Forwarded activities are believed as far as their origin vouches

A thread's server passes on what happens in it, signed with its own key: Mastodon forwards the replies to its
accounts' posts and their deletions, Friendica every activity in its threads. PrivaPub answered them 401, which also
tells a sender its signature failed. Now they get 202 and nothing in them is believed: a forwarded Create or Update is
taken as its object reads at the actor's origin, a Delete of a public or unlisted copy once that origin answers 404 or
410 (RemoteActorService.IsGone; FederationHttp remembers the status of a refusal), anything else is let go, and our own
activities coming back are ignored. A forwarded copy has its own dedupe key, so one that failed never hides the
author's own delivery.

A reply in the thread of someone followed here is kept, as Mastodon keeps them. Mastodon delivers a reply to the
followers of the account it answers; PrivaPub dropped those as unaddressed, which the pasture showed: the outsider's
reply its Mastodon scenario said was never delivered had been, and was thrown away.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

tools/pasture/scenarios/mastodon.sh

@@ -171,18 +171,22 @@ alice_on_m_o=$(mcurl -H "Authorization: Bearer $OT" "$M/api/v2/search?q=@alice_m
 unserved "$circle_uri" && ok "the circle post is not served unsigned" || ko "circle post served unsigned"
 
 echo "  threads"
-# a reply from an account nobody here follows is never delivered to PrivaPub; opening the thread has PrivaPub read
-# the thread's context collection (FEP-7888) and bring it in
+# Mastodon sends a reply to the followers of the account it answers, so an outsider's reply to someone alice follows
+# reaches PrivaPub, and is kept (as Mastodon keeps them); the outsider's answer to their own reply goes only to the
+# outsider's followers, none here, and opening the thread has PrivaPub read its context collection (FEP-7888) for it
 t_root=$(mcurl -X POST -H "$MH" "$M/api/v1/statuses" -d "status=a thread for elsewhere $circle_name&visibility=public" | j "print(d['id'])")
 until_true 30 'curl -s -H "$AH" "$P/api/v1/timelines/home" | grep -q "a thread for elsewhere $circle_name"' || true
 t_root_on_p=$(curl -s -H "$AH" "$P/api/v1/timelines/home" | j "print(next(s['id'] for s in d if 'a thread for elsewhere $circle_name' in s['content']))")
-mcurl -o /dev/null -X POST -H "Authorization: Bearer $OT" "$M/api/v1/statuses" -d "status=said where PrivaPub does not listen $circle_name&in_reply_to_id=$t_root&visibility=public"
+t_reply=$(mcurl -X POST -H "Authorization: Bearer $OT" "$M/api/v1/statuses" -d "status=an outsider answers $circle_name&in_reply_to_id=$t_root&visibility=public" | j "print(d['id'])")
+until_true 30 '[ "$(podman exec pasture-mongo mongosh --quiet PrivaPub --eval "print(db.Post.countDocuments({Text:/an outsider answers $circle_name/}))")" = "1" ]' \
+	&& ok "an outsider's reply in a followed account's thread is kept" || ko "the outsider's reply Mastodon delivered was dropped"
+mcurl -o /dev/null -X POST -H "Authorization: Bearer $OT" "$M/api/v1/statuses" -d "status=said where PrivaPub does not listen $circle_name&in_reply_to_id=$t_reply&visibility=public"
 sleep 5
 [ "$(podman exec pasture-mongo mongosh --quiet PrivaPub --eval "print(db.Post.countDocuments({Text:/said where PrivaPub does not listen $circle_name/}))")" = "0" ] \
-	&& ok "an outsider's reply is not delivered to PrivaPub" || ko "the outsider's reply was delivered (the check below proves nothing)"
+	&& ok "the outsider's answer to their own reply is not delivered to PrivaPub" || ko "the outsider's own answer was delivered (the check below proves nothing)"
 curl -s -o /dev/null -H "$AH" "$P/api/v1/statuses/$t_root_on_p/context"
 until_true 30 'curl -s -H "$AH" "$P/api/v1/statuses/$t_root_on_p/context" | grep -q "said where PrivaPub does not listen $circle_name"' \
-	&& ok "opening the thread brings the outsider's reply from Mastodon's context" || ko "the thread never got the outsider's reply"
+	&& ok "opening the thread brings the outsider's answer from Mastodon's context" || ko "the thread never got the outsider's answer"
 
 echo "  reports"
 curl -s -o /dev/null -X POST -H "$AH" "$P/api/v1/reports" -d "account_id=$masto_on_p&comment=pasture-report-$circle_name&forward=true"