⛔ THE STORE COULD NOT TELL A REPLY FROM A DIRECT MESSAGE. Mastodon delivers DMs to an inbox exactly as it delivers replies — same signature check, same handler, same store — and `normalize()` kept id/type/actor/objectId/inReplyTo/content/url/published and DROPPED `to` and `cc`. So nothing in a stored record could answer "was this addressed to the public?", and rendering that store without a login would have published somebody's DM on our domain. The addressing is not recoverable afterwards: normalize drops it, and the remote object is only refetchable while its server still serves it. So `public` is decided AT ARRIVAL and stored. ⛔ FAIL CLOSED, TWICE. isPublicActivity returns false for anything it cannot positively show to be public, and the route requires `=== true` — so records written before this field existed are `undefined` and are withheld. An operator sees a shorter public page after upgrading; the alternative is publishing a DM because a record predates the question being asked. ⚠ THREE SPELLINGS. The full activitystreams URI is canonical, `as:Public` is the compacted JSON-LD form, and bare `Public` still arrives from older implementations — and Mastodon often addresses the OBJECT rather than the activity. Matching only the canonical URI fails in the safe direction while hiding half the fediverse from a public page. All four cases are asserted. ⛔ FILTERED BEFORE PAGING, never after: paging first and filtering second yields short pages and an offset that no longer means what the link said. The content is still somebody else's: markup is stripped AND then escaped — stripping alone leaves `&lt;script&gt;` readable as text, escaping alone lets a remote server choose this page's layout. Marked noindex, because republishing other people's words on our domain is one thing and letting a crawler take a second permanent copy is a decision nobody made. 1063/1063 pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>