The town: a fake community across the pasture, checked for coherence

tools/pasture/town/ (run through tools/pasture/town.sh) seeds a fake
community across every running peer and checks that all of them, and
PrivaPub, agree on what happened:

- drivers per platform on four dialect bases (Mastodon API, Misskey API,
  Lemmy API, PrivaPub with /clientapi), each with a selftest against
  its own server; what a server holds is read from its database, never
  by making it fetch;
- a deterministic generator (specs/village.json: 23 accounts on seven
  servers, roots with several personas, circles and communities, a
  cross-server follow graph, posts of every kind and visibility, reply
  rounds, likes, boosts, reactions, votes, edits, deletes, blocks,
  mutes and a report) and a seeder that keeps a ledger of what happened;
- a sweep that expects delivery and confinement per server, what each
  account sees, counts, threads, edits, deletes, follows and privacy
  rows (sibling keys, published days, canary root credentials in every
  peer's database, located posts that never leave), with what the peers
  do on purpose modelled (Misskey drops orphan replies, Lemmy keeps only
  community content, edits go to the post's own audience);
- known gaps (gaps.json) turn failures into xfail and passes into xpass;
  a self-contained report.html, and docs/INTEROP-BACKLOG.md.

The pasture moves to a public-looking subnet (peers with no private
address switch can join), takes PASTURE_PORT when 6971 is in use, adds
peers to a running pasture (run.sh add, Caddy recreated with its CA
kept), removes its volumes on down, writes every scenario check to
out/scenarios.jsonl, serves decePub as decepub.test for its e2e tests,
lifts GoToSocial's and Lemmy's own rate limits, trusts Caddy in
Mastodon (TRUSTED_PROXY_IP) and gains Hollo (Fedify), whose one login
owning several accounts is the nearest peer to PrivaPub's personas.

The first village found the four PrivaPub bugs fixed in the commits
before this one; the second run, on the fixed server, passes 2319 checks
with 11 failures left, all between peers or from Lemmy's send worker,
which the seeder now warms up first. ROADMAP records the owner's
decisions of 2026-10-04 (the town, and P9 back from the cut list).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

CLAUDE.md

@@ -469,7 +469,7 @@ tools/pasture/run.sh down                                            # removes e
   deliveries are checked through `/api/v1/accounts/:id/statuses` of the sender as Mastodon knows them, or
   `Status.exists?` through `rails runner`. Its actors are numbered (`/ap/users/<id>`), so look URIs up rather than
   build them. Circle posts and a followers-only post survive its signed refetch (`ActivityPub::FetchRemoteStatusService`
-  through `rails runner`). Inbound Block is the one expected failure until P7.
+  through `rails runner`). Its block of a persona is checked through our `blocked_by`.
 - **Misskey (2026.10.0):** one container on the shared Postgres and Redis. A new Misskey federates with nobody
   (`federation: none`) until `admin/update-meta` says `all`, which `misskey_up` does. Its API is `POST /api/<endpoint>`
   with the token as `i` (`mk` in the scenario); `users/relation` answers a list, `users/notes` leaves replies out unless
@@ -498,6 +498,43 @@ tools/pasture/run.sh down                                            # removes e
   run.sh up mastodon`, then `interop.sh crawler`. `PRIVAPUB_ENV` passes any setting to the PrivaPub container.
 - `run.sh up` replaces every container, Mongo included, so each run starts clean. To keep the data, republish into
   `tools/pasture/.publish` and `podman restart pasture-privapub`; that is how a migration is tried on dirty data.
+- `run.sh add <peer>` starts more peers next to a running pasture; `run.sh down` removes every pasture container with
+  its volumes (`--purge` drops Caddy's CA too); `run.sh stats` shows each container's memory.
+- **The network looks public** (`PASTURE_SUBNET`, default `11.42.0.0/24`), so peers that refuse private addresses with no
+  switch (Pixelfed, Mbin, WordPress, Discourse, Fedify) federate. Mastodon then needs `TRUSTED_PROXY_IP` for Caddy, or it
+  answers every request with an IP spoofing error.
+- **`PASTURE_PORT`** moves PrivaPub's workstation port off 6971 when something else holds it; `lib/interop.sh` follows.
+- Every `ok`/`ko`/`xf` is also a line of `out/scenarios.jsonl`, which the town's report shows.
+
+#### The town (`tools/pasture/town.sh`, `tools/pasture/town/`)
+
+A fake community seeded across every running peer, then checked for coherence: what each server holds (read from its
+database, never by making it fetch), what each account sees through its API, counts, threads, edits, deletes, follows
+and the privacy rows. Python 3 standard library only, tabs.
+
+```bash
+tools/pasture/town.sh selftest [peer...]   # each driver against its own server; run after changing a driver or a pin
+tools/pasture/town.sh seed village         # specs/village.json: 23 accounts on seven servers, about 11 minutes
+tools/pasture/town.sh check village        # out/<run>/results.json; --deadline=0 re-sweeps an old run at once
+tools/pasture/town.sh report village       # out/<run>/report.html, publishable (fake data, no tokens)
+tools/pasture/town.sh backlog --write      # docs/INTEROP-BACKLOG.md
+```
+
+- **Drivers** (`dialects/`): one class per platform on a dialect base (`mastodon_api`, `misskey_api`, `lemmy_api`,
+  `privapub`). `stored()` reads the database (shared Postgres through `psql`, GoToSocial's sqlite copied out, Mongo);
+  `seen()` asks the API as one account. A driver that cannot do something raises `Unsupported`, and the planner never
+  asks for it (`gen.CAPS`).
+- **The plan** (`gen.py`) is a pure function of the spec and its seed; each run keeps its own `plan.json`, `ledger.jsonl`
+  (what happened, one fact per line) and `results.json`. `seed --resume` redoes only failed steps.
+- **Cells** are `feature|origin|observer|direction` (`in`, `out`, `via`, `control`, `local`). A known gap is a
+  `gaps.json` entry: matching failures are `xfail`, matching passes `xpass` (close the gap).
+- **What the peers do on purpose**, so the checker expects it: Misskey and Sharkey drop a reply whose parent they cannot
+  fetch; Lemmy keeps only community content and private messages; servers send edits and deletes to the post's own
+  audience only; a Misskey heart reaction arrives as a Like.
+- Peers' own limits are lifted for the town: GoToSocial `GTS_ADVANCED_RATE_LIMIT_REQUESTS=0`, Lemmy's
+  `local_site_rate_limit`. Mastodon reserves usernames that contain `mastodon`.
+- decePubClient's e2e tests (`decePubClient/tests/e2e/run.sh`) publish the client with the Pasture environment, serve
+  it as `https://decepub.test` (`peers/decepub.sh`) and write their cells to `out/client.jsonl`.
 
 After the pasture, verify.funfedi.dev and the owner's GoToSocial at social.arasaka.software. **Ask before acting from
 the owner's GoToSocial account.**