Pasture: WordPress pinned with its updates off, Mbin's worker restarting, threads checking our own deliveries

A full sweep found three peers silent. WordPress had updated itself to 7.1.2 from WP-Cron, and the new CA bundle dropped
Caddy's root: it now runs the 7.1.2 image with automatic updates off. Mbin's messenger worker had died when the shared
Postgres restarted under it: it now consumes again whenever it stops. Friendica sat in a quarantine left by the old
breaker. The threads scenario checks that PrivaPub never sends carol's reply to Mastodon, since a relay Mastodon has just
left (the relay scenario's) may still pass it on. With these, every scenario passes but the crawler's, which needs it
switched on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

tools/pasture/peers/wordpress.sh

@@ -1,10 +1,11 @@
-# WordPress 6 with the ActivityPub plugin 9.3.1: posts as Articles (or Notes when short), comments as replies, each
+# WordPress 7.1.2 with the ActivityPub plugin 9.3.1: posts as Articles (or Notes when short), comments as replies, each
 # author an actor and the blog one too, likes and boosts kept as comments of their kind. On a shared MySQL 8.4 (database
 # wordpress). The plugin federates from WP-Cron, so a sidecar runs the due events every few seconds. WordPress sends its
 # requests through its own CA bundle (wp-includes/certificates), to which Caddy's root is appended; its URL guard refuses
 # private addresses with no switch, which the pasture's public-looking subnet passes. The admin is wpuser; the town's
-# accounts are authors with application passwords for the REST API.
-WORDPRESS_IMAGE=${WORDPRESS_IMAGE:-docker.io/library/wordpress:6-apache}
+# accounts are authors with application passwords for the REST API. Its automatic updates are off: one (core 7.1.2,
+# 2026-10-05) wrote a new CA bundle over the one Caddy's root was appended to, and nothing reached PrivaPub after it.
+WORDPRESS_IMAGE=${WORDPRESS_IMAGE:-docker.io/library/wordpress:7.1.2-apache}
 WORDPRESS_CLI_IMAGE=${WORDPRESS_CLI_IMAGE:-docker.io/library/wordpress:cli}
 WORDPRESS_ACTIVITYPUB=9.3.1
 WORDPRESS_PASSWORD=Wordpress-Pasture-1
@@ -24,7 +25,7 @@ wordpress_up() {
 	# behind Caddy: https as the proxy says, and the site's own address
 	local extra="if (isset(\$_SERVER['HTTP_X_FORWARDED_PROTO']) && \$_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') { \$_SERVER['HTTPS'] = 'on'; }
 define('WP_HOME', 'https://wordpress.test'); define('WP_SITEURL', 'https://wordpress.test'); define('DISABLE_WP_CRON', true);
-define('FS_METHOD', 'direct');"
+define('FS_METHOD', 'direct'); define('AUTOMATIC_UPDATER_DISABLED', true); define('WP_AUTO_UPDATE_CORE', false);"
 	podman run -d --replace --name pasture-wordpress --network $net \
 		-e WORDPRESS_DB_HOST=mysql -e WORDPRESS_DB_USER=pasture -e WORDPRESS_DB_PASSWORD=pasture -e WORDPRESS_DB_NAME=wordpress \
 		-e WORDPRESS_CONFIG_EXTRA="$extra" -v pasture-wordpress-html:/var/www/html -v "$ca:/pasture/ca:z,ro" \