Reports reach Lemmy's moderators, from an anonymous reporter

Lemmy takes a report only from a person or a service, about one post or comment, addressed to its community, and it
answered PrivaPub's Flag (the instance actor's, an Application, with no `to` and the account and posts as its object)
400. A report of a post or comment in a community on a server whose NodeInfo names Lemmy now leaves from
`privapub_reports`, a Service with its own key that names nobody: one Flag per post, `to` the community (its own
audience, else its thread's), with the persona's words, or the category, in `summary` and `content`, sent to the
community's inbox. This is the second exception to "a server's software is for display" (owner decision 2026-10-06,
`ReportService.ServiceReportTakers`). Every other server keeps the instance actor's report. An account alone is not
reported to Lemmy, which takes no such report, and `forwarded` now says whether anything left.

The reporter is read unsigned in SecureMode and answers WebFinger like the instance actor. Nobody follows or mentions
it, the Mastodon API has no account for it, and a migration reserves its name. Checked live: Lemmy 1.0 and 0.19 keep the
reports of a thread and of a comment, with alice's words, from "Reports from privapub.test", and none names her (69
checks). A sweep of every scenario with this and the next commit: 876 checks pass; Ghost's Network feed listed alice's
post too late once, and Ghost passes alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

docs/INTEROP.md

@@ -502,10 +502,18 @@ on a Page: pins live in `featured`, locks in `Lock`.
 - **Accepted types:** Page, Article, Note, Video and Event become posts. **`Question` is dropped.**
 - **Anti-spam:** activities for a community are accepted only if a local user follows it.
 - **Actors:** a Create, vote, moderation action or Flag must come from a Person, Service or Organization. **A Group or
-  Application actor fails to parse**, so moderation comes from the moderator Person. Our Flags, sent by an
-  Application instance actor with no `to` and an array `object` (the account and the post), are refused: confirmed live
-  2026-10-06, Lemmy 1.0.0-beta.2 answers 400 and keeps no report. Reaching its moderators needs an anonymous
-  `Service`-typed reporter, `to: [the post's community]` and the post alone as `object`.
+  Application actor fails to parse**, so moderation comes from the moderator Person. Our Flags, sent by the
+  Application instance actor with no `to` and an array `object` (the account and the post), were refused: confirmed
+  live 2026-10-06, Lemmy 1.0.0-beta.2 answered 400 and kept no report.
+- **Reports reach its moderators since 2026-10-06** (owner decision, `ReportService.ServiceReportTakers`): a report of a
+  post or comment in a community on a server whose NodeInfo names Lemmy leaves from the anonymous `Service`
+  `privapub_reports`, one `Flag` per post, `to: [the community]`, the post alone as `object`, the persona's words in
+  `summary` and `content`, sent to the community's inbox. Lemmy takes no report of an account alone, so none goes there.
+  Lemmy 1.0 reads the reporter's site then (our Application at `/`, seen live), which it needs to pass the report on to
+  the moderators of a community on another server.
+  **Pasture evidence (2026-10-06, `lemmy.sh` and `lemmy19.sh`):** on 1.0 and 0.19 alice's report of lemmyuser's thread
+  and of a comment in it is kept as a `post_report` and a `comment_report` with her words, whose creator is "Reports
+  from privapub.test", and no report names her.
 - **Flags:** exactly one `to` (community or site); `object` a URL or an array; the reason in `summary` or `content`.
 - **Moderation trust:** an action is trusted when it is on the community's or the object's host (FEP-fe34), or when its
   actor is in the moderators list Lemmy fetched.
@@ -524,7 +532,7 @@ on a Page: pins live in `featured`, locks in `Lock`.
 | `ChatMessage` in and out (out to someone who writes to us that way, and to Lemmy 0.19 and Mbin by NodeInfo, done 2026-10-05) | P1 | `visibility: direct` |
 | Outbound shape for Lemmy: both `to` and `cc`; the community in `to`; Public in the object, Create and Announce; votes and comments sent to the community inbox | P1 | — |
 | Communities we host: pick `Announce(object)` per peer by NodeInfo (as PieFed does). Announcing to every follower instance, the author's included, is done and needed (pasture evidence below) | P1 | — |
-| Flags from a `Service`-typed reporter actor with `to: [community]`; the reporter stays anonymous | P2 | — |
+| Flags from a `Service`-typed reporter actor with `to: [community]`; the reporter stays anonymous: **done 2026-10-06** (`privapub_reports`, checked live on 1.0 and 0.19) | P2 | — |
 | `Warn` → `moderation_warning` notification; `Resolve{Flag}` | P2 | AccountWarning |
 | Remote communities: `description`, `language[]`, private (`locked`), `discoverable`; post tags | P2 | `Account.locked`, own `privapub.flairs[]` |
 | Serve our communities' collections the way Lemmy reads them: inline outbox of `Announce{Create{Page}}`, inline featured Pages, inline moderators. Lemmy does not page. | P2 | — |