An organiser's edits to a group's event follow its server

Mobilizon's organiser sends the Create, Update and Delete of an event attributed to the group, which announces the
Event itself. PrivaPub refused the organiser's activities as misattributed (400) and kept the event through the
group's Announce, so an edit was lost and a deletion left the event in place. An object attributed to another account
of the actor's own server is now that server's to vouch for: created or edited as the server has it, under the account
it is attributed to, and deleted once the server answers 404 or 410. Attributed to an account elsewhere, it is still
refused. Checked against Mobilizon 5.2.4 in the pasture.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub.Tests/Federation/InboxGapTests.cs

@@ -116,6 +116,50 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal(FollowState.Accepted, (await Of(jun)).State);
 		}
 
+		// Mobilizon: the organiser creates, edits and deletes an event attributed to the group, which announces it. They used
+		// to be refused as misattributed (400), so the edit was lost and the deletion left the event in place
+		[Fact]
+		public async Task An_event_its_organiser_edits_and_deletes_for_a_group_on_the_same_server_follows_that_server()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var group = new RemoteActor(_harness.Peer, "group", type: "Group");
+			var organiser = new RemoteActor(_harness.Peer, "organiser");
+			await Follows(alice.Id, group);
+			var path = $"/events/{Guid.NewGuid():N}";
+			JsonObject Event(string name) => new()
+			{
+				["id"] = _harness.Peer.A + path, ["type"] = "Event", ["name"] = name, ["content"] = "<p>bring bread</p>",
+				["attributedTo"] = group.Id, ["actor"] = organiser.Id, ["startTime"] = "2026-10-08T18:00:00Z",
+				["to"] = new JsonArray(PrivaPub.Federation.Objects.Addressing.Public), ["cc"] = new JsonArray(group.Id + "/followers")
+			};
+			_harness.Peer.Serve(path, Event("A picnic").ToJsonString());
+			Task<Post> Stored() => DB.Default.Find<Post>().Match(p => p.ObjectURI == _harness.Peer.A + path).ExecuteFirstAsync(token);
+
+			var created = await _harness.Deliver(organiser, "/human-centipede", Create(organiser, Event("A picnic")));
+			Assert.Equal(202, created.StatusCode);
+			Assert.Equal(group.Id, (await Stored()).ActorURI);
+
+			var moved = Event("A picnic, moved indoors");
+			moved["updated"] = DateTime.UtcNow.AddMinutes(1).ToString("O");
+			_harness.Peer.Serve(path, moved.ToJsonString());
+			await _harness.Deliver(organiser, "/human-centipede", Activity(organiser, "Update", Event("what the activity claims")));
+			Assert.Equal("A picnic, moved indoors", (await Stored()).Title);
+
+			await _harness.Deliver(organiser, "/human-centipede", Activity(organiser, "Delete", JsonValue.Create(_harness.Peer.A + path)!));
+			Assert.NotNull(await Stored());
+			_harness.Peer.Answer(path, 410);
+			await _harness.Deliver(organiser, "/human-centipede", Activity(organiser, "Delete", JsonValue.Create(_harness.Peer.A + path)!));
+			Assert.Null(await Stored());
+
+			// attributed to someone of another server, it is still refused
+			var elsewhere = new RemoteActor(_harness.Peer, "elsewhere", _harness.Peer.B);
+			var claimed = Event("Someone else's");
+			claimed["id"] = _harness.Peer.A + $"/events/{Guid.NewGuid():N}";
+			claimed["attributedTo"] = elsewhere.Id;
+			Assert.Equal(400, (await _harness.Deliver(organiser, "/human-centipede", Create(organiser, claimed))).StatusCode);
+		}
+
 		[Fact]
 		public async Task A_like_naming_a_post_by_its_page_counts_and_its_undo_too()
 		{