PieFed joins the pasture; the instance actor answers at the root

PieFed 1.7.17 (dockurr's image of the release) runs in the pasture with its
Celery worker on the shared Postgres and Redis, and scenarios/piefed.sh
checks it both ways: 29 checks, communities, titled threads, comments, votes
up and down, a community poll and a vote in it, private messages, a
moderator's lock, unlock and removal, the unfollow and statistics.

What it showed:
- PieFed sends a community's announces to the inbox of the Application at a
  peer's root (as Lemmy serves its site actor) and to /inbox otherwise.
  PrivaPub answered 404 at its root, so every announce went to an /inbox it
  does not have. The instance actor now answers at / for ActivityPub
  requests, unsigned under SecureMode as at its own address.
- PieFed keeps serving a thread its moderator removed, so the removal could
  never be checked against the post's origin. A community on the post's own
  server now speaks for it; one elsewhere still waits for the origin to say
  the post is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

FEDERATION.md

@@ -29,6 +29,7 @@ and every run starting clean, with signed fetches required (as privapub.thepra.d
 - **Mobilizon 5.2.4**
 - **Gancio 1.28.2**
 - **Funkwhale 2.0.11**
+- **PieFed 1.7.17**
 - in the town only (a seeded community checked server by server): **Hollo 0.9.19**, **Iceshrimp.NET 2026.1.2-beta**,
   **Pleroma 2.10.2**
 
@@ -44,8 +45,8 @@ Checked both ways, where the peer has the feature:
 - communities and circles;
 - blocks and unfollows.
 
-`docs/INTEROP.md` has each peer's evidence and what is still expected to fail. PeerTube, PieFed, Mbin and the others are
-covered by unit tests written in their documents' shape.
+`docs/INTEROP.md` has each peer's evidence and what is still expected to fail. Mbin and the others not yet in the pasture
+are covered by unit tests written in their documents' shape.
 
 ## Supported FEPs
 
@@ -89,7 +90,9 @@ The names are the project's own and are stable; resolve actors through WebFinger
   personas made on the same day do not share a date. `indexable` is `false` unless the persona turns it on, and
   `discoverable` is `true` unless it turns that off (the deploy's own persona, @thepra, is undiscoverable).
 - The instance actor is `/peasants/privapub` (type `Application`). It signs every fetch PrivaPub makes, so no avatar's key
-  is used to read another server's content.
+  is used to read another server's content. It also answers at the server's root (`/`) for a request that asks for
+  ActivityPub, as Lemmy's site actor does: PieFed sends a community's announces to the inbox of the Application at a
+  peer's root, and to `/inbox` when there is none.
 
 ## Groups
 
@@ -111,8 +114,9 @@ A group is either a **community** or a **circle**.
   from its own origin, never taken from the announce. They are taken from a group someone here follows, and also when
   they relay a vote on one of our posts in a thread of that group (Lemmy sends a vote to the community alone). A post
   keeps the group its `audience` names, however it arrived.
-- A remote community's **moderation** reaches the posts it holds. A removal (`Announce{Delete}`) is believed once the
-  post's origin answers it gone. A lock (`Announce{Lock}`, or `commentsEnabled: false` on the post) refuses replies,
+- A remote community's **moderation** reaches the posts it holds. A removal (`Announce{Delete}`) is believed at once
+  from a community on the post's own server, which speaks for it (PieFed keeps serving a thread its moderator removed),
+  and from a community elsewhere once the post's origin answers it gone. A lock (`Announce{Lock}`, or `commentsEnabled: false` on the post) refuses replies,
   ours included, until `Undo{Lock}`. A ban of a persona (`Announce{Block}` with the community as `target`) shows as
   `blocked_by` on the community and refuses the persona's posts and replies there until the `Undo`.