P7: downvotes go out, and feeds are read through the server's reader

Votes out. A persona's downvote is a Dislike (POST /api/v1/statuses/:id/downvote and /undownvote, the viewer's own as
privapub.votes.downvoted). One vote a post: a changed vote is sent as the new vote alone, as Lemmy sends one, since an
Undo of the old one beside it could arrive after it and take the new one away; Undo goes only when a vote is taken back.
A vote on a post in a remote community goes to the community, which counts it, and to the author only when on another
server: one copy a server, since PieFed drops a second copy of an activity it has just seen. Mbin keeps a favourite
apart from a vote, so there a favourite stays after a switch to a downvote.

Feeds followed (owner decision 2026-10-07: through the server). Following a feed (Lemmy's multi-community, PieFed's feed)
keeps a FeedSubscription for the persona and nothing else; the new Service privapub_feeds (LocalActorKind.Reader,
reserved by migration _017) follows every community of the feeds read here, reconciled when a persona follows or leaves
one, when a feed's list is read again (kept as it was when it cannot be read) and every six hours. Its Following rows
carry FollowerKind, so nobody's home gets what it brings in and its unanswered follows are sent again as its own. The
persona reads GET /api/v1/timelines/feed/:id (the feed's threads, ours included) and lists its feeds at GET /api/v1/feeds.

Checked in the pasture, every scenario: 873 pass. The 14 failures are Hubzilla's (identical on the previous commit:
Hubzilla no longer answers a follow in this pasture since its restore) and two activities Smithereen never sent;
followsync passes once the pasture's restore is older than the 14-day pause. Live: alice's downvotes count as downvotes
on Lemmy 1.0 and PieFed, replacing her upvote; Lemmy 1.0 and PieFed take privapub_feeds' follows and their threads reach
the feed timelines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Federation/Actors/LocalActorService.cs

@@ -51,7 +51,7 @@ namespace PrivaPub.Federation.Actors
 		public string Wall => $"{Uri}/graffiti";
 		public bool HasWall => Kind == LocalActorKind.Person && !IsCircle && IsFederated;
 		// the server's own actors (the instance actor, the reporter): nobody follows, mentions or looks them up as accounts
-		public bool IsServerActor => Kind is LocalActorKind.Application or LocalActorKind.Reporter;
+		public bool IsServerActor => Kind is LocalActorKind.Application or LocalActorKind.Reporter or LocalActorKind.Reader;
 		public string Flock => $"{Uri}/flock";
 		public string Wardens => $"{Uri}/wardens";
 		public string SharedInbox => $"{BaseAddress}/human-centipede";
@@ -74,6 +74,7 @@ namespace PrivaPub.Federation.Actors
 		Task<LocalActor> FindByAddress(string address, CancellationToken token);
 		Task<LocalActor> GetInstanceActor(CancellationToken token);
 		Task<LocalActor> GetReporterActor(CancellationToken token);
+		Task<LocalActor> GetReaderActor(CancellationToken token);
 		Task<bool> IsUserNameTaken(string userName, CancellationToken token);
 		Task<bool> TryReserveUserName(string userName, LocalActorKind kind, string ownerId, CancellationToken token);
 		LocalActor FromAvatar(Avatar avatar);
@@ -89,13 +90,17 @@ namespace PrivaPub.Federation.Actors
 		// the anonymous Service that carries this server's reports to Lemmy, which takes no report from an Application
 		// (owner decision 2026-10-06): one actor for the server, never one per persona
 		public const string ReporterUserName = "privapub_reports";
+		// the anonymous Service that follows the communities of the feeds personas read, so no community learns which persona
+		// reads it (owner decision 2026-10-07); a Service, since Lemmy takes a follow from no Application
+		public const string ReaderUserName = "privapub_feeds";
 
 		public static bool IsServerActorName(string userName) =>
-			string.Equals(userName, InstanceUserName, StringComparison.OrdinalIgnoreCase) || string.Equals(userName, ReporterUserName, StringComparison.OrdinalIgnoreCase);
+			string.Equals(userName, InstanceUserName, StringComparison.OrdinalIgnoreCase) || string.Equals(userName, ReporterUserName, StringComparison.OrdinalIgnoreCase)
+			|| string.Equals(userName, ReaderUserName, StringComparison.OrdinalIgnoreCase);
 
 		static readonly HashSet<string> ReservedByInstance = new(StringComparer.Ordinal)
 		{
-			InstanceUserName, ReporterUserName, "admin", "administrator", "root", "system", "support", "help", "moderator", "mod",
+			InstanceUserName, ReporterUserName, ReaderUserName, "admin", "administrator", "root", "system", "support", "help", "moderator", "mod",
 			"abuse", "postmaster", "webmaster", "hostmaster", "security", "noreply", "no_reply", "null", "undefined"
 		};
 
@@ -103,6 +108,7 @@ namespace PrivaPub.Federation.Actors
 		readonly IOptionsMonitor<AppConfiguration> _appConfiguration;
 		InstanceActor _instanceActor;
 		ReporterActor _reporterActor;
+		ReaderActor _readerActor;
 
 		public LocalActorService(DbEntities dbEntities, IOptionsMonitor<AppConfiguration> appConfiguration)
 		{
@@ -121,6 +127,8 @@ namespace PrivaPub.Federation.Actors
 				return await GetInstanceActor(token);
 			if (userName == ReporterUserName)
 				return await GetReporterActor(token);
+			if (userName == ReaderUserName)
+				return await GetReaderActor(token);
 
 			var avatar = await _dbEntities.Avatars
 				.Match(a => a.UserName == userName && !a.DeletionAt.HasValue)
@@ -158,6 +166,8 @@ namespace PrivaPub.Federation.Actors
 					return group == default ? default : FromGroup(group);
 				case LocalActorKind.Reporter:
 					return await GetReporterActor(token);
+				case LocalActorKind.Reader:
+					return await GetReaderActor(token);
 				default:
 					return await GetInstanceActor(token);
 			}
@@ -221,6 +231,36 @@ namespace PrivaPub.Federation.Actors
 			};
 		}
 
+		public async Task<LocalActor> GetReaderActor(CancellationToken token)
+		{
+			var reader = _readerActor ??= await LoadReaderActor(token);
+
+			return new LocalActor
+			{
+				Id = reader.ID,
+				Kind = LocalActorKind.Reader,
+				UserName = ReaderUserName,
+				Name = $"Feeds read on {new Uri(BaseAddress).Host}",
+				Summary = "It follows the communities in the feeds this PrivaPub server's people read; it never names who reads them.",
+				PrivateKeyPem = reader.PrivateKey,
+				PublicKeyPem = reader.PublicKey,
+				Discoverable = false,
+				Published = reader.CreationDate,
+				BaseAddress = BaseAddress
+			};
+		}
+
+		async Task<ReaderActor> LoadReaderActor(CancellationToken token)
+		{
+			var reader = await _dbEntities.ReaderActors.Sort(r => r.CreationDate, Order.Ascending).ExecuteFirstAsync(token);
+			if (reader != default)
+				return reader;
+			var (privateKey, publicKey) = Keys.NewKeyPair();
+			reader = new ReaderActor { PrivateKey = privateKey, PublicKey = publicKey };
+			await DB.Default.SaveAsync(reader, token);
+			return reader;
+		}
+
 		async Task<ReporterActor> LoadReporterActor(CancellationToken token)
 		{
 			var reporter = await _dbEntities.ReporterActors.Sort(r => r.CreationDate, Order.Ascending).ExecuteFirstAsync(token);