P7: downvotes go out, and feeds are read through the server's reader

Votes out. A persona's downvote is a Dislike (POST /api/v1/statuses/:id/downvote and /undownvote, the viewer's own as
privapub.votes.downvoted). One vote a post: a changed vote is sent as the new vote alone, as Lemmy sends one, since an
Undo of the old one beside it could arrive after it and take the new one away; Undo goes only when a vote is taken back.
A vote on a post in a remote community goes to the community, which counts it, and to the author only when on another
server: one copy a server, since PieFed drops a second copy of an activity it has just seen. Mbin keeps a favourite
apart from a vote, so there a favourite stays after a switch to a downvote.

Feeds followed (owner decision 2026-10-07: through the server). Following a feed (Lemmy's multi-community, PieFed's feed)
keeps a FeedSubscription for the persona and nothing else; the new Service privapub_feeds (LocalActorKind.Reader,
reserved by migration _017) follows every community of the feeds read here, reconciled when a persona follows or leaves
one, when a feed's list is read again (kept as it was when it cannot be read) and every six hours. Its Following rows
carry FollowerKind, so nobody's home gets what it brings in and its unanswered follows are sent again as its own. The
persona reads GET /api/v1/timelines/feed/:id (the feed's threads, ours included) and lists its feeds at GET /api/v1/feeds.

Checked in the pasture, every scenario: 873 pass. The 14 failures are Hubzilla's (identical on the previous commit:
Hubzilla no longer answers a follow in this pasture since its restore) and two activities Smithereen never sent;
followsync passes once the pasture's restore is older than the 14-day pause. Live: alice's downvotes count as downvotes
on Lemmy 1.0 and PieFed, replacing her upvote; Lemmy 1.0 and PieFed take privapub_feeds' follows and their threads reach
the feed timelines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Api/Mastodon/Controllers/AccountsController.cs

@@ -32,10 +32,12 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		readonly IFollowService _follows;
 		readonly IOutboxPublisher _outbox;
 		readonly IRelationshipService _relationships;
+		readonly IFeedFollows _feeds;
 
 		public AccountsController(MastodonMapper mapper, DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors,
-			IFollowService follows, IOutboxPublisher outbox, IRelationshipService relationships)
+			IFollowService follows, IOutboxPublisher outbox, IRelationshipService relationships, IFeedFollows feeds)
 		{
+			_feeds = feeds;
 			_relationships = relationships;
 			_mapper = mapper;
 			_dbEntities = dbEntities;
@@ -266,14 +268,27 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			return Json(following.Select(f => accounts.GetValueOrDefault(f.TargetAccountId)).Where(a => a != default).ToList());
 		}
 
+		// PrivaPub's own: the feeds the persona reads (a feed's timeline is /api/v1/timelines/feed/:id)
+		[HttpGet("/api/v1/feeds"), Scope("read:follows")]
+		public async Task<IActionResult> Feeds(CancellationToken token)
+		{
+			var read = await DB.Default.Find<FeedSubscription>().Match(s => s.AvatarId == MyId).Sort(s => s.ID, MongoDB.Entities.Order.Descending).ExecuteAsync(token);
+			var accounts = await _mapper.Accounts(read.Select(s => s.FeedAccountId), token);
+			return Json(read.Select(s => accounts.GetValueOrDefault(s.FeedAccountId)).Where(a => a != default).ToList());
+		}
+
 		[HttpPost("/api/v1/accounts/{id}/follow"), Scope("write:follows")]
 		public async Task<IActionResult> Follow(string id, CancellationToken token)
 		{
 			var (local, remote) = await Find(id, token);
 			if (local == default && remote == default)
 				return NotFoundError();
+			// a feed is read through the server, whose reader follows its communities; the persona follows nothing
 			if (remote is { AvatarType: AvatarType.Feed })
-				return Error(StatusCodes.Status422UnprocessableEntity, "A feed is followed through its communities");
+			{
+				await _feeds.Subscribe(Me, remote, true, token);
+				return Json(await Relationship(id, token));
+			}
 			var following = await _follows.FollowAs(Me, local?.Uri ?? remote.ActorURI, Params.Bool("reblogs") != false, token);
 			return following == default ? Error(StatusCodes.Status403Forbidden, "This action is not allowed") : Json(await Relationship(id, token));
 		}
@@ -284,7 +299,10 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			var (local, remote) = await Find(id, token);
 			if (local == default && remote == default)
 				return NotFoundError();
-			await _follows.UnfollowAs(Me, local?.Uri ?? remote.ActorURI, token);
+			if (remote is { AvatarType: AvatarType.Feed })
+				await _feeds.Subscribe(Me, remote, false, token);
+			else
+				await _follows.UnfollowAs(Me, local?.Uri ?? remote.ActorURI, token);
 			return Json(await Relationship(id, token));
 		}
 
@@ -432,6 +450,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			var (local, remote) = await Find(id, token);
 			var uri = local?.Uri ?? remote?.ActorURI;
 			var following = uri == default ? default : await _dbEntities.Followings.Match(f => f.AvatarId == MyId && f.TargetActorURI == uri).ExecuteFirstAsync(token);
+			var reading = remote is { AvatarType: AvatarType.Feed } && await _feeds.IsSubscribed(MyId, remote.ActorURI, token);
 			var followedBy = uri == default ? default : await _dbEntities.Followers.Match(f => f.LocalActorId == MyId && f.ActorURI == uri).ExecuteFirstAsync(token);
 			var blocking = uri != default && await DB.Default.Find<Block>().Match(b => b.AvatarId == MyId && b.TargetActorURI == uri).ExecuteAnyAsync(token);
 			var mute = uri == default ? default : await DB.Default.Find<Mute>().Match(m => m.AvatarId == MyId && m.TargetActorURI == uri).ExecuteFirstAsync(token);
@@ -448,7 +467,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				Muting = mute != default && (mute.ExpiresAt == default || mute.ExpiresAt > DateTime.UtcNow),
 				MutingNotifications = mute?.HideNotifications == true,
 				DomainBlocking = domainBlocked,
-				Following = following?.State == FollowState.Accepted,
+				Following = following?.State == FollowState.Accepted || reading,
 				Requested = following?.State == FollowState.Requested,
 				ShowingReblogs = following?.ShowReblogs ?? false,
 				FollowedBy = followedBy?.IsAccepted == true,

PrivaPub/Api/Mastodon/Controllers/StatusesController.cs

@@ -333,6 +333,13 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		[HttpPost("/api/v1/statuses/{id}/unfavourite"), Scope("write:favourites")]
 		public Task<IActionResult> Unfavourite(string id, CancellationToken token) => Toggle(_statuses.Favourite(Me, id, false, token), id, token);
 
+		// PrivaPub's own, for the threadiverse's downvotes (a favourite is the upvote)
+		[HttpPost("/api/v1/statuses/{id}/downvote"), Scope("write:favourites")]
+		public Task<IActionResult> Downvote(string id, CancellationToken token) => Toggle(_statuses.Downvote(Me, id, true, token), id, token);
+
+		[HttpPost("/api/v1/statuses/{id}/undownvote"), Scope("write:favourites")]
+		public Task<IActionResult> Undownvote(string id, CancellationToken token) => Toggle(_statuses.Downvote(Me, id, false, token), id, token);
+
 		[HttpPost("/api/v1/statuses/{id}/reblog"), Scope("write:statuses")]
 		public async Task<IActionResult> Reblog(string id, CancellationToken token)
 		{

PrivaPub/Api/Mastodon/Controllers/TimelinesController.cs

@@ -64,6 +64,26 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			return await Respond(query, "/api/v1/timelines/public", token);
 		}
 
+		// PrivaPub's own: a feed the persona reads (Lemmy's multi-community, PieFed's feed), its communities' threads,
+		// newest first, as the server's reader of feeds brings them in (owner decision 2026-10-07)
+		[HttpGet("/api/v1/timelines/feed/{id}"), Scope("read:statuses")]
+		public async Task<IActionResult> Feed(string id, CancellationToken token)
+		{
+			var feed = await _dbEntities.ForeignAvatars.MatchID(id).ExecuteFirstAsync(token);
+			if (feed is not { AvatarType: Models.User.AvatarType.Feed }
+				|| !await DB.Default.Find<FeedSubscription>().Match(s => s.AvatarId == MyId && s.FeedActorURI == feed.ActorURI).ExecuteAnyAsync(token))
+				return NotFoundError();
+			var communities = feed.FeedCommunities;
+			var ours = Me.BaseAddress + "/peasants/";
+			var names = communities.Where(c => c.StartsWith(ours, StringComparison.Ordinal)).Select(c => c[ours.Length..]).ToList();
+			var groups = names.Count == 0
+				? new List<string>()
+				: (await _dbEntities.Groups.Match(g => names.Contains(g.UserName) && !g.DeletionAt.HasValue).ExecuteAsync(token)).Select(g => g.ID).ToList();
+			var query = _dbEntities.Posts.Match(p => (communities.Contains(p.AudienceURI) || groups.Contains(p.GroupId))
+				&& p.ReblogOfPostId == null && p.InReplyToURI == null).Match(VisibilityPolicy.IsPublic);
+			return await Respond(query, $"/api/v1/timelines/feed/{id}", token);
+		}
+
 		[HttpGet("/api/v1/timelines/tag/{hashtag}"), Scope("read:statuses", requiresUser: false), Microsoft.AspNetCore.Authorization.AllowAnonymous]
 		public async Task<IActionResult> Tag(string hashtag, CancellationToken token)
 		{