Release 0.5.2

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk

CHANGELOG.md

@@ -10,6 +10,43 @@ The long form, with what was wrong before and how it was found, is in
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-09-12
+
+### Added
+
+- Settings → Users and `ipx user list` show when each account was added and when it last signed
+  in, to the hour.
+- `ipx user rename <name> <new name>` renames an account and keeps its feeds, read state and admin
+  rights. An account made before the proxy was set up can take the name the proxy signs it in as.
+
+### Changed
+
+- Directory and Popular list the feeds inside an OPML one by one, and no longer the OPML itself,
+  so you can subscribe to just the shows you want.
+- The database no longer records when subscriptions and sign-in sessions were created. Nothing
+  ever read it, and an existing database drops the columns on its next start.
+
+### Fixed
+
+- Show notes that the podcast's host cut off in the middle of a tag no longer open with a scrap of
+  HTML: the item's other copy of its notes is used instead, from the next time the feed changes.
+  Daily Meditation Podcast had 57.
+- Docker no longer shows ipodderx as starting, or calls it unhealthy, while it scans or downloads:
+  `ipx status` answers at once instead of waiting for the job in progress to finish.
+- Signing out after signing in through Cloudflare Access no longer lands on ipodderx's own password
+  page. With the new `sign_out_url` set, Sign out ends the Access session, and the password page
+  sends anyone the proxy signs in straight to their feeds.
+- The sign-in guide, `docs/sso.md`, describes the setup ipodderx.sdf1.net really runs: Authentik as
+  Cloudflare Access's identity provider, and how to find the address ipx has to trust. It had never
+  been checked against a real setup, and pointed at the wrong address.
+
+## [0.5.1] - 2026-09-12
+
+### Fixed
+
+- The triangle that opens an OPML or Patreon folder was cramped against the folder's art. It has
+  more room now, and a wider target to click.
+
 ## [0.5.0] - 2026-09-12
 
 ### Added
@@ -258,7 +295,9 @@ The long form, with what was wrong before and how it was found, is in
 - Torrent enclosures through librqbit, seeding to a ratio or a time, with a stall timeout.
 - `ipx import` and `ipx export` for OPML, and systemd units in `contrib/`.
 
-[unreleased]: https://git.sdf1.net/rays/ipodderx-rs/compare/v0.5.0...main
+[unreleased]: https://git.sdf1.net/rays/ipodderx-rs/compare/v0.5.2...main
+[0.5.2]: https://git.sdf1.net/rays/ipodderx-rs/compare/v0.5.1...v0.5.2
+[0.5.1]: https://git.sdf1.net/rays/ipodderx-rs/compare/v0.5.0...v0.5.1
 [0.5.0]: https://git.sdf1.net/rays/ipodderx-rs/compare/v0.4.0...v0.5.0
 [0.4.0]: https://git.sdf1.net/rays/ipodderx-rs/compare/v0.3.0...v0.4.0
 [0.3.0]: https://git.sdf1.net/rays/ipodderx-rs/compare/v0.2.0...v0.3.0

CLAUDE.md

@@ -17,6 +17,7 @@ Arcane project `content`: `/mnt/fast/arcane/projects/content/compose.yaml`. That
 | Database | `/mnt/user/ipodderx/state.db` | `/data/state.db` |
 | Downloads | `/mnt/user/ipodderx/downloads` | `/downloads` |
 | Web UI | `192.168.1.130:8099`, also `ipodderx.sdf1.net` via a Cloudflare tunnel | `0.0.0.0:8099` |
+| Sign-in via the tunnel | Cloudflare Access app `ipodderx`, with Authentik as its identity provider; see [docs/sso.md](docs/sso.md) | trusts `Cf-Access-Authenticated-User-Email` from `192.168.16.1`, the `content_default` gateway |
 
 Deploying a change is: build and push the image, then pull it and recreate the container.
 
@@ -45,7 +46,10 @@ docker tag mirror.gcr.io/library/rust:1-slim-bookworm rust:1-slim-bookworm
 Run those again now and then, or the local copies go stale.
 
 The healthcheck runs `ipx status` against the control socket, so `(healthy)` in `docker ps` means
-the worker is alive, not just the web port. The container restarts on its own after a reboot.
+the daemon answers there and can read its database, not just that the web port is up. The socket
+answers `status` itself instead of queuing it behind the worker's current job, so a long scan or
+download does not fail the check; it also means a worker stuck on one job would still pass. The
+container restarts on its own after a reboot.
 
 Before the container, ipx ran by hand in code-server, with its files in `/config/.config/ipx/` and
 `/config/.local/share/ipx/`. Those are still there and the container does not read them. If you run
@@ -113,8 +117,9 @@ Non-trivial logic leaves one runnable check behind. Pure functions (`merge_polic
   watch the shutdown channel itself; the daemon ignored SIGTERM for exactly this reason.
 * Only one daemon per socket. Removing the socket file defeats the guard and you get two daemons
   fighting over the database, with the stale one still holding the port.
-* `/api/settings` answering `200` does **not** mean the worker is alive — it is a different task.
-  Probe the control socket (`ipx status`) to check that.
+* `/api/settings` answering `200` does **not** mean the daemon is well — the web server is a
+  different task. `ipx status` checks the control socket and the database; to see the worker
+  getting through its jobs, watch for `scan complete` in the log.
 * **Every `ipx` command runs `migrate()` when it opens the database**, the healthcheck's
   `ipx status` included. A migration that rewrites a big table (`DROP COLUMN`) takes seconds on
   production, and a command run meanwhile fails with `migrating schema`. It changes nothing; wait

Cargo.lock

@@ -1605,7 +1605,7 @@ checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "ipx"
-version = "0.5.0"
+version = "0.5.2"
 dependencies = [
  "ammonia",
  "anyhow",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ipx"
-version = "0.5.0"
+version = "0.5.2"
 edition = "2024"
 
 [dependencies]

TODO.md

@@ -1,30 +1,27 @@
 # To do
 
-## Cut what is no longer needed
+## Trim the state database
 
-From a whole-repo audit for over-engineering on 2026-09-12. Biggest cut first.
+From an audit of the database layer and a read-only copy of production on 2026-09-12. The data
+itself was clean: no leftover tables or indexes, 47 free pages, one stray `entry_state` row.
+Check each against the code before cutting it.
 
-- [x] **Pre-accounts adoption and the dead `entries` columns.** The copy of the old read state into
-  `entry_state` and the `entries.read`, `flagged` and `position` columns are gone. Its other half,
-  subscribing the first admin to the catalogue, was not dead and stays as `adopt_catalogue`.
-  (`src/db.rs`, `src/main.rs`)
-- [x] **`contrib/` systemd units.** From before the container; nothing points at them.
-- [x] **`migrate_opml_children`.** A one-time move of OPML children out of `config.toml` that has
-  run. Delete it and its call. (`src/main.rs`)
-- [x] **The legacy `interval_mins` key.** Production uses `schedule`. Delete the field, the fallback
-  in `General::interval` and its test. (`src/config.rs`)
-- [x] **`Db::entries` and `Db::count_entries`.** One-line wrappers only the tests call; the tests
-  call `entries_in` and `count_in` instead. (`src/db.rs`)
-- [x] **`web::generate_token`.** Repeats `auth::new_session_token`. Use that. (`src/web.rs`)
-- [x] **Page leftovers.** `globalEvery`, `S.busy`, `S.limit`, `unitOptions`' `firstLabel`, `--r`,
-  `.ep.open`, the phone `.ep .art`, the duplicate phone `.fhead.slim{flex-wrap}`, the second
-  `#sidebar{z-index}`, and the `on()` helper. (`web/index.html`)
-- [x] **`logbuf` visitors.** `record_i64`, `record_u64` and `record_bool` repeat what `Visit`'s
-  defaults already do through `record_debug`. (`src/logbuf.rs`)
-- [x] **The `infer` dependency.** Its torrent check is the `d8:announce` test on the next line.
-- [x] **The `dirs` dependency.** `XDG_CONFIG_HOME`, `XDG_DATA_HOME` and `HOME` from `std::env`.
-- [x] **The `tokio-stream` dependency.** `futures_util::stream::unfold` over the broadcast receiver.
-- [x] **The icon inlined four times.** About 94 KB of base64 across both pages; serve it once as
-  `/icon.png` from `include_bytes!`, open without signing in like `/login`.
+- [x] **`migrate()`'s add list.** All eight columns arrived in 0.2.0, and 0.5.0 only supports
+  upgrades from 0.3.0 on. Drop the list and its loop; keep the `retired` drop loop, which a
+  database coming from 0.4.0 still needs. (`src/db.rs`)
+- [x] **`Db::subscribed_feed_ids`.** No callers; its doc says the scanner walks it, and it does not.
+  (`src/db.rs`)
+- [x] **`Db::subscriber_count`.** One caller, which only asks whether it is above zero:
+  `subscriber_counts()?.contains_key(&id)`. (`src/db.rs`, `src/web.rs`)
+- [x] **The `created` columns** on `users`, `subscriptions` and `sessions`. Written on every insert,
+  never read. Add them to `retired` and drop them from the inserts. (`src/db.rs`)
+- [x] **`Managed.orphaned`.** Selected by `managed_feeds()` on every call and never read;
+  `FeedSummary.orphaned` is what the UI uses. (`src/db.rs`)
 
-After these: `cargo test`, `node tests/page-smoke.js`, `npx playwright test`.
+## Popular
+
+- [x] **Popular lists feeds the way Directory does**: the feeds inside an OPML or a Patreon
+  creator, never the collection itself. (`src/web.rs`, `web/index.html`)
+
+After these: `cargo test`, `node tests/page-smoke.js`, `npx playwright test`. Copy `state.db`
+aside before deploying: `migrate()` drops columns on the first start.

docs/architecture.md

@@ -50,10 +50,10 @@ entries     feed_id, guid, title, link, published, description, first_seen,
             image, duration, episode, season            PK (feed_id, guid)
 enclosures  id, feed_id, guid, url UNIQUE, mime, length, path, state,
             bytes_done, downloaded_at, last_error
-users       id, name, pass_hash, is_admin, created
-sessions    token, user_id, created, seen
+users       id, name, pass_hash, is_admin, created, last_login
+sessions    token, user_id, seen
 subscriptions  user_id, feed_id, keywords, auto_download, allow_explicit,
-               max_new_per_check, created                PK (user_id, feed_id)
+               max_new_per_check                         PK (user_id, feed_id)
 entry_state    user_id, feed_id, guid, read, flagged, position
                                                          PK (user_id, feed_id, guid)
 ```
@@ -62,9 +62,11 @@ Read state is `entry_state` alone. `entries` had `read`, `flagged` and `position
 before accounts; two bugs came from queries still reading them, and `migrate()` drops them from an
 older database.
 
-Schema changes: add the table or column to `SCHEMA`, and for a column also to the list in
-`migrate()`, which does `PRAGMA table_info` then `ALTER TABLE ADD COLUMN`. `Db::memory()` runs the
-same path as `Db::open`, so a migration-only column cannot pass tests while missing in production.
+Schema changes: add the table or column to `SCHEMA`. `CREATE TABLE IF NOT EXISTS` leaves a table
+that already exists alone, so a new column on one also goes in `migrate()`'s `wanted` list, and a
+retired one in its `retired` list; both are checked with `PRAGMA table_info`. Columns from before
+0.3.0, the oldest version an upgrade may start from, need no entry. `Db::memory()` runs the same
+path as `Db::open`, so a migration cannot pass the tests while missing in production.
 
 ## Control socket
 
@@ -85,7 +87,9 @@ printf '{"cmd":"fetch","force":true}\n' | socat - UNIX-CONNECT:$XDG_RUNTIME_DIR/
 **Events** — `feed_start`, `feed_skip`, `feed_done`, `feed_error`, `progress`, `download_done`,
 `download_error`, `torrent_deferred`, `reaped`, `reap_done`, `scan_done`, `status`, `error`.
 `scan_done`, `reap_done` and `status` are terminal: a client that asked for work stops reading
-there.
+there. Commands run one at a time, in the order they arrive, except `status`: the socket answers it
+straight away, so the Docker healthcheck is never left waiting behind a scan or a download, and
+answers only the client that asked, since `status` would end any other client's session.
 
 Progress carries the enclosure id, without which a UI cannot tell one download from another and
 ends up animating every pending row. It is throttled to whole percents. The stream is a broadcast,
@@ -115,7 +119,7 @@ else a `401`.
 | `POST /api/enclosures/{id}/download`, `DELETE /api/enclosures/{id}` | `?force=true` overrides the shared-file warning |
 | `POST /api/fetch` | |
 | `GET /api/opml`, `POST /api/opml` | export your subscriptions; subscribe to every feed in an OPML |
-| `GET /api/popular`, `GET /api/directory`, `POST /api/popular/{id}` | the ten most subscribed feeds, and every listable feed A to Z, with everyone counted (id, title, art, count, whether it is yours; never a URL, never a private feed); subscribe by id |
+| `GET /api/popular`, `GET /api/directory`, `POST /api/popular/{id}` | the ten most subscribed feeds, and every listable feed A to Z, with an OPML's feeds in place of the OPML and everyone counted (id, title, art, count, whether it is yours; never a URL, never a private feed); subscribe by id |
 | `GET /api/settings`, `PATCH /api/settings` | admin-only to write |
 | `GET /api/users`, `POST /api/users`, `PATCH /api/users/{id}`, `DELETE /api/users/{id}` | admin-only; the only admin cannot be demoted or removed |
 | `GET /api/events` | SSE, the same broadcast the socket carries |

docs/configuration.md

@@ -67,6 +67,7 @@ token             = ""                    # generated and saved on first run
 trusted_header    = ""                    # e.g. "Cf-Access-Authenticated-User-Email"
 trusted_proxies   = ["127.0.0.1", "::1"]
 auto_create_users = true
+sign_out_url      = ""                    # e.g. "/cdn-cgi/access/logout"
 session_days      = 30
 ```
 
@@ -77,6 +78,9 @@ session_days      = 30
 * **`trusted_proxies`** — addresses allowed to assert that header, and the entire security boundary
   for it. Name the proxy, never a subnet.
 * **`auto_create_users`** — create an account the first time the proxy vouches for a new name.
+* **`sign_out_url`** — where Sign out sends someone the proxy signed in: the proxy's own sign-out,
+  `/cdn-cgi/access/logout` behind Cloudflare Access. Empty sends them to the sign-in page, where
+  the proxy signs them straight back in.
 * **`session_days`** — sign a session out after this long without a request.
 
 It is plain HTTP. On a LAN bind everything crosses the network in the clear — and a feed URL can

docs/history.md

@@ -6,6 +6,105 @@ reasoning lives. New write-ups go at the top.
 
 See [README.md](../README.md) for what the thing is.
 
+## 2026-09-12 — Healthy while busy
+
+After a deploy the container sat at "starting" for a minute, and Docker's health log showed two
+`ipx status` probes exceeding their 5-second timeout. The daemon's own log explained it. The first
+scan after the start fetched 23 feeds, from 14:10:41 to 14:11:35, and both probes' `status`
+commands waited in the job queue behind it; they were answered together at 14:11:35, straight after
+`scan_done`. The worker runs one job at a time and `status` was one of its jobs, so any scan or
+download longer than about a minute and a half, three 30-second probes, would have had Docker call
+a working daemon unhealthy.
+
+The socket now answers `status` itself, from two short queries, and only real work goes through the
+queue. The trade is that healthy now means the daemon answers on its socket and can read its
+database; a worker stuck on one job would still pass. Asking a daemon that downloads hour-long
+podcasts to be idle within five seconds was never a fair test of whether it was alive. A test holds
+the queue full and checks `status` still comes back.
+
+The first version broadcast the answer, as the queued one had been. Timing `status` during a forced
+scan in production showed the catch: `status` is a terminal event, so the `ipx fetch` watching that
+scan stopped reading at the first probe and printed the status line as its last, while the scan
+carried on. When `status` waited behind the scan it could never arrive first, so this had never
+shown. The answer now goes only to the client that asked, and the test checks that another client
+hears nothing.
+
+## 2026-09-12 — Signing in through Authentik, for real
+
+Ray could not get Authentik's sign-in to reach ipx, following `docs/sso.md`, which had been written
+without ever being tried. Looking at the Cloudflare account through its API showed that side was
+already complete. Authentik is Zero Trust's OpenID Connect identity provider; the Access application
+`ipodderx` allows only it and a list of five addresses; the tunnel `rays-unraid` routes
+`ipodderx.sdf1.net` to `192.168.1.130:8099`; DNS is a proxied CNAME to the tunnel. Access's log
+showed `rays@sdf1.net` signing in through it. Nothing on Cloudflare was changed, so no other site
+was touched.
+
+The gaps were all at ipx's end: `trusted_header` was empty, `trusted_proxies` held only loopback,
+and the account was called `rays` while the header carries `rays@sdf1.net`.
+
+Finding the address to trust took the most time. The page said `127.0.0.1`, but `cloudflared` runs in
+its own container and reaches ipx through the host's published port. ipx logs no peer addresses, so
+the address was read from `/proc/net/tcp` inside the ipx container: `192.168.16.1`, the gateway of
+`content_default`, where Docker's masquerade puts traffic crossing from another bridge. A request
+from Tower's own shell arrived as `192.168.1.130` instead, and a throwaway `busybox` on the default
+bridge as `192.168.16.1`: the first was refused with the header, the second believed. LAN machines
+keep their own addresses, since Docker forwards published ports with iptables (the userland proxy
+only handles loopback).
+
+Every change, in order, with how to undo it:
+
+1. **Code**, commit `586d2c0`: `ipx user rename`, deployed. Revert the commit and redeploy to
+   remove it; nothing depends on it once used.
+2. **Account**: `docker exec iPodderX ipx user rename rays rays@sdf1.net`. Same id, so its feeds,
+   read state, password and admin rights stayed. Undo: `docker exec iPodderX ipx user rename
+   rays@sdf1.net rays`. Signing in at `/login` now takes the new name.
+3. **Config**, `/mnt/fast/appdata/ipodderx/config.toml`, `[web]`: `trusted_header` from `""` to
+   `"Cf-Access-Authenticated-User-Email"`, and `"192.168.16.1"` added to `trusted_proxies`. The
+   file as it was is `config.toml.2026-09-12-sso.bak` beside it. Undo: copy the backup back and
+   `docker compose -f /mnt/fast/arcane/projects/content/compose.yaml restart ipodderx`.
+4. **Cloudflare, Docker networks and other containers**: unchanged. The `busybox` test container
+   was removed when it exited, and its image afterwards.
+5. **Authentik**, later the same day, because ipodderx had no tile in its library while Outline
+   did: a bookmark application `ipodderx` (pk `5854a98e-816a-4c4f-9f27-63e69dc29d1d`), made
+   through the API with a token of Ray's. No provider and no policy bindings, like Outline's, the
+   iPodderX icon, and a link to `https://ipodderx.sdf1.net`. It changes nothing about who can sign
+   in. Undo: delete it under Applications → Applications, or
+   `DELETE /api/v3/core/applications/ipodderx/`.
+6. **Signing out**, later again. Sign out landed on ipx's password page while Access still vouched
+   for Ray, so it signed nothing out, and the page looked like the wrong login. Cloudflare's
+   `/cdn-cgi/access/logout` ends the Access session for every Access application at once (there is
+   no per-application sign-out, and it takes no redirect), and Authentik's end-session only ends
+   one application's session unless single logout is set up there. Ray chose Access's sign-out. New
+   `[web] sign_out_url`, set to `/cdn-cgi/access/logout` in production (the file as it was is
+   `config.toml.2026-09-12-signout.bak`), and `/login` now sends anyone the proxy vouches for on to
+   `/`. Undo: take the key out and restart; the code does nothing without it.
+
+What the address trusts is any container on Tower that connects through the host's port, not only
+`cloudflared`. Verifying Cloudflare's signed `Cf-Access-Jwt-Assertion` would remove that, and is
+the upgrade if it matters.
+
+## 2026-09-12 — Trimming the state database
+
+An audit of the database layer, with a read-only copy of production to check it against. The
+data was already clean: no tables or indexes left from older versions, 47 free pages after the
+column drops earlier the same day, and one stray `entry_state` row. The code had five things:
+
+- `migrate()` still added eight columns to any table missing them. All eight shipped in 0.2.0 and
+  upgrades now start from 0.3.0 at the oldest, so the list and its loop went; the `retired` drop
+  list stays, since a database coming from 0.4.0 still has the old read columns.
+- `created` on `users`, `subscriptions` and `sessions` was written by every insert and read by
+  nothing. They joined `retired`. The old-database test now builds all three tables, foreign keys
+  included, since `DROP COLUMN` on a table that references another was the part worth proving.
+- `Db::subscribed_feed_ids` had no callers, though its doc said the scanner walked it.
+  `Db::subscriber_count` had one caller asking whether it was above zero, which
+  `subscriber_counts().contains_key` answers. `Managed.orphaned` was selected and never read.
+- `users.created` came back the same afternoon, with `last_login` beside it. Nothing read it, but
+  when an account was made and when it last signed in is what you want to know when tidying
+  accounts, and it cannot be recovered later. Both existing accounts got their creation times back
+  from the backup taken before the drop, and a last sign-in from their newest session in it.
+  `last_login` is kept to the hour, because the proxy vouches for every request and that would
+  otherwise be a write each time.
+
 ## 2026-09-12 — Cutting what had outlived its reason
 
 A whole-repo audit for over-engineering listed twelve things to cut, and all of them went.

docs/sso.md

@@ -1,9 +1,8 @@
-# Signing in through Cloudflare Zero Trust or Authentik
+# Signing in through Cloudflare Access and Authentik
 
 ipx can take the signed-in identity from whatever sits in front of it, instead of asking for a
-password itself. Both products below do the same thing in the end: they authenticate the person and
-pass the result to the origin in a **header**. ipx reads that header, finds (or creates) the
-matching account, and gets on with it.
+password itself. The proxy authenticates the person and passes the result to ipx in a **header**;
+ipx reads it, finds (or creates) the matching account, and gets on with it.
 
 Read [How this is secured](#how-this-is-secured) before exposing anything. The short version: a
 header is worth exactly as much as the hop that set it, so ipx only believes one from an address you
@@ -11,195 +10,173 @@ list.
 
 ---
 
-## The ipx side (both setups)
+## How ipodderx.sdf1.net does it
+
+Checked end to end on 2026-09-12. An earlier version of this page had never been tried against a
+real setup and pointed at the wrong address.
+
+```
+browser ─► Cloudflare Access, app "ipodderx" ─── sign in ───► Authentik (OpenID Connect)
+        ─► tunnel "rays-unraid" (the cloudflared container on Tower)
+        ─► http://192.168.1.130:8099 ─► ipx
+```
+
+Authentik is not in the request path. It is the identity provider Cloudflare Access asks. Access
+then adds `Cf-Access-Authenticated-User-Email`, the email address Authentik gave it, to every
+request it forwards through the tunnel, and ipx signs that person in.
+
+| Piece | Where | Setting |
+|---|---|---|
+| Identity provider | Zero Trust → Settings → Authentication | `Authentik`, OpenID Connect; scopes `openid email profile` |
+| Access application | Zero Trust → Access → Applications → `ipodderx` | Domain `ipodderx.sdf1.net`; identity providers: Authentik only, with instant auth; session 730h; policy *Require Login* allows a list of email addresses |
+| Tunnel route | Zero Trust → Networks → Tunnels → `rays-unraid` → Public hostnames | `ipodderx.sdf1.net` → HTTP `192.168.1.130:8099` |
+| DNS | `sdf1.net` | `ipodderx` CNAME to the tunnel, proxied |
+| ipx | `/mnt/fast/appdata/ipodderx/config.toml`, `[web]` | below |
 
 ```toml
 [web]
 enabled = true
 bind = "0.0.0.0:8099"
-token   = "…"                                  # keep it: it is the admin, used by the healthcheck
-
-# The header your proxy sets. Empty (the default) disables this whole path.
-trusted_header = "Cf-Access-Authenticated-User-Email"   # Authentik: "X-authentik-username"
-
-# Addresses allowed to assert that header -- the proxy, and nothing else.
-trusted_proxies = ["127.0.0.1", "::1"]
-
-# Create an account the first time the proxy vouches for a name ipx has not seen.
+trusted_header = "Cf-Access-Authenticated-User-Email"
+trusted_proxies = ["127.0.0.1", "::1", "192.168.16.1"]
 auto_create_users = true
-
+sign_out_url = "/cdn-cgi/access/logout"
 session_days = 30
 ```
 
-Restart the daemon after editing. Accounts made this way have **no password**: they can only ever
-arrive through the proxy. `ipx user list` marks them `proxy only`.
+Restart ipx after editing it: `docker compose -f /mnt/fast/arcane/projects/content/compose.yaml
+restart ipodderx`.
 
-The first account created is an admin. Every later one is an ordinary user, and an ordinary user
-cannot change global settings, a feed's URL or folder, or how often feeds are scanned: the API
-refuses those with a `403`, not just the UI. Everything else about a feed (which items they want,
-whether to fetch them, how many at a time) is theirs alone; see [users.md](users.md).
+### What was missing
 
-Somebody arriving through the proxy for the first time starts with **no feeds**, because
-subscriptions are per person. Adding a feed someone else already reads costs no second fetch and no
-second copy on disk.
+Cloudflare and Authentik were already right. Three things on the ipx side were not:
 
-Promote someone with:
+1. **`trusted_header` was empty**, which switches the whole proxy path off. ipx ignored the header
+   and asked for a password.
+2. **`trusted_proxies` listed only `127.0.0.1`.** The tunnel's requests do not come from there;
+   see the next section.
+3. **The account had the wrong name.** It was made by hand as `rays`, but the header carries
+   `rays@sdf1.net`. With `auto_create_users` on, the first visit would have made a second, empty
+   account. `ipx user rename rays rays@sdf1.net` fixed that without losing anything.
+
+### The address to trust, and why it is 192.168.16.1
+
+`cloudflared` runs in its own container and reaches ipx through the host's published port. Docker
+(iptables firewall backend) masquerades traffic between its bridge networks, so the tunnel's
+requests arrive from the **gateway of ipx's own network**, `content_default`:
 
 ```sh
-ipx user list
-echo -n 'a good password' | ipx user passwd <name>   # optional: also lets them sign in directly
+docker network inspect content_default -f '{{range .IPAM.Config}}{{.Gateway}}{{end}}'
 ```
 
-Local sign-in at `/login` keeps working alongside all of this, which is how you get in from the LAN
-when the tunnel is down. So does the shared `[web] token`, which signs in as the admin: that is
-what the Docker healthcheck uses, and the way back in if you lock yourself out. A brand new database
-starts with **admin / ipodderx** — change it.
+That was measured, not assumed. ipx does not log where a request came from, so the addresses were
+read from the kernel's connection table inside the container while the site was open. (`/proc/net/tcp`
+lists them in hex.)
+
+If the `content` project's network is ever recreated, its gateway can change. Check it again, and
+update `trusted_proxies` to match.
+
+### Names
+
+The username is the email address, lower-cased: `rays@sdf1.net`. To sign in at `/login` with a
+password from the LAN, use that name too.
+
+To let someone else in, add their address to the Access policy; they need an Authentik account with
+that email. With `auto_create_users = true` they get an ipx account on their first visit, as an
+ordinary user with no feeds. An account made before the proxy can be given the name the proxy will
+send:
+
+```sh
+docker exec iPodderX ipx user rename <old name> <email address>
+```
+
+### Signing out
+
+**Sign out** sends someone the proxy signed in to `sign_out_url`, here Cloudflare's
+`/cdn-cgi/access/logout`. That ends your Access session for **every** Access application,
+`code.sdf1.net` included: Cloudflare has no way to end just one, and its sign-out page does not send
+you anywhere afterwards. The next visit goes back through Authentik, which lets you straight in if
+you are still signed in there. Signing out of Authentik itself is Authentik's own sign-out.
+
+ipx never shows its password page to someone the proxy vouches for: `/login` sends them on to their
+feeds.
+
+### The tile in Authentik's library
+
+Authentik's library lists Authentik's own applications, and ipodderx signs in through the one
+called `Cloudflare Access`, so ipodderx needs a bookmark of its own to show up there. It is
+Applications → Applications → `ipodderx`: no provider, launch URL `https://ipodderx.sdf1.net`, and
+the iPodderX icon. Like Outline's, it has no policy bindings, so everyone in Authentik sees the
+tile. Who actually gets in is still up to the Access policy.
+
+### Check it
+
+```sh
+# From Tower itself: not a trusted address, so the header is ignored.
+curl -s -H 'Accept: application/json' -H 'Cf-Access-Authenticated-User-Email: rays@sdf1.net' \
+  http://192.168.1.130:8099/api/me                                          # -> sign in
+
+# From a container on a Docker bridge, as cloudflared is: believed.
+docker run --rm --network bridge mirror.gcr.io/library/busybox wget -qO- \
+  --header 'Accept: application/json' --header 'Cf-Access-Authenticated-User-Email: rays@sdf1.net' \
+  http://192.168.1.130:8099/api/me                                          # -> {"admin":true,"name":"rays@sdf1.net"}
+```
+
+Then open `https://ipodderx.sdf1.net` in a private window. Authentik should ask who you are, and
+ipx should show `rays@sdf1.net` in the sidebar footer without asking for a password.
 
 ---
 
-## Cloudflare Zero Trust
+## The ipx settings
 
-This is what runs `ipodderx.sdf1.net`: a `cloudflared` tunnel to the origin, with an Access
-application in front of it. Cloudflare authenticates the visitor and adds
-`Cf-Access-Authenticated-User-Email` to every request it forwards.
-
-### 1. The tunnel
-
-In **Zero Trust → Networks → Tunnels**, either use the existing tunnel or create one, then add a
-public hostname:
-
-| Field | Value |
+| Key | What it does |
 |---|---|
-| Subdomain / domain | `ipodderx` / `sdf1.net` |
-| Type | HTTP |
-| URL | `localhost:8099` (or the LAN address of the box) |
+| `trusted_header` | The header the proxy sets. Empty, the default, turns the proxy path off. |
+| `trusted_proxies` | The addresses allowed to set it. Nothing else is believed. |
+| `auto_create_users` | Make an account the first time the proxy vouches for a name ipx has not seen. |
+| `sign_out_url` | Where Sign out sends someone the proxy signed in: the proxy's own sign-out. Empty sends them to the sign-in page, where the proxy signs them straight back in. |
+| `session_days` | How long a password sign-in lasts without use. |
 
-Use `localhost` when `cloudflared` runs on the same machine as ipx — that keeps the origin request
-coming from `127.0.0.1`, which is already in `trusted_proxies`. If `cloudflared` runs elsewhere (its
-own container, another host), put **its** address in `trusted_proxies` instead, and make sure
-nothing else can reach port 8099.
+The first account ever created is an admin. Every later one is an ordinary user, who cannot change
+global settings, a feed's URL or folder, or how often feeds are scanned: the API refuses those with
+a `403`, not just the UI. Everything else about a feed is theirs alone; see [users.md](users.md).
 
-### 2. The Access application
-
-**Zero Trust → Access → Applications → Add an application → Self-hosted**:
-
-- Application domain: `ipodderx.sdf1.net`
-- Session duration: whatever suits; ipx keeps its own 30-day session on top.
-- Add a policy — *Allow*, with a rule such as `Emails` → your address, or `Emails ending in` →
-  your domain. Anyone this policy admits gets an ipx account when `auto_create_users` is on, so keep
-  the policy as narrow as the people you actually want reading your feeds.
-
-### 3. Point ipx at the header
-
-```toml
-trusted_header  = "Cf-Access-Authenticated-User-Email"
-trusted_proxies = ["127.0.0.1", "::1"]
-```
-
-The username becomes the email address, lower-cased (`ray@example.com`). That is what shows in the
-sidebar and what `ipx user list` prints.
-
-### 4. Check it
-
-```sh
-# From the box itself: no header, no session -> the sign-in page.
-curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' -H 'Accept: text/html' http://127.0.0.1:8099/
-
-# Pretending to be the tunnel (only works because 127.0.0.1 is trusted):
-curl -s -H 'Cf-Access-Authenticated-User-Email: you@example.com' http://127.0.0.1:8099/api/me
-```
-
-Then load `https://ipodderx.sdf1.net` in a browser: Cloudflare should ask who you are, and ipx
-should show your address in the sidebar footer without ever asking for a password.
+Local sign-in at `/login` keeps working alongside the proxy, which is how you get in from the LAN
+when the tunnel is down. So does the shared `[web] token`, which signs in as the admin and is the
+way back in if you lock yourself out. A brand new database starts with **admin / ipodderx**;
+change it.
 
 ---
 
-## Authentik
+## Authentik in the request path instead
 
-Authentik does this with a **Proxy Provider** plus an **outpost**, which sits in the request path and
-adds `X-authentik-username` (also `X-authentik-email`, `X-authentik-name`, `X-authentik-groups`).
+Not what ipodderx.sdf1.net uses, and **not verified**. Authentik can also sit in front of ipx
+itself, with a **Proxy Provider** and an **outpost** that adds `X-authentik-username`:
 
-### 1. Provider
-
-**Applications → Providers → Create → Proxy Provider**:
-
-- Name: `ipx`
-- Authorization flow: your usual (`default-provider-authorization-implicit-consent`)
-- Mode: **Forward auth (single application)** if an existing reverse proxy fronts ipx, or
-  **Proxy** to let the outpost talk to ipx directly.
-- External host: `https://ipodderx.example.net`
-- Internal host (Proxy mode): `http://<ip of the ipx box>:8099`
-
-### 2. Application and outpost
-
-**Applications → Create**, bind it to that provider, and give it a policy so only the people you
-mean are let through. Then add the provider to an outpost (**Applications → Outposts**, the embedded
-one is fine).
-
-### 3. Forward auth, if you use nginx/SWAG in front
-
-In the server block for ipx:
-
-```nginx
-location /outpost.goauthentik.io {
-    proxy_pass http://authentik-server:9000/outpost.goauthentik.io;
-    proxy_set_header Host $host;
-    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
-    add_header Set-Cookie $auth_cookie;
-    auth_request_set $auth_cookie $upstream_http_set_cookie;
-}
-
-location / {
-    auth_request /outpost.goauthentik.io/auth/nginx;
-    error_page 401 = @goauthentik_proxy_signin;
-    auth_request_set $auth_cookie $upstream_http_set_cookie;
-    add_header Set-Cookie $auth_cookie;
-
-    # This is the line that matters to ipx.
-    auth_request_set $authentik_username $upstream_http_x_authentik_username;
-    proxy_set_header X-authentik-username $authentik_username;
-
-    proxy_pass http://ipx:8099;
-}
-```
-
-### 4. Point ipx at the header
-
-```toml
-trusted_header  = "X-authentik-username"
-trusted_proxies = ["172.18.0.5"]   # the outpost or nginx container, NOT a whole subnet
-```
-
-Usernames arrive as Authentik knows them (`ray`), lower-cased.
+- Applications → Providers → Create → Proxy Provider; mode **Proxy** (the outpost talks to ipx) or
+  **Forward auth** (an existing reverse proxy asks the outpost).
+- Applications → Create, bound to that provider, with a policy; add the provider to an outpost.
+- In ipx: `trusted_header = "X-authentik-username"`, and the outpost's or reverse proxy's address
+  in `trusted_proxies`. Measure that address as above rather than guessing it.
 
 ---
 
 ## How this is secured
 
 **The header is only believed from `trusted_proxies`.** Every other source is ignored, and the
-request falls through to a session cookie or the shared token. This is the whole security boundary,
-so:
+request falls through to a session cookie or the shared token. That is the whole security boundary.
 
-- List the **proxy's own address**, not a range. `["127.0.0.1"]` when the tunnel runs beside ipx;
-  the container's IP when it does not.
-- Never list a LAN subnet. Anyone on your network could then send
-  `Cf-Access-Authenticated-User-Email: admin@…` and be your admin.
-- Make sure the origin port is not reachable *around* the proxy by anyone you would not admit
-  through it. If it is, bind ipx to `127.0.0.1` and let only the proxy reach it.
+With the tunnel reaching ipx through the host's port, `192.168.16.1` means **any container on Tower
+that connects to `192.168.1.130:8099`**, not only `cloudflared`. Machines on the LAN, and Tower
+itself, arrive under their own addresses and cannot set the header; the checks above show both
+sides. Never list a LAN address or range: anyone there could then send
+`Cf-Access-Authenticated-User-Email: rays@sdf1.net` and be you.
 
-Verify the refusal, don't assume it — set `trusted_proxies = ["10.9.9.9"]` briefly and confirm a
-header from your machine gets a `401`:
+**What ipx does not do:** it does not verify Cloudflare's signed `Cf-Access-Jwt-Assertion`. It
+trusts the hop. Verifying the signature would make the containers on Tower irrelevant to the
+boundary, and is the upgrade if that ever matters.
 
-```sh
-curl -s -o /dev/null -w '%{http_code}\n' \
-  -H 'Cf-Access-Authenticated-User-Email: someone@example.com' http://127.0.0.1:8099/api/me
-```
-
-**What ipx does not do:** it does not verify Cloudflare's `Cf-Access-Jwt-Assertion` signature or
-Authentik's session. It trusts the hop. That is a deliberate trade — it keeps the configuration to
-three lines — and it is sound exactly as long as the point above holds.
-
-**Turning it off:** clear `trusted_header`. Existing proxy-only accounts stay, but nobody can sign
+**Turning it off:** clear `trusted_header` and restart. Proxy-made accounts stay, but nobody can sign
 in with them until they are given a password (`ipx user passwd <name>`).
 
 ---
@@ -207,22 +184,20 @@ in with them until they are given a password (`ipx user passwd <name>`).
 ## Everyday administration
 
 ```sh
-ipx user list                                  # who exists, and how each one signs in
+ipx user list                                  # who exists, how each signs in, and when
 echo -n 'secret123' | ipx user add sam         # local account, password on stdin
-ipx user add sam --no-password                 # proxy-only account, created ahead of time
+ipx user add sam@example.com --no-password     # proxy-only account, made ahead of time
+ipx user rename sam sam@example.com            # give an account the name the proxy sends
 echo -n 'newsecret' | ipx user passwd sam      # change a password
 ipx user rm sam                                # remove the account
 ```
 
-Set `auto_create_users = false` once everyone who should have an account has one. After that the
-proxy vouching for an unknown name is logged and refused, rather than quietly making an account.
-Pre-create people instead with `ipx user add <name> --no-password`, using exactly the name the
-header will carry (Cloudflare sends the email address, lower-cased).
+In the container, put `docker exec iPodderX` in front, and `docker exec -i iPodderX` for the ones
+that read a password.
 
-Scanning intervals, the disk quota, retention, the download folder and a feed's URL are
-**admin-only**: the Settings button is hidden for everyone else, and the API refuses the change even
-if the request is made by hand. Everyone controls their own keywords, auto-download, explicit
-setting and per-scan cap, along with their own read state and which feeds they see.
+Set `auto_create_users = false` once everyone who should have an account has one. After that the
+proxy vouching for an unknown name is logged and refused. Make people ahead of time instead, with
+the exact name the header will carry.
 
 See also [users.md](users.md) for what several people share, [configuration.md](configuration.md)
 for every `[web]` key, and [cli.md](cli.md) for the `ipx user` commands.

docs/users.md

@@ -73,12 +73,13 @@ re-subscribing does not pull the back catalogue again.
 **Popular** and **Directory** sit at the top of the feed list, above your own feeds. Popular, also
 shown in the Add feed dialog, lists the ten feeds with the most subscribers on this server, you
 included. Directory lists every one of them A to Z. Your own feeds are marked Subscribed.
-It shows a title, artwork and a count, never a URL or who reads it. Feeds from an
-OPML subscription are left out, since they come with the OPML. So is anything that looks private: a
-login configured for the feed, credentials in its URL, or a key such as `auth=` or `token=` in the
-query, or a feed from a paid-feed service such as Patreon or Supercast, which put the key in the
-path. Those are someone's paid subscriptions, and listing them would let anyone here read what they
-pay for.
+It shows a title, artwork and a count, never a URL or who reads it. An OPML subscription is listed
+as the feeds inside it, one by one, and never the OPML itself, so you can take just the shows you
+want. Anything that looks private is left out: a login configured for the feed, credentials in its URL,
+or a key such as `auth=` or `token=` in the query, or a feed from a paid-feed service such as
+Patreon or Supercast, which put the key in the path, and any feed inside an OPML that looks private
+itself. Those are someone's paid subscriptions, and listing them would let anyone here read what
+they pay for.
 
 An admin can do the same from **Settings → Manage users…**: add someone (with a password, or none
 for someone the proxy signs in), tick or untick Admin, or remove an account. Removing one takes its

src/config.rs

@@ -80,6 +80,10 @@ pub struct Web {
     pub trusted_proxies: Vec<String>,
     /// Create an account the first time the proxy vouches for a name it has not seen.
     pub auto_create_users: bool,
+    /// Where Sign out sends someone the proxy signed in. Signing out of ipx alone cannot stick
+    /// while the proxy still vouches for them, so this is the proxy's own sign-out:
+    /// `/cdn-cgi/access/logout` behind Cloudflare Access. Empty sends them to /login.
+    pub sign_out_url: String,
     /// Sign a session out after this long without a request.
     pub session_days: i64,
 }
@@ -93,6 +97,7 @@ impl Default for Web {
             trusted_header: String::new(),
             trusted_proxies: vec!["127.0.0.1".into(), "::1".into()],
             auto_create_users: true,
+            sign_out_url: String::new(),
             session_days: 30,
         }
     }

src/db.rs

@@ -73,7 +73,9 @@ CREATE TABLE IF NOT EXISTS users (
     name      TEXT    NOT NULL UNIQUE COLLATE NOCASE,
     pass_hash TEXT,
     is_admin  INTEGER NOT NULL DEFAULT 0,
-    created   INTEGER NOT NULL
+    -- For whoever maintains the server. NULL where it is not known.
+    created    INTEGER,
+    last_login INTEGER
 );
 
 -- What one person wants from a feed. The feed, its items and its files are shared; this
@@ -85,7 +87,6 @@ CREATE TABLE IF NOT EXISTS subscriptions (
     auto_download     INTEGER,
     allow_explicit    INTEGER,
     max_new_per_check INTEGER,
-    created           INTEGER NOT NULL,
     PRIMARY KEY (user_id, feed_id)
 );
 
@@ -104,7 +105,6 @@ CREATE TABLE IF NOT EXISTS entry_state (
 CREATE TABLE IF NOT EXISTS sessions (
     token   TEXT    PRIMARY KEY,
     user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    created INTEGER NOT NULL,
     seen    INTEGER NOT NULL
 );
 ";
@@ -127,6 +127,23 @@ pub struct User {
     pub name: String,
     pub pass_hash: Option<String>,
     pub is_admin: bool,
+    /// When the account was made and when it last signed in, for whoever maintains the server.
+    pub created: Option<i64>,
+    pub last_login: Option<i64>,
+}
+
+/// The columns `user_row` reads, in its order.
+const USER_COLS: &str = "id, name, pass_hash, is_admin, created, last_login";
+
+fn user_row(r: &rusqlite::Row<'_>) -> rusqlite::Result<User> {
+    Ok(User {
+        id: r.get(0)?,
+        name: r.get(1)?,
+        pass_hash: r.get(2)?,
+        is_admin: r.get::<_, i64>(3)? != 0,
+        created: r.get(4)?,
+        last_login: r.get(5)?,
+    })
 }
 
 /// A feed derived from an OPML subscription rather than written into the config.
@@ -136,30 +153,34 @@ pub struct Managed {
     pub url: String,
     pub title: Option<String>,
     pub group_id: String,
-    pub orphaned: bool,
 }
 
 /// Adds the columns later versions introduced and drops the ones they retired. CREATE TABLE IF
-/// NOT EXISTS does nothing to a table that already exists, so an installed database needs both.
+/// NOT EXISTS leaves a table that already exists alone, so an installed database needs both done
+/// explicitly. Columns from before 0.3.0, the oldest version an upgrade may start from, need no
+/// entry.
 fn migrate(conn: &Connection) -> Result<()> {
     let wanted: &[(&str, &str, &str)] = &[
-        ("feeds", "image", "TEXT"),
-        ("feeds", "orphaned", "INTEGER NOT NULL DEFAULT 0"),
-        ("feeds", "group_id", "TEXT"),
-        ("feeds", "managed", "INTEGER NOT NULL DEFAULT 0"),
-        ("entries", "image", "TEXT"),
-        ("entries", "duration", "INTEGER"),
-        ("entries", "episode", "INTEGER"),
-        ("entries", "season", "INTEGER"),
+        // For whoever maintains the server. An audit dropped `created` as unread on 2026-09-12,
+        // and it came back the same day with `last_login` beside it.
+        ("users", "created", "INTEGER"),
+        ("users", "last_login", "INTEGER"),
     ];
+    let retired: &[(&str, &str)] = &[
         // Read state from before accounts, long since moved to entry_state. Two bugs came from
-    // queries still reading these after they stopped meaning anything, so they go.
-    let retired: &[(&str, &str)] = &[("entries", "read"), ("entries", "flagged"), ("entries", "position")];
+        // queries still reading these after they stopped meaning anything.
+        ("entries", "read"),
+        ("entries", "flagged"),
+        ("entries", "position"),
+        // Written by every insert and read by nothing.
+        ("subscriptions", "created"),
+        ("sessions", "created"),
+    ];
     let has = |table: &str, column: &str| -> Result<bool> {
-        let mut stmt = conn.prepare(&format!("PRAGMA table_info({table})"))?;
-        let names = stmt
-            .query_map([], |r| r.get::<_, String>(1))?
-            .collect::<rusqlite::Result<Vec<_>>>()?;
+        let names: Vec<String> = conn
+            .prepare(&format!("PRAGMA table_info({table})"))?
+            .query_map([], |r| r.get(1))?
+            .collect::<rusqlite::Result<_>>()?;
         Ok(names.iter().any(|c| c == column))
     };
     for (table, column, ty) in wanted {
@@ -829,15 +850,14 @@ impl Db {
         }
         for id in catalogue {
             conn.execute(
-                "INSERT OR IGNORE INTO subscriptions (user_id, feed_id, created) VALUES (?1, ?2, ?3)",
-                params![user_id, id, now()],
+                "INSERT OR IGNORE INTO subscriptions (user_id, feed_id) VALUES (?1, ?2)",
+                params![user_id, id],
             )?;
         }
         // Feeds that exist only in the database (OPML children) count too.
         conn.execute(
-            "INSERT OR IGNORE INTO subscriptions (user_id, feed_id, created)
-             SELECT ?1, id, ?2 FROM feeds",
-            params![user_id, now()],
+            "INSERT OR IGNORE INTO subscriptions (user_id, feed_id) SELECT ?1, id FROM feeds",
+            params![user_id],
         )?;
         Ok(catalogue.len())
     }
@@ -954,8 +974,8 @@ impl Db {
     pub fn subscribe(&self, user_id: i64, feed_id: &str) -> Result<()> {
         let conn = self.conn.lock().unwrap();
         conn.execute(
-            "INSERT OR IGNORE INTO subscriptions (user_id, feed_id, created) VALUES (?1, ?2, ?3)",
-            params![user_id, feed_id, now()],
+            "INSERT OR IGNORE INTO subscriptions (user_id, feed_id) VALUES (?1, ?2)",
+            params![user_id, feed_id],
         )?;
         Ok(())
     }
@@ -969,16 +989,6 @@ impl Db {
         Ok(())
     }
 
-    /// How many people want this feed. Nobody means it stops being scanned.
-    pub fn subscriber_count(&self, feed_id: &str) -> Result<i64> {
-        let conn = self.conn.lock().unwrap();
-        Ok(conn.query_row(
-            "SELECT count(*) FROM subscriptions WHERE feed_id = ?1",
-            [feed_id],
-            |r| r.get(0),
-        )?)
-    }
-
     /// Overwrites one person's settings for a feed. A None field means: follow the feed.
     pub fn set_subscription(&self, user_id: i64, sub: &Sub) -> Result<()> {
         let conn = self.conn.lock().unwrap();
@@ -989,8 +999,8 @@ impl Db {
             .transpose()?;
         conn.execute(
             "INSERT INTO subscriptions
-                (user_id, feed_id, keywords, auto_download, allow_explicit, max_new_per_check, created)
-             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
+                (user_id, feed_id, keywords, auto_download, allow_explicit, max_new_per_check)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6)
              ON CONFLICT(user_id, feed_id) DO UPDATE SET
                 keywords = excluded.keywords,
                 auto_download = excluded.auto_download,
@@ -1003,22 +1013,11 @@ impl Db {
                 sub.auto_download.map(|v| v as i64),
                 sub.allow_explicit.map(|v| v as i64),
                 sub.max_new_per_check,
-                now()
             ],
         )?;
         Ok(())
     }
 
-    /// Feeds with at least one subscriber. What the scanner walks.
-    pub fn subscribed_feed_ids(&self) -> Result<Vec<String>> {
-        let conn = self.conn.lock().unwrap();
-        let mut stmt = conn.prepare("SELECT DISTINCT feed_id FROM subscriptions")?;
-        let out = stmt
-            .query_map([], |r| r.get::<_, String>(0))?
-            .collect::<rusqlite::Result<Vec<_>>>()?;
-        Ok(out)
-    }
-
     // ---- users and sessions ----
 
     pub fn create_user(&self, name: &str, pass_hash: Option<&str>, admin: bool) -> Result<i64> {
@@ -1031,11 +1030,11 @@ impl Db {
     }
 
     pub fn user_by_name(&self, name: &str) -> Result<Option<User>> {
-        self.one_user("SELECT id, name, pass_hash, is_admin FROM users WHERE name = ?1", name)
+        self.one_user(&format!("SELECT {USER_COLS} FROM users WHERE name = ?1"), name)
     }
 
     pub fn user_by_id(&self, id: i64) -> Result<Option<User>> {
-        self.one_user("SELECT id, name, pass_hash, is_admin FROM users WHERE id = ?1", id)
+        self.one_user(&format!("SELECT {USER_COLS} FROM users WHERE id = ?1"), id)
     }
 
     fn one_user<P: rusqlite::ToSql>(&self, sql: &str, key: P) -> Result<Option<User>> {
@@ -1043,12 +1042,7 @@ impl Db {
         let mut stmt = conn.prepare(sql)?;
         let mut rows = stmt.query(params![key])?;
         Ok(match rows.next()? {
-            Some(r) => Some(User {
-                id: r.get(0)?,
-                name: r.get(1)?,
-                pass_hash: r.get(2)?,
-                is_admin: r.get::<_, i64>(3)? != 0,
-            }),
+            Some(r) => Some(user_row(r)?),
             None => None,
         })
     }
@@ -1056,16 +1050,9 @@ impl Db {
     pub fn users(&self) -> Result<Vec<User>> {
         let conn = self.conn.lock().unwrap();
         let mut stmt =
-            conn.prepare("SELECT id, name, pass_hash, is_admin FROM users ORDER BY name")?;
+            conn.prepare(&format!("SELECT {USER_COLS} FROM users ORDER BY name"))?;
         let out = stmt
-            .query_map([], |r| {
-                Ok(User {
-                    id: r.get(0)?,
-                    name: r.get(1)?,
-                    pass_hash: r.get(2)?,
-                    is_admin: r.get::<_, i64>(3)? != 0,
-                })
-            })?
+            .query_map([], user_row)?
             .collect::<rusqlite::Result<Vec<_>>>()?;
         Ok(out)
     }
@@ -1082,6 +1069,26 @@ impl Db {
         Ok(())
     }
 
+    /// The proxy signs people in by the name it vouches for, so an account made before the proxy
+    /// was set up has to take that name to be found by it. The name is UNIQUE, so a taken one is
+    /// refused here as well as by the caller.
+    pub fn rename_user(&self, id: i64, name: &str) -> Result<()> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute("UPDATE users SET name = ?2 WHERE id = ?1", params![id, name])?;
+        Ok(())
+    }
+
+    /// Records a sign-in, to the hour: the proxy vouches for every request, and writing each one
+    /// would buy nothing.
+    pub fn signed_in(&self, id: i64) -> Result<()> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "UPDATE users SET last_login = ?2 WHERE id = ?1 AND coalesce(last_login, 0) <= ?2 - 3600",
+            params![id, now()],
+        )?;
+        Ok(())
+    }
+
     /// Sessions go with the user: a deleted account must not leave a usable cookie behind.
     pub fn delete_user(&self, id: i64) -> Result<()> {
         let conn = self.conn.lock().unwrap();
@@ -1093,7 +1100,7 @@ impl Db {
     pub fn create_session(&self, user_id: i64, token: &str) -> Result<()> {
         let conn = self.conn.lock().unwrap();
         conn.execute(
-            "INSERT INTO sessions (token, user_id, created, seen) VALUES (?1, ?2, ?3, ?3)",
+            "INSERT INTO sessions (token, user_id, seen) VALUES (?1, ?2, ?3)",
             params![token, user_id, now()],
         )?;
         Ok(())
@@ -1105,18 +1112,13 @@ impl Db {
         let conn = self.conn.lock().unwrap();
         let cutoff = now() - max_idle_secs;
         let mut stmt = conn.prepare(
-            "SELECT u.id, u.name, u.pass_hash, u.is_admin
+            "SELECT u.id, u.name, u.pass_hash, u.is_admin, u.created, u.last_login
                FROM sessions s JOIN users u ON u.id = s.user_id
               WHERE s.token = ?1 AND s.seen >= ?2",
         )?;
         let mut rows = stmt.query(params![token, cutoff])?;
         let found = match rows.next()? {
-            Some(r) => Some(User {
-                id: r.get(0)?,
-                name: r.get(1)?,
-                pass_hash: r.get(2)?,
-                is_admin: r.get::<_, i64>(3)? != 0,
-            }),
+            Some(r) => Some(user_row(r)?),
             None => None,
         };
         drop(rows);
@@ -1195,7 +1197,7 @@ impl Db {
             .optional()?)
     }
 
-    /// Read and starred, per person. The row is created on first touch.
+    /// Read and kept, per person. The row is created on first touch.
     pub fn set_entry_flag(
         &self,
         user_id: i64,
@@ -1270,7 +1272,7 @@ impl Db {
     pub fn managed_feeds(&self) -> Result<Vec<Managed>> {
         let conn = self.conn.lock().unwrap();
         let mut stmt = conn.prepare(
-            "SELECT id, url, title, group_id, orphaned FROM feeds
+            "SELECT id, url, title, group_id FROM feeds
              WHERE managed = 1 AND group_id IS NOT NULL ORDER BY coalesce(title, id)",
         )?;
         Ok(stmt
@@ -1280,7 +1282,6 @@ impl Db {
                     url: r.get(1)?,
                     title: r.get(2)?,
                     group_id: r.get(3)?,
-                    orphaned: r.get::<_, i64>(4)? != 0,
                 })
             })?
             .collect::<rusqlite::Result<Vec<_>>>()?)
@@ -1423,8 +1424,8 @@ mod tests {
     fn every_sort_column_runs_and_orders_both_ways() {
         let db = Db::memory().unwrap();
         db.exec_for_test(
-            "INSERT INTO users (id, name, is_admin, created) VALUES (1,'ray',1,0);
-             INSERT INTO subscriptions (user_id, feed_id, created) VALUES (1,'f',0),(1,'g',0);
+            "INSERT INTO users (id, name, is_admin) VALUES (1,'ray',1);
+             INSERT INTO subscriptions (user_id, feed_id) VALUES (1,'f'),(1,'g');
              INSERT INTO feeds (id, url, title) VALUES ('f','u','Zebra'),('g','v','Aardvark');
              INSERT INTO entries (feed_id, guid, title, first_seen) VALUES
                 ('f','a','banana',100),('g','b','Apple',200),('f','c','cherry',300);
@@ -1457,8 +1458,8 @@ mod tests {
     fn deleting_a_shared_file_asks_about_everyone_else() {
         let db = Db::memory().unwrap();
         db.exec_for_test(
-            "INSERT INTO users (id, name, is_admin, created) VALUES (1,'ray',1,0),(2,'sam',0,0),(3,'kit',0,0);
-             INSERT INTO subscriptions (user_id, feed_id, created) VALUES (1,'f',0),(2,'f',0),(3,'f',0);
+            "INSERT INTO users (id, name, is_admin) VALUES (1,'ray',1),(2,'sam',0),(3,'kit',0);
+             INSERT INTO subscriptions (user_id, feed_id) VALUES (1,'f'),(2,'f'),(3,'f');
              INSERT INTO entries (feed_id, guid, first_seen) VALUES ('f','a',0);
              INSERT INTO enclosures (id, feed_id, guid, url, path, state) VALUES
                 (1,'f','a','u1','/tmp/a','done');",
@@ -1483,7 +1484,7 @@ mod tests {
     fn read_state_belongs_to_one_person() {
         let db = Db::memory().unwrap();
         db.exec_for_test(
-            "INSERT INTO users (id, name, is_admin, created) VALUES (1,'ray',1,0),(2,'sam',0,0);
+            "INSERT INTO users (id, name, is_admin) VALUES (1,'ray',1),(2,'sam',0);
              INSERT INTO entries (feed_id, guid, title, first_seen) VALUES
                 ('f','a','One',100),('f','b','Two',200);",
         )
@@ -1526,27 +1527,89 @@ mod tests {
     }
 
     #[test]
-    fn an_old_database_loses_the_retired_read_columns() {
+    fn an_old_database_loses_its_retired_columns() {
         let conn = Connection::open_in_memory().unwrap();
+        // As open() has it: a DROP COLUMN on a table that references another is the part worth
+        // proving, and it has to work with the foreign keys switched on.
+        conn.pragma_update(None, "foreign_keys", "ON").unwrap();
         conn.execute_batch(
             "CREATE TABLE entries (feed_id TEXT NOT NULL, guid TEXT NOT NULL,
                 first_seen INTEGER NOT NULL, read INTEGER NOT NULL DEFAULT 0,
                 flagged INTEGER NOT NULL DEFAULT 0, position INTEGER NOT NULL DEFAULT 0,
-                PRIMARY KEY (feed_id, guid));",
+                PRIMARY KEY (feed_id, guid));
+             CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT NOT NULL UNIQUE COLLATE NOCASE,
+                pass_hash TEXT, is_admin INTEGER NOT NULL DEFAULT 0, created INTEGER NOT NULL);
+             CREATE TABLE subscriptions (
+                user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+                feed_id TEXT NOT NULL, created INTEGER NOT NULL, PRIMARY KEY (user_id, feed_id));
+             CREATE TABLE sessions (token TEXT PRIMARY KEY,
+                user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+                created INTEGER NOT NULL, seen INTEGER NOT NULL);
+             INSERT INTO users VALUES (1, 'ray', NULL, 1, 0);
+             INSERT INTO subscriptions VALUES (1, 'f', 0);
+             INSERT INTO sessions VALUES ('t', 1, 0, 0);",
         )
         .unwrap();
-        // The same order as open(): the schema leaves the old table alone, migrate() fixes it.
+        // The same order as open(): the schema leaves the old tables alone, migrate() fixes them.
         conn.execute_batch(SCHEMA).unwrap();
         migrate(&conn).unwrap();
-        let cols: Vec<String> = conn
-            .prepare("PRAGMA table_info(entries)")
+        let cols = |table: &str| -> Vec<String> {
+            conn.prepare(&format!("PRAGMA table_info({table})"))
                 .unwrap()
                 .query_map([], |r| r.get(1))
                 .unwrap()
                 .collect::<rusqlite::Result<_>>()
+                .unwrap()
+        };
+        for (table, gone) in [
+            ("entries", &["read", "flagged", "position"][..]),
+            ("subscriptions", &["created"][..]),
+            ("sessions", &["created"][..]),
+        ] {
+            let cols = cols(table);
+            assert!(!cols.iter().any(|c| gone.contains(&c.as_str())), "{table}: {cols:?}");
+        }
+        // users.created is not retired: it keeps what it held, and last_login joins it.
+        let users = cols("users");
+        assert!(users.iter().any(|c| c == "last_login"), "{users:?}");
+        assert_eq!(conn.query_row("SELECT created FROM users", [], |r| r.get::<_, i64>(0)).unwrap(), 0);
+        // And the rows come through it.
+        let kept: i64 = conn
+            .query_row("SELECT count(*) FROM subscriptions JOIN sessions USING (user_id)", [], |r| r.get(0))
             .unwrap();
-        assert!(!cols.iter().any(|c| ["read", "flagged", "position"].contains(&c.as_str())), "{cols:?}");
-        assert!(cols.iter().any(|c| c == "image"), "and it still gains the newer ones");
+        assert_eq!(kept, 1);
+    }
+
+    #[test]
+    fn a_renamed_account_keeps_everything_but_its_name() {
+        let db = Db::memory().unwrap();
+        let ray = db.create_user("rays", None, true).unwrap();
+        db.create_user("sam", None, false).unwrap();
+        db.subscribe(ray, "f").unwrap();
+        db.rename_user(ray, "rays@sdf1.net").unwrap();
+        assert!(db.user_by_name("rays").unwrap().is_none());
+        let renamed = db.user_by_name("RAYS@sdf1.net").unwrap().unwrap();
+        assert_eq!((renamed.id, renamed.is_admin), (ray, true), "same account, still the admin");
+        assert_eq!(db.subscriptions_for(ray).unwrap().len(), 1, "and still subscribed");
+        assert!(db.rename_user(ray, "sam").is_err(), "a taken name is refused");
+    }
+
+    #[test]
+    fn an_account_knows_when_it_was_made_and_last_signed_in() {
+        let db = Db::memory().unwrap();
+        let id = db.create_user("ray", None, true).unwrap();
+        let get = || db.user_by_id(id).unwrap().unwrap();
+        assert!(get().created.is_some_and(|t| t > 0));
+        assert_eq!(get().last_login, None, "made, but never signed in");
+        db.signed_in(id).unwrap();
+        let first = get().last_login.unwrap();
+        // Within the hour, the proxy vouching again writes nothing; after it, it does.
+        db.exec_for_test(&format!("UPDATE users SET last_login = {} WHERE id = {id}", first - 60)).unwrap();
+        db.signed_in(id).unwrap();
+        assert_eq!(get().last_login, Some(first - 60));
+        db.exec_for_test(&format!("UPDATE users SET last_login = {} WHERE id = {id}", first - 7200)).unwrap();
+        db.signed_in(id).unwrap();
+        assert!(get().last_login.unwrap() >= first);
     }
 
     #[test]
@@ -1554,7 +1617,7 @@ mod tests {
         // Cutting this along with the dead read columns left the browser suite's admin with an
         // empty sidebar: it is how a fresh install's first account gets config.toml's feeds.
         let db = Db::memory().unwrap();
-        db.exec_for_test("INSERT INTO users (id, name, is_admin, created) VALUES (1,'admin',1,0);")
+        db.exec_for_test("INSERT INTO users (id, name, is_admin) VALUES (1,'admin',1);")
             .unwrap();
         let subs = || -> i64 {
             db.conn.lock().unwrap().query_row("SELECT count(*) FROM subscriptions", [], |r| r.get(0)).unwrap()
@@ -1582,7 +1645,7 @@ mod tests {
              INSERT INTO enclosures (id, feed_id, guid, url, path, state) VALUES
                 (1,'f','b','u1','/tmp/b','done');
              -- Read and starred belong to a person now, so say which one.
-             INSERT INTO users (id, name, is_admin, created) VALUES (7,'reader',1,0);
+             INSERT INTO users (id, name, is_admin) VALUES (7,'reader',1);
              INSERT INTO entry_state (user_id, feed_id, guid, read, flagged) VALUES
                 (7,'f','b',1,0),
                 (7,'f','c',1,1);",
@@ -1652,7 +1715,7 @@ mod tests {
     fn a_show_takes_over_what_its_creator_held() {
         let db = Db::memory().unwrap();
         db.exec_for_test(
-            "INSERT INTO users (id, name, is_admin, created) VALUES (1,'ray',1,0);
+            "INSERT INTO users (id, name, is_admin) VALUES (1,'ray',1);
              INSERT INTO enclosures (id, feed_id, guid, url, state, path, last_error) VALUES
                 (1,'creator','a','u1','done','/x/a.mp3',NULL),
                 (2,'creator','b','u2','skipped',NULL,'explicit'),
@@ -1688,9 +1751,9 @@ mod tests {
     fn a_feed_in_a_group_follows_your_settings_on_the_group() {
         let db = Db::memory().unwrap();
         db.exec_for_test(
-            "INSERT INTO users (id, name, is_admin, created) VALUES (1,'ray',1,0),(2,'sam',0,0);
-             INSERT INTO subscriptions (user_id, feed_id, allow_explicit, created) VALUES
-                (1,'group',1,0),(1,'show',NULL,0),(2,'group',1,0),(2,'show',0,0);",
+            "INSERT INTO users (id, name, is_admin) VALUES (1,'ray',1),(2,'sam',0);
+             INSERT INTO subscriptions (user_id, feed_id, allow_explicit) VALUES
+                (1,'group',1),(1,'show',NULL),(2,'group',1),(2,'show',0);",
         )
         .unwrap();
         let explicit = |group| -> Vec<Option<bool>> {

src/feed.rs

@@ -340,7 +340,7 @@ fn from_rss(ch: rss::Channel, bytes: &[u8]) -> ParsedFeed {
                 link: non_empty(item.link()),
                 published: item.pub_date().and_then(parse_date),
                 // Content wins over description, as __getEntries preferred entry.content.
-                description: non_empty(item.content()).or_else(|| non_empty(item.description())),
+                description: body(item.content(), item.description()),
                 categories: item
                     .categories()
                     .iter()
@@ -406,11 +406,7 @@ fn from_atom(feed: atom_syndication::Feed) -> ParsedFeed {
                 title: non_empty(Some(e.title().as_str())),
                 link: alt.map(str::to_owned),
                 published: e.published().or(Some(e.updated())).map(|d| d.timestamp()),
-                description: e
-                    .content()
-                    .and_then(|c| c.value())
-                    .or_else(|| e.summary().map(|s| s.as_str()))
-                    .map(str::to_owned),
+                description: body(e.content().and_then(|c| c.value()), e.summary().map(|s| s.as_str())),
                 categories: e.categories().iter().map(|c| c.term().to_owned()).collect(),
                 explicit: false,
                 image: None,
@@ -455,6 +451,25 @@ fn non_empty(s: Option<&str>) -> Option<String> {
     s.map(str::trim).filter(|s| !s.is_empty()).map(str::to_owned)
 }
 
+/// An item's show notes: its full body when that is whole, else its description.
+///
+/// libsyn served Daily Meditation Podcast's `content:encoded` cut at the `>` inside a class name
+/// pasted from a web app (`[&:has([data-writing-block])>*]:pointer-events-auto`), so the body
+/// began halfway through a tag and the page showed the rest of the tag as text. The same item's
+/// `description` was whole. With no description to fall back on, a damaged body beats none.
+fn body(content: Option<&str>, description: Option<&str>) -> Option<String> {
+    non_empty(content)
+        .filter(|c| !starts_mid_tag(c))
+        .or_else(|| non_empty(description))
+        .or_else(|| non_empty(content))
+}
+
+/// Text that closes an attribute list (`">`) before any tag has opened is the tail of a tag whose
+/// start was cut off.
+fn starts_mid_tag(html: &str) -> bool {
+    html[..html.find('<').unwrap_or(html.len())].contains("\">")
+}
+
 /// The picture to show beside an item, in order of how deliberate it is:
 /// `itunes:image`, then Media RSS `media:thumbnail`, then a `media:content` that is an
 /// image, and finally an image enclosure -- which is how a blog's article picture arrives
@@ -548,6 +563,18 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_body_cut_off_mid_tag_gives_way_to_the_description() {
+        // How libsyn served Daily Meditation Podcast #3477: content:encoded began inside a tag.
+        let cut = r#"*]:pointer-events-auto R6Vx5W_threadScrollVars" dir="auto" data-turn="assistant"> <p>What if</p>"#;
+        let whole = r#"<div class="[&:has([data-writing-block])>*]:pointer-events-auto"><p>What if</p></div>"#;
+        assert_eq!(body(Some(cut), Some(whole)).as_deref(), Some(whole));
+        assert_eq!(body(Some("<p>Notes</p>"), Some("Summary")).as_deref(), Some("<p>Notes</p>"), "a whole body wins");
+        assert_eq!(body(Some("Plain notes, no tags."), Some("Summary")).as_deref(), Some("Plain notes, no tags."));
+        assert_eq!(body(Some(cut), None).as_deref(), Some(cut), "a damaged body beats none");
+        assert_eq!(body(None, Some("Summary")).as_deref(), Some("Summary"));
+    }
+
     #[test]
     fn feed_level_explicit_overrides_entries() {
         let xml = br#"<?xml version="1.0"?>

src/ipc.rs

@@ -172,11 +172,18 @@ pub async fn daemon_is_live(path: &Path) -> bool {
     UnixStream::connect(path).await.is_ok()
 }
 
+/// Answers `status` for the socket, without the worker. The worker runs one job at a time, and a
+/// healthcheck left waiting behind a scan or a long download timed out and called a busy daemon
+/// dead. The answer goes to the client that asked and no one else: broadcast, it ended any
+/// `ipx fetch` that was watching a scan, since `status` is a terminal event.
+pub type StatusFn = std::sync::Arc<dyn Fn() -> Event + Send + Sync>;
+
 /// Accepts connections, feeding commands to `cmds` and events from `events` back out.
 pub async fn serve(
     path: PathBuf,
     events: broadcast::Sender<Event>,
     cmds: mpsc::Sender<Command>,
+    status: StatusFn,
 ) -> Result<()> {
     // A socket file left by a crashed daemon would block the bind; a live one was already
     // rejected by the caller's daemon_is_live() check.
@@ -195,8 +202,9 @@ pub async fn serve(
         let (stream, _) = listener.accept().await?;
         let rx = events.subscribe();
         let cmds = cmds.clone();
+        let status = status.clone();
         tokio::spawn(async move {
-            if let Err(e) = handle(stream, rx, cmds).await {
+            if let Err(e) = handle(stream, rx, cmds, status).await {
                 tracing::debug!(error = %e, "client gone");
             }
         });
@@ -207,12 +215,21 @@ async fn handle(
     stream: UnixStream,
     mut rx: broadcast::Receiver<Event>,
     cmds: mpsc::Sender<Command>,
+    status: StatusFn,
 ) -> Result<()> {
     let (read, mut write) = stream.into_split();
 
-    // Events out.
+    // Events out: everything broadcast, and the answers meant for this client alone.
+    let (reply, mut replies) = mpsc::channel::<Event>(4);
     let writer = tokio::spawn(async move {
-        while let Ok(ev) = rx.recv().await {
+        loop {
+            let ev = tokio::select! {
+                Some(ev) = replies.recv() => ev,
+                got = rx.recv() => match got {
+                    Ok(ev) => ev,
+                    Err(_) => break,
+                },
+            };
             let mut line = serde_json::to_string(&ev).unwrap_or_default();
             line.push('\n');
             if write.write_all(line.as_bytes()).await.is_err() {
@@ -229,6 +246,15 @@ async fn handle(
             continue;
         }
         match serde_json::from_str::<Command>(line) {
+            // Answered here, not queued behind whatever the worker is on: see StatusFn.
+            Ok(Command::Status) => {
+                tracing::info!(target: "ipx::io", "-> {line}");
+                let ev = status();
+                if let Ok(json) = serde_json::to_string(&ev) {
+                    tracing::info!(target: "ipx::io", "<- {json}");
+                }
+                let _ = reply.send(ev).await;
+            }
             Ok(cmd) => {
                 if cmds.send(cmd).await.is_err() {
                     break; // Worker is gone; so are we.
@@ -329,4 +355,29 @@ mod tests {
         }
         .is_terminal());
     }
+
+    #[tokio::test]
+    async fn status_is_answered_while_the_worker_is_busy() {
+        // The queue is full and nobody drains it, as when the worker is deep in a long download:
+        // anything sent to it would wait for ever.
+        let (cmds, _worker) = mpsc::channel::<Command>(1);
+        cmds.send(Command::Reap { dry_run: true }).await.unwrap();
+        let (events, _) = broadcast::channel::<Event>(8);
+        // Another client, watching a scan: it must not be handed someone else's answer, which
+        // would end its session.
+        let mut watcher = events.subscribe();
+        let status: StatusFn = std::sync::Arc::new(|| Event::Status { feeds: 1, pending: 2, downloaded: 3 });
+        let (client, server) = UnixStream::pair().unwrap();
+        tokio::spawn(handle(server, events.subscribe(), cmds, status));
+
+        let (read, mut write) = client.into_split();
+        write.write_all(b"{\"cmd\":\"status\"}\n").await.unwrap();
+        let line = tokio::time::timeout(std::time::Duration::from_secs(2), BufReader::new(read).lines().next_line())
+            .await
+            .expect("status waited behind the worker")
+            .unwrap()
+            .unwrap();
+        assert!(line.contains(r#""ev":"status""#), "{line}");
+        assert!(watcher.try_recv().is_err(), "the answer went to every client, not just the one asking");
+    }
 }

src/main.rs

@@ -99,6 +99,9 @@ enum UserCmd {
     Passwd { name: String },
     /// Delete an account and everything it knows: its subscriptions and read state
     Rm { name: String },
+    /// Rename an account, keeping its feeds, read state and admin rights. This is how an
+    /// account made before the proxy takes the name the proxy signs it in as
+    Rename { name: String, new_name: String },
 }
 
 /// What a brand new database starts with, so there is always a way in. Announced loudly
@@ -273,11 +276,16 @@ fn user_cmd(ctx: &Arc<Ctx>, cmd: UserCmd) -> Result<()> {
                 println!("no accounts yet: ipx user add <name>");
             }
             for u in users {
+                let added = u
+                    .created
+                    .and_then(|t| chrono::DateTime::from_timestamp(t, 0))
+                    .map_or("?".into(), |d| d.format("%Y-%m-%d").to_string());
+                let seen = u.last_login.map_or("never signed in".into(), |t| format!("signed in {}", ago(Some(t))));
                 println!(
-                    "{:<20} {:<8} {}",
+                    "{:<20} {:<6} {:<11} added {added}  {seen}",
                     u.name,
                     if u.is_admin { "admin" } else { "" },
-                    if u.pass_hash.is_some() { "password" } else { "proxy only" }
+                    if u.pass_hash.is_some() { "password" } else { "proxy only" },
                 );
             }
             Ok(())
@@ -292,6 +300,22 @@ fn user_cmd(ctx: &Arc<Ctx>, cmd: UserCmd) -> Result<()> {
             println!("password changed for {name}");
             Ok(())
         }
+        UserCmd::Rename { name, new_name } => {
+            let name = name.trim().to_ascii_lowercase();
+            // The same rules as a name the proxy vouches for, or the proxy would never find it.
+            let new_name = crate::auth::name_from_header(&new_name)
+                .ok_or_else(|| anyhow::anyhow!("not a usable name: no commas, semicolons or line breaks"))?;
+            let user = ctx
+                .db
+                .user_by_name(&name)?
+                .ok_or_else(|| anyhow::anyhow!("no such account: {name}"))?;
+            if ctx.db.user_by_name(&new_name)?.is_some() {
+                anyhow::bail!("{new_name} already exists");
+            }
+            ctx.db.rename_user(user.id, &new_name)?;
+            println!("renamed {name} to {new_name}");
+            Ok(())
+        }
         UserCmd::Rm { name } => {
             let name = name.trim().to_ascii_lowercase();
             let user = ctx
@@ -315,14 +339,24 @@ async fn run(ctx: &Arc<Ctx>, cmd: Cmd) -> Result<()> {
         Cmd::Reap { dry_run } => reap(ctx, dry_run, true),
         Cmd::Download { enclosure } => download_one(ctx, enclosure).await,
         Cmd::Status => {
-            let (pending, downloaded) = ctx.db.counts()?;
-            let feeds = subscriptions(ctx).map(|s| s.len()).unwrap_or(0);
-            ctx.out.emit(Event::Status { feeds, pending, downloaded });
+            ctx.out.emit(status(ctx));
             Ok(())
         }
     }
 }
 
+/// The counts `ipx status` prints. A running daemon's socket answers with this directly rather
+/// than through the job queue.
+fn status(ctx: &Ctx) -> Event {
+    match ctx.db.counts() {
+        Ok((pending, downloaded)) => {
+            let feeds = subscriptions(ctx).map(|s| s.len()).unwrap_or(0);
+            Event::Status { feeds, pending, downloaded }
+        }
+        Err(e) => Event::Error { msg: format!("{e:#}") },
+    }
+}
+
 async fn daemon(
     ctx: Arc<Ctx>,
     config_path: PathBuf,
@@ -361,7 +395,12 @@ async fn daemon(
     let (tx_cmd, mut rx_cmd) = mpsc::channel::<Cmd>(64);
 
     let web = start_web(&ctx, &config_path, web_addr, &tx_cmd, &events).await?;
-    let server = tokio::spawn(ipc::serve(socket.clone(), events.clone(), tx_cmd));
+    // status is answered by the socket itself; everything else waits its turn in the queue.
+    let answer: ipc::StatusFn = {
+        let ctx = ctx.clone();
+        Arc::new(move || status(&ctx))
+    };
+    let server = tokio::spawn(ipc::serve(socket.clone(), events.clone(), tx_cmd, answer));
 
     // One command at a time: the queue is what keeps two scans from overlapping.
     let mut ticker = tokio::time::interval(std::time::Duration::from_secs(60));

src/retention.rs

@@ -154,8 +154,8 @@ mod tests {
         // One file serves both subscribers, so it takes both of them to release it.
         let db = Db::memory().unwrap();
         db.exec_for_test(
-            "INSERT INTO users (id, name, is_admin, created) VALUES (1,'ray',1,0),(2,'sam',0,0);
-             INSERT INTO subscriptions (user_id, feed_id, created) VALUES (1,'f',0),(2,'f',0);
+            "INSERT INTO users (id, name, is_admin) VALUES (1,'ray',1),(2,'sam',0);
+             INSERT INTO subscriptions (user_id, feed_id) VALUES (1,'f'),(2,'f');
              INSERT INTO entries (feed_id, guid, first_seen) VALUES
                 ('f', 'keep',   0),
                 ('f', 'half',   0),
@@ -189,7 +189,7 @@ mod tests {
     fn prune_keeps_entries_that_still_have_a_file() {
         let db = Db::memory().unwrap();
         db.exec_for_test(
-            "INSERT INTO users (id, name, is_admin, created) VALUES (1,'ray',1,0);
+            "INSERT INTO users (id, name, is_admin) VALUES (1,'ray',1);
              INSERT INTO entry_state (user_id, feed_id, guid, flagged) VALUES (1,'f','flagged',1);
              INSERT INTO entries (feed_id, guid, first_seen) VALUES
                 ('f', 'has-file', 100),

src/web.rs

@@ -91,23 +91,8 @@ async fn auth(State(state): State<WebState>, mut req: Request, next: Next) -> Re
     let cfg = state.ctx.cfg();
     let token = cfg.web.token.clone();
 
-    let peer = req
-        .extensions()
-        .get::<axum::extract::ConnectInfo<std::net::SocketAddr>>()
-        .map(|c| c.0.ip().to_string())
-        .unwrap_or_default();
-
-    // 1. A header, but only from a hop we were told to believe. Anyone able to reach the
-    //    port could otherwise send it and be whoever they liked.
-    let vouched = (!cfg.web.trusted_header.is_empty()
-        && cfg.web.trusted_proxies.iter().any(|p| p == &peer))
-        .then(|| {
-            req.headers()
-                .get(&cfg.web.trusted_header)
-                .and_then(|v| v.to_str().ok())
-                .and_then(crate::auth::name_from_header)
-        })
-        .flatten();
+    // 1. A header, but only from a hop we were told to believe.
+    let vouched = vouched_name(&cfg, &req);
 
     let mut set_cookie: Option<String> = None;
     let mut user = None;
@@ -133,7 +118,13 @@ async fn auth(State(state): State<WebState>, mut req: Request, next: Next) -> Re
                 None
             }
         };
+        // Every request comes vouched for; signed_in keeps one an hour. Failing to note the time
+        // must not turn anyone away, so its error goes unanswered.
+        if let Some(u) = &user {
+            let _ = state.ctx.db.signed_in(u.id);
         }
+    }
+    let by_proxy = user.is_some();
 
     // 2. A session cookie from signing in here.
     if user.is_none() {
@@ -157,6 +148,10 @@ async fn auth(State(state): State<WebState>, mut req: Request, next: Next) -> Re
         if supplied.is_some_and(|t| constant_time_eq(&t, &token)) {
             user = admin_user(&state);
             if from_query.is_some() {
+                // The token link is a sign-in; the cookie it leaves behind is not one each time.
+                if let Some(u) = &user {
+                    let _ = state.ctx.db.signed_in(u.id);
+                }
                 set_cookie = Some(format!(
                     "{COOKIE}={token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000"
                 ));
@@ -180,6 +175,7 @@ async fn auth(State(state): State<WebState>, mut req: Request, next: Next) -> Re
     };
 
     req.extensions_mut().insert(user);
+    req.extensions_mut().insert(Proxied(by_proxy));
     let mut resp = next.run(req).await;
     if let Some(c) = set_cookie {
         if let Ok(v) = header::HeaderValue::from_str(&c) {
@@ -191,6 +187,29 @@ async fn auth(State(state): State<WebState>, mut req: Request, next: Next) -> Re
 
 const SESSION_COOKIE: &str = "ipx_session";
 
+/// Whether the proxy signed this request in, rather than a session or the token: signing out
+/// has to go through the proxy then, or its next request signs the person straight back in.
+#[derive(Clone, Copy)]
+struct Proxied(bool);
+
+/// The name the proxy vouches for, when this request came from one of `trusted_proxies` and
+/// carries `trusted_header`. Anyone able to reach the port could otherwise send the header and
+/// be whoever they liked.
+fn vouched_name(cfg: &crate::config::Config, req: &Request) -> Option<String> {
+    let peer = req
+        .extensions()
+        .get::<axum::extract::ConnectInfo<std::net::SocketAddr>>()
+        .map(|c| c.0.ip().to_string())
+        .unwrap_or_default();
+    if cfg.web.trusted_header.is_empty() || !cfg.web.trusted_proxies.iter().any(|p| p == &peer) {
+        return None;
+    }
+    req.headers()
+        .get(&cfg.web.trusted_header)
+        .and_then(|v| v.to_str().ok())
+        .and_then(crate::auth::name_from_header)
+}
+
 /// Handlers take `User` to say they need one; the auth layer put it there, and nothing
 /// reaches a handler without passing through it.
 impl<S: Send + Sync> axum::extract::FromRequestParts<S> for crate::db::User {
@@ -253,6 +272,7 @@ async fn login(
     let user = user.expect("verified above");
     let token = crate::auth::new_session_token();
     state.ctx.db.create_session(user.id, &token)?;
+    state.ctx.db.signed_in(user.id)?;
     tracing::info!(user = %user.name, "signed in");
 
     let days = state.ctx.cfg().web.session_days.max(1);
@@ -283,8 +303,15 @@ async fn logout(State(state): State<WebState>, req: Request) -> Response {
     resp
 }
 
-async fn me(user: crate::db::User) -> Json<serde_json::Value> {
-    Json(serde_json::json!({ "name": user.name, "admin": user.is_admin }))
+/// Who is signed in, and, for someone the proxy signed in, where Sign out should send them.
+async fn me(
+    State(state): State<WebState>,
+    user: crate::db::User,
+    axum::Extension(Proxied(by_proxy)): axum::Extension<Proxied>,
+) -> Json<serde_json::Value> {
+    let url = state.ctx.cfg().web.sign_out_url.clone();
+    let sign_out = (by_proxy && !url.is_empty()).then_some(url);
+    Json(serde_json::json!({ "name": user.name, "admin": user.is_admin, "sign_out": sign_out }))
 }
 
 // ---- accounts: admin only ----
@@ -317,6 +344,7 @@ async fn list_users(
         .map(|u| {
             serde_json::json!({
                 "id": u.id, "name": u.name, "admin": u.is_admin, "password": u.pass_hash.is_some(),
+                "created": u.created, "last_login": u.last_login,
             })
         })
         .collect();
@@ -406,8 +434,13 @@ async fn remove_user(
     Ok(StatusCode::NO_CONTENT)
 }
 
-async fn login_page() -> Html<&'static str> {
-    Html(include_str!("../web/login.html"))
+/// The password form, except for someone the proxy vouches for: they are signed in already, and
+/// the form only made it look as if they were not.
+async fn login_page(State(state): State<WebState>, req: Request) -> Response {
+    if vouched_name(&state.ctx.cfg(), &req).is_some() {
+        return Redirect::to("/").into_response();
+    }
+    Html(include_str!("../web/login.html")).into_response()
 }
 
 /// The 2004 icon, served once for both pages rather than inlined as base64 into each. The
@@ -580,24 +613,33 @@ struct PopularRow {
 
 /// Every feed that may be listed, with everyone counted, you included, most subscribers
 /// first. Popular is the top of it, the directory is all of it, and it is all that
-/// `subscribe_popular` will subscribe you to.
+/// `subscribe_popular` will subscribe you to. An OPML or a Patreon creator is listed as the
+/// feeds inside it and never itself: both lists are for finding a show.
 fn popular(state: &WebState, user_id: i64) -> Result<Vec<PopularRow>> {
     let db = &state.ctx.db;
     let mine: std::collections::HashSet<String> =
         db.subscriptions_for(user_id)?.into_iter().map(|s| s.feed_id).collect();
     let counts = db.subscriber_counts()?;
+    let catalogue = crate::subscriptions(&state.ctx)?;
+    let by_id: std::collections::HashMap<&str, &crate::config::Feed> =
+        catalogue.iter().map(|s| (s.id.as_str(), &s.cfg)).collect();
+    let is_folder: std::collections::HashSet<&str> =
+        catalogue.iter().filter_map(|s| s.cfg.group.as_deref()).collect();
     let mut out = vec![];
-    for s in crate::subscriptions(&state.ctx)? {
+    for s in &catalogue {
         let n = counts.get(&s.id).copied().unwrap_or(0);
-        // A feed from an OPML rides on the OPML: everyone subscribed to it counts every feed
-        // inside, which would bury everything anyone chose on purpose.
-        let from_opml = s.managed || s.cfg.group.is_some();
-        if n == 0 || from_opml || looks_private(&s.cfg) {
+        // A feed inside an OPML that looks private is as private as the OPML.
+        let folder = s.cfg.group.as_deref().and_then(|g| by_id.get(g));
+        if n == 0
+            || is_folder.contains(s.id.as_str())
+            || looks_private(&s.cfg)
+            || folder.is_some_and(|f| looks_private(f))
+        {
             continue;
         }
         let sum = db.feed_summary(&s.id)?;
         let subscribed = mine.contains(&s.id);
-        out.push(PopularRow { id: s.id, title: sum.title, image: sum.image, subscribers: n, subscribed });
+        out.push(PopularRow { id: s.id.clone(), title: sum.title, image: sum.image, subscribers: n, subscribed });
     }
     out.sort_by(|a, b| b.subscribers.cmp(&a.subscribers).then_with(|| sort_name(a).cmp(&sort_name(b))));
     Ok(out)
@@ -612,7 +654,7 @@ async fn get_popular(
     Ok(Json(rows))
 }
 
-/// Every feed that may be listed, A to Z.
+/// Every feed that may be listed, A to Z, with the feeds inside an OPML in place of the OPML.
 async fn get_directory(
     State(state): State<WebState>,
     user: crate::db::User,
@@ -634,7 +676,7 @@ async fn subscribe_popular(
     Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, ApiError> {
     if !popular(&state, user.id)?.iter().any(|p| p.id == id) {
-        return Err(ApiError::bad_request(format!("{id:?} is not on the popular list")));
+        return Err(ApiError::bad_request(format!("{id:?} is not in the directory")));
     }
     state.ctx.db.subscribe(user.id, &id)?;
     Ok(Json(serde_json::json!({ "id": id })))
@@ -739,7 +781,14 @@ mod tests {
 
     #[test]
     fn only_the_last_admin_is_protected() {
-        let u = |id, is_admin| crate::db::User { id, name: format!("u{id}"), pass_hash: None, is_admin };
+        let u = |id, is_admin| crate::db::User {
+            id,
+            name: format!("u{id}"),
+            pass_hash: None,
+            is_admin,
+            created: None,
+            last_login: None,
+        };
         assert!(last_admin(&[u(1, true), u(2, false)], 1));
         assert!(!last_admin(&[u(1, true), u(2, true)], 1), "another admin remains");
         assert!(!last_admin(&[u(1, true), u(2, false)], 2), "not an admin at all");
@@ -1083,7 +1132,7 @@ async fn remove_feed(
     {
         state.ctx.db.unsubscribe(user.id, &child.id)?;
     }
-    if state.ctx.db.subscriber_count(&id)? > 0 {
+    if state.ctx.db.subscriber_counts()?.contains_key(&id) {
         return Ok(StatusCode::NO_CONTENT);
     }
 

tests/ui/app.spec.js

@@ -433,6 +433,9 @@ test('an admin adds someone, makes them an admin, and removes them', async ({ pa
   await page.locator('#uadd').click();
   const row = userRow(page, 'pat');
   await expect(row).toBeVisible();
+  // When each account was added and last signed in; the admin signed in with the token link.
+  await expect(row).toContainText(/Added .* never signed in/);
+  await expect(userRow(page, 'admin')).toContainText(/signed in \d+m ago/);
   await expect(row.locator('[data-a="admin"]')).not.toBeChecked();
 
   await row.locator('[data-a="admin"]').check();
@@ -613,8 +616,8 @@ test('Popular lists what everyone here reads, but never a private feed', async (
   await piper.locator('#feedlist .place', { hasText: 'Popular' }).click();
   const offered = piper.locator('#popular .childrow');
   await expect(offered.filter({ hasText: 'Test Show' })).toBeVisible({ timeout: 20_000 });
-  // An OPML's own feeds ride on the OPML, and a key in a URL marks someone's paid feed.
-  await expect(offered.filter({ hasText: /Grouped Show|grouped-show/ })).toHaveCount(0);
+  // An OPML is listed as the feeds inside it, and a key in a URL marks someone's paid feed.
+  await expect(offered.filter({ hasText: /Test Subscriptions/ })).toHaveCount(0);
   await expect(offered.filter({ hasText: /Paid Show|paid-show/ })).toHaveCount(0);
 
   // No URL reaches the page at all, so neither can a key, and the server holds the same line.
@@ -623,19 +626,25 @@ test('Popular lists what everyone here reads, but never a private feed', async (
   expect(listed).not.toContain('.xml');
   expect((await piper.request.post('/api/popular/paid-show')).status()).toBe(400);
 
-  // Popular is the top ten of the directory, and the directory is every listed feed, A to Z.
+  // Popular is the top ten of the directory, and the directory is every listed feed A to Z,
+  // with an OPML's feeds in place of the OPML in both.
   const dir = await (await piper.request.get('/api/directory')).json();
   const top = await (await piper.request.get('/api/popular')).json();
   const names = dir.map(p => (p.title || p.id).toLowerCase());
   expect(names).toEqual([...names].sort());
+  const ids = dir.map(p => p.id);
+  expect(ids).not.toContain('test-subscriptions');
+  expect(ids).toEqual(expect.arrayContaining(['grouped-show', 'aardvark-radio']));
   expect(top.length).toBe(Math.min(10, dir.length));
-  expect(top.every(t => dir.some(d => d.id === t.id))).toBe(true);
-  expect(dir.map(p => p.id)).not.toContain('paid-show');
+  expect(top.every(t => ids.includes(t.id))).toBe(true);
+  expect(ids).not.toContain('paid-show');
 
   // Subscribe from the directory this time; the popular list shares the same rows.
   await piper.locator('#feedlist .place', { hasText: 'Directory' }).click();
   await expect(piper.locator('#count')).toContainText(`Directory: ${dir.length} feed`);
   await expect(offered.filter({ hasText: 'Test Show' })).toBeVisible();
+  await expect(offered.filter({ hasText: /Grouped Show|grouped-show/ })).toBeVisible();
+  await expect(offered.filter({ hasText: /Test Subscriptions/ })).toHaveCount(0);
   await expect(offered.filter({ hasText: /Paid Show|paid-show/ })).toHaveCount(0);
 
   const row = async () =>
@@ -784,3 +793,20 @@ test('play in the Files pane plays once, in the player bar', async ({ page }) =>
   await expect(page.locator('audio')).toHaveCount(1);   // the player bar's, and nothing else
   await page.locator('#pclose').click();
 });
+
+test('someone the proxy signs in never sees the password page, and signs out through the proxy', async ({ page, browser }) => {
+  // Signed in with the token, not by the proxy: Sign out stays ipx's own.
+  expect((await (await page.request.get('/api/me')).json()).sign_out).toBeNull();
+
+  const ctx = await browser.newContext({ extraHTTPHeaders: { 'X-Test-User': 'proxied@example.com' } });
+  const proxied = await ctx.newPage();
+  // Regression: after Sign out, the password form showed to someone the proxy still vouched for.
+  await proxied.goto('/login');
+  await expect(proxied).toHaveURL(/:8791\/$/);
+  await expect(proxied.locator('#who')).toContainText('proxied@example.com');
+  expect(await (await proxied.request.get('/api/me')).json())
+    .toMatchObject({ name: 'proxied@example.com', sign_out: '/signed-out-by-the-proxy' });
+  await proxied.locator('#signout').click();
+  await expect(proxied).toHaveURL(/\/signed-out-by-the-proxy$/);
+  await ctx.close();
+});

tests/ui/global-setup.js

@@ -37,6 +37,10 @@ enabled = false
 enabled = true
 bind = "127.0.0.1:8791"
 token = "${TOKEN}"
+# The proxy path, for tests that send the header themselves: the daemon sees them at 127.0.0.1.
+trusted_header = "X-Test-User"
+trusted_proxies = ["127.0.0.1"]
+sign_out_url = "/signed-out-by-the-proxy"
 
 [feeds.test-show]
 url = "http://127.0.0.1:8792/show.xml"

web/index.html

@@ -134,7 +134,9 @@ input[type=search],input[type=text],input[type=password],input[type=number],sele
   border-radius:8px;padding:7px 10px;font:inherit;font-size:13.5px;
 }
 input:focus,select:focus{outline:0;border-color:var(--accent)}
-#feedlist{overflow-y:auto;padding:0 8px 12px;flex:1;min-height:0}
+/* The wider left gutter is the folder triangle's; everything in the list shifts with it, so the
+   feeds still line up with the places above. */
+#feedlist{overflow-y:auto;padding:0 8px 12px 16px;flex:1;min-height:0}
 .feed{
   display:flex;gap:10px;align-items:center;padding:7px 8px;border-radius:9px;
   cursor:pointer;margin-bottom:1px;position:relative;
@@ -145,9 +147,10 @@ input:focus,select:focus{outline:0;border-color:var(--accent)}
 .feed.child{margin-left:44px}
 .feed.child .art{width:28px;height:28px;font-size:11px}
 /* Only a folder has a triangle, hung in the margin so every feed's art lines up with the places
-   above it. The button is the row's full height: a near miss used to open the folder's page. */
+   above it. The button is the row's full height and 24 px wide: a near miss used to open the
+   folder's page, and 16 px left the triangle cramped against the art. */
 .chev{
-  position:absolute;left:-8px;top:0;bottom:0;width:16px;display:grid;place-items:center;
+  position:absolute;left:-16px;top:0;bottom:0;width:24px;display:grid;place-items:center;
   border-radius:4px;color:var(--faint);
 }
 .chev:hover{color:var(--fg)}
@@ -772,9 +775,9 @@ const unreadFirst=(a,b)=>(b.unread>0)-(a.unread>0);
 // an id starting with ':' can never be a feed's, since feed ids are slugs.
 const VIEWS={
   ':directory':{title:'Directory',icon:ICON.directory,url:'/api/directory',
-    blurb:'Every feed anyone on this server subscribes to, A to Z.'},
+    blurb:'Every feed anyone on this server subscribes to, A to Z. The feeds inside an OPML are listed one by one, not the OPML.'},
   ':popular':{title:'Popular',icon:ICON.popular,url:'/api/popular',
-    blurb:'The ten feeds with the most subscribers here.'},
+    blurb:'The ten feeds with the most subscribers here. The feeds inside an OPML count one by one, not the OPML.'},
   ':all':{title:'All Subscriptions',icon:ICON.all},
 };
 function renderFeeds(){
@@ -1589,8 +1592,7 @@ async function renderListed(v){
     <div class="fhead slim">
       <div class="art">${v.icon}</div>
       <div class="meta"><h2>${v.title}</h2>
-        <div class="sub">${v.blurb} Everyone counts, you included. Feeds inside an OPML
-          subscription, and private feeds, are never listed.</div></div>
+        <div class="sub">${v.blurb} Everyone counts, you included. Private feeds are never listed.</div></div>
     </div>
     <div class="childlist" id="popular"><p class="hint">Loading…</p></div>`;
   $('#count').textContent=v.title;
@@ -1706,7 +1708,9 @@ async function usersModal(){
   const users = await api('/api/users') || [];
   openModal(`<h3>Users</h3>
     ${users.map(u=>`<div class="inline" data-id="${u.id}" style="margin-bottom:8px">
-      <b style="flex:1;overflow-wrap:anywhere">${esc(u.name)}</b>
+      <div style="flex:1;min-width:0"><b style="overflow-wrap:anywhere">${esc(u.name)}</b>
+        <small style="display:block;color:var(--faint)">${u.created?`Added ${dateOf(u.created)}`:'Added before this was kept'} · ${
+          u.last_login?`signed in ${ago(u.last_login)}`:'never signed in'}</small></div>
       ${u.password?'':'<span class="tag" title="No password: signs in through the proxy">Proxy</span>'}
       <label class="check" style="margin:0"><input type="checkbox" data-a="admin" ${u.admin?'checked':''}> Admin</label>
       <button class="btn ico danger" data-a="rm" title="Remove ${esc(u.name)}" aria-label="Remove ${esc(u.name)}">${ICON.trash}</button></div>`).join('')}
@@ -1865,7 +1869,9 @@ function opmlModal(){
 async function scanAll(){ toast('Scanning all feeds…'); await api('/api/fetch',{method:'POST',body:JSON.stringify({force:true})}); }
 $('#scanAll').onclick=scanAll;
 $('#prefs').onclick=prefsModal;
-$('#signout').onclick=async()=>{ await api('/api/logout',{method:'POST'}); location.href='/login'; };
+// Someone the proxy signed in is signed out by the proxy: ipx's own sign-out cannot stick while
+// the proxy still vouches for them. /api/me says where, when that is the case.
+$('#signout').onclick=async()=>{ await api('/api/logout',{method:'POST'}); location.href=S.me?.sign_out||'/login'; };
 api('/api/me').then(u=>{
   S.me=u;
   $('#who').textContent=u.name+(u.admin?' · admin':'');