P5, first batch: summaries stop hiding articles, personas get reachable names, blocks federate

- A remote `summary` is a content warning only on a Note or Question, or when `sensitive` is set. On Articles, Events, Videos, Pages and Audio it is an excerpt (WordPress teasers, Mobilizon dates and places, Mbin titles) and is now kept as `Post.Excerpt` instead of hiding the post. `Post.ObjectType` records the remote type, and the Mastodon API shows a remote non-Note object's title above its body again. - Persona usernames must match `^[a-z0-9_]+$`, as groups already did; a name outside it was unreachable from Mastodon and Misskey. - `postingRestrictedToMods` is defined in our JSON-LD context (Iceshrimp.NET drops undefined terms). - `Vary: Accept` on actor and object URLs. - Owner decision: blocks federate. A block sends `Block`, an unblock `Undo{Block}`; checked live against GoToSocial. - Owner decision: a persona's and a group's `published`, and the day in new ids, is a random day up to two weeks before creation, so personas made the same day no longer share a date. Migration _007 gives existing ones theirs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB
The owner's six decisions on what PrivaPub reveals: previews, blocks, authorship, views, bridging, reactions
2026-10-01 17:39:58 +02:00 · 2026-10-01 17:32:59 +02:00 · 2026-10-01 14:01:57 +02:00 · 2026-10-01 13:19:16 +02:00 · 2026-10-01 13:19:16 +02:00 · 2026-10-01 12:31:13 +02:00
66 changed files with 2284 additions and 117 deletions
@@ -401,3 +401,4 @@ FodyWeavers.xsd

 PrivaPub/media-store/
 PrivaPub/media-store-proxy/
+tools/pasture/.publish/
@@ -1,7 +1,9 @@
 # CLAUDE.md

 Guidance for working in this repository. `docs/ROADMAP.md` holds the owner's decisions and the phased plan to full
-ActivityPub interop; read it before changing anything federation-, privacy- or API-shaped.
+ActivityPub interop; read it before changing anything federation-, privacy- or API-shaped. `docs/INTEROP.md` is the
+per-platform evidence behind phases P5 to P8: what each peer sends, what it expects, and what PrivaPub still drops.
+Check the platform's section there before writing a parser or a renderer, and add to it whatever you learn.

 ## What this is

@@ -69,7 +71,7 @@ PrivaPub/                         ASP.NET Core Web API, net10.0
  Infrastructure/
    Http/                         FederationHttp + SafeHttpHandlerFactory + IpRangeGuard: the only way out
    Jobs/                         JobQueue (leases), JobWorker, Backoff, HostCircuitBreaker
-    Ids/                          PrivacyIds (day-only ids for personas and groups, published-time ids for remote posts)
+    Ids/                          PrivacyIds (day-only ids for personas and groups, arrival-ordered ids for remote posts)
    Data/                         Indexes (created at start), EntityMaps.Warm, Migrations/_NNN_*.cs
    Cli/                          AdminCommands (`PrivaPub admin promote|demote <root>`)
    RateLimiting.cs               accounts (per client address) and inbox (per sending origin) policies
@@ -129,7 +131,8 @@ cd PrivaPub && ASPNETCORE_ENVIRONMENT=Development \

 Development config (`appsettings.Development.json`) binds HTTPS 7195 with HTTP/2 only; the overrides above make it
 curl-able. Outbound fetches only go to https DNS names resolving to public addresses; a test network (Pasture) sets
-`Federation__AllowPrivateNetworks=true` and `Federation__AllowPlainHttp=true`, which startup refuses in Production.
+`Federation__AllowPrivateNetworks=true`, `Federation__AllowPlainHttp=true` and `Federation__AcceptAnyCertificate=true`,
+which startup refuses in Production.

 Promoting an admin on the box (signing up as "admin" grants nothing):

@@ -166,8 +169,13 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
   - the shared inbox is advertised in `endpoints.sharedInbox`.
 7. **Remote HTML is sanitized before it is stored** (`ContentSanitizer`); `Post.ContentHtml` is what is shown,
   `ContentFormat` says what `Text` holds. Remote names are plain text.
-8. **Circles never federate.** A circle's actor, collections, WebFinger and inbox answer 404, and its posts are
-   `IsLocalOnly`. Only communities are Group actors.
+8. **Circles federate to members only.** A circle is an undiscoverable Group actor that takes follow requests (the owner
+   approves); its posts are addressed to the circle and its `/flock`, delivered to members' personal inboxes, never
+   announced, and served only to a signed request from a member or a member's instance actor
+   (`SignedFetchAuthorizer`), 404 otherwise. Circles never appear in search, lookups, mentions or profile pages.
+   **Communities** are FEP-1b12 groups: `GroupDistributor` announces the whole activity (plus the object for new posts,
+   for Mastodon), top-level posts are `Page`s with a `name`, posting follows `Group.PostingPolicy`.
+   Located posts (`LocalGeo`) are the only local-only posts.
 9. **A DM joins a conversation only by `DmGroup.ParticipantsKey`**, the exact set of its participants; a remote
   `context` decides nothing. DMs are `Post`s with `Visibility = Direct` and a `ConversationId` (`DmPost` is legacy).
 10. **Nothing slow happens inside a request.** Deliveries and inbox processing are `Job`s (`Infrastructure/Jobs`):
@@ -209,8 +217,17 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
  equal to the login.
 - **One username space:** personas, groups and the instance reserve their name in `ReservedName` (unique index) before
  they are saved; `LocalActorService.TryReserveUserName` is the only way to claim one.
+- **Usernames are `Constants.UserNameRegex`** (`^[a-z0-9_]+$`): the intersection of what Mastodon and Misskey accept. A
+  name outside it creates a persona nobody on those servers can reach.
+- **An actor's `published` is `PublishedOn`**, a random whole day up to two weeks before creation, so personas made the
+  same day do not share a date. New persona and group ids carry that same day (`GenerateNewID`), because local clients
+  see ids. Never emit `CreatedAt`.
 - **Per-avatar state stays per avatar:** blocks, mutes, notifications, follows. Nothing may relate sibling avatars.
- **Blocks never federate,** and reports leave as `Flag` from the instance actor.
+- **Blocks federate** (owner decision, 2026-10-01): a block is sent as `Block` from the blocking avatar, an unblock as
+  `Undo{Block}`. Reports still leave as `Flag` from the instance actor, never from the reporting avatar.
+- **What PrivaPub reveals is the owner's call.** Previews, blocks, website authorship, views, bridging and reactions were
+  decided in `docs/ROADMAP.md` ("Owner decisions on what PrivaPub reveals"). Anything new that tells another server
+  something about an avatar gets the same treatment: ask, then record it there.
 - **Location-ranged posts never federate.**

 ## Data
@@ -221,6 +238,15 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
 - **Collection name = class name, so never rename an entity class.**
 - `Entity.ID` is a 24-character lowercase hex string; `GenerateNewID()` returns `object`, so cast it.
 - New fields must be additive: a deploy rollback restores the binary, not the database.
+- **Post ids are the timeline order, so they follow arrival, not `published`.** `PrivacyIds.Arrived` gives a remote post
+  published within the last hour (or in the future) a fresh `ObjectId`, which sorts after every post already stored,
+  and only backfill keeps a `published`-derived id. With `published` ids a reply arriving in the same second could sort
+  under the post it answers, and a late arrival landed behind a client's `since_id` and was never seen. `created_at`
+  comes from `CreationDate`, never from the id.
+- **The same ordering problem exists on the other side, so `published` carries milliseconds**
+  (`ActivityPubRenderer.Timestamp`). GoToSocial (ULIDs) and Mastodon (Snowflakes) derive a remote status's id from
+  `published` at millisecond resolution. With whole seconds, two of our posts from the same second sorted at random
+  there.
 - **Startup order:** `EntityMaps.Warm()` (every entity's class map, one at a time; two mapped at once throw "An item
  with the same key has already been added" and stay broken), then `MigrateAsync` (`Infrastructure/Data/Migrations`,
  `_NNN_` order, each runs once), then `Indexes.Create()`. A new entity needs nothing; a new unique index needs a
@@ -238,6 +264,9 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
 - Localised strings go through `IStringLocalizer<GenericRes>`.
 - Every `Display`/`ErrorMessage` resource key must exist in `FieldsNameResource`/`ErrorsResource`, including the
  `Designer.cs`, which the CLI build doesn't regenerate. A missing key throws at validation time.
+- **`cond ? value : default` with a value-type branch is the type's default, not null:** `false`, `0`, or year one
+  stored as an edit date on every remote post. Write `(T?)null`. It has shipped four times (`MastodonParams.Bool/Int`,
+  `NoteParser.Int`, `NoteParser.Time`).
 - ActivityPub output is built with `System.Text.Json.Nodes` in `ActivityPubRenderer`, not typed models. Inbound
  documents are read through `InboxService.Id`/`Value`, which handle string, object and array.
 - Libraries chosen for the roadmap: HtmlSanitizer, Markdig (`DisableHtml`), NSign (RFC 9421 inbound), OpenIddict +
@@ -256,8 +285,39 @@ Beyond the tests, verify by building, running locally, and exercising:
 - the client API (sign up, create an avatar, a group, a post);
 - the ActivityPub endpoints with curl and `Accept: application/activity+json`.

-Interop is checked against real servers: Fediverse Pasture with podman on the workstation, verify.funfedi.dev, and
-the owner's GoToSocial at social.arasaka.software. **Ask before acting from the owner's GoToSocial account.**
+Interop is checked against real servers, starting with the workstation's own pasture:
+
+```bash
+DOTNET=~/.dotnet/dotnet tools/pasture/run.sh up   # podman: PrivaPub + the latest GoToSocial + Mongo, behind Caddy
+tools/pasture/interop.sh                          # 25 checks, each side driven through its own Mastodon API
+tools/pasture/run.sh down
+```
+
+- **Two sites on one podman network, one Caddy in front.** `privapub.test` and `gts.test` are network aliases of the
+  Caddy container, which serves both with its internal CA (`tls internal`). Both servers are told to accept any
+  certificate: PrivaPub through `appsettings.Pasture.json`, GoToSocial through `GTS_HTTP_CLIENT_TLS_INSECURE_SKIP_VERIFY`.
+  GoToSocial WebFingers and fetches over https only, so plain http between them is not an option.
+- From the workstation, PrivaPub's API is `http://127.0.0.1:6971`. GoToSocial is reached as `https://gts.test:6443`
+  with `curl -k --resolve gts.test:6443:127.0.0.1`, because its sign-in cookie is bound to the host name.
+- **GoToSocial's cached home timeline can stop taking new posts after its first read**, its owner's own included, while
+  a `min_id` query shows them all. So a delivery is checked by looking the object up by URI with `resolve=false`
+  (`on_gts`), which answers from GoToSocial's database and never fetches from us. A home-timeline check there proves
+  nothing, in either direction. A deleted status still turns up in that search as a "deleted status" stub, so a delete
+  is checked as a 404 on `/api/v1/statuses/{id}`.
+- **GoToSocial creates its accounts locked**, so `interop.sh` approves alice's request through
+  `/api/v1/follow_requests`. That also checks our pending (`requested`) state and the manual Accept.
+- The scenario covers:
+  - discovery and follows both ways;
+  - posts and CW;
+  - a reply and its notification;
+  - likes and boosts both ways;
+  - DMs both ways, and the DM staying off public timelines;
+  - edit, delete both ways, and unfollow.
+- `run.sh up` replaces every container, Mongo included, so each run starts clean. To keep the data, republish into
+  `tools/pasture/.publish` and `podman restart pasture-privapub`; that is how a migration is tried on dirty data.
+
+After the pasture, verify.funfedi.dev and the owner's GoToSocial at social.arasaka.software. **Ask before acting from
+the owner's GoToSocial account.**

 ## Deploy

@@ -10,14 +10,31 @@ PrivaPub is an ActivityPub server written in C#. This document follows
 - [HTTP Signatures](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures), `rsa-sha256` / `hs2019` with RSA keys
 - [NodeInfo](https://nodeinfo.diaspora.software/) 2.0 and 2.1

+## Tested against
+
+- **GoToSocial 0.22.1, end to end.** It runs in a private network on the workstation (`tools/pasture/`) and is driven
+  through its own client API. Checked both ways:
+  - follows, including to a locked account;
+  - public posts with a content warning;
+  - replies with notifications;
+  - likes and boosts;
+  - direct messages;
+  - edits and deletes;
+  - unfollow.
+- **Mastodon, Misskey, Lemmy and PeerTube, by unit tests only.** The tests feed the parser documents written in each
+  server's shape. No live exchange with any of them has run yet.
+
 ## Supported FEPs

 - [FEP-67ff: FEDERATION.md](https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md)
 - [FEP-f1d5: NodeInfo in Fediverse Software](https://codeberg.org/fediverse/fep/src/branch/main/fep/f1d5/fep-f1d5.md)
 - [FEP-2c59: Discovery of a WebFinger address from an ActivityPub actor](https://codeberg.org/fediverse/fep/src/branch/main/fep/2c59/fep-2c59.md)
+- [FEP-1b12: Group federation](https://codeberg.org/fediverse/fep/src/branch/main/fep/1b12/fep-1b12.md) (communities; see "Groups")

-Planned: FEP-1b12 (communities), FEP-8fcf (followers synchronisation), FEP-5feb (`indexable`), FEP-7628 (Move),
-FEP-044f (quotes).
+Planned (see `docs/ROADMAP.md`, phases P5 to P8, and the per-platform notes in `docs/INTEROP.md`): FEP-044f (quotes),
+FEP-9967 (polls), FEP-c0e0 (emoji reactions), FEP-9098 (custom emoji), FEP-7888 and FEP-f228 (threads), FEP-7628 (Move),
+FEP-8fcf (followers synchronisation), FEP-5feb (`indexable`), FEP-8967 (link attachments), FEP-521a and FEP-8b32 (keys
+and integrity proofs), FEP-ae0c (relays).

 ## Actors

@@ -39,7 +56,8 @@ actor document, a collection, NodeInfo or a delivery relates two avatars of the
 The names are the project's own and are stable; resolve actors through WebFinger, not by guessing a path.

 - The key is `{actor}#main-key`, RSA 2048, served as SPKI PEM with `owner` set to the actor.
- `published` on an actor is truncated to the day. `indexable` is `false`.
+- `published` on an actor is a whole day, chosen at random up to two weeks before the account was made, so two
+  personas made on the same day do not share a date. `indexable` is `false`.
 - The instance actor is `/peasants/privapub` (type `Application`). It signs every fetch PrivaPub makes, so no avatar's key
  is used to read another server's content.

@@ -47,10 +65,18 @@ The names are the project's own and are stable; resolve actors through WebFinger

 A group is either a **community** or a **circle**.

- A community is a `Group` actor. It accepts `Follow` and re-shares (`Announce`) posts from its followers that address
-  it. Full FEP-1b12 behaviour (announcing activities, `audience`, moderation) is planned.
- A circle is private and does not federate yet: its actor, collections and WebFinger answer 404, and its posts are never
-  delivered.
+- A **community** follows [FEP-1b12](https://codeberg.org/fediverse/fep/src/branch/main/fep/1b12/fep-1b12.md). Posts
+  addressed to it (in `to`, `cc` or `audience`) are accepted according to its posting policy (followers, anyone, or
+  moderators only) and the group `Announce`s the whole activity, with `audience` set, to its followers. A new post is
+  also announced as an object so Mastodon shows it. Updates and deletes of community content are announced too. A
+  top-level post is a `Page` with a `name`. Members are counted at `/flock`; moderators are listed at `/wardens`, which
+  the actor's `attributedTo` points to, with `postingRestrictedToMods` as Lemmy expects. A mention of a community posts into it.
+- A **circle** is private. Its actor is not discoverable and every follow is a request. Its posts are addressed to the
+  circle and its members collection, delivered to each member's own inbox and never announced. They are served only
+  to a signed request from a member, or from the instance actor of a member's server; anyone else gets 404. A
+  Mastodon member's replies reach only the people they mention.
+- Announces from **remote** groups (Lemmy communities) are followed through to the activity: the object is fetched
+  from its own origin, never taken from the announce.

 ## Activities

@@ -75,16 +101,24 @@ Sent: `Follow`, `Undo{Follow}`, `Create{Note}`, `Update{Note}`, `Update{Person}`
 - **Attachments** are `Document`s with `mediaType`, `name` (alt text), `blurhash`, `focalPoint`, `width` and `height`.
  Uploaded files have all metadata removed.
 - **Pinned posts** are the actor's `featured` collection (`/trophies`); `featuredTags` is `/tattoos`.
- **Blocks are never sent.** A blocked account is sent `Reject{Follow}` if it followed, and is unfollowed.
+- **Blocks are sent.** A blocked remote account receives `Block` from the blocking account (and `Reject{Follow}` if it
+  followed); an unblock sends `Undo{Block}`.
 - **Reports** are sent as `Flag` by the instance actor, never by the reporting account.

 A `Create`'s `Note` carries Mastodon's `content`, `contentMap`, `summary` and `sensitive`, plus `Mention` and `Hashtag`
 tags. A post's title becomes `name` and is also the first, bold line of `content`, because Mastodon does not show
 `name`. A content warning without its own text uses the title, or "Content warning".

+Received `summary` is a content warning only on a `Note` or `Question`, or when `sensitive` is `true`. On an `Article`,
+`Page`, `Event`, `Video` or `Audio` it is an excerpt or description, kept as such and never hidden.
+
 Visibility is expressed in `to`/`cc` the way Mastodon does it: public, unlisted, followers-only and direct. Inbound
 followers-only posts are recognised by the author's own `followers` collection.

+## Local-only posts
+
+Posts with a location (shown to nearby users of this server) never leave the server, in any form.
+
 ## Security rules a peer will notice

 - **Signatures.** Inbox POSTs must be signed over `(request-target)`, `host`, `digest` and `date` (or `(created)`). The
@@ -9,5 +9,6 @@
 		public const int GroupInvitationLength = 64;

 		public const string PasswordRegex = @"^(?=.*)(?=.*[a-z])(?=.*[A-Z])(?!.*\s).*$";
+		public const string UserNameRegex = "^[a-z0-9_]+$";
 	}
 }
@@ -12,7 +12,7 @@ namespace PrivaPub.ClientModels.Group

 		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
 			StringLength(32, MinimumLength = 3, ErrorMessageResourceName = "StringLengthMinMax", ErrorMessageResourceType = typeof(ErrorsResource)),
-			RegularExpression("^[a-z0-9_]+$", ErrorMessageResourceName = "EmptySpacesNotAllowed", ErrorMessageResourceType = typeof(ErrorsResource)),
+			RegularExpression(Constants.UserNameRegex, ErrorMessageResourceName = "InvalidUserName", ErrorMessageResourceType = typeof(ErrorsResource)),
 			NoWhiteSpaces]
 		public string UserName { get; set; }

@@ -25,6 +25,7 @@ namespace PrivaPub.ClientModels.Group

 		public string InvitationPassword { get; set; }
 		public bool IsCommunity { get; set; }
+		public string PostingPolicy { get; set; }//followers (default), anyone, moderators
 		public bool IsDiscoverable { get; set; } = true;
 		public bool ManuallyApprovesMembers { get; set; }
 	}
@@ -20,6 +20,7 @@ namespace PrivaPub.ClientModels.Group
 		public bool RemoveInvitationPassword { get; set; }
 		public bool RegenerateInvitationCode { get; set; }
 		public bool? IsDiscoverable { get; set; }
+		public string PostingPolicy { get; set; }
 		public bool? ManuallyApprovesMembers { get; set; }
 	}
 }
@@ -9,6 +9,7 @@ namespace PrivaPub.ClientModels.Group
 		public string Url { get; set; }
 		public string Handle { get; set; }
 		public bool IsCommunity { get; set; }
+		public string PostingPolicy { get; set; }
 		public bool IsDiscoverable { get; set; }
 		public bool ManuallyApprovesMembers { get; set; }
 		public bool IsOwner { get; set; }
@@ -12,7 +12,7 @@ namespace PrivaPub.ClientModels
 		public string InvitationCode { get; set; }

 		[StringLength(32, MinimumLength = 3, ErrorMessageResourceName = "StringLengthMinMax", ErrorMessageResourceType = typeof(ErrorsResource)),
-			RegularExpression("^[a-z0-9_]+$", ErrorMessageResourceName = "EmptySpacesNotAllowed", ErrorMessageResourceType = typeof(ErrorsResource))]
+			RegularExpression(Constants.UserNameRegex, ErrorMessageResourceName = "InvalidUserName", ErrorMessageResourceType = typeof(ErrorsResource))]
 		public string AvatarUserName { get; set; }

 		[StringLength(64, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]
@@ -24,6 +24,15 @@ namespace PrivaPub.ClientModels.Post
 		public string SpoilerText { get; set; }

 		public string Visibility { get; set; }//public (default), unlisted, followersonly
+
+		[Range(-90, 90, ErrorMessageResourceName = "Range", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public double? Latitude { get; set; }
+
+		[Range(-180, 180, ErrorMessageResourceName = "Range", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public double? Longitude { get; set; }
+
+		[Range(1, 50, ErrorMessageResourceName = "Range", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public double? RangeKm { get; set; }
 	}

 	public class UpdatePostForm
@@ -17,6 +17,8 @@ namespace PrivaPub.ClientModels.Post
 		public bool IsFederatedCopy { get; set; }
 		public DateTime CreationDate { get; set; }
 		public ViewPost ReblogOf { get; set; }
+		public double? RangeKm { get; set; }
+		public double? DistanceKm { get; set; }
 	}

 	public class ViewDmGroup
@@ -105,6 +105,15 @@ namespace PrivaPub.ClientModels.Resources {
            }
        }
        
+        /// <summary>
+        ///   Looks up a localized string similar to Use only lower-case letters, digits and underscores..
+        /// </summary>
+        public static string InvalidUserName {
+            get {
+                return ResourceManager.GetString("InvalidUserName", resourceCulture);
+            }
+        }
+        
        /// <summary>
        ///   Looks up a localized string similar to Invalid password, upper-case, lower-case and number characters required..
        /// </summary>
@@ -132,6 +132,9 @@
  <data name="InvalidEmail" xml:space="preserve">
    <value>{0} è invalida.</value>
  </data>
+  <data name="InvalidUserName" xml:space="preserve">
+    <value>Usa solo lettere minuscole, cifre e trattini bassi.</value>
+  </data>
  <data name="InvalidPassword" xml:space="preserve">
    <value>Password non valida, deve avere almeno un carattere grande, un carattere piccolo ed un numero.</value>
  </data>
@@ -132,6 +132,9 @@
  <data name="InvalidEmail" xml:space="preserve">
    <value>{0} is invalid.</value>
  </data>
+  <data name="InvalidUserName" xml:space="preserve">
+    <value>Use only lower-case letters, digits and underscores.</value>
+  </data>
  <data name="InvalidPassword" xml:space="preserve">
    <value>Invalid password, upper-case, lower-case and number characters required.</value>
  </data>
@@ -20,6 +20,7 @@ namespace PrivaPub.ClientModels.User.Avatar

 		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
 			StringLength(Constants.MaxAvatarNameLength, ErrorMessageResourceName = "StringLength", ErrorMessageResourceType = typeof(ErrorsResource)),
+			RegularExpression(Constants.UserNameRegex, ErrorMessageResourceName = "InvalidUserName", ErrorMessageResourceType = typeof(ErrorsResource)),
 				Display(Name = nameof(UserName), ResourceType = typeof(FieldsNameResource))]
 		public string UserName { get; set; }//preferredUsername

@@ -0,0 +1,29 @@
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Models.Post;
+
+namespace PrivaPub.Tests.Api
+{
+	public class StatusContentTests
+	{
+		[Fact]
+		public void A_remote_article_shows_its_title_above_its_body() =>
+			Assert.Equal("<p><strong>Rain &amp; sun</strong></p><p>body</p>", MastodonMapper.Content(new Post
+			{
+				IsFederatedCopy = true, ObjectType = "Article", Title = "Rain & sun", ContentHtml = "<p>body</p>"
+			}));
+
+		[Fact]
+		public void A_remote_note_keeps_its_content_alone() =>
+			Assert.Equal("<p>body</p>", MastodonMapper.Content(new Post
+			{
+				IsFederatedCopy = true, ObjectType = "Note", Title = "a poll choice", ContentHtml = "<p>body</p>"
+			}));
+
+		[Fact]
+		public void A_remote_event_without_a_body_shows_its_excerpt() =>
+			Assert.Equal("<p><strong>Meetup</strong></p><p>Saturday &lt;10:00&gt;</p>", MastodonMapper.Content(new Post
+			{
+				IsFederatedCopy = true, ObjectType = "Event", Title = "Meetup", Excerpt = "Saturday <10:00>", ContentHtml = string.Empty
+			}));
+	}
+}
@@ -0,0 +1,77 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json;
+
+namespace PrivaPub.Tests.Domain
+{
+	[Trait("Category", "Integration")]
+	public sealed class NearbyTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task A_located_post_reaches_only_those_within_its_radius_and_never_leaves_the_server()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var latitude = 10 + Random.Shared.NextDouble() * 50;
+			var longitude = 10 + Random.Shared.NextDouble() * 50;
+			var (aliceRoot, alice) = await _harness.Persona("alice");
+			var (bobRoot, bob) = await _harness.Persona("bob");
+			var (carolRoot, carol) = await _harness.Persona("carol");
+			var follower = new RemoteActor(_harness.Peer, "follower");
+			await _harness.FollowedBy(alice, follower);
+
+			var created = await _harness.Posts.InsertPost(aliceRoot, new InsertPostForm
+			{
+				AvatarId = alice.Id, Text = "free bread at the bakery", Latitude = latitude, Longitude = longitude, RangeKm = 5
+			}, token);
+			var post = await DB.Default.Find<Post>().OneAsync(((ViewPost)created.Data).Id, token);
+
+			var three = (List<ViewPost>)(await _harness.Posts.Nearby(bobRoot, bob.Id, latitude + 0.027, longitude, token)).Data;
+			var eight = (List<ViewPost>)(await _harness.Posts.Nearby(carolRoot, carol.Id, latitude + 0.072, longitude, token)).Data;
+
+			Assert.Equal(PostVisibility.LocalGeo, post.Visibility);
+			Assert.Equal(Math.Round(latitude, 2), post.Geo.Coordinates[1]);
+			Assert.Contains(three, p => p.Id == post.ID);
+			Assert.InRange(three.First(p => p.Id == post.ID).DistanceKm.Value, 2.0, 4.0);
+			Assert.DoesNotContain(eight, p => p.Id == post.ID);
+			Assert.False(await VisibilityPolicy.CanSee(post, bob.Id, token));
+			var outgoing = (await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.Deliver).ExecuteAsync(token))
+				.Select(j => JsonSerializer.Deserialize<DeliveryPayload>(j.Payload))
+				.Where(p => p.Body.Contains(post.ID));
+			Assert.Empty(outgoing);
+		}
+
+		[Fact]
+		public async Task A_located_post_cannot_be_direct_or_in_a_group()
+		{
+			var (root, alice) = await _harness.Persona("alice");
+
+			var result = await _harness.Statuses.Publish(alice, new PrivaPub.Domain.Statuses.StatusDraft
+			{
+				Text = "x", Latitude = 45, Longitude = 7, Visibility = PostVisibility.Direct
+			}, TestContext.Current.CancellationToken);
+
+			Assert.False(result.Ok);
+		}
+	}
+}
@@ -62,7 +62,31 @@ namespace PrivaPub.Tests.Domain
 			});

 			Assert.False(await DB.Default.Find<Follower>().Match(f => f.LocalActorId == alice.Id).ExecuteAnyAsync(token));
-			Assert.Equal("Reject", Assert.Single(await _harness.Outgoing(mallory.Id + "/inbox"))["type"]!.GetValue<string>());
+			var sent = (await _harness.Outgoing(mallory.Id + "/inbox")).Select(a => a["type"]!.GetValue<string>()).ToList();
+			Assert.Equal(new[] { "Block", "Reject" }, sent.Order());
+		}
+
+		[Fact]
+		public async Task A_block_is_told_to_the_blocked_server_and_so_is_the_unblock()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(mallory)}/follows/{Guid.NewGuid():N}", ["type"] = "Follow", ["actor"] = mallory.Id, ["object"] = alice.Uri
+			});
+
+			await _harness.Relationships.Block(alice, mallory.Id, default, token);
+			await _harness.Relationships.Unblock(alice, mallory.Id, token);
+
+			var sent = await _harness.Outgoing(mallory.Id + "/inbox");
+			var block = Assert.Single(sent, a => a["type"]!.GetValue<string>() == "Block");
+			Assert.Equal(mallory.Id, block["object"]!.GetValue<string>());
+			Assert.Equal(alice.Uri, block["actor"]!.GetValue<string>());
+			var undo = Assert.Single(sent, a => a["type"]!.GetValue<string>() == "Undo");
+			Assert.Equal(block["id"]!.GetValue<string>(), undo["object"]!["id"]!.GetValue<string>());
+			Assert.False(await DB.Default.Find<Block>().Match(b => b.AvatarId == alice.Id).ExecuteAnyAsync(token));
 		}

 		[Fact]
@@ -0,0 +1,198 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Federation.Signing;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class GroupTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		async Task<(GroupEntity Entity, PrivaPub.Federation.Actors.LocalActor Actor)> Group(GroupKind kind, PostingPolicy policy, string ownerId, params string[] remoteMembers)
+		{
+			var (privateKey, publicKey) = PrivaPub.Federation.Actors.Keys.NewKeyPair();
+			var group = new GroupEntity
+			{
+				UserName = $"{kind}{Guid.NewGuid():N}"[..20].ToLowerInvariant(),
+				Kind = kind,
+				PostingPolicy = policy,
+				PrivateKey = privateKey,
+				PublicKey = publicKey,
+				Members = new() { new GroupMember { AvatarId = ownerId, Role = GroupRole.Owner } }
+			};
+			group.Members.AddRange(remoteMembers.Select(m => new GroupMember { AvatarId = m, IsForeign = true }));
+			await DB.Default.SaveAsync(group);
+			return (group, _harness.Local.FromGroup(group));
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		static JsonObject Create(RemoteActor author, IEnumerable<string> to, string audience = default)
+		{
+			var note = new JsonObject
+			{
+				["id"] = $"{Origin(author)}/notes/{Guid.NewGuid():N}",
+				["type"] = "Note",
+				["attributedTo"] = author.Id,
+				["content"] = "<p>to the group</p>",
+				["to"] = new JsonArray(to.Select(t => (JsonNode)t).ToArray())
+			};
+			if (audience != default)
+				note["audience"] = audience;
+			return new JsonObject { ["id"] = $"{Origin(author)}/activities/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = author.Id, ["object"] = note };
+		}
+
+		[Fact]
+		public async Task A_follower_posting_to_a_community_is_announced_activity_and_object()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, owner) = await _harness.Persona("owner");
+			var (_, community) = await Group(GroupKind.Community, PostingPolicy.Followers, owner.Id);
+			var lemmy = new RemoteActor(_harness.Peer, "lemmy");
+			var stranger = new RemoteActor(_harness.Peer, "stranger");
+			await _harness.FollowedBy(community, lemmy);
+
+			await _harness.Deliver(lemmy, "/human-centipede", Create(lemmy, new[] { community.Uri, Addressing.Public }, community.Uri));
+			await _harness.Deliver(stranger, "/human-centipede", Create(stranger, new[] { community.Uri, Addressing.Public }, community.Uri));
+
+			Assert.True(await DB.Default.Find<Post>().Match(p => p.GroupId == community.Id && p.ActorURI == lemmy.Id).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.GroupId == community.Id && p.ActorURI == stranger.Id).ExecuteAnyAsync(token));
+			var announces = (await _harness.Outgoing(lemmy.SharedInbox)).Where(a => a["actor"]!.GetValue<string>() == community.Uri).ToList();
+			Assert.Equal(2, announces.Count);
+			Assert.Contains(announces, a => a["object"] is JsonObject inner && inner["type"]!.GetValue<string>() == "Create" && a["audience"]!.GetValue<string>() == community.Uri);
+			Assert.Contains(announces, a => a["object"] is JsonValue);
+		}
+
+		[Fact]
+		public async Task An_open_community_takes_posts_from_anyone()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, owner) = await _harness.Persona("owner");
+			var (_, community) = await Group(GroupKind.Community, PostingPolicy.Anyone, owner.Id);
+			var stranger = new RemoteActor(_harness.Peer, "stranger");
+
+			await _harness.Deliver(stranger, "/human-centipede", Create(stranger, new[] { community.Uri, Addressing.Public }));
+
+			Assert.True(await DB.Default.Find<Post>().Match(p => p.GroupId == community.Id && p.ActorURI == stranger.Id).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task Mentioning_a_community_posts_into_it_as_a_titled_page()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var (_, community) = await Group(GroupKind.Community, PostingPolicy.Anyone, alice.Id);
+			var follower = new RemoteActor(_harness.Peer, "follower");
+			await _harness.FollowedBy(community, follower);
+
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = $"@{community.UserName} a new thread", PlainText = true }, token);
+
+			Assert.Equal(community.Id, outcome.Post.GroupId);
+			var note = ActivityPubRenderer.Note(outcome.Post, alice, community, default);
+			Assert.Equal("Page", note["type"]!.GetValue<string>());
+			Assert.Equal(community.Uri, note["audience"]!.GetValue<string>());
+			Assert.False(string.IsNullOrEmpty(note["name"]!.GetValue<string>()));
+			Assert.Contains(await _harness.Outgoing(follower.SharedInbox), a => a["type"]!.GetValue<string>() == "Announce");
+		}
+
+		[Fact]
+		public async Task A_circle_post_goes_only_to_members_and_only_members_may_read_it()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var member = new RemoteActor(_harness.Peer, "member");
+			var outsider = new RemoteActor(_harness.Peer, "outsider");
+			var (circleEntity, circle) = await Group(GroupKind.Circle, PostingPolicy.Followers, alice.Id, member.Id);
+			await _harness.Remote.GetActor(member.Id, refresh: false, token);
+			var follower = new RemoteActor(_harness.Peer, "follower");
+			await _harness.FollowedBy(alice, follower);
+
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "just us", GroupId = circle.Id }, token);
+
+			Assert.Equal(PostVisibility.Circle, outcome.Post.Visibility);
+			var create = Assert.Single(await _harness.Outgoing(member.Id + "/inbox"));
+			Assert.Equal(new[] { circle.Uri, circle.Flock }, create["object"]!["to"]!.AsArray().Select(t => t!.GetValue<string>()));
+			Assert.DoesNotContain(Addressing.Public, create.ToJsonString());
+			Assert.Empty(await _harness.Outgoing(follower.SharedInbox));
+			Assert.Empty((await _harness.Outgoing(member.SharedInbox)).Where(a => a["type"]!.GetValue<string>() == "Announce"));
+
+			var authorizer = new SignedFetchAuthorizer(_harness.Remote);
+			var path = new Uri(outcome.Post.ObjectURI).AbsolutePath;
+			var asMember = await authorizer.Requester(member.Get(Harness.Host, path), token);
+			var asOutsider = await authorizer.Requester(outsider.Get(Harness.Host, path), token);
+			Assert.True(SignedFetchAuthorizer.MayReadCircle(circleEntity, asMember));
+			Assert.False(SignedFetchAuthorizer.MayReadCircle(circleEntity, asOutsider));
+			Assert.False(SignedFetchAuthorizer.MayReadCircle(circleEntity, default));
+			Assert.True(circle.IsCircle);
+			Assert.False(circle.Discoverable);
+		}
+
+		[Fact]
+		public async Task Only_circle_members_can_post_into_a_circle()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (aliceRoot, alice) = await _harness.Persona("alice");
+			var member = new RemoteActor(_harness.Peer, "member");
+			var outsider = new RemoteActor(_harness.Peer, "outsider");
+			var (_, circle) = await Group(GroupKind.Circle, PostingPolicy.Followers, alice.Id, member.Id);
+
+			await _harness.Deliver(member, "/human-centipede", Create(member, new[] { circle.Uri, circle.Flock }));
+			await _harness.Deliver(outsider, "/human-centipede", Create(outsider, new[] { circle.Uri, circle.Flock }));
+
+			var stored = await DB.Default.Find<Post>().Match(p => p.GroupId == circle.Id).ExecuteAsync(token);
+			Assert.Equal(member.Id, Assert.Single(stored).ActorURI);
+			Assert.Equal(PostVisibility.Circle, stored[0].Visibility);
+			Assert.True(await DB.Default.Find<TimelineEntry>().Match(e => e.AvatarId == alice.Id && e.PostId == stored[0].ID).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_followed_remote_community_announcing_a_post_puts_it_in_home()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var lemmyCommunity = new RemoteActor(_harness.Peer, "cats", type: "Group");
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = lemmyCommunity.Id }, token);
+			await DB.Default.Update<Following>().Match(f => f.AvatarId == alice.Id).Modify(f => f.State, FollowState.Accepted).ExecuteAsync(token);
+			var create = Create(poster, new[] { lemmyCommunity.Id, Addressing.Public }, lemmyCommunity.Id);
+			var noteId = create["object"]!["id"]!.GetValue<string>();
+			_harness.Peer.Serve(new Uri(noteId).AbsolutePath, create["object"]!.ToJsonString());
+
+			await _harness.Deliver(lemmyCommunity, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(lemmyCommunity)}/activities/announce/{Guid.NewGuid():N}", ["type"] = "Announce", ["actor"] = lemmyCommunity.Id,
+				["to"] = new JsonArray(Addressing.Public), ["object"] = create
+			});
+
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteSingleAsync(token);
+			Assert.Equal(lemmyCommunity.Id, post.AudienceURI);
+			Assert.True(await DB.Default.Find<TimelineEntry>().Match(e => e.AvatarId == alice.Id && e.PostId == post.ID).ExecuteAnyAsync(token));
+		}
+	}
+}
@@ -54,9 +54,9 @@ namespace PrivaPub.Tests.Federation
 			{
 				new FollowHandler(db, _local, remote, delivery),
 				new UndoHandler(db, _local),
-				new CreateHandler(db, _local, remote, delivery, _blocks, new Fanout(db), new RemotePosts(db, _local, remote, _blocks, queue)),
-				new DeleteHandler(db, _local, remote, delivery),
-				new UpdateHandler(db, _local, remote)
+				new CreateHandler(db, _local, remote, delivery, _blocks, new Fanout(db), new RemotePosts(db, _local, remote, _blocks, queue), new GroupDistributor(delivery)),
+				new DeleteHandler(db, _local, remote, delivery, new GroupDistributor(delivery)),
+				new UpdateHandler(db, _local, remote, new GroupDistributor(delivery))
 			}, NullLogger<InboxProcessor>.Instance);
 		}

@@ -323,7 +323,7 @@ namespace PrivaPub.Tests.Federation
 		}

 		[Fact]
-		public async Task A_circle_is_not_a_federated_actor()
+		public async Task A_circle_only_takes_follow_requests()
 		{
 			var token = TestContext.Current.CancellationToken;
 			var (privateKey, publicKey) = Keys.NewKeyPair();
@@ -339,8 +339,13 @@ namespace PrivaPub.Tests.Federation
 				["object"] = actor.Uri
 			};

-			Assert.False(actor.IsFederated);
-			Assert.Equal(404, (await Deliver(bob, "/human-centipede", follow)).StatusCode);
+			Assert.True(actor.IsCircle);
+			Assert.True(actor.ManuallyApprovesFollowers);
+			Assert.False(actor.Discoverable);
+			Assert.Equal(202, (await Deliver(bob, "/human-centipede", follow)).StatusCode);
+			var request = await DB.Default.Find<Follower>().Match(f => f.LocalActorId == circle.ID).ExecuteSingleAsync(token);
+			Assert.False(request.IsAccepted);
+			Assert.DoesNotContain(circle.Members, m => m.AvatarId == bob.Id);
 		}
 	}
 }
@@ -54,6 +54,7 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("a cat", media.Description);
 			Assert.Equal(new[] { 0.5f, -1f }, media.Focus);
 			Assert.Equal(new DateTime(2026, 9, 30, 10, 0, 0, DateTimeKind.Utc), note.Published);
+			Assert.Null(note.Updated);
 		}

 		[Fact]
@@ -89,6 +90,28 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("https://k.example/notes/8", note.QuoteUri);
 		}

+		[Theory]
+		[InlineData("Article", false, false)]
+		[InlineData("Event", false, false)]
+		[InlineData("Video", false, false)]
+		[InlineData("Page", false, false)]
+		[InlineData("Note", false, true)]
+		[InlineData("Question", false, true)]
+		[InlineData("Article", true, true)]
+		public void A_summary_warns_only_on_notes_or_when_marked_sensitive(string type, bool sensitive, bool warns)
+		{
+			var note = NoteParser.Parse(JsonNode.Parse($$"""
+				{
+					"id": "https://w.example/?p=12", "type": "{{type}}", "name": "Twelve", "summary": "Saturday, 10:00 at the library",
+					"sensitive": {{(sensitive ? "true" : "false")}}, "attributedTo": "https://w.example/author", "content": "<p>body</p>"
+				}
+				"""));
+
+			Assert.Equal(warns, note.Sensitive);
+			Assert.Equal(warns ? "Saturday, 10:00 at the library" : null, note.SpoilerText);
+			Assert.Equal(warns ? null : "Saturday, 10:00 at the library", note.Excerpt);
+		}
+
 		[Theory]
 		[InlineData("""{ "id": "https://x.example/1", "type": "Person" }""")]
 		[InlineData("""{ "id": "not a uri", "type": "Note" }""")]
@@ -57,7 +57,7 @@ namespace PrivaPub.Tests.Federation
 				Language = "en",
 				Mentions = new() { new PostMention { ActorURI = "https://m.example/users/bob", Handle = "@bob@m.example" } },
 				Tags = new() { "cats" },
-				CreationDate = new DateTime(2026, 9, 30, 17, 45, 12, DateTimeKind.Utc)
+				CreationDate = new DateTime(2026, 9, 30, 17, 45, 12, 345, DateTimeKind.Utc)
 			};

 			var note = ActivityPubRenderer.Note(post, Alice, default, "https://m.example/users/bob/statuses/1");
@@ -67,7 +67,7 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("<p><strong>On &lt;cats&gt;</strong></p><p>body</p>", note["content"]!.GetValue<string>());
 			Assert.Equal("On <cats>", note["summary"]!.GetValue<string>());
 			Assert.True(note["sensitive"]!.GetValue<bool>());
-			Assert.Equal("2026-09-30T17:45:12Z", note["published"]!.GetValue<string>());
+			Assert.Equal("2026-09-30T17:45:12.345Z", note["published"]!.GetValue<string>());
 			Assert.Equal(new[] { ActivityPubRenderer.Public }, note["to"]!.AsArray().Select(n => n!.GetValue<string>()));
 			Assert.Equal(new[] { Alice.Followers, "https://m.example/users/bob" }, note["cc"]!.AsArray().Select(n => n!.GetValue<string>()));
 			var tags = note["tag"]!.AsArray();
@@ -12,15 +12,18 @@ namespace PrivaPub.Tests.Infrastructure
 		[Fact]
 		public void Persona_ids_carry_only_the_day_and_share_nothing_else()
 		{
-			var first = (string)new Avatar().GenerateNewID();
-			var second = (string)new Avatar().GenerateNewID();
+			var avatar = new Avatar();
+			var first = (string)avatar.GenerateNewID();
+			var second = (string)new Avatar { PublishedOn = avatar.PublishedOn }.GenerateNewID();
+			var group = new GroupEntity();

 			Assert.True(ObjectId.TryParse(first, out var a));
 			Assert.True(ObjectId.TryParse(second, out var b));
-			Assert.Equal(DateTime.UtcNow.Date, a.CreationTime);
+			Assert.Equal(avatar.PublishedOn, a.CreationTime);
+			Assert.InRange(a.CreationTime, DateTime.UtcNow.Date.AddDays(-13), DateTime.UtcNow.Date);
 			Assert.Equal(a.CreationTime, b.CreationTime);
 			Assert.NotEqual(first[8..14], second[8..14]);
-			Assert.Equal(DateTime.UtcNow.Date, ObjectId.Parse((string)new GroupEntity().GenerateNewID()).CreationTime);
+			Assert.Equal(group.PublishedOn, ObjectId.Parse((string)group.GenerateNewID()).CreationTime);
 		}

 		[Fact]
@@ -33,6 +36,33 @@ namespace PrivaPub.Tests.Infrastructure
 			Assert.Equal(new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc), ObjectId.Parse(older).CreationTime);
 		}

+		[Fact]
+		public void A_post_arriving_live_sorts_after_everything_already_stored()
+		{
+			var local = ObjectId.GenerateNewId().ToString();
+			var reply = PrivacyIds.Arrived(DateTime.UtcNow.AddSeconds(-30));
+			var skewed = PrivacyIds.Arrived(DateTime.UtcNow.AddYears(50));
+
+			Assert.True(string.CompareOrdinal(local, reply) < 0);
+			Assert.True(string.CompareOrdinal(reply, skewed) < 0);
+			Assert.True(ObjectId.Parse(skewed).CreationTime < DateTime.UtcNow.AddMinutes(1));
+		}
+
+		[Fact]
+		public void A_backfilled_post_keeps_its_published_time() =>
+			Assert.Equal(new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc), ObjectId.Parse(PrivacyIds.Arrived(new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc))).CreationTime);
+
+		[Fact]
+		public void A_persona_publishes_a_day_within_two_weeks_before_its_creation()
+		{
+			var created = new DateTime(2026, 10, 1, 15, 30, 0, DateTimeKind.Utc);
+			var days = Enumerable.Range(0, 200).Select(_ => PrivacyIds.PublishedDay(created)).ToList();
+
+			Assert.All(days, d => Assert.Equal(TimeSpan.Zero, d.TimeOfDay));
+			Assert.All(days, d => Assert.InRange(d, created.Date.AddDays(-13), created.Date));
+			Assert.True(days.Distinct().Count() > 1);
+		}
+
 		[Fact]
 		public void A_published_time_in_the_future_is_clamped() =>
 			Assert.True(ObjectId.Parse(PrivacyIds.At(DateTime.UtcNow.AddYears(50))).CreationTime < DateTime.UtcNow.AddDays(2));
@@ -41,6 +41,7 @@ namespace PrivaPub.Tests.Support
 			Remote = new RemoteActorService(Peer.Http(cache), Local, cache, Db);
 			Delivery = new DeliveryService(Db, Queue);
 			Fanout = new Fanout(Db);
+			Groups = new GroupDistributor(Delivery);
 			RemotePosts = new RemotePosts(Db, Local, Remote, new NoBlocks(), Queue);
 			Receiver = new InboxReceiver(Local, Remote, Queue, new NoBlocks(), NullLogger<InboxReceiver>.Instance);
 			Processor = new InboxProcessor(Remote, new IActivityHandler[]
@@ -50,10 +51,10 @@ namespace PrivaPub.Tests.Support
 				new RejectHandler(Db, Local),
 				new UndoHandler(Db, Local),
 				new LikeHandler(Db),
-				new AnnounceHandler(Db, Local, RemotePosts, Fanout),
-				new CreateHandler(Db, Local, Remote, Delivery, new NoBlocks(), Fanout, RemotePosts),
-				new DeleteHandler(Db, Local, Remote, Delivery),
-				new UpdateHandler(Db, Local, Remote),
+				new AnnounceHandler(Db, Local, RemotePosts, Fanout, Remote),
+				new CreateHandler(Db, Local, Remote, Delivery, new NoBlocks(), Fanout, RemotePosts, Groups),
+				new DeleteHandler(Db, Local, Remote, Delivery, Groups),
+				new UpdateHandler(Db, Local, Remote, Groups),
 				new FlagHandler(Db, Local)
 			}, NullLogger<InboxProcessor>.Instance);
 			Follows = new FollowService(Db, Local, Remote, Delivery, new KeyLocalizer<GenericRes>(), NullLogger<FollowService>.Instance);
@@ -61,7 +62,7 @@ namespace PrivaPub.Tests.Support
 			Outbox = new OutboxPublisher(Db, Local, Delivery);
 			Media = new MediaService(new StaticOptions<MediaOptions>(new MediaOptions { Root = Path.Combine(Path.GetTempPath(), $"privapub-media-{Guid.NewGuid():N}") }),
 				Local, default, NullLogger<MediaService>.Instance);
-			Statuses = new StatusService(Db, Local, Remote, Delivery, Content, Outbox, Fanout, Media);
+			Statuses = new StatusService(Db, Local, Remote, Delivery, Content, Outbox, Fanout, Media, Groups);
 			Posts = new PostsService(Db, Local, Statuses, new KeyLocalizer<GenericRes>(), NullLogger<PostsService>.Instance);
 			Timelines = new TimelineService(Db, new KeyLocalizer<GenericRes>());
 			Relationships = new RelationshipService(Db, Follows, Delivery);
@@ -82,6 +83,7 @@ namespace PrivaPub.Tests.Support
 		public PostsService Posts { get; }
 		public StatusService Statuses { get; }
 		public MediaService Media { get; }
+		public GroupDistributor Groups { get; }
 		public Fanout Fanout { get; }
 		public RemotePosts RemotePosts { get; }
 		public TimelineService Timelines { get; }
@@ -14,13 +14,16 @@ namespace PrivaPub.Tests.Support
 	{
 		readonly RSA _key = RSA.Create(2048);

-		public RemoteActor(Peer peer, string name, string origin = default)
+		public RemoteActor(Peer peer, string name, string origin = default, string type = "Person")
 		{
 			Name = $"{name}{Guid.NewGuid():N}"[..20];
 			Id = $"{origin ?? peer.A}/users/{Name}";
+			Type = type;
 			peer.Serve($"/users/{Name}", Document().ToJsonString());
 		}

+		public string Type { get; }
+
 		public string Name { get; }
 		public string Id { get; }
 		public string KeyId => Id + "#main-key";
@@ -29,7 +32,7 @@ namespace PrivaPub.Tests.Support
 		public JsonObject Document() => new()
 		{
 			["id"] = Id,
-			["type"] = "Person",
+			["type"] = Type,
 			["preferredUsername"] = Name,
 			["inbox"] = Id + "/inbox",
 			["followers"] = Id + "/followers",
@@ -41,6 +44,21 @@ namespace PrivaPub.Tests.Support
 			}
 		};

+		public HttpRequest Get(string host, string path)
+		{
+			var date = DateTimeOffset.UtcNow.ToString("r", CultureInfo.InvariantCulture);
+			var signingString = $"(request-target): get {path}\nhost: {host}\ndate: {date}";
+			var signature = Convert.ToBase64String(_key.SignData(Encoding.UTF8.GetBytes(signingString), HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1));
+			var context = new DefaultHttpContext();
+			context.Request.Method = "GET";
+			context.Request.Host = new HostString(host);
+			context.Request.Path = path;
+			context.Features.Get<IHttpRequestFeature>().RawTarget = path;
+			context.Request.Headers["Date"] = date;
+			context.Request.Headers["Signature"] = $"keyId=\"{KeyId}\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date\",signature=\"{signature}\"";
+			return context.Request;
+		}
+
 		public HttpRequest Post(string host, string path, JsonNode activity)
 		{
 			var body = Encoding.UTF8.GetBytes(activity.ToJsonString());
@@ -114,7 +114,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			if (parts.Length == 1 || parts[1].Equals(localDomain, StringComparison.OrdinalIgnoreCase))
 			{
 				var local = await _localActors.FindByUserName(parts[0], token);
-				return local is { IsFederated: true, Kind: not LocalActorKind.Application } ? Json(await _mapper.Local(local, false, token)) : NotFoundError();
+				return local is { IsFederated: true, IsCircle: false, Kind: not LocalActorKind.Application } ? Json(await _mapper.Local(local, false, token)) : NotFoundError();
 			}
 			var userName = parts[0];
 			var domain = parts[1].ToLowerInvariant();
@@ -365,7 +365,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			if (avatar is { DeletionAt: null })
 				return (_localActors.FromAvatar(avatar), default);
 			var group = await _dbEntities.Groups.MatchID(id).ExecuteFirstAsync(token);
-			if (group is { DeletionAt: null } && _localActors.FromGroup(group) is { IsFederated: true } community)
+			if (group is { DeletionAt: null } && _localActors.FromGroup(group) is { IsFederated: true, IsCircle: false } community)
 				return (community, default);
 			return (default, await _dbEntities.ForeignAvatars.MatchID(id).ExecuteFirstAsync(token));
 		}
@@ -56,7 +56,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				{
 					var local = await _localActors.FindByUri(q, token);
 					var foreign = local == default ? (resolve ? await _remoteActors.GetActor(q, refresh: false, token) : default) : default;
-					if (local is { IsFederated: true })
+					if (local is { IsFederated: true, IsCircle: false })
 						results.Accounts.Add(await _mapper.Local(local, false, token));
 					else if (foreign != default)
 						results.Accounts.Add(_mapper.Foreign(foreign));
@@ -6,6 +6,7 @@ using PrivaPub.Domain.Media;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Rendering;
 using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
 using PrivaPub.Models.Post;
 using PrivaPub.Models.Social;
 using PrivaPub.Models.User;
@@ -124,7 +125,7 @@ namespace PrivaPub.Api.Mastodon.Mappers

 			foreach (var avatar in await _dbEntities.Avatars.Match(a => wanted.Contains(a.ID) && !a.DeletionAt.HasValue).ExecuteAsync(token))
 				accounts[avatar.ID] = await Local(_localActors.FromAvatar(avatar), false, token);
-			foreach (var group in await _dbEntities.Groups.Match(g => wanted.Contains(g.ID) && !g.DeletionAt.HasValue).ExecuteAsync(token))
+			foreach (var group in await _dbEntities.Groups.Match(g => wanted.Contains(g.ID) && !g.DeletionAt.HasValue && g.Kind == GroupKind.Community).ExecuteAsync(token))
 				accounts[group.ID] = await Local(_localActors.FromGroup(group), false, token);
 			foreach (var foreign in await _dbEntities.ForeignAvatars.Match(f => wanted.Contains(f.ID)).ExecuteAsync(token))
 				accounts[foreign.ID] = Foreign(foreign);
@@ -224,9 +225,12 @@ namespace PrivaPub.Api.Mastodon.Mappers
 		public static string Content(PostEntity post)
 		{
 			var content = post.ContentHtml ?? ActivityPubRenderer.Html(post.Text);
-			return string.IsNullOrEmpty(post.Title) || post.IsFederatedCopy
-				? content ?? string.Empty
-				: $"<p><strong>{WebUtility.HtmlEncode(post.Title)}</strong></p>{content}";
+			if (post.IsFederatedCopy && string.IsNullOrWhiteSpace(content) && !string.IsNullOrEmpty(post.Excerpt))
+				content = $"<p>{WebUtility.HtmlEncode(post.Excerpt)}</p>";
+			var titled = !string.IsNullOrEmpty(post.Title) && (!post.IsFederatedCopy || post.ObjectType is not (null or "Note" or "Question"));
+			return titled
+				? $"<p><strong>{WebUtility.HtmlEncode(post.Title)}</strong></p>{content}"
+				: content ?? string.Empty;
 		}

 		public static string Visibility(PostVisibility visibility) => visibility switch
@@ -32,6 +32,10 @@ namespace PrivaPub.Controllers.ClientToServer
 		public async Task<IActionResult> Insert(InsertPostForm form, CancellationToken token) =>
 			!ModelState.IsValid ? Invalid() : Answer(await _postsService.InsertPost(User.GetUserId(), form, token));

+		[HttpGet, Route("/clientapi/post/nearby")]
+		public async Task<IActionResult> Nearby([FromQuery] string avatarId, [FromQuery] double latitude, [FromQuery] double longitude, CancellationToken token) =>
+			Answer(await _postsService.Nearby(User.GetUserId(), avatarId, latitude, longitude, token));
+
 		[HttpPost, Route("/clientapi/post/update")]
 		public async Task<IActionResult> Update(UpdatePostForm form, CancellationToken token) =>
 			!ModelState.IsValid ? Invalid() : Answer(await _postsService.UpdatePost(User.GetUserId(), form, token));
@@ -122,7 +122,7 @@ namespace PrivaPub.Domain.Content
 			if (parts.Length == 1 || parts[1].Equals(localDomain, StringComparison.OrdinalIgnoreCase))
 			{
 				var local = await _localActors.FindByUserName(parts[0], token);
-				return local is { IsFederated: true, Kind: not LocalActorKind.Application }
+				return local is { IsFederated: true, IsCircle: false, Kind: not LocalActorKind.Application }
 					? new ResolvedMention(local.Uri, local.UserName, local.Domain, local.Uri, true, local.Id, local.Inbox)
 					: default;
 			}
@@ -38,12 +38,14 @@ namespace PrivaPub.Domain.Relationships

 		public async Task Block(LocalActor me, string targetActorUri, string targetAccountId, CancellationToken token)
 		{
+			var block = new Block { AvatarId = me.Id, TargetAccountId = targetAccountId, TargetActorURI = targetActorUri };
 			try
 			{
-				await DB.Default.SaveAsync(new Block { AvatarId = me.Id, TargetAccountId = targetAccountId, TargetActorURI = targetActorUri }, token);
+				await DB.Default.SaveAsync(block, token);
 			}
 			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
 			{
+				block = await DB.Default.Find<Block>().Match(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri).ExecuteFirstAsync(token);
 			}

 			await _follows.UnfollowAs(me, targetActorUri, token);
@@ -67,10 +69,44 @@ namespace PrivaPub.Domain.Relationships
 					await DB.Default.DeleteAsync<Following>(f => f.TargetActorURI == me.Uri && f.AvatarId == targetAccountId);
 			}
 			await Forget(me, targetAccountId, token);
+			if (block != default)
+				await Tell(me, targetActorUri, BlockActivity(me, block), token);
 		}

-		public async Task Unblock(LocalActor me, string targetActorUri, CancellationToken token) =>
-			await DB.Default.DeleteAsync<Block>(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri);
+		public async Task Unblock(LocalActor me, string targetActorUri, CancellationToken token)
+		{
+			var block = await DB.Default.Find<Block>().Match(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri).ExecuteFirstAsync(token);
+			if (block == default)
+				return;
+			await DB.Default.DeleteAsync<Block>(block.ID);
+			await Tell(me, targetActorUri, new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.ActivityStreams,
+				["id"] = me.ActivityUri($"undo-block-{block.ID}"),
+				["type"] = "Undo",
+				["actor"] = me.Uri,
+				["object"] = BlockActivity(me, block)
+			}, token);
+		}
+
+		static JsonObject BlockActivity(LocalActor me, Block block) => new()
+		{
+			["@context"] = ActivityPubRenderer.ActivityStreams,
+			["id"] = me.ActivityUri($"block-{block.ID}"),
+			["type"] = "Block",
+			["actor"] = me.Uri,
+			["object"] = block.TargetActorURI,
+			["to"] = new JsonArray(block.TargetActorURI)
+		};
+
+		async Task Tell(LocalActor me, string targetActorUri, JsonObject activity, CancellationToken token)
+		{
+			if (targetActorUri.StartsWith(me.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+				return;
+			var target = await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == targetActorUri).ExecuteFirstAsync(token);
+			if (!string.IsNullOrEmpty(target?.InboxURL))
+				await _delivery.Enqueue(me, new[] { target.InboxURL }, activity, token);
+		}

 		public async Task Mute(LocalActor me, string targetActorUri, string targetAccountId, bool hideNotifications, TimeSpan? duration, CancellationToken token)
 		{
@@ -95,7 +95,7 @@ namespace PrivaPub.Domain.Social
 			var (local, remote) = await ResolveTarget(target, token);
 			if (local == default && remote == default)
 				return default;
-			if (local != default && (local.Id == follower.Id || !local.IsFederated || local.Kind == LocalActorKind.Application))
+			if (local != default && (local.Id == follower.Id || !local.IsFederated || local.IsCircle || local.Kind == LocalActorKind.Application))
 				return default;

 			var targetUri = local?.Uri ?? remote.ActorURI;
@@ -36,6 +36,9 @@ namespace PrivaPub.Domain.Statuses
 		public string ConversationId { get; init; }
 		public IReadOnlyList<string> Recipients { get; init; } = Array.Empty<string>();
 		public IReadOnlyList<string> MediaIds { get; init; }
+		public double? Latitude { get; init; }
+		public double? Longitude { get; init; }
+		public double? RangeKm { get; init; }
 	}

 	public sealed record StatusOutcome(PostEntity Post, int Status = StatusCodes.Status200OK, string Error = default)
@@ -65,11 +68,13 @@ namespace PrivaPub.Domain.Statuses
 		readonly IOutboxPublisher _outbox;
 		readonly IFanout _fanout;
 		readonly IMediaService _media;
+		readonly IGroupDistributor _groups;

 		public StatusService(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery,
-			IContentRenderer content, IOutboxPublisher outbox, IFanout fanout, IMediaService media)
+			IContentRenderer content, IOutboxPublisher outbox, IFanout fanout, IMediaService media, IGroupDistributor groups)
 		{
 			_media = media;
+			_groups = groups;
 			_dbEntities = dbEntities;
 			_localActors = localActors;
 			_remoteActors = remoteActors;
@@ -91,7 +96,7 @@ namespace PrivaPub.Domain.Statuses
 			if (!string.IsNullOrEmpty(draft.GroupId))
 			{
 				var groupEntity = await _dbEntities.Groups.MatchID(draft.GroupId).ExecuteFirstAsync(token);
-				if (groupEntity == default || groupEntity.DeletionAt.HasValue || !groupEntity.Members.Any(m => !m.IsForeign && m.AvatarId == author.Id))
+				if (groupEntity == default || groupEntity.DeletionAt.HasValue || !await MayPost(groupEntity, author, token))
 					return StatusOutcome.Fail(StatusCodes.Status404NotFound, "Group not found");
 				group = _localActors.FromGroup(groupEntity);
 			}
@@ -102,9 +107,35 @@ namespace PrivaPub.Domain.Statuses
 			if (parent != default && !await VisibilityPolicy.CanSee(parent, author.Id, token))
 				return StatusOutcome.Fail(StatusCodes.Status404NotFound, "Record not found");

+			var located = draft.Latitude.HasValue || draft.Longitude.HasValue;
+			if (located && (draft.Latitude is not (>= -90 and <= 90) || draft.Longitude is not (>= -180 and <= 180) || group != default
+				|| draft.Visibility == PostVisibility.Direct))
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: A located post needs a valid position and no group or recipients");
+
 			var rendered = draft.PlainText ? await _content.PlainText(draft.Text ?? string.Empty, token) : await _content.Markdown(draft.Text ?? string.Empty, token);
-			var isLocalOnly = group is { IsFederated: false };
-			var visibility = isLocalOnly ? PostVisibility.Circle : draft.Visibility is PostVisibility.Circle or PostVisibility.LocalGeo ? PostVisibility.Public : draft.Visibility;
+			string audienceUri = default;
+			if (group == default && !located && draft.Visibility is PostVisibility.Public or PostVisibility.Unlisted)
+				foreach (var mention in rendered.Mentions)
+				{
+					if (mention.IsLocal)
+					{
+						var mentioned = await _dbEntities.Groups.MatchID(mention.AccountId).ExecuteFirstAsync(token);
+						if (mentioned is { DeletionAt: null, Kind: GroupKind.Community } && await MayPost(mentioned, author, token))
+						{
+							group = _localActors.FromGroup(mentioned);
+							break;
+						}
+					}
+					else if (await _dbEntities.ForeignAvatars.MatchID(mention.AccountId).ExecuteFirstAsync(token) is { AvatarType: Models.User.AvatarType.Group } remoteGroup)
+					{
+						audienceUri = remoteGroup.ActorURI;
+						break;
+					}
+				}
+			var isLocalOnly = located;
+			var visibility = located ? PostVisibility.LocalGeo
+				: group is { IsCircle: true } ? PostVisibility.Circle
+				: draft.Visibility is PostVisibility.Circle or PostVisibility.LocalGeo ? PostVisibility.Public : draft.Visibility;
 			var post = new PostEntity
 			{
 				GroupUserId = author.Id,
@@ -121,6 +152,7 @@ namespace PrivaPub.Domain.Statuses
 				Mentions = rendered.Mentions.Select(ToMention).ToList(),
 				Tags = rendered.Tags.ToList(),
 				Media = media.Select(ToPostMedia).ToList(),
+				AudienceURI = audienceUri,
 				AnsweringToPostId = parent?.ID,
 				InReplyToURI = parent?.ObjectURI ?? (IsRemoteUri(draft.InReplyTo) ? draft.InReplyTo : default),
 				InReplyToAccountId = parent?.AuthorAccountId ?? parent?.GroupUserId,
@@ -130,6 +162,11 @@ namespace PrivaPub.Domain.Statuses
 			post.ID = (string)post.GenerateNewID();
 			post.ObjectURI = author.PostUri(post.ID);
 			post.Url = author.PostHtmlUrl(post.ID);
+			if (located)
+			{
+				post.Geo = new Coordinates2D(Math.Round(draft.Longitude.Value, 2), Math.Round(draft.Latitude.Value, 2));
+				post.RangeKm = (float)Math.Clamp(draft.RangeKm ?? 5, 1, 50);
+			}

 			JsonObject create = default;
 			if (visibility == PostVisibility.Direct)
@@ -165,8 +202,8 @@ namespace PrivaPub.Domain.Statuses
 			await _fanout.Distribute(post, token);
 			if (create != default)
 				await _outbox.Publish(author, post, create, token);
-			if (group is { IsFederated: true } && visibility is PostVisibility.Public or PostVisibility.Unlisted)
-				await _delivery.EnqueueToFollowers(group, ActivityPubRenderer.Announce(group, post.ObjectURI, $"announce-{post.ID}"), token);
+			if (create != default && group is { IsCircle: false } && visibility is PostVisibility.Public or PostVisibility.Unlisted)
+				await _groups.Announce(group, create, post.ObjectURI, isNewPost: string.IsNullOrEmpty(post.InReplyToURI), token);
 			return new StatusOutcome(post);
 		}

@@ -232,6 +269,8 @@ namespace PrivaPub.Domain.Statuses
 					["object"] = note
 				};
 				await _outbox.Publish(author, post, update, token);
+				if (group is { IsCircle: false })
+					await _groups.Announce(group, update, post.ObjectURI, isNewPost: false, token);
 			}
 			return new StatusOutcome(post);
 		}
@@ -262,6 +301,9 @@ namespace PrivaPub.Domain.Statuses
 				var delete = ActivityPubRenderer.Delete(author, post.ObjectURI, $"delete-{post.ID}",
 					new JsonArray(post.To.Select(t => (JsonNode)t).ToArray()), new JsonArray(post.Cc.Select(c => (JsonNode)c).ToArray()));
 				await _delivery.Enqueue(author, audience, delete, token);
+				var group = string.IsNullOrEmpty(post.GroupId) ? default : await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
+				if (group is { IsCircle: false })
+					await _groups.Announce(group, delete, post.ObjectURI, isNewPost: false, token);
 			}
 			return new StatusOutcome(post);
 		}
@@ -479,6 +521,20 @@ namespace PrivaPub.Domain.Statuses
 			return (await _dbEntities.ForeignAvatars.MatchID(post.AuthorAccountId).ExecuteFirstAsync(token))?.InboxURL;
 		}

+		async Task<bool> MayPost(Models.Group.Group group, LocalActor author, CancellationToken token)
+		{
+			var member = group.Members.FirstOrDefault(m => !m.IsForeign && m.AvatarId == author.Id);
+			if (group.Kind == GroupKind.Circle)
+				return member != default;
+			return group.PostingPolicy switch
+			{
+				PostingPolicy.Anyone => true,
+				PostingPolicy.Moderators => member?.Role is GroupRole.Owner or GroupRole.Moderator,
+				_ => member != default || await _dbEntities.Followings
+					.Match(f => f.AvatarId == author.Id && f.TargetAccountId == group.ID && f.State == FollowState.Accepted).ExecuteAnyAsync(token)
+			};
+		}
+
 		async Task<List<MediaAttachment>> Media(LocalActor author, IReadOnlyList<string> ids, string postId, CancellationToken token)
 		{
 			if (ids == default || ids.Count == 0)
@@ -40,6 +40,9 @@ namespace PrivaPub.Domain.Timelines
 					foreach (var following in followers)
 						if (await Shows(following, post, token))
 							recipients.Add(following.AvatarId);
+					if (!string.IsNullOrEmpty(post.AudienceURI))
+						foreach (var member in await _dbEntities.Followings.Match(f => f.TargetActorURI == post.AudienceURI && f.State == FollowState.Accepted).ExecuteAsync(token))
+							recipients.Add(member.AvatarId);
 					break;
 				case PostVisibility.Direct when !string.IsNullOrEmpty(post.ConversationId):
 					var conversation = await _dbEntities.DmGroups.MatchID(post.ConversationId).ExecuteFirstAsync(token);
@@ -29,6 +29,8 @@ namespace PrivaPub.Federation.Actors
 		public bool Discoverable { get; init; } = true;
 		public bool ManuallyApprovesFollowers { get; init; }
 		public bool IsFederated { get; init; } = true;
+		public bool IsCircle { get; init; }
+		public bool PostingRestrictedToModerators { get; init; }
 		public bool IsBot { get; init; }
 		public bool Indexable { get; init; }
 		public AvatarSettings Settings { get; init; } = new();
@@ -44,6 +46,8 @@ namespace PrivaPub.Federation.Actors
 		public string Following => $"{Uri}/stalking";
 		public string Featured => $"{Uri}/trophies";
 		public string FeaturedTags => $"{Uri}/tattoos";
+		public string Flock => $"{Uri}/flock";
+		public string Wardens => $"{Uri}/wardens";
 		public string SharedInbox => $"{BaseAddress}/human-centipede";
 		public string Domain => new Uri(BaseAddress).Authority;
 		public string Handle => $"{UserName}@{Domain}";
@@ -198,7 +202,7 @@ namespace PrivaPub.Federation.Actors
 			ThumbnailURL = avatar.ThumbnailURL,
 			PrivateKeyPem = avatar.PrivateKey,
 			PublicKeyPem = avatar.PublicKey,
-			Published = avatar.CreatedAt,
+			Published = avatar.PublishedOn,
 			Fields = avatar.Fields ?? new Dictionary<string, string>(),
 			ManuallyApprovesFollowers = avatar.Settings?.IsLocked == true,
 			Discoverable = avatar.Settings?.IsDiscoverable != false,
@@ -219,10 +223,11 @@ namespace PrivaPub.Federation.Actors
 			ThumbnailURL = group.ThumbnailURL,
 			PrivateKeyPem = group.PrivateKey,
 			PublicKeyPem = group.PublicKey,
-			Discoverable = group.IsDiscoverable,
-			ManuallyApprovesFollowers = group.ManuallyApprovesMembers,
-			IsFederated = group.Kind == GroupKind.Community,
-			Published = group.CreationDate,
+			Discoverable = group.Kind == GroupKind.Community && group.IsDiscoverable,
+			ManuallyApprovesFollowers = group.Kind == GroupKind.Circle || group.ManuallyApprovesMembers,
+			IsCircle = group.Kind == GroupKind.Circle,
+			PostingRestrictedToModerators = group.PostingPolicy == PostingPolicy.Moderators,
+			Published = group.PublishedOn,
 			BaseAddress = BaseAddress
 		};
 	}
@@ -6,6 +6,7 @@ using PrivaPub.StaticServices;
 using System.Text.Json;

 using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Options;

 using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Signing;
@@ -32,13 +33,16 @@ namespace PrivaPub.Federation.Actors
 		readonly ILocalActorService _localActors;
 		readonly IMemoryCache _cache;
 		readonly DbEntities _dbEntities;
+		readonly IOptionsMonitor<FederationOptions> _options;

-		public RemoteActorService(IFederationHttp http, ILocalActorService localActors, IMemoryCache cache, DbEntities dbEntities)
+		public RemoteActorService(IFederationHttp http, ILocalActorService localActors, IMemoryCache cache, DbEntities dbEntities,
+			IOptionsMonitor<FederationOptions> options = default)
 		{
 			_http = http;
 			_localActors = localActors;
 			_cache = cache;
 			_dbEntities = dbEntities;
+			_options = options;
 		}

 		public async Task<FetchedJson> FetchObject(string uri, CancellationToken token)
@@ -122,8 +126,11 @@ namespace PrivaPub.Federation.Actors
 			if (parts is not { Length: 2 } || string.IsNullOrEmpty(parts[0]) || string.IsNullOrEmpty(parts[1]))
 				return default;

-			var url = $"https://{parts[1]}/.well-known/webfinger?resource={Uri.EscapeDataString($"acct:{parts[0]}@{parts[1]}")}";
-			using var fetched = await _http.GetJson(url, "application/jrd+json, application/json", sign: default, token);
+			var query = $"/.well-known/webfinger?resource={Uri.EscapeDataString($"acct:{parts[0]}@{parts[1]}")}";
+			using var fetched = await _http.GetJson($"https://{parts[1]}{query}", "application/jrd+json, application/json", sign: default, token)
+				?? (_options?.CurrentValue.AllowPlainHttp == true
+					? await _http.GetJson($"http://{parts[1]}{query}", "application/jrd+json, application/json", sign: default, token)
+					: default);
 			if (fetched == default)
 				return default;
 			var document = fetched.Document;
@@ -1,4 +1,6 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.Extensions.Options;
 using Microsoft.AspNetCore.RateLimiting;

 using MongoDB.Entities;
@@ -15,12 +17,15 @@ using PrivaPub.Domain.Privacy;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Rendering;
 using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Signing;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Models.Group;
 using PrivaPub.Infrastructure;

 namespace PrivaPub.Federation.Controllers
 {
 	[ApiController, Route("peasants")]
-	public class PeasantsController : ControllerBase
+	public class PeasantsController : ControllerBase, IAsyncActionFilter
 	{
 		const string ActivityContentType = "application/activity+json; charset=utf-8";
 		const int OutboxSize = 20;
@@ -29,10 +34,14 @@ namespace PrivaPub.Federation.Controllers
 		readonly IInboxReceiver _inbox;
 		readonly DbEntities _dbEntities;
 		readonly ILogger<PeasantsController> _logger;
+		readonly ISignedFetchAuthorizer _fetches;
+		readonly IOptionsMonitor<FederationOptions> _federation;

 		public PeasantsController(ILocalActorService localActors, IInboxReceiver inbox, DbEntities dbEntities,
-			ILogger<PeasantsController> logger)
+			ILogger<PeasantsController> logger, ISignedFetchAuthorizer fetches, IOptionsMonitor<FederationOptions> federation)
 		{
+			_fetches = fetches;
+			_federation = federation;
 			_localActors = localActors;
 			_inbox = inbox;
 			_dbEntities = dbEntities;
@@ -113,6 +122,34 @@ namespace PrivaPub.Federation.Controllers
 			return local is not { IsFederated: true } ? NotFound() : Activity(ActivityPubRenderer.OrderedCollection(local.Following, 0, default));
 		}

+		[HttpGet, Route("{actor}/flock")]
+		public async Task<IActionResult> Members(string actor, CancellationToken token)
+		{
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local is not { IsFederated: true, Kind: LocalActorKind.Group })
+				return NotFound();
+			var group = await _dbEntities.Groups.MatchID(local.Id).ExecuteFirstAsync(token);
+			if (local.IsCircle && !SignedFetchAuthorizer.MayReadCircle(group, await _fetches.Requester(Request, token)))
+				return NotFound();
+			return Activity(ActivityPubRenderer.OrderedCollection(local.Flock, group.Members.Count, default));
+		}
+
+		[HttpGet, Route("{actor}/wardens")]
+		public async Task<IActionResult> Moderators(string actor, CancellationToken token)
+		{
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local is not { IsFederated: true, Kind: LocalActorKind.Group })
+				return NotFound();
+			var group = await _dbEntities.Groups.MatchID(local.Id).ExecuteFirstAsync(token);
+			if (local.IsCircle && !SignedFetchAuthorizer.MayReadCircle(group, await _fetches.Requester(Request, token)))
+				return NotFound();
+			var moderators = new List<JsonNode>();
+			foreach (var member in group.Members.Where(m => !m.IsForeign && m.Role is GroupRole.Owner or GroupRole.Moderator))
+				if (await _localActors.FindById(LocalActorKind.Person, member.AvatarId, token) is { } moderator)
+					moderators.Add(moderator.Uri);
+			return Activity(ActivityPubRenderer.OrderedCollection(local.Wardens, moderators.Count, moderators));
+		}
+
 		[HttpGet, Route("{actor}/trophies")]
 		public async Task<IActionResult> Featured(string actor, CancellationToken token)
 		{
@@ -145,6 +182,12 @@ namespace PrivaPub.Federation.Controllers
 		public async Task<IActionResult> Post(string actor, string postId, CancellationToken token)
 		{
 			var (local, post) = await PublicPost(actor, postId, token);
+			if (post == default && await CirclePost(actor, postId, token) is { } circlePost)
+			{
+				var circleNote = ActivityPubRenderer.Note(circlePost.Post, circlePost.Author, circlePost.Circle, circlePost.Post.InReplyToURI);
+				circleNote["@context"] = ActivityPubRenderer.Context();
+				return Activity(circleNote);
+			}
 			if (post == default)
 				return await Tombstone(actor, postId, token) ?? NotFound();
 			if (WantsHtml())
@@ -202,6 +245,20 @@ namespace PrivaPub.Federation.Controllers
 			return (local, post);
 		}

+		async Task<(LocalActor Author, LocalActor Circle, PostEntity Post)?> CirclePost(string actor, string postId, CancellationToken token)
+		{
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local is not { Kind: LocalActorKind.Person })
+				return default;
+			var post = await _dbEntities.Posts
+				.Match(p => p.ID == postId && p.GroupUserId == local.Id && !p.IsFederatedCopy && !p.DeletedAt.HasValue && p.Visibility == PostVisibility.Circle)
+				.ExecuteFirstAsync(token);
+			var circle = post == default ? default : await _dbEntities.Groups.MatchID(post.GroupId).ExecuteFirstAsync(token);
+			if (circle == default || !SignedFetchAuthorizer.MayReadCircle(circle, await _fetches.Requester(Request, token)))
+				return default;
+			return (local, _localActors.FromGroup(circle), post);
+		}
+
 		async Task<IActionResult> Tombstone(string actor, string postId, CancellationToken token)
 		{
 			var local = await _localActors.FindByUserName(actor, token);
@@ -257,6 +314,21 @@ namespace PrivaPub.Federation.Controllers
 				&& !accept.Contains("ld+json", StringComparison.OrdinalIgnoreCase);
 		}

+		[NonAction]
+		public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
+		{
+			if (HttpMethods.IsGet(Request.Method))
+				Response.Headers.Vary = "Accept";
+			if (_federation.CurrentValue.SecureMode && HttpMethods.IsGet(Request.Method)
+				&& !string.Equals(context.RouteData.Values["actor"] as string, LocalActorService.InstanceUserName, StringComparison.OrdinalIgnoreCase)
+				&& await _fetches.Requester(Request, HttpContext.RequestAborted) == default)
+			{
+				context.Result = StatusCode(StatusCodes.Status401Unauthorized);
+				return;
+			}
+			await next();
+		}
+
 		IActionResult Answer(InboxResult result)
 		{
 			if (result.Error != default)
@@ -26,9 +26,11 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		readonly ILocalActorService _localActors;
 		readonly IRemotePosts _remotePosts;
 		readonly IFanout _fanout;
+		readonly IRemoteActorService _remoteActors;

-		public AnnounceHandler(DbEntities dbEntities, ILocalActorService localActors, IRemotePosts remotePosts, IFanout fanout)
+		public AnnounceHandler(DbEntities dbEntities, ILocalActorService localActors, IRemotePosts remotePosts, IFanout fanout, IRemoteActorService remoteActors)
 		{
+			_remoteActors = remoteActors;
 			_dbEntities = dbEntities;
 			_localActors = localActors;
 			_remotePosts = remotePosts;
@@ -41,7 +43,10 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		{
 			var inner = activity["object"];
 			if (inner is JsonObject && Value(inner, "type") is "Create" or "Update" or "Delete" or "Like" or "Dislike" or "Undo" or "Add" or "Remove" or "Block")
+			{
+				await GroupActivity(inner, actor, token);
 				return;
+			}
 			var objectUri = Id(inner);
 			var announceId = Id(activity);
 			if (objectUri == default || announceId == default)
@@ -66,7 +71,7 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				: DateTime.UtcNow;
 			var reblog = new PostEntity
 			{
-				ID = PrivacyIds.At(published),
+				ID = PrivacyIds.Arrived(published),
 				ObjectURI = announceId,
 				ActivityURI = announceId,
 				ActorURI = actor.ActorURI,
@@ -96,6 +101,66 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			await _fanout.Distribute(reblog, token);
 		}

+		async Task GroupActivity(JsonNode inner, ForeignAvatar group, CancellationToken token)
+		{
+			if (group.AvatarType != AvatarType.Group
+				|| !await _dbEntities.Followings.Match(f => f.TargetActorURI == group.ActorURI && f.State == FollowState.Accepted).ExecuteAnyAsync(token))
+				return;
+			var objectUri = Id(inner["object"]);
+			switch (Value(inner, "type"))
+			{
+				case "Create" when objectUri != default:
+					if (await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteAnyAsync(token))
+						return;
+					var post = await _remotePosts.StoreContext(objectUri, 0, token);
+					if (post == default)
+						return;
+					await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.AudienceURI, group.ActorURI).ExecuteAsync(token);
+					post.AudienceURI = group.ActorURI;
+					await _fanout.Distribute(post, token);
+					break;
+				case "Update" when objectUri != default:
+					var stored = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && p.AudienceURI == group.ActorURI && !p.DeletedAt.HasValue)
+						.ExecuteFirstAsync(token);
+					if (stored == default)
+						return;
+					using (var fetched = await _remoteActors.FetchObject(objectUri, token))
+					{
+						var note = fetched == default ? default : NoteParser.Parse(System.Text.Json.Nodes.JsonNode.Parse(fetched.Root.GetRawText()));
+						if (note == default || note.AttributedTo != stored.ActorURI)
+							return;
+						stored.Revisions.Add(new PostRevision
+						{
+							Title = stored.Title,
+							SpoilerText = stored.SpoilerText,
+							ContentHtml = stored.ContentHtml,
+							HasContentWarning = stored.HasContentWarning,
+							EditedAt = stored.EditedAt ?? stored.CreationDate
+						});
+						stored.Title = note.Title;
+						stored.SpoilerText = note.SpoilerText;
+						stored.HasContentWarning = note.Sensitive;
+						stored.Text = note.ContentHtml;
+						stored.ContentHtml = note.ContentHtml;
+						stored.Tags = note.Tags.ToList();
+						stored.Media = note.Attachments.ToList();
+						stored.EditedAt = note.Updated ?? DateTime.UtcNow;
+						await DB.Default.SaveAsync(stored, token);
+					}
+					break;
+				case "Delete" when objectUri != default:
+					var deleted = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && p.AudienceURI == group.ActorURI).ExecuteFirstAsync(token);
+					if (deleted == default)
+						return;
+					using (var check = await _remoteActors.FetchObject(objectUri, token))
+						if (check != default && Value(System.Text.Json.Nodes.JsonNode.Parse(check.Root.GetRawText()), "type") != "Tombstone")
+							return;
+					await DB.Default.DeleteAsync<PostEntity>(deleted.ID);
+					await DB.Default.DeleteAsync<TimelineEntry>(e => e.PostId == deleted.ID);
+					break;
+			}
+		}
+
 		static List<string> Strings(JsonNode node) => node switch
 		{
 			JsonArray array => array.Select(Id).Where(id => id != default).ToList(),
@@ -33,10 +33,12 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		readonly IDomainBlocks _domainBlocks;
 		readonly IFanout _fanout;
 		readonly IRemotePosts _remotePosts;
+		readonly IGroupDistributor _groups;

 		public CreateHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery,
-			IDomainBlocks domainBlocks, IFanout fanout, IRemotePosts remotePosts)
+			IDomainBlocks domainBlocks, IFanout fanout, IRemotePosts remotePosts, IGroupDistributor groups)
 		{
+			_groups = groups;
 			_fanout = fanout;
 			_remotePosts = remotePosts;
 			_dbEntities = dbEntities;
@@ -85,10 +87,17 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			var parent = string.IsNullOrEmpty(note.InReplyTo)
 				? default
 				: await _dbEntities.Posts.Match(p => p.ObjectURI == note.InReplyTo && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
-			var group = visibility is PostVisibility.Public or PostVisibility.Unlisted
-				? localTargets.FirstOrDefault(t => t.Kind == LocalActorKind.Group)
-				: default;
-			if (group != default && !await IsAcceptedFollower(group, author.ActorURI, token))
+			var circle = localTargets.FirstOrDefault(t => t is { Kind: LocalActorKind.Group, IsCircle: true });
+			if (circle != default)
+			{
+				if (!await IsCircleMember(circle, author.ActorURI, token))
+					return;
+				visibility = PostVisibility.Circle;
+			}
+			var group = circle ?? (visibility is PostVisibility.Public or PostVisibility.Unlisted
+				? localTargets.FirstOrDefault(t => t is { Kind: LocalActorKind.Group, IsCircle: false })
+				: default);
+			if (group is { IsCircle: false } && !await MayPost(group, author.ActorURI, token))
 				group = default;

 			var repliesToLocal = parent is { IsFederatedCopy: false } && visibility != PostVisibility.Direct;
@@ -128,11 +137,22 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			await _fanout.Distribute(post, token);
 			if (conversation != default)
 				await DB.Default.Update<DmGroup>().MatchID(conversation.ID).Modify(g => g.UpdatedAt, DateTime.UtcNow).ExecuteAsync(token);
-			if (group != default)
-			{
-				var announce = ActivityPubRenderer.Announce(group, note.Id, $"announce-{post.ID}");
-				await _delivery.EnqueueToFollowers(group, announce, token);
+			if (group is { IsCircle: false })
+				await _groups.Announce(group, activity.AsObject(), note.Id, isNewPost: string.IsNullOrEmpty(note.InReplyTo), token);
 		}
+
+		async Task<bool> IsCircleMember(LocalActor circle, string actorUri, CancellationToken token) =>
+			await _dbEntities.Groups.Match(g => g.ID == circle.Id && g.Members.Any(m => m.IsForeign && m.AvatarId == actorUri)).ExecuteAnyAsync(token);
+
+		async Task<bool> MayPost(LocalActor community, string actorUri, CancellationToken token)
+		{
+			var entity = await _dbEntities.Groups.MatchID(community.Id).ExecuteFirstAsync(token);
+			return entity?.PostingPolicy switch
+			{
+				PostingPolicy.Anyone => true,
+				PostingPolicy.Followers => await IsAcceptedFollower(community, actorUri, token),
+				_ => false
+			};
 		}

 		async Task<DmGroup> FindOrCreateConversation(List<string> participantUris, string context, CancellationToken token)
@@ -26,9 +26,12 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		readonly ILocalActorService _localActors;
 		readonly IRemoteActorService _remoteActors;
 		readonly IDeliveryService _delivery;
+		readonly IGroupDistributor _groups;

-		public DeleteHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery)
+		public DeleteHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery,
+			IGroupDistributor groups)
 		{
+			_groups = groups;
 			_dbEntities = dbEntities;
 			_localActors = localActors;
 			_remoteActors = remoteActors;
@@ -67,6 +70,8 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				return;
 			await DB.Default.DeleteAsync<PostEntity>(post.ID);
 			await DB.Default.DeleteAsync<TimelineEntry>(e => e.PostId == post.ID || e.ReblogOfPostId == post.ID);
+			if (!string.IsNullOrEmpty(post.GroupId) && await _localActors.FindById(LocalActorKind.Group, post.GroupId, token) is { IsCircle: false } community)
+				await _groups.Announce(community, activity.AsObject(), post.ObjectURI, isNewPost: false, token);
 			await DB.Default.DeleteAsync<PostEntity>(p => p.ReblogOfPostId == post.ID);
 			if (!string.IsNullOrEmpty(post.AnsweringToPostId))
 				await DB.Default.Update<PostEntity>().MatchID(post.AnsweringToPostId).Modify(b => b.Inc(p => p.RepliesCount, -1)).ExecuteAsync(token);
@@ -2,6 +2,7 @@ using MongoDB.Entities;

 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Outbox;
 using PrivaPub.Models.Post;
 using PrivaPub.Models.User;
 using PrivaPub.StaticServices;
@@ -21,9 +22,11 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		readonly DbEntities _dbEntities;
 		readonly ILocalActorService _localActors;
 		readonly IRemoteActorService _remoteActors;
+		readonly IGroupDistributor _groups;

-		public UpdateHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors)
+		public UpdateHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IGroupDistributor groups)
 		{
+			_groups = groups;
 			_dbEntities = dbEntities;
 			_localActors = localActors;
 			_remoteActors = remoteActors;
@@ -69,6 +72,7 @@ namespace PrivaPub.Federation.Inbox.Handlers

 			post.Title = note.Title;
 			post.SpoilerText = note.SpoilerText;
+			post.Excerpt = note.Excerpt;
 			post.HasContentWarning = note.Sensitive;
 			post.Text = note.ContentHtml;
 			post.ContentHtml = note.ContentHtml;
@@ -79,6 +83,8 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			post.EditedAt = note.Updated ?? DateTime.UtcNow;
 			post.UpdateDate = DateTime.UtcNow;
 			await DB.Default.SaveAsync(post, token);
+			if (!string.IsNullOrEmpty(post.GroupId) && await _localActors.FindById(Models.Federation.LocalActorKind.Group, post.GroupId, token) is { IsCircle: false } community)
+				await _groups.Announce(community, activity.AsObject(), post.ObjectURI, isNewPost: false, token);
 		}
 	}
 }
@@ -60,7 +60,7 @@ namespace PrivaPub.Federation.Inbox

 			return new PostEntity
 			{
-				ID = PrivacyIds.At(note.Published),
+				ID = PrivacyIds.Arrived(note.Published),
 				ObjectURI = note.Id,
 				ActorURI = author.ActorURI,
 				AuthorAccountId = author.ID,
@@ -70,8 +70,10 @@ namespace PrivaPub.Federation.Inbox
 				Url = note.Url,
 				ContextURI = note.Context,
 				QuoteURI = note.QuoteUri,
+				ObjectType = note.Type,
 				Title = note.Title,
 				SpoilerText = note.SpoilerText,
+				Excerpt = note.Excerpt,
 				HasContentWarning = note.Sensitive,
 				Text = note.ContentHtml,
 				ContentHtml = note.ContentHtml,
@@ -15,6 +15,7 @@ namespace PrivaPub.Federation.Objects
 		public string ContentHtml { get; init; }
 		public string Title { get; init; }
 		public string SpoilerText { get; init; }
+		public string Excerpt { get; init; }
 		public bool Sensitive { get; init; }
 		public string Language { get; init; }
 		public string Url { get; init; }
@@ -48,6 +49,8 @@ namespace PrivaPub.Federation.Objects

 			var (contentHtml, language) = Content(note);
 			var summary = Value(note, "summary");
+			var sensitive = note["sensitive"] is JsonValue flag && flag.TryGetValue<bool>(out var marked) && marked;
+			var summaryWarns = type is "Note" or "Question" || sensitive;
 			return new NoteDocument
 			{
 				Id = id,
@@ -55,9 +58,9 @@ namespace PrivaPub.Federation.Objects
 				AttributedTo = Attribution(note["attributedTo"]),
 				ContentHtml = ContentSanitizer.Html(contentHtml),
 				Title = Plain(Value(note, "name"), 500),
-				SpoilerText = Plain(summary, 500),
-				Sensitive = note["sensitive"] is JsonValue sensitive && sensitive.TryGetValue<bool>(out var s) && s
-					|| !string.IsNullOrWhiteSpace(summary),
+				SpoilerText = summaryWarns ? Plain(summary, 500) : default,
+				Excerpt = summaryWarns ? default : Plain(summary, 1000),
+				Sensitive = sensitive || summaryWarns && !string.IsNullOrWhiteSpace(summary),
 				Language = language,
 				Url = UrlOf(note["url"]) ?? id,
 				InReplyTo = Id(note["inReplyTo"]),
@@ -163,7 +166,7 @@ namespace PrivaPub.Federation.Objects
 		static DateTime? Time(string value) =>
 			DateTimeOffset.TryParse(value, CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal, out var parsed)
 				? parsed.UtcDateTime
-				: default;
+				: (DateTime?)null;

 		static int? Int(JsonNode node) =>
 			node is JsonValue value && value.TryGetValue<int>(out var number) && number is > 0 and < 100_000 ? number : (int?)null;
@@ -0,0 +1,48 @@
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Rendering;
+
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Federation.Outbox
+{
+	public interface IGroupDistributor
+	{
+		Task Announce(LocalActor group, JsonObject activity, string objectUri, bool isNewPost, CancellationToken token);
+	}
+
+	public class GroupDistributor : IGroupDistributor
+	{
+		readonly IDeliveryService _delivery;
+
+		public GroupDistributor(IDeliveryService delivery)
+		{
+			_delivery = delivery;
+		}
+
+		public async Task Announce(LocalActor group, JsonObject activity, string objectUri, bool isNewPost, CancellationToken token)
+		{
+			if (group is not { IsCircle: false, Kind: Models.Federation.LocalActorKind.Group })
+				return;
+			var embedded = (JsonObject)activity.DeepClone();
+			embedded.Remove("@context");
+			embedded["audience"] ??= group.Uri;
+			var key = Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(activity["id"]?.GetValue<string>() ?? embedded.ToJsonString())))[..24];
+			var announce = new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.Context(),
+				["id"] = group.ActivityUri($"announce-{key}"),
+				["type"] = "Announce",
+				["actor"] = group.Uri,
+				["to"] = new JsonArray(ActivityPubRenderer.Public),
+				["cc"] = new JsonArray(group.Followers),
+				["audience"] = group.Uri,
+				["object"] = embedded
+			};
+			await _delivery.EnqueueToFollowers(group, announce, token);
+			if (isNewPost && !string.IsNullOrEmpty(objectUri))
+				await _delivery.EnqueueToFollowers(group, ActivityPubRenderer.Announce(group, objectUri, $"announce-object-{key}"), token);
+		}
+	}
+}
@@ -32,8 +32,10 @@ namespace PrivaPub.Federation.Outbox

 		public async Task<IReadOnlyList<string>> Audience(LocalActor author, PostEntity post, CancellationToken token)
 		{
-			if (post.Visibility is PostVisibility.Circle or PostVisibility.LocalGeo || post.IsLocalOnly)
+			if (post.Visibility == PostVisibility.LocalGeo || post.IsLocalOnly)
 				return Array.Empty<string>();
+			if (post.Visibility == PostVisibility.Circle)
+				return await CircleMembers(post.GroupId, token);

 			var inboxes = new List<string>();
 			if (post.Visibility is PostVisibility.Public or PostVisibility.Unlisted or PostVisibility.FollowersOnly)
@@ -58,14 +60,19 @@ namespace PrivaPub.Federation.Outbox
 					inboxes.Add(parentAuthor.InboxURL);
 			}

-			if (!string.IsNullOrEmpty(post.GroupId) && post.Visibility is PostVisibility.Public or PostVisibility.Unlisted)
-			{
-				var group = await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
-				if (group is { IsFederated: true })
-					inboxes.AddRange(await _delivery.FollowerInboxes(group, token));
+			return inboxes.Where(i => !string.IsNullOrEmpty(i)).Distinct(StringComparer.Ordinal).ToList();
 		}

-			return inboxes.Where(i => !string.IsNullOrEmpty(i)).Distinct(StringComparer.Ordinal).ToList();
+		async Task<IReadOnlyList<string>> CircleMembers(string groupId, CancellationToken token)
+		{
+			var circle = string.IsNullOrEmpty(groupId) ? default : await _dbEntities.Groups.MatchID(groupId).ExecuteFirstAsync(token);
+			if (circle == default)
+				return Array.Empty<string>();
+			var remote = circle.Members.Where(m => m.IsForeign).Select(m => m.AvatarId).ToList();
+			if (remote.Count == 0)
+				return Array.Empty<string>();
+			return (await _dbEntities.ForeignAvatars.Match(a => remote.Contains(a.ActorURI)).ExecuteAsync(token))
+				.Select(a => a.InboxURL).Where(i => !string.IsNullOrEmpty(i)).Distinct(StringComparer.Ordinal).ToList();
 		}

 		public async Task Publish(LocalActor author, PostEntity post, JsonObject activity, CancellationToken token)
@@ -41,14 +41,16 @@ namespace PrivaPub.Federation.Rendering
 				["schema"] = "http://schema.org#",
 				["PropertyValue"] = "schema:PropertyValue",
 				["value"] = "schema:value",
-				["webfinger"] = "https://purl.archive.org/socialweb/webfinger#webfinger"
+				["webfinger"] = "https://purl.archive.org/socialweb/webfinger#webfinger",
+				["lemmy"] = "https://join-lemmy.org/ns#",
+				["postingRestrictedToMods"] = "lemmy:postingRestrictedToMods"
 			});

 		public static string Html(string markdown) =>
 			string.IsNullOrEmpty(markdown) ? string.Empty : Markdown.ToHtml(markdown, Pipeline).Trim();

 		public static string Timestamp(DateTime value) =>
-			DateTime.SpecifyKind(value, DateTimeKind.Utc).ToString("yyyy-MM-ddTHH:mm:ssZ", CultureInfo.InvariantCulture);
+			DateTime.SpecifyKind(value, DateTimeKind.Utc).ToString("yyyy-MM-ddTHH:mm:ss.fffZ", CultureInfo.InvariantCulture);

 		public static string Day(DateTime value) =>
 			DateTime.SpecifyKind(value, DateTimeKind.Utc).Date.ToString("yyyy-MM-ddT00:00:00Z", CultureInfo.InvariantCulture);
@@ -97,6 +99,11 @@ namespace PrivaPub.Federation.Rendering
 					["value"] = FieldValue(field.Value)
 				}).ToArray())
 			};
+			if (actor is { Kind: LocalActorKind.Group, IsCircle: false })
+			{
+				document["attributedTo"] = actor.Wardens;
+				document["postingRestrictedToMods"] = actor.PostingRestrictedToModerators;
+			}
 			if (!string.IsNullOrEmpty(actor.PictureURL))
 				document["icon"] = new JsonObject { ["type"] = "Image", ["url"] = actor.PictureURL };
 			if (!string.IsNullOrEmpty(actor.ThumbnailURL))
@@ -109,17 +116,25 @@ namespace PrivaPub.Federation.Rendering
 			var mentions = post.Mentions.Select(m => (JsonNode)m.ActorURI).ToArray();
 			var (to, cc) = post.Visibility switch
 			{
+				PostVisibility.Circle when group != default => (new JsonArray(group.Uri, group.Flock), new JsonArray(mentions)),
 				PostVisibility.Unlisted => (new JsonArray(author.Followers), new JsonArray(mentions.Prepend(Public).ToArray())),
 				PostVisibility.FollowersOnly => (new JsonArray(author.Followers), new JsonArray(mentions)),
 				PostVisibility.Direct => (new JsonArray(mentions), new JsonArray()),
 				_ => (new JsonArray(Public), new JsonArray(mentions.Prepend(author.Followers).ToArray()))
 			};
-			if (group != default)
+			if (group is { IsCircle: false })
 				cc.Add(group.Uri);

 			var note = NoteBody(post, author, to, cc, inReplyTo);
 			if (group != default)
 				note["audience"] = group.Uri;
+			else if (!string.IsNullOrEmpty(post.AudienceURI))
+				note["audience"] = post.AudienceURI;
+			if (group is { IsCircle: false } && string.IsNullOrEmpty(inReplyTo))
+			{
+				note["type"] = "Page";
+				note["name"] = post.Title ?? Headline(post);
+			}
 			return note;
 		}

@@ -141,6 +156,13 @@ namespace PrivaPub.Federation.Rendering
 			return note;
 		}

+		static string Headline(PostEntity post)
+		{
+			var text = System.Text.RegularExpressions.Regex.Replace(post.ContentHtml ?? post.Text ?? string.Empty, "<[^>]+>", " ");
+			text = WebUtility.HtmlDecode(System.Text.RegularExpressions.Regex.Replace(text, "\\s+", " ")).Trim();
+			return text.Length <= 100 ? text : text[..97] + "...";
+		}
+
 		static JsonObject NoteBody(PostEntity post, LocalActor author, JsonArray to, JsonArray cc, string inReplyTo)
 		{
 			var content = post.ContentHtml ?? Html(post.Text);
@@ -0,0 +1,40 @@
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.User;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Federation.Signing
+{
+	public interface ISignedFetchAuthorizer
+	{
+		Task<ForeignAvatar> Requester(HttpRequest request, CancellationToken token);
+	}
+
+	public class SignedFetchAuthorizer : ISignedFetchAuthorizer
+	{
+		readonly IRemoteActorService _remoteActors;
+
+		public SignedFetchAuthorizer(IRemoteActorService remoteActors)
+		{
+			_remoteActors = remoteActors;
+		}
+
+		public async Task<ForeignAvatar> Requester(HttpRequest request, CancellationToken token)
+		{
+			var parameters = HttpSignatures.Parse(request.Headers["Signature"].ToString());
+			if (parameters == default || HttpSignatures.CheckRequest(request, parameters, body: default) != default)
+				return default;
+			var signingString = HttpSignatures.SigningString(request, parameters);
+			var actor = await _remoteActors.GetActorByKeyId(parameters.KeyId, refresh: false, token);
+			if (actor != default && HttpSignatures.Verify(actor.PublicKey, signingString, parameters.Signature))
+				return actor;
+			actor = await _remoteActors.GetActorByKeyId(parameters.KeyId, refresh: true, token);
+			return actor != default && HttpSignatures.Verify(actor.PublicKey, signingString, parameters.Signature) ? actor : default;
+		}
+
+		public static bool MayReadCircle(GroupEntity circle, ForeignAvatar requester) =>
+			requester != default && circle.Members.Any(m => m.IsForeign
+				&& (m.AvatarId == requester.ActorURI || requester.AvatarType == AvatarType.Application && Origin.Same(m.AvatarId, requester.ActorURI)));
+	}
+}
@@ -21,6 +21,7 @@ namespace PrivaPub.Infrastructure.Data
 			await Plain<Post>(token, p => p.ActorURI);
 			await Plain<Post>(token, p => p.ConversationId, p => p.ID);
 			await Plain<Post>(token, p => p.InReplyToURI);
+			await DB.Default.Index<Post>().Key(p => p.Geo, KeyType.Geo2DSphere).CreateAsync(token);

 			await Unique<DmPost>(p => p.ObjectURI, Builders<DmPost>.Filter.Type(p => p.ObjectURI, BsonType.String), token);
 			await Plain<DmPost>(token, p => p.GroupId, p => p.ID);
@@ -0,0 +1,26 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Post;
+
+namespace PrivaPub.Infrastructure.Data.Migrations
+{
+	public class _006_unedited_remote_posts_lose_year_one : IMigration
+	{
+		public async Task UpgradeAsync()
+		{
+			var posts = await DB.Default.Find<Post>()
+				.Match(p => p.EditedAt == DateTime.MinValue || p.UpdateDate == DateTime.MinValue || p.Revisions.Any(r => r.EditedAt == DateTime.MinValue))
+				.ExecuteAsync();
+			foreach (var post in posts)
+			{
+				foreach (var revision in post.Revisions.Where(r => r.EditedAt == DateTime.MinValue))
+					revision.EditedAt = post.CreationDate;
+				await DB.Default.Update<Post>().MatchID(post.ID)
+					.Modify(p => p.EditedAt, post.EditedAt == DateTime.MinValue ? null : post.EditedAt)
+					.Modify(p => p.UpdateDate, post.UpdateDate == DateTime.MinValue ? post.CreationDate : post.UpdateDate)
+					.Modify(p => p.Revisions, post.Revisions)
+					.ExecuteAsync();
+			}
+		}
+	}
+}
@@ -0,0 +1,23 @@
+using MongoDB.Bson;
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Ids;
+using PrivaPub.Models.User;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Infrastructure.Data.Migrations
+{
+	public class _007_personas_publish_a_spread_day : IMigration
+	{
+		public async Task UpgradeAsync()
+		{
+			var missing = new BsonDocument(nameof(Avatar.PublishedOn), new BsonDocument("$exists", false));
+			foreach (var avatar in await DB.Default.Collection<Avatar>().Find(missing).ToListAsync())
+				await DB.Default.Update<Avatar>().MatchID(avatar.ID).Modify(a => a.PublishedOn, PrivacyIds.PublishedDay(avatar.CreatedAt)).ExecuteAsync();
+			foreach (var group in await DB.Default.Collection<GroupEntity>().Find(missing).ToListAsync())
+				await DB.Default.Update<GroupEntity>().MatchID(group.ID).Modify(g => g.PublishedOn, PrivacyIds.PublishedDay(group.CreationDate)).ExecuteAsync();
+		}
+	}
+}
@@ -4,5 +4,7 @@ namespace PrivaPub.Infrastructure.Http
 	{
 		public bool AllowPrivateNetworks { get; set; }
 		public bool AllowPlainHttp { get; set; }
+		public bool SecureMode { get; set; }
+		public bool AcceptAnyCertificate { get; set; }
 	}
 }
@@ -1,4 +1,5 @@
 using System.Net;
+using System.Net.Security;
 using System.Net.Sockets;

 namespace PrivaPub.Infrastructure.Http
@@ -12,6 +13,9 @@ namespace PrivaPub.Infrastructure.Http
 	{
 		public static SocketsHttpHandler Create(FederationOptions options) => new()
 		{
+			SslOptions = options.AcceptAnyCertificate
+				? new SslClientAuthenticationOptions { RemoteCertificateValidationCallback = (_, _, _, _) => true }
+				: new SslClientAuthenticationOptions(),
 			AllowAutoRedirect = false,
 			UseProxy = false,
 			UseCookies = false,
@@ -1,12 +1,24 @@
 using System.Buffers.Binary;
 using System.Security.Cryptography;

+using MongoDB.Bson;
+
 namespace PrivaPub.Infrastructure.Ids
 {
 	public static class PrivacyIds
 	{
 		public static string ForDay(DateTime when) => At(DateTime.SpecifyKind(when, DateTimeKind.Utc).Date);

+		public static DateTime PublishedDay(DateTime created) =>
+			DateTime.SpecifyKind(created, DateTimeKind.Utc).Date.AddDays(-RandomNumberGenerator.GetInt32(0, PublishedSpreadDays));
+
+		const int PublishedSpreadDays = 14;
+
+		public static string Arrived(DateTime published) =>
+			DateTime.SpecifyKind(published, DateTimeKind.Utc) > DateTime.UtcNow - LiveWindow ? ObjectId.GenerateNewId().ToString() : At(published);
+
+		static readonly TimeSpan LiveWindow = TimeSpan.FromHours(1);
+
 		public static string At(DateTime when)
 		{
 			var seconds = Math.Clamp(new DateTimeOffset(DateTime.SpecifyKind(when, DateTimeKind.Utc)).ToUnixTimeSeconds(), 0,
@@ -15,6 +15,7 @@ using PrivaPub.Services.ClientToServer.Private;
 using PrivaPub.Services.ClientToServer.Public;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Signing;
 using PrivaPub.Federation.Inbox;
 using PrivaPub.Federation.Moderation;
 using PrivaPub.Federation.Inbox.Handlers;
@@ -65,6 +66,8 @@ namespace PrivaPub.Middleware
 				.AddSingleton<IRemoteActorService, RemoteActorService>()
 				.AddSingleton<IDeliveryService, DeliveryService>()
 				.AddSingleton<IOutboxPublisher, OutboxPublisher>()
+				.AddSingleton<IGroupDistributor, GroupDistributor>()
+				.AddSingleton<ISignedFetchAuthorizer, SignedFetchAuthorizer>()
 				.AddSingleton<IFanout, Fanout>()
 				.AddSingleton<IInboxReceiver, InboxReceiver>()
 				.AddSingleton<IActivityHandler, FollowHandler>()
@@ -20,6 +20,8 @@ namespace PrivaPub.Models.Group
 		public string PublicKey { get; set; }

 		public GroupKind Kind { get; set; }
+		public PostingPolicy PostingPolicy { get; set; }
+		public List<string> Rules { get; set; } = new();
 		public bool IsDiscoverable { get; set; } = true;
 		public bool ManuallyApprovesMembers { get; set; }
 		public string OwnerAvatarId { get; set; }
@@ -29,10 +31,11 @@ namespace PrivaPub.Models.Group
 		public string HashedInvitationPassword { get; set; }

 		public DateTime CreationDate { get; set; } = DateTime.UtcNow;
+		public DateTime PublishedOn { get; set; } = PrivacyIds.PublishedDay(DateTime.UtcNow);
 		public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime? DeletionAt { get; set; }

-		public override object GenerateNewID() => PrivacyIds.ForDay(DateTime.UtcNow);
+		public override object GenerateNewID() => PrivacyIds.ForDay(PublishedOn);
 	}

 	public class GroupMember
@@ -49,6 +52,13 @@ namespace PrivaPub.Models.Group
 		Community
 	}

+	public enum PostingPolicy
+	{
+		Followers,
+		Anyone,
+		Moderators
+	}
+
 	public enum GroupRole
 	{
 		Member,
@@ -1,3 +1,4 @@
+using MongoDB.Bson.Serialization.Attributes;
 using MongoDB.Entities;

 namespace PrivaPub.Models.Post
@@ -11,10 +12,12 @@ namespace PrivaPub.Models.Post
 		public string InReplyToAccountId { get; set; }
 		public string GroupId { get; set; }
 		public string ConversationId { get; set; }//DmGroup.ID of a direct post
+		public string AudienceURI { get; set; }//a remote community the post was made in
 		public string ReblogOfPostId { get; set; }
 		public PostVisibility Visibility { get; set; }
 		public string Title { get; set; }
 		public string SpoilerText { get; set; }
+		public string Excerpt { get; set; }//a non-Note's summary: a teaser, a description, an event's date and place
 		public string Text { get; set; }
 		public string ContentHtml { get; set; }
 		public ContentFormat ContentFormat { get; set; }
@@ -24,11 +27,16 @@ namespace PrivaPub.Models.Post
 		public List<PostMedia> Media { get; set; } = new();
 		public List<float> Location { get; set; } = new();
 		public float RangeKm { get; set; } = 5.0f;
+		[BsonIgnoreIfNull]
+		public Coordinates2D Geo { get; set; }
+		[BsonIgnoreIfNull]
+		public double? Distance { get; set; }
 		public bool HasContentWarning { get; set; } = false;
 		public bool IsLocalOnly { get; set; }

 		public bool IsFederatedCopy { get; set; }
 		public string ObjectURI { get; set; }//the Note's id
+		public string ObjectType { get; set; }//the remote object's type: Note, Article, Page, Video, Event…; null for local posts
 		public string ActivityURI { get; set; }//the Create's id
 		public string ActorURI { get; set; }//attributedTo
 		public string Url { get; set; }
@@ -32,12 +32,13 @@ namespace PrivaPub.Models.User

 		public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+		public DateTime PublishedOn { get; set; } = PrivacyIds.PublishedDay(DateTime.UtcNow);//the actor's published: a few days before CreatedAt, so same-day personas differ
 		public DateTime? SilencedAt { get; set; }
 		public DateTime? SuspendedAt { get; set; }
 		public DateTime? BannedAt { get; set; }
 		public DateTime? DeletionAt { get; set; }

-		public override object GenerateNewID() => PrivacyIds.ForDay(DateTime.UtcNow);
+		public override object GenerateNewID() => PrivacyIds.ForDay(PublishedOn);
 	}

 	public class ForeignAvatar : Entity
@@ -21,6 +21,8 @@ using PrivaPub.Models;
 using PrivaPub.Services;
 using PrivaPub.StaticServices;

+Log.Logger = new LoggerConfiguration().WriteTo.Console().CreateBootstrapLogger();
+
 try
 {
 	var builder = WebApplication.CreateBuilder(args);
@@ -71,8 +73,8 @@ try
 	}

 	var federationOptions = builder.Configuration.GetSection("Federation").Get<FederationOptions>() ?? new();
-	if (builder.Environment.IsProduction() && (federationOptions.AllowPrivateNetworks || federationOptions.AllowPlainHttp))
-		throw new InvalidOperationException("Federation:AllowPrivateNetworks and Federation:AllowPlainHttp are for test networks and must stay off in Production.");
+	if (builder.Environment.IsProduction() && (federationOptions.AllowPrivateNetworks || federationOptions.AllowPlainHttp || federationOptions.AcceptAnyCertificate))
+		throw new InvalidOperationException("Federation:AllowPrivateNetworks, AllowPlainHttp and AcceptAnyCertificate are for test networks and must stay off in Production.");

 	try
 	{
@@ -189,4 +191,8 @@ catch (Exception ex)
 	Log.ForContext<Program>().Fatal(ex, $"{nameof(Program)}.{nameof(Program)}()");
 	Environment.ExitCode = 1;
 }
+finally
+{
+	await Log.CloseAndFlushAsync();
+}

@@ -116,6 +116,7 @@ namespace PrivaPub.Services
 					PrivateKey = privateKey,
 					PublicKey = publicKey,
 					Kind = form.IsCommunity ? GroupKind.Community : GroupKind.Circle,
+					PostingPolicy = Policy(form.PostingPolicy) ?? PostingPolicy.Followers,
 					IsDiscoverable = form.IsDiscoverable,
 					ManuallyApprovesMembers = form.ManuallyApprovesMembers,
 					OwnerAvatarId = form.AvatarId,
@@ -157,6 +158,8 @@ namespace PrivaPub.Services
 					group.Description = form.Description;
 				if (form.IsDiscoverable.HasValue)
 					group.IsDiscoverable = form.IsDiscoverable.Value;
+				if (Policy(form.PostingPolicy) is { } policy)
+					group.PostingPolicy = policy;
 				if (form.ManuallyApprovesMembers.HasValue)
 					group.ManuallyApprovesMembers = form.ManuallyApprovesMembers.Value;
 				if (form.RemoveInvitationPassword)
@@ -316,6 +319,14 @@ namespace PrivaPub.Services
 			!string.IsNullOrEmpty(rootUserId) && !string.IsNullOrEmpty(avatarId)
 			&& await _dbEntities.RootToAvatars.Match(ra => ra.RootId == rootUserId && ra.AvatarId == avatarId).ExecuteAnyAsync(token);

+		static PostingPolicy? Policy(string value) => value?.ToLowerInvariant() switch
+		{
+			"anyone" => PostingPolicy.Anyone,
+			"moderators" => PostingPolicy.Moderators,
+			"followers" => PostingPolicy.Followers,
+			_ => (PostingPolicy?)null
+		};
+
 		static string NewInvitationCode() => $"{Guid.NewGuid():N}{Guid.NewGuid():N}";

 		ViewGroup ToView(GroupEntity group, string avatarId)
@@ -331,6 +342,7 @@ namespace PrivaPub.Services
 				Url = actor.Uri,
 				Handle = actor.Handle,
 				IsCommunity = group.Kind == GroupKind.Community,
+				PostingPolicy = group.PostingPolicy.ToString().ToLowerInvariant(),
 				IsDiscoverable = group.IsDiscoverable,
 				ManuallyApprovesMembers = group.ManuallyApprovesMembers,
 				IsOwner = group.OwnerAvatarId == avatarId,
@@ -1,5 +1,6 @@
 using Microsoft.Extensions.Localization;

+using MongoDB.Driver;
 using MongoDB.Entities;

 using PrivaPub.ClientModels;
@@ -27,6 +28,7 @@ namespace PrivaPub.Services
 		Task<WebResult> InsertPost(string rootUserId, InsertPostForm form, CancellationToken token);
 		Task<WebResult> DeletePost(string rootUserId, DeletePostForm form, CancellationToken token);
 		Task<WebResult> UpdatePost(string rootUserId, UpdatePostForm form, CancellationToken token);
+		Task<WebResult> Nearby(string rootUserId, string avatarId, double latitude, double longitude, CancellationToken token);
 		Task<WebResult> GetPosts(string rootUserId, string avatarId, string groupId, CancellationToken token);
 		Task<WebResult> InsertDm(string rootUserId, InsertDmForm form, CancellationToken token);
 		Task<WebResult> GetDms(string rootUserId, string avatarId, string dmGroupId, CancellationToken token);
@@ -68,7 +70,10 @@ namespace PrivaPub.Services
 				Sensitive = form.HasContentWarning,
 				Visibility = LocalVisibility(form.Visibility),
 				InReplyTo = form.AnsweringToPostId,
-				GroupId = form.GroupId
+				GroupId = form.GroupId,
+				Latitude = form.Latitude,
+				Longitude = form.Longitude,
+				RangeKm = form.RangeKm
 			}, token), nameof(InsertPost));
 		}

@@ -193,6 +198,35 @@ namespace PrivaPub.Services



+		public async Task<WebResult> Nearby(string rootUserId, string avatarId, double latitude, double longitude, CancellationToken token)
+		{
+			var result = new WebResult();
+			var viewer = await OwnedAvatar(rootUserId, avatarId, token);
+			if (viewer == default)
+				return result.Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound);
+			if (latitude is < -90 or > 90 || longitude is < -180 or > 180)
+				return result.Invalidate(_localizer["Invalid model."]);
+
+			var query = new MongoDB.Bson.BsonDocument
+			{
+				["Visibility"] = (int)PostVisibility.LocalGeo,
+				["DeletedAt"] = MongoDB.Bson.BsonNull.Value
+			};
+			var candidates = await DB.Default.GeoNear<PostEntity>(new Coordinates2D(longitude, latitude), p => p.Distance, true, 50_000, default, default, query)
+				.Limit(200)
+				.ToListAsync(token);
+			var near = candidates.Where(p => p.Distance <= p.RangeKm * 1000).ToList();
+			var hidden = await Domain.Relationships.Hidden.AuthorsHiddenFrom(viewer.Id, near.Select(p => p.ActorURI), forNotifications: false, token);
+			result.Data = near.Where(p => !hidden.Contains(p.ActorURI)).Select(p =>
+			{
+				var view = ToView(p);
+				view.RangeKm = p.RangeKm;
+				view.DistanceKm = Math.Round(p.Distance.Value / 1000, 1);
+				return view;
+			}).ToList();
+			return result;
+		}
+
 		async Task<WebResult> Answer(Func<Task<StatusOutcome>> action, string operation)
 		{
 			var result = new WebResult();
@@ -61,7 +61,7 @@ namespace PrivaPub.Web.Pages
 		public async Task<IActionResult> OnGetAsync(string user, CancellationToken token)
 		{
 			Actor = await _localActors.FindByUserName(user, token);
-			if (Actor is not { IsFederated: true } || Actor.Kind == LocalActorKind.Application)
+			if (Actor is not { IsFederated: true, IsCircle: false } || Actor.Kind == LocalActorKind.Application)
 				return NotFound();
 			if (WantsActivityJson())
 				return Redirect(Actor.Uri);
@@ -0,0 +1,771 @@
+# Interop: what every peer sends, what it expects, and what PrivaPub still drops
+
+Research as of **2026-10-01**: the platforms' source on their default branches, live ActivityPub fetches from large
+instances, release notes and the FEP repository. Version numbers are what was current that day. Claims the
+research could not confirm from a primary source are marked *(unconfirmed)*. The sources are at the end.
+
+This file is for two readers:
+- **Whoever changes federation code.** Every gotcha below has broken somebody.
+- **Whoever builds the rich client.** That client shows every kind of fediverse content in one place, with a secondary
+  "details" view of the raw object and how it reached us. Section 4 says what the server must keep for it.
+
+Priorities, used throughout:
+
+| Priority | Meaning |
+|---|---|
+| **P1** | Breaks interop, or loses content the user would see. |
+| **P2** | Degrades the experience. |
+| **P3** | Nice to have. |
+
+## 1. Where PrivaPub stands (checked in the code, 2026-10-01)
+
+**Already right**
+- **Public addressing:** all three spellings are recognised (`…#Public`, `as:Public`, `Public`).
+- **Undo:** embeds its whole object, which Misskey needs; it fetches the object only when it isn't embedded.
+- **Content types:**
+  - Served documents are `application/activity+json; charset=utf-8`, which is on Lemmy's exact allowlist and is
+    accepted by GoToSocial and Misskey.
+  - WebFinger answers `application/jrd+json`, and answers for the actor URL as well as `acct:`. Akkoma and
+    Iceshrimp.NET require both.
+- **SSRF guard:**
+  - Its IPv6 rule is an allowlist (`2000::/3` only), so IPv4-compatible `::a.b.c.d`, NAT64 and the other tricks behind
+    Mastodon's GHSA-vwhj (Jul 2026) are already refused.
+  - It caps fetches at 1 MB. Misskey caps at 256 KiB, so keep our own documents well under that.
+- **Attachments:**
+  - Up to 16 are kept. Mastodon drops anything past 4; Pixelfed albums and Threads carousels go beyond it.
+  - `{type: Link}` attachments are not mistaken for media.
+- **Deleted posts** answer 410 with a `Tombstone`. Actor `published` is truncated to the day. The `webfinger` property
+  (FEP-2c59) is on every actor.
+- **Live check:** the whole follow, post, reply, like, boost, DM, edit and delete set round-trips with GoToSocial
+  0.22.1 (`tools/pasture/`).
+
+**Wrong at the time of the research (P1, cheap; all three fixed in v1.7.0)**
+- **`summary` is read as a content warning on every object type.** It is one only on a `Note`, or when
+  `sensitive: true` is set. Elsewhere it is something else:
+
+  | Sender | What `summary` holds |
+  |---|---|
+  | WordPress, WriteFreely, Ghost, NodeBB (`Article`) | a teaser or excerpt |
+  | Mobilizon, Gancio (`Event`) | the date and address, or the whole description |
+  | Funkwhale (`Audio`) | a line of hashtags |
+  | Mbin (`Page`) | a short title plus tags |
+
+  Today all of these arrive hidden behind a warning, and marked sensitive.
+- **Persona and group usernames are only lowercased.** Mastodon accepts `[a-z0-9_]` with `.` and `-` only inside the
+  name; Misskey `^\w([\w-.]*\w)?$`, 128 characters at most. A persona named outside that is unreachable from either.
+- **Our JSON-LD context does not define `postingRestrictedToMods`.** Iceshrimp.NET runs full JSON-LD expansion and
+  silently drops every undefined term. Any term we add later (`quote`, `Emoji`, `EmojiReact`, `interactionPolicy`,
+  `votersCount`) must be defined in `ActivityPubRenderer.Context()` in the same commit.
+
+**Smaller**
+- No `Vary: Accept` on actor and object URLs, although they answer HTML or JSON depending on `Accept`.
+- Only `create-…` and `announce-…` activity ids dereference. `follow-`, `like-`, `accept-` and `undo-…` answer 404.
+  That is harmless while objects are embedded, but every id should resolve.
+
+## 2. Rules that hold across platforms
+
+| # | Rule | What PrivaPub must do | P |
+|---|---|---|---|
+| W1 | `url`, `icon`, `image`, `attributedTo`, `actor`, `tag`, `attachment` and `alsoKnownAs` can each be a single value, an object or an array. The `url` array matters most: PeerTube video files, Funkwhale streams, and Bridgy posts, whose `rel: canonical` link is `at://…`. | Parse every shape. For "open original", use the `text/html` Link. Keep every other Link as a media variant. | P1 |
+| W2 | `summary` is a content warning only on a `Note`, or when `sensitive: true`. | See §1. On other types store it as an excerpt or description. NodeBB 4.16 honours a CW only on a sensitive Note. | P1 |
+| W3 | `content` can be Markdown. PeerTube descriptions and comments carry `mediaType: text/markdown`. | Render it, then sanitise. Keep `source{content, mediaType}`: Markdown, BBCode, `text/x.misskeymarkdown` (MFM). | P1 |
+| W4 | `mediaType` is missing or wrong: Bridgy media has none, Funkwhale hard-codes `audio/mpeg`, Gancio `image/jpeg`. Mastodon types every attachment `Document`. | Infer it from the object or attachment type, then sniff it in the media proxy. | P1 |
+| W5 | Thumbnails live in five places: attachment `icon` (Mastodon), object `icon[]` (PeerTube), object `preview` (Loops), `image` (Bridgy video; Ghost as a bare string; WordPress), and `icon` (Plume). | Keep them all; choose one per kind. | P1 |
+| W6 | `Accept`, `Reject` and `TentativeAccept` are not always follow answers. Friendica and Hubzilla use them as event RSVPs; Mobilizon answers a `Join`; GoToSocial answers interaction requests with `result`; Mastodon answers a `QuoteRequest`. | Route on what the object *is*. | P1 |
+| W7 | `id` is not the page a person opens. WordPress uses `?p=123`, Ghost `/.ghost/…`, Bridgy `/convert/ap/at://…`. | Link to `url`, never to `id`. | P1 |
+| W8 | Rich types are updated in place: PeerTube live state, WordPress (on every save), Mobilizon. A poll's counts are refreshed with an `Update{Question}` that changes nothing else. | Apply Updates to every kind. An Update with no newer `updated` is a refresh, never an edit revision. Mastodon applies the same rule. | P1 |
+| W9 | A `Delete` can arrive before its `Create`, and relays and forwarders re-send old Creates. | Keep tombstones so deleted posts stay deleted. When the deleter is not the author, confirm with the origin: 404 or 410 means deleted. | P1 |
+| W10 | Time comes in seconds (Mastodon), milliseconds (Misskey, us), or with offsets. `-00:00` means floating local time (Hubzilla events). `duration` is ISO 8601 (`PT6299S`). GoToSocial rejects a status whose `updated` is earlier than `published`. | Parse all of these, and clamp future times. Order by arrival (PrivacyIds.Arrived). Never emit `updated` < `published`. | P1 |
+| W11 | Language may be in `contentMap`, in `@context[].@language` (Pleroma 2.9+), or a `language{identifier,name}` object (Lemmy, PeerTube). Akkoma replaces `content` with the *first* `contentMap` entry. | Read all three. When sending, put `content` and the primary `contentMap` entry first and keep them equal. | P2 |
+| W12 | Alt text: `name` (Mastodon), `summary` (GoToSocial 0.20.0, Akkoma reads it first), or their `*Map` forms. Avatar and header alt is in `icon.name`/`image.name`, or `summary` on Mastodon. | Read both; send `name`. | P2 |
+| W13 | `"id": null` objects (Akkoma); a `Tombstone` served with **200** as a soft delete (FEP-4f05: NodeBB, Discourse); 410 for deleted GoToSocial 0.22 statuses. | Accept a null id inside an activity; never emit one. Any `Tombstone`, whatever the status code, means deleted. | P2 |
+| W14 | Size limits on the receiving side: Misskey reads at most 256 KiB, truncates text at 8192 characters, CW 512, poll choice 256, alt 512. GoToSocial takes emoji up to 100 KB. Peers cap fetches at about 1 MB. | Accept long posts from others. Keep our own documents small. | P2 |
+| W15 | Hashtag `name` comes with or without `#`. Mastodon normalises with NFKC + lowercase (watch Turkish `İ`). Lemmy adds an automatic `#<community>` tag to every post. | Normalise the same way; ignore Lemmy's automatic tag. | P3 |
+
+## 3. Per platform
+
+### Mastodon: 4.7.2 (2026-09-15); mastodon.social runs 4.8 alpha; client `api_versions.mastodon` = 11
+
+**Emits**
+- **Objects and activities:**
+  - Objects: `Note` and `Question` only.
+  - Federated `Block`.
+  - `Add`/`Remove` for pins, featured hashtags and featured collections (4.6, FEP-7aa9).
+  - `Move`.
+  - `QuoteRequest`, its `Accept`/`Reject` (with `result`), and `Delete{QuoteAuthorization}`.
+  - `FeatureRequest`/`FeatureAuthorization` (4.6).
+- **Threads:** `context` is a dereferenceable collection of the thread (FEP-7888, threads started on 4.5+).
+- **Interaction counts:** `likes` and `shares` carry `totalItems`.
+- **Quotes:** `quote`, plus `quoteUri` and `_misskey_quote`, `quoteAuthorization`, and `interactionPolicy.canQuote`.
+- **Link previews:** from 4.7, a `{type: Link, href}` **attachment** names the link a card is made from (FEP-8967).
+- **Attachments:** `duration`, and `icon` thumbnails.
+- **Actors:**
+  - `webfinger`, `featuredCollections`, `interactionPolicy.canFeature`, `attributionDomains`;
+  - `memorial`, `suspended`, `indexable`, `discoverable`;
+  - avatar and header alt text in `summary`;
+  - several keys allowed (4.6).
+- **Ids:** new accounts get numeric actor ids (4.5). Remote renames are accepted, keyed on the actor `id` (4.7).
+
+**Expects**
+- **Fetched documents:**
+  - `id` equals the URL requested, exactly.
+  - The type is `activity+json`, or `ld+json` with the profile.
+  - `@context` includes the ActivityStreams URL.
+- **WebFinger:** it loops back to the same `id`.
+- **draft-cavage signatures:**
+  - `(request-target)` includes the query string (4.3).
+  - `digest` is signed on POST and `host` on GET.
+  - The window is 12 h, with 1 h of skew.
+  - Mastodon no longer signs `Accept` (4.6). Never require it.
+- **RFC 9421:** verified by default since 4.5.0.
+  - A request carries one signature only.
+  - It must cover `@method`, `@target-uri` and `content-digest`, and include `created` and `keyid`.
+  - **4.7 double-knocks:** it signs draft-cavage first, and if we answer 400 or 401 it retries with RFC 9421. A 400 for
+    any other reason therefore triggers a retry we would fail.
+  - Mastodon answers **503** when it temporarily cannot fetch a key; that is a retry, not a failure.
+- **Edits:** an Update counts as an edit only with a newer `updated`.
+- **Quotes:** a post with no `canQuote` **cannot be quoted** by Mastodon users at all. A quote without a valid stamp
+  stays "pending", and only its fallback link shows.
+- **Fetch all replies** is always on (4.5). Mastodon crawls `replies` as its instance actor, up to 500 per post, and
+  **deletes its copy** when a refetch answers 404.
+- **Converted types:** `Article`, `Page`, `Event`, `Video`, `Audio` and `Image` become `<h2>name</h2>` + summary +
+  link. **The body is dropped.** Only `Mention` tags notify. Previews come from fetching the page; FEP-8967's
+  `preview` is ignored.
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Quotes: read all keys; verify the `QuoteAuthorization` (type, host, `attributedTo`, `interactingObject`, `interactionTarget`; GHSA-vg36 compared domains only); revocation; strip the `.quote-inline` fallback | P1 | `Status.quote{state, quoted_status}`, `quotes_count`, `/statuses/:id/quotes`, `quote`/`quoted_update` notifications, `api_versions.mastodon ≥ 7` |
+| Being quotable: emit `canQuote`; answer `QuoteRequest` with `Accept{object: request id, result: stamp}`; serve and revoke stamps | P2 | `Status.quote_approval`, `PUT /statuses/:id/interaction_policy` |
+| Polls (see §3 Misskey for vote shapes) | P1 | `Status.poll`, `/polls/:id`, `/polls/:id/votes`, `poll` notification |
+| Custom emoji on posts, names, fields and poll options, proxied, refreshed by `updated` | P1 | `Status.emojis`, `Account.emojis` |
+| Link attachments as the card source | P1 | `Status.card` |
+| Inbound `Move` with Mastodon's checks (`target` re-fetched, its `alsoKnownAs` lists the old account, 7-day lock); move each persona's follow | P1 | `Account.moved` |
+| Re-run WebFinger when `preferredUsername` changes; key accounts on the actor id | P2 | `Account.acct` |
+| Inbound `Block`: stop delivering, hide | P2 | `relationship.blocked_by` |
+| `Add`/`Remove` featured (pins, tags) | P2 | `GET /accounts/:id/statuses?pinned=true` |
+| Remote like and boost totals | P2 | counts |
+| Publish `context` and a paged `replies` | P2 | — |
+| `FeatureRequest`: send `Reject` (or implement FEP-7aa9) | P3 | — |
+
+### GoToSocial: 0.22.1 (2026-07-20)
+
+**Emits**
+- **Objects:** `Note` and `Question` only.
+- **Interaction policies** on every status: `canLike`, `canReply`, `canAnnounce` and `canQuote`, each split into
+  `automaticApproval` and `manualApproval`.
+  - Defaults: open on public and unlisted posts.
+  - On followers-only posts, liking and replying are limited to the author, followers and mentioned accounts, and
+    boosting to the author.
+  - `canQuote` is author-only on every post (0.21).
+- **Since 0.21 it asks politely:** `LikeRequest`, `ReplyRequest` and `AnnounceRequest`, with the interaction in
+  `instrument`. The answer is `Accept`/`Reject` whose `result` is a `*Authorization`. The interaction then carries
+  `replyAuthorization` (with `approvedBy` as the legacy fallback).
+- **Keys and actors:**
+  - The key id is `…/main-key` (no `#`), and its document is a stub actor.
+  - There is **no `sharedInbox`**.
+  - `hidesToPublicFromUnauthedWeb` / `hidesCcPublicFromUnauthedWeb`, `indexable`.
+  - `featured` holds URIs only, and changes to it are never announced, so read it instead.
+- **What it leaves out:**
+  - `context`;
+  - `likes`/`shares`;
+  - attachment `width`/`height`.
+- **Deleted statuses:** 0.22 keeps a stub and answers 410.
+
+**Expects**
+- **Signed requests:** every GET and POST is signed, draft-cavage only, with RSA keys. **No RFC 9421 in either
+  direction.**
+- **Key handshake:** the instance actor and key documents must be served **unsigned**, or both sides deadlock fetching
+  each other's keys. Ours are: SecureMode exempts the instance actor.
+- **Content-Type:** an inbox POST must be `activity+json`, or `ld+json` with the profile. Anything else gets 406.
+- **Activities:** one without an `id` is dropped. A 400 is never retried.
+- **Keys:** a changed public key on refresh is refused. **Never rotate keys silently.**
+- **Interaction policies:**
+  - Third-party GoToSocial servers drop replies that have no valid `replyAuthorization`.
+  - On followers-only GoToSocial posts, send `ReplyRequest` / `LikeRequest` instead of a bare Create or Like.
+- **Rate limit:** 300 requests per 5 minutes per IP, answered with 503 and `Retry-After`.
+- **Not accepted:** top-level `Audio`.
+- **Timelines:** its cached home timeline can miss new posts. Check a delivery by URI, not through its timelines; see
+  CLAUDE.md, "Testing".
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Store remote `interactionPolicy` (with GoToSocial's defaults); disable or mark actions | P1 | GoToSocial-style `Status.interaction_policy` |
+| Send `ReplyRequest`/`LikeRequest` where approval is needed; handle `Accept{result}`/`Reject`; attach the authorization | P1 | own: pending/approved/rejected on our own reply |
+| Honour 503 with `Retry-After` in delivery and in the proxy | P1 | — |
+| Respect `hides*FromUnauthedWeb` on our public pages; emit it for personas (it suits the privacy design) | P2 | — |
+| Measure media size when proxying | P2 | `MediaAttachment.meta` |
+| Only advertise the policies we enforce | P2 | — |
+
+### Misskey family: Misskey 2026.10.0, Sharkey 2025.4.7, Iceshrimp.NET 2026.1.2-beta, CherryPick 4.17
+
+Firefish is dead (its site has answered 410 since February 2025).
+
+**Emits**
+- **Text and quotes:**
+  - `_misskey_content` plus `source{content, mediaType: text/x.misskeymarkdown}` (MFM).
+  - The quote is `_misskey_quote`/`quoteUrl`, plus a `RE:` fallback inside the content.
+  - An empty CW is a zero-width space.
+- **Attachments:** each carries its own `sensitive`.
+- **Emoji tags** carry `_misskey_license`.
+- **Polls:** `Question` with `oneOf`/`anyOf`. Counts are in `replies.totalItems` per option. `endTime` and `closed` are
+  set; there is **no `votersCount`**.
+  - A vote is `Create{Note{name, inReplyTo, to:[owner]}}`, one per choice.
+  - Every vote triggers an `Update{Question}`.
+- **Reactions** are `Like{content: "👍"|":name:", _misskey_reaction, tag:[Emoji]}`.
+  - One reaction per user per note; a plain like is `❤`.
+  - They are sent to the author **and to the reactor's followers**.
+- **Actors:**
+  - `isCat`, `_misskey_summary`, `_misskey_followedMessage`;
+  - `_misskey_requireSigninToViewContents`;
+  - `_misskey_makeNotesFollowersOnlyBefore`/`HiddenBefore` (seconds; a negative value is relative to now);
+  - `vcard:bday`, `vcard:Address`, `backgroundUrl`.
+- **Vanilla Misskey has no edits.**
+- **Sharkey adds:**
+  - edits;
+  - a FEP-e232 quote `Link` tag (it deliberately leaves out `quote`);
+  - a `replies` collection;
+  - `hideOnlineStatus`, `noindex`, `enableRss`, `speakAsCat`.
+  - It sends contentless Likes only to Mastodon-like peers, so **we always receive Like+content**.
+- **Iceshrimp.NET adds:**
+  - `EmojiReact`, several per user, and `:name@host:` for remote emoji;
+  - a FEP-7888 `context`;
+  - `htmlMfm: true` (FEP-c16b);
+  - every `QuoteRequest` is auto-accepted;
+  - `Bite`, `pronouns`.
+- **CherryPick adds:** events on a plain Note (`startTime`/`endTime`), `deleteAt`, and federated chat
+  (`_misskey_talk: true`).
+
+**Expects**
+- **Inbound signatures:**
+  - draft-cavage over `(request-target) host date digest`;
+  - at most 300 s of skew;
+  - since 2026.10.0, the query string is included in `(request-target)`.
+  - **No RFC 9421 anywhere in the family.**
+- **Activities:**
+  - An activity's `id` must be on the signer's host.
+  - Activities forwarded on behalf of someone else are refused. A group must `Announce`.
+  - Misskey answers 202 even when it drops something, so errors stay invisible.
+- **Fetched documents:** request URL = final URL = `id`; ≤256 KiB; `activity+json` or `ld+json`.
+- **Actor collections** must be on the actor's host.
+- **Visibility:** Misskey recognises followers-only by the author's own `followers` URL, matched exactly. Otherwise:
+  - **A "specified" (direct) note with no resolvable recipients that Misskey fetches by URL is stored as public.**
+    Circle objects must therefore never be served to an unauthorised fetcher. They aren't: 404.
+- **Groups:** vanilla Misskey drops `Announce{Create}`, so groups should `Announce` the Note itself. We send both.
+- **Reactions:** must be `:name:` with no host, plus an Emoji tag, or they fall back to ❤.
+- **Article/Page titles** are never shown in Misskey's web UI.
+- **Iceshrimp.NET:**
+  - full JSON-LD expansion (see §1);
+  - `@graph`, `@reverse` and `@included` are refused;
+  - every actor must resolve through WebFinger;
+  - `preferredUsername` must be unique per domain. PrivaPub shares one name space across personas and groups, so this
+    holds.
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Emoji reactions in all three inbound forms: Like with `content`/`_misskey_reaction`, `EmojiReact`, and `Dislike`-as-un-like (Sharkey). Normalise `:n:`, `:n@host:` and `n@host`. Store per actor, emoji and activity, including reactions to remote posts. Undo by id. | P1 | `emoji_reactions` and `pleroma.emoji_reactions` `[{name,count,me,url,static_url}]` (Phanpy reads the first); `PUT/DELETE /api/v1/pleroma/statuses/:id/reactions/:emoji` |
+| Outbound reaction as `EmojiReact{content: ":name:", tag:[Emoji]}`. A plain Like stays a favourite. | P2 | same |
+| Polls: per-option counts (fall back to `_misskey_votes`); `votersCount` null when absent; `Update{Question}` is a refresh; an inbound `Note{name, inReplyTo: question}` with no content is a vote, never a reply | P1 | `Status.poll` |
+| Keep MFM source; let the sanitiser keep `<span class="mfm-*" data-mfm-*>` and `<ruby>` (FEP-c16b) | P2 | `text`, `content_type`; the rich client renders MFM from the source |
+| Per-attachment `sensitive`; `isCat` and other actor extras; enforce `requireSignin…` and `makeNotes…Before` on our public pages | P2 | own `privapub.*` |
+| Quotes: when we send one, send every key (`quote`, `_misskey_quote`, `quoteUrl`, `quoteUri`, a FEP-e232 tag, the `RE:` fallback) | P2 | — |
+
+### Pleroma 2.10.2 and Akkoma 3.20.1
+
+**Emits**
+- **Notes:**
+  - `@context` with the instance's own `litepub-0.1.jsonld` URL (never fetch it) and `@language`;
+  - `source{content, mediaType: text/markdown}`;
+  - `context` and `conversation` holding the same value;
+  - `quoteUrl`/`quoteUri`.
+- **Edit history:** `formerRepresentations`, an OrderedCollection of earlier versions.
+- **Reactions:** `EmojiReact{content: ":name:", tag:[Emoji]}`, several per user; separate from Like.
+- **Polls:** `votersCount` (Pleroma 2.10.1, Akkoma 3.20). A vote is a `Note{name, inReplyTo, to:[], cc:[owner]}`.
+- **Pleroma only:**
+  - `ChatMessage`, sent only to actors with `capabilities.acceptsChatMessages`;
+  - `Listen{Audio}`;
+  - outgoing `Block` is on by default.
+- **Akkoma only:**
+  - local-only posts are addressed to `<base>/#Public`, which is **not** public;
+  - FEP-2c59.
+
+**Expects**
+- **Pleroma's inbox guard answers 400 for unknown activity types:** `Move`, `QuoteRequest` and `Bite` are not on its
+  list (develop, 2026-09-30). Treat that 4xx as final.
+- **Signatures (Akkoma):** `host` must be signed and match; signatures up to 2 h old and up to 40 min in the future.
+- **Activity ids** must be at least 8 bytes.
+- **ObjectAgePolicy** (default in both) delists anything older than 7 days, so `published` must be accurate.
+- **Quotes:** Pleroma's InlineQuotePolicy rewrites incoming quotes into "RT: url" text. **Neither reads FEP-044f
+  `quote`**, so send `quoteUri` and `_misskey_quote` as well.
+- **Edits:** a changed `name` is ignored on update.
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Language from `@context[].@language` | P1 | `Status.language` |
+| `formerRepresentations` → our revisions | P2 | `/statuses/:id/history` |
+| `context`/`conversation` threading; parents and quotes we could not fetch, kept as URIs | P2 | `pleroma.context`; `akkoma.in_reply_to_apid`, `akkoma.quote_apid` precedent |
+| `ChatMessage` in as a direct message (also needed for Lemmy, Mbin and PieFed); advertise `acceptsChatMessages` only once it is answered | P1 (in), P3 (out) | `visibility: direct`, Conversations |
+| `Listen`, `vcard:bday`, `backgroundUrl` | P3 | own |
+
+### Lemmy: 0.19.20 live (lemmy.ml); 1.0.0-beta.2 (2026-09-25) in beta since May
+
+join-lemmy.org's federation page is out of date. Current Lemmy neither sends nor reads `stickied` or `commentsEnabled`
+on a Page: pins live in `featured`, locks in `Lock`.
+
+**Emits**
+- **Group:**
+  - `summary` (sidebar HTML) and `source` (sidebar Markdown); a plain `description` in 1.0;
+  - `sensitive`; `attributedTo` → the moderators collection; `featured`; `postingRestrictedToMods`; `language[]`;
+  - 1.0 adds: `manuallyApprovesFollowers` for private communities, `discoverable: false` for unlisted ones, and the
+    community's post tags in `tag[]` as `CommunityPostTag` with colour slots `color01`–`color10`.
+- **Page (post):**
+  - `name`, `content` and `source`;
+  - a link post is `attachment[0] = Link{href, mediaType}`, with `image` as the thumbnail;
+  - 1.0 image posts are `Image{url, name}`, where `name` is the alt text;
+  - `language{identifier, name}`, `audience`, `to: [community, Public]`;
+  - an automatic `#<community>` hashtag;
+  - 1.0 adds a Mention of the community and `context`.
+- **Note (comment):** `distinguished`.
+- **Votes:** `Like`/`Dislike` as `{actor, object, audience}` with no `to`/`cc`, and their `Undo`.
+- **Moderation:**
+  - a `Delete` with a `summary` is a mod removal (1.0 adds `withReplies`); its `Undo` restores;
+  - `Lock`/`Undo{Lock}` (1.0 also on comments);
+  - a ban is `Block{target, removeData, summary, endTime}` (0.19 also sends `expires`);
+  - `Add`/`Remove` of featured posts and moderators;
+  - `Update{Group}` **by the moderator Person**;
+  - 1.0 adds `Warn` and `Resolve{Flag}`.
+- **Delivery:** everything travels inside the community's `Announce`. For a new post Lemmy also sends a compatibility
+  `Announce(Page)` with a synthetic id; deduplicate it.
+- **Private messages:** `ChatMessage` on 0.19; a single-recipient `Note` on 1.0.
+- **Context:** 1.0's `context` collection is unpaged and **every comment's own context URL returns the whole post
+  thread**. Group threads by the root post, never by comparing `context` strings.
+- **Feeds:** multi-communities are 1.0's `type: Feed` actors.
+
+**Expects**
+- **Fetched documents:** Content-Type exactly one of `activity+json`, `activity+json; charset=utf-8`, or `ld+json` with
+  the profile; and `id` equals the URL fetched.
+- **Addressing:**
+  - Create, Update, Lock, Delete and Block **must carry both `to` and `cc` arrays**.
+  - A post's community is the first Group found in `to` ∪ `cc`.
+  - In a public community, the object, the activity **and the Announce** all include Public.
+- **Accepted types:** Page, Article, Note, Video and Event become posts. **`Question` is dropped.**
+- **Anti-spam:** activities for a community are accepted only if a local user follows it.
+- **Actors:** a Create, vote, moderation action or Flag must come from a Person, Service or Organization. **A Group or
+  Application actor fails to parse**, so moderation comes from the moderator Person. Our Flags, sent by an
+  Application instance actor, probably fail *(unconfirmed)*.
+- **Flags:** exactly one `to` (community or site); `object` a URL or an array; the reason in `summary` or `content`.
+- **Moderation trust:** an action is trusted when it is on the community's or the object's host (FEP-fe34), or when its
+  actor is in the moderators list Lemmy fetched.
+- **1.0 hides a local user's post or comment in a remote community until that community Announces it back.** A
+  community we host must therefore announce to the author's own instance too.
+- **Refused:** Lemmy does not accept an incoming `Announce(Page)`.
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| `Dislike` and its `Undo`: a vote ledger per object (actor, ±1, activity, relaying group, time) | P1 | `favourites_count` = upvotes; own `privapub.vote{score, up, down, mine}`, `POST …/vote` |
+| Announces of activities other than Create (votes, moderation): trust the inner activity when the object's own group signed the Announce; refetching every vote does not scale. Keep the origin refetch for Create and Update. | P1 | — |
+| Moderation state: removals (reason, by, at, cascade), locks, bans with `endTime`/`removeData`, featured, moderators, `Update{Group}` by a moderator | P1 | removed posts hidden plus `privapub.removed`; `privapub.locked` (replying answers 422); pins as `pinned=true` |
+| Link posts: keep `Link.href`, the thumbnail `image` and alt text; build the card (Lemmy sends no title or description for the link) | P1 | `Status.card` |
+| `ChatMessage` in and out (out only to Lemmy < 1.0 and Mbin; `Note` to everyone else) | P1 | `visibility: direct` |
+| Outbound shape for Lemmy: both `to` and `cc`; the community in `to`; Public in the object, Create and Announce; votes and comments sent to the community inbox | P1 | — |
+| Communities we host: announce to every follower instance including the author's; pick `Announce(object)` per peer by NodeInfo (as PieFed does) | P1 | — |
+| Flags from a `Service`-typed reporter actor with `to: [community]`; the reporter stays anonymous | P2 | — |
+| `Warn` → `moderation_warning` notification; `Resolve{Flag}` | P2 | AccountWarning |
+| Remote communities: `description`, `language[]`, private (`locked`), `discoverable`; post tags | P2 | `Account.locked`, own `privapub.flairs[]` |
+| Serve our communities' collections the way Lemmy reads them: inline outbox of `Announce{Create{Page}}`, inline featured Pages, inline moderators. Lemmy does not page. | P2 | — |
+| `Feed` actors | P2 | group-like account |
+| Read 1.0 `context`, grouped by root post; cross-post detection by URL | P3 | — |
+
+### PieFed 1.7.17 and Mbin 1.10.1
+
+- **PieFed sends Lemmy's set plus:**
+  - posts: `commentsEnabled`, `stickied`, `nsfl`, `genAI`, `searchableBy`, `canQuote`;
+  - galleries of several Documents;
+  - **polls in communities** (`Question` with `votersCount`), and Mobilizon-style `Event`s;
+  - flairs in two dialects;
+  - comments: `repliesEnabled` (comment lock), `answer`, plus custom `ChooseAnswer` and `PollVote` activities;
+  - `Move{object: post}` between communities;
+  - `Feed` actors;
+  - emoji Likes and `EmojiReact` count as upvotes.
+- **How PieFed formats what it sends us:**
+  - It **chooses the format by our NodeInfo software name**, so keep that accurate.
+  - Software it lists as microblogs gets a bare `Announce(URL)`.
+  - A poll vote is recognised only when it is a `Note{name, inReplyTo}` **without `published`**.
+  - Batched Announces (FEP-1a11) go only to PieFed and Pylova.
+- **Mbin:**
+  - Thread `summary` is "short title + tags", so it is **not a CW**.
+  - On link threads `source` is a **plain URL string**.
+  - `commentsEnabled` and `stickied` are sent.
+  - A Person's `Announce` counts as an upvote; Mbin reads the `likes`/`dislikes`/`shares` counts we publish.
+  - Private messages are `ChatMessage`.
+  - The magazine outbox is empty.
+  - Mbin also auto-ingests Mastodon posts by hashtag and Announces them.
+- **Gaps:**
+  - **P1:** Lemmy's P1 set, W2, and tolerating `source` as a string.
+  - **P2:** galleries; community polls (vote without `published`); post `Move`; `repliesEnabled`; `nsfl`; flairs;
+    publish `likes`/`shares` totals.
+  - **P3:** `genAI`; accepted answers; batched Announces.
+
+### NodeBB 4.16, Discourse, Friendica
+
+- **NodeBB:**
+  - A topic's first post is an `Article` with `name`, **`summary` = an excerpt** and `preview`; replies are Notes.
+  - Categories are `Group`s **without `followers`**.
+  - `context` is a paged collection with an **ETag digest**; NodeBB refetches with `If-None-Match`.
+  - Since 4.15, an Announce of anything but a Create or a plain object is accepted only from Group actors.
+  - It sends `Move`/`Remove` of a whole context (FEP-f15d) and `Add{post → context}` (FEP-11dd).
+- **Discourse** (plugin, semi-dormant): categories and tags are Groups. "Full Topic" mode makes the topic an
+  OrderedCollection used as `context`.
+- **Friendica** (2026.05-1):
+  - Group accounts relay with `Announce(object)`.
+  - Titled posts are `Page`/`Article`; it sends `Dislike`.
+  - `instrument{Service}` names the software.
+  - It sends **`Follow` with a post as the object**, meaning "include me in this thread". Answer that with `Reject` or
+    ignore it, without an error.
+- **Gaps:**
+  - **P1:** W2 for NodeBB Articles (`privapub.excerpt`).
+  - **P2:** Groups without `followers`; Announces from an Application; context Move/Remove; paged `context` with ETag;
+    Friendica's thread-Follow.
+
+### PeerTube 8.3.1 (2026-09-28)
+
+**Emits**
+
+The account sends `Create{Video}`; the channel (a Group) sends `Announce{Video}`, so deduplicate.
+
+| Part of the Video | What it holds |
+|---|---|
+| Attribution | `attributedTo: [Person, Group]` (both, possibly bare URLs); `audience` = the channel |
+| Description | Markdown in `content` with `mediaType: text/markdown`; `summary` is the CW (since 7.2) |
+| `url[]` | A `text/html` watch page; per-resolution mp4 Links (`height`, `width`, `fps`, `size`, ffprobe codec types); HLS `application/x-mpegURL` (since 6.3 audio and video can be separate, with "0" as the audio-only resolution); torrent and magnet; a metadata JSON |
+| Images | `icon[]`: thumbnails up to 1920 px; `preview`: storyboards |
+| Captions | `subtitleLanguage[]` with VTT and HLS URLs |
+| Chapters | `hasParts` |
+| Playback and metadata | `duration` (ISO 8601), `views`, `state`, `isLiveBroadcast`, `permanentLive`, `latencyMode`, `commentsPolicy`, `downloadEnabled`, `category`, `licence`, `language`, `support`, `uuid`, `embedUrl`, `originallyPublishedAt`, `schedules`, `aspectRatio` |
+| Sensitivity | `SensitiveTag` |
+
+- **Value meanings:**
+  - **Live now** means `isLiveBroadcast && state == 1`.
+  - `commentsPolicy`: 1 open, 2 closed, 3 needs approval.
+- **Other activities:**
+  - Comments are Markdown Notes.
+  - `View` comes from the server's Application actor.
+  - `Dislike`; `ApproveReply` (FEP-5624, since 6.2); `CacheFile` (mirrors); playlists.
+
+**Expects**
+- **Replies** must:
+  - be Public;
+  - have non-empty `content`, a valid `url` and `published`;
+  - have an `id` on the actor's host;
+  - have an `inReplyTo` that resolves to the video or one of its comments.
+- `commentsPolicy` 2 rejects replies; 3 holds them until approved.
+- PeerTube signs its fetches.
+- It drops followers that have been unreachable for about 7 days (8.2).
+
+**What Mastodon does with it:** `<h2>name</h2>` + summary + link. The description is dropped and there is no
+attachment. The player is a card whose iframe loads from the remote host, which our proxy rule forbids.
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Store the whole Video: variants, thumbnails, storyboards, captions, chapters, duration, live state, views, `commentsPolicy`, licence, category, language, support, channel | P1 | own `privapub.video` |
+| Play through the proxy: a `MediaAttachment{type: video}` pointing at a proxied muxed mp4 (a `web-video` file, or a fragmented file whose codec types include both audio and video); `preview_url` = a ~560 px `icon`; `meta.original` with width, height, `frame_rate`, `duration` | P1 | `media_attachments` |
+| The proxy answers **Range** requests and rewrites HLS playlists and caption URLs to proxied ones. A 720p file is about 0.9 GB, so stream it; never buffer. | P1 | — |
+| A video card made from the object, **without** a remote iframe | P1 | `Status.card{type: video}` |
+| Reply rules: closed when `commentsPolicy` is 2; replies sent Public with a `url`; `ApproveReply` shows our reply as pending | P1 / P2 | own |
+| Dislike counts; live state through `Update`; chapters and captions | P2 | own |
+| Optionally, `View` sent from the instance actor (so it never names a persona) | P3 | — |
+
+### Loops (1.0.0-beta.14) and Pixelfed (0.14.4)
+
+- **Loops:**
+  - A video is a Note with one mp4 `Document` whose `url` is a string. **The poster is in the object's `preview`.**
+    Videos are vertical.
+  - Its interactionPolicy follows GoToSocial's model.
+  - It sends `QuoteRequest` and `FeatureRequest`.
+  - A top-level post it accepts must be a Note with an mp4 attachment, from an instance its admin allowlisted, **≤ 100 MB,
+    checked with a HEAD request**. Our media must answer HEAD.
+- **Pixelfed:**
+  - Posts are a Note with attachments.
+  - It also sends `location: Place{name, latitude, longitude, country}`, `commentsEnabled`, `capabilities`, and
+    `canQuote` (0.14).
+  - Stories are `Add{Story}` with a bearcap only Pixelfed understands.
+  - Pixelfed 0.14 does FEP-044f and FEP-8fcf.
+- **What Pixelfed accepts:**
+  - Only `Note`s, and **a top-level post must have media**.
+  - **Every** attachment must be a Document or Image with a string `url` and a `mediaType` in the instance's list. The
+    default list is **jpeg, png and gif only**, and a single webp or avif attachment rejects the whole post.
+- **Gaps:**
+  - **P1 outbound:** keep JPEG/PNG renditions with an explicit `mediaType`.
+  - **P1 inbound:** Loops' `preview` poster.
+  - **P2:** Pixelfed `location` → own `privapub.place`, display only and never re-federated; `commentsEnabled: false`
+    disables replies.
+  - **P3:** ignore `Add{Story}` without an error; answer `FeatureRequest` with `Reject`.
+
+### Long-form: WordPress plugin 9.3.1, Ghost 6, WriteFreely 0.17.2
+
+FEP-b2b8 (draft) describes the shape: plain-text `name`, a `summary` teaser (≤500), full HTML `content`, `image`, and
+a `preview` Note fallback.
+
+- **WordPress:**
+  - Object type: an Article for a titled post, a Page for a page, otherwise a Note.
+  - Fields: `image` (the featured image), `preview`, `interactionPolicy.canQuote`.
+  - A CW is `sensitive` + `summary` + `dcterms:subject`.
+  - `id` is `?p=123`, different from `url`.
+  - The blog actor is a Group with `attributionDomains`.
+  - It sends an `Update` on every save, and **signs with RFC 9421 first** (9.3.0), falling back to draft-cavage after
+    any 4xx.
+  - It drops followers-only replies.
+- **Ghost 6** (its ActivityPub service is separate, built on Fedify):
+  - Article with `image` as a bare string and `preview`; members-only parts removed.
+  - It refetches every object signed, **never applies remote Updates**, and accepts only Note and Article.
+  - Public is addressed as `as:Public`.
+- **WriteFreely:** Article when the body has a paragraph break. **`preview` reuses the Article's id**, so never store
+  it as its own post. It has no comments.
+- **Gaps:**
+
+| Gap | P | Client surface |
+|---|---|---|
+| An Article shown in the Mastodon API: `content` = name + teaser (`summary`, else `preview.content`) + a link to `url`; a card made from the object (title, description, `image` then `icon`, author, provider, date) | P1 | `Status.content`, `Status.card` |
+| The full sanitised HTML kept for a reader view | P1 | own `privapub.article{title, html, cover, excerpt}` |
+| Body images duplicated in `attachment` removed; `attributedTo` arrays resolved to the Person | P2 | — |
+
+### Events: Mobilizon 5.2.4, Gancio 1.28, Friendica/Hubzilla/Forte
+
+FEP-8a8e (draft) is the common reference.
+
+- **Mobilizon:**
+  - Times and status: `startTime`, `endTime`, `timezone`, `status`/`ical:status`, `isOnline`, `draft`.
+  - Place: `location: Place{address: PostalAddress, latitude, longitude}`.
+  - Participation: `joinMode`, `participantCount`, `maximumAttendeeCapacity`, `remainingAttendeeCapacity`,
+    `anonymousParticipationEnabled`.
+  - Comments: `repliesModerationOption`, `commentsEnabled`.
+  - Other: `category`, `contacts`.
+  - Attachments: the online link `Link{name: Website}`; `PropertyValue`s under `mz:` keys; a banner `Document`.
+  - The event is attributed to the Group.
+  - **RSVP:** `Join{object: event}` with a stable id that can be fetched; Mobilizon answers `Accept` or `Reject`;
+    `Leave`.
+- **Gancio:** a single Application actor; `location` is an **array** of `VirtualLocation` and `Place`; no RSVP.
+- **Friendica, Hubzilla:** RSVP with `Accept`/`Reject`/`TentativeAccept`. Hubzilla creates events as `Invite{Event}`,
+  with HTML in `location.content`, and `-00:00` for floating times.
+- **FEP-8a8e:** a server that does not handle joins answers `Join` with `Ignore`.
+- **Gaps:**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Store times, time zone and place in every one of those shapes; RSVP routing (W6); `Invite{Event}`; answer `Join` with `Ignore` until RSVP exists | P1 | `content` = title + "date (zone) · place" + link; card with the banner |
+| Capacity, join mode, online link, status, category | P2 | own `privapub.event` |
+| RSVP out (`Join`/`Leave`, stable ids), from the persona the user chose | P2 | own `…/rsvp` |
+
+### Audio: Funkwhale 2.0.11, Castopod 1.15.5, Owncast 0.3.0
+
+- **Funkwhale:**
+  - `Create{Audio}` whose `url` is an array: a page link plus the stream, with `bitrate` and `size`.
+  - Also `duration`, `position`, `disc`, `album`, `license` and `image`; `summary` is a hashtag line (W2).
+  - `Listen{Track}`.
+- **Castopod:** an episode arrives as a link-only Note; the player comes from OpenGraph/oEmbed. Fetching the episode
+  with the podcast type gives a `PodcastEpisode` with transcript and chapters.
+- **Owncast:** a `Service` actor; "go live" is a Note with a thumbnail.
+- **Gaps:**
+  - **P1:** pick the audio Link out of `url`, sniff its type, apply W2. Surfaces as `MediaAttachment{type: audio}`
+    with `meta.original.duration` and the cover as `preview_url`.
+  - **P2:** duration, cover, album, position and licence (own `privapub.audio`); the Castopod transcript and chapters.
+  - **P3:** `Listen` history; Owncast live state.
+
+### Books: BookWyrm 0.9.3, NeoDB 0.19.4
+
+- **BookWyrm:**
+  - **To non-BookWyrm servers** it sends a review as an `Article` named `Review of "Title" (★★★★): …`, a comment or
+    quotation as a Note with the citation appended, and the cover as a `Document`.
+  - The fields `inReplyToBook`, `rating` and `quote` go only to BookWyrm servers.
+- **NeoDB:** `relatedWith[]` carries the item, the rating (out of 10), the review and the shelf; `tag[]` holds catalogue
+  items (`{type: "Movie", href, name, image}`).
+- **Gaps:**
+  - **P1:** keep the Article `name`, `tag` entries that are not Mention or Hashtag, and covers that have no blurhash.
+  - **P2:** keep `relatedWith`, `rating` and `inReplyToBook` raw; a card for the item; own
+    `privapub.review{item, rating, scale}`.
+
+### Threads, Flipboard, Bluesky via Bridgy Fed
+
+- **Threads:**
+  - **Unsigned GETs answer 404**, so fetch it signed, as our instance actor.
+  - Quotes arrive as `_misskey_quote` + a FEP-e232 tag + an `RE:` fallback.
+  - Polls are not federated.
+  - Threads users must be 18 or over, opt in, and live outside the EU.
+  - Threads blocks servers that ignore deletes or have no privacy policy.
+  - **P1:** process `Delete` promptly; publish a privacy policy and a minimum age.
+- **Flipboard:**
+  - Each flip is a link-only Note: headline, a link with `utm_*` parameters, and a Mention of the magazine.
+  - Magazines are Groups that `Announce` bare URIs.
+  - **P1:** fetch objects that arrive as bare-URI Announces (we do).
+  - **P2:** a card, or the post reads as a bare headline; deduplicate by canonical URL with `utm_*` stripped.
+- **Bridgy Fed:**
+  - Actors are `https://bsky.brid.gy/ap/did:plc:…`, with handles like `@x.bsky.social@bsky.brid.gy` (**dots in the
+    user part**). `alsoKnownAs` holds `did:` values; there is no `published` and the outbox is empty.
+  - Posts: a `url` array with an `at://` canonical link (W1); **media without `mediaType`** (W4); link embeds flattened
+    into `content`; video thumbnails in `image`; long-form as Article.
+  - **Bridging a persona:**
+    - opt-in, by following the bot;
+    - the persona needs an `icon` and must be at least 7 days old;
+    - only public posts are bridged;
+    - **opting out takes a `Block` sent to the bot**, which we never send today.
+  - **Privacy note:** two personas created on the same day share the same day-truncated `published`. That is weak,
+    but a link.
+- **P2:** `Account.created_at` fallback; the Bridgy opt-out Block (see §6).
+
+## 4. What the rich client needs from the server
+
+The rule: **never drop what arrived; keep it typed where we understand it and raw where we don't.** The Mastodon API
+keeps working for existing apps. Everything it cannot express goes under a `privapub` object on the same entities,
+following the precedent of `pleroma.*` and `akkoma.*`, plus a few endpoints of our own.
+
+### 4.1 One post, many kinds
+
+`Post` gains a `Kind` and one typed payload per kind.
+
+| Kind | From | Typed payload | Mastodon API view | `privapub.*` |
+|---|---|---|---|---|
+| note | everyone | — | as today | `source` (Markdown/MFM/BBCode), per-attachment `sensitive` |
+| article | WordPress, Ghost, WriteFreely, NodeBB, BookWyrm, Bridgy | title, excerpt, cover, full HTML, `preview` | content = title + excerpt + link; card from the object | `article` (reader view) |
+| video | PeerTube, Loops, Bridgy, Owncast | variants, HLS, poster, storyboards, captions, chapters, duration, live state, licence, channel | proxied `video` attachment + card | `video` |
+| audio | Funkwhale, Castopod | stream variants, cover, duration, album, position, licence, transcript, chapters | `audio` attachment | `audio` |
+| event | Mobilizon, Gancio, PieFed, Friendica, Hubzilla, CherryPick | start, end, zone, place, online link, join mode, capacity, status | text + card | `event` (+ RSVP) |
+| poll | Mastodon, Misskey, Pleroma, GoToSocial, PieFed | options, counts, multiple, end, closed, voters | `poll` | — |
+| link | Lemmy, PieFed, Mbin, Flipboard, Mastodon 4.7 | href, thumbnail, alt, author | `card` | `link` |
+| review | BookWyrm, NeoDB | item, rating, scale, shelf | text + card | `review` |
+| page / thread | Lemmy, PieFed, Mbin, NodeBB | title, community, flair, lock, removal, score | content + `card` for links | `thread{community, flairs, locked, removed, score, distinguished}` |
+
+These cut across every kind:
+
+| Feature | Mastodon API | `privapub.*` |
+|---|---|---|
+| Quote | `quote{state, quoted_status}` | the URI when it could not be fetched |
+| Emoji | `emojis` | — |
+| Reactions | `emoji_reactions` (and `pleroma.emoji_reactions`) | — |
+| Votes | — | `vote{score, up, down, mine}` |
+| Interaction policy | GoToSocial-style `interaction_policy` | — |
+| Edit history | `edited_at`, `/history` | — |
+
+### 4.2 Linking things together
+
+Every reference is kept as a URI even when the target could not be fetched: the parent, the quoted post, the
+community, the channel, the book, the original `url`. The client can then link out where it cannot embed. This
+follows the `akkoma.in_reply_to_apid` / `akkoma.quote_apid` precedent.
+
+A link opens `url` (W7), never `id`. Media and thumbnails only ever go through the proxy, so the client never contacts
+a remote host.
+
+### 4.3 Details view ("nerd stats")
+
+`GET /api/privapub/v1/statuses/:id/provenance` (and the same for accounts):
+
+| Group | Fields |
+|---|---|
+| Raw | The object exactly as received, with its hash. Every later refetch and `Update`, with timestamps. The `@context` as sent (the namespaces show `toot`, `misskey`, `litepub`, `lemmy`, `pt`, `mz`, `gts`, `fedibird`, …). |
+| Path in | How it arrived: direct Create, inbox forward, Announce (and by whom: community, channel, magazine, relay), backfill, or fetch on demand. Delivered to the personal or the shared inbox. |
+| Trust | Signature scheme: draft-cavage (algorithm string, signed headers, query signed or not), RFC 9421, FEP-8b32 proof, or verified by refetch from origin. Key id and key type. LD signature present but ignored. |
+| Time | `published`, `updated`, received, and their gaps (backdated posts, clock skew). |
+| Extensions | Detected from properties: 044f `quote`, `interactionPolicy`, 7888 `context`, 8b32 `proof`, 521a `assertionMethod`, 8967 Link attachment, c16b `htmlMfm`, `_misskey_*`, `searchableBy`, `formerRepresentations`, FEP-1b12 `audience`. |
+| Origin | Software and version from NodeInfo, with a family. This is for display only: FEP-0151 says the names are opaque, so never branch on them except where a peer does the same to us (PieFed). |
+| Media | Variants with codec, fps, size and bitrate; infohashes, magnets and mirrors; licence. |
+| Counts | Remote likes, boosts, views, downloads and dislikes as last seen, with the time. |
+| Interactions | Policy as received, defaults applied, approval state, authorization URIs. |
+| Moderation | Removals, locks and bans as received from a community, with reasons. |
+
+`GET /api/privapub/v1/instances/:host` returns cached NodeInfo (`metadata` extras: Misskey `themeColor`/`maxNoteTextLength`,
+Pleroma `features[]`/`federation.mrf_policies`), the instance API's icon and description, the delivery health our
+circuit breaker sees, and which signature scheme worked.
+
+`software.name` → family, for display:
+
+| Family | `software.name` values |
+|---|---|
+| Mastodon | mastodon (glitch-soc shows `+glitch` in the version), hometown, fedibird, kmyblue |
+| Misskey | misskey, sharkey, cherrypick, iceshrimp, firefish, foundkey, catodon |
+| Pleroma | pleroma, akkoma |
+| Microblog | gotosocial, takahe, hollo, mitra, snac, smithereen, ktistec, wafrn, bonfire, friendica, hubzilla, streams/forte |
+| Threadiverse | lemmy, piefed, mbin, kbin, lotide, nodebb, discourse |
+| Media | peertube, pixelfed, loops, funkwhale, owncast, vernissage, castopod |
+| Publishing | wordpress, ghost, writefreely, plume |
+| Events | mobilizon, gancio |
+| Other | bookwyrm, neodb, forgejo |
+| Bridges and relays | bridgy-fed, activityrelay |
+
+## 5. Signatures, identity and transport
+
+| Topic | State on 2026-10-01 | PrivaPub | P |
+|---|---|---|---|
+| RFC 9421 inbound | Mastodon accepts since 4.5. WordPress and Fedify sign with it first. GoToSocial, the Misskey family, Akkoma, Pleroma and Bridgy do not. | Verify RSA and Ed25519; `content-digest` (RFC 9530); one signature; `created` and `keyid` | P2 |
+| RFC 9421 outbound | Mastodon 4.7 double-knocks | draft-cavage first; RFC 9421 after a 401; remember per host | P2 |
+| 400 vs 401 | A 400 or 401 makes Mastodon 4.7 and WordPress retry with the other scheme | 401 only for signature failures (we do this); 400 only for bodies that are really malformed | P1 (keep) |
+| Temporary key failure | Mastodon answers 503 | We should answer 503 too, and treat a 503 as a retry in delivery | P2 |
+| Keys | `publicKey` can be an array (Mastodon 4.6). FEP-521a `assertionMethod` Multikey is FINAL (Ed25519 `z6Mk…`). GoToSocial key ids have no `#` and point at a stub. | Read all of these | P2 |
+| Integrity proofs | FEP-8b32 `eddsa-jcs-2022`: JCS, no JSON-LD. Sent by Mitra, Streams, Hubzilla, Fedify and others; Mastodon verifies them from 4.7 | Verify, so relayed or forwarded objects need no refetch | P2 |
+| LD signatures | Mastodon still sends `RsaSignature2017` | Ignore, and refetch from origin (we do) | — |
+| Query string | GoToSocial, Akkoma 3.20 and Misskey 2026.10 sign it; GoToSocial retries without it | Verify both ways | P1 |
+| `hs2019` | The algorithm comes from the key; some senders hash with SHA-512 | Try rsa-sha256, then sha512 | P2 |
+| Move (FEP-7628, FINAL 2026-08-26) | See Mastodon | Inbound P1; outbound per persona P3 (never link personas) | P1 / P3 |
+| Followers sync (FEP-8fcf) | Mastodon, Pixelfed, Fedify and WordPress | Send and honour `Collection-Synchronization`. It protects followers-only posts. | P2 |
+| Instance actor discovery | FEP-d556 (FINAL), FEP-2677 | Publish both | P3 |
+| Relays (FEP-ae0c, FINAL) | Mastodon-style relays forward LD-signed Creates; LitePub-style relays Announce. GoToSocial 0.22 subscribes to relays. | Client for both styles; refetch or check an integrity proof. This is how a small server sees beyond its follows. | P2 |
+| FASP | Mastodon 4.4+, behind a flag. Its data sharing pushes content to a third party. | Do not join the data sharing; maybe consume search and trends | P3 |
+| Search consent | `indexable` (missing = false), `discoverable`, `searchableBy` (FEP-268d, which takes precedence) | Honour all three; emit explicit `false` per persona | P2 |
+
+## 6. Choices the privacy design has to make
+
+These change what PrivaPub reveals, so they are the owner's calls, not implementation details. **All six were decided on
+2026-10-01; the decisions are in `docs/ROADMAP.md`, "Owner decisions on what PrivaPub reveals".** In short:
+1. pages are fetched by the server for public posts;
+2. blocks federate;
+3. website authorship stays off;
+4. PeerTube views are never sent;
+5. Bluesky bridging is per persona, with persona dates randomised;
+6. a one-time notice before the first reaction or vote.
+
+The options as they were laid out:
+
+1. **Link previews.**
+   - Building a card from the object, or from FEP-8967 `preview` data, fetches nothing; we do that.
+   - Fetching the linked page tells that site our server read the link. Cache per URL across personas, so no fetch
+     ties a page to one persona; add jitter.
+   - Proposed admin switch: *off / from the object only / fetch*.
+2. **Outbound Block.**
+   - Blocks are never sent today.
+   - Bridgy Fed's opt-out *requires* one, and Mastodon, GoToSocial and Misskey federate blocks as a matter of course.
+   - Proposal: never by default; an explicit per-persona "tell their server" option.
+3. **`attributionDomains` / `fediverse:creator`.** It ties a persona to a website. Opt-in per persona only.
+4. **PeerTube `View`.** Counting a view tells the origin a video was watched. If ever, send it from the instance actor.
+5. **Bridging to Bluesky.** It is per persona; each persona needs its own avatar and 7 days of age. Same-day personas
+   share a `published` day.
+6. **Emoji reactions and votes** are public by nature on every platform that has them. The client should say so
+   before the first one.
+
+## Sources
+
+The full source lists, with versions and dates, were gathered by five research passes on 2026-10-01. The primary
+ones:
+
+| Area | Sources |
+|---|---|
+| Mastodon | `CHANGELOG.md` (4.3.0–4.7.2); docs.joinmastodon.org (`spec/activitypub`, `spec/security`, `spec/webfinger`, `client/quotes`, `client/collections`, entities); the `main` source (`note_serializer.rb`, `activity/{create,update,accept,delete,quote_request,move,like,flag}.rb`, `status_parser.rb`, `media_attachment_parser.rb`, `fetch_link_card_service.rb`, `verify_quote_service.rb`, `fetch_all_replies_service.rb`, `signed_request.rb`); developer posts for 4.5, 4.6 and 4.7; GHSA-vwhj, GHSA-rwcw, GHSA-vg36; issue #39997 (spam, July 2026) |
+| GoToSocial | Codeberg releases 0.18.0–0.22.1; `docs/federation/*` (`interaction_controls`, `posts`, `actors`, `http_signatures`, `access_control`); `internal/typeutils`, `internal/ap`, `internal/federation`, `internal/transport`; issues #4939, #1894, #4994, #4849, #4677 |
+| Misskey family | misskey-dev/misskey develop `ed9654b` (`ApRendererService`, `ApInboxService`, `ApNoteService`, `ApAudienceService`, `ReactionService`, `check-against-url`); PR #16250; Sharkey develop `effcecb`; Iceshrimp.NET dev `926fcde` (`FEDERATION.md`, `LdHelpers.cs`, `HttpSignature.cs`, `NoteRenderer.cs`); CherryPick develop |
+| Pleroma, Akkoma | Pleroma develop `cfeca7f` (`transmogrifier.ex`, `inbox_guard_plug.ex`, `ap_extensions.md`); Akkoma develop (`FEDERATION.md`, `CHANGELOG.md`, `nodeinfo_extensions.md`) |
+| Lemmy | LemmyNet/lemmy `main` `f1476db` and tag 0.19.20 (`crates/apub/apub/assets/*` fixtures, `objects/src/protocol/*`, `activities/src/protocol/*`, the pending-post migration); PRs #5856, #6152, #6401, #6409, #6466; issues #6281, #6343, #6346; activitypub-federation-rust `fetch/mod.rs` |
+| Other threadiverse | PieFed `41cccb7` (`FEDERATION.md`, `docs/activitypub_examples`, `docs/fep-1a11.md`); Mbin `cf95b04` (`docs/05-fediverse_developers`); NodeBB `260a0cc` (`src/activitypub/*`); discourse-activity-pub; friendica `FEDERATION.md` |
+| PeerTube | docs.joinpeertube.org/api/activitypub; Chocobozzz/PeerTube develop (`object-to-model-attributes.ts`, `custom-validators/activitypub/*`, `process-*.ts`); live fetches from peertube2.cpy.re, garr.tv (8.2.4), tube.tchncs.de |
+| Pixelfed, Loops | pixelfed dev (`Transformer/ActivityPub/Verb/*`, `Inbox/HandlesCreates.php`, `Helpers::verifyAttachments`); loops-server main (`FEDERATION.md`, `NoteWithVideoAttachmentValidator.php`) |
+| Long-form, events, audio, books | wordpress-activitypub trunk (`class-post.php`, `class-signature.php`); TryGhost/ActivityPub v1.2.13; writefreely `posts.go`; Mobilizon 5.2.4 converters; Gancio 1.28.2/2.0-beta; Funkwhale 2.0.x; Castopod 1.15.5; Owncast 0.3.0; BookWyrm 0.9.3; NeoDB `docs/internals/activitypub.md` |
+| New entrants | fed.brid.gy/docs and bridgy-fed `activitypub.py`; live probes of threads.net, flipboard.com and bsky.brid.gy; engineering.fb.com (2024-03-21) |
+| FEPs | codeberg.org/fediverse/fep at 2026-09-30: 044f, 1311, 1a11, 1b12, 2345, 268d, 2c59, 4f05, 521a, 5624, 5feb, 7458, 7628, 7888, 7aa9, 844e, 8967, 8a8e, 8b32, 8fcf, 9098, 9967, ae0c, b2b8, c0e0, c16b, d556, e232, ef61, f15d, f228, fb2a, fe34 |
+| Signatures | SWICG "ActivityPub and HTTP Signatures" report and its RFC 9421 adoption tracker; SocialHub "RFC 9421 HTTP signatures in 2026" (Jan 2026) |
@@ -8,9 +8,12 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati
 - [x] P1.1 Infrastructure and content model: v1.2.0, deployed and verified 2026-10-01
 - [x] P1.2 Social graph and timelines: v1.3.0, deployed and verified 2026-10-01
 - [x] P2 Mastodon client API: v1.4.0, deployed 2026-10-01; OAuth and the anonymous API verified on production, the signed-in API verified locally (no real-client login on production yet)
- [ ] P3 Social features
- [ ] P4 Groups and privacy features
- [ ] P5 FEPs and polish
+- [x] P3 Social features: v1.5.0, deployed 2026-10-01; media, proxy, blocks, mutes, bookmarks, pins and reports verified by tests and locally (no upload on production yet)
+- [x] P4 Groups and privacy features: v1.6.0, deployed 2026-10-01; communities, circles and local-only located posts verified by tests. v1.6.1 adds the pasture (`tools/pasture/`): live interop with GoToSocial 0.22.1 passes all 25 checks, three runs in a row. Lemmy and a live Mastodon circle member are not run yet; the pasture has GoToSocial only
+- [ ] P5 Lose nothing: wire tolerance, full objects, raw capture (see `docs/INTEROP.md`)
+- [ ] P6 Emoji, polls, quotes, reactions, cards, players
+- [ ] P7 Threads, communities, moderation, the social graph
+- [ ] P8 Signatures, discovery, the long tail

 ## Intent

@@ -115,6 +118,17 @@ and circles (see Owner decisions).
 | Location-ranged posts | **Local only, never federated.** Shown to local users within the radius, with coordinates rounded on storage. |
 | Groups | **Per group, two kinds.** A *community* federates per FEP-1b12, Lemmy-compatible: it Announces the activity, uses `audience`, and accepts posts from non-followers. A *circle* is invitation-only: posts are addressed to the members collection, and objects are served only to signed requests from members. |

+### Owner decisions on what PrivaPub reveals (2026-10-01, from `docs/INTEROP.md` §6)
+
+| Question | Decision |
+|---|---|
+| Link previews | **The server fetches the linked page itself.** It does this only for public posts, after a short random delay, once per link for the whole server (a shared cache, so a fetch never points at one persona), and when the post arrives, never when someone reads it. Cards built from the post's own data are used first. The client never contacts the site. |
+| Blocks | **Federated.** A persona's block is sent to the blocked account's server as `Block`, and an unblock as `Undo{Block}`. Their server enforces it too, and they can learn they were blocked. This replaces the earlier "blocks never federate" rule. |
+| Website authorship (`attributionDomains`, `fediverse:creator`) | **Off.** It is never emitted, not even as a per-persona option, because it would publicly tie a persona to a website. |
+| PeerTube views | **Never sent.** The remote video file is still downloaded through our proxy when it is played; that cannot be avoided without pre-downloading video. |
+| Bluesky bridging (Bridgy Fed) | **Allowed per persona**, with a clear warning that the posts become far more widely copied. Leaving the bridge must work, through a federated `Block` sent to the bridge. Persona creation dates are moved back by a random number of days, so personas created the same day no longer share a date. |
+| Reactions and votes | **Public, with a one-time notice.** The client tells each persona once, before its first reaction or vote, that these are public and visible as that persona. |
+
 ## Libraries (researched; no maintained .NET ActivityPub library exists, so Letterbook and Iceshrimp.NET both wrote their own)

 | Area | Choice |
@@ -386,28 +400,115 @@ The first refactor commit is a pure move with namespaces only. Logic changes fol
 - **Persona hardening:** optionally re-key existing avatar ids; an optional `SecureMode` (signed GETs required); no
  suggestions or directories that could relate sibling avatars.

-### P5 FEPs and polish (ongoing)
- **FEP-8fcf:** followers synchronisation.
- **FEP-5feb:** honour remote `indexable` in search.
- **FEP-7628:** Move in both directions, plus editing `alsoKnownAs`.
- **FEP-044f:** quotes and `interactionPolicy`.
- **RFC 9421:** inbound verification with NSign, plus Content-Digest.
- **Mastodon API extras:** polls, the streaming WebSocket (nginx Upgrade headers), Web Push (VAPID), and grouped
-  notifications v2, after which the advertised version moves to 4.3.
+### P5 and beyond: rich content and the rest of the fediverse
+
+Rewritten on 2026-10-01 from the research in `docs/INTEROP.md`, which holds the per-platform evidence and the
+priorities. The goal is a future client that shows and links every kind of fediverse content in one place, with a
+details view of where each object came from. So the server keeps everything it receives: typed where it understands
+it, raw where it doesn't.
+
+#### P5 Lose nothing (wire tolerance and full objects)
+- **Cheap fixes that were wrong** (done in v1.7.0):
+  - `summary` is a content warning only on a `Note`/`Question`, or when `sensitive` is set; elsewhere it is an excerpt
+    (INTEROP W2). Remote titles now show in the Mastodon API for non-Note objects.
+  - Persona usernames match Mastodon's and Misskey's pattern (groups already did).
+  - Every term we emit is defined in our JSON-LD context.
+  - `Vary: Accept`.
+  - Still open: every activity id dereferences.
+- **Owner decisions that were small** (done in v1.7.0): blocks federate (`Block`, `Undo{Block}`); a persona's and a
+  group's `published` is a random day up to two weeks before its creation (migration `_007`).
+- **Parsing every shape:**
+  - `url`, `icon`, `image`, `attachment` and `attributedTo` as a value, an object or an array (W1).
+  - A Markdown `content` and `source` (W3).
+  - Inferring a missing `mediaType` (W4).
+  - Every thumbnail location (W5).
+  - Language from `@context` (W11); alt text from `summary` (W12).
+  - A null `id`, a 200 `Tombstone`, a `Delete` before its `Create` (W9, W13).
+- **`Post.Kind`** plus typed payloads for article, video, audio, event, link, review and thread (INTEROP §4.1). The
+  Mastodon API view of each kind: content, a card made from the object without fetching, attachments.
+- **Raw capture for the details view:** the object as received, how it arrived, the signature scheme and key, received
+  versus `published`, the extensions detected, and the origin's software (§4.3). Exposed at
+  `/api/privapub/v1/statuses/:id/provenance` and `/api/privapub/v1/instances/:host`.
+- **Routing by object type:**
+  - `Accept`/`Reject`/`TentativeAccept` routed by what their object is (W6).
+  - `ChatMessage` in as a direct message.
+  - `Dislike` and votes recorded in a ledger.
+  - A `Join` answered with `Ignore` until RSVP exists.
+  - Friendica's thread-`Follow` refused without an error.
+- **Delivery:** honour 503 with `Retry-After`; answer 503 ourselves when a key fetch fails temporarily.
+
+#### P6 What people see: emoji, polls, quotes, reactions, cards, players
+- **Custom emoji** on posts, names, fields and poll options, proxied.
+- **Polls** in and out, with the Misskey, Pleroma and PieFed vote shapes. A count refresh is never an edit.
+- **Quotes (FEP-044f):**
+  - read every key; verify `QuoteAuthorization` on all of its fields; handle revocation;
+  - be quotable: `canQuote`, answer `QuoteRequest`, serve and revoke stamps;
+  - then advertise `api_versions.mastodon ≥ 7` (4.5.0).
+- **Emoji reactions** in all three inbound forms, plus outbound `EmojiReact`, exposed as `emoji_reactions`.
+- **Link cards:**
+  - from the object, or from FEP-8967 `preview`, without fetching;
+  - fetching the page itself is the owner's decision (INTEROP §6.1).
+- **Media:**
+  - video playback through the proxy (Range requests, HLS playlist rewriting, the poster), with a `video` card;
+  - audio attachments;
+  - an article reader view;
+  - JPEG/PNG renditions kept for Pixelfed.
+
+#### P7 Threads, communities and the social graph
+- **Thread backfill:**
+  - read in order: `contextHistory`, then `context` (paged, with ETag), then `replies`;
+  - group by the root post;
+  - publish our own `context` and a paged `replies`.
+- **Lemmy, PieFed and Mbin:**
+  - the moderation set: removals, locks, bans, featured, moderators, `Warn`, `Resolve`;
+  - votes in and out; link posts; flairs; `Feed` actors; community polls; post `Move`;
+  - the outbound shape Lemmy requires;
+  - communities we host announce to the author's own instance too;
+  - Flags from a `Service`-typed reporter actor.
+- **GoToSocial interaction policies:** stored and shown; send `ReplyRequest`/`LikeRequest` where approval is
+  needed; handle `Accept{result}`.
+- **Accounts and follows:**
+  - inbound `Move` with Mastodon's checks;
+  - re-run WebFinger on a rename;
+  - inbound `Block`, plus `Add`/`Remove` of pins;
+  - FEP-8fcf followers sync;
+  - `indexable`/`discoverable`/`searchableBy`;
+  - edit history from `formerRepresentations`;
+  - PeerTube reply rules and `ApproveReply`.
+- **Events:** structured RSVP (`Join`/`Leave` with stable ids).
+
+#### P8 Signatures, discovery and the long tail
+- **Signatures:**
+  - RFC 9421 inbound (RSA and Ed25519, Content-Digest);
+  - outbound double-knock, remembered per host;
+  - `publicKey` arrays and FEP-521a Multikey;
+  - FEP-8b32 proof verification;
+  - `hs2019` with SHA-512.
+- **Discovery:**
+  - a relay client for both relay styles;
+  - instance actor discovery (FEP-d556, FEP-2677);
+  - `implements` (FEP-844e).
+- **Mastodon API:** streaming WebSocket, Web Push, grouped notifications. Then advertise an honest version.
 - **Backfill:** an author's outbox after following them.
- **Later:** FEP-521a, FEP-8b32, FEP-e232, relays.
+- **Long tail:**
+  - MFM rendering data;
+  - Misskey actor extras;
+  - book reviews (`relatedWith`, `rating`);
+  - Funkwhale and Castopod metadata;
+  - Pixelfed `place` (display only, never re-federated);
+  - Bluesky bridging per persona.

 ### Cut or deferred (deliberately)
 - **Cut:**
-  - Link-preview cards: an SSRF and privacy risk.
+  - Link-preview cards *fetched from the linked page* by default. Cards built from the object, or from FEP-8967
+    `preview` data, are in P6; fetching the page is an owner decision (INTEROP §6.1).
  - Translation, trends, directory and lists (filters stay as stubs).
  - Scheduled posts.
  - The Mastodon admin API: moderation stays on `/clientapi`.
  - `POST /api/v1/accounts` registration: avatars are created through `/clientapi`.
  - Local custom emoji.
  - S3 storage.
-  - JSON-LD and LD-signature processing.
-  - Outbound RFC 9421.
+  - JSON-LD and LD-signature processing. FEP-8b32 proofs need neither (JCS), so they are in P8.
 - **Deferred:** video transcoding (remux only for now).
 - **Out of scope:** moving decePubClient onto the Mastodon API.

@@ -417,8 +518,10 @@ The first refactor commit is a pure move with namespaces only. Logic changes fol
  `Fixtures/{mastodon,gotosocial,misskey,akkoma,lemmy}/`. Renderers are checked against golden JSON. Inbound
  scenarios run as integration tests on a throwaway mongod.
 - **Interop:** **Fediverse Pasture** runs on the workstation with podman: Mastodon, GoToSocial, Misskey/Sharkey,
-  Akkoma, plus Lemmy for P4. `tools/pasture/docker-compose.privapub.yml` runs PrivaPub with `AllowPrivateNetworks`;
-  startup asserts that flag is false in Production. The matrix, per peer:
+  Akkoma, plus Lemmy for P4. As built, `tools/pasture/run.sh` runs PrivaPub and GoToSocial behind one Caddy on a
+  podman network, with `AllowPrivateNetworks`, `AllowPlainHttp` and `AcceptAnyCertificate`; startup refuses all three in
+  Production. `tools/pasture/interop.sh` drives the matrix for GoToSocial; the other peers are still to be added. The
+  matrix, per peer:
  - follow both ways;
  - public, unlisted, followers-only and direct posts both ways;
  - a reply landing in the remote thread;
@@ -0,0 +1,14 @@
+{
+	local_certs
+	skip_install_trust
+}
+
+privapub.test {
+	tls internal
+	reverse_proxy pasture-privapub:80
+}
+
+gts.test {
+	tls internal
+	reverse_proxy pasture-gts:80
+}
@@ -0,0 +1,33 @@
+{
+	"MongoSettings": {
+		"Database": "PrivaPub",
+		"LogsDatabase": "logs",
+		"ConnectionString": "mongodb://mongo:27017"
+	},
+	"AppConfiguration": {
+		"Version": "0.0.0",
+		"MaxAllowedUploadFiles": 3,
+		"MaxAllowedFileSize": 2097152,
+		"SupportedLanguages": [ "en" ],
+		"BackendBaseAddress": "https://privapub.test",
+		"FrontendBaseAddress": "https://privapub.test",
+		"HashingOptions": { "Iterations": 10101 },
+		"Jwt": {
+			"Key": "pasture-only-key-not-a-secret-pasture-only-key-not-a-secret-0123456789",
+			"Issuer": "http://privapub.test",
+			"Audience": "http://privapub.test",
+			"HoursTimeout": 24
+		}
+	},
+	"Federation": {
+		"AllowPrivateNetworks": true,
+		"AllowPlainHttp": true,
+		"AcceptAnyCertificate": true
+	},
+	"Media": { "Root": "/tmp/privapub-media" },
+	"Kestrel": { "Endpoints": { "Http": { "Url": "http://0.0.0.0:80", "Protocols": "Http1AndHttp2" } } },
+	"Serilog": {
+		"MinimumLevel": { "Default": "Information", "Override": { "Microsoft": "Warning", "System": "Warning" } },
+		"WriteTo": [ { "Name": "Console" } ]
+	}
+}
@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Drives PrivaPub and GoToSocial (started by run.sh) through each other's federation, as their users would.
+set -uo pipefail
+P=http://127.0.0.1:6971; G=https://gts.test:6443
+gcurl() { curl -k --resolve gts.test:6443:127.0.0.1 "$@"; }
+work=$(mktemp -d); trap 'rm -rf "$work"' EXIT
+pass=0; fail=0
+ok() { echo "  ok   $*"; pass=$((pass+1)); }
+ko() { echo "  FAIL $*"; fail=$((fail+1)); }
+j() { python3 -c "import sys,json
+try: d=json.load(sys.stdin)
+except Exception: d=None
+$1" 2>/dev/null; }
+until_true() { local tries=$1; shift; for i in $(seq 1 "$tries"); do if eval "$@"; then return 0; fi; sleep 2; done; return 1; }
+# GoToSocial's cached home timeline can stop taking new posts after its first read, so a delivery is checked by looking
+# the object up by URI with resolve=false: that answers from GoToSocial's database and never fetches from us.
+on_gts() { gcurl -s -G -H "$GH" "$G/api/v2/search" --data-urlencode "q=$1" -d resolve=false -d type=statuses; }
+
+# --- PrivaPub persona and token
+root=$(curl -s -X POST $P/clientapi/user/signup -H 'Content-Type: application/json' -d '{"userName":"pastureroot","password":"Pasture-Pass-1!"}')
+jwt=$(echo "$root" | j "print(d['token'])"); rootid=$(echo "$root" | j "print(d['userId'])")
+if [ -z "$jwt" ]; then jwt=$(curl -s -X POST $P/clientapi/user/login -H 'Content-Type: application/json' -d '{"userName":"pastureroot","password":"Pasture-Pass-1!"}' | j "print(d['token'])"); rootid=$(curl -s -X POST $P/clientapi/user/login -H 'Content-Type: application/json' -d '{"userName":"pastureroot","password":"Pasture-Pass-1!"}' | j "print(d['userId'])"); fi
+curl -s -o /dev/null -X POST $P/clientapi/avatar/private/insert -H 'Content-Type: application/json' -H "Authorization: Bearer $jwt" \
+	-d "{\"rootId\":\"$rootid\",\"userName\":\"alice\",\"name\":\"Alice of PrivaPub\",\"biography\":\"testing federation\"}"
+app=$(curl -s -X POST $P/api/v1/apps -d 'client_name=pasture&redirect_uris=urn:ietf:wg:oauth:2.0:oob&scopes=read+write+follow')
+cid=$(echo "$app" | j "print(d['client_id'])"); cs=$(echo "$app" | j "print(d['client_secret'])")
+q="client_id=$cid&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code&scope=read+write+follow"
+xt=$(curl -s -c $work/pj -b $work/pj "$P/oauth/login?returnUrl=/oauth/authorize?$q" | grep -o 'name="__RequestVerificationToken" type="hidden" value="[^"]*"' | sed 's/.*value="//;s/"//')
+curl -s -o /dev/null -c $work/pj -b $work/pj -X POST $P/oauth/login --data-urlencode "returnUrl=/oauth/authorize?$q" --data-urlencode "__RequestVerificationToken=$xt" -d 'userName=pastureroot&password=Pasture-Pass-1!'
+curl -s -c $work/pj -b $work/pj "$P/oauth/authorize?$q&signed_in=1" > $work/choose.html
+form=$(python3 - "$work/choose.html" <<'PY'
+import re,sys,urllib.parse,html
+s=open(sys.argv[1]).read()
+pairs=[(k,html.unescape(v)) for k,v in re.findall(r'<input type="hidden" name="([^"]*)" value="([^"]*)"',s)]
+print(urllib.parse.urlencode(pairs+[("avatarId",re.findall(r'name="avatarId" value="([^"]*)"',s)[0]),("decision","allow")]))
+PY
+)
+code=$(curl -s -c $work/pj -b $work/pj -X POST $P/oauth/authorize --data "$form" | grep -o '<code>[^<]*</code>' | sed 's/<[^>]*>//g')
+PT=$(curl -s -X POST $P/oauth/token -d "grant_type=authorization_code&code=$code&client_id=$cid&client_secret=$cs&redirect_uri=urn:ietf:wg:oauth:2.0:oob" | j "print(d['access_token'])")
+PH="Authorization: Bearer $PT"
+[ -n "$PT" ] && ok "PrivaPub token for alice" || { ko "PrivaPub token"; exit 1; }
+
+# --- GoToSocial token
+gapp=$(gcurl -s -X POST $G/api/v1/apps -d 'client_name=pasture&redirect_uris=urn:ietf:wg:oauth:2.0:oob&scopes=read+write+follow')
+gid=$(echo "$gapp" | j "print(d['client_id'])"); gs=$(echo "$gapp" | j "print(d['client_secret'])")
+gcurl -s -o /dev/null -c $work/gj -b $work/gj "$G/oauth/authorize?client_id=$gid&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code&scope=read+write+follow"
+gcurl -s -o /dev/null -c $work/gj -b $work/gj -X POST $G/auth/sign_in --data-urlencode 'username=gtsuser@gts.test' --data-urlencode 'password=Gts-Pasture-Pass-1!'
+gcode=$(gcurl -s -o /dev/null -w '%{redirect_url}' -c $work/gj -b $work/gj -X POST "$G/oauth/authorize" | sed -n 's/.*[?&]code=\([^&]*\).*/\1/p')
+GT=$(gcurl -s -X POST $G/oauth/token -d "grant_type=authorization_code&code=$gcode&client_id=$gid&client_secret=$gs&redirect_uri=urn:ietf:wg:oauth:2.0:oob&scope=read+write+follow" | j "print(d['access_token'])")
+GH="Authorization: Bearer $GT"
+[ -n "$GT" ] && ok "GoToSocial token for gtsuser" || { ko "GoToSocial token (code '$gcode')"; exit 1; }
+
+echo "discovery"
+alice_on_gts=$(gcurl -s -H "$GH" "$G/api/v2/search?q=@alice@privapub.test&resolve=true&type=accounts" | j "print(d['accounts'][0]['id'])")
+[ -n "$alice_on_gts" ] && ok "GoToSocial resolves @alice@privapub.test" || ko "GoToSocial cannot resolve alice"
+gts_on_pp=$(curl -s -H "$PH" "$P/api/v2/search?q=gtsuser@gts.test&resolve=true&type=accounts" | j "print(d['accounts'][0]['id'])")
+[ -n "$gts_on_pp" ] && ok "PrivaPub resolves @gtsuser@gts.test" || ko "PrivaPub cannot resolve gtsuser"
+
+echo "follows"
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/accounts/$alice_on_gts/follow
+until_true 20 '[ "$(gcurl -s -H "$GH" "$G/api/v1/accounts/relationships?id[]=$alice_on_gts" | j "print(d[0][\"following\"])")" = "True" ]' && ok "gtsuser follows alice (Accept arrived)" || ko "gtsuser's follow of alice not accepted"
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/accounts/$gts_on_pp/follow
+until_true 10 '[ "$(curl -s -H "$PH" "$P/api/v1/accounts/relationships?id[]=$gts_on_pp" | j "print(d[0][\"requested\"])")" = "True" ]' && ok "alice's follow of locked gtsuser waits as a request" || ko "alice's follow is not shown as requested"
+until_true 20 'gcurl -s -H "$GH" "$G/api/v1/follow_requests" | j "print(any(a[\"id\"]==\"$alice_on_gts\" for a in d))" | grep -q True' && ok "the request reaches gtsuser's follow requests" || ko "follow request missing on GoToSocial"
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/follow_requests/$alice_on_gts/authorize
+until_true 20 '[ "$(curl -s -H "$PH" "$P/api/v1/accounts/relationships?id[]=$gts_on_pp" | j "print(d[0][\"following\"])")" = "True" ]' && ok "alice follows gtsuser (Accept arrived)" || ko "alice's follow of gtsuser not accepted"
+
+echo "posts"
+pp_status=$(curl -s -X POST -H "$PH" $P/api/v1/statuses -d 'status=Hello from PrivaPub #pasture&visibility=public')
+pp_post=$(echo "$pp_status" | j "print(d['id'])"); pp_uri=$(echo "$pp_status" | j "print(d['uri'])")
+until_true 20 'on_gts "$pp_uri" | j "print(len(d[\"statuses\"]))" | grep -q 1' && ok "alice's post reaches GoToSocial" || ko "alice's post missing on GoToSocial"
+gts_post=$(gcurl -s -X POST -H "$GH" $G/api/v1/statuses -d 'status=Hello from GoToSocial&visibility=public' | j "print(d['id'])")
+until_true 20 'curl -s -H "$PH" "$P/api/v1/timelines/home" | grep -q "Hello from GoToSocial"' && ok "gtsuser's post reaches alice's home" || ko "gtsuser's post missing on PrivaPub"
+[ "$(curl -s -H "$PH" "$P/api/v1/timelines/home" | j "print(next(s['edited_at'] for s in d if 'Hello from GoToSocial' in s['content']))")" = "None" ] && ok "an unedited remote post carries no edited_at" || ko "unedited remote post reports an edit"
+cw_status=$(curl -s -X POST -H "$PH" $P/api/v1/statuses -d 'status=behind a warning&spoiler_text=spoilers&visibility=public')
+cw=$(echo "$cw_status" | j "print(d['id'])"); cw_uri=$(echo "$cw_status" | j "print(d['uri'])")
+until_true 20 'on_gts "$cw_uri" | j "print(any(s[\"spoiler_text\"]==\"spoilers\" and s[\"sensitive\"] for s in d[\"statuses\"]))" | grep -q True' && ok "content warning survives to GoToSocial" || ko "content warning lost"
+cw_on_gts=$(on_gts "$cw_uri" | j "print(d['statuses'][0]['id'])")
+
+echo "replies and mentions"
+pp_on_gts=$(on_gts "$pp_uri" | j "print(d['statuses'][0]['id'])")
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/statuses -d "status=@alice@privapub.test nice to meet you&in_reply_to_id=$pp_on_gts&visibility=public"
+until_true 20 'curl -s -H "$PH" "$P/api/v1/notifications" | j "print(any(n[\"type\"]==\"mention\" for n in d))" | grep -q True' && ok "gtsuser's reply notifies alice" || ko "reply did not notify alice"
+until_true 10 '[ "$(curl -s -H "$PH" "$P/api/v1/statuses/$pp_post/context" | j "print(len(d[\"descendants\"]))")" -ge 1 ]' && ok "the reply threads under alice's post" || ko "reply not threaded"
+
+echo "likes and boosts"
+gts_on_pp_post=$(curl -s -H "$PH" "$P/api/v1/timelines/home" | j "print(next(s['id'] for s in d if 'Hello from GoToSocial' in s['content']))")
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/statuses/$gts_on_pp_post/favourite
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/statuses/$gts_on_pp_post/reblog
+until_true 20 'gcurl -s -H "$GH" "$G/api/v1/notifications" | j "print(any(n[\"type\"]==\"favourite\" for n in d))" | grep -q True' && ok "alice's like reaches GoToSocial" || ko "like not received"
+until_true 20 'gcurl -s -H "$GH" "$G/api/v1/notifications" | j "print(any(n[\"type\"]==\"reblog\" for n in d))" | grep -q True' && ok "alice's boost reaches GoToSocial" || ko "boost not received"
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/statuses/$pp_on_gts/favourite
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/statuses/$pp_on_gts/reblog
+until_true 20 '[ "$(curl -s -H "$PH" "$P/api/v1/statuses/$pp_post" | j "print(d[\"favourites_count\"])")" = "1" ]' && ok "gtsuser's like counts on PrivaPub" || ko "like not counted"
+until_true 20 'curl -s -H "$PH" "$P/api/v1/notifications" | j "print(any(n[\"type\"]==\"reblog\" for n in d))" | grep -q True' && ok "gtsuser's boost notifies alice" || ko "boost not notified"
+
+echo "direct messages"
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/statuses -d 'status=@gtsuser@gts.test a secret&visibility=direct'
+until_true 20 'gcurl -s -H "$GH" "$G/api/v1/conversations" | grep -q "a secret"' && ok "alice's DM reaches gtsuser" || ko "DM missing on GoToSocial"
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/statuses -d 'status=@alice@privapub.test a secret back&visibility=direct'
+until_true 20 'curl -s -H "$PH" "$P/api/v1/conversations" | grep -q "a secret back"' && ok "gtsuser's DM reaches alice" || ko "DM missing on PrivaPub"
+until_true 5 '! gcurl -s -H "$GH" "$G/api/v1/timelines/public?local=false" | grep -q "a secret"' && ok "the DM is not public on GoToSocial" || ko "DM leaked to a public timeline"
+
+echo "edits and deletes"
+curl -s -o /dev/null -X PUT -H "$PH" $P/api/v1/statuses/$pp_post -d 'status=Hello from PrivaPub, edited'
+until_true 20 'gcurl -s -H "$GH" "$G/api/v1/statuses/$pp_on_gts" | grep -q "edited"' && ok "alice's edit reaches GoToSocial" || ko "edit not applied"
+curl -s -o /dev/null -X DELETE -H "$PH" $P/api/v1/statuses/$cw
+[ -n "$cw_on_gts" ] && until_true 20 '[ "$(gcurl -s -o /dev/null -w "%{http_code}" -H "$GH" "$G/api/v1/statuses/$cw_on_gts")" = "404" ]' && ok "alice's delete reaches GoToSocial" || ko "delete not applied"
+gcurl -s -o /dev/null -X DELETE -H "$GH" $G/api/v1/statuses/$gts_post
+until_true 20 '! curl -s -H "$PH" "$P/api/v1/timelines/home" | grep -q "Hello from GoToSocial"' && ok "gtsuser's delete reaches PrivaPub" || ko "remote delete not applied"
+
+echo "unfollow"
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/accounts/$gts_on_pp/unfollow
+until_true 20 '[ "$(gcurl -s -H "$GH" "$G/api/v1/accounts/relationships?id[]=$alice_on_gts" | j "print(d[0][\"followed_by\"])")" = "False" ]' && ok "alice's unfollow reaches GoToSocial" || ko "unfollow not applied"
+
+echo "blocks"
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/accounts/$gts_on_pp/block
+until_true 20 '[ "$(gcurl -s -H "$GH" "$G/api/v1/accounts/relationships?id[]=$alice_on_gts" | j "print(d[0][\"blocked_by\"])")" = "True" ]' && ok "alice's block reaches GoToSocial" || ko "block not applied"
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/accounts/$gts_on_pp/unblock
+until_true 20 '[ "$(gcurl -s -H "$GH" "$G/api/v1/accounts/relationships?id[]=$alice_on_gts" | j "print(d[0][\"blocked_by\"])")" = "False" ]' && ok "alice's unblock reaches GoToSocial" || ko "unblock not applied"
+
+echo; echo "$pass passed, $fail failed"
+[ "$fail" = 0 ]
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# A private test fediverse on one podman network: PrivaPub (privapub.test) and GoToSocial (gts.test) behind Caddy,
+# whose internal CA both sides are told to accept. From the workstation: PrivaPub's API at http://127.0.0.1:6971,
+# both sites at https://{privapub,gts}.test:6443 (curl --resolve ...:6443:127.0.0.1 -k).
+# usage: tools/pasture/run.sh up | down | logs <name>
+set -euo pipefail
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; repo="$(cd "$here/../.." && pwd)"
+net=privapub-pasture; publish="$here/.publish"
+
+case "${1:-up}" in
+up)
+	dotnet=${DOTNET:-$(command -v dotnet || echo ~/.dotnet/dotnet)}
+	"$dotnet" publish "$repo/PrivaPub/PrivaPub.csproj" -c Release -r linux-x64 --self-contained true -o "$publish" -v quiet
+	cp "$here/appsettings.Pasture.json" "$publish/"
+	podman network exists $net || podman network create $net >/dev/null
+	podman run -d --replace --name pasture-mongo --network $net --network-alias mongo docker.io/library/mongo:8 --quiet >/dev/null
+	podman run -d --replace --name pasture-caddy --network $net --network-alias privapub.test --network-alias gts.test \
+		-p 127.0.0.1:6443:443 --sysctl net.ipv4.ip_unprivileged_port_start=0 -v "$here/Caddyfile:/etc/caddy/Caddyfile:Z,ro" \
+		docker.io/library/caddy:2 >/dev/null
+	podman run -d --replace --name pasture-privapub --network $net -p 127.0.0.1:6971:80 \
+		--sysctl net.ipv4.ip_unprivileged_port_start=0 -e ASPNETCORE_ENVIRONMENT=Pasture -w /app -v "$publish:/app:Z,ro" \
+		mcr.microsoft.com/dotnet/runtime-deps:10.0 /app/PrivaPub >/dev/null
+	podman run -d --replace --name pasture-gts --network $net -p 127.0.0.1:6972:80 \
+		--sysctl net.ipv4.ip_unprivileged_port_start=0 \
+		-e GTS_HOST=gts.test -e GTS_PROTOCOL=https -e GTS_PORT=80 -e GTS_BIND_ADDRESS=0.0.0.0 -e GTS_HTTP_CLIENT_TLS_INSECURE_SKIP_VERIFY=true \
+		-e GTS_DB_TYPE=sqlite -e GTS_DB_ADDRESS=/gotosocial/storage/sqlite.db -e GTS_STORAGE_LOCAL_BASE_PATH=/gotosocial/storage \
+		-e GTS_LETSENCRYPT_ENABLED=false -e GTS_HTTP_CLIENT_ALLOW_IPS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 \
+		-e GTS_TRUSTED_PROXIES=0.0.0.0/0 -e GTS_LOG_LEVEL=info -e GTS_INSTANCE_EXPOSE_PUBLIC_TIMELINE=true \
+		docker.io/superseriousbusiness/gotosocial:latest >/dev/null
+	for i in $(seq 1 60); do curl -fs -o /dev/null http://127.0.0.1:6971/build.json && curl -fs -o /dev/null http://127.0.0.1:6972/api/v1/instance && break; sleep 2; done
+	podman exec pasture-gts /gotosocial/gotosocial admin account create --username gtsuser --email gtsuser@gts.test --password 'Gts-Pasture-Pass-1!' >/dev/null 2>&1 || true
+	podman exec pasture-gts /gotosocial/gotosocial admin account confirm --username gtsuser >/dev/null 2>&1 || true
+	podman restart pasture-gts >/dev/null
+	for i in $(seq 1 60); do curl -fs -o /dev/null http://127.0.0.1:6972/api/v1/instance && break; sleep 2; done
+	echo "privapub: http://127.0.0.1:6971, https://privapub.test:6443   gotosocial: https://gts.test:6443"
+	;;
+down)
+	podman rm -f pasture-caddy pasture-privapub pasture-gts pasture-mongo >/dev/null 2>&1 || true
+	podman network rm $net >/dev/null 2>&1 || true
+	;;
+logs)
+	podman logs --tail 200 "pasture-${2:-privapub}"
+	;;
+esac
Author	SHA1	Message	Date
thepraandClaude Opus 5.5	bb9bd71391	P5, first batch: summaries stop hiding articles, personas get reachable names, blocks federate Build / Build (push) Successful in 50s Details Deploy / privapub.thepra.dev (push) Successful in 1m4s Details - A remote `summary` is a content warning only on a Note or Question, or when `sensitive` is set. On Articles, Events, Videos, Pages and Audio it is an excerpt (WordPress teasers, Mobilizon dates and places, Mbin titles) and is now kept as `Post.Excerpt` instead of hiding the post. `Post.ObjectType` records the remote type, and the Mastodon API shows a remote non-Note object's title above its body again. - Persona usernames must match `^[a-z0-9_]+$`, as groups already did; a name outside it was unreachable from Mastodon and Misskey. - `postingRestrictedToMods` is defined in our JSON-LD context (Iceshrimp.NET drops undefined terms). - `Vary: Accept` on actor and object URLs. - Owner decision: blocks federate. A block sends `Block`, an unblock `Undo{Block}`; checked live against GoToSocial. - Owner decision: a persona's and a group's `published`, and the day in new ids, is a random day up to two weeks before creation, so personas made the same day no longer share a date. Migration _007 gives existing ones theirs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 17:39:58 +02:00
thepraandClaude Opus 5.5	4c94254502	The owner's six decisions on what PrivaPub reveals: previews, blocks, authorship, views, bridging, reactions Build / Build (push) Successful in 57s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 17:32:59 +02:00
thepraandClaude Opus 5.5	829eae3ccf	Interop research: every major platform's wire shapes, gotchas, and what PrivaPub still drops Build / Build (push) Successful in 1m22s Details docs/INTEROP.md collects five research passes from 2026-10-01: Mastodon 4.7 and GoToSocial 0.22, the Misskey and Pleroma families, the threadiverse (Lemmy 0.19/1.0, PieFed, Mbin, NodeBB), media and long-form (PeerTube, Loops, Pixelfed, WordPress, Ghost, events, audio, books, Threads, Flipboard, Bridgy Fed), and cross-cutting FEPs and signatures. Each claim was checked against source code or live fetches, with dates and versions. It is checked against our own code: what is already right, three cheap things that are wrong today (summary read as a CW on every type, unchecked usernames, an undefined context term), what the rich client needs kept (a post kind with typed payloads, raw capture and provenance for the details view), and the six privacy choices the owner has to make. The roadmap's P5 becomes P5 to P8, ordered by that evidence. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 14:01:57 +02:00
thepraandClaude Opus 5.5	8f4d6cbdf9	A private fediverse on the workstation: PrivaPub against a real GoToSocial Build / Build (push) Successful in 57s Details Deploy / privapub.thepra.dev (push) Successful in 1m12s Details tools/pasture/run.sh starts PrivaPub, GoToSocial and Mongo on one podman network behind Caddy's internal CA, and interop.sh drives both through their own client APIs: follows (one to a locked account), posts, CW, replies, likes, boosts, DMs, edits, deletes and unfollow. All 25 checks pass, three fresh runs in a row. - Federation:AcceptAnyCertificate joins the two test-network switches; startup refuses all three in Production. - WebFinger falls back to http only when AllowPlainHttp is on. - A bootstrap logger, so a failure before the host is built is no longer silent. - P4 is ticked in the roadmap, with what has not been run live (Lemmy, a Mastodon circle member). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 13:19:16 +02:00
thepraandClaude Opus 5.5	31542a181e	Remote posts take their timeline place on arrival, and an unedited one has no edit date Found by the first live run against GoToSocial: - A remote post's id came from its published second plus random bytes, so a reply arriving in the same second as the post it answers could sort under it, and a late arrival landed behind a client's since_id. A post published within the last hour now gets an id for its arrival; backfill keeps its published time. - NoteParser.Time returned default(DateTime) for a missing "updated", so every remote post was stored as edited in year one. Migration _006 clears the stored ones. - published now carries milliseconds, so peers that derive ids from it (GoToSocial, Mastodon) keep our posts in order within a second. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 13:19:16 +02:00
thepraandClaude Opus 5.5	51f2c10c6f	Community actors name their moderators the way Lemmy reads them Build / Build (push) Successful in 41s Details Deploy / privapub.thepra.dev (push) Successful in 1m1s Details attributedTo points at /wardens and postingRestrictedToMods reflects the posting policy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 12:31:13 +02:00
thepraandClaude Opus 5.5	a5d9a89445	Communities follow FEP-1b12, circles federate to their members only Communities: - a post addressed to a community (to, cc or audience) is accepted according to its posting policy - followers, anyone, or moderators - and GroupDistributor announces the whole activity with `audience` to the community's followers, plus the object for new posts so Mastodon shows them; updates and deletes of community content are announced too; - top-level posts are Pages with a name (the title, or a headline from the text); /flock counts members, /wardens lists moderators; - a Mastodon client posts into a community by mentioning it, or into a remote group, which sets `audience`; - an Announce of an activity from a remote group a persona follows (Lemmy) is followed through: the object is fetched from its own origin, kept with its AudienceURI, and fanned out to the group's local followers; updates are applied in place and deletes checked against the origin. Circles stop being local-only: an undiscoverable Group actor whose follows are all requests the owner approves; posts addressed to the circle and its /flock and delivered to members' own inboxes, never announced, never public; a remote member's post into the circle is accepted from members only. SignedFetchAuthorizer serves circle posts and collections only to a signed request from a member or a member server's instance actor - 404 for anyone else. Circles never surface in search, lookups, mentions, account ids or profile pages. Federation:SecureMode requires a valid signature on every GET under /peasants except the instance actor. Group forms take a posting policy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 12:30:57 +02:00
thepraandClaude Opus 5.5	0ccbcd558f	P3 is deployed Build / Build (push) Successful in 32s Details v1.5.0 is live; the media directory, libvips and the proxy's signature check are in place on the box. No upload has been made in production yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 12:24:30 +02:00
thepraandClaude Opus 5.5	c00865d805	Located posts: local only, rounded, matched against their own radius A post given a latitude and longitude becomes LocalGeo: its position is rounded to two decimals (about a kilometre) and stored as a 2dsphere point, its radius clamped to 1-50 km, and it is local only - no Create, no delivery, no outbox, never in the Mastodon API or on a profile page. /clientapi/post/nearby takes the viewer's position for the query only (it is neither stored nor logged), runs $geoNear and keeps posts within each post's own radius, minus authors the viewer blocks or mutes. A located post cannot be direct or in a group. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 12:24:30 +02:00