P7: downvotes go out, and feeds are read through the server's reader

Votes out. A persona's downvote is a Dislike (POST /api/v1/statuses/:id/downvote and /undownvote, the viewer's own as
privapub.votes.downvoted). One vote a post: a changed vote is sent as the new vote alone, as Lemmy sends one, since an
Undo of the old one beside it could arrive after it and take the new one away; Undo goes only when a vote is taken back.
A vote on a post in a remote community goes to the community, which counts it, and to the author only when on another
server: one copy a server, since PieFed drops a second copy of an activity it has just seen. Mbin keeps a favourite
apart from a vote, so there a favourite stays after a switch to a downvote.

Feeds followed (owner decision 2026-10-07: through the server). Following a feed (Lemmy's multi-community, PieFed's feed)
keeps a FeedSubscription for the persona and nothing else; the new Service privapub_feeds (LocalActorKind.Reader,
reserved by migration _017) follows every community of the feeds read here, reconciled when a persona follows or leaves
one, when a feed's list is read again (kept as it was when it cannot be read) and every six hours. Its Following rows
carry FollowerKind, so nobody's home gets what it brings in and its unanswered follows are sent again as its own. The
persona reads GET /api/v1/timelines/feed/:id (the feed's threads, ours included) and lists its feeds at GET /api/v1/feeds.

Checked in the pasture, every scenario: 873 pass. The 14 failures are Hubzilla's (identical on the previous commit:
Hubzilla no longer answers a follow in this pasture since its restore) and two activities Smithereen never sent;
followsync passes once the pasture's restore is older than the 14-day pause. Live: alice's downvotes count as downvotes
on Lemmy 1.0 and PieFed, replacing her upvote; Lemmy 1.0 and PieFed take privapub_feeds' follows and their threads reach
the feed timelines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

FEDERATION.md

@@ -136,6 +136,9 @@ The names are the project's own and are stable; resolve actors through WebFinger
 - The reporter is `/peasants/privapub_reports` (type `Service`, "Reports from <host>"), one for the whole server with
   its own key. It sends the reports Lemmy, PieFed and Mbin take in Lemmy's shape (see **Reports** below) and does
   nothing else: nobody follows or mentions it, the Mastodon API has no account for it, and it has no page.
+- The reader of feeds is `/peasants/privapub_feeds` (type `Service`, "Feeds read on <host>"), one for the whole server
+  with its own key. When a persona here follows a feed, the reader follows each community in it, and stops following one
+  no feed read here holds any more; no community and no feed learns which persona reads it. It does nothing else.
 
 ## Groups
 
@@ -172,7 +175,9 @@ A group is either a **community** or a **circle**.
   there with its thread; a move into a community this server hosts is not taken.
 - **Feeds** (Lemmy 1.0's multi-communities and PieFed's feeds, `type: Feed`) are read as accounts whose following is
   their communities: the feed's `following` collection, read once a day with its counts, and each community in it read in
-  turn. A feed cannot be followed from here yet; its communities can.
+  turn. A persona following a feed is followed through the server (owner decision 2026-10-07): the reader of feeds
+  follows its communities, the feed itself is sent nothing, and the persona reads the feed's threads in a timeline of
+  its own (`GET /api/v1/timelines/feed/:id`; the feeds it reads are `GET /api/v1/feeds`), not in its home.
 
 ## Activities
 
@@ -201,8 +206,14 @@ Received:
 | `Block` of a persona | the follows between them end, the blocker's posts and notifications are hidden from the persona, nothing of the persona's is addressed to the blocker, and the relationship says `blocked_by`; `Undo{Block}` lifts it |
 
 Sent: `Follow`, `Undo{Follow}`, `Create{Note}`, `Create{Question}` and poll votes, `EmojiReact` and its `Undo`, `Update{Note}`, `Update{Person}`, `Delete{Tombstone}`, `Accept{Follow}`,
-`Reject{Follow}`, `Like`, `Announce` and their `Undo`, `Flag`, `Join` and `Leave` of a remote event, and the replies to a
-persona's posts passed on to its followers. A deleted post answers 410 with a `Tombstone`.
+`Reject{Follow}`, `Like`, `Dislike`, `Announce` and their `Undo`, `Flag`, `Join` and `Leave` of a remote event, and the
+replies to a persona's posts passed on to its followers. A deleted post answers 410 with a `Tombstone`.
+
+- **Votes.** A favourite is a `Like`, a downvote a `Dislike`; a persona has one vote a post, and a changed vote is sent
+  as the new vote alone, as Lemmy sends one (an `Undo` of the old one beside it could arrive after it and take the new
+  one away). `Undo` is sent only when the vote is taken back. A vote on a post in a remote community goes to the
+  community, which counts it and passes it on, as Lemmy sends one, and to the post's author only when it lives on
+  another server: one copy a server, since PieFed drops a second copy of an activity it has just seen.
 
 - **Attachments** are `Document`s with `mediaType`, `name` (alt text), `blurhash`, `focalPoint`, `width` and `height`.
   Uploaded files have all metadata removed.
@@ -405,8 +416,9 @@ Posts with a location (shown to nearby users of this server) never leave the ser
   unlisted replies are kept, each fetched from its own origin. A thread collection read whole, which counts its posts or
   holds them all, is asked again with `If-None-Match` and its last ETag; a 304 ends the read.
 - **Reading our documents (SecureMode).** privapub.thepra.dev answers ActivityPub GETs only when they are signed, like
-  Mastodon's authorized fetch; the server's own actors (the instance actor `/peasants/privapub` and the reporter
-  `/peasants/privapub_reports`) are the exception, since their keys are needed first.
+  Mastodon's authorized fetch; the server's own actors (the instance actor `/peasants/privapub`, the reporter
+  `/peasants/privapub_reports` and the reader of feeds `/peasants/privapub_feeds`) are the exception, since their keys
+  are needed first.
   A browser asking for HTML is redirected to the public page instead.
 - **Posts that are not public** (followers-only, direct, circle) are served to a signed request from someone they were
   for, or from the instance actor of a server where someone they were for lives, and to nobody else (404). Once deleted