An id reused for another activity is not a copy

Friendica's activity ids are uniqid(): a short prefix and the microsecond. Two of its processes answering two follows at
once gave both Accepts one id, and PrivaPub, queueing each inbox activity once per id, dropped the second as a copy:
that follow stayed pending on our side while Friendica counted the persona as a follower (seen in the town's Friendica
pair). An id that comes back carrying another type, actor or object is now queued apart; a true copy is still dropped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub.Tests/Federation/InboxGapTests.cs

@@ -79,6 +79,37 @@ namespace PrivaPub.Tests.Federation
 
 		// Pixelfed names our post by its page (/@name/<id>, the post's url) in its Like, Announce and their Undo: the post is
 		// found the same as by its id
+		// Friendica's activity ids are uniqid(), a prefix and the microsecond: two of its processes answering two follows at
+		// once gave both Accepts one id, and the second was dropped as a copy of the first, leaving that follow pending
+		[Fact]
+		public async Task Two_activities_a_server_gave_one_id_are_both_taken_and_a_true_copy_once()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var dario = new RemoteActor(_harness.Peer, "dario");
+			var jun = new RemoteActor(_harness.Peer, "jun");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = dario.Id }, token);
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = jun.Id }, token);
+			Task<Following> Of(RemoteActor target) =>
+				DB.Default.Find<Following>().Match(f => f.AvatarId == alice.Id && f.TargetActorURI == target.Id).ExecuteSingleAsync(token);
+			async Task<JsonObject> Accept(RemoteActor by, string id) => new()
+			{
+				["id"] = id,
+				["type"] = "Accept",
+				["actor"] = by.Id,
+				["object"] = new JsonObject { ["id"] = (await Of(by)).FollowActivityURI, ["type"] = "Follow", ["actor"] = alice.Uri, ["object"] = by.Id }
+			};
+			var shared = NewId(dario, "activity");
+
+			var first = await _harness.Deliver(dario, "/human-centipede", await Accept(dario, shared));
+			var second = await _harness.Deliver(jun, "/human-centipede", await Accept(jun, shared));
+			var copy = await _harness.Deliver(jun, "/human-centipede", await Accept(jun, shared));
+
+			Assert.Equal(("queued", "queued", "duplicate"), (first.Reason, second.Reason, copy.Reason));
+			Assert.Equal(FollowState.Accepted, (await Of(dario)).State);
+			Assert.Equal(FollowState.Accepted, (await Of(jun)).State);
+		}
+
 		[Fact]
 		public async Task A_like_naming_a_post_by_its_page_counts_and_its_undo_too()
 		{

PrivaPub.Tests/Support/Harness.cs

@@ -135,10 +135,12 @@ namespace PrivaPub.Tests.Support
 		public async Task<InboxResult> Deliver(RemoteActor sender, string path, JsonNode activity)
 		{
 			var result = await Receiver.Receive(sender.Post(Host, path, activity), default, CancellationToken.None);
+			// the job this delivery queued: under its id, or apart (a forwarded copy; an id its sender reused)
 			var id = activity is JsonObject ? activity["id"]?.GetValue<string>() : default;
 			var dedupe = (result.Reason == "forwarded" ? "inbox|forwarded|" : "inbox|") + id;
-			var job = await DB.Default.Find<Job>().Match(j => j.DedupeKey == dedupe).ExecuteFirstAsync();
-			if (job != default)
+			var job = await DB.Default.Find<Job>().Match(j => (j.DedupeKey == dedupe || j.DedupeKey.StartsWith(dedupe + "|")) && j.State == JobState.Pending)
+				.Sort(j => j.CreatedAt, Order.Descending).ExecuteFirstAsync();
+			if (job != default && result.Reason != "duplicate")
 				Assert.Equal(JobResult.Done, (await Processor.Handle(job, CancellationToken.None)).Result);
 			return result;
 		}