Reports reach Lemmy's moderators, from an anonymous reporter

Lemmy takes a report only from a person or a service, about one post or comment, addressed to its community, and it
answered PrivaPub's Flag (the instance actor's, an Application, with no `to` and the account and posts as its object)
400. A report of a post or comment in a community on a server whose NodeInfo names Lemmy now leaves from
`privapub_reports`, a Service with its own key that names nobody: one Flag per post, `to` the community (its own
audience, else its thread's), with the persona's words, or the category, in `summary` and `content`, sent to the
community's inbox. This is the second exception to "a server's software is for display" (owner decision 2026-10-06,
`ReportService.ServiceReportTakers`). Every other server keeps the instance actor's report. An account alone is not
reported to Lemmy, which takes no such report, and `forwarded` now says whether anything left.

The reporter is read unsigned in SecureMode and answers WebFinger like the instance actor. Nobody follows or mentions
it, the Mastodon API has no account for it, and a migration reserves its name. Checked live: Lemmy 1.0 and 0.19 keep the
reports of a thread and of a comment, with alice's words, from "Reports from privapub.test", and none names her (69
checks). A sweep of every scenario with this and the next commit: 876 checks pass; Ghost's Network feed listed alice's
post too late once, and Ghost passes alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

FEDERATION.md

@@ -133,6 +133,9 @@ The names are the project's own and are stable; resolve actors through WebFinger
   is used to read another server's content. It also answers at the server's root (`/`) for a request that asks for
   ActivityPub, as Lemmy's site actor does: PieFed sends a community's announces to the inbox of the Application at a
   peer's root, and to `/inbox` when there is none.
+- The reporter is `/peasants/privapub_reports` (type `Service`, "Reports from <host>"), one for the whole server with its
+  own key. It sends the reports Lemmy takes only from a person or a service (see **Reports** below) and does nothing
+  else: nobody follows or mentions it, the Mastodon API has no account for it, and it has no page.
 
 ## Groups
 
@@ -225,10 +228,18 @@ persona's posts passed on to its followers. A deleted post answers 410 with a `T
   is told to the post's audience as `Add` or `Remove` on `featured`, as Mastodon tells it.
 - **Blocks are sent.** A blocked remote account receives `Block` from the blocking account (and `Reject{Follow}` if it
   followed); an unblock sends `Undo{Block}`.
-- **Reports** are sent as `Flag` by the instance actor, never by the reporting account.
+- **Reports** are sent as `Flag`, never by the reporting account and never naming it.
+  - To the reported account's server: from the instance actor, with the account and the posts as `object` and the
+    persona's words in `content`.
+  - To a community on a server whose NodeInfo names Lemmy (owner decision 2026-10-06, the second place PrivaPub decides
+    by a server's software): one `Flag` per reported post or comment that was made in that community (its own
+    `audience`, else its thread's), from the reporter, `to` the community, the post alone as `object`, the words (or,
+    with none, the category) in `summary` and `content`, sent to the community's inbox. Lemmy refuses a Flag from an
+    `Application`, with no `to` or with no reason. Such a server gets no instance actor's Flag: an account alone, or a
+    post outside its communities, is not reported there, since Lemmy takes neither.
 - **Direct messages** go out as a `Note` addressed to their recipients, except a message to one account elsewhere that
   writes to us as `ChatMessage`s (Pleroma's type), or whose server takes nothing else: Lemmy before 1.0 and Mbin, as
-  their NodeInfo names them (owner decision 2026-10-05, the one place PrivaPub decides by a server's software). That
+  their NodeInfo names them (owner decision 2026-10-05, the first place PrivaPub decides by a server's software). That
   message goes out as a `ChatMessage`, to the account alone, without a mention in its text.
 - **Replies are passed on** (inbox forwarding; owner decision 2026-10-05). A public or unlisted reply from another server
   to a persona's public, unlisted or followers-only post goes on to the persona's followers as its author's server sent
@@ -382,7 +393,8 @@ Posts with a location (shown to nearby users of this server) never leave the ser
   one, else its `replies` (PeerTube's `comments`) and theirs, two levels down; 5 pages and 100 posts at most. Only
   public and unlisted replies are kept, each fetched from its own origin.
 - **Reading our documents (SecureMode).** privapub.thepra.dev answers ActivityPub GETs only when they are signed, like
-  Mastodon's authorized fetch; the instance actor `/peasants/privapub` is the exception, since its key is needed first.
+  Mastodon's authorized fetch; the server's own actors (the instance actor `/peasants/privapub` and the reporter
+  `/peasants/privapub_reports`) are the exception, since their keys are needed first.
   A browser asking for HTML is redirected to the public page instead.
 - **Posts that are not public** (followers-only, direct, circle) are served to a signed request from someone they were
   for, or from the instance actor of a server where someone they were for lives, and to nobody else (404). Once deleted