Everything on, phase 4a: one answer everywhere for counts, search, collections and the instance API

Owner decision 2026-10-04: fix the mismatches and every other mismatch of the same kind.

- One counting rule (Domain/Privacy/Counted), Mastodon's. It is used for a persona's statuses_count, its outbox
  totalItems, NodeInfo localPosts and the instance status_count, which used to count four different things. It
  counts every post that is neither deleted nor a DM, boosts included, and circle and located posts too (owner
  decision). A group's count includes its remote members' posts.
- Users. Personas of banned or deleted roots no longer count, and are not found in search. NodeInfo now gives
  activeMonth and activeHalfyear, and the v2 instance gives active_month instead of a constant 0.
- replies_count counts only public and unlisted replies, so it no longer tells anyone that a private reply exists.
  Migration _012 recounts it.
- A remote account that deletes itself takes everything out of every count (GoneActors): its likes, downvotes,
  reactions and poll votes go and their counters come back, as do its boosts', replies' and quotes' counts, and its
  notifications. Lookups, account lists, search and favourited_by no longer show it. Migration _012 applies this to
  accounts already gone.
- Deleting a post also deletes its pins and the local boosts of it.
- /stalking gives the same total as following_count. Members are still never listed, and hide_collections is now
  always true, since the setting never did anything.
- Joining a community by invitation is following it, so /flock and /groupies agree; leaving unfollows.
- Search. Anyone may search, as on Mastodon; resolve and offset need a sign-in, offset pages, and deleted accounts
  are never found.
- notifications/unread_count counts what the list shows, and the owner's follower and following lists page with
  Link.
- The instance API advertises what is enforced:
  - max_characters, now enforced with a 422;
  - max_pinned_statuses = MaxPins;
  - the media types and limits MediaService and MediaOptions accept;
  - PollService's limits;
  - the configured languages;
  - no streaming URL until streaming exists.

  domain_count counts the servers we have exchanged with; which ones stays unpublished (peers is empty).
- Routes Mastodon answers now answer instead of 404:
  - directory, tags/{name}, timelines/link and identity_proofs;
  - instance/languages, translation_languages, domain_blocks and privacy_policy;
  - the v1 and v2 notification policy, and notification requests.

Also, from phase 3: a recovered password ends /clientapi sessions through a per-root SessionStamp claim instead of
comparing the JWT's whole-second nbf with the change time. That comparison let a token issued in the same second
survive, which made a test flaky.

671 tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

PrivaPub/Api/Mastodon/Controllers/SearchController.cs

@@ -35,11 +35,15 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			_search = search;
 		}
 
-		[HttpGet("/api/v2/search"), Scope("read:search", requiresUser: false)]
+		// Anyone may search, as on Mastodon; only resolving (which fetches from other servers) and paging need a sign-in.
+		[HttpGet("/api/v2/search"), Scope("read:search", requiresUser: false), Microsoft.AspNetCore.Authorization.AllowAnonymous]
 		public async Task<IActionResult> Search(CancellationToken token)
 		{
 			var q = Params.Get("q")?.Trim();
 			var type = Params.Get("type");
+			var offset = Params.Int("offset") ?? 0;
+			if (MyId == default && (Params.Bool("resolve") == true || offset > 0))
+				return Error(StatusCodes.Status401Unauthorized, "Search queries that resolve uris or use offset require the read:search scope");
 			var resolve = Params.Bool("resolve") == true && MyId != default;
 			var results = new SearchResults();
 			if (string.IsNullOrEmpty(q))
@@ -66,7 +70,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 
 			if (type is null or "accounts")
 			{
-				results.Accounts = await _search.Find(q, resolve, Limit(), token);
+				results.Accounts = await _search.Find(q, resolve, Limit(), Math.Max(0, offset), token);
 			}
 			if (type is null or "hashtags" && q.TrimStart('#') is { Length: > 0 } tag)
 				results.Hashtags.Add(new { name = tag.ToLowerInvariant(), url = $"{_localActors.BaseAddress}/tags/{Uri.EscapeDataString(tag.ToLowerInvariant())}", history = Array.Empty<object>() });
@@ -133,5 +137,67 @@ namespace PrivaPub.Api.Mastodon.Controllers
 
 		[HttpGet("/api/v1/push/subscription"), Scope("push")]
 		public IActionResult PushSubscription() => Error(StatusCodes.Status404NotFound, "Record not found");
+
+		// Routes Mastodon answers that we have nothing behind: an empty or default answer lets clients degrade, where a
+		// 404 breaks some of them (Mastodon invariant 5)
+		[HttpGet("/api/v1/directory"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult Directory() => Json(Array.Empty<object>());
+
+		[HttpGet("/api/v1/timelines/link"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult LinkTimeline() => Json(Array.Empty<object>());
+
+		[HttpGet("/api/v1/accounts/{id}/identity_proofs"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult IdentityProofs(string id) => Json(Array.Empty<object>());
+
+		[HttpGet("/api/v1/tags/{name}"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult Tag(string name)
+		{
+			var tag = name?.TrimStart('#').ToLowerInvariant() ?? string.Empty;
+			var baseAddress = HttpContext.RequestServices.GetRequiredService<Federation.Actors.ILocalActorService>().BaseAddress;
+			return Json(new { name = tag, url = $"{baseAddress}/tags/{Uri.EscapeDataString(tag)}", history = Array.Empty<object>(), following = false });
+		}
+
+		[HttpGet("/api/v1/instance/languages"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult Languages() => Json(InstanceController.LanguageCodes(HttpContext.RequestServices)
+			.Select(code => new { code, name = System.Globalization.CultureInfo.GetCultureInfo(code).EnglishName }));
+
+		[HttpGet("/api/v1/instance/translation_languages"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult TranslationLanguages() => Json(new { });
+
+		[HttpGet("/api/v1/instance/domain_blocks"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult InstanceDomainBlocks() => Json(Array.Empty<object>());
+
+		[HttpGet("/api/v1/instance/privacy_policy"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult PrivacyPolicy() => Json(new
+		{
+			updated_at = "2026-10-04T00:00:00.000Z",
+			content = "<p>One private login owns several public personas, and nobody but this server's admin can tell they belong "
+				+ "together. What a persona posts is shared as its visibility says; a located post never leaves this server. "
+				+ "Uploads lose their metadata. Statistics name servers, never people: see /stargazing.</p>"
+		});
+
+		[HttpGet("/api/v1/notifications/policy"), Scope("read:notifications")]
+		public IActionResult NotificationPolicyV1() => Json(new
+		{
+			filter_not_following = false,
+			filter_not_followers = false,
+			filter_new_accounts = false,
+			filter_private_mentions = false,
+			summary = new { pending_requests_count = 0, pending_notifications_count = 0 }
+		});
+
+		[HttpGet("/api/v2/notifications/policy"), Scope("read:notifications")]
+		public IActionResult NotificationPolicyV2() => Json(new
+		{
+			for_not_following = "accept",
+			for_not_followers = "accept",
+			for_new_accounts = "accept",
+			for_private_mentions = "accept",
+			for_limited_accounts = "accept",
+			summary = new { pending_requests_count = 0, pending_notifications_count = 0 }
+		});
+
+		[HttpGet("/api/v1/notifications/requests"), Scope("read:notifications")]
+		public IActionResult NotificationRequests() => Json(Array.Empty<object>());
 	}
 }