Moves carry follows over; first DMs to Lemmy 0.19 and Mbin go as ChatMessage

Two owner decisions of 2026-10-05, both recorded in ROADMAP:
- After a verified Move the personas following the old account follow the new one, in the same lists, and a mute or
  block of the old account carries over, as Mastodon does it.
- A direct message to one account on a server whose NodeInfo names Lemmy before 1.0 or Mbin goes as a ChatMessage,
  the one place PrivaPub decides by a server's software (invariant 17). G-0008 is closed.

Mbin addresses its private messages to the recipient's profile page, so a Create addressed to a persona's /@name now
reaches the persona. Checked live: moves 8/8, Lemmy 0.19 30/30, Mbin 26/26 with messages both ways. The software
theory runs alone, since every test's peer shares 127.0.0.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

CLAUDE.md

@@ -241,6 +241,10 @@ group www-data and reaches the private mongod; `sudo -u www-data` works too.
 16. **An `Accept` or `Reject` is routed by what it answers:** our Follow (`FollowService`, any `-again-N` resend), an
     interaction request (`InteractionApprovals`, with the author's authorization read back from its origin) or a
     persona's `Join` (`Participations`, by its `/grunts/join-<id>` id), each only from the origin of what it answers.
+17. **A server's software is for display, with one exception** (owner decision 2026-10-05): a direct message to one
+    account on a server whose NodeInfo names Lemmy before 1.0 or Mbin goes as a `ChatMessage`
+    (`StatusService.TakesOnlyChatMessages`), as one to an account that writes to us that way does. Nothing else may
+    branch on `RemoteInstance.Software`.
 
 ## Mastodon client API invariants
 
@@ -536,10 +540,11 @@ tools/pasture/run.sh down                                            # removes e
   `rate_limiter.yaml`. Its admin mbuser is made by its console; `peers/mbin_token.py` gets mbuser's OAuth token through
   the authorization-code flow (login form, consent), since a client-credentials client acts as a bot that may not vote.
   Mbin names what it makes during a request after the request's host, so every call says `Host: mbin.test`, never
-  the workstation's port. Its API never starts a conversation with an account elsewhere. `scenarios/mbin.sh`, 24
-  checks and one known gap (G-0008, direct messages): magazines both ways, threads with titles, a Note to a magazine
-  as a microblog post, comments both ways, favourites and upvotes both ways, a moderator's lock, unlock and removal, the
-  unfollow, statistics.
+  the workstation's port. Its access token lasts an hour, and the scenario gets a new one when it has expired. Its API
+  never starts a conversation with an account elsewhere, so mbuser answers in the thread alice began; Mbin addresses
+  that answer to alice's profile page. `scenarios/mbin.sh`, 26 checks: magazines both ways, threads with titles, a Note
+  to a magazine as a microblog post, comments both ways, favourites and upvotes both ways, private messages both ways,
+  a moderator's lock, unlock and removal, the unfollow, statistics.
 - **NodeBB (4.16.1):** the official image on the pasture's Mongo (database `nodebb`), set up once by its automated
   setup (`SETUP` with `NODEBB_*` variables, admin nbuser) into the `pasture-nodebb-config` volume, trusting the CA
   through `NODE_EXTRA_CA_CERTS`; its image runs `npm install` at every start. Its API (`/api/v3`) takes a bearer token
@@ -551,15 +556,16 @@ tools/pasture/run.sh down                                            # removes e
   rustls bundles, so `images/lemmy19` builds the tag with reqwest's `rustls-tls-native-roots` added (about ten minutes
   the first time) and the pasture's bundle is mounted as the system's. Its config names the database as `uri` (1.0:
   `connection`) and its API is v3 (`/api/v3`, `sort=New`, `resolve_object` answering views). It takes private messages
-  only as `ChatMessage`: a reply goes out as one, a first message cannot (G-0008). `scenarios/lemmy19.sh`, 29 checks
-  and that gap.
+  only as `ChatMessage`, which PrivaPub sends it, a first message too (invariant 17). `scenarios/lemmy19.sh`, 30
+  checks.
 - **Load (`load.sh`, needs the `flood` peer):** `flood` (`flood/flood.cs`, published once into `.flood`) answers as
   twenty fake servers and sends signed activities at a set rate; `load.sh --rate=N --seconds=N` measures the answers,
   the queue's wait and processing times, its drain, and a persona's home timeline meanwhile, and keeps each run in
   `out/load/`. `docs/LOAD.md` has the method and the runs.
 - **Account moves (`scenarios/moves.sh`, needs gts):** two fresh GoToSocial accounts made by its admin CLI; alice follows
   the old one, the new one names it as an alias (`/api/v1/accounts/alias`), the old one moves (`/api/v1/accounts/move`),
-  and PrivaPub shows it `moved` while alice's follow stays. 6 checks.
+  and PrivaPub shows it `moved` and moves alice's follow to the new one, which (locked by GoToSocial) approves it.
+  8 checks.
 - **Hollo (0.9.19):** Fedify's microblog server on the shared Postgres, set up through its web form (which
   checks `Origin` against `Host`, so the request names `hollo.test` without the port). It needs a 44-character
   `SECRET_KEY`, a media directory and a `themeColor`; statuses and votes go as JSON. Town only, no scenario.