feed: Phase 4 visibility + federation — per-viewer ACL, fanout partition, inbound/backfill/ingest, e2e feed/timeline + 22 tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/feed-on-sx.md

@@ -14,7 +14,7 @@ APL, ACL visibility filtering via `lib/acl/`, federation via fed-sx.
 
 ## Status (rolling)
 
-`bash lib/feed/conformance.sh` → **83/83** (Phases 1–3 complete)
+`bash lib/feed/conformance.sh` → **105/105** (Phases 1–4 complete)
 
 ## Ground rules
 
@@ -92,12 +92,19 @@ lib/feed/api.sx           lib/feed/fed.sx
 
 ## Phase 4 — Visibility filter + federation
 
-- [ ] ACL filter — each candidate activity passed through `(acl/permit? viewer :read
-  activity)`
-- [ ] fed-sx outbound — local `feed/post` fans out to remote followers' inboxes
-- [ ] fed-sx inbound — peer activities arrive at local inbox
-- [ ] backfill on subscribe — request peer history, merge into local stream
-- [ ] `lib/feed/tests/integration.sx` — federated timeline with ACL applied
+`lib/acl/` and fed-sx don't exist yet and are out of scope (import `lib/apl/`
+only), so ACL/transport are injected: `permit?`, `remote?`, `send-fn`, `fetch-fn`
+are function parameters. Real acl-sx / fed-sx wire in at the call site unchanged.
+
+- [x] ACL filter — `feed/visible stream viewer permit?`; default `feed/permit-acl?`
+  reads `:visible-to` allowlist (+ author-sees-own); per-viewer, never cached
+- [x] fed-sx outbound — `feed/federate`/`feed/deliver` fan out then partition
+  local vs remote inboxes; remote events handed to injected `send-fn`
+- [x] fed-sx inbound — `feed/inbound` normalizes + `feed/ingest` dedupes peer
+  activities into the local stream
+- [x] backfill on subscribe — `feed/backfill local fetch-fn peer-id`
+- [x] `lib/feed/tests/integration.sx` — 22 cases incl. end-to-end
+  `feed/timeline` (federated → ACL for viewer → recency rank → top-N)
 
 ## Progress log
 
@@ -120,6 +127,19 @@ lib/feed/api.sx           lib/feed/fed.sx
   single-arg ascending only — no comparator — so ranking uses a stable two-pass
   `apl-grade-down` (by :at desc, then by score desc) for deterministic tie-breaks.
   Dict keys must be strings, so composite group keys are string-joined ("actor#day").
+- **Phase 4 done (105/105 total).** `acl.sx` (per-viewer `feed/visible`,
+  `feed/timeline` capstone) + `fed.sx` (merge/ingest/inbound/backfill/federate/
+  deliver). ACL/transport are dependency-injected (permit?/remote?/send-fn/fetch-fn)
+  since lib/acl + fed-sx don't exist. `feed/normalize` now MERGEs defaults over the
+  raw dict (was projecting to 5 keys) so extra metadata (:visible-to, peer fields)
+  survives — matches the "flexible bag" principle.
+
+## Roadmap is complete (all 4 phases). Possible follow-ups:
+
+- Wire real acl-sx once `lib/acl/` exists (swap injected `permit?`).
+- Wire real fed-sx transport (swap `send-fn`/`fetch-fn`).
+- TF-IDF over `:tags` for content ranking (sketch mentions it; not yet built).
+- Notification feed (verb-filtered, per-recipient) as a thin layer over fanout.
 
 (none)