T11: Mastodon 4.7.3 in the pasture

peers/mastodon.sh runs Mastodon's web and sidekiq containers on a shared Postgres and Redis
(peers/shared.sh). They trust Caddy's CA through SSL_CERT_FILE and reach private addresses
through ALLOWED_PRIVATE_ADDRESSES. Its users and tokens come from tootctl and rails runner.

scenarios/mastodon.sh adds 49 checks, as listed in docs/INTEROP.md: follows, posts,
replies, likes and boosts with undos, DMs, polls, FEP-044f quotes both ways, media through
the proxy, edits, deletes, locked follows, a circle request, reports, blocks and statistics.
Two are expected failures:
- inbound Block (P7);
- circle posts. Mastodon 4.7 loses the recipient of deliveries to its numeric
  /ap/users/<id>/inbox and then drops a post that names no local account. The fix on our
  side changes what a circle reveals, so it waits for the owner.

GoToSocial and Mastodon together: 86 passed, 0 failed.

The pasture now copies Caddy's root certificate reliably, readable by the peers, and
rebuilds the bundle each time. The CA directory is mounted shared (:z), because a private
:Z label locks out every container but the last. pfetch reaches PrivaPub's own https URIs
through Caddy. PRIVAPUB_ENV passes settings to PrivaPub, which scenarios/crawler.sh uses to
check the opt-in crawler against Mastodon: it visits, describes and reads the peers list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

docs/INTEROP.md

@@ -150,6 +150,36 @@ Priorities, used throughout:
 | Publish `context` and a paged `replies` | P2 | — |
 | `FeatureRequest`: send `Reject` (or implement FEP-7aa9) | P3 | — |
 
+**Pasture evidence (2026-10-03, Mastodon v4.7.3, `tools/pasture/scenarios/mastodon.sh`):** 49 checks pass. They cover:
+- discovery, follows and locked follows both ways;
+- public, CW and followers-only posts (the last answering 404 unsigned);
+- replies threading both ways;
+- likes, boosts and their undos both ways, with counts;
+- DMs both ways;
+- polls and votes both ways;
+- FEP-044f quotes approved both ways;
+- images with alt text both ways, ours through `/media/proxy`;
+- edits with history both ways;
+- deletes both ways, ours answering 410;
+- a Flag reaching Mastodon's moderators from the instance actor;
+- a circle request held for its owner and approved;
+- unfollow and block;
+- statistics naming `mastodon.test` as mastodon with no account names.
+
+Findings:
+- **Mastodon 4.7 names its actors by number**: `https://mastodon.test/ap/users/<id>`, inbox `…/ap/users/<id>/inbox`. Nothing here may assume
+  `/users/<name>`.
+- **It drops circle posts** (expected failure in the scenario).
+  - A post addressed only to `[circle, circle/flock]` parses as `direct` there, and Mastodon keeps a `direct` post
+    only if it names a local account or arrived in a known account's inbox (`Create#addresses_local_accounts?`).
+  - But `ActivityPub::InboxesController#account_required?` looks only at `params[:account_username]`. A delivery to
+    the numeric `/ap/users/:account_id/inbox` it now advertises therefore reaches the worker with no recipient and
+    is rejected.
+  - DMs are unaffected because they name the recipient.
+  - Fixing it on our side means naming the member (or that server's members) in each copy's `cc`, which changes what a
+    circle reveals: **owner decision pending**. Reporting it upstream is the other half.
+- Inbound `Block` from Mastodon is not enforced yet (P7).
+
 ### GoToSocial: 0.22.1 (2026-07-20)
 
 **Emits**
@@ -201,6 +231,10 @@ Priorities, used throughout:
 | Measure media size when proxying | P2 | `MediaAttachment.meta` |
 | Only advertise the policies we enforce | P2 | — |
 
+**Pasture evidence (2026-10-03, GoToSocial 0.22.1, `tools/pasture/scenarios/gts.sh`):** 37 checks pass, three runs in a
+row. That is the original 33 plus four on statistics: described as gotosocial, inbound and outbound traffic counted,
+no account named.
+
 ### Misskey family: Misskey 2026.10.0, Sharkey 2025.4.7, Iceshrimp.NET 2026.1.2-beta, CherryPick 4.17
 
 Firefish is dead (its site has answered 410 since February 2025).