P7: downvotes go out, and feeds are read through the server's reader

Votes out. A persona's downvote is a Dislike (POST /api/v1/statuses/:id/downvote and /undownvote, the viewer's own as
privapub.votes.downvoted). One vote a post: a changed vote is sent as the new vote alone, as Lemmy sends one, since an
Undo of the old one beside it could arrive after it and take the new one away; Undo goes only when a vote is taken back.
A vote on a post in a remote community goes to the community, which counts it, and to the author only when on another
server: one copy a server, since PieFed drops a second copy of an activity it has just seen. Mbin keeps a favourite
apart from a vote, so there a favourite stays after a switch to a downvote.

Feeds followed (owner decision 2026-10-07: through the server). Following a feed (Lemmy's multi-community, PieFed's feed)
keeps a FeedSubscription for the persona and nothing else; the new Service privapub_feeds (LocalActorKind.Reader,
reserved by migration _017) follows every community of the feeds read here, reconciled when a persona follows or leaves
one, when a feed's list is read again (kept as it was when it cannot be read) and every six hours. Its Following rows
carry FollowerKind, so nobody's home gets what it brings in and its unanswered follows are sent again as its own. The
persona reads GET /api/v1/timelines/feed/:id (the feed's threads, ours included) and lists its feeds at GET /api/v1/feeds.

Checked in the pasture, every scenario: 873 pass. The 14 failures are Hubzilla's (identical on the previous commit:
Hubzilla no longer answers a follow in this pasture since its restore) and two activities Smithereen never sent;
followsync passes once the pasture's restore is older than the 14-day pause. Live: alice's downvotes count as downvotes
on Lemmy 1.0 and PieFed, replacing her upvote; Lemmy 1.0 and PieFed take privapub_feeds' follows and their threads reach
the feed timelines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

.gitea/workflows/build.yml

@@ -15,5 +15,5 @@ jobs:
       - name: Build
         run: dotnet build PrivaPub.sln -c Release
 
-      - name: Test
-        run: dotnet test PrivaPub.sln -c Release --no-build
+      - name: Test (unit and integration, on a throwaway mongod)
+        run: tools/ci/with-test-mongod.sh dotnet test PrivaPub.sln -c Release --no-build

.gitea/workflows/deploy.yml

@@ -12,8 +12,7 @@ env:
   BACKUPS: /var/backups/privapub.thepra.dev
   LOCAL_URL: http://127.0.0.1:6970
   PUBLIC_URL: https://privapub.thepra.dev
-  MONGO_URI: mongodb://127.0.0.1:27022
-  MONGO_DB: PrivaPub
+  SERVER_BACKUPS: /var/lib/privapub/backups
 
 jobs:
   site:
@@ -28,8 +27,8 @@ jobs:
           echo "BUILD_REF=${GITHUB_REF_NAME:-master}" >> "$GITHUB_ENV"
           echo "BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"
 
-      - name: Test
-        run: dotnet test PrivaPub.sln -c Release
+      - name: Test (unit and integration, on a throwaway mongod)
+        run: tools/ci/with-test-mongod.sh dotnet test PrivaPub.sln -c Release
 
       - name: Publish
         run: |
@@ -57,12 +56,24 @@ jobs:
           echo "SNAPSHOT=$BACKUPS/site-$STAMP" >> "$GITHUB_ENV"
           ls -1dt "$BACKUPS"/site-* 2>/dev/null | tail -n +4 | xargs -r rm -rf || true
 
-      - name: Dump the database
+      # The server's own backup (PrivaPub admin backup, owner decision 2026-10-07) of the database as the live build left it:
+      # the new build's command runs before its migrations. The media are listed, not linked (the runner may not link
+      # www-data's files; the nightly backups hold them). Never the statistics salt, which must not outlive its day (owner
+      # rule), nor the configuration's copy with its secrets. No deploy while a restore waits for its boot.
+      - name: Back up the database
         run: |
-          DUMP="$BACKUPS/mongo-$(date +%Y%m%d-%H%M%S).archive.gz"
-          mongodump --quiet --uri "$MONGO_URI" --db "$MONGO_DB" --gzip --archive="$DUMP"
-          echo "::notice::database dumped to $DUMP ($(du -h "$DUMP" | cut -f1))"
-          ls -1t "$BACKUPS"/mongo-*.archive.gz 2>/dev/null | tail -n +8 | xargs -r rm -f || true
+          [ ! -e "$SERVER_BACKUPS/restore.json" ] || { echo "::error::a restore is pending or running ($SERVER_BACKUPS/restore.json): deploy after it"; exit 1; }
+          out=$(cd "$GITHUB_WORKSPACE/publish" && ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin backup --kind pre-deploy --db-only)
+          echo "$out"
+          id=$(echo "$out" | grep -oE '^[0-9]{8}-[0-9]{6}-pre-deploy' | tail -1)
+          [ -d "$SERVER_BACKUPS/$id" ] || { echo "::error::the backup was not made"; exit 1; }
+          (cd "$GITHUB_WORKSPACE/publish" && ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin backup verify "$id")
+          if [ -e "$SERVER_BACKUPS/$id/db/InteractionSalt.jsonl.gz" ]; then
+            echo "::error::the backup holds the statistics salt"
+            exit 1
+          fi
+          echo "BACKUP_ID=$id" >> "$GITHUB_ENV"
+          echo "::notice::database backed up as $id"
 
       - name: Stop, sync, start
         run: |
@@ -95,6 +106,11 @@ jobs:
           [ "$served" = "$BUILD_COMMIT" ] || { echo "::error::served build is '$served', expected '$BUILD_COMMIT'"; exit 1; }
           code=$(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/activity+json' "$PUBLIC_URL/peasants/privapub")
           [ "$code" = "200" ] || { echo "::error::the instance actor answered $code"; exit 1; }
+          # SecureMode (owner decision 2026-10-04): an unsigned reader gets 401 from a persona, a browser the public page
+          code=$(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/activity+json' "$PUBLIC_URL/peasants/thepra")
+          [ "$code" = "401" ] || { echo "::error::an unsigned GET of a persona answered $code, not 401: SecureMode is off"; exit 1; }
+          code=$(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: text/html' "$PUBLIC_URL/peasants/thepra")
+          [ "$code" = "302" ] || { echo "::error::a browser asking for a persona got $code, not a redirect"; exit 1; }
           code=$(curl -s -o /dev/null -w '%{http_code}' "$PUBLIC_URL/.well-known/nodeinfo")
           [ "$code" = "200" ] || { echo "::error::nodeinfo answered $code"; exit 1; }
           code=$(curl -s -o /dev/null -w '%{http_code}' "$PUBLIC_URL/swagger/index.html")
@@ -105,4 +121,38 @@ jobs:
             --data '{"type":"Follow","actor":"https://example.org/users/x","object":"'"$PUBLIC_URL"'/peasants/privapub"}' "$PUBLIC_URL/human-centipede")
           [ "$code" = "401" ] || { echo "::error::an unsigned inbox POST answered $code"; exit 1; }
           tools/smoke/mastodon-api.sh "$PUBLIC_URL"
+          open=$(curl -fsS "$PUBLIC_URL/nodeinfo/2.1" | python3 -c "import json,sys; print(json.load(sys.stdin)['openRegistrations'])")
+          enabled=$(curl -fsS "$PUBLIC_URL/api/v2/instance" | python3 -c "import json,sys; print(json.load(sys.stdin)['registrations']['enabled'])")
+          [ "$open" = "$enabled" ] || { echo "::error::NodeInfo says registrations are $open, the instance API $enabled"; exit 1; }
+          curl -fsS "$PUBLIC_URL/stargazing" | grep -q 'The crawler is <strong>on</strong>' \
+            || { echo "::error::/stargazing does not say the crawler is on"; exit 1; }
           echo "::notice::serving $served"
+
+      # @thepra is the deploy's own persona (owner decision, 2026-10-04): the server's CLI makes or keeps it, undiscoverable,
+      # and gives its root a new password on every deploy, so no secret is stored and nobody has to create anything.
+      - name: Sign in as @thepra and check the signed-in API
+        run: |
+          creds=$(cd "$WEB_ROOT" && ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin smoke thepra | grep -E '^deploy-smoke [^ ]+$' | tail -1)
+          [ -n "$creds" ] || { echo "::error::the smoke persona could not be prepared"; exit 1; }
+          read -r login password <<< "$creds"
+          echo "::add-mask::$password"
+          read -r token cid cs <<< "$(tools/smoke/oauth.sh "$PUBLIC_URL" "$login" "$password" thepra read)"
+          echo "::add-mask::$token"
+          tools/smoke/mastodon-api.sh "$PUBLIC_URL" "$token"
+          discoverable=$(curl -fsS -H "Authorization: Bearer $token" "$PUBLIC_URL/api/v1/accounts/verify_credentials" | python3 -c "import json,sys; print(json.load(sys.stdin).get('discoverable'))")
+          [ "$discoverable" = "False" ] || { echo "::error::@thepra is discoverable"; exit 1; }
+          curl -fsS -o /dev/null -X POST "$PUBLIC_URL/oauth/revoke" --data-urlencode "token=$token" \
+            --data-urlencode "client_id=$cid" --data-urlencode "client_secret=$cs"
+          echo "::notice::signed in as @thepra"
+
+      # The server fetches DB-IP Lite itself (GeoUpdater) about 30 s after it starts and then daily; the deploy only checks.
+      - name: Geolocation databases are current
+        run: |
+          for kind in city asn; do
+            db="/var/lib/privapub/geo/dbip-$kind-lite.mmdb"
+            for i in $(seq 1 60); do [ -s "$db" ] && break; sleep 10; done
+            [ -s "$db" ] || { echo "::error::$db is missing: the server has not fetched DB-IP Lite"; exit 1; }
+            days=$(( ($(date +%s) - $(stat -c %Y "$db")) / 86400 ))
+            [ "$days" -le 40 ] || { echo "::error::$db was installed $days days ago"; exit 1; }
+          done
+          curl -fsS "$PUBLIC_URL/stargazing" | grep -o 'DB-IP Lite [0-9-]*' | head -1 | sed 's/^/::notice::locating with /'

.gitignore

@@ -257,6 +257,7 @@ Generated_Code/
 # because we have git ;-)
 _UpgradeReport_Files/
 Backup*/
+!PrivaPub/Infrastructure/Backup/
 UpgradeLog*.XML
 UpgradeLog*.htm
 ServiceFabricBackup/
@@ -401,4 +402,12 @@ FodyWeavers.xsd
 
 PrivaPub/media-store/
 PrivaPub/media-store-proxy/
+PrivaPub/media-store-trash/
+PrivaPub/media-store-incoming/
+PrivaPub/media-store-backups/
 tools/pasture/.publish/
+tools/pasture/.flood/
+.claude/worktrees/
+tools/pasture/.ca/
+tools/pasture/.state/
+tools/pasture/out/

CLAUDE.md

@@ -1,4 +1,4 @@
-# CLAUDE.md
+# CLAUDE.md
 
 Guidance for working in this repository. `docs/ROADMAP.md` holds the owner's decisions and the phased plan to full
 ActivityPub interop; read it before changing anything federation-, privacy- or API-shaped. `docs/INTEROP.md` is the
@@ -21,6 +21,13 @@ Its defining idea: **one private login owns several public personas.**
   becoming two kinds: a public **community** (FEP-1b12, Lemmy-compatible) and a private, invitation-only **circle**.
 - **`DmGroup` is a direct-message conversation.**
 - **`privapub` is the instance actor** (type Application). It signs fetches no persona should be tied to.
+- **`privapub_reports` is the reporter** (type Service, `LocalActorKind.Reporter`). It carries reports to Lemmy, which
+  takes none from an Application, and to PieFed and Mbin, and names nobody.
+- **`privapub_feeds` is the reader of feeds** (type Service, `LocalActorKind.Reader`). When a persona follows a feed
+  (Lemmy's multi-community, PieFed's feed), it follows the feed's communities in the server's name
+  (`Domain/Social/FeedFollows.cs`, owner decision 2026-10-07); its `Following` rows carry `FollowerKind`, and nobody's
+  home gets what it brings in. All three are server actors (`LocalActor.IsServerActor`): never followed, mentioned or
+  shown as accounts.
 
 Privacy features in the model:
 - location-ranged posts (`Post.Location`, `RangeKm`), to become local-only and never federated;
@@ -29,8 +36,8 @@ Privacy features in the model:
 
 The intended client is the Mastodon client API (Tusky, Elk, Phanpy, Ivory), where each avatar logs in as its own
 account. The private `/clientapi` covers what Mastodon can't express. `thepra/decePubClient`
-(https://decepub.thepra.dev) is the owner's own Pleroma-FE-like PWA. It still shows mock data and is not wired to the
-server.
+(https://decepub.thepra.dev) is the owner's own Pleroma-FE-like PWA. It signs in once on `/clientapi` and exchanges that
+JWT for each persona's Mastodon token (`PersonaExchange`), then uses both APIs.
 
 ## Route names are deliberate
 
@@ -83,9 +90,14 @@ PrivaPub/                         ASP.NET Core Web API, net10.0
                                   (authoritative fetch, key verification, WebFinger), ActorDocument (parser)
     Objects/                      Origin, ActivityJson, NoteParser, Addressing, ContentSanitizer
     Moderation/                   DomainBlocks (suspend / silence / reject media)
-    Signing/                      HttpSignatures (draft-cavage sign/verify)
+    Signing/                      HttpSignatures (draft-cavage sign/verify), MessageSignatures (RFC 9421 verify),
+                                  RequestSignature (whichever a request carries), IntegrityProofs (FEP-8b32
+                                  eddsa-jcs-2022 by a persona's Ed25519 key, FEP-521a Multikeys), Jcs (RFC 8785)
     Inbox/                        InboxReceiver (verify, queue, 202) → InboxProcessor (job) → Handlers/{Follow,Accept,Reject,
-                                  Undo,Create,Update,Delete,Like,Announce}; RemotePosts (build, fetch parents, FetchAncestors)
+                                  Undo,Create,Update,Delete,Like,Announce}; RemotePosts (build, fetch parents, FetchAncestors);
+                                  RemoteReplies (FetchReplies: a thread's `context`, else `replies` two levels down);
+                                  Forwarded (what a thread's server passes on, believed as far as the origin vouches);
+                                  ReplyRelay (third-party replies to a persona's posts passed on to its followers)
     Outbox/                       OutboxPublisher (who a post goes to), DeliveryService (queues jobs) + DeliveryJobHandler
     Rendering/                    ActivityPubRenderer (Mastodon @context, actors, notes, collections)
   Domain/
@@ -95,7 +107,9 @@ PrivaPub/                         ASP.NET Core Web API, net10.0
     Privacy/                      VisibilityPolicy (IsPublic expression, CanSee)
     Relationships/                RelationshipService (blocks, mutes, account domain blocks; Hidden), ReportService
     Media/                        MediaService (libvips, ffmpeg remux, blurhash), MediaProxy, MediaJanitor
-  Domain/Statuses/                StatusService: publish, edit, remove, favourite, reblog, for a persona (both client APIs use it)
+  Domain/Statuses/                StatusService: publish, edit, remove, favourite, reblog, for a persona (both client APIs use it);
+                                  InteractionApprovals: GoToSocial's canReply/canLike/canAnnounce, judged, asked and answered;
+                                  Participations: a persona's Join and Leave of a remote event, and the organiser's answer
   Api/Mastodon/
     Auth/                         OpenIddict setup (keys in Mongo), MastodonScopes, TokenController, OAuthPruner
     Infrastructure/               MastodonController (avatar context, scopes, errors, Link), MastodonParams, MastodonJson, Page
@@ -124,6 +138,7 @@ dotnet build PrivaPub.sln -c Release
 dotnet test PrivaPub.sln                                  # unit tests; integration tests skip
 PRIVAPUB_TEST_MONGOD=1 dotnet test PrivaPub.sln           # all of them, against mongod on 127.0.0.1:27017
                                                           # (PRIVAPUB_TEST_MONGO overrides; a fresh database per run, dropped after)
+tools/ci/with-test-mongod.sh dotnet test PrivaPub.sln     # all of them, on a throwaway mongod, as CI runs them
 cd PrivaPub && ASPNETCORE_ENVIRONMENT=Development \
   Kestrel__Endpoints__Http__Url=http://127.0.0.1:6970 Kestrel__Endpoints__Http__Protocols=Http1AndHttp2 \
   AppConfiguration__BackendBaseAddress=http://127.0.0.1:6970 MongoSettings__Database=PrivaPubTest \
@@ -135,29 +150,50 @@ curl-able. Outbound fetches only go to https DNS names resolving to public addre
 `Federation__AllowPrivateNetworks=true`, `Federation__AllowPlainHttp=true` and `Federation__AcceptAnyCertificate=true`,
 which startup refuses in Production.
 
-Promoting an admin on the box (signing up as "admin" grants nothing):
+The admin CLI runs with every service built but nothing started (no Kestrel, no hosted services), so it can run next to
+the live service. Sign-up is closed in production (invitations only), so the first login is made here; promoting is how
+an admin is made (signing up as "admin" grants nothing):
 
 ```bash
-cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin promote <root>
+cd /var/www/privapub.thepra.dev
+echo '<password>' | ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin create-root <login> --admin   # password on stdin
+ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin promote|demote <root>
+ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin smoke <persona>     # the deploy's: prints "deploy-smoke <new password>"
 ```
 
+The deploy runs them as `build-runner`, which owns the published files, reads `appsettings.Production.json` through
+group www-data and reaches the private mongod; `sudo -u www-data` works too.
+
 ## Federation invariants
 
 1. **Every outbound request goes through `IFederationHttp`.** Its handler resolves the name itself and connects only
    to public addresses; redirects are followed by hand (three at most, each re-checked); bodies are capped at 1 MB;
    only JSON media types are read; a refused URL is not asked again for five minutes. Never create another
-   `HttpClient` for federation.
+   `HttpClient` for federation. The only other outbound traffic is SMTP and `GeoUpdater`'s monthly DB-IP Lite download
+   (its own `geo` client, a fixed HTTPS host, size-capped, the file checked before it is swapped in).
 2. **Every fetch is signed by the instance actor** (`privapub`), never by a persona; deliveries are signed by the acting
-   avatar or group. Both are draft-cavage rsa-sha256 over `(request-target) host date` (+ `digest` on bodies).
+   avatar or group. Both are draft-cavage rsa-sha256 over `(request-target) host date` (+ `digest` on bodies). Inbound,
+   an RFC 9421 signature (`Signature-Input`) is verified too, its target against our public address. A persona's own
+   activity going to a relay also carries a FEP-8b32 proof by its Ed25519 key (`Avatar.SigningKey`, one per persona,
+   never shared), and nothing else does: Mitra refuses a proof by a key it has not read. A forwarded activity is taken
+   as it came only when its proof verifies with a Multikey of its actor's.
 3. **A remote document is believed only from its own address.** `RemoteActorService.FetchObject` requires the
    document's `id` to be the URL it was served from (a same-origin alias is followed once). A key is accepted only if
    the actor lists it, its `owner` is the actor and it shares the actor's origin.
 4. **Inbound inboxes verify everything before acting:**
    - the signature covers `(request-target)`, `host`, `digest` and `date` or `(created)`;
    - the Digest matches the body and the date is at most an hour old and fifteen minutes ahead;
-   - the signature verifies against the key owner's key, and the activity's `actor` is the key owner;
+   - the signature verifies against the key owner's key, and the activity's `actor` is the key owner, or else it was
+     forwarded (`Forwarded`: a thread's server passing on what happens in it, as Mastodon and Friendica do). A forwarded
+     activity proves nothing about its author: answered 202, a Create or Update is taken as its object reads at the
+     actor's origin now, a Delete of a public or unlisted copy once that origin answers 404 or 410
+     (`RemoteActorService.IsGone`), anything else let go. Forwarded copies have their own dedupe key, so a copy that
+     failed never hides the author's own delivery;
+   - an activity is queued once per id, but an id that comes back carrying another type, actor or object is a second
+     activity, not a copy (Friendica's ids are `uniqid()`, which two of its processes can share), and is queued apart;
    - the activity's `id`, and any object it creates, updates or deletes, is on the actor's origin; a cross-origin
-     object is refetched from its own origin.
+     object is refetched from its own origin. One attributed to another account of the actor's server (Mobilizon's
+     organiser and the group's event) is taken as that server has it, and deleted once it answers 404 or 410.
 5. **Status codes:**
    - bad or missing signature: **401**;
    - malformed or forged body: **400**;
@@ -172,36 +208,93 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
    `ContentFormat` says what `Text` holds. Remote names are plain text.
 8. **Circles federate to members only.** A circle is an undiscoverable Group actor that takes follow requests (the owner
    approves); its posts are addressed to the circle and its `/flock`, delivered to members' personal inboxes, never
-   announced, and served only to a signed request from a member or a member's instance actor
-   (`SignedFetchAuthorizer`), 404 otherwise. Circles never appear in search, lookups, mentions or profile pages.
+   announced. Each member's copy also names that member in `cc` (`OutboxPublisher.Naming`, owner decision
+   2026-10-04), because Mastodon and GoToSocial keep a post only when it names one of their accounts; Create, every
+   Update and the Delete all go through `OutboxPublisher.Publish` for that. A reply to a circle post stays in the circle,
+   and a circle post never asks a non-member for a quote. Circles never appear in search, lookups, mentions or profile
+   pages.
+   **A post that is not public is served only to a signed request from someone it was for** (`SignedFetchAuthorizer.MayRead`):
+   a follower or an addressed account for followers-only, an addressed account for a DM, a member for a circle, or the
+   instance actor of a server where one of them lives; 404 to anyone else, 410 to them once it is deleted. A circle
+   refetch names the requesting member, or the members on the requesting server. A DM's `context`
+   (`/peasants/{name}/whispers/{id}`) lists the conversation's posts for its participants. Mastodon deletes its copy
+   when a refetch answers 404, which is why this matters.
    **Communities** are FEP-1b12 groups: `GroupDistributor` announces the whole activity (plus the object for new posts,
    for Mastodon), top-level posts are `Page`s with a `name`, posting follows `Group.PostingPolicy`.
-   Located posts (`LocalGeo`) are the only local-only posts.
+   Located posts (`LocalGeo`) are the only local-only posts. The Mastodon API looks past them everywhere, homes
+   included (the fan-out gives them no `TimelineEntry`, not even their author's): they are read through
+   `/clientapi/post/nearby` and deleted through `/clientapi/post/delete`.
 9. **A DM joins a conversation only by `DmGroup.ParticipantsKey`**, the exact set of its participants; a remote
    `context` decides nothing. DMs are `Post`s with `Visibility = Direct` and a `ConversationId` (`DmPost` is legacy).
+   `DmGroup.LastPostId` pages `/api/v1/conversations`, and `ConversationState` keeps each persona's read and removed
+   marks (`Domain/Statuses/ConversationStates.cs`; writing in a conversation reads it).
 10. **Nothing slow happens inside a request.** Deliveries and inbox processing are `Job`s (`Infrastructure/Jobs`):
     leased, retried on Mastodon's curve, at most two per host, paused per host by `RemoteInstance`. The inbox answers
-    202 once it has verified and queued; a handler must be idempotent (unique `ObjectURI`, job `DedupeKey`).
-11. **Every "may anyone see this" goes through `VisibilityPolicy.IsPublic`;** a persona-specific read uses `CanSee`.
-12. **Remote content is stored only when someone here asked for it:** a persona follows the author, is addressed or
+    202 once it has verified and queued; a handler must be idempotent (unique `ObjectURI`, job `DedupeKey`). A lease
+    (2 minutes, stamped with its own owner) is renewed every third of its length while the handler runs, so a long job
+    runs once; a lease found taken cancels the handler, and `Finish` only counts for the lease it was given.
+11. **Every number about posts and users goes through `Domain/Privacy/Counted`** (owner decision 2026-10-04: one
+    answer everywhere): a persona's `statuses_count`, its outbox `totalItems`, NodeInfo `localPosts` and the instance
+    `status_count` all count Mastodon's way (not deleted, not a DM, boosts included, circle and located posts too);
+    users exclude personas of banned or deleted roots; `replies_count` counts only public and unlisted replies; a
+    remote account that deletes itself takes its likes, votes, reactions, boosts and replies out of every count
+    (`GoneActors`). Follower and following counts are public, their members never are (`hide_collections` is always
+    true).
+12. **Every "may anyone see this" goes through `VisibilityPolicy.IsPublic`;** a persona-specific read uses `CanSee`, and
+    any other read of stored posts filters by `IsShown`. All three hide deleted posts and the posts of a remote account
+    that deleted itself (`Post.AuthorGone`: kept, hidden everywhere, owner decision).
+13. **Remote content is stored only when someone here asked for it:** a persona follows the author, is addressed or
     mentioned, it replies to a local post, or it is addressed to a community the author follows; a public parent is
     fetched as context. Followers-only is detected by the author's stored `followers` URL.
-13. **Home timelines are written, not computed:** every stored or created post goes through `Fanout.Distribute`, and
+14. **Home timelines are written, not computed:** every stored or created post goes through `Fanout.Distribute`, and
     every delete removes its `TimelineEntry` rows. Local deletes are soft (content cleared, 410 Tombstone).
+15. **What PrivaPub passes on is exactly what it received** (owner decision 2026-10-05). A public or unlisted reply from
+    another server to a persona's public, unlisted or followers-only post, and its Update and Delete, go to the
+    persona's followers as the activity arrived (`Arrival.Raw`, `Federation/Inbox/ReplyRelay.cs`), signed by the
+    persona for the transport only: never to the replier's own server, never for a local-only or group post. Only an
+    activity its own actor delivered carries `Raw`, so a forwarded one is never passed on again.
+16. **An `Accept` or `Reject` is routed by what it answers:** our Follow (`FollowService`, any `-again-N` resend), an
+    interaction request (`InteractionApprovals`, with the author's authorization read back from its origin) or a
+    persona's `Join` (`Participations`, by its `/grunts/join-<id>` id), each only from the origin of what it answers.
+17. **A server's software is for display, with two exceptions** (owner decisions 2026-10-05 and 2026-10-06): a direct
+    message to one account on a server whose NodeInfo names Lemmy before 1.0 or Mbin goes as a `ChatMessage`
+    (`StatusService.TakesOnlyChatMessages`), as one to an account that writes to us that way does; and a report of a
+    post in a community on a server whose NodeInfo is in `ReportService.ServiceReportTakers` leaves in Lemmy's shape,
+    from the reporter, one `Flag` per post. A server joins that set only once the pasture shows it keeps such a report
+    with its reason. Nothing else may branch on `RemoteInstance.Software`.
 
 ## Mastodon client API invariants
 
 1. **A token is one persona.** Its subject is the avatar id; the root id lives only in the fifteen-minute `/oauth`
    cookie used while choosing the persona, and never in a token, an authorization or a response.
+   - **The first-party client exchanges the root JWT for one persona's token** (RFC 8693 on `/oauth/token`,
+     `subject_token_type` `urn:ietf:params:oauth:token-type:jwt`, `avatar_id`; `Api/Mastodon/Auth/PersonaExchange.cs`).
+     Only the seeded public application (`ClientApi:FirstPartyClientId`, default `decepub`) holds the grant.
+     `RootJwtSubjectToken` validates the JWT through `RootJwt`, the same rules as JwtBearer (signature, lifetime, ban,
+     deletion, session stamp). The issued token is the same kind as the authorization code flow's, so revocation and
+     `RootSessions` cover it.
 2. `/api/*` authenticates with OpenIddict validation, everything else with the old JWT (`PrivaPub` policy scheme).
    Every `/api` request re-checks that the persona's root is neither banned nor deleted (`MastodonController`).
 3. Read parameters through `Params` (query, form and JSON merged Rails-style), never MVC binding. A value type read
    from a conditional must say `(int?)null`, not `default`: that bug once made every list one item long.
 4. Answer with `Json(...)` (snake_case, explicit nulls) or `Error(status, message)`; page lists with `Page` and `Link`.
-5. Unsupported features answer empty lists or 422 with a message, never 404 or 500, so clients degrade.
-6. Advertise `4.2.0 (compatible; PrivaPub)` until grouped notifications exist.
+5. Unsupported features answer empty lists or 422 with a message, never 404 or 500, so clients degrade. Any `/api`
+   error that leaves without a body (a challenge, a 404 from routing, a 429) gets Mastodon's `{"error": ...}` from
+   `UseMastodonErrorBodies`. `NeverFiveHundredTests` walks every route with junk ids, anonymously, as a persona and
+   with a junk token.
+6. Advertise `4.2.0 (compatible; PrivaPub)` until streaming and Web Push exist too; `api_versions.mastodon = 7` stays,
+   because clients show quotes from it, so everything a 4.3+ client calls because of it must answer: grouped
+   notifications (`/api/v2/notifications`, its unread count, groups, accounts and dismiss) and the notification policy.
+   The policy is real (`Domain/Social/NotificationPolicies.cs`, applied in `Notifications.Add`): accepted by default,
+   it filters (into a `NotificationRequest` per account, out of every list and count unless `include_filtered`) or drops
+   what strangers, accounts that do not follow the persona (or only for three days), accounts newer than 30 days,
+   unasked private mentions and silenced accounts send; accepting a request lets that account in for good
+   (`NotificationPermission`).
 7. **What a Mastodon `Status` cannot say goes in `Status.privapub`** (`PrivaPubStatus`): object type, title, excerpt,
-   cover, the author's source, link, video, audio and event details, and up/down votes. Every media URL in it goes
+   cover, the author's source, link, video, audio and event details, a remote post's own place (Pixelfed's `location`,
+   never federated again), up/down votes and the viewer's own downvote (`votes.downvoted`, set through PrivaPub's
+   `POST /api/v1/statuses/:id/downvote` and `/undownvote`; a favourite is the upvote), and its community's flairs
+   (`ObjectShapes.Flairs`, both dialects). Every media URL in it goes
    through the proxy; only page links (`link.url`, an event's online link) point at the remote site, because following
    one is the reader's choice.
 
@@ -209,18 +302,72 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
 
 1. **No upload keeps its metadata.** Images are re-encoded by libvips with `keep=none`; audio and video are remuxed with
    `-map_metadata -1`. `MediaProcessingTests` checks EXIF and XMP are gone.
-2. Files live under `Media:Root` (`/var/lib/privapub/media`), never in the published directory; the proxy cache is the
-   sibling `media-proxy`, which `/media/files` does not serve.
-3. **A client never contacts a remote server for media:** every remote URL the API returns goes through
+2. **An image is checked before it is decoded.**
+   - **Loaders:** only libvips' JPEG, PNG, GIF, WebP and HEIF loaders ever run on an upload (`MediaService`'s static
+     constructor blocks every other loader), so an SVG, PDF or TIFF claiming another type never loads.
+   - **Size:** the header alone tells width × height (× frames for a GIF), refused above `Media:MaxPixels` (40 MP) or
+     `Media:MaxFrames`.
+   - **Then:** the image is shrunk on load to `MaxImageSide`, turned by its orientation, and its colours brought into
+     sRGB (`thumbnail`).
+   - **GIFs:** an animated GIF becomes a looping silent H.264 mp4 typed `gifv`, as on Mastodon (ffmpeg with libx264;
+     `PostMedia.Kind` says so), and a still GIF is an image.
+   - **Types:** HEIC and HEIF are not accepted, since the bundled libvips has no HEVC decoder.
+   - **Load:** processing runs `Media:Concurrency` at a time, and uploads have their own rate limit (`uploads`, per
+     credential).
+3. **Audio and video are processed off the request when the client allows it.**
+   - **v2:** `POST /api/v2/media` stores them as sent in `media-incoming` (beside the root, never served) and answers
+     202 with no url, while a `ProcessMedia` job (one at a time, its lease renewed) does the work. Until then
+     `GET /api/v1/media/:id` answers 206, and 422 with the reason if it failed. Media still processing can't be posted.
+   - **v1:** processes before answering.
+   - **ffmpeg** reads only the stored file: `-protocol_whitelist file`, and the input format is forced from the probe.
+     Data and subtitle tracks are dropped (`-dn -sn`, which iPhone MOVs need).
+   - **Remux or transcode:** a video browsers play as it is (H.264, VP8, VP9 or AV1, within `Media:MaxVideoPixels` and
+     `MaxFrameRate`) is remuxed; anything else is transcoded to H.264 that fits, as Mastodon does.
+   - **Limits:** longer than `Media:MaxSeconds` is refused.
+   - **Saving:** nothing is saved until everything succeeded; outputs move into place rather than being read into
+     memory, and every temporary file goes. FLAC is served as `audio/flac`, and the unit runs with `PrivateTmp`.
+4. Files live under `Media:Root` (`/var/lib/privapub/media`), never in the published directory; the proxy cache is the
+   sibling `media-proxy` and the trash the sibling `media-trash`, neither of which `/media/files` serves.
+5. **A file lives exactly as long as something holds it.** Every upload is a `MediaAttachment` row, profile pictures
+   too (`Kind` avatar or header, `ProfileOfAvatarId`). Deleting a post, an edit leaving media out, a replaced picture,
+   a dropped scheduled post, a removed root, and an upload never posted for a day each trash theirs
+   (`IMediaService.Trash`):
+   - the row gets `TrashedAt` in one conditional update, so a row attached meanwhile is left alone;
+   - its files move into `media-trash` at once, so `/media/files` stops serving them;
+   - `MediaJanitor` deletes them a day later (`TrashGrace`).
+
+   What a login's media take (every persona's, trashed ones no longer) is `Counted.MediaOfRoot`, shown to the login at
+   `/clientapi/user/storage`; `Media:QuotaBytesPerRoot` (0, none, by default) refuses an upload over it with 422; the
+   administrator's statistics overview has the totals, the proxy cache and the trash.
+
+   Nothing is deleted because it looks unused. `PrivaPub admin media audit [--fix]` compares disk and database: with
+   `--fix` (as www-data) it gives pictures shown from before their rows a row, and trashes media of deleted posts or
+   personas, rows whose files are missing, and files nothing holds.
+6. **A client never contacts a remote server for media:** every remote URL the API returns goes through
    `IMediaProxy.Wrap`, an HMAC-signed `/media/proxy/` URL fetched by `IFederationHttp.GetMedia`.
-4. **The proxy serves three ways:**
-   - **Cached:** a file already cached is served from disk, ranges included.
-   - **Downloaded:** a request without a `Range` is downloaded whole, up to `Media:MaxProxiedBytes`, then cached.
+7. **The proxy serves three ways:**
+   - **Cached:** a file already cached is served from disk, ranges included. It is opened before the answer, so a trim
+     that deletes it meanwhile breaks nothing.
+   - **Downloaded:** a request without a `Range` is downloaded whole, up to `Media:MaxProxiedBytes`, then cached:
+     - once for everyone asking for it at the same time;
+     - streamed into a `.part` file beside its place and renamed there, never held in memory;
+     - with its host in its `.type` sidecar, so that blocking a server can purge it.
    - **Streamed:** a ranged request, or anything too big to cache, is streamed from the origin with the range passed on,
-     and never cached. That is how remote video plays.
+     and never cached. That is how remote video plays. A file found too big is remembered for an hour, so it isn't
+     fetched twice; one that failed is remembered for five minutes.
+
+   Also:
+   - The cache's size is counted as it grows and trimmed as soon as it passes `ProxyCacheBytes`; the janitor
+     recounts hourly.
+   - Browsers may cache only a success.
+   - Nothing of a suspended server, or of one whose media are rejected, is proxied (avatars, emoji, covers and link
+     cards included, since they all go through it), and blocking one purges its cache.
+   - The `proxy` rate limit counts per client address.
 
    nginx has a `/media/proxy/` location with `proxy_buffering off` and a 600 s read timeout for those streams.
-5. **Remote video and audio become one playable attachment** in the Mastodon API (`MastodonMapper.Playable`): the best MP4
+8. **A focal point is two finite numbers** within -1..1 (`FocalPoint.Parse`); anything else is ignored. A stored NaN made
+   every status, timeline and Note holding its post fail to serialise; migration `_016` removed the ones stored before.
+9. **Remote video and audio become one playable attachment** in the Mastodon API (`MastodonMapper.Playable`): the best MP4
    up to 720p that carries both sound and picture, including PeerTube's fragmented files inside an HLS entry. HLS
    playlists themselves are not rewritten.
 
@@ -228,6 +375,16 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
 
 - **No root id in federation output, NodeInfo or logs, no IP next to an identity in logs, and no `ex.Message` to a
   client** ("Something went wrong." instead).
+- **Sign-in and recovery never tell which logins or addresses exist** (owner decision 2026-10-04): every failed sign-in
+  gets "That username and password do not match." after the same hashing (`RootUsersService.Decoy`, a constant-time
+  comparison), and only a correct password learns of a ban. Every recovery request answers the same sentence and
+  queues a `SendRecovery` job, found or not; `RecoveryJob` sends the email and keeps only a SHA-256 of the code, for an
+  hour. A recovered password ends every session of the root (`RootSessions`: a new `SessionStamp`, which every `/clientapi`
+  JWT carries, and OpenIddict revocation for each persona).
+- **Deleting a root deletes everything public it had** (`RootRemoval`, from the admin route or `/clientapi/user/delete`
+  with the password): its sessions end, each persona and each group it owns sends `Delete{Actor}` to followers, members
+  and the accounts it follows, the personas' posts are emptied, and `/peasants/{name}`, its inbox and WebFinger answer
+  410 (`LocalActorService.Gone`) while the names stay reserved. The root keeps only a `deleted-{id}` name.
 - **Never derive a public name from the root username.** Invitation sign-up takes `AvatarUserName` and refuses one
   equal to the login.
 - **One username space:** personas, groups and the instance reserve their name in `ReservedName` (unique index) before
@@ -239,11 +396,23 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
   see ids. Never emit `CreatedAt`.
 - **Per-avatar state stays per avatar:** blocks, mutes, notifications, follows. Nothing may relate sibling avatars.
 - **Blocks federate** (owner decision, 2026-10-01): a block is sent as `Block` from the blocking avatar, an unblock as
-  `Undo{Block}`. Reports still leave as `Flag` from the instance actor, never from the reporting avatar.
+  `Undo{Block}`. Reports still leave as `Flag` from the server's own actors (the instance actor, or the reporter for
+  communities on Lemmy, PieFed and Mbin), never from the reporting avatar.
 - **What PrivaPub reveals is the owner's call.** Previews, blocks, website authorship, views, bridging and reactions were
   decided in `docs/ROADMAP.md` ("Owner decisions on what PrivaPub reveals"). Anything new that tells another server
   something about an avatar gets the same treatment: ask, then record it there.
 - **Location-ranged posts never federate.**
+- **Statistics name servers, never people** (owner decisions on statistics, 2026-10-03). Every interaction is recorded
+  through `IInteractionLedger` (`Infrastructure/Statistics`) as an `InteractionEvent` (90 days), but an event never
+  holds a root, persona or group id, an activity id, an inbox URL, a remote actor URI or a sender IP:
+  - Distinct remote accounts are counted with `ActorHash`, an HMAC keyed by that day's `InteractionSalt`, which the
+    day's rollup deletes.
+  - `LocalKind` survives `Interactions.Sanitize` only on public and unlisted traffic, so a circle can show neither by
+    presence nor by absence, and no reason code names one.
+  - Traffic a reader causes (the media proxy, lookups, the client API, fetches of our own documents) is only counted
+    per day (`Count`, `CountServer`), never logged per event.
+  - A host claimed by an unverified sender is kept only if it is already a `RemoteInstance`.
+  - `Record` never blocks and never throws: it writes to a bounded channel, and a full channel drops and counts.
 
 ## Data
 
@@ -257,18 +426,34 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
   activity, inbox, key and signed headers; received time; up to 10 later revisions). Write it right after the post's
   save: `CreateHandler` (delivered) and `RemotePosts.StoreContext` (fetched) do, and `UpdateHandler` appends a
   revision. Delivery details reach them through `Arrival.Current`, which `InboxProcessor` sets for the handler's
-  duration. The raw form lives outside `Post` so timelines never load it. Read through
-  `/api/privapub/v1/statuses/:id/provenance` and `/api/privapub/v1/instances/:host`.
+  duration. A fetched record has no signature, key or `@context` of the activity that caused the fetch (its activity
+  fields name that trigger), and every record stores its `Extensions` and `ContextNamespaces` for statistics. The raw form lives outside `Post` so timelines never load it. Read through
+  `/api/privapub/v1/statuses/:id/provenance` and `/api/privapub/v1/instances/:host` (or `?host[]=`, up to 40; this
+  server answers too).
+- **A server's place leaves only through `PublicGeo.Project`:** the city, coordinates (0.1°) and network it was located
+  to, whatever its size (there is no user threshold), and only the CDN's name for a CDN-fronted one. This server's own
+  place is its host's address located once a day (`SelfLocation`), or `Statistics:Geo:Self` when the owner sets it.
+- **CDNs are found three ways, best first** (`Infrastructure/Geo/CdnCatalog.cs`): the ranges a CDN publishes
+  (`CdnUpdater` downloads them daily into `CdnRangeSet`, keeping the old set when a download or parse fails), the CDN's
+  fingerprint in the responses PrivaPub already gets (`EdgeHintsHandler` on the federation client, memory only), and
+  a network that carries nothing but a CDN. Never list an ASN shared with plain hosting (AWS, Google, Microsoft,
+  DataPacket). A server's `Geo` records the CDN, its domain and how it was found.
+- **Servers through time** (`Domain/Statistics/ServerPlaces.cs`, from the weekly `RemoteInstanceSnapshot`s):
+  `/api/privapub/v1/instances/:host/history`, a CDN-fronted server's `geo.before_cdn`, and the CDNs grouped by their
+  own domain (`/api/privapub/v1/cdns`, `/cdns/:domain` with weekly joined/left).
 - **Remote objects are parsed for every shape in `ObjectShapes`:** `url`/`icon`/`image` as a value, an object or an
   array; Markdown `content`; missing `mediaType`s inferred; thumbnails from any of their five places; and the typed
   `Link`, `Video`, `Audio` and `Event` details. A Mastodon API card is built from those, never by fetching the linked page
   (that fetch is the owner's decision 1, for P6).
-- **An `Update` is an edit only when its `updated` is newer than ours** (`UpdateHandler.IsEdit`). Otherwise it refreshes
+- **An `Update` is an edit only when its `updated` is newer than ours**, or for a first edit no older and with the text
+  actually changed, since GoToSocial's whole-second timestamps make a quick edit carry `updated == published` (`RemoteEdits.IsEdit`; plain and community-wrapped
+  Updates both go through `RemoteEdits.Apply`, and deletes through `RemoteDeletes.Remove`). Otherwise it refreshes
   the poll, video, audio and event details and nothing else, and leaves no revision: Mastodon and Misskey refresh poll
   counts with bare Updates.
 - **A poll vote is a `Note` with a `name`, an `inReplyTo` that is a poll we hold, and no content.** `CreateHandler`
   hands it to `PollService.Receive` before anything else, so it never becomes a reply. Our votes on other servers' polls
-  go only to the poll's author, without `published` (PieFed counts a vote only then).
+  go only to the poll's author, without `published` (PieFed counts a vote only then). A `closed` in the future is the
+  poll's end, not its closing: Akkoma sends an open poll's end only there (`ObjectShapes`).
 - **Link previews follow owner decision 1** (`Domain/Content/LinkPreviews.cs`): only public posts, queued on arrival with
   0–60 s of jitter, one cached `LinkPreview` per address for the whole server, never fetched when someone reads.
   `LinkPreviews.Wanted` is called where posts are saved (`CreateHandler`, `StoreContext`, `StatusService.Publish`).
@@ -285,7 +470,8 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
   same rule writes `canQuote`, answers `QuoteRequest`s (`QuoteService.ReceiveRequest`) and fills `quote_approval`, so they
   cannot disagree. A persona quoting another persona gets a parrot-licence too, so other servers see an approved quote.
 - **A server is described on arrival, never on read.** The first record from a host enqueues `DescribeInstance` (its
-  NodeInfo, at most once a week, into `RemoteInstance`), so opening the details view tells nobody anything.
+  NodeInfo, at most once a week, into `RemoteInstance`), so opening the details view tells nobody anything. A
+  description that failed frees its week, so the server's next arrival (an hour on at the soonest) asks again.
 - **Post ids are the timeline order, so they follow arrival, not `published`.** `PrivacyIds.Arrived` gives a remote post
   published within the last hour (or in the future) a fresh `ObjectId`, which sorts after every post already stored,
   and only backfill keeps a `published`-derived id. With `published` ids a reply arriving in the same second could sort
@@ -300,7 +486,89 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
   `_NNN_` order, each runs once), then `Indexes.Create()`. A new entity needs nothing; a new unique index needs a
   dedupe migration before it.
 - Production runs its **own mongod** on 127.0.0.1:27022 (unit `privapub-mongod`, no auth, data in
-  `/var/lib/privapub/mongo`). The box's shared mongod needs credentials nobody here has.
+  `/var/lib/privapub/mongo`). The box's shared mongod needs credentials nobody here has. It is a one-member replica set
+  (`--replSet rs0`, a 990 MB oplog; owner decision 2026-10-07), so a backup reads every collection at one instant;
+  `setup.sh` converts it once (PrivaPub stopped, mongod restarted, `rs.initiate`), and every connection string says
+  `directConnection=true`, which also works against a standalone. The pasture's mongo is one too.
+- **Backups** (`Infrastructure/Backup/`; owner decisions 2026-10-07: the whole server, plain files protected by their
+  permissions, run from the CLI, nightly and from the administrator's page). Each backup is a directory
+  `<yyyyMMdd-HHmmss>-<kind>` under `Backups:Root` (`/var/lib/privapub/backups`, www-data 2770, files 0640), written as
+  `.partial` and renamed once whole:
+  - `manifest.json` (`ArchiveManifest`): host, build, newest migration, whether it was read at one instant, each
+    collection's count, size, sha256 and indexes, what was left out and why, and the media list;
+  - `db/<collection>.jsonl.gz`: each document as one line of canonical Extended JSON, read raw, so every BSON type comes
+    back byte for byte; on a replica set every collection is read in one snapshot session
+    (`minSnapshotHistoryWindowInSeconds` is raised to an hour only while it reads);
+  - `media/`: hard links to the files of untrashed `MediaAttachment` rows (no disk spent; a deleted file stays until the
+    backup rotates out), copies where a link can't be made. `--db-only` lists them instead.
+
+  **Never in a backup** (`ServerBackup.Excluded`): `InteractionSalt` (owner rule), `Job` and `Delivery` (work in flight),
+  `EmailRecovery`, `openiddict.tokens` and `.authorizations` (sessions), `MaintenanceLock`, and `AppConfiguration`
+  (its SMTP password; it is made again from appsettings at boot). One backup or restore runs at a time
+  (`MaintenanceLock`, a heartbeat document; a holder silent for 2 minutes is taken over), and the media janitor purges
+  nothing meanwhile. `BackupScheduler` backs up at `Backups:NightlyAt` (03:30 UTC), or at once when it missed the night;
+  rotation keeps 7 daily and 4 weekly nightly backups, 3 pre-deploy, 3 pre-restore, and manual and uploaded ones until
+  deleted. CLI: `PrivaPub admin backup [--kind manual|pre-deploy] [--db-only]`, `admin backups`, `admin backup verify
+  <id>`; these run before migrations, so the deploy's backup is of the database as the live build left it.
+- **Restores** (`ServerRestore`, `ProtectiveMerge`; owner decision 2026-10-07). Asking (`PrivaPub admin restore <id>`, or
+  the administrator's page) checks the backup (same host, a format and newest migration this build reads, every hash)
+  and writes `restore.json` in the backups' root; the running service sees it within seconds (`RestoreWatcher`) and
+  stops, and systemd starts it again. `MaintenanceGate` (in `Program`, right after the build, before migrations, indexes
+  and hosted services) carries it out:
+  1. a pre-restore backup P, taken once (a retry reuses it, never a half-restored database);
+  2. every collection the backup holds dropped and imported raw with its indexes, every other one dropped, except what a
+     backup never holds, which stays as it is;
+  3. media files the live directory lacks linked back from the backup (or moved from the trash); a restore deletes no file;
+  4. **the protective merge from P: a restore never undoes a protective act.** Followers and follows are P's; blocks,
+     mutes, domain blocks, being blocked, reserved names, `DeletedObject`, reports, filters and OAuth applications are
+     the union, P's row winning; roots, personas, groups, posts and remote accounts deleted since are deleted again, with
+     what their deletion takes away; P's moderation of a persona and a root's password, e-mail, ban and policies stay;
+     roots, personas and groups made since become tombstones (deleted, names kept), local posts made since answer 410,
+     media made or trashed since go to the trash;
+  5. every session ends (a new `SessionStamp` for each root, persona tokens deleted), circuits close, and a
+     `RestoreRecord` (never in a backup) tells what happened (`admin restore --status`).
+
+  Each attempt redoes everything. Refused before anything changed, it is abandoned and recorded, and the server boots as
+  it was; failed midway, the process exits 1 and the next start tries again; after 3 failures it exits 75, which the
+  unit's `RestartPreventExitStatus` leaves down for someone to look. While `restore.json` exists, commands exit 75 (but
+  `admin restore --status`) and the deploy refuses to run. For `RestoreRecord.FollowersGrace` (14 days) after a restore,
+  FEP-8fcf rests: no `Collection-Synchronization` header goes out, and a follow only the remote remembers is adopted,
+  not undone.
+- **The administrator's page** (`BackupController`, `/clientapi/admin/backups`; owner decision 2026-10-07, which approved
+  these endpoints in production): the list (with what runs, the restore waiting, the last restore's report, logins
+  deleted since each backup), back up now (202; the page polls), delete, and:
+  - **download** for the password: a ticket good for ten minutes in the link's path (`/download/{ticket}`, anonymous, so a
+    browser saves it to disk), the backup as one tar (`BackupTar`: its exact length known first, written from the
+    files, `Range` honoured);
+  - **upload** in pieces of at most 32 MB (`TransferStore`): each `PUT ?offset=` must start where the upload stands, else
+    409 with what was received, so a broken upload resumes; `finish` reads it into a backup (`kind` uploaded), refusing
+    anything but plain files under one backup's folder, a path leaving it, or more than the disk holds;
+  - **restore** for the password and the server's host typed out.
+
+  Every call checks the administrator against the database, not only the token. nginx streams downloads for an hour and
+  takes upload pieces unbuffered (`deploy/nginx`, applied by `setup.sh`).
+- **A persona's archive** (`Domain/Portability/`, `PersonaArchiveController` at `/clientapi/persona/{avatarId}/archive`;
+  owner decision 2026-10-07), for the persona's own root only, never a banned one. State per persona in `PersonaArchive`
+  (never in a backup), files in `<backups>/.personas/<avatarId>/`, a week.
+  - **Export** (`ExportArchiveJob`): Mastodon's account-archive layout, so other servers' importers read it: `actor.json`
+    (its public key only), `outbox.json` (its own posts as Creates, addressed as delivered, but circles' and located
+    posts; its boosts as Announces), `media_attachments/files/` (what the attachments' urls name), avatar and header,
+    `likes.json`, `bookmarks.json` and Mastodon's CSV files; then `privapub/`: filters, followed hashtags, the
+    notification policy, pins, scheduled and located posts, `archive.json`. Nothing of its root, its siblings, its keys,
+    anyone's token. Downloaded through a ten-minute ticket in the link's path.
+  - **Import** (`ImportArchiveJob`, the parts the root picks, with progress, stoppable): uploaded in pieces like a backup,
+    read through `SafeArchive`, which refuses links, paths leaving it, names twice, too many or too large files, a file
+    compressed over 100:1, and streams the outbox an item at a time (none over 1 MB). Only the archive actor's own
+    Creates become posts; boosts, direct and circle posts are counted. **Imported posts are delivered to no one**, put in
+    no home and notify nobody (an exception next to located posts), yet show on the profile, the outbox, hashtags and
+    search. Back home (same actor) a post keeps its id and address, and one already here, even deleted, or tombstoned,
+    stays as it is; from another actor it gets an id of its date, its address here and `ImportedFromURI` (unique per
+    persona), so importing twice changes nothing. Replies and self-quotes inside the archive point at their copies; polls
+    come closed without votes; mentions stay links; HTML is sanitized; media go through `MediaService` and the quota.
+    The other parts go through the existing services: follows asked again (never on a blocked server), blocks, mutes,
+    blocked servers, lists (members only if followed), bookmarks (by signed fetch), filters, followed hashtags, the
+    notification policy, pins (no `Add` delivered), the profile (announced as Settings would). Located and scheduled
+    posts (PrivaPub's archives) and likes (each tells its author) only when asked. Followers are never imported.
 
 ## Code style
 
@@ -316,18 +584,39 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
   stored as an edit date on every remote post. Write `(T?)null`. It has shipped four times (`MastodonParams.Bool/Int`,
   `NoteParser.Int`, `NoteParser.Time`).
 - ActivityPub output is built with `System.Text.Json.Nodes` in `ActivityPubRenderer`, not typed models. Inbound
-  documents are read through `InboxService.Id`/`Value`, which handle string, object and array.
+  documents are read through `ActivityJson.Id`/`Value`, which handle string, object and array.
 - Libraries chosen for the roadmap: HtmlSanitizer, Markdig (`DisableHtml`), NSign (RFC 9421 inbound), OpenIddict +
   OpenIddict.MongoDb, NetVips, Blurhash.Core, FFMpegCore. No ImageSharp (licence key enforced), no MassTransit.
 
 ## Testing
 
 `PrivaPub.Tests` (xUnit v3). Unit tests need nothing; tests marked `Category=Integration` need a mongod and skip
-without `PRIVAPUB_TEST_MONGOD=1`. CI runs the unit tests only (the box's mongods are production).
+without `PRIVAPUB_TEST_MONGOD=1`. CI (`build.yml` and `deploy.yml`) runs all of them through
+`tools/ci/with-test-mongod.sh`, which starts a throwaway mongod on a random localhost port and deletes it afterwards.
+Like production's, it is a one-member replica set (`rs0`, reached with `directConnection=true`), so backups' snapshot
+reads are what the tests exercise (`TopologyTests`).
+The box's own mongods are production, so `MongoFixture` refuses port 27022, a data directory under `/var/lib/privapub`,
+and in CI anything but the wrapper's mongod. With `PRIVAPUB_TEST_REQUIRE_MONGOD=1`, which the wrapper sets, a missing
+mongod fails the run instead of silently skipping half the tests.
 
 - `Support/Peer` is an in-process HTTP server answering on two origins (`127.0.0.1` and `localhost`), so origin rules
   can be tested; `Support/RemoteActor` signs real deliveries with its own key.
-- Inbox scenarios go through `InboxService.Receive` with a signed request, not through the private handlers.
+- Inbox scenarios go through `InboxReceiver.Receive` with a signed request, not through the private handlers.
+- `Support/Host/PrivaPubHost` is the whole server under test (`WebApplicationFactory<Program>`, environment `Testing`,
+  configured only through `UseSetting`, on the fixture's database). `PrivaPubHost.Shared()` boots it once per run;
+  `SecureModeHost` is the same with `Federation:SecureMode`. Background workers are removed, so a test runs the jobs it
+  queued with `host.Run(j => ...)` or `host.RunInbox(activityId)`. `Accounts` signs a root up, adds personas, and gets a
+  Mastodon token through the real `/oauth` code flow; `RemoteActor.SignedPost`/`SignedGet` sign `HttpRequestMessage`s
+  for the real `/peasants` routes. Each client gets its own `X-Test-Client` address, so rate limits don't collide.
+- All test classes share one database and run in parallel, so a test touches only rows it made:
+  - random names and GUIDs;
+  - `Harness.Outgoing` sees only deliveries queued since that harness started, because Peer ports are reused;
+  - a worker gets a scoped `new JobQueue(j => ...)` so it never leases another test's jobs;
+  - domain blocks are set with `DomainBlocks.Load`, never written to the database.
+
+  A test that must change something database-wide (drop indexes, run a migration over every post, let deliveries to
+  `localhost` fail and trip its breaker) goes in `[Xunit.Collection(nameof(Exclusive))]`, which runs alone, and
+  cleans up after itself. Pure logic belongs in an unconditional unit test, not in a Mongo-gated class.
 
 Beyond the tests, verify by building, running locally, and exercising:
 - the client API (sign up, create an avatar, a group, a post);
@@ -336,33 +625,299 @@ Beyond the tests, verify by building, running locally, and exercising:
 Interop is checked against real servers, starting with the workstation's own pasture:
 
 ```bash
-DOTNET=~/.dotnet/dotnet tools/pasture/run.sh up   # podman: PrivaPub + the latest GoToSocial + Mongo, behind Caddy
-tools/pasture/interop.sh                          # 25 checks, each side driven through its own Mastodon API
-tools/pasture/run.sh down
+DOTNET=~/.dotnet/dotnet tools/pasture/run.sh up [gts mastodon ...]   # podman: PrivaPub + the named peers (default gts) + Mongo, behind Caddy
+tools/pasture/interop.sh [gts mastodon ...]                          # each peer's scenario, then what PrivaPub's statistics saw of it
+tools/pasture/run.sh down                                            # removes every pasture container and volume
 ```
 
-- **Two sites on one podman network, one Caddy in front.** `privapub.test` and `gts.test` are network aliases of the
-  Caddy container, which serves both with its internal CA (`tls internal`). Both servers are told to accept any
-  certificate: PrivaPub through `appsettings.Pasture.json`, GoToSocial through `GTS_HTTP_CLIENT_TLS_INSECURE_SKIP_VERIFY`.
-  GoToSocial WebFingers and fetches over https only, so plain http between them is not an option.
-- From the workstation, PrivaPub's API is `http://127.0.0.1:6971`. GoToSocial is reached as `https://gts.test:6443`
-  with `curl -k --resolve gts.test:6443:127.0.0.1`, because its sign-in cookie is bound to the host name.
-- **GoToSocial's cached home timeline can stop taking new posts after its first read**, its owner's own included, while
-  a `min_id` query shows them all. So a delivery is checked by looking the object up by URI with `resolve=false`
-  (`on_gts`), which answers from GoToSocial's database and never fetches from us. A home-timeline check there proves
-  nothing, in either direction. A deleted status still turns up in that search as a "deleted status" stub, so a delete
-  is checked as a 404 on `/api/v1/statuses/{id}`.
-- **GoToSocial creates its accounts locked**, so `interop.sh` approves alice's request through
-  `/api/v1/follow_requests`. That also checks our pending (`requested`) state and the manual Accept.
-- The scenario covers:
-  - discovery and follows both ways;
-  - posts and CW;
-  - a reply and its notification;
-  - likes and boosts both ways;
-  - DMs both ways, and the DM staying off public timelines;
-  - edit, delete both ways, and unfollow.
+- **A change to what PrivaPub sends** (the `@context`, an actor's properties, an activity's shape, a delivery's headers)
+  is run against every peer's scenario before it is committed, not only the peers it was written for. One reader
+  stricter than the rest fails on it alone: the 2026-10-06 `proof` term passed every peer but Smithereen, whose JSON-LD
+  1.0 reader refused every document carrying it.
+- **Layout:** `lib/pasture.sh` (network, Caddy, Mongo, PrivaPub), `peers/<name>.sh` (`<name>_up`, plus `peers/shared.sh`
+  for the Postgres and Redis several peers share), `lib/interop.sh` (`ok`, `ko`, `xf` for a check expected to fail until
+  a later phase, `privapub_token <persona>`, `stats_check <host> <software>`), `scenarios/<name>.sh`. Each peer talks to
+  its own PrivaPub persona under one root, so OAuth's persona choice is exercised too. Images are pinned.
+- Caddy's CA lives in the `pasture-caddy-data` volume and is copied to `tools/pasture/.ca/root.crt` (and `bundle.pem`
+  with the system roots) for peers that must trust it instead of skipping verification.
+
+- **All sites on one podman network, one Caddy in front.** `privapub.test`, `gts.test`, `mastodon.test` and the other
+  peers are network aliases of the Caddy container, which serves them all with its internal CA (`tls internal`).
+  PrivaPub accepts any certificate (`appsettings.Pasture.json`) and GoToSocial is told to skip verification
+  (`GTS_HTTP_CLIENT_TLS_INSECURE_SKIP_VERIFY`); Mastodon trusts the copied CA through `SSL_CERT_FILE`. Peers fetch over
+  https only, so plain http between them is not an option.
+- From the workstation, PrivaPub's API is `http://127.0.0.1:6971`. A peer is reached as `https://<name>.test:6443` with
+  `curl -k --resolve <name>.test:6443:127.0.0.1`, because sign-in cookies are bound to the host name.
+- **GoToSocial (0.22.1):**
+  - Its cached home timeline can stop taking new posts after its first read, its owner's own included, while a
+    `min_id` query shows them all. So a delivery is checked by looking the object up by URI with `resolve=false`
+    (`on_gts`), which answers from GoToSocial's database and never fetches from us. A home-timeline check there proves
+    nothing, in either direction. A deleted status still turns up in that search as a "deleted status" stub, so a
+    delete is checked as a 404 on `/api/v1/statuses/{id}`.
+  - It creates its accounts locked, so the scenario approves alice's request through `/api/v1/follow_requests`, which
+    also checks our pending (`requested`) state and the manual Accept.
+  - 64 checks: discovery and follows both ways; posts and CW; a reply and its notification; likes and boosts both
+    ways; DMs both ways and off public timelines; polls both ways; quote policy; link cards; edits and deletes both
+    ways; communities and circles; locked personas; interaction policies (a reply and a like asked for and approved
+    through `/api/v1/interaction_requests`, a boost refused); unfollow; block and unblock; statistics.
+  - It files a circle post as a direct message and shows it only to the accounts it mentions, so like a DM it is
+    checked in the member's `/api/v1/conversations`, never by URI.
+- **Mastodon (4.7.3):** web and sidekiq on the shared Postgres and Redis, `ALLOWED_PRIVATE_ADDRESSES` for the network.
+  Its token comes from `rails runner` (no password grant). Without Elasticsearch its status search finds nothing, so
+  deliveries are checked through `/api/v1/accounts/:id/statuses` of the sender as Mastodon knows them, or
+  `Status.exists?` through `rails runner`. Its actors are numbered (`/ap/users/<id>`), so look URIs up rather than
+  build them. Circle posts and a followers-only post survive its signed refetch (`ActivityPub::FetchRemoteStatusService`
+  through `rails runner`). Its block of a persona, and the unblock that ends the run, are checked through our
+  `blocked_by`; the run starts with that unblock too, since Mastodon rejects every follow from an account it blocks.
+- **Misskey (2026.10.0):** one container on the shared Postgres and Redis. A new Misskey federates with nobody
+  (`federation: none`) until `admin/update-meta` says `all`, which `misskey_up` does. Its API is `POST /api/<endpoint>`
+  with the token as `i` (`mk` in the scenario); `users/relation` answers a list, `users/notes` leaves replies out unless
+  asked, and a user has one reaction per note. Never verify a delivery with `ap/show`: it fetches. 35 checks.
+- **Sharkey (2025.4.7):** `peers/sharkey.sh` is the Misskey peer under another name, image, database, Redis db and
+  home (`/sharkey/.config`); `scenarios/sharkey.sh` runs Misskey's scenario with `MISSKEY_NAME=sharkey`, then follows
+  again (Misskey's ends unfollowed and blocked) and checks edits both ways and the FEP-e232 quote tag. 40 checks.
+- **Akkoma (3.20.1):** no official image, so `images/akkoma` installs the OTP release (pinned by checksum; the "stable"
+  zip moves, and a moved one fails the build) and `akkoma_up` builds it once. Its HTTP clients read the CA bundles
+  shipped in the release (CAStore, certifi), so the entrypoint appends Caddy's CA there. `pleroma_ctl` passes its
+  arguments on unquoted: no value may contain a space. Its Linkify never takes `@user@host.test` for a mention, so the
+  scenario addresses alice with Pleroma's `to[]`; its API never reports a remote blocker as `blocked_by`, so the block is
+  read from its `user_relationships`. `akkoma_token <user>` signs one of its users in. 45 checks.
+- **Lemmy (1.0.0-beta.2):** the backend alone on the shared Postgres, its admin made by `setup` in the generated
+  `config.hjson`. It trusts Caddy's CA through `SSL_CERT_FILE` and reaches the network through
+  `DANGER_FEDERATION_ALLOW_LOCAL_IP=1`; 0.19 cannot join (its rustls trusts only its bundled roots). Its API is
+  `/api/v4/<path>` with a bearer token (`lm` in the scenario), and `sort` values are lowercase. It logs no refused
+  activity at `warn` (`LEMMY_LOG` sets `RUST_LOG`); the reason is in the 400's body. It answers our community's echo of
+  its own activity and every bare `Announce{object}` 400 by design, and the echo is still needed (see
+  `docs/INTEROP.md`, Lemmy). A new Lemmy never sends what it queued for a server before its send worker for that
+  server started, so the scenario waits for that worker (`lm_worker`) before its first follow, and it sends what it
+  queued every 30 seconds, so a vote or a moderator's act takes up to a minute. Its lock, unlock and unban need a
+  `reason`, or it refuses them and federates nothing. 29 checks, among them a moderator's lock, ban and removal.
+- **PieFed (1.7.17):** dockurr's image of the release, its web app (with PieFed's own cron, `CRON=true`, for its send
+  queue) and a Celery worker on the shared Postgres and Redis (dbs 10 and 11), sharing the `pasture-piefed-media`
+  volume. httpx trusts only certifi's bundle, so the pasture's is mounted over it. `flask init-db` reads its admin
+  (pfuser) from stdin and drops every table it finds, so it runs once, after the web app's migrations ("Starting
+  Gunicorn"). Its API is Lemmy's v3 under `/api/alpha` with a JWT (`pf` in the scenario); `resolve_object` answers a
+  view (`community.community.id`). It sends a community's announces to the Application at a peer's root, assuming
+  `/inbox` when there is none, and keeps serving a thread its moderator removed. `scenarios/piefed.sh`, 29 checks:
+  communities both ways, threads with titles, comments, votes up and down both ways, a community poll and alice's vote,
+  private messages both ways, a moderator's lock, unlock and removal, the unfollow, statistics.
+- **Mbin (1.10.1):** its own image (FrankenPHP serving plain HTTP behind Caddy, `SERVER_NAME=:80`) and a messenger
+  worker (`mbin_worker`, consuming again whenever it stops: once, the shared Postgres restarted under it and Mbin sent
+  nothing for a day), on the shared Postgres and Redis (db 12) with a RabbitMQ of its own (its transports carry AMQP options; it
+  runs as its own user on its own volume, or it cannot read the `.erlang.cookie` it wrote as root). The pasture's bundle
+  is mounted over the system one; its API's rate limits (two threads every six minutes) are raised by a copy of its
+  `rate_limiter.yaml`. Its admin mbuser is made by its console; `peers/mbin_token.py` gets mbuser's OAuth token through
+  the authorization-code flow (login form, consent), since a client-credentials client acts as a bot that may not vote.
+  Mbin names what it makes during a request after the request's host, so every call says `Host: mbin.test`, never
+  the workstation's port. Its access token lasts an hour, and the scenario gets a new one when it has expired. Its API
+  never starts a conversation with an account elsewhere, so mbuser answers in the thread alice began; Mbin addresses
+  that answer to alice's profile page. `scenarios/mbin.sh`, 26 checks: magazines both ways, threads with titles, a Note
+  to a magazine as a microblog post, comments both ways, favourites and upvotes both ways, private messages both ways,
+  a moderator's lock, unlock and removal, the unfollow, statistics.
+- **NodeBB (4.16.1):** the official image on the pasture's Mongo (database `nodebb`), set up once by its automated
+  setup (`SETUP` with `NODEBB_*` variables, admin nbuser) into the `pasture-nodebb-config` volume, trusting the CA
+  through `NODE_EXTRA_CA_CERTS`; its image runs `npm install` at every start. Its API (`/api/v3`) takes a bearer token
+  that `nodebb_settle` writes where NodeBB keeps its tokens. A remote account's uid there is its actor's URL, but its
+  API follows one only when named by its handle; a chat room is made, then written in. `scenarios/nodebb.sh`, 23
+  checks: a category followed and its topic as a titled thread, replies both ways, nbuser following alice, votes both
+  ways, an edit and a deletion, a chat both ways, the unfollow, statistics.
+- **Lemmy 0.19 (0.19.20), as `lemmy19.test`:** what most of the threadiverse runs. Its release trusts only the roots its
+  rustls bundles, so `images/lemmy19` builds the tag with reqwest's `rustls-tls-native-roots` added (about ten minutes
+  the first time) and the pasture's bundle is mounted as the system's. Its config names the database as `uri` (1.0:
+  `connection`) and its API is v3 (`/api/v3`, `sort=New`, `resolve_object` answering views). It takes private messages
+  only as `ChatMessage`, which PrivaPub sends it, a first message too (invariant 17). `scenarios/lemmy19.sh`, 30
+  checks.
+- **Threads (`scenarios/threads.sh`, needs mastodon):** mastouser follows alice, carol answers alice's public post,
+  and opening the thread on Mastodon finds carol's reply through alice's `replies` (the scenario makes Mastodon's copy
+  look ten minutes old: Mastodon reads a thread's replies only five minutes after it first holds the post). 5 checks.
+- **Followers synchronisation (`scenarios/followsync.sh`, needs mastodon):** sent: PrivaPub forgets mastouser's follow
+  of alice (mongo), alice's followers-only post naming mastouser makes Mastodon read her roll-call and drop it; then
+  Mastodon forgets a follow (rails) and alice's next followers-only post makes it send the `Undo` PrivaPub applies.
+  Received: alice and bob follow mastouser; Mastodon forgets alice's follow and mastouser's followers-only post makes
+  PrivaPub end it, then PrivaPub forgets it and the next makes PrivaPub undo it there. Follows are checked in Mastodon's
+  database: its API caches relationships for a day. 15 checks.
+- **Pins (`scenarios/pins.sh`, needs mastodon):** a Mastodon account pins and unpins while alice follows it, alice pins
+  and unpins while it follows her, a fresh account's earlier pin shows once PrivaPub resolves it, and following it brings
+  its earlier posts (its outbox). 9 checks.
+- **Vernissage (1.43.0):** its image on SQLite in the `pasture-vernissage` volume, its queues on the shared Redis's
+  database 0 (it federates nothing without them; every other database is taken), its seeded admin (admin / admin)
+  logged in by the scenario. `scenarios/vernissage.sh`, 19 checks.
+- **BookWyrm (0.9.3):** its image, migrated, on the shared Postgres (database `bookwyrm`) and Redis (databases 14
+  and 15), gunicorn and one Celery worker (federation runs there). It has no client API: bwuser (named
+  `bwuser@bookwyrm.test`, as its signup names users), a book and every status come from its Django shell
+  (`bookwyrm_shell`, `-v 0`). `scenarios/bookwyrm.sh`, 20 checks.
+- **Ghost (6.67) with its ActivityPub service (1.2.14):** Ghost and the service on the shared MySQL (databases `ghost`
+  and `activitypub`, the service's migrations run first), routed by Caddy as Ghost's own proxy does. The owner comes
+  from Ghost's setup API (a password that repeats the site's name is refused), staff device verification is off, and
+  Ghost starts again once so it sets up its publishing webhooks. Calls to the service say `Host: ghost.test`, or it
+  cannot find the site's keys. `scenarios/ghost.sh`, 22 checks.
+- **Owncast (0.3.0):** its image, its data in the `pasture-owncast` volume, federation turned on through its admin
+  API (`owncast_admin`, its default admin / abc123) with the server's address and the actor's name.
+  `scenarios/owncast.sh`, 13 checks.
+- **WriteFreely (0.17.2):** built from its release tarball with `openssl` beside it (`images/writefreely`, it makes
+  each blog's keys with the command), on SQLite in the `pasture-writefreely` volume, which the scenario reads from the
+  host. wfuser and its blog come from its CLI; its API takes a login. `scenarios/writefreely.sh`, 13 checks.
+- **snac2 (2.95):** built from its tag (`images/snac2`, the project publishes no image), its data in the
+  `pasture-snac` volume from `snac init` and `snac adduser`; the password comes from `snac resetpwd` and the token from
+  its login form and a code grant. Its API lags behind what it has taken in, so `scenarios/snac.sh` reads its files
+  (`snac_stored`, `snac_in_timeline`). 27 checks.
+- **Mitra (5.9.1):** its image on the shared Postgres (database `mitra`), as `mitra.test`, with the pasture's bundle as
+  the system's roots; mitrauser comes from its CLI and its token from a password grant. Its search resolves an account
+  elsewhere only without `type`. `scenarios/mitra.sh`, 28 checks.
+- **Relays (`peers/relay.sh` Activity-Relay 2.0.9 as `relay.test`, on the shared Redis's database 13;
+  `peers/aoderelay.sh` aode-relay 0.3.129 as `aoderelay.test`):** `appsettings.Pasture.json` names both in
+  `Federation:Relays`, so PrivaPub subscribes a minute after it starts. `scenarios/relay.sh` has Mastodon subscribe to
+  each in turn, checks that a post of an account nobody here follows reaches the federated timeline (forwarded by one,
+  announced by the other), that alice's public post goes to the relays (and through both to Mastodon: Activity-Relay's
+  forward on its FEP-8b32 proof, after the scenario makes Mastodon read alice's keys anew) and nothing less public, and
+  has Mastodon leave again, so the town sees no relayed posts. 16 checks.
+- **Castopod (1.15.5, `peers/castopod.sh`):** the official image on the shared MySQL (database `castopod`, file cache,
+  `CP_DISABLE_HTTPS`), its database and superadmin (admin@castopod.test) from `spark`, its REST API switched on in the
+  `.env` the image rewrites at each start, `spark fediverse:broadcast` looping in the container. The podcast `@pod` is
+  made and published through its admin pages (`cp_web`, CSRF on each form). `scenarios/castopod.sh`, 15 checks; the
+  episode's sound is made with ffmpeg on the workstation.
+- **Ktistec (3.13.0, `peers/ktistec.sh`):** built from its tag by `images/ktistec` (its own Dockerfile, pinned: a static
+  Crystal server, its assets with node), SQLite in the `pasture-ktistec` volume, the pasture bundle mounted as
+  `/etc/ssl/cert.pem`. The server's name and ktuser come from its setup API (every field required, `summary` too);
+  `ktistec_token` signs in on `/sessions`. `scenarios/ktistec.sh`, 27 checks: its Mastodon API where it has the route,
+  its outbox API (`kn`) for follows, polls (`poll-duration` is seconds from now), edits, deletions and quotes, and a
+  copy of its SQLite database (`kt_sql`) for what it holds.
+- **Forte (26.9.10, `peers/forte.sh`):** built from its tag by `images/forte` (composer on Hubzilla's PHP image, an nginx
+  routing through `index.php?req=`), on the shared MySQL (database `forte`), its `.htconfig.php` written to
+  `.state/forte`, a cron sidecar (`src/Daemon/Run.php Cron`). The pasture bundle is mounted over `library/cacert.pem`,
+  the bundle its curl uses. ftuser (administrator) and ftfriend are made through its PHP (`forte_eval`: `Account::create`,
+  `Channel::create` with the role `social` and `autoperms`, or every connection waits). Connecting from the command line
+  runs the notifier itself (`ft_connect`). `scenarios/forte.sh`.
+- **Hubzilla (11.4.1, `peers/hubzilla.sh`):** the hlhd image (php-fpm and nginx on 8080) on the shared MySQL
+  (database `hubzilla`, its schema loaded from the image), `.htconfig.php` written to `.state/hubzilla` and mounted, a
+  cron sidecar running `Zotlabs/Daemon/Master.php Cron` each minute. Its addons `pubcrawl` (ActivityPub) and `statistics`
+  (NodeInfo) are installed with `util/addons`; hzuser (the hub's administrator) and hzfriend are made through its own PHP
+  (`hz_eval`), as accounts written the way its registration queue would and channels with the role `public` (the older
+  role names grant connections nothing), the ActivityPub app installed as each channel. Its API (`api/z/1.0`) posts and
+  edits with HTTP Basic (email and password); liking and dropping go through its web pages signed in (`hz_web`).
+  `scenarios/hubzilla.sh`, 20 checks and one known gap (G-0010, its unfollow).
+- **Smithereen (1.0.3):** its image on the shared MySQL (database `smithereen`, its schema from the image's commit),
+  with imgproxy and a file server behind Caddy as `smithereen.test` (`/i` and `/s`), trusting the CA through a JDK
+  store with it added (`JAVA_TOOL_OPTIONS`). MySQL takes its stored functions only with
+  `log_bin_trust_function_creators`, and a first start that failed there leaves the database without triggers (drop it
+  and start again). Accounts come from its signup form (opened, with a short description, which its NodeInfo needs) and
+  are renamed in its database; its API is VKontakte's (`/api/method/<name>?v=1.0`), with a password grant for a local
+  application the peer script inserts. `scenarios/smithereen.sh`, 40 checks, walls both ways (alice's profile is
+  told again first, so Smithereen reads her `sm:wall`; `servers.features & 1` says it took PrivaPub for a server with
+  walls). Its scenario texts avoid apostrophes: `p_home_has` puts them inside a Python string.
+- **Load (`load.sh`, needs the `flood` peer):** `flood` (`flood/flood.cs`, published once into `.flood`) answers as
+  twenty fake servers and sends signed activities at a set rate; `load.sh --rate=N --seconds=N` measures the answers,
+  the queue's wait and processing times, its drain, and a persona's home timeline meanwhile, and keeps each run in
+  `out/load/`. `docs/LOAD.md` has the method and the runs.
+- **Account moves (`scenarios/moves.sh`, needs gts):** two fresh GoToSocial accounts made by its admin CLI; alice follows
+  the old one, the new one names it as an alias (`/api/v1/accounts/alias`), the old one moves (`/api/v1/accounts/move`),
+  and PrivaPub shows it `moved` and moves alice's follow to the new one, which (locked by GoToSocial) approves it.
+  8 checks.
+- **Hollo (0.9.19):** Fedify's microblog server on the shared Postgres, set up through its web form (which
+  checks `Origin` against `Host`, so the request names `hollo.test` without the port). It needs a 44-character
+  `SECRET_KEY`, a media directory and a `themeColor`; statuses and votes go as JSON. Town only, no scenario.
+- **PeerTube (8.3.1):** the official image on the shared Postgres and Redis (db 4), configured through `PEERTUBE_*`
+  variables, trusting Caddy's CA through `NODE_EXTRA_CA_CERTS`; `peertube_settle` turns transcoding off (a test video
+  is served as uploaded) and keeps root's token in `.state/peertube.token`. It wants a bare `Host: peertube.test`.
+  Its list of comments held for review (`/api/v1/users/me/videos/comments?isHeldForReview=true`) answers 500 in 8.3.1;
+  the video's owner sees them in the video's threads (`heldForReview`). `scenarios/peertube.sh`, 28 checks.
+- **Pleroma (2.10.2):** `images/pleroma` installs the OTP release, pinned by checksum, as Akkoma's does; it also needs
+  libvips, and `instance gen` asks about deduplicating uploads. Its federation runs on hackney, which trusts only
+  certifi's compiled-in roots, so the entrypoint points `:pleroma, :http, adapter` at the system CA bundle. It answers
+  an inbox POST at once and verifies in a worker (`oban_jobs` shows what it refused and why). Town only, no scenario.
+- **Iceshrimp.NET (2026.1.2-beta):** on the shared Postgres with AuthorizedFetch on and open registrations, trusting
+  Caddy's CA through `SSL_CERT_FILE`. Accounts come from its own `/api/iceshrimp/auth/register` (its login cuts the
+  connection short for a name it does not know), Mastodon API tokens from its OAuth form, which prints the out-of-band
+  code in the page. Its `jobs` table shows what it queued for whom. Town only, no scenario.
+- **Pixelfed (0.14.4):** serversideup's FrankenPHP image on the shared Postgres (database pixelfed) and Redis (dbs 5 and
+  6), with Horizon and the scheduler as sidecars of the same image sharing its storage volume, and Caddy's CA mounted
+  as its system bundle. `pixelfed_settle` makes `caption` nullable (its PostgreSQL migration never runs, so every remote
+  boost failed), creates Passport's keys and restarts the web server so FrankenPHP reads them, numbers the OAuth
+  clients from a million (Passport refuses a token whose user id equals its client's id), and imports its cities.
+  Tokens are personal access tokens made through tinker (`App\Models\User`). Every top-level post needs a picture.
+  `scenarios/pixelfed.sh`, 26 checks; the town's driver and `specs/pixelfed-pair.json`.
+- **WordPress (7.1.2, ActivityPub plugin 9.3.1):** the official image on a shared MySQL 8.4 (`shared_mysql_up`, ready
+  only when it answers over TCP: its first start runs a server without networking), installed and configured by wp-cli,
+  its CA bundle (`wp-includes/certificates/ca-bundle.crt`) given Caddy's root, and WP-Cron run every five seconds by a
+  sidecar (`DISABLE_WP_CRON`), since the plugin federates from it. Its automatic updates are off
+  (`AUTOMATIC_UPDATER_DISABLED`): the sidecar ran one (6 to 7.1.2) whose new CA bundle dropped Caddy's root, and
+  WordPress reached nobody after it. Authors are actors; the REST API takes application passwords.
+  `scenarios/wordpress.sh`, 17 checks.
+- **Friendica (2026.05):** the official image on the shared MySQL (database friendica) and Redis (db 7, for its cache,
+  locks and sessions), installed by its autoinstall, with the image's worker daemon (`cron.sh`) as a sidecar sharing
+  its files. `friendica_settle` repairs what the install leaves: it names the system user (uid 0), or Friendica never
+  makes the system account that signs its fetches; it declares the daemon running (`worker_daemon_mode` in
+  `key-value`), or the web container, which cannot see the sidecar's pid, never wakes it and everything waits for its
+  five-minute cron; it makes the log file and turns logging on. `friendica_user` saves each account through the API
+  with `locked=0` (a number: "true" reads as 0), which makes it a "soapbox" page that takes followers without asking and
+  follows nobody back, and reads its outbox once: a Follow that reaches a user Friendica has not cached yet makes it
+  fetch that user from itself, signed, and checking the signature recurses for about five minutes. Its API takes HTTP
+  Basic (`nick:password`); an edit through it never federates, so the scenario edits in the web editor.
+  `scenarios/friendica.sh`, 25 checks; the town's driver and `specs/friendica-pair.json`.
+- **Mobilizon (5.2.4):** kaihuri's image of the release on a PostGIS of its own (`shared_postgis_up`: it needs the
+  extension), with the pasture's bundle mounted over certifi's and castore's CA files (hackney trusts only those) and
+  the system store, and geocoding pointed at a closed local port. `mobilizon_ctl users.new` makes mzuser (it splits
+  its arguments on spaces); the API is GraphQL (`/api`), signed in by the `login` mutation. An event made through it
+  without options has its comments closed. `scenarios/mobilizon.sh`, 27 checks: a group and its events (dates, place),
+  alice joining an event (Mobilizon's participant row and its Accept) and leaving it, comments both ways, the
+  organiser's edit, closed comments and deletes, a group post, the unfollow.
+- **Gancio (1.28.2):** cisti's image on sqlite in the `pasture-gancio-data` volume, whose `config.json` is written before
+  the first start (without it Gancio waits in its setup wizard), trusting Caddy's CA through `NODE_EXTRA_CA_CERTS`.
+  `gancio users create` makes gcadmin; `gancio settings set enable_resources true` keeps fediverse replies. One
+  Application actor, `relay`, publishes the agenda. Its API takes a token from an OAuth password grant
+  (`/oauth/login`, client_id `self`); an event is a multipart POST (`--form-string` for text starting with `<`).
+  `scenarios/gancio.sh`, 17 checks.
+- **Funkwhale (2.0.11):** the API (gunicorn), a Celery worker with its beat and the front's nginx, sharing the
+  `pasture-funkwhale-data` volume, on the shared Postgres (database funkwhale) and Redis (dbs 8 and 9); Python's requests
+  trusts the pasture's bundle through `REQUESTS_CA_BUNDLE`. `funkwhale-manage fw users create` makes fwuser and an OAuth
+  access token is made in its Django shell. Its API is `/api/v1` and `/api/v2` (uploads); a track is a fresh tone made
+  by ffmpeg in its container, since it skips a file it already has. `scenarios/funkwhale.sh`, 16 checks.
+- **SecureMode:** `PRIVAPUB_ENV="Federation__SecureMode=true" run.sh up …`, as production runs. A check of what an
+  unsigned reader sees uses `unserved` and `gone_unsigned` (`lib/interop.sh`), which expect 401 when SecureMode is on and
+  404 or 410 when it is off.
+- **Crawler:** `PRIVAPUB_ENV="Statistics__Crawler__Enabled=true Statistics__Crawler__Seeds__0=mastodon.test"
+  run.sh up mastodon`, then `interop.sh crawler`. `PRIVAPUB_ENV` passes any setting to the PrivaPub container.
 - `run.sh up` replaces every container, Mongo included, so each run starts clean. To keep the data, republish into
   `tools/pasture/.publish` and `podman restart pasture-privapub`; that is how a migration is tried on dirty data.
+- `run.sh add <peer>` starts more peers next to a running pasture; `run.sh down` removes every pasture container with
+  its volumes (`--purge` drops Caddy's CA too); `run.sh stats` shows each container's memory.
+- **The network looks public** (`PASTURE_SUBNET`, default `11.42.0.0/24`), so peers that refuse private addresses with no
+  switch (Pixelfed, Mbin, WordPress, Discourse, Fedify) federate. Mastodon then needs `TRUSTED_PROXY_IP` for Caddy, or it
+  answers every request with an IP spoofing error.
+- **`PASTURE_PORT`** moves PrivaPub's workstation port off 6971 when something else holds it; `lib/interop.sh` follows.
+- Every `ok`/`ko`/`xf` is also a line of `out/scenarios.jsonl`, which the town's report shows.
+
+#### The town (`tools/pasture/town.sh`, `tools/pasture/town/`)
+
+A fake community seeded across every running peer, then checked for coherence: what each server holds (read from its
+database, never by making it fetch), what each account sees through its API, counts, threads, edits, deletes, follows
+and the privacy rows. Python 3 standard library only, tabs.
+
+```bash
+tools/pasture/town.sh selftest [peer...]   # each driver against its own server; run after changing a driver or a pin
+tools/pasture/town.sh seed village         # specs/village.json: 23 accounts on seven servers, about 11 minutes
+tools/pasture/town.sh check village        # out/<run>/results.json; --deadline=0 re-sweeps an old run at once
+tools/pasture/town.sh report village       # out/<run>/report.html, publishable (fake data, no tokens)
+tools/pasture/town.sh report village hollo-pair iceshrimp-pair pleroma-pair pixelfed-pair friendica-pair   # one matrix
+tools/pasture/town.sh backlog --write      # docs/INTEROP-BACKLOG.md
+```
+
+- **Drivers** (`dialects/`): one class per platform on a dialect base (`mastodon_api`, `misskey_api`, `lemmy_api`,
+  `privapub`). `stored()` reads the database (shared Postgres through `psql`, the shared MySQL through `mysql_json`,
+  GoToSocial's sqlite copied out, Mongo);
+  `seen()` asks the API as one account. A driver that cannot do something raises `Unsupported`, and the planner never
+  asks for it (`gen.CAPS`).
+- **The plan** (`gen.py`) is a pure function of the spec and its seed; each run keeps its own `plan.json`, `ledger.jsonl`
+  (what happened, one fact per line) and `results.json`. `seed --resume` redoes only failed steps.
+- **Cells** are `feature|origin|observer|direction` (`in`, `out`, `via`, `control`, `local`). A known gap is a
+  `gaps.json` entry: matching failures are `xfail`, matching passes `xpass` (close the gap).
+- **What the peers do on purpose**, so the checker expects it: Misskey and Sharkey drop a reply whose parent they cannot
+  fetch; Lemmy keeps only community content and private messages; servers send edits and deletes to the post's own
+  audience only; a Misskey heart reaction arrives as a Like.
+- Peers' own limits are lifted for the town: GoToSocial `GTS_ADVANCED_RATE_LIMIT_REQUESTS=0`, Lemmy's
+  `local_site_rate_limit`. Mastodon reserves usernames that contain `mastodon`.
+- decePubClient's e2e tests (`decePubClient/tests/e2e/run.sh`) publish the client with the Pasture environment, serve
+  it as `https://decepub.test` (`peers/decepub.sh`) and write their cells to `out/client.jsonl`.
 
 After the pasture, verify.funfedi.dev and the owner's GoToSocial at social.arasaka.software. **Ask before acting from
 the owner's GoToSocial account.**
@@ -370,13 +925,22 @@ the owner's GoToSocial account.**
 ## Deploy
 
 - **CI/CD:** push to `master` runs `build.yml` (build + tests) on the instance-wide `build` runner. A `v*` tag runs
-  `deploy.yml`: tests, self-contained linux-x64 publish, snapshot and `mongodump` to `/var/backups/privapub.thepra.dev`,
+  `deploy.yml`: tests, self-contained linux-x64 publish, a snapshot of the site to `/var/backups/privapub.thepra.dev`,
+  the server's own pre-deploy backup (`PrivaPub admin backup --kind pre-deploy --db-only`, run from the new build before
+  its migrations, verified, and checked to hold no statistics salt; no deploy while `restore.json` waits),
   stop → rsync → start, a `127.0.0.1:6970/build.json` health loop with rollback, then public checks (actor, NodeInfo,
   Swagger 404, inbox junk 400, unsigned 401) and `tools/smoke/mastodon-api.sh` (app registration, client credentials,
-  discovery, instance, public timeline; pass a persona token as a second argument to check the signed-in side).
+  discovery, instance, public timeline). Then it checks that what production should be running is running:
+  - NodeInfo and the instance API agree on registrations (closed, invitations only);
+  - `/stargazing` says the crawler is on;
+  - **@thepra signs in**: `PrivaPub admin smoke thepra` gives the root `deploy-smoke` a new password, `tools/smoke/oauth.sh`
+    runs the real OAuth flow (the pasture's `privapub_token` uses the same script), the signed-in API is checked, the
+    persona must be undiscoverable, and the token is revoked;
+  - the DB-IP Lite databases, which the server fetches itself (`GeoUpdater`), exist and are at most 40 days old.
 - **The box:** Max (`nuvola.xyz`). Unit `privapub` runs as www-data from `/var/www/privapub.thepra.dev` with
   `ASPNETCORE_ENVIRONMENT=Production`.
-- **One-time root setup:** `deploy/max/setup.sh`, run through `../arasaka.software/tools/max/run.sh`.
+- **One-time root setup:** `deploy/max/setup.sh`, run through `../arasaka.software/tools/max/run.sh` (directories, the
+  runner's sudoers line, the units, nginx and the certificate). Nothing that runs later needs it again.
 - **Config:** `appsettings.Production.json` is committed and deployed, **secrets included, by the owner's convention**
   (the same as arasaka.software). A hand edit on the box is lost at the next deploy.
 - **Secrets drift:** `AppConfigurationService` copies `AppConfiguration` into Mongo on first boot and reads the stored

FEDERATION.md

@@ -8,33 +8,100 @@ PrivaPub is an ActivityPub server written in C#. This document follows
 - [ActivityPub](https://www.w3.org/TR/activitypub/) (server-to-server)
 - [WebFinger](https://webfinger.net/)
 - [HTTP Signatures](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures), `rsa-sha256` / `hs2019` with RSA keys
+  (`hs2019` hashed with SHA-256, or SHA-512 as some sign it; a `SHA-256=` or `SHA-512=` digest)
+- [HTTP Message Signatures](https://www.rfc-editor.org/rfc/rfc9421) (RFC 9421) and Content-Digest (RFC 9530), verified on
+  deliveries and signed fetches: `rsa-v1_5-sha256` and `rsa-pss-sha512` with RSA keys
 - [NodeInfo](https://nodeinfo.diaspora.software/) 2.0 and 2.1
+- Object integrity proofs ([FEP-8b32](https://codeberg.org/fediverse/fep/src/branch/main/fep/8b32/fep-8b32.md),
+  `eddsa-jcs-2022`, JSON canonicalised by [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785)) by Ed25519 keys published
+  as Multikeys ([FEP-521a](https://codeberg.org/fediverse/fep/src/branch/main/fep/521a/fep-521a.md)), on what personas
+  send to relays and verified on what is forwarded
 
 ## Tested against
 
-- **GoToSocial 0.22.1, end to end.** It runs in a private network on the workstation (`tools/pasture/`) and is driven
-  through its own client API. Checked both ways:
-  - follows, including to a locked account;
-  - public posts with a content warning;
-  - replies with notifications;
-  - likes and boosts;
-  - direct messages;
-  - edits and deletes;
-  - unfollow.
-- **Mastodon, Misskey, Lemmy and PeerTube, by unit tests only.** The tests feed the parser documents written in each
-  server's shape. No live exchange with any of them has run yet.
+End to end, in a private network on the workstation (`tools/pasture/`), each peer driven through its own client API
+and every run starting clean, with signed fetches required (as privapub.thepra.dev runs):
+- **GoToSocial 0.22.1**
+- **Mastodon 4.7.3**
+- **Misskey 2026.10**
+- **Sharkey 2025.4.7**
+- **Akkoma 3.20.1**
+- **Lemmy 1.0.0-beta.2**, and **Lemmy 0.19.20** (built with the platform's roots, so it trusts the pasture's CA)
+- **PeerTube 8.3.1**
+- **Pixelfed 0.14.4**
+- **WordPress 7.1.2 with ActivityPub 9.3.1**
+- **Friendica 2026.05**
+- **Mobilizon 5.2.4**
+- **Gancio 1.28.2**
+- **Funkwhale 2.0.11**
+- **PieFed 1.7.17**
+- **Mbin 1.10.1**
+- **NodeBB 4.16.1**
+- **Smithereen 1.0.3**
+- **Mitra 5.9.1**
+- **snac2 2.95**
+- **WriteFreely 0.17.2**
+- **Owncast 0.3.0**
+- **Ghost 6.67** with its ActivityPub service 1.2.14
+- **BookWyrm 0.9.3**
+- **Vernissage 1.43.0**
+- **Hubzilla 11.4.1** with its pubcrawl addon
+- **Forte 26.9.10** (portable identities: actors served through `/.well-known/apgateway/did:key:…`)
+- **Castopod 1.15.5** (podcasts as actors, their episodes with the sound)
+- **Ktistec 3.13.0**
+- **Activity-Relay 2.0.9** and **aode-relay 0.3.129**, as relays PrivaPub reads from
+- in the town only (a seeded community checked server by server): **Hollo 0.9.19**, **Iceshrimp.NET 2026.1.2-beta**,
+  **Pleroma 2.10.2**
+
+Checked both ways, where the peer has the feature:
+- follows, locked accounts included;
+- every visibility, content warnings, replies and their notifications;
+- likes, boosts and emoji reactions with their undos;
+- direct messages;
+- polls;
+- quotes;
+- images with alt text;
+- edits with history and deletes;
+- communities and circles;
+- blocks and unfollows.
+
+`docs/INTEROP.md` has each peer's evidence and what is still expected to fail. The platforms not yet in the pasture are
+covered by unit tests written in their documents' shape.
 
 ## Supported FEPs
 
 - [FEP-67ff: FEDERATION.md](https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md)
 - [FEP-f1d5: NodeInfo in Fediverse Software](https://codeberg.org/fediverse/fep/src/branch/main/fep/f1d5/fep-f1d5.md)
-- [FEP-2c59: Discovery of a WebFinger address from an ActivityPub actor](https://codeberg.org/fediverse/fep/src/branch/main/fep/2c59/fep-2c59.md)
+- [FEP-2c59: Discovery of a WebFinger address from an ActivityPub actor](https://codeberg.org/fediverse/fep/src/branch/main/fep/2c59/fep-2c59.md):
+  every actor names its handle, and a peer's `webfinger` on another domain than its actor's host (Mastodon's
+  `LOCAL_DOMAIN`) is the handle shown once that domain's WebFinger points back to the actor; asked again on a rename
+- [FEP-d556: Server-Level Actor Discovery Using WebFinger](https://codeberg.org/fediverse/fep/src/branch/main/fep/d556/fep-d556.md)
+  (WebFinger for the server's origin links its instance actor as `…#Service`) and
+  [FEP-2677: Identifying the Application Actor](https://codeberg.org/fediverse/fep/src/branch/main/fep/2677/fep-2677.md)
+  (`/.well-known/nodeinfo` links it as `…#Application`)
+- [FEP-844e: Capability discovery](https://codeberg.org/fediverse/fep/src/branch/main/fep/844e/fep-844e.md): the instance
+  actor's `implements`, and every other actor's `generator`, name RFC 9421 (verified with RSA keys)
 - [FEP-1b12: Group federation](https://codeberg.org/fediverse/fep/src/branch/main/fep/1b12/fep-1b12.md) (communities; see "Groups")
+- [FEP-044f: Consent-respecting quote posts](https://codeberg.org/fediverse/fep/src/branch/main/fep/044f/fep-044f.md)
+  (`QuoteAuthorization` at `/parrot-licences/{id}`; checked with Mastodon both ways)
+- [FEP-9967: Polls](https://codeberg.org/fediverse/fep/src/branch/main/fep/9967/fep-9967.md)
+- [FEP-c0e0: Emoji reactions](https://codeberg.org/fediverse/fep/src/branch/main/fep/c0e0/fep-c0e0.md) (`EmojiReact`, and Misskey's
+  `Like` with content)
+- [FEP-5feb: Search indexing consent](https://codeberg.org/fediverse/fep/src/branch/main/fep/5feb/fep-5feb.md) (`indexable`)
+- [FEP-521a: Representing actor's public keys](https://codeberg.org/fediverse/fep/src/branch/main/fep/521a/fep-521a.md) and
+  [FEP-8b32: Object Integrity Proofs](https://codeberg.org/fediverse/fep/src/branch/main/fep/8b32/fep-8b32.md) (see
+  "Integrity proofs")
+- [FEP-171b: Conversation Containers](https://codeberg.org/fediverse/fep/src/branch/main/fep/171b/fep-171b.md), received:
+  a thread owner's `Add` of someone's `Create`, `Update` or `Delete` to the thread's context is taken as that activity
+  passed on by the owner (on its FEP-8b32 proof, or as its origin has it)
+- [FEP-8fcf: Followers collection synchronization across servers](https://codeberg.org/fediverse/fep/src/branch/main/fep/8fcf/fep-8fcf.md)
+  (sent and honoured; see "Followers synchronisation")
+- [FEP-5624: Per-object reply control policies](https://codeberg.org/fediverse/fep/src/branch/main/fep/5624/fep-5624.md):
+  read (see "Replies its author approves")
 
-Planned (see `docs/ROADMAP.md`, phases P5 to P8, and the per-platform notes in `docs/INTEROP.md`): FEP-044f (quotes),
-FEP-9967 (polls), FEP-c0e0 (emoji reactions), FEP-9098 (custom emoji), FEP-7888 and FEP-f228 (threads), FEP-7628 (Move),
-FEP-8fcf (followers synchronisation), FEP-5feb (`indexable`), FEP-8967 (link attachments), FEP-521a and FEP-8b32 (keys
-and integrity proofs), FEP-ae0c (relays).
+Planned (see `docs/ROADMAP.md`, phases P7 and P8, and the per-platform notes in `docs/INTEROP.md`): FEP-9098 (custom
+emoji), FEP-7888 and FEP-f228 (threads), FEP-7628 (Move), FEP-8967 (link
+attachments), FEP-ae0c (relays).
 
 ## Actors
 
@@ -52,15 +119,26 @@ actor document, a collection, NodeInfo or a delivery relates two avatars of the
 | Activities | `/peasants/{name}/grunts/{id}` |
 | Quote permissions (`QuoteAuthorization`) | `/peasants/{name}/parrot-licences/{id}` |
 | Direct-message context | `/peasants/{name}/whispers/{id}` |
+| A persona's wall (FEP-400e) | `/peasants/{name}/graffiti` |
+| Followers on the asking server (FEP-8fcf) | `/peasants/{name}/groupies/roll-call` |
 | Profile and post pages | `/@{name}`, `/@{name}/{id}` |
 
 The names are the project's own and are stable; resolve actors through WebFinger, not by guessing a path.
 
 - The key is `{actor}#main-key`, RSA 2048, served as SPKI PEM with `owner` set to the actor.
 - `published` on an actor is a whole day, chosen at random up to two weeks before the account was made, so two
-  personas made on the same day do not share a date. `indexable` is `false`.
+  personas made on the same day do not share a date. `indexable` is `false` unless the persona turns it on, and
+  `discoverable` is `true` unless it turns that off (the deploy's own persona, @thepra, is undiscoverable).
 - The instance actor is `/peasants/privapub` (type `Application`). It signs every fetch PrivaPub makes, so no avatar's key
-  is used to read another server's content.
+  is used to read another server's content. It also answers at the server's root (`/`) for a request that asks for
+  ActivityPub, as Lemmy's site actor does: PieFed sends a community's announces to the inbox of the Application at a
+  peer's root, and to `/inbox` when there is none.
+- The reporter is `/peasants/privapub_reports` (type `Service`, "Reports from <host>"), one for the whole server with
+  its own key. It sends the reports Lemmy, PieFed and Mbin take in Lemmy's shape (see **Reports** below) and does
+  nothing else: nobody follows or mentions it, the Mastodon API has no account for it, and it has no page.
+- The reader of feeds is `/peasants/privapub_feeds` (type `Service`, "Feeds read on <host>"), one for the whole server
+  with its own key. When a persona here follows a feed, the reader follows each community in it, and stops following one
+  no feed read here holds any more; no community and no feed learns which persona reads it. It does nothing else.
 
 ## Groups
 
@@ -68,16 +146,38 @@ A group is either a **community** or a **circle**.
 
 - A **community** follows [FEP-1b12](https://codeberg.org/fediverse/fep/src/branch/main/fep/1b12/fep-1b12.md). Posts
   addressed to it (in `to`, `cc` or `audience`) are accepted according to its posting policy (followers, anyone, or
-  moderators only) and the group `Announce`s the whole activity, with `audience` set, to its followers. A new post is
+  moderators only) and the group `Announce`s the whole activity, with `audience` set, to its followers and to the
+  author's own server, whether anyone there follows it or not (Lemmy keeps its user's post pending until then). A new post is
   also announced as an object so Mastodon shows it. Updates and deletes of community content are announced too. A
   top-level post is a `Page` with a `name`. Members are counted at `/flock`; moderators are listed at `/wardens`, which
   the actor's `attributedTo` points to, with `postingRestrictedToMods` as Lemmy expects. A mention of a community posts into it.
 - A **circle** is private. Its actor is not discoverable and every follow is a request. Its posts are addressed to the
-  circle and its members collection, delivered to each member's own inbox and never announced. They are served only
-  to a signed request from a member, or from the instance actor of a member's server; anyone else gets 404. A
-  Mastodon member's replies reach only the people they mention.
+  circle and its members collection, delivered to each member's own inbox and never announced. Each member's copy also
+  names that member in `cc`, so servers that keep only posts naming one of their accounts (Mastodon, GoToSocial) keep
+  it; it names no other member. The posts are served only to a signed request from a member, or from the instance actor
+  of a member's server, and that copy names the member (or the members on that server); anyone else gets 404. A
+  Mastodon member's replies reach only the people they mention. Its owner lets a request in with an `Accept` of the
+  Follow, and declines one or takes a member from elsewhere out with a `Reject` of it, as Mastodon removes a follower.
 - Announces from **remote** groups (Lemmy communities) are followed through to the activity: the object is fetched
-  from its own origin, never taken from the announce.
+  from its own origin, never taken from the announce. They are taken from a group someone here follows, and also when
+  they relay a vote on one of our posts in a thread of that group (Lemmy sends a vote to the community alone). A post
+  keeps the group its `audience` names, however it arrived.
+- A post in a remote group followed here that the group's own server delivers itself, as its author's `Create` with the
+  group as its `audience` (Mbin sends a magazine's threads that way, with no announce), is kept as if announced: the
+  group's server speaks for posts in it. The same from another server is not.
+- A remote community's **moderation** reaches the posts it holds. A removal (`Announce{Delete}`) is believed at once
+  from a community on the post's own server, which speaks for it (PieFed keeps serving a thread its moderator removed),
+  and from a community elsewhere once the post's origin answers it gone. A lock sent as it is (`Lock`, Mbin) is taken
+  from the post's own server only. A lock (`Announce{Lock}`, or `commentsEnabled: false` on the post) refuses replies,
+  ours included, until `Undo{Lock}`. A ban of a persona (`Announce{Block}` with the community as `target`) shows as
+  `blocked_by` on the community and refuses the persona's posts and replies there until the `Undo`. A post moved to
+  another community (PieFed's `Announce{Move{object: post, origin, target}}`, relayed by the community it leaves) goes
+  there with its thread; a move into a community this server hosts is not taken.
+- **Feeds** (Lemmy 1.0's multi-communities and PieFed's feeds, `type: Feed`) are read as accounts whose following is
+  their communities: the feed's `following` collection, read once a day with its counts, and each community in it read in
+  turn. A persona following a feed is followed through the server (owner decision 2026-10-07): the reader of feeds
+  follows its communities, the feed itself is sent nothing, and the persona reads the feed's threads in a timeline of
+  its own (`GET /api/v1/timelines/feed/:id`; the feeds it reads are `GET /api/v1/feeds`), not in its home.
 
 ## Activities
 
@@ -86,28 +186,95 @@ Received:
 | Activity | Effect |
 |---|---|
 | `Follow` | follows an avatar or community; `Accept` is sent unless the community approves members by hand |
-| `Accept{Follow}`, `Reject{Follow}` | completes or ends a follow an avatar requested |
+| `Accept{Follow}`, `Reject{Follow}` | completes or ends a follow an avatar requested; once a follow holds, the account's latest public posts are read from its outbox's first page (twenty at most, once a day), so its profile is not empty; homes get only what arrives from then on |
+| `Accept{Join}`, `Reject{Join}` | from the event's server: a persona's participation in the event is accepted or refused |
 | `Undo{Follow, Like, Announce}` | reverses it |
-| `Create{Note, Article, Page, Question, Video, Audio, Event, ChatMessage, …}` | stored when a local avatar follows the author, is addressed or mentioned, when it replies to a local post, or when it is addressed to a community the author follows; a public parent is fetched to complete the thread |
+| `Create{Note, Article, Page, Question, Video, Audio, Event, ChatMessage, …}` | stored when a local avatar follows the author, is addressed or mentioned, when it replies to a local post, or when it is addressed to a community the author follows (a persona is addressed by its actor id or by its profile page, as Mbin addresses its private messages); a public parent is fetched to complete the thread |
 | `Update{Note}` | replaces the content; the previous version is kept |
 | `Update{Person}` | refetches the actor |
 | `Like` | counted and notified, on posts the liker could see |
 | `Dislike` | counted as a downvote (Lemmy, PieFed, Mbin, Friendica); `Undo` takes it back |
 | `EmojiReact`, `Like` with an emoji `content` | an emoji reaction (FEP-c0e0; Pleroma, Akkoma, Iceshrimp.NET, Misskey, Sharkey), Unicode or a custom emoji from its `tag`; a `Like` whose content is ❤ stays a favourite; `Undo` takes it back |
-| `Join` | answered with `Ignore`: PrivaPub hosts no events yet (FEP-8a8e) |
+| `Warn` (Lemmy 1.0) | a community moderator's warning about a persona's post there becomes the persona's `moderation_warning` notification, believed from the community's own server or an account its moderators collection lists |
+| `Resolve{Flag}` (Lemmy 1.0) | a report we sent is marked resolved by the server holding what was reported (kept beside our own moderators' resolution) |
+| `Join` | answered with `Ignore`: PrivaPub hosts no events of its own yet (FEP-8a8e) |
 | `Announce` | counted and notified for local posts; shown to followers of the announcer, with the original refetched from its origin |
-| `Delete` | deletes the object, or the actor and its follows; a deleted object id is remembered for 90 days, so a late `Create` cannot bring it back |
+| `Delete` | deletes the object, or the actor and its follows; a deleted object id is remembered for 90 days, so a late `Create` cannot bring it back, though a new post its server publishes under that id after the deletion (Gancio numbers events from the last one kept) is kept |
 | `Flag` | becomes a report for this server's moderators |
+| `Move` | an account moving: believed as Mastodon believes it, when the account sends it about itself and the new account, read again from its server, names it in `alsoKnownAs`. The old account then shows where it went (`moved`), and, as Mastodon does it (owner decision 2026-10-05), the personas following it follow the new one instead (a Follow to its server, an Undo to the old), in the same lists; a mute or a block of the old account carries over |
+| `Add`/`Remove` on the actor's `featured` | the account pins or unpins one of its own posts (fetched from its server when not held); inside a community's announce, the community features a post made in it. Its profile shows them first (`pinned=true`). The collection itself is read with the account's counts, at most once a day. On the account's wall (`sm:wall`), see "Walls". Any other target (a community's moderators) is dropped; one on the account's own server that PrivaPub does not know has its document read again first, at most hourly |
+| `Block` of a persona | the follows between them end, the blocker's posts and notifications are hidden from the persona, nothing of the persona's is addressed to the blocker, and the relationship says `blocked_by`; `Undo{Block}` lifts it |
 
 Sent: `Follow`, `Undo{Follow}`, `Create{Note}`, `Create{Question}` and poll votes, `EmojiReact` and its `Undo`, `Update{Note}`, `Update{Person}`, `Delete{Tombstone}`, `Accept{Follow}`,
-`Reject{Follow}`, `Like`, `Announce` and their `Undo`, `Flag`. A deleted post answers 410 with a `Tombstone`.
+`Reject{Follow}`, `Like`, `Dislike`, `Announce` and their `Undo`, `Flag`, `Join` and `Leave` of a remote event, and the
+replies to a persona's posts passed on to its followers. A deleted post answers 410 with a `Tombstone`.
+
+- **Votes.** A favourite is a `Like`, a downvote a `Dislike`; a persona has one vote a post, and a changed vote is sent
+  as the new vote alone, as Lemmy sends one (an `Undo` of the old one beside it could arrive after it and take the new
+  one away). `Undo` is sent only when the vote is taken back. A vote on a post in a remote community goes to the
+  community, which counts it and passes it on, as Lemmy sends one, and to the post's author only when it lives on
+  another server: one copy a server, since PieFed drops a second copy of an activity it has just seen.
 
 - **Attachments** are `Document`s with `mediaType`, `name` (alt text), `blurhash`, `focalPoint`, `width` and `height`.
   Uploaded files have all metadata removed.
-- **Pinned posts** are the actor's `featured` collection (`/trophies`); `featuredTags` is `/tattoos`.
+- **Threads** (owner decision 2026-10-06). A persona's public or unlisted post outside any group names its `replies`
+  (`…/scribbles/{id}/replies`) and its conversation, `context` (FEP-7888): the root post's `…/scribbles/{id}/context`,
+  which a reply inherits from its parent, ours or another server's. Both list only the public and unlisted posts
+  PrivaPub holds, the context every one under the root (at most 500); followers-only, circle, direct and local-only posts
+  name neither, and their collections answer 404. Mastodon completes a thread from them.
+- **Followers synchronisation** (FEP-8fcf, owner decision 2026-10-06). A persona's delivery addressed to its followers
+  carries a signed `Collection-Synchronization` header: its `followers`, its roll-call (`…/groupies/roll-call`) and the
+  digest (XOR of each id's SHA-256) of its accepted followers on the receiving server only. The roll-call answers a
+  signed request with the persona's followers on the signer's server and nobody else's; unsigned, 401. A server whose
+  view differs mends itself from it, Mastodon both ways (checked live). Mastodon's `Undo{Follow}` for a follow it never
+  knew of has one id per account (`…#follows//undo`); when it comes again after a new follow, it ends that follow too.
+  Honoured the other way: when a delivery's header digests the sender's followers here otherwise than the personas
+  following it, PrivaPub reads the list it names (same origin, signed by the instance actor). A follow the list leaves out
+  ends, but only when the list is the one the digest describes; a request it lists is taken as accepted; a persona it
+  lists that follows nothing there sends `Undo{Follow}`, as Mastodon does.
+- **Walls** (FEP-400e, Smithereen's; owner decision 2026-10-06). A persona's actor names its `wall`
+  (`…/graffiti`, `sm:wall`) and Smithereen's `privacySettings`: its followers may write on it (`wallPosting`), everyone
+  may read it (`wallPostVisibility`). A public post that is not a reply, sent with the wall as its `target` by an account
+  following the persona, is hosted: the persona is notified (as a mention), it reaches the persona's home and its
+  followers' here, and the persona's followers' servers and the author's are told with `Add{Note}` (the wall as the
+  target). Anything else written there is dropped. The persona may delete it (`DELETE /api/v1/statuses/:id`), which
+  sends `Remove{Note}` with the wall as a plain id; Smithereen deletes the post then, as it does when an owner deletes a
+  post on its wall. The wall lists the persona's public posts that start a thread and what was written on it, newest
+  first. An account elsewhere that tells its followers here, with `Add{Note}` on its own wall, of a post written there
+  has it shown to them as on its wall (`privapub.wall` on the status); a `Remove` there takes it away.
+- **Pinned posts** are the actor's `featured` collection (`/trophies`); `featuredTags` is `/tattoos`. A pin or an unpin
+  is told to the post's audience as `Add` or `Remove` on `featured`, as Mastodon tells it.
 - **Blocks are sent.** A blocked remote account receives `Block` from the blocking account (and `Reject{Follow}` if it
   followed); an unblock sends `Undo{Block}`.
-- **Reports** are sent as `Flag` by the instance actor, never by the reporting account.
+- **Reports** are sent as `Flag`, never by the reporting account and never naming it.
+  - To the reported account's server: from the instance actor, with the account and the posts as `object` and the
+    persona's words in `content`.
+  - To a community on a server whose NodeInfo names Lemmy, PieFed or Mbin (owner decision 2026-10-06, the second place
+    PrivaPub decides by a server's software; PieFed and Mbin once the pasture showed each keeps such a report with its
+    reason): one `Flag` per reported post or comment that was made in that community (its own
+    `audience`, else its thread's), from the reporter, `to` the community, the post alone as `object`, the words (or,
+    with none, the category) in `summary` and `content`, sent to the community's inbox. Lemmy refuses a Flag from an
+    `Application`, with no `to` or with no reason; PieFed drops one from an `Application`; Mbin reads the reason from
+    `summary` alone. Such a server gets no instance actor's Flag: an account alone, or a post outside its communities,
+    is not reported there, since Lemmy takes neither (PieFed would take an account alone from the reporter; that is not
+    sent yet).
+- **Direct messages** go out as a `Note` addressed to their recipients, except a message to one account elsewhere that
+  writes to us as `ChatMessage`s (Pleroma's type), or whose server takes nothing else: Lemmy before 1.0 and Mbin, as
+  their NodeInfo names them (owner decision 2026-10-05, the first place PrivaPub decides by a server's software). That
+  message goes out as a `ChatMessage`, to the account alone, without a mention in its text.
+- **Replies are passed on** (inbox forwarding; owner decision 2026-10-05). A public or unlisted reply from another server
+  to a persona's public, unlisted or followers-only post goes on to the persona's followers as its author's server sent
+  and signed it, the way Mastodon forwards it: to every follower's server but the replier's own. Its `Update` and
+  `Delete` follow the same way. Nothing is passed on for a local-only post, a group's post or a reply that is not public
+  or unlisted. A server that receives it checks it as it checks any forwarded activity: Mastodon, Misskey and Sharkey
+  keep it only when its author LD-signed it (Mastodon does; Misskey 2026.10 and Akkoma do not), others read the reply
+  from its origin.
+- **Events** (owner decision 2026-10-05). A persona joins another server's event with a `Join` and leaves it with a
+  `Leave`, both sent to the event's organiser only (`…/grunts/join-<id>`, `…/grunts/leave-<id>`). The organiser's
+  server answers `Accept` (Mobilizon at once for an open event) or `Reject`, which the persona sees as
+  `privapub.event.participation`: `pending`, `accepted` or `rejected`. An event that takes participants by invitation
+  or on another site (Mobilizon's `joinMode` `invite` or `external`) is refused before anything is sent (422). Who
+  takes part is public on the event's server.
 
 A `Create`'s `Note` carries Mastodon's `content`, `contentMap`, `summary` and `sensitive`, plus `Mention` and `Hashtag`
 tags.
@@ -117,6 +284,8 @@ tags.
 content, one per choice, counted once per voter. Counts are refreshed with an `Update{Question}` at most every three
 minutes. Our own votes on other servers' polls are sent the same way to the poll's author only, without `published`.
 An incoming `Update` without a newer `updated` only refreshes counts and details; it is never recorded as an edit.
+A post's earlier versions in `formerRepresentations` (Pleroma, Akkoma) are its edit history, read as the post itself is:
+a post first met after its edits has them, and an edit that carries them brings the versions missed in between.
 
 **Quotes** (FEP-044f, with the older keys):
 - **Received.** A quote is read from `quote`, `quoteUrl`, `quoteUri`, `_misskey_quote` or a FEP-e232 `Link` tag.
@@ -139,6 +308,28 @@ An incoming `Update` without a newer `updated` only refreshes counts and details
     `Delete{stamp}`.
   - Followers-only posts and DMs can never be quoted.
 
+**Interaction policies** (GoToSocial's `canReply`, `canLike`, `canAnnounce`, with the older `always` and
+`approvalRequired`):
+- **Read** on every remote post; one left out means anyone, automatically. A persona is let in at once when the rule
+  names the public, the persona itself, the author's followers while it follows the author, or the accounts the author
+  follows while the author follows it.
+- **Shut out:** the client API answers 422 to a reply, favourite or boost the rule does not allow at all.
+- **Asked first:** a `ReplyRequest`, `LikeRequest` or `AnnounceRequest` (the interaction as its `instrument`) goes to the
+  author alone, and the interaction waits (`privapub.approval: pending`). The author's `Accept` brings an authorization
+  (`result`), which must be on the author's origin, attributed to them and naming the interaction and the post; only then
+  does the reply go out with `replyAuthorization`, the boost with `announceAuthorization` and the like with
+  `likeAuthorization`. A `Reject` leaves it ours alone (`rejected`), and takes a like or a boost back.
+- **As a third party,** a reply that a post's policy does not let in at once is kept only with an authorization that
+  verifies the same way. A rule naming a collection we cannot list (followers, following) lets the reply in.
+- **Shown** to clients as GoToSocial's `interaction_policy` (`can_favourite`, `can_reply`, `can_reblog`).
+- Our own posts state only `canQuote`: anyone may reply to, like and boost them.
+
+**Replies its author approves** (FEP-5624's `canReply`, as PeerTube sets it on a video whose comments are moderated; a
+`null` one says nothing): a persona it names, or that the post mentions, may reply, and the reply waits
+(`privapub.approval: pending`), its `Create` going to the author alone. The author's `ApproveReply`, signed by the author
+and naming the post answered, lets it out to its audience with `replyApproval`; a `RejectReply` leaves it ours alone
+(`rejected`). An empty `canReply` refuses every reply (422).
+
 **Custom emoji** (`Emoji` tags) are read on posts, display names, bios and profile fields, at most 64 per object.
 **Profiles** keep their header, profile fields, `manuallyApprovesFollowers`, `published`, `movedTo`, `indexable`,
 `memorial` and avatar and header descriptions. A post's title becomes `name` and is also the first, bold line of `content`, because Mastodon does not show
@@ -162,6 +353,35 @@ The page's OpenGraph and Twitter tags give the title, description and image; the
 days and shared by every account on the server. Images are served to clients only through PrivaPub's media proxy.
 `Federation:FetchLinkPreviews=false` turns page fetching off.
 
+## Relays
+
+PrivaPub reads from the relays `Federation:Relays` names (by their actor's address, or their inbox's), none by default.
+Its instance actor follows `Public` at each, as Mastodon subscribes (`Federation/Relays/Relays.cs`, a minute after start
+and every six hours: an unanswered or refused subscription is asked again a day later, and a relay no longer named gets
+the `Undo`). What an accepted relay passes on comes to the federated timeline, never to anyone's home: a public post it
+forwards as its author sent it (Activity-Relay), read again from its origin like any forwarded post, and a post it
+announces (aode-relay), kept as its author's and never as the relay's boost. Nothing else is taken from a relay. A
+persona's public post outside any group, its edit and its deletion also go to the relays that accepted us (owner decision
+2026-10-06), as Mastodon sends them; nothing less public, and no boost. Mastodon takes a post Activity-Relay forwards
+only with an LD signature or an FEP-8b32 proof: PrivaPub's carry a proof, so they reach Mastodon through both kinds of
+relay (checked live).
+
+## Server descriptions and the crawler
+
+PrivaPub keeps statistics about servers, never about accounts (see `/stargazing` on the server).
+- **Describing a server:** a server it exchanges activities with is described at most once a week, from:
+  - `/.well-known/nodeinfo` and the NodeInfo document it links;
+  - `/api/v2/instance`, falling back to `/api/v1/instance`.
+
+  These requests are unsigned, because they are not ActivityPub documents.
+- **The crawler** is on at privapub.thepra.dev. It identifies as
+  `PrivaPub-Stargazer/<version> (+https://privapub.thepra.dev/stargazing)`.
+  - **What it reads:** `/robots.txt`, then the documents above and `/api/v1/instance/peers`, and nothing else: no
+    accounts, posts or directories.
+  - **How often:** one server a minute, each at most weekly.
+  - **Opting out:** in robots.txt, the crawler obeys the group `PrivaPub-Stargazer`, then `PrivaPub`, then `*`. A
+    robots.txt that answers with a server error or times out also keeps it out, as do this server's domain blocks.
+
 ## Local-only posts
 
 Posts with a location (shown to nearby users of this server) never leave the server, in any form.
@@ -174,21 +394,71 @@ Posts with a location (shown to nearby users of this server) never leave the ser
 - **Origins.** An actor document is accepted only from the address it names as its `id`. A key only if its actor lists
   it with `owner` set to the actor and on the actor's origin. An activity's `id`, and any object it creates, updates or
   deletes, must be on its actor's origin. An embedded object from another origin is fetched from that origin.
+- **Another account of the same server.** An object attributed to another account of the actor's own server (Mobilizon's
+  organiser creates, edits and deletes the group's event) is that server's to vouch for: a creation or an edit is
+  taken as the server has the object, a deletion once it answers 404 or 410. Attributed to an account elsewhere, it is
+  refused (400).
+- **Forwarded activities** (ActivityPub's inbox forwarding: a thread's server passing on the replies in it, signed with
+  its own key) are answered 202 and believed only as far as their origin vouches for them: a created or edited post
+  is read again from its author's server, a deletion of a public or unlisted post is applied once that server answers
+  404 or 410, and anything else is dropped. LD signatures are not verified. A reply forwarded this way is kept when
+  someone here follows the author of the post it answers, as Mastodon does.
+- **Follow requests** still unanswered are sent again after 15 minutes, an hour, 6 hours, a day, two and four days: a
+  server can take a Follow and lose its answer (Lemmy 1.0 sends nothing it queued for a server before it started
+  sending there), and one that holds the follow answers it again. Each is the same follow under a new id
+  (`…/follow-<id>-again-<n>`), since Lemmy ignores an id it has seen; an answer naming any of them counts.
 - **Fetching.** All fetches are signed by the instance actor. They go only to public addresses, follow at most three
   redirects and read at most 1 MB.
+- **Threads.** A reply's missing parents are fetched, up to 10 levels. When someone here opens a public remote thread,
+  its replies are read from their servers, at most once an hour: the thread's conversation container (FEP-171b's
+  `contextHistory`: the posts its owner's `Add`s brought in) or its `context` collection (FEP-7888) if it has one, else
+  its `replies` (PeerTube's `comments`) and theirs, two levels down; 5 pages and 100 posts at most. Only public and
+  unlisted replies are kept, each fetched from its own origin. A thread collection read whole, which counts its posts or
+  holds them all, is asked again with `If-None-Match` and its last ETag; a 304 ends the read.
+- **Reading our documents (SecureMode).** privapub.thepra.dev answers ActivityPub GETs only when they are signed, like
+  Mastodon's authorized fetch; the server's own actors (the instance actor `/peasants/privapub`, the reporter
+  `/peasants/privapub_reports` and the reader of feeds `/peasants/privapub_feeds`) are the exception, since their keys
+  are needed first.
+  A browser asking for HTML is redirected to the public page instead.
+- **Posts that are not public** (followers-only, direct, circle) are served to a signed request from someone they were
+  for, or from the instance actor of a server where someone they were for lives, and to nobody else (404). Once deleted
+  they answer those same readers 410. A direct message's `context`, `/peasants/{name}/whispers/{id}`, is an
+  `OrderedCollection` of the conversation's posts for its participants.
 - **HTML.** Received HTML is sanitised to Mastodon's allowlist.
 - **Keys we cannot fetch for now.** When a sender's key cannot be fetched because its server timed out or answered
   5xx, the inbox answers 503 with `Retry-After: 300` rather than 401.
-- **Activity ids.** `Create` and `Announce` ids dereference. `Follow`, `Like`, `Block` and the `Accept`, `Reject` and
-  `Undo` that answer them do not, because serving them would reveal who follows, likes and blocks whom; they are always
-  sent with their object embedded.
-- **Delivery.** Failed deliveries are retried with Mastodon's backoff (16 attempts). A host that keeps failing is paused,
-  starting at an hour and growing to a week.
+- **Activity ids.** `Create` and `Announce` ids dereference, a community's announces included, until the post they
+  carry is deleted (then 410); a persona's boost id sends a browser to the boosted post. `Follow`, `Like`, `Block` and
+  the `Accept`, `Reject` and `Undo` that answer them do not, because serving them would reveal who follows, likes and
+  blocks whom. Neither do `Update`, `Delete`, `EmojiReact`, `QuoteRequest` and its answers, `Flag`, `Ignore` or poll
+  votes. All of them are always sent with their object embedded. Every boost and every favourite is an activity of its
+  own (`announce-{boost}`, `like-{favourite}`), so one given again after its `Undo` is new to the server it reaches.
+- **Hashtags.** A post's `Hashtag` links go to `/tags/{tag}`, a public page of this server's public posts with that tag.
+- **Delivery.** An activity goes once to each server, to its shared inbox when the server has one, whoever there it
+  follows, names or answers (a circle post excepted: each member's copy names that member). Failed deliveries are
+  retried with Mastodon's backoff (16 attempts). A host that keeps failing is paused,
+  starting at an hour and growing to a week: unreachable, timing out, or a gateway answering 502, 503 or 504. A 500 is
+  the server failing on that one activity, retried on its own while its other deliveries go on. A server can also take a Follow (202) and drop it afterwards, as Pleroma
+  does when it cannot yet fetch our actor, so a follow request still unanswered is sent again, same activity, when the
+  persona follows once more, at most once an hour.
 
 ## Known limitations
 
 - Our own posts carry no custom emoji: emoji are received and shown, not offered.
 - Remote media is fetched through this server's proxy when a local client displays it. Video and audio are streamed
   through it with byte ranges passed on, so a PeerTube file is never fetched whole for one viewer.
-- Collections expose counts, not members.
-- Only `rsa-sha256`-style keys are verified. RFC 9421 signatures are planned.
+- Collections expose counts, not members: `/groupies` and `/stalking` give the same totals as the Mastodon API's
+  follower and following counts, and the outbox's `totalItems` is the persona's post count, though only public posts
+  are listed. `/api/v1/instance/peers` is empty: which servers this one talks to is not published.
+- HTTP signatures are verified with RSA keys only, under draft-cavage or RFC 9421. What PrivaPub sends is signed with
+  draft-cavage only, which every server reads.
+- **Integrity proofs** (FEP-8b32, FEP-521a). Every persona has an Ed25519 key of its own (never shared between personas),
+  named in its actor's `assertionMethod` as a `Multikey` (`…#ed25519-key`, `publicKeyMultibase`); the terms are defined
+  in the actor's own context, so no context document has to be fetched. A persona's activity going to a relay carries a
+  `DataIntegrityProof` (`eddsa-jcs-2022`, `proofPurpose` `assertionMethod`) over the activity as delivered; Mastodon
+  4.7 verifies it (checked against its own verifier), so what the relay forwards reaches it. Nothing else carries one:
+  Mitra takes a proof over the HTTP signature, and refuses one by a key it has not read yet without reading the actor
+  again, which every server that knew a persona before it had its key would do. What a persona passes on of others'
+  carries theirs or none. Received: an actor's own Multikeys (at most five, under its id, controlled by it) are kept;
+  a forwarded activity whose proof one of them verifies is taken as it came, instead of being read again from its origin
+  (an unknown key of the actor's has the actor read again first).

PrivaPub.ClientModels/Admin/ViewBackups.cs

@@ -0,0 +1,103 @@
+using PrivaPub.ClientModels.Resources;
+
+using System.ComponentModel.DataAnnotations;
+
+namespace PrivaPub.ClientModels.Admin
+{
+	// the server's backups as the administrator's page shows them, with what is running and the last restore
+	public class ViewBackups
+	{
+		public List<ViewBackup> Backups { get; set; } = [];
+		public string Running { get; set; }//"backup" or "restore" while one runs
+		public ViewRestoreWaiting Waiting { get; set; }
+		public ViewRestore LastRestore { get; set; }
+		public string Host { get; set; }//what a restore asks to be typed
+		public long FreeBytes { get; set; }
+	}
+
+	public class ViewBackup
+	{
+		public string Id { get; set; }
+		public string Kind { get; set; }//nightly, manual, pre-deploy, pre-restore, uploaded
+		public DateTime CreatedAt { get; set; }
+		public long Bytes { get; set; }//the database's files
+		public long MediaBytes { get; set; }
+		public int MediaFiles { get; set; }
+		public int MediaMissing { get; set; }
+		public bool DbOnly { get; set; }
+		public bool Consistent { get; set; }
+		public int Collections { get; set; }
+		public long Documents { get; set; }
+		public string AppCommit { get; set; }
+		public int MigrationNumber { get; set; }
+		public int RootsDeletedSince { get; set; }//logins deleted after it, which a restore deletes again
+		public string NotRestorable { get; set; }//why not, from its manifest; hashes are checked when asked
+	}
+
+	public class ViewRestoreWaiting
+	{
+		public string Backup { get; set; }
+		public string State { get; set; }
+		public int Attempts { get; set; }
+		public string RequestedBy { get; set; }
+		public DateTime RequestedAt { get; set; }
+		public string Error { get; set; }
+	}
+
+	public class ViewRestore
+	{
+		public string Backup { get; set; }
+		public DateTime BackupCreatedAt { get; set; }
+		public string PreRestore { get; set; }
+		public string RequestedBy { get; set; }
+		public DateTime RestoredAt { get; set; }
+		public bool Abandoned { get; set; }
+		public string Error { get; set; }
+		public long Documents { get; set; }
+		public int Collections { get; set; }
+		public int MediaRestored { get; set; }
+		public int MediaMissing { get; set; }
+		public int RootsDeleted { get; set; }
+		public int PersonasDeleted { get; set; }
+		public int GroupsDeleted { get; set; }
+		public int PostsDeleted { get; set; }
+		public List<string> RootsTombstoned { get; set; } = [];
+		public List<string> PersonasTombstoned { get; set; } = [];
+		public List<string> GroupsTombstoned { get; set; } = [];
+		public int PostsGone { get; set; }
+		public int MediaTrashed { get; set; }
+		public int ProtectiveKept { get; set; }
+		public int SessionsEnded { get; set; }
+	}
+
+	// a backup downloaded or restored: the administrator's password again, and for a restore the server's host typed out
+	public class BackupPasswordForm
+	{
+		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
+			StringLength(200, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string Password { get; set; }
+	}
+
+	public class RestoreBackupForm : BackupPasswordForm
+	{
+		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
+			StringLength(253, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public string Host { get; set; }
+	}
+
+	// a download link good for a while, for one backup
+	public class ViewBackupTicket
+	{
+		public string Url { get; set; }
+		public DateTime ExpiresAt { get; set; }
+		public long Bytes { get; set; }
+	}
+
+	// a backup being uploaded in pieces: how much has arrived
+	public class ViewBackupUpload
+	{
+		public string Id { get; set; }
+		public long Received { get; set; }
+		public long ChunkBytes { get; set; }//the largest piece accepted
+	}
+}

PrivaPub.ClientModels/Admin/ViewReport.cs

@@ -0,0 +1,22 @@
+namespace PrivaPub.ClientModels.Admin
+{
+	// a report as moderators read it: who sent it ("local" for a persona here, never which one; or the remote actor), whom
+	// and which posts it is about, and whether it was resolved
+	public class ViewReport
+	{
+		public string ID { get; set; }
+		public string Reporter { get; set; }
+		public string TargetAccountId { get; set; }
+		public string TargetActorURI { get; set; }
+		public List<string> PostIds { get; set; } = new();
+		public List<string> ObjectURIs { get; set; } = new();
+		public string Category { get; set; }
+		public string Comment { get; set; }
+		public bool Forwarded { get; set; }
+		public bool IsResolved { get; set; }
+		public DateTime CreatedAt { get; set; }
+		public DateTime? ResolvedAt { get; set; }
+		public DateTime? RemoteResolvedAt { get; set; }//the server holding what was reported said it dealt with it
+		public string RemoteResolvedBy { get; set; }
+	}
+}

PrivaPub.ClientModels/Admin/ViewStatistics.cs

@@ -0,0 +1,99 @@
+namespace PrivaPub.ClientModels.Admin
+{
+	// /clientapi/admin/statistics/overview: the last days' federation at a glance; counters keyed as the ledger keys them
+	public class ViewStatisticsOverview
+	{
+		public int Days { get; set; }
+		public Dictionary<string, long> Channels { get; set; } = new();
+		public Dictionary<string, long> Inbound { get; set; } = new();
+		public Dictionary<string, long> Outbound { get; set; } = new();
+		public double? DeliverySuccess { get; set; }
+		public ViewLatency DeliveryLatencyMs { get; set; } = new();
+		public ViewHostCounts Hosts { get; set; } = new();
+		public int Accounts { get; set; }
+		public ViewLedgerCounts Ledger { get; set; } = new();
+		public ViewMediaTotals Media { get; set; } = new();
+	}
+
+	// what media take on the server: the uploads and pictures kept, the remote media cache, the trash waiting its grace
+	public class ViewMediaTotals
+	{
+		public long MediaBytes { get; set; }
+		public long MediaFiles { get; set; }
+		public long ProxyCacheBytes { get; set; }
+		public long TrashBytes { get; set; }
+	}
+
+	public class ViewLatency
+	{
+		public int? P50 { get; set; }
+		public int? P95 { get; set; }
+	}
+
+	public class ViewHostCounts
+	{
+		public int Active { get; set; }
+		public long Known { get; set; }
+	}
+
+	public class ViewLedgerCounts
+	{
+		public long Written { get; set; }
+		public long Dropped { get; set; }
+		public long Failed { get; set; }
+	}
+
+	// /clientapi/admin/statistics/hosts: one page of the servers we exchanged with
+	public class ViewHostsPage
+	{
+		public int Total { get; set; }
+		public int Page { get; set; }
+		public List<ViewHostRow> Hosts { get; set; } = new();
+		public string Attribution { get; set; }
+	}
+
+	public class ViewHostRow
+	{
+		public string Host { get; set; }
+		public string Software { get; set; }
+		public string Version { get; set; }
+		public long In { get; set; }
+		public long Out { get; set; }
+		public long Refused { get; set; }
+		public long Failures { get; set; }
+		public int? LatencyP50 { get; set; }
+		public int Accounts { get; set; }
+		public DateTime? DescribedAt { get; set; }
+		public ViewHostDelivery Delivery { get; set; }
+	}
+
+	public class ViewHostDelivery
+	{
+		public int ConsecutiveFailures { get; set; }
+		public DateTime? UnavailableUntil { get; set; }
+		public DateTime? LastSuccessAt { get; set; }
+		public DateTime? LastFailureAt { get; set; }
+	}
+
+	// /clientapi/admin/statistics/crawler: how far the crawler got
+	public class ViewCrawler
+	{
+		public bool Enabled { get; set; }
+		public long Touched { get; set; }
+		public long Crawled { get; set; }
+		public long Due { get; set; }
+		public long RobotsDisallowed { get; set; }
+		public List<ViewCrawledHost> Recent { get; set; } = new();
+	}
+
+	public class ViewCrawledHost
+	{
+		public string Host { get; set; }
+		public string Seen { get; set; }
+		public DateTime? LastCrawledAt { get; set; }
+		public int? PeersCount { get; set; }
+		public bool? RobotsDisallowed { get; set; }
+		public string CrawlError { get; set; }
+		public string Software { get; set; }
+	}
+}

PrivaPub.ClientModels/Group/ViewGroupMember.cs

@@ -0,0 +1,15 @@
+namespace PrivaPub.ClientModels.Group
+{
+	// someone in a group, or asking to join it, as its owner and moderators see them
+	public class ViewGroupMember
+	{
+		public string ActorUri { get; set; }
+		public string Handle { get; set; }
+		public string Name { get; set; }
+		public string PictureUrl { get; set; }
+		public bool IsLocal { get; set; }
+		public bool IsPending { get; set; }
+		public string Role { get; set; }//owner, moderator, member
+		public DateTime Since { get; set; }
+	}
+}

PrivaPub.ClientModels/User/RemoveSelfForm.cs

@@ -0,0 +1,14 @@
+using PrivaPub.ClientModels.Resources;
+
+using System.ComponentModel.DataAnnotations;
+
+namespace PrivaPub.ClientModels.User
+{
+	// Deleting one's own login, and with it every persona and group it owns, asks for the password again.
+	public class RemoveSelfForm
+	{
+		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
+			Display(Name = "Password", ResourceType = typeof(FieldsNameResource))]
+		public string Password { get; set; }
+	}
+}

PrivaPub.ClientModels/User/ViewPersonaArchive.cs

@@ -0,0 +1,48 @@
+namespace PrivaPub.ClientModels.User
+{
+	// A persona's archive (owner decision 2026-10-07): made for it to take away, in Mastodon's account-archive layout, and
+	// restored into it. States: none, queued, running, ready (export) or done (import), failed, stopped.
+	public class ViewPersonaArchive
+	{
+		public string ExportState { get; set; }
+		public DateTime? ExportAskedAt { get; set; }
+		public DateTime? ExportReadyAt { get; set; }
+		public DateTime? ExportExpiresAt { get; set; }
+		public long ExportBytes { get; set; }
+		public string ExportError { get; set; }
+
+		public string ImportState { get; set; }
+		public DateTime? ImportAskedAt { get; set; }
+		public DateTime? ImportEndedAt { get; set; }
+		public List<string> ImportParts { get; set; } = [];
+		public long ImportDone { get; set; }
+		public long ImportTotal { get; set; }
+		public Dictionary<string, int> ImportCounts { get; set; } = [];//what was imported and what skipped, by why
+		public string ImportError { get; set; }
+		public string ImportFrom { get; set; }//the archive's actor
+		public bool ImportSameActor { get; set; }
+	}
+
+	// the parts of an archive to import: posts (with their media), profile, follows, blocks, mutes, domainblocks, lists,
+	// bookmarks, filters, tags, notificationpolicy, pins; and only when asked, located, scheduled, likes (which tell their
+	// authors)
+	public class ImportPersonaArchiveForm
+	{
+		public string UploadId { get; set; }
+		public List<string> Parts { get; set; } = [];
+	}
+
+	public class ViewArchiveTicket
+	{
+		public string Url { get; set; }
+		public DateTime ExpiresAt { get; set; }
+		public long Bytes { get; set; }
+	}
+
+	public class ViewArchiveUpload
+	{
+		public string Id { get; set; }
+		public long Received { get; set; }
+		public long ChunkBytes { get; set; }
+	}
+}

PrivaPub.ClientModels/User/ViewStorage.cs

@@ -0,0 +1,11 @@
+namespace PrivaPub.ClientModels.User
+{
+	// /clientapi/user/storage: what the login's media take (every persona's uploads and pictures), and its quota when the
+	// server sets one
+	public class ViewStorage
+	{
+		public long MediaBytes { get; set; }
+		public long MediaFiles { get; set; }
+		public long? QuotaBytes { get; set; }
+	}
+}

PrivaPub.Tests/Domain/ContentRendererTests.cs

@@ -60,6 +60,7 @@ namespace PrivaPub.Tests.Domain
 		{
 			public string BaseAddress => Base;
 
+			public Task<GoneActor> Gone(string userName, CancellationToken token) => Task.FromResult<GoneActor>(default);
 			public Task<LocalActor> FindByUserName(string userName, CancellationToken token) =>
 				Task.FromResult(userName.Equals("alice", StringComparison.OrdinalIgnoreCase)
 					? new LocalActor { Id = "a1", UserName = "alice", BaseAddress = Base, Kind = LocalActorKind.Person }
@@ -67,7 +68,10 @@ namespace PrivaPub.Tests.Domain
 
 			public Task<LocalActor> FindById(LocalActorKind kind, string id, CancellationToken token) => throw new NotSupportedException();
 			public Task<LocalActor> FindByUri(string actorUri, CancellationToken token) => throw new NotSupportedException();
+			public Task<LocalActor> FindByAddress(string address, CancellationToken token) => throw new NotSupportedException();
 			public Task<LocalActor> GetInstanceActor(CancellationToken token) => throw new NotSupportedException();
+			public Task<LocalActor> GetReporterActor(CancellationToken token) => throw new NotSupportedException();
+			public Task<LocalActor> GetReaderActor(CancellationToken token) => throw new NotSupportedException();
 			public Task<bool> IsUserNameTaken(string userName, CancellationToken token) => throw new NotSupportedException();
 			public Task<bool> TryReserveUserName(string userName, LocalActorKind kind, string ownerId, CancellationToken token) => throw new NotSupportedException();
 			public LocalActor FromAvatar(Avatar avatar) => throw new NotSupportedException();

PrivaPub.Tests/Domain/MediaFlowTests.cs

@@ -1,3 +1,4 @@
+using PrivaPub.Models.Federation;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Caching.Memory;
 
@@ -46,7 +47,7 @@ namespace PrivaPub.Tests.Domain
 			var (_, alice) = await _harness.Persona("alice");
 			var (_, mallory) = await _harness.Persona("mallory");
 
-			var upload = await _harness.Media.Upload(alice, Upload(Png(300, 200), "image/png"), "a blue square", "0.25,-0.5", token);
+			var upload = await _harness.Media.Upload(alice, Upload(Png(300, 200), "image/png"), "a blue square", "0.25,-0.5", false, token);
 			Assert.True(upload.Ok);
 			Assert.True(File.Exists(Path.Combine(_harness.Media.Root, upload.Attachment.FilePath)));
 
@@ -73,7 +74,7 @@ namespace PrivaPub.Tests.Domain
 		{
 			var (_, alice) = await _harness.Persona("alice");
 
-			var outcome = await _harness.Media.Upload(alice, Upload(System.Text.Encoding.UTF8.GetBytes("<svg/>"), "image/svg+xml"), default, default, TestContext.Current.CancellationToken);
+			var outcome = await _harness.Media.Upload(alice, Upload(System.Text.Encoding.UTF8.GetBytes("<svg/>"), "image/svg+xml"), default, default, false, TestContext.Current.CancellationToken);
 
 			Assert.False(outcome.Ok);
 			Assert.Equal(422, outcome.Status);
@@ -98,5 +99,62 @@ namespace PrivaPub.Tests.Domain
 			Assert.StartsWith(_harness.Media.ProxyRoot, file);
 			Assert.Null(tampered);
 		}
+
+		// a login over its quota uploads nothing more, whichever persona tries
+		[Fact]
+		public async Task A_login_over_its_quota_uploads_nothing_more()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var (_, sibling) = await _harness.Persona("sibling", root);
+			var quota = new MediaService(new StaticOptions<MediaOptions>(new MediaOptions { Root = _harness.Media.Root, QuotaBytesPerRoot = 3000 }),
+				_harness.Local, default, Microsoft.Extensions.Logging.Abstractions.NullLogger<MediaService>.Instance);
+			// noise: its PNG is about as big as its pixels, so two of them are over the quota and one is not
+			static byte[] Noise()
+			{
+				var pixels = new byte[30 * 20 * 3];
+				Random.Shared.NextBytes(pixels);
+				using var image = NetVips.Image.NewFromMemory(pixels, 30, 20, 3, NetVips.Enums.BandFormat.Uchar);
+				return image.WriteToBuffer(".png");
+			}
+
+			Assert.True((await quota.Upload(alice, Upload(Noise(), "image/png"), default, default, false, token)).Ok);
+			var full = await quota.Upload(sibling, Upload(Noise(), "image/png"), default, default, false, token);
+
+			Assert.False(full.Ok);
+			Assert.Contains("storage is full", full.Error);
+		}
+
+		// nothing of a suspended server, or of one whose media are rejected, is proxied; blocking one purges what was cached
+		[Fact]
+		public async Task A_blocked_servers_media_are_not_proxied_and_their_cache_goes()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var path = $"/files/{Guid.NewGuid():N}.png";
+			_harness.Peer.ServeFile(path, Png(10, 10), "image/png");
+			var remote = _harness.Peer.A + path;
+			var host = new Uri(remote).Host;
+			var blocks = new Blocks();
+			var proxy = new MediaProxy(_harness.Local, Peer.Http(), _harness.Media, new StaticOptions<MediaOptions>(new MediaOptions()), blocks);
+			Assert.Equal(ProxyOutcome.Cached, (await proxy.Download(remote, token)).Outcome);
+
+			blocks.Blocked[host] = new DomainBlock { Domain = host, Severity = DomainBlockSeverity.Silence, RejectMedia = true };
+			Assert.True(proxy.Refuses(remote));
+			Assert.True(proxy.Purge(host) >= 1);
+			Assert.Equal(default, proxy.Cached(remote));
+
+			blocks.Blocked[host] = new DomainBlock { Domain = host, Severity = DomainBlockSeverity.Silence };
+			Assert.False(proxy.Refuses(remote));
+			blocks.Blocked[host] = new DomainBlock { Domain = host, Severity = DomainBlockSeverity.Suspend };
+			Assert.True(proxy.Refuses(remote));
+		}
+
+		sealed class Blocks : PrivaPub.Federation.Moderation.IDomainBlocks
+		{
+			public Dictionary<string, DomainBlock> Blocked { get; } = new();
+			public DomainBlock Find(string host) => Blocked.GetValueOrDefault(host);
+			public bool IsSuspended(string host) => Find(host)?.Severity == DomainBlockSeverity.Suspend;
+			public Task Reload(CancellationToken token) => Task.CompletedTask;
+		}
 	}
 }

PrivaPub.Tests/Domain/MediaProcessingTests.cs

@@ -19,6 +19,37 @@ namespace PrivaPub.Tests.Domain
 			return tagged.WriteToBuffer(".jpg");
 		}
 
+		// SVG, PDF and the other formats libvips could read never load from an upload, whatever it claims to be
+		[Fact]
+		public void Only_the_upload_formats_are_ever_loaded()
+		{
+			var svg = "<svg xmlns='http://www.w3.org/2000/svg' width='20000' height='20000'><rect width='10' height='10'/></svg>"u8.ToArray();
+			Assert.Throws<VipsException>(() => MediaService.Inspect(svg));
+			Assert.Throws<VipsException>(() => MediaService.Inspect("%PDF-1.4\n1 0 obj<<>>endobj\ntrailer<<>>\n%%EOF"u8.ToArray()));
+			using var colour = (Image.Black(8, 8, bands: 3) + 100).Cast(Enums.BandFormat.Uchar);
+			foreach (var format in new[] { ".jpg", ".png", ".gif", ".webp" })
+				Assert.Equal(8, MediaService.Inspect(colour.WriteToBuffer(format)).Width);
+			Assert.Throws<VipsException>(() => MediaService.Inspect(colour.WriteToBuffer(".tif")));
+		}
+
+		// the header tells how big an image would decode before anything is decoded
+		[Fact]
+		public void The_header_says_how_big_an_image_would_decode()
+		{
+			using var huge = Image.Black(8000, 6000);
+			var header = MediaService.Inspect(huge.WriteToBuffer(".png"));
+			Assert.Equal(48_000_000, header.Pixels);
+			Assert.False(header.Animated);
+
+			using var frame = (Image.Black(40, 30, bands: 3) + 60).Cast(Enums.BandFormat.Uchar);
+			using var frames = Image.Arrayjoin(new[] { frame, frame + 80, frame + 160 }, across: 1).Cast(Enums.BandFormat.Uchar);
+			using var paged = frames.Mutate(m => m.Set(GValue.GIntType, "page-height", 30));
+			var gif = MediaService.Inspect(paged.WriteToBuffer(".gif"));
+			Assert.True(gif.Animated);
+			Assert.Equal(3, gif.Pages);
+			Assert.Equal(40 * 30 * 3, gif.Pixels);
+		}
+
 		[Fact]
 		public void Uploaded_images_lose_every_kind_of_metadata()
 		{
@@ -26,7 +57,7 @@ namespace PrivaPub.Tests.Domain
 			using (var original = Image.NewFromBuffer(input))
 				Assert.Contains("exif-data", original.GetFields());
 
-			var processed = MediaService.ProcessImage(input, 4096, 640, animated: false);
+			var processed = MediaService.ProcessImage(input, 4096, 640);
 
 			using var output = Image.NewFromBuffer(processed.Bytes);
 			var fields = output.GetFields();
@@ -44,7 +75,7 @@ namespace PrivaPub.Tests.Domain
 		[Fact]
 		public void Large_images_are_capped()
 		{
-			var processed = MediaService.ProcessImage(JpegWithMetadata(5000, 2500), 4096, 640, animated: false);
+			var processed = MediaService.ProcessImage(JpegWithMetadata(5000, 2500), 4096, 640);
 
 			Assert.Equal((4096, 2048), (processed.Width, processed.Height));
 		}
@@ -52,7 +83,7 @@ namespace PrivaPub.Tests.Domain
 		[Fact]
 		public void A_blurhash_is_well_formed()
 		{
-			var processed = MediaService.ProcessImage(JpegWithMetadata(64, 64), 4096, 640, animated: false);
+			var processed = MediaService.ProcessImage(JpegWithMetadata(64, 64), 4096, 640);
 
 			Assert.Equal(28, processed.Blurhash.Length);
 			Assert.Equal('L', processed.Blurhash[0]);

PrivaPub.Tests/Domain/NearbyTests.cs

@@ -59,6 +59,8 @@ namespace PrivaPub.Tests.Domain
 				.Select(j => JsonSerializer.Deserialize<DeliveryPayload>(j.Payload))
 				.Where(p => p.Body.Contains(post.ID));
 			Assert.Empty(outgoing);
+			// nor reaches a home, its author's included: the Mastodon API looks past it, so there it could not be acted on
+			Assert.False(await DB.Default.Find<PrivaPub.Models.Social.TimelineEntry>().Match(e => e.PostId == post.ID).ExecuteAnyAsync(token));
 		}
 
 		[Fact]

PrivaPub.Tests/Domain/OutboxTests.cs

@@ -65,6 +65,8 @@ namespace PrivaPub.Tests.Domain
 			var sent = await _harness.Outgoing(follower.SharedInbox);
 			Assert.Equal(new[] { "Create", "Update", "Delete" }, sent.Select(a => a["type"]!.GetValue<string>()));
 			Assert.DoesNotContain(sent[0]["to"]!.AsArray(), n => n!.GetValue<string>().EndsWith("#Public"));
+			// Pleroma reads an empty cc without a "/followers" address as a direct message
+			Assert.Contains(sent[0]["object"]!["cc"]!.AsArray(), n => n!.GetValue<string>() == alice.Followers);
 			Assert.Equal("cw", sent[1]["object"]!["summary"]!.GetValue<string>());
 			Assert.NotNull(sent[1]["object"]!["updated"]);
 			Assert.Equal(sent[0]["to"]!.ToJsonString(), sent[2]["to"]!.ToJsonString());

PrivaPub.Tests/Federation/ActorFeaturesTests.cs

@@ -0,0 +1,50 @@
+using PrivaPub.Federation.Actors;
+
+using System.Security.Cryptography;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class ActorFeaturesTests
+	{
+		[Fact]
+		public void A_rich_actor_reports_the_extensions_it_uses()
+		{
+			using var rsa = RSA.Create(4096);
+			var actor = new JsonObject
+			{
+				["id"] = "https://social.example/users/a",
+				["type"] = "Person",
+				["featured"] = "https://social.example/users/a/featured",
+				["alsoKnownAs"] = new JsonArray("https://old.example/users/a"),
+				["endpoints"] = new JsonObject { ["sharedInbox"] = "https://social.example/inbox" },
+				["assertionMethod"] = new JsonArray(),
+				["attachment"] = new JsonArray(new JsonObject { ["type"] = "PropertyValue", ["name"] = "x", ["value"] = "y" }),
+				["manuallyApprovesFollowers"] = true,
+				["discoverable"] = false,
+				["indexable"] = true,
+				["isCat"] = true,
+				["_misskey_summary"] = "hi",
+				["publicKey"] = new JsonObject { ["id"] = "https://social.example/users/a#main-key", ["publicKeyPem"] = rsa.ExportSubjectPublicKeyInfoPem() }
+			};
+
+			var features = ActorFeatures.Detect(JsonDocument.Parse(actor.ToJsonString()).RootElement);
+
+			Assert.Equal(new[]
+			{
+				"featured", "also-known-as", "shared-inbox", "fep-521a-assertion-method", "property-value", "misskey", "is-cat",
+				"indexable", "undiscoverable", "locked", "key:rsa-4096"
+			}, features);
+		}
+
+		[Fact]
+		public void A_bare_actor_reports_nothing_and_junk_is_survived()
+		{
+			Assert.Empty(ActorFeatures.Detect(JsonDocument.Parse("{\"id\":\"https://a.example/u\",\"type\":\"Person\"}").RootElement));
+			Assert.Equal(new[] { "public-key-array" },
+				ActorFeatures.Detect(JsonDocument.Parse("{\"publicKey\":[{\"publicKeyPem\":\"not a key\"}]}").RootElement));
+			Assert.Empty(ActorFeatures.Detect(JsonDocument.Parse("[1,2]").RootElement));
+		}
+	}
+}

PrivaPub.Tests/Federation/AuthorGoneTests.cs

@@ -0,0 +1,277 @@
+using MongoDB.Entities;
+
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.FederatedSeeds;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class AuthorGoneRuleTests
+	{
+		[Fact]
+		public async Task A_post_whose_author_is_gone_is_neither_shown_nor_public_nor_seen_by_anyone()
+		{
+			var gone = new Post { Visibility = PostVisibility.Public, AuthorGone = true, GroupUserId = "alice" };
+
+			Assert.False(VisibilityPolicy.Shown(gone));
+			Assert.False(VisibilityPolicy.IsPublic.Compile()(gone));
+			Assert.False(await VisibilityPolicy.CanSee(gone, default, TestContext.Current.CancellationToken));
+			Assert.False(await VisibilityPolicy.CanSee(gone, "alice", TestContext.Current.CancellationToken));
+			Assert.True(VisibilityPolicy.Shown(new Post()));
+			Assert.False(VisibilityPolicy.Shown(new Post { DeletedAt = DateTime.UtcNow }));
+			Assert.False(VisibilityPolicy.Shown(default));
+		}
+	}
+
+	[Trait("Category", "Integration")]
+	public sealed class AuthorGoneTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		async Task<Post> Delivered(RemoteActor author, JsonObject note)
+		{
+			await _harness.Deliver(author, "/human-centipede", Create(author, note));
+			return await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(note)).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+		}
+
+		[Fact]
+		public async Task Deleting_itself_keeps_every_post_of_the_account_but_hides_them_and_drops_its_follows_and_rows()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var ghost = new RemoteActor(_harness.Peer, "ghost");
+			var friend = new RemoteActor(_harness.Peer, "friend");
+			await Follows(alice.Id, ghost);
+			await Follows(alice.Id, friend);
+			await _harness.FollowedBy(alice, ghost);
+			var post = await Delivered(ghost, PublicNote(ghost, "<p>soon gone</p>"));
+			var friends = await Delivered(friend, PublicNote(friend, "<p>still here</p>"));
+			await _harness.Deliver(ghost, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(ghost, "announces"), ["type"] = "Announce", ["actor"] = ghost.Id, ["object"] = friends.ObjectURI,
+				["to"] = new JsonArray(Addressing.Public)
+			});
+			var ghostAccount = await DB.Default.Find<ForeignAvatar>().Match(f => f.ActorURI == ghost.Id).ExecuteSingleAsync(token);
+			Assert.True(await DB.Default.Find<TimelineEntry>().Match(e => e.AvatarId == alice.Id && e.AuthorAccountId == ghostAccount.ID).ExecuteAnyAsync(token));
+
+			Assert.Equal(202, (await _harness.Deliver(ghost, "/human-centipede", Activity(ghost, "Delete", JsonValue.Create(ghost.Id)!))).StatusCode);
+
+			var kept = await DB.Default.Find<Post>().Match(p => p.ActorURI == ghost.Id).ExecuteAsync(token);
+			Assert.Equal(2, kept.Count);
+			Assert.All(kept, p => Assert.True(p.AuthorGone));
+			Assert.Contains(kept, p => p.ID == post.ID && p.ContentHtml == "<p>soon gone</p>");
+			Assert.Contains(kept, p => p.ReblogOfPostId == friends.ID);
+			Assert.False((await DB.Default.Find<Post>().OneAsync(friends.ID, token)).AuthorGone);
+			Assert.All(kept, p => Assert.False(VisibilityPolicy.Shown(p)));
+			foreach (var hidden in kept)
+				Assert.False(await VisibilityPolicy.CanSee(hidden, alice.Id, token));
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ActorURI == ghost.Id).Match(VisibilityPolicy.IsPublic).ExecuteAnyAsync(token));
+
+			Assert.Equal(AvatarAccountState.Deleted, (await DB.Default.Find<ForeignAvatar>().OneAsync(ghostAccount.ID, token)).AccountState);
+			Assert.False(await DB.Default.Find<Follower>().Match(f => f.ActorURI == ghost.Id).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<Following>().Match(f => f.TargetActorURI == ghost.Id).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<TimelineEntry>().Match(e => e.AuthorAccountId == ghostAccount.ID).ExecuteAnyAsync(token));
+
+			var mapper = new MastodonMapper(_harness.Db, _harness.Local);
+			Assert.Empty(await mapper.Statuses(kept, alice.Id, token));
+			var home = (List<PrivaPub.ClientModels.Post.ViewPost>)(await _harness.Timelines.Home(root, alice.Id, default, 40, token)).Data;
+			Assert.DoesNotContain(home, v => v.AuthorActorURI == ghost.Id);
+			Assert.Contains(home, v => v.Id == friends.ID);
+		}
+
+		[Fact]
+		public async Task A_post_by_an_account_already_gone_is_hidden_from_the_moment_it_is_stored()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var ghost = new RemoteActor(_harness.Peer, "ghost");
+			await _harness.FollowedBy(alice, ghost);
+			await _harness.Deliver(ghost, "/human-centipede", Activity(ghost, "Delete", JsonValue.Create(ghost.Id)!));
+			var late = PublicNote(ghost, "<p>from beyond</p>");
+			_harness.Peer.Serve(new Uri(IdOf(late)).AbsolutePath, late.ToJsonString());
+
+			var stored = await _harness.RemotePosts.StoreContext(IdOf(late), 0, token);
+
+			Assert.NotNull(stored);
+			Assert.True(stored.AuthorGone);
+			Assert.False(await VisibilityPolicy.CanSee(stored, alice.Id, token));
+		}
+	}
+
+	[Trait("Category", "Integration")]
+	public sealed class AuthorGoneOverHttpTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		static async Task<(HttpStatusCode Status, JsonNode Body)> Get(HttpClient client, string path)
+		{
+			var response = await client.GetAsync(path, TestContext.Current.CancellationToken);
+			var text = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+			return (response.StatusCode, string.IsNullOrEmpty(text) || response.Content.Headers.ContentType?.MediaType?.Contains("json") != true ? default : JsonNode.Parse(text));
+		}
+
+		static async Task<List<string>> Ids(HttpClient client, string path)
+		{
+			var (status, body) = await Get(client, path);
+			Assert.Equal(HttpStatusCode.OK, status);
+			return body!.AsArray().Select(s => IdOf(s!)).ToList();
+		}
+
+		static async Task<bool> Found(HttpClient client, string path) => (await Get(client, path)).Status == HttpStatusCode.OK;
+
+		sealed record Seen(bool Status, bool Context, bool FavouritedBy, bool RebloggedBy, bool History, bool Many, bool Boost, bool InAncestors,
+			bool BoostersListed, bool OnProfile, bool OnTag, bool OnPublic, bool OnHome, bool Notified, bool InConversation, bool Searched,
+			bool Favourited, bool Bookmarked, bool Provenance, bool InCommunityOutbox);
+
+		[Fact]
+		public async Task Every_lookup_treats_a_post_whose_author_deleted_itself_as_not_found()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var persona = await _host.Persona(await _host.SignUp(), "reader");
+			var bearer = await _host.MastodonToken(persona);
+			using var client = _host.As(bearer);
+			var (privateKey, publicKey) = PrivaPub.Federation.Actors.Keys.NewKeyPair();
+			var community = new GroupEntity
+			{
+				UserName = $"commons{Guid.NewGuid():N}"[..20], Kind = GroupKind.Community, PostingPolicy = PostingPolicy.Anyone,
+				PrivateKey = privateKey, PublicKey = publicKey, Members = new() { new GroupMember { AvatarId = persona.Id, Role = GroupRole.Owner } }
+			};
+			await DB.Default.SaveAsync(community, token);
+			var personaUri = $"{PrivaPubHost.Base}/peasants/{persona.UserName}";
+			var communityUri = $"{PrivaPubHost.Base}/peasants/{community.UserName}";
+			var ghost = new RemoteActor(_peer, "ghost");
+			var friend = new RemoteActor(_peer, "friend");
+			await Follows(persona.Id, ghost);
+			await Follows(persona.Id, friend);
+			var tag = $"gone{Guid.NewGuid():N}"[..16];
+
+			var note = PublicNote(ghost, $"<p>hello #{tag}</p>", personaUri, communityUri);
+			note["tag"] = new JsonArray(
+				new JsonObject { ["type"] = "Mention", ["href"] = personaUri, ["name"] = "@reader" },
+				new JsonObject { ["type"] = "Hashtag", ["name"] = "#" + tag, ["href"] = $"{Origin(ghost)}/tags/{tag}" });
+			Assert.Equal(HttpStatusCode.Accepted, await DeliverSigned(_host, ghost, Create(ghost, note)));
+			var friendsNote = PublicNote(friend, "<p>a friend's post</p>");
+			await DeliverSigned(_host, friend, Create(friend, friendsNote));
+			var reply = PublicNote(friend, "<p>a reply</p>");
+			reply["inReplyTo"] = IdOf(note);
+			await DeliverSigned(_host, friend, Create(friend, reply));
+			await DeliverSigned(_host, friend, new JsonObject
+			{
+				["id"] = NewId(friend, "announces"), ["type"] = "Announce", ["actor"] = friend.Id, ["object"] = IdOf(note), ["to"] = new JsonArray(Addressing.Public)
+			});
+			var ghostBoostId = NewId(ghost, "announces");
+			await DeliverSigned(_host, ghost, new JsonObject
+			{
+				["id"] = ghostBoostId, ["type"] = "Announce", ["actor"] = ghost.Id, ["object"] = IdOf(friendsNote), ["to"] = new JsonArray(Addressing.Public)
+			});
+			var dm = new JsonObject
+			{
+				["id"] = NewId(ghost, "notes"), ["type"] = "Note", ["attributedTo"] = ghost.Id, ["content"] = "<p>psst</p>", ["to"] = new JsonArray(personaUri),
+				["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = personaUri, ["name"] = "@reader" })
+			};
+			await DeliverSigned(_host, ghost, Create(ghost, dm));
+
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(note)).ExecuteSingleAsync(token);
+			var friends = await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(friendsNote)).ExecuteSingleAsync(token);
+			var replyPost = await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(reply)).ExecuteSingleAsync(token);
+			var ghostBoost = await DB.Default.Find<Post>().Match(p => p.ObjectURI == ghostBoostId).ExecuteSingleAsync(token);
+			var dmPost = await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(dm)).ExecuteSingleAsync(token);
+			var ghostAccount = await DB.Default.Find<ForeignAvatar>().Match(f => f.ActorURI == ghost.Id).ExecuteSingleAsync(token);
+			Assert.Equal(community.ID, post.GroupId);
+			//search looks up https addresses only, which the peer does not have
+			var searchable = new Post
+			{
+				ObjectURI = $"https://ghost{Guid.NewGuid():N}.example/notes/1", ActorURI = ghost.Id, AuthorAccountId = ghostAccount.ID, IsFederatedCopy = true,
+				Visibility = PostVisibility.Public, ContentHtml = "<p>found by its address</p>"
+			};
+			await DB.Default.SaveAsync(searchable, token);
+			Assert.Equal(HttpStatusCode.OK, (await client.PostAsync($"/api/v1/statuses/{post.ID}/favourite", default, token)).StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await client.PostAsync($"/api/v1/statuses/{post.ID}/bookmark", default, token)).StatusCode);
+
+			async Task<Seen> Look()
+			{
+				var home = (await Get(client, "/api/v1/timelines/home?limit=40")).Body!.AsArray();
+				var notifications = (await Get(client, "/api/v1/notifications?limit=30")).Body!.AsArray();
+				var conversations = (await Get(client, "/api/v1/conversations")).Body!.AsArray();
+				var search = (await Get(client, $"/api/v2/search?type=statuses&q={Uri.EscapeDataString(searchable.ObjectURI)}")).Body!;
+				using var anonymous = _host.Client();
+				using var outboxRequest = new HttpRequestMessage(HttpMethod.Get, $"/peasants/{community.UserName}/anus?page=true");
+				outboxRequest.Headers.Accept.ParseAdd("application/activity+json");
+				var outbox = JsonNode.Parse(await (await anonymous.SendAsync(outboxRequest, token)).Content.ReadAsStringAsync(token))!;
+				return new Seen(
+					await Found(client, $"/api/v1/statuses/{post.ID}"),
+					await Found(client, $"/api/v1/statuses/{post.ID}/context"),
+					await Found(client, $"/api/v1/statuses/{post.ID}/favourited_by"),
+					await Found(client, $"/api/v1/statuses/{post.ID}/reblogged_by"),
+					await Found(client, $"/api/v1/statuses/{post.ID}/history"),
+					(await Ids(client, $"/api/v1/statuses?id[]={post.ID}")).Contains(post.ID),
+					await Found(client, $"/api/v1/statuses/{ghostBoost.ID}"),
+					(await Get(client, $"/api/v1/statuses/{replyPost.ID}/context")).Body!["ancestors"]!.AsArray().Any(a => IdOf(a!) == post.ID),
+					(await Ids(client, $"/api/v1/statuses/{friends.ID}/reblogged_by")).Contains(ghostAccount.ID),
+					(await Ids(client, $"/api/v1/accounts/{ghostAccount.ID}/statuses")).Count > 0,
+					(await Ids(client, $"/api/v1/timelines/tag/{tag}")).Contains(post.ID),
+					(await Ids(client, $"/api/v1/timelines/public?remote=true&limit=1&max_id={IdAbove(post.ID)}")).Contains(post.ID),
+					home.Any(s => IdOf(s!) == post.ID || IdOf(s!) == ghostBoost.ID || s!["reblog"] is JsonObject inner && IdOf(inner) == post.ID),
+					notifications.Any(n => n!["status"] is JsonObject status && IdOf(status) == post.ID),
+					conversations.Any(c => c!["last_status"] is JsonObject last && IdOf(last) == dmPost.ID),
+					search["statuses"]!.AsArray().Count > 0,
+					(await Ids(client, "/api/v1/favourites")).Contains(post.ID),
+					(await Ids(client, "/api/v1/bookmarks")).Contains(post.ID),
+					await Found(client, $"/api/privapub/v1/statuses/{post.ID}/provenance"),
+					outbox["orderedItems"]!.AsArray().Any(a => a!["object"]?.GetValue<string>() == post.ObjectURI));
+			}
+
+			var before = await Look();
+			Assert.Equal(HttpStatusCode.Accepted, await DeliverSigned(_host, ghost, Activity(ghost, "Delete", JsonValue.Create(ghost.Id)!)));
+			var after = await Look();
+
+			var everything = new Seen(true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true);
+			var nothing = new Seen(false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false);
+			Assert.Equal(everything, before);
+			Assert.Equal(nothing, after);
+			Assert.True(await DB.Default.Find<Post>().Match(p => p.ID == post.ID && p.AuthorGone && p.DeletedAt == null).ExecuteAnyAsync(token));
+			Assert.True(await Found(client, $"/api/v1/statuses/{friends.ID}"));
+			Assert.True(await Found(client, $"/api/v1/statuses/{replyPost.ID}"));
+		}
+	}
+}

PrivaPub.Tests/Federation/BackfillTests.cs

@@ -0,0 +1,78 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// a follow that holds reads the account's latest public posts from its outbox, so its profile is not empty
+	[Trait("Category", "Integration")]
+	public sealed class BackfillTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task An_accepted_follow_reads_the_accounts_latest_public_posts_from_its_outbox()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var mallory = new RemoteActor(_harness.Peer, "mallory", _harness.Peer.B);
+			var origin = new Uri(bob.Id).GetLeftPart(UriPartial.Authority);
+			JsonObject Note(string id, string text, RemoteActor author) => new()
+			{
+				["id"] = id, ["type"] = "Note", ["attributedTo"] = author.Id, ["content"] = $"<p>{text}</p>",
+				["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public"), ["published"] = DateTime.UtcNow.ToString("O")
+			};
+			var older = $"{origin}/notes/{Guid.NewGuid():N}";
+			var newer = $"{origin}/notes/{Guid.NewGuid():N}";
+			var notBobs = $"{new Uri(mallory.Id).GetLeftPart(UriPartial.Authority)}/notes/{Guid.NewGuid():N}";
+			_harness.Peer.Serve(new Uri(older).AbsolutePath, Note(older, "an older post", bob).ToJsonString());
+			_harness.Peer.Serve(new Uri(newer).AbsolutePath, Note(newer, "a newer post", bob).ToJsonString());
+			_harness.Peer.Serve(new Uri(bob.Id).AbsolutePath + "/outbox", new JsonObject
+			{
+				["id"] = bob.Id + "/outbox", ["type"] = "OrderedCollection", ["totalItems"] = 4,
+				["orderedItems"] = new JsonArray(
+					new JsonObject { ["type"] = "Create", ["object"] = Note(newer, "a newer post", bob) },
+					new JsonObject { ["type"] = "Announce", ["object"] = notBobs },
+					new JsonObject { ["type"] = "Create", ["object"] = notBobs },
+					new JsonObject { ["type"] = "Create", ["object"] = older })
+			}.ToJsonString());
+			var account = await _harness.Remote.GetActor(bob.Id, refresh: false, token);
+			var followId = alice.ActivityUri($"follow-{Guid.NewGuid():N}");
+			await DB.Default.SaveAsync(new Following
+			{
+				AvatarId = alice.Id, TargetActorURI = bob.Id, TargetAccountId = account.ID, State = FollowState.Requested, FollowActivityURI = followId
+			}, token);
+
+			await _harness.Deliver(bob, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{bob.Id}#accept-{Guid.NewGuid():N}", ["type"] = "Accept", ["actor"] = bob.Id,
+				["object"] = new JsonObject { ["id"] = followId, ["type"] = "Follow", ["actor"] = alice.Uri, ["object"] = bob.Id }
+			});
+			var job = await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.BackfillOutbox && j.Payload == bob.Id).ExecuteSingleAsync(token);
+			await new OutboxBackfill(_harness.Db, _harness.Remote, _harness.RemotePosts).Handle(job, token);
+
+			var held = (await DB.Default.Find<Post>().Match(p => p.ActorURI == bob.Id).ExecuteAsync(token)).Select(p => p.ObjectURI).ToHashSet();
+			Assert.Equal(new HashSet<string> { older, newer }, held);
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ObjectURI == notBobs).ExecuteAnyAsync(token));
+		}
+	}
+}

PrivaPub.Tests/Federation/ChatMessageSoftwareTests.cs

@@ -0,0 +1,75 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// alone in its collection: every test's peer is 127.0.0.1, and the server row it writes decides for whoever writes there
+	[Trait("Category", "Integration")]
+	[Xunit.Collection(nameof(Exclusive))]
+	public sealed class ChatMessageSoftwareTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string NewId(RemoteActor actor, string kind) => $"{new Uri(actor.Id).GetLeftPart(UriPartial.Authority)}/{kind}/{Guid.NewGuid():N}";
+
+		// the one decision taken by a server's software (owner decision 2026-10-05): Lemmy before 1.0 and Mbin get a
+		// ChatMessage even from a persona answering a Note; Lemmy 1.0 a Note
+		[Theory]
+		[InlineData("lemmy", "0.19.20", "ChatMessage")]
+		[InlineData("mbin", "1.10.1", "ChatMessage")]
+		[InlineData("lemmy", "1.0.0-beta.2", "Note")]
+		public async Task A_direct_message_to_lemmy_before_1_0_or_mbin_is_a_chat_message(string software, string version, string sent)
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var sender = new RemoteActor(_harness.Peer, "pm");
+			var host = new Uri(sender.Id).Host;
+			await DB.Default.DeleteAsync<PrivaPub.Models.Jobs.RemoteInstance>(i => i.Host == host);
+			await DB.Default.SaveAsync(new PrivaPub.Models.Jobs.RemoteInstance { Host = host, Software = software, SoftwareVersion = version }, token);
+			try
+			{
+				var id = NewId(sender, "messages");
+				await _harness.Deliver(sender, "/human-centipede", new JsonObject
+				{
+					["id"] = NewId(sender, "activities/create"), ["type"] = "Create", ["actor"] = sender.Id, ["to"] = new JsonArray(alice.Uri),
+					["object"] = new JsonObject
+					{
+						["id"] = id, ["type"] = "Note", ["attributedTo"] = sender.Id, ["to"] = new JsonArray(alice.Uri),
+						["content"] = "<p>psst</p>", ["published"] = DateTime.UtcNow.ToString("O")
+					}
+				});
+				var message = await DB.Default.Find<Post>().Match(p => p.ObjectURI == id).ExecuteSingleAsync(token);
+
+				var answer = await _harness.Statuses.Publish(alice, new PrivaPub.Domain.Statuses.StatusDraft
+				{
+					Text = "psst back", Visibility = PostVisibility.Direct, ConversationId = message.ConversationId
+				}, token);
+
+				Assert.True(answer.Ok, answer.Error);
+				var create = (await _harness.Outgoing(sender.Id + "/inbox")).Last(a => a["type"]!.GetValue<string>() == "Create");
+				Assert.Equal(sent, create["object"]!["type"]!.GetValue<string>());
+			}
+			finally
+			{
+				await DB.Default.DeleteAsync<PrivaPub.Models.Jobs.RemoteInstance>(i => i.Host == host);
+			}
+		}
+	}
+}

PrivaPub.Tests/Federation/CommunityEditsTests.cs

@@ -0,0 +1,223 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class CommunityEditsTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		// a post in a community the persona follows; the community on the poster's server unless another origin is given
+		async Task<(RemoteActor Community, RemoteActor Poster, JsonObject Note, Post Post)> Announced(string communityOrigin = default)
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var community = new RemoteActor(_harness.Peer, "cats", communityOrigin, type: "Group");
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = community.Id }, token);
+			await DB.Default.Update<Following>().Match(f => f.AvatarId == alice.Id).Modify(f => f.State, FollowState.Accepted).ExecuteAsync(token);
+			var note = new JsonObject
+			{
+				["id"] = $"{Origin(poster)}/notes/{Guid.NewGuid():N}",
+				["type"] = "Page",
+				["name"] = "a title",
+				["attributedTo"] = poster.Id,
+				["content"] = "<p>first</p>",
+				["to"] = new JsonArray(community.Id, Addressing.Public),
+				["audience"] = community.Id,
+				["published"] = DateTime.UtcNow.AddMinutes(-5).ToString("O")
+			};
+			_harness.Peer.Serve(new Uri(note["id"]!.GetValue<string>()).AbsolutePath, note.ToJsonString());
+			await Announce(community, new JsonObject { ["id"] = $"{Origin(poster)}/create/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = poster.Id, ["object"] = note.DeepClone() });
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == note["id"]!.GetValue<string>()).ExecuteSingleAsync(token);
+			return (community, poster, note, post);
+		}
+
+		Task Announce(RemoteActor community, JsonObject inner) =>
+			_harness.Deliver(community, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(community)}/announce/{Guid.NewGuid():N}",
+				["type"] = "Announce",
+				["actor"] = community.Id,
+				["to"] = new JsonArray(Addressing.Public),
+				["object"] = inner
+			});
+
+		[Fact]
+		public async Task A_community_edit_is_an_edit_only_when_newer_and_keeps_its_history()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (community, poster, note, post) = await Announced();
+
+			var refresh = (JsonObject)note.DeepClone();
+			_harness.Peer.Serve(new Uri(note["id"]!.GetValue<string>()).AbsolutePath, refresh.ToJsonString());
+			await Announce(community, new JsonObject { ["id"] = $"{Origin(poster)}/update/{Guid.NewGuid():N}", ["type"] = "Update", ["actor"] = poster.Id, ["object"] = note["id"]!.GetValue<string>() });
+			var afterRefresh = await DB.Default.Find<Post>().OneAsync(post.ID, token);
+
+			var edit = (JsonObject)note.DeepClone();
+			edit["content"] = "<p>second</p>";
+			edit["updated"] = DateTime.UtcNow.ToString("O");
+			_harness.Peer.Serve(new Uri(note["id"]!.GetValue<string>()).AbsolutePath, edit.ToJsonString());
+			await Announce(community, new JsonObject { ["id"] = $"{Origin(poster)}/update/{Guid.NewGuid():N}", ["type"] = "Update", ["actor"] = poster.Id, ["object"] = note["id"]!.GetValue<string>() });
+			var afterEdit = await DB.Default.Find<Post>().OneAsync(post.ID, token);
+			var record = await DB.Default.Find<ObjectRecord>().Match(r => r.ObjectURI == post.ObjectURI).ExecuteSingleAsync(token);
+
+			Assert.Empty(afterRefresh.Revisions);
+			Assert.Null(afterRefresh.EditedAt);
+			Assert.Equal("<p>second</p>", afterEdit.ContentHtml);
+			Assert.Equal("a title", afterEdit.Title);
+			Assert.Single(afterEdit.Revisions);
+			Assert.NotNull(afterEdit.EditedAt);
+			Assert.Equal(2, record.Revisions.Count);
+			Assert.Equal(new[] { "refresh", "edit" }, _harness.Ledger.Of("in").Where(e => e.Activity == "Announce" && e.Object == "Update").Select(e => e.Reason));
+		}
+
+		[Fact]
+		public async Task A_community_delete_leaves_a_tombstone_and_no_trace()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (community, poster, note, post) = await Announced();
+			_harness.Peer.Serve(new Uri(note["id"]!.GetValue<string>()).AbsolutePath, new JsonObject { ["id"] = note["id"]!.GetValue<string>(), ["type"] = "Tombstone" }.ToJsonString());
+
+			await Announce(community, new JsonObject { ["id"] = $"{Origin(poster)}/delete/{Guid.NewGuid():N}", ["type"] = "Delete", ["actor"] = poster.Id, ["object"] = note["id"]!.GetValue<string>() });
+
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ID == post.ID).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<ObjectRecord>().Match(r => r.ObjectURI == post.ObjectURI).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<TimelineEntry>().Match(e => e.PostId == post.ID).ExecuteAnyAsync(token));
+			Assert.True(await DB.Default.Find<DeletedObject>().Match(d => d.ObjectURI == post.ObjectURI).ExecuteAnyAsync(token));
+		}
+
+		// PieFed keeps serving a thread its moderator removed: a community on the post's own server speaks for it
+		[Fact]
+		public async Task A_removal_a_community_on_the_posts_server_announces_is_taken_though_the_post_is_still_served()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (community, poster, note, post) = await Announced();
+
+			await Announce(community, new JsonObject
+			{
+				["id"] = $"{Origin(poster)}/delete/{Guid.NewGuid():N}", ["type"] = "Delete", ["actor"] = poster.Id,
+				["object"] = note["id"]!.GetValue<string>(), ["summary"] = "off topic"
+			});
+
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ID == post.ID).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_removal_a_community_elsewhere_announces_waits_for_the_posts_server_to_say_it_is_gone()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (community, poster, note, post) = await Announced(_harness.Peer.B);
+			var delete = new JsonObject
+			{
+				["id"] = $"{Origin(community)}/delete/{Guid.NewGuid():N}", ["type"] = "Delete", ["actor"] = community.Id,
+				["object"] = note["id"]!.GetValue<string>()
+			};
+
+			await Announce(community, (JsonObject)delete.DeepClone());
+			var kept = await DB.Default.Find<Post>().Match(p => p.ID == post.ID).ExecuteAnyAsync(token);
+			_harness.Peer.Serve(new Uri(note["id"]!.GetValue<string>()).AbsolutePath, new JsonObject { ["id"] = note["id"]!.GetValue<string>(), ["type"] = "Tombstone" }.ToJsonString());
+			delete["id"] = $"{Origin(community)}/delete/{Guid.NewGuid():N}";
+			await Announce(community, delete);
+
+			Assert.True(kept);
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ID == post.ID).ExecuteAnyAsync(token));
+		}
+
+		// Mbin sends a magazine's thread to its subscribers as the author's Create, and a moderator's lock as it is, with no
+		// announce: the magazine's server speaks for them, another server does not
+		[Fact]
+		public async Task A_thread_and_its_lock_that_a_followed_groups_own_server_sends_without_announcing_them_are_taken()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var magazine = new RemoteActor(_harness.Peer, "books", type: "Group");
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			var stranger = new RemoteActor(_harness.Peer, "stranger", _harness.Peer.B);
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = magazine.Id }, token);
+			await DB.Default.Update<Following>().Match(f => f.AvatarId == alice.Id).Modify(f => f.State, FollowState.Accepted).ExecuteAsync(token);
+			JsonObject Page(RemoteActor author) => new()
+			{
+				["id"] = $"{Origin(author)}/m/books/t/{Guid.NewGuid():N}", ["type"] = "Page", ["name"] = "a thread",
+				["attributedTo"] = author.Id, ["content"] = "<p>in the magazine</p>",
+				["to"] = new JsonArray(magazine.Id, Addressing.Public), ["cc"] = new JsonArray(author.Id + "/followers"),
+				["audience"] = magazine.Id, ["published"] = DateTime.UtcNow.ToString("O")
+			};
+			JsonObject Create(RemoteActor author, JsonObject page) => new()
+			{
+				["id"] = $"{Origin(author)}/f/object/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = author.Id,
+				["to"] = page["to"]!.DeepClone(), ["cc"] = page["cc"]!.DeepClone(), ["object"] = page
+			};
+			JsonObject Lock(RemoteActor moderator, string uri) => new()
+			{
+				["id"] = $"{Origin(moderator)}/f/object/{Guid.NewGuid():N}", ["type"] = "Lock", ["actor"] = moderator.Id, ["object"] = uri
+			};
+			var page = Page(poster);
+			var elsewhere = Page(stranger);
+			var uri = page["id"]!.GetValue<string>();
+
+			await _harness.Deliver(poster, "/human-centipede", Create(poster, page));
+			await _harness.Deliver(stranger, "/human-centipede", Create(stranger, elsewhere));
+			var kept = await DB.Default.Find<Post>().Match(p => p.ObjectURI == uri).ExecuteSingleAsync(token);
+			await _harness.Deliver(stranger, "/human-centipede", Lock(stranger, uri));
+			var lockedByStranger = (await DB.Default.Find<Post>().OneAsync(kept.ID, token)).LockedAt;
+			var moderator = new RemoteActor(_harness.Peer, "moderator");
+			var locking = Lock(moderator, uri);
+			await _harness.Deliver(moderator, "/human-centipede", locking);
+			var locked = (await DB.Default.Find<Post>().OneAsync(kept.ID, token)).LockedAt;
+			await _harness.Deliver(moderator, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(moderator)}/f/object/{Guid.NewGuid():N}", ["type"] = "Undo", ["actor"] = moderator.Id, ["object"] = locking.DeepClone()
+			});
+
+			Assert.Equal(magazine.Id, kept.AudienceURI);
+			Assert.True(await DB.Default.Find<TimelineEntry>().Match(e => e.PostId == kept.ID && e.AvatarId == alice.Id).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ObjectURI == elsewhere["id"]!.GetValue<string>()).ExecuteAnyAsync(token));
+			Assert.Null(lockedByStranger);
+			Assert.NotNull(locked);
+			Assert.Null((await DB.Default.Find<Post>().OneAsync(kept.ID, token)).LockedAt);
+		}
+
+		[Fact]
+		public async Task A_fetched_object_does_not_wear_the_signature_of_the_activity_that_caused_the_fetch()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, _, _, post) = await Announced();
+
+			var record = await DB.Default.Find<ObjectRecord>().Match(r => r.ObjectURI == post.ObjectURI).ExecuteSingleAsync(token);
+
+			Assert.Equal(ObjectPath.Fetched, record.Path);
+			Assert.Null(record.KeyId);
+			Assert.Null(record.SignatureScheme);
+			Assert.Empty(record.SignedHeaders);
+			Assert.Null(record.ActivityContext);
+			Assert.Equal("Announce", record.ActivityType);
+			Assert.InRange(record.ReceivedAt, DateTime.UtcNow.AddMinutes(-1), DateTime.UtcNow.AddSeconds(1));
+			Assert.Contains("fep-1b12-audience", record.Extensions);
+			Assert.NotNull(record.ContextNamespaces);
+		}
+	}
+}

PrivaPub.Tests/Federation/CommunityModerationTests.cs

@@ -0,0 +1,115 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class CommunityModerationTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(string id) => new Uri(id).GetLeftPart(UriPartial.Authority);
+
+		// a Lemmy community on the peer's first origin whose moderators collection lists the given accounts
+		RemoteActor Community(params RemoteActor[] moderators)
+		{
+			var community = new RemoteActor(_harness.Peer, "comm", type: "Group");
+			var document = community.Document();
+			document["attributedTo"] = community.Id + "/moderators";
+			_harness.Peer.Serve($"/users/{community.Name}", document.ToJsonString());
+			_harness.Peer.Serve($"/users/{community.Name}/moderators", new JsonObject
+			{
+				["id"] = community.Id + "/moderators", ["type"] = "OrderedCollection",
+				["orderedItems"] = new JsonArray(moderators.Select(m => (JsonNode)m.Id).ToArray())
+			}.ToJsonString());
+			return community;
+		}
+
+		async Task<(Post Post, PrivaPub.Federation.Actors.LocalActor Alice)> PostIn(RemoteActor community)
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			await _harness.Posts.InsertPost(root, new InsertPostForm { AvatarId = alice.Id, Text = "in the community" }, token);
+			var post = await DB.Default.Find<Post>().Match(p => p.GroupUserId == alice.Id).ExecuteFirstAsync(token);
+			await DB.Default.Update<Post>().MatchID(post.ID).Modify(p => p.AudienceURI, community.Id).ExecuteAsync(token);
+			await _harness.Remote.GetActor(community.Id, refresh: true, token);
+			return (post, alice);
+		}
+
+		JsonObject Warn(RemoteActor moderator, RemoteActor community, string persona, string post) => new()
+		{
+			["id"] = $"{Origin(moderator.Id)}/activities/warn/{Guid.NewGuid():N}", ["type"] = "Warn", ["actor"] = moderator.Id,
+			["to"] = new JsonArray(persona), ["object"] = post, ["summary"] = "please keep it civil", ["audience"] = community.Id
+		};
+
+		[Fact]
+		public async Task A_warning_from_the_communitys_moderators_reaches_the_persona_and_a_strangers_does_not()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var listed = new RemoteActor(_harness.Peer, "listedmod", origin: _harness.Peer.B);
+			var stranger = new RemoteActor(_harness.Peer, "stranger", origin: _harness.Peer.B);
+			var community = Community(listed);
+			var admin = new RemoteActor(_harness.Peer, "admin");
+			var (post, alice) = await PostIn(community);
+
+			await _harness.Deliver(stranger, "/human-centipede", Warn(stranger, community, alice.Uri, post.ObjectURI));
+			Assert.False(await DB.Default.Find<Notification>().Match(n => n.AvatarId == alice.Id && n.Type == NotificationType.ModerationWarning).ExecuteAnyAsync(token));
+
+			await _harness.Deliver(listed, "/human-centipede", Warn(listed, community, alice.Uri, post.ObjectURI));
+			var warning = await DB.Default.Find<Notification>().Match(n => n.AvatarId == alice.Id && n.Type == NotificationType.ModerationWarning).ExecuteFirstAsync(token);
+			Assert.Equal("please keep it civil", warning.Text);
+			Assert.Equal(post.ID, warning.PostId);
+
+			var adminWarning = Warn(admin, community, alice.Uri, post.ObjectURI);
+			adminWarning["summary"] = "from the server's admin";
+			await DB.Default.DeleteAsync<Notification>(n => n.AvatarId == alice.Id);
+			await _harness.Deliver(admin, "/human-centipede", adminWarning);
+			Assert.Equal("from the server's admin", (await DB.Default.Find<Notification>().Match(n => n.AvatarId == alice.Id && n.Type == NotificationType.ModerationWarning).ExecuteFirstAsync(token)).Text);
+		}
+
+		[Fact]
+		public async Task A_reports_resolution_is_kept_only_from_the_server_holding_what_was_reported()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var community = Community();
+			var (post, _) = await PostIn(community);
+			var report = new Report { PostIds = new() { post.ID }, Comment = "spam" };
+			await DB.Default.SaveAsync(report, token);
+			var flag = $"{_harness.Local.BaseAddress}/peasants/privapub_reports/grunts/flag-{report.ID}-1";
+			JsonObject Resolve(RemoteActor by) => new()
+			{
+				["id"] = $"{Origin(by.Id)}/activities/resolve/{Guid.NewGuid():N}", ["type"] = "Resolve", ["actor"] = by.Id, ["to"] = new JsonArray(community.Id),
+				["object"] = new JsonObject { ["id"] = flag, ["type"] = "Flag", ["actor"] = $"{_harness.Local.BaseAddress}/peasants/privapub_reports", ["object"] = post.ObjectURI }
+			};
+			var elsewhere = new RemoteActor(_harness.Peer, "elsewhere", origin: _harness.Peer.B);
+			var moderator = new RemoteActor(_harness.Peer, "moderator");
+
+			await _harness.Deliver(elsewhere, "/human-centipede", Resolve(elsewhere));
+			Assert.Null((await DB.Default.Find<Report>().OneAsync(report.ID, token)).RemoteResolvedAt);
+
+			await _harness.Deliver(moderator, "/human-centipede", Resolve(moderator));
+			var resolved = await DB.Default.Find<Report>().OneAsync(report.ID, token);
+			Assert.NotNull(resolved.RemoteResolvedAt);
+			Assert.Equal(moderator.Id, resolved.RemoteResolvedBy);
+			Assert.False(resolved.IsResolved);
+		}
+	}
+}

PrivaPub.Tests/Federation/ContextTests.cs

@@ -0,0 +1,32 @@
+using PrivaPub.Federation.Rendering;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// The @context on everything we send. Readers that expand JSON-LD 1.0 (Smithereen) refuse a whole document over one
+	// term only 1.1 knows, so every term stays within 1.0
+	public class ContextTests
+	{
+		static readonly string[] Containers10 = ["@list", "@set", "@index", "@language"];
+		static readonly string[] Keywords11 = ["@version", "@protected", "@propagate", "@import", "@nest", "@prefix", "@context", "@direction", "@json"];
+
+		[Fact]
+		public void Every_term_is_json_ld_1_0()
+		{
+			var terms = ActivityPubRenderer.Context().OfType<JsonObject>().Single();
+
+			foreach (var (name, definition) in terms)
+			{
+				if (definition is not JsonObject term)
+					continue;
+				if (term["@container"] is JsonValue container)
+					Assert.True(Containers10.Contains(container.GetValue<string>()), $"{name}: @container {container} is JSON-LD 1.1");
+				Assert.True(term["@container"] is null or JsonValue, $"{name}: an array of containers is JSON-LD 1.1");
+				Assert.DoesNotContain(term.Select(p => p.Key), Keywords11.Contains);
+				Assert.NotEqual("@json", term["@type"]?.GetValue<string>());
+			}
+			Assert.DoesNotContain(terms.Select(p => p.Key), Keywords11.Contains);
+		}
+	}
+}

PrivaPub.Tests/Federation/ConversationContainerTests.cs

@@ -0,0 +1,142 @@
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Tests.Federation
+{
+	// FEP-171b: a thread's owner adds a reply someone else wrote to the thread's context (Hubzilla's Add{Create}), and the
+	// reply is taken as passed on by the owner, on its own proof; an Add aimed at a collection elsewhere is not a thread's
+	[Trait("Category", "Integration")]
+	public sealed class ConversationContainerTests : IAsyncLifetime
+	{
+		const string Public = "https://www.w3.org/ns/activitystreams#Public";
+
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		static JsonObject Create(RemoteActor author, string text, string context, string inReplyTo = default)
+		{
+			var noteId = $"{Origin(author)}/item/{Guid.NewGuid():N}";
+			var note = new JsonObject
+			{
+				["id"] = noteId, ["type"] = "Note", ["attributedTo"] = author.Id, ["content"] = $"<p>{text}</p>", ["context"] = context,
+				["to"] = new JsonArray(Public), ["published"] = DateTime.UtcNow.ToString("O")
+			};
+			if (inReplyTo != default)
+				note["inReplyTo"] = inReplyTo;
+			return new JsonObject
+			{
+				["id"] = $"{Origin(author)}/activity/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = author.Id, ["to"] = new JsonArray(Public),
+				["object"] = note
+			};
+		}
+
+		async Task<bool> Held(string objectUri) => await DB.Default.Find<PostEntity>().Match(p => p.ObjectURI == objectUri).ExecuteAnyAsync(Token);
+
+		async Task RunQueued(string innerId)
+		{
+			var job = await DB.Default.Find<Job>().Match(j => j.DedupeKey == "inbox|forwarded|" + innerId && j.State == JobState.Pending).ExecuteFirstAsync(Token);
+			Assert.NotNull(job);
+			Assert.Equal(JobResult.Done, (await _harness.Processor.Handle(job, Token)).Result);
+		}
+
+		[Fact]
+		public async Task A_reply_the_threads_owner_adds_to_its_context_is_taken_on_its_proof()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var owner = new RemoteActor(_harness.Peer, "owner", ed25519: true);
+			var commenter = new RemoteActor(_harness.Peer, "commenter", ed25519: true);
+			await DB.Default.SaveAsync(new Following { AvatarId = alice.Id, TargetActorURI = owner.Id, TargetInboxURL = owner.Id + "/inbox", State = FollowState.Accepted }, Token);
+			var context = $"{Origin(owner)}/conversation/{Guid.NewGuid():N}";
+			var root = Create(owner, "a thread", context);
+			await _harness.Deliver(owner, "/human-centipede", root);
+			var rootId = root["object"]!["id"]!.GetValue<string>();
+			Assert.True(await Held(rootId));
+
+			var reply = commenter.Prove(Create(commenter, "a reply in it", context, rootId));
+			var replyId = reply["object"]!["id"]!.GetValue<string>();
+			await _harness.Deliver(owner, "/human-centipede", owner.Prove(new JsonObject
+			{
+				["id"] = $"{Origin(owner)}/activity/{Guid.NewGuid():N}", ["type"] = "Add", ["actor"] = owner.Id, ["object"] = reply,
+				["target"] = new JsonObject { ["id"] = context, ["type"] = "Collection", ["attributedTo"] = owner.Id }, ["to"] = new JsonArray(Public)
+			}));
+			await RunQueued(reply["id"]!.GetValue<string>());
+
+			var stored = await DB.Default.Find<PostEntity>().Match(p => p.ObjectURI == replyId).ExecuteFirstAsync(Token);
+			Assert.NotNull(stored);
+			Assert.Equal(commenter.Id, stored.ActorURI);
+			Assert.Equal((await DB.Default.Find<PostEntity>().Match(p => p.ObjectURI == rootId).ExecuteFirstAsync(Token)).ID, stored.AnsweringToPostId);
+		}
+
+		// Forte gives a post's Update the id of its Create, and sends it only added to the thread's context
+		[Fact]
+		public async Task An_update_added_under_its_creates_id_is_taken_as_the_edit()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var owner = new RemoteActor(_harness.Peer, "owner", ed25519: true);
+			await DB.Default.SaveAsync(new Following { AvatarId = alice.Id, TargetActorURI = owner.Id, TargetInboxURL = owner.Id + "/inbox", State = FollowState.Accepted }, Token);
+			var context = $"{Origin(owner)}/conversation/{Guid.NewGuid():N}";
+			var create = owner.Prove(Create(owner, "as first written", context));
+			JsonObject Added(JsonObject inner) => owner.Prove(new JsonObject
+			{
+				["id"] = $"{Origin(owner)}/activity/{Guid.NewGuid():N}", ["type"] = "Add", ["actor"] = owner.Id, ["object"] = inner,
+				["target"] = new JsonObject { ["id"] = context, ["type"] = "Collection", ["attributedTo"] = owner.Id }
+			});
+			await _harness.Deliver(owner, "/human-centipede", Added(create));
+			await RunQueued(create["id"]!.GetValue<string>());
+			var update = create.DeepClone().AsObject();
+			update.Remove("proof");
+			update["type"] = "Update";
+			update["object"]!["content"] = "<p>as edited</p>";
+			update["object"]!["updated"] = DateTime.UtcNow.AddSeconds(1).ToString("O");
+			owner.Prove(update);
+
+			await _harness.Deliver(owner, "/human-centipede", Added(update));
+			var job = await DB.Default.Find<Job>().Match(j => j.DedupeKey.StartsWith("inbox|forwarded|" + update["id"]!.GetValue<string>() + "|") && j.State == JobState.Pending)
+				.ExecuteFirstAsync(Token);
+			Assert.NotNull(job);
+			Assert.Equal(JobResult.Done, (await _harness.Processor.Handle(job, Token)).Result);
+
+			var noteId = create["object"]!["id"]!.GetValue<string>();
+			Assert.Contains("as edited", (await DB.Default.Find<PostEntity>().Match(p => p.ObjectURI == noteId).ExecuteFirstAsync(Token)).ContentHtml);
+		}
+
+		[Fact]
+		public async Task An_add_to_a_collection_on_another_server_is_no_threads()
+		{
+			var owner = new RemoteActor(_harness.Peer, "owner", ed25519: true);
+			var commenter = new RemoteActor(_harness.Peer, "commenter", _harness.Peer.B, ed25519: true);
+			var reply = commenter.Prove(Create(commenter, "elsewhere", $"{Origin(commenter)}/conversation/1"));
+
+			await _harness.Deliver(owner, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(owner)}/activity/{Guid.NewGuid():N}", ["type"] = "Add", ["actor"] = owner.Id, ["object"] = reply,
+				["target"] = $"{Origin(commenter)}/conversation/1"
+			});
+
+			Assert.False(await DB.Default.Find<Job>().Match(j => j.DedupeKey == "inbox|forwarded|" + reply["id"]!.GetValue<string>()).ExecuteAnyAsync(Token));
+		}
+	}
+}

PrivaPub.Tests/Federation/DomainBlocksTests.cs

@@ -0,0 +1,37 @@
+using Microsoft.Extensions.Logging.Abstractions;
+
+using PrivaPub.Federation.Moderation;
+using PrivaPub.Models.Federation;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class DomainBlocksTests
+	{
+		[Fact]
+		public void A_block_covers_subdomains_but_not_lookalikes()
+		{
+			var blocks = new DomainBlocks(NullLogger<DomainBlocks>.Instance);
+			blocks.Load(new[] { new DomainBlock { Domain = "evil.example", Severity = DomainBlockSeverity.Silence } });
+
+			Assert.NotNull(blocks.Find("evil.example"));
+			Assert.NotNull(blocks.Find("A.Evil.Example."));
+			Assert.Null(blocks.Find("notevil.example"));
+			Assert.False(blocks.IsSuspended("evil.example"));
+		}
+
+		[Fact]
+		public void A_suspension_is_found_from_any_subdomain()
+		{
+			var blocks = new DomainBlocks(NullLogger<DomainBlocks>.Instance);
+			blocks.Load(new[]
+			{
+				new DomainBlock { Domain = " Spam.Example. ", Severity = DomainBlockSeverity.Suspend },
+				new DomainBlock { Domain = "", Severity = DomainBlockSeverity.Suspend }
+			});
+
+			Assert.True(blocks.IsSuspended("deep.inside.spam.example"));
+			Assert.False(blocks.IsSuspended("example"));
+			Assert.Null(blocks.Find(default));
+		}
+	}
+}

PrivaPub.Tests/Federation/FeaturedTests.cs

@@ -0,0 +1,143 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// pins across servers: an account elsewhere features its own posts (Add and Remove on its `featured` collection, and
+	// the collection itself), a community features posts made in it, and a persona's pin is told to its followers
+	[Trait("Category", "Integration")]
+	public sealed class FeaturedTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		// a public note of the actor's, served where its id points
+		string Note(RemoteActor author, string text, string audience = default)
+		{
+			var path = $"/notes/{Guid.NewGuid():N}";
+			var note = new JsonObject
+			{
+				["id"] = Origin(author) + path, ["type"] = "Note", ["attributedTo"] = author.Id, ["content"] = $"<p>{text}</p>",
+				["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public"), ["published"] = DateTime.UtcNow.ToString("O")
+			};
+			if (audience != default)
+				note["audience"] = audience;
+			_harness.Peer.Serve(path, note.ToJsonString());
+			return Origin(author) + path;
+		}
+
+		JsonObject Featuring(RemoteActor actor, string type, string objectUri, string target = default) => new()
+		{
+			["id"] = $"{actor.Id}#{type}-{Guid.NewGuid():N}", ["type"] = type, ["actor"] = actor.Id, ["object"] = objectUri,
+			["target"] = target ?? actor.Id + "/featured"
+		};
+
+		Task<List<RemoteFeatured>> FeaturedBy(RemoteActor actor) =>
+			DB.Default.Find<RemoteFeatured>().Match(f => f.ActorURI == actor.Id).Sort(f => f.Position, Order.Ascending).ExecuteAsync(TestContext.Current.CancellationToken);
+
+		[Fact]
+		public async Task An_account_features_its_own_post_and_takes_it_back_but_nothing_else()
+		{
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var carol = new RemoteActor(_harness.Peer, "carol", _harness.Peer.B);
+			var mine = Note(bob, "pinned");
+			var theirs = Note(carol, "not bob's");
+			var older = Note(bob, "pinned before");
+
+			await _harness.Deliver(bob, "/human-centipede", Featuring(bob, "Add", older));
+			await _harness.Deliver(bob, "/human-centipede", Featuring(bob, "Add", mine));
+			await _harness.Deliver(bob, "/human-centipede", Featuring(bob, "Add", theirs));
+			// Smithereen's wall is a collection of the actor's too, but no pin
+			await _harness.Deliver(bob, "/human-centipede", Featuring(bob, "Add", Note(bob, "on the wall"), bob.Id + "/wall"));
+
+			Assert.Equal(new[] { mine, older }, (await FeaturedBy(bob)).Select(f => f.ObjectURI));
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == mine).ExecuteSingleAsync(TestContext.Current.CancellationToken);
+			Assert.Equal(post.ID, (await FeaturedBy(bob))[0].PostId);
+
+			await _harness.Deliver(bob, "/human-centipede", Featuring(bob, "Remove", mine));
+
+			Assert.Equal(new[] { older }, (await FeaturedBy(bob)).Select(f => f.ObjectURI));
+		}
+
+		[Fact]
+		public async Task The_featured_collection_is_read_in_its_order_from_the_accounts_own_server()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var first = Note(bob, "first pin");
+			var second = Note(bob, "second pin");
+			_harness.Peer.Serve(new Uri(bob.Id).AbsolutePath + "/featured", new JsonObject
+			{
+				["id"] = bob.Id + "/featured", ["type"] = "OrderedCollection", ["totalItems"] = 2,
+				["orderedItems"] = new JsonArray(new JsonObject { ["id"] = first, ["type"] = "Note" }, second)
+			}.ToJsonString());
+			var account = await _harness.Remote.GetActor(bob.Id, refresh: false, token);
+
+			await _harness.Featured.Sync(account, token);
+
+			Assert.Equal(new[] { first, second }, (await FeaturedBy(bob)).Select(f => f.ObjectURI));
+		}
+
+		[Fact]
+		public async Task A_personas_pin_and_unpin_reach_its_followers_as_add_and_remove()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var follower = new RemoteActor(_harness.Peer, "fan");
+			await _harness.FollowedBy(alice, follower);
+			await _harness.Posts.InsertPost(root, new PrivaPub.ClientModels.Post.InsertPostForm { AvatarId = alice.Id, Text = "worth a pin" }, token);
+			var post = await DB.Default.Find<Post>().Match(p => p.GroupUserId == alice.Id).ExecuteFirstAsync(token);
+
+			await _harness.Outbox.PublishFeatured(alice.Id, post, featured: true, token);
+			await _harness.Outbox.PublishFeatured(alice.Id, post, featured: false, token);
+
+			var sent = (await _harness.Outgoing(follower.SharedInbox)).Concat(await _harness.Outgoing(follower.Id + "/inbox"))
+				.Where(a => a["type"]!.GetValue<string>() is "Add" or "Remove").ToList();
+			Assert.Equal(new[] { "Add", "Remove" }, sent.Select(a => a["type"]!.GetValue<string>()));
+			Assert.All(sent, a => Assert.Equal((alice.PostUri(post.ID), alice.Featured), (a["object"]!.GetValue<string>(), a["target"]!.GetValue<string>())));
+		}
+
+		[Fact]
+		public async Task A_community_features_a_post_made_in_it()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var community = new RemoteActor(_harness.Peer, "books", type: "Group");
+			var member = new RemoteActor(_harness.Peer, "reader", _harness.Peer.B);
+			var account = await _harness.Remote.GetActor(community.Id, refresh: false, token);
+			await DB.Default.SaveAsync(new Following { AvatarId = alice.Id, TargetActorURI = community.Id, TargetAccountId = account.ID, State = FollowState.Accepted }, token);
+			var post = Note(member, "a thread in the community", community.Id);
+
+			await _harness.Deliver(community, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{community.Id}#announce-{Guid.NewGuid():N}", ["type"] = "Announce", ["actor"] = community.Id,
+				["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public"),
+				["object"] = new JsonObject
+				{
+					["id"] = $"{Origin(member)}/activities/{Guid.NewGuid():N}", ["type"] = "Add", ["actor"] = member.Id, ["object"] = post,
+					["target"] = community.Id + "/featured"
+				}
+			});
+
+			Assert.Equal(new[] { post }, (await FeaturedBy(community)).Select(f => f.ObjectURI));
+		}
+	}
+}

PrivaPub.Tests/Federation/FlairTests.cs

@@ -0,0 +1,68 @@
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Objects;
+
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class FlairTests
+	{
+		[Fact]
+		public void A_lemmy_posts_flair_is_described_by_its_community()
+		{
+			using var group = JsonDocument.Parse("""
+				{
+					"id": "https://lemmy.example/c/tenforward", "type": "Group", "preferredUsername": "tenforward", "inbox": "https://lemmy.example/c/tenforward/inbox",
+					"attributedTo": "https://lemmy.example/c/tenforward/moderators",
+					"tag": [{ "type": "CommunityPostTag", "id": "https://lemmy.example/c/tenforward/tag/news", "preferredUsername": "news",
+						"name": "News", "content": "What happened", "color": "color03" }]
+				}
+				""");
+			var community = ActorDocument.Parse(group.RootElement);
+			var page = NoteParser.Parse(JsonNode.Parse("""
+				{
+					"id": "https://lemmy.example/post/1", "type": "Page", "name": "Big news", "attributedTo": "https://lemmy.example/u/bo",
+					"tag": [{ "type": "CommunityPostTag", "id": "https://lemmy.example/c/tenforward/tag/news", "preferredUsername": "news" },
+						{ "type": "Mention", "href": "https://lemmy.example/c/tenforward", "name": "@tenforward@lemmy.example" }]
+				}
+				"""));
+
+			Assert.Equal("https://lemmy.example/c/tenforward/moderators", community.Moderators);
+			var flair = Assert.Single(ObjectShapes.Described(page.Flairs, community.Flairs));
+			Assert.Equal("News", flair.Name);
+			Assert.Equal("news", flair.Slug);
+			Assert.Equal("color03", flair.Color);
+			Assert.Equal("What happened", flair.Description);
+		}
+
+		[Fact]
+		public void Reads_piefeds_flairs_in_both_dialects_and_its_older_community_list()
+		{
+			var post = NoteParser.Parse(JsonNode.Parse("""
+				{
+					"id": "https://piefed.example/post/9", "type": "Page", "name": "A question", "attributedTo": "https://piefed.example/u/pf",
+					"tag": [{ "type": "lemmy:CommunityTag", "id": "https://piefed.example/c/ask/tag/3", "display_name": "Solved",
+						"text_color": "#ffffff", "background_color": "#2e7d32", "blur_images": false },
+						{ "type": "Hashtag", "href": "https://piefed.example/tag/q", "name": "#q" }]
+				}
+				"""));
+			using var group = JsonDocument.Parse("""
+				{
+					"id": "https://piefed.example/c/ask", "type": "Group", "preferredUsername": "ask", "inbox": "https://piefed.example/c/ask/inbox",
+					"lemmy:tagsForPosts": [{ "type": "lemmy:CommunityTag", "id": "https://piefed.example/c/ask/tag/4", "display_name": "Spoiler",
+						"text_color": "#000", "background_color": "red; background: url(x)", "blur_images": true }]
+				}
+				""");
+
+			var solved = Assert.Single(post.Flairs);
+			Assert.Equal("Solved", solved.Name);
+			Assert.Equal("#2e7d32", solved.BackgroundColor);
+			Assert.Equal("q", Assert.Single(post.Tags));
+			var spoiler = Assert.Single(ActorDocument.Parse(group.RootElement).Flairs);
+			Assert.True(spoiler.BlurImages);
+			Assert.Equal("#000", spoiler.TextColor);
+			Assert.Null(spoiler.BackgroundColor);
+		}
+	}
+}

PrivaPub.Tests/Federation/FollowersSynchronizationTests.cs

@@ -0,0 +1,282 @@
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Signing;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// FEP-8fcf (owner decision 2026-10-06): a delivery addressed to a persona's followers tells the receiving server, in a signed
+	// header, a digest of the persona's followers there; the roll-call it names lists them, to that server only
+	[Trait("Category", "Integration")]
+	[Xunit.Collection(nameof(Exclusive))]
+	public sealed class FollowersSynchronizationTests : IAsyncLifetime
+	{
+		static readonly string[] PeerHosts = { "localhost", "127.0.0.1" };
+
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+			await DB.Default.DeleteAsync<RemoteInstance>(i => PeerHosts.Contains(i.Host));
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		[Fact]
+		public void The_digest_is_the_xor_of_each_ids_sha256_whatever_the_order()
+		{
+			Assert.Equal(new string('0', 64), FollowersSynchronization.Digest([]));
+			Assert.Equal(FollowersSynchronization.Digest(["https://a.example/users/one", "https://a.example/users/two"]),
+				FollowersSynchronization.Digest(["https://a.example/users/two", "https://a.example/users/one"]));
+			Assert.Equal(Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes("https://a.example/users/one"))),
+				FollowersSynchronization.Digest(["https://a.example/users/one"]));
+		}
+
+		async Task<HttpRequestRecord> Delivered(LocalActor signer, string inbox, JsonObject activity)
+		{
+			await _harness.Delivery.Enqueue(signer, new[] { inbox }, activity, Token);
+			var job = await DB.Default.Find<Job>().Match(j => j.DedupeKey == $"{activity["id"]!.GetValue<string>()}|{inbox}").ExecuteSingleAsync(Token);
+			var handler = new DeliveryJobHandler(_harness.Local, Peer.Http(), new HostCircuitBreaker(new MemoryCache(new MemoryCacheOptions())),
+				NullLogger<DeliveryJobHandler>.Instance);
+			Assert.Equal(JobResult.Done, (await handler.Handle(job, Token)).Result);
+			return Assert.Single(_harness.Peer.Requests, r => r.Body?.Contains(activity["id"]!.GetValue<string>()) == true);
+		}
+
+		static JsonObject Create(LocalActor author, params string[] to) => new()
+		{
+			["id"] = $"{author.Uri}/grunts/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = author.Uri, ["to"] = new JsonArray(to.Select(t => (JsonNode)t).ToArray()),
+			["object"] = new JsonObject { ["type"] = "Note", ["content"] = "hi", ["to"] = new JsonArray(to.Select(t => (JsonNode)t).ToArray()) }
+		};
+
+		[Fact]
+		public async Task A_delivery_to_followers_carries_a_signed_digest_of_the_followers_on_that_server_only()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var one = new RemoteActor(_harness.Peer, "one");
+			var two = new RemoteActor(_harness.Peer, "two");
+			var far = new RemoteActor(_harness.Peer, "far", _harness.Peer.B);
+			await _harness.FollowedBy(alice, one);
+			await _harness.FollowedBy(alice, two);
+			await _harness.FollowedBy(alice, far);
+			await DB.Default.SaveAsync(new Follower
+			{
+				LocalActorId = alice.Id, LocalActorKind = alice.Kind, ActorURI = _harness.Peer.A + "/users/asking", InboxURL = _harness.Peer.A + "/users/asking/inbox", IsAccepted = false
+			}, Token);
+			_harness.Peer.Answer("/inbox", 202);
+
+			var received = await Delivered(alice, _harness.Peer.A + "/inbox", Create(alice, alice.Followers));
+
+			Assert.Equal(alice.Followers, Value(received, "collectionId"));
+			Assert.Equal(alice.Followers + "/roll-call", Value(received, "url"));
+			Assert.Equal(FollowersSynchronization.Digest([one.Id, two.Id]), Value(received, "digest"));
+			var signature = HttpSignatures.Parse(received.Signature);
+			Assert.Equal(new[] { "(request-target)", "host", "date", "digest", "collection-synchronization" }, signature.Headers);
+			var signingString = $"(request-target): post /inbox\nhost: {received.Headers["Host"]}\ndate: {received.Headers["Date"]}\ndigest: {received.Headers["Digest"]}\n"
+				+ $"collection-synchronization: {received.Headers[FollowersSynchronization.Header]}";
+			using var key = RSA.Create();
+			key.ImportFromPem(alice.PublicKeyPem);
+			Assert.True(key.VerifyData(Encoding.UTF8.GetBytes(signingString), signature.Signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1));
+		}
+
+		static string Value(HttpRequestRecord received, string name)
+		{
+			var values = received.Headers[FollowersSynchronization.Header].Split(',', StringSplitOptions.TrimEntries)
+				.Select(p => p.Split('=', 2)).ToDictionary(p => p[0], p => p[1].Trim('"'));
+			return values[name];
+		}
+
+		[Fact]
+		public async Task A_delivery_that_is_not_for_followers_carries_none()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var recipient = new RemoteActor(_harness.Peer, "recipient");
+			await _harness.FollowedBy(alice, recipient);
+			_harness.Peer.Answer("/inbox", 202);
+
+			var received = await Delivered(alice, _harness.Peer.A + "/inbox", Create(alice, recipient.Id));
+
+			Assert.False(received.Headers.ContainsKey(FollowersSynchronization.Header));
+			Assert.DoesNotContain("collection-synchronization", HttpSignatures.Parse(received.Signature).Headers);
+		}
+
+		// Mastodon undoes a follow it never knew of with the same id each time ({actor}#follows//undo): when it comes again,
+		// after a new follow, it ends that one too; a copy of it, with nothing to end, stays a copy
+		[Fact]
+		public async Task An_undo_of_a_follow_sent_again_after_a_new_follow_ends_that_one_too()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var undo = new JsonObject
+			{
+				["id"] = bob.Id + "#follows//undo", ["type"] = "Undo", ["actor"] = bob.Id,
+				["object"] = new JsonObject { ["id"] = bob.Id + "#follows/", ["type"] = "Follow", ["actor"] = bob.Id, ["object"] = alice.Uri }
+			};
+			Task<bool> Follows() => DB.Default.Find<Follower>().Match(f => f.LocalActorId == alice.Id && f.ActorURI == bob.Id).ExecuteAnyAsync(Token);
+
+			await _harness.FollowedBy(alice, bob);
+			await _harness.Deliver(bob, "/human-centipede", undo.DeepClone());
+			Assert.False(await Follows());
+
+			await _harness.FollowedBy(alice, bob);
+			await _harness.Deliver(bob, "/human-centipede", undo.DeepClone());
+			Assert.False(await Follows());
+
+			Assert.Equal("duplicate", (await _harness.Deliver(bob, "/human-centipede", undo.DeepClone())).Reason);
+		}
+
+		// received: bob's delivery claims a digest of his followers here, and lists them at his own synchronisation URL
+		async Task Claimed(RemoteActor bob, string digest, params string[] listed)
+		{
+			var path = new Uri(bob.Id).AbsolutePath + "/followers/sync";
+			_harness.Peer.Serve(path, new JsonObject
+			{
+				["id"] = bob.Id + "/followers/sync", ["type"] = "OrderedCollection",
+				["orderedItems"] = new JsonArray(listed.Select(l => (JsonNode)l).ToArray())
+			}.ToJsonString());
+			var note = $"{bob.Id}/notes/{Guid.NewGuid():N}";
+			var request = bob.Post(Harness.Host, "/human-centipede", new JsonObject
+			{
+				["id"] = note + "/activity", ["type"] = "Create", ["actor"] = bob.Id, ["to"] = new JsonArray(bob.Id + "/followers"),
+				["object"] = new JsonObject { ["id"] = note, ["type"] = "Note", ["attributedTo"] = bob.Id, ["to"] = new JsonArray(bob.Id + "/followers"), ["content"] = "hi" }
+			});
+			request.Headers[FollowersSynchronization.Header] = $"collectionId=\"{bob.Id}/followers\", url=\"{bob.Id}/followers/sync\", digest=\"{digest}\"";
+			await _harness.Receiver.Receive(request, default, Token);
+			var job = await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.SynchronizeFollowing && j.State == JobState.Pending && j.Payload.Contains(bob.Id))
+				.ExecuteSingleAsync(Token);
+			var handler = new FollowingSynchronization(_harness.Db, _harness.Local, _harness.Remote, _harness.Follows, _harness.Delivery);
+			Assert.Equal(JobResult.Done, (await handler.Handle(job, Token)).Result);
+		}
+
+		async Task<Following> Follows(LocalActor persona, RemoteActor bob, FollowState state)
+		{
+			var following = new Following
+			{
+				AvatarId = persona.Id, TargetActorURI = bob.Id, TargetInboxURL = bob.Id + "/inbox", State = state, FollowActivityURI = persona.ActivityUri($"follow-{Guid.NewGuid():N}")
+			};
+			await DB.Default.SaveAsync(following, Token);
+			return following;
+		}
+
+		Task<Following> Following(LocalActor persona, RemoteActor bob) =>
+			DB.Default.Find<Following>().Match(f => f.AvatarId == persona.Id && f.TargetActorURI == bob.Id).ExecuteFirstAsync(Token);
+
+		[Fact]
+		public async Task A_claim_that_differs_is_mended_from_the_accounts_own_list()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var (_, carol) = await _harness.Persona("carol");
+			var (_, dave) = await _harness.Persona("dave");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			await Follows(alice, bob, FollowState.Accepted);
+			await Follows(carol, bob, FollowState.Requested);
+
+			await Claimed(bob, FollowersSynchronization.Digest([carol.Uri, dave.Uri]), carol.Uri, dave.Uri);
+
+			Assert.Null(await Following(alice, bob));
+			Assert.Equal(FollowState.Accepted, (await Following(carol, bob)).State);
+			var undos = (await _harness.Outgoing(bob.Id + "/inbox")).Where(a => a["type"]!.GetValue<string>() == "Undo").ToList();
+			Assert.Equal(new[] { alice.Uri, dave.Uri }.Order(), undos.Select(u => u["actor"]!.GetValue<string>()).Order());
+			var daves = Assert.Single(undos, u => u["actor"]!.GetValue<string>() == dave.Uri);
+			Assert.Equal(("Follow", bob.Id), (daves["object"]!["type"]!.GetValue<string>(), daves["object"]!["object"]!.GetValue<string>()));
+		}
+
+		[Fact]
+		public async Task A_list_the_claim_does_not_describe_ends_no_follow()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			await Follows(alice, bob, FollowState.Accepted);
+
+			await Claimed(bob, FollowersSynchronization.Digest(["https://privapub.test/peasants/someone"]));
+
+			Assert.Equal(FollowState.Accepted, (await Following(alice, bob)).State);
+		}
+
+		[Fact]
+		public async Task A_claim_that_agrees_reads_nothing()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			await Follows(alice, bob, FollowState.Accepted);
+
+			await Claimed(bob, FollowersSynchronization.Digest([alice.Uri]));
+
+			Assert.DoesNotContain(_harness.Peer.Requests, r => r.Path.EndsWith("/followers/sync"));
+			Assert.Equal(FollowState.Accepted, (await Following(alice, bob)).State);
+		}
+	}
+
+	[Trait("Category", "Integration")]
+	public sealed class RollCallTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		HttpClient _client;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_client = _host.Client();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			_client?.Dispose();
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		static string[] Items(JsonObject collection) => collection["orderedItems"]!.AsArray().Select(i => i!.GetValue<string>()).ToArray();
+
+		[Fact]
+		public async Task The_roll_call_lists_the_followers_on_the_signing_server_and_asks_for_a_signature()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var persona = await _host.Persona(await _host.SignUp(), "rollcall");
+			var near = new RemoteActor(_peer, "near");
+			var server = new RemoteActor(_peer, "instance", type: "Application");
+			var far = new RemoteActor(_peer, "far", _peer.B);
+			foreach (var follower in new[] { near, far })
+				await DB.Default.SaveAsync(new Follower
+				{
+					LocalActorId = persona.Id, LocalActorKind = LocalActorKind.Person, ActorURI = follower.Id, InboxURL = follower.Id + "/inbox"
+				}, token);
+			var path = $"/peasants/{persona.UserName}/groupies/roll-call";
+
+			var asServer = await _client.Fetch(server.SignedGet(path));
+			var asFar = await _client.Fetch(far.SignedGet(path));
+
+			Assert.Equal(HttpStatusCode.OK, asServer.Status);
+			Assert.Equal(persona.ActorUri() + "/groupies/roll-call", asServer.Json["id"]!.GetValue<string>());
+			Assert.Equal(new[] { near.Id }, Items(asServer.Json));
+			Assert.Equal(new[] { far.Id }, Items(asFar.Json));
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _client.Fetch(path)).Status);
+		}
+	}
+}

PrivaPub.Tests/Federation/FormerRepresentationsTests.cs

@@ -0,0 +1,97 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// Pleroma's and Akkoma's edited posts carry their earlier versions (formerRepresentations): a post first met after its
+	// edits has its history, and an edit tells the ones missed in between
+	[Trait("Category", "Integration")]
+	public sealed class FormerRepresentationsTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+		static readonly DateTime Start = DateTime.UtcNow.AddHours(-1);
+
+		static JsonObject Version(string text, int minutes) => new()
+		{
+			["type"] = "Note", ["content"] = $"<p>{text}</p>", ["published"] = Start.ToString("O"),
+			["updated"] = minutes == 0 ? default : Start.AddMinutes(minutes).ToString("O")
+		};
+
+		async Task<(RemoteActor Carol, JsonObject Note)> Followed(string text, int minutes, params JsonObject[] former)
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			await DB.Default.SaveAsync(new Following { AvatarId = alice.Id, TargetActorURI = carol.Id, State = FollowState.Accepted }, token);
+			var note = Version(text, minutes);
+			note["id"] = $"{Origin(carol)}/objects/{Guid.NewGuid():N}";
+			note["attributedTo"] = carol.Id;
+			note["to"] = new JsonArray(Addressing.Public);
+			note["cc"] = new JsonArray($"{carol.Id}/followers");
+			if (former.Length > 0)
+				note["formerRepresentations"] = new JsonObject { ["type"] = "OrderedCollection", ["totalItems"] = former.Length, ["orderedItems"] = new JsonArray(former) };
+			return (carol, note);
+		}
+
+		Task Deliver(RemoteActor carol, string type, JsonObject note) => _harness.Deliver(carol, "/human-centipede", new JsonObject
+		{
+			["id"] = $"{Origin(carol)}/activities/{Guid.NewGuid():N}", ["type"] = type, ["actor"] = carol.Id,
+			["to"] = new JsonArray(Addressing.Public), ["object"] = note.DeepClone()
+		});
+
+		Task<Post> Stored(JsonObject note) =>
+			DB.Default.Find<Post>().Match(p => p.ObjectURI == note["id"]!.GetValue<string>()).ExecuteSingleAsync(TestContext.Current.CancellationToken);
+
+		[Fact]
+		public async Task A_post_first_met_after_its_edits_has_its_history()
+		{
+			var (carol, note) = await Followed("third", 40, Version("second", 20), Version("first", 0));
+
+			await Deliver(carol, "Create", note);
+
+			var post = await Stored(note);
+			Assert.Equal(["<p>first</p>", "<p>second</p>"], post.Revisions.Select(r => r.ContentHtml));
+			Assert.Equal("<p>third</p>", post.ContentHtml);
+		}
+
+		[Fact]
+		public async Task An_edit_tells_the_versions_missed_in_between()
+		{
+			var (carol, note) = await Followed("first", 0);
+			await Deliver(carol, "Create", note);
+
+			var edited = (JsonObject)note.DeepClone();
+			edited["content"] = "<p>third</p>";
+			edited["updated"] = Start.AddMinutes(40).ToString("O");
+			edited["formerRepresentations"] = new JsonObject
+			{
+				["type"] = "OrderedCollection", ["totalItems"] = 2, ["orderedItems"] = new JsonArray(Version("second", 20), Version("first", 0))
+			};
+			await Deliver(carol, "Update", edited);
+
+			var post = await Stored(note);
+			Assert.Equal(["<p>first</p>", "<p>second</p>"], post.Revisions.Select(r => r.ContentHtml));
+			Assert.Equal("<p>third</p>", post.ContentHtml);
+		}
+	}
+}

PrivaPub.Tests/Federation/ForwardedTests.cs

@@ -0,0 +1,167 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.FederatedSeeds;
+
+namespace PrivaPub.Tests.Federation
+{
+	// Inbox forwarding: a thread's server passes on the activities in it, signed with its own key (Mastodon the replies to
+	// its accounts' posts and their deletions, Friendica everything in its threads). They used to be refused with 401.
+	[Trait("Category", "Integration")]
+	public sealed class ForwardedTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		PrivaPub.Models.Statistics.InteractionEvent Processed(string activity) => _harness.Ledger.Of("in").Last(e => e.Activity == activity);
+
+		PrivaPub.Models.Statistics.InteractionEvent Received(string activity) => _harness.Ledger.Of("recv").Last(e => e.Activity == activity);
+
+		Task<Post> Stored(string objectUri) =>
+			DB.Default.Find<Post>().Match(p => p.ObjectURI == objectUri).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+
+		// alice follows the thread's author (on its own server), whose post she holds; bob, elsewhere, replies to it
+		async Task<(RemoteActor Owner, RemoteActor Bob, JsonObject Reply)> Thread()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var owner = new RemoteActor(_harness.Peer, "owner", _harness.Peer.B);
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			await Follows(alice.Id, owner);
+			var post = PublicNote(owner, "<p>the thread</p>");
+			await _harness.Deliver(owner, "/human-centipede", Create(owner, post));
+			Assert.NotNull(await Stored(IdOf(post)));
+
+			var reply = PublicNote(bob, "<p>bob's reply as he wrote it</p>", owner.Id);
+			reply["inReplyTo"] = IdOf(post);
+			_harness.Peer.Serve(new Uri(IdOf(reply)).AbsolutePath, reply.ToJsonString());
+			return (owner, bob, reply);
+		}
+
+		[Fact]
+		public async Task A_reply_the_threads_server_forwards_is_kept_as_its_author_wrote_it()
+		{
+			var (owner, bob, reply) = await Thread();
+			var claimed = (JsonObject)reply.DeepClone();
+			claimed["content"] = "<p>what the forwarder says bob wrote</p>";
+
+			var result = await _harness.Deliver(owner, "/human-centipede", Create(bob, claimed));
+
+			Assert.Equal((202, "forwarded"), (result.StatusCode, result.Reason));
+			var stored = await Stored(IdOf(reply));
+			Assert.NotNull(stored);
+			Assert.Equal(bob.Id, stored.ActorURI);
+			Assert.Contains("as he wrote it", stored.ContentHtml);
+			Assert.Equal(("accepted", "stored"), (Processed("Create").Outcome, Processed("Create").Reason));
+			Assert.True((await DB.Default.Find<PrivaPub.Models.Federation.ObjectRecord>().Match(r => r.ObjectURI == IdOf(reply)).ExecuteFirstAsync(TestContext.Current.CancellationToken)).Refetched);
+		}
+
+		[Fact]
+		public async Task A_forwarded_edit_applies_the_post_as_its_origin_has_it_now()
+		{
+			var (owner, bob, reply) = await Thread();
+			await _harness.Deliver(owner, "/human-centipede", Create(bob, reply));
+			var edited = (JsonObject)reply.DeepClone();
+			edited["content"] = "<p>bob's reply, edited</p>";
+			edited["updated"] = DateTime.UtcNow.AddMinutes(1).ToString("O");
+			_harness.Peer.Serve(new Uri(IdOf(reply)).AbsolutePath, edited.ToJsonString());
+			var claimed = (JsonObject)edited.DeepClone();
+			claimed["content"] = "<p>an edit bob never made</p>";
+
+			await _harness.Deliver(owner, "/human-centipede", Activity(bob, "Update", claimed));
+
+			Assert.Contains("bob's reply, edited", (await Stored(IdOf(reply))).ContentHtml);
+		}
+
+		[Fact]
+		public async Task A_forwarded_deletion_waits_for_the_origin_to_say_the_post_is_gone()
+		{
+			var (owner, bob, reply) = await Thread();
+			await _harness.Deliver(owner, "/human-centipede", Create(bob, reply));
+
+			await _harness.Deliver(owner, "/human-centipede", Activity(bob, "Delete", JsonValue.Create(IdOf(reply))!));
+			Assert.Equal(("dropped", "forwarded-not-gone"), (Processed("Delete").Outcome, Processed("Delete").Reason));
+			Assert.NotNull(await Stored(IdOf(reply)));
+
+			_harness.Peer.Answer(new Uri(IdOf(reply)).AbsolutePath, 410);
+			await _harness.Deliver(owner, "/human-centipede", Activity(bob, "Delete", JsonValue.Create(IdOf(reply))!));
+			Assert.Null(await Stored(IdOf(reply)));
+		}
+
+		// the origin answers 404 for a followers-only post to our instance actor too: only its author's server says it is gone
+		[Fact]
+		public async Task A_forwarded_deletion_of_a_followers_only_post_is_left_to_its_author()
+		{
+			var (owner, bob, reply) = await Thread();
+			await _harness.Deliver(owner, "/human-centipede", Create(bob, reply));
+			await DB.Default.Update<Post>().Match(p => p.ObjectURI == IdOf(reply)).Modify(p => p.Visibility, PostVisibility.FollowersOnly).ExecuteAsync(TestContext.Current.CancellationToken);
+			_harness.Peer.Answer(new Uri(IdOf(reply)).AbsolutePath, 404);
+
+			await _harness.Deliver(owner, "/human-centipede", Activity(bob, "Delete", JsonValue.Create(IdOf(reply))!));
+
+			Assert.Equal(("dropped", "forwarded-private"), (Processed("Delete").Outcome, Processed("Delete").Reason));
+			Assert.NotNull(await Stored(IdOf(reply)));
+		}
+
+		// a forwarded copy is kept apart from the author's own delivery, which carries what the copy could not
+		[Fact]
+		public async Task The_authors_own_delivery_is_still_taken_after_a_forwarded_copy_that_failed()
+		{
+			var (owner, bob, reply) = await Thread();
+			_harness.Peer.Answer(new Uri(IdOf(reply)).AbsolutePath, 404);
+			var create = Create(bob, reply);
+
+			await _harness.Deliver(owner, "/human-centipede", create);
+			Assert.Null(await Stored(IdOf(reply)));
+
+			var direct = await _harness.Deliver(bob, "/human-centipede", create);
+			Assert.Equal("queued", direct.Reason);
+			Assert.NotNull(await Stored(IdOf(reply)));
+		}
+
+		// what cannot be checked against its origin (a vote, a follow, someone else's post) is let go, answered 202: a 401
+		// tells the forwarder its signature failed
+		[Fact]
+		public async Task What_a_forwarder_cannot_vouch_for_is_let_go_without_an_error()
+		{
+			var (owner, bob, reply) = await Thread();
+			var like = new JsonObject { ["id"] = NewId(bob, "likes"), ["type"] = "Like", ["actor"] = bob.Id, ["object"] = IdOf(reply) };
+
+			var result = await _harness.Deliver(owner, "/human-centipede", like);
+			Assert.Equal((202, "forwarded-ignored"), (result.StatusCode, result.Reason));
+			Assert.Equal("dropped", Received("Like").Outcome);
+
+			var onTheForwardersServer = PublicNote(owner, "<p>a post of the forwarder's</p>");
+			onTheForwardersServer["attributedTo"] = bob.Id;
+			result = await _harness.Deliver(owner, "/human-centipede", Create(bob, onTheForwardersServer));
+			Assert.Equal((202, "forwarded-ignored"), (result.StatusCode, result.Reason));
+			Assert.Null(await Stored(IdOf(onTheForwardersServer)));
+
+			// our own, coming back from a thread on another server
+			var (_, carol) = await _harness.Persona("carol");
+			var ours = new JsonObject
+			{
+				["id"] = carol.Uri + "/grunts/create-" + Guid.NewGuid().ToString("N"),
+				["type"] = "Create",
+				["actor"] = carol.Uri,
+				["object"] = new JsonObject { ["id"] = carol.Uri + "/scribbles/" + Guid.NewGuid().ToString("N"), ["type"] = "Note", ["attributedTo"] = carol.Uri }
+			};
+			result = await _harness.Deliver(owner, "/human-centipede", ours);
+			Assert.Equal((202, "forwarded-ignored"), (result.StatusCode, result.Reason));
+		}
+	}
+}

PrivaPub.Tests/Federation/GroupTests.cs

@@ -9,6 +9,7 @@ using PrivaPub.Models.Federation;
 using PrivaPub.Models.Group;
 using PrivaPub.Models.Post;
 using PrivaPub.Models.Social;
+using PrivaPub.StaticServices;
 using PrivaPub.Tests.Support;
 
 using System.Text.Json.Nodes;
@@ -89,6 +90,28 @@ namespace PrivaPub.Tests.Federation
 			Assert.Contains(announces, a => a["object"] is JsonValue);
 		}
 
+		[Fact]
+		public async Task A_comment_in_a_community_is_announced_activity_and_object_too()
+		{
+			var (_, owner) = await _harness.Persona("owner");
+			var (_, community) = await Group(GroupKind.Community, PostingPolicy.Followers, owner.Id);
+			var lemmy = new RemoteActor(_harness.Peer, "lemmy");
+			var akkoma = new RemoteActor(_harness.Peer, "akkoma");
+			await _harness.FollowedBy(community, lemmy);
+			await _harness.FollowedBy(community, akkoma);
+			var thread = Create(lemmy, new[] { community.Uri, Addressing.Public }, community.Uri);
+			await _harness.Deliver(lemmy, "/human-centipede", thread);
+			var comment = Create(lemmy, new[] { community.Uri, Addressing.Public }, community.Uri);
+			comment["object"]!["inReplyTo"] = thread["object"]!["id"]!.GetValue<string>();
+
+			await _harness.Deliver(lemmy, "/human-centipede", comment);
+
+			var commentId = comment["object"]!["id"]!.GetValue<string>();
+			var announces = (await _harness.Outgoing(akkoma.SharedInbox)).Where(a => a["actor"]!.GetValue<string>() == community.Uri).ToList();
+			Assert.Contains(announces, a => a["object"] is JsonObject inner && inner["object"]?["id"]?.GetValue<string>() == commentId);
+			Assert.Contains(announces, a => a["object"] is JsonValue bare && bare.GetValue<string>() == commentId);
+		}
+
 		[Fact]
 		public async Task An_open_community_takes_posts_from_anyone()
 		{
@@ -102,6 +125,21 @@ namespace PrivaPub.Tests.Federation
 			Assert.True(await DB.Default.Find<Post>().Match(p => p.GroupId == community.Id && p.ActorURI == stranger.Id).ExecuteAnyAsync(token));
 		}
 
+		// Lemmy keeps its user's post pending until the community announces it back, whether anyone there follows the
+		// community or not
+		[Fact]
+		public async Task A_post_into_a_community_is_announced_back_to_its_authors_server_though_nobody_there_follows_it()
+		{
+			var (_, owner) = await _harness.Persona("owner");
+			var (_, community) = await Group(GroupKind.Community, PostingPolicy.Anyone, owner.Id);
+			var stranger = new RemoteActor(_harness.Peer, "stranger", sharedInbox: true);
+
+			await _harness.Deliver(stranger, "/human-centipede", Create(stranger, new[] { community.Uri, Addressing.Public }, community.Uri));
+
+			var announces = (await _harness.Outgoing(stranger.SharedInbox)).Where(a => a["actor"]!.GetValue<string>() == community.Uri).ToList();
+			Assert.Contains(announces, a => a["object"] is JsonObject inner && inner["type"]!.GetValue<string>() == "Create");
+		}
+
 		[Fact]
 		public async Task Mentioning_a_community_posts_into_it_as_a_titled_page()
 		{
@@ -138,21 +176,86 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal(PostVisibility.Circle, outcome.Post.Visibility);
 			var create = Assert.Single(await _harness.Outgoing(member.Id + "/inbox"));
 			Assert.Equal(new[] { circle.Uri, circle.Flock }, create["object"]!["to"]!.AsArray().Select(t => t!.GetValue<string>()));
+			// the member's copy names the member, so Mastodon and GoToSocial keep it, and names nobody else
+			Assert.Equal(new[] { member.Id }, create["cc"]!.AsArray().Select(t => t!.GetValue<string>()));
+			Assert.Equal(new[] { member.Id }, create["object"]!["cc"]!.AsArray().Select(t => t!.GetValue<string>()));
+			Assert.Contains(create["object"]!["tag"]!.AsArray(), t => t!["type"]!.GetValue<string>() == "Mention" && t["href"]!.GetValue<string>() == member.Id);
 			Assert.DoesNotContain(Addressing.Public, create.ToJsonString());
 			Assert.Empty(await _harness.Outgoing(follower.SharedInbox));
 			Assert.Empty((await _harness.Outgoing(member.SharedInbox)).Where(a => a["type"]!.GetValue<string>() == "Announce"));
 
-			var authorizer = new SignedFetchAuthorizer(_harness.Remote);
+			var authorizer = new SignedFetchAuthorizer(_harness.Remote, new DbEntities());
 			var path = new Uri(outcome.Post.ObjectURI).AbsolutePath;
 			var asMember = await authorizer.Requester(member.Get(Harness.Host, path), token);
 			var asOutsider = await authorizer.Requester(outsider.Get(Harness.Host, path), token);
 			Assert.True(SignedFetchAuthorizer.MayReadCircle(circleEntity, asMember));
 			Assert.False(SignedFetchAuthorizer.MayReadCircle(circleEntity, asOutsider));
 			Assert.False(SignedFetchAuthorizer.MayReadCircle(circleEntity, default));
+			Assert.True(await authorizer.MayRead(outcome.Post, asMember, token));
+			Assert.False(await authorizer.MayRead(outcome.Post, asOutsider, token));
+			Assert.Equal(new[] { member.Id }, SignedFetchAuthorizer.CircleReaders(circleEntity, asMember));
 			Assert.True(circle.IsCircle);
 			Assert.False(circle.Discoverable);
 		}
 
+		[Fact]
+		public async Task A_circle_posts_edit_and_delete_reach_each_member_naming_only_that_member()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var first = new RemoteActor(_harness.Peer, "first");
+			var second = new RemoteActor(_harness.Peer, "second", _harness.Peer.B);
+			var (_, circle) = await Group(GroupKind.Circle, PostingPolicy.Followers, alice.Id, first.Id, second.Id);
+			await _harness.Remote.GetActor(first.Id, refresh: false, token);
+			await _harness.Remote.GetActor(second.Id, refresh: false, token);
+
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "just us", GroupId = circle.Id }, token);
+			await _harness.Statuses.Edit(alice, outcome.Post.ID, new StatusDraft { Text = "just us, edited" }, token);
+			await _harness.Statuses.Remove(alice, outcome.Post.ID, token);
+
+			foreach (var (member, other) in new[] { (first, second), (second, first) })
+			{
+				var sent = await _harness.Outgoing(member.Id + "/inbox");
+				Assert.Equal(new[] { "Create", "Update", "Delete" }, sent.Select(a => a["type"]!.GetValue<string>()));
+				Assert.All(sent, a => Assert.Contains(member.Id, a["cc"]!.AsArray().Select(c => c!.GetValue<string>())));
+				Assert.All(sent, a => Assert.DoesNotContain(other.Id, a.ToJsonString()));
+			}
+		}
+
+		[Fact]
+		public async Task A_reply_to_a_circle_post_stays_in_it_and_a_circle_post_asks_nobody_outside_for_a_quote()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var (_, bob) = await _harness.Persona("bob");
+			var (entity, circle) = await Group(GroupKind.Circle, PostingPolicy.Followers, alice.Id);
+			entity.Members.Add(new GroupMember { AvatarId = bob.Id });
+			await DB.Default.SaveAsync(entity, token);
+			var outsider = new RemoteActor(_harness.Peer, "asked");
+			var outsiderAccount = await _harness.Remote.GetActor(outsider.Id, refresh: false, token);
+			var asksFirst = new Post
+			{
+				ObjectURI = $"{Origin(outsider)}/notes/{Guid.NewGuid():N}",
+				ActorURI = outsider.Id,
+				GroupUserId = outsiderAccount.ID,
+				AuthorAccountId = outsiderAccount.ID,
+				IsFederatedCopy = true,
+				Visibility = PostVisibility.Public,
+				ContentHtml = "<p>ask me first</p>",
+				QuotePolicy = new InteractionRule { Manual = new() { Addressing.Public } }
+			};
+			await DB.Default.SaveAsync(asksFirst, token);
+
+			var root = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "just us", GroupId = circle.Id }, token);
+			var reply = await _harness.Statuses.Publish(bob, new StatusDraft { Text = "still just us", InReplyTo = root.Post.ID }, token);
+			var quote = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "look", GroupId = circle.Id, QuotedStatusId = asksFirst.ID }, token);
+
+			Assert.Equal(PostVisibility.Circle, reply.Post.Visibility);
+			Assert.Equal(circle.Id, reply.Post.GroupId);
+			Assert.Equal(422, quote.Status);
+			Assert.Empty(await _harness.Outgoing(outsider.Id + "/inbox"));
+		}
+
 		[Fact]
 		public async Task Only_circle_members_can_post_into_a_circle()
 		{

PrivaPub.Tests/Federation/HttpSignaturesTests.cs

@@ -101,6 +101,33 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("the signature has expired",
 				Check(MastodonRequest(extra: $",expires=\"{Now.AddMinutes(-20).ToUnixTimeSeconds()}\"")));
 
+		// hs2019 leaves the hash to the key: some sign RSA with SHA-512, which rsa-sha256 does not allow; and a SHA-512 digest
+		[Fact]
+		public void Accepts_hs2019_hashed_with_sha512_and_a_sha512_digest()
+		{
+			var context = new DefaultHttpContext();
+			context.Request.Method = "POST";
+			context.Request.Host = new HostString(Host);
+			context.Request.Path = "/peasants/bob/mouth";
+			context.Features.Get<IHttpRequestFeature>().RawTarget = "/peasants/bob/mouth";
+			var date = Now.ToString("r", CultureInfo.InvariantCulture);
+			var digest = "SHA-512=" + Convert.ToBase64String(SHA512.HashData(Body));
+			context.Request.Headers["Date"] = date;
+			context.Request.Headers["Digest"] = digest;
+			var signingString = $"(request-target): post /peasants/bob/mouth\nhost: {Host}\ndate: {date}\ndigest: {digest}";
+			var signature = Convert.ToBase64String(_key.SignData(Encoding.UTF8.GetBytes(signingString), HashAlgorithmName.SHA512, RSASignaturePadding.Pkcs1));
+			string Signed(string algorithm) => $"keyId=\"{KeyId}\",algorithm=\"{algorithm}\",headers=\"(request-target) host date digest\",signature=\"{signature}\"";
+
+			context.Request.Headers["Signature"] = Signed("hs2019");
+			var parameters = HttpSignatures.Parse(context.Request.Headers["Signature"].ToString());
+			Assert.Null(HttpSignatures.CheckRequest(context.Request, parameters, Body, Now));
+			Assert.True(HttpSignatures.Verify(PublicKey, HttpSignatures.SigningString(context.Request, parameters), parameters.Signature, parameters.Algorithm));
+
+			context.Request.Headers["Signature"] = Signed("rsa-sha256");
+			parameters = HttpSignatures.Parse(context.Request.Headers["Signature"].ToString());
+			Assert.False(HttpSignatures.Verify(PublicKey, HttpSignatures.SigningString(context.Request, parameters), parameters.Signature, parameters.Algorithm));
+		}
+
 		[Fact]
 		public void Signs_with_the_raw_request_target()
 		{

PrivaPub.Tests/Federation/InboundBlockTests.cs

@@ -0,0 +1,77 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Relationships;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// A remote account's Block of a persona, as Mastodon sends it (the pasture's last Mastodon expected failure, G-0002)
+	[Trait("Category", "Integration")]
+	public sealed class InboundBlockTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		[Fact]
+		public async Task A_block_ends_the_follows_both_ways_hides_the_blocker_and_its_undo_lifts_it()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			await _harness.FollowedBy(alice, carol);
+			await DB.Default.SaveAsync(new Following { AvatarId = alice.Id, TargetActorURI = carol.Id, State = FollowState.Accepted }, token);
+			var block = new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/blocks/{Guid.NewGuid():N}", ["type"] = "Block", ["actor"] = carol.Id, ["object"] = alice.Uri
+			};
+
+			await _harness.Deliver(carol, $"/peasants/{alice.UserName}/mouth", block);
+
+			Assert.True(await DB.Default.Find<BlockedBy>().Match(b => b.AvatarId == alice.Id && b.ActorURI == carol.Id).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<Follower>().Match(f => f.LocalActorId == alice.Id && f.ActorURI == carol.Id).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<Following>().Match(f => f.AvatarId == alice.Id && f.TargetActorURI == carol.Id).ExecuteAnyAsync(token));
+			Assert.Contains(carol.Id, await Hidden.AuthorsHiddenFrom(alice.Id, new[] { carol.Id }, forNotifications: false, token));
+			Assert.Contains(alice.Id, await Hidden.RecipientsHiding(new[] { alice.Id }, carol.Id, token));
+
+			await _harness.Deliver(carol, $"/peasants/{alice.UserName}/mouth", new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/undos/{Guid.NewGuid():N}", ["type"] = "Undo", ["actor"] = carol.Id, ["object"] = block
+			});
+
+			Assert.False(await DB.Default.Find<BlockedBy>().Match(b => b.AvatarId == alice.Id && b.ActorURI == carol.Id).ExecuteAnyAsync(token));
+			Assert.Empty(await Hidden.AuthorsHiddenFrom(alice.Id, new[] { carol.Id }, forNotifications: false, token));
+		}
+
+		[Fact]
+		public async Task A_block_of_someone_who_is_not_ours_is_dropped()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var carol = new RemoteActor(_harness.Peer, "carol");
+
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/blocks/{Guid.NewGuid():N}", ["type"] = "Block", ["actor"] = carol.Id,
+				["object"] = $"{Origin(carol)}/users/somebody-else"
+			});
+
+			Assert.False(await DB.Default.Find<BlockedBy>().Match(b => b.ActorURI == carol.Id).ExecuteAnyAsync(token));
+		}
+	}
+}

PrivaPub.Tests/Federation/InboundRoutingTests.cs

@@ -2,6 +2,7 @@ using MongoDB.Entities;
 
 using PrivaPub.ClientModels.Post;
 using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Group;
 using PrivaPub.Models.Post;
 using PrivaPub.Tests.Support;
 
@@ -106,6 +107,75 @@ namespace PrivaPub.Tests.Federation
 			Assert.NotNull(message.ConversationId);
 		}
 
+		// Mbin addresses its private messages to the recipient's profile page (its `url`), not to the actor
+		[Fact]
+		public async Task A_chat_message_addressed_to_a_personas_profile_page_reaches_the_persona()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mbin = new RemoteActor(_harness.Peer, "mbuser");
+			var messageId = NewId(mbin, "f/object");
+
+			await _harness.Deliver(mbin, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mbin, "f/object"), ["type"] = "Create", ["actor"] = mbin.Id, ["to"] = new JsonArray(alice.HtmlUrl), ["cc"] = new JsonArray(),
+				["object"] = new JsonObject
+				{
+					["id"] = messageId, ["type"] = "ChatMessage", ["attributedTo"] = mbin.Id, ["to"] = new JsonArray(alice.HtmlUrl), ["cc"] = new JsonArray(),
+					["content"] = "<p>an answer</p>", ["mediaType"] = "text/html", ["published"] = DateTime.UtcNow.ToString("O")
+				}
+			});
+
+			var message = await DB.Default.Find<Post>().Match(p => p.ObjectURI == messageId).ExecuteFirstAsync(token);
+			Assert.NotNull(message);
+			Assert.Equal(PostVisibility.Direct, message.Visibility);
+			var conversation = await DB.Default.Find<DmGroup>().OneAsync(message.ConversationId, token);
+			Assert.Equal(new[] { alice.Id, mbin.Id }.Order(StringComparer.Ordinal), conversation.Members.Select(m => m.AvatarId).Order(StringComparer.Ordinal));
+		}
+
+		// Lemmy 0.19 and Mbin take a private message only as a ChatMessage: someone who writes to us that way is answered in
+		// kind, anyone else with a Note
+		[Fact]
+		public async Task A_direct_message_answers_in_the_form_its_recipient_writes_in()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var lemmy = new RemoteActor(_harness.Peer, "pm");
+			var mastodon = new RemoteActor(_harness.Peer, "dm");
+			async Task<Post> Received(RemoteActor sender, string type)
+			{
+				var id = NewId(sender, "messages");
+				await _harness.Deliver(sender, "/human-centipede", new JsonObject
+				{
+					["id"] = NewId(sender, "activities/create"), ["type"] = "Create", ["actor"] = sender.Id, ["to"] = new JsonArray(alice.Uri),
+					["object"] = new JsonObject
+					{
+						["id"] = id, ["type"] = type, ["attributedTo"] = sender.Id, ["to"] = new JsonArray(alice.Uri),
+						["content"] = "<p>psst</p>", ["published"] = DateTime.UtcNow.ToString("O")
+					}
+				});
+				return await DB.Default.Find<Post>().Match(p => p.ObjectURI == id).ExecuteSingleAsync(token);
+			}
+			async Task<JsonObject> Answer(RemoteActor to, Post message)
+			{
+				var answer = await _harness.Statuses.Publish(alice, new PrivaPub.Domain.Statuses.StatusDraft
+				{
+					Text = "psst back", Visibility = PostVisibility.Direct, ConversationId = message.ConversationId
+				}, token);
+				Assert.True(answer.Ok, answer.Error);
+				return (JsonObject)(await _harness.Outgoing(to.Id + "/inbox")).Last(a => a["type"]!.GetValue<string>() == "Create")["object"]!;
+			}
+
+			var chat = await Answer(lemmy, await Received(lemmy, "ChatMessage"));
+			var note = await Answer(mastodon, await Received(mastodon, "Note"));
+
+			Assert.Equal("ChatMessage", chat["type"]!.GetValue<string>());
+			Assert.Equal(lemmy.Id, Assert.Single(chat["to"]!.AsArray())!.GetValue<string>());
+			Assert.Null(chat["cc"]);
+			Assert.DoesNotContain("h-card", chat["content"]!.GetValue<string>());
+			Assert.Equal("Note", note["type"]!.GetValue<string>());
+		}
+
 		[Fact]
 		public async Task An_unreachable_key_asks_the_sender_to_retry_instead_of_refusing()
 		{
@@ -121,6 +191,68 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal(300, result.RetryAfterSeconds);
 		}
 
+		// Forte follows a persona by its profile page, as WebFinger names it, rather than by its actor's id; so does its Undo
+		[Fact]
+		public async Task A_follow_of_a_personas_profile_page_follows_the_persona()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var forte = new RemoteActor(_harness.Peer, "forte");
+			var follow = new JsonObject { ["id"] = NewId(forte, "follow"), ["type"] = "Follow", ["actor"] = forte.Id, ["object"] = alice.HtmlUrl };
+
+			Assert.Equal(202, (await _harness.Deliver(forte, "/human-centipede", follow)).StatusCode);
+			Assert.True(await DB.Default.Find<PrivaPub.Models.Federation.Follower>().Match(f => f.LocalActorId == alice.Id && f.ActorURI == forte.Id && f.IsAccepted).ExecuteAnyAsync(token));
+			Assert.Contains(await _harness.Outgoing(forte.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Accept");
+
+			await _harness.Deliver(forte, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(forte, "undo"), ["type"] = "Undo", ["actor"] = forte.Id,
+				["object"] = new JsonObject { ["type"] = "Follow", ["actor"] = forte.Id, ["object"] = alice.HtmlUrl }
+			});
+			Assert.False(await DB.Default.Find<PrivaPub.Models.Federation.Follower>().Match(f => f.LocalActorId == alice.Id && f.ActorURI == forte.Id).ExecuteAnyAsync(token));
+		}
+
+		// Castopod announces an episode with a note that only links to it: the post takes the episode's sound, title and cover
+		[Fact]
+		public async Task A_note_that_only_links_its_authors_episode_carries_the_episodes_sound()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var podcast = new RemoteActor(_harness.Peer, "pod");
+			await DB.Default.SaveAsync(new PrivaPub.Models.Social.Following
+			{
+				AvatarId = alice.Id, TargetActorURI = podcast.Id, TargetInboxURL = podcast.Id + "/inbox", State = PrivaPub.Models.Social.FollowState.Accepted
+			}, token);
+			var origin = new Uri(podcast.Id).GetLeftPart(UriPartial.Authority);
+			var episodePath = $"/episodes/{Guid.NewGuid():N}";
+			_harness.Peer.Serve(episodePath, new JsonObject
+			{
+				["id"] = origin + episodePath, ["type"] = "PodcastEpisode", ["attributedTo"] = podcast.Id, ["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public"),
+				["description"] = new JsonObject { ["type"] = "Note", ["content"] = "the meadow", ["mediaType"] = "text/markdown" },
+				["image"] = new JsonObject { ["type"] = "Image", ["url"] = origin + "/cover.png" },
+				["audio"] = new JsonObject
+				{
+					["id"] = origin + "/one.mp3", ["type"] = "Audio", ["name"] = "Episode one", ["duration"] = 4.0,
+					["url"] = new JsonObject { ["href"] = origin + "/one.mp3", ["type"] = "Link", ["mediaType"] = "audio/mpeg" }
+				}
+			}.ToJsonString());
+			var noteId = NewId(podcast, "posts");
+
+			await _harness.Deliver(podcast, "/human-centipede", new JsonObject
+			{
+				["id"] = noteId + "/activity", ["type"] = "Create", ["actor"] = podcast.Id, ["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public"),
+				["object"] = new JsonObject
+				{
+					["id"] = noteId, ["type"] = "Note", ["attributedTo"] = podcast.Id, ["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public"),
+					["content"] = $"<a href=\"{origin + episodePath}\">Episode one</a><br/>", ["published"] = DateTime.UtcNow.ToString("O")
+				}
+			});
+
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteSingleAsync(token);
+			Assert.Equal(origin + "/one.mp3", Assert.Single(post.Media).RemoteURL);
+			Assert.Equal(("Episode one", origin + "/cover.png", 4.0), (post.Title, post.CoverURL, post.Audio.DurationSeconds));
+		}
+
 		[Fact]
 		public async Task A_join_of_a_local_post_is_answered_with_ignore()
 		{

PrivaPub.Tests/Federation/InboxGapTests.cs

@@ -0,0 +1,611 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+
+using System.Security.Cryptography;
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.FederatedSeeds;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class InboxGapTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static JsonObject Follow(RemoteActor follower, string target) =>
+			new() { ["id"] = NewId(follower, "follows"), ["type"] = "Follow", ["actor"] = follower.Id, ["object"] = target };
+
+		Task<ForeignAvatar> Stored(RemoteActor actor) =>
+			DB.Default.Find<ForeignAvatar>().Match(f => f.ActorURI == actor.Id).ExecuteSingleAsync(TestContext.Current.CancellationToken);
+
+		PrivaPub.Models.Statistics.InteractionEvent Processed(string activity) => _harness.Ledger.Of("in").Last(e => e.Activity == activity);
+
+		// a follow request nobody answers is sent again after 15 minutes, an hour, 6 hours... (Lemmy 1.0 lost the Accept of a
+		// follow it took before it started sending to us, and the community's posts were refused as not followed)
+		[Fact]
+		public async Task A_follow_request_nobody_answers_is_sent_again_with_a_growing_pause_until_it_is()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var quiet = new RemoteActor(_harness.Peer, "quiet");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = quiet.Id }, token);
+			var following = await DB.Default.Find<Following>().Match(f => f.AvatarId == alice.Id && f.TargetActorURI == quiet.Id).ExecuteSingleAsync(token);
+			async Task<int> Follows() => (await _harness.Outgoing(quiet.Id + "/inbox")).Count(a => a["type"]!.GetValue<string>() == "Follow");
+			var made = following.CreatedAt;
+			Assert.Equal(1, await Follows());
+
+			// (the store is shared with other tests' requests: what this one got is counted on its own inbox)
+			async Task<int> After(TimeSpan wait)
+			{
+				var before = await Follows();
+				await _harness.Follows.ResendPending(made + wait, token);
+				return await Follows() - before;
+			}
+			Assert.Equal(0, await After(TimeSpan.FromMinutes(10)));
+			Assert.Equal(1, await After(TimeSpan.FromMinutes(16)));
+			Assert.Equal(0, await After(TimeSpan.FromMinutes(30)));
+			Assert.Equal(1, await After(TimeSpan.FromMinutes(77)));
+			Assert.Equal(3, await Follows());
+			// each one again under its own id (Lemmy never answers an id it has seen), and an answer naming it counts
+			var sentIds = (await _harness.Outgoing(quiet.Id + "/inbox")).Select(a => a["id"]!.GetValue<string>()).ToList();
+			Assert.Equal(new[] { following.FollowActivityURI, following.FollowActivityURI + "-again-1", following.FollowActivityURI + "-again-2" }, sentIds);
+
+			// a request older than the count is sent again too; an answered one never
+			await DB.Default.Update<Following>().MatchID(following.ID).Modify(b => b.Unset(f => f.Resent)).Modify(b => b.Unset(f => f.ResentAt)).ExecuteAsync(token);
+			Assert.Equal(1, await After(TimeSpan.FromDays(1)));
+			await _harness.Deliver(quiet, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(quiet, "accepts"), ["type"] = "Accept", ["actor"] = quiet.Id, ["object"] = following.FollowActivityURI + "-again-2"
+			});
+			Assert.Equal(FollowState.Accepted, (await DB.Default.Find<Following>().OneAsync(following.ID, token)).State);
+			Assert.Equal(0, await After(TimeSpan.FromDays(30)));
+		}
+
+		// Pixelfed names our post by its page (/@name/<id>, the post's url) in its Like, Announce and their Undo: the post is
+		// found the same as by its id
+		// Friendica's activity ids are uniqid(), a prefix and the microsecond: two of its processes answering two follows at
+		// once gave both Accepts one id, and the second was dropped as a copy of the first, leaving that follow pending
+		[Fact]
+		public async Task Two_activities_a_server_gave_one_id_are_both_taken_and_a_true_copy_once()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var dario = new RemoteActor(_harness.Peer, "dario");
+			var jun = new RemoteActor(_harness.Peer, "jun");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = dario.Id }, token);
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = jun.Id }, token);
+			Task<Following> Of(RemoteActor target) =>
+				DB.Default.Find<Following>().Match(f => f.AvatarId == alice.Id && f.TargetActorURI == target.Id).ExecuteSingleAsync(token);
+			async Task<JsonObject> Accept(RemoteActor by, string id) => new()
+			{
+				["id"] = id,
+				["type"] = "Accept",
+				["actor"] = by.Id,
+				["object"] = new JsonObject { ["id"] = (await Of(by)).FollowActivityURI, ["type"] = "Follow", ["actor"] = alice.Uri, ["object"] = by.Id }
+			};
+			var shared = NewId(dario, "activity");
+
+			var first = await _harness.Deliver(dario, "/human-centipede", await Accept(dario, shared));
+			var second = await _harness.Deliver(jun, "/human-centipede", await Accept(jun, shared));
+			var copy = await _harness.Deliver(jun, "/human-centipede", await Accept(jun, shared));
+
+			Assert.Equal(("queued", "queued", "duplicate"), (first.Reason, second.Reason, copy.Reason));
+			Assert.Equal(FollowState.Accepted, (await Of(dario)).State);
+			Assert.Equal(FollowState.Accepted, (await Of(jun)).State);
+		}
+
+		// Mobilizon: the organiser creates, edits and deletes an event attributed to the group, which announces it. They used
+		// to be refused as misattributed (400), so the edit was lost and the deletion left the event in place
+		[Fact]
+		public async Task An_event_its_organiser_edits_and_deletes_for_a_group_on_the_same_server_follows_that_server()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var group = new RemoteActor(_harness.Peer, "group", type: "Group");
+			var organiser = new RemoteActor(_harness.Peer, "organiser");
+			await Follows(alice.Id, group);
+			var path = $"/events/{Guid.NewGuid():N}";
+			JsonObject Event(string name) => new()
+			{
+				["id"] = _harness.Peer.A + path, ["type"] = "Event", ["name"] = name, ["content"] = "<p>bring bread</p>",
+				["attributedTo"] = group.Id, ["actor"] = organiser.Id, ["startTime"] = "2026-10-08T18:00:00Z",
+				["to"] = new JsonArray(PrivaPub.Federation.Objects.Addressing.Public), ["cc"] = new JsonArray(group.Id + "/followers")
+			};
+			_harness.Peer.Serve(path, Event("A picnic").ToJsonString());
+			Task<Post> Stored() => DB.Default.Find<Post>().Match(p => p.ObjectURI == _harness.Peer.A + path).ExecuteFirstAsync(token);
+
+			var created = await _harness.Deliver(organiser, "/human-centipede", Create(organiser, Event("A picnic")));
+			Assert.Equal(202, created.StatusCode);
+			Assert.Equal(group.Id, (await Stored()).ActorURI);
+
+			var moved = Event("A picnic, moved indoors");
+			moved["updated"] = DateTime.UtcNow.AddMinutes(1).ToString("O");
+			_harness.Peer.Serve(path, moved.ToJsonString());
+			await _harness.Deliver(organiser, "/human-centipede", Activity(organiser, "Update", Event("what the activity claims")));
+			Assert.Equal("A picnic, moved indoors", (await Stored()).Title);
+
+			await _harness.Deliver(organiser, "/human-centipede", Activity(organiser, "Delete", JsonValue.Create(_harness.Peer.A + path)!));
+			Assert.NotNull(await Stored());
+			_harness.Peer.Answer(path, 410);
+			await _harness.Deliver(organiser, "/human-centipede", Activity(organiser, "Delete", JsonValue.Create(_harness.Peer.A + path)!));
+			Assert.Null(await Stored());
+
+			// attributed to someone of another server, it is still refused
+			var elsewhere = new RemoteActor(_harness.Peer, "elsewhere", _harness.Peer.B);
+			var claimed = Event("Someone else's");
+			claimed["id"] = _harness.Peer.A + $"/events/{Guid.NewGuid():N}";
+			claimed["attributedTo"] = elsewhere.Id;
+			Assert.Equal(400, (await _harness.Deliver(organiser, "/human-centipede", Create(organiser, claimed))).StatusCode);
+		}
+
+		// Funkwhale names its Accept after the Follow it answers (`<our Follow's id>/accept`), on our origin, not its own
+		[Fact]
+		public async Task An_answer_named_after_our_follow_is_taken_and_one_naming_someone_elses_is_not()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var channel = new RemoteActor(_harness.Peer, "channel");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = channel.Id }, token);
+			var following = await DB.Default.Find<Following>().Match(f => f.AvatarId == alice.Id && f.TargetActorURI == channel.Id).ExecuteSingleAsync(token);
+
+			var elsewhere = await _harness.Deliver(channel, "/human-centipede", new JsonObject
+			{
+				["id"] = "https://privapub.test/peasants/somebody/accept", ["type"] = "Accept", ["actor"] = channel.Id, ["object"] = following.FollowActivityURI
+			});
+			Assert.Equal(400, elsewhere.StatusCode);
+
+			var named = await _harness.Deliver(channel, "/human-centipede", new JsonObject
+			{
+				["id"] = following.FollowActivityURI + "/accept", ["type"] = "Accept", ["actor"] = channel.Id,
+				["object"] = new JsonObject { ["id"] = following.FollowActivityURI, ["type"] = "Follow", ["actor"] = alice.Uri, ["object"] = channel.Id }
+			});
+			Assert.Equal(202, named.StatusCode);
+			Assert.Equal(FollowState.Accepted, (await DB.Default.Find<Following>().OneAsync(following.ID, token)).State);
+		}
+
+		// Funkwhale's channel deletes its uploads in one Delete, their ids in a list as the object's id (and the Delete has
+		// no id of its own)
+		[Fact]
+		public async Task A_delete_naming_several_objects_removes_each()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var channel = new RemoteActor(_harness.Peer, "channel");
+			await Follows(alice.Id, channel);
+			var first = PublicNote(channel, "<p>a first track</p>");
+			var second = PublicNote(channel, "<p>a second track</p>");
+			await _harness.Deliver(channel, "/human-centipede", Create(channel, first));
+			await _harness.Deliver(channel, "/human-centipede", Create(channel, second));
+			Task<bool> Held(JsonObject note) => DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(note)).ExecuteAnyAsync(token);
+			Assert.True(await Held(first) && await Held(second));
+
+			var result = await _harness.Receiver.Receive(channel.Post(Harness.Host, "/human-centipede", new JsonObject
+			{
+				["type"] = "Delete", ["actor"] = channel.Id,
+				["object"] = new JsonObject { ["id"] = new JsonArray(IdOf(first), IdOf(second)), ["type"] = "Audio" }
+			}), default, token);
+			Assert.Equal(202, result.StatusCode);
+			var listed = IdOf(first);
+			var job = await DB.Default.Find<PrivaPub.Models.Jobs.Job>().Match(j => j.Kind == PrivaPub.Models.Jobs.JobKind.ProcessInbox
+				&& j.State == PrivaPub.Models.Jobs.JobState.Pending && j.Payload.Contains(listed)).Sort(j => j.CreatedAt, MongoDB.Entities.Order.Descending)
+				.ExecuteFirstAsync(token);
+			await _harness.Processor.Handle(job, token);
+
+			Assert.False(await Held(first));
+			Assert.False(await Held(second));
+		}
+
+		[Fact]
+		public async Task A_like_naming_a_post_by_its_page_counts_and_its_undo_too()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var fan = new RemoteActor(_harness.Peer, "fan");
+			var post = (await _harness.Statuses.Publish(alice, new StatusDraft { Text = "a picture" }, token)).Post;
+			var page = alice.PostHtmlUrl(post.ID);
+			Assert.NotEqual(post.ObjectURI, page);
+			var like = new JsonObject { ["id"] = NewId(fan, "likes"), ["type"] = "Like", ["actor"] = fan.Id, ["object"] = page };
+
+			await _harness.Deliver(fan, "/human-centipede", like);
+			Assert.Equal("accepted", Processed("Like").Outcome);
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+			await _harness.Deliver(fan, "/human-centipede", Activity(fan, "Undo", like));
+			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+
+			// a page that is no post of ours stays as it is
+			var elsewhere = new JsonObject { ["id"] = NewId(fan, "likes"), ["type"] = "Like", ["actor"] = fan.Id, ["object"] = alice.PostHtmlUrl("000000000000000000000000") };
+			await _harness.Deliver(fan, "/human-centipede", elsewhere);
+			Assert.Equal(("dropped", "unknown-object"), (Processed("Like").Outcome, Processed("Like").Reason));
+		}
+
+		[Fact]
+		public async Task An_actor_update_refreshes_the_account_from_its_origin_even_when_its_updated_is_older()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			await _harness.Deliver(bob, "/human-centipede", Follow(bob, alice.Uri));
+			var before = await Stored(bob);
+			using var rotated = RSA.Create(2048);
+			var document = bob.Document();
+			document["name"] = "Bob Renamed";
+			document["summary"] = "<p>a new bio<script>alert(1)</script></p>";
+			document["publicKey"]!["publicKeyPem"] = rotated.ExportSubjectPublicKeyInfoPem();
+			_harness.Peer.Serve(new Uri(bob.Id).AbsolutePath, document.ToJsonString());
+			var embedded = (JsonObject)document.DeepClone();
+			embedded["name"] = "What the activity claims";
+			embedded["updated"] = "2001-01-01T00:00:00Z";
+
+			var result = await _harness.Deliver(bob, "/human-centipede", Activity(bob, "Update", embedded));
+
+			var after = await Stored(bob);
+			Assert.Equal(202, result.StatusCode);
+			Assert.Null(before.Name);
+			Assert.Equal(before.ID, after.ID);
+			Assert.Equal("Bob Renamed", after.Name);
+			Assert.Equal("<p>a new bio</p>", after.Biography);
+			Assert.Equal(bob.KeyId, after.PublicKeyId);
+			Assert.NotEqual(before.PublicKey, after.PublicKey);
+			Assert.Equal(rotated.ExportSubjectPublicKeyInfoPem(), after.PublicKey);
+			Assert.Equal(("accepted", "actor-refresh"), (Processed("Update").Outcome, Processed("Update").Reason));
+		}
+
+		[Fact]
+		public async Task A_key_moved_to_a_new_id_replaces_the_old_one()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			await _harness.Deliver(bob, "/human-centipede", Follow(bob, alice.Uri));
+			using var rotated = RSA.Create(2048);
+			var document = bob.Document();
+			document["publicKey"] = new JsonObject { ["id"] = bob.Id + "#key-2", ["owner"] = bob.Id, ["publicKeyPem"] = rotated.ExportSubjectPublicKeyInfoPem() };
+			_harness.Peer.Serve(new Uri(bob.Id).AbsolutePath, document.ToJsonString());
+
+			await _harness.Deliver(bob, "/human-centipede", Activity(bob, "Update", JsonValue.Create(bob.Id)!));
+
+			var after = await Stored(bob);
+			Assert.Equal(bob.Id + "#key-2", after.PublicKeyId);
+			Assert.Equal(rotated.ExportSubjectPublicKeyInfoPem(), after.PublicKey);
+		}
+
+		[Fact]
+		public async Task Undoing_a_follow_removes_the_follower_by_the_activity_id_or_by_its_object()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			var bobFollows = Follow(bob, alice.Uri);
+			await _harness.Deliver(bob, "/human-centipede", bobFollows);
+			await _harness.Deliver(carol, "/human-centipede", Follow(carol, alice.Uri));
+			Assert.Equal(2, await DB.Default.CountAsync<Follower>(f => f.LocalActorId == alice.Id, token));
+
+			await _harness.Deliver(bob, "/human-centipede", Activity(bob, "Undo", JsonValue.Create(IdOf(bobFollows))!));
+			Assert.False(await DB.Default.Find<Follower>().Match(f => f.LocalActorId == alice.Id && f.ActorURI == bob.Id).ExecuteAnyAsync(token));
+			Assert.Equal(("accepted", "undone"), (Processed("Undo").Outcome, Processed("Undo").Reason));
+
+			var forgotten = Follow(carol, alice.Uri);
+			forgotten["id"] = NewId(carol, "follows");
+			await _harness.Deliver(carol, "/human-centipede", Activity(carol, "Undo", forgotten));
+			Assert.False(await DB.Default.Find<Follower>().Match(f => f.LocalActorId == alice.Id).ExecuteAnyAsync(token));
+
+			await _harness.Deliver(carol, "/human-centipede", Activity(carol, "Undo", forgotten));
+			Assert.Equal(("dropped", "unknown-object"), (Processed("Undo").Outcome, Processed("Undo").Reason));
+		}
+
+		[Fact]
+		public async Task A_rejected_quote_request_marks_the_quote_rejected_and_only_the_quoted_author_can_reject_it()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var ann = new RemoteActor(_harness.Peer, "ann");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var note = PublicNote(ann, "<p>ask me first</p>", alice.Uri);
+			note["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@alice" });
+			note["interactionPolicy"] = new JsonObject { ["canQuote"] = new JsonObject { ["manualApproval"] = new JsonArray(Addressing.Public) } };
+			await _harness.Deliver(ann, "/human-centipede", Create(ann, note));
+			var original = await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(note)).ExecuteSingleAsync(token);
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "may I?", QuotedStatusId = original.ID }, token);
+			Assert.Equal(QuoteState.Pending, outcome.Post.QuoteState);
+			var request = Assert.Single(await _harness.Outgoing(ann.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "QuoteRequest");
+
+			await _harness.Deliver(mallory, "/human-centipede", Activity(mallory, "Reject", JsonValue.Create(IdOf(request))!));
+			Assert.Equal(QuoteState.Pending, (await DB.Default.Find<Post>().OneAsync(outcome.Post.ID, token)).QuoteState);
+
+			await _harness.Deliver(ann, "/human-centipede", Activity(ann, "Reject", request));
+
+			var quoting = await DB.Default.Find<Post>().OneAsync(outcome.Post.ID, token);
+			Assert.Equal(QuoteState.Rejected, quoting.QuoteState);
+			Assert.Null(quoting.QuoteAuthorizationURI);
+			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(original.ID, token)).QuotesCount);
+			Assert.Equal(("accepted", "quote-answer"), (Processed("Reject").Outcome, Processed("Reject").Reason));
+		}
+
+		[Fact]
+		public async Task A_vote_a_followed_community_relays_counts_and_its_undo_takes_it_back()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var community = new RemoteActor(_harness.Peer, "cats", type: "Group");
+			var stranger = new RemoteActor(_harness.Peer, "dogs", type: "Group");
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			var voter = new RemoteActor(_harness.Peer, "voter");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = community.Id }, token);
+			await DB.Default.Update<Following>().Match(f => f.AvatarId == alice.Id).Modify(f => f.State, FollowState.Accepted).ExecuteAsync(token);
+			var page = PublicNote(poster, "<p>a post</p>", community.Id);
+			page["type"] = "Page";
+			page["name"] = "a title";
+			page["audience"] = community.Id;
+			_harness.Peer.Serve(new Uri(IdOf(page)).AbsolutePath, page.ToJsonString());
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", Create(poster, page)));
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(page)).ExecuteSingleAsync(token);
+			var like = new JsonObject { ["id"] = NewId(voter, "likes"), ["type"] = "Like", ["actor"] = voter.Id, ["object"] = post.ObjectURI, ["audience"] = community.Id };
+
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", like));
+			var liked = Processed("Announce");
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", Activity(voter, "Undo", like)));
+			var unliked = Processed("Announce");
+			await _harness.Deliver(stranger, "/human-centipede", Activity(stranger, "Announce", like));
+			var unfollowed = Processed("Announce");
+
+			//Lemmy relays its members' votes inside the community's Announce (G-0003): a voter on the community's own server
+			//is vouched for by it, and the vote is handled as if the voter had sent it; a community nobody follows is ignored
+			Assert.Equal("accepted", liked.Outcome);
+			Assert.Equal("accepted", unliked.Outcome);
+			Assert.Equal(("dropped", "not-followed"), (unfollowed.Outcome, unfollowed.Reason));
+			var after = await DB.Default.Find<Post>().OneAsync(post.ID, token);
+			Assert.Equal(0, after.FavouritesCount);
+			Assert.False(await DB.Default.Find<Favourite>().Match(f => f.PostId == post.ID).ExecuteAnyAsync(token));
+		}
+
+		// Lemmy sends a vote to the community alone: a vote on our reply in a thread of a community nobody here follows still
+		// reaches us through it, and only through that community (found by the town's village)
+		[Fact]
+		public async Task A_vote_on_our_reply_in_an_unfollowed_communitys_thread_counts_through_that_community_only()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var community = new RemoteActor(_harness.Peer, "cats", type: "Group");
+			var other = new RemoteActor(_harness.Peer, "dogs", type: "Group");
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			var voter = new RemoteActor(_harness.Peer, "voter");
+			var page = PublicNote(poster, "<p>a thread</p>", community.Id);
+			page["type"] = "Page";
+			page["name"] = "a thread";
+			page["audience"] = community.Id;
+			_harness.Peer.Serve(new Uri(IdOf(page)).AbsolutePath, page.ToJsonString());
+			var root = await _harness.RemotePosts.StoreContext(IdOf(page), 0, token);
+			Assert.Equal(community.Id, root.AudienceURI);
+			var reply = (await _harness.Statuses.Publish(alice, new StatusDraft { Text = "my answer", InReplyTo = root.ID }, token)).Post;
+			var like = new JsonObject { ["id"] = NewId(voter, "likes"), ["type"] = "Like", ["actor"] = voter.Id, ["object"] = reply.ObjectURI };
+
+			await _harness.Deliver(other, "/human-centipede", Activity(other, "Announce", like));
+			Assert.Equal(("dropped", "not-followed"), (Processed("Announce").Outcome, Processed("Announce").Reason));
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", like));
+			Assert.Equal("accepted", Processed("Announce").Outcome);
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(reply.ID, token)).FavouritesCount);
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", Activity(voter, "Undo", like)));
+			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(reply.ID, token)).FavouritesCount);
+		}
+
+		// PieFed moves a post to another community, and the community it leaves relays the Move: the post's thread goes with it
+		[Fact]
+		public async Task A_post_moved_to_another_community_takes_its_thread_along()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var community = new RemoteActor(_harness.Peer, "cats", type: "Group");
+			var other = new RemoteActor(_harness.Peer, "dogs", type: "Group");
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = community.Id }, token);
+			await DB.Default.Update<Following>().Match(f => f.AvatarId == alice.Id).Modify(f => f.State, FollowState.Accepted).ExecuteAsync(token);
+			async Task<Post> Announced(JsonObject note)
+			{
+				note["audience"] = community.Id;
+				_harness.Peer.Serve(new Uri(IdOf(note)).AbsolutePath, note.ToJsonString());
+				await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", Create(poster, note)));
+				return await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(note)).ExecuteSingleAsync(token);
+			}
+			var page = PublicNote(poster, "<p>misplaced</p>", community.Id);
+			page["type"] = "Page";
+			page["name"] = "misplaced";
+			var post = await Announced(page);
+			var comment = PublicNote(poster, "<p>a comment</p>", community.Id);
+			comment["inReplyTo"] = IdOf(page);
+			var answer = await Announced(comment);
+			var move = new JsonObject
+			{
+				["id"] = NewId(poster, "moves"), ["type"] = "Move", ["actor"] = poster.Id, ["object"] = post.ObjectURI, ["origin"] = community.Id, ["target"] = other.Id
+			};
+
+			// only the community it leaves speaks for it
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", new JsonObject
+			{
+				["id"] = NewId(poster, "moves"), ["type"] = "Move", ["actor"] = poster.Id, ["object"] = post.ObjectURI, ["origin"] = other.Id, ["target"] = community.Id
+			}));
+			Assert.Equal(("dropped", "unsupported"), (Processed("Announce").Outcome, Processed("Announce").Reason));
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", move));
+			Assert.Equal(("accepted", "moved"), (Processed("Announce").Outcome, Processed("Announce").Reason));
+			Assert.Equal(other.Id, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).AudienceURI);
+			Assert.Equal(other.Id, (await DB.Default.Find<Post>().OneAsync(answer.ID, token)).AudienceURI);
+		}
+
+		// Lemmy's moderators lock a community's post and ban members, and the community relays both inside its Announce
+		// (G-0006): a locked post takes no reply, a banned persona posts nothing there, until the Undo
+		[Fact]
+		public async Task A_community_locks_a_post_and_bans_a_persona_until_it_undoes_either()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var community = new RemoteActor(_harness.Peer, "cats", type: "Group");
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			var moderator = new RemoteActor(_harness.Peer, "moderator");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = community.Id }, token);
+			await DB.Default.Update<Following>().Match(f => f.AvatarId == alice.Id).Modify(f => f.State, FollowState.Accepted).ExecuteAsync(token);
+			JsonObject Page(string text, bool commentsEnabled = true)
+			{
+				var page = PublicNote(poster, $"<p>{text}</p>", community.Id);
+				page["type"] = "Page";
+				page["name"] = text;
+				page["audience"] = community.Id;
+				page["commentsEnabled"] = commentsEnabled;
+				_harness.Peer.Serve(new Uri(IdOf(page)).AbsolutePath, page.ToJsonString());
+				return page;
+			}
+			async Task<Post> Announced(JsonObject page)
+			{
+				await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", Create(poster, page)));
+				return await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(page)).ExecuteSingleAsync(token);
+			}
+			Task<StatusOutcome> Reply(Post post) => _harness.Statuses.Publish(alice, new StatusDraft { Text = "a reply", InReplyTo = post.ID }, token);
+			var post = await Announced(Page("a thread"));
+			var lockIt = new JsonObject { ["id"] = NewId(moderator, "locks"), ["type"] = "Lock", ["actor"] = moderator.Id, ["object"] = post.ObjectURI };
+
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", lockIt));
+			Assert.Equal(("accepted", "locked"), (Processed("Announce").Outcome, Processed("Announce").Reason));
+			var refused = await Reply(post);
+			Assert.Equal((422, "Validation failed: This thread is locked"), (refused.Status, refused.Error));
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", Activity(moderator, "Undo", lockIt)));
+			Assert.Null((await DB.Default.Find<Post>().OneAsync(post.ID, token)).LockedAt);
+			Assert.True((await Reply(post)).Ok);
+			// a post its community serves locked arrives locked
+			Assert.NotNull((await Announced(Page("born locked", commentsEnabled: false))).LockedAt);
+
+			var ban = new JsonObject { ["id"] = NewId(moderator, "bans"), ["type"] = "Block", ["actor"] = moderator.Id, ["object"] = alice.Uri, ["target"] = community.Id };
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", ban));
+			Assert.Equal(("accepted", "banned"), (Processed("Announce").Outcome, Processed("Announce").Reason));
+			var banned = await Reply(post);
+			Assert.Equal((422, "Validation failed: This community banned you"), (banned.Status, banned.Error));
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", Activity(moderator, "Undo", ban)));
+			Assert.Equal(("accepted", "unbanned"), (Processed("Announce").Outcome, Processed("Announce").Reason));
+			Assert.True((await Reply(post)).Ok);
+
+			// Lemmy also sends the ban straight to the persona's server, as its moderator's Block: still the community's ban,
+			// never the moderator's own block of the persona
+			var direct = new JsonObject { ["id"] = NewId(moderator, "bans"), ["type"] = "Block", ["actor"] = moderator.Id, ["object"] = alice.Uri, ["target"] = community.Id };
+			await _harness.Deliver(moderator, "/human-centipede", direct);
+			Assert.Equal(("accepted", "banned"), (Processed("Block").Outcome, Processed("Block").Reason));
+			Assert.False(await DB.Default.Find<BlockedBy>().Match(b => b.AvatarId == alice.Id && b.ActorURI == moderator.Id).ExecuteAnyAsync(token));
+			Assert.Equal(422, (await Reply(post)).Status);
+			await _harness.Deliver(moderator, "/human-centipede", Activity(moderator, "Undo", direct));
+			Assert.True((await Reply(post)).Ok);
+
+			var elsewhere = new JsonObject { ["id"] = NewId(moderator, "bans"), ["type"] = "Block", ["actor"] = moderator.Id, ["object"] = poster.Id, ["target"] = community.Id };
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", elsewhere));
+			Assert.Equal(("dropped", "not-ours"), (Processed("Announce").Outcome, Processed("Announce").Reason));
+		}
+
+		// a voter on another server than the community is believed for the community's own posts, as Lemmy trusts it; for
+		// anything else only once its vote is fetched from its own origin
+		[Fact]
+		public async Task A_relayed_vote_from_another_server_counts_on_the_communitys_posts_and_elsewhere_only_once_fetched()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var community = new RemoteActor(_harness.Peer, "cats", type: "Group");
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			var voter = new RemoteActor(_harness.Peer, "voter", origin: _harness.Peer.B);
+			var forger = new RemoteActor(_harness.Peer, "forger", origin: _harness.Peer.B);
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = community.Id }, token);
+			await DB.Default.Update<Following>().Match(f => f.AvatarId == alice.Id).Modify(f => f.State, FollowState.Accepted).ExecuteAsync(token);
+			var page = PublicNote(poster, "<p>a post</p>", community.Id);
+			page["type"] = "Page";
+			page["name"] = "a title";
+			_harness.Peer.Serve(new Uri(IdOf(page)).AbsolutePath, page.ToJsonString());
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", Create(poster, page)));
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(page)).ExecuteSingleAsync(token);
+			var other = await OwnPost(alice, token);
+			var like = new JsonObject { ["id"] = NewId(voter, "likes"), ["type"] = "Like", ["actor"] = voter.Id, ["object"] = post.ObjectURI };
+			var forged = new JsonObject { ["id"] = NewId(forger, "likes"), ["type"] = "Like", ["actor"] = forger.Id, ["object"] = other.ObjectURI };
+
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", like));
+			await _harness.Deliver(community, "/human-centipede", Activity(community, "Announce", forged));
+
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+			Assert.True(await DB.Default.Find<Favourite>().Match(f => f.PostId == post.ID && f.ActorURI == voter.Id).ExecuteAnyAsync(token));
+			Assert.Equal(("dropped", "fetch-failed"), (Processed("Announce").Outcome, Processed("Announce").Reason));
+			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(other.ID, token)).FavouritesCount);
+		}
+
+		// a public post of a persona's own, outside any community
+		static async Task<Post> OwnPost(PrivaPub.Federation.Actors.LocalActor author, CancellationToken token)
+		{
+			var post = new Post { GroupUserId = author.Id, AuthorAccountId = author.Id, Text = "not the community's" };
+			post.ID = (string)post.GenerateNewID();
+			post.ObjectURI = author.PostUri(post.ID);
+			await DB.Default.SaveAsync(post, token);
+			return post;
+		}
+
+		[Fact]
+		public async Task A_locked_persona_holds_a_follow_until_it_decides_and_answers_with_the_original_follow()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, open) = await _harness.Persona("alice");
+			await DB.Default.Update<Avatar>().MatchID(open.Id).Modify(a => a.Settings.IsLocked, true).ExecuteAsync(token);
+			var alice = await _harness.Local.FindById(LocalActorKind.Person, open.Id, token);
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			var bobFollows = Follow(bob, alice.Uri);
+			var carolFollows = Follow(carol, alice.Uri);
+			Assert.True(alice.ManuallyApprovesFollowers);
+
+			await _harness.Deliver(bob, "/human-centipede", bobFollows);
+			await _harness.Deliver(carol, "/human-centipede", carolFollows);
+
+			var pending = await DB.Default.Find<Follower>().Match(f => f.LocalActorId == alice.Id).ExecuteAsync(token);
+			Assert.Equal(2, pending.Count);
+			Assert.All(pending, f => Assert.False(f.IsAccepted));
+			Assert.Equal(("accepted", "pending"), (Processed("Follow").Outcome, Processed("Follow").Reason));
+			var requests = await DB.Default.Find<Notification>().Match(n => n.AvatarId == alice.Id).ExecuteAsync(token);
+			Assert.Equal(2, requests.Count);
+			Assert.All(requests, n => Assert.Equal(NotificationType.FollowRequest, n.Type));
+			Assert.Empty(await _harness.Outgoing(bob.Id + "/inbox"));
+			Assert.Empty(await _harness.Delivery.FollowerInboxes(alice, token));
+
+			var bobAccount = await Stored(bob);
+			var carolAccount = await Stored(carol);
+			Assert.True(await _harness.Follows.Decide(alice, bobAccount.ID, accept: true, token));
+			Assert.True(await _harness.Follows.Decide(alice, carolAccount.ID, accept: false, token));
+			Assert.False(await _harness.Follows.Decide(alice, carolAccount.ID, accept: true, token));
+
+			var accept = Assert.Single(await _harness.Outgoing(bob.Id + "/inbox"));
+			Assert.Equal("Accept", accept["type"]!.GetValue<string>());
+			Assert.Equal(alice.Uri, accept["actor"]!.GetValue<string>());
+			Assert.Equal(IdOf(bobFollows), IdOf(accept["object"]!));
+			Assert.Equal(bob.Id, accept["object"]!["actor"]!.GetValue<string>());
+			var reject = Assert.Single(await _harness.Outgoing(carol.Id + "/inbox"));
+			Assert.Equal("Reject", reject["type"]!.GetValue<string>());
+			Assert.Equal(IdOf(carolFollows), IdOf(reject["object"]!));
+			Assert.True((await DB.Default.Find<Follower>().Match(f => f.LocalActorId == alice.Id && f.ActorURI == bob.Id).ExecuteSingleAsync(token)).IsAccepted);
+			Assert.False(await DB.Default.Find<Follower>().Match(f => f.LocalActorId == alice.Id && f.ActorURI == carol.Id).ExecuteAnyAsync(token));
+			Assert.Contains(await DB.Default.Find<Notification>().Match(n => n.AvatarId == alice.Id && n.Type == NotificationType.Follow).ExecuteAsync(token),
+				n => n.FromAccountId == bobAccount.ID);
+			Assert.Equal(new[] { bob.Id + "/inbox" }, await _harness.Delivery.FollowerInboxes(alice, token));
+		}
+	}
+}

PrivaPub.Tests/Federation/InboxScenarioTests.cs

@@ -171,12 +171,19 @@ namespace PrivaPub.Tests.Federation
 			var token = TestContext.Current.CancellationToken;
 			var alice = await LocalAvatar("alice");
 			var mallory = new RemoteActor(_peer, "mallory");
-			var victim = new RemoteActor(_peer, "victim");
+			var victim = new RemoteActor(_peer, "victim", _peer.B);
 
 			var result = await Deliver(mallory, $"/peasants/{alice.UserName}/mouth", DirectCreate(mallory, alice.Uri, attributedTo: victim.Id));
 
 			Assert.Equal(400, result.StatusCode);
 			Assert.False(await DB.Default.Find<Post>().Match(p => p.ActorURI == victim.Id).ExecuteAnyAsync(token));
+
+			// a colleague on mallory's own server is that server's to vouch for: believed only as the server has it, and
+			// it has no such note
+			var colleague = new RemoteActor(_peer, "colleague");
+			result = await Deliver(mallory, $"/peasants/{alice.UserName}/mouth", DirectCreate(mallory, alice.Uri, attributedTo: colleague.Id));
+			Assert.Equal(202, result.StatusCode);
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ActorURI == colleague.Id).ExecuteAnyAsync(token));
 		}
 
 		[Fact]
@@ -263,44 +270,42 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal(alice.Id, mention.AccountId);
 		}
 
+		// GoToSocial kept a persona in cc after an edit took the @name out, and Akkoma addresses with to[] alone: the persona it
+		// is addressed to sees a followers-only post as a silent mention, which no list shows as a mention (found by the town)
+		[Fact]
+		public async Task A_followers_only_post_addressed_to_a_persona_without_naming_it_is_a_silent_mention()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var alice = await LocalAvatar("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var create = PublicCreate(bob, default, alice.Uri);
+			create["object"]!["to"] = bob.Id + "/followers";
+			create["object"]!["cc"] = alice.Uri;
+
+			await Deliver(bob, "/human-centipede", create);
+
+			var post = await DB.Default.Find<Post>().Match(p => p.ActorURI == bob.Id).ExecuteSingleAsync(token);
+			Assert.Equal(PostVisibility.FollowersOnly, post.Visibility);
+			var mention = Assert.Single(post.Mentions);
+			Assert.True(mention.Silent);
+			Assert.Equal(alice.Id, mention.AccountId);
+			Assert.True(await PrivaPub.Domain.Privacy.VisibilityPolicy.CanSee(post, alice.Id, token));
+		}
+
 		[Fact]
 		public async Task A_suspended_domain_is_dropped_before_its_key_is_fetched()
 		{
 			var token = TestContext.Current.CancellationToken;
 			var alice = await LocalAvatar("alice");
 			var bob = new RemoteActor(_peer, "bob", _peer.B);
-			await DB.Default.SaveAsync(new DomainBlock { Domain = "localhost", Severity = DomainBlockSeverity.Suspend }, token);
-			try
-			{
-				await _blocks.Reload(token);
-				var before = _peer.Requests.Count;
+			_blocks.Load(new[] { new DomainBlock { Domain = "localhost", Severity = DomainBlockSeverity.Suspend } });
+			var before = _peer.Requests.Count;
 
-				var result = await Deliver(bob, $"/peasants/{alice.UserName}/mouth", DirectCreate(bob, alice.Uri));
+			var result = await Deliver(bob, $"/peasants/{alice.UserName}/mouth", DirectCreate(bob, alice.Uri));
 
-				Assert.Equal(202, result.StatusCode);
-				Assert.Equal(before, _peer.Requests.Count);
-				Assert.False(await DB.Default.Find<Post>().Match(p => p.ActorURI == bob.Id).ExecuteAnyAsync(token));
-			}
-			finally
-			{
-				await DB.Default.DeleteAsync<DomainBlock>(b => b.Domain == "localhost");
-				await _blocks.Reload(token);
-			}
-		}
-
-		[Fact]
-		public void A_block_covers_subdomains_but_not_lookalikes()
-		{
-			var blocks = new DomainBlocks(NullLogger<DomainBlocks>.Instance);
-			typeof(DomainBlocks).GetField("_blocks", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
-				.SetValue(blocks, new Dictionary<string, DomainBlock> { ["evil.example"] = new() { Domain = "evil.example", Severity = DomainBlockSeverity.Silence } });
-			typeof(DomainBlocks).GetField("_loadedAt", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
-				.SetValue(blocks, DateTime.UtcNow);
-
-			Assert.NotNull(blocks.Find("evil.example"));
-			Assert.NotNull(blocks.Find("A.Evil.Example."));
-			Assert.Null(blocks.Find("notevil.example"));
-			Assert.False(blocks.IsSuspended("evil.example"));
+			Assert.Equal(202, result.StatusCode);
+			Assert.Equal(before, _peer.Requests.Count);
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ActorURI == bob.Id).ExecuteAnyAsync(token));
 		}
 
 		[Fact]

PrivaPub.Tests/Federation/IntegrityProofTests.cs

@@ -0,0 +1,175 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Federation.Signing;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+
+using System.Text;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// FEP-8b32 proofs (eddsa-jcs-2022) by a persona's Ed25519 key, which its actor names as a FEP-521a Multikey
+	public sealed class IntegrityProofTests
+	{
+		[Fact]
+		public void Canonical_json_is_rfc_8785s()
+		{
+			// RFC 8785, section 3.2.2
+			var input = JsonNode.Parse("{\"numbers\":[333333333.33333329,1E30,4.50,2e-3,0.000000000000000000000000001],"
+				+ "\"string\":\"\\u20ac$\\u000F\\u000aA'\\u0042\\u0022\\u005c\\\\\\\"\\/\",\"literals\":[null,true,false]}");
+
+			Assert.Equal("{\"literals\":[null,true,false],\"numbers\":[333333333.3333333,1e+30,4.5,0.002,1e-27],\"string\":\"€$\\u000f\\nA'B\\\"\\\\\\\\\\\"/\"}",
+				Jcs.Serialize(input));
+		}
+
+		[Fact]
+		public void Base58_and_multikeys_read_back_what_they_write()
+		{
+			Assert.Equal("2NEpo7TZRRrLZSi2U", IntegrityProofs.Base58(Encoding.ASCII.GetBytes("Hello World!")));
+			Assert.Equal("112", IntegrityProofs.Base58(new byte[] { 0, 0, 1 }));
+			Assert.Equal(new byte[] { 0, 0, 1 }, IntegrityProofs.FromBase58("112"));
+
+			var publicKey = IntegrityProofs.PublicKey(IntegrityProofs.NewSeed());
+			var multikey = IntegrityProofs.Multikey(publicKey);
+			Assert.StartsWith("z6Mk", multikey);
+			Assert.Equal(publicKey, IntegrityProofs.FromMultikey(multikey));
+		}
+
+		[Fact]
+		public void A_proof_verifies_with_its_key_and_with_nothing_changed()
+		{
+			var seed = IntegrityProofs.NewSeed();
+			var activity = new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.Context(), ["id"] = "https://privapub.test/peasants/alice/grunts/1", ["type"] = "Create",
+				["actor"] = "https://privapub.test/peasants/alice", ["object"] = new JsonObject { ["type"] = "Note", ["content"] = "<p>ciao, è così</p>", ["width"] = 4.5 }
+			};
+			activity["proof"] = IntegrityProofs.Create(activity, "https://privapub.test/peasants/alice#ed25519-key", seed, DateTime.UtcNow);
+
+			var delivered = JsonNode.Parse(activity.ToJsonString())!.AsObject();
+			Assert.True(IntegrityProofs.Verify(delivered, IntegrityProofs.PublicKey(seed)));
+			Assert.Equal("assertionMethod", delivered["proof"]!["proofPurpose"]!.GetValue<string>());
+
+			var changed = delivered.DeepClone().AsObject();
+			changed["object"]!["content"] = "<p>something else</p>";
+			Assert.False(IntegrityProofs.Verify(changed, IntegrityProofs.PublicKey(seed)));
+			Assert.False(IntegrityProofs.Verify(delivered, IntegrityProofs.PublicKey(IntegrityProofs.NewSeed())));
+		}
+
+		[Fact]
+		public void A_persona_with_a_key_names_it_as_a_multikey()
+		{
+			var seed = IntegrityProofs.NewSeed();
+			var actor = ActivityPubRenderer.Actor(new LocalActor { Id = "a", UserName = "alice", BaseAddress = Harness.Base, Kind = LocalActorKind.Person, SigningKey = seed });
+			var keyless = ActivityPubRenderer.Actor(new LocalActor { Id = "b", UserName = "bob", BaseAddress = Harness.Base, Kind = LocalActorKind.Person });
+
+			var key = Assert.Single(actor["assertionMethod"]!.AsArray())!;
+			Assert.Equal(($"{Harness.Base}/peasants/alice#ed25519-key", "Multikey", $"{Harness.Base}/peasants/alice"),
+				(key["id"]!.GetValue<string>(), key["type"]!.GetValue<string>(), key["controller"]!.GetValue<string>()));
+			Assert.Equal(IntegrityProofs.PublicKey(seed), IntegrityProofs.FromMultikey(key["publicKeyMultibase"]!.GetValue<string>()));
+			Assert.Null(keyless["assertionMethod"]);
+		}
+	}
+
+	[Trait("Category", "Integration")]
+	[Xunit.Collection(nameof(Exclusive))]
+	public sealed class DeliveredProofTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		// what goes to a relay carries the persona's proof, to be forwarded on its strength; what goes to a server directly
+		// does not (Mitra refuses a proof by a key it has not read yet); another's activity passed on never gets ours
+		[Fact]
+		public async Task A_personas_activity_goes_to_a_relay_with_its_proof_and_elsewhere_without()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, persona) = await _harness.Persona("alice");
+			var seed = IntegrityProofs.NewSeed();
+			await DB.Default.Update<Avatar>().MatchID(persona.Id).Modify(a => a.SigningKey, seed).ExecuteAsync(token);
+			var alice = _harness.Local.FromAvatar(await DB.Default.Find<Avatar>().MatchID(persona.Id).ExecuteSingleAsync(token));
+			var relayInbox = $"{_harness.Peer.A}/relay-{Guid.NewGuid():N}/inbox";
+			var serverInbox = _harness.Peer.A + "/proofs/inbox";
+			await DB.Default.SaveAsync(new RelaySubscription
+			{
+				Configured = relayInbox, ActorURI = relayInbox.Replace("/inbox", "/actor"), InboxURL = relayInbox, State = RelayState.Accepted
+			}, token);
+			var own = new JsonObject { ["id"] = alice.ActivityUri(Guid.NewGuid().ToString("N")), ["type"] = "Create", ["actor"] = alice.Uri, ["object"] = new JsonObject { ["type"] = "Note" } };
+			var passedOn = new JsonObject { ["id"] = $"https://elsewhere.example/activities/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = "https://elsewhere.example/users/bob" };
+
+			try
+			{
+				await _harness.Delivery.Enqueue(alice, new[] { relayInbox, serverInbox }, own, token);
+				await _harness.Delivery.Enqueue(alice, new[] { relayInbox }, passedOn, token);
+
+				var toRelay = await _harness.Outgoing(relayInbox);
+				var signed = Assert.Single(toRelay, a => a["actor"]!.GetValue<string>() == alice.Uri);
+				Assert.Equal(alice.AssertionKeyId, signed["proof"]!["verificationMethod"]!.GetValue<string>());
+				Assert.True(IntegrityProofs.Verify(signed, IntegrityProofs.PublicKey(seed)));
+				Assert.Null(Assert.Single(toRelay, a => a["actor"]!.GetValue<string>() != alice.Uri)["proof"]);
+				Assert.Null(Assert.Single(await _harness.Outgoing(serverInbox))["proof"]);
+				Assert.Null(own["proof"]);
+			}
+			finally
+			{
+				await DB.Default.DeleteAsync<RelaySubscription>(s => s.InboxURL == relayInbox);
+			}
+		}
+
+		// a post forwarded by another server, which its origin does not serve: taken on its author's proof, never without
+		[Fact]
+		public async Task A_forwarded_post_with_its_authors_proof_is_taken_as_it_came()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var author = new RemoteActor(_harness.Peer, "author", ed25519: true);
+			var forwarder = new RemoteActor(_harness.Peer, "forwarder", _harness.Peer.B);
+			await DB.Default.SaveAsync(new PrivaPub.Models.Social.Following
+			{
+				AvatarId = alice.Id, TargetActorURI = author.Id, TargetInboxURL = author.Id + "/inbox", State = PrivaPub.Models.Social.FollowState.Accepted
+			}, token);
+			JsonObject Create(string text)
+			{
+				var noteId = $"{new Uri(author.Id).GetLeftPart(UriPartial.Authority)}/notes/{Guid.NewGuid():N}";
+				return new JsonObject
+				{
+					["@context"] = "https://www.w3.org/ns/activitystreams", ["id"] = noteId + "/activity", ["type"] = "Create", ["actor"] = author.Id,
+					["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public"),
+					["object"] = new JsonObject
+					{
+						["id"] = noteId, ["type"] = "Note", ["attributedTo"] = author.Id, ["content"] = $"<p>{text}</p>",
+						["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public"), ["published"] = DateTime.UtcNow.ToString("O")
+					}
+				};
+			}
+			var proven = author.Prove(Create("proven"));
+			var tampered = author.Prove(Create("as written"));
+			tampered["object"]!["content"] = "<p>changed on the way</p>";
+			var bare = Create("unproven");
+
+			await _harness.Deliver(forwarder, "/human-centipede", proven);
+			await _harness.Deliver(forwarder, "/human-centipede", tampered);
+			await _harness.Deliver(forwarder, "/human-centipede", bare);
+
+			Task<bool> Held(JsonObject create) => DB.Default.Find<PrivaPub.Models.Post.Post>().Match(p => p.ObjectURI == create["object"]!["id"]!.GetValue<string>()).ExecuteAnyAsync(token);
+			Assert.True(await Held(proven));
+			Assert.False(await Held(tampered));
+			Assert.False(await Held(bare));
+		}
+	}
+}

PrivaPub.Tests/Federation/InteractionPolicyTests.cs

@@ -0,0 +1,284 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.FederatedSeeds;
+
+namespace PrivaPub.Tests.Federation
+{
+	// GoToSocial's interaction policies: who may reply to, like and boost a post at once, who must ask its author first, and
+	// who may not
+	[Trait("Category", "Integration")]
+	public sealed class InteractionPolicyTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static JsonObject Rule(params string[] automatic) => Rule(automatic, Array.Empty<string>());
+
+		static JsonObject Rule(string[] automatic, string[] manual) => new()
+		{
+			["automaticApproval"] = new JsonArray(automatic.Select(a => (JsonNode)a).ToArray()),
+			["manualApproval"] = new JsonArray(manual.Select(m => (JsonNode)m).ToArray())
+		};
+
+		// bob's public post, which alice follows bob to see, under the policy given
+		async Task<(PrivaPub.Federation.Actors.LocalActor Alice, RemoteActor Bob, Post Post, RemoteActor Fan)> Posted(JsonObject policy)
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var fan = new RemoteActor(_harness.Peer, "fan");
+			await Follows(alice.Id, bob);
+			await _harness.FollowedBy(alice, fan);
+			var note = PublicNote(bob, "<p>a post with rules</p>");
+			note["interactionPolicy"] = policy;
+			await _harness.Deliver(bob, "/human-centipede", Create(bob, note));
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(note)).ExecuteSingleAsync(token);
+			return (alice, bob, post, fan);
+		}
+
+		Task<List<JsonObject>> To(RemoteActor actor) => _harness.Outgoing(actor.Id + "/inbox");
+
+		Task<List<JsonObject>> ToShared(RemoteActor actor) => _harness.Outgoing(actor.SharedInbox);
+
+		JsonObject Authorization(RemoteActor author, string type, string interaction, Post target)
+		{
+			var path = $"/authorizations/{Guid.NewGuid():N}";
+			var stamp = new JsonObject
+			{
+				["id"] = Origin(author) + path, ["type"] = type, ["attributedTo"] = author.Id,
+				["interactingObject"] = interaction, ["interactionTarget"] = target.ObjectURI
+			};
+			_harness.Peer.Serve(path, stamp.ToJsonString());
+			return stamp;
+		}
+
+		[Fact]
+		public async Task A_reply_the_policy_lets_in_at_once_goes_out_as_always_and_one_it_shuts_out_is_refused()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (alice, bob, post, _) = await Posted(new JsonObject { ["canReply"] = Rule("https://www.w3.org/ns/activitystreams#Public") });
+			var reply = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "an open reply", InReplyTo = post.ID }, token);
+			Assert.Equal(ApprovalState.None, reply.Post.Approval);
+			Assert.Contains(await To(bob), a => a["type"]!.GetValue<string>() == "Create");
+
+			var (carol, dave, shut, _) = await Posted(new JsonObject { ["canReply"] = Rule(new string[0], new string[0]) });
+			var refused = await _harness.Statuses.Publish(carol, new StatusDraft { Text = "a shut-out reply", InReplyTo = shut.ID }, token);
+			Assert.Equal(422, refused.Status);
+		}
+
+		[Fact]
+		public async Task A_reply_its_author_must_approve_is_asked_for_and_goes_out_with_the_authorization_once_given()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (alice, bob, post, fan) = await Posted(new JsonObject
+			{
+				["canReply"] = Rule(new[] { "https://dummy.invalid/nobody" }, new[] { "https://www.w3.org/ns/activitystreams#Public" })
+			});
+
+			var reply = (await _harness.Statuses.Publish(alice, new StatusDraft { Text = "may I?", InReplyTo = post.ID }, token)).Post;
+
+			Assert.Equal(ApprovalState.Pending, reply.Approval);
+			var request = Assert.Single(await To(bob), a => a["type"]!.GetValue<string>() == "ReplyRequest");
+			Assert.Equal(post.ObjectURI, request["object"]!.GetValue<string>());
+			Assert.Equal(reply.ObjectURI, request["instrument"]!["id"]!.GetValue<string>());
+			Assert.DoesNotContain(await ToShared(fan), a => a["type"]!.GetValue<string>() == "Create");
+
+			var stamp = Authorization(bob, "ReplyAuthorization", reply.ObjectURI, post);
+			await _harness.Deliver(bob, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(bob, "accepts"), ["type"] = "Accept", ["actor"] = bob.Id,
+				["object"] = new JsonObject { ["type"] = "ReplyRequest", ["id"] = request["id"]!.GetValue<string>() },
+				["result"] = IdOf(stamp)
+			});
+
+			var after = await DB.Default.Find<Post>().OneAsync(reply.ID, token);
+			Assert.Equal((ApprovalState.Accepted, IdOf(stamp)), (after.Approval, after.ApprovalURI));
+			var create = Assert.Single(await ToShared(fan), a => a["type"]!.GetValue<string>() == "Create");
+			Assert.Equal(IdOf(stamp), create["object"]!["replyAuthorization"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task A_rejected_reply_stays_ours_alone_and_a_forged_authorization_changes_nothing()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (alice, bob, post, fan) = await Posted(new JsonObject
+			{
+				["canReply"] = Rule(new[] { "https://dummy.invalid/nobody" }, new[] { "https://www.w3.org/ns/activitystreams#Public" })
+			});
+			var reply = (await _harness.Statuses.Publish(alice, new StatusDraft { Text = "may I?", InReplyTo = post.ID }, token)).Post;
+			var request = Assert.Single(await To(bob), a => a["type"]!.GetValue<string>() == "ReplyRequest");
+
+			// an authorization naming another post is no authorization
+			var forged = Authorization(bob, "ReplyAuthorization", reply.ObjectURI, new Post { ObjectURI = "https://elsewhere.invalid/post" });
+			await _harness.Deliver(bob, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(bob, "accepts"), ["type"] = "Accept", ["actor"] = bob.Id, ["object"] = request["id"]!.GetValue<string>(), ["result"] = IdOf(forged)
+			});
+			Assert.Equal(ApprovalState.Pending, (await DB.Default.Find<Post>().OneAsync(reply.ID, token)).Approval);
+
+			await _harness.Deliver(bob, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(bob, "rejects"), ["type"] = "Reject", ["actor"] = bob.Id, ["object"] = request["id"]!.GetValue<string>()
+			});
+			Assert.Equal(ApprovalState.Rejected, (await DB.Default.Find<Post>().OneAsync(reply.ID, token)).Approval);
+			Assert.DoesNotContain(await ToShared(fan), a => a["type"]!.GetValue<string>() == "Create");
+		}
+
+		[Fact]
+		public async Task A_like_and_a_boost_its_author_must_approve_are_asked_for_and_a_shut_out_boost_is_refused()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (alice, bob, post, fan) = await Posted(new JsonObject
+			{
+				["canLike"] = Rule(new[] { "https://dummy.invalid/nobody" }, new[] { "https://www.w3.org/ns/activitystreams#Public" }),
+				["canAnnounce"] = Rule(new[] { "https://dummy.invalid/nobody" }, new[] { "https://www.w3.org/ns/activitystreams#Public" })
+			});
+
+			await _harness.Statuses.Favourite(alice, post.ID, true, token);
+			var like = await DB.Default.Find<Favourite>().Match(f => f.AccountId == alice.Id && f.PostId == post.ID).ExecuteSingleAsync(token);
+			Assert.Equal(ApprovalState.Pending, like.Approval);
+			var likeRequest = Assert.Single(await To(bob), a => a["type"]!.GetValue<string>() == "LikeRequest");
+			Assert.DoesNotContain(await To(bob), a => a["type"]!.GetValue<string>() == "Like");
+			var stamp = Authorization(bob, "LikeAuthorization", like.ActivityURI, post);
+			await _harness.Deliver(bob, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(bob, "accepts"), ["type"] = "Accept", ["actor"] = bob.Id, ["object"] = likeRequest["id"]!.GetValue<string>(), ["result"] = IdOf(stamp)
+			});
+			Assert.Equal(ApprovalState.Accepted, (await DB.Default.Find<Favourite>().OneAsync(like.ID, token)).Approval);
+			Assert.Equal(IdOf(stamp), Assert.Single(await To(bob), a => a["type"]!.GetValue<string>() == "Like")["likeAuthorization"]!.GetValue<string>());
+
+			var boost = (await _harness.Statuses.Reblog(alice, post.ID, true, PostVisibility.Public, token)).Post;
+			Assert.Equal(ApprovalState.Pending, boost.Approval);
+			var announceRequest = Assert.Single(await _harness.Outgoing(bob.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "AnnounceRequest");
+			Assert.DoesNotContain(await ToShared(fan), a => a["type"]!.GetValue<string>() == "Announce");
+			await _harness.Deliver(bob, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(bob, "rejects"), ["type"] = "Reject", ["actor"] = bob.Id, ["object"] = announceRequest["id"]!.GetValue<string>()
+			});
+			Assert.Equal(ApprovalState.Rejected, (await DB.Default.Find<Post>().OneAsync(boost.ID, token)).Approval);
+
+			var (carol, _, shut, _) = await Posted(new JsonObject { ["canAnnounce"] = Rule(new string[0], new string[0]) });
+			Assert.Equal(422, (await _harness.Statuses.Reblog(carol, shut.ID, true, PostVisibility.Public, token)).Status);
+		}
+
+		// as a third party: a reply bob's policy does not let in at once is shown only with bob's authorization
+		[Fact]
+		public async Task A_reply_to_a_post_that_needs_its_authors_approval_is_kept_only_with_that_approval()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (alice, bob, post, _) = await Posted(new JsonObject
+			{
+				["canReply"] = Rule(new[] { "https://dummy.invalid/nobody" }, new[] { "https://www.w3.org/ns/activitystreams#Public" })
+			});
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			await Follows(alice.Id, carol);
+
+			var unasked = PublicNote(carol, "<p>barging in</p>");
+			unasked["inReplyTo"] = post.ObjectURI;
+			await _harness.Deliver(carol, "/human-centipede", Create(carol, unasked));
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(unasked)).ExecuteAnyAsync(token));
+
+			var asked = PublicNote(carol, "<p>with leave</p>");
+			asked["inReplyTo"] = post.ObjectURI;
+			asked["replyAuthorization"] = IdOf(Authorization(bob, "ReplyAuthorization", IdOf(asked), post));
+			await _harness.Deliver(carol, "/human-centipede", Create(carol, asked));
+			Assert.True(await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(asked)).ExecuteAnyAsync(token));
+		}
+
+		// bob's public post whose replies wait for his approval (FEP-5624's canReply, as PeerTube sets it on a video whose
+		// comments are moderated), which alice follows bob to see
+		async Task<(PrivaPub.Federation.Actors.LocalActor Alice, RemoteActor Bob, Post Post, RemoteActor Fan)> Moderated(JsonNode canReply)
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var fan = new RemoteActor(_harness.Peer, "fan");
+			await Follows(alice.Id, bob);
+			await _harness.FollowedBy(alice, fan);
+			var note = PublicNote(bob, "<p>a moderated post</p>");
+			note["canReply"] = canReply;
+			await _harness.Deliver(bob, "/human-centipede", Create(bob, note));
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(note)).ExecuteSingleAsync(token);
+			return (alice, bob, post, fan);
+		}
+
+		Task Answer(RemoteActor from, string type, Post reply, string inReplyTo) => _harness.Deliver(from, "/human-centipede", new JsonObject
+		{
+			["id"] = NewId(from, "approvals"), ["type"] = type, ["actor"] = from.Id, ["object"] = reply.ObjectURI, ["inReplyTo"] = inReplyTo
+		});
+
+		[Fact]
+		public async Task A_reply_its_author_approves_goes_to_that_author_alone_then_out_with_the_approval()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (alice, bob, post, fan) = await Moderated("https://www.w3.org/ns/activitystreams#Public");
+
+			var reply = (await _harness.Statuses.Publish(alice, new StatusDraft { Text = "a comment to approve", InReplyTo = post.ID }, token)).Post;
+
+			Assert.Equal(ApprovalState.Pending, reply.Approval);
+			var asked = Assert.Single(await To(bob), a => a["type"]!.GetValue<string>() == "Create");
+			Assert.Equal(reply.ObjectURI, asked["object"]!["id"]!.GetValue<string>());
+			Assert.DoesNotContain(await To(bob), a => a["type"]!.GetValue<string>() == "ReplyRequest");
+			Assert.DoesNotContain(await ToShared(fan), a => a["type"]!.GetValue<string>() == "Create");
+
+			var approval = NewId(bob, "approve-reply");
+			await _harness.Deliver(bob, "/human-centipede", new JsonObject
+			{
+				["id"] = approval, ["type"] = "ApproveReply", ["actor"] = bob.Id, ["object"] = reply.ObjectURI, ["inReplyTo"] = post.ObjectURI
+			});
+
+			var after = await DB.Default.Find<Post>().OneAsync(reply.ID, token);
+			Assert.Equal((ApprovalState.Accepted, approval), (after.Approval, after.ReplyApprovalURI));
+			var create = Assert.Single(await ToShared(fan), a => a["type"]!.GetValue<string>() == "Create");
+			Assert.Equal(approval, create["object"]!["replyApproval"]!.GetValue<string>());
+			Assert.Null(create["object"]!["replyAuthorization"]);
+		}
+
+		[Fact]
+		public async Task A_refused_reply_stays_ours_alone_and_an_approval_from_elsewhere_changes_nothing()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (alice, bob, post, fan) = await Moderated("https://www.w3.org/ns/activitystreams#Public");
+			var reply = (await _harness.Statuses.Publish(alice, new StatusDraft { Text = "a comment to refuse", InReplyTo = post.ID }, token)).Post;
+
+			// an approval by someone else than the post's author, or naming another post, is no approval
+			await Answer(new RemoteActor(_harness.Peer, "mallory"), "ApproveReply", reply, post.ObjectURI);
+			await Answer(bob, "ApproveReply", reply, "https://elsewhere.invalid/post");
+			Assert.Equal(ApprovalState.Pending, (await DB.Default.Find<Post>().OneAsync(reply.ID, token)).Approval);
+
+			await Answer(bob, "RejectReply", reply, post.ObjectURI);
+			Assert.Equal(ApprovalState.Rejected, (await DB.Default.Find<Post>().OneAsync(reply.ID, token)).Approval);
+			Assert.DoesNotContain(await ToShared(fan), a => a["type"]!.GetValue<string>() == "Create");
+		}
+
+		[Fact]
+		public async Task Only_those_its_canReply_names_or_it_mentions_may_reply()
+		{
+			var (alice, _, post, _) = await Moderated(new JsonArray());
+
+			var refused = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "nobody asked me", InReplyTo = post.ID },
+				TestContext.Current.CancellationToken);
+
+			Assert.Equal(422, refused.Status);
+		}
+	}
+}

PrivaPub.Tests/Federation/InteractionTests.cs

@@ -3,8 +3,10 @@ using MongoDB.Entities;
 using PrivaPub.ClientModels.Post;
 using PrivaPub.ClientModels.Social;
 using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Group;
 using PrivaPub.Models.Post;
 using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
 using PrivaPub.Tests.Support;
 
 using System.Text.Json.Nodes;
@@ -74,6 +76,92 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
 		}
 
+		// Our followers-only posts are addressed to the followers collection, never to each follower, so a follower is found
+		// among our followers, not in to/cc. The town found every follower's like, reaction and downvote dropped (G-0001).
+		[Fact]
+		public async Task A_follower_likes_reacts_to_and_downvotes_a_followers_only_post()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, post) = await LocalPost("followersonly");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			await _harness.FollowedBy(_harness.Local.FromAvatar(await DB.Default.Find<Avatar>().OneAsync(post.GroupUserId, token)), carol);
+
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/likes/{Guid.NewGuid():N}", ["type"] = "Like", ["actor"] = carol.Id, ["object"] = post.ObjectURI
+			});
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/reactions/{Guid.NewGuid():N}", ["type"] = "EmojiReact", ["actor"] = carol.Id, ["object"] = post.ObjectURI,
+				["content"] = "🔥"
+			});
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/dislikes/{Guid.NewGuid():N}", ["type"] = "Dislike", ["actor"] = carol.Id, ["object"] = post.ObjectURI
+			});
+
+			// the downvote counts, and takes the place of carol's like (one vote each, as Lemmy votes)
+			var stored = await DB.Default.Find<Post>().OneAsync(post.ID, token);
+			Assert.Equal(0, stored.FavouritesCount);
+			Assert.Equal(1, stored.DownvotesCount);
+			Assert.True(await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID && r.ActorURI == carol.Id && r.Emoji == "🔥").ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_vote_turned_the_other_way_replaces_the_first_as_lemmy_sends_it()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, post) = await LocalPost();
+			var voter = new RemoteActor(_harness.Peer, "voter");
+			var other = new RemoteActor(_harness.Peer, "other");
+			JsonObject Vote(RemoteActor actor, string type) => new()
+			{
+				["id"] = $"{Origin(actor)}/{type.ToLowerInvariant()}s/{Guid.NewGuid():N}", ["type"] = type, ["actor"] = actor.Id, ["object"] = post.ObjectURI
+			};
+
+			await _harness.Deliver(other, "/human-centipede", Vote(other, "Like"));
+			await _harness.Deliver(voter, "/human-centipede", Vote(voter, "Dislike"));
+			await _harness.Deliver(voter, "/human-centipede", Vote(voter, "Like"));
+			var up = await DB.Default.Find<Post>().OneAsync(post.ID, token);
+			Assert.Equal((2, 0), (up.FavouritesCount, up.DownvotesCount));
+
+			await _harness.Deliver(voter, "/human-centipede", Vote(voter, "Dislike"));
+			var down = await DB.Default.Find<Post>().OneAsync(post.ID, token);
+			Assert.Equal((1, 1), (down.FavouritesCount, down.DownvotesCount));
+			Assert.False(await DB.Default.Find<Favourite>().Match(f => f.PostId == post.ID && f.ActorURI == voter.Id).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_circle_member_likes_a_circle_post_and_an_outsider_cannot()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var circle = new Group
+			{
+				UserName = $"circle{Guid.NewGuid():N}"[..20], Name = "a circle", Kind = GroupKind.Circle, OwnerAvatarId = alice.Id,
+				Members = { new() { AvatarId = alice.Id }, new() { AvatarId = carol.Id, IsForeign = true } }
+			};
+			await DB.Default.SaveAsync(circle, token);
+			var post = new Post
+			{
+				GroupUserId = alice.Id, AuthorAccountId = alice.Id, GroupId = circle.ID, Visibility = PostVisibility.Circle, Text = "only us",
+				ObjectURI = $"{alice.Uri}/scribbles/{Guid.NewGuid():N}"
+			};
+			await DB.Default.SaveAsync(post, token);
+
+			foreach (var who in new[] { carol, mallory })
+				await _harness.Deliver(who, "/human-centipede", new JsonObject
+				{
+					["id"] = $"{Origin(who)}/likes/{Guid.NewGuid():N}", ["type"] = "Like", ["actor"] = who.Id, ["object"] = post.ObjectURI
+				});
+
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+			Assert.True(await DB.Default.Find<Favourite>().Match(f => f.PostId == post.ID && f.ActorURI == carol.Id).ExecuteAnyAsync(token));
+		}
+
 		[Fact]
 		public async Task A_boost_of_a_local_post_counts_notifies_and_can_be_undone()
 		{

PrivaPub.Tests/Federation/JobHandlerTests.cs

@@ -0,0 +1,811 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+
+using MongoDB.Entities;
+
+using OpenIddict.Abstractions;
+
+using PrivaPub.Api.Mastodon.Auth;
+using PrivaPub.Domain.Content;
+using PrivaPub.Domain.Media;
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Signing;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Media;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.FederatedSeeds;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class JobHandlerTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		sealed class PeerDescriber : InstanceDescriber
+		{
+			readonly string _peer;
+
+			public PeerDescriber(IFederationHttp http, string peer) : base(http) => _peer = peer;
+
+			protected override string Address(string url) => _peer + new Uri(url).PathAndQuery;
+		}
+
+		[Fact]
+		public async Task Ancestors_are_fetched_one_job_at_a_time_and_stop_at_the_depth_limit()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			var chain = new List<JsonObject>();
+			for (var i = 0; i < RemotePosts.MaxDepth + 3; i++)
+			{
+				var note = PublicNote(poster, $"<p>number {i}</p>");
+				if (i > 0)
+					note["inReplyTo"] = IdOf(chain[^1]);
+				_harness.Peer.Serve(new Uri(IdOf(note)).AbsolutePath, note.ToJsonString());
+				chain.Add(note);
+			}
+			var leaf = new Post
+			{
+				ObjectURI = NewId(poster, "notes"), ActorURI = poster.Id, IsFederatedCopy = true, Visibility = PostVisibility.Public,
+				InReplyToURI = IdOf(chain[^1]), ContentHtml = "<p>the leaf</p>"
+			};
+			await DB.Default.SaveAsync(leaf, token);
+			await _harness.Queue.Enqueue(JobKind.FetchAncestors, JsonSerializer.Serialize(new AncestorsPayload(leaf.ID, 1)), "127.0.0.1", "ancestors|" + leaf.ID, token);
+			var handler = new AncestorsJobHandler(_harness.Db, _harness.RemotePosts);
+
+			var keys = new List<string> { "ancestors|" + leaf.ID };
+			var ran = 0;
+			while (await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.FetchAncestors && j.State == JobState.Pending && keys.Contains(j.DedupeKey))
+				.ExecuteFirstAsync(token) is { } job)
+			{
+				Assert.Equal(JobResult.Done, (await handler.Handle(job, token)).Result);
+				await DB.Default.Update<Job>().MatchID(job.ID).Modify(j => j.State, JobState.Done).ExecuteAsync(token);
+				ran++;
+				var uris = chain.Select(IdOf).ToList();
+				keys = (await DB.Default.Find<Post>().Match(p => uris.Contains(p.ObjectURI)).ExecuteAsync(token)).Select(p => "ancestors|" + p.ID).Append("ancestors|" + leaf.ID).ToList();
+				Assert.True(ran <= RemotePosts.MaxDepth, "the chain did not stop");
+			}
+
+			var all = chain.Select(IdOf).ToList();
+			var stored = (await DB.Default.Find<Post>().Match(p => all.Contains(p.ObjectURI)).ExecuteAsync(token)).ToDictionary(p => p.ObjectURI);
+			Assert.Equal(RemotePosts.MaxDepth, ran);
+			Assert.Equal(all.Skip(3), stored.Keys.OrderBy(all.IndexOf));
+			Assert.Equal(stored[all[^1]].ID, (await DB.Default.Find<Post>().OneAsync(leaf.ID, token)).AnsweringToPostId);
+			for (var i = 4; i < all.Count; i++)
+				Assert.Equal(stored[all[i - 1]].ID, stored[all[i]].AnsweringToPostId);
+			Assert.Null(stored[all[3]].AnsweringToPostId);
+			Assert.Equal(all[2], stored[all[3]].InReplyToURI);
+			Assert.DoesNotContain(_harness.Peer.Requests, r => r.Path == new Uri(all[2]).AbsolutePath);
+		}
+
+		JsonObject Served(JsonObject document)
+		{
+			_harness.Peer.Serve(new Uri(IdOf(document)).AbsolutePath, document.ToJsonString());
+			return document;
+		}
+
+		static JsonObject Reply(RemoteActor author, string text, JsonObject parent)
+		{
+			var note = PublicNote(author, $"<p>{text}</p>");
+			note["inReplyTo"] = IdOf(parent);
+			return note;
+		}
+
+		static async Task<Post> Held(JsonObject note)
+		{
+			var post = new Post
+			{
+				ObjectURI = IdOf(note), ActorURI = note["attributedTo"]!.GetValue<string>(), IsFederatedCopy = true, Visibility = PostVisibility.Public,
+				ContentHtml = note["content"]!.GetValue<string>()
+			};
+			await DB.Default.SaveAsync(post, TestContext.Current.CancellationToken);
+			return post;
+		}
+
+		// runs the FetchReplies job for the post, and those it queues for this peer's posts, until none is left; how many ran
+		async Task<int> RunReplies(Post first)
+		{
+			var token = TestContext.Current.CancellationToken;
+			var handler = new RepliesJobHandler(_harness.Db, _harness.Remote, _harness.RemotePosts, _harness.Queue);
+			var origin = new Uri(first.ObjectURI).GetLeftPart(UriPartial.Authority);
+			await _harness.Queue.EnqueueMany(new[] { RepliesJobHandler.For(first, 1) }, token);
+			var ran = 0;
+			while (true)
+			{
+				var mine = new List<Job>();
+				foreach (var job in await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.FetchReplies && j.State == JobState.Pending).ExecuteAsync(token))
+				{
+					var post = await DB.Default.Find<Post>().OneAsync(JsonSerializer.Deserialize<RepliesPayload>(job.Payload)!.PostId, token);
+					if (post?.ObjectURI.StartsWith(origin) == true)
+						mine.Add(job);
+				}
+				if (mine.Count == 0)
+					return ran;
+				foreach (var job in mine)
+				{
+					Assert.Equal(JobResult.Done, (await handler.Handle(job, token)).Result);
+					await DB.Default.Update<Job>().MatchID(job.ID).Modify(j => j.State, JobState.Done).ExecuteAsync(token);
+					ran++;
+				}
+			}
+		}
+
+		static async Task<Dictionary<string, Post>> Stored(params JsonObject[] notes)
+		{
+			var uris = notes.Select(IdOf).ToList();
+			return (await DB.Default.Find<Post>().Match(p => uris.Contains(p.ObjectURI)).ExecuteAsync(TestContext.Current.CancellationToken))
+				.ToDictionary(p => p.ObjectURI);
+		}
+
+		[Fact]
+		public async Task A_threads_replies_are_read_from_their_servers_two_levels_down_and_only_public_ones_kept()
+		{
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			var answerer = new RemoteActor(_harness.Peer, "answerer");
+			var root = PublicNote(poster, "<p>the root</p>");
+			// what a post carries is as old as the post: the collection is read again by its id
+			root["replies"] = new JsonObject
+			{
+				["id"] = IdOf(root) + "/replies", ["type"] = "Collection", ["first"] = new JsonObject { ["type"] = "CollectionPage", ["items"] = new JsonArray() }
+			};
+			Served(root);
+			var first = Reply(answerer, "first answer", root);
+			var second = Served(Reply(poster, "second answer", root));
+			var hidden = Reply(answerer, "for followers", root);
+			hidden["to"] = new JsonArray(answerer.Id + "/followers");
+			hidden["cc"] = new JsonArray();
+			Served(hidden);
+			var nested = Reply(poster, "nested", first);
+			var deeper = Served(Reply(answerer, "too deep", nested));
+			first["replies"] = IdOf(first) + "/replies";
+			Served(first);
+			nested["replies"] = IdOf(nested) + "/replies";
+			Served(nested);
+
+			Served(new JsonObject { ["id"] = IdOf(root) + "/replies", ["type"] = "Collection", ["first"] = IdOf(root) + "/replies/1" });
+			Served(new JsonObject
+			{
+				["id"] = IdOf(root) + "/replies/1", ["type"] = "CollectionPage", ["next"] = IdOf(root) + "/replies/2",
+				["items"] = new JsonArray(first.DeepClone(), IdOf(second))
+			});
+			Served(new JsonObject { ["id"] = IdOf(root) + "/replies/2", ["type"] = "CollectionPage", ["items"] = new JsonArray(IdOf(hidden)) });
+			Served(new JsonObject { ["id"] = IdOf(first) + "/replies", ["type"] = "OrderedCollection", ["orderedItems"] = new JsonArray(IdOf(nested)) });
+			Served(new JsonObject { ["id"] = IdOf(nested) + "/replies", ["type"] = "OrderedCollection", ["orderedItems"] = new JsonArray(IdOf(deeper)) });
+			var held = await Held(root);
+
+			Assert.Equal(3, await RunReplies(held));
+			var stored = await Stored(first, second, hidden, nested, deeper);
+			Assert.Equal(new[] { IdOf(first), IdOf(second), IdOf(nested) }.Order(), stored.Keys.Order());
+			Assert.Equal(held.ID, stored[IdOf(first)].AnsweringToPostId);
+			Assert.Equal(held.ID, stored[IdOf(second)].AnsweringToPostId);
+			Assert.Equal(stored[IdOf(first)].ID, stored[IdOf(nested)].AnsweringToPostId);
+			Assert.DoesNotContain(_harness.Peer.Requests, r => r.Path == new Uri(IdOf(nested) + "/replies").AbsolutePath);
+			Assert.All(_harness.Peer.Requests.Where(r => r.Path.EndsWith("/replies")), r => Assert.False(string.IsNullOrEmpty(r.Signature)));
+		}
+
+		[Fact]
+		public async Task A_conversation_container_is_read_before_the_context_and_only_its_added_posts_taken()
+		{
+			var owner = new RemoteActor(_harness.Peer, "owner");
+			var answerer = new RemoteActor(_harness.Peer, "answerer");
+			var root = PublicNote(owner, "<p>a conversation</p>");
+			var history = NewId(owner, "conversations");
+			root["contextHistory"] = history;
+			root["context"] = NewId(owner, "never");
+			Served(root);
+			var embedded = Served(Reply(answerer, "added whole", root));
+			var referenced = Served(Reply(owner, "added by reference", embedded));
+			var liked = Served(Reply(answerer, "only liked", root));
+			var target = new JsonObject { ["type"] = "OrderedCollection", ["id"] = history, ["attributedTo"] = owner.Id };
+			JsonObject Add(JsonNode activity) => new()
+			{
+				["id"] = NewId(owner, "activities"), ["type"] = "Add", ["actor"] = owner.Id, ["object"] = activity, ["target"] = target.DeepClone()
+			};
+			var create = Served(Create(owner, referenced));
+			create["object"] = IdOf(referenced);
+			Served(create);
+			var byReference = Served(Add(IdOf(create)));
+			Served(new JsonObject
+			{
+				["id"] = history, ["type"] = "OrderedCollection", ["attributedTo"] = owner.Id, ["collectionOf"] = "Activity",
+				["orderedItems"] = new JsonArray(Create(owner, root), Add(Create(answerer, embedded)), IdOf(byReference), Add(Activity(answerer, "Like", JsonValue.Create(IdOf(liked)))))
+			});
+			var held = await Held(root);
+
+			Assert.Equal(1, await RunReplies(held));
+			var stored = await Stored(embedded, referenced, liked);
+			Assert.Equal(new[] { IdOf(embedded), IdOf(referenced) }.Order(), stored.Keys.Order());
+			Assert.Equal(held.ID, stored[IdOf(embedded)].AnsweringToPostId);
+			Assert.Equal(stored[IdOf(embedded)].ID, stored[IdOf(referenced)].AnsweringToPostId);
+			Assert.DoesNotContain(_harness.Peer.Requests, r => r.Path == new Uri(root["context"]!.GetValue<string>()).AbsolutePath);
+		}
+
+		[Fact]
+		public async Task An_unchanged_context_is_not_read_again_while_it_counts_the_thread()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			var answerer = new RemoteActor(_harness.Peer, "answerer");
+			var root = PublicNote(poster, "<p>a topic</p>");
+			var context = NewId(poster, "topics");
+			var path = new Uri(context).AbsolutePath;
+			root["context"] = context;
+			Served(root);
+			var first = Served(Reply(answerer, "first", root));
+			var later = Served(Reply(poster, "later", root));
+			// NodeBB's: every post inline, counted, and an ETag without quotes
+			JsonObject Thread(params JsonObject[] notes) => new()
+			{
+				["id"] = context, ["type"] = "OrderedCollection", ["totalItems"] = notes.Length,
+				["orderedItems"] = new JsonArray(notes.Select(n => (JsonNode)IdOf(n)).ToArray())
+			};
+			_harness.Peer.ServeTagged(path, Thread(root, first).ToJsonString(), "4f930186eb");
+			var held = await Held(root);
+			var handler = new RepliesJobHandler(_harness.Db, _harness.Remote, _harness.RemotePosts, _harness.Queue);
+
+			await handler.Handle(RepliesJobHandler.For(held, 1), token);
+			Assert.Equal("4f930186eb", (await DB.Default.Find<ThreadCollection>().Match(c => c.URI == context).ExecuteFirstAsync(token)).ETag);
+			// the same version: a 304, and nothing read
+			_harness.Peer.ServeTagged(path, Thread(root, first, later).ToJsonString(), "4f930186eb");
+			await handler.Handle(RepliesJobHandler.For(held, 1), token);
+			Assert.Equal("4f930186eb", _harness.Peer.Requests.Last(r => r.Path == path).Headers["If-None-Match"]);
+			Assert.Single(await Stored(first, later));
+			// a new one
+			_harness.Peer.ServeTagged(path, Thread(root, first, later).ToJsonString(), "5a0b");
+			await handler.Handle(RepliesJobHandler.For(held, 1), token);
+			Assert.Equal(2, (await Stored(first, later)).Count);
+			Assert.Equal("5a0b", (await DB.Default.Find<ThreadCollection>().Match(c => c.URI == context).ExecuteFirstAsync(token)).ETag);
+		}
+
+		[Fact]
+		public async Task A_paged_contexts_etag_is_not_kept_since_its_first_page_hides_what_is_added_later()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			var root = PublicNote(poster, "<p>a long thread</p>");
+			var context = NewId(poster, "contexts");
+			root["context"] = context;
+			Served(root);
+			var answer = Served(Reply(poster, "on the second page", root));
+			_harness.Peer.ServeTagged(new Uri(context).AbsolutePath, new JsonObject
+			{
+				["id"] = context, ["type"] = "Collection",
+				["first"] = new JsonObject { ["type"] = "CollectionPage", ["items"] = new JsonArray(IdOf(root)), ["next"] = context + "/2" }
+			}.ToJsonString(), "W/\"first\"");
+			Served(new JsonObject { ["id"] = context + "/2", ["type"] = "CollectionPage", ["items"] = new JsonArray(IdOf(answer)) });
+			var held = await Held(root);
+
+			await new RepliesJobHandler(_harness.Db, _harness.Remote, _harness.RemotePosts, _harness.Queue).Handle(RepliesJobHandler.For(held, 1), token);
+			Assert.Single(await Stored(answer));
+			Assert.False(await DB.Default.Find<ThreadCollection>().Match(c => c.URI == context && c.ETag != null).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_threads_context_collection_brings_every_reply_at_once()
+		{
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			var answerer = new RemoteActor(_harness.Peer, "answerer");
+			var root = PublicNote(poster, "<p>a thread</p>");
+			var context = NewId(poster, "contexts");
+			root["context"] = context;
+			root["replies"] = NewId(poster, "never");
+			Served(root);
+			var answer = Served(Reply(answerer, "an answer", root));
+			var deep = Served(Reply(poster, "an answer to it", answer));
+			// FEP-f228 lets a context list the activities that made the thread
+			Served(new JsonObject
+			{
+				["id"] = context, ["type"] = "OrderedCollection",
+				["first"] = new JsonObject { ["type"] = "OrderedCollectionPage", ["orderedItems"] = new JsonArray(IdOf(root), Create(answerer, answer), IdOf(deep)) }
+			});
+			var held = await Held(root);
+
+			Assert.Equal(1, await RunReplies(held));
+			var stored = await Stored(answer, deep);
+			Assert.Equal(held.ID, stored[IdOf(answer)].AnsweringToPostId);
+			Assert.Equal(stored[IdOf(answer)].ID, stored[IdOf(deep)].AnsweringToPostId);
+			Assert.DoesNotContain(_harness.Peer.Requests, r => r.Path == new Uri(root["replies"]!.GetValue<string>()).AbsolutePath);
+		}
+
+		async Task<(LocalActor Alice, RemoteActor Mallory, Post Poll)> LocalPoll()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mallory, "follows"), ["type"] = "Follow", ["actor"] = mallory.Id, ["object"] = alice.Uri
+			});
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "which?", Poll = new PollDraft(new[] { "tea", "coffee" }, 3600, false, false) }, token);
+			Assert.True(outcome.Ok);
+			return (alice, mallory, outcome.Post);
+		}
+
+		async Task<List<JsonObject>> Updates(RemoteActor to) =>
+			(await _harness.Outgoing(to.Id + "/inbox")).Where(a => a["type"]!.GetValue<string>() == "Update").ToList();
+
+		static int[] Counts(JsonNode question) =>
+			question["oneOf"]!.AsArray().Select(o => o!["replies"]!["totalItems"]!.GetValue<int>()).ToArray();
+
+		[Fact]
+		public async Task A_poll_refresh_sends_the_new_counts_to_followers_as_an_update()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, mallory, poll) = await LocalPoll();
+			var (_, bob) = await _harness.Persona("bob");
+			Assert.True((await _harness.Polls.Vote(bob, poll, new[] { 1 }, token)).Ok);
+			var job = await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.PollRefresh && j.Payload == poll.ID).ExecuteSingleAsync(token);
+			Assert.True(job.RunAt > DateTime.UtcNow);
+			Assert.Empty(await Updates(mallory));
+
+			Assert.Equal(JobResult.Done, (await new PollRefreshJob(_harness.Db, _harness.Local, _harness.Outbox).Handle(job, token)).Result);
+
+			var question = Assert.Single(await Updates(mallory))["object"]!;
+			Assert.Equal("Question", question["type"]!.GetValue<string>());
+			Assert.Equal(new[] { 0, 1 }, Counts(question));
+			Assert.Null(question["closed"]);
+			Assert.Null((await DB.Default.Find<Post>().OneAsync(poll.ID, token)).Poll.ClosedAt);
+		}
+
+		[Fact]
+		public async Task Closing_a_local_poll_tells_its_voters_and_sends_the_closed_question()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (alice, mallory, poll) = await LocalPoll();
+			var (_, bob) = await _harness.Persona("bob");
+			Assert.True((await _harness.Polls.Vote(bob, poll, new[] { 0 }, token)).Ok);
+			var job = await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.PollClose && j.Payload == poll.ID).ExecuteSingleAsync(token);
+
+			Assert.Equal(JobResult.Done, (await new PollCloseJob(_harness.Db, _harness.Local, _harness.Outbox).Handle(job, token)).Result);
+
+			var closed = (await DB.Default.Find<Post>().OneAsync(poll.ID, token)).Poll.ClosedAt;
+			Assert.NotNull(closed);
+			var question = Assert.Single(await Updates(mallory))["object"]!;
+			Assert.NotNull(question["closed"]);
+			Assert.Equal(new[] { 1, 0 }, Counts(question));
+			var told = await DB.Default.Find<Notification>().Match(n => n.Type == NotificationType.Poll && n.PostId == poll.ID).ExecuteAsync(token);
+			Assert.Equal(new[] { alice.Id, bob.Id }.Order(), told.Select(n => n.AvatarId).Order());
+		}
+
+		[Fact]
+		public async Task Closing_a_remote_poll_tells_the_local_voters_and_sends_nothing()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var question = PublicNote(mallory, "<p>pick</p>", alice.Uri);
+			question["type"] = "Question";
+			question["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@alice" });
+			question["endTime"] = DateTime.UtcNow.AddMinutes(10).ToString("O");
+			question["oneOf"] = new JsonArray(
+				new JsonObject { ["type"] = "Note", ["name"] = "red", ["replies"] = new JsonObject { ["type"] = "Collection", ["totalItems"] = 0 } },
+				new JsonObject { ["type"] = "Note", ["name"] = "blue", ["replies"] = new JsonObject { ["type"] = "Collection", ["totalItems"] = 0 } });
+			await _harness.Deliver(mallory, "/human-centipede", Create(mallory, question));
+			var poll = await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(question)).ExecuteSingleAsync(token);
+			Assert.True((await _harness.Polls.Vote(alice, poll, new[] { 1 }, token)).Ok);
+			var job = await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.PollClose && j.Payload == poll.ID).ExecuteSingleAsync(token);
+
+			Assert.Equal(JobResult.Done, (await new PollCloseJob(_harness.Db, _harness.Local, _harness.Outbox).Handle(job, token)).Result);
+
+			var told = Assert.Single(await DB.Default.Find<Notification>().Match(n => n.Type == NotificationType.Poll && n.PostId == poll.ID).ExecuteAsync(token));
+			Assert.Equal(alice.Id, told.AvatarId);
+			Assert.Equal(poll.AuthorAccountId, told.FromAccountId);
+			Assert.Empty(await Updates(mallory));
+			Assert.Null((await DB.Default.Find<Post>().OneAsync(poll.ID, token)).Poll.ClosedAt);
+		}
+
+		[Fact]
+		public async Task A_server_is_described_from_its_nodeinfo_and_at_most_once_a_week()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var host = $"describe{Guid.NewGuid():N}.example";
+			var peer = _harness.Peer;
+			peer.ServeText("/.well-known/nodeinfo", new JsonObject
+			{
+				["links"] = new JsonArray(
+					new JsonObject { ["rel"] = "http://nodeinfo.diaspora.software/ns/schema/2.0", ["href"] = $"https://{host}/nodeinfo/2.0" },
+					new JsonObject { ["rel"] = "http://nodeinfo.diaspora.software/ns/schema/2.1", ["href"] = $"https://{host}/nodeinfo/2.1" })
+			}.ToJsonString(), "application/json");
+			peer.ServeText("/nodeinfo/2.1", new JsonObject
+			{
+				["version"] = "2.1",
+				["software"] = new JsonObject { ["name"] = "gotosocial", ["version"] = "0.20.1" },
+				["protocols"] = new JsonArray("activitypub", 42),
+				["openRegistrations"] = false,
+				["usage"] = new JsonObject { ["users"] = new JsonObject { ["total"] = 3 } },
+				["metadata"] = new JsonObject { ["nodeName"] = "A small place" }
+			}.ToJsonString(), "application/json");
+			var describer = new PeerDescriber(Peer.Http(), peer.A);
+
+			async Task Record()
+			{
+				var note = NoteParser.Parse(new JsonObject
+				{
+					["id"] = $"https://{host}/notes/{Guid.NewGuid():N}", ["type"] = "Note", ["attributedTo"] = $"https://{host}/users/x",
+					["content"] = "<p>hi</p>", ["to"] = new JsonArray(Addressing.Public)
+				});
+				var post = new Post { ObjectURI = note.Id, IsFederatedCopy = true };
+				await DB.Default.SaveAsync(post, token);
+				await _harness.Records.Record(note, post, ObjectPath.Fetched, refetched: false, token);
+			}
+			Task<List<Job>> Jobs() => DB.Default.Find<Job>().Match(j => j.Kind == JobKind.DescribeInstance && j.Payload == host).ExecuteAsync(token);
+
+			await Record();
+			await Record();
+			var job = Assert.Single(await Jobs());
+			Assert.StartsWith($"describe|{host}|", job.DedupeKey);
+
+			Assert.Equal(JobResult.Done, (await describer.Handle(job, token)).Result);
+
+			var instance = await DB.Default.Find<RemoteInstance>().Match(i => i.Host == host).ExecuteSingleAsync(token);
+			Assert.Equal(("gotosocial", "0.20.1", "A small place"), (instance.Software, instance.SoftwareVersion, instance.NodeName));
+			Assert.Equal(new[] { "activitypub" }, instance.Protocols);
+			Assert.False(instance.OpenRegistrations);
+			Assert.Equal(3, JsonNode.Parse(instance.NodeInfo)!["usage"]!["users"]!["total"]!.GetValue<int>());
+			Assert.Null(instance.DescriptionError);
+			Assert.InRange(instance.DescribedAt!.Value, DateTime.UtcNow.AddMinutes(-1), DateTime.UtcNow.AddSeconds(1));
+			Assert.DoesNotContain(peer.Requests, r => r.Path == "/nodeinfo/2.0");
+
+			await DB.Default.DeleteAsync<Job>(job.ID);
+			await Record();
+			Assert.Empty(await Jobs());
+
+			await DB.Default.Update<RemoteInstance>().MatchID(instance.ID).Modify(i => i.DescribedAt, DateTime.UtcNow.AddDays(-8)).ExecuteAsync(token);
+			await Record();
+			Assert.Single(await Jobs());
+		}
+
+		[Fact]
+		public async Task A_server_without_usable_nodeinfo_is_described_as_such()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var plain = $"plain{Guid.NewGuid():N}.example";
+			var describer = new PeerDescriber(Peer.Http(), _harness.Peer.A + "/" + plain);
+			_harness.Peer.ServeText($"/{plain}/.well-known/nodeinfo", new JsonObject
+			{
+				["links"] = new JsonArray(new JsonObject { ["rel"] = "http://nodeinfo.diaspora.software/ns/schema/2.1", ["href"] = $"http://{plain}/nodeinfo/2.1" })
+			}.ToJsonString(), "application/json");
+			var silent = $"silent{Guid.NewGuid():N}.example";
+
+			await describer.Handle(new Job { Kind = JobKind.DescribeInstance, Payload = plain }, token);
+			await new PeerDescriber(Peer.Http(), _harness.Peer.A + "/" + silent).Handle(new Job { Kind = JobKind.DescribeInstance, Payload = silent }, token);
+
+			Assert.Equal("no NodeInfo", (await DB.Default.Find<RemoteInstance>().Match(i => i.Host == plain).ExecuteSingleAsync(token)).DescriptionError);
+			Assert.Equal("no NodeInfo", (await DB.Default.Find<RemoteInstance>().Match(i => i.Host == silent).ExecuteSingleAsync(token)).DescriptionError);
+		}
+
+		LinkPreviews Previews() => new(_harness.Db, _harness.Local, Peer.Http(), _harness.Queue,
+			new StaticOptions<FederationOptions>(new FederationOptions { AllowPrivateNetworks = true, AllowPlainHttp = true }));
+
+		async Task<Post> Linking(PostVisibility visibility, string path)
+		{
+			var post = new Post
+			{
+				ObjectURI = $"https://elsewhere.example/notes/{Guid.NewGuid():N}", IsFederatedCopy = true, Visibility = visibility,
+				ContentHtml = $"<p>read <a href=\"{_harness.Peer.A}{path}\">this</a></p>"
+			};
+			await DB.Default.SaveAsync(post, TestContext.Current.CancellationToken);
+			_harness.Peer.ServeText(path, """
+				<html><head><title>Fallback</title>
+				<meta property="og:title" content="A headline">
+				<meta property="og:description" content="What it says">
+				<meta property="og:image" content="/cover.jpg">
+				</head><body></body></html>
+				""", "text/html; charset=utf-8");
+			return post;
+		}
+
+		[Fact]
+		public async Task A_link_preview_is_built_from_open_graph_for_a_public_post_only()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var publicPath = $"/articles/{Guid.NewGuid():N}";
+			var privatePath = $"/articles/{Guid.NewGuid():N}";
+			var open = await Linking(PostVisibility.Public, publicPath);
+			var followersOnly = await Linking(PostVisibility.FollowersOnly, privatePath);
+
+			Assert.Equal(JobResult.Done, (await Previews().Handle(new Job { Kind = JobKind.FetchPreview, Payload = open.ID }, token)).Result);
+			Assert.Equal(JobResult.Done, (await Previews().Handle(new Job { Kind = JobKind.FetchPreview, Payload = followersOnly.ID }, token)).Result);
+
+			var card = (await DB.Default.Find<Post>().OneAsync(open.ID, token)).Link;
+			Assert.Equal(_harness.Peer.A + publicPath, card.Href);
+			Assert.Equal(("A headline", "What it says", _harness.Peer.A + "/cover.jpg"), (card.Title, card.Description, card.ImageURL));
+			Assert.True(await DB.Default.Find<LinkPreview>().Match(p => p.Url == _harness.Peer.A + publicPath).ExecuteAnyAsync(token));
+			Assert.Null((await DB.Default.Find<Post>().OneAsync(followersOnly.ID, token)).Link);
+			Assert.DoesNotContain(_harness.Peer.Requests, r => r.Path == privatePath);
+			Assert.False(await DB.Default.Find<LinkPreview>().Match(p => p.Url == _harness.Peer.A + privatePath).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task The_janitor_removes_stale_unattached_uploads_and_trims_the_proxy_cache_oldest_first()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var root = Path.Combine(Path.GetTempPath(), $"privapub-janitor-{Guid.NewGuid():N}");
+			var options = new StaticOptions<MediaOptions>(new MediaOptions { Root = root, ProxyCacheBytes = 800 });
+			var media = new MediaService(options, _harness.Local, default, NullLogger<MediaService>.Instance);
+			var seeded = new List<string>();
+			try
+			{
+				MediaAttachment Upload(string name, DateTime created, string postId = default)
+				{
+					Directory.CreateDirectory(Path.Combine(root, "files"));
+					File.WriteAllBytes(Path.Combine(root, "files", name), new byte[] { 1, 2, 3 });
+					File.WriteAllBytes(Path.Combine(root, "files", "small-" + name), new byte[] { 1 });
+					return new MediaAttachment { FilePath = Path.Combine("files", name), PreviewPath = Path.Combine("files", "small-" + name), CreatedAt = created, PostId = postId };
+				}
+				var stale = Upload("stale.webp", DateTime.UtcNow.AddDays(-2));
+				var fresh = Upload("fresh.webp", DateTime.UtcNow.AddHours(-1));
+				var attached = Upload("attached.webp", DateTime.UtcNow.AddDays(-3), "000000000000000000000001");
+				await DB.Default.SaveAsync(new[] { stale, fresh, attached }, token);
+				seeded.AddRange(new[] { stale.ID, fresh.ID, attached.ID });
+				Directory.CreateDirectory(media.ProxyRoot);
+				FileInfo Cached(string name, int bytes, int minutesAgo)
+				{
+					var path = Path.Combine(media.ProxyRoot, name);
+					File.WriteAllBytes(path, new byte[bytes]);
+					File.WriteAllText(path + ".type", "image/png");
+					File.SetLastWriteTimeUtc(path, DateTime.UtcNow.AddMinutes(-minutesAgo));
+					return new FileInfo(path);
+				}
+				var oldest = Cached("a", 600, 30);
+				var older = Cached("b", 400, 20);
+				var newest = Cached("c", 300, 10);
+
+				await new MediaJanitor(media, options, NullLogger<MediaJanitor>.Instance).Sweep(token);
+
+				// never posted for a day: trashed, its files out of what /media/files serves at once
+				Assert.NotNull((await DB.Default.Find<MediaAttachment>().OneAsync(stale.ID, token)).TrashedAt);
+				Assert.False(File.Exists(Path.Combine(root, stale.FilePath)));
+				Assert.False(File.Exists(Path.Combine(root, stale.PreviewPath)));
+				Assert.True(File.Exists(Path.Combine(media.TrashRoot, stale.FilePath)));
+				// and once its grace has passed, deleted with its row
+				await DB.Default.Update<MediaAttachment>().MatchID(stale.ID).Modify(m => m.TrashedAt, DateTime.UtcNow - MediaJanitor.TrashGrace - TimeSpan.FromMinutes(1)).ExecuteAsync(token);
+				await new MediaJanitor(media, options, NullLogger<MediaJanitor>.Instance).Sweep(token);
+				Assert.False(await DB.Default.Find<MediaAttachment>().Match(m => m.ID == stale.ID).ExecuteAnyAsync(token));
+				Assert.False(File.Exists(Path.Combine(media.TrashRoot, stale.FilePath)));
+				Assert.False(File.Exists(Path.Combine(media.TrashRoot, stale.PreviewPath)));
+				Assert.True(await DB.Default.Find<MediaAttachment>().Match(m => m.ID == fresh.ID).ExecuteAnyAsync(token));
+				Assert.True(await DB.Default.Find<MediaAttachment>().Match(m => m.ID == attached.ID).ExecuteAnyAsync(token));
+				Assert.True(File.Exists(Path.Combine(root, fresh.FilePath)));
+				Assert.False(File.Exists(oldest.FullName));
+				Assert.False(File.Exists(oldest.FullName + ".type"));
+				Assert.True(File.Exists(older.FullName));
+				Assert.True(File.Exists(older.FullName + ".type"));
+				Assert.True(File.Exists(newest.FullName));
+			}
+			finally
+			{
+				await DB.Default.DeleteAsync<MediaAttachment>(m => seeded.Contains(m.ID));
+				foreach (var directory in new[] { root, media.ProxyRoot }.Where(Directory.Exists))
+					Directory.Delete(directory, recursive: true);
+			}
+		}
+	}
+
+	[Trait("Category", "Integration")]
+	public sealed class OAuthPrunerTests
+	{
+		[Fact]
+		public async Task Old_tokens_and_authorizations_that_are_no_longer_valid_are_pruned_and_the_rest_kept()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			var token = TestContext.Current.CancellationToken;
+			var host = await PrivaPubHost.Shared();
+			var now = DateTimeOffset.UtcNow;
+			using var scope = host.Services.CreateScope();
+			var tokens = scope.ServiceProvider.GetRequiredService<IOpenIddictTokenManager>();
+			var authorizations = scope.ServiceProvider.GetRequiredService<IOpenIddictAuthorizationManager>();
+			var subject = $"pruned{Guid.NewGuid():N}";
+			async Task<string> Token(DateTimeOffset created, DateTimeOffset expires, string status) =>
+				await tokens.GetIdAsync(await tokens.CreateAsync(new OpenIddictTokenDescriptor
+				{
+					CreationDate = created, ExpirationDate = expires, Status = status, Subject = subject, Type = OpenIddictConstants.TokenTypeHints.AccessToken
+				}, token), token);
+			async Task<string> Authorization(DateTimeOffset created, string status) =>
+				await authorizations.GetIdAsync(await authorizations.CreateAsync(new OpenIddictAuthorizationDescriptor
+				{
+					CreationDate = created, Status = status, Subject = subject, Type = OpenIddictConstants.AuthorizationTypes.Permanent
+				}, token), token);
+			var expired = await Token(now.AddDays(-30), now.AddDays(-29), OpenIddictConstants.Statuses.Valid);
+			var revoked = await Token(now.AddDays(-30), now.AddDays(1), OpenIddictConstants.Statuses.Revoked);
+			var current = await Token(now.AddMinutes(-5), now.AddHours(1), OpenIddictConstants.Statuses.Valid);
+			var recentlyRevoked = await Token(now.AddDays(-1), now.AddDays(-1).AddMinutes(1), OpenIddictConstants.Statuses.Revoked);
+			var oldRevoked = await Authorization(now.AddDays(-30), OpenIddictConstants.Statuses.Revoked);
+			var oldValid = await Authorization(now.AddDays(-30), OpenIddictConstants.Statuses.Valid);
+
+			var (prunedTokens, prunedAuthorizations) = await new OAuthPruner(host.Services, NullLogger<OAuthPruner>.Instance).Prune(now.AddDays(-14), token);
+
+			Assert.True(prunedTokens >= 2, $"{prunedTokens} tokens pruned");
+			Assert.True(prunedAuthorizations >= 1, $"{prunedAuthorizations} authorizations pruned");
+			//a fresh scope: the managers cache what they created
+			using var after = host.Services.CreateScope();
+			tokens = after.ServiceProvider.GetRequiredService<IOpenIddictTokenManager>();
+			authorizations = after.ServiceProvider.GetRequiredService<IOpenIddictAuthorizationManager>();
+			Assert.Null(await tokens.FindByIdAsync(expired, token));
+			Assert.Null(await tokens.FindByIdAsync(revoked, token));
+			Assert.NotNull(await tokens.FindByIdAsync(current, token));
+			Assert.NotNull(await tokens.FindByIdAsync(recentlyRevoked, token));
+			Assert.Null(await authorizations.FindByIdAsync(oldRevoked, token));
+			Assert.NotNull(await authorizations.FindByIdAsync(oldValid, token));
+		}
+	}
+
+	[Xunit.Collection(nameof(Exclusive))]
+	[Trait("Category", "Integration")]
+	public sealed class DeliveryOutcomeTests : IAsyncLifetime
+	{
+		static readonly string[] PeerHosts = { "localhost", "127.0.0.1" };
+
+		Harness _harness;
+		WebApplication _hinting;
+		string _hintingBase;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+			await DB.Default.DeleteAsync<RemoteInstance>(i => PeerHosts.Contains(i.Host));
+			var builder = WebApplication.CreateSlimBuilder();
+			builder.WebHost.UseUrls("http://127.0.0.1:0");
+			_hinting = builder.Build();
+			//answers /{status}/{retry-after}: the peer cannot send a Retry-After
+			_hinting.Run(context =>
+			{
+				var parts = context.Request.Path.Value!.Trim('/').Split('/');
+				context.Response.StatusCode = int.Parse(parts[0]);
+				if (parts.Length > 1)
+					context.Response.Headers.RetryAfter = parts[1] == "date"
+						? DateTimeOffset.UtcNow.AddMinutes(10).ToString("r")
+						: parts[1];
+				return Task.CompletedTask;
+			});
+			await _hinting.StartAsync();
+			_hintingBase = _hinting.Urls.First();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_hinting != default)
+				await _hinting.DisposeAsync();
+			if (_harness == default)
+				return;
+			await _harness.DisposeAsync();
+			await DB.Default.DeleteAsync<RemoteInstance>(i => PeerHosts.Contains(i.Host));
+		}
+
+		async Task<JobOutcome> Attempt(LocalActor signer, string inbox, int attempts = 1)
+		{
+			var token = TestContext.Current.CancellationToken;
+			var id = $"{Harness.Base}/a/{Guid.NewGuid():N}";
+			await _harness.Delivery.Enqueue(signer, new[] { inbox }, new JsonObject
+			{
+				["id"] = id, ["type"] = "Create", ["actor"] = signer.Uri, ["to"] = new JsonArray(Addressing.Public),
+				["object"] = new JsonObject { ["type"] = "Note", ["content"] = "hi" }
+			}, token);
+			var job = await DB.Default.Find<Job>().Match(j => j.DedupeKey == $"{id}|{inbox}").ExecuteSingleAsync(token);
+			job.Attempts = attempts;
+			var handler = new DeliveryJobHandler(_harness.Local, Peer.Http(), new HostCircuitBreaker(new MemoryCache(new MemoryCacheOptions())),
+				NullLogger<DeliveryJobHandler>.Instance);
+			return await handler.Handle(job, token);
+		}
+
+		[Fact]
+		public async Task A_delivery_carries_a_valid_digest_and_a_signature_by_the_signer()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			_harness.Peer.Answer("/ok/inbox", 202);
+
+			var outcome = await Attempt(alice, _harness.Peer.A + "/ok/inbox");
+
+			Assert.Equal(JobResult.Done, outcome.Result);
+			var received = Assert.Single(_harness.Peer.Requests, r => r.Path == "/ok/inbox");
+			Assert.Equal("POST", received.Method);
+			Assert.Equal(alice.Uri, JsonNode.Parse(received.Body)!["actor"]!.GetValue<string>());
+			Assert.Equal(HttpSignatures.Digest(Encoding.UTF8.GetBytes(received.Body)), received.Headers["Digest"]);
+			var signature = HttpSignatures.Parse(received.Signature);
+			Assert.Equal(alice.KeyId, signature.KeyId);
+			Assert.Equal(new[] { "(request-target)", "host", "date", "digest" }, signature.Headers);
+			var signingString = $"(request-target): post /ok/inbox\nhost: {received.Headers["Host"]}\ndate: {received.Headers["Date"]}\ndigest: {received.Headers["Digest"]}";
+			using var key = RSA.Create();
+			key.ImportFromPem(alice.PublicKeyPem);
+			Assert.True(key.VerifyData(Encoding.UTF8.GetBytes(signingString), signature.Signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1));
+		}
+
+		[Fact]
+		public async Task Refusals_are_dead_hints_defer_and_failures_retry()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			_harness.Peer.Answer("/gone/inbox", 410);
+			_harness.Peer.Answer("/missing/inbox", 404);
+			_harness.Peer.Answer("/broken/inbox", 500);
+
+			var gone = await Attempt(alice, _harness.Peer.A + "/gone/inbox");
+			var missing = await Attempt(alice, _harness.Peer.A + "/missing/inbox");
+			var busy = await Attempt(alice, _hintingBase + "/429/120");
+			var down = await Attempt(alice, _hintingBase + "/503/date");
+			var unhinted = await Attempt(alice, _hintingBase + "/503");
+			var broken = await Attempt(alice, _harness.Peer.A + "/broken/inbox");
+
+			Assert.Equal(JobResult.Dead, gone.Result);
+			Assert.StartsWith("410", gone.Error);
+			Assert.Equal(JobResult.Dead, missing.Result);
+			Assert.Equal(JobResult.Defer, busy.Result);
+			Assert.InRange(busy.RetryAt!.Value, DateTime.UtcNow.AddSeconds(100), DateTime.UtcNow.AddSeconds(125));
+			Assert.Equal(JobResult.Defer, down.Result);
+			Assert.InRange(down.RetryAt!.Value, DateTime.UtcNow.AddMinutes(9), DateTime.UtcNow.AddMinutes(11));
+			Assert.Equal(JobResult.Retry, unhinted.Result);
+			Assert.Equal(JobResult.Retry, broken.Result);
+			Assert.StartsWith("500", broken.Error);
+		}
+
+		// a server that fails on one activity is up: its 500s are that delivery's to retry, and only a gateway's 502, 503 or
+		// 504 counts towards taking the host out (Smithereen's 500s on documents it could not read once held every delivery
+		// to it back for an hour)
+		[Fact]
+		public async Task Only_a_gateways_failures_take_the_host_out()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			_harness.Peer.Answer("/broken/inbox", 500);
+			_harness.Peer.Answer("/gateway/inbox", 502);
+
+			for (var i = 0; i < HostCircuitBreaker.Threshold; i++)
+				await Attempt(alice, _harness.Peer.A + "/broken/inbox");
+			var stillTried = await Attempt(alice, _harness.Peer.A + "/broken/inbox");
+			for (var i = 0; i < HostCircuitBreaker.Threshold; i++)
+				await Attempt(alice, _harness.Peer.A + "/gateway/inbox");
+			var heldBack = await Attempt(alice, _harness.Peer.A + "/broken/inbox");
+
+			Assert.Equal((JobResult.Retry, "500"), (stillTried.Result, stillTried.Error[..3]));
+			Assert.Equal((JobResult.Defer, "the host is unavailable"), (heldBack.Result, heldBack.Error));
+		}
+
+		// Mastodon's 422 for two first contacts racing to create one account, and its 409 for a held lock, are retried a
+		// few times; the third refusal is final like any other
+		[Fact]
+		public async Task Conflicts_and_unprocessable_answers_are_retried_twice_then_dead()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			_harness.Peer.Answer("/racing/inbox", 422);
+			_harness.Peer.Answer("/locked/inbox", 409);
+
+			Assert.Equal(JobResult.Retry, (await Attempt(alice, _harness.Peer.A + "/racing/inbox")).Result);
+			Assert.Equal(JobResult.Retry, (await Attempt(alice, _harness.Peer.A + "/locked/inbox", attempts: 2)).Result);
+			var final = await Attempt(alice, _harness.Peer.A + "/racing/inbox", attempts: 3);
+			Assert.Equal(JobResult.Dead, final.Result);
+			Assert.StartsWith("422", final.Error);
+		}
+	}
+}

PrivaPub.Tests/Federation/MoveTests.cs

@@ -0,0 +1,106 @@
+using MongoDB.Entities;
+
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.FederatedSeeds;
+
+namespace PrivaPub.Tests.Federation
+{
+	// An account moving to another (Mastodon's Move), believed as Mastodon believes it: sent by the moving account about
+	// itself, and the new account naming it among its alsoKnownAs
+	[Trait("Category", "Integration")]
+	public sealed class MoveTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		// the new account, serving a document that names the old one (or not)
+		RemoteActor Target(string name, RemoteActor aliasOf)
+		{
+			var target = new RemoteActor(_harness.Peer, name);
+			var document = target.Document();
+			if (aliasOf != default)
+				document["alsoKnownAs"] = new JsonArray(aliasOf.Id);
+			_harness.Peer.Serve(new Uri(target.Id).AbsolutePath, document.ToJsonString());
+			return target;
+		}
+
+		Task Move(RemoteActor sender, RemoteActor moved, RemoteActor target) =>
+			_harness.Deliver(sender, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(sender, "moves"), ["type"] = "Move", ["actor"] = sender.Id, ["object"] = moved.Id, ["target"] = target.Id
+			});
+
+		static Task<ForeignAvatar> Stored(RemoteActor actor) =>
+			DB.Default.Find<ForeignAvatar>().Match(a => a.ActorURI == actor.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+
+		// as Mastodon does it (owner decision 2026-10-05): the follow moves to the new account, in the same lists, and a mute
+		// or a block of the old account carries over
+		[Fact]
+		public async Task A_move_the_new_account_confirms_moves_the_personas_follows_lists_mutes_and_blocks()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var (_, bob) = await _harness.Persona("bob");
+			var old = new RemoteActor(_harness.Peer, "old");
+			await _harness.Remote.GetActor(old.Id, refresh: true, token);
+			await Follows(alice.Id, old);
+			var oldAccount = await Stored(old);
+			var list = new PersonaList { AvatarId = alice.Id, Title = "friends" };
+			await DB.Default.SaveAsync(list, token);
+			await DB.Default.SaveAsync(new PersonaListMember { ListId = list.ID, AvatarId = alice.Id, AccountId = oldAccount.ID }, token);
+			await _harness.Relationships.Mute(alice, old.Id, oldAccount.ID, hideNotifications: true, duration: default, token);
+			await _harness.Relationships.Block(bob, old.Id, oldAccount.ID, token);
+			var target = Target("new", aliasOf: old);
+
+			await Move(old, old, target);
+
+			var stored = await Stored(old);
+			Assert.Equal(target.Id, stored.MovedToURL);
+			var account = await new MastodonMapper(_harness.Db, _harness.Local).Account(stored.ID, token);
+			Assert.Equal(target.Name, account.Moved?.Username);
+			Assert.Contains(_harness.Ledger.Of("in"), e => e.Activity == "Move" && e.Reason == "moved");
+			var newAccount = await Stored(target);
+			Assert.True(await DB.Default.Find<Following>().Match(f => f.AvatarId == alice.Id && f.TargetActorURI == target.Id).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<Following>().Match(f => f.AvatarId == alice.Id && f.TargetActorURI == old.Id).ExecuteAnyAsync(token));
+			Assert.Contains(await _harness.Outgoing(target.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Follow");
+			Assert.Contains(await _harness.Outgoing(old.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Undo");
+			Assert.True(await DB.Default.Find<PersonaListMember>().Match(m => m.ListId == list.ID && m.AccountId == newAccount.ID).ExecuteAnyAsync(token));
+			Assert.True(await DB.Default.Find<Mute>().Match(m => m.AvatarId == alice.Id && m.TargetActorURI == target.Id).ExecuteAnyAsync(token));
+			Assert.True(await DB.Default.Find<Block>().Match(b => b.AvatarId == bob.Id && b.TargetActorURI == target.Id).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_move_the_new_account_does_not_confirm_or_someone_else_sends_changes_nothing()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var old = new RemoteActor(_harness.Peer, "old");
+			var stranger = new RemoteActor(_harness.Peer, "stranger");
+			await Follows(alice.Id, old);
+			var unconfirmed = Target("new", aliasOf: default);
+			var hijack = Target("hijack", aliasOf: stranger);
+
+			await Move(old, old, unconfirmed);
+			await Move(stranger, old, hijack);
+
+			Assert.Null((await Stored(old)).MovedToURL);
+			Assert.Equal(new[] { "not-aliased", "not-self" }, _harness.Ledger.Of("in").Where(e => e.Activity == "Move").Select(e => e.Reason));
+		}
+	}
+}

PrivaPub.Tests/Federation/NoteParserTests.cs

@@ -35,6 +35,26 @@ namespace PrivaPub.Tests.Federation
 			}
 			""";
 
+		// Castopod's episode: its words in description, its sound in audio, the sound's name for a title
+		[Fact]
+		public void A_podcast_episode_is_read_with_its_words_sound_and_cover()
+		{
+			var episode = NoteParser.Parse(JsonNode.Parse("""
+				{"id":"https://castopod.test/@pod/episodes/one","type":"PodcastEpisode","published":"2026-10-06T09:08:17+00:00",
+				 "to":["https://www.w3.org/ns/activitystreams#Public"],"attributedTo":"https://castopod.test/@pod",
+				 "description":{"type":"Note","mediaType":"text/markdown","content":"Listen to the **meadow**","contentMap":{"en":"<p>Listen to the meadow</p>"}},
+				 "image":{"type":"Image","mediaType":"image/png","url":"https://castopod.test/media/cover.png"},
+				 "audio":{"id":"https://castopod.test/audio/one.mp3","type":"Audio","name":"Episode one","size":16791,"duration":4.02,
+				  "url":{"href":"https://castopod.test/audio/one.mp3","type":"Link","mediaType":"audio/mpeg"}}}
+				"""));
+
+			Assert.Equal(("PodcastEpisode", "Episode one", "https://castopod.test/media/cover.png"), (episode.Type, episode.Title, episode.CoverURL));
+			Assert.Contains("<strong>meadow</strong>", episode.ContentHtml);
+			var sound = Assert.Single(episode.Attachments);
+			Assert.Equal(("https://castopod.test/audio/one.mp3", "audio/mpeg"), (sound.RemoteURL, sound.ContentType));
+			Assert.Equal(4.02, episode.Audio.DurationSeconds);
+		}
+
 		[Fact]
 		public void Reads_a_mastodon_note()
 		{
@@ -57,6 +77,69 @@ namespace PrivaPub.Tests.Federation
 			Assert.Null(note.Updated);
 		}
 
+		// GoToSocial writes a lone tag, and lone to and cc, as plain values instead of arrays (captured by the town)
+		[Fact]
+		public void Reads_a_gotosocial_reply_whose_only_tag_and_audience_are_single_values()
+		{
+			var note = NoteParser.Parse(JsonNode.Parse(File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "gotosocial",
+				"followers-only-reply-one-tag.json"))));
+
+			var mention = Assert.Single(note.Mentions);
+			Assert.Equal("https://privapub.test/peasants/flor_pp98", mention.ActorURI);
+			Assert.Equal(["https://gts.test/users/ines_gt59/followers"], note.To);
+			Assert.Equal(["https://privapub.test/peasants/flor_pp98"], note.Cc);
+		}
+
+		// PeerTube's video whose comments wait for approval names who may comment (FEP-5624), apart from GoToSocial's policy
+		[Fact]
+		public void Reads_who_may_reply_pending_approval()
+		{
+			var video = NoteParser.Parse(JsonNode.Parse("""
+				{"id":"https://peertube.test/videos/watch/1","type":"Video","name":"a video","attributedTo":["https://peertube.test/accounts/pt"],
+				 "canReply":"https://www.w3.org/ns/activitystreams#Public","commentsEnabled":true}
+				"""));
+			var open = NoteParser.Parse(JsonNode.Parse("""
+				{"id":"https://peertube.test/videos/watch/2","type":"Video","name":"an open video","attributedTo":["https://peertube.test/accounts/pt"],
+				 "canReply":null,"commentsPolicy":1}
+				"""));
+			var note = NoteParser.Parse(JsonNode.Parse(MastodonNote));
+
+			Assert.Equal(["https://www.w3.org/ns/activitystreams#Public"], video.ReplyApprovals.Manual);
+			Assert.Null(video.ReplyPolicy);
+			Assert.Null(open.ReplyApprovals);
+			Assert.Null(note.ReplyApprovals);
+		}
+
+		// Pleroma's edited post carries its earlier versions (formerRepresentations, newest first)
+		[Fact]
+		public void Reads_the_earlier_versions_of_a_pleroma_edit()
+		{
+			var note = NoteParser.Parse(JsonNode.Parse(File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "pleroma", "edited.json"))));
+
+			var before = Assert.Single(note.FormerRepresentations);
+			Assert.StartsWith("tomorrow library garden bridge", before.ContentHtml);
+			Assert.Equal(new DateTime(2026, 10, 5, 0, 49, 58, DateTimeKind.Utc).AddTicks(8_600_710), before.EditedAt);
+			Assert.Null(before.SpoilerText);
+			Assert.EndsWith("(edited)", note.ContentHtml);
+		}
+
+		[Fact]
+		public void Earlier_versions_come_oldest_first_each_read_as_the_post_is()
+		{
+			var note = NoteParser.Parse(JsonNode.Parse("""
+				{"id":"https://pl.example/objects/1","type":"Note","attributedTo":"https://pl.example/users/carol","content":"<p>third</p>",
+				 "published":"2026-10-06T08:00:00Z","updated":"2026-10-06T09:00:00Z",
+				 "formerRepresentations":{"type":"OrderedCollection","totalItems":2,"orderedItems":[
+				  {"type":"Note","content":"<p>second</p>","summary":"careful","published":"2026-10-06T08:00:00Z","updated":"2026-10-06T08:30:00Z"},
+				  {"type":"Note","content":"<p>first<script>x</script></p>","summary":"","published":"2026-10-06T08:00:00Z"}]}}
+				"""));
+
+			Assert.Equal(["<p>first</p>", "<p>second</p>"], note.FormerRepresentations.Select(r => r.ContentHtml));
+			Assert.Equal([new DateTime(2026, 10, 6, 8, 0, 0, DateTimeKind.Utc), new DateTime(2026, 10, 6, 8, 30, 0, DateTimeKind.Utc)],
+				note.FormerRepresentations.Select(r => r.EditedAt));
+			Assert.Equal([(default(string), false), ("careful", true)], note.FormerRepresentations.Select(r => (r.SpoilerText, r.HasContentWarning)));
+		}
+
 		[Fact]
 		public void Reads_a_lemmy_page_with_a_title()
 		{

PrivaPub.Tests/Federation/ObjectRecordsTests.cs

@@ -0,0 +1,36 @@
+using PrivaPub.Federation.Objects;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class ObjectRecordsTests
+	{
+		[Fact]
+		public void An_object_larger_than_the_cap_keeps_only_its_hash()
+		{
+			var big = new JsonObject { ["content"] = new string('x', ObjectRecords.MaxRawBytes + 1) };
+
+			var (text, hash, bytes, truncated) = ObjectRecords.Capture(big);
+
+			Assert.Null(text);
+			Assert.True(truncated);
+			Assert.True(bytes > ObjectRecords.MaxRawBytes);
+			Assert.Equal(64, hash.Length);
+		}
+
+		[Fact]
+		public void A_small_object_is_kept_whole_with_its_hash()
+		{
+			var small = new JsonObject { ["type"] = "Note", ["content"] = "hi" };
+
+			var (text, hash, bytes, truncated) = ObjectRecords.Capture(small);
+
+			Assert.Equal(small.ToJsonString(), text);
+			Assert.False(truncated);
+			Assert.Equal(text.Length, bytes);
+			Assert.Equal(64, hash.Length);
+			Assert.Equal(default, ObjectRecords.Capture(default));
+		}
+	}
+}

PrivaPub.Tests/Federation/ObjectShapesTests.cs

@@ -1,4 +1,4 @@
-using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Api.Mastodon.Mappers;
 using PrivaPub.Federation.Objects;
 using PrivaPub.Models.Post;
 
@@ -79,6 +79,51 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("2026-10-03 10:00 – 13:00 (Europe/Rome) · Biblioteca", MastodonMapper.EventLine(note.Event));
 		}
 
+		[Fact]
+		public void Keeps_a_pixelfed_place_whose_coordinates_are_strings()
+		{
+			var note = Parse("""
+				{
+					"id": "https://pixel.example/p/ann/1", "type": "Note", "attributedTo": "https://pixel.example/users/ann", "content": "<p>view</p>",
+					"location": { "type": "Place", "name": "Tokyo", "longitude": "139.6917", "latitude": "35.6895", "country": "Japan" },
+					"commentsEnabled": true
+				}
+				""");
+
+			Assert.Equal(("Tokyo", 35.6895, 139.6917, "Japan"), (note.Place.Name, note.Place.Latitude, note.Place.Longitude, note.Place.Country));
+			Assert.Null(note.Event);
+		}
+
+		[Theory]
+		[InlineData("null")]
+		[InlineData("""{ "type": "Place", "name": "Nowhere" }""")]
+		[InlineData("""{ "type": "Place", "name": "Off the map", "latitude": 123, "longitude": 9 }""")]
+		[InlineData("""{ "type": "Place", "latitude": "north", "longitude": "9.19" }""")]
+		[InlineData("""{ "type": "VirtualLocation", "url": "https://meet.example/a", "latitude": 45, "longitude": 9 }""")]
+		public void Has_no_place_without_a_place_with_coordinates(string location)
+		{
+			var note = Parse($$"""
+				{ "id": "https://pixel.example/p/ann/2", "type": "Note", "attributedTo": "https://pixel.example/users/ann", "content": "<p>x</p>", "location": {{location}} }
+				""");
+
+			Assert.Null(note.Place);
+		}
+
+		[Fact]
+		public void An_events_location_stays_the_events_own()
+		{
+			var note = Parse("""
+				{
+					"id": "https://events.example/events/10", "type": "Event", "name": "Picnic", "startTime": "2026-10-03T10:00:00+02:00",
+					"location": { "type": "Place", "name": "Park", "latitude": 45.07, "longitude": 7.68 },
+					"attributedTo": "https://events.example/@club"
+				}
+				""");
+
+			Assert.Null(note.Place);
+			Assert.Equal("Park", Assert.Single(note.Event.Places).Name);
+		}
+
 		[Fact]
 		public void Keeps_a_lemmy_link_post_as_a_link_with_its_thumbnail()
 		{
@@ -190,7 +235,7 @@ namespace PrivaPub.Tests.Federation
 		}
 
 		[Fact]
-		public void Reads_polls_from_mastodon_misskey_and_closed_ones()
+		public void Reads_polls_from_mastodon_misskey_akkoma_and_closed_ones()
 		{
 			var mastodon = Parse("""
 				{ "id": "https://m.example/q/1", "type": "Question", "attributedTo": "https://m.example/u", "content": "?", "endTime": "2026-10-02T00:00:00Z", "votersCount": 7,
@@ -204,6 +249,10 @@ namespace PrivaPub.Tests.Federation
 				{ "id": "https://g.example/q/1", "type": "Question", "attributedTo": "https://g.example/u", "content": "?", "closed": "2026-09-30T12:00:00Z",
 					"oneOf": [{ "type": "Note", "name": "p" }, { "type": "Note", "name": "q" }] }
 				""");
+			var akkoma = Parse("""
+				{ "id": "https://a.example/objects/1", "type": "Question", "attributedTo": "https://a.example/users/u", "content": "?", "closed": "2099-01-01T00:00:00.000000Z",
+					"oneOf": [{ "type": "Note", "name": "p" }, { "type": "Note", "name": "q" }] }
+				""");
 
 			Assert.False(mastodon.Poll.Multiple);
 			Assert.Equal(new[] { 4, 3 }, mastodon.Poll.Options.Select(o => o.Votes));
@@ -212,6 +261,8 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal(new[] { 2, 5 }, misskey.Poll.Options.Select(o => o.Votes));
 			Assert.Null(misskey.Poll.VotersCount);
 			Assert.Equal(new DateTime(2026, 9, 30, 12, 0, 0, DateTimeKind.Utc), closed.Poll.ClosedAt);
+			Assert.Null(akkoma.Poll.ClosedAt);
+			Assert.Equal(new DateTime(2099, 1, 1, 0, 0, 0, DateTimeKind.Utc), akkoma.Poll.ExpiresAt);
 		}
 
 		[Fact]

PrivaPub.Tests/Federation/ParticipationTests.cs

@@ -0,0 +1,100 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.FederatedSeeds;
+
+namespace PrivaPub.Tests.Federation
+{
+	// a persona joins a remote event (owner decision 2026-10-05): Join, answered Accept or Reject; Leave
+	[Trait("Category", "Integration")]
+	public sealed class ParticipationTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		async Task<(PrivaPub.Federation.Actors.LocalActor Alice, RemoteActor Group, Post Event)> Announced(string joinMode = "free")
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var group = new RemoteActor(_harness.Peer, "group", type: "Group");
+			await Follows(alice.Id, group);
+			var happening = new JsonObject
+			{
+				["id"] = NewId(group, "events"), ["type"] = "Event", ["name"] = "A picnic", ["content"] = "<p>bring bread</p>",
+				["attributedTo"] = group.Id, ["startTime"] = DateTime.UtcNow.AddDays(3).ToString("O"), ["joinMode"] = joinMode,
+				["to"] = new JsonArray(PrivaPub.Federation.Objects.Addressing.Public), ["cc"] = new JsonArray(group.Id + "/followers")
+			};
+			await _harness.Deliver(group, "/human-centipede", Create(group, happening));
+			return (alice, group, await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(happening)).ExecuteSingleAsync(token));
+		}
+
+		Task<Participation> Of(PrivaPub.Federation.Actors.LocalActor alice, Post happening) =>
+			DB.Default.Find<Participation>().Match(p => p.AvatarId == alice.Id && p.PostId == happening.ID).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+
+		[Fact]
+		public async Task A_persona_joins_an_event_its_server_accepts_and_leaves_it()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (alice, group, happening) = await Announced();
+
+			Assert.True((await _harness.Participations.Join(alice, happening.ID, token)).Ok);
+
+			var join = Assert.Single(await _harness.Outgoing(group.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Join");
+			Assert.Equal((alice.Uri, happening.ObjectURI), (join["actor"]!.GetValue<string>(), join["object"]!.GetValue<string>()));
+			Assert.Equal(ParticipationState.Pending, (await Of(alice, happening)).State);
+
+			await _harness.Deliver(group, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(group, "accepts"), ["type"] = "Accept", ["actor"] = group.Id, ["object"] = join["id"]!.GetValue<string>()
+			});
+			Assert.Equal(ParticipationState.Accepted, (await Of(alice, happening)).State);
+
+			Assert.True((await _harness.Participations.Leave(alice, happening.ID, token)).Ok);
+			Assert.Null(await Of(alice, happening));
+			var leave = Assert.Single(await _harness.Outgoing(group.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Leave");
+			Assert.Equal(happening.ObjectURI, leave["object"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task A_refusal_counts_an_answer_from_another_server_does_not_and_an_invitation_only_event_is_not_joined()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (alice, group, happening) = await Announced();
+			await _harness.Participations.Join(alice, happening.ID, token);
+			var join = Assert.Single(await _harness.Outgoing(group.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Join");
+
+			var stranger = new RemoteActor(_harness.Peer, "stranger", _harness.Peer.B);
+			await _harness.Deliver(stranger, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(stranger, "accepts"), ["type"] = "Accept", ["actor"] = stranger.Id, ["object"] = join["id"]!.GetValue<string>()
+			});
+			Assert.Equal(ParticipationState.Pending, (await Of(alice, happening)).State);
+
+			await _harness.Deliver(group, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(group, "rejects"), ["type"] = "Reject", ["actor"] = group.Id,
+				["object"] = new JsonObject { ["id"] = join["id"]!.GetValue<string>(), ["type"] = "Join", ["actor"] = alice.Uri, ["object"] = happening.ObjectURI }
+			});
+			Assert.Equal(ParticipationState.Rejected, (await Of(alice, happening)).State);
+
+			var (carol, _, invitationOnly) = await Announced("invite");
+			Assert.Equal(422, (await _harness.Participations.Join(carol, invitationOnly.ID, token)).Status);
+		}
+	}
+}

PrivaPub.Tests/Federation/ProvenanceTests.cs

@@ -68,18 +68,5 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("<p>hi again</p>", JsonNode.Parse(Assert.Single(record.Revisions).Raw)!["content"]!.GetValue<string>());
 			Assert.True(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.DescribeInstance && j.Payload == record.Host).ExecuteAnyAsync(token));
 		}
-
-		[Fact]
-		public void An_object_larger_than_the_cap_keeps_only_its_hash()
-		{
-			var big = new JsonObject { ["content"] = new string('x', ObjectRecords.MaxRawBytes + 1) };
-
-			var (text, hash, bytes, truncated) = ObjectRecords.Capture(big);
-
-			Assert.Null(text);
-			Assert.True(truncated);
-			Assert.True(bytes > ObjectRecords.MaxRawBytes);
-			Assert.Equal(64, hash.Length);
-		}
 	}
 }

PrivaPub.Tests/Federation/ReactionTests.cs

@@ -17,6 +17,9 @@ namespace PrivaPub.Tests.Federation
 		[InlineData(":blobcat@k.example:", "blobcat")]
 		[InlineData("👍🏽", "👍🏽")]
 		[InlineData("❤️", "❤️")]
+		[InlineData("❤", "❤️")]
+		[InlineData("✌", "✌️")]
+		[InlineData("🔥\uFE0F", "🔥")]
 		[InlineData("nope", null)]
 		[InlineData("👍👍", null)]
 		[InlineData(":unknown:", null)]

PrivaPub.Tests/Federation/RelayTests.cs

@@ -0,0 +1,143 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// relays the configuration names: the instance actor follows Public there, and the public posts the relay passes on,
+	// forwarded or announced, come to the federated timeline as their authors' posts; nothing else is taken from it
+	[Trait("Category", "Integration")]
+	[Xunit.Collection(nameof(Exclusive))]
+	public sealed class RelayTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+			{
+				_harness.RelayOptions.Relays.Clear();
+				await _harness.Relays.Reconcile(TestContext.Current.CancellationToken);
+				await _harness.DisposeAsync();
+			}
+		}
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		string Note(RemoteActor author, string text, string to = "https://www.w3.org/ns/activitystreams#Public")
+		{
+			var path = $"/notes/{Guid.NewGuid():N}";
+			_harness.Peer.Serve(path, new JsonObject
+			{
+				["id"] = Origin(author) + path, ["type"] = "Note", ["attributedTo"] = author.Id, ["content"] = $"<p>{text}</p>",
+				["to"] = new JsonArray(to), ["published"] = DateTime.UtcNow.ToString("O")
+			}.ToJsonString());
+			return Origin(author) + path;
+		}
+
+		JsonObject Create(RemoteActor author, string noteId) => new()
+		{
+			["id"] = noteId + "/activity", ["type"] = "Create", ["actor"] = author.Id,
+			["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public"),
+			["object"] = new JsonObject { ["id"] = noteId, ["type"] = "Note", ["attributedTo"] = author.Id }
+		};
+
+		// a relay the instance actor subscribes to, which accepts
+		async Task<RemoteActor> Subscribed()
+		{
+			var relay = new RemoteActor(_harness.Peer, "relay", type: "Service");
+			_harness.RelayOptions.Relays.Add(relay.Id);
+			await _harness.Relays.Reconcile(Token);
+			var follow = Assert.Single(await _harness.Outgoing(relay.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Follow");
+			await _harness.Deliver(relay, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{relay.Id}#accept-{Guid.NewGuid():N}", ["type"] = "Accept", ["actor"] = relay.Id, ["object"] = follow.DeepClone()
+			});
+			return relay;
+		}
+
+		[Fact]
+		public async Task The_instance_actor_follows_public_at_a_configured_relay_and_takes_its_answer()
+		{
+			var relay = await Subscribed();
+
+			var follow = Assert.Single(await _harness.Outgoing(relay.Id + "/inbox"));
+			Assert.Equal(("Follow", "https://www.w3.org/ns/activitystreams#Public"), (follow["type"]!.GetValue<string>(), follow["object"]!.GetValue<string>()));
+			Assert.Equal((await _harness.Local.GetInstanceActor(Token)).Uri, follow["actor"]!.GetValue<string>());
+			Assert.Equal(RelayState.Accepted, (await DB.Default.Find<RelaySubscription>().Match(s => s.ActorURI == relay.Id).ExecuteSingleAsync(Token)).State);
+			Assert.True(await _harness.Relays.Passes(relay.Id, Token));
+
+			_harness.RelayOptions.Relays.Clear();
+			await _harness.Relays.Reconcile(Token);
+
+			Assert.Contains(await _harness.Outgoing(relay.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Undo");
+			Assert.False(await DB.Default.Find<RelaySubscription>().Match(s => s.ActorURI == relay.Id).ExecuteAnyAsync(Token));
+		}
+
+		[Fact]
+		public async Task A_public_post_a_subscribed_relay_forwards_is_kept_and_one_from_anyone_else_is_not()
+		{
+			var relay = await Subscribed();
+			var stranger = new RemoteActor(_harness.Peer, "stranger", type: "Service");
+			var author = new RemoteActor(_harness.Peer, "author", _harness.Peer.B);
+			var relayed = Note(author, "through the relay");
+			var forwarded = Note(author, "through a stranger");
+			var followersOnly = Note(author, "for followers", author.Id + "/followers");
+
+			await _harness.Deliver(relay, "/human-centipede", Create(author, relayed));
+			await _harness.Deliver(stranger, "/human-centipede", Create(author, forwarded));
+			await _harness.Deliver(relay, "/human-centipede", Create(author, followersOnly));
+
+			var kept = await DB.Default.Find<Post>().Match(p => p.ActorURI == author.Id).ExecuteAsync(Token);
+			Assert.Equal(new[] { relayed }, kept.Select(p => p.ObjectURI));
+			Assert.Equal(PostVisibility.Public, kept[0].Visibility);
+		}
+
+		// owner decision 2026-10-06: a persona's public post, its edit and its deletion go to the relays too; nothing less
+		// public does, nor a boost
+		[Fact]
+		public async Task A_personas_public_post_goes_to_the_relays_and_nothing_less_public()
+		{
+			var relay = await Subscribed();
+			var (_, alice) = await _harness.Persona("alice");
+			var token = Token;
+
+			var open = await _harness.Statuses.Publish(alice, new PrivaPub.Domain.Statuses.StatusDraft { Text = "for everyone", Visibility = PostVisibility.Public }, token);
+			await _harness.Statuses.Publish(alice, new PrivaPub.Domain.Statuses.StatusDraft { Text = "quietly", Visibility = PostVisibility.Unlisted }, token);
+			await _harness.Statuses.Publish(alice, new PrivaPub.Domain.Statuses.StatusDraft { Text = "for followers", Visibility = PostVisibility.FollowersOnly }, token);
+
+			var sent = (await _harness.Outgoing(relay.Id + "/inbox")).Where(a => a["type"]!.GetValue<string>() == "Create").ToList();
+			var create = Assert.Single(sent);
+			Assert.Equal(alice.PostUri(open.Post.ID), create["object"]!["id"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task A_post_a_relay_announces_is_its_authors_never_the_relays_boost()
+		{
+			var relay = await Subscribed();
+			var author = new RemoteActor(_harness.Peer, "author", _harness.Peer.B);
+			var noteId = Note(author, "announced by the relay");
+
+			await _harness.Deliver(relay, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{relay.Id}/activities/{Guid.NewGuid():N}", ["type"] = "Announce", ["actor"] = relay.Id,
+				["to"] = new JsonArray(relay.Id + "/followers"), ["object"] = noteId
+			});
+
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteSingleAsync(Token);
+			Assert.Equal(author.Id, post.ActorURI);
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ReblogOfPostId == post.ID).ExecuteAnyAsync(Token));
+		}
+	}
+}

PrivaPub.Tests/Federation/RemoteActorServiceTests.cs

@@ -32,6 +32,16 @@ namespace PrivaPub.Tests.Federation
 				await _peer.DisposeAsync();
 		}
 
+		[Fact]
+		public async Task A_stored_actor_remembers_the_extensions_its_document_uses()
+		{
+			var bob = new RemoteActor(_peer, "bob");
+
+			var stored = await _service.GetActor(bob.Id, refresh: true, TestContext.Current.CancellationToken);
+
+			Assert.Contains("key:rsa-2048", stored.Features);
+		}
+
 		static string Actor(string id, string keyId = default, string owner = default, string pem = default, string type = "Person") =>
 			new JsonObject
 			{

PrivaPub.Tests/Federation/RemoteEditsTests.cs

@@ -0,0 +1,38 @@
+using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class RemoteEditsTests
+	{
+		static readonly DateTime Published = new(2026, 10, 3, 10, 40, 1, DateTimeKind.Utc);
+
+		static Post Stored(DateTime? editedAt = default) => new() { CreationDate = Published, EditedAt = editedAt, ContentHtml = "<p>before</p>" };
+
+		[Fact]
+		public void A_newer_update_is_an_edit_and_an_update_without_a_date_is_a_refresh()
+		{
+			Assert.True(RemoteEdits.IsEdit(new NoteDocument { Updated = Published.AddSeconds(1), ContentHtml = "<p>before</p>" }, Stored()));
+			Assert.False(RemoteEdits.IsEdit(new NoteDocument { ContentHtml = "<p>after</p>" }, Stored()));
+			Assert.False(RemoteEdits.IsEdit(new NoteDocument { Updated = Published.AddSeconds(-1), ContentHtml = "<p>after</p>" }, Stored()));
+		}
+
+		[Fact]
+		public void An_edit_in_the_second_the_post_was_published_counts_when_the_text_changed()
+		{
+			Assert.True(RemoteEdits.IsEdit(new NoteDocument { Updated = Published, ContentHtml = "<p>after</p>" }, Stored()));
+			Assert.True(RemoteEdits.IsEdit(new NoteDocument { Updated = Published, ContentHtml = "<p>before</p>", SpoilerText = "now with a warning" }, Stored()));
+			Assert.False(RemoteEdits.IsEdit(new NoteDocument { Updated = Published, ContentHtml = "<p>before</p>" }, Stored()));
+		}
+
+		[Fact]
+		public void After_a_first_edit_only_a_newer_one_counts()
+		{
+			var edited = Published.AddMinutes(1);
+
+			Assert.False(RemoteEdits.IsEdit(new NoteDocument { Updated = edited, ContentHtml = "<p>again</p>" }, Stored(edited)));
+			Assert.True(RemoteEdits.IsEdit(new NoteDocument { Updated = edited.AddSeconds(1), ContentHtml = "<p>again</p>" }, Stored(edited)));
+		}
+	}
+}

PrivaPub.Tests/Federation/RemoteHandleTests.cs

@@ -0,0 +1,117 @@
+using Microsoft.Extensions.Caching.Memory;
+
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Relationships;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// an account's handle: user@host, or the domain its `webfinger` names (FEP-2c59; Mastodon's LOCAL_DOMAIN apart from
+	// its WEB_DOMAIN) once that domain's WebFinger says the handle is this account
+	[Trait("Category", "Integration")]
+	public sealed class RemoteHandleTests : IAsyncLifetime
+	{
+		Harness _harness;
+		RemoteActorService _remote;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+			_remote = new RemoteActorService(Peer.Http(), _harness.Local, new MemoryCache(new MemoryCacheOptions()), _harness.Db,
+				new StaticOptions<FederationOptions>(new FederationOptions { AllowPrivateNetworks = true, AllowPlainHttp = true }));
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		// the actor at the peer's first address, its handle at the second
+		RemoteActor Actor(string name) => Serve(new RemoteActor(_harness.Peer, name));
+
+		RemoteActor Serve(RemoteActor actor, string preferredUsername = default)
+		{
+			var document = actor.Document();
+			if (preferredUsername != default)
+				document["preferredUsername"] = preferredUsername;
+			document["webfinger"] = $"acct:{preferredUsername ?? actor.Name}@{new Uri(_harness.Peer.B).Authority}";
+			_harness.Peer.Serve(new Uri(actor.Id).AbsolutePath, document.ToJsonString());
+			return actor;
+		}
+
+		void WebFinger(string self) => _harness.Peer.ServeText("/.well-known/webfinger", new JsonObject
+		{
+			["links"] = new JsonArray(new JsonObject { ["rel"] = "self", ["type"] = "application/activity+json", ["href"] = self })
+		}.ToJsonString(), "application/jrd+json");
+
+		[Fact]
+		public async Task A_handle_on_another_domain_is_kept_once_its_webfinger_agrees()
+		{
+			var actor = Actor("split");
+			WebFinger(actor.Id);
+
+			var stored = await _remote.GetActor(actor.Id, refresh: true, TestContext.Current.CancellationToken);
+
+			Assert.Equal(new Uri(_harness.Peer.B).Authority, stored.Domain);
+		}
+
+		[Fact]
+		public async Task A_handle_its_webfinger_does_not_confirm_stays_on_the_actors_host()
+		{
+			var actor = Actor("claims");
+			WebFinger("http://localhost/users/someone-else");
+
+			var stored = await _remote.GetActor(actor.Id, refresh: true, TestContext.Current.CancellationToken);
+
+			Assert.Equal(new Uri(actor.Id).Authority, stored.Domain);
+		}
+
+		[Fact]
+		public async Task A_renamed_account_is_asked_again()
+		{
+			var actor = Actor("renames");
+			WebFinger(actor.Id);
+			await _remote.GetActor(actor.Id, refresh: true, TestContext.Current.CancellationToken);
+
+			Serve(actor, "renamed");
+			WebFinger("http://localhost/users/someone-else");
+			// (another cache: the first fetch holds the actor back for a while)
+			var later = new RemoteActorService(Peer.Http(), _harness.Local, new MemoryCache(new MemoryCacheOptions()), _harness.Db,
+				new StaticOptions<FederationOptions>(new FederationOptions { AllowPrivateNetworks = true, AllowPlainHttp = true }));
+			var stored = await later.GetActor(actor.Id, refresh: true, TestContext.Current.CancellationToken);
+
+			Assert.Equal("renamed", stored.UserName);
+			Assert.Equal(new Uri(actor.Id).Authority, stored.Domain);
+		}
+
+		[Fact]
+		public async Task A_persona_blocking_the_handles_server_hides_the_account()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var split = Actor("split");
+			WebFinger(split.Id);
+			await _remote.GetActor(split.Id, refresh: true, token);
+			var claims = Actor("claims");
+			WebFinger("http://localhost/users/someone-else");
+			await new RemoteActorService(Peer.Http(), _harness.Local, new MemoryCache(new MemoryCacheOptions()), _harness.Db,
+				new StaticOptions<FederationOptions>(new FederationOptions { AllowPrivateNetworks = true, AllowPlainHttp = true }))
+				.GetActor(claims.Id, refresh: true, token);
+
+			await DB.Default.SaveAsync(new AccountDomainBlock { AvatarId = alice.Id, Domain = new Uri(_harness.Peer.B).Host }, token);
+
+			Assert.Equal([split.Id], await Hidden.AuthorsHiddenFrom(alice.Id, new[] { split.Id, claims.Id }, forNotifications: false, token));
+			Assert.Contains(alice.Id, await Hidden.RecipientsHiding(new[] { alice.Id }, split.Id, token));
+			Assert.Empty(await Hidden.RecipientsHiding(new[] { alice.Id }, claims.Id, token));
+		}
+	}
+}

PrivaPub.Tests/Federation/ReplyRelayTests.cs

@@ -0,0 +1,114 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.FederatedSeeds;
+
+namespace PrivaPub.Tests.Federation
+{
+	// Inbox forwarding of replies (owner decision 2026-10-05): a reply to a persona's post reaches the persona's followers,
+	// who are not among those its author's server sends it to
+	[Trait("Category", "Integration")]
+	public sealed class ReplyRelayTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		// alice's post; bob replies from his server, fan follows alice from another, pal from bob's
+		async Task<(PrivaPub.Federation.Actors.LocalActor Alice, Post Post, RemoteActor Bob, RemoteActor Fan, RemoteActor Pal)> Thread()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var fan = new RemoteActor(_harness.Peer, "fan", _harness.Peer.B);
+			var pal = new RemoteActor(_harness.Peer, "pal");
+			await _harness.FollowedBy(alice, fan);
+			await _harness.FollowedBy(alice, pal);
+			var post = (await _harness.Statuses.Publish(alice, new StatusDraft { Text = "what do you think?" }, token)).Post;
+			return (alice, post, bob, fan, pal);
+		}
+
+		JsonObject Reply(RemoteActor bob, Post post, string visibility = "public")
+		{
+			var reply = PublicNote(bob, "<p>I think so</p>", post.ActorURI);
+			reply["inReplyTo"] = post.ObjectURI;
+			if (visibility == "followers")
+			{
+				reply["to"] = new JsonArray(bob.Id + "/followers");
+				reply["cc"] = new JsonArray(post.ActorURI);
+			}
+			return reply;
+		}
+
+		Task<List<JsonObject>> At(RemoteActor follower) => _harness.Outgoing(follower.SharedInbox);
+
+		[Fact]
+		public async Task A_public_reply_to_a_personas_post_reaches_its_followers_as_it_came_and_not_its_authors_server()
+		{
+			var (_, post, bob, fan, pal) = await Thread();
+			var create = Create(bob, Reply(bob, post));
+			create["signature"] = new JsonObject { ["type"] = "RsaSignature2017", ["signatureValue"] = "kept as it came" };
+
+			await _harness.Deliver(bob, "/human-centipede", create);
+
+			var relayed = Assert.Single(await At(fan), a => a["id"]!.GetValue<string>() == IdOf(create));
+			Assert.Equal(bob.Id, relayed["actor"]!.GetValue<string>());
+			Assert.Equal("kept as it came", relayed["signature"]!["signatureValue"]!.GetValue<string>());
+			Assert.DoesNotContain(await At(pal), a => a["id"]!.GetValue<string>() == IdOf(create));
+		}
+
+		[Fact]
+		public async Task Its_edit_and_deletion_follow_it_and_a_followers_only_reply_stays_where_it_was_sent()
+		{
+			var (_, post, bob, fan, _) = await Thread();
+			var reply = Reply(bob, post);
+			await _harness.Deliver(bob, "/human-centipede", Create(bob, reply));
+			var edited = (JsonObject)reply.DeepClone();
+			edited["content"] = "<p>I think so, on second thought</p>";
+			edited["updated"] = DateTime.UtcNow.AddMinutes(1).ToString("O");
+			var update = Activity(bob, "Update", edited);
+			await _harness.Deliver(bob, "/human-centipede", update);
+			var delete = Activity(bob, "Delete", JsonValue.Create(IdOf(reply))!);
+			await _harness.Deliver(bob, "/human-centipede", delete);
+
+			var relayed = (await At(fan)).Select(a => a["id"]!.GetValue<string>()).ToList();
+			Assert.Contains(IdOf(update), relayed);
+			Assert.Contains(IdOf(delete), relayed);
+
+			var quiet = Create(bob, Reply(bob, post, "followers"));
+			await _harness.Deliver(bob, "/human-centipede", quiet);
+			Assert.DoesNotContain(await At(fan), a => a["id"]!.GetValue<string>() == IdOf(quiet));
+		}
+
+		[Fact]
+		public async Task A_reply_that_reached_us_forwarded_is_not_passed_on_again()
+		{
+			var (_, post, bob, fan, _) = await Thread();
+			var other = new RemoteActor(_harness.Peer, "other", _harness.Peer.B);
+			var reply = Reply(bob, post);
+			_harness.Peer.Serve(new Uri(IdOf(reply)).AbsolutePath, reply.ToJsonString());
+			var create = Create(bob, reply);
+
+			var result = await _harness.Deliver(other, "/human-centipede", create);
+
+			Assert.Equal("forwarded", result.Reason);
+			Assert.True(await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(reply)).ExecuteAnyAsync(TestContext.Current.CancellationToken));
+			Assert.DoesNotContain(await At(fan), a => a["id"]!.GetValue<string>() == IdOf(create));
+		}
+	}
+}

PrivaPub.Tests/Federation/ReusedIdTests.cs

@@ -0,0 +1,64 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.FederatedSeeds;
+
+namespace PrivaPub.Tests.Federation
+{
+	// A deleted remote post is never brought back by its own Create, however late it comes; an id its server gives a new
+	// post afterwards (Gancio numbers an event after the last one it keeps) is that new post
+	[Trait("Category", "Integration")]
+	public sealed class ReusedIdTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task A_deleted_posts_create_stays_dropped_and_a_new_post_under_its_id_is_kept()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			await Follows(alice.Id, carol);
+			var first = PublicNote(carol, "<p>the first event</p>");
+			first["published"] = DateTime.UtcNow.AddMinutes(-10).ToString("O");
+			await _harness.Deliver(carol, "/human-centipede", Create(carol, first));
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(carol, "deletes"), ["type"] = "Delete", ["actor"] = carol.Id,
+				["object"] = new JsonObject { ["id"] = IdOf(first), ["type"] = "Tombstone" }
+			});
+			Assert.True(await DB.Default.Find<DeletedObject>().Match(d => d.ObjectURI == IdOf(first)).ExecuteAnyAsync(token));
+
+			// the first Create again, late
+			await _harness.Deliver(carol, "/human-centipede", Create(carol, (JsonObject)first.DeepClone()));
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(first) && !p.DeletedAt.HasValue).ExecuteAnyAsync(token));
+
+			var second = PublicNote(carol, "<p>a new event, numbered as the first</p>");
+			second["id"] = IdOf(first);
+			second["published"] = DateTime.UtcNow.ToString("O");
+			await _harness.Deliver(carol, "/human-centipede", Create(carol, second));
+
+			var kept = await DB.Default.Find<Post>().Match(p => p.ObjectURI == IdOf(first) && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			Assert.Contains("a new event", kept?.ContentHtml);
+			Assert.False(await DB.Default.Find<DeletedObject>().Match(d => d.ObjectURI == IdOf(first)).ExecuteAnyAsync(token));
+		}
+	}
+}

PrivaPub.Tests/Federation/ServiceReportTests.cs

@@ -0,0 +1,252 @@
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Signing;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// Lemmy takes a report only from a person or a service, about one post or comment, addressed to its community (owner
+	// decision 2026-10-06): a report about a post in a community on a Lemmy leaves from the server's reporter, one per post.
+	// Alone in its collection: the server rows it writes for the peer's hosts decide for whoever reports there.
+	[Trait("Category", "Integration")]
+	[Xunit.Collection(nameof(Exclusive))]
+	public sealed class ServiceReportTests : IAsyncLifetime
+	{
+		static readonly string[] PeerHosts = { "localhost", "127.0.0.1" };
+
+		// (a test sees only the deliveries queued since it began: the others' share the database)
+		readonly DateTime _started = DateTime.UtcNow;
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+			await DB.Default.DeleteAsync<RemoteInstance>(i => PeerHosts.Contains(i.Host));
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness == default)
+				return;
+			await DB.Default.DeleteAsync<RemoteInstance>(i => PeerHosts.Contains(i.Host));
+			await _harness.DisposeAsync();
+		}
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		// what NodeInfo said the server at that host runs
+		static async Task Runs(string host, string software)
+		{
+			await DB.Default.DeleteAsync<RemoteInstance>(i => i.Host == host);
+			await DB.Default.SaveAsync(new RemoteInstance { Host = host, Software = software, SoftwareVersion = "1.0.0" }, Token);
+		}
+
+		async Task<ForeignAvatar> Known(RemoteActor actor) => await _harness.Remote.GetActor(actor.Id, refresh: false, Token);
+
+		static async Task<Post> Held(RemoteActor author, string community = default, Post parent = default)
+		{
+			var post = new Post
+			{
+				ObjectURI = $"{Origin(author)}/post/{Guid.NewGuid():N}",
+				ActorURI = author.Id,
+				AudienceURI = community,
+				AnsweringToPostId = parent?.ID,
+				ContentHtml = "<p>reported</p>"
+			};
+			await DB.Default.SaveAsync(post, Token);
+			return post;
+		}
+
+		async Task<List<DeliveryPayload>> Queued() =>
+			(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.Deliver && j.CreatedAt >= _started).ExecuteAsync(Token))
+				.Select(j => JsonSerializer.Deserialize<DeliveryPayload>(j.Payload))
+				.ToList();
+
+		// a community on a Lemmy, or on a server that takes reports as Lemmy does (the peer as localhost), and one of its posters there
+		async Task<(RemoteActor Community, RemoteActor Poster)> OnLemmy(string software = "lemmy")
+		{
+			var community = new RemoteActor(_harness.Peer, "cats", _harness.Peer.B, type: "Group", sharedInbox: true);
+			var poster = new RemoteActor(_harness.Peer, "poster", _harness.Peer.B);
+			await Known(community);
+			await Known(poster);
+			await Runs("localhost", software);
+			return (community, poster);
+		}
+
+		// PieFed and Mbin take it too, proven live (2026-10-06); NodeInfo names Lemmy as "lemmy" and kbin's heir as "mbin"
+		[Theory]
+		[InlineData("lemmy")]
+		[InlineData("Lemmy")]
+		[InlineData("piefed")]
+		[InlineData("mbin")]
+		public async Task A_post_in_a_lemmy_community_is_reported_to_its_community_by_the_reporter_and_nowhere_else(string software)
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var (community, poster) = await OnLemmy(software);
+			var post = await Held(poster, community.Id);
+			var reporter = await _harness.Local.GetReporterActor(Token);
+
+			var report = await _harness.Reports.File(alice, (await Known(poster)).ID, new[] { post.ID }, "  a slur in the title ", "violation", forward: true, Token);
+
+			Assert.True(report.Forwarded);
+			var flag = Assert.Single(await _harness.Outgoing(community.SharedInbox));
+			Assert.Equal("Flag", flag["type"]!.GetValue<string>());
+			Assert.Equal(reporter.Uri, flag["actor"]!.GetValue<string>());
+			Assert.EndsWith("/peasants/privapub_reports", reporter.Uri);
+			Assert.StartsWith(reporter.Uri + "/", flag["id"]!.GetValue<string>());
+			Assert.Equal(new[] { community.Id }, flag["to"]!.AsArray().Select(t => t!.GetValue<string>()));
+			Assert.Equal(community.Id, flag["audience"]!.GetValue<string>());
+			Assert.Equal(post.ObjectURI, flag["object"]!.GetValue<string>());
+			Assert.Equal("a slur in the title", flag["summary"]!.GetValue<string>());
+			Assert.Equal("a slur in the title", flag["content"]!.GetValue<string>());
+			Assert.Empty(await _harness.Outgoing(poster.Id + "/inbox"));
+			Assert.DoesNotContain(await Queued(), q => q.Inbox != community.SharedInbox && q.Body.Contains(post.ObjectURI));
+			Assert.DoesNotContain(alice.UserName, flag.ToJsonString());
+			Assert.DoesNotContain(alice.Id, flag.ToJsonString());
+			var queued = Assert.Single(await Queued(), q => q.Inbox == community.SharedInbox);
+			Assert.Equal(LocalActorKind.Reporter, queued.SignerKind);
+			Assert.Equal(reporter.Id, queued.SignerId);
+		}
+
+		[Fact]
+		public async Task The_reporter_signs_its_flag_with_its_own_key()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var (community, poster) = await OnLemmy();
+			var post = await Held(poster, community.Id);
+			var reporter = await _harness.Local.GetReporterActor(Token);
+			var instance = await _harness.Local.GetInstanceActor(Token);
+			_harness.Peer.Answer("/inbox", 202);
+			await _harness.Reports.File(alice, (await Known(poster)).ID, new[] { post.ID }, default, "spam", forward: true, Token);
+			var job = await DB.Default.Find<Job>()
+				.Match(j => j.Kind == JobKind.Deliver && j.DedupeKey.StartsWith(reporter.ActivityUri($"flag-")))
+				.Sort(j => j.CreatedAt, Order.Descending).ExecuteFirstAsync(Token);
+
+			var handler = new DeliveryJobHandler(_harness.Local, Peer.Http(), new HostCircuitBreaker(new MemoryCache(new MemoryCacheOptions())),
+				NullLogger<DeliveryJobHandler>.Instance);
+			var outcome = await handler.Handle(job, Token);
+
+			Assert.Equal(JobResult.Done, outcome.Result);
+			var received = Assert.Single(_harness.Peer.Requests, r => r.Path == "/inbox" && r.Method == "POST");
+			// no words: Lemmy takes no report without a reason, so the category is it
+			Assert.Equal("spam", JsonNode.Parse(received.Body)!["summary"]!.GetValue<string>());
+			var signature = HttpSignatures.Parse(received.Signature);
+			Assert.Equal(reporter.KeyId, signature.KeyId);
+			Assert.NotEqual(instance.PublicKeyPem, reporter.PublicKeyPem);
+			var signingString = $"(request-target): post /inbox\nhost: {received.Headers["Host"]}\ndate: {received.Headers["Date"]}\ndigest: {received.Headers["Digest"]}";
+			using var key = RSA.Create();
+			key.ImportFromPem(reporter.PublicKeyPem);
+			Assert.True(key.VerifyData(Encoding.UTF8.GetBytes(signingString), signature.Signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1));
+		}
+
+		[Fact]
+		public async Task A_comment_finds_its_community_through_its_thread_and_two_posts_are_two_flags()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var (community, poster) = await OnLemmy();
+			var thread = await Held(poster, community.Id);
+			var comment = await Held(poster, parent: thread);
+			var answer = await Held(poster, parent: comment);
+
+			var report = await _harness.Reports.File(alice, (await Known(poster)).ID, new[] { comment.ID, answer.ID }, "harassment", "other", forward: true, Token);
+
+			Assert.True(report.Forwarded);
+			var flags = await _harness.Outgoing(community.SharedInbox);
+			Assert.Equal(2, flags.Count);
+			Assert.Equal(new[] { comment.ObjectURI, answer.ObjectURI }.Order(), flags.Select(f => f["object"]!.GetValue<string>()).Order());
+			Assert.All(flags, f => Assert.Equal(community.Id, f["to"]![0]!.GetValue<string>()));
+			Assert.Equal(2, flags.Select(f => f["id"]!.GetValue<string>()).Distinct().Count());
+		}
+
+		[Fact]
+		public async Task An_account_alone_on_a_lemmy_is_reported_to_nobody()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var (community, poster) = await OnLemmy();
+
+			var report = await _harness.Reports.File(alice, (await Known(poster)).ID, Array.Empty<string>(), "a spammer", "spam", forward: true, Token);
+
+			Assert.False(report.Forwarded);
+			Assert.False((await DB.Default.Find<PrivaPub.Models.Social.Report>().OneAsync(report.ID, Token)).Forwarded);
+			Assert.Empty(await _harness.Outgoing(community.SharedInbox));
+			Assert.Empty(await _harness.Outgoing(poster.Id + "/inbox"));
+		}
+
+		[Fact]
+		public async Task Any_other_server_still_gets_the_instance_flag_and_a_lemmy_community_its_own()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var (community, _) = await OnLemmy();
+			// an account on a Mastodon (the peer as 127.0.0.1) that wrote in the community on the Lemmy, and elsewhere
+			var mastodonian = new RemoteActor(_harness.Peer, "masto");
+			await Runs("127.0.0.1", "mastodon");
+			var inCommunity = await Held(mastodonian, community.Id);
+			var elsewhere = await Held(mastodonian);
+			var instance = await _harness.Local.GetInstanceActor(Token);
+
+			var report = await _harness.Reports.File(alice, (await Known(mastodonian)).ID, new[] { inCommunity.ID, elsewhere.ID }, "spam", "spam", forward: true, Token);
+
+			Assert.True(report.Forwarded);
+			var toCommunity = Assert.Single(await _harness.Outgoing(community.SharedInbox));
+			Assert.Equal(inCommunity.ObjectURI, toCommunity["object"]!.GetValue<string>());
+			var toAuthor = Assert.Single(await _harness.Outgoing(mastodonian.Id + "/inbox"));
+			Assert.Equal(instance.Uri, toAuthor["actor"]!.GetValue<string>());
+			Assert.Equal(new[] { mastodonian.Id, inCommunity.ObjectURI, elsewhere.ObjectURI }.Order(),
+				toAuthor["object"]!.AsArray().Select(o => o!.GetValue<string>()).Order());
+			Assert.Null(toAuthor["to"]);
+		}
+
+		[Fact]
+		public async Task A_community_on_a_server_that_takes_no_service_reports_gets_nothing_new()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var community = new RemoteActor(_harness.Peer, "forum", _harness.Peer.B, type: "Group", sharedInbox: true);
+			var poster = new RemoteActor(_harness.Peer, "poster", _harness.Peer.B);
+			await Known(community);
+			var foreign = await Known(poster);
+			await Runs("localhost", "friendica");
+			var post = await Held(poster, community.Id);
+
+			var report = await _harness.Reports.File(alice, foreign.ID, new[] { post.ID }, "spam", "spam", forward: true, Token);
+
+			Assert.True(report.Forwarded);
+			Assert.Empty(await _harness.Outgoing(community.SharedInbox));
+			var flag = Assert.Single(await _harness.Outgoing(poster.Id + "/inbox"));
+			Assert.EndsWith("/peasants/privapub", flag["actor"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task Nobody_follows_the_reporter()
+		{
+			var follower = new RemoteActor(_harness.Peer, "follower");
+			var reporter = await _harness.Local.GetReporterActor(Token);
+
+			var result = await _harness.Deliver(follower, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(follower)}/follow/{Guid.NewGuid():N}", ["type"] = "Follow", ["actor"] = follower.Id, ["object"] = reporter.Uri
+			});
+
+			Assert.Equal(404, result.StatusCode);
+			Assert.False(await DB.Default.Find<Follower>().Match(f => f.ActorURI == follower.Id).ExecuteAnyAsync(Token));
+		}
+	}
+}

PrivaPub.Tests/Federation/SharedInboxTests.cs

@@ -0,0 +1,50 @@
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	// one delivery a server: a reply to a follower's post goes to its server's shared inbox once, not also to the
+	// follower's own inbox (BookWyrm kept two copies of a post that reached both at once)
+	[Trait("Category", "Integration")]
+	public sealed class SharedInboxTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task A_reply_to_a_followers_post_reaches_its_server_once_through_the_shared_inbox()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob", sharedInbox: true);
+			await _harness.FollowedBy(alice, bob);
+			var path = $"/notes/{Guid.NewGuid():N}";
+			var noteId = new Uri(bob.Id).GetLeftPart(UriPartial.Authority) + path;
+			_harness.Peer.Serve(path, new JsonObject
+			{
+				["id"] = noteId, ["type"] = "Note", ["attributedTo"] = bob.Id, ["content"] = "<p>a question</p>",
+				["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public"), ["published"] = DateTime.UtcNow.ToString("O")
+			}.ToJsonString());
+			var parent = await _harness.RemotePosts.StoreContext(noteId, 0, token);
+
+			var reply = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "an answer", InReplyTo = parent.ID }, token);
+
+			Assert.True(reply.Ok, reply.Error);
+			Assert.Single(await _harness.Outgoing(bob.SharedInbox), a => a["type"]!.GetValue<string>() == "Create");
+			Assert.Empty(await _harness.Outgoing(bob.Id + "/inbox"));
+		}
+	}
+}

PrivaPub.Tests/Federation/WallTests.cs

@@ -0,0 +1,213 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.Host.FederationHelpers;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Tests.Federation
+{
+	// walls (FEP-400e, Smithereen's; owner decision 2026-10-06): a persona's followers write on its wall, PrivaPub hosts what
+	// they write and tells the persona's followers with Add{Note}; the persona takes it off with Remove; an account elsewhere
+	// that tells of a post on its own wall has it shown to its followers here
+	[Trait("Category", "Integration")]
+	public sealed class WallTests : IAsyncLifetime
+	{
+		const string Public = "https://www.w3.org/ns/activitystreams#Public";
+
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		// a public note by author, written on the wall of owner (whose actor and wall are given), served at its id
+		string WallNote(RemoteActor author, string ownerUri, string wall, string text, string inReplyTo = default, string to = Public)
+		{
+			var path = $"/notes/{Guid.NewGuid():N}";
+			var origin = new Uri(author.Id).GetLeftPart(UriPartial.Authority);
+			var note = new JsonObject
+			{
+				["id"] = origin + path, ["type"] = "Note", ["attributedTo"] = author.Id, ["content"] = $"<p>{text}</p>",
+				["to"] = new JsonArray(to, ownerUri), ["published"] = DateTime.UtcNow.ToString("O"),
+				["target"] = new JsonObject { ["type"] = "Collection", ["id"] = wall, ["attributedTo"] = ownerUri }
+			};
+			if (inReplyTo != default)
+				note["inReplyTo"] = inReplyTo;
+			_harness.Peer.Serve(path, note.ToJsonString());
+			_notes[origin + path] = note;
+			return origin + path;
+		}
+
+		readonly Dictionary<string, JsonObject> _notes = new();
+
+		// as Smithereen sends it: the whole note, to the wall's owner
+		JsonObject Create(RemoteActor author, string noteId) => new()
+		{
+			["id"] = noteId + "/activityCreate", ["type"] = "Create", ["actor"] = author.Id, ["to"] = _notes[noteId]["to"]!.DeepClone(),
+			["object"] = _notes[noteId].DeepClone()
+		};
+
+		Task<PostEntity> Post(string objectUri) => DB.Default.Find<PostEntity>().Match(p => p.ObjectURI == objectUri).ExecuteFirstAsync(Token);
+
+		[Fact]
+		public void A_persona_names_its_wall_and_lets_its_followers_write_on_it()
+		{
+			var actor = ActivityPubRenderer.Actor(new LocalActor { Id = "a", UserName = "alice", BaseAddress = Harness.Base, Kind = PrivaPub.Models.Federation.LocalActorKind.Person });
+			var circle = ActivityPubRenderer.Actor(new LocalActor { Id = "c", UserName = "circle", BaseAddress = Harness.Base, Kind = PrivaPub.Models.Federation.LocalActorKind.Group, IsCircle = true });
+
+			Assert.Equal($"{Harness.Base}/peasants/alice/graffiti", actor["wall"]!.GetValue<string>());
+			Assert.Equal($"{Harness.Base}/peasants/alice/groupies", actor["privacySettings"]!["wallPosting"]!["allowedTo"]![0]!.GetValue<string>());
+			Assert.Equal(Public, actor["privacySettings"]!["wallPostVisibility"]!["allowedTo"]![0]!.GetValue<string>());
+			Assert.Contains(actor["@context"]!.AsArray(), c => c is JsonObject terms && terms["wall"]?["@id"]?.GetValue<string>() == "sm:wall");
+			Assert.Null(circle["wall"]);
+		}
+
+		[Fact]
+		public async Task A_followers_post_on_the_wall_is_hosted_shown_and_told_to_the_personas_followers()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var smuser = new RemoteActor(_harness.Peer, "smuser", wall: true);
+			await _harness.FollowedBy(alice, smuser);
+			var noteId = WallNote(smuser, alice.Uri, alice.Wall, "on alice's wall");
+
+			await _harness.Deliver(smuser, "/human-centipede", Create(smuser, noteId));
+
+			var post = await Post(noteId);
+			Assert.NotNull(post);
+			Assert.Equal((alice.Wall, alice.Uri, alice.Id), (post.WallURI, post.WallOwnerURI, post.WallOwnerAccountId));
+			Assert.True(await DB.Default.Find<TimelineEntry>().Match(e => e.AvatarId == alice.Id && e.PostId == post.ID).ExecuteAnyAsync(Token));
+			Assert.True(await DB.Default.Find<Notification>().Match(n => n.AvatarId == alice.Id && n.PostId == post.ID && n.Type == NotificationType.Mention).ExecuteAnyAsync(Token));
+			var add = Assert.Single(await _harness.Outgoing(_harness.Peer.A + "/inbox"), a => a["type"]!.GetValue<string>() == "Add");
+			Assert.Equal((alice.Uri, noteId, alice.Wall), (add["actor"]!.GetValue<string>(), add["object"]!.GetValue<string>(), add["target"]!["id"]!.GetValue<string>()));
+			Assert.Contains(await _harness.Outgoing(smuser.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Add");
+
+			Assert.True(await _harness.Walls.Remove(alice, post, Token));
+
+			Assert.Null(await Post(noteId));
+			var remove = Assert.Single(await _harness.Outgoing(_harness.Peer.A + "/inbox"), a => a["type"]!.GetValue<string>() == "Remove");
+			Assert.Equal((noteId, alice.Wall), (remove["object"]!.GetValue<string>(), remove["target"]!.GetValue<string>()));
+		}
+
+		[Fact]
+		public async Task A_wall_post_from_a_stranger_a_reply_or_a_quiet_one_is_refused()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var stranger = new RemoteActor(_harness.Peer, "stranger", wall: true);
+			var follower = new RemoteActor(_harness.Peer, "follower", wall: true);
+			await _harness.FollowedBy(alice, follower);
+			var fromStranger = WallNote(stranger, alice.Uri, alice.Wall, "from a stranger");
+			var reply = WallNote(follower, alice.Uri, alice.Wall, "a reply", inReplyTo: "https://elsewhere.example/notes/1");
+			var quiet = WallNote(follower, alice.Uri, alice.Wall, "quietly", to: follower.Id + "/followers");
+
+			await _harness.Deliver(stranger, "/human-centipede", Create(stranger, fromStranger));
+			await _harness.Deliver(follower, "/human-centipede", Create(follower, reply));
+			await _harness.Deliver(follower, "/human-centipede", Create(follower, quiet));
+
+			Assert.Null(await Post(fromStranger));
+			Assert.Null(await Post(reply));
+			Assert.Null(await Post(quiet));
+			Assert.DoesNotContain(await _harness.Outgoing(_harness.Peer.A + "/inbox"), a => a["type"]!.GetValue<string>() == "Add");
+		}
+
+		[Fact]
+		public async Task A_post_on_a_followed_accounts_wall_elsewhere_reaches_its_followers_here_until_it_is_taken_off()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var owner = new RemoteActor(_harness.Peer, "owner", wall: true);
+			var writer = new RemoteActor(_harness.Peer, "writer");
+			await DB.Default.SaveAsync(new Following { AvatarId = alice.Id, TargetActorURI = owner.Id, TargetInboxURL = owner.Id + "/inbox", State = FollowState.Accepted }, Token);
+			var noteId = WallNote(writer, owner.Id, owner.Wall, "on the owner's wall");
+			// (kept before PrivaPub read walls: its document is read again when it names one)
+			await DB.Default.SaveAsync(new PrivaPub.Models.User.ForeignAvatar
+			{
+				ActorURI = owner.Id, UserName = owner.Name, PublicKeyId = owner.KeyId, PublicKey = owner.PublicKeyPem, InboxURL = owner.Id + "/inbox",
+				FollowersURL = owner.Id + "/followers", UpdatedAt = DateTime.UtcNow.AddDays(-2)
+			}, Token);
+
+			await _harness.Deliver(owner, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{owner.Id}/posts/{Guid.NewGuid():N}/activityAdd", ["type"] = "Add", ["actor"] = owner.Id, ["object"] = noteId,
+				["target"] = new JsonObject { ["type"] = "Collection", ["id"] = owner.Wall, ["attributedTo"] = owner.Id },
+				["to"] = new JsonArray(Public, owner.Id + "/followers")
+			});
+
+			var post = await Post(noteId);
+			Assert.NotNull(post);
+			Assert.Equal((writer.Id, owner.Id), (post.ActorURI, post.WallOwnerURI));
+			Assert.True(await DB.Default.Find<TimelineEntry>().Match(e => e.AvatarId == alice.Id && e.PostId == post.ID).ExecuteAnyAsync(Token));
+			Assert.False(await DB.Default.Find<RemoteFeatured>().Match(f => f.ObjectURI == noteId).ExecuteAnyAsync(Token));
+
+			await _harness.Deliver(owner, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{owner.Id}/posts/{Guid.NewGuid():N}/activityRemove", ["type"] = "Remove", ["actor"] = owner.Id, ["object"] = noteId, ["target"] = owner.Wall
+			});
+
+			Assert.Null(await Post(noteId));
+		}
+	}
+
+	[Trait("Category", "Integration")]
+	public sealed class WallCollectionTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		HttpClient _client;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_client = _host.Client();
+		}
+
+		public ValueTask DisposeAsync()
+		{
+			_client?.Dispose();
+			return ValueTask.CompletedTask;
+		}
+
+		[Fact]
+		public async Task The_wall_lists_the_personas_public_posts_and_what_others_wrote_on_it()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var persona = await _host.Persona(await _host.SignUp(), "wall");
+			var open = await _host.Publish(persona, "for everyone", PostVisibility.Public);
+			var quiet = await _host.Publish(persona, "for followers", PostVisibility.FollowersOnly);
+			var wall = persona.ActorUri() + "/graffiti";
+			var written = new PostEntity
+			{
+				ObjectURI = $"https://elsewhere.example/notes/{Guid.NewGuid():N}", ActorURI = "https://elsewhere.example/users/writer", IsFederatedCopy = true,
+				Visibility = PostVisibility.Public, WallURI = wall, WallOwnerURI = persona.ActorUri(), WallOwnerAccountId = persona.Id
+			};
+			await DB.Default.SaveAsync(written, token);
+
+			var collection = await _client.Fetch($"/peasants/{persona.UserName}/graffiti");
+			var page = await _client.Fetch($"/peasants/{persona.UserName}/graffiti?page=true");
+
+			Assert.Equal(HttpStatusCode.OK, collection.Status);
+			Assert.Equal((wall, 2), (collection.Json["id"]!.GetValue<string>(), collection.Json["totalItems"]!.GetValue<int>()));
+			var items = page.Json["orderedItems"]!.AsArray().Select(i => i!.GetValue<string>()).ToList();
+			Assert.Equal(new[] { written.ObjectURI, persona.ActorUri() + "/scribbles/" + open.ID }, items);
+			Assert.DoesNotContain(items, i => i.EndsWith(quiet.ID));
+		}
+	}
+}

PrivaPub.Tests/Fixtures/gotosocial/followers-only-reply-one-tag.json

@@ -0,0 +1 @@
+{"attributedTo":"https://gts.test/users/ines_gt59","cc":"https://privapub.test/peasants/flor_pp98","content":"\u003Cp\u003E\u003Cspan class=\u0022h-card\u0022\u003E\u003Ca href=\u0022https://privapub.test/@flor_pp98\u0022 class=\u0022u-url mention\u0022 rel=\u0022nofollow noreferrer noopener\u0022 target=\u0022_blank\u0022\u003E@\u003Cspan\u003Eflor_pp98\u003C/span\u003E\u003C/a\u003E\u003C/span\u003E bicycle the window bicycle tomorrow festival (p111)\u003C/p\u003E","contentMap":{"en":"\u003Cp\u003E\u003Cspan class=\u0022h-card\u0022\u003E\u003Ca href=\u0022https://privapub.test/@flor_pp98\u0022 class=\u0022u-url mention\u0022 rel=\u0022nofollow noreferrer noopener\u0022 target=\u0022_blank\u0022\u003E@\u003Cspan\u003Eflor_pp98\u003C/span\u003E\u003C/a\u003E\u003C/span\u003E bicycle the window bicycle tomorrow festival (p111)\u003C/p\u003E"},"id":"https://gts.test/users/ines_gt59/statuses/01M44BKDVTWFAMAQ3YSBM4QETY","inReplyTo":"https://privapub.test/peasants/flor_pp98/scribbles/6ac2beaf092dc0af8ce6035e","interactionPolicy":{"canAnnounce":{"automaticApproval":["https://gts.test/users/ines_gt59"]},"canLike":{"automaticApproval":["https://gts.test/users/ines_gt59","https://gts.test/users/ines_gt59/followers","https://privapub.test/peasants/flor_pp98"]},"canQuote":{"automaticApproval":["https://gts.test/users/ines_gt59"]},"canReply":{"automaticApproval":["https://gts.test/users/ines_gt59","https://gts.test/users/ines_gt59/followers","https://privapub.test/peasants/flor_pp98"]}},"published":"2026-10-04T21:02:31Z","replies":{"first":{"id":"https://gts.test/users/ines_gt59/statuses/01M44BKDVTWFAMAQ3YSBM4QETY/replies?page=true","next":"https://gts.test/users/ines_gt59/statuses/01M44BKDVTWFAMAQ3YSBM4QETY/replies?page=true\u0026only_other_accounts=false","partOf":"https://gts.test/users/ines_gt59/statuses/01M44BKDVTWFAMAQ3YSBM4QETY/replies","type":"CollectionPage"},"id":"https://gts.test/users/ines_gt59/statuses/01M44BKDVTWFAMAQ3YSBM4QETY/replies","type":"Collection"},"tag":{"href":"https://privapub.test/peasants/flor_pp98","name":"@flor_pp98@privapub.test","type":"Mention"},"to":"https://gts.test/users/ines_gt59/followers","type":"Note","url":"https://gts.test/@ines_gt59/statuses/01M44BKDVTWFAMAQ3YSBM4QETY"}

PrivaPub.Tests/Fixtures/pleroma/edited.json

@@ -0,0 +1,71 @@
+{
+	"actor": "https://pleroma.test/users/flor_pl97",
+	"attachment": [],
+	"attributedTo": "https://pleroma.test/users/flor_pl97",
+	"cc": [
+		"https://pleroma.test/users/flor_pl97/followers"
+	],
+	"content": "mountain late window map bright postcard (p10) (edited)",
+	"context": "https://pleroma.test/contexts/891653c5-91ba-43f3-b3ef-b066caa3fa4d",
+	"conversation": "https://pleroma.test/contexts/891653c5-91ba-43f3-b3ef-b066caa3fa4d",
+	"formerRepresentations": {
+		"orderedItems": [
+			{
+				"actor": "https://pleroma.test/users/flor_pl97",
+				"attachment": [],
+				"attributedTo": "https://pleroma.test/users/flor_pl97",
+				"cc": [
+					"https://pleroma.test/users/flor_pl97/followers"
+				],
+				"content": "tomorrow library garden bridge the festival bicycle together garden early quiet morning library the postcard tomorrow mountain the small rain postcard warm garden market map mountain map (p10)",
+				"contentMap": {
+					"en": "tomorrow library garden bridge the festival bicycle together garden early quiet morning library the postcard tomorrow mountain the small rain postcard warm garden market map mountain map (p10)"
+				},
+				"context": "https://pleroma.test/contexts/891653c5-91ba-43f3-b3ef-b066caa3fa4d",
+				"conversation": "https://pleroma.test/contexts/891653c5-91ba-43f3-b3ef-b066caa3fa4d",
+				"published": "2026-10-05T00:49:58.860071Z",
+				"repliesCount": 2,
+				"source": {
+					"content": "tomorrow library garden bridge the festival bicycle together garden early quiet morning library the postcard tomorrow mountain the small rain postcard warm garden market map mountain map (p10)",
+					"mediaType": "text/plain"
+				},
+				"summary": "",
+				"tag": [],
+				"to": [
+					"https://www.w3.org/ns/activitystreams#Public"
+				],
+				"type": "Note"
+			}
+		],
+		"totalItems": 1,
+		"type": "OrderedCollection"
+	},
+	"id": "https://pleroma.test/objects/6101c4fd-ed46-461c-a3fe-9742852f47da",
+	"published": "2026-10-05T00:49:58.860071Z",
+	"replies": {
+		"first": {
+			"id": "https://pleroma.test/objects/6101c4fd-ed46-461c-a3fe-9742852f47da/replies?page=true",
+			"orderedItems": [
+				"https://pleroma.test/objects/b7b7c066-51a8-46d1-8919-07b87f158887",
+				"https://privapub.test/peasants/vera_pp40/scribbles/6ac2f4520c61eaf3ab241d35"
+			],
+			"partOf": "https://pleroma.test/objects/6101c4fd-ed46-461c-a3fe-9742852f47da/replies",
+			"type": "OrderedCollectionPage"
+		},
+		"id": "https://pleroma.test/objects/6101c4fd-ed46-461c-a3fe-9742852f47da/replies",
+		"totalItems": 2,
+		"type": "OrderedCollection"
+	},
+	"repliesCount": 2,
+	"source": {
+		"content": "mountain late window map bright postcard (p10) (edited)",
+		"mediaType": "text/plain"
+	},
+	"summary": "",
+	"tag": [],
+	"to": [
+		"https://www.w3.org/ns/activitystreams#Public"
+	],
+	"type": "Note",
+	"updated": "2026-10-05T00:52:40.105051Z"
+}

PrivaPub.Tests/Http/BackupEndpointTests.cs

@@ -0,0 +1,200 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels;
+using PrivaPub.Infrastructure.Backup;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Formats.Tar;
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	// The administrator's page backs up, downloads, uploads and restores (owner decision 2026-10-07): only an
+	// administrator the database still says is one; a download and a restore ask for the password again, a restore for
+	// the host typed out; an upload resumes where it stopped, and one that would write outside its backup is refused.
+	[Trait("Category", "Integration")]
+	[Xunit.Collection(nameof(Exclusive))]
+	public sealed class BackupEndpointTests : IAsyncLifetime
+	{
+		const string Base = "/clientapi/admin/backups";
+		PrivaPubHost _host;
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync()
+		{
+			RestoreMarker.Clear(_host?.Get<Backups>().Root ?? Path.GetTempPath());
+			return ValueTask.CompletedTask;
+		}
+
+		async Task<string> BackedUp(HttpClient admin)
+		{
+			var before = _host.Get<Backups>().List().Select(b => b.Id).ToHashSet();
+			Assert.Equal(HttpStatusCode.Accepted, (await admin.PostAsync(Base, null, Token)).StatusCode);
+			var made = default(string);
+			Assert.True(await Wait(async () =>
+			{
+				var list = (await admin.GetFromJsonAsync<JsonObject>(Base, Token))!;
+				made = list["backups"]!.AsArray().Select(b => b!["id"]!.GetValue<string>()).FirstOrDefault(id => !before.Contains(id));
+				return made != default && list["running"] is null;
+			}), "the backup was never made");
+			return made;
+		}
+
+		static async Task<bool> Wait(Func<Task<bool>> done)
+		{
+			for (var i = 0; i < 120; i++)
+			{
+				if (await done())
+					return true;
+				await Task.Delay(250, Token);
+			}
+			return false;
+		}
+
+		[Fact]
+		public async Task Only_an_administrator_the_database_still_knows()
+		{
+			var root = await _host.SignUp("plain");
+			using (var plain = _host.As(root.Jwt))
+				Assert.Equal(HttpStatusCode.Forbidden, (await plain.GetAsync(Base, Token)).StatusCode);
+
+			var admin = await _host.Admin();
+			using var client = _host.As(admin.Jwt);
+			Assert.Equal(HttpStatusCode.OK, (await client.GetAsync(Base, Token)).StatusCode);
+			await DB.Default.Update<RootUser>().MatchID(admin.Id).Modify(u => u.Policies, [Policies.IsUser]).ExecuteAsync(Token);
+			Assert.Equal(HttpStatusCode.Forbidden, (await client.GetAsync(Base, Token)).StatusCode);
+			Assert.Equal(HttpStatusCode.Forbidden, (await client.PostAsync(Base, null, Token)).StatusCode);
+		}
+
+		[Fact]
+		public async Task A_backup_is_made_downloaded_whole_or_in_part_and_uploaded_again()
+		{
+			var admin = await _host.Admin();
+			using var client = _host.As(admin.Jwt);
+			var id = await BackedUp(client);
+			var listed = (await client.GetFromJsonAsync<JsonObject>(Base, Token))!;
+			Assert.Equal("privapub.test", listed["host"]!.GetValue<string>());
+			Assert.Equal("manual", listed["backups"]!.AsArray().Single(b => b!["id"]!.GetValue<string>() == id)!["kind"]!.GetValue<string>());
+
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await client.PostAsJsonAsync($"{Base}/{id}/ticket", new { password = "wrong" }, Token)).StatusCode);
+			var ticket = (await (await client.PostAsJsonAsync($"{Base}/{id}/ticket", new { password = admin.Password }, Token)).Content.ReadFromJsonAsync<JsonObject>(Token))!;
+			var url = ticket["url"]!.GetValue<string>();
+
+			// a plain link: no token needed, the ticket is the credential
+			using var anonymous = _host.Client();
+			var whole = await anonymous.GetAsync(url, Token);
+			Assert.Equal(HttpStatusCode.OK, whole.StatusCode);
+			var bytes = await whole.Content.ReadAsByteArrayAsync(Token);
+			Assert.Equal(ticket["bytes"]!.GetValue<long>(), bytes.Length);
+			Assert.Equal(bytes.Length, whole.Content.Headers.ContentLength);
+			var names = new List<string>();
+			await using (var reader = new TarReader(new MemoryStream(bytes)))
+				while (await reader.GetNextEntryAsync(cancellationToken: Token) is { } entry)
+					names.Add(entry.Name);
+			Assert.Contains($"{id}/manifest.json", names);
+			Assert.Contains($"{id}/db/Avatar.jsonl.gz", names);
+
+			var part = new HttpRequestMessage(HttpMethod.Get, url);
+			part.Headers.Range = new RangeHeaderValue(700, 2747);
+			var partial = await anonymous.SendAsync(part, Token);
+			Assert.Equal(HttpStatusCode.PartialContent, partial.StatusCode);
+			Assert.Equal($"bytes 700-2747/{bytes.Length}", partial.Content.Headers.ContentRange!.ToString());
+			Assert.Equal(bytes.AsSpan(700, 2048).ToArray(), await partial.Content.ReadAsByteArrayAsync(Token));
+			Assert.Equal(HttpStatusCode.NotFound, (await anonymous.GetAsync($"{Base}/download/{new string('0', 64)}", Token)).StatusCode);
+
+			// gone, then uploaded again in three pieces, one sent at the wrong place and refused with where to go on
+			Assert.Equal(HttpStatusCode.OK, (await client.DeleteAsync($"{Base}/{id}", Token)).StatusCode);
+			Assert.Equal(HttpStatusCode.NotFound, (await client.DeleteAsync($"{Base}/{id}", Token)).StatusCode);
+			var upload = (await (await client.PostAsync($"{Base}/uploads", null, Token)).Content.ReadFromJsonAsync<JsonObject>(Token))!["id"]!.GetValue<string>();
+			var third = bytes.Length / 3;
+			Assert.Equal(HttpStatusCode.OK, (await Piece(client, upload, 0, bytes[..third])).StatusCode);
+			var gap = await Piece(client, upload, third + 10, bytes[(third + 10)..]);
+			Assert.Equal(HttpStatusCode.Conflict, gap.StatusCode);
+			Assert.Equal(third, (await gap.Content.ReadFromJsonAsync<JsonObject>(Token))!["received"]!.GetValue<long>());
+			Assert.Equal(HttpStatusCode.OK, (await Piece(client, upload, third, bytes[third..(2 * third)])).StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await Piece(client, upload, 2 * third, bytes[(2 * third)..])).StatusCode);
+			var finished = await client.PostAsync($"{Base}/uploads/{upload}/finish", null, Token);
+			Assert.Equal(HttpStatusCode.OK, finished.StatusCode);
+			Assert.Equal("uploaded", (await finished.Content.ReadFromJsonAsync<JsonObject>(Token))!["kind"]!.GetValue<string>());
+			Assert.Empty(await _host.Get<Backups>().Verify(id, Token));
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await client.PostAsync($"{Base}/uploads/{upload}/finish", null, Token)).StatusCode);
+			_host.Get<Backups>().Delete(id);
+		}
+
+		Task<HttpResponseMessage> Piece(HttpClient client, string upload, long offset, byte[] bytes) =>
+			client.PutAsync($"{Base}/uploads/{upload}?offset={offset}", new ByteArrayContent(bytes), Token);
+
+		[Theory]
+		[InlineData("escape")]
+		[InlineData("link")]
+		[InlineData("elsewhere")]
+		[InlineData("junk")]
+		public async Task An_upload_that_is_not_a_plain_backup_is_refused_and_leaves_nothing(string how)
+		{
+			var admin = await _host.Admin();
+			using var client = _host.As(admin.Jwt);
+			const string id = "20260101-000000-manual";
+			var tar = new MemoryStream();
+			if (how == "junk")
+				tar.Write("not a tar at all, not even close"u8);
+			else
+				await using (var writer = new TarWriter(tar, TarEntryFormat.Pax, leaveOpen: true))
+				{
+					await writer.WriteEntryAsync(new PaxTarEntry(TarEntryType.RegularFile, $"{id}/manifest.json") { DataStream = new MemoryStream("{}"u8.ToArray()) }, Token);
+					await writer.WriteEntryAsync(how switch
+					{
+						"escape" => new PaxTarEntry(TarEntryType.RegularFile, $"{id}/../../evil") { DataStream = new MemoryStream("x"u8.ToArray()) },
+						"link" => new PaxTarEntry(TarEntryType.SymbolicLink, $"{id}/media/x.jpg") { LinkName = "/etc/passwd" },
+						_ => new PaxTarEntry(TarEntryType.RegularFile, "20260101-000000-nightly/db/Post.jsonl.gz") { DataStream = new MemoryStream("x"u8.ToArray()) }
+					}, Token);
+				}
+			var upload = (await (await client.PostAsync($"{Base}/uploads", null, Token)).Content.ReadFromJsonAsync<JsonObject>(Token))!["id"]!.GetValue<string>();
+			Assert.Equal(HttpStatusCode.OK, (await Piece(client, upload, 0, tar.ToArray())).StatusCode);
+
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await client.PostAsync($"{Base}/uploads/{upload}/finish", null, Token)).StatusCode);
+			var root = _host.Get<Backups>().Root;
+			Assert.False(Directory.Exists(Path.Combine(root, id)));
+			Assert.False(Directory.Exists(Path.Combine(root, id + ServerBackup.PartialSuffix)));
+			Assert.False(File.Exists(Path.Combine(root, "..", "evil")));
+		}
+
+		// asked for: written for the next start (the test host has no watcher to stop it, and the marker is taken away)
+		[Fact]
+		public async Task A_restore_asks_for_the_password_and_the_host_typed_out()
+		{
+			var admin = await _host.Admin();
+			using var client = _host.As(admin.Jwt);
+			var id = await BackedUp(client);
+			var root = _host.Get<Backups>().Root;
+			try
+			{
+				Assert.Equal(HttpStatusCode.UnprocessableEntity, (await client.PostAsJsonAsync($"{Base}/{id}/restore", new { password = "wrong", host = "privapub.test" }, Token)).StatusCode);
+				Assert.Equal(HttpStatusCode.UnprocessableEntity, (await client.PostAsJsonAsync($"{Base}/{id}/restore", new { password = admin.Password, host = "elsewhere.test" }, Token)).StatusCode);
+				Assert.Null(RestoreMarker.Read(root));
+
+				Assert.Equal(HttpStatusCode.Accepted, (await client.PostAsJsonAsync($"{Base}/{id}/restore", new { password = admin.Password, host = "PrivaPub.test" }, Token)).StatusCode);
+				var marker = RestoreMarker.Read(root);
+				Assert.Equal((id, "pending", admin.UserName), (marker.Backup, marker.State, marker.RequestedBy));
+				Assert.Equal(id, (await client.GetFromJsonAsync<JsonObject>(Base, Token))!["waiting"]!["backup"]!.GetValue<string>());
+				Assert.Equal(HttpStatusCode.Conflict, (await client.DeleteAsync($"{Base}/{id}", Token)).StatusCode);
+			}
+			finally
+			{
+				RestoreMarker.Clear(root);
+				_host.Get<Backups>().Delete(id);
+			}
+		}
+	}
+}

PrivaPub.Tests/Http/ClientApiAccountsTests.cs

@@ -0,0 +1,492 @@
+using Microsoft.Extensions.Configuration;
+using Microsoft.IdentityModel.Tokens;
+
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.User;
+using PrivaPub.Services;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.IdentityModel.Tokens.Jwt;
+using System.Net;
+using System.Security.Claims;
+using System.Text;
+using System.Text.Json.Nodes;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class ClientApiAccountsTests : IAsyncLifetime
+	{
+		const string NewPassword = "Other-Pass-2!";
+
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static string Name(string prefix) => $"{prefix}{Guid.NewGuid():N}"[..20];
+
+		async Task<HttpResponseMessage> LogIn(string userName, string password)
+		{
+			using var client = _host.Client();
+			return await client.PostJson("/clientapi/user/login", new { userName, password });
+		}
+
+		async Task<HttpStatusCode> Settings(string jwt)
+		{
+			using var client = _host.As(jwt);
+			return (await client.GetAsync("/clientapi/user/settings", TestContext.Current.CancellationToken)).StatusCode;
+		}
+
+		static async Task<string> Message(HttpResponseMessage response)
+		{
+			var body = await response.JsonBody();
+			return body["errorMessage"]?.GetValue<string>() ?? body["title"]?.GetValue<string>();
+		}
+
+		string Jwt(string rootId, string userName, DateTime expires, string key = default)
+		{
+			var configuration = _host.Get<IConfiguration>();
+			var signing = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(key ?? configuration["AppConfiguration:Jwt:Key"]!));
+			var token = new JwtSecurityToken(configuration["AppConfiguration:Jwt:Issuer"], configuration["AppConfiguration:Jwt:Audience"],
+				new[] { new Claim(ClaimTypes.UserData, rootId), new Claim(ClaimTypes.Name, userName), new Claim(Policies.IsUser, "true") },
+				notBefore: expires.AddHours(-1), expires: expires, signingCredentials: new SigningCredentials(signing, SecurityAlgorithms.HmacSha512));
+			return new JwtSecurityTokenHandler().WriteToken(token);
+		}
+
+		[Fact]
+		public async Task Signing_up_answers_a_token_for_the_new_root()
+		{
+			var userName = Name("Signup");
+			using var client = _host.Client();
+
+			var response = await client.PostJson("/clientapi/user/signup", new { userName, password = Accounts.Password });
+
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			var jwt = await response.JsonBody();
+			Assert.Equal(userName.ToLowerInvariant(), jwt["username"]!.GetValue<string>());
+			Assert.Equal(new[] { Policies.IsUser }, jwt["policies"]!.AsArray().Select(p => p!.GetValue<string>()));
+			Assert.Equal(HttpStatusCode.OK, await Settings(jwt["token"]!.GetValue<string>()));
+			var stored = await DB.Default.Find<RootUser>().MatchID(jwt["userId"]!.GetValue<string>()).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+			Assert.NotEqual(Accounts.Password, stored.HashedPassword);
+		}
+
+		[Fact]
+		public async Task A_taken_username_is_refused_whatever_its_case()
+		{
+			var root = await _host.SignUp("taken");
+			using var client = _host.Client();
+
+			var again = await client.PostJson("/clientapi/user/signup", new { userName = root.UserName, password = Accounts.Password });
+			var shouted = await client.PostJson("/clientapi/user/signup", new { userName = root.UserName.ToUpperInvariant(), password = Accounts.Password });
+
+			Assert.Equal(HttpStatusCode.BadRequest, again.StatusCode);
+			Assert.Contains("already taken", await Message(again));
+			Assert.Equal(HttpStatusCode.BadRequest, shouted.StatusCode);
+			Assert.Equal(1, await DB.Default.CountAsync<RootUser>(u => u.UserName == root.UserName, TestContext.Current.CancellationToken));
+		}
+
+		public static TheoryData<string> InvalidSignUps() => new()
+		{
+			"{}",
+			"{\"userName\":\"ab\",\"password\":\"Test-Pass-1!\"}",
+			"{\"userName\":\"has space\",\"password\":\"Test-Pass-1!\"}",
+			"{\"userName\":\"validname\",\"password\":\"short\"}",
+			"{\"userName\":\"validname\",\"password\":\"nouppercase1\"}",
+			"{\"userName\":\"validname\",\"password\":\"Has Space1\"}",
+			"{\"userName\":\"validname\",\"password\":\"Test-Pass-1!\",\"lightThemeIndexColour\":400}",
+			"{\"userName\":\"" + new string('a', 40) + "\",\"password\":\"Test-Pass-1!\"}",
+			"not json"
+		};
+
+		[Theory]
+		[MemberData(nameof(InvalidSignUps))]
+		public async Task An_invalid_sign_up_answers_400_with_a_message(string body)
+		{
+			using var client = _host.Client();
+
+			var response = await client.PostAsync("/clientapi/user/signup", new StringContent(body, Encoding.UTF8, "application/json"), TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+			Assert.False(string.IsNullOrEmpty(await Message(response)));
+		}
+
+		[Fact]
+		public async Task Logging_in_and_out()
+		{
+			var root = await _host.SignUp("login");
+
+			var ok = await LogIn(root.UserName, root.Password);
+			var wrong = await LogIn(root.UserName, "Wrong-Pass-1!");
+			var unknown = await LogIn(Name("nobody"), root.Password);
+			using var signedIn = _host.As((await ok.JsonBody())["token"]!.GetValue<string>());
+			var logout = await signedIn.GetAsync("/clientapi/user/logout", TestContext.Current.CancellationToken);
+			using var anonymous = _host.Client();
+			var anonymousLogout = await anonymous.GetAsync("/clientapi/user/logout", TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.OK, ok.StatusCode);
+			Assert.Equal(root.Id, (await ok.JsonBody())["userId"]!.GetValue<string>());
+			// a wrong password and an unknown login get the same answer, so sign-in tells nobody which logins exist
+			Assert.Equal(HttpStatusCode.BadRequest, wrong.StatusCode);
+			Assert.Equal(RootUsersService.NoMatch, await Message(wrong));
+			Assert.Equal(HttpStatusCode.BadRequest, unknown.StatusCode);
+			Assert.Equal(await Message(wrong), await Message(unknown));
+			Assert.Equal(HttpStatusCode.OK, logout.StatusCode);
+			Assert.Equal(HttpStatusCode.Unauthorized, anonymousLogout.StatusCode);
+		}
+
+		[Fact]
+		public async Task Update_sets_the_recovery_email_and_refuses_one_in_use()
+		{
+			var root = await _host.SignUp("email");
+			var other = await _host.SignUp("email");
+			var email = $"{Guid.NewGuid():N}@example.test";
+			using var client = _host.As(root.Jwt);
+			using var otherClient = _host.As(other.Jwt);
+
+			var set = await client.PostJson("/clientapi/user/update", new { email });
+			var taken = await otherClient.PostJson("/clientapi/user/update", new { email });
+			var invalid = await otherClient.PostJson("/clientapi/user/update", new { email = "not an email" });
+
+			Assert.Equal(HttpStatusCode.OK, set.StatusCode);
+			Assert.Equal(email, (await DB.Default.Find<RootUser>().MatchID(root.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken)).Email);
+			Assert.Equal(HttpStatusCode.BadRequest, taken.StatusCode);
+			Assert.Contains("already taken", await Message(taken));
+			Assert.Equal(HttpStatusCode.BadRequest, invalid.StatusCode);
+			Assert.Null((await DB.Default.Find<RootUser>().MatchID(other.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken)).Email);
+		}
+
+		[Fact]
+		public async Task Settings_round_trip()
+		{
+			var root = await _host.SignUp("settings");
+			using var client = _host.As(root.Jwt);
+
+			var updated = await client.PostJson("/clientapi/user/update/settings", new
+			{
+				languageCode = "it",
+				lightThemeIndexColour = 100,
+				darkThemeIndexColour = 200,
+				iconsThemeIndexColour = 50,
+				themeIsDarkMode = true,
+				themeIsDarkGray = true
+			});
+			var settings = await (await client.GetAsync("/clientapi/user/settings", TestContext.Current.CancellationToken)).JsonBody();
+			var unsupported = await client.PostJson("/clientapi/user/update/settings", new { languageCode = "xx" });
+			var outOfRange = await client.PostJson("/clientapi/user/update/settings", new { languageCode = "en", lightThemeIndexColour = 360 });
+
+			Assert.Equal(HttpStatusCode.OK, updated.StatusCode);
+			Assert.Equal("it", settings["languageCode"]!.GetValue<string>());
+			Assert.Equal(100, settings["lightThemeIndexColour"]!.GetValue<int>());
+			Assert.Equal(200, settings["darkThemeIndexColour"]!.GetValue<int>());
+			Assert.Equal(50, settings["iconsThemeIndexColour"]!.GetValue<int>());
+			Assert.True(settings["themeIsDarkMode"]!.GetValue<bool>());
+			Assert.True(settings["themeIsDarkGray"]!.GetValue<bool>());
+			Assert.Equal(HttpStatusCode.BadRequest, unsupported.StatusCode);
+			Assert.Contains("unsupported", await Message(unsupported));
+			Assert.Equal(HttpStatusCode.BadRequest, outOfRange.StatusCode);
+			Assert.Equal("it", (await DB.Default.Find<RootUser>().MatchID(root.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken)).Settings.LanguageCode);
+		}
+
+		[Fact]
+		public async Task Changing_the_password_needs_the_old_one()
+		{
+			var root = await _host.SignUp("password");
+			using var client = _host.As(root.Jwt);
+
+			var wrongOld = await client.PostJson("/clientapi/user/update/password", new { oldPassword = "Wrong-Pass-1!", newPassword = NewPassword, repeatedPassword = NewPassword });
+			var mismatch = await client.PostJson("/clientapi/user/update/password", new { oldPassword = root.Password, newPassword = NewPassword, repeatedPassword = "Something-3!" });
+			var weak = await client.PostJson("/clientapi/user/update/password", new { oldPassword = root.Password, newPassword = "weak", repeatedPassword = "weak" });
+			var changed = await client.PostJson("/clientapi/user/update/password", new { oldPassword = root.Password, newPassword = NewPassword, repeatedPassword = NewPassword });
+
+			Assert.Equal(HttpStatusCode.BadRequest, wrongOld.StatusCode);
+			Assert.Equal("Wrong password.", await Message(wrongOld));
+			Assert.Equal(HttpStatusCode.BadRequest, mismatch.StatusCode);
+			Assert.Equal(HttpStatusCode.BadRequest, weak.StatusCode);
+			Assert.Equal(HttpStatusCode.OK, changed.StatusCode);
+			Assert.Equal(HttpStatusCode.BadRequest, (await LogIn(root.UserName, root.Password)).StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await LogIn(root.UserName, NewPassword)).StatusCode);
+		}
+
+		[Fact]
+		public async Task An_invitation_signs_up_a_root_with_a_persona_in_the_group()
+		{
+			var owner = await _host.Persona(await _host.SignUp("owner"), "owner");
+			var group = await _host.Group(owner, community: false, password: "door-Pass-1");
+			var invitationCode = group["invitationCode"]!.GetValue<string>();
+			var userName = Name("invited");
+			var avatarUserName = Name("guest");
+			using var client = _host.Client();
+
+			var wrongPassword = await client.PostJson("/clientapi/user/invitation/signup", new { userName, password = Accounts.Password, invitationCode, invitationPassword = "nope", avatarUserName });
+			var wrongCode = await client.PostJson("/clientapi/user/invitation/signup", new { userName, password = Accounts.Password, invitationCode = $"{Guid.NewGuid():N}{Guid.NewGuid():N}", invitationPassword = "door-Pass-1", avatarUserName });
+			var response = await client.PostJson("/clientapi/user/invitation/signup", new { userName, password = Accounts.Password, invitationCode, invitationPassword = "door-Pass-1", avatarUserName, avatarName = "Guest" });
+
+			Assert.Equal(HttpStatusCode.NotAcceptable, wrongPassword.StatusCode);
+			Assert.Equal(HttpStatusCode.NotFound, wrongCode.StatusCode);
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			var jwt = await response.JsonBody();
+			using var invited = _host.As(jwt["token"]!.GetValue<string>());
+			var avatars = await (await invited.GetAsync("/clientapi/avatar/private/list", TestContext.Current.CancellationToken)).JsonItems();
+			var avatar = Assert.Single(avatars)!;
+			Assert.Equal(avatarUserName, avatar["userName"]!.GetValue<string>());
+			Assert.Equal("Guest", avatar["name"]!.GetValue<string>());
+			var stored = await DB.Default.Find<GroupEntity>().MatchID(group["id"]!.GetValue<string>()).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+			Assert.Contains(stored.Members, m => !m.IsForeign && m.AvatarId == avatar["id"]!.GetValue<string>() && m.Role == GroupRole.Member);
+		}
+
+		[Fact]
+		public async Task An_invitation_never_names_the_persona_after_the_login()
+		{
+			var owner = await _host.Persona(await _host.SignUp("owner"), "owner");
+			var invitationCode = (await _host.Group(owner, community: true))["invitationCode"]!.GetValue<string>();
+			var userName = Name("same");
+			using var client = _host.Client();
+
+			var same = await client.PostJson("/clientapi/user/invitation/signup", new { userName, password = Accounts.Password, invitationCode, avatarUserName = userName });
+			var shouted = await client.PostJson("/clientapi/user/invitation/signup", new { userName = userName.ToUpperInvariant(), password = Accounts.Password, invitationCode, avatarUserName = userName });
+			var missing = await client.PostJson("/clientapi/user/invitation/signup", new { userName, password = Accounts.Password, invitationCode });
+
+			Assert.Equal(HttpStatusCode.BadRequest, same.StatusCode);
+			Assert.Equal("Your persona's username must differ from your login.", await Message(same));
+			Assert.Equal(HttpStatusCode.BadRequest, shouted.StatusCode);
+			Assert.Equal("Your persona's username must differ from your login.", await Message(shouted));
+			Assert.Equal(HttpStatusCode.BadRequest, missing.StatusCode);
+			Assert.False(await DB.Default.Find<RootUser>().Match(u => u.UserName == userName).ExecuteAnyAsync(TestContext.Current.CancellationToken));
+			Assert.False(await DB.Default.Find<Avatar>().Match(a => a.UserName == userName).ExecuteAnyAsync(TestContext.Current.CancellationToken));
+		}
+
+		[Fact]
+		public async Task An_existing_root_joins_through_an_invitation_with_a_new_persona()
+		{
+			var owner = await _host.Persona(await _host.SignUp("owner"), "owner");
+			var group = await _host.Group(owner, community: true);
+			var root = await _host.SignUp("joiner");
+			var avatarUserName = Name("joined");
+			using var client = _host.Client();
+
+			var response = await client.PostJson("/clientapi/user/invitation/login", new
+			{
+				userName = root.UserName,
+				password = root.Password,
+				invitationCode = group["invitationCode"]!.GetValue<string>(),
+				avatarUserName
+			});
+
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			using var joined = _host.As(root.Jwt);
+			var avatar = Assert.Single(await (await joined.GetAsync("/clientapi/avatar/private/list", TestContext.Current.CancellationToken)).JsonItems())!;
+			Assert.Equal(avatarUserName, avatar["userName"]!.GetValue<string>());
+			var groups = await (await joined.GetAsync("/clientapi/group/list?avatarId=" + avatar["id"]!.GetValue<string>(), TestContext.Current.CancellationToken)).JsonItems();
+			Assert.Equal(group["id"]!.GetValue<string>(), Assert.Single(groups)!["id"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task Recovery_answers_the_same_whoever_asks_and_queues_the_work()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var withEmail = await _host.SignUp("withemail");
+			var withoutEmail = await _host.SignUp("noemail");
+			var email = $"{Guid.NewGuid():N}@example.test";
+			using (var signedIn = _host.As(withEmail.Jwt))
+				Assert.Equal(HttpStatusCode.OK, (await signedIn.PostJson("/clientapi/user/update", new { email })).StatusCode);
+			using var client = _host.Client();
+
+			var answers = new[]
+			{
+				await client.PostJson("/clientapi/user/recover/password", new { userName = withEmail.UserName }),
+				await client.PostJson("/clientapi/user/recover/password", new { email }),
+				await client.PostJson("/clientapi/user/recover/password", new { userName = withoutEmail.UserName }),
+				await client.PostJson("/clientapi/user/recover/password", new { userName = Name("nobody") }),
+				await client.PostJson("/clientapi/user/recover/password", new { email = $"{Guid.NewGuid():N}@example.test" })
+			};
+			var bodies = new List<string>();
+			foreach (var answer in answers)
+			{
+				Assert.Equal(HttpStatusCode.OK, answer.StatusCode);
+				bodies.Add(await answer.Content.ReadAsStringAsync(token));
+			}
+
+			Assert.Single(bodies.Distinct());
+			Assert.Contains("recovery link is on its way", bodies[0]);
+			var queued = await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.SendRecovery && j.CreatedAt >= since).ExecuteAsync(token);
+			Assert.True(queued.Count >= answers.Length);
+			Assert.Contains(queued, j => j.Payload.Contains(withEmail.Id));
+			Assert.Equal(HttpStatusCode.BadRequest, (await client.PostJson("/clientapi/user/recover/password", new { })).StatusCode);
+		}
+
+		[Fact]
+		public async Task The_recovery_job_keeps_only_a_hash_and_an_unreachable_mail_server_says_nothing_to_anyone()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var root = await _host.SignUp("smtp");
+			var email = $"{Guid.NewGuid():N}@example.test";
+			using (var signedIn = _host.As(root.Jwt))
+				Assert.Equal(HttpStatusCode.OK, (await signedIn.PostJson("/clientapi/user/update", new { email })).StatusCode);
+			using var client = _host.Client();
+
+			var answer = await client.PostJson("/clientapi/user/recover/password", new { userName = root.UserName });
+			await _host.Run(j => j.Kind == JobKind.SendRecovery && j.Payload.Contains(root.Id), token);
+
+			Assert.Equal(HttpStatusCode.OK, answer.StatusCode);
+			var recovery = await DB.Default.Find<EmailRecovery>().Match(r => r.RootUserId == root.Id).ExecuteFirstAsync(token);
+			Assert.NotNull(recovery);
+			Assert.Null(recovery.RecoveryCode);
+			Assert.Equal(64, recovery.CodeHash.Length);
+			Assert.InRange(recovery.ExpiresAt, DateTime.UtcNow.AddMinutes(50), DateTime.UtcNow.AddMinutes(61));
+		}
+
+		[Fact]
+		public async Task A_wrong_recovery_code_changes_nothing()
+		{
+			using var client = _host.Client();
+			var code = Guid.NewGuid().ToString("N");
+
+			var valid = await client.PostAsync("/clientapi/user/recover/valid", new StringContent($"\"{code}\"", Encoding.UTF8, "application/json"), TestContext.Current.CancellationToken);
+			var change = await client.PostJson("/clientapi/user/recover/update/password", new { newPassword = NewPassword, repeatedPassword = NewPassword, recoveryCode = code });
+
+			Assert.Equal(HttpStatusCode.OK, valid.StatusCode);
+			Assert.Equal("false", await valid.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+			Assert.Equal(HttpStatusCode.NotFound, change.StatusCode);
+			Assert.Equal("Invalid recovery code.", await Message(change));
+		}
+
+		[Fact]
+		public async Task A_valid_recovery_code_resets_the_password_once()
+		{
+			var root = await _host.SignUp("recover");
+			var code = Guid.NewGuid().ToString("N") + Guid.NewGuid().ToString("N");
+			await DB.Default.SaveAsync(new EmailRecovery { RootUserId = root.Id, CodeHash = RecoveryJob.Hash(code), ExpiresAt = DateTime.UtcNow.AddHours(1) },
+				TestContext.Current.CancellationToken);
+			var persona = await _host.Persona(root, "recovered");
+			var apiToken = await _host.MastodonToken(persona);
+			using var client = _host.Client();
+
+			var valid = await client.PostAsync("/clientapi/user/recover/valid", new StringContent($"\"{code}\"", Encoding.UTF8, "application/json"), TestContext.Current.CancellationToken);
+			var change = await client.PostJson("/clientapi/user/recover/update/password", new { newPassword = NewPassword, repeatedPassword = NewPassword, recoveryCode = code });
+			var again = await client.PostJson("/clientapi/user/recover/update/password", new { newPassword = "Third-Pass-3!", repeatedPassword = "Third-Pass-3!", recoveryCode = code });
+
+			Assert.Equal("true", await valid.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+			Assert.True(change.IsSuccessStatusCode);
+			Assert.Equal(HttpStatusCode.NotFound, again.StatusCode);
+			Assert.Equal(HttpStatusCode.BadRequest, (await LogIn(root.UserName, root.Password)).StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await LogIn(root.UserName, NewPassword)).StatusCode);
+			Assert.False(await DB.Default.Find<EmailRecovery>().Match(r => r.RootUserId == root.Id).ExecuteAnyAsync(TestContext.Current.CancellationToken));
+			// whoever held the old sessions may be why the password was recovered: they end
+			using (var oldSession = _host.As(root.Jwt))
+				Assert.Equal(HttpStatusCode.Unauthorized, (await oldSession.GetAsync("/clientapi/user/sniff/again", TestContext.Current.CancellationToken)).StatusCode);
+			using (var oldApp = _host.Client())
+			{
+				oldApp.DefaultRequestHeaders.Authorization = new("Bearer", apiToken);
+				Assert.Equal(HttpStatusCode.Unauthorized, (await oldApp.GetAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken)).StatusCode);
+			}
+		}
+
+		[Fact]
+		public async Task An_expired_recovery_code_changes_nothing()
+		{
+			var root = await _host.SignUp("expired");
+			var code = Guid.NewGuid().ToString("N") + Guid.NewGuid().ToString("N");
+			await DB.Default.SaveAsync(new EmailRecovery { RootUserId = root.Id, CodeHash = RecoveryJob.Hash(code), ExpiresAt = DateTime.UtcNow.AddMinutes(-1) },
+				TestContext.Current.CancellationToken);
+			using var client = _host.Client();
+
+			var change = await client.PostJson("/clientapi/user/recover/update/password", new { newPassword = NewPassword, repeatedPassword = NewPassword, recoveryCode = code });
+
+			Assert.Equal(HttpStatusCode.NotFound, change.StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await LogIn(root.UserName, root.Password)).StatusCode);
+		}
+
+		[Fact]
+		public async Task Sniffing_again_answers_a_fresh_token()
+		{
+			var root = await _host.SignUp("sniff");
+			using var client = _host.As(root.Jwt);
+
+			var response = await client.GetAsync("/clientapi/user/sniff/again", TestContext.Current.CancellationToken);
+			using var anonymous = _host.Client();
+			var refused = await anonymous.GetAsync("/clientapi/user/sniff/again", TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			var jwt = await response.JsonBody();
+			Assert.Equal(root.Id, jwt["userId"]!.GetValue<string>());
+			Assert.Equal(root.UserName, jwt["username"]!.GetValue<string>());
+			Assert.True(jwt["expiration"]!.GetValue<long>() > DateTime.UtcNow.Ticks);
+			Assert.Equal(HttpStatusCode.OK, await Settings(jwt["token"]!.GetValue<string>()));
+			Assert.Equal(HttpStatusCode.Unauthorized, refused.StatusCode);
+		}
+
+		[Fact]
+		public async Task The_eleventh_sign_up_from_one_address_in_a_minute_is_refused()
+		{
+			using var client = _host.ClientAt("198.51.100.21");
+			for (var attempt = 1; attempt <= 10; attempt++)
+				Assert.Equal(HttpStatusCode.BadRequest, (await client.PostJson("/clientapi/user/signup", new { })).StatusCode);
+
+			var eleventh = await client.PostJson("/clientapi/user/signup", new { userName = Name("limited"), password = Accounts.Password });
+
+			Assert.Equal(HttpStatusCode.TooManyRequests, eleventh.StatusCode);
+		}
+
+		[Fact]
+		public async Task A_bad_token_answers_401_with_a_json_body()
+		{
+			var root = await _host.SignUp("badjwt");
+			var tokens = new[]
+			{
+				"not-a-jwt",
+				Jwt(root.Id, root.UserName, DateTime.UtcNow.AddHours(-1)),
+				Jwt(root.Id, root.UserName, DateTime.UtcNow.AddHours(1), key: "another-key-entirely-0123456789abcdef0123456789abcdef0123456789abcdef")
+			};
+
+			foreach (var token in tokens)
+			{
+				using var client = _host.As(token);
+				var response = await client.GetAsync("/clientapi/user/settings", TestContext.Current.CancellationToken);
+
+				Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+				Assert.Equal("application/json", response.Content.Headers.ContentType!.MediaType);
+				var body = await response.JsonBody();
+				Assert.Equal(401, body["statusCode"]!.GetValue<int>());
+				Assert.False(body["isValid"]!.GetValue<bool>());
+				Assert.Contains("invalid_token", response.Headers.WwwAuthenticate.ToString());
+			}
+			Assert.Equal(HttpStatusCode.OK, await Settings(Jwt(root.Id, root.UserName, DateTime.UtcNow.AddHours(1))));
+		}
+
+		[Fact]
+		public async Task A_banned_or_removed_root_loses_the_client_api_at_once()
+		{
+			var banned = await _host.SignUp("banned");
+			var removed = await _host.SignUp("removed");
+			Assert.Equal(HttpStatusCode.OK, await Settings(banned.Jwt));
+			Assert.Equal(HttpStatusCode.OK, await Settings(removed.Jwt));
+
+			await ClientApi.Ban(banned.Id);
+			await DB.Default.Update<RootUser>().MatchID(removed.Id).Modify(u => u.DeletedAt, DateTime.UtcNow).ExecuteAsync(TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.Unauthorized, await Settings(banned.Jwt));
+			Assert.Equal(HttpStatusCode.Unauthorized, await Settings(removed.Jwt));
+			using (var client = _host.As(banned.Jwt))
+			{
+				Assert.Equal(HttpStatusCode.Unauthorized, (await client.GetAsync("/clientapi/user/sniff/again", TestContext.Current.CancellationToken)).StatusCode);
+				Assert.Equal(HttpStatusCode.Unauthorized, (await client.PostJson("/clientapi/avatar/private/insert", new { userName = Name("late"), name = "late", biography = "testing" })).StatusCode);
+			}
+			await ClientApi.Ban(banned.Id, banned: false);
+			Assert.Equal(HttpStatusCode.OK, await Settings(banned.Jwt));
+		}
+	}
+}

PrivaPub.Tests/Http/ClientApiGroupsTests.cs

@@ -0,0 +1,302 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class ClientApiGroupsTests : IAsyncLifetime
+	{
+		const string DoorPassword = "door-Pass-1";
+
+		PrivaPubHost _host;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		async Task<Persona> NewPersona(string name) => await _host.Persona(await _host.SignUp(name), name);
+
+		static Task<GroupEntity> Stored(JsonObject group) =>
+			DB.Default.Find<GroupEntity>().MatchID(group["id"]!.GetValue<string>()).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+
+		async Task<List<string>> Groups(Persona persona)
+		{
+			using var client = _host.As(persona.Root.Jwt);
+			var response = await client.GetAsync("/clientapi/group/list?avatarId=" + persona.Id, TestContext.Current.CancellationToken);
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			return (await response.JsonItems()).Select(g => g!["id"]!.GetValue<string>()).ToList();
+		}
+
+		async Task<HttpResponseMessage> Approve(Persona manager, JsonObject group, string actorUri)
+		{
+			using var client = _host.As(manager.Root.Jwt);
+			return await client.PostJson("/clientapi/group/approve", new { avatarId = manager.Id, groupId = group["id"]!.GetValue<string>(), memberActorURI = actorUri });
+		}
+
+		async Task<(Persona Owner, JsonObject Circle, RemoteActor Member)> CircleWithRemoteMember()
+		{
+			var owner = await NewPersona("circleowner");
+			var circle = await _host.Group(owner, community: false, name: "circle");
+			var member = new RemoteActor(_peer, "member");
+			await _host.Follow(member, _peer.A, circle["userName"]!.GetValue<string>());
+			Assert.True((await Approve(owner, circle, member.Id)).IsSuccessStatusCode);
+			return (owner, circle, member);
+		}
+
+		async Task<HttpStatusCode> Get(string path, RemoteActor signer = default)
+		{
+			using var client = _host.Client();
+			using var request = signer == default ? new HttpRequestMessage(HttpMethod.Get, path) : signer.SignedGet(path);
+			request.Headers.Accept.ParseAdd("application/activity+json");
+			return (await client.SendAsync(request, TestContext.Current.CancellationToken)).StatusCode;
+		}
+
+		[Fact]
+		public async Task A_community_and_a_circle_are_created()
+		{
+			var owner = await NewPersona("founder");
+
+			var community = await _host.Group(owner, community: true, name: "community");
+			var circle = await _host.Group(owner, community: false, password: DoorPassword, name: "circle");
+
+			Assert.True(community["isCommunity"]!.GetValue<bool>());
+			Assert.False(circle["isCommunity"]!.GetValue<bool>());
+			foreach (var group in new[] { community, circle })
+			{
+				Assert.True(group["isOwner"]!.GetValue<bool>());
+				Assert.Equal(64, group["invitationCode"]!.GetValue<string>().Length);
+				Assert.Equal($"{PrivaPubHost.Base}/peasants/{group["userName"]!.GetValue<string>()}", group["url"]!.GetValue<string>());
+				Assert.Equal(1, group["membersCount"]!.GetValue<int>());
+			}
+			Assert.True(circle["isPasswordRequired"]!.GetValue<bool>());
+			Assert.False(community["isPasswordRequired"]!.GetValue<bool>());
+			Assert.Equal(GroupKind.Community, (await Stored(community)).Kind);
+			var storedCircle = await Stored(circle);
+			Assert.Equal(GroupKind.Circle, storedCircle.Kind);
+			Assert.NotEqual(DoorPassword, storedCircle.HashedInvitationPassword);
+			Assert.Contains(storedCircle.Members, m => m.AvatarId == owner.Id && m.Role == GroupRole.Owner);
+			Assert.Equal(new[] { community["id"]!.GetValue<string>(), circle["id"]!.GetValue<string>() }.Order(), (await Groups(owner)).Order());
+		}
+
+		[Fact]
+		public async Task A_group_needs_a_persona_of_ones_own()
+		{
+			var owner = await NewPersona("founder");
+			var stranger = await _host.SignUp("stranger");
+			using var client = _host.As(stranger.Jwt);
+
+			var insert = await client.PostJson("/clientapi/group/insert", new { avatarId = owner.Id, userName = $"stolen{Guid.NewGuid():N}"[..20], name = "stolen", isCommunity = true });
+			var list = await client.GetAsync("/clientapi/group/list?avatarId=" + owner.Id, TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.NotFound, insert.StatusCode);
+			Assert.Equal(HttpStatusCode.NotFound, list.StatusCode);
+		}
+
+		[Fact]
+		public async Task Joining_takes_the_code_and_the_password()
+		{
+			var owner = await NewPersona("host");
+			var circle = await _host.Group(owner, community: false, password: DoorPassword);
+			var joiner = await NewPersona("guest");
+			var invitationCode = circle["invitationCode"]!.GetValue<string>();
+			using var client = _host.As(joiner.Root.Jwt);
+
+			var noPassword = await client.PostJson("/clientapi/group/join", new { avatarId = joiner.Id, invitationCode });
+			var wrongPassword = await client.PostJson("/clientapi/group/join", new { avatarId = joiner.Id, invitationCode, invitationPassword = "wrong" });
+			var wrongCode = await client.PostJson("/clientapi/group/join", new { avatarId = joiner.Id, invitationCode = $"{Guid.NewGuid():N}{Guid.NewGuid():N}", invitationPassword = DoorPassword });
+			var joined = await client.PostJson("/clientapi/group/join", new { avatarId = joiner.Id, invitationCode, invitationPassword = DoorPassword });
+			var twice = await client.PostJson("/clientapi/group/join", new { avatarId = joiner.Id, invitationCode, invitationPassword = DoorPassword });
+
+			Assert.Equal(HttpStatusCode.NotAcceptable, noPassword.StatusCode);
+			Assert.Equal(HttpStatusCode.NotAcceptable, wrongPassword.StatusCode);
+			Assert.Equal(HttpStatusCode.NotFound, wrongCode.StatusCode);
+			Assert.Equal(HttpStatusCode.OK, joined.StatusCode);
+			var view = await joined.JsonBody();
+			Assert.Equal(2, view["membersCount"]!.GetValue<int>());
+			Assert.False(view["isOwner"]!.GetValue<bool>());
+			Assert.Null(view["invitationCode"]);
+			Assert.Equal(HttpStatusCode.OK, twice.StatusCode);
+			Assert.Equal(2, (await Stored(circle)).Members.Count);
+			Assert.Equal(new[] { circle["id"]!.GetValue<string>() }, await Groups(joiner));
+		}
+
+		[Fact]
+		public async Task Joining_needs_a_persona_of_ones_own()
+		{
+			var owner = await NewPersona("host");
+			var community = await _host.Group(owner, community: true);
+			var victim = await NewPersona("victim");
+			var stranger = await _host.SignUp("stranger");
+			using var client = _host.As(stranger.Jwt);
+
+			var response = await client.PostJson("/clientapi/group/join", new { avatarId = victim.Id, invitationCode = community["invitationCode"]!.GetValue<string>() });
+
+			Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+			Assert.DoesNotContain((await Stored(community)).Members, m => m.AvatarId == victim.Id);
+		}
+
+		[Fact]
+		public async Task Members_leave_and_owners_cannot()
+		{
+			var owner = await NewPersona("host");
+			var community = await _host.Group(owner, community: true);
+			var member = await NewPersona("leaver");
+			var groupId = community["id"]!.GetValue<string>();
+			using (var joining = _host.As(member.Root.Jwt))
+				Assert.Equal(HttpStatusCode.OK, (await joining.PostJson("/clientapi/group/join", new { avatarId = member.Id, invitationCode = community["invitationCode"]!.GetValue<string>() })).StatusCode);
+			using var memberClient = _host.As(member.Root.Jwt);
+			using var ownerClient = _host.As(owner.Root.Jwt);
+
+			var left = await memberClient.PostJson("/clientapi/group/leave", new { avatarId = member.Id, groupId });
+			var ownerLeft = await ownerClient.PostJson("/clientapi/group/leave", new { avatarId = owner.Id, groupId });
+
+			Assert.True(left.IsSuccessStatusCode);
+			Assert.Empty(await Groups(member));
+			Assert.Equal(HttpStatusCode.BadRequest, ownerLeft.StatusCode);
+			Assert.Equal(new[] { owner.Id }, (await Stored(community)).Members.Select(m => m.AvatarId));
+		}
+
+		[Fact]
+		public async Task A_circle_takes_a_remote_member_only_once_the_owner_approves()
+		{
+			var owner = await NewPersona("approver");
+			var circle = await _host.Group(owner, community: false);
+			var member = new RemoteActor(_peer, "asker");
+			var since = DateTime.UtcNow.AddSeconds(-1);
+
+			await _host.Follow(member, _peer.A, circle["userName"]!.GetValue<string>());
+
+			var request = await DB.Default.Find<Follower>().Match(f => f.LocalActorId == circle["id"]!.GetValue<string>() && f.ActorURI == member.Id).ExecuteSingleAsync(TestContext.Current.CancellationToken);
+			Assert.False(request.IsAccepted);
+			Assert.DoesNotContain((await Stored(circle)).Members, m => m.AvatarId == member.Id);
+			Assert.Empty(await Jobs.Deliveries(member.Id + "/inbox", since, TestContext.Current.CancellationToken));
+
+			var outsider = await NewPersona("outsider");
+			Assert.Equal(HttpStatusCode.NotFound, (await Approve(outsider, circle, member.Id)).StatusCode);
+			Assert.Equal(HttpStatusCode.NotFound, (await Approve(owner, circle, $"{_peer.A}/users/nobody")).StatusCode);
+			Assert.True((await Approve(owner, circle, member.Id)).IsSuccessStatusCode);
+
+			Assert.Contains((await Stored(circle)).Members, m => m.IsForeign && m.AvatarId == member.Id);
+			Assert.True((await DB.Default.Find<Follower>().MatchID(request.ID).ExecuteFirstAsync(TestContext.Current.CancellationToken)).IsAccepted);
+			var accept = Assert.Single(await Jobs.Deliveries(member.Id + "/inbox", since, TestContext.Current.CancellationToken));
+			Assert.Equal("Accept", accept["type"]!.GetValue<string>());
+			Assert.Equal(circle["url"]!.GetValue<string>(), accept["actor"]!.GetValue<string>());
+		}
+
+		// its owner sees who is in the circle and who asks to join, declines one request and takes members out; nobody else
+		// sees them
+		[Fact]
+		public async Task An_owner_sees_the_members_and_requests_declines_one_and_removes_members()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (owner, circle, member) = await CircleWithRemoteMember();
+			var groupId = circle["id"]!.GetValue<string>();
+			var joiner = await NewPersona("joiner");
+			using (var joining = _host.As(joiner.Root.Jwt))
+				Assert.True((await joining.PostJson("/clientapi/group/join", new { avatarId = joiner.Id, invitationCode = circle["invitationCode"]!.GetValue<string>() })).IsSuccessStatusCode);
+			var asker = new RemoteActor(_peer, "asker");
+			await _host.Follow(asker, _peer.A, circle["userName"]!.GetValue<string>());
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			using var client = _host.As(owner.Root.Jwt);
+			async Task<List<JsonNode>> Members(HttpClient as_, string avatarId)
+			{
+				var response = await as_.GetAsync($"/clientapi/group/members?avatarId={avatarId}&groupId={groupId}", token);
+				return response.IsSuccessStatusCode ? (await response.JsonItems()).ToList() : null;
+			}
+
+			var listed = await Members(client, owner.Id);
+			using var joinerClient = _host.As(joiner.Root.Jwt);
+			var forJoiner = await Members(joinerClient, joiner.Id);
+			var declined = await client.PostJson("/clientapi/group/reject", new { avatarId = owner.Id, groupId, memberActorURI = asker.Id });
+			var removedRemote = await client.PostJson("/clientapi/group/remove", new { avatarId = owner.Id, groupId, memberActorURI = member.Id });
+			var removedLocal = await client.PostJson("/clientapi/group/remove", new { avatarId = owner.Id, groupId, memberActorURI = joiner.ActorUri() });
+			var removedOwner = await client.PostJson("/clientapi/group/remove", new { avatarId = owner.Id, groupId, memberActorURI = owner.ActorUri() });
+
+			Assert.Null(forJoiner);
+			Assert.Equal(4, listed.Count);
+			Assert.Contains(listed, m => m!["actorUri"]!.GetValue<string>() == owner.ActorUri() && m["role"]!.GetValue<string>() == "owner" && m["isLocal"]!.GetValue<bool>());
+			Assert.Contains(listed, m => m!["actorUri"]!.GetValue<string>() == joiner.ActorUri() && !m["isPending"]!.GetValue<bool>());
+			Assert.Contains(listed, m => m!["actorUri"]!.GetValue<string>() == member.Id && !m["isPending"]!.GetValue<bool>() && !m["isLocal"]!.GetValue<bool>());
+			Assert.Contains(listed, m => m!["actorUri"]!.GetValue<string>() == asker.Id && m["isPending"]!.GetValue<bool>());
+			Assert.True(declined.IsSuccessStatusCode);
+			Assert.True(removedRemote.IsSuccessStatusCode);
+			Assert.True(removedLocal.IsSuccessStatusCode);
+			Assert.Equal(HttpStatusCode.BadRequest, removedOwner.StatusCode);
+			Assert.Equal(new[] { owner.Id }, (await Stored(circle)).Members.Select(m => m.AvatarId));
+			Assert.False(await DB.Default.Find<Follower>().Match(f => f.LocalActorId == groupId && f.ActorURI != owner.ActorUri()).ExecuteAnyAsync(token));
+			Assert.Contains(await Jobs.Deliveries(asker.Id + "/inbox", since, token), d => d["type"]!.GetValue<string>() == "Reject");
+			Assert.Contains(await Jobs.Deliveries(member.Id + "/inbox", since, token), d => d["type"]!.GetValue<string>() == "Reject");
+		}
+
+		[Fact]
+		public async Task A_circle_is_never_found()
+		{
+			var owner = await NewPersona("hidden");
+			var circle = await _host.Group(owner, community: false, name: "circle");
+			var community = await _host.Group(owner, community: true, name: "community");
+			var circleName = circle["userName"]!.GetValue<string>();
+			var communityName = community["userName"]!.GetValue<string>();
+			using var anonymous = _host.Client();
+			using var searcher = _host.As(await _host.MastodonToken(await NewPersona("searcher")));
+
+			foreach (var acct in new[] { circleName, $"{circleName}@{PrivaPubHost.Host}", $"@{circleName}@{PrivaPubHost.Host}" })
+			{
+				Assert.Equal(HttpStatusCode.NotFound, (await anonymous.GetAsync("/api/v1/accounts/lookup?acct=" + Uri.EscapeDataString(acct), TestContext.Current.CancellationToken)).StatusCode);
+				Assert.Equal(HttpStatusCode.NotFound, (await searcher.GetAsync("/api/v1/accounts/lookup?acct=" + Uri.EscapeDataString(acct), TestContext.Current.CancellationToken)).StatusCode);
+			}
+			Assert.Equal(HttpStatusCode.OK, (await anonymous.GetAsync("/api/v1/accounts/lookup?acct=" + communityName, TestContext.Current.CancellationToken)).StatusCode);
+			Assert.Equal(HttpStatusCode.NotFound, (await searcher.GetAsync("/api/v1/accounts/" + circle["id"]!.GetValue<string>(), TestContext.Current.CancellationToken)).StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await searcher.GetAsync("/api/v1/accounts/" + community["id"]!.GetValue<string>(), TestContext.Current.CancellationToken)).StatusCode);
+
+			foreach (var q in new[] { circleName, $"@{circleName}@{PrivaPubHost.Host}", circle["url"]!.GetValue<string>() })
+			{
+				var found = await searcher.GetStringAsync($"/api/v2/search?resolve=true&q={Uri.EscapeDataString(q)}", TestContext.Current.CancellationToken);
+				Assert.Empty(JsonNode.Parse(found)!["accounts"]!.AsArray());
+				Assert.Empty(JsonNode.Parse(found)!["statuses"]!.AsArray());
+			}
+			var communityFound = await searcher.GetStringAsync($"/api/v2/search?resolve=true&q={Uri.EscapeDataString(community["url"]!.GetValue<string>())}", TestContext.Current.CancellationToken);
+			Assert.Single(JsonNode.Parse(communityFound)!["accounts"]!.AsArray());
+
+			Assert.Equal(HttpStatusCode.NotFound, (await anonymous.GetAsync($"/@{circleName}", TestContext.Current.CancellationToken)).StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await anonymous.GetAsync($"/@{communityName}", TestContext.Current.CancellationToken)).StatusCode);
+		}
+
+		[Fact]
+		public async Task A_circles_members_and_wardens_are_shown_only_to_members()
+		{
+			var (_, circle, member) = await CircleWithRemoteMember();
+			var outsider = new RemoteActor(_peer, "outsider");
+			var community = await _host.Group(await NewPersona("open"), community: true);
+			var circleName = circle["userName"]!.GetValue<string>();
+			var communityName = community["userName"]!.GetValue<string>();
+
+			foreach (var collection in new[] { "flock", "wardens" })
+			{
+				var path = $"/peasants/{circleName}/{collection}";
+				Assert.Equal(HttpStatusCode.NotFound, await Get(path));
+				Assert.Equal(HttpStatusCode.NotFound, await Get(path, outsider));
+				Assert.Equal(HttpStatusCode.OK, await Get(path, member));
+				Assert.Equal(HttpStatusCode.OK, await Get($"/peasants/{communityName}/{collection}"));
+			}
+		}
+	}
+}

PrivaPub.Tests/Http/ClientApiModerationTests.cs

@@ -0,0 +1,308 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Moderation;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	[Xunit.Collection(nameof(Exclusive))]
+	public sealed class ClientApiModerationTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		async Task<HttpStatusCode> Settings(string jwt)
+		{
+			using var client = _host.As(jwt);
+			return (await client.GetAsync("/clientapi/user/settings", TestContext.Current.CancellationToken)).StatusCode;
+		}
+
+		async Task<HttpStatusCode> Credentials(string token)
+		{
+			using var client = _host.As(token);
+			return (await client.GetAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken)).StatusCode;
+		}
+
+		async Task<HttpResponseMessage> LogIn(Root root)
+		{
+			using var client = _host.Client();
+			return await client.PostJson("/clientapi/user/login", new { userName = root.UserName, password = root.Password });
+		}
+
+		static Task<HttpResponseMessage> Remove(HttpClient client, params string[] ids) =>
+			client.SendAsync(new HttpRequestMessage(HttpMethod.Delete, "/clientapi/admin/remove/users") { Content = JsonContent.Create(new { userIdList = ids }) });
+
+		static Task<RootUser> Stored(string id) => DB.Default.Find<RootUser>().MatchID(id).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+
+		static JsonObject DirectNote(RemoteActor sender, string origin, Persona persona)
+		{
+			var noteId = $"{origin}/notes/{Guid.NewGuid():N}";
+			var to = new JsonArray($"{PrivaPubHost.Base}/peasants/{persona.UserName}");
+			return new JsonObject
+			{
+				["id"] = noteId + "/activity",
+				["type"] = "Create",
+				["actor"] = sender.Id,
+				["to"] = to.DeepClone(),
+				["object"] = new JsonObject { ["id"] = noteId, ["type"] = "Note", ["attributedTo"] = sender.Id, ["to"] = to.DeepClone(), ["content"] = "<p>hello</p>" }
+			};
+		}
+
+		[Fact]
+		public async Task An_admin_bans_and_unbans_a_root()
+		{
+			var admin = await _host.Admin();
+			var victim = await _host.Persona(await _host.SignUp("victim"), "victim");
+			var token = await _host.MastodonToken(victim);
+			using var client = _host.As(admin.Jwt);
+
+			var banned = await client.PostJson("/clientapi/admin/ban/users", new { userIdList = new[] { victim.Root.Id } });
+
+			Assert.Equal(HttpStatusCode.OK, banned.StatusCode);
+			Assert.True((await Stored(victim.Root.Id)).IsBanned);
+			Assert.Equal(HttpStatusCode.Unauthorized, await Settings(victim.Root.Jwt));
+			Assert.Equal(HttpStatusCode.Unauthorized, await Credentials(token));
+			var login = await LogIn(victim.Root);
+			Assert.Equal(HttpStatusCode.BadRequest, login.StatusCode);
+			Assert.Contains("banned", (await login.JsonBody())["errorMessage"]!.GetValue<string>());
+
+			var unbanned = await client.PostJson("/clientapi/admin/unban/users", new { userIdList = new[] { victim.Root.Id } });
+
+			Assert.Equal(HttpStatusCode.OK, unbanned.StatusCode);
+			Assert.Equal(HttpStatusCode.OK, await Settings(victim.Root.Jwt));
+			Assert.Equal(HttpStatusCode.OK, await Credentials(token));
+			Assert.Equal(HttpStatusCode.OK, (await LogIn(victim.Root)).StatusCode);
+		}
+
+		[Fact]
+		public async Task An_admin_cannot_ban_or_remove_itself()
+		{
+			var admin = await _host.Admin();
+			var victim = await _host.SignUp("victim");
+			using var client = _host.As(admin.Jwt);
+
+			Assert.Equal(HttpStatusCode.OK, (await client.PostJson("/clientapi/admin/ban/users", new { userIdList = new[] { admin.Id, victim.Id } })).StatusCode);
+			var removed = await Remove(client, admin.Id);
+
+			Assert.False((await Stored(admin.Id)).IsBanned);
+			Assert.True((await Stored(victim.Id)).IsBanned);
+			Assert.Equal(HttpStatusCode.BadRequest, removed.StatusCode);
+			Assert.Null((await Stored(admin.Id)).DeletedAt);
+			Assert.Equal(HttpStatusCode.OK, await Settings(admin.Jwt));
+		}
+
+		[Fact]
+		public async Task An_admin_removes_a_root()
+		{
+			var admin = await _host.Admin();
+			var victim = await _host.Persona(await _host.SignUp("removed"), "removed");
+			var token = await _host.MastodonToken(victim);
+			using var client = _host.As(admin.Jwt);
+
+			var removed = await Remove(client, victim.Root.Id);
+			var again = await Remove(client, victim.Root.Id);
+
+			Assert.Equal(HttpStatusCode.OK, removed.StatusCode);
+			var stored = await Stored(victim.Root.Id);
+			Assert.NotNull(stored.DeletedAt);
+			Assert.Null(stored.HashedPassword);
+			Assert.NotEqual(victim.Root.UserName, stored.UserName);
+			Assert.Equal(HttpStatusCode.BadRequest, again.StatusCode);
+			Assert.Equal(HttpStatusCode.Unauthorized, await Settings(victim.Root.Jwt));
+			Assert.Equal(HttpStatusCode.Unauthorized, await Credentials(token));
+			Assert.Equal(HttpStatusCode.BadRequest, (await LogIn(victim.Root)).StatusCode);
+		}
+
+		[Fact]
+		public async Task Only_admins_moderate()
+		{
+			var root = await _host.SignUp("plain");
+			var target = await _host.SignUp("target");
+			using var client = _host.As(root.Jwt);
+			using var anonymous = _host.Client();
+			var forbidden = new List<HttpResponseMessage>
+			{
+				await client.PostJson("/clientapi/admin/ban/users", new { userIdList = new[] { target.Id } }),
+				await client.PostJson("/clientapi/admin/unban/users", new { userIdList = new[] { target.Id } }),
+				await Remove(client, target.Id),
+				await client.GetAsync("/clientapi/admin/domainblocks/list", TestContext.Current.CancellationToken),
+				await client.PostJson("/clientapi/admin/domainblocks/insert", new { domain = "forbidden.example" }),
+				await client.PostAsync("/clientapi/admin/domainblocks/delete?domain=forbidden.example", default, TestContext.Current.CancellationToken),
+				await client.GetAsync("/clientapi/moderator/reports", TestContext.Current.CancellationToken),
+				await client.PostAsync($"/clientapi/moderator/reports/{target.Id}/resolve", default, TestContext.Current.CancellationToken)
+			};
+			var unauthorized = await anonymous.PostJson("/clientapi/admin/ban/users", new { userIdList = new[] { target.Id } });
+
+			foreach (var response in forbidden)
+			{
+				Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+				var body = await response.JsonBody();
+				Assert.Equal(403, body["statusCode"]!.GetValue<int>());
+				Assert.Equal("Forbidden.", body["errorMessage"]!.GetValue<string>());
+			}
+			Assert.Equal(HttpStatusCode.Unauthorized, unauthorized.StatusCode);
+			var stored = await Stored(target.Id);
+			Assert.False(stored.IsBanned);
+			Assert.Null(stored.DeletedAt);
+			Assert.False(await DB.Default.Find<DomainBlock>().Match(b => b.Domain == "forbidden.example").ExecuteAnyAsync(TestContext.Current.CancellationToken));
+		}
+
+		[Fact]
+		public async Task A_moderator_lists_and_resolves_reports()
+		{
+			var admin = await _host.Admin();
+			var reporter = await _host.Persona(await _host.SignUp("reporter"), "reporter");
+			var target = await _host.Persona(await _host.SignUp("reported"), "reported");
+			var comment = $"spam {Guid.NewGuid():N}";
+			using (var api = _host.As(await _host.MastodonToken(reporter)))
+				Assert.Equal(HttpStatusCode.OK, (await api.Form("/api/v1/reports", ("account_id", target.Id), ("comment", comment), ("category", "spam"))).StatusCode);
+			var reportId = (await DB.Default.Find<Models.Social.Report>().Match(r => r.Comment == comment).ExecuteSingleAsync(TestContext.Current.CancellationToken)).ID;
+			using var client = _host.As(admin.Jwt);
+
+			var open = await client.GetStringAsync("/clientapi/moderator/reports?resolved=false", TestContext.Current.CancellationToken);
+			var resolved = await client.PostAsync($"/clientapi/moderator/reports/{reportId}/resolve", default, TestContext.Current.CancellationToken);
+			var stillOpen = await client.GetStringAsync("/clientapi/moderator/reports?resolved=false", TestContext.Current.CancellationToken);
+			var closed = await client.GetStringAsync("/clientapi/moderator/reports?resolved=true", TestContext.Current.CancellationToken);
+			var unknown = await client.PostAsync($"/clientapi/moderator/reports/{MongoDB.Bson.ObjectId.GenerateNewId()}/resolve", default, TestContext.Current.CancellationToken);
+			var junk = await client.PostAsync("/clientapi/moderator/reports/x/resolve", default, TestContext.Current.CancellationToken);
+
+			var listed = JsonNode.Parse(open)!.AsArray().Single(r => r!["id"]!.GetValue<string>() == reportId)!;
+			Assert.Equal("local", listed["reporter"]!.GetValue<string>());
+			Assert.Equal(target.Id, listed["targetAccountId"]!.GetValue<string>());
+			Assert.Equal("spam", listed["category"]!.GetValue<string>());
+			Assert.DoesNotContain(reporter.Id, open);
+			Assert.DoesNotContain(reporter.UserName, open);
+			Assert.DoesNotContain(reporter.Root.Id, open);
+			Assert.Equal(HttpStatusCode.OK, resolved.StatusCode);
+			Assert.DoesNotContain(reportId, stillOpen);
+			Assert.Contains(reportId, closed);
+			var stored = await DB.Default.Find<Models.Social.Report>().MatchID(reportId).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+			Assert.Equal(admin.Id, stored.ResolvedBy);
+			Assert.NotNull(stored.ResolvedAt);
+			Assert.Equal(HttpStatusCode.NotFound, unknown.StatusCode);
+			Assert.Equal(HttpStatusCode.NotFound, junk.StatusCode);
+		}
+
+		[Fact]
+		public async Task Domain_blocks_are_inserted_listed_and_deleted()
+		{
+			var admin = await _host.Admin();
+			var domain = $"blocked-{Guid.NewGuid():N}.example";
+			using var client = _host.As(admin.Jwt);
+			try
+			{
+				var inserted = await client.PostJson("/clientapi/admin/domainblocks/insert", new { domain = $" {domain.ToUpperInvariant()}. ", suspend = false, rejectMedia = true, publicComment = "noisy" });
+				var listed = await (await client.GetAsync("/clientapi/admin/domainblocks/list", TestContext.Current.CancellationToken)).JsonItems();
+				var suspended = await client.PostJson("/clientapi/admin/domainblocks/insert", new { domain, suspend = true });
+				var deleted = await client.PostAsync($"/clientapi/admin/domainblocks/delete?domain={domain}", default, TestContext.Current.CancellationToken);
+				var after = await (await client.GetAsync("/clientapi/admin/domainblocks/list", TestContext.Current.CancellationToken)).JsonItems();
+
+				Assert.Equal(HttpStatusCode.OK, inserted.StatusCode);
+				var view = await inserted.JsonBody();
+				Assert.Equal(domain, view["domain"]!.GetValue<string>());
+				Assert.Equal("Silence", view["severity"]!.GetValue<string>());
+				Assert.True(view["rejectMedia"]!.GetValue<bool>());
+				Assert.Contains(listed, b => b!["domain"]!.GetValue<string>() == domain);
+				Assert.Equal(HttpStatusCode.OK, suspended.StatusCode);
+				Assert.Equal("Suspend", (await suspended.JsonBody())["severity"]!.GetValue<string>());
+				Assert.Equal(view["id"]!.GetValue<string>(), (await suspended.JsonBody())["id"]!.GetValue<string>());
+				Assert.Equal(HttpStatusCode.OK, deleted.StatusCode);
+				Assert.DoesNotContain(after, b => b!["domain"]!.GetValue<string>() == domain);
+				Assert.Null(_host.Get<IDomainBlocks>().Find(domain));
+			}
+			finally
+			{
+				await DB.Default.DeleteAsync<DomainBlock>(b => b.Domain == domain);
+				await _host.Get<IDomainBlocks>().Reload(CancellationToken.None);
+			}
+		}
+
+		[Theory]
+		[InlineData("")]
+		[InlineData("ab")]
+		[InlineData("not a domain")]
+		[InlineData("127.0.0.1")]
+		[InlineData("https://bad.example/")]
+		[InlineData("bad..example")]
+		public async Task A_bad_domain_is_refused(string domain)
+		{
+			var admin = await _host.Admin();
+			using var client = _host.As(admin.Jwt);
+
+			var response = await client.PostJson("/clientapi/admin/domainblocks/insert", new { domain });
+
+			Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+			var normalised = DomainBlocks.Normalise(domain);
+			Assert.False(await DB.Default.Find<DomainBlock>().Match(b => b.Domain == normalised).ExecuteAnyAsync(TestContext.Current.CancellationToken));
+		}
+
+		[Fact]
+		public async Task A_suspended_server_is_answered_202_and_nothing_is_kept()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var admin = await _host.Admin();
+			var persona = await _host.Persona(await _host.SignUp("suspend"), "suspend");
+			await using var peer = await Peer.Start();
+			var sender = new RemoteActor(peer, "suspended", origin: peer.B);
+			var blocked = DirectNote(sender, peer.B, persona);
+			var welcome = DirectNote(sender, peer.B, persona);
+			using var adminClient = _host.As(admin.Jwt);
+			using var client = _host.Client();
+			try
+			{
+				Assert.Equal(HttpStatusCode.OK, (await adminClient.PostJson("/clientapi/admin/domainblocks/insert", new { domain = "localhost", suspend = true })).StatusCode);
+				var answer = await client.SendAsync(sender.SignedPost($"/peasants/{persona.UserName}/mouth", blocked), token);
+
+				Assert.Equal(HttpStatusCode.Accepted, answer.StatusCode);
+				Assert.False(await DB.Default.Find<Job>().Match(j => j.DedupeKey == "inbox|" + blocked["id"]!.GetValue<string>()).ExecuteAnyAsync(token));
+				Assert.Equal(0, await _host.RunInbox(blocked["id"]!.GetValue<string>(), token));
+				Assert.False(await DB.Default.Find<Post>().Match(p => p.ObjectURI == blocked["object"]!["id"]!.GetValue<string>()).ExecuteAnyAsync(token));
+				Assert.Empty(peer.Requests);
+
+				Assert.Equal(HttpStatusCode.OK, (await adminClient.PostAsync("/clientapi/admin/domainblocks/delete?domain=localhost", default, token)).StatusCode);
+				Assert.Equal(HttpStatusCode.Accepted, (await client.SendAsync(sender.SignedPost($"/peasants/{persona.UserName}/mouth", welcome), token)).StatusCode);
+				Assert.Equal(1, await _host.RunInbox(welcome["id"]!.GetValue<string>(), token));
+				Assert.True(await DB.Default.Find<Post>().Match(p => p.ObjectURI == welcome["object"]!["id"]!.GetValue<string>()).ExecuteAnyAsync(token));
+			}
+			finally
+			{
+				await DB.Default.DeleteAsync<DomainBlock>(b => b.Domain == "localhost");
+				await _host.Get<IDomainBlocks>().Reload(CancellationToken.None);
+			}
+		}
+
+		[Fact]
+		public async Task The_data_endpoints_answer_anyone()
+		{
+			using var client = _host.Client();
+
+			var ping = await client.GetAsync("/clientapi/data/ping", TestContext.Current.CancellationToken);
+			var version = await client.GetAsync("/clientapi/data/current-version", TestContext.Current.CancellationToken);
+			var languages = await client.GetAsync("/clientapi/data/languages", TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.NoContent, ping.StatusCode);
+			Assert.Equal(HttpStatusCode.OK, version.StatusCode);
+			Assert.False(string.IsNullOrWhiteSpace(await version.Content.ReadAsStringAsync(TestContext.Current.CancellationToken)));
+			Assert.Equal(HttpStatusCode.OK, languages.StatusCode);
+			var codes = (await languages.JsonItems()).Select(l => l!["international2Code"]!.GetValue<string>()).Order().ToList();
+			Assert.Equal(new[] { "en", "it" }, codes);
+		}
+	}
+}

PrivaPub.Tests/Http/ClientApiPersonasTests.cs

@@ -0,0 +1,232 @@
+using MongoDB.Bson;
+using MongoDB.Entities;
+
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Globalization;
+using System.Net;
+using System.Text.Json.Nodes;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class ClientApiPersonasTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static string Name(string prefix) => $"{prefix}{Guid.NewGuid():N}"[..20];
+
+		async Task<HttpResponseMessage> Insert(Root root, object body)
+		{
+			using var client = _host.As(root.Jwt);
+			return await client.PostJson("/clientapi/avatar/private/insert", body);
+		}
+
+		async Task<List<string>> Listed(Root root)
+		{
+			using var client = _host.As(root.Jwt);
+			return (await (await client.GetAsync("/clientapi/avatar/private/list", TestContext.Current.CancellationToken)).JsonItems())
+				.Select(a => a!["id"]!.GetValue<string>()).ToList();
+		}
+
+		static DateTime IdDay(string id) => ObjectId.Parse(id).CreationTime;
+
+		static void WithinTwoWeeksBefore(DateTime created, DateTime published, string id)
+		{
+			Assert.Equal(published.Date, published);
+			Assert.InRange(published, created.Date.AddDays(-13), DateTime.UtcNow.Date);
+			Assert.Equal(published, IdDay(id));
+		}
+
+		[Fact]
+		public async Task A_root_id_in_the_body_is_ignored()
+		{
+			var root = await _host.SignUp("owner");
+			var other = await _host.SignUp("victim");
+			var userName = Name("planted");
+
+			var response = await Insert(root, new { userName, name = "planted", biography = "testing", rootId = other.Id });
+
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			var id = (await response.JsonBody())["id"]!.GetValue<string>();
+			var link = await DB.Default.Find<RootToAvatar>().Match(r => r.AvatarId == id).ExecuteSingleAsync(TestContext.Current.CancellationToken);
+			Assert.Equal(root.Id, link.RootId);
+			Assert.Contains(id, await Listed(root));
+			Assert.DoesNotContain(id, await Listed(other));
+			Assert.DoesNotContain(root.Id, await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+		}
+
+		[Theory]
+		[InlineData("Upper")]
+		[InlineData("has-dash")]
+		[InlineData("dot.ted")]
+		[InlineData("spa ce")]
+		[InlineData("ünïcode")]
+		[InlineData("at@sign")]
+		[InlineData("")]
+		public async Task Usernames_outside_the_regex_are_refused(string userName)
+		{
+			var root = await _host.SignUp("regex");
+
+			var response = await Insert(root, new { userName, name = "regex", biography = "testing" });
+
+			Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+			Assert.Contains((await response.JsonBody())["errors"]!.AsObject(), e => e.Key.Equals("userName", StringComparison.OrdinalIgnoreCase));
+			Assert.Empty(await Listed(root));
+			if (userName.Length > 0)
+				Assert.False(await DB.Default.Find<ReservedName>().Match(r => r.Name == userName || r.Name == userName.ToLowerInvariant()).ExecuteAnyAsync(TestContext.Current.CancellationToken));
+		}
+
+		[Theory]
+		[InlineData("admin")]
+		[InlineData("privapub")]
+		[InlineData("root")]
+		[InlineData("moderator")]
+		[InlineData("abuse")]
+		public async Task Reserved_names_are_refused(string userName)
+		{
+			var root = await _host.SignUp("reserved");
+
+			var response = await Insert(root, new { userName, name = userName, biography = "testing" });
+
+			Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+			Assert.Contains("already taken", (await response.JsonBody())["errorMessage"]!.GetValue<string>());
+			Assert.Empty(await Listed(root));
+		}
+
+		[Fact]
+		public async Task Personas_and_groups_share_one_name_space()
+		{
+			var root = await _host.SignUp("names");
+			var persona = await _host.Persona(root, "names");
+			var group = await _host.Group(persona, community: true);
+			var groupName = group["userName"]!.GetValue<string>();
+			using var client = _host.As(root.Jwt);
+
+			var personaOverGroup = await Insert(root, new { userName = groupName, name = "copy", biography = "testing" });
+			var groupOverPersona = await client.PostJson("/clientapi/group/insert", new { avatarId = persona.Id, userName = persona.UserName, name = "copy", isCommunity = true });
+			var personaOverPersona = await Insert(await _host.SignUp("names"), new { userName = persona.UserName, name = "copy", biography = "testing" });
+
+			Assert.Equal(HttpStatusCode.BadRequest, personaOverGroup.StatusCode);
+			Assert.Equal(HttpStatusCode.BadRequest, groupOverPersona.StatusCode);
+			Assert.Equal(HttpStatusCode.BadRequest, personaOverPersona.StatusCode);
+			var reserved = await DB.Default.Find<ReservedName>().Match(r => r.Name == groupName || r.Name == persona.UserName).ExecuteAsync(TestContext.Current.CancellationToken);
+			Assert.Equal(2, reserved.Count);
+			Assert.Contains(reserved, r => r.Name == persona.UserName && r.OwnerKind == LocalActorKind.Person && r.OwnerId == persona.Id);
+			Assert.Contains(reserved, r => r.Name == groupName && r.OwnerKind == LocalActorKind.Group && r.OwnerId == group["id"]!.GetValue<string>());
+			Assert.Equal(1, await DB.Default.CountAsync<Avatar>(a => a.UserName == persona.UserName, TestContext.Current.CancellationToken));
+			Assert.Equal(1, await DB.Default.CountAsync<GroupEntity>(g => g.UserName == groupName, TestContext.Current.CancellationToken));
+		}
+
+		[Fact]
+		public async Task An_update_is_delivered_to_followers()
+		{
+			await using var peer = await Peer.Start();
+			var persona = await _host.Persona(await _host.SignUp("update"), "update");
+			var follower = new RemoteActor(peer, "fan");
+			await _host.Follow(follower, peer.A, persona.UserName);
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			using var client = _host.As(persona.Root.Jwt);
+
+			var response = await client.PostJson("/clientapi/avatar/private/update", new { avatarId = persona.Id, name = "Renamed", biography = "new biography" });
+
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			var update = Assert.Single(await Jobs.Deliveries(follower.Id + "/inbox", since, TestContext.Current.CancellationToken), d => d["type"]!.GetValue<string>() == "Update");
+			Assert.Equal($"{PrivaPubHost.Base}/peasants/{persona.UserName}", update["actor"]!.GetValue<string>());
+			var person = update["object"]!.AsObject();
+			Assert.Equal("Person", person["type"]!.GetValue<string>());
+			Assert.Equal($"{PrivaPubHost.Base}/peasants/{persona.UserName}", person["id"]!.GetValue<string>());
+			Assert.Equal("Renamed", person["name"]!.GetValue<string>());
+			Assert.DoesNotContain(persona.Root.Id, update.ToJsonString());
+			Assert.DoesNotContain(persona.Root.UserName, update.ToJsonString());
+		}
+
+		[Fact]
+		public async Task A_theme_change_here_keeps_what_the_mastodon_api_set()
+		{
+			var persona = await _host.Persona(await _host.SignUp("keep"), "keep");
+			await DB.Default.Update<Avatar>().MatchID(persona.Id)
+				.Modify(a => a.Settings.IsDiscoverable, false)
+				.Modify(a => a.Settings.IsLocked, true)
+				.Modify(a => a.Settings.QuotePolicy, QuotePolicies.Nobody)
+				.ExecuteAsync(TestContext.Current.CancellationToken);
+			using var client = _host.As(persona.Root.Jwt);
+
+			var response = await client.PostJson("/clientapi/avatar/private/update", new
+			{
+				avatarId = persona.Id,
+				name = "Kept",
+				biography = "same settings",
+				settings = new { isDefault = false, darkThemeIndexColour = 100, themeIsDarkMode = true }
+			});
+
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			var settings = (await DB.Default.Find<Avatar>().MatchID(persona.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken)).Settings;
+			Assert.True(settings.ThemeIsDarkMode);
+			Assert.Equal(100, settings.DarkThemeIndexColour);
+			Assert.False(settings.IsDiscoverable);
+			Assert.True(settings.IsLocked);
+			Assert.Equal(QuotePolicies.Nobody, settings.QuotePolicy);
+		}
+
+		[Fact]
+		public async Task Updating_another_roots_persona_is_refused()
+		{
+			var persona = await _host.Persona(await _host.SignUp("mine"), "mine");
+			var intruder = await _host.SignUp("intruder");
+			using var client = _host.As(intruder.Jwt);
+
+			var response = await client.PostJson("/clientapi/avatar/private/update", new { avatarId = persona.Id, name = "Hijacked", biography = "testing" });
+
+			Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+			Assert.NotEqual("Hijacked", (await DB.Default.Find<Avatar>().MatchID(persona.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken)).Name);
+		}
+
+		[Fact]
+		public async Task Published_days_and_ids_fall_within_two_weeks_before_creation()
+		{
+			var created = DateTime.UtcNow;
+			var persona = await _host.Persona(await _host.SignUp("published"), "published");
+			var group = await _host.Group(persona, community: true);
+			using var client = _host.Client();
+			using var request = new HttpRequestMessage(HttpMethod.Get, $"/peasants/{persona.UserName}");
+			request.Headers.Accept.ParseAdd("application/activity+json");
+
+			var avatar = await DB.Default.Find<Avatar>().MatchID(persona.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+			var stored = await DB.Default.Find<GroupEntity>().MatchID(group["id"]!.GetValue<string>()).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+			var actor = JsonNode.Parse(await (await client.SendAsync(request, TestContext.Current.CancellationToken)).Content.ReadAsStringAsync(TestContext.Current.CancellationToken))!;
+
+			WithinTwoWeeksBefore(created, avatar.PublishedOn, avatar.ID);
+			WithinTwoWeeksBefore(created, stored.PublishedOn, stored.ID);
+			var published = DateTime.Parse(actor["published"]!.GetValue<string>(), CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal);
+			Assert.Equal(avatar.PublishedOn, published);
+			Assert.DoesNotContain(avatar.CreatedAt.ToString("yyyy-MM-ddTHH:mm:ss", CultureInfo.InvariantCulture), actor.ToJsonString());
+		}
+
+		[Fact]
+		public async Task The_list_holds_only_the_roots_own_personas()
+		{
+			var root = await _host.SignUp("list");
+			var other = await _host.SignUp("list");
+			var first = await _host.Persona(root, "first");
+			var second = await _host.Persona(root, "second");
+			var theirs = await _host.Persona(other, "theirs");
+
+			Assert.Equal(new[] { first.Id, second.Id }.Order(), (await Listed(root)).Order());
+			Assert.Equal(new[] { theirs.Id }, await Listed(other));
+		}
+	}
+}

PrivaPub.Tests/Http/FederationGetTests.cs

@@ -0,0 +1,579 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Security.Cryptography;
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.Host.FederationHelpers;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class FederationGetTests : IAsyncLifetime
+	{
+		const string Base = PrivaPubHost.Base;
+
+		PrivaPubHost _host;
+		HttpClient _client;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_client = _host.Client();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			_client?.Dispose();
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task The_actor_document_is_activity_json_with_an_spki_key_on_the_actor()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "actor");
+			var avatar = await DB.Default.Find<Avatar>().MatchID(persona.Id).ExecuteSingleAsync(TestContext.Current.CancellationToken);
+
+			var fetched = await _client.Fetch($"/peasants/{persona.UserName}");
+
+			Assert.Equal(HttpStatusCode.OK, fetched.Status);
+			Assert.Equal(ActivityJson, fetched.MediaType);
+			Assert.Contains("Accept", fetched.Response.Headers.Vary);
+			var actor = fetched.Json;
+			var id = persona.ActorUri();
+			Assert.Equal(id, actor["id"]!.GetValue<string>());
+			Assert.Equal("Person", actor["type"]!.GetValue<string>());
+			Assert.Equal(persona.UserName, actor["preferredUsername"]!.GetValue<string>());
+			Assert.Equal(id + "/mouth", actor["inbox"]!.GetValue<string>());
+			Assert.Equal(id + "/anus", actor["outbox"]!.GetValue<string>());
+			Assert.Equal(id + "/groupies", actor["followers"]!.GetValue<string>());
+			Assert.Equal(id + "/stalking", actor["following"]!.GetValue<string>());
+			Assert.Equal(id + "/trophies", actor["featured"]!.GetValue<string>());
+			Assert.Equal(id + "/tattoos", actor["featuredTags"]!.GetValue<string>());
+			Assert.Equal($"{Base}/@{persona.UserName}", actor["url"]!.GetValue<string>());
+			Assert.Equal(Base + "/human-centipede", actor["endpoints"]!["sharedInbox"]!.GetValue<string>());
+
+			var key = actor["publicKey"]!;
+			Assert.Equal(id + "#main-key", key["id"]!.GetValue<string>());
+			Assert.Equal(id, key["owner"]!.GetValue<string>());
+			var pem = key["publicKeyPem"]!.GetValue<string>();
+			Assert.StartsWith("-----BEGIN PUBLIC KEY-----", pem);
+			using var rsa = RSA.Create();
+			rsa.ImportFromPem(pem);
+			Assert.True(rsa.KeySize >= 2048);
+
+			Assert.Equal(ActivityPubRenderer.Day(avatar.PublishedOn), actor["published"]!.GetValue<string>());
+			Assert.EndsWith("T00:00:00Z", actor["published"]!.GetValue<string>());
+			Assert.DoesNotContain(Keys(actor), k => k.Contains("created", StringComparison.OrdinalIgnoreCase));
+			Assert.DoesNotContain(ActivityPubRenderer.Timestamp(avatar.CreatedAt)[..16], fetched.Text);
+			Assert.DoesNotContain(persona.Root.Id, fetched.Text);
+			Assert.DoesNotContain(persona.Root.UserName, fetched.Text);
+		}
+
+		[Fact]
+		public async Task The_actor_answers_ld_json_and_sends_browsers_to_the_profile_page()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "browser");
+
+			var ld = await _client.Fetch($"/peasants/{persona.UserName}", LdJson);
+			var browser = await _client.Fetch($"/peasants/{persona.UserName}", Browser);
+			var instance = await _client.Fetch("/peasants/privapub", Browser);
+
+			Assert.Equal(HttpStatusCode.OK, ld.Status);
+			Assert.Equal(persona.ActorUri(), ld.Json["id"]!.GetValue<string>());
+			Assert.Equal(HttpStatusCode.Redirect, browser.Status);
+			Assert.Equal($"{Base}/@{persona.UserName}", browser.Location);
+			Assert.Contains("Accept", browser.Response.Headers.Vary);
+			Assert.Equal(HttpStatusCode.OK, instance.Status);
+			Assert.Equal("Application", instance.Json["type"]!.GetValue<string>());
+		}
+
+		// PieFed reads the inbox it sends a community's announces to from the Application at a peer's root
+		[Fact]
+		public async Task The_instance_actor_answers_at_the_root_for_activitypub_only()
+		{
+			var root = await _client.Fetch("/");
+			var browser = await _client.Fetch("/", Browser);
+
+			Assert.Equal(HttpStatusCode.OK, root.Status);
+			Assert.Equal("Application", root.Json["type"]!.GetValue<string>());
+			Assert.Equal($"{Base}/peasants/privapub", root.Json["id"]!.GetValue<string>());
+			Assert.Equal($"{Base}/peasants/privapub/mouth", root.Json["inbox"]!.GetValue<string>());
+			Assert.Equal(HttpStatusCode.NotFound, browser.Status);
+		}
+
+		// Lemmy takes a report only from a Person, a Service or an Organization, whose document names its preferredUsername,
+		// inbox, outbox and key; a browser gets the document too, as from the instance actor: the reporter has no page
+		[Fact]
+		public async Task The_reporter_is_a_service_with_an_inbox_an_outbox_and_its_own_key()
+		{
+			var fetched = await _client.Fetch("/peasants/privapub_reports");
+			var browser = await _client.Fetch("/peasants/privapub_reports", Browser);
+			var outbox = await _client.Fetch("/peasants/privapub_reports/anus");
+			var instance = await _client.Fetch("/peasants/privapub");
+
+			Assert.Equal(HttpStatusCode.OK, fetched.Status);
+			var actor = fetched.Json;
+			var id = $"{Base}/peasants/privapub_reports";
+			Assert.Equal(id, actor["id"]!.GetValue<string>());
+			Assert.Equal("Service", actor["type"]!.GetValue<string>());
+			Assert.Equal("privapub_reports", actor["preferredUsername"]!.GetValue<string>());
+			Assert.Equal(id + "/mouth", actor["inbox"]!.GetValue<string>());
+			Assert.Equal(id + "/anus", actor["outbox"]!.GetValue<string>());
+			Assert.Equal(id, actor["url"]!.GetValue<string>());
+			Assert.Equal(id + "#main-key", actor["publicKey"]!["id"]!.GetValue<string>());
+			Assert.Equal(id, actor["publicKey"]!["owner"]!.GetValue<string>());
+			Assert.NotEqual(instance.Json["publicKey"]!["publicKeyPem"]!.GetValue<string>(), actor["publicKey"]!["publicKeyPem"]!.GetValue<string>());
+			Assert.False(actor["discoverable"]!.GetValue<bool>());
+			Assert.Null(actor["wall"]);
+			Assert.Null(actor["implements"]);
+			Assert.Equal(HttpStatusCode.OK, browser.Status);
+			Assert.Equal("Service", browser.Json["type"]!.GetValue<string>());
+			Assert.Equal(HttpStatusCode.OK, outbox.Status);
+			Assert.Equal(0, outbox.Json["totalItems"]!.GetValue<int>());
+		}
+
+		[Fact]
+		public async Task Users_moves_permanently_to_peasants_and_unknown_actors_are_404()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "users");
+
+			var moved = await _client.Fetch($"/users/{persona.UserName}");
+			var unknown = await _client.Fetch($"/peasants/nobody{Guid.NewGuid():N}"[..28]);
+
+			Assert.Equal(HttpStatusCode.MovedPermanently, moved.Status);
+			Assert.Equal($"/peasants/{persona.UserName}", moved.Location);
+			Assert.Equal(HttpStatusCode.NotFound, unknown.Status);
+		}
+
+		[Fact]
+		public async Task The_outbox_pages_public_posts_and_boosts_and_nothing_else()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "outbox");
+			var friend = await _host.Persona(await _host.SignUp(), "friend");
+			var boosted = await _host.Publish(friend, "worth a boost");
+			var shown = new List<Post>();
+			for (var i = 0; i < 20; i++)
+				shown.Add(await _host.Publish(persona, $"public number {i}"));
+			shown.Add(await _host.Publish(persona, "quietly public", PostVisibility.Unlisted));
+			var hidden = new List<Post>
+			{
+				await _host.Publish(persona, "for followers", PostVisibility.FollowersOnly),
+				await _host.Publish(persona, $"@{friend.UserName} just you", PostVisibility.Direct),
+				await _host.PublishLocated(persona, "only around here"),
+				await _host.FederatedCopy(persona)
+			};
+			var deleted = await _host.Publish(persona, "regretted");
+			await _host.Remove(persona, deleted);
+			hidden.Add(deleted);
+			var reblog = await _host.Reblog(persona, boosted);
+			Assert.Equal(PostVisibility.LocalGeo, hidden[2].Visibility);
+
+			var outbox = await _client.Fetch($"/peasants/{persona.UserName}/anus");
+			Assert.Equal(HttpStatusCode.OK, outbox.Status);
+			Assert.Equal(ActivityJson, outbox.MediaType);
+			Assert.Equal("OrderedCollection", outbox.Json["type"]!.GetValue<string>());
+			Assert.Equal(persona.ActorUri() + "/anus", outbox.Json["id"]!.GetValue<string>());
+			// statuses_count, as Mastodon counts it: everything but the DM, the deleted post and the copy of a remote post,
+			// the followers-only and located posts and the boost included; only the public posts are listed
+			Assert.Equal(24, outbox.Json["totalItems"]!.GetValue<int>());
+			Assert.Null(outbox.Json["orderedItems"]);
+			var first = outbox.Json["first"]!.GetValue<string>();
+			Assert.Equal(persona.ActorUri() + "/anus?page=true", first);
+
+			var page1 = await _client.Fetch(PathOf(first));
+			Assert.Equal(HttpStatusCode.OK, page1.Status);
+			Assert.Equal("OrderedCollectionPage", page1.Json["type"]!.GetValue<string>());
+			Assert.Equal(persona.ActorUri() + "/anus", page1.Json["partOf"]!.GetValue<string>());
+			var items1 = page1.Json["orderedItems"]!.AsArray().Select(i => i!.AsObject()).ToList();
+			Assert.Equal(20, items1.Count);
+			var next = page1.Json["next"]!.GetValue<string>();
+			Assert.StartsWith(persona.ActorUri() + "/anus?page=true&max_id=", next);
+
+			var page2 = await _client.Fetch(PathOf(next));
+			Assert.Equal(HttpStatusCode.OK, page2.Status);
+			Assert.Equal(next, page2.Json["id"]!.GetValue<string>());
+			var items2 = page2.Json["orderedItems"]!.AsArray().Select(i => i!.AsObject()).ToList();
+			Assert.Equal(2, items2.Count);
+			Assert.Null(page2.Json["next"]);
+
+			var items = items1.Concat(items2).ToList();
+			Assert.Equal(22, items.Select(i => i["id"]!.GetValue<string>()).Distinct().Count());
+			var announce = items[0];
+			Assert.Equal("Announce", announce["type"]!.GetValue<string>());
+			Assert.Equal(reblog.ObjectURI, announce["id"]!.GetValue<string>());
+			Assert.Equal($"{persona.ActorUri()}/grunts/announce-{reblog.ID}", announce["id"]!.GetValue<string>());
+			Assert.Equal(boosted.ObjectURI, announce["object"]!.GetValue<string>());
+			Assert.Equal(persona.ActorUri(), announce["actor"]!.GetValue<string>());
+
+			var creates = items.Skip(1).ToList();
+			Assert.All(creates, c =>
+			{
+				Assert.Equal("Create", c["type"]!.GetValue<string>());
+				Assert.Equal(persona.ActorUri(), c["actor"]!.GetValue<string>());
+				Assert.Equal(persona.ActorUri(), c["object"]!["attributedTo"]!.GetValue<string>());
+			});
+			Assert.Equal(shown.Select(p => p.ObjectURI).Reverse(), creates.Select(c => c["object"]!["id"]!.GetValue<string>()));
+			var everything = page1.Text + page2.Text;
+			foreach (var post in hidden)
+				Assert.DoesNotContain(post.ID, everything);
+
+			var junk = await _client.Fetch($"/peasants/{persona.UserName}/anus?page=true&max_id=not-an-id");
+			Assert.True((int)junk.Status < 500, $"a junk max_id answered {(int)junk.Status}");
+		}
+
+		[Fact]
+		public async Task Followers_and_following_give_no_names_away()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var persona = await _host.Persona(await _host.SignUp(), "groupies");
+			var friend = await _host.Persona(await _host.SignUp(), "stalked");
+			var accepted = $"https://remote.example/users/fan{Guid.NewGuid():N}";
+			var pending = $"https://remote.example/users/hopeful{Guid.NewGuid():N}";
+			await DB.Default.SaveAsync(new[]
+			{
+				new Follower { LocalActorId = persona.Id, LocalActorKind = LocalActorKind.Person, ActorURI = accepted, InboxURL = accepted + "/inbox" },
+				new Follower { LocalActorId = persona.Id, LocalActorKind = LocalActorKind.Person, ActorURI = pending, InboxURL = pending + "/inbox", IsAccepted = false }
+			}, token);
+			await DB.Default.SaveAsync(new Following
+			{
+				AvatarId = persona.Id,
+				TargetAccountId = friend.Id,
+				TargetActorURI = friend.ActorUri(),
+				TargetIsLocal = true,
+				State = FollowState.Accepted
+			}, token);
+
+			var followers = await _client.Fetch($"/peasants/{persona.UserName}/groupies");
+			var following = await _client.Fetch($"/peasants/{persona.UserName}/stalking");
+
+			Assert.Equal(HttpStatusCode.OK, followers.Status);
+			Assert.Equal("OrderedCollection", followers.Json["type"]!.GetValue<string>());
+			Assert.Equal(persona.ActorUri() + "/groupies", followers.Json["id"]!.GetValue<string>());
+			Assert.Equal(1, followers.Json["totalItems"]!.GetValue<int>());
+			Assert.DoesNotContain(accepted, followers.Text);
+			Assert.DoesNotContain(pending, followers.Text);
+			Assert.Equal(HttpStatusCode.OK, following.Status);
+			Assert.Equal(persona.ActorUri() + "/stalking", following.Json["id"]!.GetValue<string>());
+			Assert.Equal(1, following.Json["totalItems"]!.GetValue<int>());//counted, as following_count says, never listed
+			Assert.DoesNotContain(friend.UserName, following.Text);
+		}
+
+		[Fact]
+		public async Task Trophies_are_the_public_pins_newest_first_and_tattoos_is_empty()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var persona = await _host.Persona(await _host.SignUp(), "trophies");
+			var older = await _host.Publish(persona, "pinned first");
+			var newer = await _host.Publish(persona, "pinned second");
+			var followersOnly = await _host.Publish(persona, "pinned but private", PostVisibility.FollowersOnly);
+			var removed = await _host.Publish(persona, "pinned then deleted");
+			foreach (var post in new[] { older, followersOnly, removed, newer })
+				await DB.Default.SaveAsync(new Pin { AvatarId = persona.Id, PostId = post.ID }, token);
+			await _host.Remove(persona, removed);
+
+			var featured = await _client.Fetch($"/peasants/{persona.UserName}/trophies");
+			var tags = await _client.Fetch($"/peasants/{persona.UserName}/tattoos");
+
+			Assert.Equal(HttpStatusCode.OK, featured.Status);
+			Assert.Equal(persona.ActorUri() + "/trophies", featured.Json["id"]!.GetValue<string>());
+			Assert.Equal(2, featured.Json["totalItems"]!.GetValue<int>());
+			var notes = featured.Json["orderedItems"]!.AsArray();
+			Assert.Equal(new[] { newer.ObjectURI, older.ObjectURI }, notes.Select(n => n!["id"]!.GetValue<string>()));
+			Assert.All(notes, n => Assert.Equal("Note", n!["type"]!.GetValue<string>()));
+			Assert.DoesNotContain(followersOnly.ID, featured.Text);
+			Assert.DoesNotContain(removed.ID, featured.Text);
+
+			Assert.Equal(HttpStatusCode.OK, tags.Status);
+			Assert.Equal(persona.ActorUri() + "/tattoos", tags.Json["id"]!.GetValue<string>());
+			Assert.Equal(0, tags.Json["totalItems"]!.GetValue<int>());
+			Assert.Empty(tags.Json["orderedItems"]!.AsArray());
+		}
+
+		[Fact]
+		public async Task A_scribble_is_served_while_public_and_a_tombstone_once_deleted()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "scribble");
+			var other = await _host.Persona(await _host.SignUp(), "other");
+			var shown = await _host.Publish(persona, "hello fediverse");
+			var unlisted = await _host.Publish(persona, "hello quietly", PostVisibility.Unlisted);
+			var followersOnly = await _host.Publish(persona, "hello followers", PostVisibility.FollowersOnly);
+			var direct = await _host.Publish(persona, $"@{other.UserName} hello you", PostVisibility.Direct);
+			var located = await _host.PublishLocated(persona, "hello neighbours");
+			var deleted = await _host.Publish(persona, "goodbye");
+			await _host.Remove(persona, deleted);
+			string Path(Post post) => $"/peasants/{persona.UserName}/scribbles/{post.ID}";
+
+			var note = await _client.Fetch(Path(shown));
+			Assert.Equal(HttpStatusCode.OK, note.Status);
+			Assert.Equal(ActivityJson, note.MediaType);
+			Assert.Equal(shown.ObjectURI, note.Json["id"]!.GetValue<string>());
+			Assert.Equal("Note", note.Json["type"]!.GetValue<string>());
+			Assert.Equal(persona.ActorUri(), note.Json["attributedTo"]!.GetValue<string>());
+			Assert.NotNull(note.Json["@context"]);
+			Assert.Contains(ActivityPubRenderer.Public, Strings(note.Json["to"]));
+			Assert.Equal(HttpStatusCode.OK, (await _client.Fetch(Path(unlisted))).Status);
+
+			var browser = await _client.Fetch(Path(shown), Browser);
+			Assert.Equal(HttpStatusCode.Redirect, browser.Status);
+			Assert.Equal($"{Base}/@{persona.UserName}/{shown.ID}", browser.Location);
+
+			foreach (var post in new[] { followersOnly, direct, located })
+				Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(Path(post))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch($"/peasants/{other.UserName}/scribbles/{shown.ID}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch($"/peasants/{persona.UserName}/scribbles/{Guid.NewGuid():N}"[..48])).Status);
+
+			var tombstone = await _client.Fetch(Path(deleted));
+			Assert.Equal(HttpStatusCode.Gone, tombstone.Status);
+			Assert.Equal(ActivityJson, tombstone.MediaType);
+			Assert.Equal("Tombstone", tombstone.Json["type"]!.GetValue<string>());
+			Assert.Equal(deleted.ObjectURI, tombstone.Json["id"]!.GetValue<string>());
+			Assert.Equal("Note", tombstone.Json["formerType"]!.GetValue<string>());
+			Assert.NotNull(tombstone.Json["deleted"]);
+			Assert.DoesNotContain("goodbye", tombstone.Text);
+		}
+
+		[Fact]
+		public async Task A_circle_post_is_served_only_to_a_member_or_its_instance_actor()
+		{
+			var owner = await _host.Persona(await _host.SignUp(), "circleowner");
+			var circle = await _host.FederatedGroup(owner, community: false);
+			var member = new RemoteActor(_peer, "member");
+			var memberServer = new RemoteActor(_peer, "instance", type: "Application");
+			var neighbour = new RemoteActor(_peer, "neighbour");
+			var stranger = new RemoteActor(_peer, "stranger", _peer.B);
+			var strangerServer = new RemoteActor(_peer, "instance", _peer.B, "Application");
+			await circle.AddForeignMember(member.Id);
+			var post = await _host.Publish(owner, new StatusDraft { Text = "just us", PlainText = true, GroupId = circle.Id });
+			Assert.Equal(PostVisibility.Circle, post.Visibility);
+			var path = $"/peasants/{owner.UserName}/scribbles/{post.ID}";
+
+			var asMember = await _client.Fetch(member.SignedGet(path));
+			var asMemberServer = await _client.Fetch(memberServer.SignedGet(path));
+
+			Assert.Equal(HttpStatusCode.OK, asMember.Status);
+			Assert.Equal(post.ObjectURI, asMember.Json["id"]!.GetValue<string>());
+			Assert.Equal(new[] { circle.Uri, circle.Uri + "/flock" }, Strings(asMember.Json["to"]));
+			Assert.DoesNotContain(ActivityPubRenderer.Public, asMember.Text);
+			Assert.Equal(HttpStatusCode.OK, asMemberServer.Status);
+			// a refetch names the member, as the member's copy did; the instance actor sees the members on its server only
+			Assert.Equal(new[] { member.Id }, Strings(asMember.Json["cc"]));
+			Assert.Equal(new[] { member.Id }, Strings(asMemberServer.Json["cc"]));
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(path)).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(path, Browser)).Status);
+			foreach (var outsider in new[] { neighbour, stranger, strangerServer })
+				Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(outsider.SignedGet(path))).Status);
+			var create = $"/peasants/{owner.UserName}/grunts/create-{post.ID}";
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(create)).Status);
+			var createAsMember = await _client.Fetch(member.SignedGet(create));
+			Assert.Equal(HttpStatusCode.OK, createAsMember.Status);
+			Assert.Equal(post.ObjectURI, createAsMember.Json["object"]!["id"]!.GetValue<string>());
+			Assert.Equal(new[] { member.Id }, Strings(createAsMember.Json["object"]!["cc"]));
+		}
+
+		[Fact]
+		public async Task Followers_only_and_direct_posts_are_served_to_signed_fetches_from_those_they_were_for()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var owner = await _host.Persona(await _host.SignUp(), "private");
+			var follower = new RemoteActor(_peer, "follower");
+			var followerServer = new RemoteActor(_peer, "instance", type: "Application");
+			var recipient = new RemoteActor(_peer, "recipient");
+			var stranger = new RemoteActor(_peer, "stranger", _peer.B);
+			_peer.WebFinger(recipient);
+			await DB.Default.SaveAsync(new Follower
+			{
+				LocalActorId = owner.Id,
+				LocalActorKind = LocalActorKind.Person,
+				ActorURI = follower.Id,
+				InboxURL = follower.Id + "/inbox"
+			}, token);
+			var quiet = await _host.Publish(owner, "for followers", PostVisibility.FollowersOnly);
+			var direct = await _host.Publish(owner, new StatusDraft { Text = $"@{recipient.Handle()} just you", PlainText = true, Visibility = PostVisibility.Direct });
+			var quietPath = $"/peasants/{owner.UserName}/scribbles/{quiet.ID}";
+			var directPath = $"/peasants/{owner.UserName}/scribbles/{direct.ID}";
+
+			Assert.Equal(HttpStatusCode.OK, (await _client.Fetch(follower.SignedGet(quietPath))).Status);
+			Assert.Equal(HttpStatusCode.OK, (await _client.Fetch(followerServer.SignedGet(quietPath))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(stranger.SignedGet(quietPath))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(quietPath)).Status);
+			var asRecipient = await _client.Fetch(recipient.SignedGet(directPath));
+			Assert.Equal(HttpStatusCode.OK, asRecipient.Status);
+			Assert.Contains(recipient.Id, Strings(asRecipient.Json["to"]));
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(follower.SignedGet(directPath))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(directPath)).Status);
+
+			// the DM's context is the conversation, for its participants only
+			var context = PathOf(asRecipient.Json["context"]!.GetValue<string>());
+			var conversation = await _client.Fetch(recipient.SignedGet(context));
+			Assert.Equal(HttpStatusCode.OK, conversation.Status);
+			Assert.Equal(new[] { direct.ObjectURI }, Strings(conversation.Json["orderedItems"]));
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(stranger.SignedGet(context))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(context)).Status);
+
+			// once deleted, those it was for learn it is gone; everyone else still learns nothing
+			await _host.Remove(owner, quiet);
+			Assert.Equal(HttpStatusCode.Gone, (await _client.Fetch(follower.SignedGet(quietPath))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(stranger.SignedGet(quietPath))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(quietPath)).Status);
+		}
+
+		[Fact]
+		public async Task A_circles_followers_members_and_wardens_are_shown_only_to_its_members()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var owner = await _host.Persona(await _host.SignUp(), "circlelists");
+			var circle = await _host.FederatedGroup(owner, community: false);
+			var community = await _host.FederatedGroup(owner, community: true);
+			var member = new RemoteActor(_peer, "member");
+			var stranger = new RemoteActor(_peer, "stranger", _peer.B);
+			await circle.AddForeignMember(member.Id);
+			foreach (var group in new[] { circle, community })
+				await DB.Default.SaveAsync(new Follower
+				{
+					LocalActorId = group.Id,
+					LocalActorKind = LocalActorKind.Group,
+					ActorURI = member.Id,
+					InboxURL = member.Id + "/inbox"
+				}, token);
+
+			foreach (var collection in new[] { "groupies", "flock", "wardens" })
+			{
+				var path = $"/peasants/{circle.UserName}/{collection}";
+				Assert.True((await _client.Fetch(path)).Status == HttpStatusCode.NotFound, $"the circle's {collection} answered an unsigned GET");
+				Assert.True((await _client.Fetch(stranger.SignedGet(path))).Status == HttpStatusCode.NotFound, $"the circle's {collection} answered a stranger");
+				var asMember = await _client.Fetch(member.SignedGet(path));
+				Assert.True(asMember.Status == HttpStatusCode.OK, $"the circle's {collection} refused a member");
+				Assert.Equal(circle.Uri + "/" + collection, asMember.Json["id"]!.GetValue<string>());
+				var open = await _client.Fetch($"/peasants/{community.UserName}/{collection}");
+				Assert.True(open.Status == HttpStatusCode.OK, $"the community's {collection} answered {(int)open.Status}");
+			}
+			Assert.Equal(1, (await _client.Fetch(member.SignedGet($"/peasants/{circle.UserName}/groupies"))).Json["totalItems"]!.GetValue<int>());
+			Assert.Equal(2, (await _client.Fetch(member.SignedGet($"/peasants/{circle.UserName}/flock"))).Json["totalItems"]!.GetValue<int>());
+			var wardens = await _client.Fetch($"/peasants/{community.UserName}/wardens");
+			Assert.Equal(new[] { owner.ActorUri() }, Strings(wardens.Json["orderedItems"]));
+			Assert.Equal(community.Uri + "/wardens", (await _client.Fetch($"/peasants/{community.UserName}")).Json["attributedTo"]!.GetValue<string>());
+			Assert.Null((await _client.Fetch($"/peasants/{circle.UserName}")).Json["attributedTo"]);
+		}
+
+		[Fact]
+		public async Task Grunts_resolve_creates_and_boosts()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "grunts");
+			var friend = await _host.Persona(await _host.SignUp(), "boosted");
+			var post = await _host.Publish(persona, "a grunt");
+			var followersOnly = await _host.Publish(persona, "a private grunt", PostVisibility.FollowersOnly);
+			var original = await _host.Publish(friend, "boost me");
+			var reblog = await _host.Reblog(persona, original);
+			string Path(string id) => $"/peasants/{persona.UserName}/grunts/{id}";
+
+			var create = await _client.Fetch(Path($"create-{post.ID}"));
+			var announce = await _client.Fetch(Path($"announce-{reblog.ID}"));
+
+			Assert.Equal(HttpStatusCode.OK, create.Status);
+			Assert.Equal(ActivityJson, create.MediaType);
+			Assert.Equal("Create", create.Json["type"]!.GetValue<string>());
+			Assert.Equal(Base + Path($"create-{post.ID}"), create.Json["id"]!.GetValue<string>());
+			Assert.Equal(post.ObjectURI, create.Json["object"]!["id"]!.GetValue<string>());
+			Assert.Equal(post.ActivityURI, create.Json["id"]!.GetValue<string>());
+			Assert.Equal(HttpStatusCode.OK, announce.Status);
+			Assert.Equal("Announce", announce.Json["type"]!.GetValue<string>());
+			Assert.Equal(reblog.ObjectURI, announce.Json["id"]!.GetValue<string>());
+			Assert.Equal(original.ObjectURI, announce.Json["object"]!.GetValue<string>());
+
+			foreach (var unknown in new[] { $"create-{followersOnly.ID}", $"create-{Guid.NewGuid():N}"[..31], $"announce-{post.ID}", $"like-{post.ID}", "x" })
+				Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(Path(unknown))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch(Path($"announce-{original.ID}"))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _client.Fetch($"/peasants/{friend.UserName}/grunts/announce-{reblog.ID}")).Status);
+		}
+
+		[Fact]
+		public async Task A_parrot_licence_is_served_by_its_author_until_revoked()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var quoted = await _host.Persona(await _host.SignUp(), "quoted");
+			var quoter = await _host.Persona(await _host.SignUp(), "quoter");
+			var original = await _host.Publish(quoted, "quote me");
+			var quoting = await _host.Publish(quoter, new StatusDraft { Text = "well said", PlainText = true, QuotedStatusId = original.ID });
+			Assert.Equal(QuoteState.Accepted, quoting.QuoteState);
+			var licenceUri = quoting.QuoteAuthorizationURI;
+			Assert.StartsWith(quoted.ActorUri() + "/parrot-licences/", licenceUri);
+			var licenceId = licenceUri.Split('/')[^1];
+
+			var licence = await _client.Fetch(PathOf(licenceUri));
+			var wrongAuthor = await _client.Fetch($"/peasants/{quoter.UserName}/parrot-licences/{licenceId}");
+			var unknown = await _client.Fetch($"/peasants/{quoted.UserName}/parrot-licences/{Guid.NewGuid():N}"[..48]);
+
+			Assert.Equal(HttpStatusCode.OK, licence.Status);
+			Assert.Equal(ActivityJson, licence.MediaType);
+			Assert.Equal("QuoteAuthorization", licence.Json["type"]!.GetValue<string>());
+			Assert.Equal(licenceUri, licence.Json["id"]!.GetValue<string>());
+			Assert.Equal(quoted.ActorUri(), licence.Json["attributedTo"]!.GetValue<string>());
+			Assert.Equal(quoting.ObjectURI, licence.Json["interactingObject"]!.GetValue<string>());
+			Assert.Equal(original.ObjectURI, licence.Json["interactionTarget"]!.GetValue<string>());
+			Assert.Equal(HttpStatusCode.NotFound, wrongAuthor.Status);
+			Assert.Equal(HttpStatusCode.NotFound, unknown.Status);
+
+			Assert.True(await _host.Get<IQuoteService>().RevokeLicence(original, quoting, token));
+			var revoked = await _client.Fetch(PathOf(licenceUri));
+
+			Assert.Equal(HttpStatusCode.Gone, revoked.Status);
+			Assert.Equal(ActivityJson, revoked.MediaType);
+			Assert.Equal("Tombstone", revoked.Json["type"]!.GetValue<string>());
+			Assert.Equal("QuoteAuthorization", revoked.Json["formerType"]!.GetValue<string>());
+			Assert.Equal(licenceUri, revoked.Json["id"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task Secure_mode_refuses_unsigned_gets_except_for_the_servers_own_actors()
+		{
+			var secure = await SecureModeHost.Shared();
+			using var client = secure.Client();
+			var persona = await _host.Persona(await _host.SignUp(), "secure");
+			var post = await _host.Publish(persona, "only for the signed");
+			var reader = new RemoteActor(_peer, "reader");
+			var paths = new[]
+			{
+				$"/peasants/{persona.UserName}",
+				$"/peasants/{persona.UserName}/anus",
+				$"/peasants/{persona.UserName}/anus?page=true",
+				$"/peasants/{persona.UserName}/groupies",
+				$"/peasants/{persona.UserName}/stalking",
+				$"/peasants/{persona.UserName}/trophies",
+				$"/peasants/{persona.UserName}/tattoos",
+				$"/peasants/{persona.UserName}/scribbles/{post.ID}",
+				$"/peasants/{persona.UserName}/grunts/create-{post.ID}",
+				$"/peasants/nobody{Guid.NewGuid():N}"[..28]
+			};
+
+			foreach (var path in paths)
+				Assert.True((await client.Fetch(path)).Status == HttpStatusCode.Unauthorized, $"{path} answered an unsigned GET");
+			var instance = await client.Fetch("/peasants/privapub");
+			Assert.Equal(HttpStatusCode.OK, instance.Status);
+			Assert.Equal("Application", instance.Json["type"]!.GetValue<string>());
+			var reporter = await client.Fetch("/peasants/privapub_reports");
+			Assert.Equal(HttpStatusCode.OK, reporter.Status);
+			Assert.Equal("Service", reporter.Json["type"]!.GetValue<string>());
+			Assert.Equal(HttpStatusCode.OK, (await client.Fetch("/")).Status);
+			foreach (var path in paths[..^1])
+				Assert.True((await client.Fetch(reader.SignedGet(path))).Status == HttpStatusCode.OK, $"{path} refused a signed GET");
+			// a browser is not asked for a signature: it is only sent to the public pages
+			var browser = await client.Fetch($"/peasants/{persona.UserName}", Browser);
+			Assert.Equal(HttpStatusCode.Redirect, browser.Status);
+			Assert.Equal(HttpStatusCode.Redirect, (await client.Fetch($"/peasants/{persona.UserName}/scribbles/{post.ID}", Browser)).Status);
+		}
+	}
+}

PrivaPub.Tests/Http/HostBootTests.cs

@@ -0,0 +1,146 @@
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Microsoft.AspNetCore.Mvc.Infrastructure;
+using Microsoft.AspNetCore.Mvc.RazorPages;
+using Microsoft.Extensions.DependencyInjection;
+
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Inbox;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class HostBootTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		[Fact]
+		public async Task The_host_shares_the_fixture_database()
+		{
+			Assert.True(await DB.Default.Find<AppConfiguration>().ExecuteAnyAsync(TestContext.Current.CancellationToken));
+			using var client = _host.Client();
+			Assert.Equal(HttpStatusCode.OK, (await client.GetAsync("/build.json", TestContext.Current.CancellationToken)).StatusCode);
+		}
+
+		[Fact]
+		public async Task The_harness_handles_the_same_activities_as_the_server()
+		{
+			await using var harness = await Harness.Start();
+			var registered = _host.Services.GetServices<IActivityHandler>().Select(h => h.GetType()).OrderBy(t => t.Name);
+			var harnessed = harness.Handlers.Select(h => h.GetType()).OrderBy(t => t.Name);
+
+			Assert.Equal(registered, harnessed);
+		}
+
+		[Fact]
+		public void Every_job_kind_has_exactly_one_handler()
+		{
+			var handlers = _host.Services.GetServices<IJobHandler>().GroupBy(h => h.Kind).ToDictionary(g => g.Key, g => g.Count());
+
+			foreach (var kind in Enum.GetValues<JobKind>())
+				Assert.True(handlers.GetValueOrDefault(kind) == 1, $"{kind} has {handlers.GetValueOrDefault(kind)} handlers");
+		}
+
+		[Fact]
+		public void Every_controller_and_page_model_can_be_made()
+		{
+			using var scope = _host.Services.CreateScope();
+			var controllers = _host.Get<IActionDescriptorCollectionProvider>().ActionDescriptors.Items
+				.OfType<ControllerActionDescriptor>()
+				.Select(d => d.ControllerTypeInfo.AsType())
+				.Distinct()
+				.ToList();
+			var pages = typeof(Program).Assembly.GetTypes().Where(t => t.IsSubclassOf(typeof(PageModel)) && !t.IsAbstract).ToList();
+
+			Assert.NotEmpty(controllers);
+			Assert.NotEmpty(pages);
+			foreach (var type in controllers.Concat(pages))
+				Assert.NotNull(ActivatorUtilities.CreateInstance(scope.ServiceProvider, type));
+		}
+
+		[Fact]
+		public void The_service_graph_is_valid()
+		{
+			var services = new ServiceCollection();
+			foreach (var descriptor in _host.Registered)
+				((ICollection<ServiceDescriptor>)services).Add(descriptor);
+
+			using var provider = services.BuildServiceProvider(new ServiceProviderOptions { ValidateOnBuild = true, ValidateScopes = true });
+		}
+
+		[Fact]
+		public async Task Swagger_is_not_served_outside_development()
+		{
+			using var client = _host.Client();
+
+			Assert.Equal(HttpStatusCode.NotFound, (await client.GetAsync("/swagger/index.html", TestContext.Current.CancellationToken)).StatusCode);
+		}
+
+		[Fact]
+		public async Task A_persona_gets_a_mastodon_token_through_the_real_code_flow()
+		{
+			var root = await _host.SignUp();
+			var persona = await _host.Persona(root, "boot");
+
+			var token = await _host.MastodonToken(persona);
+
+			using var client = _host.As(token);
+			var account = await client.GetStringAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken);
+			Assert.Contains($"\"id\":\"{persona.Id}\"", account);
+			Assert.DoesNotContain(root.Id, account);
+			Assert.DoesNotContain(root.UserName, account);
+		}
+	
+		[Fact]
+		public async Task A_signed_delivery_through_the_real_route_is_queued_and_stored()
+		{
+			var token = TestContext.Current.CancellationToken;
+			await using var peer = await Peer.Start();
+			var persona = await _host.Persona(await _host.SignUp(), "mouth");
+			var bob = new RemoteActor(peer, "bob");
+			var noteId = $"{peer.A}/notes/{Guid.NewGuid():N}";
+			var activity = new JsonObject
+			{
+				["id"] = noteId + "/activity",
+				["type"] = "Create",
+				["actor"] = bob.Id,
+				["to"] = new JsonArray($"{PrivaPubHost.Base}/peasants/{persona.UserName}"),
+				["object"] = new JsonObject
+				{
+					["id"] = noteId,
+					["type"] = "Note",
+					["attributedTo"] = bob.Id,
+					["to"] = new JsonArray($"{PrivaPubHost.Base}/peasants/{persona.UserName}"),
+					["content"] = "<p>hello through the front door</p>",
+					["published"] = DateTime.UtcNow.ToString("O")
+				}
+			};
+			using var client = _host.Client();
+
+			var response = await client.SendAsync(bob.SignedPost($"/peasants/{persona.UserName}/mouth", activity), token);
+
+			Assert.Equal(HttpStatusCode.Accepted, response.StatusCode);
+			Assert.Equal(1, await _host.RunInbox(noteId + "/activity", token));
+			var stored = await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteFirstAsync(token);
+			Assert.Equal(PostVisibility.Direct, stored.Visibility);
+			Assert.Contains("front door", stored.ContentHtml);
+		}
+	}
+}

PrivaPub.Tests/Http/InboxRouteTests.cs

@@ -0,0 +1,205 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Jobs;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Globalization;
+using System.Net;
+using System.Text;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class InboxRouteTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		HttpClient _client;
+		Peer _peer;
+		Persona _persona;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_client = _host.Client();
+			_peer = await Peer.Start();
+			_persona = await _host.Persona(await _host.SignUp(), "inbox");
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			_client?.Dispose();
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		public static TheoryData<string> Inboxes() => new() { "personal", "personal-shared", "shared" };
+
+		string Route(string inbox) => inbox switch
+		{
+			"personal" => $"/peasants/{_persona.UserName}/mouth",
+			"personal-shared" => $"/peasants/{_persona.UserName}/human-centipede",
+			_ => "/human-centipede"
+		};
+
+		JsonObject Direct(RemoteActor sender)
+		{
+			var noteId = $"{new Uri(sender.Id).GetLeftPart(UriPartial.Authority)}/notes/{Guid.NewGuid():N}";
+			var to = new JsonArray($"{PrivaPubHost.Base}/peasants/{_persona.UserName}");
+			return new JsonObject
+			{
+				["id"] = noteId + "/activity",
+				["type"] = "Create",
+				["actor"] = sender.Id,
+				["to"] = to.DeepClone(),
+				["object"] = new JsonObject
+				{
+					["id"] = noteId,
+					["type"] = "Note",
+					["attributedTo"] = sender.Id,
+					["to"] = to.DeepClone(),
+					["content"] = "<p>knock knock</p>",
+					["published"] = DateTime.UtcNow.ToString("O")
+				}
+			};
+		}
+
+		static string Id(JsonObject activity) => activity["id"]!.GetValue<string>();
+
+		async Task<bool> Queued(JsonObject activity) =>
+			await DB.Default.Find<Job>().Match(j => j.DedupeKey == "inbox|" + Id(activity)).ExecuteAnyAsync(TestContext.Current.CancellationToken);
+
+		async Task<HttpResponseMessage> Send(HttpRequestMessage request) => await _client.SendAsync(request, TestContext.Current.CancellationToken);
+
+		[Theory]
+		[MemberData(nameof(Inboxes))]
+		public async Task A_signed_delivery_is_accepted_and_queued(string inbox)
+		{
+			var sender = new RemoteActor(_peer, "sender");
+			var activity = Direct(sender);
+
+			var response = await Send(sender.SignedPost(Route(inbox), activity));
+
+			Assert.Equal(HttpStatusCode.Accepted, response.StatusCode);
+			Assert.Equal(1, await _host.RunInbox(Id(activity), TestContext.Current.CancellationToken));
+		}
+
+		[Theory]
+		[MemberData(nameof(Inboxes))]
+		public async Task Junk_is_400_and_an_unsigned_activity_401(string inbox)
+		{
+			var sender = new RemoteActor(_peer, "unsigned");
+			foreach (var junk in new[] { "not json", "[1,2,3]", "\"Create\"", "{}", "{\"type\":\"Create\"}" })
+			{
+				using var request = new HttpRequestMessage(HttpMethod.Post, Route(inbox)) { Content = new StringContent(junk, Encoding.UTF8, "application/activity+json") };
+				Assert.Equal(HttpStatusCode.BadRequest, (await Send(request)).StatusCode);
+			}
+			var activity = Direct(sender);
+			using var unsigned = new HttpRequestMessage(HttpMethod.Post, Route(inbox))
+			{
+				Content = new StringContent(activity.ToJsonString(), Encoding.UTF8, "application/activity+json")
+			};
+
+			Assert.Equal(HttpStatusCode.Unauthorized, (await Send(unsigned)).StatusCode);
+			Assert.False(await Queued(activity));
+		}
+
+		[Fact]
+		public async Task An_unknown_persona_has_no_mouth()
+		{
+			var sender = new RemoteActor(_peer, "lost");
+			var activity = Direct(sender);
+
+			var response = await Send(sender.SignedPost($"/peasants/nobody{Guid.NewGuid():N}"[..28] + "/mouth", activity));
+
+			Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+			Assert.False(await Queued(activity));
+		}
+
+		[Theory]
+		[MemberData(nameof(Inboxes))]
+		public async Task A_tampered_stale_or_misdirected_signature_is_401(string inbox)
+		{
+			var sender = new RemoteActor(_peer, "forger");
+			var path = Route(inbox);
+
+			var tampered = Direct(sender);
+			var badDigest = sender.SignedPost(path, tampered);
+			badDigest.Headers.Remove("Digest");
+			badDigest.Headers.TryAddWithoutValidation("Digest", "SHA-256=" + Convert.ToBase64String(new byte[32]));
+			var stale = Direct(sender);
+			var twoHoursAgo = DateTimeOffset.UtcNow.AddHours(-2).ToString("r", CultureInfo.InvariantCulture);
+			var elsewhere = Direct(sender);
+			var otherBody = Direct(sender);
+			var swapped = sender.SignedPost(path, Direct(sender));
+			swapped.Content = new StringContent(otherBody.ToJsonString(), Encoding.UTF8, "application/activity+json");
+
+			Assert.Equal(HttpStatusCode.Unauthorized, (await Send(badDigest)).StatusCode);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await Send(sender.SignedPost(path, stale, date: twoHoursAgo))).StatusCode);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await Send(sender.SignedPost(path, elsewhere, host: "elsewhere.example"))).StatusCode);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await Send(swapped)).StatusCode);
+			foreach (var activity in new[] { tampered, stale, elsewhere, otherBody })
+				Assert.False(await Queued(activity));
+		}
+
+		[Fact]
+		public async Task Ld_json_with_the_activitystreams_profile_is_accepted()
+		{
+			var sender = new RemoteActor(_peer, "ldjson");
+			var activity = Direct(sender);
+			var request = sender.SignedPost($"/peasants/{_persona.UserName}/mouth", activity);
+			request.Content!.Headers.Remove("Content-Type");
+			request.Content.Headers.TryAddWithoutValidation("Content-Type", "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"");
+
+			var response = await Send(request);
+
+			Assert.Equal(HttpStatusCode.Accepted, response.StatusCode);
+			Assert.True(await Queued(activity));
+		}
+
+		[Fact]
+		public async Task An_unreachable_signing_key_asks_the_sender_to_retry()
+		{
+			var sender = new RemoteActor(_peer, "flaky");
+			_peer.Answer(new Uri(sender.Id).AbsolutePath, 503);
+			var activity = Direct(sender);
+
+			var response = await Send(sender.SignedPost($"/peasants/{_persona.UserName}/mouth", activity));
+
+			Assert.Equal(HttpStatusCode.ServiceUnavailable, response.StatusCode);
+			Assert.True(response.Headers.RetryAfter?.Delta is { TotalSeconds: > 0 }, "no Retry-After");
+			Assert.False(await Queued(activity));
+		}
+
+		[Fact]
+		public async Task Unsigned_posts_from_one_address_are_limited()
+		{
+			var token = TestContext.Current.CancellationToken;
+			using var client = _host.Client();
+			client.DefaultRequestHeaders.Remove(PrivaPubHost.ClientHeader);
+			client.DefaultRequestHeaders.Add(PrivaPubHost.ClientHeader, $"fd7e:{Random.Shared.Next(0x10000):x}:{Random.Shared.Next(0x10000):x}::1");
+			var body = Direct(new RemoteActor(_peer, "flood")).ToJsonString();
+			async Task<HttpStatusCode> Post()
+			{
+				using var content = new StringContent(body, Encoding.UTF8, "application/activity+json");
+				using var response = await client.PostAsync("/human-centipede", content, token);
+				return response.StatusCode;
+			}
+
+			// The bucket holds 300 and refills 50 every ten seconds on its own timer, so a refill can land at any moment:
+			// the first refusal comes after at least 300 posts and within a few refills.
+			var answers = new List<HttpStatusCode>();
+			while (answers.Count < 600 && (answers.Count == 0 || answers[^1] != HttpStatusCode.TooManyRequests))
+				answers.Add(await Post());
+
+			Assert.Equal(HttpStatusCode.TooManyRequests, answers[^1]);
+			Assert.True(answers.Count > 300, $"limited after only {answers.Count - 1} posts");
+			Assert.All(answers.SkipLast(1), status => Assert.Equal(HttpStatusCode.Unauthorized, status));
+			var polite = new RemoteActor(_peer, "polite");
+			using var signed = await client.SendAsync(polite.SignedPost("/human-centipede", Direct(polite)), token);
+			Assert.Equal(HttpStatusCode.Accepted, signed.StatusCode);
+		}
+	}
+}

PrivaPub.Tests/Http/InstanceLocationTests.cs

@@ -0,0 +1,291 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Jobs;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	// Where a server is, on the public instance API: where it was located (city, coordinates and network, whatever its size),
+	// only the CDN's name for a CDN-fronted one, the batch form, and this server itself.
+	[Trait("Category", "Integration")]
+	public sealed class InstanceLocationTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		static async Task<string> Instance(int users, InstanceGeo geo, string name = "located")
+		{
+			var host = $"{name}{Guid.NewGuid():N}.example";
+			await DB.Default.SaveAsync(new RemoteInstance { Host = host, Software = "mastodon", UsersTotal = users, Geo = geo }, Token);
+			return host;
+		}
+
+		static InstanceGeo Milan(string cdn = default) => new()
+		{
+			Country = "IT",
+			City = "Milan",
+			Latitude = 45.5,
+			Longitude = 9.2,
+			Asn = 12345,
+			AsnOrg = "Example Hosting",
+			Cdn = cdn,
+			Ipv6 = true,
+			Source = "DB-IP Lite 2026-10",
+			LocatedAt = DateTime.UtcNow.AddDays(-2)
+		};
+
+		async Task<JsonNode> Geo(string host) => (await _host.Client().Get($"/api/privapub/v1/instances/{host}")).Ok().Body["geo"];
+
+		[Fact]
+		public async Task A_located_server_shows_its_city_coordinates_and_network()
+		{
+			var geo = await Geo(await Instance(50, Milan()));
+
+			Assert.Equal("city", geo.Text("precision"));
+			Assert.Equal(("IT", "Milan", "Example Hosting"), (geo.Text("country"), geo.Text("city"), geo.Text("network")));
+			Assert.Equal(45.5, geo["latitude"]!.GetValue<double>());
+			Assert.Equal(9.2, geo["longitude"]!.GetValue<double>());
+			Assert.Equal("DB-IP Lite 2026-10", geo.Text("source"));
+			Assert.NotNull(geo.Text("located_at"));
+			Assert.Null(geo["asn"]);
+			Assert.Null(geo["ipv6"]);
+		}
+
+		[Fact]
+		public async Task A_one_user_server_shows_its_city_too()
+		{
+			var geo = await Geo(await Instance(1, Milan()));
+
+			Assert.Equal("city", geo.Text("precision"));
+			Assert.Equal(("IT", "Milan", "Example Hosting"), (geo.Text("country"), geo.Text("city"), geo.Text("network")));
+			Assert.Equal(45.5, geo["latitude"]!.GetValue<double>());
+		}
+
+		[Fact]
+		public async Task A_server_located_only_to_its_country_shows_the_country()
+		{
+			var geo = await Geo(await Instance(50, new InstanceGeo { Country = "IT", Source = "DB-IP Lite 2026-10", LocatedAt = DateTime.UtcNow }));
+
+			Assert.Equal("country", geo.Text("precision"));
+			Assert.Equal("IT", geo.Text("country"));
+			Assert.Null(geo["city"]);
+			Assert.Null(geo["latitude"]);
+		}
+
+		[Fact]
+		public async Task A_cdn_fronted_server_shows_only_its_cdn()
+		{
+			var geo = await Geo(await Instance(5000, Milan(cdn: "Cloudflare")));
+
+			Assert.Equal("cdn", geo.Text("precision"));
+			Assert.Equal("Cloudflare", geo.Text("cdn"));
+			Assert.Null(geo["country"]);
+			Assert.Null(geo["latitude"]);
+			Assert.Null(geo["network"]);
+		}
+
+		[Fact]
+		public async Task An_unlocated_server_has_no_place()
+		{
+			Assert.Null(await Geo(await Instance(50, default)));
+		}
+
+		[Fact]
+		public async Task The_provenance_of_a_post_carries_the_same_projection()
+		{
+			var host = await Instance(3, Milan());
+			var described = (await _host.Client().Get($"/api/privapub/v1/instances/{host}")).Ok().Body;
+
+			Assert.Equal("city", described["geo"].Text("precision"));
+			Assert.Equal(described["geo"]!.ToJsonString(), (await Geo(host))!.ToJsonString());
+		}
+
+		[Fact]
+		public async Task Several_servers_answer_at_once_in_the_order_asked_without_the_unknown_ones()
+		{
+			var big = await Instance(50, Milan(), "big");
+			var small = await Instance(3, Milan(), "small");
+			var unknown = $"unknown{Guid.NewGuid():N}.example";
+
+			var answer = (await _host.Client().Get($"/api/privapub/v1/instances?host[]={small}&host[]={unknown}&host[]={big.ToUpperInvariant()}&host[]={small}")).Ok();
+			var hosts = answer.Body!.AsArray().Select(i => i.Text("host")).ToList();
+
+			Assert.Equal(new[] { small, big }, hosts);
+			Assert.Equal("city", answer.Body![0]["geo"].Text("precision"));
+			Assert.Equal("city", answer.Body![1]["geo"].Text("precision"));
+			Assert.Empty((await _host.Client().Get("/api/privapub/v1/instances")).Ok().Body!.AsArray());
+		}
+
+		[Fact]
+		public async Task At_most_forty_servers_answer_at_once()
+		{
+			var hosts = new List<string>();
+			for (var i = 0; i < 42; i++)
+				hosts.Add(await Instance(1, default, "many"));
+
+			var answer = (await _host.Client().Get("/api/privapub/v1/instances?" + string.Join("&", hosts.Select(h => "host[]=" + h)))).Ok();
+
+			Assert.Equal(hosts.Take(40), answer.Body!.AsArray().Select(i => i.Text("host")));
+		}
+
+		[Fact]
+		public async Task This_server_describes_itself()
+		{
+			var self = (await _host.Client().Get($"/api/privapub/v1/instances/{PrivaPubHost.Host}")).Ok().Body;
+
+			Assert.Equal(PrivaPubHost.Host, self.Text("host"));
+			Assert.Equal("privapub", self.Text("software"));
+			Assert.Equal("activitypub", Assert.Single(self["protocols"]!.AsArray())!.GetValue<string>());
+			Assert.Null(self["geo"]);
+			var batch = (await _host.Client().Get($"/api/privapub/v1/instances?host[]={PrivaPubHost.Host}")).Ok().Body!.AsArray();
+			Assert.Equal("privapub", Assert.Single(batch).Text("software"));
+		}
+
+		[Fact]
+		public async Task The_owner_may_place_this_server()
+		{
+			var placed = await SelfPlacedHost.Shared();
+
+			var geo = (await placed.Client().Get($"/api/privapub/v1/instances/{PrivaPubHost.Host}")).Ok().Body["geo"];
+
+			Assert.Equal("city", geo.Text("precision"));
+			Assert.Equal(("IT", "Milan", "configured"), (geo.Text("country"), geo.Text("city"), geo.Text("source")));
+			Assert.Equal(45.5, geo["latitude"]!.GetValue<double>());
+			Assert.Equal(9.2, geo["longitude"]!.GetValue<double>());
+		}
+
+		static string WeeksAgo(int weeks) => PrivaPub.Federation.Objects.InstanceDescriber.Week(DateTime.UtcNow.AddDays(-7 * weeks));
+
+		static Task Snapshot(string host, int weeksAgo, string cdn = default, string cdnDomain = default, string city = default, double? latitude = default,
+			double? longitude = default, string country = default) =>
+			DB.Default.SaveAsync(new RemoteInstanceSnapshot
+			{
+				Host = host, Week = WeeksAgo(weeksAgo), TakenAt = DateTime.UtcNow.AddDays(-7 * weeksAgo), Reachable = true, Software = "mastodon", UsersTotal = 3,
+				Cdn = cdn, CdnDomain = cdnDomain, CdnSource = cdn == default ? default : "ranges", Country = country, City = city, Latitude = latitude, Longitude = longitude
+			}, Token);
+
+		[Fact]
+		public async Task A_cdn_fronted_server_names_its_cdn_and_where_it_was_before_it()
+		{
+			var host = await Instance(3, new InstanceGeo
+			{
+				Country = "US", City = "San Francisco", Latitude = 37.8, Longitude = -122.4, Cdn = "Cloudflare", CdnDomain = "cloudflare.com", CdnSource = "ranges",
+				Source = "DB-IP Lite 2026-10", LocatedAt = DateTime.UtcNow
+			}, "fronted");
+			await Snapshot(host, 3, city: "Berlin", latitude: 52.5, longitude: 13.4, country: "DE");
+			await Snapshot(host, 2, city: "Hamburg", latitude: 53.6, longitude: 10.0, country: "DE");
+			await Snapshot(host, 1, cdn: "Cloudflare", cdnDomain: "cloudflare.com", city: "San Francisco", latitude: 37.8, longitude: -122.4, country: "US");
+
+			var geo = await Geo(host);
+
+			Assert.Equal(("cdn", "Cloudflare", "cloudflare.com", "ranges"), (geo.Text("precision"), geo.Text("cdn"), geo.Text("cdn_domain"), geo.Text("cdn_source")));
+			Assert.Null(geo["latitude"]);
+			Assert.Equal((WeeksAgo(2), "Hamburg", "DE"), (geo["before_cdn"].Text("week"), geo["before_cdn"].Text("city"), geo["before_cdn"].Text("country")));
+			Assert.Equal(53.6, geo["before_cdn"]!["latitude"]!.GetValue<double>());
+		}
+
+		[Fact]
+		public async Task A_server_history_is_weekly_newest_first_and_a_cdn_hides_its_place()
+		{
+			var host = await Instance(3, Milan(), "historic");
+			await Snapshot(host, 2, city: "Milan", latitude: 45.5, longitude: 9.2, country: "IT");
+			await Snapshot(host, 1, cdn: "Fastly", cdnDomain: "fastly.com", city: "Frankfurt", latitude: 50.1, longitude: 8.7, country: "DE");
+
+			var weeks = (await _host.Client().Get($"/api/privapub/v1/instances/{host}/history")).Ok().Body!.AsArray();
+
+			Assert.Equal(new[] { WeeksAgo(1), WeeksAgo(2) }, weeks.Select(w => w.Text("week")));
+			Assert.Equal(("cdn", "fastly.com"), (weeks[0]!["geo"].Text("precision"), weeks[0]!["geo"].Text("cdn_domain")));
+			Assert.Null(weeks[0]!["geo"]!["city"]);
+			Assert.Equal(("city", "Milan"), (weeks[1]!["geo"].Text("precision"), weeks[1]!["geo"].Text("city")));
+			Assert.Equal(3, weeks[1]!["users_total"]!.GetValue<long>());
+			Assert.Single((await _host.Client().Get($"/api/privapub/v1/instances/{host}/history?weeks=1")).Ok().Body!.AsArray());
+			Assert.Equal(HttpStatusCode.NotFound, (await _host.Client().Get($"/api/privapub/v1/instances/unknown{Guid.NewGuid():N}.example/history")).Status);
+		}
+
+		[Fact]
+		public async Task Servers_are_grouped_by_their_cdn_week_by_week()
+		{
+			var cdn = $"Edge{Guid.NewGuid():N}"[..20];
+			var key = cdn.ToLowerInvariant();
+			var stayed = await Instance(3, new InstanceGeo { Country = "FR", Cdn = cdn, CdnSource = "headers" }, "stayed");
+			var moved = await Instance(3, Milan(), "moved");
+			await Snapshot(moved, 3, cdn: cdn);
+			await Snapshot(moved, 2, cdn: cdn);
+			await Snapshot(stayed, 2, cdn: cdn);
+			await Snapshot(moved, 1, city: "Milan", latitude: 45.5, longitude: 9.2, country: "IT");
+			await Snapshot(stayed, 1, cdn: cdn);
+
+			var list = (await _host.Client().Get("/api/privapub/v1/cdns")).Ok().Body!.AsArray();
+			var group = list.Single(g => g.Text("key") == key);
+			Assert.Equal((cdn, 1), (group.Text("name"), group["servers"]!.GetValue<int>()));
+			var cloudflare = list.Single(g => g.Text("key") == "cloudflare.com");
+			Assert.Equal(new[] { "ranges", "headers", "asn" }, cloudflare["detected_by"]!.AsArray().Select(v => v!.GetValue<string>()));
+
+			var detail = (await _host.Client().Get($"/api/privapub/v1/cdns/{key}")).Ok().Body;
+			Assert.Equal(new[] { stayed }, detail["hosts"]!.AsArray().Select(h => h!.GetValue<string>()));
+			var weeks = detail["weeks"]!.AsArray();
+			Assert.Equal(new[] { WeeksAgo(1), WeeksAgo(2), WeeksAgo(3) }, weeks.Select(w => w.Text("week")));
+			Assert.Equal(new[] { 1, 2, 1 }, weeks.Select(w => w!["servers"]!.GetValue<int>()));
+			Assert.Equal(new[] { moved }, weeks[0]!["left"]!.AsArray().Select(h => h!.GetValue<string>()));
+			Assert.Equal(new[] { stayed }, weeks[1]!["joined"]!.AsArray().Select(h => h!.GetValue<string>()));
+			Assert.Equal(new[] { moved }, weeks[2]!["joined"]!.AsArray().Select(h => h!.GetValue<string>()));
+
+			Assert.Equal("Cloudflare", (await _host.Client().Get("/api/privapub/v1/cdns/cloudflare.com")).Ok().Body.Text("name"));
+			Assert.Equal(HttpStatusCode.NotFound, (await _host.Client().Get($"/api/privapub/v1/cdns/none{Guid.NewGuid():N}")).Status);
+		}
+
+		[Fact]
+		public async Task Junk_hosts_are_not_an_error()
+		{
+			Assert.Equal(HttpStatusCode.NotFound, (await _host.Client().Get($"/api/privapub/v1/instances/{new string('a', 300)}")).Status);
+			Assert.Empty((await _host.Client().Get($"/api/privapub/v1/instances?host[]=&host[]={new string('a', 300)}")).Ok().Body!.AsArray());
+		}
+	}
+
+	public sealed class SelfPlacedHost : PrivaPubHost
+	{
+		static readonly SemaphoreSlim Boot = new(1, 1);
+		static SelfPlacedHost _shared;
+
+		public static new async Task<SelfPlacedHost> Shared()
+		{
+			await PrivaPubHost.Shared();
+			await Boot.WaitAsync();
+			try
+			{
+				if (_shared == default)
+				{
+					var host = new SelfPlacedHost();
+					_ = host.Services;
+					_shared = host;
+				}
+				return _shared;
+			}
+			finally
+			{
+				Boot.Release();
+			}
+		}
+
+		protected override IEnumerable<KeyValuePair<string, string>> Settings() => base.Settings().Concat(new Dictionary<string, string>
+		{
+			["Statistics:Geo:Self:Latitude"] = "45.4642",
+			["Statistics:Geo:Self:Longitude"] = "9.19",
+			["Statistics:Geo:Self:City"] = "Milan",
+			["Statistics:Geo:Self:Country"] = "IT"
+		});
+	}
+}

PrivaPub.Tests/Http/MastodonAccountsTests.cs

@@ -0,0 +1,672 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class MastodonAccountsTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		async Task<(RemoteActor Actor, string Id)> Remote(string name = "bob")
+		{
+			var actor = new RemoteActor(_peer, name);
+			var known = await _host.Known(actor);
+			return (actor, known.ID);
+		}
+
+		[Fact]
+		public async Task Verify_credentials_shows_the_persona_and_its_source_and_nothing_of_the_login()
+		{
+			var alice = await _host.Mastodon("alice");
+
+			var me = (await alice.Client.Get("/api/v1/accounts/verify_credentials")).Ok();
+
+			Assert.Equal(alice.Id, me.Body.Text("id"));
+			Assert.Equal(alice.UserName, me.Body.Text("username"));
+			Assert.Equal(alice.UserName, me.Body.Text("acct"));
+			Assert.Equal(alice.Uri, me.Body.Text("uri"));
+			Assert.Equal("public", me.Body["source"].Text("privacy"));
+			Assert.Equal("public", me.Body["source"].Text("quote_policy"));
+			Assert.Equal(0, me.Body["source"].Number("follow_requests_count"));
+			Assert.DoesNotContain(alice.Persona.Root.Id, me.Text);
+			Assert.DoesNotContain(alice.Persona.Root.UserName, me.Text);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().Get("/api/v1/accounts/verify_credentials")).Status);
+		}
+
+		[Fact]
+		public async Task Update_credentials_takes_fields_in_both_shapes_the_source_and_the_quote_policy()
+		{
+			var alice = await _host.Mastodon("alice");
+
+			var updated = (await alice.Client.Patch("/api/v1/accounts/update_credentials",
+				("display_name", "  Alice Liddell "), ("note", "down the hole"), ("locked", "true"), ("bot", "true"),
+				("fields_attributes[0][name]", "Site"), ("fields_attributes[0][value]", "https://example.com"),
+				("fields_attributes[1][name]", "Pronouns"), ("fields_attributes[1][value]", "she/her"),
+				("source[privacy]", "private"), ("source[sensitive]", "true"), ("source[language]", "it"), ("source[quote_policy]", "followers"))).Ok();
+
+			Assert.Equal("Alice Liddell", updated.Body.Text("display_name"));
+			Assert.True(updated.Body.Flag("locked"));
+			Assert.True(updated.Body.Flag("bot"));
+			Assert.Equal(new[] { "Site", "Pronouns" }, updated.Body["fields"]!.AsArray().Select(f => f.Text("name")));
+			Assert.Equal("down the hole", updated.Body["source"].Text("note"));
+			Assert.Equal("private", updated.Body["source"].Text("privacy"));
+			Assert.True(updated.Body["source"].Flag("sensitive"));
+			Assert.Equal("it", updated.Body["source"].Text("language"));
+			Assert.Equal("followers", updated.Body["source"].Text("quote_policy"));
+
+			var arrayShape = (await alice.Client.Json(HttpMethod.Patch, "/api/v1/accounts/update_credentials", new JsonObject
+			{
+				["fields_attributes"] = new JsonArray(new JsonObject { ["name"] = "Garden", ["value"] = "roses" }, new JsonObject { ["name"] = "Cat", ["value"] = "Dinah" }),
+				["source"] = new JsonObject { ["quote_policy"] = "everyone" }
+			})).Ok();
+			Assert.Equal(new[] { ("Garden", "roses"), ("Cat", "Dinah") },
+				arrayShape.Body["source"]!["fields"]!.AsArray().Select(f => (f.Text("name"), f.Text("value"))));
+			Assert.Equal("followers", arrayShape.Body["source"].Text("quote_policy"));
+
+			var formArray = (await alice.Client.Patch("/api/v1/accounts/update_credentials",
+				("fields_attributes[][name]", "One"), ("fields_attributes[][value]", "1"), ("fields_attributes[][name]", "Two"), ("fields_attributes[][value]", "2"))).Ok();
+			Assert.Equal(new[] { ("One", "1"), ("Two", "2") }, formArray.Body["source"]!["fields"]!.AsArray().Select(f => (f.Text("name"), f.Text("value"))));
+
+			var again = (await alice.Client.Get("/api/v1/accounts/verify_credentials")).Ok();
+			Assert.Equal(2, again.Body["fields"]!.AsArray().Count);
+			Assert.Equal("private", again.Body["source"].Text("privacy"));
+			var status = await alice.Status("with the default visibility");
+			Assert.Equal("private", status.Text("visibility"));
+			Assert.True(status.Flag("sensitive"));
+			Assert.Equal("it", status.Text("language"));
+		}
+
+		[Fact]
+		public async Task Avatar_and_header_uploads_are_resized_and_lose_their_metadata()
+		{
+			var alice = await _host.Mastodon("alice");
+			var picture = MastodonHelpers.JpegWithMetadata(900, 700);
+			using (var original = NetVips.Image.NewFromBuffer(picture))
+				Assert.Contains("exif-data", original.GetFields());
+			var form = MastodonHelpers.Multipart(("avatar", picture, "image/jpeg", "me.jpg"), ("header", MastodonHelpers.JpegWithMetadata(2000, 900), "image/jpeg", "header.jpg"));
+			form.Add(new StringContent("Alice"), "display_name");
+
+			var updated = (await alice.Client.Exchange(new HttpRequestMessage(HttpMethod.Patch, "/api/v1/accounts/update_credentials") { Content = form })).Ok();
+
+			Assert.Equal("Alice", updated.Body.Text("display_name"));
+			foreach (var (field, maxWidth, maxHeight) in new[] { ("avatar", 400, 400), ("header", 1500, 500) })
+			{
+				var url = updated.Body.Text(field);
+				Assert.StartsWith($"{PrivaPubHost.Base}/media/files/", url);
+				var bytes = await _host.Client().GetByteArrayAsync(url, Token);
+				MastodonHelpers.AssertNoMetadata(bytes);
+				using var stored = NetVips.Image.NewFromBuffer(bytes);
+				Assert.True(stored.Width <= maxWidth && stored.Height <= maxHeight, $"{field} is {stored.Width}x{stored.Height}");
+			}
+		}
+
+		[Fact]
+		public async Task Lookup_finds_local_and_remote_accounts_but_never_a_circle_or_the_servers_own_actors()
+		{
+			var alice = await _host.Mastodon("alice");
+			var (bob, bobId) = await Remote();
+			var circleName = $"circle{Guid.NewGuid():N}"[..20];
+			string circleId;
+			using (var clientApi = _host.As(alice.Persona.Root.Jwt))
+			{
+				var circle = await clientApi.PostAsJsonAsync("/clientapi/group/insert", new { avatarId = alice.Id, userName = circleName, name = "inner", isCommunity = false }, Token);
+				Assert.Equal(HttpStatusCode.OK, circle.StatusCode);
+				circleId = (await circle.Content.ReadFromJsonAsync<JsonObject>(Token))!["id"]!.GetValue<string>();
+			}
+			var anonymous = _host.Client();
+
+			Assert.Equal(alice.Id, (await anonymous.Get($"/api/v1/accounts/lookup?acct={alice.UserName}")).Ok().Body.Text("id"));
+			Assert.Equal(alice.Id, (await anonymous.Get($"/api/v1/accounts/lookup?acct=@{alice.UserName}@{PrivaPubHost.Host}")).Ok().Body.Text("id"));
+			var remote = (await anonymous.Get($"/api/v1/accounts/lookup?acct={Uri.EscapeDataString(bob.Handle())}")).Ok();
+			Assert.Equal(bobId, remote.Body.Text("id"));
+			Assert.Equal(bob.Handle(), remote.Body.Text("acct"));
+			Assert.Equal(HttpStatusCode.NotFound, (await anonymous.Get($"/api/v1/accounts/lookup?acct={circleName}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Get($"/api/v1/accounts/lookup?acct={circleName}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await anonymous.Get("/api/v1/accounts/lookup?acct=privapub")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await anonymous.Get("/api/v1/accounts/lookup?acct=privapub_reports")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await anonymous.Get($"/api/v1/accounts/lookup?acct=nobody{Guid.NewGuid():N}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await anonymous.Get("/api/v1/accounts/lookup?acct=a@b@c")).Status);
+
+			Assert.Equal(alice.UserName, (await anonymous.Get($"/api/v1/accounts/{alice.Id}")).Ok().Body.Text("username"));
+			Assert.Equal(bob.Handle(), (await anonymous.Get($"/api/v1/accounts/{bobId}")).Ok().Body.Text("acct"));
+			Assert.Equal(HttpStatusCode.NotFound, (await anonymous.Get("/api/v1/accounts/000000000000000000000000")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Get($"/api/v1/accounts/{circleId}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Get($"/api/v1/accounts/{circleId}/statuses")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Post($"/api/v1/accounts/{circleId}/follow")).Status);
+		}
+
+		[Fact]
+		public async Task Search_resolves_a_remote_handle_only_when_asked_by_a_signed_in_persona()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			_peer.WebFinger(bob);
+			var handle = Uri.EscapeDataString(bob.Handle());
+
+			Assert.Empty((await alice.Client.Get($"/api/v1/accounts/search?q={handle}")).Ok().Array);
+			Assert.Empty((await alice.Client.Get($"/api/v2/search?q={handle}")).Ok().Body["accounts"]!.AsArray());
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().Get($"/api/v1/accounts/search?q={handle}&resolve=true")).Status);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().Get($"/api/v2/search?q={handle}&resolve=true")).Status);
+			Assert.Empty(_peer.Requests);
+
+			var resolved = (await alice.Client.Get($"/api/v1/accounts/search?q={handle}&resolve=true")).Ok();
+
+			var found = Assert.Single(resolved.Array);
+			Assert.Equal(bob.Handle(), found.Text("acct"));
+			Assert.Contains(_peer.Requests, r => r.Path == "/.well-known/webfinger");
+			Assert.Equal(found.Text("id"), Assert.Single((await alice.Client.Get($"/api/v2/search?q={handle}&type=accounts")).Ok().Body["accounts"]!.AsArray()).Text("id"));
+			Assert.Contains(alice.Id, (await alice.Client.Get($"/api/v1/accounts/search?q={alice.UserName}")).Ok().Ids);
+		}
+
+		// an account elsewhere: what it features, in its order, its public posts only
+		[Fact]
+		public async Task A_remote_accounts_pinned_statuses_are_what_it_features()
+		{
+			var alice = await _host.Mastodon("alice");
+			var (bob, bobId) = await Remote();
+			Post Held(string text, PostVisibility visibility) => new()
+			{
+				ObjectURI = $"{bob.Id}/statuses/{Guid.NewGuid():N}", ActorURI = bob.Id, AuthorAccountId = bobId, IsFederatedCopy = true,
+				Visibility = visibility, ContentHtml = $"<p>{text}</p>", CreationDate = DateTime.UtcNow, UpdateDate = DateTime.UtcNow
+			};
+			var first = Held("first pin", PostVisibility.Public);
+			var second = Held("second pin", PostVisibility.Unlisted);
+			var hidden = Held("for followers", PostVisibility.FollowersOnly);
+			await DB.Default.SaveAsync(new[] { first, second, hidden }, Token);
+			await DB.Default.SaveAsync(new[]
+			{
+				new RemoteFeatured { ActorURI = bob.Id, ObjectURI = second.ObjectURI, PostId = second.ID, Position = 1 },
+				new RemoteFeatured { ActorURI = bob.Id, ObjectURI = hidden.ObjectURI, PostId = hidden.ID, Position = 2 },
+				new RemoteFeatured { ActorURI = bob.Id, ObjectURI = first.ObjectURI, PostId = first.ID, Position = 0 }
+			}, Token);
+
+			var pinned = (await alice.Client.Get($"/api/v1/accounts/{bobId}/statuses?pinned=true")).Ok();
+
+			Assert.Equal(new[] { first.ID, second.ID }, pinned.Ids);
+		}
+
+		[Fact]
+		public async Task Account_statuses_filter_pins_replies_reblogs_media_and_tags_and_page_both_ways()
+		{
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var tag = $"tag{Guid.NewGuid():N}"[..16];
+			var tagged = await alice.Status($"first #{tag}");
+			var thread = await alice.Status("and a thread", ("in_reply_to_id", tagged.Text("id")));
+			var upload = (await alice.Client.Exchange(new HttpRequestMessage(HttpMethod.Post, "/api/v2/media")
+			{
+				Content = MastodonHelpers.Multipart(("file", MastodonHelpers.JpegWithMetadata(64, 48), "image/jpeg", "a.jpg"))
+			})).Ok();
+			var withMedia = await alice.Status("a picture", ("media_ids[]", upload.Body.Text("id")));
+			var carolPost = await carol.Status("boost me");
+			var answer = await alice.Status("an answer", ("in_reply_to_id", carolPost.Text("id")));
+			var reblog = (await alice.Client.Post($"/api/v1/statuses/{carolPost.Text("id")}/reblog")).Ok().Body;
+			var pinned = await alice.Status("pinned");
+			(await alice.Client.Post($"/api/v1/statuses/{pinned.Text("id")}/pin")).Ok();
+			var path = $"/api/v1/accounts/{alice.Id}/statuses";
+			string[] Ids(params JsonObject[] statuses) => statuses.Select(s => s.Text("id")).ToArray();
+
+			Assert.Equal(Ids(pinned), (await carol.Client.Get(path + "?pinned=true")).Ok().Ids);
+			Assert.True((await carol.Client.Get(path + "?pinned=true")).Ok().Array[0].Flag("pinned"));
+			Assert.Equal(Ids(pinned, reblog.AsObject(), answer, withMedia, thread, tagged), (await carol.Client.Get(path)).Ok().Ids);
+			Assert.Equal(Ids(pinned, reblog.AsObject(), withMedia, thread, tagged), (await carol.Client.Get(path + "?exclude_replies=true")).Ok().Ids);
+			Assert.DoesNotContain(reblog.Text("id"), (await carol.Client.Get(path + "?exclude_reblogs=true")).Ok().Ids);
+			Assert.Equal(Ids(withMedia), (await carol.Client.Get(path + "?only_media=true")).Ok().Ids);
+			Assert.Equal(Ids(tagged), (await _host.Client().Get(path + $"?tagged={tag.ToUpperInvariant()}")).Ok().Ids);
+
+			var first = (await carol.Client.Get(path + "?limit=2")).Ok();
+			Assert.Equal(Ids(pinned, reblog.AsObject()), first.Ids);
+			var next = (await carol.Client.Get(first.Link("next"))).Ok();
+			Assert.Equal(Ids(answer, withMedia), next.Ids);
+			Assert.Contains("limit=2", next.Link("prev"));
+			Assert.Equal(first.Ids, (await carol.Client.Get(next.Link("prev"))).Ok().Ids);
+			var last = (await carol.Client.Get(next.Link("next"))).Ok();
+			Assert.Equal(Ids(thread, tagged), last.Ids);
+			Assert.Empty((await carol.Client.Get(last.Link("next"))).Ok().Array);
+		}
+
+		[Fact]
+		public async Task A_community_account_lists_the_posts_addressed_to_it()
+		{
+			var alice = await _host.Mastodon("alice");
+			var reader = await _host.Mastodon("reader");
+			var name = $"community{Guid.NewGuid():N}"[..20];
+			string communityId;
+			using (var clientApi = _host.As(alice.Persona.Root.Jwt))
+			{
+				var created = await clientApi.PostAsJsonAsync("/clientapi/group/insert", new { avatarId = alice.Id, userName = name, name = "Gardeners", isCommunity = true }, Token);
+				Assert.Equal(HttpStatusCode.OK, created.StatusCode);
+				communityId = (await created.Content.ReadFromJsonAsync<JsonObject>(Token))!["id"]!.GetValue<string>();
+			}
+			var addressed = await alice.Status($"@{name} first meeting on Sunday");
+			await alice.Status("not for the garden");
+
+			var community = (await reader.Client.Get($"/api/v1/accounts/lookup?acct={name}")).Ok();
+			Assert.Equal(communityId, community.Body.Text("id"));
+			Assert.True(community.Body.Flag("group"));
+			Assert.Equal(new[] { addressed.Text("id") }, (await reader.Client.Get($"/api/v1/accounts/{communityId}/statuses")).Ok().Ids);
+			Assert.Equal(1, (await _host.Client().Get($"/api/v1/accounts/{communityId}")).Ok().Body.Number("statuses_count"));
+		}
+
+		[Fact]
+		public async Task A_follower_sees_followers_only_posts_and_a_stranger_does_not()
+		{
+			var alice = await _host.Mastodon("alice");
+			var follower = await _host.Mastodon("follower");
+			var stranger = await _host.Mastodon("stranger");
+			(await follower.Client.Post($"/api/v1/accounts/{alice.Id}/follow")).Ok();
+			var open = await alice.Status("for everyone");
+			var quiet = await alice.Status("for followers", ("visibility", "private"));
+			var direct = await alice.Status($"@{follower.UserName} for you", ("visibility", "direct"));
+			var path = $"/api/v1/accounts/{alice.Id}/statuses";
+
+			Assert.Equal(new[] { quiet.Text("id"), open.Text("id") }, (await follower.Client.Get(path)).Ok().Ids);
+			Assert.Equal(new[] { open.Text("id") }, (await stranger.Client.Get(path)).Ok().Ids);
+			Assert.Equal(new[] { open.Text("id") }, (await _host.Client().Get(path)).Ok().Ids);
+			Assert.Equal(new[] { direct.Text("id"), quiet.Text("id"), open.Text("id") }, (await alice.Client.Get(path)).Ok().Ids);
+			Assert.Equal(HttpStatusCode.NotFound, (await stranger.Client.Get($"/api/v1/statuses/{quiet.Text("id")}")).Status);
+			Assert.Equal(HttpStatusCode.OK, (await follower.Client.Get($"/api/v1/statuses/{quiet.Text("id")}")).Status);
+		}
+
+		[Fact]
+		public async Task Followers_and_following_are_listed_only_to_their_owner()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			(await bob.Client.Post($"/api/v1/accounts/{alice.Id}/follow")).Ok();
+
+			Assert.Equal(new[] { bob.Id }, (await alice.Client.Get($"/api/v1/accounts/{alice.Id}/followers")).Ok().Ids);
+			Assert.Empty((await bob.Client.Get($"/api/v1/accounts/{alice.Id}/followers")).Ok().Array);
+			Assert.Empty((await _host.Client().Get($"/api/v1/accounts/{alice.Id}/followers")).Ok().Array);
+			Assert.Equal(new[] { alice.Id }, (await bob.Client.Get($"/api/v1/accounts/{bob.Id}/following")).Ok().Ids);
+			Assert.Empty((await alice.Client.Get($"/api/v1/accounts/{bob.Id}/following")).Ok().Array);
+			var account = (await bob.Client.Get($"/api/v1/accounts/{alice.Id}")).Ok();
+			Assert.Equal(1, account.Body.Number("followers_count"));
+		}
+
+		[Fact]
+		public async Task Following_is_immediate_for_an_open_persona_requested_for_a_locked_one_and_queued_for_a_remote_one()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var locked = await _host.Mastodon("locked");
+			var follower = await _host.Mastodon("follower");
+			(await locked.Client.Patch("/api/v1/accounts/update_credentials", ("locked", "true"))).Ok();
+			var (bob, bobId) = await Remote();
+
+			var open = (await follower.Client.Post($"/api/v1/accounts/{alice.Id}/follow")).Ok();
+			Assert.True(open.Body.Flag("following"));
+			Assert.False(open.Body.Flag("requested"));
+			Assert.True(open.Body.Flag("showing_reblogs"));
+			var notified = (await alice.Client.Get("/api/v1/notifications?types[]=follow")).Ok();
+			Assert.Equal(follower.Id, Assert.Single(notified.Array)!["account"].Text("id"));
+
+			var asked = (await follower.Client.Post($"/api/v1/accounts/{locked.Id}/follow", ("reblogs", "false"))).Ok();
+			Assert.False(asked.Body.Flag("following"));
+			Assert.True(asked.Body.Flag("requested"));
+			Assert.Equal(new[] { follower.Id }, (await locked.Client.Get("/api/v1/follow_requests")).Ok().Ids);
+			Assert.Equal(1, (await locked.Client.Get("/api/v1/accounts/verify_credentials")).Ok().Body["source"].Number("follow_requests_count"));
+			Assert.True((await locked.Client.Post($"/api/v1/follow_requests/{follower.Id}/authorize")).Ok().Body.Flag("followed_by"));
+			var accepted = Assert.Single((await follower.Client.Get($"/api/v1/accounts/relationships?id[]={locked.Id}")).Ok().Array);
+			Assert.True(accepted.Flag("following"));
+			Assert.False(accepted.Flag("showing_reblogs"));
+			Assert.Empty((await locked.Client.Get("/api/v1/follow_requests")).Ok().Array);
+
+			var remote = (await follower.Client.Post($"/api/v1/accounts/{bobId}/follow")).Ok();
+			Assert.True(remote.Body.Flag("requested"));
+			var follow = Assert.Single(await bob.Delivered(since), d => d.Type() == "Follow");
+			Assert.Equal(follower.Uri, follow.Text("actor"));
+			Assert.Equal(bob.Id, follow.Text("object"));
+
+			Assert.False((await follower.Client.Post($"/api/v1/accounts/{alice.Id}/unfollow")).Ok().Body.Flag("following"));
+			Assert.Empty((await alice.Client.Get($"/api/v1/accounts/{alice.Id}/followers")).Ok().Array);
+			Assert.False((await follower.Client.Post($"/api/v1/accounts/{bobId}/unfollow")).Ok().Body.Flag("requested"));
+			var undo = Assert.Single(await bob.Delivered(since), d => d.Type() == "Undo");
+			Assert.Equal(follow.Text("id"), undo["object"].Text("id"));
+			Assert.Equal(HttpStatusCode.NotFound, (await follower.Client.Post("/api/v1/accounts/000000000000000000000000/follow")).Status);
+			Assert.Equal(HttpStatusCode.Forbidden, (await follower.Client.Post($"/api/v1/accounts/{follower.Id}/follow")).Status);
+		}
+
+		[Fact]
+		public async Task Remote_follow_requests_are_answered_with_the_original_follow()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var locked = await _host.Mastodon("locked");
+			(await locked.Client.Patch("/api/v1/accounts/update_credentials", ("locked", "true"))).Ok();
+			var bob = new RemoteActor(_peer, "bob");
+			var carol = new RemoteActor(_peer, "carol");
+			var bobFollow = await _host.FollowedBy(locked, bob);
+			var carolFollow = await _host.FollowedBy(locked, carol);
+			var bobId = (await _host.Known(bob)).ID;
+			var carolId = (await _host.Known(carol)).ID;
+
+			var requests = (await locked.Client.Get("/api/v1/follow_requests")).Ok();
+			Assert.Equal(new[] { carolId, bobId }, requests.Ids);
+			Assert.True(Assert.Single((await locked.Client.Get($"/api/v1/accounts/relationships?id[]={bobId}")).Ok().Array).Flag("requested_by"));
+			Assert.Empty(await bob.Delivered(since));
+
+			Assert.True((await locked.Client.Post($"/api/v1/follow_requests/{bobId}/authorize")).Ok().Body.Flag("followed_by"));
+			Assert.False((await locked.Client.Post($"/api/v1/follow_requests/{carolId}/reject")).Ok().Body.Flag("requested_by"));
+
+			var accept = Assert.Single(await bob.Delivered(since));
+			Assert.Equal("Accept", accept.Type());
+			Assert.Equal(locked.Uri, accept.Text("actor"));
+			Assert.Equal(bobFollow, accept["object"].Text("id"));
+			var reject = Assert.Single(await carol.Delivered(since));
+			Assert.Equal("Reject", reject.Type());
+			Assert.Equal(carolFollow, reject["object"].Text("id"));
+			Assert.Equal(carol.Id, reject["object"].Text("actor"));
+			Assert.Empty((await locked.Client.Get("/api/v1/follow_requests")).Ok().Array);
+			Assert.Equal(new[] { bobId }, (await locked.Client.Get($"/api/v1/accounts/{locked.Id}/followers")).Ok().Ids);
+			Assert.Equal(HttpStatusCode.NotFound, (await locked.Client.Post($"/api/v1/follow_requests/{carolId}/authorize")).Status);
+
+			var local = await _host.Mastodon("local");
+			(await local.Client.Post($"/api/v1/accounts/{locked.Id}/follow")).Ok();
+			(await locked.Client.Post($"/api/v1/follow_requests/{local.Id}/reject")).Ok();
+			var refused = Assert.Single((await local.Client.Get($"/api/v1/accounts/relationships?id[]={locked.Id}")).Ok().Array);
+			Assert.False(refused.Flag("requested"));
+			Assert.False(refused.Flag("following"));
+		}
+
+		[Fact]
+		public async Task Removing_a_follower_ends_the_follow_on_both_sides_and_tells_a_remote_follower()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var local = await _host.Mastodon("local");
+			var bob = new RemoteActor(_peer, "bob");
+			var follow = await _host.FollowedBy(alice, bob);
+			var bobId = (await _host.Known(bob)).ID;
+			(await local.Client.Post($"/api/v1/accounts/{alice.Id}/follow")).Ok();
+			Assert.True(Assert.Single((await alice.Client.Get($"/api/v1/accounts/relationships?id[]={bobId}")).Ok().Array).Flag("followed_by"));
+
+			var removed = (await alice.Client.Post($"/api/v1/accounts/{bobId}/remove_from_followers")).Ok();
+
+			Assert.False(removed.Body.Flag("followed_by"));
+			var reject = Assert.Single(await bob.Delivered(since), d => d.Type() == "Reject");
+			Assert.Equal(alice.Uri, reject.Text("actor"));
+			Assert.Equal(follow, reject["object"].Text("id"));
+			Assert.Equal("Follow", reject["object"].Text("type"));
+			Assert.Equal(bob.Id, reject["object"].Text("actor"));
+			Assert.Equal(alice.Uri, reject["object"].Text("object"));
+
+			Assert.False((await alice.Client.Post($"/api/v1/accounts/{local.Id}/remove_from_followers")).Ok().Body.Flag("followed_by"));
+			Assert.False(Assert.Single((await local.Client.Get($"/api/v1/accounts/relationships?id[]={alice.Id}")).Ok().Array).Flag("following"));
+			Assert.Empty((await alice.Client.Get($"/api/v1/accounts/{alice.Id}/followers")).Ok().Array);
+			Assert.Empty((await local.Client.Get($"/api/v1/accounts/{local.Id}/following")).Ok().Array);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Post("/api/v1/accounts/000000000000000000000000/remove_from_followers")).Status);
+		}
+
+		[Fact]
+		public async Task Blocks_federate_and_reject_a_remote_follower()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var local = await _host.Mastodon("local");
+			var bob = new RemoteActor(_peer, "bob");
+			var follow = await _host.FollowedBy(alice, bob);
+			var bobId = (await _host.Known(bob)).ID;
+			(await local.Client.Post($"/api/v1/accounts/{alice.Id}/follow")).Ok();
+
+			var blocked = (await alice.Client.Post($"/api/v1/accounts/{bobId}/block")).Ok();
+
+			Assert.True(blocked.Body.Flag("blocking"));
+			Assert.False(blocked.Body.Flag("followed_by"));
+			var sent = await bob.Delivered(since);
+			var reject = Assert.Single(sent, d => d.Type() == "Reject");
+			Assert.Equal((follow, "Follow", bob.Id), (reject["object"].Text("id"), reject["object"].Text("type"), reject["object"].Text("actor")));
+			var block = Assert.Single(sent, d => d.Type() == "Block");
+			Assert.Equal((alice.Uri, bob.Id), (block.Text("actor"), block.Text("object")));
+			Assert.True((await alice.Client.Post($"/api/v1/accounts/{local.Id}/block")).Ok().Body.Flag("blocking"));
+			Assert.Equal(new[] { local.Id, bobId }, (await alice.Client.Get("/api/v1/blocks")).Ok().Ids);
+			var blockedBy = Assert.Single((await local.Client.Get($"/api/v1/accounts/relationships?id[]={alice.Id}")).Ok().Array);
+			Assert.True(blockedBy.Flag("blocked_by"));
+			Assert.False(blockedBy.Flag("following"));
+			Assert.Empty((await alice.Client.Get($"/api/v1/accounts/{alice.Id}/followers")).Ok().Array);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Post($"/api/v1/accounts/{alice.Id}/block")).Status);
+
+			Assert.False((await alice.Client.Post($"/api/v1/accounts/{bobId}/unblock")).Ok().Body.Flag("blocking"));
+			var undo = Assert.Single(await bob.Delivered(since), d => d.Type() == "Undo");
+			Assert.Equal(block.Text("id"), undo["object"].Text("id"));
+			(await alice.Client.Post($"/api/v1/accounts/{local.Id}/unblock")).Ok();
+			Assert.Empty((await alice.Client.Get("/api/v1/blocks")).Ok().Array);
+			Assert.Equal(new[] { "Accept", "Block", "Reject", "Undo" }, (await bob.Delivered(since)).Select(d => d.Type()).Order());
+		}
+
+		[Fact]
+		public async Task Mutes_keep_their_duration_and_notification_choice_and_never_federate()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var chatty = await _host.Mastodon("chatty");
+			var muffled = await _host.Mastodon("muffled");
+			var (bob, bobId) = await Remote();
+			(await alice.Client.Post($"/api/v1/accounts/{chatty.Id}/follow")).Ok();
+			var post = (await alice.Status("like me")).Text("id");
+
+			var muted = (await alice.Client.Post($"/api/v1/accounts/{chatty.Id}/mute", ("duration", "3600"), ("notifications", "false"))).Ok();
+			Assert.True(muted.Body.Flag("muting"));
+			Assert.False(muted.Body.Flag("muting_notifications"));
+			var mute = await DB.Default.Find<Mute>().Match(m => m.AvatarId == alice.Id && m.TargetAccountId == chatty.Id).ExecuteFirstAsync(Token);
+			Assert.InRange(mute.ExpiresAt!.Value, DateTime.UtcNow.AddMinutes(59), DateTime.UtcNow.AddMinutes(61));
+			var forever = (await alice.Client.Post($"/api/v1/accounts/{muffled.Id}/mute")).Ok();
+			Assert.True(forever.Body.Flag("muting_notifications"));
+			Assert.Null((await DB.Default.Find<Mute>().Match(m => m.AvatarId == alice.Id && m.TargetAccountId == muffled.Id).ExecuteFirstAsync(Token)).ExpiresAt);
+			(await alice.Client.Post($"/api/v1/accounts/{bobId}/mute")).Ok();
+			Assert.Equal(new[] { bobId, muffled.Id, chatty.Id }, (await alice.Client.Get("/api/v1/mutes")).Ok().Ids);
+
+			var hidden = (await chatty.Status("you will not see this")).Text("id");
+			(await chatty.Client.Post($"/api/v1/statuses/{post}/favourite")).Ok();
+			(await muffled.Client.Post($"/api/v1/statuses/{post}/favourite")).Ok();
+			Assert.DoesNotContain(hidden, (await alice.Client.Get("/api/v1/timelines/home")).Ok().Ids);
+			Assert.Equal(new[] { chatty.Id }, (await alice.Client.Get("/api/v1/notifications?types[]=favourite")).Ok().Array.Select(n => n!["account"].Text("id")));
+			Assert.Empty(await bob.Delivered(since));
+
+			Assert.False((await alice.Client.Post($"/api/v1/accounts/{chatty.Id}/unmute")).Ok().Body.Flag("muting"));
+			(await alice.Client.Post($"/api/v1/accounts/{muffled.Id}/unmute")).Ok();
+			(await alice.Client.Post($"/api/v1/accounts/{bobId}/unmute")).Ok();
+			Assert.Empty((await alice.Client.Get("/api/v1/mutes")).Ok().Array);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Post($"/api/v1/accounts/{alice.Id}/mute")).Status);
+		}
+
+		[Fact]
+		public async Task Domain_blocks_are_listed_added_and_removed()
+		{
+			var alice = await _host.Mastodon("alice");
+			var domain = $"blocked{Guid.NewGuid():N}.example";
+
+			Assert.Equal("{}", (await alice.Client.Post("/api/v1/domain_blocks", ("domain", domain.ToUpperInvariant()))).Ok().Text);
+			(await alice.Client.Post("/api/v1/domain_blocks", ("domain", "not a domain"))).Ok();
+			Assert.Equal(new[] { domain }, (await alice.Client.Get("/api/v1/domain_blocks")).Ok().Array.Select(d => d!.GetValue<string>()));
+
+			(await alice.Client.Delete("/api/v1/domain_blocks", ("domain", domain))).Ok();
+			Assert.Empty((await alice.Client.Get("/api/v1/domain_blocks")).Ok().Array);
+		}
+
+		[Fact]
+		public async Task Relationships_answer_every_asked_id_even_a_junk_one()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+
+			var answer = (await alice.Client.Get($"/api/v1/accounts/relationships?id[]=junk&id[]={bob.Id}&id[]=junk")).Ok();
+
+			Assert.Equal(new[] { "junk", bob.Id }, answer.Ids);
+			Assert.All(answer.Array, r => Assert.False(r.Flag("following") || r.Flag("blocking") || r.Flag("muting") || r.Flag("followed_by")));
+		}
+
+		[Fact]
+		public async Task Following_again_sends_an_unanswered_request_once_more_and_no_more_than_hourly()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var (bob, bobId) = await Remote();
+			Assert.True((await alice.Client.Post($"/api/v1/accounts/{bobId}/follow")).Ok().Body.Flag("requested"));
+			var first = Assert.Single(await bob.Delivered(since), d => d.Type() == "Follow");
+
+			Assert.True((await alice.Client.Post($"/api/v1/accounts/{bobId}/follow")).Ok().Body.Flag("requested"));
+			(await alice.Client.Post($"/api/v1/accounts/{bobId}/follow")).Ok();
+
+			var follows = (await bob.Delivered(since)).Where(d => d.Type() == "Follow").ToList();
+			Assert.Equal(2, follows.Count);
+			Assert.All(follows, f => Assert.Equal(first.Text("id"), f.Text("id")));
+		}
+
+		[Fact]
+		public async Task A_remote_authors_followers_only_posts_show_only_to_the_personas_that_follow_them()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var (bob, bobId) = await Remote();
+			(await alice.Client.Post($"/api/v1/accounts/{bobId}/follow")).Ok();
+			var follow = Assert.Single(await bob.Delivered(since), d => d.Type() == "Follow");
+			await _host.Deliver(bob, alice.Mouth, new JsonObject
+			{
+				["id"] = $"{bob.Origin()}/accepts/{Guid.NewGuid():N}",
+				["type"] = "Accept",
+				["actor"] = bob.Id,
+				["object"] = follow.DeepClone()
+			});
+			Assert.True(Assert.Single((await alice.Client.Get($"/api/v1/accounts/relationships?id[]={bobId}")).Ok().Array).Flag("following"));
+			var create = bob.Create("<p>for my followers</p>", new[] { bob.Id + "/followers" });
+			await _host.Deliver(bob, alice.Mouth, create);
+			var noteId = create["object"].Text("id");
+			var stored = await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteFirstAsync(Token);
+			Assert.Equal(PostVisibility.FollowersOnly, stored.Visibility);
+			var path = $"/api/v1/accounts/{bobId}/statuses";
+
+			Assert.Equal(new[] { stored.ID }, (await alice.Client.Get(path)).Ok().Ids);
+			Assert.Empty((await carol.Client.Get(path)).Ok().Array);
+			Assert.Empty((await _host.Client().Get(path)).Ok().Array);
+			Assert.Equal("private", (await alice.Client.Get($"/api/v1/statuses/{stored.ID}")).Ok().Body.Text("visibility"));
+			Assert.Equal(HttpStatusCode.NotFound, (await carol.Client.Get($"/api/v1/statuses/{stored.ID}")).Status);
+			Assert.Contains(stored.ID, (await alice.Client.Get("/api/v1/timelines/home")).Ok().Ids);
+			Assert.True((await alice.Client.Post($"/api/v1/statuses/{stored.ID}/favourite")).Ok().Body.Flag("favourited"));
+		}
+
+		[Fact]
+		public async Task Search_by_address_finds_local_posts_and_personas_but_never_a_circle_or_a_hidden_post()
+		{
+			var alice = await _host.Mastodon("alice");
+			var stranger = await _host.Mastodon("stranger");
+			var open = await alice.Status("findable");
+			var quiet = await alice.Status("not for strangers", ("visibility", "private"));
+			var circleName = $"circle{Guid.NewGuid():N}"[..20];
+			using (var clientApi = _host.As(alice.Persona.Root.Jwt))
+				Assert.Equal(HttpStatusCode.OK, (await clientApi.PostAsJsonAsync("/clientapi/group/insert",
+					new { avatarId = alice.Id, userName = circleName, name = "inner", isCommunity = false }, Token)).StatusCode);
+
+			var byPost = (await stranger.Client.Get($"/api/v2/search?q={Uri.EscapeDataString(open.Text("uri"))}")).Ok();
+			Assert.Equal(open.Text("id"), Assert.Single(byPost.Body["statuses"]!.AsArray()).Text("id"));
+			Assert.Equal(open.Text("id"), Assert.Single((await stranger.Client.Get($"/api/v2/search?q={Uri.EscapeDataString(open.Text("url"))}")).Ok().Body["statuses"]!.AsArray()).Text("id"));
+			var hidden = (await stranger.Client.Get($"/api/v2/search?q={Uri.EscapeDataString(quiet.Text("uri"))}&resolve=true")).Ok();
+			Assert.Empty(hidden.Body["statuses"]!.AsArray());
+			Assert.Equal(alice.Id, Assert.Single((await stranger.Client.Get($"/api/v2/search?q={Uri.EscapeDataString(alice.Uri)}")).Ok().Body["accounts"]!.AsArray()).Text("id"));
+			Assert.Empty((await stranger.Client.Get($"/api/v2/search?q={Uri.EscapeDataString($"{PrivaPubHost.Base}/peasants/{circleName}")}&resolve=true")).Ok().Body["accounts"]!.AsArray());
+			Assert.Empty((await stranger.Client.Get($"/api/v1/accounts/search?q={circleName}")).Ok().Array);
+			var tag = (await stranger.Client.Get("/api/v2/search?q=%23Cats&type=hashtags")).Ok();
+			Assert.Equal("cats", Assert.Single(tag.Body["hashtags"]!.AsArray()).Text("name"));
+			Assert.Empty(tag.Body["accounts"]!.AsArray());
+
+			(await alice.Client.Patch("/api/v1/accounts/update_credentials", ("discoverable", "false"))).Ok();
+			Assert.Empty((await stranger.Client.Get($"/api/v1/accounts/search?q={alice.UserName}")).Ok().Array);
+			Assert.Equal(alice.Id, (await stranger.Client.Get($"/api/v1/accounts/lookup?acct={alice.UserName}")).Ok().Body.Text("id"));
+		}
+
+		[Fact]
+		public async Task A_banned_login_loses_every_persona_token()
+		{
+			var alice = await _host.Mastodon("alice");
+			Assert.Equal(HttpStatusCode.OK, (await alice.Client.Get("/api/v1/accounts/verify_credentials")).Status);
+
+			await DB.Default.Update<RootUser>().MatchID(alice.Persona.Root.Id).Modify(r => r.IsBanned, true).ExecuteAsync(Token);
+
+			Assert.Equal(HttpStatusCode.Unauthorized, (await alice.Client.Get("/api/v1/accounts/verify_credentials")).Status);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await alice.Client.Post("/api/v1/statuses", ("status", "still here?"))).Status);
+			Assert.Equal(alice.Id, (await _host.Client().Get($"/api/v1/accounts/{alice.Id}")).Ok().Body.Text("id"));
+		}
+
+		[Fact]
+		public async Task A_forwarded_report_leaves_as_a_flag_from_the_instance_actor_never_from_the_reporter()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var local = await _host.Mastodon("local");
+			var bob = new RemoteActor(_peer, "bob");
+			var post = await _host.PublicPostFrom(bob, alice, "<p>something nasty</p>");
+			var bobId = (await _host.Known(bob)).ID;
+			var unrelated = await alice.Status("mine");
+
+			var report = (await alice.Client.Post("/api/v1/reports", ("account_id", bobId), ("status_ids[]", post.ID), ("status_ids[]", unrelated.Text("id")),
+				("comment", "please look"), ("category", "spam"), ("forward", "true"))).Ok();
+
+			Assert.Equal(bobId, report.Body["target_account"].Text("id"));
+			Assert.Equal(new[] { post.ID }, report.Body["status_ids"]!.AsArray().Select(i => i!.GetValue<string>()));
+			Assert.True(report.Body.Flag("forwarded"));
+			Assert.Equal("spam", report.Body.Text("category"));
+			var flag = Assert.Single(await bob.Delivered(since));
+			Assert.Equal("Flag", flag.Type());
+			Assert.Equal($"{PrivaPubHost.Base}/peasants/privapub", flag.Text("actor"));
+			Assert.Equal(new[] { bob.Id, post.ObjectURI }, flag["object"]!.AsArray().Select(o => o!.GetValue<string>()));
+			Assert.DoesNotContain(alice.UserName, flag.ToJsonString());
+			Assert.DoesNotContain(alice.Id, flag.ToJsonString());
+
+			var quiet = (await alice.Client.Post("/api/v1/reports", ("account_id", bobId), ("comment", "just noting"))).Ok();
+			Assert.False(quiet.Body.Flag("forwarded"));
+			Assert.False((await alice.Client.Post("/api/v1/reports", ("account_id", local.Id), ("forward", "true"))).Ok().Body.Flag("forwarded"));
+			Assert.Single(await bob.Delivered(since));
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Post("/api/v1/reports", ("account_id", "000000000000000000000000"))).Status);
+		}
+
+		[Fact]
+		public async Task Statuses_count_still_counts_located_posts_pending_an_owner_decision()
+		{
+			var alice = await _host.Mastodon("alice");
+			await alice.Status("visible");
+			await _host.Located(alice, "by the river");
+
+			var account = (await _host.Client().Get($"/api/v1/accounts/{alice.Id}")).Ok();
+
+			Assert.Equal(2, account.Body.Number("statuses_count"));
+			Assert.Single((await _host.Client().Get($"/api/v1/accounts/{alice.Id}/statuses")).Ok().Array);
+		}
+
+		[Fact]
+		public async Task Account_stub_routes_answer_empty_lists()
+		{
+			var alice = await _host.Mastodon("alice");
+
+			Assert.Empty((await _host.Client().Get($"/api/v1/accounts/{alice.Id}/featured_tags")).Ok().Array);
+			var familiar = (await alice.Client.Get($"/api/v1/accounts/familiar_followers?id[]={alice.Id}")).Ok();
+			Assert.Equal(alice.Id, Assert.Single(familiar.Array).Text("id"));
+			Assert.Empty(familiar.Array[0]!["accounts"]!.AsArray());
+		}
+	}
+}

PrivaPub.Tests/Http/MastodonFeedTests.cs

@@ -0,0 +1,140 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	// Lemmy 1.0's multi-communities and PieFed's feeds are `Feed` actors whose `following` is their communities
+	[Trait("Category", "Integration")]
+	public sealed class MastodonFeedTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task A_feed_shows_as_an_account_whose_following_is_its_communities()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var reader = await _host.Mastodon("feeder");
+			var cats = new RemoteActor(_peer, "cats", type: "Group");
+			var dogs = new RemoteActor(_peer, "dogs", type: "Group");
+			var name = $"feed{Guid.NewGuid():N}"[..12];
+			var feed = $"{_peer.A}/m/{name}";
+			// as Lemmy serves one: the instance's inbox and key, its text in `description`
+			_peer.Serve($"/m/{name}", new JsonObject
+			{
+				["@context"] = new JsonArray("https://join-lemmy.org/context.json", "https://www.w3.org/ns/activitystreams"),
+				["type"] = "Feed", ["id"] = feed, ["inbox"] = $"{_peer.A}/inbox",
+				["publicKey"] = new JsonObject { ["id"] = $"{_peer.A}/#main-key", ["owner"] = $"{_peer.A}/", ["publicKeyPem"] = "-----BEGIN PUBLIC KEY-----\n-----END PUBLIC KEY-----\n" },
+				["following"] = $"{feed}/following", ["preferredUsername"] = name, ["name"] = "Pets", ["description"] = "every pet",
+				["attributedTo"] = $"{_peer.A}/users/owner"
+			}.ToJsonString());
+			_peer.Serve($"/m/{name}/following", new JsonObject
+			{
+				["type"] = "Collection", ["id"] = $"{feed}/following", ["totalItems"] = 2, ["items"] = new JsonArray(cats.Id, dogs.Id)
+			}.ToJsonString());
+
+			var account = await _host.Get<IRemoteActorService>().GetActor(feed, refresh: true, token);
+			Assert.NotNull(account);
+			await _host.Run(j => j.Kind == JobKind.CountAccount && j.Payload == feed, token);
+
+			var shown = (await reader.Client.Get($"/api/v1/accounts/{account.ID}")).Ok().Body;
+			Assert.Equal(("Pets", 2), (shown.Text("display_name"), shown.Number("following_count")));
+			Assert.Contains("every pet", shown.Text("note"));
+			var communities = (await reader.Client.Get($"/api/v1/accounts/{account.ID}/following")).Ok().Array;
+			Assert.Equal(new[] { cats.Id, dogs.Id }, communities.Select(c => c.Text("uri")));
+			Assert.All(communities, c => Assert.True(c!["group"]!.GetValue<bool>()));
+		}
+
+		// owner decision 2026-10-07: a feed is read through the server, whose reader follows its communities; the persona
+		// follows nothing, and reads the feed in a timeline of its own
+		[Fact]
+		public async Task A_feed_is_followed_by_the_servers_reader_and_read_in_its_own_timeline()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var persona = await _host.Mastodon("feedreader");
+			var cats = new RemoteActor(_peer, "cats", type: "Group");
+			var dogs = new RemoteActor(_peer, "dogs", type: "Group");
+			var poster = new RemoteActor(_peer, "poster");
+			var name = $"feed{Guid.NewGuid():N}"[..12];
+			var feed = $"{_peer.A}/m/{name}";
+			_peer.Serve($"/m/{name}", new JsonObject
+			{
+				["type"] = "Feed", ["id"] = feed, ["inbox"] = $"{_peer.A}/inbox", ["following"] = $"{feed}/following", ["preferredUsername"] = name, ["name"] = "Pets"
+			}.ToJsonString());
+			_peer.Serve($"/m/{name}/following", new JsonObject
+			{
+				["type"] = "Collection", ["id"] = $"{feed}/following", ["totalItems"] = 2, ["items"] = new JsonArray(cats.Id, dogs.Id)
+			}.ToJsonString());
+			var account = await _host.Get<IRemoteActorService>().GetActor(feed, refresh: true, token);
+			await _host.Run(j => j.Kind == JobKind.CountAccount && j.Payload == feed, token);
+
+			var followed = (await persona.Client.Post($"/api/v1/accounts/{account.ID}/follow")).Ok().Body;
+			Assert.True(followed.Flag("following"));
+			Assert.Equal(new[] { account.ID }, (await persona.Client.Get("/api/v1/feeds")).Ok().Ids);
+			await _host.Run(j => j.Kind == JobKind.SyncFeeds, token);
+
+			var readerActor = await _host.Get<ILocalActorService>().GetReaderActor(token);
+			var follows = await DB.Default.Find<Following>().Match(f => f.AvatarId == readerActor.Id).ExecuteAsync(token);
+			Assert.Equal(new[] { cats.Id, dogs.Id }.Order(), follows.Select(f => f.TargetActorURI).Order());
+			Assert.All(follows, f => Assert.Equal(LocalActorKind.Reader, f.FollowerKind));
+			Assert.False(await DB.Default.Find<Following>().Match(f => f.AvatarId == persona.Id).ExecuteAnyAsync(token));
+			var asked = Assert.Single(await cats.Delivered(since), d => d.Type() == "Follow");
+			Assert.Equal(readerActor.Uri, asked.Text("actor"));
+			var document = (await _host.Client().Fetch(new Uri(readerActor.Uri).AbsolutePath)).Json;
+			Assert.Equal(("Service", LocalActorService.ReaderUserName), (document.Text("type"), document.Text("preferredUsername")));
+
+			await _host.Deliver(cats, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{cats.Id}/accepts/{Guid.NewGuid():N}", ["type"] = "Accept", ["actor"] = cats.Id, ["object"] = asked.Text("id")
+			});
+			var create = poster.Create("<p>a thread among cats</p>", new[] { "https://www.w3.org/ns/activitystreams#Public", cats.Id }, shape: note =>
+			{
+				note["type"] = "Page";
+				note["name"] = "Cats";
+				note["audience"] = cats.Id;
+			});
+			_peer.Serve(new Uri(create["object"]!.Text("id")).AbsolutePath, create["object"]!.ToJsonString());
+			await _host.Deliver(cats, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{cats.Id}/announces/{Guid.NewGuid():N}", ["type"] = "Announce", ["actor"] = cats.Id, ["object"] = create,
+				["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public")
+			});
+			var thread = await DB.Default.Find<Post>().Match(p => p.ObjectURI == create["object"]!.Text("id")).ExecuteSingleAsync(token);
+
+			Assert.Equal(new[] { thread.ID }, (await persona.Client.Get($"/api/v1/timelines/feed/{account.ID}")).Ok().Ids);
+			Assert.DoesNotContain(thread.ID, (await persona.Client.Get("/api/v1/timelines/home")).Ok().Ids);
+			Assert.False(await DB.Default.Find<TimelineEntry>().Match(e => e.PostId == thread.ID).ExecuteAnyAsync(token));
+			var stranger = await _host.Mastodon("notreading");
+			Assert.Equal(HttpStatusCode.NotFound, (await stranger.Client.Get($"/api/v1/timelines/feed/{account.ID}")).Status);
+
+			Assert.False((await persona.Client.Post($"/api/v1/accounts/{account.ID}/unfollow")).Ok().Body.Flag("following"));
+			await _host.Run(j => j.Kind == JobKind.SyncFeeds, token);
+			Assert.False(await DB.Default.Find<Following>().Match(f => f.AvatarId == readerActor.Id).ExecuteAnyAsync(token));
+			Assert.Contains(await cats.Delivered(since), d => d.Type() == "Undo" && d["object"].Text("type") == "Follow");
+		}
+	}
+}

PrivaPub.Tests/Http/MastodonFiltersTests.cs

@@ -0,0 +1,169 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	// Mastodon's filters: a persona's v2 filters with keywords and statuses, the v1 API over their keywords, and the
+	// `filtered` each status carries for the filters it matches
+	[Trait("Category", "Integration")]
+	public sealed class MastodonFiltersTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static Task<ApiAnswer> Create(Mastodon owner, string title, string action, params (string Keyword, bool WholeWord)[] keywords) =>
+			owner.Client.Json(HttpMethod.Post, "/api/v2/filters", new JsonObject
+			{
+				["title"] = title,
+				["context"] = new JsonArray("home", "public", "thread"),
+				["filter_action"] = action,
+				["keywords_attributes"] = new JsonArray(keywords.Select(k => (JsonNode)new JsonObject { ["keyword"] = k.Keyword, ["whole_word"] = k.WholeWord }).ToArray())
+			});
+
+		[Fact]
+		public async Task A_filter_is_made_changed_and_deleted_by_its_owner_only()
+		{
+			var alice = await _host.Mastodon("alice");
+			var mallory = await _host.Mastodon("mallory");
+
+			var made = (await Create(alice, "Spoilers", "hide", ("spoiler", true), ("leak", false))).Ok().Object;
+			var id = made.Text("id");
+			Assert.Equal("hide", made.Text("filter_action"));
+			Assert.Equal(new[] { "home", "public", "thread" }, made["context"]!.AsArray().Select(c => c!.GetValue<string>()));
+			var keywords = made["keywords"]!.AsArray();
+			Assert.Equal(new[] { "spoiler", "leak" }, keywords.Select(k => k.Text("keyword")));
+			Assert.Equal(new[] { true, false }, keywords.Select(k => k!.Flag("whole_word")));
+			Assert.Null(made["expires_at"]);
+
+			var changed = (await alice.Client.Json(HttpMethod.Put, $"/api/v2/filters/{id}", new JsonObject
+			{
+				["title"] = "Leaks",
+				["filter_action"] = "warn",
+				["expires_in"] = 3600,
+				["keywords_attributes"] = new JsonArray(
+					new JsonObject { ["id"] = keywords[0].Text("id"), ["_destroy"] = true },
+					new JsonObject { ["keyword"] = "ending" })
+			})).Ok().Object;
+			Assert.Equal("Leaks", changed.Text("title"));
+			Assert.Equal("warn", changed.Text("filter_action"));
+			Assert.NotNull(changed.Text("expires_at"));
+			Assert.Equal(new[] { "leak", "ending" }, changed["keywords"]!.AsArray().Select(k => k.Text("keyword")));
+
+			var added = (await alice.Client.Post($"/api/v2/filters/{id}/keywords", ("keyword", "finale"), ("whole_word", "false"))).Ok().Object;
+			Assert.False(added.Flag("whole_word"));
+			var keywordId = added.Text("id");
+			Assert.Equal("finale", (await alice.Client.Get($"/api/v2/filters/keywords/{keywordId}")).Ok().Object.Text("keyword"));
+			Assert.Equal("last scene", (await alice.Client.Put($"/api/v2/filters/keywords/{keywordId}", ("keyword", "last scene"))).Ok().Object.Text("keyword"));
+			(await alice.Client.Delete($"/api/v2/filters/keywords/{keywordId}")).Ok();
+			Assert.Equal(2, (await alice.Client.Get($"/api/v2/filters/{id}/keywords")).Ok().Array.Count);
+
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await Create(alice, " ", "warn", ("x", true))).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await Create(alice, "x", "explode", ("x", true))).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post("/api/v2/filters", ("title", "x"), ("context[]", "everywhere"))).Status);
+			Assert.Empty((await mallory.Client.Get("/api/v2/filters")).Ok().Array);
+			Assert.Equal(HttpStatusCode.NotFound, (await mallory.Client.Get($"/api/v2/filters/{id}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await mallory.Client.Delete($"/api/v2/filters/keywords/{changed["keywords"]![0].Text("id")}")).Status);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().Get("/api/v2/filters")).Status);
+
+			(await alice.Client.Delete($"/api/v2/filters/{id}")).Ok();
+			Assert.Empty((await alice.Client.Get("/api/v2/filters")).Ok().Array);
+		}
+
+		[Fact]
+		public async Task Statuses_carry_the_filters_they_match_by_word_and_by_id()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			(await bob.Client.Post($"/api/v1/accounts/{alice.Id}/follow")).Ok();
+			var filterId = (await Create(alice, "Spoilers", "warn", ("spoiler", true), ("#tv", true))).Ok().Object.Text("id");
+			var other = (await Create(bob, "Not mine", "hide", ("spoiler", false))).Ok().Object.Text("id");
+			var whole = (await alice.Status("a big SPOILER ahead")).Text("id");
+			var partial = (await alice.Status("spoilers galore")).Text("id");
+			var tagged = (await alice.Status("watching #TV tonight")).Text("id");
+			var plain = (await alice.Status("nothing to see")).Text("id");
+			var warned = (await alice.Status("calm text", ("spoiler_text", "spoiler inside"))).Text("id");
+			var byId = (await alice.Client.Post($"/api/v2/filters/{filterId}/statuses", ("status_id", plain))).Ok().Object;
+			Assert.Equal(plain, byId.Text("status_id"));
+			var boost = (await bob.Client.Post($"/api/v1/statuses/{whole}/reblog")).Ok().Object.Text("id");
+
+			var home = (await alice.Client.Get("/api/v1/timelines/home?limit=40")).Ok().Array.ToDictionary(s => s.Text("id"), s => s!["filtered"]!.AsArray());
+			var match = Assert.Single(home[whole]);
+			Assert.Equal(filterId, match!["filter"].Text("id"));
+			Assert.Equal("warn", match["filter"].Text("filter_action"));
+			Assert.Equal(new[] { "spoiler" }, match["keyword_matches"]!.AsArray().Select(k => k!.GetValue<string>()));
+			Assert.Empty(home[partial]);
+			Assert.Equal(new[] { "#tv" }, Assert.Single(home[tagged])!["keyword_matches"]!.AsArray().Select(k => k!.GetValue<string>()));
+			Assert.Equal(new[] { byId.Text("id") }, Assert.Single(home[plain])!["status_matches"]!.AsArray().Select(k => k!.GetValue<string>()));
+			Assert.Single(home[warned]);
+			Assert.Single((await alice.Client.Get($"/api/v1/statuses/{boost}")).Ok().Body["filtered"]!.AsArray());
+
+			var asBob = (await bob.Client.Get($"/api/v1/statuses/{partial}")).Ok().Body["filtered"]!.AsArray();
+			Assert.Equal(other, Assert.Single(asBob)!["filter"].Text("id"));
+			Assert.Empty((await _host.Client().Get($"/api/v1/statuses/{whole}")).Ok().Body["filtered"]!.AsArray());
+
+			// an expired filter matches nothing
+			await DB.Default.Update<PersonaFilter>().MatchID(filterId).Modify(f => f.ExpiresAt, DateTime.UtcNow.AddMinutes(-1)).ExecuteAsync(Token);
+			Assert.Empty((await alice.Client.Get($"/api/v1/statuses/{whole}")).Ok().Body["filtered"]!.AsArray());
+		}
+
+		[Fact]
+		public async Task Keywords_come_as_form_fields_listed_or_numbered()
+		{
+			var alice = await _host.Mastodon("alice");
+
+			var listed = (await alice.Client.Post("/api/v2/filters", ("title", "Listed"), ("context[]", "home"),
+				("keywords_attributes[][keyword]", "one"), ("keywords_attributes[][whole_word]", "false"),
+				("keywords_attributes[][keyword]", "two"), ("keywords_attributes[][whole_word]", "true"))).Ok().Object;
+			Assert.Equal(new[] { ("one", false), ("two", true) },
+				listed["keywords"]!.AsArray().Select(k => (k.Text("keyword"), k!.Flag("whole_word"))));
+
+			var numbered = (await alice.Client.Post("/api/v2/filters", ("title", "Numbered"), ("context[]", "public"),
+				("keywords_attributes[1][keyword]", "second"), ("keywords_attributes[0][keyword]", "first"),
+				("keywords_attributes[0][whole_word]", "false"))).Ok().Object;
+			Assert.Equal(new[] { ("first", false), ("second", true) },
+				numbered["keywords"]!.AsArray().Select(k => (k.Text("keyword"), k!.Flag("whole_word"))));
+		}
+
+		[Fact]
+		public async Task A_v1_filter_is_one_keyword_of_a_v2_filter()
+		{
+			var alice = await _host.Mastodon("alice");
+
+			var made = (await alice.Client.Post("/api/v1/filters", ("phrase", "election"), ("context[]", "home"), ("context[]", "notifications"),
+				("irreversible", "true"), ("whole_word", "false"))).Ok().Object;
+			var id = made.Text("id");
+			Assert.Equal("election", made.Text("phrase"));
+			Assert.True(made.Flag("irreversible"));
+			Assert.False(made.Flag("whole_word"));
+			var v2 = Assert.Single((await alice.Client.Get("/api/v2/filters")).Ok().Array)!;
+			Assert.Equal("election", v2.Text("title"));
+			Assert.Equal("hide", v2.Text("filter_action"));
+			Assert.Equal(id, Assert.Single(v2["keywords"]!.AsArray()).Text("id"));
+
+			var changed = (await alice.Client.Put($"/api/v1/filters/{id}", ("phrase", "elections"), ("irreversible", "false"))).Ok().Object;
+			Assert.Equal("elections", changed.Text("phrase"));
+			Assert.False(changed.Flag("irreversible"));
+			Assert.Equal(new[] { id }, (await alice.Client.Get("/api/v1/filters")).Ok().Ids);
+			Assert.Equal("elections", (await alice.Client.Get($"/api/v1/filters/{id}")).Ok().Object.Text("phrase"));
+
+			(await alice.Client.Delete($"/api/v1/filters/{id}")).Ok();
+			Assert.Empty((await alice.Client.Get("/api/v2/filters")).Ok().Array);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Get($"/api/v1/filters/{id}")).Status);
+		}
+	}
+}

PrivaPub.Tests/Http/MastodonInstanceTests.cs

@@ -0,0 +1,131 @@
+using PrivaPub.Api.Mastodon.Controllers;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class MastodonInstanceTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		[Fact]
+		public async Task Both_instance_documents_advertise_mastodon_4_2_and_the_domain()
+		{
+			var anonymous = _host.Client();
+
+			var v1 = (await anonymous.Get("/api/v1/instance")).Ok();
+			Assert.Equal("4.2.0 (compatible; PrivaPub)", v1.Body.Text("version"));
+			Assert.Equal(InstanceController.Version, v1.Body.Text("version"));
+			Assert.Equal(PrivaPubHost.Host, v1.Body.Text("uri"));
+			Assert.True(v1.Body.Flag("registrations"));
+			Assert.True(v1.Body.Flag("invites_enabled"));
+			Assert.True(v1.Body["stats"].Number("user_count") >= 0);
+			Assert.Equal(5000, v1.Body["configuration"]!["statuses"].Number("max_characters"));
+			Assert.Equal(4, v1.Body["configuration"]!["polls"].Number("max_options"));
+			Assert.Contains("image/jpeg", v1.Body["configuration"]!["media_attachments"]!["supported_mime_types"]!.AsArray().Select(t => t!.GetValue<string>()));
+			Assert.Empty(v1.Body["rules"]!.AsArray());
+			Assert.Null(v1.Body["contact_account"]);
+			Assert.True(v1.Body.AsObject().ContainsKey("contact_account"));
+
+			var v2 = (await anonymous.Get("/api/v2/instance")).Ok();
+			Assert.Equal(InstanceController.Version, v2.Body.Text("version"));
+			Assert.Equal(PrivaPubHost.Host, v2.Body.Text("domain"));
+			Assert.Equal($"wss://{PrivaPubHost.Host}", v2.Body["configuration"]!["urls"]!.Text("streaming"));
+			Assert.Equal($"wss://{PrivaPubHost.Host}", v1.Body["urls"]!.Text("streaming_api"));
+			Assert.Equal(PrivaPub.Api.Mastodon.Controllers.StatusesController.MaxPins, v2.Body["configuration"]!["accounts"].Number("max_pinned_statuses"));
+			Assert.Contains("image/avif", v2.Body["configuration"]!["media_attachments"]!["supported_mime_types"]!.AsArray().Select(t => t!.GetValue<string>()));
+			// what the bundled libvips can't decode is not offered
+			Assert.DoesNotContain("image/heic", v2.Body["configuration"]!["media_attachments"]!["supported_mime_types"]!.AsArray().Select(t => t!.GetValue<string>()));
+			Assert.True(v2.Body["registrations"].Flag("enabled"));
+			Assert.True((await anonymous.Get("/nodeinfo/2.1")).Ok().Body.Flag("openRegistrations"));
+			Assert.False(v2.Body["configuration"]!["translation"].Flag("enabled"));
+			Assert.Equal(7, v2.Body["api_versions"].Number("mastodon"));
+
+			var signedIn = await _host.Mastodon("reader");
+			Assert.Equal(InstanceController.Version, (await signedIn.Client.Get("/api/v1/instance")).Ok().Body.Text("version"));
+		}
+
+		[Fact]
+		public async Task The_instance_side_routes_answer_without_a_login()
+		{
+			var anonymous = _host.Client();
+
+			Assert.Empty((await anonymous.Get("/api/v1/instance/peers")).Ok().Array);
+			Assert.Empty((await anonymous.Get("/api/v1/instance/activity")).Ok().Array);
+			Assert.Empty((await anonymous.Get("/api/v1/instance/rules")).Ok().Array);
+			var extended = (await anonymous.Get("/api/v1/instance/extended_description")).Ok();
+			Assert.StartsWith("<p>", extended.Body.Text("content"));
+			Assert.EndsWith("T00:00:00.000Z", extended.Body.Text("updated_at"));
+		}
+
+		[Theory]
+		[InlineData("/api/v1/custom_emojis")]
+		[InlineData("/api/v1/announcements")]
+		public async Task Public_stub_routes_answer_empty_lists_to_anyone(string path)
+		{
+			Assert.Empty((await _host.Client().Get(path)).Ok().Array);
+		}
+
+		[Theory]
+		[InlineData("/api/v1/suggestions")]
+		[InlineData("/api/v2/suggestions")]
+		[InlineData("/api/v1/endorsements")]
+		[InlineData("/api/v1/featured_tags")]
+		public async Task Signed_in_stub_routes_answer_empty_lists(string path)
+		{
+			var reader = await _host.Mastodon("reader");
+
+			Assert.Empty((await reader.Client.Get(path)).Ok().Array);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().Get(path)).Status);
+		}
+
+		[Fact]
+		public async Task Apps_are_registered_validated_and_verified()
+		{
+			var anonymous = _host.Client();
+
+			var app = (await anonymous.Post("/api/v1/apps", ("client_name", "tusky-ish"), ("redirect_uris", "urn:ietf:wg:oauth:2.0:oob"), ("scopes", "read write"),
+				("website", "https://example.com"))).Ok();
+
+			Assert.Equal("tusky-ish", app.Body.Text("name"));
+			Assert.Equal(new[] { "read", "write" }, app.Body["scopes"]!.AsArray().Select(s => s!.GetValue<string>()));
+			Assert.False(string.IsNullOrEmpty(app.Body.Text("client_id")));
+			Assert.False(string.IsNullOrEmpty(app.Body.Text("client_secret")));
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await anonymous.Post("/api/v1/apps", ("redirect_uris", "urn:ietf:wg:oauth:2.0:oob"))).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await anonymous.Post("/api/v1/apps", ("client_name", "x"), ("redirect_uris", "javascript:alert(1)"))).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await anonymous.Post("/api/v1/apps", ("client_name", "x"))).Status);
+
+			var reader = await _host.Mastodon("reader");
+			var verified = (await reader.Client.Get("/api/v1/apps/verify_credentials")).Ok();
+			Assert.Equal("privapub-tests", verified.Body.Text("name"));
+			Assert.Equal(HttpStatusCode.Unauthorized, (await anonymous.Get("/api/v1/apps/verify_credentials")).Status);
+		}
+
+		[Fact]
+		public async Task Preferences_follow_the_persona_and_push_has_no_subscription()
+		{
+			var reader = await _host.Mastodon("reader", scopes: "read write follow push");
+			(await reader.Client.Patch("/api/v1/accounts/update_credentials", ("source[privacy]", "unlisted"), ("source[sensitive]", "true"))).Ok();
+
+			var preferences = (await reader.Client.Get("/api/v1/preferences")).Ok();
+
+			Assert.Equal("unlisted", preferences.Body.Text("posting:default:visibility"));
+			Assert.True(preferences.Body.Flag("posting:default:sensitive"));
+			Assert.False(preferences.Body.Flag("reading:expand:spoilers"));
+			var push = await reader.Client.Get("/api/v1/push/subscription");
+			Assert.Equal(HttpStatusCode.NotFound, push.Status);
+			Assert.Equal("Record not found", push.Body.Text("error"));
+		}
+	}
+}

PrivaPub.Tests/Http/MastodonListsTests.cs

@@ -0,0 +1,179 @@
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+
+namespace PrivaPub.Tests.Http
+{
+	// Mastodon's lists: a persona's own groups of accounts it follows, read as timelines, never federated
+	[Trait("Category", "Integration")]
+	public sealed class MastodonListsTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static async Task Follow(Mastodon follower, Mastodon target) =>
+			(await follower.Client.Post($"/api/v1/accounts/{target.Id}/follow")).Ok();
+
+		static async Task<string> List(Mastodon owner, string title, params (string Key, string Value)[] more) =>
+			(await owner.Client.Post("/api/v1/lists", more.Prepend(("title", title)).ToArray())).Ok().Object.Text("id");
+
+		[Fact]
+		public async Task A_list_is_created_renamed_and_deleted_by_its_owner_only()
+		{
+			var alice = await _host.Mastodon("alice");
+			var mallory = await _host.Mastodon("mallory");
+
+			var created = (await alice.Client.Post("/api/v1/lists", ("title", "Friends"), ("replies_policy", "followed"), ("exclusive", "true"))).Ok().Object;
+			var id = created.Text("id");
+			Assert.Equal("Friends", created.Text("title"));
+			Assert.Equal("followed", created.Text("replies_policy"));
+			Assert.True(created.Flag("exclusive"));
+			var other = await List(alice, "Art");
+
+			Assert.Equal(new[] { other, id }, (await alice.Client.Get("/api/v1/lists")).Ok().Ids);
+			var renamed = (await alice.Client.Put($"/api/v1/lists/{id}", ("title", "Close friends"), ("exclusive", "false"))).Ok().Object;
+			Assert.Equal("Close friends", renamed.Text("title"));
+			Assert.Equal("followed", renamed.Text("replies_policy"));
+			Assert.False(renamed.Flag("exclusive"));
+			Assert.Equal("Close friends", (await alice.Client.Get($"/api/v1/lists/{id}")).Ok().Object.Text("title"));
+
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post("/api/v1/lists", ("title", " "))).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post("/api/v1/lists", ("title", "x"), ("replies_policy", "everyone"))).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Put($"/api/v1/lists/{id}", ("title", ""))).Status);
+			Assert.Empty((await mallory.Client.Get("/api/v1/lists")).Ok().Array);
+			Assert.Equal(HttpStatusCode.NotFound, (await mallory.Client.Get($"/api/v1/lists/{id}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await mallory.Client.Put($"/api/v1/lists/{id}", ("title", "mine"))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await mallory.Client.Delete($"/api/v1/lists/{id}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await mallory.Client.Get($"/api/v1/timelines/list/{id}")).Status);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().Get("/api/v1/lists")).Status);
+
+			(await alice.Client.Delete($"/api/v1/lists/{id}")).Ok();
+			Assert.Equal(new[] { other }, (await alice.Client.Get("/api/v1/lists")).Ok().Ids);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Get($"/api/v1/lists/{id}")).Status);
+		}
+
+		[Fact]
+		public async Task Only_followed_accounts_join_a_list_and_its_timeline_shows_their_posts()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var carol = await _host.Mastodon("carol");
+			var dave = await _host.Mastodon("dave");
+			await Follow(alice, bob);
+			await Follow(alice, dave);
+			var list = await List(alice, "Bob");
+
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post($"/api/v1/lists/{list}/accounts", ("account_ids[]", carol.Id))).Status);
+			(await alice.Client.Post($"/api/v1/lists/{list}/accounts", ("account_ids[]", bob.Id))).Ok();
+			(await alice.Client.Post($"/api/v1/lists/{list}/accounts", ("account_ids[]", bob.Id))).Ok();
+			Assert.Equal(new[] { bob.Id }, (await alice.Client.Get($"/api/v1/lists/{list}/accounts")).Ok().Ids);
+			Assert.Equal(new[] { list }, (await alice.Client.Get($"/api/v1/accounts/{bob.Id}/lists")).Ok().Ids);
+			Assert.Empty((await alice.Client.Get($"/api/v1/accounts/{dave.Id}/lists")).Ok().Array);
+
+			var fromBob = (await bob.Status("from bob")).Text("id");
+			await dave.Status("from dave");
+			await carol.Status("from carol");
+			Assert.Equal(new[] { fromBob }, (await alice.Client.Get($"/api/v1/timelines/list/{list}")).Ok().Ids);
+
+			(await alice.Client.Delete($"/api/v1/lists/{list}/accounts", ("account_ids[]", bob.Id))).Ok();
+			Assert.Empty((await alice.Client.Get($"/api/v1/lists/{list}/accounts")).Ok().Array);
+			Assert.Empty((await alice.Client.Get($"/api/v1/timelines/list/{list}")).Ok().Array);
+		}
+
+		[Theory]
+		[InlineData("list", true, false, false)]
+		[InlineData("followed", true, true, false)]
+		[InlineData("none", true, false, false)]
+		public async Task A_lists_replies_follow_its_policy(string policy, bool toSelf, bool toFollowed, bool toStranger)
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var dave = await _host.Mastodon("dave");
+			var carol = await _host.Mastodon("carol");
+			await Follow(alice, bob);
+			await Follow(alice, dave);
+			var list = await List(alice, "Bob", ("replies_policy", policy));
+			(await alice.Client.Post($"/api/v1/lists/{list}/accounts", ("account_ids[]", bob.Id))).Ok();
+			var root = (await bob.Status("a thread")).Text("id");
+			var mine = (await alice.Status("asking bob")).Text("id");
+			var ofDave = (await dave.Status("dave's")).Text("id");
+			var ofCarol = (await carol.Status("carol's")).Text("id");
+
+			var self = (await bob.Status("and more", ("in_reply_to_id", root))).Text("id");
+			var toAlice = (await bob.Status($"@{alice.UserName} answered", ("in_reply_to_id", mine))).Text("id");
+			var toDave = (await bob.Status($"@{dave.UserName} agreed", ("in_reply_to_id", ofDave))).Text("id");
+			var toCarol = (await bob.Status($"@{carol.UserName} hm", ("in_reply_to_id", ofCarol))).Text("id");
+
+			var shown = (await alice.Client.Get($"/api/v1/timelines/list/{list}")).Ok().Ids.ToList();
+			Assert.Contains(root, shown);
+			Assert.Equal(toSelf, shown.Contains(self));
+			Assert.Contains(toAlice, shown);
+			Assert.Equal(toFollowed, shown.Contains(toDave));
+			Assert.Equal(toStranger, shown.Contains(toCarol));
+		}
+
+		[Fact]
+		public async Task An_exclusive_lists_members_are_read_there_and_not_at_home()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var dave = await _host.Mastodon("dave");
+			await Follow(alice, bob);
+			await Follow(alice, dave);
+			var list = await List(alice, "Apart", ("exclusive", "true"));
+			(await alice.Client.Post($"/api/v1/lists/{list}/accounts", ("account_ids[]", bob.Id))).Ok();
+			var fromBob = (await bob.Status("from bob")).Text("id");
+			var fromDave = (await dave.Status("from dave")).Text("id");
+
+			var home = (await alice.Client.Get("/api/v1/timelines/home")).Ok().Ids.ToList();
+			Assert.Contains(fromDave, home);
+			Assert.DoesNotContain(fromBob, home);
+			Assert.Equal(new[] { fromBob }, (await alice.Client.Get($"/api/v1/timelines/list/{list}")).Ok().Ids);
+
+			(await alice.Client.Put($"/api/v1/lists/{list}", ("exclusive", "false"))).Ok();
+			Assert.Contains(fromBob, (await alice.Client.Get("/api/v1/timelines/home")).Ok().Ids);
+		}
+
+		[Fact]
+		public async Task Account_search_with_following_finds_only_followed_accounts()
+		{
+			var alice = await _host.Mastodon("alice");
+			var prefix = $"ls{Guid.NewGuid():N}"[..10];
+			var followed = await _host.Mastodon(prefix + "a");
+			var stranger = await _host.Mastodon(prefix + "b");
+			await Follow(alice, followed);
+
+			var found = (await alice.Client.Get($"/api/v1/accounts/search?q={prefix}&following=true")).Ok().Ids.ToList();
+			Assert.Equal(new[] { followed.Id }, found);
+			Assert.Contains(stranger.Id, (await alice.Client.Get($"/api/v1/accounts/search?q={prefix}")).Ok().Ids);
+			Assert.Empty((await stranger.Client.Get($"/api/v1/accounts/search?q={prefix}&following=true")).Ok().Array);
+		}
+
+		[Fact]
+		public async Task An_unfollowed_account_leaves_the_personas_lists_and_does_not_come_back_with_a_new_follow()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			await Follow(alice, bob);
+			var list = await List(alice, "Bob", ("exclusive", "true"));
+			(await alice.Client.Post($"/api/v1/lists/{list}/accounts", ("account_ids[]", bob.Id))).Ok();
+
+			(await alice.Client.Post($"/api/v1/accounts/{bob.Id}/unfollow")).Ok();
+			Assert.Empty((await alice.Client.Get($"/api/v1/lists/{list}/accounts")).Ok().Array);
+			Assert.Empty((await alice.Client.Get($"/api/v1/accounts/{bob.Id}/lists")).Ok().Array);
+
+			await Follow(alice, bob);
+			var fromBob = (await bob.Status("back again")).Text("id");
+			Assert.Contains(fromBob, (await alice.Client.Get("/api/v1/timelines/home")).Ok().Ids);
+			Assert.Empty((await alice.Client.Get($"/api/v1/lists/{list}/accounts")).Ok().Array);
+		}
+	}
+}

PrivaPub.Tests/Http/MastodonMediaTests.cs

@@ -0,0 +1,504 @@
+using PrivaPub.Models.Jobs;
+using PrivaPub.Domain.Media;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Diagnostics;
+using System.Net;
+using System.Net.Http.Headers;
+using System.Text;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class MastodonMediaTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		// what GET /api/v1/media/:id answers once the job processing an upload sent to v2 has run
+		async Task<ApiAnswer> Processed(Mastodon account, ApiAnswer accepted)
+		{
+			var id = accepted.Body.Text("id");
+			await _host.Run(j => j.Kind == JobKind.ProcessMedia && j.Payload == id, Token);
+			return await account.Client.Get($"/api/v1/media/{id}");
+		}
+
+		static Task<ApiAnswer> Upload(Mastodon account, string path, byte[] bytes, string contentType, string fileName, params (string Key, string Value)[] fields)
+		{
+			var form = MastodonHelpers.Multipart(("file", bytes, contentType, fileName));
+			foreach (var (key, value) in fields)
+				form.Add(new StringContent(value), key);
+			return account.Client.Exchange(new HttpRequestMessage(HttpMethod.Post, path) { Content = form });
+		}
+
+		static async Task<(int ExitCode, string Output)> Run(string program, params string[] arguments)
+		{
+			var start = new ProcessStartInfo(program) { RedirectStandardOutput = true, RedirectStandardError = true };
+			foreach (var argument in arguments)
+				start.ArgumentList.Add(argument);
+			try
+			{
+				using var process = Process.Start(start)!;
+				var output = process.StandardOutput.ReadToEndAsync(Token);
+				var errors = process.StandardError.ReadToEndAsync(Token);
+				await process.WaitForExitAsync(Token);
+				return (process.ExitCode, await output + await errors);
+			}
+			catch (System.ComponentModel.Win32Exception)
+			{
+				return (-1, $"{program} is not installed");
+			}
+		}
+
+		static async Task<byte[]> Made(string extension, params string[] arguments)
+		{
+			if ((await Run("ffmpeg", "-version")).ExitCode != 0 || (await Run("ffprobe", "-version")).ExitCode != 0)
+				Assert.Skip("ffmpeg and ffprobe are needed to make and inspect audio and video");
+			var path = Path.Combine(Path.GetTempPath(), $"privapub-av-{Guid.NewGuid():N}.{extension}");
+			try
+			{
+				var (exitCode, output) = await Run("ffmpeg", arguments.Append(path).Prepend("-nostdin").Prepend("-y").ToArray());
+				Assert.True(exitCode == 0, output);
+				return await File.ReadAllBytesAsync(path, Token);
+			}
+			finally
+			{
+				File.Delete(path);
+			}
+		}
+
+		async Task<string> Probe(string url)
+		{
+			var path = Path.Combine(Path.GetTempPath(), $"privapub-probe-{Guid.NewGuid():N}");
+			try
+			{
+				await File.WriteAllBytesAsync(path, await _host.Client().GetByteArrayAsync(url, Token), Token);
+				var (exitCode, output) = await Run("ffprobe", "-v", "quiet", "-print_format", "json", "-show_format", "-show_streams", path);
+				Assert.Equal(0, exitCode);
+				return output;
+			}
+			finally
+			{
+				File.Delete(path);
+			}
+		}
+
+		[Theory]
+		[InlineData("/api/v1/media")]
+		[InlineData("/api/v2/media")]
+		public async Task Images_upload_with_their_description_and_focus_and_without_their_metadata(string route)
+		{
+			var alice = await _host.Mastodon("alice");
+
+			var uploaded = (await Upload(alice, route, MastodonHelpers.JpegWithMetadata(640, 480), "image/jpeg", "holiday.jpg",
+				("description", "a blue square"), ("focus", "0.5,-0.25"))).Ok();
+
+			Assert.Equal("image", uploaded.Body.Text("type"));
+			Assert.Equal("a blue square", uploaded.Body.Text("description"));
+			Assert.Equal(640, uploaded.Body["meta"]!["original"].Number("width"));
+			Assert.Equal(480, uploaded.Body["meta"]!["original"].Number("height"));
+			Assert.Equal(0.5, uploaded.Body["meta"]!["focus"]!["x"]!.GetValue<double>());
+			Assert.Equal(-0.25, uploaded.Body["meta"]!["focus"]!["y"]!.GetValue<double>());
+			Assert.False(string.IsNullOrEmpty(uploaded.Body.Text("blurhash")));
+			Assert.Null(uploaded.Body.Text("remote_url"));
+			foreach (var field in new[] { "url", "preview_url" })
+			{
+				Assert.StartsWith($"{PrivaPubHost.Base}/media/files/", uploaded.Body.Text(field));
+				MastodonHelpers.AssertNoMetadata(await _host.Client().GetByteArrayAsync(uploaded.Body.Text(field), Token));
+			}
+		}
+
+		[Fact]
+		public async Task Media_is_read_and_described_only_by_its_owner()
+		{
+			var alice = await _host.Mastodon("alice");
+			var mallory = await _host.Mastodon("mallory");
+			var id = (await Upload(alice, "/api/v2/media", MastodonHelpers.JpegWithMetadata(32, 32), "image/jpeg", "a.jpg")).Ok().Body.Text("id");
+
+			Assert.Equal(id, (await alice.Client.Get($"/api/v1/media/{id}")).Ok().Body.Text("id"));
+			Assert.Equal(HttpStatusCode.NotFound, (await mallory.Client.Get($"/api/v1/media/{id}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await mallory.Client.Put($"/api/v1/media/{id}", ("description", "mine now"))).Status);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().Get($"/api/v1/media/{id}")).Status);
+
+			var described = (await alice.Client.Put($"/api/v1/media/{id}", ("description", "  a tiny square  "), ("focus", "2,-3"))).Ok();
+
+			Assert.Equal("a tiny square", described.Body.Text("description"));
+			Assert.Equal((1.0, -1.0), (described.Body["meta"]!["focus"]!["x"]!.GetValue<double>(), described.Body["meta"]!["focus"]!["y"]!.GetValue<double>()));
+			Assert.Equal("a tiny square", (await alice.Client.Get($"/api/v1/media/{id}")).Ok().Body.Text("description"));
+			Assert.Null((await alice.Client.Put($"/api/v1/media/{id}", ("description", ""))).Ok().Body.Text("description"));
+		}
+
+		// a focal point is two finite numbers: NaN or Infinity is ignored, never stored (it broke every timeline holding the post)
+		[Fact]
+		public async Task A_focal_point_that_is_not_a_number_is_ignored()
+		{
+			var alice = await _host.Mastodon("alice");
+			var uploaded = (await Upload(alice, "/api/v2/media", MastodonHelpers.JpegWithMetadata(32, 32), "image/jpeg", "a.jpg", ("focus", "NaN,NaN"))).Ok();
+			Assert.Null(uploaded.Body["meta"]?["focus"]);
+			var id = uploaded.Body.Text("id");
+
+			(await alice.Client.Put($"/api/v1/media/{id}", ("focus", "0.5,0.25"))).Ok();
+			foreach (var unsound in new[] { "NaN,0", "Infinity,1", "0,-Infinity" })
+			{
+				var focus = (await alice.Client.Put($"/api/v1/media/{id}", ("focus", unsound))).Ok().Body["meta"]!["focus"]!;
+				Assert.Equal((0.5, 0.25), (focus["x"]!.GetValue<double>(), focus["y"]!.GetValue<double>()));
+			}
+			var status = (await alice.Client.Post("/api/v1/statuses", ("status", "focused"), ("media_ids[]", id))).Ok();
+			Assert.Equal(0.5, status.Body["media_attachments"]![0]!["meta"]!["focus"]!["x"]!.GetValue<double>());
+		}
+
+		[Fact]
+		public async Task Unsupported_unreadable_and_missing_files_are_refused_with_422()
+		{
+			var alice = await _host.Mastodon("alice");
+
+			var text = await Upload(alice, "/api/v2/media", Encoding.UTF8.GetBytes("hello"), "text/plain", "a.txt");
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, text.Status);
+			Assert.Contains("not supported", text.Body.Text("error"));
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await Upload(alice, "/api/v2/media", Encoding.UTF8.GetBytes("not a jpeg"), "image/jpeg", "a.jpg")).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await Upload(alice, "/api/v1/media", Encoding.UTF8.GetBytes("not a video"), "video/mp4", "a.mp4")).Status);
+			// sent to v2, it is taken, then refused once processed
+			var later = await Upload(alice, "/api/v2/media", Encoding.UTF8.GetBytes("not a video"), "video/mp4", "a.mp4");
+			Assert.Equal(HttpStatusCode.Accepted, later.Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await Processed(alice, later)).Status);
+			var empty = new MultipartFormDataContent { { new StringContent("no file"), "description" } };
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Exchange(new HttpRequestMessage(HttpMethod.Post, "/api/v2/media") { Content = empty })).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post("/api/v1/media")).Status);
+		}
+
+		// refused before anything is decoded: an SVG claiming to be a PNG, and an image that would decode to too many pixels
+		[Fact]
+		public async Task An_image_that_is_not_one_or_too_large_is_refused_before_decoding()
+		{
+			var alice = await _host.Mastodon("alice");
+			var svg = "<svg xmlns='http://www.w3.org/2000/svg' width='30000' height='30000'><rect width='1' height='1'/></svg>"u8.ToArray();
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await Upload(alice, "/api/v2/media", svg, "image/png", "a.png")).Status);
+
+			using var huge = NetVips.Image.Black(8000, 6000);
+			var tooLarge = await Upload(alice, "/api/v2/media", huge.WriteToBuffer(".png"), "image/png", "huge.png");
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, tooLarge.Status);
+			Assert.Contains("too large", tooLarge.Body.Text("error"));
+		}
+
+		// an animated GIF becomes what Mastodon makes of one, a looping mp4 typed gifv; a still GIF stays an image
+		[Fact]
+		public async Task An_animated_gif_becomes_a_gifv_and_a_still_one_an_image()
+		{
+			var alice = await _host.Mastodon("alice");
+			using var frame = (NetVips.Image.Black(64, 48, bands: 3) + 60).Cast(NetVips.Enums.BandFormat.Uchar);
+			using var frames = NetVips.Image.Arrayjoin(new[] { frame, frame + 80, frame + 160 }, across: 1).Cast(NetVips.Enums.BandFormat.Uchar);
+			using var animated = frames.Mutate(m => m.Set(NetVips.GValue.GIntType, "page-height", 48));
+
+			var gifv = (await Upload(alice, "/api/v2/media", animated.WriteToBuffer(".gif"), "image/gif", "dance.gif")).Ok();
+			Assert.Equal("gifv", gifv.Body.Text("type"));
+			Assert.EndsWith(".mp4", gifv.Body.Text("url"));
+			Assert.Equal(64, gifv.Body["meta"]!["original"]!["width"]!.GetValue<int>());
+			var status = (await alice.Client.Post("/api/v1/statuses", ("status", "dancing"), ("media_ids[]", gifv.Body.Text("id")))).Ok();
+			Assert.Equal("gifv", status.Body["media_attachments"]![0]!.Text("type"));
+
+			var still = (await Upload(alice, "/api/v2/media", frame.WriteToBuffer(".gif"), "image/gif", "still.gif")).Ok();
+			Assert.Equal("image", still.Body.Text("type"));
+		}
+
+		[Fact]
+		public async Task Video_is_remuxed_without_its_metadata()
+		{
+			var alice = await _host.Mastodon("alice");
+			var video = await Made("mp4", "-f", "lavfi", "-i", "testsrc=duration=1:size=320x240:rate=10", "-f", "lavfi", "-i", "sine=frequency=440:duration=1",
+				"-metadata", "title=secret title", "-metadata", "comment=filmed at home", "-metadata:s:v:0", "handler_name=hidden handler",
+				"-c:v", "mpeg4", "-c:a", "aac", "-shortest");
+			Assert.Contains("secret title", Encoding.Latin1.GetString(video));
+
+			// v2 answers before it is processed: 202, no url yet, and it can't be posted until it is
+			var accepted = await Upload(alice, "/api/v2/media", video, "video/mp4", "clip.mp4");
+			Assert.Equal(HttpStatusCode.Accepted, accepted.Status);
+			Assert.Null(accepted.Body["url"]);
+			Assert.Equal(HttpStatusCode.PartialContent, (await alice.Client.Get($"/api/v1/media/{accepted.Body.Text("id")}")).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post("/api/v1/statuses", ("status", "too soon"), ("media_ids[]", accepted.Body.Text("id")))).Status);
+			var uploaded = (await Processed(alice, accepted)).Ok();
+
+			Assert.Equal("video", uploaded.Body.Text("type"));
+			Assert.Equal(320, uploaded.Body["meta"]!["original"].Number("width"));
+			Assert.EndsWith(".mp4", uploaded.Body.Text("url"));
+			Assert.EndsWith(".jpg", uploaded.Body.Text("preview_url"));
+			var probe = await Probe(uploaded.Body.Text("url"));
+			Assert.Contains("\"codec_type\": \"video\"", probe);
+			// MPEG-4 Part 2, which browsers don't play, made H.264
+			Assert.Contains("\"codec_name\": \"h264\"", probe);
+			Assert.DoesNotContain("secret title", probe);
+			Assert.DoesNotContain("filmed at home", probe);
+			Assert.DoesNotContain("hidden handler", probe);
+		}
+
+		[Fact]
+		public async Task Audio_is_remuxed_without_its_metadata()
+		{
+			var alice = await _host.Mastodon("alice");
+			var audio = await Made("m4a", "-f", "lavfi", "-i", "sine=frequency=330:duration=1", "-metadata", "title=secret song", "-metadata", "artist=Alice Smith",
+				"-c:a", "aac");
+
+			// v1 waits for it
+			var uploaded = (await Upload(alice, "/api/v1/media", audio, "audio/mp4", "song.m4a")).Ok();
+
+			Assert.Equal("audio", uploaded.Body.Text("type"));
+			var probe = await Probe(uploaded.Body.Text("url"));
+			Assert.Contains("\"codec_type\": \"audio\"", probe);
+			Assert.DoesNotContain("secret song", probe);
+			Assert.DoesNotContain("Alice Smith", probe);
+		}
+
+		// FLAC is served as what it is (ASP.NET's map has no entry for it, so it was a 404)
+		[Fact]
+		public async Task Flac_is_served()
+		{
+			var alice = await _host.Mastodon("alice");
+			var flac = await Made("flac", "-f", "lavfi", "-i", "sine=frequency=500:duration=1", "-c:a", "flac");
+
+			var uploaded = (await Upload(alice, "/api/v1/media", flac, "audio/flac", "song.flac")).Ok();
+
+			var served = await _host.Client().GetAsync(new Uri(uploaded.Body.Text("url")).PathAndQuery, Token);
+			Assert.Equal(HttpStatusCode.OK, served.StatusCode);
+			Assert.Equal("audio/flac", served.Content.Headers.ContentType?.MediaType);
+		}
+
+		// a video larger than video_matrix_limit is made smaller, its shape kept
+		[Fact]
+		public async Task A_video_larger_than_the_limit_is_made_smaller()
+		{
+			var alice = await _host.Mastodon("alice");
+			var video = await Made("mp4", "-f", "lavfi", "-i", "testsrc=duration=1:size=2000x1500:rate=5", "-c:v", "libx264", "-preset", "ultrafast", "-pix_fmt", "yuv420p");
+
+			var uploaded = (await Upload(alice, "/api/v1/media", video, "video/mp4", "big.mp4")).Ok();
+
+			var width = uploaded.Body["meta"]!["original"].Number("width");
+			var height = uploaded.Body["meta"]!["original"].Number("height");
+			Assert.True((long)width * height <= 2_304_000, $"{width}x{height}");
+			Assert.InRange((double)width / height, 1.3, 1.37);
+		}
+
+		static byte[] Bytes(int length)
+		{
+			var bytes = new byte[length];
+			Random.Shared.NextBytes(bytes);
+			return bytes;
+		}
+
+		string Served(byte[] bytes, string contentType = "video/mp4")
+		{
+			var path = $"/media/{Guid.NewGuid():N}.bin";
+			_peer.ServeFile(path, bytes, contentType);
+			return _peer.A + path;
+		}
+
+		static HttpRequestMessage Ranged(string url, long from, long to)
+		{
+			var request = new HttpRequestMessage(HttpMethod.Get, url);
+			request.Headers.Range = new RangeHeaderValue(from, to);
+			return request;
+		}
+
+		[Fact]
+		public async Task Every_remote_media_address_the_api_returns_goes_through_the_proxy()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var document = bob.Document();
+			document["icon"] = new JsonObject { ["type"] = "Image", ["url"] = _peer.A + "/avatar.png" };
+			document["image"] = new JsonObject { ["type"] = "Image", ["url"] = _peer.A + "/header.png" };
+			_peer.Serve($"/users/{bob.Name}", document.ToJsonString());
+			var bobId = (await _host.Known(bob)).ID;
+			var post = await _host.PublicPostFrom(bob, alice, "<p>look :blob:</p>", note =>
+			{
+				note["attachment"] = new JsonArray(new JsonObject
+				{
+					["type"] = "Document", ["mediaType"] = "image/png", ["url"] = _peer.A + "/picture.png", ["name"] = "a picture"
+				});
+				note["tag"]!.AsArray().Add(new JsonObject
+				{
+					["type"] = "Emoji", ["name"] = ":blob:", ["icon"] = new JsonObject { ["type"] = "Image", ["url"] = _peer.A + "/blob.png" }
+				});
+			});
+			var proxied = $"{PrivaPubHost.Base}/media/proxy/";
+
+			var account = (await alice.Client.Get($"/api/v1/accounts/{bobId}")).Ok().Body;
+			var status = (await alice.Client.Get($"/api/v1/statuses/{post.ID}")).Ok().Body;
+
+			foreach (var field in new[] { "avatar", "avatar_static", "header", "header_static" })
+				Assert.StartsWith(proxied, account.Text(field));
+			Assert.StartsWith(proxied, status["account"].Text("avatar"));
+			var attachment = Assert.Single(status["media_attachments"]!.AsArray());
+			Assert.StartsWith(proxied, attachment.Text("url"));
+			Assert.StartsWith(proxied, attachment.Text("preview_url"));
+			Assert.Equal(_peer.A + "/picture.png", attachment.Text("remote_url"));
+			Assert.Equal("a picture", attachment.Text("description"));
+			Assert.StartsWith(proxied, Assert.Single(status["emojis"]!.AsArray()).Text("url"));
+			var everything = account.ToJsonString() + status.ToJsonString();
+			foreach (var file in new[] { "/avatar.png", "/header.png", "/blob.png" })
+				Assert.DoesNotContain(_peer.A + file, everything);
+		}
+
+		[Fact]
+		public async Task The_proxy_refuses_a_url_it_did_not_sign()
+		{
+			var proxy = _host.Get<IMediaProxy>();
+			var remote = Served(Bytes(100));
+			var wrapped = proxy.Wrap(remote);
+			var parts = new Uri(wrapped).AbsolutePath.Split('/');
+			var other = new Uri(proxy.Wrap(Served(Bytes(100)))).AbsolutePath.Split('/');
+			using var client = _host.Client();
+
+			Assert.StartsWith($"{PrivaPubHost.Base}/media/proxy/", wrapped);
+			Assert.Equal(HttpStatusCode.NotFound, (await client.GetAsync($"/media/proxy/AAAAAAAAAAAAAAAAAAAAAA/{parts[^1]}", Token)).StatusCode);
+			Assert.Equal(HttpStatusCode.NotFound, (await client.GetAsync($"/media/proxy/{parts[^2]}/{other[^1]}", Token)).StatusCode);
+			Assert.Equal(HttpStatusCode.NotFound, (await client.GetAsync($"/media/proxy/{parts[^2]}/!!!", Token)).StatusCode);
+			Assert.Empty(_peer.Requests);
+			Assert.Equal($"{PrivaPubHost.Base}/media/files/a.jpg", proxy.Wrap($"{PrivaPubHost.Base}/media/files/a.jpg"));
+		}
+
+		[Fact]
+		public async Task A_ranged_request_is_streamed_as_206_and_never_cached()
+		{
+			var proxy = _host.Get<IMediaProxy>();
+			var bytes = Bytes(10_000);
+			var remote = Served(bytes);
+			using var client = _host.Client();
+
+			using var response = await client.SendAsync(Ranged(proxy.Wrap(remote), 100, 199), Token);
+
+			Assert.Equal(HttpStatusCode.PartialContent, response.StatusCode);
+			Assert.Equal("bytes 100-199/10000", response.Content.Headers.ContentRange!.ToString());
+			Assert.Equal(bytes[100..200], await response.Content.ReadAsByteArrayAsync(Token));
+			Assert.Equal("nosniff", response.Headers.GetValues("X-Content-Type-Options").Single());
+			Assert.Equal(default, proxy.Cached(remote));
+			using var again = await client.SendAsync(Ranged(proxy.Wrap(remote), 0, 9), Token);
+			Assert.Equal(bytes[..10], await again.Content.ReadAsByteArrayAsync(Token));
+			Assert.Equal(2, _peer.Requests.Count);
+			Assert.All(_peer.Requests, r => Assert.StartsWith("bytes=", r.Headers["Range"]));
+		}
+
+		[Fact]
+		public async Task A_whole_download_is_cached_and_then_served_with_ranges()
+		{
+			var proxy = _host.Get<IMediaProxy>();
+			var bytes = Bytes(5_000);
+			var remote = Served(bytes, "image/png");
+			using var client = _host.Client();
+
+			using var whole = await client.GetAsync(proxy.Wrap(remote), Token);
+
+			Assert.Equal(HttpStatusCode.OK, whole.StatusCode);
+			Assert.Equal("image/png", whole.Content.Headers.ContentType!.MediaType);
+			Assert.Equal(bytes, await whole.Content.ReadAsByteArrayAsync(Token));
+			Assert.NotNull(proxy.Cached(remote).Path);
+			using var part = await client.SendAsync(Ranged(proxy.Wrap(remote), 10, 19), Token);
+			Assert.Equal(HttpStatusCode.PartialContent, part.StatusCode);
+			Assert.Equal(bytes[10..20], await part.Content.ReadAsByteArrayAsync(Token));
+			using var cached = await client.GetAsync(proxy.Wrap(remote), Token);
+			Assert.Equal(bytes, await cached.Content.ReadAsByteArrayAsync(Token));
+			Assert.Single(_peer.Requests);
+		}
+
+		// clients asking at once for a file not cached yet share one download
+		[Fact]
+		public async Task Clients_asking_at_once_share_one_download()
+		{
+			var proxy = _host.Get<IMediaProxy>();
+			var bytes = Bytes(200_000);
+			var remote = Served(bytes, "image/png");
+			var path = new Uri(remote).AbsolutePath;
+			using var client = _host.Client();
+
+			var answers = await Task.WhenAll(Enumerable.Range(0, 5).Select(_ => client.GetAsync(proxy.Wrap(remote), Token)));
+
+			foreach (var answer in answers)
+				Assert.Equal(bytes, await answer.Content.ReadAsByteArrayAsync(Token));
+			Assert.Single(_peer.Requests, r => r.Path == path);
+		}
+
+		// a remote file that can't be had is a 404 no browser keeps
+		[Fact]
+		public async Task A_remote_file_that_fails_is_not_cached_by_browsers()
+		{
+			var proxy = _host.Get<IMediaProxy>();
+			using var client = _host.Client();
+
+			using var missing = await client.GetAsync(proxy.Wrap($"{_peer.A}/media/{Guid.NewGuid():N}.png"), Token);
+
+			Assert.Equal(HttpStatusCode.NotFound, missing.StatusCode);
+			Assert.Null(missing.Headers.CacheControl);
+		}
+
+		[Fact]
+		public async Task Anything_over_the_proxy_limit_is_streamed_and_never_cached()
+		{
+			var host = await SmallProxyHost.Shared();
+			var proxy = host.Get<IMediaProxy>();
+			var bytes = Bytes(SmallProxyHost.Limit * 4);
+			var remote = Served(bytes);
+			using var client = host.Client();
+
+			using var response = await client.GetAsync(proxy.Wrap(remote), Token);
+
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			Assert.Equal(bytes.Length, response.Content.Headers.ContentLength);
+			Assert.Equal(bytes, await response.Content.ReadAsByteArrayAsync(Token));
+			Assert.Equal(default, proxy.Cached(remote));
+			using var again = await client.GetAsync(proxy.Wrap(remote), Token);
+			Assert.Equal(bytes, await again.Content.ReadAsByteArrayAsync(Token));
+			// the first time, an attempt to cache it and the stream; then it is known to be too big, and only streamed
+			Assert.Equal(3, _peer.Requests.Count);
+			var small = Served(Bytes(SmallProxyHost.Limit / 2));
+			using (var fits = await client.GetAsync(proxy.Wrap(small), Token))
+				Assert.Equal(HttpStatusCode.OK, fits.StatusCode);
+			Assert.NotNull(proxy.Cached(small).Path);
+		}
+	}
+
+	public sealed class SmallProxyHost : PrivaPubHost
+	{
+		public const int Limit = 16 * 1024;
+
+		static readonly SemaphoreSlim Boot = new(1, 1);
+		static SmallProxyHost _shared;
+
+		public static new async Task<SmallProxyHost> Shared()
+		{
+			await PrivaPubHost.Shared();
+			await Boot.WaitAsync();
+			try
+			{
+				if (_shared == default)
+				{
+					var host = new SmallProxyHost();
+					_ = host.Services;
+					_shared = host;
+				}
+				return _shared;
+			}
+			finally
+			{
+				Boot.Release();
+			}
+		}
+
+		protected override IEnumerable<KeyValuePair<string, string>> Settings() =>
+			base.Settings().Append(new KeyValuePair<string, string>("Media:MaxProxiedBytes", Limit.ToString(System.Globalization.CultureInfo.InvariantCulture)));
+	}
+}

PrivaPub.Tests/Http/MastodonScheduledStatusesTests.cs

@@ -0,0 +1,158 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Media;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+
+namespace PrivaPub.Tests.Http
+{
+	// Mastodon's scheduled statuses: a post given a scheduled_at waits as asked, can be moved or dropped, and is
+	// published by its job when its time comes
+	[Trait("Category", "Integration")]
+	public sealed class MastodonScheduledStatusesTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static string In(TimeSpan from) => DateTime.UtcNow.Add(from).ToString("o");
+
+		[Fact]
+		public async Task A_scheduled_post_waits_is_moved_and_is_dropped_by_its_owner_only()
+		{
+			var alice = await _host.Mastodon("alice");
+			var mallory = await _host.Mastodon("mallory");
+
+			var scheduled = (await alice.Client.Post("/api/v1/statuses", ("status", "later, friends"), ("visibility", "unlisted"),
+				("spoiler_text", "soon"), ("scheduled_at", In(TimeSpan.FromMinutes(30))))).Ok().Object;
+			var id = scheduled.Text("id");
+			Assert.Null(scheduled["uri"]);
+			Assert.Equal("later, friends", scheduled["params"].Text("text"));
+			Assert.Equal("unlisted", scheduled["params"].Text("visibility"));
+			Assert.Equal("soon", scheduled["params"].Text("spoiler_text"));
+			Assert.Empty((await alice.Client.Get($"/api/v1/accounts/{alice.Id}/statuses")).Ok().Array);
+			Assert.Equal(new[] { id }, (await alice.Client.Get("/api/v1/scheduled_statuses")).Ok().Ids);
+
+			var later = DateTime.UtcNow.AddHours(2);
+			var moved = (await alice.Client.Put($"/api/v1/scheduled_statuses/{id}", ("scheduled_at", later.ToString("o")))).Ok().Object;
+			Assert.Equal(later.ToString("yyyy-MM-ddTHH:mm"), moved.Text("scheduled_at")[..16]);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity,
+				(await alice.Client.Put($"/api/v1/scheduled_statuses/{id}", ("scheduled_at", In(TimeSpan.FromMinutes(2))))).Status);
+
+			Assert.Equal(HttpStatusCode.UnprocessableEntity,
+				(await alice.Client.Post("/api/v1/statuses", ("status", "too soon"), ("scheduled_at", In(TimeSpan.FromMinutes(1))))).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity,
+				(await alice.Client.Post("/api/v1/statuses", ("status", " "), ("scheduled_at", In(TimeSpan.FromHours(1))))).Status);
+			Assert.Empty((await mallory.Client.Get("/api/v1/scheduled_statuses")).Ok().Array);
+			Assert.Equal(HttpStatusCode.NotFound, (await mallory.Client.Get($"/api/v1/scheduled_statuses/{id}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await mallory.Client.Delete($"/api/v1/scheduled_statuses/{id}")).Status);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().Get("/api/v1/scheduled_statuses")).Status);
+
+			(await alice.Client.Delete($"/api/v1/scheduled_statuses/{id}")).Ok();
+			Assert.Empty((await alice.Client.Get("/api/v1/scheduled_statuses")).Ok().Array);
+			await DB.Default.Update<Job>().Match(j => j.Kind == JobKind.PublishScheduled && j.Payload == id)
+				.Modify(j => j.RunAt, DateTime.UtcNow).ExecuteAsync(Token);
+			await _host.Run(j => j.Kind == JobKind.PublishScheduled && j.Payload == id, Token);
+			Assert.Empty((await alice.Client.Get($"/api/v1/accounts/{alice.Id}/statuses")).Ok().Array);
+		}
+
+		[Fact]
+		public async Task A_scheduled_post_is_published_with_its_media_when_its_time_comes()
+		{
+			var alice = await _host.Mastodon("alice");
+			var upload = MastodonHelpers.Multipart(("file", MastodonHelpers.JpegWithMetadata(16, 16), "image/jpeg", "a.jpg"));
+			var mediaId = (await alice.Client.Exchange(new HttpRequestMessage(HttpMethod.Post, "/api/v2/media") { Content = upload })).Ok().Body.Text("id");
+
+			var id = (await alice.Client.Post("/api/v1/statuses", ("status", "on time"), ("media_ids[]", mediaId), ("poll[options][]", "yes"),
+				("poll[options][]", "no"), ("poll[expires_in]", "3600"), ("scheduled_at", In(TimeSpan.FromMinutes(10))))).Ok().Object.Text("id");
+			Assert.Equal(id, (await DB.Default.Find<MediaAttachment>().MatchID(mediaId).ExecuteFirstAsync(Token)).ScheduledStatusId);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post("/api/v1/statuses", ("status", "same media"), ("media_ids[]", mediaId),
+				("scheduled_at", In(TimeSpan.FromMinutes(20))))).Status);
+
+			// not due yet: its job leaves it waiting
+			Assert.Equal(1, await _host.Run(j => j.Kind == JobKind.PublishScheduled && j.Payload == id, Token));
+			Assert.Single((await alice.Client.Get("/api/v1/scheduled_statuses")).Ok().Array);
+
+			// its time comes (moved into the past, as the clock would have it)
+			await DB.Default.Update<ScheduledStatus>().MatchID(id).Modify(s => s.ScheduledAt, DateTime.UtcNow.AddSeconds(-1)).ExecuteAsync(Token);
+			await DB.Default.Update<Job>().Match(j => j.Kind == JobKind.PublishScheduled && j.Payload == id).Modify(j => j.State, JobState.Pending).ExecuteAsync(Token);
+			await _host.Run(j => j.Kind == JobKind.PublishScheduled && j.Payload == id, Token);
+
+			Assert.Empty((await alice.Client.Get("/api/v1/scheduled_statuses")).Ok().Array);
+			var published = Assert.Single((await alice.Client.Get($"/api/v1/accounts/{alice.Id}/statuses")).Ok().Array)!;
+			Assert.Contains("on time", published.Text("content"));
+			Assert.Equal(mediaId, Assert.Single(published["media_attachments"]!.AsArray()).Text("id"));
+			Assert.Equal(2, published["poll"]!["options"]!.AsArray().Count);
+			var media = await DB.Default.Find<MediaAttachment>().MatchID(mediaId).ExecuteFirstAsync(Token);
+			Assert.Equal(published.Text("id"), media.PostId);
+			Assert.Null(media.ScheduledStatusId);
+		}
+
+		async Task<string> Picture(Mastodon account)
+		{
+			var upload = MastodonHelpers.Multipart(("file", MastodonHelpers.JpegWithMetadata(16, 16), "image/jpeg", "a.jpg"));
+			return (await account.Client.Exchange(new HttpRequestMessage(HttpMethod.Post, "/api/v2/media") { Content = upload })).Ok().Body.Text("id");
+		}
+
+		// a scheduled post's media are its alone: a post now, or an edit, can't take them
+		[Fact]
+		public async Task A_scheduled_posts_media_cannot_be_taken_by_a_post_now()
+		{
+			var alice = await _host.Mastodon("alice");
+			var mediaId = await Picture(alice);
+			(await alice.Client.Post("/api/v1/statuses", ("status", "later"), ("media_ids[]", mediaId), ("scheduled_at", In(TimeSpan.FromMinutes(10))))).Ok();
+
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post("/api/v1/statuses", ("status", "now"), ("media_ids[]", mediaId))).Status);
+			var plain = (await alice.Client.Post("/api/v1/statuses", ("status", "plain"))).Ok().Body.Text("id");
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Put($"/api/v1/statuses/{plain}", ("status", "edited"), ("media_ids[]", mediaId))).Status);
+			var media = await DB.Default.Find<MediaAttachment>().OneAsync(mediaId, Token);
+			Assert.Null(media.PostId);
+			Assert.NotNull(media.ScheduledStatusId);
+		}
+
+		// two posts asking for the same upload at once: exactly one gets it
+		[Fact]
+		public async Task Two_posts_racing_for_one_upload_never_both_get_it()
+		{
+			var alice = await _host.Mastodon("alice");
+			for (var round = 0; round < 5; round++)
+			{
+				var mediaId = await Picture(alice);
+				var answers = await Task.WhenAll(Enumerable.Range(0, 2).Select(i =>
+					alice.Client.Post("/api/v1/statuses", ("status", $"race {round} {i}"), ("media_ids[]", mediaId))));
+				Assert.Single(answers, a => a.Status == HttpStatusCode.OK);
+				Assert.Single(answers, a => a.Status == HttpStatusCode.UnprocessableEntity);
+			}
+		}
+
+		// a persona deleted since it scheduled a post publishes nothing, and what the post held is trashed
+		[Fact]
+		public async Task A_gone_personas_scheduled_post_never_publishes()
+		{
+			var gone = await _host.Mastodon($"gone{Guid.NewGuid():N}"[..12]);
+			var mediaId = await Picture(gone);
+			var id = (await gone.Client.Post("/api/v1/statuses", ("status", "from beyond"), ("media_ids[]", mediaId), ("scheduled_at", In(TimeSpan.FromMinutes(10))))).Ok().Object.Text("id");
+			await DB.Default.Update<Models.User.Avatar>().MatchID(gone.Persona.Id).Modify(a => a.DeletionAt, DateTime.UtcNow).ExecuteAsync(Token);
+
+			await DB.Default.Update<ScheduledStatus>().MatchID(id).Modify(s => s.ScheduledAt, DateTime.UtcNow.AddSeconds(-1)).ExecuteAsync(Token);
+			await DB.Default.Update<Job>().Match(j => j.Kind == JobKind.PublishScheduled && j.Payload == id).Modify(j => j.RunAt, DateTime.UtcNow).ExecuteAsync(Token);
+			await _host.Run(j => j.Kind == JobKind.PublishScheduled && j.Payload == id, Token);
+
+			Assert.False(await DB.Default.Find<Models.Post.Post>().Match(p => p.GroupUserId == gone.Persona.Id && p.Text == "from beyond").ExecuteAnyAsync(Token));
+			Assert.False(await DB.Default.Find<ScheduledStatus>().Match(s => s.ID == id).ExecuteAnyAsync(Token));
+			Assert.NotNull((await DB.Default.Find<MediaAttachment>().OneAsync(mediaId, Token)).TrashedAt);
+		}
+	}
+}

PrivaPub.Tests/Http/MastodonStatusesTests.cs

@@ -0,0 +1,728 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class MastodonStatusesTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		static IEnumerable<string> Strings(JsonNode node) => node!.AsArray().Select(n => n!.GetValue<string>());
+
+		static async Task<JsonObject> Image(Mastodon account) =>
+			(await account.Client.Exchange(new HttpRequestMessage(HttpMethod.Post, "/api/v1/media")
+			{
+				Content = MastodonHelpers.Multipart(("file", MastodonHelpers.JpegWithMetadata(80, 60), "image/jpeg", "a.jpg"))
+			})).Ok().Object;
+
+		[Fact]
+		public async Task Each_visibility_is_addressed_the_way_mastodon_addresses_it()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var carol = new RemoteActor(_peer, "carol");
+			await _host.FollowedBy(alice, bob);
+			_peer.WebFinger(carol);
+			var followers = alice.Uri + "/groupies";
+
+			var open = await alice.Status("for everyone");
+			var unlisted = await alice.Status("quietly public", ("visibility", "unlisted"));
+			var quiet = await alice.Status("for followers", ("visibility", "private"));
+			var direct = await alice.Status($"@{carol.Handle()} just you", ("visibility", "direct"));
+
+			Assert.Equal(new[] { "public", "unlisted", "private", "direct" }, new[] { open, unlisted, quiet, direct }.Select(s => s.Text("visibility")));
+			var creates = (await bob.Delivered(since)).Where(d => d.Type() == "Create").ToDictionary(d => d["object"].Text("id"));
+			Assert.Equal(3, creates.Count);
+			var publicNote = creates[open.Text("uri")]["object"];
+			Assert.Equal(new[] { MastodonHelpers.Public }, Strings(publicNote["to"]));
+			Assert.Equal(new[] { followers }, Strings(publicNote["cc"]));
+			var unlistedNote = creates[unlisted.Text("uri")]["object"];
+			Assert.Equal(new[] { followers }, Strings(unlistedNote["to"]));
+			Assert.Equal(new[] { MastodonHelpers.Public }, Strings(unlistedNote["cc"]));
+			var quietNote = creates[quiet.Text("uri")]["object"];
+			Assert.Equal(new[] { followers }, Strings(quietNote["to"]));
+			// named again in cc: Pleroma and Akkoma read an empty cc without a "/followers" address as a direct message
+			Assert.Equal(new[] { followers }, Strings(quietNote["cc"]));
+			var whisper = Assert.Single(await carol.Delivered(since));
+			Assert.Equal(direct.Text("uri"), whisper["object"].Text("id"));
+			Assert.Equal(new[] { carol.Id }, Strings(whisper["object"]!["to"]));
+			Assert.Empty(whisper["object"]!["cc"]!.AsArray());
+			Assert.Equal(carol.Handle(), Assert.Single(direct["mentions"]!.AsArray()).Text("acct"));
+		}
+
+		[Fact]
+		public async Task A_content_warning_is_kept_as_spoiler_text_and_federates_as_a_summary()
+		{
+			var alice = await _host.Mastodon("alice");
+
+			var warned = await alice.Status("the butler did it", ("spoiler_text", "spoilers"));
+
+			Assert.True(warned.Flag("sensitive"));
+			Assert.Equal("spoilers", warned.Text("spoiler_text"));
+			var note = (await _host.ActivityPub($"/peasants/{alice.UserName}/scribbles/{warned.Text("id")}")).Ok().Body;
+			Assert.Equal("spoilers", note.Text("summary"));
+			Assert.True(note.Flag("sensitive"));
+			Assert.Contains("the butler did it", note.Text("content"));
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post("/api/v1/statuses", ("status", " "))).Status);
+		}
+
+		[Fact]
+		public async Task A_reply_to_a_local_post_threads_counts_and_shows_in_the_context()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var root = await alice.Status("what do you think?");
+
+			var reply = await bob.Status("I agree", ("in_reply_to_id", root.Text("id")));
+			var nested = await alice.Status("thanks", ("in_reply_to_id", reply.Text("id")));
+
+			Assert.Equal(root.Text("id"), reply.Text("in_reply_to_id"));
+			Assert.Equal(alice.Id, reply.Text("in_reply_to_account_id"));
+			Assert.Equal(1, (await bob.Client.Get($"/api/v1/statuses/{root.Text("id")}")).Ok().Body.Number("replies_count"));
+			var context = (await _host.Client().Get($"/api/v1/statuses/{reply.Text("id")}/context")).Ok();
+			Assert.Equal(new[] { root.Text("id") }, context.Body["ancestors"]!.AsArray().Select(s => s.Text("id")));
+			Assert.Equal(new[] { nested.Text("id") }, context.Body["descendants"]!.AsArray().Select(s => s.Text("id")));
+			var whole = (await alice.Client.Get($"/api/v1/statuses/{root.Text("id")}/context")).Ok();
+			Assert.Equal(new[] { reply.Text("id"), nested.Text("id") }, whole.Body["descendants"]!.AsArray().Select(s => s.Text("id")));
+			Assert.Equal(HttpStatusCode.NotFound, (await bob.Client.Post("/api/v1/statuses", ("status", "lost"), ("in_reply_to_id", "000000000000000000000000"))).Status);
+		}
+
+		[Fact]
+		public async Task A_reply_to_a_remote_post_mentions_its_author_and_reaches_its_inbox()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			_peer.WebFinger(bob);
+			var parent = await _host.PublicPostFrom(bob, alice);
+			var bobId = (await _host.Known(bob)).ID;
+
+			var reply = await alice.Status($"@{bob.Handle()} well said", ("in_reply_to_id", parent.ID));
+
+			Assert.Equal(parent.ID, reply.Text("in_reply_to_id"));
+			Assert.Equal(bobId, reply.Text("in_reply_to_account_id"));
+			var mention = Assert.Single(reply["mentions"]!.AsArray());
+			Assert.Equal((bobId, bob.Handle()), (mention.Text("id"), mention.Text("acct")));
+			var create = Assert.Single(await bob.Delivered(since), d => d.Type() == "Create");
+			var note = create["object"]!;
+			Assert.Equal(parent.ObjectURI, note.Text("inReplyTo"));
+			Assert.Contains(bob.Id, Strings(note["cc"]));
+			Assert.Contains(note["tag"]!.AsArray(), t => t.Text("type") == "Mention" && t.Text("href") == bob.Id);
+			Assert.Equal(1, (await alice.Client.Get($"/api/v1/statuses/{parent.ID}")).Ok().Body.Number("replies_count"));
+		}
+
+		// a remote thread opened by a persona has its replies read from its server (here its FEP-7888 context), at most hourly
+		[Fact]
+		public async Task Opening_a_remote_thread_reads_the_replies_that_never_reached_us()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var carol = new RemoteActor(_peer, "carol");
+			var context = $"{bob.Origin()}/contexts/{Guid.NewGuid():N}";
+			var post = await _host.PublicPostFrom(bob, alice, shape: note => note["context"] = context);
+			var answer = carol.Create("<p>said elsewhere</p>", new[] { MastodonHelpers.Public }, new[] { carol.Id + "/followers" },
+				note => note["inReplyTo"] = post.ObjectURI)["object"]!;
+			var answerId = answer["id"]!.GetValue<string>();
+			_peer.Serve(new Uri(answerId).AbsolutePath, answer.ToJsonString());
+			_peer.Serve(new Uri(context).AbsolutePath, new JsonObject
+			{
+				["id"] = context, ["type"] = "OrderedCollection", ["orderedItems"] = new JsonArray(post.ObjectURI, answerId)
+			}.ToJsonString());
+			async Task<int> Queued() => (await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.FetchReplies && j.Payload.Contains(post.ID)).ExecuteAsync(token)).Count;
+
+			(await _host.Client().Get($"/api/v1/statuses/{post.ID}/context")).Ok();
+			Assert.Equal(0, await Queued());
+			Assert.Empty((await alice.Client.Get($"/api/v1/statuses/{post.ID}/context")).Ok().Body["descendants"]!.AsArray());
+			Assert.Equal(1, await _host.Run(j => j.Kind == JobKind.FetchReplies && j.Payload.Contains(post.ID), token));
+
+			var descendants = (await alice.Client.Get($"/api/v1/statuses/{post.ID}/context")).Ok().Body["descendants"]!.AsArray();
+			Assert.Equal(answerId, Assert.Single(descendants).Text("uri"));
+			Assert.Equal(1, await Queued());
+		}
+
+		// Akkoma marks a post with sensitive media "sensitive" and leaves its summary empty: the media is hidden, the words are
+		// not, and no warning is made up for them (found by decePub's e2e tests on the town)
+		[Fact]
+		public async Task A_remote_post_sensitive_without_a_summary_hides_its_media_and_not_its_words()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			_peer.WebFinger(bob);
+			var post = await _host.PublicPostFrom(bob, alice, shape: note => { note["sensitive"] = true; note["summary"] = ""; });
+
+			var status = (await alice.Client.Get($"/api/v1/statuses/{post.ID}")).Ok().Body;
+
+			Assert.True(status["sensitive"]!.GetValue<bool>());
+			Assert.Equal("", status.Text("spoiler_text"));
+		}
+
+		// a status asked for by id is shown even when the viewer blocked or muted its author, as Mastodon shows it: only lists
+		// leave such posts out (it once answered 200 with null, and decePub's thread page showed nothing)
+		[Fact]
+		public async Task A_status_of_an_author_the_viewer_blocked_is_still_shown_by_its_id()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			_peer.WebFinger(bob);
+			var post = await _host.PublicPostFrom(bob, alice);
+			var bobId = (await _host.Known(bob)).ID;
+			(await alice.Client.Post($"/api/v1/accounts/{bobId}/block")).Ok();
+
+			var status = (await alice.Client.Get($"/api/v1/statuses/{post.ID}")).Ok().Body;
+
+			Assert.Equal(post.ID, status.Text("id"));
+		}
+
+		// a reader who deletes the @name decePub prefills still answers its author: GoToSocial dropped such a reply, addressed
+		// to nobody there (found by decePub's e2e tests on the town)
+		[Fact]
+		public async Task A_reply_without_the_authors_name_still_names_the_author_in_cc()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			_peer.WebFinger(bob);
+			var parent = await _host.PublicPostFrom(bob, alice);
+
+			var reply = await alice.Status("no name in this one", ("in_reply_to_id", parent.ID));
+
+			Assert.Empty(reply["mentions"]!.AsArray());
+			var create = Assert.Single(await bob.Delivered(since), d => d.Type() == "Create");
+			Assert.Contains(bob.Id, Strings(create["object"]!["cc"]));
+		}
+
+		[Fact]
+		public async Task A_poll_is_created_validated_and_federated_as_a_question()
+		{
+			var alice = await _host.Mastodon("alice");
+
+			var status = await alice.Status("tea or coffee?", ("poll[options][]", "tea"), ("poll[options][]", "coffee"), ("poll[expires_in]", "600"),
+				("poll[multiple]", "true"));
+
+			var poll = status["poll"]!;
+			Assert.Equal(new[] { "tea", "coffee" }, poll["options"]!.AsArray().Select(o => o.Text("title")));
+			Assert.True(poll.Flag("multiple"));
+			Assert.False(poll.Flag("expired"));
+			Assert.NotNull(poll.Text("expires_at"));
+			Assert.Equal(status.Text("id"), (await _host.Client().Get($"/api/v1/polls/{status.Text("id")}")).Ok().Body.Text("id"));
+			var question = (await _host.ActivityPub($"/peasants/{alice.UserName}/scribbles/{status.Text("id")}")).Ok().Body;
+			Assert.Equal("Question", question.Text("type"));
+			Assert.Equal(2, question["anyOf"]!.AsArray().Count);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post("/api/v1/statuses", ("status", "one?"), ("poll[options][]", "only"),
+				("poll[expires_in]", "600"))).Status);
+		}
+
+		[Fact]
+		public async Task Media_is_attached_only_by_its_owner()
+		{
+			var alice = await _host.Mastodon("alice");
+			var mallory = await _host.Mastodon("mallory");
+			var upload = await Image(alice);
+
+			var status = await alice.Status("look", ("media_ids[]", upload.Text("id")));
+
+			var attachment = Assert.Single(status["media_attachments"]!.AsArray());
+			Assert.Equal(upload.Text("id"), attachment.Text("id"));
+			Assert.Equal("image", attachment.Text("type"));
+			var note = (await _host.ActivityPub($"/peasants/{alice.UserName}/scribbles/{status.Text("id")}")).Ok().Body;
+			Assert.Equal(upload.Text("url"), Assert.Single(note["attachment"]!.AsArray()).Text("url"));
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await mallory.Client.Post("/api/v1/statuses", ("status", "mine"), ("media_ids[]", (await Image(alice)).Text("id")))).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post("/api/v1/statuses", ("status", "again"), ("media_ids[]", upload.Text("id")))).Status);
+		}
+
+		[Fact]
+		public async Task A_quote_of_a_local_post_is_accepted_listed_and_revocable()
+		{
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var original = await carol.Status("quote me");
+			var closed = await carol.Status("do not quote me", ("quote_approval_policy", "nobody"));
+
+			var quote = await alice.Status("so true", ("quoted_status_id", original.Text("id")));
+
+			Assert.Equal("accepted", quote["quote"].Text("state"));
+			Assert.Equal(original.Text("id"), quote["quote"]!["quoted_status"].Text("id"));
+			Assert.Equal(1, (await carol.Client.Get($"/api/v1/statuses/{original.Text("id")}")).Ok().Body.Number("quotes_count"));
+			Assert.Equal(new[] { quote.Text("id") }, (await _host.Client().Get($"/api/v1/statuses/{original.Text("id")}/quotes")).Ok().Ids);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post("/api/v1/statuses", ("status", "anyway"), ("quoted_status_id", closed.Text("id")))).Status);
+			Assert.Empty(closed["quote_approval"]!["automatic"]!.AsArray());
+
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Post($"/api/v1/statuses/{original.Text("id")}/quotes/{quote.Text("id")}/revoke")).Status);
+			var revoked = (await carol.Client.Post($"/api/v1/statuses/{original.Text("id")}/quotes/{quote.Text("id")}/revoke")).Ok();
+
+			Assert.Equal(quote.Text("id"), revoked.Body.Text("id"));
+			Assert.Equal("revoked", revoked.Body["quote"].Text("state"));
+			Assert.Empty((await carol.Client.Get($"/api/v1/statuses/{original.Text("id")}/quotes")).Ok().Array);
+			Assert.Equal(0, (await carol.Client.Get($"/api/v1/statuses/{original.Text("id")}")).Ok().Body.Number("quotes_count"));
+		}
+
+		[Fact]
+		public async Task An_edit_keeps_its_history_shows_its_source_and_federates_an_update()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var other = await _host.Mastodon("other");
+			var bob = new RemoteActor(_peer, "bob");
+			await _host.FollowedBy(alice, bob);
+			var status = await alice.Status("first version", ("spoiler_text", "cw"));
+			var id = status.Text("id");
+
+			var edited = (await alice.Client.Put($"/api/v1/statuses/{id}", ("status", "second version"))).Ok();
+
+			Assert.NotNull(edited.Body.Text("edited_at"));
+			Assert.Contains("second version", edited.Body.Text("content"));
+			Assert.Contains("second version", (await other.Client.Get($"/api/v1/statuses/{id}")).Ok().Body.Text("content"));
+			var history = (await _host.Client().Get($"/api/v1/statuses/{id}/history")).Ok().Array;
+			Assert.Equal(2, history.Count);
+			Assert.Contains("first version", history[0].Text("content"));
+			Assert.Equal("cw", history[0].Text("spoiler_text"));
+			Assert.Contains("second version", history[1].Text("content"));
+			Assert.Equal(alice.Id, history[1]!["account"].Text("id"));
+			var source = (await alice.Client.Get($"/api/v1/statuses/{id}/source")).Ok();
+			Assert.Equal(("second version", ""), (source.Body.Text("text"), source.Body.Text("spoiler_text")));
+			Assert.Equal(HttpStatusCode.NotFound, (await other.Client.Get($"/api/v1/statuses/{id}/source")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await other.Client.Put($"/api/v1/statuses/{id}", ("status", "hijacked"))).Status);
+			var update = Assert.Single(await bob.Delivered(since), d => d.Type() == "Update");
+			Assert.Equal(status.Text("uri"), update["object"].Text("id"));
+			Assert.Contains("second version", update["object"].Text("content"));
+		}
+
+		[Fact]
+		public async Task Delete_returns_the_text_for_a_redraft_and_leaves_a_tombstone()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var other = await _host.Mastodon("other");
+			var bob = new RemoteActor(_peer, "bob");
+			await _host.FollowedBy(alice, bob);
+			var status = await alice.Status("regrettable", ("spoiler_text", "hot take"));
+			var id = status.Text("id");
+			var scribble = $"/peasants/{alice.UserName}/scribbles/{id}";
+			Assert.Equal(HttpStatusCode.OK, (await _host.ActivityPub(scribble)).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await other.Client.Delete($"/api/v1/statuses/{id}")).Status);
+
+			var deleted = (await alice.Client.Delete($"/api/v1/statuses/{id}")).Ok();
+
+			Assert.Equal(id, deleted.Body.Text("id"));
+			Assert.Equal("regrettable", deleted.Body.Text("text"));
+			Assert.Equal("hot take", deleted.Body.Text("spoiler_text"));
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Get($"/api/v1/statuses/{id}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Delete($"/api/v1/statuses/{id}")).Status);
+			var tombstone = await _host.ActivityPub(scribble);
+			Assert.Equal(HttpStatusCode.Gone, tombstone.Status);
+			Assert.Equal("Tombstone", tombstone.Body.Text("type"));
+			Assert.Equal(status.Text("uri"), tombstone.Body.Text("id"));
+			var delete = Assert.Single(await bob.Delivered(since), d => d.Type() == "Delete");
+			Assert.Equal(status.Text("uri"), delete["object"].Text("id"));
+		}
+
+		[Fact]
+		public async Task Favourites_and_reblogs_count_and_federate_with_their_undos()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var bob = new RemoteActor(_peer, "bob");
+			var remote = await _host.PublicPostFrom(bob, alice);
+			var path = $"/api/v1/statuses/{remote.ID}";
+
+			var liked = (await alice.Client.Post(path + "/favourite")).Ok();
+			Assert.True(liked.Body.Flag("favourited"));
+			Assert.Equal(1, liked.Body.Number("favourites_count"));
+			Assert.Equal(new[] { alice.Id }, (await _host.Client().Get(path + "/favourited_by")).Ok().Ids);
+			Assert.Equal(1, (await alice.Client.Post(path + "/favourite")).Ok().Body.Number("favourites_count"));
+			var unliked = (await alice.Client.Post(path + "/unfavourite")).Ok();
+			Assert.False(unliked.Body.Flag("favourited"));
+			Assert.Equal(0, unliked.Body.Number("favourites_count"));
+
+			var reblog = (await alice.Client.Post(path + "/reblog")).Ok();
+			Assert.Equal(remote.ID, reblog.Body["reblog"].Text("id"));
+			Assert.True(reblog.Body["reblog"].Flag("reblogged"));
+			Assert.Equal(1, reblog.Body["reblog"].Number("reblogs_count"));
+			Assert.Equal(new[] { alice.Id }, (await carol.Client.Get(path + "/reblogged_by")).Ok().Ids);
+			var unreblogged = (await alice.Client.Post(path + "/unreblog")).Ok();
+			Assert.False(unreblogged.Body.Flag("reblogged"));
+			Assert.Equal(0, unreblogged.Body.Number("reblogs_count"));
+			Assert.Empty((await carol.Client.Get(path + "/reblogged_by")).Ok().Array);
+
+			var sent = await bob.Delivered(since);
+			var like = Assert.Single(sent, d => d.Type() == "Like");
+			Assert.Equal((alice.Uri, remote.ObjectURI), (like.Text("actor"), like.Text("object")));
+			var announce = Assert.Single(sent, d => d.Type() == "Announce");
+			Assert.Equal(remote.ObjectURI, announce.Text("object"));
+			var undos = sent.Where(d => d.Type() == "Undo").ToList();
+			Assert.Equal(new[] { "Announce", "Like" }, undos.Select(u => u["object"].Text("type")).Order());
+			Assert.Equal(like.Text("id"), undos.Single(u => u["object"].Text("type") == "Like")["object"].Text("id"));
+
+			var local = await carol.Status("a local one");
+			(await alice.Client.Post($"/api/v1/statuses/{local.Text("id")}/favourite")).Ok();
+			var notification = Assert.Single((await carol.Client.Get("/api/v1/notifications?types[]=favourite")).Ok().Array);
+			Assert.Equal((alice.Id, local.Text("id")), (notification["account"].Text("id"), notification["status"].Text("id")));
+			var quiet = await carol.Status("followers only", ("visibility", "private"));
+			(await alice.Client.Post($"/api/v1/accounts/{carol.Id}/follow")).Ok();
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post($"/api/v1/statuses/{quiet.Text("id")}/reblog")).Status);
+			Assert.True((await alice.Client.Post($"/api/v1/statuses/{quiet.Text("id")}/favourite")).Ok().Body.Flag("favourited"));
+		}
+
+		// a downvote is a Dislike, one vote a post: a downvote replaces the favourite and a favourite the downvote, each by its
+		// own activity alone; a vote on a post in a community goes to the community, which counts it, and to its author only
+		// when on another server
+		[Fact]
+		public async Task A_downvote_replaces_the_favourite_and_votes_reach_the_posts_community()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob", origin: _peer.B);
+			var community = new RemoteActor(_peer, "pies", type: "Group");
+			await _host.Get<PrivaPub.Federation.Actors.IRemoteActorService>().GetActor(community.Id, refresh: true, TestContext.Current.CancellationToken);
+			var remote = await _host.PublicPostFrom(bob, alice, shape: note => note["audience"] = community.Id);
+			var neighbour = new RemoteActor(_peer, "neighbour");
+			var nearby = await _host.PublicPostFrom(neighbour, alice, shape: note => note["audience"] = community.Id);
+			(await alice.Client.Post($"/api/v1/statuses/{nearby.ID}/favourite")).Ok();
+			Assert.Empty(await neighbour.Delivered(since));
+			var path = $"/api/v1/statuses/{remote.ID}";
+
+			(await alice.Client.Post(path + "/favourite")).Ok();
+			var down = (await alice.Client.Post(path + "/downvote")).Ok().Body;
+			Assert.False(down.Flag("favourited"));
+			Assert.Equal((0, 1, true), (down["privapub"]!["votes"].Number("up"), down["privapub"]!["votes"].Number("down"), down["privapub"]!["votes"].Flag("downvoted")));
+			Assert.Equal(1, (await alice.Client.Post(path + "/downvote")).Ok().Body["privapub"]!["votes"].Number("down"));
+			var up = (await alice.Client.Post(path + "/favourite")).Ok().Body;
+			Assert.Equal((true, 0, false), (up.Flag("favourited"), up["privapub"]!["votes"].Number("down"), up["privapub"]!["votes"].Flag("downvoted")));
+			Assert.Null((await _host.Client().Get(path)).Ok().Body["privapub"]!["votes"]!["downvoted"]);
+			(await alice.Client.Post(path + "/downvote")).Ok();
+			var none = (await alice.Client.Post(path + "/undownvote")).Ok().Body;
+			Assert.Equal((false, 0, 0), (none.Flag("favourited"), none.Number("favourites_count"), none["privapub"]!["votes"].Number("down")));
+
+			foreach (var inbox in new[] { bob, community })
+			{
+				var sent = (await inbox.Delivered(since)).Where(d => (d.Type() == "Undo" ? d["object"].Text("object") : d.Text("object")) == remote.ObjectURI).ToList();
+				Assert.Equal(new[] { "Like", "Dislike", "Like", "Dislike", "Undo:Dislike" },
+					sent.Select(d => d.Type() == "Undo" ? "Undo:" + d["object"].Text("type") : d.Type()));
+				var dislike = sent.Last(d => d.Type() == "Dislike");
+				Assert.Equal((alice.Uri, remote.ObjectURI), (dislike.Text("actor"), dislike.Text("object")));
+				Assert.Equal(dislike.Text("id"), sent.Single(d => d.Type() == "Undo")["object"].Text("id"));
+			}
+		}
+
+		[Fact]
+		public async Task A_favourite_or_a_boost_given_again_after_its_undo_is_a_new_activity_that_is_delivered()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var remote = await _host.PublicPostFrom(bob, alice);
+			var path = $"/api/v1/statuses/{remote.ID}";
+
+			foreach (var (on, off) in new[] { ("favourite", "unfavourite"), ("reblog", "unreblog") })
+			{
+				(await alice.Client.Post($"{path}/{on}")).Ok();
+				(await alice.Client.Post($"{path}/{off}")).Ok();
+				(await alice.Client.Post($"{path}/{on}")).Ok();
+			}
+
+			var sent = await bob.Delivered(since);
+			foreach (var type in new[] { "Like", "Announce" })
+			{
+				var given = sent.Where(d => d.Type() == type).ToList();
+				Assert.Equal(2, given.Count);
+				Assert.NotEqual(given[0].Text("id"), given[1].Text("id"));
+				var undo = Assert.Single(sent, d => d.Type() == "Undo" && d["object"].Text("type") == type);
+				Assert.Equal(given[0].Text("id"), undo["object"].Text("id"));
+			}
+			var status = (await alice.Client.Get(path)).Ok().Body;
+			Assert.True(status.Flag("favourited"));
+			Assert.True(status.Flag("reblogged"));
+			Assert.Equal(1, status.Number("reblogs_count"));
+		}
+
+		[Fact]
+		public async Task A_boost_reaches_the_authors_server_once_through_its_shared_inbox_and_a_like_its_own_inbox()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var remote = await _host.PublicPostFrom(bob, alice);
+			await DB.Default.Update<ForeignAvatar>().Match(f => f.ActorURI == bob.Id).Modify(f => f.SharedInboxURL, bob.SharedInbox)
+				.ExecuteAsync(TestContext.Current.CancellationToken);
+
+			(await alice.Client.Post($"/api/v1/statuses/{remote.ID}/reblog")).Ok();
+			(await alice.Client.Post($"/api/v1/statuses/{remote.ID}/unreblog")).Ok();
+			(await alice.Client.Post($"/api/v1/statuses/{remote.ID}/favourite")).Ok();
+
+			var shared = await Jobs.Deliveries(bob.SharedInbox, since, TestContext.Current.CancellationToken);
+			Assert.Single(shared, d => d.Type() == "Announce");
+			Assert.Single(shared, d => d.Type() == "Undo");
+			var own = await bob.Delivered(since);
+			Assert.DoesNotContain(own, d => d.Type() is "Announce" or "Undo");
+			Assert.Single(own, d => d.Type() == "Like");
+		}
+
+		[Fact]
+		public async Task Bookmarks_are_kept_listed_and_removed()
+		{
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var first = await carol.Status("worth keeping");
+			var second = await carol.Status("this too");
+
+			Assert.True((await alice.Client.Post($"/api/v1/statuses/{first.Text("id")}/bookmark")).Ok().Body.Flag("bookmarked"));
+			(await alice.Client.Post($"/api/v1/statuses/{second.Text("id")}/bookmark")).Ok();
+			(await alice.Client.Post($"/api/v1/statuses/{second.Text("id")}/bookmark")).Ok();
+
+			Assert.Equal(new[] { second.Text("id"), first.Text("id") }, (await alice.Client.Get("/api/v1/bookmarks")).Ok().Ids);
+			Assert.Empty((await carol.Client.Get("/api/v1/bookmarks")).Ok().Array);
+			var page = (await alice.Client.Get("/api/v1/bookmarks?limit=1")).Ok();
+			Assert.Equal(new[] { second.Text("id") }, page.Ids);
+			Assert.Equal(new[] { first.Text("id") }, (await alice.Client.Get(page.Link("next"))).Ok().Ids);
+			Assert.False((await alice.Client.Post($"/api/v1/statuses/{first.Text("id")}/unbookmark")).Ok().Body.Flag("bookmarked"));
+			Assert.Equal(new[] { second.Text("id") }, (await alice.Client.Get("/api/v1/bookmarks")).Ok().Ids);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Post("/api/v1/statuses/000000000000000000000000/bookmark")).Status);
+		}
+
+		[Fact]
+		public async Task Pins_take_only_the_owners_public_posts()
+		{
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var mine = await alice.Status("pin me");
+			var quiet = await alice.Status("not this", ("visibility", "private"));
+			var theirs = await carol.Status("not yours");
+
+			Assert.True((await alice.Client.Post($"/api/v1/statuses/{mine.Text("id")}/pin")).Ok().Body.Flag("pinned"));
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post($"/api/v1/statuses/{theirs.Text("id")}/pin")).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post($"/api/v1/statuses/{quiet.Text("id")}/pin")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await carol.Client.Post($"/api/v1/statuses/{quiet.Text("id")}/pin")).Status);
+			var featured = (await _host.ActivityPub($"/peasants/{alice.UserName}/trophies")).Ok().Body;
+			Assert.Equal(mine.Text("uri"), Assert.Single(featured["orderedItems"]!.AsArray()).Text("id"));
+
+			for (var i = 0; i < 4; i++)
+				(await alice.Client.Post($"/api/v1/statuses/{(await alice.Status($"more {i}")).Text("id")}/pin")).Ok();
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post($"/api/v1/statuses/{(await alice.Status("one too many")).Text("id")}/pin")).Status);
+
+			Assert.False((await alice.Client.Post($"/api/v1/statuses/{mine.Text("id")}/unpin")).Ok().Body.Flag("pinned"));
+			Assert.Equal(4, (await alice.Client.Get($"/api/v1/accounts/{alice.Id}/statuses?pinned=true")).Ok().Array.Count);
+		}
+
+		[Fact]
+		public async Task The_interaction_policy_sets_who_may_quote_and_matches_the_activitypub_note()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			await _host.FollowedBy(alice, bob);
+			var open = await alice.Status("quotable");
+			var quiet = await alice.Status("followers only", ("visibility", "private"));
+			var scribble = $"/peasants/{alice.UserName}/scribbles/{open.Text("id")}";
+			string CanQuote(JsonNode note) => Assert.Single(note["interactionPolicy"]!["canQuote"]!["automaticApproval"]!.AsArray())!.GetValue<string>();
+
+			Assert.Equal(new[] { "public" }, Strings(open["quote_approval"]!["automatic"]));
+			Assert.Equal(MastodonHelpers.Public, CanQuote((await _host.ActivityPub(scribble)).Ok().Body));
+
+			var followers = (await alice.Client.Put($"/api/v1/statuses/{open.Text("id")}/interaction_policy", ("quote_approval_policy", "followers"))).Ok();
+			Assert.Equal(new[] { "followers" }, Strings(followers.Body["quote_approval"]!["automatic"]));
+			Assert.Equal(alice.Uri + "/groupies", CanQuote((await _host.ActivityPub(scribble)).Ok().Body));
+
+			var nobody = (await alice.Client.Put($"/api/v1/statuses/{open.Text("id")}/interaction_policy", ("quote_approval_policy", "nobody"))).Ok();
+			Assert.Empty(nobody.Body["quote_approval"]!["automatic"]!.AsArray());
+			Assert.Equal(alice.Uri, CanQuote((await _host.ActivityPub(scribble)).Ok().Body));
+
+			var forced = (await alice.Client.Put($"/api/v1/statuses/{quiet.Text("id")}/interaction_policy", ("quote_approval_policy", "public"))).Ok();
+			Assert.Empty(forced.Body["quote_approval"]!["automatic"]!.AsArray());
+			var updates = (await bob.Delivered(since)).Where(d => d.Type() == "Update").ToList();
+			Assert.Equal(3, updates.Count);
+			Assert.Equal(alice.Uri, CanQuote(updates.Single(u => u["object"].Text("id") == quiet.Text("uri"))["object"]));
+			Assert.Equal(HttpStatusCode.UnprocessableEntity,
+				(await alice.Client.Put($"/api/v1/statuses/{open.Text("id")}/interaction_policy", ("quote_approval_policy", "everyone"))).Status);
+			Assert.Equal(HttpStatusCode.NotFound,
+				(await (await _host.Mastodon("other")).Client.Put($"/api/v1/statuses/{open.Text("id")}/interaction_policy", ("quote_approval_policy", "public"))).Status);
+		}
+
+		[Fact]
+		public async Task A_stranger_gets_404_for_followers_only_and_direct_posts()
+		{
+			var alice = await _host.Mastodon("alice");
+			var follower = await _host.Mastodon("follower");
+			var friend = await _host.Mastodon("friend");
+			var stranger = await _host.Mastodon("stranger");
+			(await follower.Client.Post($"/api/v1/accounts/{alice.Id}/follow")).Ok();
+			var quiet = await alice.Status("followers only", ("visibility", "private"));
+			var direct = await alice.Status($"@{friend.UserName} only you", ("visibility", "direct"));
+			var anonymous = _host.Client();
+
+			foreach (var id in new[] { quiet.Text("id"), direct.Text("id") })
+			{
+				Assert.Equal(HttpStatusCode.NotFound, (await stranger.Client.Get($"/api/v1/statuses/{id}")).Status);
+				Assert.Equal(HttpStatusCode.NotFound, (await stranger.Client.Get($"/api/v1/statuses/{id}/context")).Status);
+				Assert.Equal(HttpStatusCode.NotFound, (await stranger.Client.Post($"/api/v1/statuses/{id}/favourite")).Status);
+				Assert.Equal(HttpStatusCode.NotFound, (await stranger.Client.Post($"/api/v1/statuses/{id}/bookmark")).Status);
+				Assert.Equal(HttpStatusCode.NotFound, (await stranger.Client.Post("/api/v1/statuses", ("status", "re"), ("in_reply_to_id", id))).Status);
+				Assert.Equal(HttpStatusCode.NotFound, (await anonymous.Get($"/api/v1/statuses/{id}")).Status);
+				Assert.Equal(HttpStatusCode.NotFound, (await anonymous.Get($"/api/v1/statuses/{id}/favourited_by")).Status);
+			}
+			Assert.Empty((await stranger.Client.Get($"/api/v1/statuses?id[]={quiet.Text("id")}&id[]={direct.Text("id")}")).Ok().Array);
+			Assert.Equal(new[] { quiet.Text("id") }, (await follower.Client.Get($"/api/v1/statuses?id[]={quiet.Text("id")}&id[]={direct.Text("id")}")).Ok().Ids);
+			Assert.Equal(new[] { direct.Text("id") }, (await friend.Client.Get($"/api/v1/statuses?id[]={quiet.Text("id")}&id[]={direct.Text("id")}")).Ok().Ids);
+			Assert.Equal(HttpStatusCode.OK, (await follower.Client.Get($"/api/v1/statuses/{quiet.Text("id")}/context")).Status);
+			Assert.Equal(quiet.Text("id"), (await follower.Client.Post("/api/v1/statuses", ("status", "re"), ("in_reply_to_id", quiet.Text("id")))).Ok().Body.Text("in_reply_to_id"));
+			Assert.Equal(HttpStatusCode.NotFound, (await _host.ActivityPub($"/peasants/{alice.UserName}/scribbles/{quiet.Text("id")}")).Status);
+		}
+
+		[Fact]
+		public async Task A_located_post_is_never_reachable_by_id_by_anyone_else()
+		{
+			var alice = await _host.Mastodon("alice");
+			var other = await _host.Mastodon("other");
+			var id = await _host.Located(alice, "the bench by the river");
+			var anonymous = _host.Client();
+
+			foreach (var client in new[] { other.Client, anonymous })
+			{
+				foreach (var path in new[] { "", "/context", "/history", "/favourited_by", "/reblogged_by", "/quotes" })
+					Assert.Equal(HttpStatusCode.NotFound, (await client.Get($"/api/v1/statuses/{id}{path}")).Status);
+				Assert.Equal(HttpStatusCode.NotFound, (await client.Get($"/api/privapub/v1/statuses/{id}/provenance")).Status);
+				Assert.Equal(HttpStatusCode.NotFound, (await client.Get($"/api/v1/pleroma/statuses/{id}/reactions")).Status);
+				Assert.Equal(HttpStatusCode.NotFound, (await client.Get($"/api/v1/polls/{id}")).Status);
+				Assert.Empty((await client.Get($"/api/v1/statuses?id[]={id}")).Ok().Array);
+				Assert.DoesNotContain(id, (await client.Get($"/api/v1/accounts/{alice.Id}/statuses")).Ok().Ids);
+			}
+			foreach (var action in new[] { "favourite", "reblog", "bookmark", "pin" })
+				Assert.Equal(HttpStatusCode.NotFound, (await other.Client.Post($"/api/v1/statuses/{id}/{action}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await other.Client.Put($"/api/v1/pleroma/statuses/{id}/reactions/%F0%9F%91%8D")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await other.Client.Post("/api/v1/statuses", ("status", "re"), ("in_reply_to_id", id))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await other.Client.Post("/api/v1/statuses", ("status", "qt"), ("quoted_status_id", id))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _host.ActivityPub($"/peasants/{alice.UserName}/scribbles/{id}")).Status);
+		}
+
+		[Fact]
+		public async Task Creating_honours_the_idempotency_key_the_scopes_and_needs_a_recipient_for_a_direct_message()
+		{
+			var alice = await _host.Mastodon("alice");
+			var reader = await _host.Mastodon("reader", scopes: "read");
+			var key = Guid.NewGuid().ToString("N");
+			Task<ApiAnswer> Keyed(string text)
+			{
+				var request = new HttpRequestMessage(HttpMethod.Post, "/api/v1/statuses") { Content = new FormUrlEncodedContent(new Dictionary<string, string> { ["status"] = text }) };
+				request.Headers.Add("Idempotency-Key", key);
+				return alice.Client.Exchange(request);
+			}
+
+			var first = (await Keyed("once")).Ok();
+			var second = (await Keyed("once again")).Ok();
+
+			Assert.Equal(first.Body.Text("id"), second.Body.Text("id"));
+			Assert.Single((await alice.Client.Get($"/api/v1/accounts/{alice.Id}/statuses")).Ok().Array);
+			var noRecipient = await alice.Client.Post("/api/v1/statuses", ("status", "to nobody"), ("visibility", "direct"));
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, noRecipient.Status);
+			Assert.Contains("recipient", noRecipient.Body.Text("error"));
+			Assert.Equal(HttpStatusCode.Forbidden, (await reader.Client.Post("/api/v1/statuses", ("status", "read only"))).Status);
+			Assert.Equal(HttpStatusCode.Forbidden, (await reader.Client.Post($"/api/v1/statuses/{first.Body.Text("id")}/favourite")).Status);
+			Assert.Equal(HttpStatusCode.OK, (await reader.Client.Get($"/api/v1/statuses/{first.Body.Text("id")}")).Status);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().Post("/api/v1/statuses", ("status", "anonymous"))).Status);
+		}
+
+		[Fact]
+		public async Task Local_polls_take_one_vote_per_persona_and_never_from_their_author()
+		{
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var poll = await alice.Status("pick one", ("poll[options][]", "red"), ("poll[options][]", "blue"), ("poll[expires_in]", "3600"));
+			var path = $"/api/v1/polls/{poll.Text("id")}";
+
+			var voted = (await carol.Client.Post(path + "/votes", ("choices[]", "1"))).Ok();
+
+			Assert.True(voted.Body.Flag("voted"));
+			Assert.Equal(new[] { 1 }, voted.Body["own_votes"]!.AsArray().Select(v => v!.GetValue<int>()));
+			Assert.Equal(1, voted.Body.Number("votes_count"));
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await carol.Client.Post(path + "/votes", ("choices[]", "0"))).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Post(path + "/votes", ("choices[]", "0"))).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await (await _host.Mastodon("dave")).Client.Post(path + "/votes", ("choices[]", "0"), ("choices[]", "1"))).Status);
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await (await _host.Mastodon("erin")).Client.Post(path + "/votes", ("choices[]", "7"))).Status);
+			var anonymous = (await _host.Client().Get(path)).Ok();
+			Assert.Null(anonymous.Body["voted"]);
+			Assert.Equal(new[] { 0, 1 }, anonymous.Body["options"]!.AsArray().Select(o => o.Number("votes_count")));
+		}
+
+		[Fact]
+		public async Task A_vote_on_a_remote_poll_goes_only_to_its_author_without_a_published_date()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var carol = new RemoteActor(_peer, "carol");
+			await _host.FollowedBy(alice, carol);
+			var question = await _host.PublicPostFrom(bob, alice, "<p>which?</p>", note =>
+			{
+				note["type"] = "Question";
+				note["oneOf"] = new JsonArray(
+					new JsonObject { ["type"] = "Note", ["name"] = "this", ["replies"] = new JsonObject { ["type"] = "Collection", ["totalItems"] = 0 } },
+					new JsonObject { ["type"] = "Note", ["name"] = "that", ["replies"] = new JsonObject { ["type"] = "Collection", ["totalItems"] = 0 } });
+				note["endTime"] = DateTime.UtcNow.AddDays(1).ToString("O");
+			});
+
+			var voted = (await alice.Client.Post($"/api/v1/polls/{question.ID}/votes", ("choices[]", "1"))).Ok();
+
+			Assert.True(voted.Body.Flag("voted"));
+			var vote = Assert.Single(await bob.Delivered(since), d => d.Type() == "Create");
+			Assert.Equal("that", vote["object"].Text("name"));
+			Assert.Equal(question.ObjectURI, vote["object"].Text("inReplyTo"));
+			Assert.Null(vote["object"]!["published"]);
+			Assert.Equal(new[] { bob.Id }, Strings(vote["object"]!["to"]));
+			Assert.DoesNotContain(await carol.Delivered(since), d => d.Type() == "Create");
+		}
+
+		[Fact]
+		public async Task Deleting_a_reblog_undoes_it()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var remote = await _host.PublicPostFrom(bob, alice);
+			var reblog = (await alice.Client.Post($"/api/v1/statuses/{remote.ID}/reblog")).Ok().Body;
+
+			(await alice.Client.Delete($"/api/v1/statuses/{reblog.Text("id")}")).Ok();
+
+			Assert.False((await alice.Client.Get($"/api/v1/statuses/{remote.ID}")).Ok().Body.Flag("reblogged"));
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Get($"/api/v1/statuses/{reblog.Text("id")}")).Status);
+			var undo = Assert.Single(await bob.Delivered(since), d => d.Type() == "Undo");
+			Assert.Equal("Announce", undo["object"].Text("type"));
+		}
+
+		[Fact]
+		public async Task Many_statuses_are_fetched_by_id_in_one_call()
+		{
+			var alice = await _host.Mastodon("alice");
+			var first = await alice.Status("one");
+			var second = await alice.Status("two");
+
+			var answer = (await _host.Client().Get($"/api/v1/statuses?id[]={first.Text("id")}&id[]={second.Text("id")}&id[]=junk")).Ok();
+
+			Assert.Equal(new[] { first.Text("id"), second.Text("id") }, answer.Ids.Order());
+			Assert.Empty((await _host.Client().Get("/api/v1/statuses")).Ok().Array);
+		}
+	}
+}

PrivaPub.Tests/Http/MastodonStreamingTests.cs

@@ -0,0 +1,165 @@
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Net.WebSockets;
+using System.Text;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	// Mastodon's streaming API: a WebSocket whose streams are subscribed by message or in the URL, and server-sent events
+	// per stream; each event mapped for its persona, never what it may not see
+	[Trait("Category", "Integration")]
+	public sealed class MastodonStreamingTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		async Task<WebSocket> Connect(Mastodon account, string query = "")
+		{
+			var client = _host.Server.CreateWebSocketClient();
+			var uri = new Uri($"ws://{PrivaPubHost.Host}/api/v1/streaming?access_token={account.Token}{query}");
+			var socket = await client.ConnectAsync(uri, Token);
+			// the subscription is made as the socket opens: give the server a moment to hear it
+			await Task.Delay(200, Token);
+			return socket;
+		}
+
+		static async Task Say(WebSocket socket, JsonObject message) =>
+			await socket.SendAsync(Encoding.UTF8.GetBytes(message.ToJsonString()), WebSocketMessageType.Text, true, Token);
+
+		// the next message for which `wanted` holds, within a few seconds, or null
+		static async Task<JsonObject> Next(WebSocket socket, Func<JsonObject, bool> wanted, int seconds = 5)
+		{
+			using var timeout = CancellationTokenSource.CreateLinkedTokenSource(Token);
+			timeout.CancelAfter(TimeSpan.FromSeconds(seconds));
+			var buffer = new byte[65536];
+			try
+			{
+				while (true)
+				{
+					var text = new StringBuilder();
+					WebSocketReceiveResult received;
+					do
+					{
+						received = await socket.ReceiveAsync(buffer, timeout.Token);
+						text.Append(Encoding.UTF8.GetString(buffer, 0, received.Count));
+					}
+					while (!received.EndOfMessage);
+					if (JsonNode.Parse(text.ToString()) is JsonObject message && wanted(message))
+						return message;
+				}
+			}
+			catch (OperationCanceledException)
+			{
+				return null;
+			}
+		}
+
+		static string Id(JsonObject message) => JsonNode.Parse(message["payload"]!.GetValue<string>())!["id"]!.GetValue<string>();
+
+		[Fact]
+		public async Task Health_is_answered_and_a_stream_needs_a_persona()
+		{
+			var health = await _host.Client().GetAsync("/api/v1/streaming/health", Token);
+			Assert.Equal("OK", await health.Content.ReadAsStringAsync(Token));
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().GetAsync("/api/v1/streaming/public", Token)).StatusCode);
+			var instance = (await _host.Client().Get("/api/v2/instance")).Ok().Body;
+			Assert.StartsWith("ws", instance["configuration"]!["urls"]!["streaming"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task The_user_stream_tells_home_posts_notifications_edits_and_deletions()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var carol = await _host.Mastodon("carol");
+			var stranger = await _host.Mastodon("stranger");
+			(await alice.Client.Post($"/api/v1/accounts/{bob.Id}/follow")).Ok();
+			using var socket = await Connect(alice, "&stream=user");
+			using var elsewhere = await Connect(stranger, "&stream=user");
+
+			var post = (await bob.Status("streamed to alice")).Text("id");
+			var update = await Next(socket, m => m.Text("event") == "update");
+			Assert.NotNull(update);
+			Assert.Equal(new[] { "user" }, update!["stream"]!.AsArray().Select(s => s!.GetValue<string>()));
+			Assert.Equal(post, Id(update));
+
+			await carol.Status($"@{alice.UserName} hello there", ("visibility", "direct"));
+			var notification = await Next(socket, m => m.Text("event") == "notification");
+			Assert.Equal("mention", JsonNode.Parse(notification!["payload"]!.GetValue<string>())!.Text("type"));
+
+			(await bob.Client.Put($"/api/v1/statuses/{post}", ("status", "streamed, then edited"))).Ok();
+			var edited = await Next(socket, m => m.Text("event") == "status.update");
+			Assert.Contains("then edited", JsonNode.Parse(edited!["payload"]!.GetValue<string>())!.Text("content"));
+
+			(await bob.Client.Delete($"/api/v1/statuses/{post}")).Ok();
+			Assert.NotNull(await Next(socket, m => m.Text("event") == "delete" && m["payload"]!.GetValue<string>() == post));
+			// a persona whose home never held it hears nothing of it, not even its id
+			Assert.Null(await Next(elsewhere, m => m.Text("event") is "update" or "delete" && m["payload"]!.GetValue<string>().Contains(post), seconds: 2));
+		}
+
+		[Fact]
+		public async Task A_hashtag_stream_subscribed_by_message_tells_public_posts_only_and_never_a_blocked_authors()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var dave = await _host.Mastodon("dave");
+			(await alice.Client.Post($"/api/v1/accounts/{dave.Id}/block")).Ok();
+			var tag = $"st{Guid.NewGuid():N}"[..12];
+			using var socket = await Connect(alice);
+			await Say(socket, new JsonObject { ["type"] = "subscribe", ["stream"] = "hashtag", ["tag"] = tag });
+			await Task.Delay(200, Token);
+
+			await dave.Status($"blocked #{tag}");
+			await bob.Status($"quiet #{tag}", ("visibility", "unlisted"));
+			var open = (await bob.Status($"open #{tag}")).Text("id");
+			var told = await Next(socket, m => m.Text("event") == "update");
+			Assert.Equal(open, Id(told!));
+			Assert.Equal(new[] { "hashtag", tag }, told["stream"]!.AsArray().Select(s => s!.GetValue<string>()));
+			Assert.Null(await Next(socket, m => m.Text("event") == "update", seconds: 2));
+
+			await Say(socket, new JsonObject { ["type"] = "unsubscribe", ["stream"] = "hashtag", ["tag"] = tag });
+			await Task.Delay(200, Token);
+			await bob.Status($"again #{tag}");
+			Assert.Null(await Next(socket, m => m.Text("event") == "update", seconds: 2));
+
+			await Say(socket, new JsonObject { ["type"] = "subscribe", ["stream"] = "list", ["list"] = "000000000000000000000000" });
+			Assert.Equal("Unknown list", (await Next(socket, m => m["error"] != null))!.Text("error"));
+		}
+
+		[Fact]
+		public async Task Server_sent_events_tell_a_personas_notifications()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			using var request = new HttpRequestMessage(HttpMethod.Get, "/api/v1/streaming/user/notification");
+			request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", alice.Token);
+			using var response = await _host.Client().SendAsync(request, HttpCompletionOption.ResponseHeadersRead, Token);
+			Assert.Equal("text/event-stream", response.Content.Headers.ContentType!.MediaType);
+			using var reader = new StreamReader(await response.Content.ReadAsStreamAsync(Token));
+			Assert.Equal(":)", await reader.ReadLineAsync(Token));
+
+			(await bob.Client.Post($"/api/v1/accounts/{alice.Id}/follow")).Ok();
+			using var timeout = CancellationTokenSource.CreateLinkedTokenSource(Token);
+			timeout.CancelAfter(TimeSpan.FromSeconds(5));
+			string line;
+			while ((line = await reader.ReadLineAsync(timeout.Token)) != null && line != "event: notification")
+			{
+			}
+			Assert.Equal("event: notification", line);
+			var data = await reader.ReadLineAsync(timeout.Token);
+			Assert.Equal("follow", JsonNode.Parse(data!["data: ".Length..])!.Text("type"));
+		}
+	}
+}

PrivaPub.Tests/Http/MastodonTagsTests.cs

@@ -0,0 +1,89 @@
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	// Hashtags: a tag's week of use in public posts, and followed tags, whose public posts come to the persona's home
+	[Trait("Category", "Integration")]
+	public sealed class MastodonTagsTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		static string NewTag() => $"t{Guid.NewGuid():N}"[..12];
+
+		[Fact]
+		public async Task A_tag_shows_its_week_of_public_use_and_whether_the_persona_follows_it()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var tag = NewTag();
+			await alice.Status($"about #{tag}");
+			await alice.Status($"more about #{tag.ToUpperInvariant()}");
+			await bob.Status($"also #{tag}");
+			await bob.Status($"quietly #{tag}", ("visibility", "unlisted"));
+
+			var shown = (await _host.Client().Get($"/api/v1/tags/{tag}")).Ok().Object;
+			Assert.Equal(tag, shown.Text("name"));
+			Assert.False(shown.Flag("following"));
+			var history = shown["history"]!.AsArray();
+			Assert.Equal(7, history.Count);
+			Assert.Equal(("3", "2"), (history[0].Text("uses"), history[0].Text("accounts")));
+			Assert.Equal(new DateTimeOffset(DateTime.UtcNow.Date, TimeSpan.Zero).ToUnixTimeSeconds().ToString(), history[0].Text("day"));
+
+			Assert.True((await alice.Client.Post($"/api/v1/tags/{tag}/follow")).Ok().Body.Flag("following"));
+			Assert.True((await alice.Client.Get($"/api/v1/tags/%23{tag.ToUpperInvariant()}")).Ok().Body.Flag("following"));
+			Assert.Equal(new[] { tag }, (await alice.Client.Get("/api/v1/followed_tags")).Ok().Array.Select(t => t.Text("name")));
+			Assert.False((await bob.Client.Get($"/api/v1/tags/{tag}")).Ok().Body.Flag("following"));
+			Assert.False((await alice.Client.Post($"/api/v1/tags/{tag}/unfollow")).Ok().Body.Flag("following"));
+			Assert.Empty((await alice.Client.Get("/api/v1/followed_tags")).Ok().Array);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().Post($"/api/v1/tags/{tag}/follow")).Status);
+		}
+
+		[Fact]
+		public async Task A_followed_tags_public_posts_come_home_from_here_and_from_other_servers()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var carol = await _host.Mastodon("carol");
+			var remote = new RemoteActor(_peer, "dora");
+			var tag = NewTag();
+			(await alice.Client.Post($"/api/v1/tags/{tag}/follow")).Ok();
+
+			var open = (await bob.Status($"news about #{tag}")).Text("id");
+			var quiet = (await bob.Status($"quiet news #{tag}", ("visibility", "unlisted"))).Text("id");
+			var answer = (await bob.Status($"and #{tag} again", ("in_reply_to_id", open))).Text("id");
+			var untagged = (await bob.Status("nothing tagged")).Text("id");
+			var far = await _host.PublicPostFrom(remote, carol, $"<p>far away #{tag}</p>", note => note["tag"]!.AsArray().Add(new JsonObject
+			{
+				["type"] = "Hashtag",
+				["name"] = "#" + tag,
+				["href"] = $"{remote.Origin()}/tags/{tag}"
+			}));
+
+			var home = (await alice.Client.Get("/api/v1/timelines/home?limit=40")).Ok().Ids.ToList();
+			Assert.Contains(open, home);
+			Assert.Contains(far.ID, home);
+			Assert.DoesNotContain(quiet, home);
+			Assert.DoesNotContain(answer, home);
+			Assert.DoesNotContain(untagged, home);
+			Assert.DoesNotContain(open, (await carol.Client.Get("/api/v1/timelines/home?limit=40")).Ok().Ids);
+		}
+	}
+}

PrivaPub.Tests/Http/MastodonTimelinesTests.cs

@@ -0,0 +1,265 @@
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class MastodonTimelinesTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task The_home_timeline_pages_with_max_since_and_min_id()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var posts = new List<string>();
+			for (var i = 1; i <= 4; i++)
+				posts.Add((await alice.Status($"post {i}")).Text("id"));
+			(await bob.Client.Post($"/api/v1/accounts/{alice.Id}/follow")).Ok();
+			var afterFollow = (await alice.Status("post 5")).Text("id");
+			var (p1, p2, p3, p4) = (posts[0], posts[1], posts[2], posts[3]);
+
+			var first = (await alice.Client.Get("/api/v1/timelines/home?limit=2")).Ok();
+			Assert.Equal(new[] { afterFollow, p4 }, first.Ids);
+			Assert.Equal(new[] { p3, p2 }, (await alice.Client.Get(first.Link("next"))).Ok().Ids);
+			Assert.Empty((await alice.Client.Get(first.Link("prev"))).Ok().Array);
+			Assert.Equal(new[] { p2, p1 }, (await alice.Client.Get($"/api/v1/timelines/home?max_id={p3}&limit=2")).Ok().Ids);
+			Assert.Equal(new[] { afterFollow, p4 }, (await alice.Client.Get($"/api/v1/timelines/home?since_id={p1}&limit=2")).Ok().Ids);
+			Assert.Equal(new[] { p3, p2 }, (await alice.Client.Get($"/api/v1/timelines/home?min_id={p1}&limit=2")).Ok().Ids);
+			Assert.Equal(new[] { p3 }, (await alice.Client.Get($"/api/v1/timelines/home?min_id={p2}&max_id={p4}")).Ok().Ids);
+
+			Assert.Equal(new[] { afterFollow }, (await bob.Client.Get("/api/v1/timelines/home")).Ok().Ids);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _host.Client().Get("/api/v1/timelines/home")).Status);
+		}
+
+		static async Task<List<string>> Window(HttpClient client, string filter, string since, string until)
+		{
+			var ids = new List<string>();
+			for (var page = 0; page < 50; page++)
+			{
+				var batch = (await client.Get($"/api/v1/timelines/public?{filter}&since_id={since}&max_id={until}&limit=40")).Ok().Ids.ToList();
+				if (batch.Count == 0)
+					break;
+				ids.AddRange(batch);
+				until = batch[^1];
+			}
+			return ids;
+		}
+
+		[Fact]
+		public async Task The_public_timeline_splits_local_from_remote_and_leaves_out_unlisted_posts()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var since = MastodonHelpers.IdBefore(DateTime.UtcNow);
+			var remote = await _host.PublicPostFrom(bob, alice);
+			var open = (await alice.Status("hello world")).Text("id");
+			var unlisted = (await alice.Status("hello quietly", ("visibility", "unlisted"))).Text("id");
+			var until = MastodonHelpers.IdBefore(DateTime.UtcNow.AddSeconds(1));
+			var anonymous = _host.Client();
+
+			var everything = await Window(anonymous, "local=false", since, until);
+			Assert.Contains(open, everything);
+			Assert.Contains(remote.ID, everything);
+			Assert.DoesNotContain(unlisted, everything);
+			var local = await Window(anonymous, "local=true", since, until);
+			Assert.Contains(open, local);
+			Assert.DoesNotContain(remote.ID, local);
+			var federated = await Window(alice.Client, "remote=true", since, until);
+			Assert.Contains(remote.ID, federated);
+			Assert.DoesNotContain(open, federated);
+		}
+
+		[Fact]
+		public async Task The_tag_timeline_is_open_to_anonymous_readers_and_shows_only_public_posts()
+		{
+			var alice = await _host.Mastodon("alice");
+			var tag = $"t{Guid.NewGuid():N}"[..16];
+			var open = (await alice.Status($"about #{tag}")).Text("id");
+			await alice.Status($"quietly about #{tag}", ("visibility", "unlisted"));
+			await alice.Status($"privately about #{tag}", ("visibility", "private"));
+			var later = (await alice.Status($"more about #{tag.ToUpperInvariant()}")).Text("id");
+
+			var tagged = (await _host.Client().Get($"/api/v1/timelines/tag/{tag}")).Ok();
+
+			Assert.Equal(new[] { later, open }, tagged.Ids);
+			Assert.Equal(new[] { later }, (await _host.Client().Get($"/api/v1/timelines/tag/{tag}?local=true&limit=1")).Ok().Ids);
+			Assert.Equal(new[] { later, open }, (await alice.Client.Get($"/api/v1/timelines/tag/%23{tag}")).Ok().Ids);
+		}
+
+		[Fact]
+		public async Task Favourites_list_what_the_persona_liked_newest_first()
+		{
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var first = (await carol.Status("one")).Text("id");
+			var second = (await carol.Status("two")).Text("id");
+			(await alice.Client.Post($"/api/v1/statuses/{first}/favourite")).Ok();
+			(await alice.Client.Post($"/api/v1/statuses/{second}/favourite")).Ok();
+
+			Assert.Equal(new[] { second, first }, (await alice.Client.Get("/api/v1/favourites")).Ok().Ids);
+			var page = (await alice.Client.Get("/api/v1/favourites?limit=1")).Ok();
+			Assert.Equal(new[] { second }, page.Ids);
+			Assert.Equal(new[] { first }, (await alice.Client.Get(page.Link("next"))).Ok().Ids);
+			Assert.Empty((await carol.Client.Get("/api/v1/favourites")).Ok().Array);
+		}
+
+		[Fact]
+		public async Task Conversations_list_direct_messages_to_their_participants_only()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var stranger = await _host.Mastodon("stranger");
+			(await alice.Status($"@{bob.UserName} psst", ("visibility", "direct"))).Text("id");
+			var answer = (await bob.Status($"@{alice.UserName} what?", ("visibility", "direct"))).Text("id");
+
+			var mine = Assert.Single((await alice.Client.Get("/api/v1/conversations")).Ok().Array);
+			Assert.Equal(new[] { bob.Id }, mine!["accounts"]!.AsArray().Select(a => a.Text("id")));
+			Assert.Equal(answer, mine["last_status"].Text("id"));
+			var theirs = Assert.Single((await bob.Client.Get("/api/v1/conversations")).Ok().Array);
+			Assert.Equal(mine.Text("id"), theirs.Text("id"));
+			Assert.Equal(new[] { alice.Id }, theirs!["accounts"]!.AsArray().Select(a => a.Text("id")));
+			Assert.Empty((await stranger.Client.Get("/api/v1/conversations")).Ok().Array);
+
+			var read = (await bob.Client.Post($"/api/v1/conversations/{mine.Text("id")}/read")).Ok();
+			Assert.Equal(mine.Text("id"), read.Body.Text("id"));
+			Assert.Equal(answer, read.Body["last_status"].Text("id"));
+			Assert.Equal(HttpStatusCode.NotFound, (await stranger.Client.Post($"/api/v1/conversations/{mine.Text("id")}/read")).Status);
+			Assert.DoesNotContain(answer, (await stranger.Client.Get($"/api/v1/accounts/{bob.Id}/statuses")).Ok().Ids);
+		}
+
+		[Fact]
+		public async Task Conversations_page_by_their_newest_message_and_know_what_is_unread_read_and_removed()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var carol = await _host.Mastodon("carol");
+			await bob.Status($"@{alice.UserName} first", ("visibility", "direct"));
+			var fromCarol = (await carol.Status($"@{alice.UserName} second", ("visibility", "direct"))).Text("id");
+			// writing in a conversation reads it
+			await alice.Status($"@{bob.UserName} third", ("visibility", "direct"));
+			async Task<JsonArray> List() => (await alice.Client.Get("/api/v1/conversations")).Ok().Array;
+
+			var all = await List();
+			Assert.Equal(2, all.Count);
+			var (withBob, withCarol) = (all[0].Text("id"), all[1].Text("id"));
+			Assert.Equal(new[] { bob.Id }, all[0]!["accounts"]!.AsArray().Select(a => a.Text("id")));
+			Assert.False(all[0].Flag("unread"));
+			Assert.True(all[1].Flag("unread"));
+			Assert.Equal(fromCarol, all[1]!["last_status"].Text("id"));
+
+			var page = (await alice.Client.Get("/api/v1/conversations?limit=1")).Ok();
+			Assert.Equal(withBob, Assert.Single(page.Array).Text("id"));
+			Assert.Equal(withCarol, Assert.Single((await alice.Client.Get(page.Link("next"))).Ok().Array).Text("id"));
+
+			Assert.False((await alice.Client.Post($"/api/v1/conversations/{withCarol}/read")).Ok().Body.Flag("unread"));
+			Assert.False((await List()).Single(c => c.Text("id") == withCarol).Flag("unread"));
+
+			// off the list until a newer message, which brings it back unread; carol's own list never changed
+			(await alice.Client.Delete($"/api/v1/conversations/{withCarol}")).Ok();
+			Assert.Equal(new[] { withBob }, (await List()).Select(c => c.Text("id")));
+			Assert.Equal(withCarol, Assert.Single((await carol.Client.Get("/api/v1/conversations")).Ok().Array).Text("id"));
+			var again = (await carol.Status($"@{alice.UserName} are you there?", ("visibility", "direct"))).Text("id");
+			var back = (await List())[0];
+			Assert.Equal((withCarol, again, true), (back.Text("id"), back!["last_status"].Text("id"), back.Flag("unread")));
+			Assert.Equal(HttpStatusCode.NotFound, (await bob.Client.Delete($"/api/v1/conversations/{withCarol}")).Status);
+		}
+
+		[Fact]
+		public async Task Markers_are_saved_versioned_and_read_back_per_timeline()
+		{
+			var alice = await _host.Mastodon("alice");
+
+			var saved = (await alice.Client.Post("/api/v1/markers", ("home[last_read_id]", "100"))).Ok();
+			Assert.Equal("100", saved.Body["home"].Text("last_read_id"));
+			Assert.Equal(1, saved.Body["home"].Number("version"));
+			Assert.Null(saved.Body["notifications"]);
+
+			var again = (await alice.Client.Json(HttpMethod.Post, "/api/v1/markers", new JsonObject
+			{
+				["home"] = new JsonObject { ["last_read_id"] = "200" },
+				["notifications"] = new JsonObject { ["last_read_id"] = "7" }
+			})).Ok();
+			Assert.Equal(("200", 2), (again.Body["home"].Text("last_read_id"), again.Body["home"].Number("version")));
+			Assert.Equal(("7", 1), (again.Body["notifications"].Text("last_read_id"), again.Body["notifications"].Number("version")));
+
+			var home = (await alice.Client.Get("/api/v1/markers?timeline[]=home")).Ok().Object;
+			Assert.Equal(new[] { "home" }, home.Select(p => p.Key));
+			Assert.Equal("200", home["home"].Text("last_read_id"));
+			Assert.Equal(new[] { "home", "notifications" }, (await alice.Client.Get("/api/v1/markers")).Ok().Object.Select(p => p.Key).Order());
+			Assert.Empty((await (await _host.Mastodon("other")).Client.Get("/api/v1/markers")).Ok().Object);
+		}
+
+		[Fact]
+		public async Task A_notification_about_a_deleted_post_is_gone_not_null()
+		{
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var post = (await alice.Status("short lived")).Text("id");
+			(await carol.Client.Post($"/api/v1/statuses/{post}/favourite")).Ok();
+			var id = Assert.Single((await alice.Client.Get("/api/v1/notifications")).Ok().Array).Text("id");
+
+			(await alice.Client.Delete($"/api/v1/statuses/{post}")).Ok();
+
+			Assert.Empty((await alice.Client.Get("/api/v1/notifications")).Ok().Array);
+			var gone = await alice.Client.Get($"/api/v1/notifications/{id}");
+			Assert.Equal(HttpStatusCode.NotFound, gone.Status);
+			Assert.Equal("Record not found", gone.Body.Text("error"));
+		}
+
+		[Fact]
+		public async Task Notifications_filter_page_dismiss_and_clear()
+		{
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var post = (await alice.Status("notice me")).Text("id");
+			(await carol.Client.Post($"/api/v1/accounts/{alice.Id}/follow")).Ok();
+			(await carol.Client.Post($"/api/v1/statuses/{post}/favourite")).Ok();
+			var mention = (await carol.Status($"hey @{alice.UserName}")).Text("id");
+			(await carol.Client.Post($"/api/v1/statuses/{post}/reblog")).Ok();
+
+			var all = (await alice.Client.Get("/api/v1/notifications")).Ok();
+			Assert.Equal(new[] { "reblog", "mention", "favourite", "follow" }, all.Array.Select(n => n.Text("type")));
+			Assert.All(all.Array, n => Assert.Equal(carol.Id, n!["account"].Text("id")));
+			Assert.Equal(mention, all.Array[1]!["status"].Text("id"));
+			Assert.Equal(new[] { "mention" }, (await alice.Client.Get("/api/v1/notifications?types[]=mention")).Ok().Array.Select(n => n.Text("type")));
+			Assert.Equal(new[] { "mention", "favourite" },
+				(await alice.Client.Get("/api/v1/notifications?exclude_types[]=follow&exclude_types[]=reblog")).Ok().Array.Select(n => n.Text("type")));
+			Assert.Equal(4, (await alice.Client.Get($"/api/v1/notifications?account_id={carol.Id}")).Ok().Array.Count);
+			var page = (await alice.Client.Get("/api/v1/notifications?limit=3")).Ok();
+			Assert.Equal(new[] { "follow" }, (await alice.Client.Get(page.Link("next"))).Ok().Array.Select(n => n.Text("type")));
+			Assert.Equal(4, (await alice.Client.Get("/api/v1/notifications/unread_count")).Ok().Body.Number("count"));
+
+			var followId = all.Array[3].Text("id");
+			Assert.Equal("follow", (await alice.Client.Get($"/api/v1/notifications/{followId}")).Ok().Body.Text("type"));
+			Assert.Equal(HttpStatusCode.NotFound, (await carol.Client.Get($"/api/v1/notifications/{followId}")).Status);
+			(await carol.Client.Post($"/api/v1/notifications/{followId}/dismiss")).Ok();
+			Assert.Equal(HttpStatusCode.OK, (await alice.Client.Get($"/api/v1/notifications/{followId}")).Status);
+			(await alice.Client.Post($"/api/v1/notifications/{followId}/dismiss")).Ok();
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Get($"/api/v1/notifications/{followId}")).Status);
+			Assert.Equal(3, (await alice.Client.Get("/api/v1/notifications")).Ok().Array.Count);
+
+			(await alice.Client.Post("/api/v1/notifications/clear")).Ok();
+			Assert.Empty((await alice.Client.Get("/api/v1/notifications")).Ok().Array);
+			Assert.Equal(0, (await alice.Client.Get("/api/v1/notifications/unread_count")).Ok().Body.Number("count"));
+		}
+	}
+}

PrivaPub.Tests/Http/MastodonTrendsTests.cs

@@ -0,0 +1,133 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Social;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+namespace PrivaPub.Tests.Http
+{
+	// Trends from what PrivaPub holds (hashtags and links by how many authors use them, posts by their interactions,
+	// from discoverable authors only) and the directory of accounts that let themselves be discovered
+	[Trait("Category", "Integration")]
+	public sealed class MastodonTrendsTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		void Fresh() => _host.Get<Trends>().Forget();
+
+		static string NewTag() => $"tr{Guid.NewGuid():N}"[..12];
+
+		[Fact]
+		public async Task A_hashtag_trends_once_two_authors_use_it_today_and_never_from_one_or_behind_a_warning()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var carol = await _host.Mastodon("carol");
+			var shared = NewTag();
+			var lonely = NewTag();
+			var warned = NewTag();
+			await alice.Status($"#{shared} is good");
+			await bob.Status($"#{shared} indeed");
+			for (var i = 0; i < 4; i++)
+				await carol.Status($"#{lonely} again {i}");
+			await alice.Status($"#{warned}", ("spoiler_text", "careful"));
+			await bob.Status($"#{warned}", ("spoiler_text", "careful"));
+			Fresh();
+
+			var trends = (await _host.Client().Get("/api/v1/trends/tags?limit=20")).Ok().Array;
+			var trend = Assert.Single(trends, t => t.Text("name") == shared)!;
+			Assert.Equal(("2", "2"), (trend["history"]![0].Text("uses"), trend["history"]![0].Text("accounts")));
+			Assert.DoesNotContain(trends, t => t.Text("name") == lonely);
+			Assert.DoesNotContain(trends, t => t.Text("name") == warned);
+			Assert.Contains((await alice.Client.Get("/api/v1/trends?limit=20")).Ok().Array, t => t.Text("name") == shared);
+		}
+
+		[Fact]
+		public async Task A_post_trends_by_its_interactions_when_its_author_is_discoverable()
+		{
+			var alice = await _host.Mastodon("alice");
+			var hidden = await _host.Mastodon("hidden");
+			var bob = await _host.Mastodon("bob");
+			(await hidden.Client.Patch("/api/v1/accounts/update_credentials", ("discoverable", "false"))).Ok();
+			var liked = (await alice.Status("worth a like")).Text("id");
+			var quiet = (await hidden.Status("worth a like too")).Text("id");
+			var answer = (await alice.Status("a reply", ("in_reply_to_id", liked))).Text("id");
+			foreach (var id in new[] { liked, quiet, answer })
+			{
+				(await bob.Client.Post($"/api/v1/statuses/{id}/favourite")).Ok();
+				(await bob.Client.Post($"/api/v1/statuses/{id}/reblog")).Ok();
+			}
+			Fresh();
+
+			var trending = (await _host.Client().Get("/api/v1/trends/statuses?limit=40")).Ok().Ids.ToList();
+			Assert.Contains(liked, trending);
+			Assert.DoesNotContain(quiet, trending);
+			Assert.DoesNotContain(answer, trending);
+		}
+
+		[Fact]
+		public async Task A_link_trends_once_two_authors_share_it()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = await _host.Mastodon("bob");
+			var url = $"https://news.example/{Guid.NewGuid():N}";
+			foreach (var account in new[] { alice, bob })
+			{
+				var id = (await account.Status($"read {url}")).Text("id");
+				await DB.Default.Update<Post>().MatchID(id).Modify(p => p.Link, new PostLink { Href = url, Title = "The news" }).ExecuteAsync(Token);
+			}
+			Fresh();
+
+			var link = Assert.Single((await _host.Client().Get("/api/v1/trends/links?limit=20")).Ok().Array, l => l.Text("url") == url)!;
+			Assert.Equal("The news", link.Text("title"));
+			Assert.Equal("2", link["history"]![0].Text("accounts"));
+		}
+
+		[Fact]
+		public async Task The_directory_lists_discoverable_accounts_by_activity_or_by_joining_and_never_by_creation()
+		{
+			var alice = await _host.Mastodon("alice");
+			var hidden = await _host.Mastodon("hidden");
+			(await hidden.Client.Patch("/api/v1/accounts/update_credentials", ("discoverable", "false"))).Ok();
+			await hidden.Status("not listed");
+			await alice.Status("listed");
+
+			// by their latest public post, newest first: other tests post too, so the directory is read until alice
+			var active = new List<string>();
+			for (var offset = 0; offset < 4000 && !active.Contains(alice.Id); offset += 80)
+			{
+				var page = (await _host.Client().Get($"/api/v1/directory?order=active&local=true&limit=80&offset={offset}")).Ok().Ids.ToList();
+				active.AddRange(page);
+				if (page.Count < 80)
+					break;
+			}
+			Assert.Contains(alice.Id, active);
+			Assert.DoesNotContain(hidden.Id, active);
+			// by the day each says it joined, newest first: a persona's is its published day, set some days back
+			// (each page in order: other tests make personas between two pages)
+			var joined = new List<System.Text.Json.Nodes.JsonNode>();
+			for (var offset = 0; offset < 4000; offset += 80)
+			{
+				var page = (await _host.Client().Get($"/api/v1/directory?order=new&local=true&limit=80&offset={offset}")).Ok().Array;
+				var days = page.Select(a => a.Text("created_at")[..10]).ToList();
+				Assert.Equal(days.OrderByDescending(d => d, StringComparer.Ordinal), days);
+				joined.AddRange(page!);
+				if (page.Count < 80 || joined.Any(a => a.Text("id") == alice.Id))
+					break;
+			}
+			Assert.Contains(joined, a => a.Text("id") == alice.Id);
+			Assert.DoesNotContain(joined, a => a.Text("id") == hidden.Id);
+		}
+	}
+}

PrivaPub.Tests/Http/MastodonWordSearchTests.cs

@@ -0,0 +1,135 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	// Status search by words, as Mastodon scopes it: the persona's own posts and those it boosted, favourited, bookmarked
+	// or was named in, and public posts of authors who let themselves be indexed
+	[Trait("Category", "Integration")]
+	public sealed class MastodonWordSearchTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		[Fact]
+		public async Task Words_find_what_the_persona_wrote_or_touched_and_what_indexable_authors_made_public()
+		{
+			var reader = await _host.Mastodon("reader");
+			var open = await _host.Mastodon("open");
+			var shy = await _host.Mastodon("shy");
+			(await open.Client.Patch("/api/v1/accounts/update_credentials", ("indexable", "true"))).Ok();
+			var word = $"w{Guid.NewGuid():N}"[..12];
+
+			var own = (await reader.Status($"my {word}")).Text("id");
+			var indexed = (await open.Status($"open {word}")).Text("id");
+			var quietIndexed = (await open.Status($"followers {word}", ("visibility", "private"))).Text("id");
+			var unindexed = (await shy.Status($"shy {word}")).Text("id");
+			var liked = (await shy.Status($"liked {word}")).Text("id");
+			var named = (await shy.Status($"@{reader.UserName} about {word}")).Text("id");
+			var warned = (await shy.Status("calm", ("spoiler_text", $"about {word}"))).Text("id");
+			(await reader.Client.Post($"/api/v1/statuses/{liked}/favourite")).Ok();
+			(await reader.Client.Post($"/api/v1/statuses/{warned}/bookmark")).Ok();
+
+			var found = (await reader.Client.Get($"/api/v2/search?q={word}&type=statuses&limit=40")).Ok().Body["statuses"]!.AsArray()
+				.Select(s => s.Text("id")).ToList();
+			Assert.Equal(new[] { warned, named, liked, indexed, own }, found);
+			Assert.DoesNotContain(unindexed, found);
+			Assert.DoesNotContain(quietIndexed, found);
+			Assert.Empty((await _host.Client().Get($"/api/v2/search?q={word}&type=statuses")).Ok().Body["statuses"]!.AsArray());
+			Assert.Equal(new[] { named },
+				(await reader.Client.Get($"/api/v2/search?q={word}&type=statuses&limit=1&offset=1")).Ok().Body["statuses"]!.AsArray().Select(s => s.Text("id")));
+		}
+
+		// FEP-268d: a remote account's searchableBy outranks its indexable, and a post's own outranks its author's
+		[Fact]
+		public async Task A_remote_searchable_by_decides_before_indexable()
+		{
+			var token = TestContext.Current.CancellationToken;
+			await using var peer = await Peer.Start();
+			var reader = await _host.Mastodon("reader");
+			var keeper = await _host.Mastodon("keeper");
+			var word = $"s{Guid.NewGuid():N}"[..12];
+
+			async Task<RemoteActor> Author(string name, bool indexable, Func<RemoteActor, JsonArray> searchableBy)
+			{
+				var author = new RemoteActor(peer, name);
+				var document = author.Document();
+				document["indexable"] = indexable;
+				if (searchableBy != default)
+					document["searchableBy"] = searchableBy(author);
+				peer.Serve($"/users/{author.Name}", document.ToJsonString());
+				await DB.Default.SaveAsync(new Following { AvatarId = keeper.Id, TargetActorURI = author.Id, State = FollowState.Accepted }, token);
+				return author;
+			}
+			async Task<string> Says(RemoteActor author, string text, JsonArray searchableBy = default)
+			{
+				var noteId = $"{peer.A}/notes/{Guid.NewGuid():N}";
+				var note = new JsonObject
+				{
+					["id"] = noteId, ["type"] = "Note", ["attributedTo"] = author.Id, ["content"] = $"<p>{text}</p>",
+					["to"] = new JsonArray(Addressing.Public), ["cc"] = new JsonArray(author.Id + "/followers"), ["published"] = DateTime.UtcNow.ToString("O")
+				};
+				if (searchableBy != default)
+					note["searchableBy"] = searchableBy;
+				using var client = _host.Client();
+				await client.SendAsync(author.SignedPost("/human-centipede", new JsonObject
+				{
+					["id"] = noteId + "/activity", ["type"] = "Create", ["actor"] = author.Id,
+					["to"] = new JsonArray(Addressing.Public), ["cc"] = new JsonArray(author.Id + "/followers"), ["object"] = note
+				}), token);
+				Assert.Equal(1, await _host.RunInbox(noteId + "/activity", token));
+				return (await DB.Default.Find<Models.Post.Post>().Match(p => p.ObjectURI == noteId).ExecuteFirstAsync(token)).ID;
+			}
+
+			var open = await Says(await Author("open", indexable: false, _ => new JsonArray(Addressing.Public)), $"open {word}");
+			var closed = await Says(await Author("closed", indexable: true, _ => new JsonArray()), $"closed {word}");
+			var friendly = await Author("friendly", indexable: false, a => new JsonArray(a.Id + "/followers"));
+			var friends = await Says(friendly, $"friends {word}");
+			var quiet = await Author("quiet", indexable: false, default);
+			var perPost = await Says(quiet, $"per post {word}", new JsonArray(Addressing.Public));
+			var plain = await Says(quiet, $"plain {word}");
+
+			static List<string> Found(JsonNode body) => body["statuses"]!.AsArray().Select(s => s.Text("id")).ToList();
+			var before = Found((await reader.Client.Get($"/api/v2/search?q={word}&type=statuses&limit=40")).Ok().Body);
+			Assert.Contains(open, before);
+			Assert.Contains(perPost, before);
+			Assert.DoesNotContain(closed, before);
+			Assert.DoesNotContain(friends, before);
+			Assert.DoesNotContain(plain, before);
+
+			await DB.Default.SaveAsync(new Following { AvatarId = reader.Id, TargetActorURI = friendly.Id, State = FollowState.Accepted }, token);
+			Assert.Contains(friends, Found((await reader.Client.Get($"/api/v2/search?q={word}&type=statuses&limit=40")).Ok().Body));
+		}
+
+		// a handle asks for its account: no posts sharing its words, and no hashtag made of it
+		[Fact]
+		public async Task A_handle_finds_its_account_and_neither_posts_nor_a_hashtag()
+		{
+			var reader = await _host.Mastodon("reader");
+			var named = await _host.Mastodon("named");
+			await reader.Status($"talking of {named.UserName} here");
+
+			foreach (var q in new[] { $"@{named.UserName}", $"@{named.UserName}@{PrivaPubHost.Host}", $"{named.UserName}@{PrivaPubHost.Host}" })
+			{
+				var body = (await reader.Client.Get($"/api/v2/search?q={Uri.EscapeDataString(q)}")).Ok().Body;
+				Assert.Contains(body["accounts"]!.AsArray(), a => a.Text("id") == named.Id);
+				Assert.Empty(body["statuses"]!.AsArray());
+				Assert.Empty(body["hashtags"]!.AsArray());
+			}
+			Assert.Equal("cats", Assert.Single((await reader.Client.Get("/api/v2/search?q=%23Cats")).Ok().Body["hashtags"]!.AsArray()).Text("name"));
+		}
+	}
+}

PrivaPub.Tests/Http/MediaLifecycleTests.cs

@@ -0,0 +1,234 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Media;
+using PrivaPub.Models.Media;
+using PrivaPub.Services;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+
+namespace PrivaPub.Tests.Http
+{
+	// A file lives exactly as long as something holds it: a deleted post, an edit leaving media out, a replaced picture and
+	// a removed root each trash theirs, which stops /media/files serving them at once; the janitor deletes them later.
+	[Trait("Category", "Integration")]
+	public sealed class MediaLifecycleTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		async Task<string> Upload(Mastodon account, string name)
+		{
+			var form = MastodonHelpers.Multipart(("file", MastodonHelpers.JpegWithMetadata(64, 48), "image/jpeg", name));
+			return (await account.Client.Exchange(new HttpRequestMessage(HttpMethod.Post, "/api/v2/media") { Content = form })).Ok().Body.Text("id");
+		}
+
+		async Task<HttpStatusCode> Served(string url) =>
+			(await _host.Client().GetAsync(new Uri(url).PathAndQuery, Token)).StatusCode;
+
+		[Fact]
+		public async Task A_deleted_posts_media_stop_being_served()
+		{
+			var alice = await _host.Mastodon("alice");
+			var id = await Upload(alice, "a.jpg");
+			var status = (await alice.Client.Post("/api/v1/statuses", ("status", "with a picture"), ("media_ids[]", id))).Ok();
+			var url = status.Body["media_attachments"]![0]!["url"]!.GetValue<string>();
+			var preview = status.Body["media_attachments"]![0]!["preview_url"]!.GetValue<string>();
+			Assert.Equal(HttpStatusCode.OK, await Served(url));
+
+			(await alice.Client.Delete($"/api/v1/statuses/{status.Body.Text("id")}")).Ok();
+
+			Assert.Equal(HttpStatusCode.NotFound, await Served(url));
+			Assert.Equal(HttpStatusCode.NotFound, await Served(preview));
+			Assert.Equal("post deleted", (await DB.Default.Find<MediaAttachment>().OneAsync(id, Token)).TrashReason);
+			// the file waits in the trash, beside what /media/files serves
+			var relative = url[(url.IndexOf("/media/files/", StringComparison.Ordinal) + "/media/files/".Length)..];
+			Assert.True(File.Exists(Path.Combine(_host.Get<IMediaService>().TrashRoot, relative)));
+			Assert.Equal(HttpStatusCode.NotFound, await Served(url.Replace("/media/files/", "/media/files/.trash/")));
+		}
+
+		[Fact]
+		public async Task An_edit_that_leaves_media_out_trashes_them()
+		{
+			var alice = await _host.Mastodon("alice");
+			var kept = await Upload(alice, "kept.jpg");
+			var dropped = await Upload(alice, "dropped.jpg");
+			var status = (await alice.Client.Post("/api/v1/statuses", ("status", "two pictures"), ("media_ids[]", kept), ("media_ids[]", dropped))).Ok();
+			var urls = status.Body["media_attachments"]!.AsArray().ToDictionary(m => m!["id"]!.GetValue<string>(), m => m!["url"]!.GetValue<string>());
+
+			(await alice.Client.Put($"/api/v1/statuses/{status.Body.Text("id")}", ("status", "one picture"), ("media_ids[]", kept))).Ok();
+
+			Assert.Equal(HttpStatusCode.OK, await Served(urls[kept]));
+			Assert.Equal(HttpStatusCode.NotFound, await Served(urls[dropped]));
+			Assert.Null((await DB.Default.Find<MediaAttachment>().OneAsync(kept, Token)).TrashedAt);
+			Assert.Equal("edited out", (await DB.Default.Find<MediaAttachment>().OneAsync(dropped, Token)).TrashReason);
+		}
+
+		// a posted picture's description and focus change by editing its post (media_attributes), not by PUT, as on Mastodon
+		[Fact]
+		public async Task An_edit_describes_its_media_again_and_keeps_what_it_is_not_sent()
+		{
+			var alice = await _host.Mastodon("alice");
+			var id = await Upload(alice, "a.jpg");
+			var status = (await alice.Client.Post("/api/v1/statuses", ("status", "described later"), ("media_ids[]", id),
+				("spoiler_text", "a warning"), ("sensitive", "true"), ("language", "it"))).Ok();
+			var statusId = status.Body.Text("id");
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Put($"/api/v1/media/{id}", ("description", "too late"))).Status);
+
+			var edited = (await alice.Client.Json(HttpMethod.Put, $"/api/v1/statuses/{statusId}", new System.Text.Json.Nodes.JsonObject
+			{
+				["status"] = "described now",
+				["spoiler_text"] = "a warning",
+				["sensitive"] = true,
+				["media_ids"] = new System.Text.Json.Nodes.JsonArray(id),
+				["media_attributes"] = new System.Text.Json.Nodes.JsonArray(new System.Text.Json.Nodes.JsonObject { ["id"] = id, ["description"] = "a red square", ["focus"] = "0.5,0.5" })
+			})).Ok();
+
+			Assert.Equal("a red square", edited.Body["media_attachments"]![0]!.Text("description"));
+			Assert.Equal(0.5, edited.Body["media_attachments"]![0]!["meta"]!["focus"]!["x"]!.GetValue<double>());
+			Assert.Equal("a warning", edited.Body.Text("spoiler_text"));
+			Assert.True(edited.Body["sensitive"]!.GetValue<bool>());
+			Assert.Equal("it", edited.Body.Text("language"));
+			Assert.Equal("a red square", (await DB.Default.Find<MediaAttachment>().OneAsync(id, Token)).Description);
+
+			// an edit that doesn't send media keeps them, described as they were; an empty media_ids takes them away
+			var kept = (await alice.Client.Put($"/api/v1/statuses/{statusId}", ("status", "media kept"))).Ok();
+			Assert.Equal("a red square", kept.Body["media_attachments"]![0]!.Text("description"));
+			var bare = (await alice.Client.Json(HttpMethod.Put, $"/api/v1/statuses/{statusId}", new System.Text.Json.Nodes.JsonObject
+			{
+				["status"] = "no picture now",
+				["media_ids"] = new System.Text.Json.Nodes.JsonArray()
+			})).Ok();
+			Assert.Empty(bare.Body["media_attachments"]!.AsArray());
+			Assert.Equal("edited out", (await DB.Default.Find<MediaAttachment>().OneAsync(id, Token)).TrashReason);
+		}
+
+		[Fact]
+		public async Task A_replaced_avatar_is_trashed_and_a_picture_that_is_not_one_is_refused()
+		{
+			var alice = await _host.Mastodon("alice");
+			async Task<ApiAnswer> Picture(byte[] bytes, string type, string name) =>
+				await alice.Client.Exchange(new HttpRequestMessage(HttpMethod.Patch, "/api/v1/accounts/update_credentials")
+				{
+					Content = MastodonHelpers.Multipart(("avatar", bytes, type, name))
+				});
+			var first = (await Picture(MastodonHelpers.JpegWithMetadata(300, 300), "image/jpeg", "one.jpg")).Ok().Body.Text("avatar");
+			var second = (await Picture(MastodonHelpers.JpegWithMetadata(320, 300), "image/jpeg", "two.jpg")).Ok().Body.Text("avatar");
+
+			Assert.NotEqual(first, second);
+			Assert.Equal(HttpStatusCode.NotFound, await Served(first));
+			Assert.Equal(HttpStatusCode.OK, await Served(second));
+			var row = await DB.Default.Find<MediaAttachment>().Match(m => m.ProfileOfAvatarId == alice.Persona.Id && m.Kind == "avatar" && m.TrashedAt == null).ExecuteSingleAsync(Token);
+			Assert.EndsWith(row.FilePath, second);
+
+			// not an image: 422, and the avatar stays as it was
+			var refused = await Picture("<svg xmlns='http://www.w3.org/2000/svg'/>"u8.ToArray(), "image/svg+xml", "x.svg");
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, refused.Status);
+			Assert.Equal(second, (await alice.Client.Get("/api/v1/accounts/verify_credentials")).Ok().Body.Text("avatar"));
+		}
+
+		// Mastodon's DELETE /api/v1/profile/avatar and /header: the picture goes, the default shows again
+		[Fact]
+		public async Task A_picture_is_removed_and_the_default_shows_again()
+		{
+			var alice = await _host.Mastodon($"pic{Guid.NewGuid():N}"[..12]);
+			var form = MastodonHelpers.Multipart(("avatar", MastodonHelpers.JpegWithMetadata(200, 200), "image/jpeg", "me.jpg"),
+				("header", MastodonHelpers.JpegWithMetadata(900, 300), "image/jpeg", "top.jpg"));
+			var set = (await alice.Client.Exchange(new HttpRequestMessage(HttpMethod.Patch, "/api/v1/accounts/update_credentials") { Content = form })).Ok();
+			var avatar = set.Body.Text("avatar");
+			var header = set.Body.Text("header");
+
+			var removed = (await alice.Client.Delete("/api/v1/profile/avatar")).Ok();
+
+			Assert.Contains("missing", removed.Body.Text("avatar"));
+			Assert.Equal(header, removed.Body.Text("header"));
+			Assert.Equal(HttpStatusCode.NotFound, await Served(avatar));
+			Assert.Equal(HttpStatusCode.OK, await Served(header));
+
+			Assert.Contains("missing", (await alice.Client.Delete("/api/v1/profile/header")).Ok().Body.Text("header"));
+			Assert.Equal(HttpStatusCode.NotFound, await Served(header));
+			Assert.False(await DB.Default.Find<MediaAttachment>().Match(m => m.ProfileOfAvatarId == alice.Persona.Id && m.TrashedAt == null).ExecuteAnyAsync(Token));
+		}
+
+		[Fact]
+		public async Task A_removed_roots_media_and_pictures_are_trashed_and_its_scheduled_posts_dropped()
+		{
+			var gone = await _host.Mastodon($"gone{Guid.NewGuid():N}"[..12]);
+			var posted = await Upload(gone, "posted.jpg");
+			var url = (await gone.Client.Post("/api/v1/statuses", ("status", "soon gone"), ("media_ids[]", posted))).Ok()
+				.Body["media_attachments"]![0]!["url"]!.GetValue<string>();
+			var held = await Upload(gone, "held.jpg");
+			(await gone.Client.Post("/api/v1/statuses", ("status", "later"), ("media_ids[]", held),
+				("scheduled_at", DateTime.UtcNow.AddHours(2).ToString("O")))).Ok();
+			var avatar = (await gone.Client.Exchange(new HttpRequestMessage(HttpMethod.Patch, "/api/v1/accounts/update_credentials")
+			{
+				Content = MastodonHelpers.Multipart(("avatar", MastodonHelpers.JpegWithMetadata(200, 200), "image/jpeg", "me.jpg"))
+			})).Ok().Body.Text("avatar");
+
+			Assert.True(await _host.Get<IRootRemoval>().Remove(gone.Persona.Root.Id, Token));
+
+			Assert.Equal(HttpStatusCode.NotFound, await Served(url));
+			Assert.Equal(HttpStatusCode.NotFound, await Served(avatar));
+			Assert.False(await DB.Default.Find<MediaAttachment>().Match(m => m.OwnerAvatarId == gone.Persona.Id && m.TrashedAt == null).ExecuteAnyAsync(Token));
+			Assert.False(await DB.Default.Find<Models.Social.ScheduledStatus>().Match(s => s.AvatarId == gone.Persona.Id).ExecuteAnyAsync(Token));
+		}
+
+		// what a login's media take: every persona's uploads and pictures, trashed ones no longer
+		[Fact]
+		public async Task A_logins_storage_counts_what_its_personas_keep()
+		{
+			var alice = await _host.Mastodon($"store{Guid.NewGuid():N}"[..12]);
+			using var root = _host.As(alice.Persona.Root.Jwt);
+			async Task<System.Text.Json.Nodes.JsonObject> Storage() => await (await root.GetAsync("/clientapi/user/storage", Token)).JsonBody();
+			Assert.Equal(0, Storage().Result["mediaBytes"]!.GetValue<long>());
+
+			var id = await Upload(alice, "a.jpg");
+			var stored = await Storage();
+			Assert.True(stored["mediaBytes"]!.GetValue<long>() > 0);
+			Assert.Equal(1, stored["mediaFiles"]!.GetValue<long>());
+			Assert.Null(stored["quotaBytes"]);
+
+			await _host.Get<IMediaService>().Trash(m => m.ID == id, "test", Token);
+			Assert.Equal(0, (await Storage())["mediaFiles"]!.GetValue<long>());
+		}
+
+		[Fact]
+		public async Task The_audit_adopts_todays_pictures_and_trashes_what_nothing_holds()
+		{
+			var media = _host.Get<IMediaService>();
+			var bob = await _host.Mastodon($"bob{Guid.NewGuid():N}"[..12]);
+			// a picture shown from before pictures had rows, and a leftover nothing holds
+			var picture = $"2020/01/{Guid.NewGuid():N}.jpg";
+			var leftover = $"2020/01/{Guid.NewGuid():N}.jpg";
+			foreach (var relative in new[] { picture, leftover })
+			{
+				Directory.CreateDirectory(Path.GetDirectoryName(Path.Combine(media.Root, relative))!);
+				await File.WriteAllBytesAsync(Path.Combine(media.Root, relative), new byte[] { 1, 2, 3 }, Token);
+			}
+			await DB.Default.Update<Models.User.Avatar>().MatchID(bob.Persona.Id).Modify(a => a.PictureURL, media.Url(picture)).ExecuteAsync(Token);
+
+			var looked = await MediaAudit.Run(media, fix: false, Token);
+			Assert.True(looked.Adopted >= 1);
+			Assert.True(looked.Unheld >= 1);
+			Assert.True(File.Exists(Path.Combine(media.Root, leftover)));
+
+			await MediaAudit.Run(media, fix: true, Token);
+
+			Assert.True(await DB.Default.Find<MediaAttachment>().Match(m => m.ProfileOfAvatarId == bob.Persona.Id && m.FilePath == picture && m.TrashedAt == null).ExecuteAnyAsync(Token));
+			Assert.Equal(HttpStatusCode.OK, await Served(media.Url(picture)));
+			Assert.Equal(HttpStatusCode.NotFound, await Served(media.Url(leftover)));
+			Assert.True(File.Exists(Path.Combine(media.TrashRoot, leftover)));
+			Assert.True(await DB.Default.Find<MediaAttachment>().Match(m => m.FilePath == leftover && m.TrashedAt != null).ExecuteAnyAsync(Token));
+		}
+	}
+}

PrivaPub.Tests/Http/MessageSignatureTests.cs

@@ -0,0 +1,103 @@
+using MongoDB.Entities;
+
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http.Features;
+
+using PrivaPub.Federation.Signing;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	// RFC 9421 message signatures, as WordPress's ActivityPub plugin, Ghost and Fedify send them first: a delivery so signed
+	// is taken in one request, and refused when its body or its target is not what was signed
+	[Trait("Category", "Integration")]
+	public sealed class MessageSignatureTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		Peer _peer;
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task A_delivery_signed_as_rfc9421_is_taken_and_one_whose_body_or_target_differs_is_refused()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var create = bob.Create("<p>signed the new way</p>", new[] { alice.Uri });
+			var noteId = create["object"]!["id"]!.GetValue<string>();
+			using var client = _host.Client();
+
+			var tampered = bob.MessageSignedPost(alice.Mouth, create);
+			tampered.Content = new ByteArrayContent(Encoding.UTF8.GetBytes(create.ToJsonString().Replace("new way", "other way")));
+			tampered.Content.Headers.TryAddWithoutValidation("Content-Type", "application/activity+json");
+			tampered.Content.Headers.TryAddWithoutValidation("Content-Digest", bob.MessageSignedPost(alice.Mouth, create).Content!.Headers.GetValues("Content-Digest").First());
+			Assert.Equal(HttpStatusCode.Unauthorized, (await client.SendAsync(tampered, Token)).StatusCode);
+			var elsewhere = bob.MessageSignedPost(alice.Mouth, create, signedFor: "/human-centipede");
+			Assert.Equal(HttpStatusCode.Unauthorized, (await client.SendAsync(elsewhere, Token)).StatusCode);
+
+			Assert.Equal(HttpStatusCode.Accepted, (await client.SendAsync(bob.MessageSignedPost(alice.Mouth, create), Token)).StatusCode);
+			Assert.Equal(1, await _host.RunInbox(Id(create), Token));
+			Assert.Contains("signed the new way", (await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteSingleAsync(Token)).ContentHtml);
+		}
+
+		static string Id(JsonObject activity) => activity["id"]!.GetValue<string>();
+
+		// a signed fetch (a GET, no body) verifies the same way, and so does RSA-PSS with SHA-512
+		[Fact]
+		public void A_signed_fetch_and_an_rsa_pss_signature_verify()
+		{
+			using var key = RSA.Create(2048);
+			var message = new HttpRequestMessage(HttpMethod.Get, "https://privapub.test/peasants/alice/scribbles/1");
+			MessageSignatures.Sign(message, "https://peer.example/users/bob#main-key", key.ExportPkcs8PrivateKeyPem(), body: null);
+			var request = Request(message);
+			var signature = RequestSignature.Of(request);
+			Assert.Equal("rfc9421:rsa-v1_5-sha256", signature.Scheme);
+			Assert.Null(signature.Problem(request, body: null));
+			Assert.True(signature.VerifiedBy(key.ExportSubjectPublicKeyInfoPem(), signature.Signed(request, "https://privapub.test")));
+			Assert.False(signature.VerifiedBy(key.ExportSubjectPublicKeyInfoPem(), signature.Signed(request, "https://elsewhere.example")));
+
+			var created = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+			var parameters = $"(\"@method\" \"@target-uri\");created={created};keyid=\"bob\";alg=\"rsa-pss-sha512\"";
+			var signatureBase = $"\"@method\": GET\n\"@target-uri\": https://privapub.test/peasants/alice/scribbles/1\n\"@signature-params\": {parameters}";
+			var signed = key.SignData(Encoding.UTF8.GetBytes(signatureBase), HashAlgorithmName.SHA512, RSASignaturePadding.Pss);
+			var pss = new HttpRequestMessage(HttpMethod.Get, "https://privapub.test/peasants/alice/scribbles/1");
+			pss.Headers.TryAddWithoutValidation("Signature-Input", $"pss={parameters}");
+			pss.Headers.TryAddWithoutValidation("Signature", $"pss=:{Convert.ToBase64String(signed)}:");
+			var pssRequest = Request(pss);
+			var pssSignature = RequestSignature.Of(pssRequest);
+			Assert.True(pssSignature.VerifiedBy(key.ExportSubjectPublicKeyInfoPem(), pssSignature.Signed(pssRequest, "https://privapub.test")));
+		}
+
+		static HttpRequest Request(HttpRequestMessage message)
+		{
+			var context = new DefaultHttpContext();
+			context.Request.Method = message.Method.Method;
+			context.Request.Host = new HostString(message.RequestUri!.Host);
+			context.Request.Path = message.RequestUri.AbsolutePath;
+			context.Features.Get<IHttpRequestFeature>()!.RawTarget = message.RequestUri.PathAndQuery;
+			foreach (var (name, values) in message.Headers)
+				context.Request.Headers[name] = values.ToArray();
+			return context.Request;
+		}
+	}
+}

PrivaPub.Tests/Http/NeverFiveHundredTests.cs

@@ -0,0 +1,127 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.AspNetCore.Routing.Patterns;
+using Microsoft.Extensions.DependencyInjection;
+
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Net.Http.Headers;
+using System.Text;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class NeverFiveHundredTests : IAsyncLifetime
+	{
+		static readonly string[] Junk = { "x", "000000000000000000000000", "%2e%2e", new string('a', 5000), "5f0c1a2b3c4d5e6f70819203" };
+
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		public static TheoryData<string> Credentials() => new() { "anonymous", "persona", "junk" };
+
+		[Theory]
+		[MemberData(nameof(Credentials))]
+		public async Task No_route_answers_500_to_junk(string credentials)
+		{
+			var token = TestContext.Current.CancellationToken;
+			var bearer = credentials switch
+			{
+				"persona" => await _host.MastodonToken(await _host.Persona(await _host.SignUp(), "junk")),
+				"junk" => "not-a-token",
+				_ => default
+			};
+			var jwt = credentials == "persona" ? (await _host.SignUp()).Jwt : bearer;
+			var failures = new List<string>();
+
+			foreach (var (method, template) in Routes())
+				foreach (var value in Junk)
+				{
+					var path = Fill(template, value);
+					using var request = new HttpRequestMessage(new HttpMethod(method), path);
+					request.Headers.Add(PrivaPubHost.ClientHeader, $"10.9.{Random.Shared.Next(256)}.{Random.Shared.Next(1, 255)}");
+					var auth = path.StartsWith("/api/", StringComparison.Ordinal) || path.StartsWith("/oauth/", StringComparison.Ordinal) ? bearer : jwt;
+					if (auth != default)
+						request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", auth);
+					if (method is "POST" or "PUT" or "PATCH")
+						request.Content = new StringContent("{}", Encoding.UTF8, "application/json");
+					using var client = _host.Client();
+					HttpResponseMessage response;
+					try
+					{
+						response = await client.SendAsync(request, token);
+					}
+					catch (Exception ex)
+					{
+						failures.Add($"{method} {Short(path)} threw {ex.GetType().Name}: {ex.Message}");
+						continue;
+					}
+					using (response)
+					{
+						if ((int)response.StatusCode >= 500)
+							failures.Add($"{method} {Short(path)} answered {(int)response.StatusCode}");
+						else if (path.StartsWith("/api/", StringComparison.Ordinal) && (int)response.StatusCode >= 400 && !await IsMastodonError(response))
+							failures.Add($"{method} {Short(path)} answered {(int)response.StatusCode} without a Mastodon error body");
+					}
+				}
+
+			Assert.True(failures.Count == 0, $"{failures.Count} problems as {credentials}:\n" + string.Join("\n", failures.Distinct().Take(80)));
+		}
+
+		IEnumerable<(string Method, string Template)> Routes()
+		{
+			var endpoints = _host.Services.GetRequiredService<EndpointDataSource>().Endpoints.OfType<RouteEndpoint>();
+			foreach (var endpoint in endpoints)
+			{
+				var methods = endpoint.Metadata.GetMetadata<IHttpMethodMetadata>()?.HttpMethods;
+				var template = "/" + endpoint.RoutePattern.RawText?.TrimStart('/');
+				foreach (var method in methods is { Count: > 0 } ? methods : new[] { "GET", "POST" })
+					yield return (method, template);
+			}
+		}
+
+		static string Fill(string template, string value)
+		{
+			var pattern = RoutePatternFactory.Parse(template);
+			var builder = new StringBuilder();
+			foreach (var segment in pattern.PathSegments)
+			{
+				builder.Append('/');
+				foreach (var part in segment.Parts)
+					builder.Append(part switch
+					{
+						RoutePatternLiteralPart literal => literal.Content,
+						RoutePatternParameterPart => value,
+						RoutePatternSeparatorPart separator => separator.Content,
+						_ => string.Empty
+					});
+			}
+			return builder.Length == 0 ? "/" : builder.ToString();
+		}
+
+		static async Task<bool> IsMastodonError(HttpResponseMessage response)
+		{
+			var body = await response.Content.ReadAsStringAsync();
+			try
+			{
+				return JsonNode.Parse(body) is JsonObject error && error["error"] is JsonValue;
+			}
+			catch (System.Text.Json.JsonException)
+			{
+				return false;
+			}
+		}
+
+		static string Short(string path) => path.Length > 120 ? path[..120] + "…" : path;
+	}
+}

PrivaPub.Tests/Http/NotificationPolicyTests.cs

@@ -0,0 +1,119 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+
+namespace PrivaPub.Tests.Http
+{
+	// Mastodon's notification policy and requests (4.3): accepted by default; a policy filters what strangers, new accounts
+	// or unasked private mentions send into a request per account, which the persona lets in (and that account from then
+	// on) or dismisses; or drops it
+	[Trait("Category", "Integration")]
+	public sealed class NotificationPolicyTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static async Task<IEnumerable<string>> Notifiers(Mastodon persona, string query = "") =>
+			(await persona.Client.Get("/api/v1/notifications" + query)).Ok().Array.Select(n => n!["account"].Text("id"));
+
+		[Fact]
+		public async Task Everything_is_accepted_until_the_persona_chooses()
+		{
+			var alice = await _host.Mastodon("alice");
+			var stranger = await _host.Mastodon("stranger");
+			var post = (await alice.Status("like me")).Text("id");
+
+			var policy = (await alice.Client.Get("/api/v2/notifications/policy")).Ok().Body;
+			(await stranger.Client.Post($"/api/v1/statuses/{post}/favourite")).Ok();
+
+			Assert.Equal(["accept"], new[] { "for_not_following", "for_not_followers", "for_new_accounts", "for_private_mentions", "for_limited_accounts" }
+				.Select(key => policy.Text(key)).Distinct());
+			Assert.Contains(stranger.Id, await Notifiers(alice));
+			Assert.Empty((await alice.Client.Get("/api/v1/notifications/requests")).Ok().Array);
+		}
+
+		[Fact]
+		public async Task A_strangers_notifications_wait_in_a_request_which_lets_them_and_the_stranger_in()
+		{
+			var alice = await _host.Mastodon("alice");
+			var friend = await _host.Mastodon("friend");
+			var stranger = await _host.Mastodon("stranger");
+			(await alice.Client.Post($"/api/v1/accounts/{friend.Id}/follow")).Ok();
+			var post = (await alice.Status("like me")).Text("id");
+			var policy = (await alice.Client.Patch("/api/v2/notifications/policy", ("for_not_following", "filter"))).Ok().Body;
+			Assert.Equal("filter", policy.Text("for_not_following"));
+
+			(await friend.Client.Post($"/api/v1/statuses/{post}/favourite")).Ok();
+			(await stranger.Client.Post($"/api/v1/statuses/{post}/favourite")).Ok();
+
+			Assert.Equal([friend.Id], await Notifiers(alice));
+			Assert.Equal(1, (await alice.Client.Get("/api/v1/notifications/unread_count")).Ok().Body["count"]!.GetValue<int>());
+			Assert.DoesNotContain(stranger.Id, (await alice.Client.Get("/api/v2/notifications")).Ok().Body["accounts"]!.AsArray().Select(a => a.Text("id")));
+			var request = Assert.Single((await alice.Client.Get("/api/v1/notifications/requests")).Ok().Array)!;
+			Assert.Equal((stranger.Id, "1", post), (request["account"].Text("id"), request.Text("notifications_count"), request["last_status"].Text("id")));
+			var summary = (await alice.Client.Get("/api/v2/notifications/policy")).Ok().Body["summary"]!;
+			Assert.Equal((1, 1), (summary["pending_requests_count"]!.GetValue<int>(), summary["pending_notifications_count"]!.GetValue<int>()));
+			Assert.Equal([stranger.Id], await Notifiers(alice, $"?account_id={stranger.Id}&include_filtered=true"));
+
+			(await alice.Client.Post($"/api/v1/notifications/requests/{request.Text("id")}/accept")).Ok();
+
+			Assert.Contains(stranger.Id, await Notifiers(alice));
+			Assert.Empty((await alice.Client.Get("/api/v1/notifications/requests")).Ok().Array);
+			var again = (await alice.Status("like me again")).Text("id");
+			(await stranger.Client.Post($"/api/v1/statuses/{again}/favourite")).Ok();
+			Assert.Equal(2, (await Notifiers(alice, "?types[]=favourite")).Count(id => id == stranger.Id));
+		}
+
+		[Fact]
+		public async Task A_dismissed_request_takes_its_notifications_with_it_and_a_dropped_one_is_never_kept()
+		{
+			var alice = await _host.Mastodon("alice");
+			var stranger = await _host.Mastodon("stranger");
+			var newcomer = await _host.Mastodon("newcomer");
+			var post = (await alice.Status("like me")).Text("id");
+			// (v1 speaks of filtering only)
+			Assert.True((await alice.Client.Put("/api/v1/notifications/policy", ("filter_not_following", "true"))).Ok().Body.Flag("filter_not_following"));
+			(await stranger.Client.Post($"/api/v1/statuses/{post}/favourite")).Ok();
+			var request = Assert.Single((await alice.Client.Get("/api/v1/notifications/requests")).Ok().Array)!;
+
+			(await alice.Client.Post($"/api/v1/notifications/requests/{request.Text("id")}/dismiss")).Ok();
+
+			Assert.Empty((await alice.Client.Get("/api/v1/notifications/requests")).Ok().Array);
+			Assert.Empty(await Notifiers(alice, $"?account_id={stranger.Id}&include_filtered=true"));
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Get($"/api/v1/notifications/requests/{request.Text("id")}")).Status);
+
+			(await alice.Client.Patch("/api/v2/notifications/policy", ("for_new_accounts", "drop"))).Ok();
+			(await newcomer.Client.Post($"/api/v1/statuses/{post}/favourite")).Ok();
+			Assert.Empty(await Notifiers(alice, $"?account_id={newcomer.Id}&include_filtered=true"));
+			Assert.Empty((await alice.Client.Get("/api/v1/notifications/requests")).Ok().Array);
+		}
+
+		[Fact]
+		public async Task An_unasked_private_mention_is_filtered_and_one_answering_the_persona_is_not()
+		{
+			var alice = await _host.Mastodon("alice");
+			var stranger = await _host.Mastodon("stranger");
+			(await alice.Client.Patch("/api/v2/notifications/policy", ("for_private_mentions", "filter"))).Ok();
+			var asked = (await alice.Status($"@{stranger.UserName} write to me", ("visibility", "direct"))).Text("id");
+
+			await stranger.Status($"@{alice.UserName} hello out of nowhere", ("visibility", "direct"));
+			await stranger.Status($"@{alice.UserName} as you asked", ("visibility", "direct"), ("in_reply_to_id", asked));
+
+			var mentions = (await alice.Client.Get("/api/v1/notifications?types[]=mention")).Ok().Array.Select(n => n!["status"].Text("content")).ToList();
+			Assert.Contains(mentions, c => c.Contains("as you asked"));
+			Assert.DoesNotContain(mentions, c => c.Contains("out of nowhere"));
+			Assert.Single((await alice.Client.Get("/api/v1/notifications/requests")).Ok().Array);
+		}
+	}
+}

PrivaPub.Tests/Http/OAuthTests.cs

@@ -0,0 +1,346 @@
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class OAuthTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		async Task<Persona> NewPersona(string name = "oauth") => await _host.Persona(await _host.SignUp(), name);
+
+		static async Task<bool> SignedIn(HttpClient client, OAuthApp app)
+		{
+			var response = await client.GetAsync(app.ReturnUrl(), TestContext.Current.CancellationToken);
+			return response.StatusCode == HttpStatusCode.OK;
+		}
+
+		static async Task AssertMastodonError(HttpResponseMessage response, HttpStatusCode status)
+		{
+			Assert.Equal(status, response.StatusCode);
+			Assert.False(string.IsNullOrEmpty((await response.JsonBody())["error"]?.GetValue<string>()));
+		}
+
+		[Fact]
+		public async Task The_token_names_the_persona_and_never_the_root()
+		{
+			var persona = await NewPersona();
+			var root = persona.Root;
+			using var client = _host.Client(cookies: true);
+			var app = await client.RegisterApp();
+
+			var exchanged = await client.Exchange(app, await client.Code(app, persona));
+			var body = await exchanged.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.OK, exchanged.StatusCode);
+			Assert.DoesNotContain(root.Id, body);
+			Assert.DoesNotContain(root.UserName, body);
+			var token = JsonNode.Parse(body)!["access_token"]!.GetValue<string>();
+			using var api = _host.As(token);
+			var account = await api.GetStringAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken);
+			Assert.Contains($"\"id\":\"{persona.Id}\"", account);
+			Assert.DoesNotContain(root.Id, account);
+			Assert.DoesNotContain(root.UserName, account);
+
+			var stored = await ClientApi.StoredTokens(app.ClientId);
+			Assert.NotEmpty(stored);
+			foreach (var entry in stored)
+			{
+				Assert.Equal(persona.Id, entry["subject"].AsString);
+				var raw = entry.ToString();
+				var payload = entry.Contains("payload") && entry["payload"].IsString ? ClientApi.JwtPayload(entry["payload"].AsString) : string.Empty;
+				Assert.DoesNotContain(root.Id, raw + payload);
+				Assert.DoesNotContain(root.UserName, raw + payload);
+			}
+			var access = stored.Single(t => ClientApi.IsAccessToken(t));
+			Assert.Equal(persona.Id, JsonNode.Parse(ClientApi.JwtPayload(access["payload"].AsString))!["sub"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task A_wrong_password_shows_an_error_and_signs_nobody_in()
+		{
+			var persona = await NewPersona();
+			using var client = _host.Client(cookies: true);
+			var app = await client.RegisterApp();
+
+			var response = await client.SignIn(persona.Root, app.ReturnUrl(), password: "Wrong-Pass-1!");
+
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			Assert.Contains("That username and password do not match.", await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+			Assert.DoesNotContain(response.Headers.TryGetValues("Set-Cookie", out var cookies) ? cookies : Enumerable.Empty<string>(),
+				c => c.StartsWith("privapub.oauth=", StringComparison.Ordinal));
+			var authorize = await client.GetAsync(app.ReturnUrl(), TestContext.Current.CancellationToken);
+			Assert.Equal(HttpStatusCode.Redirect, authorize.StatusCode);
+			Assert.StartsWith("/oauth/login?", authorize.Headers.Location!.OriginalString);
+		}
+
+		[Fact]
+		public async Task A_login_without_the_antiforgery_token_is_refused()
+		{
+			var persona = await NewPersona();
+			using var client = _host.Client(cookies: true);
+			await client.GetStringAsync("/oauth/login", TestContext.Current.CancellationToken);
+
+			var response = await client.Form("/oauth/login", ("returnUrl", "/oauth/authorize?x=1"), ("userName", persona.Root.UserName), ("password", persona.Root.Password));
+
+			Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+			Assert.False(response.Headers.TryGetValues("Set-Cookie", out var cookies) && cookies.Any(c => c.StartsWith("privapub.oauth=", StringComparison.Ordinal)));
+		}
+
+		[Theory]
+		[InlineData("https://evil.example/oauth/authorize?client_id=x")]
+		[InlineData("//evil.example/oauth/authorize?client_id=x")]
+		[InlineData("/\\evil.example/oauth/authorize?client_id=x")]
+		[InlineData("/somewhere/else")]
+		public async Task The_return_address_never_leaves_the_site(string returnUrl)
+		{
+			var persona = await NewPersona();
+			using var client = _host.Client(cookies: true);
+
+			var response = await client.SignIn(persona.Root, returnUrl);
+
+			Assert.Equal(HttpStatusCode.Redirect, response.StatusCode);
+			Assert.Equal("/oauth/authorize?signed_in=1", response.Headers.Location!.OriginalString);
+		}
+
+		[Fact]
+		public async Task Denying_answers_access_denied_and_no_code()
+		{
+			var persona = await NewPersona();
+			using var client = _host.Client(cookies: true);
+			var app = await client.RegisterApp();
+			Assert.Equal(HttpStatusCode.Redirect, (await client.SignIn(persona.Root, app.ReturnUrl())).StatusCode);
+
+			var response = await client.Choose(app, persona.Id, decision: "deny");
+			var page = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+			Assert.Null(ClientApi.CodeIn(page));
+			Assert.Equal(HttpStatusCode.Redirect, response.StatusCode);
+			var location = response.Headers.Location!.OriginalString;
+			Assert.StartsWith(ClientApi.OutOfBand + "?error=access_denied", location);
+			Assert.DoesNotContain("code=", location);
+			Assert.DoesNotContain(await ClientApi.StoredTokens(app.ClientId), ClientApi.IsAccessToken);
+		}
+
+		[Fact]
+		public async Task Choosing_another_roots_persona_shows_the_choice_again_without_a_code()
+		{
+			var mine = await NewPersona();
+			var theirs = await NewPersona("theirs");
+			using var client = _host.Client(cookies: true);
+			var app = await client.RegisterApp();
+			Assert.Equal(HttpStatusCode.Redirect, (await client.SignIn(mine.Root, app.ReturnUrl())).StatusCode);
+
+			var response = await client.Choose(app, theirs.Id);
+			var page = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			Assert.Null(ClientApi.CodeIn(page));
+			Assert.Contains(mine.Id, page);
+			Assert.DoesNotContain(theirs.Id, page);
+			Assert.DoesNotContain(theirs.UserName, page);
+			Assert.DoesNotContain(await ClientApi.StoredTokens(app.ClientId), ClientApi.IsAccessToken);
+		}
+
+		[Fact]
+		public async Task A_banned_root_is_sent_back_to_the_login()
+		{
+			var persona = await NewPersona();
+			using var client = _host.Client(cookies: true);
+			var app = await client.RegisterApp();
+			Assert.Equal(HttpStatusCode.Redirect, (await client.SignIn(persona.Root, app.ReturnUrl())).StatusCode);
+			var choice = await client.Choice(app);
+
+			await ClientApi.Ban(persona.Root.Id);
+			var authorize = await client.GetAsync(app.ReturnUrl(), TestContext.Current.CancellationToken);
+			var chosen = await client.Decide(choice, persona.Id);
+			var again = await client.SignIn(persona.Root, app.ReturnUrl());
+
+			Assert.Equal(HttpStatusCode.Redirect, authorize.StatusCode);
+			Assert.StartsWith("/oauth/login?returnUrl=", authorize.Headers.Location!.OriginalString);
+			Assert.Equal(HttpStatusCode.Redirect, chosen.StatusCode);
+			Assert.StartsWith("/oauth/login?returnUrl=", chosen.Headers.Location!.OriginalString);
+			Assert.Equal(HttpStatusCode.OK, again.StatusCode);
+			Assert.Contains("That username and password do not match.", await again.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+		}
+
+		[Fact]
+		public async Task A_code_issued_before_a_ban_buys_no_token()
+		{
+			var persona = await NewPersona();
+			using var client = _host.Client(cookies: true);
+			var app = await client.RegisterApp();
+			var code = await client.Code(app, persona);
+
+			await ClientApi.Ban(persona.Root.Id);
+			var response = await client.Exchange(app, code);
+
+			Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+			Assert.Equal("invalid_grant", (await response.JsonBody())["error"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task Force_login_asks_for_the_password_again()
+		{
+			var persona = await NewPersona();
+			using var client = _host.Client(cookies: true);
+			var app = await client.RegisterApp();
+			Assert.Equal(HttpStatusCode.Redirect, (await client.SignIn(persona.Root, app.ReturnUrl())).StatusCode);
+			Assert.True(await SignedIn(client, app));
+
+			var forced = await client.GetAsync(app.ReturnUrl("force_login=true"), TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.Redirect, forced.StatusCode);
+			var location = forced.Headers.Location!.OriginalString;
+			Assert.StartsWith("/oauth/login?returnUrl=", location);
+			var returnUrl = Uri.UnescapeDataString(location["/oauth/login?returnUrl=".Length..]);
+			Assert.Contains("force_login=true", returnUrl);
+			Assert.DoesNotContain("signed_in", returnUrl);
+			var signedIn = await client.SignIn(persona.Root, returnUrl);
+			Assert.Equal(HttpStatusCode.Redirect, signedIn.StatusCode);
+			Assert.EndsWith("&signed_in=1", signedIn.Headers.Location!.OriginalString);
+			var page = await client.GetAsync(signedIn.Headers.Location!.OriginalString, TestContext.Current.CancellationToken);
+			Assert.Equal(HttpStatusCode.OK, page.StatusCode);
+			Assert.Contains(persona.Id, await page.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+		}
+
+		[Fact]
+		public async Task An_authorization_code_works_once()
+		{
+			var persona = await NewPersona();
+			using var client = _host.Client(cookies: true);
+			var app = await client.RegisterApp();
+			var code = await client.Code(app, persona);
+
+			var first = await client.Exchange(app, code);
+			var second = await client.Exchange(app, code);
+
+			Assert.Equal(HttpStatusCode.OK, first.StatusCode);
+			Assert.Equal(HttpStatusCode.BadRequest, second.StatusCode);
+			Assert.Equal("invalid_grant", (await second.JsonBody())["error"]!.GetValue<string>());
+			using var api = _host.As((await first.JsonBody())["access_token"]!.GetValue<string>());
+			await AssertMastodonError(await api.GetAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken), HttpStatusCode.Unauthorized);
+		}
+
+		[Theory]
+		[InlineData("password")]
+		[InlineData("refresh_token")]
+		public async Task Grants_other_than_code_and_client_credentials_are_refused(string grant)
+		{
+			var persona = await NewPersona();
+			using var client = _host.Client();
+			var app = await client.RegisterApp();
+
+			var response = await client.Form("/oauth/token", ("grant_type", grant), ("client_id", app.ClientId), ("client_secret", app.ClientSecret),
+				("username", persona.Root.UserName), ("password", persona.Root.Password), ("refresh_token", "anything"), ("scope", "read"));
+			var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+			Assert.DoesNotContain("access_token", body);
+			Assert.Equal("unsupported_grant_type", JsonNode.Parse(body)!["error"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task A_client_credentials_token_is_no_persona()
+		{
+			using var client = _host.Client();
+			var app = await client.RegisterApp("read write");
+			var response = await client.Form("/oauth/token", ("grant_type", "client_credentials"), ("client_id", app.ClientId), ("client_secret", app.ClientSecret), ("scope", "read"));
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			var token = (await response.JsonBody())["access_token"]!.GetValue<string>();
+			using var api = _host.As(token);
+
+			Assert.Equal(HttpStatusCode.OK, (await api.GetAsync("/api/v1/apps/verify_credentials", TestContext.Current.CancellationToken)).StatusCode);
+			await AssertMastodonError(await api.GetAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken), HttpStatusCode.Unauthorized);
+			await AssertMastodonError(await api.GetAsync("/api/v1/notifications", TestContext.Current.CancellationToken), HttpStatusCode.Unauthorized);
+		}
+
+		[Fact]
+		public async Task A_read_only_token_cannot_post()
+		{
+			var token = await _host.MastodonToken(await NewPersona(), "read");
+			using var api = _host.As(token);
+
+			var response = await api.Form("/api/v1/statuses", ("status", "nope"));
+
+			await AssertMastodonError(response, HttpStatusCode.Forbidden);
+			Assert.Equal(HttpStatusCode.OK, (await api.GetAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken)).StatusCode);
+		}
+
+		[Fact]
+		public async Task The_follow_scope_covers_reading_follows()
+		{
+			var token = await _host.MastodonToken(await NewPersona(), "follow");
+			using var api = _host.As(token);
+
+			Assert.Equal(HttpStatusCode.OK, (await api.GetAsync("/api/v1/follow_requests", TestContext.Current.CancellationToken)).StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await api.GetAsync("/api/v1/blocks", TestContext.Current.CancellationToken)).StatusCode);
+			await AssertMastodonError(await api.GetAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken), HttpStatusCode.Forbidden);
+		}
+
+		[Fact]
+		public async Task A_revoked_token_stops_working()
+		{
+			var persona = await NewPersona();
+			using var client = _host.Client(cookies: true);
+			var app = await client.RegisterApp();
+			var token = await client.Token(app, persona);
+			using var api = _host.As(token);
+			Assert.Equal(HttpStatusCode.OK, (await api.GetAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken)).StatusCode);
+
+			var revoked = await client.Form("/oauth/revoke", ("token", token), ("client_id", app.ClientId), ("client_secret", app.ClientSecret));
+
+			Assert.Equal(HttpStatusCode.OK, revoked.StatusCode);
+			await AssertMastodonError(await api.GetAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken), HttpStatusCode.Unauthorized);
+		}
+
+		[Fact]
+		public async Task The_login_and_authorize_pages_are_hardened()
+		{
+			var persona = await NewPersona();
+			using var client = _host.Client(cookies: true);
+			var app = await client.RegisterApp();
+
+			var login = await client.GetAsync("/oauth/login?returnUrl=" + Uri.EscapeDataString(app.ReturnUrl()), TestContext.Current.CancellationToken);
+			var failed = await client.SignIn(persona.Root, app.ReturnUrl(), password: "Wrong-Pass-1!");
+			Assert.Equal(HttpStatusCode.Redirect, (await client.SignIn(persona.Root, app.ReturnUrl())).StatusCode);
+			var authorize = await client.GetAsync(app.ReturnUrl(), TestContext.Current.CancellationToken);
+
+			foreach (var response in new[] { login, failed, authorize })
+			{
+				Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+				var csp = string.Join(";", response.Headers.GetValues("Content-Security-Policy"));
+				Assert.Contains("default-src 'none'", csp);
+				Assert.Contains("frame-ancestors 'none'", csp);
+				Assert.Contains("no-store", response.Headers.CacheControl!.ToString());
+			}
+		}
+
+		[Fact]
+		public async Task The_eleventh_login_from_one_address_in_a_minute_is_refused()
+		{
+			using var client = _host.ClientAt("198.51.100.12");
+			for (var attempt = 1; attempt <= 10; attempt++)
+				Assert.Equal(HttpStatusCode.OK, (await client.GetAsync("/oauth/login", TestContext.Current.CancellationToken)).StatusCode);
+
+			var eleventh = await client.GetAsync("/oauth/login", TestContext.Current.CancellationToken);
+			using var elsewhere = _host.ClientAt("198.51.100.13");
+			var other = await elsewhere.GetAsync("/oauth/login", TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.TooManyRequests, eleventh.StatusCode);
+			Assert.Equal(HttpStatusCode.OK, other.StatusCode);
+		}
+	}
+}

PrivaPub.Tests/Http/OneAnswerTests.cs

@@ -0,0 +1,270 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.Host.FederationHelpers;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Tests.Http
+{
+	// Two views of the same fact give one answer (owner decision 2026-10-04: fix the mismatches).
+	[Trait("Category", "Integration")]
+	public sealed class OneAnswerTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		HttpClient _client;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_client = _host.Client();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			_client?.Dispose();
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task Anyone_may_search_and_only_a_signed_in_reader_resolves_or_pages()
+		{
+			var reader = await _host.Mastodon("searcher");
+
+			Assert.Equal(HttpStatusCode.OK, (await _client.Get("/api/v2/search?q=somebody")).Status);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _client.Get("/api/v2/search?q=somebody&resolve=true")).Status);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await _client.Get("/api/v2/search?q=somebody&offset=5")).Status);
+			Assert.Equal(HttpStatusCode.OK, (await reader.Client.Get("/api/v2/search?q=somebody&offset=5")).Status);
+		}
+
+		[Fact]
+		public async Task A_remote_account_that_deletes_itself_leaves_nothing_in_the_counts()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var author = await _host.Mastodon("liked");
+			var post = await author.Status("like me");
+			var fan = new RemoteActor(_peer, "fickle");
+			var like = new JsonObject
+			{
+				["id"] = $"{fan.Id}#likes/{Guid.NewGuid():N}",
+				["type"] = "Like",
+				["actor"] = fan.Id,
+				["object"] = post.Text("uri")
+			};
+			Assert.Equal(HttpStatusCode.Accepted, (await _client.SendAsync(fan.SignedPost("/human-centipede", like), token)).StatusCode);
+			await _host.RunInbox(like["id"]!.GetValue<string>(), token);
+			Assert.Equal(1, (await author.Client.Get($"/api/v1/statuses/{post.Text("id")}")).Ok().Body.Number("favourites_count"));
+
+			var delete = new JsonObject
+			{
+				["id"] = $"{fan.Id}#delete",
+				["type"] = "Delete",
+				["actor"] = fan.Id,
+				["object"] = fan.Id,
+				["to"] = new JsonArray("https://www.w3.org/ns/activitystreams#Public")
+			};
+			Assert.Equal(HttpStatusCode.Accepted, (await _client.SendAsync(fan.SignedPost("/human-centipede", delete), token)).StatusCode);
+			await _host.RunInbox(delete["id"]!.GetValue<string>(), token);
+
+			Assert.Equal(0, (await author.Client.Get($"/api/v1/statuses/{post.Text("id")}")).Ok().Body.Number("favourites_count"));
+			Assert.Empty((await author.Client.Get($"/api/v1/statuses/{post.Text("id")}/favourited_by")).Ok().Array);
+			Assert.False(await DB.Default.Find<Favourite>().Match(f => f.ActorURI == fan.Id).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<Notification>().Match(n => n.FromActorURI == fan.Id).ExecuteAnyAsync(token));
+			Assert.Equal(0, (await author.Client.Get("/api/v1/notifications/unread_count")).Ok().Body.Number("count"));
+		}
+
+		[Fact]
+		public async Task Only_public_and_unlisted_replies_are_counted()
+		{
+			var author = await _host.Mastodon("threadstart");
+			var replier = await _host.Mastodon("replier");
+			var root = await author.Status("say something");
+			var id = root.Text("id");
+
+			await replier.Status("in public", ("in_reply_to_id", id));
+			await replier.Status("quietly", ("in_reply_to_id", id), ("visibility", "unlisted"));
+			await replier.Status("for my followers", ("in_reply_to_id", id), ("visibility", "private"));
+			await replier.Status($"@{author.UserName} just you", ("in_reply_to_id", id), ("visibility", "direct"));
+
+			Assert.Equal(2, (await author.Client.Get($"/api/v1/statuses/{id}")).Ok().Body.Number("replies_count"));
+		}
+
+		[Fact]
+		public async Task A_status_longer_than_advertised_is_refused()
+		{
+			var author = await _host.Mastodon("wordy");
+			var limit = (await _client.Get("/api/v2/instance")).Ok().Body["configuration"]!["statuses"].Number("max_characters");
+
+			var refused = await author.Client.Post("/api/v1/statuses", ("status", new string('a', limit + 1)));
+			var accepted = await author.Client.Post("/api/v1/statuses", ("status", new string('a', limit)));
+
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, refused.Status);
+			Assert.Equal(HttpStatusCode.OK, accepted.Status);
+		}
+
+		[Fact]
+		public async Task Joining_a_community_by_invitation_is_following_it()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var owner = await _host.Persona(await _host.SignUp(), "commowner");
+			var joinerRoot = await _host.SignUp("joiner");
+			var joiner = await _host.Persona(joinerRoot, "joiner");
+			var group = await _host.Group(owner, community: true);
+			var groupName = group["userName"]!.GetValue<string>();
+			using var client = _host.As(joinerRoot.Jwt);
+
+			var joined = await client.PostJson("/clientapi/group/join", new { avatarId = joiner.Id, invitationCode = group["invitationCode"]!.GetValue<string>() });
+
+			Assert.Equal(HttpStatusCode.OK, joined.StatusCode);
+			Assert.Equal(1, (await _client.Fetch($"/peasants/{groupName}/groupies")).Json["totalItems"]!.GetValue<int>());
+			Assert.True(await DB.Default.Find<Following>().Match(f => f.AvatarId == joiner.Id && f.State == FollowState.Accepted).ExecuteAnyAsync(token));
+		}
+
+		public static TheoryData<string> AnsweredRoutes() => new()
+		{
+			"/api/v1/directory",
+			"/api/v1/tags/cats",
+			"/api/v1/instance/languages",
+			"/api/v1/instance/translation_languages",
+			"/api/v1/instance/domain_blocks",
+			"/api/v1/instance/privacy_policy",
+			"/api/v1/timelines/link?url=https%3A%2F%2Fexample.org%2F",
+			"/api/v1/accounts/000000000000000000000000/identity_proofs"
+		};
+
+		[Theory]
+		[MemberData(nameof(AnsweredRoutes))]
+		public async Task Mastodon_routes_we_have_nothing_behind_answer_instead_of_404(string path)
+		{
+			Assert.Equal(HttpStatusCode.OK, (await _client.Get(path)).Status);
+		}
+
+		[Fact]
+		public async Task Likes_of_one_post_come_as_one_group_of_notifications()
+		{
+			var author = await _host.Mastodon("grouped");
+			var first = await _host.Mastodon("fanone");
+			var second = await _host.Mastodon("fantwo");
+			var post = await author.Status("like me twice");
+			var id = post.Text("id");
+			await first.Client.Post($"/api/v1/statuses/{id}/favourite");
+			await second.Client.Post($"/api/v1/statuses/{id}/favourite");
+
+			var list = (await author.Client.Get("/api/v2/notifications")).Ok().Body;
+			var group = Assert.Single(list["notification_groups"]!.AsArray(), g => g!.Text("type") == "favourite")!;
+			var key = group.Text("group_key");
+
+			Assert.Equal($"grouped-favourite-{id}", key);
+			// told alone (v1, a stream), each notification names the group it belongs to
+			Assert.All((await author.Client.Get("/api/v1/notifications?types[]=favourite")).Ok().Array, n => Assert.Equal(key, n.Text("group_key")));
+			Assert.Equal(2, group.Number("notifications_count"));
+			Assert.Equal(2, group["sample_account_ids"]!.AsArray().Count);
+			Assert.Equal(id, group.Text("status_id"));
+			Assert.Contains(list["statuses"]!.AsArray(), s => s!.Text("id") == id);
+			Assert.True((await author.Client.Get("/api/v2/notifications/unread_count")).Ok().Body.Number("count") >= 1);
+			Assert.Equal(key, Assert.Single((await author.Client.Get($"/api/v2/notifications/{key}")).Ok().Body["notification_groups"]!.AsArray())!.Text("group_key"));
+			Assert.Equal(2, (await author.Client.Get($"/api/v2/notifications/{key}/accounts")).Ok().Array.Count);
+			// a notifications marker past them reads them
+			var newest = (await author.Client.Get("/api/v1/notifications")).Ok().Ids.First();
+			(await author.Client.Post("/api/v1/markers", ("notifications[last_read_id]", newest))).Ok();
+			Assert.Equal(0, (await author.Client.Get("/api/v2/notifications/unread_count")).Ok().Body.Number("count"));
+			Assert.Equal(0, (await author.Client.Get("/api/v1/notifications/unread_count")).Ok().Body.Number("count"));
+			Assert.Equal(HttpStatusCode.OK, (await author.Client.Post($"/api/v2/notifications/{key}/dismiss")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await author.Client.Get($"/api/v2/notifications/{key}")).Status);
+		}
+
+		[Fact]
+		public async Task A_hashtag_link_opens_a_page_of_public_posts_with_that_tag()
+		{
+			var author = await _host.Mastodon("tagger");
+			var tag = $"tag{Guid.NewGuid():N}"[..16];
+			await author.Status($"about #{tag}");
+			await author.Status($"quietly about #{tag}", ("visibility", "private"));
+
+			var page = await _client.Fetch($"/tags/{tag}", Browser);
+
+			Assert.Equal(HttpStatusCode.OK, page.Status);
+			Assert.Contains("about", page.Text);
+			Assert.DoesNotContain("quietly", page.Text);
+			Assert.Contains("default-src 'none'", page.Response.Headers.GetValues("Content-Security-Policy").Single());
+		}
+
+		[Fact]
+		public async Task A_communitys_announces_resolve_while_the_post_is_shown()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var owner = await _host.Persona(await _host.SignUp(), "announcer");
+			var community = await _host.FederatedGroup(owner, community: true);
+			var post = await _host.Publish(owner, new PrivaPub.Domain.Statuses.StatusDraft { Text = "into the community", PlainText = true, GroupId = community.Id });
+			var kept = await DB.Default.Find<GroupAnnouncement>().Match(a => a.GroupId == community.Id && a.ObjectURI == post.ObjectURI).ExecuteAsync(token);
+			Assert.Equal(2, kept.Count);//the activity, and the object for Mastodon
+
+			foreach (var announcement in kept)
+			{
+				var fetched = await _client.Fetch(PathOf(announcement.ActivityURI));
+				Assert.Equal(HttpStatusCode.OK, fetched.Status);
+				Assert.Equal("Announce", fetched.Json["type"]!.GetValue<string>());
+				Assert.Equal(announcement.ActivityURI, fetched.Json["id"]!.GetValue<string>());
+			}
+			var listed = await _client.Fetch($"/peasants/{community.UserName}/grunts/announce-{post.ID}");
+			Assert.Equal(HttpStatusCode.OK, listed.Status);
+
+			await _host.Remove(owner, post);
+			Assert.Equal(HttpStatusCode.Gone, (await _client.Fetch(PathOf(kept[0].ActivityURI))).Status);
+		}
+
+		[Fact]
+		public async Task A_boost_points_at_the_boosted_posts_page()
+		{
+			var author = await _host.Mastodon("boosted");
+			var booster = await _host.Mastodon("booster");
+			var post = await author.Status("boost me");
+
+			var boost = (await booster.Client.Post($"/api/v1/statuses/{post.Text("id")}/reblog")).Ok().Body;
+
+			Assert.Equal(post.Text("url"), boost.Text("url"));
+			var browser = await _client.Fetch(PathOf(boost.Text("uri")), Browser);
+			Assert.Equal(HttpStatusCode.Redirect, browser.Status);
+		}
+
+		[Fact]
+		public async Task A_remote_accounts_counts_are_what_its_server_publishes()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var reader = await _host.Mastodon("counter");
+			var popular = new RemoteActor(_peer, "popular");
+			_peer.Serve(new Uri(popular.Id).AbsolutePath + "/followers",
+				$$"""{"@context":"https://www.w3.org/ns/activitystreams","id":"{{popular.Id}}/followers","type":"OrderedCollection","totalItems":42}""");
+			var remote = _host.Get<PrivaPub.Federation.Actors.IRemoteActorService>();
+			var account = await remote.GetActor(popular.Id, refresh: true, token);
+
+			await _host.Run(j => j.Kind == PrivaPub.Models.Jobs.JobKind.CountAccount && j.Payload == popular.Id, token);
+
+			var shown = (await reader.Client.Get($"/api/v1/accounts/{account.ID}")).Ok().Body;
+			Assert.Equal(42, shown.Number("followers_count"));
+			Assert.Equal(0, shown.Number("following_count"));
+		}
+
+		[Fact]
+		public async Task Notification_policy_and_requests_answer_a_signed_in_reader()
+		{
+			var reader = await _host.Mastodon("policy");
+
+			Assert.Equal(HttpStatusCode.OK, (await reader.Client.Get("/api/v1/notifications/policy")).Status);
+			Assert.Equal("accept", (await reader.Client.Get("/api/v2/notifications/policy")).Ok().Body.Text("for_not_following"));
+			Assert.Empty((await reader.Client.Get("/api/v1/notifications/requests")).Ok().Array);
+		}
+	}
+}

PrivaPub.Tests/Http/PersonaArchiveTests.cs

@@ -0,0 +1,346 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Media;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.IO.Compression;
+using System.Net;
+using System.Net.Http.Json;
+using System.Text;
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Tests.Http
+{
+	// A persona's archive (owner decision 2026-10-07): exported in Mastodon's layout with nothing of its root, its siblings
+	// or its keys; imported back home without bringing anything back, or into another persona as posts nobody is told of,
+	// once; Mastodon's own archives read too; and hostile ones refused.
+	[Trait("Category", "Integration")]
+	public sealed class PersonaArchiveTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static string Base(Persona persona) => $"/clientapi/persona/{persona.Id}/archive";
+
+		async Task<JsonObject> Status(Persona persona)
+		{
+			using var client = _host.As(persona.Root.Jwt);
+			return (await client.GetFromJsonAsync<JsonObject>(Base(persona), Token))!;
+		}
+
+		async Task<byte[]> Exported(Persona persona)
+		{
+			using var client = _host.As(persona.Root.Jwt);
+			Assert.Equal(HttpStatusCode.Accepted, (await client.PostAsync(Base(persona), null, Token)).StatusCode);
+			await _host.Run(j => j.Kind == JobKind.ExportArchive && j.Payload == persona.Id, Token);
+			Assert.Equal("ready", (await Status(persona))["exportState"]!.GetValue<string>());
+			var ticket = (await (await client.PostAsync(Base(persona) + "/ticket", null, Token)).Content.ReadFromJsonAsync<JsonObject>(Token))!;
+			using var anonymous = _host.Client();
+			var response = await anonymous.GetAsync(ticket["url"]!.GetValue<string>(), Token);
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			return await response.Content.ReadAsByteArrayAsync(Token);
+		}
+
+		// uploaded in two pieces, then imported with the parts asked for, the job run: the import's state
+		async Task<(HttpStatusCode Status, JsonObject State)> Imported(Persona persona, byte[] archive, params string[] parts)
+		{
+			using var client = _host.As(persona.Root.Jwt);
+			var upload = (await (await client.PostAsync("/clientapi/persona/archive/uploads", null, Token)).Content.ReadFromJsonAsync<JsonObject>(Token))!["id"]!.GetValue<string>();
+			var half = archive.Length / 2;
+			Assert.Equal(HttpStatusCode.OK, (await client.PutAsync($"/clientapi/persona/archive/uploads/{upload}?offset=0", new ByteArrayContent(archive[..half]), Token)).StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await client.PutAsync($"/clientapi/persona/archive/uploads/{upload}?offset={half}", new ByteArrayContent(archive[half..]), Token)).StatusCode);
+			var asked = await client.PostAsJsonAsync(Base(persona) + "/import", new { uploadId = upload, parts }, Token);
+			if (asked.StatusCode != HttpStatusCode.Accepted)
+				return (asked.StatusCode, default);
+			await _host.Run(j => j.Kind == JobKind.ImportArchive && j.Payload == persona.Id, Token);
+			return (asked.StatusCode, await Status(persona));
+		}
+
+		static int Count(JsonObject state, string what) => state["importCounts"]?[what]?.GetValue<int>() ?? 0;
+
+		static Dictionary<string, string> Texts(byte[] zip)
+		{
+			using var archive = new ZipArchive(new MemoryStream(zip));
+			return archive.Entries.Where(e => e.Name.EndsWith(".json") || e.Name.EndsWith(".csv"))
+				.ToDictionary(e => e.FullName, e => new StreamReader(e.Open()).ReadToEnd());
+		}
+
+		[Fact]
+		public async Task An_archive_holds_the_persona_and_nothing_of_its_root_its_siblings_or_its_keys()
+		{
+			var alice = await _host.Mastodon("alice");
+			var sibling = await _host.Persona(alice.Persona.Root, "sibling");
+			var bob = await _host.Mastodon("bob");
+			var picture = (await alice.Client.Exchange(new HttpRequestMessage(HttpMethod.Post, "/api/v2/media")
+			{
+				Content = MastodonHelpers.Multipart(("file", MastodonHelpers.JpegWithMetadata(64, 48), "image/jpeg", "dot.jpg"))
+			})).Ok().Body.Text("id");
+			var first = await alice.Status("a public post with a picture #archives", ("media_ids[]", picture));
+			await alice.Status("for my followers only", ("visibility", "private"));
+			await alice.Status("a reply to myself", ("in_reply_to_id", first.Text("id")));
+			await alice.Client.Post($"/api/v1/statuses/{first.Text("id")}/bookmark");
+			await alice.Client.Post($"/api/v1/statuses/{first.Text("id")}/pin");
+			await alice.Client.Post($"/api/v1/accounts/{bob.Persona.Id}/block");
+			await alice.Client.Post("/api/v1/domain_blocks", ("domain", "spam.example"));
+			await alice.Client.Post("/api/v1/tags/archives/follow");
+
+			var zip = await Exported(alice.Persona);
+			var texts = Texts(zip);
+
+			foreach (var file in new[] { "actor.json", "outbox.json", "likes.json", "bookmarks.json", "following_accounts.csv", "blocked_accounts.csv",
+				"muted_accounts.csv", "blocked_domains.csv", "lists.csv", "bookmarks.csv", "privapub/archive.json", "privapub/pins.json",
+				"privapub/followed_tags.json", "privapub/filters.json", "privapub/notification_policy.json" })
+				Assert.True(texts.ContainsKey(file), $"{file} is missing");
+			using (var archive = new ZipArchive(new MemoryStream(zip)))
+				Assert.Contains(archive.Entries, e => e.FullName.StartsWith("media_attachments/files/", StringComparison.Ordinal));
+			var outbox = JsonNode.Parse(texts["outbox.json"])!["orderedItems"]!.AsArray();
+			Assert.Equal(3, outbox.Count);
+			Assert.Contains(outbox, i => i!["object"]!["attachment"]?[0]?["url"]?.GetValue<string>().StartsWith("/media_attachments/files/") == true);
+			Assert.Contains(bob.Persona.UserName, texts["blocked_accounts.csv"]);
+			Assert.Contains("spam.example", texts["blocked_domains.csv"]);
+			Assert.Contains(first.Text("uri"), texts["privapub/pins.json"]);
+
+			var avatar = await DB.Default.Find<Avatar>().MatchID(alice.Persona.Id).ExecuteFirstAsync(Token);
+			var root = await DB.Default.Find<RootUser>().MatchID(alice.Persona.Root.Id).ExecuteFirstAsync(Token);
+			var all = string.Concat(texts.Values);
+			Assert.DoesNotContain(avatar.PrivateKey.Split('\n')[1], all);
+			Assert.DoesNotContain(avatar.SigningKey, all);
+			Assert.DoesNotContain(root.UserName, all);
+			Assert.DoesNotContain(root.HashedPassword, all);
+			Assert.DoesNotContain(sibling.UserName, all);
+			Assert.DoesNotContain(alice.Token, all);
+		}
+
+		[Fact]
+		public async Task Back_home_an_archive_brings_nothing_back()
+		{
+			var alice = await _host.Mastodon("alice");
+			await alice.Status("kept");
+			var regretted = await alice.Status("regretted");
+			var zip = await Exported(alice.Persona);
+			await alice.Client.Delete($"/api/v1/statuses/{regretted.Text("id")}");
+			var before = await DB.Default.CountAsync<PostEntity>(p => p.GroupUserId == alice.Persona.Id, Token);
+
+			var (status, state) = await Imported(alice.Persona, zip, "posts", "pins");
+
+			Assert.Equal(HttpStatusCode.Accepted, status);
+			Assert.Equal("done", state["importState"]!.GetValue<string>());
+			Assert.True(state["importSameActor"]!.GetValue<bool>());
+			Assert.Equal((0, 1, 1), (Count(state, "posts"), Count(state, "posts already here"), Count(state, "posts deleted here")));
+			Assert.Equal(before, await DB.Default.CountAsync<PostEntity>(p => p.GroupUserId == alice.Persona.Id, Token));
+			Assert.NotNull((await DB.Default.Find<PostEntity>().MatchID(regretted.Text("id")).ExecuteFirstAsync(Token)).DeletedAt);
+		}
+
+		[Fact]
+		public async Task Into_another_persona_posts_arrive_once_and_nobody_is_told()
+		{
+			var alice = await _host.Mastodon("alice");
+			var follower = await _host.Mastodon("follower");
+			var picture = (await alice.Client.Exchange(new HttpRequestMessage(HttpMethod.Post, "/api/v2/media")
+			{
+				Content = MastodonHelpers.Multipart(("file", MastodonHelpers.JpegWithMetadata(64, 48), "image/jpeg", "dot.jpg"))
+			})).Ok().Body.Text("id");
+			var first = await alice.Status("the first words #moving", ("media_ids[]", picture));
+			await alice.Status("and a reply to them", ("in_reply_to_id", first.Text("id")));
+			await _host.Located(alice, "here and nowhere else");
+			var zip = await Exported(alice.Persona);
+
+			var carol = await _host.Mastodon("carol");
+			await follower.Client.Post($"/api/v1/accounts/{carol.Persona.Id}/follow");
+			var actor = $"/peasants/{carol.Persona.UserName}";
+			var jobs = await DB.Default.CountAsync<Job>(j => j.Kind == JobKind.Deliver && j.Payload.Contains(actor), Token);
+			var (_, state) = await Imported(carol.Persona, zip, "posts", "pins", "tags", "located");
+
+			Assert.Equal("done", state["importState"]!.GetValue<string>());
+			Assert.False(state["importSameActor"]!.GetValue<bool>());
+			Assert.Equal(2, Count(state, "posts"));
+			Assert.Equal(1, Count(state, "media"));
+			Assert.Equal(1, Count(state, "located posts"));
+			var copies = await DB.Default.Find<PostEntity>().Match(p => p.GroupUserId == carol.Persona.Id && p.Visibility != Models.Post.PostVisibility.LocalGeo).ExecuteAsync(Token);
+			Assert.Equal(2, copies.Count);
+			var copy = copies.Single(p => p.ImportedFromURI == first.Text("uri"));
+			Assert.StartsWith($"{PrivaPubHost.Base}/peasants/{carol.Persona.UserName}/scribbles/", copy.ObjectURI);
+			Assert.Equal(["moving"], copy.Tags);
+			Assert.Single(copy.Media);
+			Assert.Equal(carol.Persona.Id, (await DB.Default.Find<MediaAttachment>().MatchID(copy.Media[0].AttachmentId).ExecuteFirstAsync(Token)).OwnerAvatarId);
+			var reply = copies.Single(p => p.ID != copy.ID);
+			Assert.Equal(copy.ID, reply.AnsweringToPostId);
+			Assert.Equal(copy.ObjectURI + "/context", reply.ContextURI);
+
+			// nobody told: no delivery, no home, no notification; on the profile all the same
+			Assert.Equal(jobs, await DB.Default.CountAsync<Job>(j => j.Kind == JobKind.Deliver && j.Payload.Contains(actor), Token));
+			var ids = copies.Select(p => p.ID).ToList();
+			Assert.False(await DB.Default.Find<TimelineEntry>().Match(e => ids.Contains(e.PostId)).ExecuteAnyAsync(Token));
+			Assert.Contains((await carol.Client.Get($"/api/v1/accounts/{carol.Persona.Id}/statuses")).Ok().Body!.AsArray(), s => s!.Text("id") == copy.ID);
+
+			// twice changes nothing
+			var (_, again) = await Imported(carol.Persona, zip, "posts", "located");
+			Assert.Equal((0, 2, 1), (Count(again, "posts"), Count(again, "posts already here"), Count(again, "located posts already here")));
+			Assert.Equal(3, await DB.Default.CountAsync<PostEntity>(p => p.GroupUserId == carol.Persona.Id, Token));
+		}
+
+		// Mastodon's own archive: its posts, not its boosts nor its direct messages
+		[Fact]
+		public async Task A_mastodon_archive_is_read()
+		{
+			var dave = await _host.Mastodon("dave");
+			const string actor = "https://mastodon.example/users/dave";
+			const string Public = "https://www.w3.org/ns/activitystreams#Public";
+			var outbox = new JsonObject
+			{
+				["@context"] = "https://www.w3.org/ns/activitystreams",
+				["id"] = "outbox.json",
+				["type"] = "OrderedCollection",
+				["orderedItems"] = new JsonArray(
+					Create(actor, "1", "<p>hello from <b>Mastodon</b><script>alert(1)</script></p>", [Public], [actor + "/followers"], "2023-04-01T10:00:00Z"),
+					Create(actor, "2", "<p>only for one</p>", ["https://elsewhere.example/users/x"], [], "2023-04-02T10:00:00Z"),
+					new JsonObject { ["type"] = "Announce", ["actor"] = actor, ["object"] = "https://elsewhere.example/notes/9" })
+			};
+			var zip = Zip(("actor.json", new JsonObject { ["id"] = actor, ["type"] = "Person", ["followers"] = actor + "/followers" }.ToJsonString()),
+				("outbox.json", outbox.ToJsonString()));
+
+			var (_, state) = await Imported(dave.Persona, zip, "posts");
+
+			Assert.Equal("done", state["importState"]!.GetValue<string>());
+			Assert.Equal((1, 1, 1), (Count(state, "posts"), Count(state, "boosts skipped"), Count(state, "direct or circle posts skipped")));
+			var post = await DB.Default.Find<PostEntity>().Match(p => p.GroupUserId == dave.Persona.Id).ExecuteFirstAsync(Token);
+			Assert.Equal(actor + "/statuses/1", post.ImportedFromURI);
+			Assert.Equal(new DateTime(2023, 4, 1, 10, 0, 0, DateTimeKind.Utc), post.CreationDate);
+			Assert.DoesNotContain("<script", post.ContentHtml);
+			Assert.Contains("Mastodon", post.ContentHtml);
+		}
+
+		static JsonObject Create(string actor, string id, string content, string[] to, string[] cc, string published) => new()
+		{
+			["type"] = "Create",
+			["actor"] = actor,
+			["object"] = new JsonObject
+			{
+				["id"] = $"{actor}/statuses/{id}",
+				["type"] = "Note",
+				["attributedTo"] = actor,
+				["content"] = content,
+				["published"] = published,
+				["to"] = new JsonArray(to.Select(t => (JsonNode)t).ToArray()),
+				["cc"] = new JsonArray(cc.Select(c => (JsonNode)c).ToArray())
+			}
+		};
+
+		static byte[] Zip(params (string Name, string Text)[] files)
+		{
+			var stream = new MemoryStream();
+			using (var archive = new ZipArchive(stream, ZipArchiveMode.Create, leaveOpen: true))
+				foreach (var (name, text) in files)
+				{
+					using var entry = archive.CreateEntry(name).Open();
+					entry.Write(Encoding.UTF8.GetBytes(text));
+				}
+			return stream.ToArray();
+		}
+
+		[Theory]
+		[InlineData("escape")]
+		[InlineData("twice")]
+		[InlineData("bomb")]
+		[InlineData("link")]
+		[InlineData("junk")]
+		public async Task A_hostile_archive_is_refused(string how)
+		{
+			var erin = await _host.Mastodon("erin");
+			var actorJson = new JsonObject { ["id"] = "https://elsewhere.example/users/erin" }.ToJsonString();
+			var zip = how switch
+			{
+				"escape" => Zip(("actor.json", actorJson), ("../escape.txt", "x")),
+				"twice" => Zip(("actor.json", actorJson), ("outbox.json", "{}"), ("outbox.json", "{}")),
+				"bomb" => Zip(("actor.json", actorJson), ("outbox.json", new string(' ', 30 * 1024 * 1024))),
+				"link" => Link(actorJson),
+				_ => "not a zip at all"u8.ToArray()
+			};
+
+			var (status, _) = await Imported(erin.Persona, zip, "posts");
+
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, status);
+			Assert.False(await DB.Default.Find<PostEntity>().Match(p => p.GroupUserId == erin.Persona.Id).ExecuteAnyAsync(Token));
+		}
+
+		// a symbolic link, as zip on Unix stores one
+		static byte[] Link(string actorJson)
+		{
+			var stream = new MemoryStream();
+			using (var archive = new ZipArchive(stream, ZipArchiveMode.Create, leaveOpen: true))
+			{
+				using (var actor = archive.CreateEntry("actor.json").Open())
+					actor.Write(Encoding.UTF8.GetBytes(actorJson));
+				var link = archive.CreateEntry("media_attachments/files/passwd");
+				link.ExternalAttributes = unchecked((int)(0xA1FFu << 16));
+				using var target = link.Open();
+				target.Write("/etc/passwd"u8);
+			}
+			return stream.ToArray();
+		}
+
+		[Fact]
+		public async Task An_outbox_item_too_large_stops_the_import()
+		{
+			var frank = await _host.Mastodon("frank");
+			const string actor = "https://elsewhere.example/users/frank";
+			// (random, so it is no compression bomb: that is refused before the import starts)
+			var words = Convert.ToBase64String(System.Security.Cryptography.RandomNumberGenerator.GetBytes(1536 * 1024));
+			var huge = Create(actor, "1", words, ["https://www.w3.org/ns/activitystreams#Public"], [], "2024-01-01T00:00:00Z");
+			var zip = Zip(("actor.json", new JsonObject { ["id"] = actor }.ToJsonString()),
+				("outbox.json", new JsonObject { ["orderedItems"] = new JsonArray(huge) }.ToJsonString()));
+
+			var (_, state) = await Imported(frank.Persona, zip, "posts");
+
+			Assert.Equal("failed", state["importState"]!.GetValue<string>());
+			Assert.Contains("larger than", state["importError"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task Only_the_personas_own_root_and_never_a_banned_one()
+		{
+			var grace = await _host.Mastodon("grace");
+			var stranger = await _host.SignUp("stranger");
+			using (var other = _host.As(stranger.Jwt))
+				Assert.Equal(HttpStatusCode.NotFound, (await other.GetAsync(Base(grace.Persona), Token)).StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await _host.As(grace.Persona.Root.Jwt).GetAsync(Base(grace.Persona), Token)).StatusCode);
+			await DB.Default.Update<RootUser>().MatchID(grace.Persona.Root.Id).Modify(u => u.IsBanned, true).ExecuteAsync(Token);
+			Assert.NotEqual(HttpStatusCode.OK, (await _host.As(grace.Persona.Root.Jwt).GetAsync(Base(grace.Persona), Token)).StatusCode);
+		}
+
+		[Fact]
+		public async Task An_import_asked_to_stop_stops()
+		{
+			var henry = await _host.Mastodon("henry");
+			const string actor = "https://elsewhere.example/users/henry";
+			var zip = Zip(("actor.json", new JsonObject { ["id"] = actor }.ToJsonString()),
+				("outbox.json", new JsonObject { ["orderedItems"] = new JsonArray(Create(actor, "1", "one", ["https://www.w3.org/ns/activitystreams#Public"], [], "2024-01-01T00:00:00Z")) }.ToJsonString()));
+			using var client = _host.As(henry.Persona.Root.Jwt);
+			var upload = (await (await client.PostAsync("/clientapi/persona/archive/uploads", null, Token)).Content.ReadFromJsonAsync<JsonObject>(Token))!["id"]!.GetValue<string>();
+			await client.PutAsync($"/clientapi/persona/archive/uploads/{upload}?offset=0", new ByteArrayContent(zip), Token);
+			Assert.Equal(HttpStatusCode.Accepted, (await client.PostAsJsonAsync(Base(henry.Persona) + "/import", new { uploadId = upload, parts = new[] { "posts" } }, Token)).StatusCode);
+			Assert.Equal(HttpStatusCode.Conflict, (await client.PostAsJsonAsync(Base(henry.Persona) + "/import", new { uploadId = upload, parts = new[] { "posts" } }, Token)).StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await client.PostAsync(Base(henry.Persona) + "/import/stop", null, Token)).StatusCode);
+
+			await _host.Run(j => j.Kind == JobKind.ImportArchive && j.Payload == henry.Persona.Id, Token);
+
+			Assert.Equal("stopped", (await Status(henry.Persona))["importState"]!.GetValue<string>());
+			Assert.False(await DB.Default.Find<PostEntity>().Match(p => p.GroupUserId == henry.Persona.Id).ExecuteAnyAsync(Token));
+		}
+	}
+}

PrivaPub.Tests/Http/PersonaExchangeTests.cs

@@ -0,0 +1,218 @@
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.JsonWebTokens;
+using Microsoft.IdentityModel.Tokens;
+
+using PrivaPub.Api.Mastodon.Auth;
+using PrivaPub.Services;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Security.Claims;
+using System.Text;
+
+namespace PrivaPub.Tests.Http
+{
+	// The first-party client's one sign-in: the /clientapi JWT exchanged for one persona's Mastodon token (PersonaExchange).
+	[Trait("Category", "Integration")]
+	public sealed class PersonaExchangeTests : IAsyncLifetime
+	{
+		const string Grant = "urn:ietf:params:oauth:grant-type:token-exchange";
+		const string FirstParty = "decepub";
+
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		async Task<HttpResponseMessage> Exchange(string jwt, string avatarId, string clientId = FirstParty, string clientSecret = default,
+			string subjectTokenType = PersonaExchange.SubjectTokenType)
+		{
+			var fields = new List<(string, string)>
+			{
+				("grant_type", Grant),
+				("client_id", clientId),
+				("subject_token", jwt),
+				("subject_token_type", subjectTokenType),
+				(PersonaExchange.AvatarParameter, avatarId),
+				("scope", "read write follow")
+			};
+			if (clientSecret != default)
+				fields.Add(("client_secret", clientSecret));
+			using var client = _host.Client();
+			return await client.Form("/oauth/token", fields.Where(f => f.Item2 != default).ToArray());
+		}
+
+		async Task<string> Token(Persona persona)
+		{
+			var response = await Exchange(persona.Root.Jwt, persona.Id);
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			return (await response.JsonBody())["access_token"]!.GetValue<string>();
+		}
+
+		static async Task AssertRefused(HttpResponseMessage response, string error = "invalid_grant")
+		{
+			Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+			Assert.Equal(error, (await response.JsonBody())["error"]?.GetValue<string>());
+		}
+
+		async Task<HttpStatusCode> Me(string token)
+		{
+			using var api = _host.As(token);
+			return (await api.GetAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken)).StatusCode;
+		}
+
+		static string Jwt(string rootId, string key, DateTime expires) => new JsonWebTokenHandler().CreateToken(new SecurityTokenDescriptor
+		{
+			Issuer = PrivaPubHost.Base,
+			Audience = PrivaPubHost.Base,
+			Subject = new ClaimsIdentity(new[] { new Claim(ClaimTypes.UserData, rootId) }),
+			NotBefore = expires.AddHours(-2),
+			IssuedAt = expires.AddHours(-2),
+			Expires = expires,
+			SigningCredentials = new(new SymmetricSecurityKey(Encoding.UTF8.GetBytes(key)), SecurityAlgorithms.HmacSha512)
+		});
+
+		[Fact]
+		public async Task The_root_jwt_becomes_one_personas_token_that_never_names_the_root()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "exchange");
+			var root = persona.Root;
+
+			var response = await Exchange(root.Jwt, persona.Id);
+			var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			Assert.DoesNotContain(root.Id, body);
+			Assert.DoesNotContain(root.UserName, body);
+			var token = (await response.JsonBody())["access_token"]!.GetValue<string>();
+			using var api = _host.As(token);
+			var account = await api.GetStringAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken);
+			Assert.Contains($"\"id\":\"{persona.Id}\"", account);
+			Assert.DoesNotContain(root.Id, account);
+			foreach (var entry in await ClientApi.StoredTokens(FirstParty))
+			{
+				var payload = entry.Contains("payload") && entry["payload"].IsString ? ClientApi.JwtPayload(entry["payload"].AsString) : string.Empty;
+				Assert.DoesNotContain(root.Id, entry.ToString() + payload);
+				Assert.DoesNotContain(root.UserName, entry.ToString() + payload);
+			}
+		}
+
+		[Fact]
+		public async Task Each_persona_of_the_root_gets_its_own_token()
+		{
+			var root = await _host.SignUp();
+			var first = await _host.Persona(root, "first");
+			var second = await _host.Persona(root, "second");
+
+			using var firstApi = _host.As(await Token(first));
+			using var secondApi = _host.As(await Token(second));
+
+			Assert.Contains($"\"id\":\"{first.Id}\"", await firstApi.GetStringAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken));
+			Assert.Contains($"\"id\":\"{second.Id}\"", await secondApi.GetStringAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken));
+		}
+
+		[Fact]
+		public async Task Another_roots_persona_is_refused()
+		{
+			var mine = await _host.SignUp();
+			var theirs = await _host.Persona(await _host.SignUp(), "theirs");
+
+			await AssertRefused(await Exchange(mine.Jwt, theirs.Id));
+			await AssertRefused(await Exchange(mine.Jwt, "000000000000000000000000"));
+			await AssertRefused(await Exchange(mine.Jwt, "not an id"));
+		}
+
+		[Fact]
+		public async Task A_token_that_is_not_a_valid_root_jwt_is_refused()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "forged");
+			var key = _host.Services.GetRequiredService<IConfiguration>()["AppConfiguration:Jwt:Key"]!;
+
+			await AssertRefused(await Exchange("garbage", persona.Id));
+			await AssertRefused(await Exchange(Jwt(persona.Root.Id, key, DateTime.UtcNow.AddMinutes(-10)), persona.Id));
+			await AssertRefused(await Exchange(Jwt(persona.Root.Id, new string('k', 64), DateTime.UtcNow.AddHours(1)), persona.Id));
+		}
+
+		[Fact]
+		public async Task Ended_sessions_refuse_the_jwt_and_revoke_the_exchanged_tokens()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "ended");
+			var token = await Token(persona);
+			Assert.Equal(HttpStatusCode.OK, await Me(token));
+
+			using (var scope = _host.Services.CreateScope())
+				await scope.ServiceProvider.GetRequiredService<IRootSessions>().Revoke(persona.Root.Id, TestContext.Current.CancellationToken);
+
+			await AssertRefused(await Exchange(persona.Root.Jwt, persona.Id));
+			Assert.Equal(HttpStatusCode.Unauthorized, await Me(token));
+		}
+
+		[Fact]
+		public async Task A_banned_root_is_refused()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "banned");
+			await ClientApi.Ban(persona.Root.Id);
+			try
+			{
+				await AssertRefused(await Exchange(persona.Root.Jwt, persona.Id));
+			}
+			finally
+			{
+				await ClientApi.Ban(persona.Root.Id, banned: false);
+			}
+		}
+
+		[Fact]
+		public async Task A_revoked_token_no_longer_works()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "revoked");
+			var token = await Token(persona);
+
+			using var client = _host.Client();
+			var revoked = await client.Form("/oauth/revoke", ("token", token), ("client_id", FirstParty));
+
+			Assert.Equal(HttpStatusCode.OK, revoked.StatusCode);
+			Assert.Equal(HttpStatusCode.Unauthorized, await Me(token));
+		}
+
+		[Fact]
+		public async Task Only_the_first_party_client_may_exchange()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "thirdparty");
+			using var client = _host.Client();
+			var app = await client.RegisterApp();
+
+			var response = await Exchange(persona.Root.Jwt, persona.Id, app.ClientId, app.ClientSecret);
+
+			Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+			Assert.Equal("unauthorized_client", (await response.JsonBody())["error"]?.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task A_mastodon_token_is_not_a_subject_token()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "mastodon");
+			var token = await Token(persona);
+
+			await AssertRefused(await Exchange(token, persona.Id, subjectTokenType: "urn:ietf:params:oauth:token-type:access_token"), "invalid_request");
+			await AssertRefused(await Exchange(token, persona.Id));
+		}
+
+		[Fact]
+		public async Task Missing_parameters_are_a_client_error()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "missing");
+
+			await AssertRefused(await Exchange(persona.Root.Jwt, default));
+			await AssertRefused(await Exchange(default, persona.Id), "invalid_request");
+			await AssertRefused(await Exchange(persona.Root.Jwt, persona.Id, subjectTokenType: default), "invalid_request");
+		}
+	}
+}

PrivaPub.Tests/Http/PersonaSeparationHttpTests.cs

@@ -0,0 +1,261 @@
+using Microsoft.AspNetCore.Routing;
+using Microsoft.AspNetCore.Routing.Patterns;
+using Microsoft.Extensions.DependencyInjection;
+
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Domain.Social;
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text;
+using System.Text.Json.Nodes;
+using System.Text.RegularExpressions;
+
+using static PrivaPub.Tests.Support.Host.FederationHelpers;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed partial class PersonaSeparationHttpTests : IAsyncLifetime
+	{
+		const string Base = PrivaPubHost.Base;
+		const int MaxDocuments = 300;
+
+		PrivaPubHost _host;
+		Root _root;
+		Persona _alpha;
+		Persona _bravo;
+		Persona _charlie;
+		LocalGroup _community;
+		string _tag;
+		Post _shown;
+		Post _poll;
+		List<Post> _alphaPosts;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			var token = TestContext.Current.CancellationToken;
+			_host = await PrivaPubHost.Shared();
+			_root = await _host.SignUp("sep");
+			_alpha = await _host.Persona(_root, "sepalpha");
+			_bravo = await _host.Persona(_root, "sepbravo");
+			_charlie = await _host.Persona(await _host.SignUp(), "sepcharlie");
+			_community = await _host.FederatedGroup(_bravo, community: true, "sepcommunity");
+			_tag = $"septag{Guid.NewGuid():N}"[..14];
+
+			await _host.Publish(_bravo, "the sibling's own words", PostVisibility.FollowersOnly);
+			var follows = _host.Get<IFollowService>();
+			Assert.True((await follows.Follow(_root.Id, new FollowForm { AvatarId = _bravo.Id, Target = _charlie.UserName }, token)).IsValid);
+
+			_shown = await _host.Publish(_alpha, $"hello from alpha #{_tag}");
+			_poll = await _host.Publish(_alpha, new StatusDraft
+			{
+				Text = "which one?",
+				PlainText = true,
+				Poll = new PollDraft(new[] { "this", "that" }, 3600, false, false)
+			});
+			var charlieSays = await _host.Publish(_charlie, "worth sharing");
+			_alphaPosts = new List<Post>
+			{
+				_shown,
+				_poll,
+				await _host.Publish(_alpha, "quietly", PostVisibility.Unlisted),
+				await _host.Publish(_alpha, "for my followers", PostVisibility.FollowersOnly),
+				await _host.Publish(_alpha, $"@{_charlie.UserName} between us", PostVisibility.Direct),
+				await _host.PublishLocated(_alpha, "around here"),
+				await _host.Publish(_alpha, new StatusDraft { Text = "quoting charlie", PlainText = true, QuotedStatusId = charlieSays.ID }),
+				await _host.Reblog(_alpha, charlieSays)
+			};
+			await DB.Default.SaveAsync(new Pin { AvatarId = _alpha.Id, PostId = _shown.ID }, token);
+			Assert.True((await follows.Follow(_root.Id, new FollowForm { AvatarId = _alpha.Id, Target = _charlie.UserName }, token)).IsValid);
+			Assert.True((await follows.Follow(_charlie.Root.Id, new FollowForm { AvatarId = _charlie.Id, Target = _alpha.UserName }, token)).IsValid);
+			Assert.True((await _host.Get<IStatusService>().Favourite(await _host.Actor(_charlie), _shown.ID, true, token)).Ok);
+			await _host.Publish(_charlie, new StatusDraft { Text = $"@{_alpha.UserName} nice", PlainText = true, InReplyTo = _shown.ID });
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		string[] Forbidden() => new[] { _bravo.Id, _bravo.UserName, _root.Id, _root.UserName, _community.Id, _community.UserName };
+
+		[Fact]
+		public async Task Nothing_the_api_tells_a_persona_names_its_sibling_or_its_login()
+		{
+			var bearer = await _host.MastodonToken(_alpha);
+			using var client = _host.As(bearer);
+			var notifications = await client.Fetch("/api/v1/notifications", "application/json");
+			Assert.Equal(HttpStatusCode.OK, notifications.Status);
+			var notificationIds = JsonNode.Parse(notifications.Text)!.AsArray().Select(n => n!["id"]!.GetValue<string>()).ToList();
+			Assert.NotEmpty(notificationIds);
+
+			var paths = Routes().Select(Fill).Concat(new[]
+			{
+				$"/api/v2/search?q={_alpha.UserName}",
+				$"/api/v2/search?q={Uri.EscapeDataString($"@{_alpha.UserName}@{PrivaPubHost.Host}")}",
+				$"/api/v2/search?q={Uri.EscapeDataString(_alpha.ActorUri())}",
+				$"/api/v2/search?q={Uri.EscapeDataString(_shown.ObjectURI)}",
+				$"/api/v2/search?q=%23{_tag}",
+				$"/api/v1/accounts/search?q={_alpha.UserName}",
+				$"/api/v1/accounts/lookup?acct={_alpha.UserName}",
+				$"/api/v1/accounts/relationships?id[]={_alpha.Id}&id[]={_charlie.Id}",
+				$"/api/v1/accounts/familiar_followers?id[]={_charlie.Id}",
+				$"/api/v1/accounts/{_alpha.Id}/statuses?pinned=true",
+				$"/api/v1/accounts/{_alpha.Id}/statuses?exclude_replies=true&limit=40",
+				$"/api/v1/statuses?{string.Join("&", _alphaPosts.Select(p => "id[]=" + p.ID))}",
+				$"/api/v1/statuses/{_poll.ID}",
+				$"/api/v1/polls/{_poll.ID}",
+				$"/api/v1/notifications/{notificationIds[0]}",
+				"/api/v1/timelines/home?limit=40",
+				"/api/v1/timelines/public?local=true&limit=40"
+			}).Concat(_alphaPosts.Select(p => $"/api/v1/statuses/{p.ID}/context"))
+				.Distinct()
+				.ToList();
+
+			var answered = 0;
+			var failures = new List<string>();
+			foreach (var path in paths)
+			{
+				var fetched = await client.Fetch(path, "application/json");
+				if ((int)fetched.Status >= 500)
+					failures.Add($"{path} answered {(int)fetched.Status}");
+				if (fetched.Status == HttpStatusCode.OK)
+					answered++;
+				foreach (var secret in Forbidden())
+					if (fetched.Text.Contains(secret, StringComparison.OrdinalIgnoreCase) || fetched.Response.Headers.ToString().Contains(secret, StringComparison.OrdinalIgnoreCase))
+						failures.Add($"{path} names {secret}: {Short(fetched.Text)}");
+			}
+
+			Assert.True(failures.Count == 0, string.Join("\n", failures));
+			Assert.True(answered >= 40, $"only {answered} of {paths.Count} answers were 200");
+			var me = await client.Fetch("/api/v1/accounts/verify_credentials", "application/json");
+			Assert.Contains(_alpha.Id, me.Text);
+			Assert.Contains(_shown.ID, (await client.Fetch("/api/v1/timelines/home?limit=40", "application/json")).Text);
+		}
+
+		[Fact]
+		public async Task Nothing_published_about_a_persona_names_its_sibling_or_its_login()
+		{
+			using var client = _host.Client();
+			var seeds = new[]
+			{
+				$"/peasants/{_alpha.UserName}",
+				$"/users/{_alpha.UserName}",
+				$"/peasants/{_alpha.UserName}/anus?page=true",
+				$"/peasants/{_alpha.UserName}/scribbles/{_shown.ID}",
+				$"/peasants/{_alpha.UserName}/grunts/create-{_shown.ID}",
+				$"/.well-known/webfinger?resource=acct:{_alpha.UserName}@{PrivaPubHost.Host}",
+				"/.well-known/nodeinfo",
+				$"/@{_alpha.UserName}",
+				$"/@{_alpha.UserName}/{_shown.ID}"
+			};
+			var queue = new Queue<string>(seeds);
+			var seen = new HashSet<string>(seeds);
+			var failures = new List<string>();
+			var fetchedOk = 0;
+
+			while (queue.Count > 0 && seen.Count <= MaxDocuments)
+			{
+				var path = queue.Dequeue();
+				var html = path.StartsWith("/@", StringComparison.Ordinal);
+				var fetched = await client.Fetch(path, html ? Browser : path.StartsWith("/peasants/", StringComparison.Ordinal) ? ActivityJson : "application/json");
+				if ((int)fetched.Status >= 500)
+					failures.Add($"{path} answered {(int)fetched.Status}");
+				if (fetched.Status == HttpStatusCode.OK)
+					fetchedOk++;
+				foreach (var secret in Forbidden())
+					if (fetched.Text.Contains(secret, StringComparison.OrdinalIgnoreCase))
+						failures.Add($"{path} names {secret}: {Short(fetched.Text)}");
+
+				var links = Links(fetched.Text).ToList();
+				if (fetched.Location != default)
+					links.Add(fetched.Location.StartsWith('/') ? Base + fetched.Location : fetched.Location);
+				foreach (var link in links)
+				{
+					if (!link.StartsWith(Base + "/", StringComparison.Ordinal))
+						continue;
+					var next = PathOf(link.Split('#')[0]);
+					if (Followed(next) && seen.Add(next))
+						queue.Enqueue(next);
+				}
+			}
+
+			Assert.True(failures.Count == 0, string.Join("\n", failures));
+			Assert.Contains($"/peasants/{_alpha.UserName}/groupies", seen);
+			Assert.Contains($"/peasants/{_alpha.UserName}/trophies", seen);
+			Assert.Contains("/nodeinfo/2.1", seen);
+			Assert.True(fetchedOk >= 15, $"only {fetchedOk} of {seen.Count} documents were served");
+		}
+
+		bool Followed(string path) =>
+			path.StartsWith($"/peasants/{_alpha.UserName}", StringComparison.Ordinal)
+			|| path.StartsWith($"/@{_alpha.UserName}", StringComparison.Ordinal)
+			|| path.StartsWith("/.well-known/", StringComparison.Ordinal)
+			|| path.StartsWith("/nodeinfo/", StringComparison.Ordinal);
+
+		static IEnumerable<string> Links(string text)
+		{
+			JsonNode json = default;
+			try
+			{
+				json = JsonNode.Parse(text);
+			}
+			catch (System.Text.Json.JsonException)
+			{
+			}
+			if (json != default)
+				return Strings(json);
+			return Href().Matches(text).Select(m => WebUtility.HtmlDecode(m.Groups[1].Value));
+		}
+
+		IEnumerable<string> Routes()
+		{
+			var endpoints = _host.Services.GetRequiredService<EndpointDataSource>().Endpoints.OfType<RouteEndpoint>();
+			foreach (var endpoint in endpoints)
+			{
+				var methods = endpoint.Metadata.GetMetadata<IHttpMethodMetadata>()?.HttpMethods;
+				var template = "/" + endpoint.RoutePattern.RawText?.TrimStart('/');
+				if (template.StartsWith("/api/", StringComparison.Ordinal) && methods is { } verbs && verbs.Contains("GET"))
+					yield return template;
+			}
+		}
+
+		string Fill(string template)
+		{
+			var builder = new StringBuilder();
+			foreach (var segment in RoutePatternFactory.Parse(template).PathSegments)
+			{
+				builder.Append('/');
+				foreach (var part in segment.Parts)
+					builder.Append(part switch
+					{
+						RoutePatternLiteralPart literal => literal.Content,
+						RoutePatternSeparatorPart separator => separator.Content,
+						RoutePatternParameterPart parameter => Value(template, parameter.Name),
+						_ => string.Empty
+					});
+			}
+			return builder.ToString();
+		}
+
+		string Value(string template, string parameter) => parameter switch
+		{
+			"hashtag" => _tag,
+			"host" => PrivaPubHost.Host,
+			_ when template.StartsWith("/api/v1/statuses/", StringComparison.Ordinal)
+				|| template.Contains("/statuses/{id}", StringComparison.Ordinal) => _shown.ID,
+			_ when template.StartsWith("/api/v1/polls/", StringComparison.Ordinal) => _poll.ID,
+			_ => _alpha.Id
+		};
+
+		static string Short(string text) => text.Length > 400 ? text[..400] + "…" : text;
+
+		[GeneratedRegex("(?:href|src)=\"([^\"]+)\"")]
+		private static partial Regex Href();
+	}
+}

PrivaPub.Tests/Http/PostPlaceTests.cs

@@ -0,0 +1,106 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	// A Pixelfed post's own place: stored from `location`, shown as `privapub.place`, changed by an edit.
+	[Trait("Category", "Integration")]
+	public sealed class PostPlaceTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		static JsonObject Location(string name, string latitude, string longitude) => new()
+		{
+			["type"] = "Place", ["name"] = name, ["latitude"] = latitude, ["longitude"] = longitude, ["country"] = "Italy"
+		};
+
+		[Fact]
+		public async Task A_pixelfed_place_is_shown_and_follows_the_authors_edits()
+		{
+			var alice = await _host.Mastodon("alice");
+			var ann = new RemoteActor(_peer, "ann");
+			var post = await _host.PublicPostFrom(ann, alice, "<p>the duomo</p>", note => note["location"] = Location("Milan", "45.4642", "9.19"));
+
+			var place = (await alice.Client.Get($"/api/v1/statuses/{post.ID}")).Ok().Body["privapub"]!["place"];
+
+			Assert.Equal(("Milan", "Italy"), (place.Text("name"), place.Text("country")));
+			Assert.Equal(45.4642, place["latitude"]!.GetValue<double>());
+			Assert.Equal(9.19, place["longitude"]!.GetValue<double>());
+
+			await Edit(ann, alice, post, note => note["location"] = Location("Turin", "45.0703", "7.6869"));
+			Assert.Equal("Turin", (await alice.Client.Get($"/api/v1/statuses/{post.ID}")).Ok().Body["privapub"]!["place"].Text("name"));
+
+			await Edit(ann, alice, post, _ => { });
+			Assert.Null((await alice.Client.Get($"/api/v1/statuses/{post.ID}")).Ok().Body["privapub"]!["place"]);
+			Assert.Null((await DB.Default.Find<Post>().MatchID(post.ID).ExecuteFirstAsync(Token)).Place);
+		}
+
+		[Fact]
+		public async Task A_post_without_a_place_has_none()
+		{
+			var alice = await _host.Mastodon("alice");
+			var post = await _host.PublicPostFrom(new RemoteActor(_peer, "plain"), alice);
+
+			Assert.Null((await alice.Client.Get($"/api/v1/statuses/{post.ID}")).Ok().Body["privapub"]!["place"]);
+		}
+
+		[Fact]
+		public async Task A_local_post_never_carries_a_location()
+		{
+			var alice = await _host.Mastodon("alice");
+			var status = await alice.Status("made here");
+
+			using var client = _host.Client();
+			client.DefaultRequestHeaders.Accept.ParseAdd("application/activity+json");
+			var note = JsonNode.Parse(await client.GetStringAsync(status.Text("uri"), Token))!;
+
+			Assert.Null(note["location"]);
+		}
+
+		async Task Edit(RemoteActor author, Mastodon mentioned, Post post, Action<JsonObject> shape)
+		{
+			var note = new JsonObject
+			{
+				["id"] = post.ObjectURI,
+				["type"] = "Note",
+				["attributedTo"] = author.Id,
+				["to"] = new JsonArray(MastodonHelpers.Public),
+				["cc"] = new JsonArray(mentioned.Uri),
+				["content"] = "<p>the duomo, again</p>",
+				["published"] = post.CreationDate.ToString("O"),
+				["updated"] = DateTime.UtcNow.ToString("O"),
+				["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = mentioned.Uri, ["name"] = "@" + mentioned.UserName })
+			};
+			shape(note);
+			await _host.Deliver(author, mentioned.Mouth, new JsonObject
+			{
+				["id"] = $"{post.ObjectURI}/updates/{Guid.NewGuid():N}",
+				["type"] = "Update",
+				["actor"] = author.Id,
+				["to"] = new JsonArray(MastodonHelpers.Public),
+				["object"] = note
+			});
+		}
+	}
+}

PrivaPub.Tests/Http/ProvenanceAndReactionsTests.cs

@@ -0,0 +1,224 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class ProvenanceAndReactionsTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		static string Provenance(string id) => $"/api/privapub/v1/statuses/{id}/provenance";
+
+		[Fact]
+		public async Task A_local_post_has_a_local_provenance()
+		{
+			var alice = await _host.Mastodon("alice");
+			var status = await alice.Status("made here");
+
+			var provenance = (await _host.Client().Get(Provenance(status.Text("id")))).Ok();
+
+			Assert.Equal("local", provenance.Body.Text("path"));
+			Assert.Equal(status.Text("uri"), provenance.Body.Text("object_uri"));
+			Assert.Equal(status.Text("url"), provenance.Body.Text("url"));
+			Assert.Null(provenance.Body["signature"]);
+			Assert.Null(provenance.Body["raw"]);
+		}
+
+		[Fact]
+		public async Task A_delivered_post_shows_its_signature_and_raw_form_and_reading_it_asks_nobody()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var create = bob.Create("<p>signed and sealed</p>", new[] { MastodonHelpers.Public }, new[] { alice.Uri },
+				note => note["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@" + alice.UserName }));
+			await _host.Deliver(bob, alice.Mouth, create);
+			var noteId = create["object"].Text("id");
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteFirstAsync(Token);
+			var asked = _peer.Requests.Count;
+
+			var provenance = (await alice.Client.Get(Provenance(post.ID))).Ok().Body;
+			var anonymous = (await _host.Client().Get(Provenance(post.ID))).Ok().Body;
+
+			Assert.Equal("delivered", provenance.Text("path"));
+			Assert.Equal(noteId, provenance.Text("object_uri"));
+			Assert.Equal("Note", provenance.Text("object_type"));
+			Assert.Null(provenance["fetched_by"]);
+			Assert.Equal((create.Text("id"), "Create", bob.Id), (provenance["activity"].Text("id"), provenance["activity"].Text("type"), provenance["activity"].Text("actor")));
+			Assert.Equal(bob.KeyId, provenance["signature"].Text("key_id"));
+			Assert.Equal("rsa-sha256", provenance["signature"].Text("algorithm"));
+			Assert.Contains("digest", provenance["signature"]!["headers"]!.AsArray().Select(h => h!.GetValue<string>()));
+			Assert.Equal(noteId, provenance["raw"].Text("id"));
+			Assert.False(string.IsNullOrEmpty(provenance.Text("raw_hash")));
+			Assert.True(provenance.Number("raw_bytes") > 0);
+			Assert.NotNull(provenance.Text("received_at"));
+			Assert.Equal(provenance.ToJsonString(), anonymous.ToJsonString());
+			Assert.Equal(asked, _peer.Requests.Count);
+		}
+
+		[Fact]
+		public async Task A_fetched_parent_shows_no_signature_and_was_fetched_by_the_instance_actor()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			var parentPath = $"/notes/{Guid.NewGuid():N}";
+			var parentId = _peer.A + parentPath;
+			_peer.Serve(parentPath, new JsonObject
+			{
+				["id"] = parentId,
+				["type"] = "Note",
+				["attributedTo"] = bob.Id,
+				["to"] = new JsonArray(MastodonHelpers.Public),
+				["content"] = "<p>the start of it</p>",
+				["published"] = DateTime.UtcNow.AddMinutes(-5).ToString("O")
+			}.ToJsonString());
+			var reply = bob.Create("<p>and a reply</p>", new[] { MastodonHelpers.Public }, new[] { alice.Uri }, note =>
+			{
+				note["inReplyTo"] = parentId;
+				note["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@" + alice.UserName });
+			});
+			await _host.Deliver(bob, alice.Mouth, reply);
+			var parent = await DB.Default.Find<Post>().Match(p => p.ObjectURI == parentId).ExecuteFirstAsync(Token);
+			Assert.NotNull(parent);
+			var asked = _peer.Requests.Count;
+
+			var provenance = (await alice.Client.Get(Provenance(parent.ID))).Ok().Body;
+
+			Assert.Equal("fetched", provenance.Text("path"));
+			Assert.Equal("instance-actor", provenance.Text("fetched_by"));
+			Assert.Null(provenance["signature"]);
+			Assert.Equal((reply.Text("id"), "Create"), (provenance["activity"].Text("id"), provenance["activity"].Text("type")));
+			Assert.Null(provenance["inbox"]);
+			Assert.Equal(parentId, provenance["raw"].Text("id"));
+			Assert.Contains(_peer.Requests, r => r.Path == parentPath && r.Signature.Contains("/peasants/privapub#main-key"));
+			Assert.Equal(asked, _peer.Requests.Count);
+		}
+
+		[Fact]
+		public async Task Provenance_follows_who_may_see_the_post()
+		{
+			var alice = await _host.Mastodon("alice");
+			var other = await _host.Mastodon("other");
+			var bob = new RemoteActor(_peer, "bob");
+			var direct = bob.Create("<p>between us</p>", new[] { alice.Uri }, shape: note =>
+				note["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@" + alice.UserName }));
+			await _host.Deliver(bob, alice.Mouth, direct);
+			var noteId = direct["object"].Text("id");
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteFirstAsync(Token);
+
+			Assert.Equal("delivered", (await alice.Client.Get(Provenance(post.ID))).Ok().Body.Text("path"));
+			Assert.Equal(HttpStatusCode.NotFound, (await other.Client.Get(Provenance(post.ID))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _host.Client().Get(Provenance(post.ID))).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _host.Client().Get(Provenance("000000000000000000000000"))).Status);
+		}
+
+		[Fact]
+		public async Task An_instance_is_described_from_what_was_stored_and_reading_it_asks_nobody()
+		{
+			var host = $"described{Guid.NewGuid():N}.example";
+			await DB.Default.SaveAsync(new RemoteInstance
+			{
+				Host = host,
+				Software = "gotosocial",
+				SoftwareVersion = "0.20.0",
+				NodeName = "a test pasture",
+				Protocols = new List<string> { "activitypub" },
+				OpenRegistrations = false,
+				DescribedAt = DateTime.UtcNow.AddDays(-1),
+				NodeInfo = "{\"software\":{\"name\":\"gotosocial\",\"version\":\"0.20.0\"}}",
+				ConsecutiveFailures = 2,
+				LastFailureAt = DateTime.UtcNow.AddHours(-1)
+			}, Token);
+			var alice = await _host.Mastodon("alice");
+
+			var described = (await alice.Client.Get($"/api/privapub/v1/instances/{host.ToUpperInvariant()}")).Ok().Body;
+
+			Assert.Equal(host, described.Text("host"));
+			Assert.Equal(("gotosocial", "0.20.0", "a test pasture"), (described.Text("software"), described.Text("version"), described.Text("node_name")));
+			Assert.Equal("activitypub", Assert.Single(described["protocols"]!.AsArray())!.GetValue<string>());
+			Assert.False(described.Flag("open_registrations"));
+			Assert.Equal("gotosocial", described["node_info"]!["software"].Text("name"));
+			Assert.Equal(2, described["delivery"].Number("consecutive_failures"));
+			Assert.NotNull(described["delivery"].Text("last_failure_at"));
+			Assert.Null(described["delivery"]["last_success_at"]);
+			Assert.Equal(described.ToJsonString(), (await _host.Client().Get($"/api/privapub/v1/instances/{host}")).Ok().Body.ToJsonString());
+			Assert.Equal(HttpStatusCode.NotFound, (await _host.Client().Get($"/api/privapub/v1/instances/unknown{Guid.NewGuid():N}.example")).Status);
+			Assert.Empty(_peer.Requests);
+		}
+
+		[Fact]
+		public async Task Reacting_to_a_remote_post_federates_an_emoji_react_and_its_undo()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var bob = new RemoteActor(_peer, "bob");
+			var post = await _host.PublicPostFrom(bob, alice);
+			var path = $"/api/v1/pleroma/statuses/{post.ID}/reactions";
+
+			var reacted = (await alice.Client.Put(path + "/%F0%9F%91%8D")).Ok();
+
+			var reaction = Assert.Single(reacted.Body["emoji_reactions"]!.AsArray());
+			Assert.Equal(("👍", 1, true), (reaction.Text("name"), reaction.Number("count"), reaction.Flag("me")));
+			Assert.Equal("👍", Assert.Single(reacted.Body["pleroma"]!["emoji_reactions"]!.AsArray()).Text("name"));
+			(await carol.Client.Put(path + "/%F0%9F%91%8D")).Ok();
+			var listed = Assert.Single((await _host.Client().Get(path)).Ok().Array);
+			Assert.Equal(("👍", 2, false), (listed.Text("name"), listed.Number("count"), listed.Flag("me")));
+			Assert.Equal(new[] { alice.Id, carol.Id }.Order(), listed!["accounts"]!.AsArray().Select(a => a.Text("id")).Order());
+			Assert.True(Assert.Single((await alice.Client.Get(path)).Ok().Array).Flag("me"));
+			var react = Assert.Single(await bob.Delivered(since), d => d.Type() == "EmojiReact" && d.Text("actor") == alice.Uri);
+			Assert.Equal(("👍", post.ObjectURI), (react.Text("content"), react.Text("object")));
+
+			var withdrawn = (await alice.Client.Delete(path + "/%F0%9F%91%8D")).Ok();
+
+			Assert.Equal(1, Assert.Single(withdrawn.Body["emoji_reactions"]!.AsArray()).Number("count"));
+			var undo = Assert.Single(await bob.Delivered(since), d => d.Type() == "Undo" && d.Text("actor") == alice.Uri);
+			Assert.Equal(react.Text("id"), undo["object"].Text("id"));
+			Assert.Equal("EmojiReact", undo["object"].Text("type"));
+			Assert.Equal(HttpStatusCode.UnprocessableEntity, (await alice.Client.Put(path + "/abc")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await alice.Client.Put("/api/v1/pleroma/statuses/000000000000000000000000/reactions/%F0%9F%91%8D")).Status);
+		}
+
+		[Fact]
+		public async Task Reacting_to_a_local_post_notifies_its_author_and_federates_nothing()
+		{
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var bob = new RemoteActor(_peer, "bob");
+			await _host.FollowedBy(carol, bob);
+			var post = await carol.Status("react to me");
+
+			(await alice.Client.Put($"/api/v1/pleroma/statuses/{post.Text("id")}/reactions/%F0%9F%8E%89")).Ok();
+
+			var notification = Assert.Single((await carol.Client.Get("/api/v1/notifications?types[]=pleroma:emoji_reaction")).Ok().Array);
+			Assert.Equal(("🎉", alice.Id, post.Text("id")), (notification.Text("emoji"), notification["account"].Text("id"), notification["status"].Text("id")));
+			Assert.DoesNotContain(await bob.Delivered(since), d => d.Type() is "EmojiReact" or "Like");
+			(await alice.Client.Delete($"/api/v1/pleroma/statuses/{post.Text("id")}/reactions/%F0%9F%8E%89")).Ok();
+			Assert.Empty((await carol.Client.Get($"/api/v1/pleroma/statuses/{post.Text("id")}/reactions")).Ok().Array);
+		}
+	}
+}

PrivaPub.Tests/Http/RegistrationsTests.cs

@@ -0,0 +1,50 @@
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+
+using PrivaPub.Infrastructure;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class RegistrationsTests : IAsyncLifetime
+	{
+		WebApplicationFactory<Program> _closed;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			var shared = await PrivaPubHost.Shared();
+			_closed = shared.WithWebHostBuilder(builder => builder.UseSetting("Registrations:Mode", nameof(RegistrationMode.Invitations)));
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_closed != default)
+				await _closed.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task Invitations_only_refuses_sign_up_and_every_document_says_closed()
+		{
+			using var client = _closed.CreateClient(new WebApplicationFactoryClientOptions { BaseAddress = new Uri(PrivaPubHost.Base + "/"), AllowAutoRedirect = false });
+			client.DefaultRequestHeaders.Add(PrivaPubHost.ClientHeader, $"10.9.{Random.Shared.Next(256)}.{Random.Shared.Next(1, 255)}");
+
+			var signUp = await client.PostJson("/clientapi/user/signup", new { userName = $"closed{Guid.NewGuid():N}"[..20], password = "Closed-Door-Pass-1" });
+			var nodeInfo = (await client.Get("/nodeinfo/2.1")).Ok().Body;
+			var v1 = (await client.Get("/api/v1/instance")).Ok().Body;
+			var v2 = (await client.Get("/api/v2/instance")).Ok().Body;
+
+			Assert.Equal(HttpStatusCode.Forbidden, signUp.StatusCode);
+			Assert.Contains("invitation", await signUp.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+			Assert.False(nodeInfo.Flag("openRegistrations"));
+			Assert.False(v1.Flag("registrations"));
+			Assert.True(v1.Flag("invites_enabled"));
+			Assert.False(v2["registrations"].Flag("enabled"));
+			Assert.Equal(RegistrationOptions.ClosedMessage, v2["registrations"].Text("message"));
+		}
+	}
+}

PrivaPub.Tests/Http/RootRemovalTests.cs

@@ -0,0 +1,118 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Net.Http.Json;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Tests.Http
+{
+	// Deleting a root deletes its personas and their groups everywhere (owner decision 2026-10-04).
+	[Trait("Category", "Integration")]
+	public sealed class RootRemovalTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		HttpClient _client;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_client = _host.Client();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			_client?.Dispose();
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		async Task<HttpResponseMessage> AdminRemoves(params string[] rootIds)
+		{
+			var admin = await _host.Admin();
+			using var client = _host.As(admin.Jwt);
+			using var request = new HttpRequestMessage(HttpMethod.Delete, "/clientapi/admin/remove/users") { Content = JsonContent.Create(new { userIdList = rootIds }) };
+			return await client.SendAsync(request, TestContext.Current.CancellationToken);
+		}
+
+		[Fact]
+		public async Task A_removed_roots_personas_and_groups_are_deleted_everywhere_and_say_so()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var root = await _host.SignUp("leaving");
+			var persona = await _host.Persona(root, "leaving");
+			var follower = new RemoteActor(_peer, "fan");
+			var member = new RemoteActor(_peer, "member");
+			await DB.Default.SaveAsync(new Follower { LocalActorId = persona.Id, LocalActorKind = LocalActorKind.Person, ActorURI = follower.Id, InboxURL = follower.Id + "/inbox" }, token);
+			var group = await _host.Group(persona, community: true);
+			var groupId = group["id"]!.GetValue<string>();
+			await DB.Default.SaveAsync(new Follower { LocalActorId = groupId, LocalActorKind = LocalActorKind.Group, ActorURI = member.Id, InboxURL = member.Id + "/inbox" }, token);
+			var post = await _host.Publish(persona, "goodbye soon");
+			var apiToken = await _host.MastodonToken(persona);
+			var since = DateTime.UtcNow.AddSeconds(-1);
+
+			Assert.Equal(HttpStatusCode.OK, (await AdminRemoves(root.Id)).StatusCode);
+
+			var toFollower = Assert.Single(await Jobs.Deliveries(follower.Id + "/inbox", since, token), d => d["type"]!.GetValue<string>() == "Delete");
+			Assert.Equal(persona.ActorUri(), toFollower["object"]!.GetValue<string>());
+			Assert.Equal(persona.ActorUri(), toFollower["actor"]!.GetValue<string>());
+			var groupName = group["userName"]!.GetValue<string>();
+			Assert.Contains(await Jobs.Deliveries(member.Id + "/inbox", since, token),
+				d => d["type"]!.GetValue<string>() == "Delete" && d["object"]!.GetValue<string>() == $"{PrivaPubHost.Base}/peasants/{groupName}");
+			var gone = await _client.Fetch($"/peasants/{persona.UserName}");
+			Assert.Equal(HttpStatusCode.Gone, gone.Status);
+			Assert.Equal("Person", gone.Json["formerType"]!.GetValue<string>());
+			Assert.Equal(HttpStatusCode.Gone, (await _client.Fetch($"/peasants/{groupName}")).Status);
+			Assert.Equal(HttpStatusCode.Gone, (await _client.GetAsync($"/.well-known/webfinger?resource=acct:{persona.UserName}@{PrivaPubHost.Host}", token)).StatusCode);
+			var stored = await DB.Default.Find<PostEntity>().MatchID(post.ID).ExecuteFirstAsync(token);
+			Assert.NotNull(stored.DeletedAt);
+			Assert.Null(stored.ContentHtml);
+			Assert.NotNull((await DB.Default.Find<GroupEntity>().MatchID(groupId).ExecuteFirstAsync(token)).DeletionAt);
+			var removed = await DB.Default.Find<RootUser>().MatchID(root.Id).ExecuteFirstAsync(token);
+			Assert.Equal($"deleted-{root.Id}", removed.UserName);
+			Assert.Null(removed.HashedPassword);
+			using var app = _host.Client();
+			app.DefaultRequestHeaders.Authorization = new("Bearer", apiToken);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await app.GetAsync("/api/v1/accounts/verify_credentials", token)).StatusCode);
+		}
+
+		[Fact]
+		public async Task A_second_removal_does_not_collide_with_the_first()
+		{
+			var first = await _host.SignUp("first");
+			var second = await _host.SignUp("second");
+
+			Assert.Equal(HttpStatusCode.OK, (await AdminRemoves(first.Id)).StatusCode);
+			Assert.Equal(HttpStatusCode.OK, (await AdminRemoves(second.Id)).StatusCode);
+
+			Assert.NotNull((await DB.Default.Find<RootUser>().MatchID(second.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken)).DeletedAt);
+		}
+
+		[Fact]
+		public async Task A_root_deletes_itself_only_with_its_password()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var root = await _host.SignUp("self");
+			var persona = await _host.Persona(root, "self");
+			using var client = _host.As(root.Jwt);
+
+			var refused = await client.PostJson("/clientapi/user/delete", new { password = "Not-The-Password-1" });
+			Assert.Equal(HttpStatusCode.Forbidden, refused.StatusCode);
+			Assert.Null((await DB.Default.Find<Avatar>().MatchID(persona.Id).ExecuteFirstAsync(token)).DeletionAt);
+
+			var accepted = await client.PostJson("/clientapi/user/delete", new { password = root.Password });
+			Assert.Equal(HttpStatusCode.OK, accepted.StatusCode);
+			Assert.NotNull((await DB.Default.Find<Avatar>().MatchID(persona.Id).ExecuteFirstAsync(token)).DeletionAt);
+			Assert.Equal(HttpStatusCode.Unauthorized, (await client.GetAsync("/clientapi/user/sniff/again", token)).StatusCode);
+		}
+	}
+}

PrivaPub.Tests/Http/ThreadCollectionsTests.cs

@@ -0,0 +1,63 @@
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	// a public thread names its replies and its conversation (owner decision 2026-10-06), and they list only what is public
+	// or unlisted; a followers-only post names neither
+	[Trait("Category", "Integration")]
+	public sealed class ThreadCollectionsTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static string PathOf(JsonObject status) => new Uri(status.Text("uri")).AbsolutePath;
+
+		static string[] Items(JsonNode collection) => collection["orderedItems"]!.AsArray().Select(i => i!.GetValue<string>()).ToArray();
+
+		[Fact]
+		public async Task A_public_post_names_its_replies_and_context_which_list_only_public_answers()
+		{
+			var alice = await _host.Mastodon("alice");
+			var carol = await _host.Mastodon("carol");
+			var root = await alice.Status("a public question");
+			var answer = await carol.Status("a public answer", ("in_reply_to_id", root.Text("id")));
+			var hidden = await carol.Status("for my followers", ("in_reply_to_id", root.Text("id")), ("visibility", "private"));
+			var deeper = await alice.Status("and a deeper one", ("in_reply_to_id", answer.Text("id")), ("visibility", "unlisted"));
+
+			var note = (await _host.ActivityPub(PathOf(root))).Ok().Object;
+			Assert.Equal(root.Text("uri") + "/replies", note.Text("replies"));
+			Assert.Equal(root.Text("uri") + "/context", note.Text("context"));
+			var answerNote = (await _host.ActivityPub(PathOf(deeper))).Ok().Object;
+			Assert.Equal(root.Text("uri") + "/context", answerNote.Text("context"));
+
+			var replies = (await _host.ActivityPub(PathOf(root) + "/replies")).Ok().Object;
+			Assert.Equal(new[] { answer.Text("uri") }, Items(replies));
+
+			var context = (await _host.ActivityPub(PathOf(root) + "/context")).Ok().Object;
+			Assert.Equal(new[] { root.Text("uri"), answer.Text("uri"), deeper.Text("uri") }, Items(context));
+			Assert.Equal(alice.Uri, context.Text("attributedTo"));
+			Assert.DoesNotContain(hidden.Text("uri"), Items(context));
+		}
+
+		[Fact]
+		public async Task A_followers_only_post_names_neither_and_serves_neither()
+		{
+			var alice = await _host.Mastodon("alice");
+			var quiet = await alice.Status("for my followers", ("visibility", "private"));
+
+			Assert.Equal(HttpStatusCode.NotFound, (await _host.ActivityPub(PathOf(quiet) + "/replies")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await _host.ActivityPub(PathOf(quiet) + "/context")).Status);
+		}
+	}
+}

PrivaPub.Tests/Http/WellKnownTests.cs

@@ -0,0 +1,237 @@
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Tests.Support.Host.FederationHelpers;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class WellKnownTests : IAsyncLifetime
+	{
+		const string Base = PrivaPubHost.Base;
+		const string Domain = PrivaPubHost.Host;
+
+		PrivaPubHost _host;
+		HttpClient _client;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_client = _host.Client();
+		}
+
+		public ValueTask DisposeAsync()
+		{
+			_client?.Dispose();
+			return ValueTask.CompletedTask;
+		}
+
+		Task<Fetched> WebFinger(string resource) =>
+			_client.Fetch("/.well-known/webfinger" + (resource == default ? string.Empty : "?resource=" + Uri.EscapeDataString(resource)), "application/jrd+json");
+
+		static string Link(JsonObject document, string rel) =>
+			document["links"]!.AsArray().Single(l => l!["rel"]!.GetValue<string>() == rel)!["href"]!.GetValue<string>();
+
+		// FEP-d556, FEP-2677 and FEP-844e: the server's own actor is found from its origin and from NodeInfo, and says what
+		// the server reads that its documents do not show
+		[Fact]
+		public async Task The_server_actor_is_found_from_the_origin_and_nodeinfo_and_tells_what_it_implements()
+		{
+			var instance = $"{Base}/peasants/privapub";
+			foreach (var resource in new[] { Base, Base + "/" })
+			{
+				var found = await WebFinger(resource);
+				Assert.Equal(HttpStatusCode.OK, found.Status);
+				Assert.Equal(resource, found.Json["subject"]!.GetValue<string>());
+				Assert.Equal(instance, Link(found.Json, "https://www.w3.org/ns/activitystreams#Service"));
+			}
+			var nodeinfo = await _client.Fetch("/.well-known/nodeinfo", "application/json");
+			Assert.Equal(instance, Link(nodeinfo.Json, "https://www.w3.org/ns/activitystreams#Application"));
+
+			var actor = (await _client.Fetch("/peasants/privapub")).Json;
+			Assert.Contains(actor["implements"]!.AsArray(), i => i!["href"]!.GetValue<string>() == "https://datatracker.ietf.org/doc/html/rfc9421");
+			var persona = await _host.Persona(await _host.SignUp(), "generated");
+			var personaActor = (await _client.Fetch($"/peasants/{persona.UserName}")).Json;
+			Assert.Equal("Application", personaActor["generator"]!["type"]!.GetValue<string>());
+			Assert.Contains(personaActor["generator"]!["implements"]!.AsArray(), i => i!["href"]!.GetValue<string>() == "https://datatracker.ietf.org/doc/html/rfc9421");
+			Assert.StartsWith("z6Mk", personaActor["assertionMethod"]![0]!["publicKeyMultibase"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task WebFinger_finds_a_persona_by_acct_and_by_actor_uri()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "finger");
+			var resources = new[]
+			{
+				$"acct:{persona.UserName}@{Domain}",
+				$"acct:@{persona.UserName}@{Domain}",
+				$"acct:{persona.UserName.ToUpperInvariant()}@{Domain.ToUpperInvariant()}",
+				$"{persona.UserName}@{Domain}",
+				$"@{persona.UserName}@{Domain}",
+				persona.ActorUri()
+			};
+
+			foreach (var resource in resources)
+			{
+				var found = await WebFinger(resource);
+				Assert.True(found.Status == HttpStatusCode.OK, $"{resource} answered {(int)found.Status}");
+				Assert.Equal("application/jrd+json", found.MediaType);
+				var document = found.Json;
+				Assert.Equal($"acct:{persona.UserName}@{Domain}", document["subject"]!.GetValue<string>());
+				Assert.Equal(new[] { $"{Base}/@{persona.UserName}", persona.ActorUri() }, Strings(document["aliases"]));
+				Assert.Equal(persona.ActorUri(), Link(document, "self"));
+				Assert.Equal("application/activity+json", document["links"]!.AsArray().Single(l => l!["rel"]!.GetValue<string>() == "self")!["type"]!.GetValue<string>());
+				Assert.Equal($"{Base}/@{persona.UserName}", Link(document, "http://webfinger.net/rel/profile-page"));
+				Assert.DoesNotContain(persona.Root.Id, found.Text);
+				Assert.DoesNotContain(persona.Root.UserName, found.Text);
+			}
+		}
+
+		[Fact]
+		public async Task WebFinger_refuses_other_domains_unknown_names_and_a_missing_resource()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "nofinger");
+
+			Assert.Equal(HttpStatusCode.NotFound, (await WebFinger($"acct:{persona.UserName}@elsewhere.example")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await WebFinger($"acct:{persona.UserName}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await WebFinger($"acct:nobody{Guid.NewGuid():N}"[..20] + "@" + Domain)).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await WebFinger($"https://elsewhere.example/peasants/{persona.UserName}")).Status);
+			Assert.Equal(HttpStatusCode.NotFound, (await WebFinger($"acct:{persona.Root.UserName}@{Domain}")).Status);
+			Assert.Equal(HttpStatusCode.BadRequest, (await WebFinger(default)).Status);
+			Assert.Equal(HttpStatusCode.BadRequest, (await WebFinger(string.Empty)).Status);
+		}
+
+		[Fact]
+		public async Task WebFinger_finds_the_servers_own_actors_and_a_community()
+		{
+			var owner = await _host.Persona(await _host.SignUp(), "fingerowner");
+			var community = await _host.FederatedGroup(owner, community: true);
+
+			var instance = await WebFinger($"acct:privapub@{Domain}");
+			var group = await WebFinger($"acct:{community.UserName}@{Domain}");
+
+			Assert.Equal(HttpStatusCode.OK, instance.Status);
+			Assert.Equal($"acct:privapub@{Domain}", instance.Json["subject"]!.GetValue<string>());
+			Assert.Equal($"{Base}/peasants/privapub", Link(instance.Json, "self"));
+			Assert.Single(instance.Json["links"]!.AsArray());
+			var reporter = await WebFinger($"acct:privapub_reports@{Domain}");
+			Assert.Equal(HttpStatusCode.OK, reporter.Status);
+			Assert.Equal($"{Base}/peasants/privapub_reports", Link(reporter.Json, "self"));
+			Assert.Single(reporter.Json["links"]!.AsArray());
+			Assert.Equal(HttpStatusCode.OK, group.Status);
+			Assert.Equal($"acct:{community.UserName}@{Domain}", group.Json["subject"]!.GetValue<string>());
+			Assert.Equal(community.Uri, Link(group.Json, "self"));
+			Assert.DoesNotContain(owner.UserName, group.Text);
+			Assert.DoesNotContain(owner.Id, group.Text);
+		}
+
+		// Current behaviour, for the owner to decide: WebFinger answers for a circle, because Mastodon resolves a handle
+		// through WebFinger before it can send the Follow a circle takes members through, while /api/v1/accounts/lookup,
+		// search and the profile page do not show circles at all.
+		[Fact]
+		public async Task WebFinger_answers_for_a_circle()
+		{
+			var owner = await _host.Persona(await _host.SignUp(), "circlefinger");
+			var circle = await _host.FederatedGroup(owner, community: false);
+
+			var found = await WebFinger($"acct:{circle.UserName}@{Domain}");
+
+			Assert.Equal(HttpStatusCode.OK, found.Status);
+			Assert.Equal(circle.Uri, Link(found.Json, "self"));
+			Assert.DoesNotContain(owner.UserName, found.Text);
+		}
+
+		[Fact]
+		public async Task NodeInfo_is_linked_and_served_in_both_versions_without_naming_anyone()
+		{
+			var root = await _host.SignUp();
+			var persona = await _host.Persona(root, "nodeinfo");
+			await _host.Publish(persona, "counted");
+
+			var links = await _client.Fetch("/.well-known/nodeinfo", "application/json");
+
+			Assert.Equal(HttpStatusCode.OK, links.Status);
+			Assert.Equal("application/json", links.MediaType);
+			var hrefs = links.Json["links"]!.AsArray().ToDictionary(l => l!["rel"]!.GetValue<string>(), l => l!["href"]!.GetValue<string>());
+			Assert.Equal($"{Base}/nodeinfo/2.1", hrefs["http://nodeinfo.diaspora.software/ns/schema/2.1"]);
+			Assert.Equal($"{Base}/nodeinfo/2.0", hrefs["http://nodeinfo.diaspora.software/ns/schema/2.0"]);
+			foreach (var version in new[] { "2.0", "2.1" })
+			{
+				var info = await _client.Fetch(PathOf(hrefs[$"http://nodeinfo.diaspora.software/ns/schema/{version}"]), "application/json");
+				Assert.Equal(HttpStatusCode.OK, info.Status);
+				Assert.Equal("application/json", info.MediaType);
+				Assert.Contains($"profile=\"http://nodeinfo.diaspora.software/ns/schema/{version}#\"", info.Response.Content.Headers.ContentType!.ToString());
+				var document = info.Json;
+				Assert.Equal(version, document["version"]!.GetValue<string>());
+				Assert.Equal("privapub", document["software"]!["name"]!.GetValue<string>());
+				Assert.Equal(version == "2.1", document["software"]!["repository"] != default);
+				Assert.Equal(new[] { "activitypub" }, Strings(document["protocols"]));
+				Assert.True(document["usage"]!["users"]!["total"]!.GetValue<long>() >= 1);
+				Assert.True(document["usage"]!["localPosts"]!.GetValue<long>() >= 1);
+				Assert.DoesNotContain(root.Id, info.Text);
+				Assert.DoesNotContain(root.UserName, info.Text);
+				Assert.DoesNotContain(persona.UserName, info.Text);
+			}
+		}
+
+		[Fact]
+		public async Task Unknown_nodeinfo_versions_are_404()
+		{
+			foreach (var version in new[] { "1.0", "2.2", "3.0", "2.0.json", "2" })
+				Assert.True((await _client.Fetch($"/nodeinfo/{version}", "application/json")).Status == HttpStatusCode.NotFound, $"/nodeinfo/{version} was served");
+		}
+	}
+
+	[Trait("Category", "Integration")]
+	[Collection(nameof(Exclusive))]
+	public sealed class NodeInfoUsageTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		async Task<long> LocalPosts()
+		{
+			using var client = _host.Client();
+			return (await client.Fetch("/nodeinfo/2.1", "application/json")).Json["usage"]!["localPosts"]!.GetValue<long>();
+		}
+
+		// localPosts is Mastodon's: the sum of statuses_count, every local post but DMs and deleted ones, boosts included,
+		// and circle and located posts too (owner decision 2026-10-04)
+		[Fact]
+		public async Task Local_posts_count_as_mastodon_counts_statuses()
+		{
+			var persona = await _host.Persona(await _host.SignUp(), "usage");
+			var friend = await _host.Persona(await _host.SignUp(), "usagefriend");
+			var start = await LocalPosts();
+
+			var shown = await _host.Publish(persona, "counted");
+			await _host.Publish(persona, "counted too", PostVisibility.Unlisted);
+			Assert.Equal(start + 2, await LocalPosts());
+
+			await _host.Publish(persona, "for followers", PostVisibility.FollowersOnly);
+			await _host.Publish(persona, $"@{friend.UserName} between us", PostVisibility.Direct);
+			await _host.PublishLocated(persona, "around here");
+			await _host.FederatedCopy(persona);
+			await _host.Reblog(friend, shown);
+			var circle = await _host.FederatedGroup(persona, community: false);
+			await _host.Publish(persona, new StatusDraft { Text = "circle only", PlainText = true, GroupId = circle.Id });
+			Assert.Equal(start + 6, await LocalPosts());//followers-only, located, the boost and the circle post; not the DM nor the copy
+
+			await _host.Remove(persona, shown);
+			Assert.Equal(start + 4, await LocalPosts());//the post and the boost of it
+		}
+	}
+}

PrivaPub.Tests/Infrastructure/AdminCommandsTests.cs

@@ -0,0 +1,147 @@
+using Microsoft.Extensions.DependencyInjection;
+
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels;
+using PrivaPub.Infrastructure.Cli;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+
+namespace PrivaPub.Tests.Infrastructure
+{
+	[Trait("Category", "Integration")]
+	public sealed class AdminCommandsTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static async Task<List<string>> StoredPolicies(Root root) =>
+			(await DB.Default.Find<RootUser>().MatchID(root.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken)).Policies.Order().ToList();
+
+		async Task<HttpStatusCode> AdminRoute(Root root)
+		{
+			using var client = _host.As(root.Jwt);
+			return (await client.GetAsync("/clientapi/admin/domainblocks/list", TestContext.Current.CancellationToken)).StatusCode;
+		}
+
+		[Fact]
+		public async Task Promote_makes_an_admin_and_a_moderator()
+		{
+			var root = await _host.SignUp("promote");
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName.ToUpperInvariant() }, _host.Services));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }, _host.Services));
+
+			Assert.Equal(new[] { Policies.IsAdmin, Policies.IsModerator, Policies.IsUser }.Order(), await StoredPolicies(root));
+		}
+
+		[Fact]
+		public async Task Demote_leaves_a_plain_user()
+		{
+			var root = await _host.SignUp("demote");
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }, _host.Services));
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }, _host.Services));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }, _host.Services));
+
+			Assert.Equal(new[] { Policies.IsUser }, await StoredPolicies(root));
+		}
+
+		[Fact]
+		public async Task An_unknown_root_exits_1()
+		{
+			Assert.Equal(1, await AdminCommands.Run(new[] { "promote", $"nobody{Guid.NewGuid():N}" }, _host.Services));
+			Assert.Equal(1, await AdminCommands.Run(new[] { "demote", $"nobody{Guid.NewGuid():N}" }, _host.Services));
+		}
+
+		public static TheoryData<string[]> Misuses() => new()
+		{
+			Array.Empty<string>(),
+			new[] { "promote" },
+			new[] { "promote", "a", "b" },
+			new[] { "delete", "a" },
+			new[] { "PROMOTE", "a" }
+		};
+
+		[Theory]
+		[MemberData(nameof(Misuses))]
+		public async Task Misuse_exits_2(string[] args)
+		{
+			Assert.Equal(2, await AdminCommands.Run(args, _host.Services));
+		}
+
+		[Fact]
+		public async Task A_token_follows_its_roots_policies_at_once()
+		{
+			var root = await _host.SignUp("policies");
+			Assert.Equal(HttpStatusCode.Forbidden, await AdminRoute(root));
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }, _host.Services));
+			Assert.Equal(HttpStatusCode.OK, await AdminRoute(root));
+			using (var client = _host.As(root.Jwt))
+			{
+				var refreshed = await (await client.GetAsync("/clientapi/user/sniff/again", TestContext.Current.CancellationToken)).JsonBody();
+				Assert.Contains(Policies.IsAdmin, refreshed["policies"]!.AsArray().Select(p => p!.GetValue<string>()));
+			}
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }, _host.Services));
+			Assert.Equal(HttpStatusCode.Forbidden, await AdminRoute(root));
+		}
+
+		async Task<HttpStatusCode> LogIn(string login, string password)
+		{
+			using var client = _host.Client();
+			return (await client.PostJson("/clientapi/user/login", new { userName = login, password })).StatusCode;
+		}
+
+		[Fact]
+		public async Task Create_root_makes_a_login_from_a_password_on_standard_input()
+		{
+			using var scope = _host.Services.CreateScope();
+			var login = $"made{Guid.NewGuid():N}"[..20];
+			var output = new StringWriter();
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "create-root", login, "--admin" }, scope.ServiceProvider, new StringReader("Typed-On-Stdin-1\n"), output));
+			Assert.Equal(1, await AdminCommands.Run(new[] { "create-root", login }, scope.ServiceProvider, new StringReader("Typed-On-Stdin-2\n"), new StringWriter()));
+			Assert.Equal(1, await AdminCommands.Run(new[] { "create-root", $"weak{Guid.NewGuid():N}"[..20] }, scope.ServiceProvider, new StringReader("short\n"), new StringWriter()));
+			Assert.Equal(2, await AdminCommands.Run(new[] { "create-root", login, "--root" }, scope.ServiceProvider, new StringReader("Typed-On-Stdin-3\n"), new StringWriter()));
+
+			Assert.Equal(HttpStatusCode.OK, await LogIn(login, "Typed-On-Stdin-1"));
+			var stored = await DB.Default.Find<RootUser>().Match(u => u.UserName == login).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+			Assert.Contains(Policies.IsAdmin, stored.Policies);
+		}
+
+		[Fact]
+		public async Task Smoke_keeps_one_undiscoverable_persona_and_a_new_password_each_run()
+		{
+			using var scope = _host.Services.CreateScope();
+			var persona = $"smoke{Guid.NewGuid():N}"[..20];
+			var first = new StringWriter();
+			var second = new StringWriter();
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "smoke", persona }, scope.ServiceProvider, output: first));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "smoke", persona }, scope.ServiceProvider, output: second));
+
+			var (login, oldPassword) = (first.ToString().Trim().Split(' ')[0], first.ToString().Trim().Split(' ')[1]);
+			var newPassword = second.ToString().Trim().Split(' ')[1];
+			Assert.Equal(AdminCommands.SmokeLogin, login);
+			Assert.NotEqual(oldPassword, newPassword);
+			Assert.Equal(HttpStatusCode.OK, await LogIn(login, newPassword));
+			Assert.NotEqual(HttpStatusCode.OK, await LogIn(login, oldPassword));
+			var avatars = await DB.Default.Find<Avatar>().Match(a => a.UserName == persona).ExecuteAsync(TestContext.Current.CancellationToken);
+			var avatar = Assert.Single(avatars);
+			Assert.False(avatar.Settings.IsDiscoverable);
+			Assert.False(avatar.Settings.IsIndexable);
+		}
+	}
+}

PrivaPub.Tests/Infrastructure/BackupTests.cs

@@ -0,0 +1,287 @@
+using MongoDB.Bson;
+using MongoDB.Bson.IO;
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Backup;
+using PrivaPub.Infrastructure.Cli;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.IO.Compression;
+
+namespace PrivaPub.Tests.Infrastructure
+{
+	// The server's backup: every collection as it was, byte for byte, read at one instant on a replica set, without what
+	// belongs to the moment (the statistics salt above all), with the media rows' files linked, checkable and rotated.
+	// Each test backs up a database of its own; alone, since the maintenance lock is the server's one.
+	[Trait("Category", "Integration")]
+	[Xunit.Collection(nameof(Exclusive))]
+	public sealed class BackupTests : IAsyncLifetime
+	{
+		readonly string _scratch = Path.Combine(Path.GetTempPath(), $"privapub-backup-tests-{Guid.NewGuid():N}");
+		IMongoDatabase _database;
+
+		string Backups => Path.Combine(_scratch, "backups");
+		string Media => Path.Combine(_scratch, "media");
+		string Trash => Path.Combine(_scratch, "media-trash");
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			await PrivaPubHost.Shared();
+			_database = DB.Default.Database().Client.GetDatabase($"PrivaPubBackup_{Guid.NewGuid():N}");
+			Directory.CreateDirectory(Media);
+			Directory.CreateDirectory(Trash);
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_database != default)
+				await _database.Client.DropDatabaseAsync(_database.DatabaseNamespace.DatabaseName);
+			if (Directory.Exists(_scratch))
+				Directory.Delete(_scratch, recursive: true);
+		}
+
+		BackupContext Context(BackupOptions options = default) => new(_database, Backups, Media, Trash, "https://privapub.test", options ?? new BackupOptions());
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		static List<BsonDocument> Read(string file)
+		{
+			using var gzip = new GZipStream(File.OpenRead(file), CompressionMode.Decompress);
+			using var reader = new StreamReader(gzip);
+			var documents = new List<BsonDocument>();
+			while (reader.ReadLine() is { } line)
+				documents.Add(BsonDocument.Parse(line));
+			return documents;
+		}
+
+		async Task<List<byte[]>> Raw(string collection) =>
+			(await (await _database.GetCollection<RawBsonDocument>(collection).FindAsync(FilterDefinition<RawBsonDocument>.Empty, cancellationToken: Token)).ToListAsync(Token))
+				.Select(d =>
+				{
+					var bytes = new byte[d.Slice.Length];
+					d.Slice.GetBytes(0, bytes, 0, bytes.Length);
+					return bytes;
+				})
+				.ToList();
+
+		[Fact]
+		public async Task Every_document_comes_back_byte_for_byte_and_the_salt_never_leaves()
+		{
+			var odd = new BsonDocument
+			{
+				{ "_id", ObjectId.GenerateNewId() },
+				{ "Guid", new BsonBinaryData(Guid.NewGuid(), GuidRepresentation.Standard) },
+				{ "OldGuid", new BsonBinaryData(new byte[16], BsonBinarySubType.UuidLegacy) },
+				{ "Money", new BsonDecimal128(Decimal128.Parse("12345.678900")) },
+				{ "Long", new BsonInt64(long.MaxValue) },
+				{ "Int", 7 },
+				{ "Double", -0.0 },
+				{ "NaN", double.NaN },
+				{ "At", new BsonDateTime(new DateTime(2026, 10, 7, 3, 30, 0, 123, DateTimeKind.Utc)) },
+				{ "Stamp", new BsonTimestamp(1, 2) },
+				{ "Null", BsonNull.Value },
+				{ "Regex", new BsonRegularExpression("^a.b$", "i") },
+				{ "Nested", new BsonDocument { { "z", 1 }, { "a", new BsonArray { 1, "two", new BsonDocument("three", 3) } } } },
+				{ "Unicode", "città 🌍 \u0000 end" }
+			};
+			// an ObjectRecord as big as a remote's long post gets
+			var big = new BsonDocument { { "_id", ObjectId.GenerateNewId() }, { "Json", new string('x', 10 * 1024 * 1024) } };
+			await _database.GetCollection<BsonDocument>("Odd").InsertOneAsync(odd, cancellationToken: Token);
+			await _database.GetCollection<BsonDocument>("ObjectRecord").InsertOneAsync(big, cancellationToken: Token);
+			await _database.GetCollection<BsonDocument>("Odd").Indexes.CreateOneAsync(
+				new CreateIndexModel<BsonDocument>(Builders<BsonDocument>.IndexKeys.Ascending("At"), new CreateIndexOptions { Name = "at", Unique = true }), cancellationToken: Token);
+			await _database.GetCollection<BsonDocument>("InteractionSalt").InsertOneAsync(new BsonDocument("Salt", "never in a backup"), cancellationToken: Token);
+			await _database.GetCollection<BsonDocument>("Job").InsertOneAsync(new BsonDocument("Kind", "Deliver"), cancellationToken: Token);
+			await _database.GetCollection<BsonDocument>("_migration_history_").InsertManyAsync([
+				new BsonDocument { { "Number", 15 }, { "Name", "older" } }, new BsonDocument { { "Number", 16 }, { "Name", "focal points are finite" } }], cancellationToken: Token);
+
+			var (backup, error) = await ServerBackup.Create(Context(), "manual", dbOnly: false, Token);
+
+			Assert.Null(error);
+			var directory = Path.Combine(Backups, backup.Id);
+			Assert.False(Directory.Exists(directory + ServerBackup.PartialSuffix));
+			Assert.Equal(await Raw("Odd"), Read(Path.Combine(directory, "db", "Odd.jsonl.gz")).Select(d => d.ToBson()).ToList());
+			Assert.Equal(await Raw("ObjectRecord"), Read(Path.Combine(directory, "db", "ObjectRecord.jsonl.gz")).Select(d => d.ToBson()).ToList());
+
+			Assert.False(File.Exists(Path.Combine(directory, "db", "InteractionSalt.jsonl.gz")));
+			Assert.False(File.Exists(Path.Combine(directory, "db", "Job.jsonl.gz")));
+			foreach (var file in Directory.EnumerateFiles(directory, "*", SearchOption.AllDirectories))
+				Assert.DoesNotContain("never in a backup", await ReadAll(file));
+			Assert.Contains(backup.Manifest.Excluded, e => e.Name == "InteractionSalt");
+
+			var odds = backup.Manifest.Collections.Single(c => c.Name == "Odd");
+			Assert.Equal(1, odds.Count);
+			Assert.Contains(odds.Indexes, i => BsonDocument.Parse(i)["name"] == "at" && BsonDocument.Parse(i)["unique"].ToBoolean());
+			Assert.Equal((16, "focal points are finite"), (backup.Manifest.MigrationNumber, backup.Manifest.NewestMigration));
+			Assert.Equal("https://privapub.test", backup.Manifest.Host);
+			Assert.Equal(MongoFixture.Connection.Contains("directConnection=true"), backup.Manifest.Consistent);
+			Assert.Empty(await ServerBackup.Verify(Backups, backup.Id, Token));
+			if (!OperatingSystem.IsWindows())
+			{
+				Assert.Equal(UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.GroupRead, File.GetUnixFileMode(Path.Combine(directory, "db", "Odd.jsonl.gz")));
+				Assert.False(File.GetUnixFileMode(directory).HasFlag(UnixFileMode.OtherRead));
+			}
+		}
+
+		static async Task<string> ReadAll(string file)
+		{
+			if (!file.EndsWith(".gz", StringComparison.Ordinal))
+				return await File.ReadAllTextAsync(file, Token);
+			await using var gzip = new GZipStream(File.OpenRead(file), CompressionMode.Decompress);
+			using var reader = new StreamReader(gzip);
+			return await reader.ReadToEndAsync(Token);
+		}
+
+		[Fact]
+		public async Task Media_rows_files_are_linked_from_the_live_directory_or_the_trash()
+		{
+			Directory.CreateDirectory(Path.Combine(Media, "2026", "10"));
+			await File.WriteAllTextAsync(Path.Combine(Media, "2026", "10", "live.jpg"), "live", Token);
+			await File.WriteAllTextAsync(Path.Combine(Media, "2026", "10", "live-preview.jpg"), "preview", Token);
+			Directory.CreateDirectory(Path.Combine(Trash, "2026", "10"));
+			await File.WriteAllTextAsync(Path.Combine(Trash, "2026", "10", "moving.jpg"), "moving", Token);
+			await File.WriteAllTextAsync(Path.Combine(Media, "2026", "10", "trashed.jpg"), "trashed", Token);
+			await _database.GetCollection<BsonDocument>("MediaAttachment").InsertManyAsync([
+				new BsonDocument { { "FilePath", "2026/10/live.jpg" }, { "PreviewPath", "2026/10/live-preview.jpg" }, { "TrashedAt", BsonNull.Value } },
+				new BsonDocument { { "FilePath", "2026/10/moving.jpg" } },//a file the janitor moved while its row was being trashed
+				new BsonDocument { { "FilePath", "2026/10/gone.jpg" } },
+				new BsonDocument { { "FilePath", "2026/10/trashed.jpg" }, { "TrashedAt", DateTime.UtcNow } },
+				new BsonDocument { { "FilePath", "../../etc/passwd" } }], cancellationToken: Token);
+
+			var (backup, _) = await ServerBackup.Create(Context(), "manual", dbOnly: false, Token);
+
+			var media = Path.Combine(Backups, backup.Id, "media");
+			Assert.Equal("live", await File.ReadAllTextAsync(Path.Combine(media, "2026", "10", "live.jpg"), Token));
+			Assert.Equal("preview", await File.ReadAllTextAsync(Path.Combine(media, "2026", "10", "live-preview.jpg"), Token));
+			Assert.Equal("moving", await File.ReadAllTextAsync(Path.Combine(media, "2026", "10", "moving.jpg"), Token));
+			Assert.False(File.Exists(Path.Combine(media, "2026", "10", "trashed.jpg")));
+			Assert.Equal(["2026/10/live-preview.jpg", "2026/10/live.jpg", "2026/10/moving.jpg"], backup.Manifest.Media.List);
+			Assert.Equal((3, 1), (backup.Manifest.Media.Files, backup.Manifest.Media.Missing));
+
+			// a link, not a copy: the live file deleted, the backup's stays
+			File.Delete(Path.Combine(Media, "2026", "10", "live.jpg"));
+			Assert.Equal("live", await File.ReadAllTextAsync(Path.Combine(media, "2026", "10", "live.jpg"), Token));
+
+			// db-only lists them and links none
+			var (listed, _) = await ServerBackup.Create(Context(), "pre-deploy", dbOnly: true, Token);
+			Assert.False(Directory.Exists(Path.Combine(Backups, listed.Id, "media")));
+			Assert.Equal(["2026/10/live-preview.jpg", "2026/10/moving.jpg"], listed.Manifest.Media.List);
+			Assert.Empty(await ServerBackup.Verify(Backups, listed.Id, Token));
+			Assert.Empty(await ServerBackup.Verify(Backups, backup.Id, Token));
+		}
+
+		[Fact]
+		public async Task Verify_finds_an_altered_or_missing_file()
+		{
+			await _database.GetCollection<BsonDocument>("Post").InsertOneAsync(new BsonDocument("Content", "hello"), cancellationToken: Token);
+			await _database.GetCollection<BsonDocument>("Avatar").InsertOneAsync(new BsonDocument("UserName", "someone"), cancellationToken: Token);
+			var (backup, _) = await ServerBackup.Create(Context(), "manual", dbOnly: false, Token);
+			var db = Path.Combine(Backups, backup.Id, "db");
+
+			await File.AppendAllTextAsync(Path.Combine(db, "Post.jsonl.gz"), "tampered", Token);
+			File.Delete(Path.Combine(db, "Avatar.jsonl.gz"));
+
+			Assert.Equal(["Avatar: missing", "Post: altered"], (await ServerBackup.Verify(Backups, backup.Id, Token)).Order());
+			Assert.Equal(["no such backup, or no manifest"], await ServerBackup.Verify(Backups, "../" + backup.Id, Token));
+		}
+
+		[Fact]
+		public async Task One_backup_at_a_time()
+		{
+			await using (var held = await MaintenanceLock.Take("restore", Token))
+			{
+				Assert.NotNull(held);
+				var (backup, error) = await ServerBackup.Create(Context(), "manual", dbOnly: true, Token);
+				Assert.Null(backup);
+				Assert.Contains("already running", error);
+				Assert.Equal("restore", (await MaintenanceLock.Current(Token)).What);
+			}
+			Assert.Null(await MaintenanceLock.Current(Token));
+			Assert.NotNull((await ServerBackup.Create(Context(), "manual", dbOnly: true, Token)).Backup);
+		}
+
+		[Fact]
+		public async Task A_holder_that_died_is_taken_over()
+		{
+			await using var dead = await MaintenanceLock.Take("backup", Token);
+			await DB.Default.Update<MaintenanceLock>().Match(l => l.ID == MaintenanceLock.Name)
+				.Modify(l => l.Heartbeat, DateTime.UtcNow.AddMinutes(-3)).ExecuteAsync(Token);
+
+			Assert.Null(await MaintenanceLock.Current(Token));
+			await using var alive = await MaintenanceLock.Take("restore", Token);
+			Assert.NotNull(alive);
+			Assert.Equal("restore", (await MaintenanceLock.Current(Token)).What);
+		}
+
+		// the newest 7 nightly, the newest of each of the 4 weeks before, the newest 3 pre-deploy; manual ones kept
+		[Fact]
+		public void Rotation_keeps_days_weeks_and_the_last_deploys()
+		{
+			var today = new DateTime(2026, 10, 7, 3, 30, 0, DateTimeKind.Utc);
+			for (var day = 0; day < 60; day++)
+				Fake("nightly", today.AddDays(-day));
+			for (var deploy = 0; deploy < 5; deploy++)
+				Fake("pre-deploy", today.AddDays(-deploy).AddHours(5));
+			Fake("manual", today.AddYears(-1));
+			Directory.CreateDirectory(Path.Combine(Backups, "20260901-000000-nightly" + ServerBackup.PartialSuffix));
+			Directory.SetLastWriteTimeUtc(Path.Combine(Backups, "20260901-000000-nightly" + ServerBackup.PartialSuffix), today.AddDays(-30));
+
+			ServerBackup.Retain(Backups, new BackupOptions());
+
+			var kept = ServerBackup.List(Backups);
+			var nightly = kept.Where(b => b.Kind == "nightly").Select(b => b.CreatedAt).ToList();
+			Assert.Equal(11, nightly.Count);
+			Assert.Equal(Enumerable.Range(0, 7).Select(d => today.AddDays(-d)), nightly.Take(7));
+			Assert.Equal(4, nightly.Skip(7).Select(d => System.Globalization.ISOWeek.GetWeekOfYear(d)).Distinct().Count());
+			Assert.Equal(3, kept.Count(b => b.Kind == "pre-deploy"));
+			Assert.Single(kept, b => b.Kind == "manual");
+			Assert.Empty(Directory.EnumerateDirectories(Backups, "*" + ServerBackup.PartialSuffix));
+		}
+
+		void Fake(string kind, DateTime at)
+		{
+			var directory = Path.Combine(Backups, $"{at:yyyyMMdd-HHmmss}-{kind}");
+			Directory.CreateDirectory(Path.Combine(directory, "db"));
+			new ArchiveManifest { Kind = kind, CreatedAt = at }.Write(directory);
+		}
+
+		[Theory]
+		[InlineData("2026-10-07T03:29:00", "2026-10-06T03:31:00", false)]//yesterday's is the last one due
+		[InlineData("2026-10-07T03:31:00", "2026-10-06T03:31:00", true)]
+		[InlineData("2026-10-07T03:31:00", "2026-10-07T03:30:30", false)]
+		[InlineData("2026-10-07T01:00:00", "2026-10-05T03:31:00", true)]//missed last night: at once
+		public void A_nightly_backup_is_due_once_a_night(string now, string last, bool due) =>
+			Assert.Equal(due, BackupScheduler.IsDue(DateTime.Parse(now, null, System.Globalization.DateTimeStyles.AdjustToUniversal),
+				new TimeOnly(3, 30), [DateTime.Parse(last, null, System.Globalization.DateTimeStyles.AdjustToUniversal)]));
+
+		// the deploy's: the server's own database, through the configuration, without media links
+		[Fact]
+		public async Task The_deploy_backs_up_from_the_command_line()
+		{
+			var host = await PrivaPubHost.Shared();
+			var output = new StringWriter();
+
+			Assert.Equal(0, await AdminCommands.Run(["backup", "--kind", "pre-deploy", "--db-only"], host.Services, output: output));
+			var id = output.ToString().Split(':')[0];
+			Assert.EndsWith("-pre-deploy", id);
+			Assert.Equal(2, await AdminCommands.Run(["backup", "--kind", "nightly"], host.Services, output: TextWriter.Null));
+
+			output = new StringWriter();
+			Assert.Equal(0, await AdminCommands.Run(["backups"], host.Services, output: output));
+			Assert.StartsWith(id + "\tpre-deploy", output.ToString());
+			output = new StringWriter();
+			Assert.Equal(0, await AdminCommands.Run(["backup", "verify", id], host.Services, output: output));
+			Assert.Contains("whole", output.ToString());
+
+			var backups = host.Get<Backups>();
+			var manifest = backups.Find(id).Manifest;
+			Assert.Contains(manifest.Collections, c => c.Name == "Avatar");
+			Assert.DoesNotContain(manifest.Collections, c => c.Name is "InteractionSalt" or "Job" or "MaintenanceLock" or "openiddict.tokens" or "AppConfiguration");
+			Assert.Equal(ServerBackup.CodeMigration(), manifest.MigrationNumber);
+			Assert.True(backups.Delete(id));
+		}
+	}
+}

PrivaPub.Tests/Infrastructure/CdnCatalogTests.cs

@@ -0,0 +1,111 @@
+using PrivaPub.Infrastructure.Geo;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Models.Jobs;
+
+using System.Net;
+
+namespace PrivaPub.Tests.Infrastructure
+{
+	public class CdnCatalogTests
+	{
+		static HttpResponseMessage Response(params (string Name, string Value)[] headers)
+		{
+			var response = new HttpResponseMessage(HttpStatusCode.OK) { Content = new StringContent("{}") };
+			foreach (var (name, value) in headers)
+				response.Headers.TryAddWithoutValidation(name, value);
+			return response;
+		}
+
+		[Theory]
+		[InlineData("cf-ray", "8c1f0e2b4d5a1234-FRA", "cloudflare.com")]
+		[InlineData("server", "cloudflare", "cloudflare.com")]
+		[InlineData("x-amz-cf-id", "abc==", "cloudfront.net")]
+		[InlineData("via", "1.1 5a1b.cloudfront.net (CloudFront)", "cloudfront.net")]
+		[InlineData("x-served-by", "cache-fra-eddf8230045-FRA", "fastly.com")]
+		[InlineData("server", "BunnyCDN-DE1-1078", "bunny.net")]
+		[InlineData("akamai-grn", "0.1234", "akamai.com")]
+		[InlineData("x-azure-ref", "20261004T101010Z-abc", "azure.microsoft.com")]
+		[InlineData("x-vercel-id", "fra1::abc", "vercel.com")]
+		[InlineData("x-iinfo", "1-2-3", "imperva.com")]
+		public void A_cdn_is_recognised_by_its_fingerprint(string header, string value, string domain)
+		{
+			Assert.Equal(domain, CdnCatalog.FromResponse(Response((header, value)))?.Domain);
+		}
+
+		[Fact]
+		public void A_plain_server_has_no_cdn_and_an_unknown_cdn_names_itself()
+		{
+			Assert.Null(CdnCatalog.FromResponse(Response(("server", "nginx"), ("via", "1.1 varnish"))));
+			var named = CdnCatalog.FromResponse(Response(("x-cdn", "EdgeOne")));
+			Assert.Equal(("EdgeOne", null, "edgeone"), (named.Name, named.Domain, named.Key));
+			Assert.Null(CdnCatalog.FromResponse(Response(("x-cdn", "<script>"))));
+		}
+
+		[Fact]
+		public void Only_networks_that_carry_nothing_but_a_cdn_name_it()
+		{
+			Assert.Equal("Cloudflare", CdnCatalog.OfAsn(13335)?.Name);
+			Assert.Equal("Akamai", CdnCatalog.OfAsn(20940)?.Name);
+			Assert.Null(CdnCatalog.OfAsn(16509));//AWS: CloudFront only by its ranges or its headers
+			Assert.Null(CdnCatalog.OfAsn(60068));//DataPacket also rents servers
+		}
+
+		[Fact]
+		public void Every_published_list_format_is_read()
+		{
+			Assert.Equal(new[] { "173.245.48.0/20", "2400:cb00::/32" },
+				CdnCatalog.Parse(CdnListFormat.Lines, "173.245.48.0/20\n# comment\n\n2400:cb00::/32\n").Select(n => n.ToString()));
+			Assert.Equal(new[] { "89.187.188.227/32", "2400:52e0:1500::714:1/128" },
+				CdnCatalog.Parse(CdnListFormat.StringArray, """["89.187.188.227","2400:52e0:1500::714:1"]""").Select(n => n.ToString()));
+			Assert.Equal(new[] { "23.235.32.0/20", "2a04:4e40::/32" },
+				CdnCatalog.Parse(CdnListFormat.AddressesJson, """{"addresses":["23.235.32.0/20"],"ipv6_addresses":["2a04:4e40::/32"]}""").Select(n => n.ToString()));
+			Assert.Equal(new[] { "92.223.124.12/32", "2a03:90c0::/32" },
+				CdnCatalog.Parse(CdnListFormat.AddressesJson, """{"addresses":["92.223.124.12/32"],"addresses_v6":["2a03:90c0::/32"]}""").Select(n => n.ToString()));
+			Assert.Equal(new[] { "199.83.128.0/21", "2a02:e980::/29" },
+				CdnCatalog.Parse(CdnListFormat.ImpervaJson, """{"ipRanges":["199.83.128.0/21"],"ipv6Ranges":["2a02:e980::/29"],"res":0}""").Select(n => n.ToString()));
+			Assert.Equal(new[] { "13.32.0.0/15", "2600:9000::/28" },
+				CdnCatalog.Parse(CdnListFormat.AwsCloudFront, """
+					{"prefixes":[{"ip_prefix":"3.4.12.4/32","service":"AMAZON"},{"ip_prefix":"13.32.0.0/15","service":"CLOUDFRONT"}],
+					 "ipv6_prefixes":[{"ipv6_prefix":"2600:9000::/28","service":"CLOUDFRONT"},{"ipv6_prefix":"2406:daba::/40","service":"EC2"}]}
+					""").Select(n => n.ToString()));
+			Assert.Throws<FormatException>(() => CdnCatalog.Parse(CdnListFormat.Lines, "173.245.48.0/20\nnot an address"));
+		}
+
+		[Fact]
+		public void The_published_ranges_name_the_cdn_of_an_address()
+		{
+			var ranges = new CdnRanges();
+			ranges.Replace(new CdnRangeSet { Key = "cloudflare.com", Name = "Cloudflare", Ranges = new() { "104.16.0.0/13", "2606:4700::/32" }, FetchedAt = DateTime.UtcNow });
+
+			Assert.Equal("Cloudflare", ranges.Of(IPAddress.Parse("104.18.2.3"))?.Name);
+			Assert.Equal("Cloudflare", ranges.Of(IPAddress.Parse("::ffff:104.18.2.3"))?.Name);
+			Assert.Equal("Cloudflare", ranges.Of(IPAddress.Parse("2606:4700::1"))?.Name);
+			Assert.Null(ranges.Of(IPAddress.Parse("203.0.113.7")));
+			Assert.Equal(2, ranges.Status["cloudflare.com"].Ranges);
+		}
+
+		[Fact]
+		public async Task Responses_leave_a_cdn_hint_for_their_host_until_one_comes_without()
+		{
+			var hints = new EdgeHints();
+			var answers = new Queue<HttpResponseMessage>(new[] { Response(("cf-ray", "1-FRA")), Response(("server", "nginx")) });
+			using var client = new HttpClient(new EdgeHintsHandler(hints) { InnerHandler = new Answering(answers) });
+
+			await client.GetAsync("https://social.example/.well-known/nodeinfo", TestContext.Current.CancellationToken);
+			Assert.Equal("Cloudflare", hints.Of("social.example")?.Name);
+
+			await client.GetAsync("https://social.example/nodeinfo/2.1", TestContext.Current.CancellationToken);
+			Assert.Null(hints.Of("social.example"));
+		}
+
+		sealed class Answering : HttpMessageHandler
+		{
+			readonly Queue<HttpResponseMessage> _answers;
+
+			public Answering(Queue<HttpResponseMessage> answers) => _answers = answers;
+
+			protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken) =>
+				Task.FromResult(_answers.Dequeue());
+		}
+	}
+}

PrivaPub.Tests/Infrastructure/CdnUpdaterTests.cs

@@ -0,0 +1,105 @@
+using Microsoft.Extensions.Logging.Abstractions;
+
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Geo;
+using PrivaPub.Infrastructure.Statistics;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Tests.Support;
+
+using System.Net;
+
+namespace PrivaPub.Tests.Infrastructure
+{
+	[Trait("Category", "Integration")]
+	public sealed class CdnUpdaterTests : IAsyncLifetime
+	{
+		Peer _peer;
+		CdnRanges _ranges;
+		CdnUpdater _updater;
+		string _key;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_peer = await Peer.Start();
+			_ranges = new CdnRanges();
+			_updater = new CdnUpdater(new Clients(), new StaticOptions<StatisticsOptions>(new StatisticsOptions()), _ranges, NullLogger<CdnUpdater>.Instance);
+			_key = $"edge{Guid.NewGuid():N}.example";
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		sealed class Clients : IHttpClientFactory
+		{
+			public HttpClient CreateClient(string name) => new();
+		}
+
+		CdnProvider Provider() => new("Test Edge", _key, Array.Empty<int>(), new[]
+		{
+			new CdnList($"{_peer.A}/edge/v4", CdnListFormat.Lines),
+			new CdnList($"{_peer.A}/edge/v6", CdnListFormat.StringArray)
+		}, _ => false);
+
+		static CancellationToken Token => TestContext.Current.CancellationToken;
+
+		[Fact]
+		public async Task The_published_ranges_are_downloaded_stored_and_used()
+		{
+			_peer.ServeText("/edge/v4", "198.51.100.0/24\n", "text/plain");
+			_peer.ServeText("/edge/v6", """["2001:db8::/32","192.0.2.9"]""", "application/json");
+
+			Assert.Equal(1, await _updater.Update(new[] { Provider() }, Token));
+
+			var stored = await DB.Default.Find<CdnRangeSet>().Match(s => s.Key == _key).ExecuteSingleAsync(Token);
+			Assert.Equal(new[] { "198.51.100.0/24", "2001:db8::/32", "192.0.2.9/32" }, stored.Ranges);
+			Assert.Equal("Test Edge", _ranges.Of(IPAddress.Parse("198.51.100.20"))?.Name);
+			Assert.Equal("Test Edge", _ranges.Of(IPAddress.Parse("192.0.2.9"))?.Name);
+
+			var restarted = new CdnRanges();
+			await restarted.Load(Token);
+			Assert.Equal("Test Edge", restarted.Of(IPAddress.Parse("2001:db8::7"))?.Name);
+		}
+
+		[Theory]
+		[InlineData("not a network")]
+		[InlineData("")]
+		public async Task A_broken_or_empty_list_keeps_the_stored_ranges(string broken)
+		{
+			_peer.ServeText("/edge/v4", "198.51.100.0/24", "text/plain");
+			_peer.ServeText("/edge/v6", "[]", "application/json");
+			Assert.Equal(1, await _updater.Update(new[] { Provider() }, Token));
+
+			_peer.ServeText("/edge/v4", broken, "text/plain");
+			Assert.Equal(0, await _updater.Update(new[] { Provider() }, Token));
+
+			Assert.Equal(new[] { "198.51.100.0/24" }, (await DB.Default.Find<CdnRangeSet>().Match(s => s.Key == _key).ExecuteSingleAsync(Token)).Ranges);
+			Assert.Equal("Test Edge", _ranges.Of(IPAddress.Parse("198.51.100.1"))?.Name);
+		}
+
+		// The real lists, from the CDNs themselves: set PRIVAPUB_TEST_CDN_LIVE=1 to check that every format still parses.
+		[Fact]
+		public async Task Every_cdns_real_list_still_parses()
+		{
+			Assert.SkipUnless(Environment.GetEnvironmentVariable("PRIVAPUB_TEST_CDN_LIVE") == "1", "set PRIVAPUB_TEST_CDN_LIVE=1 to download the real lists");
+			var listed = CdnCatalog.All.Where(p => p.Lists.Length > 0).ToList();
+
+			Assert.Equal(listed.Count, await _updater.Update(listed, Token));
+
+			Assert.Equal("Cloudflare", _ranges.Of(IPAddress.Parse("104.16.0.1"))?.Name);
+			foreach (var provider in listed)
+				Assert.True(_ranges.Status[provider.Key].Ranges > 0, provider.Name);
+		}
+
+		[Fact]
+		public async Task An_unreachable_list_changes_nothing()
+		{
+			Assert.Equal(0, await _updater.Update(new[] { Provider() }, Token));
+			Assert.False(await DB.Default.Find<CdnRangeSet>().Match(s => s.Key == _key).ExecuteAnyAsync(Token));
+		}
+	}
+}