P7: downvotes go out, and feeds are read through the server's reader

Votes out. A persona's downvote is a Dislike (POST /api/v1/statuses/:id/downvote and /undownvote, the viewer's own as
privapub.votes.downvoted). One vote a post: a changed vote is sent as the new vote alone, as Lemmy sends one, since an
Undo of the old one beside it could arrive after it and take the new one away; Undo goes only when a vote is taken back.
A vote on a post in a remote community goes to the community, which counts it, and to the author only when on another
server: one copy a server, since PieFed drops a second copy of an activity it has just seen. Mbin keeps a favourite
apart from a vote, so there a favourite stays after a switch to a downvote.

Feeds followed (owner decision 2026-10-07: through the server). Following a feed (Lemmy's multi-community, PieFed's feed)
keeps a FeedSubscription for the persona and nothing else; the new Service privapub_feeds (LocalActorKind.Reader,
reserved by migration _017) follows every community of the feeds read here, reconciled when a persona follows or leaves
one, when a feed's list is read again (kept as it was when it cannot be read) and every six hours. Its Following rows
carry FollowerKind, so nobody's home gets what it brings in and its unanswered follows are sent again as its own. The
persona reads GET /api/v1/timelines/feed/:id (the feed's threads, ours included) and lists its feeds at GET /api/v1/feeds.

Checked in the pasture, every scenario: 873 pass. The 14 failures are Hubzilla's (identical on the previous commit:
Hubzilla no longer answers a follow in this pasture since its restore) and two activities Smithereen never sent;
followsync passes once the pasture's restore is older than the 14-day pause. Live: alice's downvotes count as downvotes
on Lemmy 1.0 and PieFed, replacing her upvote; Lemmy 1.0 and PieFed take privapub_feeds' follows and their threads reach
the feed timelines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Domain/Social/FeedFollows.cs

@@ -0,0 +1,134 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+namespace PrivaPub.Domain.Social
+{
+	public interface IFeedFollows
+	{
+		Task<bool> Subscribe(LocalActor me, ForeignAvatar feed, bool on, CancellationToken token);
+		Task<bool> IsSubscribed(string avatarId, string feedActorUri, CancellationToken token);
+		Task Reconcile(CancellationToken token);
+	}
+
+	// Feeds read through the server (owner decision 2026-10-07): a persona following a feed is kept here alone, and the
+	// server's reader (LocalActorService.ReaderUserName) follows every community in the feeds anyone reads, as Lemmy's own
+	// follower of multi-communities does, and stops following one no feed holds any more. What it follows arrives as any
+	// community's posts do; nobody's home shows them, the feed's timeline does.
+	public class FeedFollows : IFeedFollows
+	{
+		public const int MaxCommunities = 500;
+		static readonly TimeSpan Stale = TimeSpan.FromDays(1);
+
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IRemoteActorService _remoteActors;
+		readonly IFollowService _follows;
+		readonly IJobQueue _jobs;
+
+		public FeedFollows(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IFollowService follows, IJobQueue jobs)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_remoteActors = remoteActors;
+			_follows = follows;
+			_jobs = jobs;
+		}
+
+		public static Task<bool> Sync(IJobQueue jobs, CancellationToken token) =>
+			jobs.Enqueue(JobKind.SyncFeeds, string.Empty, default, $"feeds|{Guid.NewGuid():N}", token);
+
+		public async Task<bool> Subscribe(LocalActor me, ForeignAvatar feed, bool on, CancellationToken token)
+		{
+			if (feed is not { AvatarType: AvatarType.Feed })
+				return false;
+			if (on)
+				try
+				{
+					await DB.Default.SaveAsync(new FeedSubscription { AvatarId = me.Id, FeedActorURI = feed.ActorURI, FeedAccountId = feed.ID }, token);
+				}
+				catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+				{
+					return true;
+				}
+			else if ((await DB.Default.DeleteAsync<FeedSubscription>(s => s.AvatarId == me.Id && s.FeedActorURI == feed.ActorURI)).DeletedCount == 0)
+				return true;
+			await Sync(_jobs, token);
+			return true;
+		}
+
+		public Task<bool> IsSubscribed(string avatarId, string feedActorUri, CancellationToken token) =>
+			DB.Default.Find<FeedSubscription>().Match(s => s.AvatarId == avatarId && s.FeedActorURI == feedActorUri).ExecuteAnyAsync(token);
+
+		public async Task Reconcile(CancellationToken token)
+		{
+			var read = (await DB.Default.Find<FeedSubscription, string>().Project(s => s.FeedActorURI).ExecuteAsync(token)).Distinct().ToList();
+			var feeds = await _dbEntities.ForeignAvatars.Match(a => read.Contains(a.ActorURI) && a.AvatarType == AvatarType.Feed && !a.DeletionAt.HasValue)
+				.ExecuteAsync(token);
+			// a feed's communities are as its server listed them a day ago at most (AccountCountsJob reads them, then asks
+			// for this again)
+			foreach (var stale in feeds.Where(f => !(DateTime.UtcNow - f.CountedAt < Stale)))
+				if (Uri.TryCreate(stale.ActorURI, UriKind.Absolute, out var uri))
+					await _jobs.Enqueue(JobKind.CountAccount, stale.ActorURI, uri.Host.ToLowerInvariant(), AccountCountsJob.DedupeKey(stale.ActorURI, DateTime.UtcNow), token);
+
+			var ours = _localActors.BaseAddress + "/";
+			var wanted = feeds.SelectMany(f => f.FeedCommunities).Where(c => !c.StartsWith(ours, StringComparison.Ordinal))
+				.Distinct(StringComparer.Ordinal).Take(MaxCommunities).ToHashSet(StringComparer.Ordinal);
+			var reader = await _localActors.GetReaderActor(token);
+			var following = await _dbEntities.Followings.Match(f => f.AvatarId == reader.Id).ExecuteAsync(token);
+			foreach (var gone in following.Where(f => !wanted.Contains(f.TargetActorURI)))
+				await _follows.UnfollowAs(reader, gone.TargetActorURI, token);
+			var followed = following.Select(f => f.TargetActorURI).ToHashSet(StringComparer.Ordinal);
+			foreach (var community in wanted.Where(c => !followed.Contains(c)))
+				// only a community: a feed lists nothing else, and the reader follows nothing else
+				if (await _remoteActors.GetActor(community, refresh: false, token) is { AvatarType: AvatarType.Group })
+					await _follows.FollowAs(reader, community, showReblogs: false, token);
+		}
+	}
+
+	public class FeedSyncJob(IServiceScopeFactory scopes) : IJobHandler
+	{
+		public JobKind Kind => JobKind.SyncFeeds;
+		public int Concurrency => 1;
+		public int MaxAttempts => 2;
+		public int PerHostLimit => 1;
+
+		public async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			using var scope = scopes.CreateScope();
+			await scope.ServiceProvider.GetRequiredService<IFeedFollows>().Reconcile(token);
+			return JobOutcome.Done;
+		}
+	}
+
+	// brings the reader's follows up to date with the feeds read here, a minute after start and then every six hours
+	public sealed class FeedReader(IServiceScopeFactory scopes, ILogger<FeedReader> logger) : BackgroundService
+	{
+		static readonly TimeSpan Every = TimeSpan.FromHours(6);
+
+		protected override async Task ExecuteAsync(CancellationToken token)
+		{
+			await Task.Delay(TimeSpan.FromMinutes(1), token);
+			using var timer = new PeriodicTimer(Every);
+			do
+			{
+				try
+				{
+					using var scope = scopes.CreateScope();
+					await FeedFollows.Sync(scope.ServiceProvider.GetRequiredService<IJobQueue>(), token);
+				}
+				catch (Exception ex) when (ex is not OperationCanceledException)
+				{
+					logger.LogWarning(ex, "Feeds could not be brought up to date");
+				}
+			}
+			while (await timer.WaitForNextTickAsync(token));
+		}
+	}
+}

PrivaPub/Domain/Social/FollowService.cs

@@ -119,6 +119,7 @@ namespace PrivaPub.Domain.Social
 			var following = new Following
 			{
 				AvatarId = follower.Id,
+				FollowerKind = follower.Kind == LocalActorKind.Person ? default(LocalActorKind?) : follower.Kind,
 				TargetActorURI = targetUri,
 				TargetAccountId = local?.Id ?? remote.ID,
 				TargetIsLocal = local != default,
@@ -298,7 +299,7 @@ namespace PrivaPub.Domain.Social
 				.ExecuteAsync(token);
 			foreach (var following in pending.Where(f => (f.ResentAt ?? f.CreatedAt) + ResendAfter[f.Resent] <= now))
 			{
-				var follower = await _localActors.FindById(LocalActorKind.Person, following.AvatarId, token);
+				var follower = await _localActors.FindById(following.FollowerKind ?? LocalActorKind.Person, following.AvatarId, token);
 				var inbox = following.TargetInboxURL ?? (await _remoteActors.GetActor(following.TargetActorURI, refresh: false, token))?.InboxURL;
 				if (follower != default && !string.IsNullOrEmpty(inbox))
 				{

PrivaPub/Domain/Statuses/StatusService.cs

@@ -64,6 +64,7 @@ namespace PrivaPub.Domain.Statuses
 		Task<StatusOutcome> Edit(LocalActor author, string postId, StatusDraft draft, CancellationToken token);
 		Task<StatusOutcome> Remove(LocalActor author, string postId, CancellationToken token);
 		Task<StatusOutcome> Favourite(LocalActor me, string postId, bool on, CancellationToken token);
+		Task<StatusOutcome> Downvote(LocalActor me, string postId, bool on, CancellationToken token);
 		Task<StatusOutcome> Reblog(LocalActor me, string postId, bool on, PostVisibility visibility, CancellationToken token);
 	}
 
@@ -438,6 +439,9 @@ namespace PrivaPub.Domain.Statuses
 			var likePermission = on ? await Permission(post, me, InteractionKind.Like, token) : QuotePermission.Granted;
 			if (likePermission == QuotePermission.Denied)
 				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: Its author does not take likes from you");
+			// one vote a post: an upvote replaces the downvote, here and, by its Like alone, there
+			if (on)
+				await Forget<Downvote>(d => d.PostId == post.ID && d.ActorURI == me.Uri, post, p => p.DownvotesCount, token);
 
 			// each favourite is a Like of its own, as Mastodon's are: a favourite after an unfavourite is a new Like, which no
 			// server (and no delivery queue) takes for the one already undone; an unfavourite undoes the Like it ends
@@ -472,7 +476,7 @@ namespace PrivaPub.Domain.Statuses
 				post.FavouritesCount--;
 			}
 
-			if (post.IsFederatedCopy && await AuthorInbox(post, token) is { } inbox)
+			if (post.IsFederatedCopy && await VoteInboxes(post, token) is { Count: > 0 } inboxes)
 			{
 				var like = new JsonObject
 				{
@@ -485,11 +489,95 @@ namespace PrivaPub.Domain.Statuses
 				if (on && favourite.Approval == ApprovalState.Pending)
 					await _approvals.Ask(me, post, InteractionKind.Like, like, favourite.ID, token);
 				else
-					await _delivery.Enqueue(me, new[] { inbox }, on ? like : Undo(me, like, $"undo-like-{favourite.ID}"), token);
+					await _delivery.Enqueue(me, inboxes, on ? like : Undo(me, like, $"undo-like-{favourite.ID}"), token);
 			}
 			return new StatusOutcome(post);
 		}
 
+		// A downvote, as the threadiverse counts them (Lemmy, PieFed): a `Dislike` to the post's author and its community,
+		// `Undo{Dislike}` to take it back. One vote a post: a downvote replaces the upvote by its Dislike alone, as Lemmy
+		// sends a changed vote, since an Undo{Like} sent beside it could arrive after it and take the downvote away (Mbin,
+		// which keeps a favourite apart, keeps it). Public, as a favourite is (owner decision: the client tells each
+		// persona once).
+		public async Task<StatusOutcome> Downvote(LocalActor me, string postId, bool on, CancellationToken token)
+		{
+			var post = await Visible(me, postId, token);
+			if (post?.ReblogOfPostId != default)
+				post = await Visible(me, post.ReblogOfPostId, token);
+			if (post == default)
+				return StatusOutcome.Fail(StatusCodes.Status404NotFound, "Record not found");
+
+			Downvote downvote;
+			if (on)
+			{
+				await Forget<Favourite>(f => f.AccountId == me.Id && f.PostId == post.ID, post, p => p.FavouritesCount, token);
+				downvote = new Downvote { ID = ObjectId.GenerateNewId().ToString(), AccountId = me.Id, ActorURI = me.Uri, PostId = post.ID };
+				downvote.ActivityURI = me.ActivityUri($"dislike-{downvote.ID}");
+				try
+				{
+					await DB.Default.SaveAsync(downvote, token);
+				}
+				catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+				{
+					return new StatusOutcome(post);
+				}
+				await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(b => b.Inc(p => p.DownvotesCount, 1)).ExecuteAsync(token);
+				post.DownvotesCount++;
+			}
+			else
+			{
+				downvote = await DB.Default.Find<Downvote>().Match(d => d.PostId == post.ID && d.ActorURI == me.Uri).ExecuteFirstAsync(token);
+				if (downvote == default || (await DB.Default.DeleteAsync<Downvote>(downvote.ID)).DeletedCount == 0)
+					return new StatusOutcome(post);
+				await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(b => b.Inc(p => p.DownvotesCount, -1)).ExecuteAsync(token);
+				post.DownvotesCount--;
+			}
+
+			if (post.IsFederatedCopy && await VoteInboxes(post, token) is { Count: > 0 } inboxes)
+			{
+				var dislike = new JsonObject
+				{
+					["@context"] = ActivityPubRenderer.ActivityStreams,
+					["id"] = downvote.ActivityURI,
+					["type"] = "Dislike",
+					["actor"] = me.Uri,
+					["object"] = post.ObjectURI
+				};
+				await _delivery.Enqueue(me, inboxes, on ? dislike : Undo(me, dislike, $"undo-dislike-{downvote.ID}"), token);
+			}
+			return new StatusOutcome(post);
+		}
+
+		// the persona's other vote on the post, dropped here alone: the vote that replaces it says so there
+		async Task Forget<TVote>(System.Linq.Expressions.Expression<Func<TVote, bool>> mine, PostEntity post,
+			System.Linq.Expressions.Expression<Func<PostEntity, int>> count, CancellationToken token) where TVote : Entity
+		{
+			var vote = await DB.Default.Find<TVote>().Match(mine).ExecuteFirstAsync(token);
+			if (vote == default || (await DB.Default.DeleteAsync<TVote>(vote.ID)).DeletedCount == 0)
+				return;
+			await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(b => b.Inc(count, -1)).ExecuteAsync(token);
+			if (typeof(TVote) == typeof(Favourite))
+				post.FavouritesCount--;
+			else
+				post.DownvotesCount--;
+		}
+
+		// where a vote on a remote post goes: the community it was made in, which counts the votes and passes them on, as
+		// Lemmy sends one; and its author when on another server (a Mastodon account's post in a Lemmy community). One copy a
+		// server: PieFed drops the second it is sent within a minute, though its first may yet fail.
+		async Task<List<string>> VoteInboxes(PostEntity post, CancellationToken token)
+		{
+			var inboxes = new List<string>();
+			if (await Federation.Inbox.Communities.Of(post, _dbEntities, token) is { } communityUri
+				&& await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == communityUri && f.AvatarType == AvatarType.Group).ExecuteFirstAsync(token) is { } community
+				&& !string.IsNullOrEmpty(community.InboxURL))
+				inboxes.Add(community.InboxURL);
+			if (await AuthorInbox(post, token) is { } author
+				&& !inboxes.Any(i => string.Equals(new Uri(i).Authority, new Uri(author).Authority, StringComparison.OrdinalIgnoreCase)))
+				inboxes.Add(author);
+			return inboxes;
+		}
+
 		// how a remote post's interaction policy takes an interaction of ours: at once, once asked, or not at all
 		async Task<QuotePermission> Permission(PostEntity target, LocalActor actor, InteractionKind kind, CancellationToken token) =>
 			target is { IsFederatedCopy: true } && _approvals != default ? await _approvals.Judge(target, actor, kind, token) : QuotePermission.Granted;

PrivaPub/Domain/Timelines/Fanout.cs

@@ -40,13 +40,14 @@ namespace PrivaPub.Domain.Timelines
 			{
 				case PostVisibility.Public or PostVisibility.Unlisted or PostVisibility.FollowersOnly:
 					var followers = post.IsFederatedCopy
-						? await _dbEntities.Followings.Match(f => f.TargetActorURI == post.ActorURI && f.State == FollowState.Accepted).ExecuteAsync(token)
+						? await _dbEntities.Followings.Match(f => f.TargetActorURI == post.ActorURI && f.State == FollowState.Accepted && f.FollowerKind == null).ExecuteAsync(token)
 						: await _dbEntities.Followings.Match(f => f.TargetAccountId == post.GroupUserId && f.TargetIsLocal && f.State == FollowState.Accepted).ExecuteAsync(token);
 					foreach (var following in followers)
 						if (await Shows(following, post, token))
 							recipients.Add(following.AvatarId);
 					if (!string.IsNullOrEmpty(post.AudienceURI))
-						foreach (var member in await _dbEntities.Followings.Match(f => f.TargetActorURI == post.AudienceURI && f.State == FollowState.Accepted).ExecuteAsync(token))
+						// (the server's reader of feeds follows communities for nobody's home)
+						foreach (var member in await _dbEntities.Followings.Match(f => f.TargetActorURI == post.AudienceURI && f.State == FollowState.Accepted && f.FollowerKind == null).ExecuteAsync(token))
 							recipients.Add(member.AvatarId);
 					// a post on a wall (FEP-400e): its owner, when a persona, and those following the owner
 					if (!string.IsNullOrEmpty(post.WallOwnerURI))