI, although `fp` is not registered at prefix.cc.
+5. **The participations collection** — the person-side record of where they participate, for themself and for their contacts. An `as:Collection` in the participant's pod, attached to their profile under `http://festipod.org/participations`, created by the backend the way welcometomyplace attaches `apods:attendees` to an event (`PodCollectionsHandlerMixin`), and readable by the participant's `/contacts` WAC group (`pod-permissions.add` with `acl:agentGroup`, the group found through `pod-wac-groups.getUriFromCollectionUri` on `apods:contacts`). The group is evaluated at read time: a future contact sees past participations. The pod creates such a collection **world-readable** (observed 2026-10-12 on the attendee lists): the backend takes that public read away, with the same revocation it applies to the list of a meeting point switched private — a participations collection readable by strangers would list the person's events to anyone. Its items are meeting point URIs, added on a Join and removed on a Leave by the backend. The backend creates the collection at the person's first sign-up when the profile links none (one creation at a time per person); a profile with no collection has no participation to list.
+6. **Recognition on an event.** The viewer reads each contact's profile once per session (it is read for names anyway) and keeps the secrets in memory; for an event, it puts the URNs of all its meeting points' lists in a set, hashes each contact once and tests membership — O(contacts + participations) per event, no network beyond the lists. Measured 2026-10-29 (Bun, Web Crypto): 500 contacts / 2 000 participations in 3.4 ms, 5 000 / 20 000 in 28 ms.
+7. **Notification of the creator** on every sign-up and withdrawal, sent by the backend with `pod-notifications.send` (the welcometomyplace call), **always anonymous** ("a participant…"); the backend never passes the participant's profile. Naming a participant to a creator who is their contact would need a trustworthy contacts signal the app can read: the `/contacts` group is not readable by the app (403, verified live 2026-10-29), and the `apods:contacts` list can be forged (below). `pod-notifications.send` posts from the app's own outbox, which requires the backend to run with WebACL on a secure main dataset, as the three reference apps do.
+
+## Rejected alternatives
+
+- **Addressing the Join to the creator** (welcometomyplace's choice, where events are private): the creator's inbox, and the participant's outbox as a recipient, show them the participant's WebID.
+- **Addressing the Join to the contacts**: an activity's read rights are granted once, at emission, to each recipient individually (semapps `setRightsHandler`; `getRecipients` expands only the sender's followers) — future contacts would never see past participations.
+- **One read grant per item of the `apods:contacts` list**, kept in sync with contact changes: the list is forgeable — on a received `Accept` of a contact request the pod adds its sender without checking that a request was ever sent (pod provider `contacts/request.ts`, `acceptContactRequest.onReceive`); it first caches the sender's profile, so a sender whose profile the recipient cannot read is not added, but a sender who first sends the person a contact request (which lets the person read the sender's profile) is added (both verified live 2026-10-29) — a stranger would then gain the person's participations, where the group grants them nothing (verified live the same day: the forged contact is refused the profile and the participations collection, and is notified anonymously).
+- **Granting the contacts group read on each Join**: the app holds read only on activities (`apods:ReadOutbox` maps to a default read on the activities container), no control; the browser's token carries the app's rights.
+- **A private object named by the Join** (an "event reference"): useless once the Join is non-public, and creating its container and ACL from the browser is not a reference-app path.
+- **A secret readable by its owner only**: contacts could not recognise anyone from the event side, and resolving identities would mean reading every contact's participations on every event view.
+- **The backend resolving identities for viewers**: it would turn the backend into the gate of identity on the main screen.
+- **Participations stored in the profile itself**: the profile is read for every contact at session start and would grow with each person's history.
+
+## Accepted residuals
+
+- The target of a contact request is in the requester's `/contacts` group as soon as it is sent, before accepting: they see the requester's profile and participations (user-accepted 2026-10-29). Showing such pending requests in the contacts screen is to be discussed.
+- **Platform defect, reported upstream (2026-10-29):** `removeContact` removes from the `apods:contacts` list only, never from the `/contacts` group nor from the profile's read authorisation (pod provider `contacts/manager.ts`) — a removed contact keeps seeing the profile and the participations until the platform fixes it.
+- **Platform defect, reported upstream (2026-10-29):** the `apods:contacts` list accepts a forged `Accept` (above) — the reason notifications stay anonymous; the contacts screen, which displays that list, shows such a stranger as a contact.
+- A person who rewrites their secret between two meeting points of one event is counted twice in that event — no worse than a second account.
+- The outbox root, read anonymously, carries in its pagination link the URI (never the content) of the newest activity: it reveals that an activity exists.
+- An act writes twice (the list in the creator's pod, the collection in the participant's pod), not atomically: a failed write leaves the two apart until the person's next act on that meeting point.
+- Removing the app leaves the collection and its grant in place.
+- If the pod keeps refusing to link a new collection to the profile, each retried Join leaves one more empty, unlinked collection in the person's pod (the act itself stays unrecorded and retryable).
+
+## Not built: public users
+
+A future per-person setting will make some users **public**: their Joins become public, their list entries hold their WebID instead of a URN, their participations collection becomes readable by everyone. Switching a person between the two modes converts their existing entries. Nothing in the mechanism above precludes it.
@@ -0,0 +1,34 @@
+---
+type: decision
+summary: Join/Leave are addressed to the Festipod app actor alone and handled on reception in the app's inbox, no longer picked up unaddressed by an outbox webhook; any compatible sender may send, authorship rests on the signature and the pod, the meeting point is read in its creator's pod
+---
+
+# Decision (2026-11-03): participation activities are delivered to the app
+
+User-validated 2026-11-03, on the advice of the ActivityPods developer: an activity meant for an actor who acts on it is addressed to that actor and reaches it through its inbox — the ActivityPub protocol rather than a side channel. This replaces steps 1 and 2 (the unaddressed sign-up, "the backend acts on emission") of [[decision_2026-10-29_participation-privacy-mechanism]]; every other step of that mechanism (member URN, secret, participations collection, recognition, anonymous notification) and all its residuals stand.
+
+## The delivery
+
+- The participant posts the `as:Join` (withdrawal: `as:Leave`) to their own outbox, naming the meeting point, with `to` = the Festipod app actor (`<backend>/as/actor/app`, which is also the Solid-OIDC client id) and no other addressee. Their pod delivers it to the app's inbox.
+- The backend handles it with `onReceive` of `@semapps/activitypub`'s `ActivitiesHandlerMixin` (`registration.service.js`), the path `@activitypods/app` itself uses for `Create interop:ApplicationRegistration`. No reference app receives user activities in the app's inbox: this is a named exception to the project rule `festipod-only-reference-app-patterns`, justified by the platform developer's advice and by the framework's own use of that path.
+- The outbox webhook (`apods:ReadOutbox`) stays: the catalog, the contacts and the attendee lists still follow the user's own resources there, which have no actor to address.
+
+## Who may send: anyone, nobody for someone else
+
+- **No "app installed" gate** (user decision): interoperability is the aim of the ActivityPods architecture, and a Join sent by another compatible app is legitimate. The processing filters by what it needs: a sender whose profile secret the backend cannot read is refused, nothing written.
+- **Authorship.** The inbox accepts a delivery only when it is signed by the activity's `actor` (semapps 1.2.7 `inbox.post` refuses any other actor, `INVALID_ACTOR`; read in code 2026-11-03). The handler further requires the activity to lie in that actor's pod and its stored copy to name them, and acts on the stored copy (`verifiedDelivery` in `emitted-activity.js`). A pod refuses writes under another actor's path, so nobody can join or leave for someone else.
+- **The meeting point is read in its creator's pod.** Read through the participant's pod, a resource of another pod goes through the proxy the participant's own actor document declares: for a participant on another server, an answer that server chooses — another meeting point's attendee list, a forged name (reproduced by the adversarial review 2026-11-03 against mocked platform calls). The handler reads the meeting point again through its creator's access and uses that copy alone (`meetingPointOf`).
+
+## Confidentiality: unchanged
+
+The Join stays readable by its author and its only addressee, the app; the creator's inbox receives nothing. The rights matrix lines on the Join's read rights pass unchanged (148/148 hard lines, run 2026-11-03 with the change as committed, creator re-read included). The backend learns the participant's identity as before.
+
+## Costs accepted
+
+- The inbox POST awaits the processing (semapps `processInbox` waits for its job), so each Join/Leave delivery holds the participant's pod's request for the whole handling: 2.6–6.2 s over the 9 deliveries of a full validation run (measured 2026-11-03 on the local stack, creator re-read included, from the queue's job timestamps), against 0.7–1.5 s for the app's other inbox jobs. The app's inbox queue runs 5 jobs at a time, shared with app registrations. Whether the pod provider serializes its outgoing deliveries is not verified.
+- The app's inbox stores a copy of every Join/Leave in the backend's dataset — the person ↔ meeting point link the attendance ledger already holds. An anonymous GET of the app's inbox answers 404 (observed 2026-11-03).
+- Known exposure, not introduced here and not settled: the backend issues app-signed GETs to URIs a sender chooses — the meeting point it names, its own documents — as the framework's app-registration handler already does with the registration URI a delivery names. Festipod filters no private or internal address; whether the framework does is not verified.
+
+## Open
+
+How to welcome a participant from another app, whose secret the backend cannot read — refused today. Leads: count them under a member URN only the backend can compute (counted, recognised by nobody); agree with the ActivityPods developer on a shared vocabulary for the secret; another policy. A product decision, not taken.
@@ -16,14 +16,14 @@ Every entity is stored in the **scope** matching who must be able to read it:
 | Event (the anchor) | **public** | everyone |
 | Meeting point | **public** | everyone |
 | Network profile (name, avatar, bio, city, interests) | **protected** | the holder + their connections |
-| Participation / sign-up to a meeting point | **protected** | the participant + their connections |
+| Participation / sign-up to a meeting point | **public object, private link** | everyone sees *that* (and how many) participate; *who* participates is contacts-only — [[behavior_participation-listing-is-contacts-only]] |
 | Connection index | **protected** | the holder + their connections |
 | Private profile (settings, email, preferences) | **private** | the holder alone |
 | Connection A↔B (bilateral link, + future messaging) | **dialog** | both users |

-**Deviation on the ActivityPods backend (user decision 2026-10-12, open):** a public meeting point's attendee list — its `apods:attendees` collection, whose members are WebIDs, which embed usernames — is **world-readable**, the pod's default, instead of protected. Moving it to the protected scope is a later task; until then the end-to-end rights matrix tracks it as a KNOWN-DEVIATION line, never as a positive assertion. When the meeting point is switched private, its attendee list stops being readable anonymously with it.
+The attendee list of a public meeting point — its `apods:attendees` collection — is world-readable, and that is the **model, not a deviation**: participations are public objects. What is protected is the **identity link**: the list holds opaque member URNs that only a contact of the participant can recognise, and a person's events are listable by their contacts only; the meeting point's creator has no particular read right. The mechanism is [[decision_2026-10-29_participation-privacy-mechanism]]. When the meeting point is switched private, its attendee list stops being readable anonymously with it.

-Guiding principle: **the "public" side (meeting point, event) and the "personal" side (profile, participations, connections) coexist within a single user.** Personal information is reserved to the **network** (bilateral connections), never visible to an ordinary user.
+Guiding principle: **the "public" side (meeting point, event, the participation as an object) and the "personal" side (profile, the identity link of a participation, connections) coexist within a single user.** Personal information is reserved to the **network** (bilateral connections), never visible to an ordinary user.

 - **Meeting points / events are universally public.** Any user can read them and subscribe; creating a meeting point makes you its host, declaring an event makes you its declarer (no prerequisite).
 - **The host is the sole holder of write rights** on their meeting point; the declarer has no particular right over the meeting points grafted onto their event.
@@ -40,7 +40,7 @@ The intent is the same on both backends — every public event is findable by ev
 - **ActivityPods (the default backend): the Festipod backend's catalog.** An event or meeting point is public when Festipod creates it addressed to the ActivityStreams Public collection (`to: as:Public`). Such a record is readable by anyone at its URI, and the Festipod backend lists it in its catalog at once — no curation. The listing follows the record: the owner's edits update it; a deletion, or a switch to private, removes it and makes the record and its attendee list unreadable anonymously again. Only a record's owner can change its listing. Découvrir shows the user's own events plus the catalog's; opening another user's event reads that event, its meeting points and their attendee counts anonymously, by URI. Costs, accepted: a record created while the backend was not receiving the pod's notifications is never listed (no backfill), and the catalog lists meeting points too, so its own total is not an event count. Verified end to end by `bun run test:e2e-rights` (groups catalog, discovery, visibility).
 - **NextGraph (backend suspended): a curated shared-index document** — [[decision_2026-08-17_discovery-through-a-shared-index]] (concept `data-layer`), no code consumes it yet. An ordinary public document the app reaches by a reference it hardcodes; anyone may deposit a reference to their event, only the index's owner curates deposits into visible entries, ordered by start date. Its accepted costs: an event is findable only once **someone curates** the index (an operator role, no fixed schedule); an event declared before its document could carry the indexed field never becomes findable; a withdrawn or corrected event **stays listed**, so a reader must tolerate a reference that no longer resolves or resolves to something changed; an entry's position is **frozen at curation**.

-> **Sign-up notification (product intent).** Signing up to a meeting point notifies its host: identified if the participant is one of the host's connections, **unnamed otherwise**. This "identified if known, unnamed otherwise" falls out of scope placement — the host can read the sign-up, but not the *protected* profile it points at unless they are connected. The app states the intent; it implements no filter of its own.
+> **Sign-up notification.** Signing up to a meeting point, and withdrawing, notifies its host. The intent is "identified if the participant is one of the host's connections, unnamed otherwise"; on ActivityPods it is **always unnamed** for now — the host has no read right over who signed up, and the app has no trustworthy contacts signal to decide otherwise ([[decision_2026-10-29_participation-privacy-mechanism]]).

 ## Settled: the event write model is OWNER-ONLY

@@ -18,4 +18,4 @@ The project's stack and tooling. Guiding principle: **Bun-first** — Bun replac
 - [[knowledge_bun-apis]] — native Bun APIs (serve, sqlite, redis, sql, file, shell)
 - [[knowledge_build-pipeline]] — build.ts, bundler, server, harness built separately, Storybook
 - [[knowledge_stack-and-commands]] — stack components + the real scripts (plus quirks)
- [[knowledge_deployment]] — the Coolify test stack (one base URL, backend under /api), both images, first-boot traps, prod served from src/, `portless` in dev
+- [[knowledge_deployment]] — the Coolify test stack (one base URL, backend under /api), both images, first-boot traps, prod served from src/
@@ -1,6 +1,6 @@
 ---
 type: caveat
-summary: A running `bun run dev` never picks up a refreshed data-layer package — VERIFIED, not even across a real rebuild (new bundle hash, still the stale dependency). Only a restart serves the fresh copy; suspect a stale server before suspecting the code.
+summary: A running `pnpm dev` never picks up a refreshed data-layer package — VERIFIED, not even across a real rebuild (new bundle hash, still the stale dependency). Only a restart serves the fresh copy; suspect a stale server before suspecting the code.
 last_checked: 2026-08-16
 ---

@@ -10,7 +10,7 @@ last_checked: 2026-08-16

 **VERIFIED, controlled sandbox test with this project's own bun.** A dependency resolving to copy A, overlaid with copy B: the running server still serves A at +3 s and +13 s after the overlay. An edit to **application source** then triggers a genuine rebuild — a new bundle hash confirms it — and the rebuilt bundle **still serves A**. Only a restart serves B. So the mechanism is not "the watcher never fires because `node_modules` is excluded" — a rebuild the watcher DOES trigger still carries the stale dependency forward; the server's resolution of that import is pinned at process start, and a rebuild does not re-resolve it.

-**So: restart `bun run dev` after every refresh of the package — a rebuild is not a substitute, even a real one.** There is no signal that you needed to; a stale server looks exactly like a current one.
+**So: restart `pnpm dev` after every refresh of the package — a rebuild is not a substitute, even a real one.** There is no signal that you needed to; a stale server looks exactly like a current one.

 ## Why this is worth a leaf

@@ -10,7 +10,7 @@ last_checked: 2026-08-16

 | Path | Command | What is served |
 |---|---|---|
-| **Dev** | `bun run dev` → `bun --hot src/index.ts` | **`src/`** — HMR, port 3000 |
+| **Dev** | `pnpm dev` → `bun --hot src/index.ts` | **`src/`** — HMR, port `PORT` (default 4005) |
 | **Production** | `bun run start` → `NODE_ENV=production bun src/index.ts` | **`src/` as well** — Bun transpiles on the fly |
 | Bundle | `bun run build` → `build.ts` (Bun bundler + Tailwind plugin) → `dist/` | **nothing** |

@@ -40,7 +40,7 @@ Practical consequence: to exercise the "shared wallet" flow in dev **end to end*
 ```
 FESTIPOD_SHARED_WALLET_PASSWORD=festipod-e2e-tests \
 FESTIPOD_SHARED_WALLET_FILE=./festipod-e2e-tests.ngw \
-bun run dev
+pnpm dev
 ```

 ## The test harness is built separately
@@ -8,15 +8,18 @@ last_checked: 2026-10-19

 ## The Coolify test stack

-`docker-compose.coolify.yml` is what Coolify (build pack *Docker Compose*) builds and runs from the git repository, on the test server only for now: `frontend` (the root `Dockerfile`, below), `backend` (`backend/Dockerfile`, Moleculer + `@activitypods/app`) and a per-stack Redis. Fuseki is the one shared with the other ActivityPods apps of the Coolify instance (`shared-infra`): only the backend joins the external `coolify` network to reach it, with a pair of datasets of its own named from `DATASET_PREFIX` and the backend's service name (a second non-preview stack on the same Fuseki needs its own prefix). The variables Coolify must carry are listed at the top of the compose file; `SERVICE_FQDN_*` / `SERVICE_NAME_*` are generated by Coolify.
+`docker-compose.coolify.yml` is what Coolify (build pack *Docker Compose*) builds and runs from the git repository, on the test server only for now: `frontend` (the root `Dockerfile`, below), `backend` (`backend/Dockerfile`, Moleculer + `@activitypods/app`) and a per-stack Redis. Fuseki is the one shared with the other ActivityPods apps of the Coolify instance (`shared-infra`): only the backend joins the external `coolify` network to reach it, with a pair of datasets of its own, named as on the sibling apps: explicit `MAIN_DATASET` / `SETTINGS_DATASET` for the main stack (`festipod-test` / `settings-festipod-test`), computed from `DATASET_PREFIX` and the backend's service name when left empty (a preview: `festipod-backend-pr-<n>`). Coolify stores the compose default of those two variables, itself an expression, as their value — it reads as unresolved text in its UI but resolves at deploy time; setting explicit names avoids the confusion. The variables Coolify must carry are listed at the top of the compose file; `SERVICE_FQDN_*` / `SERVICE_NAME_*` are generated by Coolify at deploy time.

 **One base URL per environment** (user decision 2026-10-19, so a pull-request preview lives on a single host, like the sibling apps): the app at `https://festipod.dev.reconnexion.coop/`, the backend on the same host under `/api` — its Domains field is `https://<host>/api,https://<host>/.well-known`. Coolify's **Strip Prefixes must be OFF** (it is on the sibling apps): the backend mounts its routes under `/api` itself, read from `SEMAPPS_HOME_URL=https://<host>/api/`, and the front end is pointed at `VITE_BACKEND_URL=https://<host>/api`. With the prefix stripped every backend request is refused (404).

-**The backend is base-path aware** (`backend/services/base-path.js`), because SemApps is: it mounts every route it adds under the base URL's path (LDP resources, the app actor and its inbox, public keys, access needs, webhooks, `/nodeinfo/2.1`) but keeps the `/.well-known` ones (`context.jsonld`, `nodeinfo`, `solid`, `void`) at the origin root. Festipod's own routes (`/app`, `/as/actor/app`, `/catalog`) are mounted under the base path the same way, the public-surface allow-list matches paths relative to it (the two `/.well-known` endpoints against the full path), and the Solid-OIDC `client_id` is the requested URI rebuilt from the base URL as written — so it equals, byte for byte, the actor URI the backend mints and the `${backendUrl}/as/actor/app` the front end derives. At the root (`http://localhost:3003`, local dev) every decision is identical to the pre-base-path code. To verify: `bun test backend/services` (with and without `SEMAPPS_HOME_URL=https://<host>/api/`).
+**The backend is base-path aware** (`backend/services/base-path.js`), because SemApps is: it mounts every route it adds under the base URL's path (LDP resources, the app actor and its inbox, public keys, access needs, webhooks, `/nodeinfo/2.1`) but keeps the `/.well-known` ones (`context.jsonld`, `nodeinfo`, `solid`, `void`) at the origin root. Festipod's own routes (`/app`, `/as/actor/app`, `/catalog`) are mounted under the base path the same way, the public-surface allow-list matches paths relative to it (the two `/.well-known` endpoints against the full path), and the Solid-OIDC `client_id` is the requested URI rebuilt from the base URL as written — so it equals, byte for byte, the actor URI the backend mints and the `${backendUrl}/as/actor/app` the front end derives. At the root (`http://localhost:3005`, local dev) every decision is identical to the pre-base-path code. To verify: `bun test backend/services` (with and without `SEMAPPS_HOME_URL=https://<host>/api/`).

 **First-boot traps.**
- The backend registers its app actor in its dataset with the domain it has on the FIRST boot: set the domains in Coolify before the first deployment; changing them later means deleting the two datasets and redeploying.
- On a cold first boot, `GET <base>app` answers from an in-memory copy of the actor taken before the access-need group got linked, so it lacks `interop:hasAccessNeedGroup` until the backend restarts (the actor itself, `<base>as/actor/app`, is right). A real sign-in is unaffected — the pod reads the actor — but the rights matrix's programmatic install reads `/app`: restart the backend once after a first deployment.
+- The backend registers its app actor in its dataset with the domain it has on the FIRST boot: set the domains in Coolify before the first deployment.
+- The backend runs with WebACL on, as the reference apps do, so its main dataset must be SECURE: the backend creates it so when it does not exist, and refuses to start ("the main dataset is not secure") on an existing one created otherwise. Starting again from nothing (domains changed, or a dataset created before WebACL was on): delete the two datasets in Fuseki AND the secure dataset's files Fuseki's delete leaves on disk (`databases/<main>`, `<main>Acl`, `<main>Mirror`, `configuration/<main>.ttl`), empty the stack's Redis (its cache keeps serving the old app actor, keys and access needs), redeploy — then every user installs the app again. The exact steps are in the compose file's header. Two more traps, both met on the test server 2026-10-30:
+- **A deleted dataset cannot be re-created under the same name in the same Fuseki process**: Jena keeps the closed storage of that location, and every query on the new dataset fails with `ClosedException: already closed` (500), so the backend crashes at boot. Restart Fuseki before re-creating it — on the test server it is the shared one, so every test app loses its triplestore meanwhile — or give the stack new dataset names (`MAIN_DATASET` / `SETTINGS_DATASET`, e.g. `festipod-test-2`).
+- A "Model permissions violation: http://semapps.org/securedWebacl" in Fuseki's log at the backend's boot is EXPECTED: semapps probes the WebACL graph anonymously to check the dataset is secure and wants that refusal. The backend must reach Fuseki as the Fuseki user named exactly `admin` (`JENA_USER`), the only one the semapps permissions module grants a secure dataset to (semapps `ShiroEvaluator`, read in source).
+- On a cold first boot, `GET <base>app` answered from an in-memory copy of the actor taken before the access-need group got linked, so it lacked `interop:hasAccessNeedGroup` until the backend restarted (the actor itself, `<base>as/actor/app`, was right). A real sign-in is unaffected — the pod reads the actor — but the rights matrix's programmatic install reads `/app`. Since 2026-11-02 the backend refreshes that copy from the store at the end of its boot (`backend/services/app.service.js`). That is verified locally without a Redis cache, not yet on Coolify, whose stack has one: after a first deployment, check that `GET <base>app` links a group before running the matrix.

 **Verified 2026-10-19, locally, not yet on Coolify**: both images built from a clean export of the tree, run against the local pod provider behind a same-origin proxy that routes `/api` and `/.well-known` to the backend unstripped with the Host header kept (as Traefik does) — the login flow, the rights matrix (98/98 hard lines) and the revocation probe all pass; the same images at the origin root pass them too.

@@ -55,7 +58,7 @@ A `Dockerfile` exists (multi-stage Bun Alpine). **Installation goes through pnpm

 ## Environment variables

- `PORT` (default 3000), `NODE_ENV` (enables/disables HMR and the dev auto-seed — see concept `data-layer`).
+- `PORT` (default 4005), `NODE_ENV` (enables/disables HMR and the dev auto-seed — see concept `data-layer`).
 - No `.env*` is committed (`.env` is gitignored).

 ### The shared wallet: config, not a secret, not a mount
@@ -72,6 +75,6 @@ A `Dockerfile` exists (multi-stage Bun Alpine). **Installation goes through pnpm

 ## Dev

-`bun run dev` = **`portless festipod bun --hot src/index.ts`** — it goes through the **`portless`** wrapper (an external port-management tool), not a bare `bun --hot`. HMR is active outside production.
+`pnpm dev` = **`bun --hot src/index.ts`**, served on the fixed port `PORT` (root `.env`, default 4005) like the sibling ActivityPods apps — no port-management wrapper. HMR is active outside production. The local stack (pod provider, backend, ports) is in [[cookbook_local-activitypods-platform]].

 **Reactive local overlay for the SDK**: in production the `@ng-eventually/polyfill` dependency comes from Gitea (git+https, pinned by `pnpm-lock.yaml`), and `@ng-helpers/indexing` likewise. When a provider's package has to be exercised from a local checkout, `pnpm run overlay:polyfill` or `pnpm run overlay:indexing` (script `scripts/overlay-local-checkout.ts`, one provider per run) replaces `node_modules/<package>` with a **real copy** of that checkout (location overridable with `NG_EVENTUALLY_LOCAL` / `NG_HELPERS_LOCAL`) — **without** its own `node_modules/*` — and resyncs on every edit. Copying rather than symlinking is what keeps a **single instance** of every package the provider shares with Festipod installed (`@ng-org/*`, and for `indexing`, `@ng-eventually/polyfill` itself): a symlink would drag in a second one and the SDK would stop working. To go back to the committed state: `pnpm install`.
@@ -21,8 +21,8 @@ summary: Stack components (Bun runtime/build/test, install through pnpm, React,

 | Script | Command / role |
 |---|---|
-| `dev` | `portless festipod bun --hot src/index.ts` — dev with HMR through the `portless` wrapper (see [[knowledge_deployment]]) |
-| `start` | `NODE_ENV=production bun src/index.ts` — production, served from `src/` (not `dist/`) |
+| `dev` | `bun --hot src/index.ts` — dev with HMR on the fixed port `PORT` (root `.env`, default 4005); launched with `pnpm dev`, run by Bun |
+| `start` | `NODE_ENV=production bun src/index.ts` — production, served from `src/` (not `dist/`), same `PORT` default (4005) |
 | `build` | `bun run build.ts` — Bun bundler + Tailwind → `dist/`, **which nothing serves**: production runs `start`, from `src/` ([[knowledge_build-pipeline]]) |
 | `test:cucumber` | chains `cucumber:run` → `cucumber:report` → `features:parse` → `steps:extract` |
 | `cucumber:run` | `node --import tsx/esm node_modules/@cucumber/cucumber/bin/cucumber.js` — **through Node+tsx, not Bun** (Playwright/happy-dom plugin compatibility), and through the package's **actual JS entry**, not the `.bin/` shim (see Pitfalls) |
@@ -87,20 +87,15 @@ The reconstruction is the specification. Its source was read **once, deliberatel
 - `types` takes precedence over `shapeTreeUri` when both are set — the **opposite** of what the configuration type documents.
 - `custom` is not implemented, so there is **no escape hatch through Refine** for non-CRUD operations.
 - Collections are POSTable LDP resources (`/as/collection`) with `semapps:dereferenceItems` — *"all items will be dereferenced (if permissions allow)"*. That is how `event.participations` can come back as full objects for a reader who is allowed, and as URIs otherwise, in one read. Items are added/removed by SparqlPatch on `as:items`.
- `acl:Append` exists among the WAC modes and is really used in app access needs. **Whether it lets a third party insert an item without being able to remove one is NOT VERIFIED** — enforcement lives in `@semapps/webacl`, absent from the checkout. The structure does not depend on the answer: if it works that way the participant appends directly; otherwise the route is `apods:PostOutbox` to the owner's inbox, which is exactly the NextGraph shape, and only latency changes.
 - An app declares `accessNeeds` (`shapeTreeUri` + `accessMode`) plus special needs: `apods:CreateCollection`, `apods:CreateWacGroup`, `apods:PostOutbox`, `apods:QuerySparqlEndpoint`, `apods:UpdateWebId`, inbox/outbox reads.
 - **Backend-less apps are supported**: `onlineBackend` is false only when the app description document at the `clientId` URI is not fetchable. A static file suffices.
- A custom ontology prefix **must be registered at prefix.cc** (the Pod provider requires every ontology to have a known prefix) — this concerns Festipod's `fp:`. Shape trees must sit at a public URL, one per entity, and **cannot reference other shapes** (no sharing cascade).
+- A Festipod **class** with its own shape tree needs `fp:` registered at prefix.cc (the pod registers the ontology of every class it creates a data registration for, and refuses an unknown prefix); shape trees must sit at a public URL, one per entity, and **cannot reference other shapes** (no sharing cascade). A Festipod **predicate** on an existing resource does not: verified 2026-10-29 on a profile with the owner's token (app-token path to confirm live).

-**Four contributions this points to** (we may contribute to these providers): `getMany` must signal the unreadable instead of swallowing it; an append path into a collection one does not own; collection support as a resource with `dereferenceItems`; and a teardown for the auth provider's timer.
+**Three contributions this points to** (we may contribute to these providers): `getMany` must signal the unreadable instead of swallowing it; collection support as a resource with `dereferenceItems`; and a teardown for the auth provider's timer.

-## The deduplication question — answered, and still open
+## Participation privacy and deduplication — settled

-The attendance model (`brief_2026-07-20_attendance-set-model`, PO 2026-07-27) requires the creator to tell two references from the *same* person apart from two from different people **without knowing who**, or the count is not a count of people and a participant can inflate it.
-
-**Checked on this base: not solved.** A different problem is, and well. `materializeAttendance` (`src/shared/data/registration.ts`) keys its active set by a **per-deposit** `uid` minted from time plus randomness, so a broker re-sync replaying the same deposits converges — that is **replay idempotence**, not person identity. The count counts **deposits**: the same person joining twice counts twice. Further: the **plaintext `userId` travels in the deposit** and the cancellation fallback depends on it (a leave without a known `regUid` cancels the earliest still-active join for that `userId`), so the creator *does* know who and the anonymity the model rests on does not hold. Participations are in the **protected** scope rather than public, and withdrawal is still a deletion. And the gap was **never raised** through the channel meant for it.
-
-So both platforms count deposits rather than people, and the gap sits in **neither Refine provider** — polyfill on one side, server on the other. ActivityPods could arbitrate server-side because the server sees everything.
+Settled 2026-10-29: `.project/concepts/functional-domain/decision_2026-10-29_participation-privacy-mechanism.md` — a private Join handled by the backend on emission, attendee lists of per-(person, event) member URNs (distinct-person counts, no identity), recognition by contacts only, a contacts-readable participations collection per person.

 ## Problems hit, and how they turned out

@@ -148,7 +143,7 @@ What was missing for Festipod's premise — discover other users' public events

 - **Attendee lists stay world-readable for now** (2026-10-12) — an explicit deviation from the domain doctrine, where participation is in the protected scope (`functional-domain`, `knowledge_data-scopes-and-discovery`): anonymous readers of a public meeting point's attendee collection see its members' WebIDs, which embed usernames. The matrix tracks it as a KNOWN-DEVIATION line (printed, non-fatal, flags loudly the day it changes). Moving participation to the protected scope is a later task.
 - **A revoked app logs the user out** (2026-10-12): picker with a notice, never sent back to consent.
- **Defensive testing only** (2026-10-13): no automated check sends a forged or spoofed activity; such checks are MANUAL-CHECK lines (below).
+- **Tests never break the dev environment** (user rule 2026-10-30, concept `bdd-testing`): attacks, forged or spoofed activities included, are allowed between the throwaway accounts a run creates and deletes.
 - **Trusted local network** (2026-10-13): no key rotation after the exposure below; it is recorded as a risk. Until `88f23b7` the Festipod backend served, anonymously and on all interfaces (reached from the LAN), an open `/sparql` over its `settings` dataset — the app actor's private key, the pod provider's password hashes and emails (the dataset is shared with the pod provider locally), webhook URLs, catalog snapshots — and the private key again at `/key` through the LDP catch-all. Fuseki still listens on all interfaces with `admin/admin`.

 **MANUAL checks** — kept out of the automated matrix because they need a crafted request; each is covered by backend unit tests and owes one manual run by a human: (1) a Delete posted to a user's OWN outbox that embeds a Tombstone of ANOTHER user's event must not de-index it (`catalog.service` ownership, `emitted-activity` re-read); (2) a forged pod notification (webhook) must not publish a private event, grant or revoke a read, or list/de-list anything; (3) a crafted delivery to `POST /as/actor/app/inbox` or `/.webhooks/<id>`, and any write outside them, must change nothing (`public-surface`, `emitted-activity`).
@@ -176,8 +171,8 @@ What was missing for Festipod's premise — discover other users' public events
 - Adding `## Needs` to the polyfill declaration is where the per-person discriminator belongs. It is **outward-facing** (the provider reads it on its next pull), so it awaits the user's go.
 - `acl:Append` behaviour, as above.
 - The router's prefix stripping, with the second backend.
- The four provider contributions.
- Wiring the seam: DONE 2026-10-09 (T04 tree, tip `f8c2e3b`) — `FestipodDataContext` runs over Refine with the ActivityPods backend as the registered default; the join→collection loop is built but `@suspendu` until the app is installed on a pod (consent screen). Current state: `## Current gate state` above. The app-install blocker is CLEARED end-to-end 2026-10-12 (tips `3aa9131` → this state): the login → Solid-OIDC → consent → registration → app loop completes on the aligned stack, verified by an automated Playwright probe (fresh user: picker → login → consent → `/home` authenticated → event created → meeting point attached). The chain of causes, in the order they surfaced: (1) the pod provider's OIDC adapter resolves an unknown client_id by fetching it and requires a Solid-OIDC Client ID Document — `/app` serves it when the request carries the `JsonLdContext` header, the actor otherwise; (2) the platform stack has to run a coherent version — the app packages are pinned at npm latest (`@activitypods/app` 2.3.2, refine-providers 0.2.0) and the pod provider runs the release tag v2.3.12 (fresh pull + full data reset + the pod frontend needing `VITE_CONFIG_URL` in dev and redis remapped to :6390 per the cookbook); (3) on a cold start the actor's `interop:hasAccessNeedGroup` link races the access-need-group creation and is never attached — an idempotent heal in `backend/services/app.service.js` `started()` patches it when missing; (4) the auth provider's `registerApp` discovers the AppRegistration via a `Link: rel="interop:registeredAgent"` header the pod only returns when the requester's token identity (azp = the configured client_id) equals the registration's `registeredAgent`, which the pod stores under the app ACTOR uri — so the Solid-OIDC client_id IS the actor uri (`${backendUrl}/as/actor/app`), and `/as/actor/app` serves the actor / the Client ID Document by the same header trick through a standalone `client-id-doc` service (routing it to `app.get` deadlocked boot: the app service's own `awaitCreateComplete` polls the actor over HTTP while the service is still starting). The pinned contract carries a dated re-baseline section recording the registerApp/getAppStatus findings (authorized one-time re-read). The verify-compat shim was removed once the aligned stack made it redundant. A revoked app is now detected client-side (`4fc856f`, `d4fcb7e` — see `## T05`). The join→collection scenarios are re-enabled and green (5/5 smoke), and the full authenticated UI flow is banked as a durable gate: `bun run test:e2e-flow` (scripts/e2e-login-flow.ts — picker → login → consent → authenticated → event → meeting point, fresh user, benign-4xx classification, non-zero exit on any fatal ≥400). Platform fragility observed while un-suspending: hand-crafting an `apods:attendees` collection (instead of letting the backend attach it) crashed the festipod backend with an uncaught `Invalid URL` in `@activitypods/app` `pod-collections-handler.getGroupSlugFromCollectionUri(undefined)` — the scenario now reads the attached collection rather than building it; the crash path itself is platform-side.
+- The three provider contributions.
+- Wiring the seam: DONE 2026-10-09 (T04 tree, tip `f8c2e3b`) — `FestipodDataContext` runs over Refine with the ActivityPods backend as the registered default; the join→collection loop is built but `@suspendu` until the app is installed on a pod (consent screen). Current state: `## Current gate state` above. The app-install blocker is CLEARED end-to-end 2026-10-12 (tips `3aa9131` → this state): the login → Solid-OIDC → consent → registration → app loop completes on the aligned stack, verified by an automated Playwright probe (fresh user: picker → login → consent → `/home` authenticated → event created → meeting point attached). The chain of causes, in the order they surfaced: (1) the pod provider's OIDC adapter resolves an unknown client_id by fetching it and requires a Solid-OIDC Client ID Document — `/app` serves it when the request carries the `JsonLdContext` header, the actor otherwise; (2) the platform stack has to run a coherent version — the app packages are pinned at npm latest (`@activitypods/app` 2.3.2, refine-providers 0.2.0) and the pod provider runs the release tag v2.3.12 (fresh pull + full data reset + the pod frontend needing `VITE_CONFIG_URL` in dev and redis remapped to :6390 per the cookbook); (3) on a cold start the actor was seen without its `interop:hasAccessNeedGroup` link (cause not established, possibly the stale `GET /app` snapshot fixed 2026-11-02) — an idempotent heal in `backend/services/app.service.js` `started()` patches it when missing; (4) the auth provider's `registerApp` discovers the AppRegistration via a `Link: rel="interop:registeredAgent"` header the pod only returns when the requester's token identity (azp = the configured client_id) equals the registration's `registeredAgent`, which the pod stores under the app ACTOR uri — so the Solid-OIDC client_id IS the actor uri (`${backendUrl}/as/actor/app`), and `/as/actor/app` serves the actor / the Client ID Document by the same header trick through a standalone `client-id-doc` service (routing it to `app.get` deadlocked boot: the app service's own `awaitCreateComplete` polls the actor over HTTP while the service is still starting). The pinned contract carries a dated re-baseline section recording the registerApp/getAppStatus findings (authorized one-time re-read). The verify-compat shim was removed once the aligned stack made it redundant. A revoked app is now detected client-side (`4fc856f`, `d4fcb7e` — see `## T05`). The join→collection scenarios are re-enabled and green (5/5 smoke), and the full authenticated UI flow is banked as a durable gate: `bun run test:e2e-flow` (scripts/e2e-login-flow.ts — picker → login → consent → authenticated → event → meeting point, fresh user, benign-4xx classification, non-zero exit on any fatal ≥400). Platform fragility observed while un-suspending: hand-crafting an `apods:attendees` collection (instead of letting the backend attach it) crashed the festipod backend with an uncaught `Invalid URL` in `@activitypods/app` `pod-collections-handler.getGroupSlugFromCollectionUri(undefined)` — the scenario now reads the attached collection rather than building it; the crash path itself is platform-side.
 - Both usage declarations are named `usage_festipod.md`, so the bare stem is ambiguous as a wikilink — refer to either by folder path.
 - Driving `getAppStatus()`: DONE (`4fc856f`, `d4fcb7e`). Festipod relies on its `installed` member, which the reconstruction does not pin — recorded in the activitypods-providers usage declaration (constraint 9, need 3), together with its reliance on `create` sending `to` unchanged (constraint 10).
 - The `activitypods-providers` reconstruction is stamped at the 0.1.5-era pin while the installed package is 0.2.0 — re-constructing the contract at the installed version is a pending decision (the source is read once at adoption time; a re-read is its own decision).
@@ -0,0 +1,7 @@
+# Rules (local)
+
+Each rule below shows its one-line summary. **Read the full file** when a rule looks relevant — it carries the *why* and *how to apply* needed to use the rule with judgment.
+
+## activitypods
+
+- **festipod-only-reference-app-patterns** — N'écrire sur le pod ActivityPods que par des patterns des apps de référence du dossier ~/projects/activitypods/, sinon exception justifiée. → `.project/rules/activitypods/festipod-only-reference-app-patterns.md`
@@ -0,0 +1,15 @@
+---
+name: festipod-only-reference-app-patterns
+summary: N'écrire sur le pod ActivityPods que par des patterns des apps de référence du dossier ~/projects/activitypods/, sinon exception justifiée.
+group: activitypods
+scope: local
+created: 2026-10-28
+---
+
+# Ne faire sur le pod que ce que font les apps de référence
+
+**Rule:** Dans Festipod, n'utiliser pour interagir avec la plateforme ActivityPods que des patterns déjà présents dans les applications de référence du dossier `~/projects/activitypods/`, sauf si aucune autre solution n'existe — auquel cas l'exception doit être nommée et justifiée explicitement avant de coder.
+
+**Why:** La validation live du 2026-10-28 a montré que tout chemin de plateforme non exercé par une app de référence est un terrain miné : le provisioning holder-side navigateur (création de conteneur dans `as/collection` + PATCH `/_acl` avec un token de session Solid-OIDC `azp`) a révélé deux bugs fournisseurs (500 après création effective du conteneur ; hang sans écriture dans `webacl.resource.addRights`), alors que les chemins utilisés par les apps de référence fonctionnent en production. Aucune app de référence ne provisionne d'infrastructure depuis le frontend : toute écriture pod hors données (conteneur, ACL, groupe, collection) se fait **backend-side, signée app-actor** via `signature.proxy.query`.
+
+**How to apply:** Références canoniques (2026-10-28, les mieux maintenues, ajoutées au dossier) : **`welcometomyplace`, `mutual-aid.app`, `portejunes`** — en priorité welcometomyplace, seule à exercer les patterns sociaux avancés. Secondaires : `mastopod` (access needs simples), `refine-providers/examples/antd-app` (frontend), et les services du app-framework (`activitypods/app-framework/app`). Avant toute écriture pod, vérifier le pattern dans ces sources ; s'il est absent des trois canoniques, ne pas coder : chercher une composition de patterns existants, et à défaut demander la décision utilisateur en nommant l'exception. Patterns welcometomyplace que Festipod réutilise : traiter une activité sur `onEmit` de l'outbox de son émetteur (catalogue, contacts, listes de participants) ; exception nommée (2026-11-03, sur avis du développeur d'ActivityPods, `decision_2026-11-03_participation-delivered-to-the-app`) : un Join/Leave de participation est adressé à l'acteur de l'app et traité à sa réception dans l'inbox de l'app (`onReceive` de l'`ActivitiesHandlerMixin` de semapps, le chemin du framework pour l'installation d'une app, `registration.service.js`) ; collection lisible par un groupe = `pod-permissions.add({agentPredicate: 'acl:agentGroup', mode: 'acl:Read'})` sur une collection `pod-collections` (`attendees.service.js`), le groupe `/contacts` d'un utilisateur trouvé par `pod-wac-groups.getUriFromCollectionUri({collectionUri: apods:contacts})` — jamais un droit par élément de la liste `apods:contacts`, falsifiable par un `Accept` forgé ; notifier = `pod-notifications.send`, qui exige un backend en WebACL activé sur un dataset sécurisé, comme les trois apps de référence. Ne JAMAIS reprendre leur `addMember` de l'organisateur dans le groupe `/contacts` du participant : c'est un choix produit de welcometomyplace (événements privés), une fuite d'identité sous la règle de Festipod (`behavior_participation-listing-is-contacts-only`). Couvre l'usage de la plateforme, pas les choix produit propres à Festipod.
@@ -1,3 +1,5 @@
 # To discuss

 - [ ] clarifier le vocabulaire d'identité employé par Festipod (wallet, utilisateur, profil, username) et réconcilier decision_2026-07-06 (« identifiant = wallet ») et decision_2026-07-20 (« username dans le profil ») avec ce que le contrat publie aujourd'hui : `ensureIdentity()` ne prend aucun identifiant, et `username` ne désigne plus que `UserProfile.username`
+- [ ] déclarer (usage_festipod) et faire confirmer par le fournisseur l'usage de `fetchJson` et `resolveContainerUri` (`@activitypods/refine-providers/utils`) pour l'upload d'images : utilisés par `useUploadImage` mais absents du contrat épinglé ; et le moyen de créer/lier un `as:Profile` quand le Pod n'en expose aucun (aujourd'hui : message seulement)
+- [ ] afficher « en attente » dans l'écran des contacts les personnes à qui l'utilisateur a envoyé une demande non encore acceptée (elles voient déjà son profil et ses participations : le groupe /contacts les inclut dès l'envoi) — source possible : les `Offer` sans réponse de son outbox, ou une collection des demandes envoyées à demander en amont
@@ -12,7 +12,7 @@ Web app mobile-first où les utilisateurs créent des **points de rencontre** qu
  src/screens/index.ts # Registre d'écrans (utilisé par Storybook)
  ```
 - **Un module n'importe QUE depuis `shared/` — jamais d'un autre module.** C'est l'invariant qui rend l'archi réelle.
- **Bun-first** : `bun` / `bun install` / `bun test` / `bun build`, jamais node/npm/vite/jest. `bun run dev` (portless, port dynamique ; défaut servi par `bun run start` : 4000).
+- **Bun-first** : `bun` / `bun install` / `bun test` / `bun build`, jamais node/npm/vite/jest. `pnpm dev` (port fixe, `PORT` du `.env` racine, défaut 4005 ; même défaut pour `pnpm start`).

 ## Frontière SDK

@@ -38,3 +38,7 @@ La connaissance détaillée vit dans `.project/concepts/` (système *concept*) :
 | `app-security` | Isolation déléguée au SDK (pas de contrôle d'accès dans les écrans), auth wallet, matrice d'autorisations cible |

 Pour **documenter** un fait projet : `/concept document <sujet>` (ne pas écrire en libre dans `.project/`).
+
+## Rules
+
+@.project/rules/INDEX.md
@@ -0,0 +1,22 @@
+.PHONY: start stop config upgrade attach-activitypods
+
+# The local pod provider and its infrastructure (fuseki, redis, mailcatcher, arena).
+# Festipod's own backend and app run outside Docker: `cd backend && pnpm dev`, `pnpm dev`.
+DOCKER_COMPOSE_DEV=docker compose -f docker-compose-dev.yml
+
+start:
+	$(DOCKER_COMPOSE_DEV) up -d
+
+stop:
+	$(DOCKER_COMPOSE_DEV) kill
+	$(DOCKER_COMPOSE_DEV) rm -fv
+
+config:
+	$(DOCKER_COMPOSE_DEV) config
+
+upgrade:
+	$(DOCKER_COMPOSE_DEV) pull
+	$(DOCKER_COMPOSE_DEV) up -d
+
+attach-activitypods:
+	$(DOCKER_COMPOSE_DEV) exec activitypods-backend pm2 attach 0
@@ -60,11 +60,18 @@ Identifiées comme nécessaires (notamment pour la scalabilité et la découvert

 ## Quick Start

+Comme les autres apps ActivityPods : le Pod provider local et l'infrastructure tournent dans Docker, le backend et l'app hors Docker. Ports par défaut : Pod provider 3000 (frontend 5000), backend Festipod 3005, app 4005 — à surcharger dans `backend/.env` et `.env`.
+
 ```bash
-bun install
-bun run dev              # Dev server avec HMR (port 3000)
+cp .env.example .env && cp backend/.env.example backend/.env
+make start                          # Pod provider local + Fuseki + Redis + mailcatcher + Arena
+pnpm install && (cd backend && pnpm install)
+cd backend && pnpm dev              # backend (port SEMAPPS_PORT, 3005 par défaut)
+pnpm dev                            # app avec HMR, dans un autre terminal (port PORT, 4005 par défaut)
 ```

+Détails, pièges et remise à zéro : concept `data-layer`, `cookbook_local-activitypods-platform`.
+
 ## Commandes utiles

 ```bash
@@ -1,14 +1,21 @@
 SEMAPPS_APP_NAME=Festipod
 SEMAPPS_APP_DESCRIPTION=Points de rencontre sur les événements publics
 SEMAPPS_APP_LANG=en,fr
-SEMAPPS_HOME_URL=http://localhost:3003
-SEMAPPS_FRONT_URL=http://localhost:4000
+
+SEMAPPS_HOME_URL=http://localhost:3005/
+SEMAPPS_FRONT_URL=http://localhost:4005/
+SEMAPPS_PORT=3005
+
 SEMAPPS_SHAPE_REPOSITORY_URL=https://shapes.activitypods.org/
-SEMAPPS_PORT=3003
+
+# Triple store
 SEMAPPS_SPARQL_ENDPOINT=http://localhost:3030/
-SEMAPPS_MAIN_DATASET=settings
 SEMAPPS_JENA_USER=admin
 SEMAPPS_JENA_PASSWORD=admin
-SEMAPPS_REDIS_CACHE_URL=redis://localhost:6390/3
-SEMAPPS_QUEUE_SERVICE_URL=redis://localhost:6390/4
-SEMAPPS_AUTH_ACCOUNTS_DATASET_NAME=settings
+SEMAPPS_MAIN_DATASET=festipod
+SEMAPPS_AUTH_ACCOUNTS_DATASET_NAME=settings-festipod
+
+# Redis (format: redis://localhost:6379/0) — no cache locally; queue db 15 (the sibling apps use 12, 13, 14)
+# The port is the one `make start` publishes: REDIS_PORT of the root .env when set, else 6379.
+SEMAPPS_REDIS_CACHE_URL=
+SEMAPPS_QUEUE_SERVICE_URL=redis://localhost:6379/15
@@ -1,4 +1,6 @@
-require('dotenv-flow').config();
+// The backend's own env files, wherever the process starts: the root `bun test` runs the
+// backend's tests too, from the repository root.
+require('dotenv-flow').config({ path: require('path').join(__dirname, '..') });

 module.exports = {
  APP_NAME: process.env.SEMAPPS_APP_NAME,
@@ -1,4 +1,4 @@
-const { CacherMiddleware } = require('@semapps/webacl');
+const { WebAclMiddleware, CacherMiddleware } = require('@semapps/webacl');
 const CONFIG = require('./config/config');

 Error.stackTraceLimit = Infinity;
@@ -42,7 +42,11 @@ module.exports = {
  middlewares: [
    SkipOrphanBlankNodesCleanupMiddleware(),
    SystemCallWebIdMiddleware(),
-    CacherMiddleware(cacherConfig)
+    // As in the reference apps: the cacher before the WebACL middleware, which checks the read
+    // rights of every `ldp.resource.get` and gives each resource created in the main dataset the
+    // rights its container prescribes (the app actor and its public key readable by anyone, say).
+    CacherMiddleware(cacherConfig),
+    WebAclMiddleware({ baseUrl: CONFIG.HOME_URL })
  ],
  logger: {
    type: 'Console',
@@ -14,8 +14,11 @@
 // `pim:storage` (verified 2026-10-12: PATCH → 204, the profile then lists both) — so it proves
 // nothing about who owns a resource.
 //
-// `actorUri` must come from the server side — the actor whose outbox the webhook fired on — never
-// from the activity's own `actor` field, which the emitting client writes.
+// `actorUri` must come from the server side — the actor whose outbox a webhook fired on, or the
+// signer the app's inbox verified for a delivered activity — never from a field nothing vouches for,
+// such as a webhook body's `actor`, which the emitting client writes. One use takes an unvouched
+// value as a HINT only: registration's `meetingPointOf` reads a meeting point in the pod its first
+// copy names, and believes that pod only once the copy it serves names the same creator.

 const WEB_PROTOCOLS = new Set(['http:', 'https:']);

@@ -47,6 +47,12 @@ module.exports = {
          accessMode: ['acl:Read', 'acl:Write'],
          preferredScope: 'interop:AllFromRegistry'
        },
+        {
+          // The images users upload (event covers, avatars): the Pod's `file` container.
+          shapeTreeUri: urlJoin(CONFIG.SHAPE_REPOSITORY_URL, 'shapetrees/File'),
+          accessMode: ['acl:Read', 'acl:Write'],
+          preferredScope: 'interop:AllFromRegistry'
+        },
        {
          shapeTreeUri: urlJoin(CONFIG.SHAPE_REPOSITORY_URL, 'shapetrees/vcard/Group'),
          accessMode: 'acl:Read',
@@ -56,7 +62,6 @@ module.exports = {
        'apods:ReadOutbox',
        'apods:PostOutbox',
        'apods:QuerySparqlEndpoint',
-        'apods:CreateWacGroup',
        'apods:CreateCollection',
        'apods:UpdateWebId'
      ],
@@ -66,8 +71,8 @@ module.exports = {
  },
  actions: {
    // Overrides the mixin's `get` (which returns `this.appActor` for every request) to
-    // answer the Solid-OIDC Client ID Document fetch as well. `this.appActor` is set by the
-    // mixin's `started()`, i.e. long before any request is served.
+    // answer the Solid-OIDC Client ID Document fetch as well. `this.appActor` is the mixin's
+    // snapshot of the actor, refreshed by this service's own started() (see there).
    get: {
      async handler(ctx) {
        // moleculer-web exposes the raw request only when the route alias sets
@@ -79,11 +84,9 @@ module.exports = {
        const isOidcClientIdDocument =
          jsonLdContextKey !== undefined && String(headers[jsonLdContextKey]).includes('solid/oidc-context.jsonld');

-        // `this.appActor` is set at the very END of the mixin's started(). During boot,
-        // this action is already routable (the api gateway is up before the services
-        // finish starting) and `@activitypods/app`'s own `awaitCreateComplete` polls the
-        // actor over HTTP through this very route — waiting on an action that waits on the
-        // boot it blocks. Read the actor straight from the triplestore in that window.
+        // Moleculer registers this action only once every started() handler of the service has
+        // finished, by which time the mixin has set `this.appActor`: reading the actor from the
+        // triplestore when it is unset is a guard, not a boot path.
        let actor = this.appActor;
        if (!actor) {
          try {
@@ -119,34 +122,67 @@ module.exports = {
  },
  async started() {
    // Heal the actor ↔ access-need-group link. `@activitypods/app` attaches the group to the
-    // actor in an after.post hook of the group's creation, but the hook races the actor's own
-    // creation on a cold start (both run inside the broker's parallel started() phase): the
-    // group then exists while the actor never gets `interop:hasAccessNeedGroup`, and both the
-    // pod frontend (consent screen) and the pod backend (requirements discovery) read the
-    // needs from that link — an empty consent registers the app with zero grants and the
-    // register flow loops. Idempotent: only patches when the link is missing.
+    // actor in an after.post hook of the group's creation. On a fresh dataset (2026-10-26)
+    // consents registered zero grants and a one-shot version of this heal found no group; the
+    // cause was not established — the mixin's started() creates the actor, then the group,
+    // before this handler runs. Both the pod frontend (consent screen)
+    // and the pod backend (requirements discovery) read the needs from that link — an empty
+    // consent registers the app with zero grants and the register flow loops — so the link
+    // is checked in the store and attached when missing, polling for the group rather than
+    // checking once. Idempotent: only patches when the link is missing.
    const actorUri = urlJoin(CONFIG.HOME_URL, 'as/actor/app');
-    const actor = await this.broker.call('ldp.resource.get', {
-      resourceUri: actorUri,
-      accept: 'application/ld+json',
-      webId: 'system'
-    });
-    const link = actor && actor['interop:hasAccessNeedGroup'];
-    const hasLink = Array.isArray(link) ? link.length > 0 : Boolean(link);
-    if (!hasLink) {
+    const readActor = () =>
+      this.broker.call('ldp.resource.get', {
+        resourceUri: actorUri,
+        accept: 'application/ld+json',
+        webId: 'system'
+      });
+    const linksGroup = actor => {
+      const link = actor && actor['interop:hasAccessNeedGroup'];
+      return Array.isArray(link) ? link.length > 0 : Boolean(link);
+    };
+    const findGroup = async () => {
      const groups = await this.broker.call('access-needs-groups.list', {
        filters: {
          'http://www.w3.org/ns/solid/interop#accessNecessity': 'http://www.w3.org/ns/solid/interop#AccessRequired'
        },
        accept: 'application/ld+json'
      });
-      const group = groups && groups['ldp:contains'] && groups['ldp:contains'][0];
-      if (group) {
-        await this.broker.call('actors.attachAccessNeedGroup', {
-          accessNeedGroupUri: group.id || group['@id']
-        });
-        this.logger.info(`Healed the actor's interop:hasAccessNeedGroup link to ${group.id || group['@id']}`);
+      return groups && groups['ldp:contains'] && groups['ldp:contains'][0];
+    };
+    // A started() handler must not block the broker's boot, but the link must
+    // exist before the first consent/register flow; ~1 min is far past the
+    // observed gap (seconds) while the dataset is empty.
+    const deadline = Date.now() + 60000;
+    for (;;) {
+      try {
+        if (linksGroup(await readActor())) break;
+        const group = await findGroup();
+        if (group) {
+          await this.broker.call('actors.attachAccessNeedGroup', {
+            accessNeedGroupUri: group.id || group['@id']
+          });
+          this.logger.info(`Healed the actor's interop:hasAccessNeedGroup link to ${group.id || group['@id']}`);
+          break;
+        }
+      } catch (e) {
+        this.logger.warn(`Access-need-group heal attempt failed: ${e.message}`);
      }
+      if (Date.now() >= deadline) {
+        this.logger.error('No access-need group appeared within 60s; the actor stays unlinked — consents will register zero grants');
+        break;
+      }
+      await new Promise(r => setTimeout(r, 2000));
+    }
+    // `get` serves `this.appActor`, the snapshot the mixin's started() takes BEFORE it creates
+    // or replaces the group: on a dataset's first boot that snapshot lacks the link, and on a
+    // boot that changes the access needs it names the group just deleted. `GET /app` kept
+    // that until the next restart (observed 2026-11-02), so refresh it from the store.
+    try {
+      const actor = await readActor();
+      if (linksGroup(actor)) this.appActor = actor;
+    } catch (e) {
+      this.logger.warn(`Could not refresh the app actor snapshot: ${e.message}`);
    }
  }
 };
@@ -0,0 +1,96 @@
+const { test, expect, describe, afterEach, setSystemTime } = require('bun:test');
+const app = require('./app.service');
+
+const ACTOR = 'http://localhost:3005/as/actor/app';
+const GROUP = 'http://localhost:3005/interop/access-need-group/g1';
+
+const actor = (extra = {}) => ({ id: ACTOR, type: ['Application', 'interop:Application'], ...extra });
+const linked = () => actor({ 'interop:hasAccessNeedGroup': GROUP });
+
+/**
+ * The app service as moleculer runs its own started(), after the mixin's: `snapshot` is the
+ * `this.appActor` the mixin left, `store` the actor the triplestore holds, `groups` what the
+ * group listing answers. Attaching a group writes the link into the store, as the mixin does.
+ * `failReadsFrom` makes the n-th actor read (1-based) and every later one throw.
+ */
+function service({ snapshot, store, groups = [], failReadsFrom = Infinity }) {
+  const calls = [];
+  const logs = { info: [], warn: [], error: [] };
+  let reads = 0;
+  const svc = {
+    appActor: snapshot,
+    logger: { info: m => logs.info.push(m), warn: m => logs.warn.push(m), error: m => logs.error.push(m) },
+    broker: {
+      call: async (action, params) => {
+        calls.push(action);
+        if (action === 'ldp.resource.get') {
+          reads += 1;
+          if (reads >= failReadsFrom) throw new Error('triplestore down');
+          return store;
+        }
+        if (action === 'access-needs-groups.list') return { 'ldp:contains': groups };
+        if (action === 'actors.attachAccessNeedGroup') {
+          store = { ...store, 'interop:hasAccessNeedGroup': params.accessNeedGroupUri };
+          return undefined;
+        }
+        throw new Error(`unexpected call ${action}`);
+      }
+    }
+  };
+  return { svc, calls, logs };
+}
+
+describe('app actor snapshot — GET /app serves the access-need group once the store links it', () => {
+  // The deadline test moves the clock; reset it even when a test times out mid-way.
+  afterEach(() => setSystemTime());
+
+  test("a dataset's first boot: the snapshot predates the link the store holds, so it is refreshed", async () => {
+    const { svc, calls } = service({ snapshot: actor(), store: linked() });
+    await app.started.call(svc);
+    expect(svc.appActor['interop:hasAccessNeedGroup']).toBe(GROUP);
+    expect(calls).not.toContain('actors.attachAccessNeedGroup');
+  });
+
+  test('the cold-start race: the store lacks the link too, the heal attaches the group, then the snapshot follows', async () => {
+    const { svc, calls, logs } = service({ snapshot: actor(), store: actor(), groups: [{ id: GROUP }] });
+    await app.started.call(svc);
+    expect(calls).toContain('actors.attachAccessNeedGroup');
+    expect(logs.info.some(m => m.includes(GROUP))).toBe(true);
+    expect(svc.appActor['interop:hasAccessNeedGroup']).toBe(GROUP);
+  });
+
+  test('a later boot: the snapshot already carries the link and keeps it', async () => {
+    const { svc } = service({ snapshot: linked(), store: linked() });
+    await app.started.call(svc);
+    expect(svc.appActor['interop:hasAccessNeedGroup']).toBe(GROUP);
+  });
+
+  test('a boot that changes the access needs: the snapshot names the deleted group, the store the new one', async () => {
+    const { svc } = service({ snapshot: actor({ 'interop:hasAccessNeedGroup': `${GROUP}-old` }), store: linked() });
+    await app.started.call(svc);
+    expect(svc.appActor['interop:hasAccessNeedGroup']).toBe(GROUP);
+  });
+
+  test('no group ever appears: the heal gives up and the snapshot is not replaced by an unlinked actor', async () => {
+    const snapshot = actor();
+    const { svc, logs } = service({ snapshot, store: actor({ name: 'from the store' }) });
+    // The group listing answers empty; jump the clock past the heal's 60 s deadline at that
+    // point so the loop gives up without sleeping.
+    const call = svc.broker.call;
+    svc.broker.call = async (action, params) => {
+      if (action === 'access-needs-groups.list') setSystemTime(new Date(Date.now() + 61000));
+      return call(action, params);
+    };
+    await app.started.call(svc);
+    expect(logs.error.some(m => m.includes('No access-need group appeared'))).toBe(true);
+    expect(svc.appActor).toBe(snapshot);
+  });
+
+  test('a failed refresh read leaves the snapshot as it was and says so', async () => {
+    const snapshot = actor();
+    const { svc, logs } = service({ snapshot, store: linked(), failReadsFrom: 2 });
+    await app.started.call(svc);
+    expect(svc.appActor).toBe(snapshot);
+    expect(logs.warn.some(m => m.includes('refresh the app actor snapshot'))).toBe(true);
+  });
+});
@@ -1,5 +1,6 @@
-// The last participation act applied for each (meeting point, participant) — what makes attendance
-// independent of the order notifications arrive in.
+// The last participation act applied for each (meeting point, participant WebID) — what makes attendance
+// independent of the order notifications arrive in, and what remembers which member URN that act put in
+// (or took out of) the meeting point's attendee list.
 //
 // WHY. A participant's Join and Leave reach the backend as separate notifications, handled
 // concurrently; the per-meeting-point lock (`keyed-serializer.js`) serializes them, but in the order
@@ -16,30 +17,61 @@
 // attending, "leave then join" ends attending. All acts of one participant are stamped by her own pod,
 // so they share one clock.
 //
+// THE MEMBER is STICKY per pair. The URN listed for a participant is computed from the secret on their
+// profile, which they may rewrite between acts. So the entry remembers the URN once chosen and reuses it
+// for every later act of the pair — `member` is persisted (`persistMember`) BEFORE the first attendee-list
+// write, WRITE-ONCE (inserted only when absent, never replaced, not rewritten when an act is recorded),
+// and never recomputed afterwards: a later Join keeps it, a Leave removes that one. This is what
+// keeps the pair listed under exactly ONE URN even when an act fails half-way (the add lands, a later step
+// throws, the act is left unrecorded) and the participant then rewrites their secret and acts again —
+// without it, the second act would compute a second URN and the list would carry both.
+//
+// The member and the act are persisted SEPARATELY: `member` the moment a URN is first chosen for the pair,
+// the act (its URI, its stamp, its kind) only once BOTH collections match it. So the entry may hold a
+// member with no act yet (a first act that failed before recording) — `lastAttendance` returns it so the
+// retry reuses the URN, while the absent act makes the retry the "first" act for ordering (`isNewerAct`).
+//
+// THE KEY is the participant's WebID, not the member URN. This exposes nothing new at rest: the entry
+// already holds the act's URI, which lies in the participant's pod and so already identifies them.
+//
 // WHERE IT LIVES. Like the catalog (`catalog-store.js`): in the backend's main dataset, DEFAULT graph
 // (persisted by Fuseki), so the rule holds across a backend restart. One entry per pair, under a minted
-// `urn:festipod:attendance:` subject, with three Festipod predicates: the act's URI, its stamp, its kind.
+// `urn:festipod:attendance:` subject, with four Festipod predicates: the act's URI, its stamp, its kind,
+// the member URN applied.

 const { iriRef, stringLiteral } = require('./catalog-store');

 const ACT = 'http://festipod.org/attendanceAct';
 const PUBLISHED = 'http://festipod.org/attendancePublished';
 const CHANGE = 'http://festipod.org/attendanceChange';
+const MEMBER = 'http://festipod.org/attendanceMember';

 /** The subject of the (meeting point, participant) entry: both URIs percent-encoded into one URN. */
-function attendanceSubject(meetingPointUri, memberUri) {
-  return `urn:festipod:attendance:${encodeURIComponent(meetingPointUri)}:${encodeURIComponent(memberUri)}`;
+function attendanceSubject(meetingPointUri, participantUri) {
+  return `urn:festipod:attendance:${encodeURIComponent(meetingPointUri)}:${encodeURIComponent(participantUri)}`;
 }

-/** The last act applied for the pair: one row (act, published, change) or none. */
-function lastAttendanceQuery(meetingPointUri, memberUri) {
-  const s = iriRef(attendanceSubject(meetingPointUri, memberUri));
-  return `SELECT ?act ?published ?change WHERE { ${s} <${ACT}> ?act ; <${PUBLISHED}> ?published ; <${CHANGE}> ?change } LIMIT 1`;
+// The pair's entry, anchored on its sticky `member`: a row iff a URN has been chosen for the pair, the
+// act fields bound only once an act was recorded (OPTIONAL — a member may be persisted with no act yet).
+function lastAttendanceQuery(meetingPointUri, participantUri) {
+  const s = iriRef(attendanceSubject(meetingPointUri, participantUri));
+  return `SELECT ?act ?published ?change ?member WHERE { ${s} <${MEMBER}> ?member . OPTIONAL { ${s} <${ACT}> ?act ; <${PUBLISHED}> ?published ; <${CHANGE}> ?change } } LIMIT 1`;
 }

-/** Replace the pair's entry with `{ activityUri, published, change }`. One update = one transaction. */
-function recordAttendanceUpdate(meetingPointUri, memberUri, { activityUri, published, change }) {
-  const s = iriRef(attendanceSubject(meetingPointUri, memberUri));
+// Set the pair's sticky member URN ONLY IF IT HAS NONE: the member is written once and never replaced,
+// so a write still in flight from an act that timed out cannot overwrite the URN a later act already
+// chose and listed. The caller reads the entry back and applies whatever member it holds.
+function persistMemberUpdate(meetingPointUri, participantUri, member) {
+  const s = iriRef(attendanceSubject(meetingPointUri, participantUri));
+  return `
+    INSERT { ${s} <${MEMBER}> ${stringLiteral(member)} }
+    WHERE { FILTER NOT EXISTS { ${s} <${MEMBER}> ?member } }
+  `;
+}
+
+/** Replace the pair's recorded act `{ activityUri, published, change }`; its member is left as persisted. */
+function recordAttendanceUpdate(meetingPointUri, participantUri, { activityUri, published, change }) {
+  const s = iriRef(attendanceSubject(meetingPointUri, participantUri));
  return `
    DELETE { ${s} ?p ?o }
    INSERT { ${s} <${ACT}> ${iriRef(activityUri)} ; <${PUBLISHED}> ${stringLiteral(published)} ; <${CHANGE}> ${stringLiteral(change)} }
@@ -66,23 +98,41 @@ const termValue = term => (term && typeof term === 'object' ? term.value : term)

 // ── Store operations: `ctx` is a moleculer context (anything with `call`) ──

-/** The last act applied for the pair, `{ activityUri, published, change }`, or undefined. */
-async function lastAttendance(ctx, { dataset, meetingPointUri, memberUri }) {
-  const rows = await ctx.call('triplestore.query', { query: lastAttendanceQuery(meetingPointUri, memberUri), dataset, webId: 'system' });
+/**
+ * The pair's entry, `{ activityUri, published, change, member }`, or undefined when no URN was ever
+ * chosen for it. `member` is always set when a row is returned; the act fields are undefined when a
+ * member was persisted but no act recorded yet (a first act that failed before recording).
+ */
+async function lastAttendance(ctx, { dataset, meetingPointUri, participantUri }) {
+  const rows = await ctx.call('triplestore.query', { query: lastAttendanceQuery(meetingPointUri, participantUri), dataset, webId: 'system' });
  const row = Array.isArray(rows) ? rows[0] : undefined;
  if (!row) return undefined;
-  return { activityUri: termValue(row.act), published: termValue(row.published), change: termValue(row.change) };
+  return { activityUri: termValue(row.act), published: termValue(row.published), change: termValue(row.change), member: termValue(row.member) };
 }

-async function recordAttendance(ctx, { dataset, meetingPointUri, memberUri, act }) {
-  await ctx.call('triplestore.update', { query: recordAttendanceUpdate(meetingPointUri, memberUri, act), dataset, webId: 'system' });
+/**
+ * Persist `member` as the pair's sticky URN unless it already has one — before any attendee-list write
+ * (see the header) — then resolve the member the entry holds NOW: `member` itself, or the one another
+ * act persisted first. The caller applies that one, never its own candidate.
+ */
+async function persistMember(ctx, { dataset, meetingPointUri, participantUri, member }) {
+  await ctx.call('triplestore.update', { query: persistMemberUpdate(meetingPointUri, participantUri, member), dataset, webId: 'system' });
+  const entry = await lastAttendance(ctx, { dataset, meetingPointUri, participantUri });
+  if (!entry || !entry.member) throw new Error(`the member URN of ${participantUri} on ${meetingPointUri} could not be persisted`);
+  return entry.member;
+}
+
+async function recordAttendance(ctx, { dataset, meetingPointUri, participantUri, act }) {
+  await ctx.call('triplestore.update', { query: recordAttendanceUpdate(meetingPointUri, participantUri, act), dataset, webId: 'system' });
 }

 module.exports = {
  attendanceSubject,
  lastAttendanceQuery,
+  persistMemberUpdate,
  recordAttendanceUpdate,
  isNewerAct,
  lastAttendance,
+  persistMember,
  recordAttendance
 };
@@ -4,14 +4,17 @@ const CONFIG = require('../config/config');
 const { neverThrowingMatcher, verifiedEmit, uriOf } = require('./emitted-activity');
 const { guardedCreateAndAttach } = require('./collection-attach');

-// Attaches an `apods:attendees` collection (and a WAC group of the same members) to every
-// `as:Event` created in a user's pod that this backend learns of through the outbox watcher —
-// plain events as well as meeting points (observed 2026-10-12). A join adds the actor to it.
+// Attaches an `apods:attendees` collection to every `as:Event` created in a user's pod that this
+// backend learns of through the outbox watcher — plain events as well as meeting points (observed
+// 2026-10-12). A join adds the participant's MEMBER URN to it (never a WebID — see
+// registration.service.js, member-urn.js and decision_2026-10-29_participation-privacy-mechanism),
+// so the collection's members are opaque URNs only readers of the participant's secret (they, their
+// contacts, the app) can recognise, and no WAC group mirrors them.
 //
 // Who may read the collection: the pod creates it world-readable (`acl:Read` for `foaf:Agent`) — a
-// platform default, observed 2026-10-12, not a choice made here. Whether attendee lists of a PUBLIC
-// event SHOULD be world-readable is an open product question (the functional-domain doctrine places
-// participation in the protected scope); this service does not settle it. What it does settle: the
+// platform default, observed 2026-10-12, not a choice made here. The collection is the PUBLIC
+// surface of a participation: a count of opaque members, no identity (the model, per
+// knowledge_data-scopes-and-discovery — not an open question). What this service settles: the
 // collection it creates never stays more readable than its event. Once attached, it records that
 // collection's public read as Festipod's (`public-read.recordCreated`) and asks `public-read.reconcile`
 // to align the event AND its collection with the event's current public intent — granted while the
@@ -26,7 +29,9 @@ module.exports = {
      ordered: false,
      summary: 'Meeting point attendees'
    },
-    createWacGroup: true
+    // Members are member URNs, not agents — a mirrored WAC group would be meaningless
+    // (decision_2026-10-29_participation-privacy-mechanism).
+    createWacGroup: false
  },
  dependencies: ['public-read'],
  // The mixin's create handler would act on the object embedded in the (unauthenticated) webhook
@@ -1,5 +1,5 @@
 // The path the backend is served under, read from its base URL (SEMAPPS_HOME_URL): `/` when the
-// backend owns its origin (http://localhost:3003 locally), `/api/` when it shares the front end's
+// backend owns its origin (http://localhost:3005 locally), `/api/` when it shares the front end's
 // origin (https://<host>/api/, the Coolify layout, where one base URL per environment keeps pull
 // request previews on a single host). The proxy in front passes the path through unchanged; SemApps
 // mounts every route it adds under the base path, except the `/.well-known` ones, which stay at the
@@ -2,7 +2,7 @@
 * The catalog index, persisted in the backend's own triplestore so it survives a
 * backend restart (it used to be process memory).
 *
- * WHERE IT LIVES. In the backend's main dataset (`settings`), in the DEFAULT graph.
+ * WHERE IT LIVES. In the backend's main dataset (`SEMAPPS_MAIN_DATASET`), in the DEFAULT graph.
 * Not in a dedicated named graph: that dataset is assembled from TDB2 graphs, and only
 * the graphs its assembler declares are TDB2-backed — a triple written to any other
 * named graph is held in memory by Fuseki and lost when Fuseki restarts (verified on
@@ -22,6 +22,19 @@ function arrayOf(value) {
 */
 const isListable = item => hasListedPublicIntent(item);

+/**
+ * The creator attribution a catalog item carries — `dc:creator` as the event
+ * resource serves it, publicly: a bare IRI string or an embedded `{ id }`.
+ * An item without one was indexed from a resource that names no creator; it
+ * can never match an owner filter.
+ */
+function creatorOf(item) {
+  const creator = item?.['dc:creator'];
+  if (typeof creator === 'string') return creator;
+  if (creator && typeof creator === 'object' && typeof creator.id === 'string') return creator.id;
+  return undefined;
+}
+
 module.exports = {
  name: 'catalog',
  mixins: [PodResourcesHandlerMixin],
@@ -109,11 +122,16 @@ module.exports = {
  },
  actions: {
    discover: {
+      // An `owner` narrows the listing to what that actor declared — the
+      // catalog snapshot IS the event resource as the pod served it, with its
+      // public `dc:creator` attribution, so the filter judges the same body the
+      // listing serves. Without `owner`, every listed item is served, unchanged.
      async handler(ctx) {
+        const { owner } = ctx.params ?? {};
        const { items, invalid } = await listEntries(ctx, { dataset: CONFIG.MAIN_DATASET });
        if (invalid.length > 0) this.logger.warn(`Catalog skipped unreadable entries: ${invalid.join(', ')}`);
        // Filtered on every read, whatever wrote the store: only listed public items are served.
-        const listed = items.filter(isListable);
+        const listed = items.filter(item => isListable(item) && (owner === undefined || creatorOf(item) === owner));
        return {
          '@context': 'https://www.w3.org/ns/activitystreams',
          type: 'Collection',
@@ -403,6 +403,56 @@ describe('catalog listing — only listed public items are served, shape unchang
  });
 });

+describe('catalog discover — the owner filter narrows the listing to what an actor declared', () => {
+  const rowOf = item => ({ uri: { value: item.id }, snapshot: { value: JSON.stringify(item) } });
+  // Declared events carry the creator attribution the pod serves publicly, as
+  // a bare IRI or embedded — both forms must be matched.
+  const alices = { ...listedEvent(ALICE), 'dc:creator': ALICE };
+  const alicesEmbedded = { ...listedEvent(ALICE), id: `${ALICE}/data/e2`, 'dc:creator': { id: ALICE } };
+  const bobs = { ...listedEvent(BOB), 'dc:creator': BOB };
+  const noCreator = listedEvent('http://localhost:3000/carol');
+  // Not listed, even though it is Alice's: the owner filter applies AFTER the
+  // listing rule, so a non-public event of hers is never served to anyone.
+  const alicesUnlisted = { ...event(ALICE, { to: BOB, content: 'only for a friend' }), 'dc:creator': ALICE };
+  const stored = () => [rowOf(alices), rowOf(alicesEmbedded), rowOf(bobs), rowOf(noCreator), rowOf(alicesUnlisted)];
+
+  test('with an owner, only their listed items are served — dc:creator as a string or an embedded id', async () => {
+    const { svc } = service();
+    const ctx = Object.assign(store({ rows: stored() }), { params: { owner: ALICE } });
+    const result = await catalog.actions.discover.handler.call(svc, ctx);
+    expect(result.items).toEqual([alices, alicesEmbedded]);
+    expect(result.totalItems).toBe(2);
+    expect(JSON.stringify(result)).not.toContain('only for a friend');
+  });
+
+  test('another owner gets only their own; the unlisted and creator-less items never match', async () => {
+    const { svc } = service();
+    const result = await catalog.actions.discover.handler.call(
+      svc,
+      Object.assign(store({ rows: stored() }), { params: { owner: BOB } })
+    );
+    expect(result.items).toEqual([bobs]);
+    expect(result.totalItems).toBe(1);
+
+    // An owner nobody matches: an honest empty listing.
+    const nobody = await catalog.actions.discover.handler.call(
+      svc,
+      Object.assign(store({ rows: stored() }), { params: { owner: 'http://localhost:3000/dan' } })
+    );
+    expect(nobody.items).toEqual([]);
+    expect(nobody.totalItems).toBe(0);
+  });
+
+  test('without owner (or without params at all) every listed item is served, unchanged', async () => {
+    const { svc } = service();
+    const all = [alices, alicesEmbedded, bobs, noCreator];
+    const bare = await catalog.actions.discover.handler.call(svc, store({ rows: stored() }));
+    expect(bare.items).toEqual(all);
+    const emptyParams = await catalog.actions.discover.handler.call(svc, Object.assign(store({ rows: stored() }), { params: {} }));
+    expect(emptyParams.items).toEqual(all);
+  });
+});
+
 describe('catalog startup — entries it would not serve are removed from its store', () => {
  const rowOf = item => ({ uri: { value: item.id }, snapshot: { value: JSON.stringify(item) } });

@@ -1,5 +1,5 @@
-// The `createAndAttach` action every Festipod collection handler uses (attendees, contacts), in place
-// of the one `PodCollectionsHandlerMixin` (@activitypods/app 2.3.2) gives them.
+// The `createAndAttach` action every Festipod collection handler uses (attendees, contacts,
+// participations), in place of the one `PodCollectionsHandlerMixin` (@activitypods/app 2.3.2) gives them.
 //
 // The mixin's version calls `pod-collections.createAndAttach`, then derives a WAC group slug from the
 // collection URI it returns. That call returns undefined when it attaches nothing — the resource
@@ -2,6 +2,7 @@ const { test, expect, describe } = require('bun:test');
 const { PodCollectionsHandlerMixin } = require('@activitypods/app');
 const attendees = require('./attendees.service');
 const contacts = require('./contacts.service');
+const participations = require('./participations.service');

 const ALICE = 'http://localhost:3000/alice';
 const MALLORY = 'http://localhost:3000/mallory';
@@ -11,7 +12,7 @@ const PROFILE = `${ALICE}/data/profiles/me`;
 const CREATE = `${ALICE}/data/activities/create-1`;

 /** A schema bound like moleculer binds it: mixin methods first, the service's own over them. */
-function bind(schema, pod, { attached, groupFails = false } = {}) {
+function bind(schema, pod, { attached, groupFails = false, recordFails = false } = {}) {
  const logs = { info: [], warn: [], error: [] };
  const calls = [];
  const ctx = {
@@ -23,6 +24,7 @@ function bind(schema, pod, { attached, groupFails = false } = {}) {
      }
      if (action === 'pod-collections.createAndAttach') return attached;
      if (action === 'pod-wac-groups.create' && groupFails) throw new Error('group creation failed');
+      if (action === 'public-read.recordCreated' && recordFails) throw new Error('record failed');
      return undefined;
    }
  };
@@ -45,25 +47,25 @@ const created = objectUri => ({ id: CREATE, type: 'Create', actor: ALICE, object
 const actions = calls => calls.map(c => c.action);

 describe('attendees — a verified Create attaches the collection, then aligns its public read with the event', () => {
-  test('a public event: collection attached, group created, then public-read.reconcile on the event', async () => {
+  test('a public event: collection attached, recorded, then reconciled — NO WAC group (members are member URNs, not agents)', async () => {
    const { calls, emit } = bind(attendees, { [CREATE]: created(E), [E]: { id: E, type: 'Event', to: 'as:Public' } }, { attached: C });
    await emit('create', created(E), ALICE);
    expect(actions(calls).filter(a => a !== 'pod-resources.get')).toEqual([
      'pod-collections.createAndAttach',
      'public-read.recordCreated',
-      'pod-wac-groups.create',
      'public-read.reconcile'
    ]);
+    expect(actions(calls)).not.toContain('pod-wac-groups.create');
    expect(calls.find(c => c.action === 'public-read.recordCreated').params).toEqual({ resourceUri: C, actorUri: ALICE });
    expect(calls.find(c => c.action === 'public-read.reconcile').params).toEqual({ resourceUri: E, actorUri: ALICE });
  });

-  test('the collection is recorded as Festipod\'s even when the WAC group creation after the attach fails', async () => {
-    const { calls, emit, logs } = bind(attendees, { [CREATE]: created(E), [E]: { id: E, type: 'Event', name: 'private' } }, { attached: C, groupFails: true });
+  test('the reconcile still runs when the recording right after the attach fails', async () => {
+    const { calls, emit, logs } = bind(attendees, { [CREATE]: created(E), [E]: { id: E, type: 'Event', name: 'private' } }, { attached: C, recordFails: true });
    await emit('create', created(E), ALICE);
    const order = actions(calls).filter(a => a !== 'pod-resources.get');
-    expect(order).toEqual(['pod-collections.createAndAttach', 'public-read.recordCreated', 'pod-wac-groups.create', 'public-read.reconcile']);
-    expect(logs.error.some(m => m.includes('group creation failed'))).toBe(true);
+    expect(order).toEqual(['pod-collections.createAndAttach', 'public-read.recordCreated', 'public-read.reconcile']);
+    expect(logs.error.some(m => m.includes('record failed'))).toBe(true);
  });

  test('a PRIVATE event: its collection is reconciled too (the pod made it world-readable; it must not stay so)', async () => {
@@ -125,3 +127,29 @@ describe('contacts — the webhook is a hint, and nothing attached creates no gr
    expect(logs.error).toEqual([]);
  });
 });
+
+describe('participations — attached at a sign-up only, through the guarded createAndAttach', () => {
+  const profile = { id: PROFILE, type: ['as:Profile', 'vcard:Individual'] };
+
+  test('a profile Create attaches nothing: the service handles no activity', () => {
+    expect(Object.keys(participations.activities)).toEqual([]);
+  });
+
+  test('createAndAttach on the profile, with the participations predicate, and no WAC group', async () => {
+    const { svc, calls } = bind(participations, { [PROFILE]: profile }, { attached: `${ALICE}/data/as/collection/p1` });
+    const uri = await svc.actions.createAndAttach({ resourceUri: PROFILE, actorUri: ALICE });
+    expect(uri).toBe(`${ALICE}/data/as/collection/p1`);
+    expect(calls.find(c => c.action === 'pod-collections.createAndAttach').params).toMatchObject({
+      resourceUri: PROFILE,
+      attachPredicate: 'http://festipod.org/participations',
+      actorUri: ALICE
+    });
+    expect(actions(calls)).not.toContain('pod-wac-groups.create');
+  });
+
+  test('nothing attached: undefined, nothing thrown', async () => {
+    const { svc, logs } = bind(participations, { [PROFILE]: profile }, { attached: undefined });
+    await expect(svc.actions.createAndAttach({ resourceUri: PROFILE, actorUri: ALICE })).resolves.toBeUndefined();
+    expect(logs.error).toEqual([]);
+  });
+});
@@ -0,0 +1,55 @@
+// The items of a pod collection, read and checked with the pod's answer SEEN.
+//
+// The platform's `pod-collections` service (@activitypods/app 2.3.2) hides a failure of the pod:
+// `getItems` answers `[]` whatever the GET returned (it never looks at the status), and `add` /
+// `remove` resolve normally when the pod refuses the PATCH (a status ≥ 400 is only logged). A
+// decision taken on such an answer is wrong without anything saying so: a Leave read against a
+// failed read finds nobody to remove, and an act whose write was refused is recorded as applied.
+//
+// So the backend reads a collection through `pod-resources.get`, where the status is visible, and
+// verifies every write by reading the collection back. The writes themselves stay the platform's
+// calls (`pod-collections.add` / `.remove`, through the collection handlers' `add` / `remove`).
+//
+//   readItems(ctx, { collectionUri, actorUri }) → the item URIs; throws unless the pod answers 200
+//     with that very collection, its items inline (a paged collection is not read here: its items
+//     are not in the root, and reading them as "none" is the defect this module exists to avoid).
+//   expectItem(ctx, { collectionUri, itemUri, actorUri, present }) → resolves when the collection,
+//     read again, holds `itemUri` (`present`) or does not (`!present`); throws otherwise — the write
+//     just made did not take effect.
+
+const { arrayOf } = require('@semapps/ldp');
+const { uriOf } = require('./emitted-activity');
+
+const AS = 'https://www.w3.org/ns/activitystreams#';
+
+/** The item URIs a collection node lists inline, under any spelling of `items` / `orderedItems`. */
+function itemsOf(collection) {
+  const keys = ['items', 'orderedItems', 'as:items', 'as:orderedItems', `${AS}items`, `${AS}orderedItems`];
+  const value = keys.map(key => collection[key]).find(v => v !== undefined);
+  return arrayOf(value)
+    .map(uriOf)
+    .filter(uri => typeof uri === 'string');
+}
+
+/** Whether a collection root sends its items to pages (`first`) instead of listing them. */
+const isPaged = collection =>
+  ['first', 'as:first', `${AS}first`].some(key => collection[key] !== undefined) && itemsOf(collection).length === 0;
+
+async function readItems(ctx, { collectionUri, actorUri }) {
+  const { status, body } = await ctx.call('pod-resources.get', { resourceUri: collectionUri, actorUri });
+  if (status !== 200 || !body || typeof body !== 'object') {
+    throw new Error(`the pod does not return the collection ${collectionUri} (HTTP ${status})`);
+  }
+  if (uriOf(body) !== collectionUri) throw new Error(`the pod returned another resource for ${collectionUri}`);
+  if (isPaged(body)) throw new Error(`the collection ${collectionUri} is paged: its items cannot be read from its root`);
+  return itemsOf(body);
+}
+
+async function expectItem(ctx, { collectionUri, itemUri, actorUri, present }) {
+  const holds = (await readItems(ctx, { collectionUri, actorUri })).includes(itemUri);
+  if (holds !== present) {
+    throw new Error(`${collectionUri} ${present ? 'does not hold' : 'still holds'} ${itemUri} after the ${present ? 'add' : 'remove'}: the pod did not apply it`);
+  }
+}
+
+module.exports = { itemsOf, readItems, expectItem };
@@ -0,0 +1,64 @@
+const { test, expect, describe } = require('bun:test');
+const { itemsOf, readItems, expectItem } = require('./collection-items');
+
+const C = 'http://localhost:3000/alice/data/as/collection/c1';
+const ALICE = 'http://localhost:3000/alice';
+const A = 'urn:festipod:userref:aa';
+const B = 'urn:festipod:userref:bb';
+
+/** A ctx whose `pod-resources.get` answers `reply` (a `{ status, body }`, or a function of the call). */
+const pod = reply => {
+  const calls = [];
+  return {
+    calls,
+    call: async (action, params) => {
+      calls.push({ action, params });
+      if (action !== 'pod-resources.get') throw new Error(`unexpected call ${action}`);
+      return typeof reply === 'function' ? reply(params) : reply;
+    }
+  };
+};
+const collection = extra => ({ status: 200, body: { id: C, type: 'Collection', ...extra } });
+
+describe('itemsOf — the item URIs a collection lists inline', () => {
+  test('every spelling of items / orderedItems; strings and nodes; none', () => {
+    expect(itemsOf({ items: [A, B] })).toEqual([A, B]);
+    expect(itemsOf({ items: A })).toEqual([A]);
+    expect(itemsOf({ items: [{ id: A }, { '@id': B }] })).toEqual([A, B]);
+    expect(itemsOf({ orderedItems: [A] })).toEqual([A]);
+    expect(itemsOf({ 'as:items': [A] })).toEqual([A]);
+    expect(itemsOf({ 'https://www.w3.org/ns/activitystreams#items': [{ '@id': A }] })).toEqual([A]);
+    expect(itemsOf({ totalItems: 0 })).toEqual([]);
+  });
+});
+
+describe('readItems — a failed read throws, it never means "empty"', () => {
+  test('a 200 with the collection: its items, read as the given actor', async () => {
+    const ctx = pod(collection({ items: [A, B] }));
+    expect(await readItems(ctx, { collectionUri: C, actorUri: ALICE })).toEqual([A, B]);
+    expect(ctx.calls).toEqual([{ action: 'pod-resources.get', params: { resourceUri: C, actorUri: ALICE } }]);
+    expect(await readItems(pod(collection({ totalItems: 0 })), { collectionUri: C, actorUri: ALICE })).toEqual([]);
+  });
+
+  test('any other status, no body, another resource, a paged root: throws', async () => {
+    for (const status of [0, 401, 403, 404, 500]) {
+      await expect(readItems(pod({ status }), { collectionUri: C, actorUri: ALICE })).rejects.toThrow(`(HTTP ${status})`);
+    }
+    await expect(readItems(pod({ status: 200 }), { collectionUri: C, actorUri: ALICE })).rejects.toThrow('does not return the collection');
+    await expect(readItems(pod({ status: 200, body: { id: `${C}-other`, items: [A] } }), { collectionUri: C, actorUri: ALICE })).rejects.toThrow('another resource');
+    await expect(readItems(pod(collection({ first: `${C}?page=1`, totalItems: 3 })), { collectionUri: C, actorUri: ALICE })).rejects.toThrow('is paged');
+  });
+});
+
+describe('expectItem — a write is checked by reading the collection back', () => {
+  test('present after an add, absent after a remove: resolves', async () => {
+    await expect(expectItem(pod(collection({ items: [A] })), { collectionUri: C, itemUri: A, actorUri: ALICE, present: true })).resolves.toBeUndefined();
+    await expect(expectItem(pod(collection({ items: [B] })), { collectionUri: C, itemUri: A, actorUri: ALICE, present: false })).resolves.toBeUndefined();
+  });
+
+  test('a write that did not take effect, or a read-back that fails: throws', async () => {
+    await expect(expectItem(pod(collection({ items: [B] })), { collectionUri: C, itemUri: A, actorUri: ALICE, present: true })).rejects.toThrow(`does not hold ${A} after the add`);
+    await expect(expectItem(pod(collection({ items: [A] })), { collectionUri: C, itemUri: A, actorUri: ALICE, present: false })).rejects.toThrow(`still holds ${A} after the remove`);
+    await expect(expectItem(pod({ status: 500 }), { collectionUri: C, itemUri: A, actorUri: ALICE, present: false })).rejects.toThrow('(HTTP 500)');
+  });
+});
@@ -25,10 +25,12 @@ module.exports = {
    },
    api: {
      port: CONFIG.PORT,
-      // In front of EVERY route — these below and the ones CoreService's services add (the LDP
-      // catch-all among them, which with `webacl: false` would serve the whole `settings` dataset,
-      // the app's private key included): only the allow-listed public endpoints pass, anything else
-      // is a 404 for every caller. See public-surface.js.
+      // In front of EVERY route — these below and the ones CoreService's services add, the LDP
+      // catch-all among them: only the allow-listed public endpoints pass, anything else is a 404 for
+      // every caller. WebACL already filters what the catch-all serves (the main dataset is a secure
+      // one); the gate is defence in depth, so that a resource whose rights are too wide is still not
+      // served over HTTP — the backend's own services reach its data through internal calls. See
+      // public-surface.js.
      use: [createPublicSurfaceGate(BASE_PATH)],
      routes: [
        {
@@ -81,12 +83,10 @@ module.exports = {
        }
      ]
    },
-    webacl: false,
    void: false,
-    // No public SPARQL endpoint. CoreService mounts one at `/sparql` unless this is `false`, and
-    // with `webacl: false` it answers anonymous queries over the whole `settings` dataset — the
-    // app actor's key, the webhook listener URLs, the catalog store and, locally, the pod
-    // provider's accounts (observed 2026-10-12). Nothing in Festipod queries it.
+    // No public SPARQL endpoint. CoreService mounts one at `/sparql` unless this is `false`; WebACL
+    // would filter its answers by the caller's rights, but nothing in Festipod queries it, so it is
+    // not mounted at all (defence in depth, like the gate above).
    sparqlEndpoint: false
  }
 };
@@ -1,5 +1,7 @@
-// What the backend may believe about an activity its watcher reports — the check in front of every
-// Festipod handler fed by that watcher (public-read, catalog, attendees, contacts, registration).
+// What the backend may believe about an activity its watcher reports, or a server delivers to the
+// app's inbox — the check in front of every Festipod handler fed by that watcher (public-read,
+// catalog, attendees, contacts) or by that inbox (registration). A delivered body, like a webhook
+// body, is only a pointer.
 //
 // THE WEBHOOK IS A HINT, NOT A SOURCE. The webhook route (`/.webhooks/:uuid`) is unauthenticated: the
 // listener only matches the uuid, the watcher derives the box owner from the body's `target`, and an
@@ -16,7 +18,11 @@
 //     activity must lie in that owner's pod and the stored activity must name that owner as `actor`;
 //   - an INBOX notification does not (`verifiedReceive`): the emitter is the stored activity's own
 //     `actor`, believed only because the activity lies in THAT actor's pod — someone else's claim
-//     about an actor cannot be stored there.
+//     about an actor cannot be stored there;
+//   - a DELIVERY to the app's own inbox names its emitter (`verifiedDelivery`): the inbox accepts it
+//     only signed by the activity's `actor` (@semapps/activitypub 1.2.7 `inbox.post` refuses an actor
+//     other than the signer, INVALID_ACTOR). Nothing else in the body is believed: the activity must
+//     lie in that actor's pod and the copy stored there name them.
 //
 // An activity is accepted only when all of this holds:
 //   1. it is identified by a URI (an embedded activity without an id was never stored);
@@ -71,7 +77,11 @@ function asTypesOf(node) {
  });
 }

-const hasAsType = (node, name) => asTypesOf(node).includes(AS + name);
+// `name` is an AS name (`Event`), an `as:` name, or a full IRI: only bare names get the AS namespace.
+const hasAsType = (node, name) => {
+  const iri = name.startsWith('as:') ? AS + name.slice('as:'.length) : name.includes(':') ? name : AS + name;
+  return asTypesOf(node).includes(iri);
+};

 const ACTIVITY_TYPES = new Set(['Create', 'Update', 'Delete', 'Join', 'Leave']);

@@ -83,13 +93,14 @@ const ANY_POD = Symbol('any pod');
 *   { ok: true, activity, emitterUri, objectUri, object }   (object: the stored object; undefined for a Delete)
 *   { ok: false, reason }
 *
- * `activity` is what the watcher handed over (a URI or a node — only its id is used). `type` is the
- * activity type the handler expects. `emitterUri` is the owner of the outbox the notification names,
- * or `null` for an inbox notification (the emitter is then the stored activity's actor). The object
- * must lie in the pod of `objectOwnerUri`, or anywhere with `ANY_POD`. `objectType` is the
- * ActivityStreams type the stored object must declare (`Event`, `Profile`; not checked for a Delete).
- * `read(uri)` reads a resource as the box owner and resolves `{ status, body }` (`status` 0 when the
- * request itself failed). Never throws for a refusal; a throwing `read` propagates.
+ * `activity` is what the watcher or the app's inbox handed over (a URI or a node — only its id is
+ * used). `type` is the activity type the handler expects. `emitterUri` is the owner of the outbox the
+ * notification names, the `actor` the app's inbox verified as the signer of a delivery, or `null` for
+ * an inbox notification (the emitter is then the stored activity's actor). The object must lie in the
+ * pod of `objectOwnerUri`, or anywhere with `ANY_POD`. `objectType` is the type the stored object
+ * must declare — an ActivityStreams name or a full IRI; not checked for a Delete. `read(uri)` reads a
+ * resource as the box owner — for a delivery, as its emitter — and resolves `{ status, body }`
+ * (`status` 0 when the request itself failed). Never throws for a refusal; a throwing `read` propagates.
 */
 async function verifyActivity({ activity, type, emitterUri, objectOwnerUri, objectType, read }) {
  if (!ACTIVITY_TYPES.has(type)) throw new Error(`Unsupported activity type ${type}`);
@@ -195,7 +206,8 @@ function verifiedHandler(box, type, handle, verify) {
 * An `onEmit` (outbox handler) that runs `handle(ctx, verdict, actorUri)` only for an activity
 * `verifyActivity` accepts as emitted by `actorUri`, the outbox owner. `objectType` is the type the
 * stored object must declare; `objectIn` is `'emitter'` (default: the object is in the emitter's pod)
- * or `'any'` (the handler checks where the object lies, e.g. the event a Join names).
+ * or `'any'` (the handler checks where the object lies, e.g. the meeting point a Join names, in its
+ * creator's pod).
 */
 function verifiedEmit(type, handle, { objectType, objectIn = 'emitter' } = {}) {
  if (objectIn !== 'emitter' && objectIn !== 'any') throw new Error(`Unknown objectIn ${objectIn}`);
@@ -222,6 +234,45 @@ function verifiedReceive(type, handle, { objectType } = {}) {
  );
 }

+/**
+ * An `onReceive` for the APP's own inbox (`@semapps/activitypub` `ActivitiesHandlerMixin`, whose
+ * third argument is the inbox owner, the app): runs `handle(ctx, verdict, emitterUri)` only for an
+ * activity `verifyActivity` accepts as emitted by the delivered activity's `actor`, the signer the
+ * inbox verified. Before anything is read, the activity's URI must lie in that actor's pod; the
+ * activity and its object are then read through that actor's pod (`podReader`), the stored activity
+ * having to name that same actor. `objectType` and `objectIn` are those of `verifiedEmit`. With
+ * `objectIn: 'any'`, an object outside the actor's pod is read through the proxy THEIR actor document
+ * declares — for an actor on another server, an answer that server chooses: a handler acting on such
+ * an object reads it again where it lies (registration's `meetingPointOf`).
+ */
+function verifiedDelivery(type, handle, { objectType, objectIn = 'emitter' } = {}) {
+  if (objectIn !== 'emitter' && objectIn !== 'any') throw new Error(`Unknown objectIn ${objectIn}`);
+  return async function (ctx, activity, inboxOwnerUri) {
+    try {
+      const claimed = activity && typeof activity === 'object' ? singleUriOf(activity.actor) : undefined;
+      if (!claimed) {
+        this.logger.warn(`${this.name} ignored a ${type} delivered to ${inboxOwnerUri}: it names no single actor`);
+        return;
+      }
+      const verdict = await verifyActivity({
+        activity,
+        type,
+        emitterUri: claimed,
+        objectOwnerUri: objectIn === 'any' ? ANY_POD : claimed,
+        objectType,
+        read: podReader(ctx, claimed)
+      });
+      if (!verdict.ok) {
+        this.logger.warn(`${this.name} ignored a ${type} delivered to ${inboxOwnerUri} as from ${claimed}: ${verdict.reason}`);
+        return;
+      }
+      await handle.call(this, ctx, verdict, verdict.emitterUri);
+    } catch (e) {
+      this.logger.error(`${this.name} could not process a ${type} delivered to ${inboxOwnerUri}: ${e.message}`);
+    }
+  };
+}
+
 module.exports = {
  verifyActivity,
  verifyEmittedActivity,
@@ -229,6 +280,7 @@ module.exports = {
  neverThrowingMatcher,
  verifiedEmit,
  verifiedReceive,
+  verifiedDelivery,
  uriOf,
  singleUriOf,
  hasAsType,
@@ -1,5 +1,5 @@
 const { test, expect, describe } = require('bun:test');
-const { verifyEmittedActivity, verifyActivity, verifiedEmit, verifiedReceive, neverThrowingMatcher, ANY_POD } = require('./emitted-activity');
+const { verifyEmittedActivity, verifyActivity, verifiedEmit, verifiedReceive, verifiedDelivery, neverThrowingMatcher, ANY_POD } = require('./emitted-activity');

 const ALICE = 'http://localhost:3000/alice';
 const BOB = 'http://localhost:3000/bob';
@@ -264,3 +264,128 @@ describe('verifiedReceive / verifiedEmit with objectIn "any"', () => {
    expect(svc.logger.w).toContain(`not in the pod of ${BOB}`);
  });
 });
+
+describe('verifiedEmit — a Join from a participant\'s outbox', () => {
+  const MP = `${ALICE}/data/events/mp1`;
+  const JOIN = `${BOB}/outbox/join-1`;
+  const join = { id: JOIN, type: 'Join', actor: BOB, object: MP };
+
+  test('the activity AND the meeting point are read through the outbox owner\'s access, the stored object handed over', async () => {
+    const reads = [];
+    const stored = { [JOIN]: join, [MP]: { id: MP, type: 'Event', context: `${ALICE}/data/events/e1` } };
+    const ctx = {
+      call: async (action, params) => {
+        reads.push([action, params.resourceUri, params.actorUri]);
+        const body = stored[params.resourceUri];
+        return body ? { status: 200, body } : { status: 404 };
+      }
+    };
+    const ran = [];
+    const service = { name: 'test', logger: { info() {}, warn() {}, error() {} } };
+    // The webhook body claims another object: only the stored one counts.
+    await verifiedEmit('Join', async (_ctx, verdict) => ran.push(verdict.object), { objectType: 'Event', objectIn: 'any' })
+      .call(service, ctx, { ...join, object: { id: `${ALICE}/data/events/other`, type: 'Event' } }, BOB);
+    expect(reads).toEqual([['pod-resources.get', JOIN, BOB], ['pod-resources.get', MP, BOB]]);
+    expect(ran).toEqual([stored[MP]]);
+  });
+
+  test('a Join whose stored actor is not the outbox owner is refused', async () => {
+    const ctx = { call: async (_action, { resourceUri }) => (resourceUri === JOIN ? { status: 200, body: { ...join, actor: ALICE } } : { status: 200, body: { id: MP, type: 'Event' } }) };
+    const ran = [];
+    const service = { name: 'test', logger: { info() {}, warn(m) { this.w = m; }, error() {} } };
+    await verifiedEmit('Join', async () => ran.push(true), { objectType: 'Event', objectIn: 'any' }).call(service, ctx, join, BOB);
+    expect(ran).toEqual([]);
+    expect(service.logger.w).toContain('not attributed to');
+  });
+});
+
+describe("verifiedDelivery — a Join delivered to the app's inbox: the body's actor is a claim", () => {
+  const APP = 'http://localhost:3005/as/actor/app';
+  const MALLORY = 'http://localhost:3000/mallory';
+  const MP = `${ALICE}/data/events/mp1`;
+  const JOIN = `${BOB}/data/activities/join-1`;
+  const join = { id: JOIN, type: 'Join', actor: BOB, object: MP, to: APP };
+  const meetingPoint = { id: MP, type: 'Event', context: `${ALICE}/data/events/e1` };
+
+  /** A pod answering `stored` (uri → body), recording every read as [uri, actorUri]. */
+  function setup(stored = { [JOIN]: join, [MP]: meetingPoint }) {
+    const reads = [];
+    const ctx = {
+      call: async (_action, { resourceUri, actorUri }) => {
+        reads.push([resourceUri, actorUri]);
+        const body = stored[resourceUri];
+        return body ? { status: 200, body } : { status: 404 };
+      }
+    };
+    const logs = { warn: [], error: [] };
+    const service = { name: 'test', logger: { info() {}, warn: m => logs.warn.push(m), error: m => logs.error.push(m) } };
+    const ran = [];
+    const deliver = (body, options = { objectType: 'Event', objectIn: 'any' }, handle = async (_ctx, verdict, emitterUri) => ran.push([emitterUri, verdict.object])) =>
+      verifiedDelivery('Join', handle, options).call(service, ctx, body, APP);
+    return { reads, logs, ran, deliver };
+  }
+
+  test("the normal case: the claimed actor's pod holds the activity naming them — the handler runs for them, on the STORED object, everything read through their pod", async () => {
+    const w = setup();
+    await w.deliver({ ...join, object: { id: `${ALICE}/data/events/other`, type: 'Event' } });
+    expect(w.ran).toEqual([[BOB, meetingPoint]]);
+    expect(w.reads).toEqual([[JOIN, BOB], [MP, BOB]]);
+    expect(w.logs.warn).toEqual([]);
+  });
+
+  test("a body claiming another actor for an activity of Bob's pod is refused before anything is read", async () => {
+    const w = setup();
+    await w.deliver({ ...join, actor: MALLORY });
+    expect(w.ran).toEqual([]);
+    expect(w.reads).toEqual([]);
+    expect(w.logs.warn.some(m => m.includes(`not in the pod of ${MALLORY}`))).toBe(true);
+  });
+
+  test("an activity held in Mallory's pod claiming Bob as its actor is refused before anything is read", async () => {
+    const forged = `${MALLORY}/data/activities/join-1`;
+    const w = setup({ [forged]: { ...join, id: forged }, [MP]: meetingPoint });
+    await w.deliver({ ...join, id: forged });
+    expect(w.ran).toEqual([]);
+    expect(w.reads).toEqual([]);
+    expect(w.logs.warn.some(m => m.includes(`not in the pod of ${BOB}`))).toBe(true);
+  });
+
+  test("an activity of Bob's pod whose stored copy names someone else is refused", async () => {
+    const w = setup({ [JOIN]: { ...join, actor: ALICE }, [MP]: meetingPoint });
+    await w.deliver(join);
+    expect(w.ran).toEqual([]);
+    expect(w.logs.warn.some(m => m.includes('not attributed to'))).toBe(true);
+  });
+
+  test('a body naming no single actor, or no body at all, is refused without a read', async () => {
+    for (const body of [{ ...join, actor: undefined }, { ...join, actor: [BOB, ALICE] }, JOIN, undefined]) {
+      const w = setup();
+      await w.deliver(body);
+      expect(w.ran).toEqual([]);
+      expect(w.reads).toEqual([]);
+      expect(w.logs.warn.some(m => m.includes('names no single actor'))).toBe(true);
+    }
+  });
+
+  test("an activity the claimed actor's pod does not hold is refused", async () => {
+    const w = setup({ [MP]: meetingPoint });
+    await w.deliver(join);
+    expect(w.ran).toEqual([]);
+    expect(w.logs.warn.some(m => m.includes('does not return the activity'))).toBe(true);
+  });
+
+  test('by default the object must lie in the emitter\'s pod; objectIn "any" lets the handler check it', async () => {
+    const w = setup();
+    await w.deliver(join, { objectType: 'Event' });
+    expect(w.ran).toEqual([]);
+    expect(w.logs.warn.some(m => m.includes(`not in the pod of ${BOB}`))).toBe(true);
+  });
+
+  test('a failing handler or read is logged, never thrown', async () => {
+    const w = setup();
+    await w.deliver(join, { objectType: 'Event', objectIn: 'any' }, async () => {
+      throw new Error('boom');
+    });
+    expect(w.logs.error.some(m => m.includes('boom'))).toBe(true);
+  });
+});
@@ -35,8 +35,10 @@

 // 30 s: a serialized decision makes a handful of pod round-trips — read the object, read up to two
 // ACLs, write up to two (public-read); read, then one store write (catalog); a wait of at most 1.5 s
-// for a fresh collection, a read and one write (attendance) — each answering in tens of milliseconds
-// on the local stack, a few seconds at worst on a loaded one. 30 s is over ten times the slowest
+// for a fresh collection, the participant's participations collection made ready (a profile and an
+// ACL read; at its creation, the create-and-attach, a profile re-read, one ACL write and one group
+// grant), a read, two writes and their two read-backs (attendance) —
+// each answering in tens of milliseconds on the local stack, a few seconds at worst on a loaded one. 30 s is over ten times the slowest
 // legitimate run, and short enough that a stalled pod holds one object's decisions for half a minute
 // rather than until the backend restarts.
 const DEFAULT_TIMEOUT_MS = 30000;
@@ -0,0 +1,53 @@
+// The member URN an attendee list records for a participant, and the secret it is derived from
+// (decision_2026-10-29_participation-privacy-mechanism).
+//
+// THE URN. `urn:festipod:userref:` + the lowercase-hex sha256 of the string
+// "<participant WebID> <event URI> <secret>" (single spaces), where the event URI is the meeting
+// point's anchor (`as:context`). It is the same for one person on every meeting point of one event —
+// so the per-event count of distinct URNs is publicly computable — and unrelated from one event to
+// another. Only whoever can read the secret can compute it: the person, their contacts, the app. The
+// backend computes it from the secret; a client never supplies one, so it cannot inflate a count.
+// ("festipod" here is the URN namespace, unrelated to the http://festipod.org/ vocabulary.)
+//
+// THE SECRET lives in the participant's `as:Profile` under `http://festipod.org/participationSecret`:
+// 32 random bytes as 64 lowercase hex characters, written by the participant's browser before the
+// first sign-up. Anything else — absent, several values, another length, uppercase — is no secret.
+
+const crypto = require('crypto');
+
+const MEMBER_URN_PREFIX = 'urn:festipod:userref:';
+const PARTICIPATION_SECRET = 'http://festipod.org/participationSecret';
+const SECRET_PATTERN = /^[0-9a-f]{64}$/;
+
+const listOf = value => (value === undefined || value === null ? [] : Array.isArray(value) ? value : [value]);
+
+/** The string a JSON-LD value holds: a string, or a value node's `@value`; undefined otherwise. */
+const stringOf = value => {
+  if (typeof value === 'string') return value;
+  if (value && typeof value === 'object' && typeof value['@value'] === 'string') return value['@value'];
+  return undefined;
+};
+
+/**
+ * participationSecretOf(profile) → the participant's secret (64 lowercase hex characters), or
+ * undefined when the profile carries none that is usable. Reads the predicate under its full IRI or
+ * the `fp:` CURIE; exactly one value is accepted.
+ */
+function participationSecretOf(profile) {
+  if (!profile || typeof profile !== 'object') return undefined;
+  const values = listOf(profile[PARTICIPATION_SECRET] ?? profile['fp:participationSecret']);
+  if (values.length !== 1) return undefined;
+  const secret = stringOf(values[0]);
+  return secret !== undefined && SECRET_PATTERN.test(secret) ? secret : undefined;
+}
+
+/** memberUrn({ participantUri, eventUri, secret }) → `urn:festipod:userref:<sha256 hex>`. */
+function memberUrn({ participantUri, eventUri, secret }) {
+  for (const [name, value] of Object.entries({ participantUri, eventUri, secret })) {
+    if (typeof value !== 'string' || value.length === 0) throw new Error(`memberUrn needs a ${name}`);
+  }
+  const digest = crypto.createHash('sha256').update(`${participantUri} ${eventUri} ${secret}`, 'utf8').digest('hex');
+  return MEMBER_URN_PREFIX + digest;
+}
+
+module.exports = { MEMBER_URN_PREFIX, PARTICIPATION_SECRET, participationSecretOf, memberUrn };
@@ -0,0 +1,50 @@
+const { test, expect, describe } = require('bun:test');
+const crypto = require('crypto');
+const { MEMBER_URN_PREFIX, PARTICIPATION_SECRET, participationSecretOf, memberUrn } = require('./member-urn');
+
+const BOB = 'http://localhost:3000/bob';
+const CAROL = 'http://localhost:3000/carol';
+const EVENT = 'http://localhost:3000/alice/data/events/e1';
+const OTHER_EVENT = 'http://localhost:3000/alice/data/events/e2';
+const SECRET = '0123456789abcdef'.repeat(4);
+
+describe('memberUrn — urn:festipod:userref:<sha256("<WebID> <event URI> <secret>")>', () => {
+  test('the contract: the lowercase-hex sha256 of the three values joined by single spaces', () => {
+    const expected = crypto.createHash('sha256').update(`${BOB} ${EVENT} ${SECRET}`).digest('hex');
+    expect(memberUrn({ participantUri: BOB, eventUri: EVENT, secret: SECRET })).toBe(`urn:festipod:userref:${expected}`);
+    expect(MEMBER_URN_PREFIX).toBe('urn:festipod:userref:');
+    expect(memberUrn({ participantUri: BOB, eventUri: EVENT, secret: SECRET })).toMatch(/^urn:festipod:userref:[0-9a-f]{64}$/);
+  });
+
+  test('deterministic for one person and one event; different for another event, person or secret', () => {
+    const base = { participantUri: BOB, eventUri: EVENT, secret: SECRET };
+    const urn = memberUrn(base);
+    expect(memberUrn({ ...base })).toBe(urn);
+    expect(memberUrn({ ...base, eventUri: OTHER_EVENT })).not.toBe(urn);
+    expect(memberUrn({ ...base, participantUri: CAROL })).not.toBe(urn);
+    expect(memberUrn({ ...base, secret: 'f'.repeat(64) })).not.toBe(urn);
+  });
+
+  test('a missing value is a programming error, never a URN', () => {
+    expect(() => memberUrn({ participantUri: BOB, eventUri: undefined, secret: SECRET })).toThrow('eventUri');
+    expect(() => memberUrn({ participantUri: BOB, eventUri: EVENT, secret: '' })).toThrow('secret');
+  });
+});
+
+describe('participationSecretOf — 64 lowercase hex characters under fp:participationSecret, or nothing', () => {
+  test('read under the full IRI, the CURIE, or as a value node', () => {
+    expect(PARTICIPATION_SECRET).toBe('http://festipod.org/participationSecret');
+    expect(participationSecretOf({ [PARTICIPATION_SECRET]: SECRET })).toBe(SECRET);
+    expect(participationSecretOf({ 'fp:participationSecret': SECRET })).toBe(SECRET);
+    expect(participationSecretOf({ [PARTICIPATION_SECRET]: { '@value': SECRET } })).toBe(SECRET);
+    expect(participationSecretOf({ [PARTICIPATION_SECRET]: [SECRET] })).toBe(SECRET);
+  });
+
+  test('absent, malformed or ambiguous: no secret', () => {
+    for (const value of [undefined, '', SECRET.toUpperCase(), SECRET.slice(1), `${SECRET}0`, 'g'.repeat(64), 42, { id: SECRET }, [SECRET, 'f'.repeat(64)]]) {
+      expect(participationSecretOf({ [PARTICIPATION_SECRET]: value })).toBeUndefined();
+    }
+    expect(participationSecretOf(undefined)).toBeUndefined();
+    expect(participationSecretOf({ name: 'Bob' })).toBeUndefined();
+  });
+});
@@ -0,0 +1,299 @@
+// TEST SUPPORT ONLY (required by registration.service.test.js and participations.service.test.js):
+// a fake ActivityPods stack for the participation flow — the pods' resources, collections and ACLs,
+// the backend's attendance ledger and the notifications sent — with the registration and
+// participations services bound to it the way moleculer binds them, so that a call from one service
+// to the other runs the other's real code. Every call is recorded.
+//
+// The platform calls answer as @activitypods/app 2.3.2 does, failures included: `pod-resources.get`
+// carries the pod's status (no body on a failure); `pod-collections.getItems` reads through it and
+// answers `[]` whatever the status; `pod-collections.add` / `.remove` (and the attendees handler's
+// `add` / `remove`, which run them) resolve normally when the pod refuses the PATCH; and
+// `pod-collections.createAndAttach` returns the collection it created even when the pod refuses the
+// PATCH that links it to the resource.
+
+const { PodCollectionsHandlerMixin } = require('@activitypods/app');
+const { arrayOf } = require('@semapps/ldp');
+const registration = require('./registration.service');
+const participations = require('./participations.service');
+
+const HOST = 'http://localhost:3000';
+const APP = 'http://localhost:4005/as/actor/app';
+const ALICE = `${HOST}/alice`; // creates the meeting points
+const BOB = `${HOST}/bob`; // participates
+const CAROL = `${HOST}/carol`; // participates too
+const MALLORY = `${HOST}/mallory`;
+
+const EVENT1 = `${HOST}/dave/data/events/festival`;
+const EVENT2 = `${HOST}/dave/data/events/concert`;
+const FP_SECRET = 'http://festipod.org/participationSecret';
+const FP_PARTICIPATIONS = 'http://festipod.org/participations';
+const SECRETS = { [BOB]: 'b0'.repeat(32), [CAROL]: 'c0'.repeat(32), [ALICE]: 'a0'.repeat(32) };
+
+const profileOf = actorUri => `${actorUri}/data/profiles/me`;
+const contactsOf = actorUri => `${actorUri}/contacts`;
+const groupOf = actorUri => `${HOST}/_groups${new URL(actorUri).pathname}/contacts`;
+const attendeesOf = meetingPointUri => `${meetingPointUri}-attendees`;
+
+const actor = (uri, extra = {}) => ({ id: uri, type: 'Person', url: profileOf(uri), 'apods:contacts': contactsOf(uri), ...extra });
+const profile = (uri, extra = {}) => ({ id: profileOf(uri), type: 'Profile', name: uri.split('/').pop(), [FP_SECRET]: SECRETS[uri], ...extra });
+const meetingPoint = (uri, extra = {}) => ({
+  id: uri,
+  type: 'Event',
+  name: `Rendez-vous ${uri.split('/').pop()}`,
+  context: EVENT1,
+  'dc:creator': ALICE,
+  'apods:attendees': attendeesOf(uri),
+  to: 'as:Public',
+  ...extra
+});
+// The pod stamps `published` on every activity posted to an outbox.
+const activity = (type, actorUri, objectUri, published, n = 1) => ({
+  id: `${actorUri}/data/activities/${type.toLowerCase()}-${objectUri.split('/').pop()}-${n}`,
+  type,
+  actor: actorUri,
+  object: objectUri,
+  published
+});
+
+/**
+ * The ACL the pod gives a collection the app creates: an OWN public read (observed 2026-10-12) and
+ * an OWN `#Control` for the app (observed 2026-10-29 on a participations collection).
+ */
+const createdCollectionAcl = uri => [
+  { '@id': `${HOST}/_acl${new URL(uri).pathname}#Read`, 'acl:mode': 'acl:Read', 'acl:agentClass': 'foaf:Agent' },
+  { '@id': `${HOST}/_acl${new URL(uri).pathname}#Control`, 'acl:mode': 'acl:Control', 'acl:agent': APP }
+];
+
+const ACT = 'http://festipod.org/attendanceAct';
+const MEMBER = 'http://festipod.org/attendanceMember';
+
+/**
+ * world(options) → { ctx, calls, state, registration, participations, logs, emit }
+ *
+ * options: `stored` (uri → body; the default actors and profiles are added), `items` (collection →
+ * items; every collection a stored resource names under `apods:attendees` exists, empty when unset),
+ * `acls` (collection → authorizations), `ledger` (attendance subject → act with its member URN),
+ * `delays` (`read:<uri>`, `create`, `attendees.add`, `attendees.remove`, `pod-collections.add`,
+ * `pod-collections.remove` → ms), `fail`, `timeoutMs` (the registration lock's time limit).
+ *
+ * `fail` (read at each call, so a test may change it between acts): `read` (uri → the status a GET of
+ * it answers, with no body), `attendeesWrite` / `participationsWrite` (the pod refuses every PATCH of
+ * an attendee list / a participations collection: the call resolves, nothing changes, the attempt is
+ * kept in `state.refusedWrites`), `attach` (the pod creates the collection but refuses the PATCH that
+ * links it), `putStatus` (the status of an ACL PUT), `grant`, `aclRead`, `notify`.
+ *
+ * A collection (a key of `state.items`) answers a GET as the pod serves an unpaged collection: its
+ * `items` inline.
+ */
+function world({ stored = {}, items = {}, acls = {}, ledger = {}, delays = {}, fail = {}, proxied = {}, timeoutMs } = {}) {
+  const calls = [];
+  const logs = { info: [], warn: [], error: [] };
+  const logger = { info: m => logs.info.push(m), warn: m => logs.warn.push(m), error: m => logs.error.push(m) };
+  const state = {
+    stored: {
+      [ALICE]: actor(ALICE),
+      [BOB]: actor(BOB),
+      [CAROL]: actor(CAROL),
+      [profileOf(ALICE)]: profile(ALICE),
+      [profileOf(BOB)]: profile(BOB),
+      [profileOf(CAROL)]: profile(CAROL),
+      ...stored
+    },
+    items: JSON.parse(JSON.stringify(items)),
+    acls: JSON.parse(JSON.stringify(acls)),
+    ledger: { ...ledger },
+    notifications: [],
+    created: [],
+    refusedWrites: []
+  };
+  // The attendees handler attached each meeting point's list when the meeting point was created.
+  for (const body of Object.values(state.stored)) {
+    const list = body && body['apods:attendees'];
+    if (typeof list === 'string' && !(list in state.items)) state.items[list] = [];
+  }
+  const wait = ms => (ms ? new Promise(resolve => setTimeout(resolve, ms)) : undefined);
+  const resourceOfAcl = url => url.replace(`${HOST}/_acl`, HOST);
+  /** A GET as the pod answers it (`pod-resources.get`): the status, and the body on a 200 only. */
+  const read = uri => {
+    const failed = fail.read && fail.read[uri];
+    if (failed) return { ok: false, status: failed };
+    if (Object.prototype.hasOwnProperty.call(state.items, uri)) {
+      return { ok: true, status: 200, body: { id: uri, type: 'Collection', items: [...state.items[uri]] } };
+    }
+    const body = state.stored[uri];
+    return body ? { ok: true, status: 200, body } : { ok: false, status: 404 };
+  };
+
+  let registrationSvc;
+  let participationsSvc;
+  const ctx = {
+    call: async (action, params) => {
+      calls.push({ action, params });
+      if (action.startsWith('participations.')) {
+        return participationsSvc.actions[action.slice('participations.'.length)](params);
+      }
+      switch (action) {
+        case 'app.get':
+          return { id: APP };
+        case 'pod-resources.get':
+          await wait(delays[`read:${params.resourceUri}`]);
+          // `proxied[reader][uri]`: what the reader's OWN server answers for a resource outside the
+          // reader's pod — the platform reads it through the proxy the reader's actor document declares.
+          if (proxied[params.actorUri] && params.resourceUri in proxied[params.actorUri] && !params.resourceUri.startsWith(`${params.actorUri}/`)) {
+            return { ok: true, status: 200, body: proxied[params.actorUri][params.resourceUri] };
+          }
+          return read(params.resourceUri);
+        case 'pod-collections.getItems': {
+          // As the platform does: the body's items, whatever the status — `[]` on a failed read.
+          const { body } = read(params.collectionUri);
+          return arrayOf(body?.items || body?.orderedItems);
+        }
+        case 'attendees.add':
+        case 'pod-collections.add':
+        case 'attendees.remove':
+        case 'pod-collections.remove': {
+          // The attendees handler's add/remove run `pod-collections.add`/`.remove` as the creator; the
+          // participations handler's, as the participant. A refused PATCH resolves, as on the platform.
+          await wait(delays[action]);
+          if (fail[action.startsWith('attendees.') ? 'attendeesWrite' : 'participationsWrite']) {
+            state.refusedWrites.push({ action, ...params });
+            return undefined;
+          }
+          const list = (state.items[params.collectionUri] = state.items[params.collectionUri] || []);
+          if (action.endsWith('.add')) {
+            if (!list.includes(params.itemUri)) list.push(params.itemUri);
+          } else {
+            state.items[params.collectionUri] = list.filter(item => item !== params.itemUri);
+          }
+          return undefined;
+        }
+        case 'pod-collections.createAndAttach': {
+          // As the platform does: read the resource, then create, then attach — with a gap between
+          // the read and the attach, where a concurrent creation can slip in. The attach PATCH is not
+          // checked: the created collection's URI is returned even when the pod refused it.
+          const before = state.stored[params.resourceUri];
+          await wait(delays.create === undefined ? 10 : delays.create);
+          if (!before || before[params.attachPredicate] !== undefined) return undefined;
+          const uri = `${params.actorUri}/data/as/collection/participations-${state.created.length + 1}`;
+          state.created.push(uri);
+          state.items[uri] = [];
+          state.acls[uri] = createdCollectionAcl(uri);
+          if (fail.attach) return uri;
+          const current = state.stored[params.resourceUri];
+          const link = { id: uri };
+          const existing = current[params.attachPredicate];
+          state.stored[params.resourceUri] = { ...current, [params.attachPredicate]: existing === undefined ? link : [].concat(existing, link) };
+          return uri;
+        }
+        case 'pod-wac-groups.getUriFromCollectionUri': {
+          const { origin, pathname } = new URL(params.collectionUri);
+          return `${origin}/_groups${pathname}`;
+        }
+        case 'pod-permissions.fetch': {
+          if (fail.aclRead) return { status: 500 };
+          const authorizations = state.acls[resourceOfAcl(params.url)];
+          return authorizations ? { status: 200, body: { '@graph': authorizations } } : { status: 404 };
+        }
+        case 'pod-permissions.add': {
+          if (fail.grant) return false;
+          const acl = (state.acls[params.uri] = state.acls[params.uri] || []);
+          const id = `${HOST}/_acl${new URL(params.uri).pathname}#Read`;
+          let rule = acl.find(a => a['@id'] === id);
+          if (!rule) acl.push((rule = { '@id': id, 'acl:mode': 'acl:Read' }));
+          rule[params.agentPredicate] = [...new Set([].concat(rule[params.agentPredicate] ?? [], params.agentUri))];
+          return true;
+        }
+        case 'signature.proxy.query': {
+          if (params.method !== 'PUT') throw new Error(`unexpected proxy ${params.method} ${params.url}`);
+          if (fail.putStatus) return { status: fail.putStatus };
+          const uri = resourceOfAcl(params.url);
+          const inherited = (state.acls[uri] || []).filter(a => String(a['@id']).includes('#Default'));
+          state.acls[uri] = [...inherited, ...JSON.parse(params.body)['@graph']];
+          return { status: 204 };
+        }
+        case 'triplestore.query': {
+          // As the real SELECT, anchored on `<member> ?member`: no row for an entry without a member;
+          // the act fields unbound (absent) until an act is recorded.
+          const subject = /<(urn:festipod:attendance:[^>]+)>/.exec(params.query)[1];
+          const last = state.ledger[subject];
+          if (!last || last.member === undefined) return [];
+          const row = { member: { value: last.member } };
+          if (last.activityUri !== undefined) Object.assign(row, { act: { value: last.activityUri }, published: { value: last.published }, change: { value: last.change } });
+          return [row];
+        }
+        case 'triplestore.update': {
+          const subject = /<(urn:festipod:attendance:[^>]+)>/.exec(params.query)[1];
+          const entry = (state.ledger[subject] = state.ledger[subject] || {});
+          // `recordAttendance`: replaces the act fields, leaves the member as persisted.
+          const act = new RegExp(`<${ACT}> <([^>]+)> ; <[^>]+> "([^"]*)" ; <[^>]+> "([^"]*)"`).exec(params.query);
+          if (act) {
+            Object.assign(entry, { activityUri: act[1], published: act[2], change: act[3] });
+            return undefined;
+          }
+          // `persistMember`: INSERT … WHERE { FILTER NOT EXISTS { member } } — set only when absent.
+          const member = new RegExp(`<${MEMBER}> "([^"]*)"`).exec(params.query);
+          if (member && entry.member === undefined) entry.member = member[1];
+          return undefined;
+        }
+        case 'pod-notifications.send':
+          if (fail.notify) throw new Error('the app outbox is down');
+          state.notifications.push(params);
+          return undefined;
+        default:
+          throw new Error(`unexpected call ${action}`);
+      }
+    }
+  };
+
+  // The participations service, bound like collection-handlers.test.js binds a collection handler.
+  participationsSvc = {
+    name: participations.name,
+    settings: { ...PodCollectionsHandlerMixin.settings, ...participations.settings },
+    logger,
+    actions: {}
+  };
+  participations.created.call(participationsSvc);
+  for (const [name, fn] of Object.entries({ ...PodCollectionsHandlerMixin.methods, ...participations.methods })) {
+    participationsSvc[name] = fn.bind(participationsSvc);
+  }
+  for (const [name, def] of Object.entries({ ...PodCollectionsHandlerMixin.actions, ...participations.actions })) {
+    participationsSvc.actions[name] = (params, opts) => def.handler.call(participationsSvc, { ...opts, params, call: ctx.call });
+  }
+
+  registrationSvc = { name: registration.name, logger };
+  registration.created.call(registrationSvc);
+  if (timeoutMs) {
+    const { createKeyedSerializer } = require('./keyed-serializer');
+    registrationSvc.serialize = createKeyedSerializer({ timeoutMs });
+  }
+  for (const [name, fn] of Object.entries(registration.methods)) registrationSvc[name] = fn.bind(registrationSvc);
+
+  /** Delivers an activity to the app's inbox, as the participant's pod does: the body is all the handler gets. */
+  const deliver = (key, body) => registration.activities[key].onReceive.call(registrationSvc, ctx, body, APP);
+
+  return { ctx, calls, state, logs, registration: registrationSvc, participations: participationsSvc, deliver };
+}
+
+module.exports = {
+  world,
+  activity,
+  meetingPoint,
+  actor,
+  profile,
+  profileOf,
+  contactsOf,
+  groupOf,
+  attendeesOf,
+  createdCollectionAcl,
+  HOST,
+  APP,
+  ALICE,
+  BOB,
+  CAROL,
+  MALLORY,
+  EVENT1,
+  EVENT2,
+  SECRETS,
+  FP_SECRET,
+  FP_PARTICIPATIONS
+};
@@ -0,0 +1,191 @@
+const urlJoin = require('url-join');
+const { PodCollectionsHandlerMixin } = require('@activitypods/app');
+const { arrayOf } = require('@semapps/ldp');
+const CONFIG = require('../config/config');
+const { isInActorPod } = require('./actor-pod');
+const { createKeyedSerializer } = require('./keyed-serializer');
+const { uriOf } = require('./emitted-activity');
+const { guardedCreateAndAttach } = require('./collection-attach');
+const { hasInheritedPublicRead, hasOwnPublicRead, revocationGraph, ownReaders, aclUriOf, readAcl, putOwnRights } = require('./public-read-acl');
+
+const FP_PARTICIPATIONS = 'http://festipod.org/participations';
+
+/** The collection URIs a profile links under `fp:participations` (full IRI or CURIE). */
+const participationsLinksOf = profile =>
+  arrayOf(profile[FP_PARTICIPATIONS] ?? profile['fp:participations'])
+    .map(uriOf)
+    .filter(uri => typeof uri === 'string');
+
+// A person's participations collection (decision_2026-10-29_participation-privacy-mechanism): the
+// person-side record of the meeting points they joined, for themself and for their contacts. An
+// unordered `as:Collection` in the participant's pod, attached to their `as:Profile` under
+// `http://festipod.org/participations`, whose items are meeting point URIs — added on a Join and
+// removed on a Leave by registration.service.js, acting as the participant.
+//
+// Who may read it: its owner, the app, and the participant's `/contacts` WAC group — through ONE
+// `acl:agentGroup` grant on the collection's own `#Read` rule (the welcometomyplace pattern), the
+// group URI derived from the `apods:contacts` collection (`pod-wac-groups.getUriFromCollectionUri`).
+// The GROUP, not the `apods:contacts` LIST: a received `Accept` of a contact `Offer` is added to the
+// list with no prior request checked (platform defect reported upstream), so the list is forgeable —
+// a stranger could grant themself read; the group gains a member only through the person's OWN
+// emitted activities (a contact request they send, an acceptance they emit), which a forged received
+// activity cannot do. (The group does admit the target of a request the person SENT before it is
+// accepted, and keeps a removed contact — platform behaviours, both deliberate here: see the e2e.)
+// And never anyone else: the pod creates a collection world-readable (`acl:Read` for `foaf:Agent`,
+// observed 2026-10-12 on the attendee lists), and a participations collection readable by strangers
+// would list a person's events to anyone.
+//
+// `syncReaders` makes that true from the collection's ACL as the pod serves it NOW, read as the
+// participant: the pod's own public read goes (the `revocationGraph` PUT of `public-read-acl.js` —
+// `pod-permissions.remove` cannot do it, see there), then the `/contacts` group gets its grant if it
+// has none (`pod-permissions.add`, the welcometomyplace grant call). It runs on every Join (`ensure`,
+// before the meeting point is added). The grant names a STABLE group URI, so it never needs revisiting
+// when the person's contacts change — the pod keeps the group's membership, nothing here to re-sync.
+// Idempotent: on a collection already in that state, one ACL read and nothing written. A failure
+// throws — the act that needed it is not recorded, the next one retries.
+//
+// Created at a person's first sign-up, never on a profile's Create (no activity handler here): a
+// profile with no collection has no participation to list. One run at a time per person — two Joins of
+// one person on two meeting points run concurrently and would otherwise both find no collection and
+// attach one each.
+module.exports = {
+  name: 'participations',
+  mixins: [PodCollectionsHandlerMixin],
+  settings: {
+    shapeTreeUri: urlJoin(CONFIG.SHAPE_REPOSITORY_URL, 'shapetrees/as/Profile'),
+    attachPredicate: FP_PARTICIPATIONS,
+    collectionOptions: {
+      ordered: false,
+      summary: 'Festipod participations'
+    },
+    // Items are meeting points, not agents: no mirrored WAC group.
+    createWacGroup: false
+  },
+  dependencies: ['pod-permissions'],
+  // Replaces the mixin's whole map (moleculer does not merge a custom schema key): no handler, so
+  // no collection is attached to a profile when it is created.
+  activities: {},
+  created() {
+    this.serialize = createKeyedSerializer();
+  },
+  actions: {
+    // Nothing attached → no WAC group (see collection-attach.js).
+    createAndAttach: guardedCreateAndAttach,
+    /** The collection the participant's profile links now, or undefined (see `collectionOf`). */
+    collectionOf: {
+      params: {
+        actorUri: { type: 'string' },
+        profileUri: { type: 'string' }
+      },
+      async handler(ctx) {
+        return this.collectionOf(ctx, ctx.params);
+      }
+    },
+    /** The participant's collection, created if none and readable by their `/contacts` group only (see `ensure`). */
+    ensure: {
+      params: {
+        actorUri: { type: 'string' },
+        profileUri: { type: 'string' },
+        contactsUri: { type: 'string', optional: true }
+      },
+      async handler(ctx) {
+        return this.ensure(ctx, ctx.params);
+      }
+    }
+  },
+  methods: {
+    /**
+     * The collection `profileUri` (the profile of `actorUri`) links NOW — read from the pod as the
+     * participant — or undefined when it links none. Throws when the profile cannot be read, links
+     * several, or links one outside the participant's pod (ignored: nothing is written to it).
+     */
+    async collectionOf(ctx, { actorUri, profileUri }) {
+      if (!isInActorPod(profileUri, actorUri)) throw new Error(`the profile ${profileUri} is not in the pod of ${actorUri}`);
+      const { status, body } = await ctx.call('pod-resources.get', { resourceUri: profileUri, actorUri });
+      if (status !== 200 || !body || uriOf(body) !== profileUri) {
+        throw new Error(`the pod does not return the profile ${profileUri} (HTTP ${status})`);
+      }
+      const links = participationsLinksOf(body);
+      if (links.length > 1) throw new Error(`the profile ${profileUri} links several participations collections`);
+      if (links.length === 1 && !isInActorPod(links[0], actorUri)) {
+        throw new Error(`the profile ${profileUri} links a participations collection outside the pod of ${actorUri}: ignored`);
+      }
+      return links[0];
+    },
+    /**
+     * The participant's collection, ready to receive a meeting point: the one the profile links, or
+     * one created and attached now when it links none; then readable by the participant's `/contacts`
+     * WAC group and by no one else (`syncReaders`). One run at a time per participant. Resolves the
+     * collection URI; throws when any of this cannot be made true — nothing may then be added to it.
+     *
+     * After an attach, the collection used is the one the profile links when READ AGAIN, never the
+     * URI the attach returned: the platform's `createAndAttach` returns the collection it created even
+     * when the pod refused the profile PATCH that links it (it does not check that write), and returns
+     * nothing when the profile gained a link meanwhile (another app). A created collection the profile
+     * does not link is left unused, empty — its contacts could never find it.
+     */
+    async ensure(ctx, { actorUri, profileUri, contactsUri }) {
+      return this.serialize(actorUri, async signal => {
+        let collectionUri = await this.collectionOf(ctx, { actorUri, profileUri });
+        if (!collectionUri) {
+          const attached = await this.actions.createAndAttach({ resourceUri: profileUri, actorUri }, { parentCtx: ctx });
+          collectionUri = await this.collectionOf(ctx, { actorUri, profileUri });
+          if (!collectionUri) {
+            throw new Error(
+              attached
+                ? `the pod created ${attached} but did not link it to ${profileUri}: left unused`
+                : `no participations collection could be attached to ${profileUri}`
+            );
+          }
+          if (attached === collectionUri) this.logger.info(`Attached the participations collection ${collectionUri} to ${profileUri}`);
+          else if (attached) this.logger.warn(`${profileUri} links ${collectionUri}, not the collection ${attached} just created: that one is left unused`);
+        }
+        await this.syncReaders(ctx, { collectionUri, actorUri, contactsUri, signal });
+        return collectionUri;
+      });
+    },
+    /**
+     * Makes `collectionUri` readable by the participant's `/contacts` WAC group (one `acl:agentGroup`
+     * grant on its own `#Read` rule, the group URI derived from their `apods:contacts` collection) and
+     * by no one else: the pod's own public read is removed first (the `revocationGraph` PUT, one call,
+     * the app keeping its `#Control`), then the group is granted read if it has none. The grant names a
+     * stable group URI whose membership the pod keeps, so it is set once and never re-synced. Gives up
+     * before any write once its time is out (`signal`). Idempotent: on a collection already in that
+     * state, one ACL read and nothing written. Throws when the ACL cannot be read, the pod refuses a
+     * change, or the collection stays world-readable through a rule inherited from its container (not
+     * removable here) — the Join that needed it is then not recorded, and retries.
+     */
+    async syncReaders(ctx, { collectionUri, actorUri, contactsUri, signal }) {
+      if (!contactsUri || !isInActorPod(contactsUri, actorUri)) {
+        throw new Error(`${actorUri} names no contacts collection in their pod: who may read ${collectionUri} is unknown`);
+      }
+      const groupUri = await ctx.call('pod-wac-groups.getUriFromCollectionUri', { collectionUri: contactsUri });
+      const acl = await readAcl(ctx, collectionUri, actorUri);
+      if (!acl.authorizations) throw new Error(`the ACL of ${collectionUri} could not be read (HTTP ${acl.status})`);
+      if (hasInheritedPublicRead(acl.authorizations)) {
+        throw new Error(`${collectionUri} is world-readable through a rule inherited from its container: not removable here`);
+      }
+      if (hasOwnPublicRead(acl.authorizations)) {
+        if (signal && signal.aborted) throw new Error(`out of time before removing the public read of ${collectionUri}`);
+        const document = revocationGraph(acl.authorizations, collectionUri, actorUri, aclUriOf(collectionUri));
+        const status = await putOwnRights(ctx, collectionUri, document);
+        if (status !== 204 && status !== 200) {
+          throw new Error(`the pod refused to remove the public read of ${collectionUri} (HTTP ${status})`);
+        }
+        this.logger.info(`Removed the public read of ${collectionUri}`);
+      }
+      if (!ownReaders(acl.authorizations).agentGroup.includes(groupUri)) {
+        if (signal && signal.aborted) throw new Error(`out of time before granting the contacts group read on ${collectionUri}`);
+        const added = await ctx.call('pod-permissions.add', {
+          uri: collectionUri,
+          agentPredicate: 'acl:agentGroup',
+          agentUri: groupUri,
+          mode: 'acl:Read',
+          actorUri
+        });
+        if (!added) throw new Error(`the pod refused the read grant of the contacts group ${groupUri} on ${collectionUri}`);
+        this.logger.info(`Granted the contacts group ${groupUri} read on ${collectionUri}`);
+      }
+    }
+  }
+};
@@ -0,0 +1,155 @@
+const { test, expect, describe } = require('bun:test');
+const participations = require('./participations.service');
+const { hasOwnPublicRead, ownReaders } = require('./public-read-acl');
+const { world, profile, profileOf, contactsOf, groupOf, createdCollectionAcl, APP, ALICE, BOB, MALLORY, FP_PARTICIPATIONS } = require('./participation-world');
+
+const ensure = (w, extra = {}) => w.participations.actions.ensure({ actorUri: BOB, profileUri: profileOf(BOB), contactsUri: contactsOf(BOB), ...extra });
+const collectionOf = w => w.participations.actions.collectionOf({ actorUri: BOB, profileUri: profileOf(BOB) });
+const EXISTING = `${BOB}/data/as/collection/participations-existing`;
+const linked = uri => ({ [profileOf(BOB)]: profile(BOB, { [FP_PARTICIPATIONS]: { id: uri } }) });
+const aclId = (uri, rule) => `http://localhost:3000/_acl${new URL(uri).pathname}#${rule}`;
+const appControl = uri => ({ '@id': aclId(uri, 'Control'), 'acl:mode': 'acl:Control', 'acl:agent': APP });
+/** The /contacts WAC group that may read Bob's participations collection (what the grant names). */
+const GROUP = groupOf(BOB);
+/** A collection readable by Bob's /contacts group, the app keeping its Control. */
+const groupRead = uri => ({ '@id': aclId(uri, 'Read'), 'acl:mode': 'acl:Read', 'acl:agentGroup': GROUP });
+const protectedAcl = uri => [groupRead(uri), appControl(uri)];
+/** The collection created at the first sign-up (the world names the first one `participations-1`). */
+const CREATED = `${BOB}/data/as/collection/participations-1`;
+/** Who the collection's own #Read rule lets read, plus every inherited rule's readers. */
+const readersOf = (w, uri) => ownReaders(w.state.acls[uri]);
+const writes = w => w.calls.filter(c => ['pod-collections.createAndAttach', 'pod-permissions.add', 'signature.proxy.query'].includes(c.action));
+
+describe('participations — the collection is attached at the first sign-up, never on a profile Create', () => {
+  test('no activity handler, the full-IRI attach predicate, unordered, no mirrored group', () => {
+    expect(participations.activities).toEqual({});
+    expect(participations.settings.attachPredicate).toBe('http://festipod.org/participations');
+    expect(participations.settings.collectionOptions.ordered).toBe(false);
+    expect(participations.settings.createWacGroup).toBe(false);
+  });
+});
+
+describe('participations.collectionOf — the collection the profile links now', () => {
+  test('none, one, one outside the pod, several, an unreadable profile', async () => {
+    expect(await collectionOf(world())).toBeUndefined();
+    expect(await collectionOf(world({ stored: linked(EXISTING) }))).toBe(EXISTING);
+    expect(await collectionOf(world({ stored: { [profileOf(BOB)]: profile(BOB, { [FP_PARTICIPATIONS]: EXISTING }) } }))).toBe(EXISTING); // a plain IRI value
+    await expect(collectionOf(world({ stored: linked(`${MALLORY}/data/as/collection/x`) }))).rejects.toThrow('outside the pod');
+    await expect(collectionOf(world({ stored: { [profileOf(BOB)]: profile(BOB, { [FP_PARTICIPATIONS]: [{ id: EXISTING }, { id: `${EXISTING}-2` }] }) } }))).rejects.toThrow('several');
+    await expect(collectionOf(world({ stored: { [profileOf(BOB)]: undefined } }))).rejects.toThrow('does not return the profile');
+  });
+
+  test('a profile outside the participant\'s pod is never read', async () => {
+    const w = world();
+    await expect(w.participations.actions.collectionOf({ actorUri: BOB, profileUri: profileOf(MALLORY) })).rejects.toThrow('not in the pod');
+    expect(w.calls.some(c => c.action === 'pod-resources.get')).toBe(false);
+  });
+});
+
+
+describe('participations.ensure — a collection readable by the participant\'s /contacts group', () => {
+  test('no collection: one is created and attached, the /contacts group granted read, the pod\'s public read removed', async () => {
+    const w = world();
+    const uri = await ensure(w);
+    expect(uri).toBe(CREATED);
+    expect(w.state.created).toEqual([uri]);
+    expect(w.state.stored[profileOf(BOB)][FP_PARTICIPATIONS]).toEqual({ id: uri });
+    const attach = w.calls.find(c => c.action === 'pod-collections.createAndAttach');
+    expect(attach.params).toMatchObject({ resourceUri: profileOf(BOB), attachPredicate: FP_PARTICIPATIONS, actorUri: BOB });
+    const grants = w.calls.filter(c => c.action === 'pod-permissions.add').map(c => c.params);
+    expect(grants).toEqual([{ uri, agentPredicate: 'acl:agentGroup', agentUri: GROUP, mode: 'acl:Read', actorUri: BOB }]);
+    expect(hasOwnPublicRead(w.state.acls[uri])).toBe(false);
+    expect(readersOf(w, uri)).toEqual({ agent: [], agentClass: [], agentGroup: [GROUP] });
+    // The group URI is DERIVED from her apods:contacts collection; the list itself is never read.
+    expect(w.calls.find(c => c.action === 'pod-wac-groups.getUriFromCollectionUri').params).toEqual({ collectionUri: contactsOf(BOB) });
+    expect(w.calls.some(c => c.action === 'pod-collections.getItems')).toBe(false);
+  });
+
+  test('the public read goes FIRST (one PUT, the app keeping its Control), then the group grant', async () => {
+    const w = world();
+    const uri = await ensure(w);
+    const order = writes(w).map(c => c.action);
+    expect(order).toEqual(['pod-collections.createAndAttach', 'signature.proxy.query', 'pod-permissions.add']);
+    const put = w.calls.find(c => c.action === 'signature.proxy.query');
+    expect(put.params.url).toBe(`http://localhost:3000/_acl${new URL(uri).pathname}`);
+    expect(put.params.actorUri).toBe(APP);
+    const graph = JSON.parse(put.params.body)['@graph'];
+    expect(JSON.stringify(graph)).not.toContain('foaf:Agent');
+    expect(graph.some(n => n['@id'].endsWith('#Control') && n['acl:agent'] === APP)).toBe(true);
+  });
+
+  test('no contact yet: the group is granted all the same — its membership is the pod\'s business', async () => {
+    const w = world();
+    const uri = await ensure(w);
+    expect(readersOf(w, uri)).toEqual({ agent: [], agentClass: [], agentGroup: [GROUP] });
+    // No per-contact acl:agent grant is ever made; the group carries everyone.
+    expect(w.calls.every(c => c.action !== 'pod-permissions.add' || c.params.agentPredicate === 'acl:agentGroup')).toBe(true);
+  });
+
+  test('idempotent: on a collection already readable by the group, the ACL reads, nothing written', async () => {
+    const w = world({ stored: linked(EXISTING), acls: { [EXISTING]: protectedAcl(EXISTING) } });
+    expect(await ensure(w)).toBe(EXISTING);
+    expect(await ensure(w)).toBe(EXISTING);
+    expect(writes(w)).toEqual([]);
+    expect(w.calls.filter(c => c.action === 'pod-permissions.fetch')).toHaveLength(2);
+  });
+
+  test('an existing collection still world-readable: reused, the public read removed, the group granted', async () => {
+    const w = world({ stored: linked(EXISTING), acls: { [EXISTING]: createdCollectionAcl(EXISTING) } });
+    expect(await ensure(w)).toBe(EXISTING);
+    expect(w.state.created).toEqual([]);
+    expect(hasOwnPublicRead(w.state.acls[EXISTING])).toBe(false);
+    expect(readersOf(w, EXISTING)).toEqual({ agent: [], agentClass: [], agentGroup: [GROUP] });
+  });
+
+  test('an existing collection granting the group but still world-readable: the public read goes, the grant is not repeated', async () => {
+    const bothOnRead = { '@id': aclId(EXISTING, 'Read'), 'acl:mode': 'acl:Read', 'acl:agentGroup': GROUP, 'acl:agentClass': 'foaf:Agent' };
+    const w = world({ stored: linked(EXISTING), acls: { [EXISTING]: [bothOnRead, appControl(EXISTING)] } });
+    await ensure(w);
+    expect(hasOwnPublicRead(w.state.acls[EXISTING])).toBe(false);
+    expect(readersOf(w, EXISTING)).toEqual({ agent: [], agentClass: [], agentGroup: [GROUP] });
+    expect(writes(w).map(c => c.action)).toEqual(['signature.proxy.query']); // the PUT only, no repeated grant
+  });
+
+  test('one creation per participant: two concurrent calls attach ONE collection', async () => {
+    const w = world({ delays: { create: 30 } });
+    const [a, b] = await Promise.all([ensure(w), ensure(w)]);
+    expect(a).toBe(b);
+    expect(w.state.created).toHaveLength(1);
+  });
+
+  test('nothing attached (the profile gained a link meanwhile): the linked collection is used', async () => {
+    const w = world({ stored: linked(EXISTING), acls: { [EXISTING]: protectedAcl(EXISTING) } });
+    // collectionOf saw no link at first: simulate by an attach that finds one.
+    const original = w.participations.collectionOf;
+    let first = true;
+    w.participations.collectionOf = async (...args) => (first ? ((first = false), undefined) : original(...args));
+    expect(await ensure(w)).toBe(EXISTING);
+    expect(w.state.created).toEqual([]);
+  });
+
+  test('a collection the pod creates but does not link (the profile PATCH refused): ensure throws, the collection is never used', async () => {
+    const w = world({ fail: { attach: true } });
+    await expect(ensure(w)).rejects.toThrow(`the pod created ${CREATED} but did not link it`);
+    expect(w.state.created).toEqual([CREATED]);
+    expect(w.state.stored[profileOf(BOB)][FP_PARTICIPATIONS]).toBeUndefined();
+    // Not protected, not granted: nothing is done with a collection no contact could find.
+    expect(writes(w).map(c => c.action)).toEqual(['pod-collections.createAndAttach']);
+    // The profile is read again after the attach: the link counts, not what the attach returned.
+    expect(w.calls.filter(c => c.action === 'pod-resources.get' && c.params.resourceUri === profileOf(BOB))).toHaveLength(2);
+  });
+
+  test('every failure throws — nothing may then be added to the collection', async () => {
+    await expect(ensure(world({ fail: { putStatus: 403 } }))).rejects.toThrow('refused to remove the public read');
+    await expect(ensure(world({ stored: linked(EXISTING), acls: { [EXISTING]: [appControl(EXISTING)] }, fail: { grant: true } }))).rejects.toThrow('refused the read grant of the contacts group');
+    await expect(ensure(world({ fail: { aclRead: true } }))).rejects.toThrow('could not be read');
+    await expect(ensure(world(), { contactsUri: undefined })).rejects.toThrow('names no contacts collection');
+    await expect(ensure(world(), { contactsUri: `${MALLORY}/contacts` })).rejects.toThrow('names no contacts collection');
+    const inherited = world({
+      stored: linked(EXISTING),
+      acls: { [EXISTING]: [...protectedAcl(EXISTING), { '@id': 'http://localhost:3000/_acl/bob/data/as/collection#DefaultRead', 'acl:mode': 'acl:Read', 'acl:agentClass': 'foaf:Agent' }] }
+    });
+    await expect(ensure(inherited)).rejects.toThrow('inherited');
+    expect(writes(inherited)).toEqual([]);
+  });
+});
@@ -14,7 +14,7 @@
 // removing the foaf:Agent triple alone would leave the own set empty and the PUT would be refused.
 // `revocationGraph` therefore keeps the owner as `acl:agent` of `#Read` when nothing else remains —
 // the owner already reads via the default, so no right is gained or lost — and preserves any other
-// own agent triples (e.g. a future per-contact grant) unchanged.
+// own agent triples (e.g. the `/contacts` group a participations collection grants read to) unchanged.
 //
 // NARROW: only the public READ goes. The pod keys own rules by mode (`#Read`, `#Write`, `#Append`,
 // `#Control`); the `foaf:Agent` triple is removed from the `#Read` rule alone, so a `foaf:Agent` on
@@ -28,6 +28,15 @@
 // the compacted `foaf:Agent` the pod returns (removes nothing), and it drops any authorization
 // whose removed predicate becomes empty even when other agent predicates remain (would empty the
 // set → 400). This module PUTs a correct graph instead.
+//
+// `ownReaders` says who a resource's own `#Read` rule lets read (its agents, groups and classes):
+// participations.service.js uses it to tell whether the `/contacts` WAC group it grants read to a
+// participations collection is already granted.
+//
+// Two pod calls go with the graphs: `readAcl` (the ACL as the pod serves it to the app, a failure
+// told apart from "no public read") and `putOwnRights` (the PUT, as the app actor). Every Festipod
+// caller that reads or replaces an ACL goes through them: public-read (events and their attendee
+// lists) and participations (a person's participations collection).

 const { arrayOf } = require('@semapps/ldp');

@@ -98,12 +107,13 @@ const aclContext = aclUri => ({
 });

 /**
- * revocationGraph(authorizations, resourceUri, ownerUri) → a JSON-LD document `{ '@context', '@graph' }`
- * to PUT on the resource's ACL so it keeps every one of its OWN agent triples EXCEPT
- * `acl:agentClass foaf:Agent` on its `#Read` authorization (a `foaf:Agent` on any other own rule stays). Inherited `#Default*` rules are not emitted
- * (a PUT does not touch them). When removing the public-read triple would leave the own set empty,
- * the owner is emitted as `acl:agent` of `#Read` so the PUT is accepted without changing any right.
- * `aclUri` is where the document will be PUT (used only for the context `@base`).
+ * revocationGraph(authorizations, resourceUri, ownerUri, aclUri) → a JSON-LD document `{ '@context',
+ * '@graph' }` to PUT on the resource's ACL so it keeps every one of its OWN agent triples EXCEPT
+ * `acl:agentClass foaf:Agent` on its `#Read` authorization (a `foaf:Agent` on any other own rule
+ * stays). The other own rules (`#Write`, `#Append`, `#Control`) stay exactly as they are. Inherited
+ * `#Default*` rules are not emitted (a PUT does not touch them). When removing the public-read triple
+ * would leave the own set empty, the owner is emitted as `acl:agent` of `#Read` so the PUT is accepted
+ * without changing any right. `aclUri` is where the document will be PUT (used only for the context `@base`).
 */
 const revocationGraph = (authorizations, resourceUri, ownerUri, aclUri) => {
  const graph = [];
@@ -134,13 +144,78 @@ const revocationGraph = (authorizations, resourceUri, ownerUri, aclUri) => {
  return { '@context': aclContext(aclUri), '@graph': graph };
 };

+/**
+ * ownReaders(authorizations) → `{ agent, agentClass, agentGroup }`: the values (full IRIs, without
+ * duplicates) the resource's OWN `#Read` authorization grants read to — not the inherited rules.
+ */
+const ownReaders = authorizations => {
+  const readers = { agent: [], agentClass: [], agentGroup: [] };
+  for (const authorization of arrayOf(authorizations)) {
+    if (suffixOf(authorization) !== 'Read' || !expandedValuesOf(authorization, 'mode').includes(ACL + 'Read')) continue;
+    for (const name of Object.keys(readers)) {
+      for (const iri of expandedValuesOf(authorization, name)) {
+        if (typeof iri === 'string' && !readers[name].includes(iri)) readers[name].push(iri);
+      }
+    }
+  }
+  return readers;
+};
+
+/** The ACL document URI of a pod resource: `{origin}/_acl{path}` (the pod's `getAclUriFromResourceUri`). */
+const aclUriOf = resourceUri => {
+  const { origin, pathname } = new URL(resourceUri);
+  return `${origin}/_acl${pathname}`;
+};
+
+/**
+ * readAcl(ctx, resourceUri, actorUri) → `{ status, authorizations }`, the authorizations only when
+ * the pod answered 200. Unlike `pod-permissions.get`, which answers `false` for ANY failure —
+ * indistinguishable from "no public read" — a failure here is reported, so a caller can tell "not
+ * public" from "unknown". Read where `putOwnRights` writes (`aclUriOf`), through the pod owner's
+ * access (`actorUri`).
+ */
+async function readAcl(ctx, resourceUri, actorUri) {
+  const { status, body } =
+    (await ctx.call('pod-permissions.fetch', {
+      url: aclUriOf(resourceUri),
+      headers: { Accept: 'application/ld+json' },
+      actorUri
+    })) || {};
+  if (status !== 200 || !body || typeof body !== 'object') return { status: typeof status === 'number' ? status : 0 };
+  const graph = body['@graph'] !== undefined ? body['@graph'] : body['@id'] || body.id ? [body] : [];
+  return { status, authorizations: Array.isArray(graph) ? graph : [graph] };
+}
+
+/**
+ * putOwnRights(ctx, resourceUri, document) → the HTTP status of the PUT of `document` (a
+ * `revocationGraph`) on the resource's ACL, sent as the APP ACTOR through the platform's signature
+ * proxy — the actor that holds `acl:Control` on the resources Festipod grants or revokes on.
+ * Resolves the status (0 when none); the caller decides what a refusal means.
+ */
+async function putOwnRights(ctx, resourceUri, document) {
+  const app = await ctx.call('app.get');
+  const { status } =
+    (await ctx.call('signature.proxy.query', {
+      url: aclUriOf(resourceUri),
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/ld+json' },
+      body: JSON.stringify(document),
+      actorUri: app.id || app['@id']
+    })) || {};
+  return typeof status === 'number' ? status : 0;
+}
+
 module.exports = {
  grantsPublicRead,
  hasOwnPublicRead,
  hasInheritedPublicRead,
  revocationGraph,
+  ownReaders,
  isPublicRead,
  expand,
+  aclUriOf,
+  readAcl,
+  putOwnRights,
  FOAF_AGENT,
  ACL
 };
@@ -5,15 +5,18 @@ const { hasPublicIntent } = require('./public-intent');
 const { isInActorPod } = require('./actor-pod');
 const { createKeyedSerializer } = require('./keyed-serializer');
 const { neverThrowingMatcher, verifiedEmit, uriOf, singleUriOf, hasAsType } = require('./emitted-activity');
-const { grantsPublicRead, hasOwnPublicRead, hasInheritedPublicRead, revocationGraph, FOAF_AGENT } = require('./public-read-acl');
+const {
+  grantsPublicRead,
+  hasOwnPublicRead,
+  hasInheritedPublicRead,
+  revocationGraph,
+  aclUriOf,
+  readAcl,
+  putOwnRights,
+  FOAF_AGENT
+} = require('./public-read-acl');
 const { recordGrant, forgetGrant, isGrantedByFestipod } = require('./public-read-ledger');

-/** The ACL document URI of a pod resource: `{origin}/_acl{path}` (the pod's `getAclUriFromResourceUri`). */
-const aclUriOf = resourceUri => {
-  const { origin, pathname } = new URL(resourceUri);
-  return `${origin}/_acl${pathname}`;
-};
-
 const APODS_ATTENDEES = 'http://activitypods.org/ns/core#attendees';

 /** The attendees collection an event names (compacted or full-IRI key), when it names exactly one. */
@@ -165,22 +168,9 @@ module.exports = {
        this.logger.error(`Could not re-decide public read on ${resourceUri} after a late write: ${e.message}`);
      }
    },
-    /**
-     * The resource's ACL as the pod serves it to the app: `{ status, authorizations }`, the
-     * authorizations only when the pod answered 200. Unlike `pod-permissions.get`, which answers
-     * `false` for ANY failure — indistinguishable from "no public read" — a failure here is reported,
-     * so a caller can tell "not public" from "unknown". Read where `revoke` writes (`aclUriOf`).
-     */
+    /** The resource's ACL as the pod serves it to the app (`public-read-acl.js` `readAcl`). */
    async readAcl(ctx, resourceUri, actorUri) {
-      const { status, body } =
-        (await ctx.call('pod-permissions.fetch', {
-          url: aclUriOf(resourceUri),
-          headers: { Accept: 'application/ld+json' },
-          actorUri
-        })) || {};
-      if (status !== 200 || !body || typeof body !== 'object') return { status: typeof status === 'number' ? status : 0 };
-      const graph = body['@graph'] !== undefined ? body['@graph'] : body['@id'] || body.id ? [body] : [];
-      return { status, authorizations: Array.isArray(graph) ? graph : [graph] };
+      return readAcl(ctx, resourceUri, actorUri);
    },
    /**
     * Makes `resourceUri` world-readable and records it as FESTIPOD's grant — only when its ACL was
@@ -277,17 +267,9 @@ module.exports = {
        return false;
      }

-      const aclUri = aclUriOf(resourceUri);
-      const document = revocationGraph(acl.authorizations, resourceUri, actorUri, aclUri);
-      const app = await ctx.call('app.get');
+      const document = revocationGraph(acl.authorizations, resourceUri, actorUri, aclUriOf(resourceUri));
      if (aborted()) return false;
-      const { status } = await ctx.call('signature.proxy.query', {
-        url: aclUri,
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/ld+json' },
-        body: JSON.stringify(document),
-        actorUri: app.id || app['@id']
-      });
+      const status = await putOwnRights(ctx, resourceUri, document);
      if (status !== 204 && status !== 200) {
        throw new Error(`The pod refused to revoke the public-read grant on ${resourceUri} (HTTP ${status})`);
      }
@@ -1,15 +1,15 @@
 // The backend's whole HTTP surface, as an allow-list checked in front of every route.
 //
-// WHY. The backend runs SemApps' CoreService with `webacl: false`, so nothing checks rights on the
-// resources it stores, and CoreService mounts routes Festipod never asked for — above all the LDP
-// catch-all (`@semapps/ldp` `getCatchAllRoute`: `GET|POST|PUT|PATCH|DELETE /<any path>`,
-// `authorization: false`), which served the backend's `settings` dataset to anyone: the app actor's
-// PRIVATE key (`GET /key`, observed 2026-10-13), the user registrations and grants the app holds
-// (`/interop/…`), the webhook listeners. A signed request is no better: any pod user can sign one.
-// Rather than chase each route (deny-list), the gateway serves ONLY what a caller legitimately needs
-// and refuses everything else with a 404 — for every caller, anonymous or signed, since none needs
-// more over HTTP: the backend's own services reach its data through internal calls, never through
-// these routes.
+// WHY. CoreService mounts routes Festipod never asked for — above all the LDP catch-all
+// (`@semapps/ldp` `getCatchAllRoute`: `GET|POST|PUT|PATCH|DELETE /<any path>`), over the dataset that
+// holds the app actor's PRIVATE key (`/key`), the user registrations and grants the app holds
+// (`/interop/…`), the catalog store and the ledgers. WebACL filters what those routes serve (the main
+// dataset is a secure one, see core.service.js), so each resource is only as private as the rights
+// its container gave it; this gate does not depend on those rights being right. A signed request is
+// no better than an anonymous one here: any pod user can sign one. Rather than chase each route
+// (deny-list), the gateway serves ONLY what a caller legitimately needs and refuses everything else
+// with a 404 — for every caller, anonymous or signed, since none needs more over HTTP: the backend's
+// own services reach its data through internal calls, never through these routes.
 //
 // WHAT IS PUBLIC, and who calls it (backend request log, 2026-10-09 → 2026-10-13, all e2e runs):
 //   GET  /app                          the app description — the Festipod front end and the pod (install)
@@ -1,60 +1,221 @@
-const { ACTIVITY_TYPES, OBJECT_TYPES, matchActivity } = require('@semapps/activitypub');
-const { PodActivitiesHandlerMixin } = require('@activitypods/app');
+const { ACTIVITY_TYPES, ActivitiesHandlerMixin, matchActivity } = require('@semapps/activitypub');
 const { arrayOf } = require('@semapps/ldp');
 const CONFIG = require('../config/config');
 const { isInActorPod } = require('./actor-pod');
 const { createKeyedSerializer } = require('./keyed-serializer');
-const { isNewerAct, lastAttendance, recordAttendance } = require('./attendance-ledger');
-const { neverThrowingMatcher, verifiedEmit, verifiedReceive, singleUriOf, uriOf } = require('./emitted-activity');
+const { isNewerAct, lastAttendance, persistMember, recordAttendance } = require('./attendance-ledger');
+const { neverThrowingMatcher, verifiedDelivery, singleUriOf, uriOf, hasAsType } = require('./emitted-activity');
+const { participationSecretOf, memberUrn } = require('./member-urn');
+const { readItems, expectItem } = require('./collection-items');

+const AS = 'https://www.w3.org/ns/activitystreams#';
 const APODS_ATTENDEES = 'http://activitypods.org/ns/core#attendees';
 const APODS_CONTACTS = 'http://activitypods.org/ns/core#contacts';
 const DC_CREATOR = 'http://purl.org/dc/terms/creator';

-const JOIN_PATTERN = { type: ACTIVITY_TYPES.JOIN, object: { type: OBJECT_TYPES.EVENT } };
-const LEAVE_PATTERN = { type: ACTIVITY_TYPES.LEAVE, object: { type: OBJECT_TYPES.EVENT } };
-
-const AS_PUBLISHED = 'https://www.w3.org/ns/activitystreams#published';
+// Routing matches the activity TYPE alone: routing is a hint, the verified handler re-reads the
+// activity and its object from the pod and decides (see emitted-activity.js).
+const JOIN_PATTERN = { type: ACTIVITY_TYPES.JOIN };
+const LEAVE_PATTERN = { type: ACTIVITY_TYPES.LEAVE };

 /** The time the pod stamped on a stored activity (`published`, under any of its spellings). */
 const publishedOf = activity => {
  if (!activity || typeof activity !== 'object') return undefined;
-  const value = activity.published ?? activity['as:published'] ?? activity[AS_PUBLISHED];
+  const value = activity.published ?? activity['as:published'] ?? activity[`${AS}published`];
  return value && typeof value === 'object' ? value['@value'] : value;
 };

-/** The single URI an event names under a compacted or full-IRI key. */
-const linkOf = (node, compacted, full) => singleUriOf(node[compacted] ?? node[full]);
+/** The single URI a node names under the first of `keys` it carries (compacted, CURIE or full IRI). */
+const linkOf = (node, ...keys) => singleUriOf(keys.map(key => node[key]).find(value => value !== undefined));

-// Participation: a user joins (or leaves) a meeting point with a Join (Leave) posted to her outbox,
-// addressed to its organizer. Two effects, each from one side's box:
-//   - EMITTED (the joiner's outbox): the organizer joins the joiner's contacts group, so the
-//     organizer may read her profile;
-//   - RECEIVED (the organizer's inbox): the joiner is added to (removed from) the meeting point's
-//     attendees collection.
-// The webhook that reports either is a hint (emitted-activity.js): each handler acts only on the
-// activity and the meeting point as the pod stores them, and only for the people they really name:
-//   - the joiner is the actor whose pod holds the activity, never a value of the webhook body;
-//   - the organizer is the meeting point's `dc:creator`, accepted only when the meeting point lies in
-//     that creator's pod — the pod stamps the creator, and nobody can store a resource in someone
-//     else's pod;
-//   - the collection and the group written to are the ones the STORED meeting point and the
-//     joiner's STORED actor document name, and must lie in the pod of whoever owns them.
+/** The first string a property holds (a string, a value node, or a list of either). */
+const firstStringOf = value =>
+  arrayOf(value)
+    .map(v => (typeof v === 'string' ? v : v && typeof v === 'object' ? v['@value'] : undefined))
+    .find(v => typeof v === 'string' && v.trim().length > 0);
+
+/**
+ * What a Join/Leave targets: the stored object must be a meeting point — an `as:Event` (checked by
+ * `verifiedDelivery`, and by `meetingPointOf` on the creator's copy) anchored to an event by
+ * `as:context` — whose creator is its `dc:creator`, required to own the pod the meeting point lies
+ * in. Only on the copy the creator's pod serves (`meetingPointOf`) is that creator believed (the pod
+ * stamps the creator, and nobody can store a resource in someone else's pod); on the copy read
+ * through the participant's pod, it only names where to read that one. Resolves
+ * `{ ok, eventUri, creatorUri }` or a refusal.
+ */
+function meetingPointTarget(meetingPoint, meetingPointUri) {
+  const eventUri = linkOf(meetingPoint, 'context', 'as:context', `${AS}context`);
+  if (!eventUri) return { ok: false, reason: `the meeting point ${meetingPointUri} names no single as:context (its event)` };
+  const creatorUri = linkOf(meetingPoint, 'dc:creator', DC_CREATOR);
+  if (!creatorUri) return { ok: false, reason: `the meeting point ${meetingPointUri} names no single dc:creator` };
+  if (!isInActorPod(meetingPointUri, creatorUri)) {
+    return { ok: false, reason: `the meeting point ${meetingPointUri} is not in the pod of its creator ${creatorUri}` };
+  }
+  return { ok: true, eventUri, creatorUri };
+}
+
+/**
+ * The notification template for the creator of a meeting point (`pod-notifications.send`, rendered in
+ * the creator's language): always ANONYMOUS, the meeting point named through `meetingPointName`, the
+ * link to its event's meeting points (`eventUri`). Every value travels as a template PARAMETER, never
+ * inside the template, so no user text is compiled.
+ *
+ * Never names the participant: naming would need a trustworthy signal that the creator is one of the
+ * participant's contacts, and the only one the app can read — the participant's `apods:contacts` list —
+ * is forgeable (a stranger's received `Accept` of a contact `Offer` is added to it with no prior
+ * request checked; platform defect reported upstream). Until that list can be trusted, every
+ * notification is anonymous.
+ */
+function notificationTemplate(change) {
+  const title =
+    change === 'join'
+      ? {
+          en: 'A participant joined your meeting point "{{{meetingPointName}}}"',
+          fr: 'Un participant a rejoint votre point de rencontre « {{{meetingPointName}}} »'
+        }
+      : {
+          en: 'A participant left your meeting point "{{{meetingPointName}}}"',
+          fr: 'Un participant a quitté votre point de rencontre « {{{meetingPointName}}} »'
+        };
+  return {
+    title,
+    actions: [{ caption: { en: 'View', fr: 'Voir' }, link: '/events/{{encodeUri eventUri}}/meeting-points' }]
+  };
+}
+
+// Participation (decision_2026-10-29_participation-privacy-mechanism; its delivery:
+// decision_2026-11-03_participation-delivered-to-the-app): a person joins (leaves) a meeting point with an `as:Join`
+// (`as:Leave`) posted to their OWN outbox, naming the meeting point, addressed to the app actor alone —
+// so only its author and the app read it. Their pod delivers it to the app's inbox; the creator's inbox
+// receives nothing. The backend acts on RECEPTION in the app's inbox (`onReceive` of the semapps
+// `ActivitiesHandlerMixin`, as the app framework handles an app registration), and records:
+//   - in the meeting point's `apods:attendees` collection (the creator's pod, acting as the creator):
+//     the participant's MEMBER URN, never their WebID — `member-urn.js`, computed from the secret in
+//     their profile. A Join whose author's profile carries no usable secret is refused, nothing written;
+//   - in the participant's participations collection (their pod, acting as the participant): the
+//     meeting point URI — the collection created at the first Join and kept readable by the
+//     participant's `/contacts` WAC group only (`participations.service.js`).
+// Then the creator is notified ANONYMOUSLY — always: naming would need a trustworthy "is the creator a
+// contact of the participant" signal, and the only one the app can read (the participant's
+// `apods:contacts` list) is forgeable (platform defect reported upstream, see `notificationTemplate`).
+// The creator has no other right on the participant: they learn a count and opaque URNs.
+// The delivery that reports the act is a pointer (emitted-activity.js, `verifiedDelivery`): the handler
+// acts only on the activity and the meeting point as the pods store them, and only for the people they
+// really name:
+//   - the participant is the delivered activity's `actor` — the app's inbox accepts a delivery only
+//     signed by its actor — and the activity must lie in that actor's pod, its stored copy naming them:
+//     any server may deliver, nobody acts for someone else;
+//   - the meeting point is the copy its creator's pod serves (`meetingPointOf`), never the one read
+//     through the participant's server; the creator is its `dc:creator`, accepted only when the meeting
+//     point lies in that creator's pod (`meetingPointTarget`);
+//   - the collections written to are the ones the STORED meeting point and the participant's STORED
+//     profile name, and must lie in the pod of whoever owns them.
 // Joins and leaves of one meeting point are processed one at a time (keyed-serializer.js), and the
 // order they reach that lock does not decide: under the lock, an act is applied only when it is newer —
 // by the time the participant's pod stamped on it — than the last act applied for that participant and
-// meeting point (`attendance-ledger.js`, persisted). Whatever order the notifications run in, the
-// participant ends in the state of her latest act. The collection is read when acting.
+// meeting point (`attendance-ledger.js`, persisted, which also holds the member URN that act applied). Whatever order the notifications run in, the
+// participant ends in the state of their latest act. The member URN is STICKY per (meeting point,
+// participant): chosen once and persisted BEFORE any attendee-list write, so every later act reuses it —
+// the pair is never listed under two URNs, even after a half-way failure and a secret rewrite. An act is
+// recorded only once BOTH collections, READ BACK, show it (collection-items.js — the platform's own
+// collection calls answer "empty" on a failed read and resolve on a refused write); one that fails
+// half-way is not, nor notified, and the participant's next act on that meeting point re-applies it
+// (the two writes are not atomic).
 module.exports = {
  name: 'registration',
-  mixins: [PodActivitiesHandlerMixin],
+  mixins: [ActivitiesHandlerMixin],
+  dependencies: ['participations'],
  created() {
    this.serialize = createKeyedSerializer();
  },
  async started() {
-    this.logger.info('Registration watcher subscribed');
+    this.logger.info("Registration listens to the Joins and Leaves delivered to the app's inbox");
  },
  methods: {
+    /**
+     * Handles one verified Join/Leave (`change`: 'join' | 'leave') of `participantUri`, its verified
+     * emitter: resolves the meeting point and the participant, applies the act, then notifies the
+     * creator when the act changed the participant's state. A refusal is logged; nothing is written.
+     */
+    async onParticipation(ctx, change, { activity, objectUri: meetingPointUri, object: claimedMeetingPoint }, participantUri) {
+      const refuse = reason => this.logger.warn(`${this.name} refused the ${change} ${uriOf(activity)} of ${participantUri}: ${reason}`);
+      const claimed = meetingPointTarget(claimedMeetingPoint, meetingPointUri);
+      if (!claimed.ok) return refuse(claimed.reason);
+      const target = await this.meetingPointOf(ctx, meetingPointUri, claimed.creatorUri);
+      if (!target.ok) return refuse(target.reason);
+      const { meetingPoint } = target;
+      const participant = await this.participantOf(ctx, participantUri);
+      if (!participant.ok) return refuse(participant.reason);
+      const outcome = await this.updateAttendance(ctx, {
+        change,
+        eventUri: target.eventUri,
+        secret: participant.secret,
+        meetingPointUri,
+        meetingPoint,
+        activity,
+        creatorUri: target.creatorUri,
+        participantUri,
+        profileUri: participant.profileUri,
+        contactsUri: participant.contactsUri
+      });
+      if (outcome && outcome.changed) {
+        await this.notifyCreator(ctx, {
+          change,
+          meetingPointUri,
+          meetingPoint,
+          eventUri: target.eventUri,
+          creatorUri: target.creatorUri,
+          participantUri
+        });
+      }
+    },
+    /**
+     * The meeting point as the pod that holds it serves it. The verification read it through the
+     * participant's pod — for a participant on another server, through the proxy THEIR actor document
+     * declares, which answers what it wants (another meeting point's list, another name). Only the
+     * creator's pod speaks for the meeting point: it is read again there, through the creator's access
+     * (a GET to that pod, signed by the app), and the act uses that copy alone. It must still be an
+     * `as:Event` anchored by `as:context` whose `dc:creator` is that same creator. Resolves
+     * `{ ok, meetingPoint, eventUri, creatorUri }` or a refusal.
+     */
+    async meetingPointOf(ctx, meetingPointUri, creatorUri) {
+      const { status, body } = await ctx.call('pod-resources.get', { resourceUri: meetingPointUri, actorUri: creatorUri });
+      if (status !== 200 || !body || uriOf(body) !== meetingPointUri) {
+        return { ok: false, reason: `the pod of ${creatorUri} does not return the meeting point ${meetingPointUri} (HTTP ${status})` };
+      }
+      if (!hasAsType(body, 'Event')) return { ok: false, reason: `the meeting point ${meetingPointUri} its pod returns is not an Event` };
+      const target = meetingPointTarget(body, meetingPointUri);
+      if (!target.ok) return target;
+      if (target.creatorUri !== creatorUri) {
+        return { ok: false, reason: `the meeting point ${meetingPointUri} names ${target.creatorUri} as its creator in its pod, not ${creatorUri}` };
+      }
+      return { ok: true, meetingPoint: body, eventUri: target.eventUri, creatorUri };
+    },
+    /**
+     * The participant as their pod describes them, read as the participant: their actor document
+     * (its `url` — the `as:Profile`, which must lie in their pod — and `apods:contacts`), then the
+     * profile, which must carry a usable participation secret. Resolves `{ ok, profileUri,
+     * contactsUri, secret }` or a refusal. `contactsUri` is the participant's `apods:contacts`
+     * collection — whose `/contacts` WAC group is what may read their participations collection.
+     */
+    async participantOf(ctx, participantUri) {
+      const read = async uri => {
+        const { status, body } = await ctx.call('pod-resources.get', { resourceUri: uri, actorUri: participantUri });
+        return status === 200 && body && uriOf(body) === uri ? body : undefined;
+      };
+      const actor = await read(participantUri);
+      if (!actor) return { ok: false, reason: `the pod does not return the actor ${participantUri}` };
+      const profileUri = linkOf(actor, 'url', 'as:url', `${AS}url`);
+      if (!profileUri || !isInActorPod(profileUri, participantUri)) {
+        return { ok: false, reason: `${participantUri} names no single profile in their pod (${profileUri})` };
+      }
+      const profile = await read(profileUri);
+      if (!profile) return { ok: false, reason: `the pod does not return the profile ${profileUri}` };
+      const secret = participationSecretOf(profile);
+      if (!secret) return { ok: false, reason: `the profile ${profileUri} carries no usable participation secret` };
+      const contactsUri = linkOf(actor, 'apods:contacts', APODS_CONTACTS);
+      return { ok: true, profileUri, contactsUri, secret };
+    },
    /**
     * The attendees collection of a meeting point of `actorUri`'s pod, from the STORED meeting point.
     * It is attached asynchronously when the meeting point is created (attendees service), so a
@@ -79,11 +240,37 @@ module.exports = {
      return collectionUri;
    },
    /**
-     * Applies one participant act (`join` / `leave`, the stored activity `activity`) to the meeting
-     * point's collection — under the meeting point's lock, and only when the act is newer than the last
-     * one applied for that participant there (see the header). A stale act changes nothing; an act
-     * without a pod stamp cannot be placed and changes nothing. The decision is recorded once the
-     * collection matches it. Gives up before any write once its time is out (`signal`).
+     * The participant's participations collection, under the meeting point's lock: for a Join, the one
+     * `participations.ensure` makes ready (created if none, contacts-only); for a Leave, the one the
+     * profile links now, if any. Resolves `{ ok, collectionUri }` — `collectionUri` undefined for a
+     * Leave without a collection — or `{ ok: false }` once the failure is logged: the act must then
+     * write nothing and stay unrecorded, so that the next act retries.
+     */
+    async participationsCollectionOf(ctx, { change, participantUri, profileUri, contactsUri }) {
+      try {
+        const collectionUri =
+          change === 'join'
+            ? await ctx.call('participations.ensure', { actorUri: participantUri, profileUri, contactsUri })
+            : await ctx.call('participations.collectionOf', { actorUri: participantUri, profileUri });
+        return { ok: true, collectionUri };
+      } catch (e) {
+        this.logger.error(
+          `The participations collection of ${participantUri} is not ready (${e.message}): the ${change} is NOT recorded, the next act retries`
+        );
+        return { ok: false };
+      }
+    },
+    /**
+     * Applies one participant act (`join` / `leave`, the stored activity `activity`) — under the
+     * meeting point's lock, and only when the act is newer than the last one applied for that member
+     * there (see the header). A stale act changes nothing; an act without a pod stamp cannot be placed
+     * and changes nothing. The act is applied to the meeting point's attendees (as the creator), then
+     * to the participant's participations collection (as the participant), each write read back
+     * (`applyToAttendees`, `applyToParticipations`), and recorded once both show it; a failed read, a
+     * refused write or a write that does not show leaves the act unrecorded (logged). Gives up before
+     * any write once its time is out (`signal`). Resolves `{ changed }` when the act was applied —
+     * `changed` when it added or removed the member, or flipped the state the ledger held — and
+     * undefined when it was not.
     *
     * KNOWN LIMIT — a write in flight at the timeout: an add or remove ALREADY SENT when the time ran
     * out still lands, and is not recorded. If a newer act of the same participant was applied in the
@@ -93,37 +280,116 @@ module.exports = {
     * is the ledger that is behind — re-applying the ledger would undo it, and the two cases cannot be
     * told apart here. Needs a pod slower than the 30 s limit.
     */
-    async updateAttendance(ctx, { change, memberUri, meetingPointUri, meetingPoint, activity, actorUri }) {
+    async updateAttendance(ctx, { change, eventUri, secret, meetingPointUri, meetingPoint, activity, creatorUri, participantUri, profileUri, contactsUri }) {
      const act = { activityUri: uriOf(activity), published: publishedOf(activity), change };
      if (Number.isNaN(Date.parse(act.published))) {
-        this.logger.warn(`${change} ${act.activityUri} of ${memberUri} carries no pod stamp (published): it cannot be ordered, unchanged`);
-        return;
+        this.logger.warn(`${change} ${act.activityUri} of ${participantUri} carries no pod stamp (published): it cannot be ordered, unchanged`);
+        return undefined;
      }
-      await this.serialize(meetingPointUri, async signal => {
+      return this.serialize(meetingPointUri, async signal => {
        const dataset = CONFIG.MAIN_DATASET;
-        const last = await lastAttendance(ctx, { dataset, meetingPointUri, memberUri });
+        const last = await lastAttendance(ctx, { dataset, meetingPointUri, participantUri });
        if (!isNewerAct(act, last)) {
-          this.logger.info(`${change} ${act.activityUri} of ${memberUri} on ${meetingPointUri} is not newer than the last act applied (${last.activityUri}, possibly the same act notified again): unchanged`);
-          return;
+          this.logger.info(`${change} ${act.activityUri} of ${participantUri} on ${meetingPointUri} is not newer than the last act applied (${last.activityUri}, possibly the same act notified again): unchanged`);
+          return undefined;
        }
-        const collectionUri = await this.attendeesCollectionOf(ctx, meetingPoint, meetingPointUri, actorUri);
+        const collectionUri = await this.attendeesCollectionOf(ctx, meetingPoint, meetingPointUri, creatorUri);
        if (!collectionUri) {
          this.logger.warn(`No attendees collection on ${meetingPointUri}, skipping ${change}`);
+          return undefined;
+        }
+        if (signal.aborted) return undefined;
+        const participations = await this.participationsCollectionOf(ctx, { change, participantUri, profileUri, contactsUri });
+        if (!participations.ok || signal.aborted) return undefined;
+        // The member URN the act applies is STICKY per (meeting point, participant): the one the ledger
+        // already holds for the pair, else one computed from the secret on the profile now and persisted
+        // write-once BEFORE any attendee-list write — the act then applies whatever member the ledger holds
+        // after that write (another act's, if one landed first) — so that every later act (Join or Leave,
+        // after any half-way failure, timeout or secret rewrite) uses that same URN and the pair is never
+        // listed under two.
+        if (signal.aborted) return undefined;
+        let wrote;
+        try {
+          const memberUri =
+            last && last.member
+              ? last.member
+              : await persistMember(ctx, { dataset, meetingPointUri, participantUri, member: memberUrn({ participantUri, eventUri, secret }) });
+          if (signal.aborted) return undefined;
+          wrote = await this.applyToAttendees(ctx, { change, collectionUri, memberUri, creatorUri, meetingPointUri, signal });
+          await this.applyToParticipations(ctx, { change, collectionUri: participations.collectionUri, meetingPointUri, participantUri, signal });
+        } catch (e) {
+          this.logger.error(`The ${change} ${act.activityUri} of ${participantUri} on ${meetingPointUri} is NOT recorded (${e.message}): the next act retries`);
+          return undefined;
+        }
+        if (signal.aborted) return undefined;
+        await recordAttendance(ctx, { dataset, meetingPointUri, participantUri, act });
+        const wasAttending = Boolean(last && last.change === 'join');
+        return { changed: wrote || wasAttending !== (change === 'join') };
+      });
+    },
+    /**
+     * Applies `change` for `memberUri` to the meeting point's attendee list `collectionUri`, in the
+     * creator's pod and as the creator: reads the list — a failed read throws, it never means "not
+     * listed" — then adds the member on a Join when absent, removes it on a Leave when present (the
+     * attendees handler's `add` / `remove`, the reference-app calls) and reads the list back: throws
+     * unless the write shows. Resolves whether it wrote (false when the list already matched the act).
+     * Throws instead of writing once its time is out (`signal`).
+     */
+    async applyToAttendees(ctx, { change, collectionUri, memberUri, creatorUri, meetingPointUri, signal }) {
+      const joining = change === 'join';
+      const attending = (await readItems(ctx, { collectionUri, actorUri: creatorUri })).includes(memberUri);
+      if (attending === joining) {
+        this.logger.info(`${memberUri} already ${joining ? 'attends' : 'does not attend'} ${meetingPointUri}`);
+        return false;
+      }
+      if (signal.aborted) throw new Error(`out of time before the ${change} write to ${collectionUri}`);
+      await ctx.call(joining ? 'attendees.add' : 'attendees.remove', { collectionUri, itemUri: memberUri, actorUri: creatorUri });
+      await expectItem(ctx, { collectionUri, itemUri: memberUri, actorUri: creatorUri, present: joining });
+      return true;
+    },
+    /**
+     * Applies `change` to the participant's participations collection `collectionUri`, in their pod and
+     * as them: adds the meeting point on a Join, removes it on a Leave (the participations handler's
+     * `add` / `remove`, the reference-app calls — adding an item already there or removing one that is
+     * not changes nothing, so no read first), then reads the collection back: throws unless it shows
+     * the act. Nothing to do on a Leave when the participant has no collection (`collectionUri`
+     * undefined). Throws instead of writing once its time is out (`signal`).
+     */
+    async applyToParticipations(ctx, { change, collectionUri, meetingPointUri, participantUri, signal }) {
+      if (!collectionUri) {
+        this.logger.info(`${participantUri} has no participations collection: nothing to remove ${meetingPointUri} from`);
+        return;
+      }
+      const joining = change === 'join';
+      if (signal.aborted) throw new Error(`out of time before the ${change} write to ${collectionUri}`);
+      await ctx.call(joining ? 'participations.add' : 'participations.remove', { collectionUri, itemUri: meetingPointUri, actorUri: participantUri });
+      await expectItem(ctx, { collectionUri, itemUri: meetingPointUri, actorUri: participantUri, present: joining });
+    },
+    /**
+     * Tells the creator of the meeting point that a participant joined or left it — ALWAYS anonymously.
+     * The participant is never named: the only membership signal the app can read (the participant's
+     * `apods:contacts` list) is forgeable, so naming cannot be trusted (platform defect reported
+     * upstream, see `notificationTemplate`). The notification carries no `activity`: given one,
+     * `pod-notifications.send` fetches the emitter's profile. A creator acting on their own meeting
+     * point is not notified. A failure is logged, never thrown: the act stands.
+     */
+    async notifyCreator(ctx, { change, meetingPointUri, meetingPoint, eventUri, creatorUri, participantUri }) {
+      try {
+        if (creatorUri === participantUri) {
+          this.logger.info(`${participantUri} acted on their own meeting point ${meetingPointUri}: no notification`);
          return;
        }
-        if (signal.aborted) return;
-        const attending = arrayOf(await ctx.call('pod-collections.getItems', { collectionUri, actorUri })).includes(memberUri);
-        if (signal.aborted) return;
-        if (change === 'join' && !attending) {
-          await ctx.call('attendees.add', { collectionUri, itemUri: memberUri, actorUri });
-        } else if (change === 'leave' && attending) {
-          await ctx.call('attendees.remove', { collectionUri, itemUri: memberUri, actorUri });
-        } else {
-          this.logger.info(`${memberUri} already ${change === 'join' ? 'attends' : 'does not attend'} ${meetingPointUri}`);
-        }
-        if (signal.aborted) return;
-        await recordAttendance(ctx, { dataset, meetingPointUri, memberUri, act });
-      });
+        this.logger.info(`Notifying ${creatorUri} of a ${change} on ${meetingPointUri}, anonymously`);
+        await ctx.call('pod-notifications.send', {
+          template: notificationTemplate(change),
+          recipientUri: creatorUri,
+          context: meetingPointUri,
+          meetingPointName: firstStringOf(meetingPoint.name ?? meetingPoint['as:name'] ?? meetingPoint[`${AS}name`]) ?? '',
+          eventUri
+        });
+      } catch (e) {
+        this.logger.error(`Could not notify ${creatorUri} of a ${change} on ${meetingPointUri}: ${e.message}`);
+      }
    }
  },
  activities: {
@@ -131,48 +397,26 @@ module.exports = {
      match: neverThrowingMatcher(function (activity, fetcher) {
        return matchActivity(JOIN_PATTERN, activity, fetcher);
      }),
-      // The joiner's outbox: `actorUri` is the joiner. The meeting point lies in the organizer's pod.
-      onEmit: verifiedEmit(
+      // Delivered to the app's inbox: the participant is the verified emitter; the meeting point may lie
+      // in any pod (its creator's — checked by `meetingPointTarget`).
+      onReceive: verifiedDelivery(
        'Join',
-        async function (ctx, { object: meetingPoint, objectUri: meetingPointUri }, actorUri) {
-          const organizerUri = linkOf(meetingPoint, 'dc:creator', DC_CREATOR);
-          if (!organizerUri || !isInActorPod(meetingPointUri, organizerUri)) {
-            this.logger.warn(`${meetingPointUri} is not in the pod of the creator it names: no contact added`);
-            return;
-          }
-
-          const { body: actor } = await ctx.call('pod-resources.get', { resourceUri: actorUri, actorUri });
-          const contactsUri = actor && linkOf(actor, 'apods:contacts', APODS_CONTACTS);
-          if (!contactsUri) return;
-          if (!isInActorPod(contactsUri, actorUri)) {
-            this.logger.warn(`${actorUri} names a contacts collection outside its pod: no contact added`);
-            return;
-          }
-
-          const contactsGroupUri = await ctx.call('pod-wac-groups.getUriFromCollectionUri', { collectionUri: contactsUri });
-          await ctx.call('pod-wac-groups.addMember', { groupUri: contactsGroupUri, memberUri: organizerUri, actorUri });
+        async function (ctx, verdict, participantUri) {
+          await this.onParticipation(ctx, 'join', verdict, participantUri);
        },
        { objectType: 'Event', objectIn: 'any' }
-      ),
-      // The organizer's inbox: `actorUri` is the organizer; the meeting point must lie in her pod.
-      onReceive: verifiedReceive(
-        'Join',
-        async function (ctx, { activity, emitterUri, object, objectUri }, actorUri) {
-          await this.updateAttendance(ctx, { change: 'join', memberUri: emitterUri, meetingPointUri: objectUri, meetingPoint: object, activity, actorUri });
-        },
-        { objectType: 'Event' }
      )
    },
    leave: {
      match: neverThrowingMatcher(function (activity, fetcher) {
        return matchActivity(LEAVE_PATTERN, activity, fetcher);
      }),
-      onReceive: verifiedReceive(
+      onReceive: verifiedDelivery(
        'Leave',
-        async function (ctx, { activity, emitterUri, object, objectUri }, actorUri) {
-          await this.updateAttendance(ctx, { change: 'leave', memberUri: emitterUri, meetingPointUri: objectUri, meetingPoint: object, activity, actorUri });
+        async function (ctx, verdict, participantUri) {
+          await this.onParticipation(ctx, 'leave', verdict, participantUri);
        },
-        { objectType: 'Event' }
+        { objectType: 'Event', objectIn: 'any' }
      )
    }
  }
@@ -0,0 +1,84 @@
+services:
+  fuseki:
+    image: semapps/jena-fuseki-webacl
+    container_name: fuseki
+    volumes:
+      - ./data/fuseki:/fuseki:z
+    ports:
+      - '3030:3030'
+    expose:
+      - '3030'
+    environment:
+      ADMIN_PASSWORD: admin
+
+  activitypods-backend:
+    image: activitypods/backend
+    container_name: activitypods-backend
+    depends_on:
+      - fuseki
+      - redis
+    restart: always
+    expose:
+      - '3000'
+    volumes:
+      - ./data/backend/logs:/app/backend/logs:z
+      - ./data/backend/jwt:/app/backend/jwt:z
+      - ./data/backend/uploads:/app/backend/uploads:z
+      # Account deletion removes the account's dataset files and backups from disk, at the image's SEMAPPS_FUSEKI_BASE (../data/fuseki)
+      - ./data/fuseki:/app/data/fuseki:z
+    environment:
+      SEMAPPS_JENA_PASSWORD: admin
+      SEMAPPS_DEFAULT_LOCALE: en
+      # Host network: the pod provider reaches redis on its published host port (REDIS_PORT, default 6379)
+      SEMAPPS_QUEUE_SERVICE_URL: redis://localhost:${REDIS_PORT:-6379}/1
+      SEMAPPS_REDIS_OIDC_PROVIDER_URL: redis://localhost:${REDIS_PORT:-6379}/2
+    # Allow the Pod backend to access the app backend
+    # See https://docs.docker.com/network/drivers/host/
+    network_mode: 'host'
+
+  activitypods-frontend:
+    image: activitypods/frontend
+    container_name: activitypods-frontend
+    depends_on:
+      - activitypods-backend
+    restart: always
+    ports:
+      - '5000:5000'
+    expose:
+      - '5000'
+    environment:
+      REACT_APP_CONFIG_URL: 'http://localhost:3000/.well-known/config.js'
+
+  mailcatcher:
+    image: dockage/mailcatcher:0.7.1
+    container_name: mailcatcher
+    ports:
+      - '1080:1080'
+      - '1025:1025'
+    restart: on-failure
+
+  redis:
+    image: redis
+    container_name: redis
+    expose:
+      - '6379'
+    ports:
+      - '${REDIS_PORT:-6379}:6379'
+    volumes:
+      - ./data/redis:/data:z
+    command: ['redis-server', '--appendonly', 'yes']
+
+  arena:
+    image: activitypods/arena
+    container_name: arena
+    restart: always
+    volumes:
+      - ./docker/arena-dev.json:/opt/arena/src/server/config/index.json:z
+    depends_on:
+      - redis
+    expose:
+      - '4567'
+    ports:
+      - '4567:4567'
+    environment:
+      REDIS_HOST: 'redis'
@@ -22,8 +22,20 @@
 # backend request would be refused (404).
 #
 # The backend registers its app actor in its main dataset on the first boot, with the
-# domain it had at that time: set the domains in Coolify BEFORE the first deployment. If
-# they change later, delete the two datasets in Fuseki and redeploy.
+# domain it had at that time: set the domains in Coolify BEFORE the first deployment. The
+# main dataset must be a SECURE one (WebACL is on): the backend creates it so when it does
+# not exist, and refuses to start on an existing one that is not secure. To start again from
+# nothing (the domains changed, or the main dataset was created before WebACL was on):
+#   1. delete the two datasets in Fuseki. Fuseki's delete leaves a secure dataset's files on
+#      disk — remove `databases/<main>`, `databases/<main>Acl`, `databases/<main>Mirror` and
+#      `configuration/<main>.ttl` under the Fuseki base too, or a dataset created again under
+#      the same name reopens the old data;
+#      Fuseki then keeps the closed storage of the deleted dataset: re-creating one under the
+#      SAME name fails every query with `ClosedException: already closed` until Fuseki restarts
+#      (the shared one, on the test server) — or set new MAIN_DATASET / SETTINGS_DATASET names;
+#   2. empty this stack's Redis (the `redis-data` volume): its cache outlives the datasets and
+#      would keep serving the old app actor, keys and access needs;
+#   3. redeploy.
 #
 # Fuseki is the one shared with the other apps (shared-infra, in the "infra" project): the
 # backend joins the "coolify" network to reach it, with its own pair of datasets. Redis
@@ -1,29 +0,0 @@
-services:
-  frontend:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    ports:
-      - "4000:3000"
-    environment:
-      - PORT=3000
-      - NODE_ENV=production
-      - VITE_BACKEND_URL=${VITE_BACKEND_URL:-http://localhost:3003}
-      - VITE_BACKEND_CLIENT_ID=${VITE_BACKEND_CLIENT_ID:-}
-      - FESTIPOD_SHARED_WALLET_PASSWORD=${FESTIPOD_SHARED_WALLET_PASSWORD:-}
-      - FESTIPOD_SHARED_WALLET_FILE=${FESTIPOD_SHARED_WALLET_FILE:-}
-      - FESTIPOD_SHARED_WALLET_FILE_BASE64=${FESTIPOD_SHARED_WALLET_FILE_BASE64:-}
-      - FESTIPOD_AUTO_SEED=${FESTIPOD_AUTO_SEED:-}
-
-  backend:
-    build:
-      context: ./backend
-      dockerfile: Dockerfile
-    ports:
-      - "3003:3003"
-    env_file:
-      - path: ./backend/.env
-        required: false
-    environment:
-      - SEMAPPS_HOME_URL=${SEMAPPS_HOME_URL:-http://localhost:3003}
-      - SEMAPPS_FRONT_URL=${SEMAPPS_FRONT_URL:-http://localhost:4000}
@@ -0,0 +1,74 @@
+{
+  "queues": [
+    {
+      "name": "sendMail",
+      "hostId": "activitypods",
+      "host": "redis",
+      "port": 6379,
+      "db": 1
+    },
+    {
+      "name": "remotePost",
+      "hostId": "activitypods",
+      "host": "redis",
+      "port": 6379,
+      "db": 1
+    },
+    {
+      "name": "processOutbox",
+      "hostId": "activitypods",
+      "host": "redis",
+      "port": 6379,
+      "db": 1
+    },
+    {
+      "name": "processInbox",
+      "hostId": "activitypods",
+      "host": "redis",
+      "port": 6379,
+      "db": 1
+    },
+    {
+      "name": "webhookPost",
+      "hostId": "activitypods",
+      "host": "redis",
+      "port": 6379,
+      "db": 1
+    },
+    {
+      "name": "remotePost",
+      "hostId": "festipod",
+      "host": "redis",
+      "port": 6379,
+      "db": 15
+    },
+    {
+      "name": "processOutbox",
+      "hostId": "festipod",
+      "host": "redis",
+      "port": 6379,
+      "db": 15
+    },
+    {
+      "name": "processInbox",
+      "hostId": "festipod",
+      "host": "redis",
+      "port": 6379,
+      "db": 15
+    },
+    {
+      "name": "registerListener",
+      "hostId": "festipod",
+      "host": "redis",
+      "port": 6379,
+      "db": 15
+    },
+    {
+      "name": "timeout",
+      "hostId": "festipod",
+      "host": "redis",
+      "port": 6379,
+      "db": 15
+    }
+  ]
+}
@@ -241,7 +241,7 @@ Alors une erreur de validation est affichée pour "Date"
 Alors je peux voir la liste des participants
 Alors l'écran affiche les informations de l'événement
 Alors je peux m'inscrire à l'événement
-Alors je peux voir le QR code
+Alors je peux voir le lien de partage
 ```

 ## Test Outcomes
@@ -4,7 +4,7 @@
  "private": true,
  "type": "module",
  "scripts": {
-    "dev": "portless festipod bun --hot src/index.ts",
+    "dev": "bun --hot src/index.ts",
    "start": "NODE_ENV=production bun src/index.ts",
    "build": "bun run build.ts",
    "test:cucumber": "bun run cucumber:run && bun run cucumber:report && bun run features:parse && bun run steps:extract",
@@ -0,0 +1,160 @@
+/**
+ * DIAGNOSTIC (not a gate): reproduce the invite-link contact flow end to end
+ * with two FRESH accounts and inspect what lands in each pod's apods:contacts —
+ * then run the app's own fetchCollectionMemberIds against the real collections.
+ *
+ * Usage: bun scripts/diag-invite.ts
+ */
+import {
+  loginWithRetry,
+  http,
+  poll,
+  parseJson,
+  itemUris,
+  need,
+  sleep,
+} from './e2e-rights-matrix-support';
+import type { ApodsSession } from '../src/shared/support/activitypodsStack';
+// The app's real reader — tested here against a REAL collection document.
+import { fetchCollectionMemberIds } from '../src/shared/data/contacts';
+
+const TS = Date.now();
+const PASS = 'Test1test';
+const POD = process.env.VITE_POD_PROVIDER_URL || 'http://localhost:3000';
+const A_NAME = `diaginv${TS}a`;
+const B_NAME = `diaginv${TS}b`;
+const config = { podProviderUrl: POD, backendUrl: process.env.BACKEND_URL || process.env.VITE_BACKEND_URL || 'http://localhost:3005' };
+
+const CRED_CTX = [
+  'https://www.w3.org/ns/credentials/v2',
+  { as: 'https://www.w3.org/ns/activitystreams#', apods: 'http://activitypods.org/ns/core#', acl: 'http://www.w3.org/ns/auth/acl#' },
+];
+
+async function actorDoc(session: ApodsSession): Promise<Record<string, any>> {
+  const r = await http('GET', session.webId, { token: session.token });
+  return need(parseJson(r.text), `actor doc for ${session.webId}`);
+}
+const linkOf = (v: any): string | undefined =>
+  typeof v === 'string' ? v : v?.id ?? v?.['@id'];
+
+async function main() {
+  console.log('1) Signup of two fresh accounts (browser-driven, slow)...');
+  const a = await loginWithRetry(config, A_NAME, PASS);
+  const b = await loginWithRetry(config, B_NAME, PASS);
+  console.log('   A (inviter):', a.webId);
+  console.log('   B (invitee):', b.webId);
+
+  const aDoc = await actorDoc(a);
+  const bDoc = await actorDoc(b);
+  const aProfile = need(linkOf(aDoc.url), 'A profile URI');
+  const bProfile = need(linkOf(bDoc.url), 'B profile URI');
+  const bOutbox = need(linkOf(bDoc.outbox), 'B outbox');
+
+  console.log('2) A creates the invite capability...');
+  const issue = async () =>
+    http('POST', `${a.webId}/vc/v0.3/credentials/issue`, {
+      token: a.token,
+      contentType: 'application/json',
+      accept: 'application/ld+json',
+      timeoutMs: 30000,
+      body: JSON.stringify({
+        credential: {
+          '@context': CRED_CTX,
+          type: 'VerifiableCredential',
+          name: 'Invite Link',
+          credentialSubject: {
+            'apods:hasActivityGrant': {
+              type: 'as:Offer',
+              'as:to': { '@id': a.webId },
+              'as:target': { '@id': a.webId },
+              'as:object': { type: 'as:Add', 'as:object': { type: 'as:Profile' } },
+            },
+            'apods:hasAuthorization': {
+              type: 'acl:Authorization',
+              'acl:mode': 'acl:Read',
+              'acl:accessTo': { '@id': aProfile },
+            },
+          },
+        },
+      }),
+    });
+  let capRes = await issue();
+  for (let attempt = 0; capRes.status === 0 && attempt < 10; attempt++) {
+    console.log('   VC issue unreachable (', capRes.error ?? 'timeout', ') — retrying in 3 s...');
+    await sleep(3000);
+    capRes = await issue();
+  }
+  const capJson = parseJson(capRes.text);
+  const capUri = typeof capJson?.id === 'string' ? capJson.id : undefined;
+  console.log('   VC issue:', capRes.status, capUri ?? `${capRes.error ?? ''} ${capRes.text.slice(0, 160)}`);
+  if (!capUri) throw new Error('capability creation failed');
+
+  console.log('3) B reads the capability (proof the grant works)...');
+  const capDoc = await http('GET', capUri, { token: b.token, accept: 'application/ld+json' });
+  console.log('   capability fetch:', capDoc.status, capDoc.text.slice(0, 120).replace(/\s+/g, ' '));
+
+  console.log('4) B builds the presentation (challenge from A, sign at B)...');
+  const challengeRes = await http('POST', `${a.webId}/vc/v0.3/challenges`, { token: b.token, accept: 'application/ld+json' });
+  const challenge = need(parseJson(challengeRes.text)?.challenge, 'challenge');
+  const presRes = await http('POST', `${b.webId}/vc/v0.3/presentations/`, {
+    token: b.token,
+    contentType: 'application/json',
+    accept: 'application/ld+json',
+    body: JSON.stringify({
+      presentation: {
+        '@context': CRED_CTX,
+        type: 'VerifiablePresentation',
+        verifiableCredential: [need(parseJson(capDoc.text), 'VC doc')],
+      },
+      options: { challenge, persist: false },
+    }),
+  });
+  const presentation = parseJson(presRes.text);
+  console.log('   presentation:', presRes.status, presentation ? 'ok' : presRes.text.slice(0, 160));
+
+  console.log('5) B posts Offer{Add{profile}} + capability to B\'s outbox...');
+  const offer = await http('POST', bOutbox, {
+    token: b.token,
+    contentType: 'application/ld+json',
+    accept: 'application/ld+json',
+    body: JSON.stringify({
+      '@context': 'https://www.w3.org/ns/activitystreams',
+      type: 'Offer',
+      actor: b.webId,
+      object: { type: 'Add', object: { id: bProfile, type: 'Profile' } },
+      target: a.webId,
+      to: a.webId,
+      capability: presentation,
+    }),
+  });
+  console.log('   outbox post:', offer.status, offer.text.slice(0, 120).replace(/\s+/g, ' '));
+
+  console.log('6) Polling the apods:contacts collections (up to 60 s)...');
+  const contactsUriOf = (doc: Record<string, any>) => linkOf(doc['apods:contacts']);
+  const aContacts = need(contactsUriOf(aDoc), 'A contacts URI');
+  const bContacts = need(contactsUriOf(bDoc), 'B contacts URI');
+  const readItems = async (uri: string, token: string) =>
+    itemUris(parseJson((await http('GET', uri, { token })).text));
+
+  const aPoll = await poll(() => readItems(aContacts, a.token), v => v.length > 0, 60000, 2000);
+  await sleep(3000);
+  const bPoll = await readItems(bContacts, b.token);
+  console.log('   A contacts items:', JSON.stringify(aPoll));
+  console.log('   B contacts items:', JSON.stringify(bPoll));
+
+  console.log('7) The APP reader against the REAL collection documents...');
+  const aDocRaw = (await http('GET', aContacts, { token: a.token })).text;
+  const bDocRaw = (await http('GET', bContacts, { token: b.token })).text;
+  console.log('   A collection doc (first 400):', aDocRaw.replace(/\s+/g, ' ').slice(0, 400));
+  console.log('   B collection doc (first 400):', bDocRaw.replace(/\s+/g, ' ').slice(0, 400));
+  const appReadsA = await fetchCollectionMemberIds(aContacts, a.token, a.webId);
+  const appReadsB = await fetchCollectionMemberIds(bContacts, b.token, b.webId);
+  console.log('   app fetchCollectionMemberIds(A):', JSON.stringify(appReadsA));
+  console.log('   app fetchCollectionMemberIds(B):', JSON.stringify(appReadsB));
+
+  const ok = appReadsA.includes(b.webId) && appReadsB.includes(a.webId);
+  console.log(ok ? 'VERDICT: platform flow + app reader BOTH OK' : 'VERDICT: MISMATCH — see above');
+  process.exit(ok ? 0 : 1);
+}
+
+main().catch((e) => { console.error('DIAG FAILED:', e); process.exit(2); });
@@ -9,7 +9,7 @@
 * runs it end-to-end and fails on any UNEXPECTED ≥400, so the regression is
 * caught without a human driving the browser.
 *
- * ORIGIN. The OIDC redirect_uri is registered for `http://localhost:4000/login`
+ * ORIGIN. The OIDC redirect_uri is registered for the app origin `/login` (default http://localhost:4005)
 * only (the app's FRONT_URL), so the app MUST be served at APP_URL — do not
 * serve a private instance on an ephemeral port: the pod rejects the redirect.
 *
@@ -18,7 +18,7 @@
 * leave the app for the pod, the consent Accept is clicked once stable and the
 * page must then leave the consent screen, and the shell counts only with the
 * bottom navigation shown and no picker). The previous local loop could report
- * "shell reached" while still on `:4000/` — the user never consented, the app
+ * "shell reached" while still on the app origin `/` — the user never consented, the app
 * was never installed. `authenticated` also requires the install to be visible
 * on the pod (the user's registered Event container answers 200).
 *
@@ -31,10 +31,10 @@ import type { ApodsStackConfig } from '../src/shared/support/activitypodsStack';
 import { driveLogin, installedContainer, loginWithRetry, type DriveContext } from './e2e-rights-matrix-support';

 const strip = (u: string): string => u.replace(/\/+$/, '');
-const BACKEND: string = strip(process.env.BACKEND_URL || 'http://localhost:3003');
-const APP: string = strip(process.env.APP_URL || 'http://localhost:4000');
+const BACKEND: string = strip(process.env.BACKEND_URL || process.env.VITE_BACKEND_URL || 'http://localhost:3005');
+const APP: string = strip(process.env.APP_URL || `http://localhost:${process.env.PORT || 4005}`);
 const config: ApodsStackConfig = {
-  podProviderUrl: strip(process.env.POD_PROVIDER_URL || 'http://localhost:3000'),
+  podProviderUrl: strip(process.env.POD_PROVIDER_URL || process.env.VITE_POD_PROVIDER_URL || 'http://localhost:3000'),
  backendUrl: BACKEND,
 };
 const POD_FRONT: string = strip(process.env.POD_FRONTEND_URL || 'http://localhost:5000');
@@ -99,6 +99,9 @@ async function createMeetingPoint(page: Page): Promise<boolean> {
  await propose.first().click().catch(() => {});
  await page.waitForTimeout(1500);
  await page.locator('input[placeholder="Ex : Gouvernance coopérative — retours SCIC"]').fill('Rdv flow').catch(() => {});
+  // The place is the form's mandatory field (title optional) — without it the
+  // submit bails on the client and nothing is created.
+  await page.locator('input[placeholder="Café en face du tiers-lieu"]').fill('Devant la gare').catch(() => {});
  await page.getByRole('button', { name: /Créer le point de rencontre/ }).click().catch(() => {});
  await page.waitForTimeout(5000);
  const txt = await bodyText(page);
@@ -136,11 +139,18 @@ function classify(e: HttpError): string | null {
  await browser.close();
  await new Promise(r => setTimeout(r, 1200));

+  // User decision 2026-10-26: the suite must not accumulate pod datasets. The
+  // platform tombstones the account and drops its dataset on a delay.
+  const accountDeleted = await fetch(`${config.podProviderUrl}/.account/${USER}`, {
+    method: 'DELETE', headers: { Authorization: `Bearer ${session.token}` }, signal: AbortSignal.timeout(60000),
+  }).then(r => r.status).catch(() => 0);
+
  const fatal = errors4xx.filter(e => classify(e) === null);
  const benign = errors4xx.map(e => ({ e, label: classify(e) })).filter(x => x.label).map(x => ({ status: x.e.status, url: x.e.url, label: x.label }));
  const report = {
    user: USER,
    authenticated,
+    accountDeleted,
    login: login.detail,
    installed: install.actual,
    eventCreated,
@@ -35,7 +35,7 @@
 * visibilitychange); its one-minute throttle is untouched.
 *
 * ORIGIN. As for `e2e-login-flow.ts`: the OIDC redirect_uri is registered for
- * `http://localhost:4000/login` only, so the app MUST be served at APP_URL.
+ * the app origin `/login` (default http://localhost:4005) only, so the app MUST be served at APP_URL.
 *
 * Exit code 0 only when every phase holds; the JSON report says which did not.
 */
@@ -52,10 +52,10 @@ import {
 import { driveLogin, type DriveContext } from './e2e-rights-matrix-support';

 const strip = (u: string): string => u.replace(/\/+$/, '');
-const BACKEND: string = strip(process.env.BACKEND_URL || 'http://localhost:3003');
-const APP: string = strip(process.env.APP_URL || 'http://localhost:4000');
+const BACKEND: string = strip(process.env.BACKEND_URL || process.env.VITE_BACKEND_URL || 'http://localhost:3005');
+const APP: string = strip(process.env.APP_URL || `http://localhost:${process.env.PORT || 4005}`);
 const config: ApodsStackConfig = {
-  podProviderUrl: strip(process.env.POD_PROVIDER_URL || 'http://localhost:3000'),
+  podProviderUrl: strip(process.env.POD_PROVIDER_URL || process.env.VITE_POD_PROVIDER_URL || 'http://localhost:3000'),
  backendUrl: BACKEND,
 };
 const POD_FRONT = strip(process.env.POD_FRONTEND_URL || 'http://localhost:5000');
@@ -325,6 +325,12 @@ function benign(e: HttpError): boolean {
  await browser.close();
  await sleep(1000);

+  // User decision 2026-10-26: the suite must not accumulate pod datasets. The
+  // platform tombstones the account and drops its dataset on a delay.
+  const accountDeleted = await fetch(`${config.podProviderUrl}/.account/${USER}`, {
+    method: 'DELETE', headers: { Authorization: `Bearer ${user.token}` }, signal: AbortSignal.timeout(60000),
+  }).then(r => r.status).catch(() => 0);
+
  // The deferred probe lands at the end of the minute: never before (throttle),
  // and not much after (it was deferred, not dropped). Measured between the
  // app's own log lines, so a few hundred ms of request latency either way.
@@ -374,6 +380,7 @@ function benign(e: HttpError): boolean {
  const report = {
    user: USER,
    appUri,
+    accountDeleted,
    positive,
    negative,
    recovered,
@@ -104,9 +104,8 @@ export class Matrix {
  }

  /**
-   * A MANUAL-CHECK line: an assertion this script deliberately does NOT exercise
-   * live (it would send a forged or spoofed activity — user decision 2026-10-13,
-   * defensive only). Printed with where it is covered; never affects the exit code.
+   * A MANUAL-CHECK line: an assertion this script does not exercise live yet.
+   * Printed with where it is covered; never affects the exit code.
   */
  manual(id: string, group: string, name: string, coverage: string): void {
    this.push({ id, group, name, kind: 'manual', expected: '(not exercised live)', actual: coverage, status: 'MANUAL-CHECK' });
@@ -262,7 +261,7 @@ export async function installApp(config: ApodsStackConfig, session: ApodsSession
  if (reg.status < 200 || reg.status >= 300) return { ok: false, actual: `register → ${brief(reg)}` };
  const container = await poll(
    () => http('GET', `${session.storage}/as/event`, { token: session.token }),
-    r => r.status === 200, 30000, 500,
+    r => r.status === 200, 90000, 500,
  );
  return { ok: container.status === 200, actual: `register → HTTP ${reg.status}; ${session.storage}/as/event → ${brief(container).slice(0, 40)}` };
 }
@@ -380,7 +379,7 @@ export interface LoginOutcome { ok: boolean; detail: string }
 * still open (a sign-out of the app keeps it: the revocation probe's second
 * sign-in), in which case no form is shown and the hops below start at once;
 * after the credentials the
- * browser comes BACK to the app's OIDC callback (:4000/login?code…), and only
+ * browser comes BACK to the app's OIDC callback (<app origin>/login?code…), and only
 * then — when the app is not yet registered on this pod — does the app send it
 * to the pod's consent screen (:5000/authorize), which navigates a second time
 * right after it opens. Accept leads back to the app, then to the shell.
@@ -516,6 +515,9 @@ export async function createMeetingPointUi(page: Page, title: string): Promise<b
  await propose.first().click().catch(() => {});
  await page.waitForTimeout(1500);
  await page.locator('input[placeholder="Ex : Gouvernance coopérative — retours SCIC"]').fill(title, { timeout: 10000 }).catch(() => {});
+  // The form REQUIRES a place since the title became optional (the pod has no
+  // slot for a free-text "when"; the place is the one mandatory fact).
+  await page.locator('input[placeholder="Café en face du tiers-lieu"]').fill('Devant la mairie', { timeout: 10000 }).catch(() => {});
  await page.getByRole('button', { name: /Créer le point de rencontre/ }).click({ timeout: 5000 }).catch(() => {});
  const txt = await poll(() => bodyText(page), t => t.includes(title), 15000, 500);
  return txt.includes(title) && !/pas pu/i.test(txt);
@@ -37,7 +37,7 @@
 *
 * USAGE (reactive dev):
 *   Terminal 1:  pnpm run overlay:polyfill    # or: pnpm run overlay:indexing
- *   Terminal 2:  bun run dev                  # portless festipod bun --hot src/index.ts
+ *   Terminal 2:  pnpm dev                      # bun --hot src/index.ts
 *   Edit the checkout's src → it lands in node_modules → RESTART dev to pick it up.
 *
 *   pnpm run overlay:indexing --once          # overlay + verify, no watch (CI / one-shot)
@@ -76,10 +76,10 @@ const TIMEOUT_REVOCATION_MS = 15 * 60 * 1000; // 15 min (the probe bounds itself

 /** The local stack, with the same defaults and env overrides as the e2e scripts. */
 const strip = (u: string): string => u.replace(/\/+$/, "");
-const POD_PROVIDER = strip(process.env.POD_PROVIDER_URL || "http://localhost:3000");
+const POD_PROVIDER = strip(process.env.POD_PROVIDER_URL || process.env.VITE_POD_PROVIDER_URL || 'http://localhost:3000');
 const POD_FRONT = strip(process.env.POD_FRONTEND_URL || "http://localhost:5000");
-const BACKEND = strip(process.env.BACKEND_URL || "http://localhost:3003");
-const APP = strip(process.env.APP_URL || "http://localhost:4000");
+const BACKEND = strip(process.env.BACKEND_URL || process.env.VITE_BACKEND_URL || 'http://localhost:3005');
+const APP = strip(process.env.APP_URL || `http://localhost:${process.env.PORT || 4005}`);
 const FUSEKI = strip(process.env.FUSEKI_URL || "http://localhost:3030");

 /** What the browser-driven e2e probes need answering 200 — every piece of the local stack. */
@@ -1,10 +1,10 @@
-import { useEffect } from 'react';
+import React, { useEffect } from 'react';
 import { RouterProvider, useNavigate, useRouter } from './router';
 import { ThemeProvider } from '../shared/context/ThemeContext';
 import { NextGraphProvider } from '../shared/context/NextGraphContext';
-import { FestipodDataProvider } from '../shared/context/FestipodDataContext';
+import { useFestipodData, FestipodDataProvider } from '../shared/context/FestipodDataContext';
 import { AuthGate } from './AuthGate';
-import { ToastContainer } from '../shared/components/sketchy';
+import { ToastContainer, Spinner, Text } from '../shared/components/sketchy';
 import { initialBackendName } from '../shared/refine/providers';

 // Auth
@@ -31,6 +31,44 @@ import { FriendsListScreen } from '../modules/user/screens/FriendsListScreen';
 import { ShareProfileScreen } from '../modules/user/screens/ShareProfileScreen';
 import { ConnectScreen } from '../modules/user/screens/ConnectScreen';

+/**
+ * A signed-in person whose Pod has no readable profile, or one without a name,
+ * cannot be recognised by anyone and cannot edit anything: the app tells them
+ * so and asks for a name instead of leaving them in screens that silently fail.
+ * Presence of a name is the only completion flag — nothing is stored locally.
+ */
+function ProfileCompletionGate({ children }: { children: React.ReactNode }) {
+  const { currentUser, profileStatus } = useFestipodData();
+  if (profileStatus === 'loading') {
+    // A blank screen reads as a crash; the profile read is the app's first
+    // blocking step, so say that plainly while it settles.
+    return (
+      <div style={{ flex: 1, display: 'flex', flexDirection: 'column', alignItems: 'center', justifyContent: 'center', gap: 12, padding: 24 }}>
+        <Spinner size={24} />
+        <Text style={{ color: '#888', fontSize: 14 }}>Chargement de votre profil…</Text>
+      </div>
+    );
+  }
+  if (profileStatus === 'missing') {
+    return (
+      <div style={{ padding: 24, textAlign: 'center' }}>
+        <p style={{ fontWeight: 700 }}>Votre profil est introuvable</p>
+        <p style={{ color: '#888', fontSize: 14, lineHeight: 1.5 }}>
+          Votre Pod ne fournit pas de profil lisible : Festipod ne peut pas l'afficher ni le modifier.
+          Complétez votre profil depuis votre fournisseur de Pod, puis réessayez. Cet écran apparaît aussi quand la lecture a échoué momentanément.
+        </p>
+        <button onClick={() => window.location.reload()} style={{ padding: '10px 18px', borderRadius: 10, border: '1.5px solid #ccc', background: '#fff', cursor: 'pointer' }}>
+          Réessayer
+        </button>
+      </div>
+    );
+  }
+  if (profileStatus === 'ready' && (currentUser?.name ?? '').trim() === '') {
+    return <UpdateProfileScreen onboarding />;
+  }
+  return <>{children}</>;
+}
+
 function AppContent() {
  const { route } = useRouter();

@@ -81,7 +119,9 @@ export function App() {
    <AuthGate>
      <FestipodDataProvider>
        <div className="app-container">
-          <AppContent />
+          <ProfileCompletionGate>
+            <AppContent />
+          </ProfileCompletionGate>
          <ToastContainer />
        </div>
      </FestipodDataProvider>
@@ -14,9 +14,9 @@ test('clientId uses explicit backendClientId when set', () => {
 });

 test('clientId derives the actor uri from backendUrl when backendClientId is empty', () => {
-  setRuntimeConfig({ backendUrl: 'http://localhost:3003', backendClientId: '' });
+  setRuntimeConfig({ backendUrl: 'http://localhost:3005', backendClientId: '' });
  const cfg = resolveActivityPodsAuthConfig('http://localhost:5000');
-  expect(cfg.clientId).toBe('http://localhost:3003/as/actor/app');
+  expect(cfg.clientId).toBe('http://localhost:3005/as/actor/app');
  expect(cfg.redirectUri).toBe('http://localhost:5000/login');
 });

@@ -27,9 +27,9 @@ test('clientId falls back to the origin actor uri when nothing is configured', (
 });

 test('clientId does not double the slash on a trailing-slash backendUrl', () => {
-  setRuntimeConfig({ backendUrl: 'http://localhost:3003/' });
+  setRuntimeConfig({ backendUrl: 'http://localhost:3005/' });
  const cfg = resolveActivityPodsAuthConfig('http://localhost:5000');
-  expect(cfg.clientId).toBe('http://localhost:3003/as/actor/app');
+  expect(cfg.clientId).toBe('http://localhost:3005/as/actor/app');
 });

 test('podProviderUrl is passed through when set', () => {
@@ -139,19 +139,6 @@ body {
  color: var(--app-black);
 }

-/* Placeholder box */
-.app-placeholder {
-  background: var(--app-light-gray);
-  border: 2px dashed #ddd;
-  border-radius: var(--app-radius-sm);
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  color: var(--app-gray);
-  font-family: var(--font-app);
-  font-size: 14px;
-}
-
 /* Divider */
 .app-divider {
  height: 1px;
@@ -263,7 +250,7 @@ body {
  position: relative;
 }

-/* Badge / Tag */
+/* Badge */
 .app-badge {
  display: inline-block;
  padding: 3px 10px;
@@ -274,17 +261,6 @@ body {
  color: #666;
 }

-.app-tag {
-  display: inline-block;
-  padding: 3px 10px;
-  border-radius: 20px;
-  font-size: 11.5px;
-  font-weight: 500;
-  color: #5a3e00;
-  background: #fff3d6;
-  letter-spacing: 0.1px;
-}
-
 /* Section label */
 .app-section-label {
  font-size: 12px;
@@ -1,7 +1,7 @@
 import { serve } from "bun";
 import index from "./index.html";

-const port = process.env.PORT ? parseInt(process.env.PORT) : 4000;
+const port = process.env.PORT ? parseInt(process.env.PORT) : 4005;

 // Strict base64 check (not a mere `Buffer.from` attempt, which silently drops invalid
 // characters instead of failing): reject anything that is not a well-formed base64 body
@@ -122,7 +122,10 @@ const server = serve({
      return new Response("No shared wallet file configured.", { status: 404 });
    },

-    // Serve index.html for all unmatched routes (must be last)
+    // Serve index.html for all unmatched routes (must be last). The imported
+    // HTMLBundle is opaque at runtime (`index.index` is its source path, not
+    // HTML) — only Bun.serve knows how to build & serve it, so it must stay
+    // the direct route value; wrapping it in Response() would serve garbage.
    "/*": index,
  },

@@ -59,10 +59,6 @@ export function WelcomeScreen() {
          Déjà membre ? <span onClick={() => navigate('/home')} style={{ color: '#E8590C', cursor: 'pointer', fontWeight: 600 }}>Connexion</span>
        </Text>
      </div>
-
-      <Text style={{ textAlign: 'center', fontSize: 12, color: '#bbb' }}>
-        Version beta - 127 membres actifs
-      </Text>
    </div>
  );
 }
@@ -10,7 +10,7 @@ Fonctionnalité: Smoke e2e de la pile ActivityPods locale
  # aucun broker. Elle n'existe que si la pile locale tourne — son mode d'emploi
  # reproductible est le concept `data-layer`,
  # `cookbook_local-activitypods-platform.md` (pod provider :3000, backend Festipod
-  # :3003, redis remappé :6390). Le chargement de l'app reprend le motif `@e2e` du
+  # :3005 par défaut). Le chargement de l'app reprend le motif `@e2e` du
  # repo (serveur réel + Playwright), pas le wallet partagé.

  Scénario: La pile locale est joignable et le backend sert son application
@@ -32,8 +32,11 @@ Fonctionnalité: Smoke e2e de la pile ActivityPods locale
  # L'app s'installe sur le Pod (consentement de l'agent d'autorisation, ou pour un
  # scénario sans navigateur l'endpoint d'enregistrement — voir l'étape
  # « installée sur le Pod »). Une fois installée, l'activité `as:Join` postée sur
-  # l'outbox de l'utilisateur EST délivrée au backend, qui tient la collection
-  # `apods:attendees` du point de rencontre. Le point de rencontre est créé dans le
+  # l'outbox de l'utilisateur, adressée à l'acteur de l'app seul, est livrée dans
+  # l'inbox de l'app et traitée par le backend à sa réception : il inscrit dans la collection `apods:attendees` du point de
+  # rencontre l'URN de membre dérivée du secret de participation du profil
+  # (écrit avant le Join, comme le fait l'app) — jamais le WebID
+  # (decision_2026-10-29_participation-privacy-mechanism). Le point de rencontre est créé dans le
  # conteneur enregistré (`as/event`) ; sa collection `apods:attendees` est attachée
  # par le backend lui-même, à la création — le scénario la lit, il ne la crée pas.
  Scénario: Rejoindre puis quitter un point de rencontre met à jour la collection apods:attendees
@@ -47,7 +50,8 @@ Fonctionnalité: Smoke e2e de la pile ActivityPods locale

  # Dépend du scénario précédent pour la mise en place, mais lit la collection
  # elle-même : le compteur est le total de la collection (jamais les profils
-  # résolus) et une référence non résolue reste comptée et rendue anonyme.
+  # résolus) et une URN de membre, que rien ne résout, reste comptée et rendue
+  # anonyme.
  Scénario: Le compteur et la liste des participants tiennent une référence non résolue
    Étant donné une session Pod locale pour "alice" avec le mot de passe "Test1test"
    Et l'application Festipod est installée sur le Pod de la session
@@ -1,26 +1,9 @@
 import React, { useState, useMemo } from 'react';
 import { ArrowLeft } from 'lucide-react';
-import { Header, Text, Input, Button, Placeholder, showToast } from '../../../shared/components/sketchy';
+import { Header, Text, Input, Button, ImagePicker, showToast } from '../../../shared/components/sketchy';
 import { useFestipodData } from '../../../shared/context/FestipodDataContext';
 import { eventPath, useNavigate } from '../../../app/router';

-const importableEvents = [
-  {
-    name: 'Festival des Utopies Concrètes',
-    source: 'Mobilizon',
-    date: '2026-03-15',
-    location: 'Paris, Parc de la Villette',
-    description: 'Festival annuel présentant des alternatives concrètes pour un monde durable.',
-  },
-  {
-    name: "Rencontres de l'Écologie",
-    source: 'Transiscope',
-    date: '2026-04-20',
-    location: 'Lyon, Halle Tony Garnier',
-    description: 'Deux jours de conférences et ateliers sur la transition écologique.',
-  },
-];
-
 type Step = 1 | 2 | 3;

 export function CreateEventScreen() {
@@ -35,7 +18,6 @@ export function CreateEventScreen() {
  const [endTime, setEndTime] = useState('');
  const [location, setLocation] = useState('');
  const [description, setDescription] = useState('');
-  const [importedFrom, setImportedFrom] = useState<string | null>(null);

  const similarExisting = useMemo(() => {
    if (name.trim().length < 3) return [];
@@ -43,22 +25,6 @@ export function CreateEventScreen() {
    return events.filter(e => e.title.toLowerCase().includes(lower.slice(0, 3)));
  }, [name, events]);

-  const importCandidate = useMemo(() => {
-    if (importedFrom) return null;
-    if (name.trim().length < 3) return null;
-    const lower = name.toLowerCase();
-    return importableEvents.find(e => e.name.toLowerCase().includes(lower.slice(0, 3))) ?? null;
-  }, [name, importedFrom]);
-
-  const applyImport = (candidate: typeof importableEvents[number]) => {
-    setName(candidate.name);
-    setStartDate(candidate.date);
-    setLocation(candidate.location);
-    setDescription(candidate.description);
-    setImportedFrom(candidate.source);
-    showToast(`Données importées depuis ${candidate.source}`, 'info');
-  };
-
  const goNext = () => {
    if (step === 1) {
      if (similarExisting.length > 0) setStep(2);
@@ -74,6 +40,8 @@ export function CreateEventScreen() {
    setStep((step - 1) as Step);
  };

+  const [coverImage, setCoverImage] = useState('');
+
  const submit = async () => {
    const dateLabel = startDate
      ? (endDate ? `${startDate} - ${endDate}` : startDate)
@@ -94,6 +62,7 @@ export function CreateEventScreen() {
        endTime,
        location: location || 'Lieu à définir',
        description,
+        coverImage: coverImage || undefined,
        // Option B: the creator does NOT auto-participate (no host notion). The count
        // starts at 0 and is DERIVED by the owner-materializer from real inbox
        // deposits (|active registrations|) — never a local literal. Passing 1 here was
@@ -139,33 +108,6 @@ export function CreateEventScreen() {
      </div>

      <div style={{ flex: 1, padding: 16, overflow: 'auto' }}>
-        {importCandidate && step === 1 && (
-          <div
-            style={{
-              background: '#EFF6FF',
-              border: '1.5px solid #93C5FD',
-              borderRadius: 12,
-              padding: 12,
-              marginBottom: 16,
-            }}
-          >
-            <Text style={{ margin: 0, fontWeight: 'bold', fontSize: 14, marginBottom: 4 }}>
-              Données trouvées sur {importCandidate.source}
-            </Text>
-            <Text style={{ margin: 0, fontSize: 13, lineHeight: 1.5 }}>
-              « {importCandidate.name} » — {importCandidate.location}
-            </Text>
-            <div style={{ display: 'flex', gap: 8, marginTop: 8 }}>
-              <Button variant="primary" style={{ padding: '6px 12px', fontSize: 13 }} onClick={() => applyImport(importCandidate)}>
-                Importer
-              </Button>
-              <Button style={{ padding: '6px 12px', fontSize: 13 }} onClick={() => setImportedFrom('dismissed')}>
-                Ignorer
-              </Button>
-            </div>
-          </div>
-        )}
-
        {step === 1 && (
          <div style={{ display: 'flex', flexDirection: 'column', gap: 16 }}>
            <Text style={{ fontSize: 13, color: '#888', margin: 0 }}>
@@ -179,7 +121,6 @@ export function CreateEventScreen() {
                value={name}
                onChange={(e: React.ChangeEvent<HTMLInputElement>) => {
                  setName(e.target.value);
-                  if (importedFrom === 'dismissed') setImportedFrom(null);
                }}
              />
            </div>
@@ -254,11 +195,7 @@ export function CreateEventScreen() {

        {step === 3 && (
          <div style={{ display: 'flex', flexDirection: 'column', gap: 16 }}>
-            <Placeholder
-              height={140}
-              label="+ Ajouter une photo"
-              style={{ cursor: 'pointer' }}
-            />
+            <ImagePicker value={coverImage} label="+ Ajouter une photo" onChange={setCoverImage} />

            <div style={{ display: 'flex', gap: 12 }}>
              <div style={{ flex: 1 }}>
@@ -10,7 +10,6 @@ export function EventDetailScreen() {
  const { eventId } = useParams();
  const {
    getEvent,
-    currentUser,
    isParticipating,
    joinMeetingPoint,
    leaveMeetingPoint,
@@ -36,9 +35,8 @@ export function EventDetailScreen() {

  const meetingPoints: MeetingPointData[] = meetingPointsRaw.map(mp => ({
    id: mp.id,
-    title: mp.location,
-    when: mp.time,
-    duration: '~60 min',
+    title: mp.title,
+    when: mp.time || undefined,
    lieu: mp.location,
    // Derived by the data layer (absent where it cannot be counted per point).
    participantCount: mp.participantCount,
@@ -81,11 +79,9 @@ export function EventDetailScreen() {
  // the answer is still coming.
  const ownership = eventId ? getEventOwnership(eventId) : 'unknown';
  const canEdit = ownership === 'mine';
-  // Preview list shows the OTHER participants (deliberate — the total is in the
-  // header count; the full list at "Voir tous les participants" shows everyone).
-  // On this backend `currentUser.id` and `p.id` are BOTH actor URIs (the id the
-  // attendees collection keys memberships by), so comparing them drops self.
-  const knownParticipants = participants.filter(p => p.id !== currentUser?.id);
+  // Preview and full list apply the same rule — everyone, self included — so the
+  // rows agree with the header count.
+  const knownParticipants = participants;
  // The rest of the total could not be resolved to a profile — a non-contact
  // sees only anonymous attendees. The total still counts them, so the
  // difference is rendered as anonymous rows (mirrors ParticipantsListScreen),
@@ -140,7 +136,7 @@ export function EventDetailScreen() {
        </div>

        <div style={{ padding: '0 16px 12px' }}>
-          <EventCover eventId={event.id} height={100} />
+          <EventCover url={event.coverImage} height={100} />
        </div>

        <div style={{ margin: '0 16px 12px', padding: 14, background: '#fafafa', borderRadius: 12, display: 'flex', flexDirection: 'column', gap: 8 }}>
@@ -217,7 +213,7 @@ export function EventDetailScreen() {
                onClick={() => navigate(userPath(p.id))}
                style={{ display: 'flex', alignItems: 'center', gap: 12, padding: '10px 0', borderBottom: '1px solid #f5f5f5', cursor: 'pointer' }}
              >
-                <Avatar initials={displayInitials} size={38} color="#2B6CB0" />
+                <Avatar initials={displayInitials} photo={p.photo} size={38} color="#2B6CB0" />
                <div style={{ flex: 1 }}>
                  <div className="user-content" style={{ fontSize: 14, fontWeight: 600 }}>{displayName}</div>
                  {displayUsername && (
@@ -238,7 +234,7 @@ export function EventDetailScreen() {
              </div>
            </div>
          ))}
-          {unknownCount > 0 && (
+          {participants.length > 0 && (
            <div
              style={{ marginTop: 12, padding: 12, background: '#f9f9f9', borderRadius: 12, textAlign: 'center', cursor: 'pointer' }}
              onClick={() => navigate(eventPath(event.id, 'participants'))}
@@ -1,17 +1,11 @@
+import { useState } from 'react';
 import { ArrowLeft } from 'lucide-react';
-import { Header, Input, Card, Badge, BottomNav, AvatarStack, getEventPhotoUrl, Text } from '../../../shared/components/sketchy';
+import { Header, Input, Card, BottomNav, EventCover, Text } from '../../../shared/components/sketchy';
 import { useFestipodData } from '../../../shared/context/FestipodDataContext';
 import { eventPath, useNavigate } from '../../../app/router';
+import { matchesQuery } from '../../../shared/utils/search';
 import { useDiscoverEvents } from '../useDiscoverEvents';

-const PEOPLE = [
-  { name: 'Marie Leroy', color: '#E8590C' },
-  { name: 'Jean Morel', color: '#2B6CB0' },
-  { name: 'Alice Duval', color: '#9C4DC7' },
-  { name: 'Thomas Bazin', color: '#38A169' },
-  { name: 'Camille Noir', color: '#D69E2E' },
-];
-
 const EVENT_COLORS = ['#E8590C', '#2B6CB0', '#9C4DC7', '#38A169', '#D69E2E'];

 function EventCard({
@@ -19,23 +13,15 @@ function EventCard({
  participantCount,
  onClick,
 }: {
-  event: { id: string; title: string; date: string; location: string; distance?: number };
+  event: { id: string; title: string; date: string; location: string; distance?: number; coverImage?: string };
  /** `undefined` when nobody counted it (a catalog entry) — then no count is shown, never a made-up 0. */
  participantCount: number | undefined;
  onClick: () => void;
 }) {
  const color = EVENT_COLORS[Number(event.id.replace(/\D/g, '') || 0) % EVENT_COLORS.length] ?? '#E8590C';
-  const people = PEOPLE.slice(0, Math.min(5, Math.max(1, participantCount ?? 0)));
  return (
    <Card onClick={onClick} style={{ marginBottom: 12, padding: 0, overflow: 'hidden' }} accentColor={color}>
-      <div
-        style={{
-          height: 100,
-          backgroundImage: `url(${getEventPhotoUrl(event.id)})`,
-          backgroundSize: 'cover',
-          backgroundPosition: 'center',
-        }}
-      />
+      <EventCover url={event.coverImage} height={100} borderRadius={0} />
      <div style={{ padding: 14 }}>
        <div className="user-content" style={{ fontSize: 15.5, fontWeight: 700, lineHeight: 1.3, marginBottom: 6 }}>{event.title}</div>
        <div style={{ fontSize: 12.5, color: '#888', marginBottom: 10 }}>
@@ -44,7 +30,6 @@ function EventCard({
        {participantCount !== undefined && (
          <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
            <div style={{ display: 'flex', alignItems: 'center', gap: 10 }}>
-              <AvatarStack people={people} size={26} />
              <span style={{ fontSize: 12, color: '#666' }}>{participantCount} inscrits</span>
            </div>
          </div>
@@ -57,7 +42,9 @@ function EventCard({
 export function EventsScreen() {
  const navigate = useNavigate();
  const { events: ownEvents, getEvent } = useFestipodData();
-  const events = useDiscoverEvents(ownEvents);
+  const { events: allEvents, loading } = useDiscoverEvents(ownEvents);
+  const [query, setQuery] = useState('');
+  const events = allEvents.filter(e => matchesQuery(query, e.title, e.location));

  return (
    <div style={{ display: 'flex', flexDirection: 'column', height: '100%' }}>
@@ -67,22 +54,18 @@ export function EventsScreen() {
      />

      <div style={{ padding: '12px 16px', borderBottom: '1px solid #f0f0f0' }}>
-        <Input placeholder="Rechercher un événement..." />
-      </div>
-
-      <div style={{ display: 'flex', gap: 8, padding: '12px 16px', borderBottom: '1px solid #f0f0f0' }}>
-        <Badge style={{ background: '#1a1a1a', color: '#fff' }}>Tous</Badge>
-        <Badge>Cette semaine</Badge>
-        <Badge>Proches</Badge>
-        <Badge>Amis</Badge>
+        <Input placeholder="Rechercher un événement..." value={query} onChange={(e: React.ChangeEvent<HTMLInputElement>) => setQuery(e.target.value)} />
      </div>

      <div style={{ flex: 1, padding: 16, overflow: 'auto' }}>
        {events.length === 0 && (
          <Text style={{ textAlign: 'center', color: '#888', marginTop: 32 }}>
-            Aucun événement à afficher
+            {loading ? 'Chargement des événements…' : query.trim() ? 'Aucun événement ne correspond à votre recherche.' : 'Aucun événement à afficher pour le moment.'}
          </Text>
        )}
+        {events.length > 0 && loading && (
+          <Text style={{ textAlign: 'center', color: '#888', fontSize: 12, marginBottom: 8 }}>Chargement des événements…</Text>
+        )}
        {events.map(event => {
          // An event the data layer READ (own, or another user's opened by URI)
          // carries a derived count; a catalog entry nobody opened carries none —
@@ -3,17 +3,20 @@ import { ArrowLeft } from 'lucide-react';
 import { Header, Input, Text, Avatar, Checkbox, Button, showToast } from '../../../shared/components/sketchy';
 import { useFestipodData } from '../../../shared/context/FestipodDataContext';
 import { safeUserName, safeUserInitials, safeUserUsername } from '../../../shared/context/festipodDataBase';
+import { matchesQuery } from '../../../shared/utils/search';
 import { eventPath, useNavigate, useParams } from '../../../app/router';

 export function InviteScreen() {
  const navigate = useNavigate();
  const { eventId } = useParams();
-  const { getFriends } = useFestipodData();
+  const { getFriends, inviteToEvent } = useFestipodData();
  const friends = getFriends();

  const [selected, setSelected] = useState<Set<string>>(new Set());
  const [step, setStep] = useState<'select' | 'message'>('select');
  const [message, setMessage] = useState('');
+  const [query, setQuery] = useState('');
+  const shownFriends = friends.filter(f => matchesQuery(query, safeUserName(f), safeUserUsername(f)));

  const toggleFriend = (id: string) => {
    const next = new Set(selected);
@@ -23,9 +26,22 @@ export function InviteScreen() {

  const selectedFriends = friends.filter(f => selected.has(f.id));

+  const [sending, setSending] = useState(false);
  const send = () => {
-    showToast(`${selected.size} invitation${selected.size > 1 ? 's' : ''} envoyée${selected.size > 1 ? 's' : ''}`, 'success');
-    navigate(eventPath(eventId ?? ''));
+    if (!eventId || sending) return;
+    setSending(true);
+    const count = selected.size;
+    // The confirmation follows the post: nothing is announced as sent until the Pod accepted it.
+    void Promise.resolve(inviteToEvent(eventId, [...selected], message))
+      .then(() => {
+        showToast(`${count} invitation${count > 1 ? 's' : ''} envoyée${count > 1 ? 's' : ''}`, 'success');
+        navigate(eventPath(eventId));
+      })
+      .catch((err: unknown) => {
+        console.error('[Invite] invitation failed:', err);
+        showToast("Les invitations n'ont pas pu être envoyées", 'error');
+      })
+      .finally(() => setSending(false));
  };

  if (step === 'message') {
@@ -126,9 +142,11 @@ export function InviteScreen() {
        left={<ArrowLeft size={20} onClick={() => navigate(eventPath(eventId ?? ''))} style={{ cursor: 'pointer' }} />}
      />

-      <div style={{ padding: '12px 16px', borderBottom: '1px solid #f0f0f0' }}>
-        <Input placeholder="Rechercher un ami..." />
-      </div>
+      {friends.length > 0 && (
+        <div style={{ padding: '12px 16px', borderBottom: '1px solid #f0f0f0' }}>
+          <Input placeholder="Rechercher un ami..." value={query} onChange={(e: React.ChangeEvent<HTMLInputElement>) => setQuery(e.target.value)} />
+        </div>
+      )}

      {selected.size > 0 && (
        <div style={{
@@ -143,7 +161,15 @@ export function InviteScreen() {
      )}

      <div style={{ flex: 1, overflow: 'auto' }}>
-        {friends.map((friend) => (
+        {friends.length === 0 && (
+          <Text style={{ textAlign: 'center', color: '#888', margin: '32px 24px', lineHeight: 1.5 }}>
+            Vous n'avez pas encore de contact à inviter. Ajoutez des personnes à votre réseau depuis leur profil.
+          </Text>
+        )}
+        {friends.length > 0 && shownFriends.length === 0 && (
+          <Text style={{ textAlign: 'center', color: '#888', marginTop: 32 }}>Aucun contact ne correspond à votre recherche.</Text>
+        )}
+        {shownFriends.map((friend) => (
          <div
            key={friend.id}
            onClick={() => toggleFriend(friend.id)}
@@ -1,35 +1,39 @@
 import React, { useState } from 'react';
 import { ArrowLeft } from 'lucide-react';
-import { Button, Avatar, Input, showToast } from '../../../shared/components/sketchy';
+import { Button, Input, showToast } from '../../../shared/components/sketchy';
 import { useFestipodData } from '../../../shared/context/FestipodDataContext';
-import { safeUserName, safeUserInitials } from '../../../shared/context/festipodDataBase';
 import { eventPath, useNavigate, useParams } from '../../../app/router';

 export function MeetingPointsScreen() {
  const navigate = useNavigate();
  const { eventId } = useParams();
-  const { addMeetingPoint, currentUser, getFriends } = useFestipodData();
-  const friends = getFriends();
+  const { addMeetingPoint } = useFestipodData();

  const [title, setTitle] = useState('');
-  const [when, setWhen] = useState('');
-  const [duration, setDuration] = useState('~30 min');
  const [lieu, setLieu] = useState('');
-  const [invited, setInvited] = useState<string[]>(friends.slice(0, 3).map(f => f.id));
-
-  const removeInvited = (id: string) => {
-    setInvited(invited.filter(i => i !== id));
-  };

  const submit = () => {
    if (!eventId) return;
-    addMeetingPoint({
+    if (!lieu.trim()) {
+      showToast('Indiquez le lieu du point de rencontre', 'error');
+      return;
+    }
+    // Only what the backend can store is asked for: the title and the place.
+    // A free-text "when" / duration has no slot in the pod's vocabulary (no
+    // ActivityStreams term holds either), so the form no longer offers them.
+    void Promise.resolve(addMeetingPoint({
      eventId,
-      location: title || lieu || 'Point de rencontre',
-      time: when || duration,
-    });
-    showToast(title ? `Point de rencontre créé : ${title}` : 'Point de rencontre créé', 'success');
-    navigate(eventPath(eventId ?? ''));
+      title: title.trim() || undefined,
+      location: lieu.trim(),
+    }))
+      .then(() => {
+        showToast(title.trim() ? `Point de rencontre créé : ${title.trim()}` : 'Point de rencontre créé', 'success');
+        navigate(eventPath(eventId));
+      })
+      .catch((err: unknown) => {
+        console.error('[MeetingPoints] creation failed:', err);
+        showToast("Le point de rencontre n'a pas pu être créé", 'error');
+      });
  };

  return (
@@ -52,49 +56,14 @@ export function MeetingPointsScreen() {
          style={{ marginBottom: 16 }}
        />

-        <div style={{ display: 'flex', gap: 10, marginBottom: 16 }}>
-          <div style={{ flex: 1 }}>
-            <label style={{ fontSize: 12, fontWeight: 600, color: '#999', textTransform: 'uppercase', letterSpacing: 0.8, display: 'block', marginBottom: 6 }}>Quand</label>
-            <Input
-              value={when}
-              onChange={(e: React.ChangeEvent<HTMLInputElement>) => setWhen(e.target.value)}
-              placeholder="Ven. 22 · 9h00"
-            />
-          </div>
-          <div style={{ flex: 1 }}>
-            <label style={{ fontSize: 12, fontWeight: 600, color: '#999', textTransform: 'uppercase', letterSpacing: 0.8, display: 'block', marginBottom: 6 }}>Durée</label>
-            <Input
-              value={duration}
-              onChange={(e: React.ChangeEvent<HTMLInputElement>) => setDuration(e.target.value)}
-              placeholder="~30 min"
-            />
-          </div>
-        </div>
-
-        <label style={{ fontSize: 12, fontWeight: 600, color: '#999', textTransform: 'uppercase', letterSpacing: 0.8, display: 'block', marginBottom: 6 }}>Lieu</label>
+        <label style={{ fontSize: 12, fontWeight: 600, color: '#999', textTransform: 'uppercase', letterSpacing: 0.8, display: 'block', marginBottom: 6 }}>Lieu *</label>
        <Input
          value={lieu}
          onChange={(e: React.ChangeEvent<HTMLInputElement>) => setLieu(e.target.value)}
          placeholder="Café en face du tiers-lieu"
-          style={{ marginBottom: 16 }}
+          style={{ marginBottom: 24 }}
        />

-        <label style={{ fontSize: 12, fontWeight: 600, color: '#999', textTransform: 'uppercase', letterSpacing: 0.8, display: 'block', marginBottom: 8 }}>Inviter</label>
-        <div style={{ display: 'flex', gap: 6, flexWrap: 'wrap', marginBottom: 20 }}>
-          {invited.map(id => {
-            const friend = friends.find(f => f.id === id);
-            if (!friend) return null;
-            return (
-              <div key={id} style={{ display: 'flex', alignItems: 'center', gap: 6, padding: '6px 12px 6px 6px', borderRadius: 20, background: '#f5f5f5' }}>
-                <Avatar initials={safeUserInitials(friend)} color="#2B6CB0" size={22} />
-                <span style={{ fontSize: 12, fontWeight: 500 }}>{safeUserName(friend).split(' ')[0]}</span>
-                <span onClick={() => removeInvited(id)} style={{ fontSize: 14, color: '#bbb', cursor: 'pointer' }}>×</span>
-              </div>
-            );
-          })}
-          <button style={{ padding: '6px 14px', borderRadius: 20, border: '1.5px dashed #ccc', background: 'none', fontSize: 12, cursor: 'pointer', color: '#999', fontFamily: 'var(--font-app)' }}>+ ajouter</button>
-        </div>
-
        <Button
          variant="primary"
          style={{ width: '100%', padding: 14, fontSize: 15 }}
@@ -1,7 +1,9 @@
+import { useState } from 'react';
 import { ArrowLeft } from 'lucide-react';
 import { Header, Avatar, Text, Input } from '../../../shared/components/sketchy';
 import { useFestipodData } from '../../../shared/context/FestipodDataContext';
 import { safeUserName, safeUserInitials, safeUserUsername } from '../../../shared/context/festipodDataBase';
+import { matchesQuery } from '../../../shared/utils/search';
 import { eventPath, useNavigate, useParams, userPath } from '../../../app/router';

 const COLORS = ['#E8590C', '#2B6CB0', '#9C4DC7', '#38A169', '#D69E2E', '#E53E3E'];
@@ -9,9 +11,10 @@ const COLORS = ['#E8590C', '#2B6CB0', '#9C4DC7', '#38A169', '#D69E2E', '#E53E3E'
 export function ParticipantsListScreen() {
  const navigate = useNavigate();
  const { eventId } = useParams();
-  const { getEvent, getEventParticipants } = useFestipodData();
+  const { getEvent, getEventParticipants, getEventReadState } = useFestipodData();
  const event = eventId ? getEvent(eventId) : undefined;
  const participants = eventId ? getEventParticipants(eventId) : [];
+  const readState = eventId ? getEventReadState(eventId) : 'unavailable';

  // The displayed NUMBER of participants comes ONLY from `event.participantCount`
  // (the owner-derived, single source of truth — Option B), never from a local
@@ -21,12 +24,15 @@ export function ParticipantsListScreen() {
  const totalCount = event ? event.participantCount : 0;
  const unknownCount = Math.max(0, totalCount - participants.length);

-  const rows = [
+  const [query, setQuery] = useState('');
+
+  const allRows = [
    ...participants.map((p, i) => ({
      key: p.id,
      initials: safeUserInitials(p),
      name: safeUserName(p),
      username: safeUserUsername(p),
+      photo: p.photo,
      color: COLORS[i % COLORS.length] ?? '#888',
      known: true,
    })),
@@ -35,11 +41,29 @@ export function ParticipantsListScreen() {
      initials: '?',
      name: '',
      username: '',
+      photo: undefined as string | undefined,
      color: '#ccc',
      known: false,
    })),
  ];

+  // An active search narrows to the named people: an anonymous row has nothing to match.
+  const rows = query.trim() ? allRows.filter(r => r.known && matchesQuery(query, r.name, r.username)) : allRows;
+
+  if (!event) {
+    return (
+      <div style={{ display: 'flex', flexDirection: 'column', height: '100%' }}>
+        <Header
+          title="Participants"
+          left={<ArrowLeft size={20} onClick={() => navigate(eventPath(eventId ?? ''))} style={{ cursor: 'pointer' }} />}
+        />
+        <div style={{ flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
+          <Text>{readState === 'loading' ? 'Chargement des participants…' : 'Événement non trouvé'}</Text>
+        </div>
+      </div>
+    );
+  }
+
  return (
    <div style={{ display: 'flex', flexDirection: 'column', height: '100%' }}>
      <Header
@@ -48,10 +72,15 @@ export function ParticipantsListScreen() {
      />

      <div style={{ padding: 16, borderBottom: '1px solid #f0f0f0' }}>
-        <Input placeholder="Rechercher un participant..." />
+        <Input placeholder="Rechercher un participant..." value={query} onChange={(e: React.ChangeEvent<HTMLInputElement>) => setQuery(e.target.value)} />
      </div>

      <div style={{ flex: 1, overflow: 'auto' }}>
+        {rows.length === 0 && (
+          <Text style={{ textAlign: 'center', color: '#888', marginTop: 32 }}>
+            {query.trim() ? 'Aucun participant ne correspond à votre recherche.' : 'Aucun participant pour le moment.'}
+          </Text>
+        )}
        {rows.map((p) => (
          <div
            key={p.key}
@@ -65,7 +94,7 @@ export function ParticipantsListScreen() {
              borderBottom: '1px solid #f5f5f5',
            }}
          >
-            <Avatar initials={p.initials} color={p.color} size="sm" />
+            <Avatar initials={p.initials} photo={p.photo} color={p.color} size="sm" />
            <div style={{ flex: 1 }}>
              {p.known ? (
                <>
@@ -1,5 +1,5 @@
 import React, { useState } from 'react';
-import { Header, Text, Input, Button, Placeholder, showToast } from '../../../shared/components/sketchy';
+import { Header, Text, Input, Button, ImagePicker, showToast } from '../../../shared/components/sketchy';
 import { useFestipodData } from '../../../shared/context/FestipodDataContext';
 import { eventPath, useNavigate, useParams } from '../../../app/router';

@@ -23,6 +23,7 @@ export function UpdateEventScreen() {
  const [startTime, setStartTime] = useState(event?.startTime ?? '');
  const [endTime, setEndTime] = useState(event?.endTime ?? '');
  const [location, setLocation] = useState(event?.location ?? '');
+  const [coverImage, setCoverImage] = useState(event?.coverImage ?? '');
  const [description, setDescription] = useState(event?.description ?? '');

  const save = () => {
@@ -43,6 +44,7 @@ export function UpdateEventScreen() {
      endTime,
      location,
      description,
+      coverImage: coverImage || undefined,
    }))
      .then(() => {
        showToast('Événement mis à jour', 'success');
@@ -99,11 +101,9 @@ export function UpdateEventScreen() {
      />

      <div style={{ flex: 1, padding: 16, overflow: 'auto' }}>
-        <Placeholder
-          height={140}
-          label="Photo de couverture"
-          style={{ marginBottom: 20, cursor: 'pointer' }}
-        />
+        <div style={{ marginBottom: 20 }}>
+          <ImagePicker value={coverImage} label="Photo de couverture" onChange={setCoverImage} />
+        </div>

        <div style={{ display: 'flex', flexDirection: 'column', gap: 16 }}>
          <div>
@@ -7,9 +7,14 @@ import {
  attendeesCollectionUri,
  contextLink,
  createResource,
+  ensureParticipationSecret,
  linkId,
+  MEMBER_URN_PREFIX,
+  memberUrnOf,
+  participationSecretOf,
  podLogin,
  postOutboxActivity,
+  appActorUri,
  readAttendees,
  readResource,
  recordUri,
@@ -169,10 +174,14 @@ Given("l'application Festipod est installée sur le Pod de la session", async fu
  // Registration is confirmed asynchronously by the app backend (the Pod posts a
  // CREATE to the user's outbox), and the registered shape-tree containers come
  // with it. Wait for the Event DataRegistration before a scenario writes there.
+  // The Accept header is required: the pod answers 500 to a container read in any other
+  // format ("LDP containers can only be returned with JSON-LD format").
  const eventContainer = `${pod.storage}/as/event`;
  const end = Date.now() + 20000;
  while (Date.now() < end) {
-    const status = await fetch(eventContainer, { headers: { Authorization: `Bearer ${pod.token}` } })
+    const status = await fetch(eventContainer, {
+      headers: { Accept: 'application/ld+json', Authorization: `Bearer ${pod.token}` },
+    })
      .then(r => r.status)
      .catch(() => 0);
    if (status === 200) return;
@@ -267,26 +276,42 @@ Given(
 When('la session rejoint le point de rencontre', async function (this: FestipodWorld) {
  const pod = session(this);
  const mpUri = requires(this, this.apods.meetingPointUri, 'meeting point URI');
-  // The app's own path (src/shared/data/outbox.ts): as:Join to the user's own
-  // outbox, `object` = the meeting point URI and `to` = the HOST (the record's
-  // dc:creator). Without the addressee the backend silently drops the activity;
-  // and an activity carrying no routing target never reaches the host.
-  const host = linkId((await readResource(pod, mpUri))['dc:creator']) ?? pod.webId;
-  await postOutboxActivity(pod, 'Join', mpUri, host);
+  // The app's own sequence (refineData.tsx, src/shared/data/outbox.ts —
+  // decision_2026-10-29_participation-privacy-mechanism): the participation
+  // secret on my profile first (the backend refuses a Join whose author's
+  // profile carries none), then an as:Join naming the meeting point, posted to
+  // my OWN outbox and addressed to the app actor alone — not public, not
+  // addressed to the creator (decision_2026-11-03_participation-delivered-to-the-app).
+  await ensureParticipationSecret(pod);
+  await postOutboxActivity(pod, 'Join', mpUri, appActorUri(apodsStackConfig()));
 });

 When('la session quitte le point de rencontre', async function (this: FestipodWorld) {
  const pod = session(this);
  const mpUri = requires(this, this.apods.meetingPointUri, 'meeting point URI');
-  const host = linkId((await readResource(pod, mpUri))['dc:creator']) ?? pod.webId;
-  await postOutboxActivity(pod, 'Leave', mpUri, host);
+  await postOutboxActivity(pod, 'Leave', mpUri, appActorUri(apodsStackConfig()));
 });

+/**
+ * The session's own member URN at the scenario's event: what the attendee list
+ * records for it — computed from the secret its OWN profile carries (the person
+ * reads their secret; nobody hands it over), and the anchor event the meeting
+ * point names.
+ */
+async function ownMemberUrn(world: FestipodWorld): Promise<string> {
+  const pod = session(world);
+  const profileUri = requires(world, linkId((await readResource(pod, pod.webId))['url']), "the session's profile (actor url)");
+  const secret = requires(world, participationSecretOf(await readResource(pod, profileUri)), "the session's participation secret");
+  return memberUrnOf(pod.webId, requires(world, world.apods.anchorUri, 'anchor URI'), secret);
+}
+
 Then('la collection apods:attendees contient la session', async function (this: FestipodWorld) {
  const pod = session(this);
  const collectionUri = requires(this, this.apods.collectionUri, 'attendees collection URI');
-  const members = await waitForMembers(pod, collectionUri, found => found.map(linkId).includes(pod.webId));
-  expect(members.map(linkId)).to.include(pod.webId);
+  const urn = await ownMemberUrn(this);
+  const members = (await waitForMembers(pod, collectionUri, found => found.map(linkId).includes(urn))).map(linkId);
+  expect(members, 'the member URN derived from my secret is listed').to.include(urn);
+  expect(members, 'the list never holds a WebID').to.not.include(pod.webId);
 });

 Then(
@@ -294,8 +319,10 @@ Then(
  async function (this: FestipodWorld) {
    const pod = session(this);
    const collectionUri = requires(this, this.apods.collectionUri, 'attendees collection URI');
-    const members = await waitForMembers(pod, collectionUri, found => !found.map(linkId).includes(pod.webId));
-    expect(members.map(linkId)).to.not.include(pod.webId);
+    const urn = await ownMemberUrn(this);
+    const members = (await waitForMembers(pod, collectionUri, found => !found.map(linkId).includes(urn))).map(linkId);
+    expect(members).to.not.include(urn);
+    expect(members).to.not.include(pod.webId);
  },
 );

@@ -304,25 +331,28 @@ Then(
 Then('le compteur du point de rencontre compte cette inscription', async function (this: FestipodWorld) {
  const pod = session(this);
  const collectionUri = requires(this, this.apods.collectionUri, 'attendees collection URI');
-  const members = await waitForMembers(pod, collectionUri, found => found.map(linkId).includes(pod.webId));
+  const urn = await ownMemberUrn(this);
+  const members = await waitForMembers(pod, collectionUri, found => found.map(linkId).includes(urn));
  const collection = await readResource(pod, collectionUri);
  // The count is the collection total — kept as-is, never the number of
  // RESOLVED profiles, so it stays total for a reader who resolves nobody.
  const raw = collection.totalItems ?? collection['as:totalItems'];
  const total = raw === undefined ? members.length : Number(raw);
  expect(total, 'the count reflects the joined session').to.be.greaterThan(0);
-  expect(members.map(linkId), 'the counted session is the one listed').to.include(pod.webId);
+  expect(members.map(linkId), 'the counted session is the one listed (its member URN)').to.include(urn);
 });

 Then('la liste des participants rend ce participant comme anonyme', async function (this: FestipodWorld) {
  const pod = session(this);
  const collectionUri = requires(this, this.apods.collectionUri, 'attendees collection URI');
-  const members = await waitForMembers(pod, collectionUri, found => found.map(linkId).includes(pod.webId));
-  const joined = members.find(member => linkId(member) === pod.webId);
+  const urn = await ownMemberUrn(this);
+  const members = await waitForMembers(pod, collectionUri, found => found.map(linkId).includes(urn));
+  const joined = members.find(member => linkId(member) === urn);
  expect(joined, 'the joined session is listed').to.not.be.undefined;
-  // "Anonymous" is the read-side fact: the member travels as a REFERENCE with no
-  // profile the reader can resolve — the list has nothing but the URI to render,
-  // which is exactly what the app shows for a participant it cannot dereference.
+  // "Anonymous" is the read-side fact: the member is a member URN — a value in
+  // no pod, no WebID, nothing to dereference — so a reader who cannot compute
+  // it from a contact's secret has nothing but the count to render.
+  expect(members.map(linkId).every(id => typeof id === 'string' && id.startsWith(MEMBER_URN_PREFIX)), 'every member is a member URN').to.be.true;
  const profileFields = ['name', 'preferredUsername', 'as:name', 'nickname'];
  const hasProfile =
    typeof joined === 'object' && joined !== null && profileFields.some(field => (joined as Record<string, unknown>)[field] !== undefined);
@@ -9,23 +9,36 @@ import { getBackendUrl } from '../../shared/utils/runtimeConfig';
 * Connected mode only — without an ActivityPods session (demo) or a configured
 * backend the catalog is never called and the list is `own` unchanged.
 */
-export function useDiscoverEvents(own: FpEventData[]): FpEventData[] {
+export function useDiscoverEvents(own: FpEventData[]): { events: FpEventData[]; loading: boolean } {
  const session = useCurrentSession();
  const backendUrl = getBackendUrl();
  const connected = !!session && !!backendUrl;
  const [catalog, setCatalog] = useState<FpEventData[]>([]);
+  const [loading, setLoading] = useState(false);

  useEffect(() => {
    if (!connected || !backendUrl) {
      setCatalog([]);
+      setLoading(false);
      return;
    }
    const controller = new AbortController();
-    void fetchCatalogEvents(backendUrl, controller.signal).then(events => {
-      if (!controller.signal.aborted) setCatalog(events);
+    setLoading(true);
+    void fetchCatalogEvents(backendUrl, { signal: controller.signal }).then(events => {
+      if (controller.signal.aborted) return;
+      setCatalog(events);
+      setLoading(false);
+    }).catch((err: unknown) => {
+      // An unreachable/failing catalog must not hold the list in "loading"
+      // forever: the screen falls back to the user's own events, empty catalog.
+      if (controller.signal.aborted) return;
+      console.error('[useDiscoverEvents] catalog fetch failed:', err);
+      setCatalog([]);
+      setLoading(false);
    });
    return () => controller.abort();
  }, [connected, backendUrl]);

-  return useMemo(() => unionEvents(own, catalog), [own, catalog]);
+  const events = useMemo(() => unionEvents(own, catalog), [own, catalog]);
+  return { events, loading };
 }
@@ -1,16 +1,7 @@
-import { useState } from 'react';
-import { Title, Card, AvatarStack, BottomNav, EventCover, EventMeetingPoints, Spinner, type MeetingPointData } from '../../../shared/components/sketchy';
+import { Title, Text, Card, BottomNav, EventCover, EventMeetingPoints, Spinner, type MeetingPointData } from '../../../shared/components/sketchy';
 import { useFestipodData } from '../../../shared/context/FestipodDataContext';
 import { usePendingQueries } from '../../../shared/data/pendingQueries';
-import { useNavigate } from '../../../app/router';
-
-const PEOPLE = [
-  { name: 'Marie Leroy', color: '#E8590C' },
-  { name: 'Jean Morel', color: '#2B6CB0' },
-  { name: 'Alice Duval', color: '#9C4DC7' },
-  { name: 'Thomas Bazin', color: '#38A169' },
-  { name: 'Camille Noir', color: '#D69E2E' },
-];
+import { useNavigate, eventPath } from '../../../app/router';

 const EVENT_COLORS = ['#E8590C', '#2B6CB0', '#9C4DC7', '#38A169', '#D69E2E'];

@@ -19,24 +10,21 @@ function EventCardBody({
  joinedIds,
  onToggle,
  onClick,
-  isOngoing = false,
 }: {
-  event: { id: string; title: string; date: string; location: string; meetingPoints?: MeetingPointData[] };
+  event: { id: string; title: string; date: string; location: string; coverImage?: string; meetingPoints?: MeetingPointData[] };
  joinedIds: Set<string>;
  onToggle: (id: string) => void;
  onClick: () => void;
-  isOngoing?: boolean;
 }) {
  const color = EVENT_COLORS[Number(event.id.replace(/\D/g, '') || 0) % EVENT_COLORS.length] ?? '#E8590C';
-  const borderStyle = isOngoing ? '2px solid #c6f6d5' : undefined;
  const meetingPoints = event.meetingPoints ?? [];
  return (
    <Card
      onClick={onClick}
-      style={{ marginBottom: 14, padding: 0, overflow: 'hidden', border: borderStyle }}
+      style={{ marginBottom: 14, padding: 0, overflow: 'hidden' }}
      accentColor={color}
    >
-      <EventCover eventId={event.id} height={110} borderRadius={0} />
+      <EventCover url={event.coverImage} height={110} borderRadius={0} />
      <div style={{ padding: 14 }}>
        <div className="user-content" style={{ fontSize: 16, fontWeight: 700, marginBottom: 4 }}>
          {event.title}
@@ -44,12 +32,6 @@ function EventCardBody({
        <div style={{ fontSize: 12.5, color: '#888', marginBottom: 10 }}>
          {event.date} · {event.location}
        </div>
-        <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 14 }}>
-          <AvatarStack people={PEOPLE} size={26} />
-          <span style={{ fontSize: 12, color: '#666' }}>
-            {PEOPLE.length} {isOngoing ? 'connexions présentes' : 'connexions'}
-          </span>
-        </div>

        {meetingPoints.length > 0 && (
          <EventMeetingPoints
@@ -65,29 +47,27 @@ function EventCardBody({

 export function HomeScreen() {
  const navigate = useNavigate();
-  const { getUserEvents, currentUserId, getEventMeetingPoints } = useFestipodData();
+  const { getUserEvents, currentUserId, getEventMeetingPoints, isParticipating, joinMeetingPoint, leaveMeetingPoint } = useFestipodData();
  const pendingQueries = usePendingQueries();
-  const [joinedIds, setJoinedIds] = useState<Set<string>>(new Set());
-
  const myEvents = getUserEvents(currentUserId);
-  const ongoing = myEvents.slice(0, 1);
-  const upcoming = myEvents.slice(1, 4);
+  const upcoming = myEvents.slice(0, 4);
+
+  const joinedIds = new Set(
+    myEvents.flatMap(e => getEventMeetingPoints(e.id)).filter(mp => isParticipating(mp.id)).map(mp => String(mp.id)),
+  );

  const toggle = (id: string) => {
-    setJoinedIds(prev => {
-      const next = new Set(prev);
-      if (next.has(id)) next.delete(id); else next.add(id);
-      return next;
-    });
+    const failed = (err: unknown) => console.error('[Home] meeting point participation failed:', err);
+    const action = joinedIds.has(id) ? leaveMeetingPoint : joinMeetingPoint;
+    void Promise.resolve(action(id)).catch(failed);
  };

-  const withMeetingPoints = (event: { id: string; title: string; date: string; location: string }) => ({
+  const withMeetingPoints = (event: { id: string; title: string; date: string; location: string; coverImage?: string }) => ({
    ...event,
    meetingPoints: getEventMeetingPoints(event.id).map(mp => ({
      id: mp.id,
-      title: mp.location,
-      when: mp.time,
-      duration: '~60 min',
+      title: mp.title,
+      when: mp.time || undefined,
      lieu: mp.location,
    })),
  });
@@ -123,26 +103,11 @@ export function HomeScreen() {
        </div>

        <div style={{ padding: '0 16px' }}>
-          {ongoing.length > 0 && (
-            <>
-              <div style={{ fontSize: 13, fontWeight: 700, textTransform: 'uppercase', letterSpacing: 1, color: '#22543D', marginBottom: 10, display: 'flex', alignItems: 'center', gap: 8 }}>
-                <span style={{ width: 8, height: 8, borderRadius: '50%', background: '#38A169', display: 'inline-block' }} />
-                En cours
-              </div>
-
-              {ongoing.map(event => (
-                <EventCardBody
-                  key={event.id}
-                  event={withMeetingPoints(event)}
-                  joinedIds={joinedIds}
-                  onToggle={toggle}
-                  onClick={() => navigate(`/events/${event.id}`)}
-                  isOngoing
-                />
-              ))}
-            </>
+          {upcoming.length === 0 && (
+            <Text style={{ textAlign: 'center', color: '#888', marginTop: 32, lineHeight: 1.5 }}>
+              Vous n'avez pas encore d'événement. Relayez-en un, ou découvrez ceux des autres dans l'onglet Découvrir.
+            </Text>
          )}
-
          {upcoming.length > 0 && (
            <>
              <div style={{ fontSize: 13, fontWeight: 700, textTransform: 'uppercase', letterSpacing: 1, color: '#E8590C', margin: '20px 0 10px' }}>
@@ -155,7 +120,7 @@ export function HomeScreen() {
                  event={withMeetingPoints(event)}
                  joinedIds={joinedIds}
                  onToggle={toggle}
-                  onClick={() => navigate(`/events/${event.id}`)}
+                  onClick={() => navigate(eventPath(event.id))}
                />
              ))}
            </>
@@ -21,5 +21,5 @@ Fonctionnalité: US-16 Indiquer un ou plusieurs points de rencontre

  Scénario: Renseigner les détails du point de rencontre
    Étant donné que je suis sur la page "points de rencontre"
-    Alors l'écran contient un champ "Quand"
-    Et l'écran contient un champ "Durée"
+    Alors l'écran contient un champ "Titre"
+    Et l'écran contient un champ "Lieu"
@@ -3,7 +3,7 @@
 Fonctionnalité: US-10 Visualiser la fiche/le profil d'un participant
  En tant qu'utilisateur
  Je peux sélectionner un individu dans la liste des inscrits à un événement/atelier
-  Afin de voir les événements auxquels la personne a participé et voir un formulaire de contact
+  Afin de voir les événements auxquels la personne a participé et de pouvoir l'ajouter à mon réseau

  Contexte:
    Étant donné que je suis connecté en tant qu'utilisateur
@@ -21,9 +21,9 @@ Fonctionnalité: US-10 Visualiser la fiche/le profil d'un participant
    Étant donné que je suis sur la page "profil utilisateur"
    Alors les événements affichent leur localisation et distance

-  Scénario: Voir le formulaire de contact
+  Scénario: Ajouter l'utilisateur à mon réseau
    Étant donné que je suis sur la page "profil utilisateur"
-    Alors je peux contacter l'utilisateur
+    Alors je peux ajouter l'utilisateur à mon réseau

  Scénario: Vérifier les informations du profil
    * Scénario non implémenté
@@ -3,8 +3,8 @@
 Fonctionnalité: US-22 Parrainer un nouvel utilisateur
  En tant qu'utilisateur
  Je peux parrainer un nouvel utilisateur
-  En lui partageant mon QR code ou lien de contact
-  Afin de savoir combien de personnes ont rejoint le réseau grâce à moi
+  En lui partageant mon lien de contact
+  Afin d'inviter des personnes à rejoindre le réseau

  Contexte:
    Étant donné que je suis connecté en tant qu'utilisateur
@@ -18,17 +18,11 @@ Fonctionnalité: US-22 Parrainer un nouvel utilisateur
    Quand je navigue vers "partage de profil"
    Alors je vois l'écran "share-profile"

-  Scénario: Voir le QR code de parrainage
+  Scénario: Voir l'invitation de parrainage
    Étant donné que je suis sur la page "partage profil"
-    Alors l'écran contient un texte "Scannez pour me retrouver sur Festipod"
+    Alors l'écran contient un texte "Retrouvez-moi sur Festipod"

  Scénario: Voir le lien de parrainage
    Étant donné que je suis sur la page "partage profil"
-    Alors l'écran contient une section "Mon lien de profil"
-    Et l'écran contient un bouton "Copier"
-
-  Scénario: Voir les statistiques de parrainage
-    Étant donné que je suis sur la page "partage profil"
-    Alors l'écran contient une section "Statistiques de parrainage"
-    Et l'écran contient un texte "Personnes parrainées"
-    Et l'écran contient un texte "Scans du QR code"
+    Alors l'écran contient une section "Mon lien d'invitation"
+    Et l'écran contient un bouton "Créer un lien d'invitation"
@@ -3,7 +3,7 @@
 Fonctionnalité: US-23 Me connecter avec d'autres utilisateurs
  En tant qu'utilisateur
  Je peux me connecter avec d'autres utilisateurs
-  En partageant mon QR code ou mon lien de contact
+  En partageant mon lien de contact
  Afin d'étendre mon réseau

  Contexte:
@@ -13,13 +13,13 @@ Fonctionnalité: US-23 Me connecter avec d'autres utilisateurs
    Étant donné que je suis sur la page "mon profil"
    Alors l'écran contient une section "Partager"

-  Scénario: Voir le QR code
+  Scénario: Voir l'invitation à me retrouver
    Étant donné que je suis sur la page "partage profil"
-    Alors l'écran contient un texte "Scannez pour me retrouver sur Festipod"
+    Alors l'écran contient un texte "Retrouvez-moi sur Festipod"

  Scénario: Voir le lien de partage
    Étant donné que je suis sur la page "partage profil"
-    Alors l'écran contient une section "Mon lien de profil"
+    Alors l'écran contient une section "Mon lien d'invitation"

  Scénario: Accéder à l'écran de partage dédié
    Étant donné que je suis sur la page "mon profil"
@@ -29,4 +29,5 @@ Fonctionnalité: US-9 Visualiser la photo d'un individu
    Et l'écran contient un texte "@mariedupont"

  Scénario: Ajouter une photo personnelle sur une fiche existante
-    * Scénario non implémenté
+    Étant donné que je suis sur la page "modifier le profil"
+    Alors l'écran contient un bouton "Changer la photo"
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Sylvain Duchesne	9e2df2478b	Deliver Join and Leave to the app's inbox instead of an unaddressed outbox post A participation activity is now addressed to the Festipod app actor alone and handled on reception in the app's inbox, the way the ActivityPods developer advised: use the ActivityPub protocol rather than a side channel. Any compatible sender may deliver; the inbox accepts only the activity's own signer, and the backend still requires the activity to lie in that actor's pod and acts on the stored copy. The meeting point is read again in its creator's pod before anything is written: read through the participant's pod, a foreign server's proxy chose the attendee list and the notification's name. Confidentiality is unchanged: the Join stays readable by its author and the app only. Recorded in decision_2026-11-03_participation-delivered-to-the-app, a named exception to festipod-only-reference-app-patterns.	2026-11-03 18:31:24 +01:00
Sylvain Duchesne	ea359488b6	Load the backend's env files from its own directory The root `bun test` also runs the backend's tests, from the repository root, where dotenv-flow found no backend/.env: they passed only while the root .env still carried stale SEMAPPS_* lines, and failed on a clean one (HOME_URL undefined).	2026-11-02 21:50:24 +01:00
Sylvain Duchesne	223059c629	Run the pod provider from images with make start, and fix what a fresh stack exposed - docker-compose-dev.yml: the redis host port is overridable (REDIS_PORT in the root .env, 6379 by default as in the sibling apps), and the pod provider, in host network mode, follows it for its queue and OIDC redis. All of ./data/fuseki is mounted at the image's SEMAPPS_FUSEKI_BASE, so account deletion removes the backups and, 24 h later, the secure dataset's files (it answered 500 without the mount). - backend: GET /app served the app actor snapshot the mixin takes before it creates or replaces the access-need group, so a dataset's first boot lacked the link until a restart; the app service refreshes the snapshot from the store at the end of started(). - e2e smoke: the post-install poll sends Accept: application/ld+json; the pod answers 500 to a container read in any other format. - Docs: cookbook (Redis port, mounts, hot reload, dataset-named accounts, fresh-boot note), deployment note, env examples; claims about a parallel race are no longer stated as fact.	2026-11-02 21:46:37 +01:00
Sylvain Duchesne	5e3e821e2a	Run locally like the sibling apps: fixed ports, the pod provider in Docker, the app outside Festipod now follows the local convention of welcometomyplace, mutual-aid.app and portejunes: one fixed port pair per app (Festipod defaults: backend 3005, app 4005; pod provider 3000/5000), overridable in backend/.env and .env. `make start` runs docker-compose-dev.yml (the local pod provider from images, Fuseki, Redis, mailcatcher, Arena); the backend and the app run outside Docker with `cd backend && pnpm dev` and `pnpm dev`. pnpm stays the package manager. The old docker-compose.yml, which containerized Festipod's own frontend and backend and could not reach the host's Fuseki and Redis, is gone; portless is dropped from the dev script, since the backend declares a single OIDC redirect URI. The local backend runs without a Redis cache, as the sibling apps do. The e2e suites and validate read the app, backend and pod provider URLs from the env files instead of hardcoding them. The deployment and local cookbook leaves record the traps met while resetting datasets: a dataset re-created under the same name needs a Fuseki restart (ClosedException otherwise), the anonymous WebACL probe at boot is expected, and a change of the backend's URL leaves persistent accounts with a participations collection the new app identity cannot control.	2026-11-01 11:40:27 +01:00
Sylvain Duchesne	908f7ea973	Keep sign-ups unlinkable on ActivityPods, and land the pending coherence-pass work Participation privacy (decision_2026-10-29_participation-privacy-mechanism): a sign-up is a private Join naming the meeting point, addressed to nobody, handled by the backend on emission. Attendee lists hold member URNs hashed from (WebID, event, a secret kept in the participant's profile), so counts stay public and only contacts recognise anyone; the creator has no read right and is notified anonymously. Each person's participations collection, created by the backend at the first sign-up, is readable by their /contacts WAC group only, never world-readable. The member URN is sticky per (meeting point, participant) and every collection write is verified by reading back, so a refused write leaves the act unrecorded and retryable. The EventRef mechanism and its browser-side provisioning are gone. The backend now runs with WebACL on, as the reference apps do, on its own secure datasets festipod / settings-festipod instead of the pod provider's settings dataset; pod-notifications needs it. The compose header and the deployment leaf say how to reset a stack whose datasets predate this. The rights matrix covers the new mechanism live (148 hard lines), including a forged contact Accept between throwaway accounts: the stranger enters the contacts list (platform defect, reported upstream) but is refused the profile and the participations. Tests may attack as long as they never break the dev environment (rule_tests-never-break-the-dev-environment). Also lands the coherence-pass work that was still uncommitted: contacts as the Pod's social graph and invite links, image upload to the Pod, the meeting-point form, profile completion gate, and the doctrine for them. Superseded briefs and decisions are deleted rather than annotated.	2026-10-30 17:06:38 +01:00
Sylvain Duchesne	f90651eb9a	Name the datasets as the sibling apps do Back to the sibling apps' pattern: an overridable MAIN_DATASET / SETTINGS_DATASET, explicit on the main stack (festipod-test / settings-festipod-test), computed from DATASET_PREFIX and the service name when left empty (previews). One convention across the apps is simpler for the developers who move between them than a local variant. Reverts the previous commit's compose change; the deployment leaf keeps one line on why Coolify shows those two variables holding expression text.	2026-10-19 17:52:15 +02:00
Sylvain Duchesne	5b61ce9905	Compute the dataset names in the compose, with no overridable wrapper The sibling apps wrap their dataset names in an overridable `${MAIN_DATASET:-${DATASET_PREFIX:-…}-${SERVICE_NAME_BACKEND}}` because they keep historical datasets. Coolify stores such a default, itself an expression, as the created variable's value, so the new app showed MAIN_DATASET and SETTINGS_DATASET holding what reads as unresolved text. It does resolve at deploy time (docker compose interpolates `.env` values), so this was confusing rather than broken — but Festipod has no historical datasets to keep, so the names are now computed directly: festipod-backend / settings-festipod-backend, `…-backend-pr-<n>` in a preview, the same names as before. The comment and the deployment leaf say what was observed and what was traced, and that a second stack on the same Fuseki needs its own DATASET_PREFIX in both its normal and preview scopes.	2026-10-19 17:44:51 +02:00