Index: test/c2s-direct.test.js
===================================================================
--- test/c2s-direct.test.js	(revision 024f4f8c0acb305dd19077f639d2e96c787dd63c)
+++ test/c2s-direct.test.js	(revision 024f4f8c0acb305dd19077f639d2e96c787dd63c)
@@ -0,0 +1,52 @@
+// Direct notes (private mentions, shaer-tqc): never Public, never boostable.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+process.env.DATABASE_PATH = ':memory:';
+process.env.PUBLIC_BASE_URL = 'https://test.example';
+
+const dbMod = await import('../src/config/database.js');
+const db = dbMod.default;
+dbMod.initializeDatabase();
+const AP = (await import('../src/services/ActivityPubService.js')).default;
+
+const PUB = 'https://www.w3.org/ns/activitystreams#Public';
+db.prepare('INSERT INTO users (id, username, email, password_hash, role) VALUES (?,?,?,?,?)').run('u1', 'u1', 'u1@test', 'x', 'god');
+db.prepare('INSERT INTO sites (id, slug, title, owner_id, is_primary) VALUES (?,?,?,?,?)').run('s1', 'me', 'Me', 'u1', 1);
+const site = db.prepare('SELECT * FROM sites WHERE id = ?').get('s1');
+const user = { id: 'u1', username: 'u1' };
+
+test('a direct outbox row addresses only its recipients, no Public, no cc', () => {
+  db.prepare(`INSERT INTO ap_outbox (id, site_slug, post_id, post_slug, in_reply_to, to_actor, to_handle, content, visibility, to_actors, created_at)
+    VALUES ('d1','me','',NULL,NULL,'https://r.test/u/g','@g@r.test','<p>help</p>','direct','["https://r.test/u/g","https://q.test/u/h"]',CURRENT_TIMESTAMP)`).run();
+  const row = db.prepare('SELECT * FROM ap_outbox WHERE id = ?').get('d1');
+  const note = AP.buildReplyNote('https://test.example', site, row);
+  assert.deepEqual(note.to, ['https://r.test/u/g', 'https://q.test/u/h']);
+  assert.deepEqual(note.cc, []);
+  assert.ok(!JSON.stringify(note.to).includes(PUB) && !JSON.stringify(note.cc).includes(PUB));
+});
+
+test('direct without any real recipient is refused (400 no_recipients)', async () => {
+  const r = await AP.ingestOutboxActivity(site, user, {
+    type: 'Note', content: '<p>x</p>',
+    to: ['https://test.example/ap/users/me/followers'], cc: [],   // friends-shaped? no: followers in to = friends
+  });
+  // followers-only reads as friends, so force the direct shape: bare unknown string
+  const r2 = await AP.ingestOutboxActivity(site, user, { type: 'Note', content: '<p>x</p>', to: [], cc: [] });
+  // empty addressing = legacy public; the real no-recipient direct case:
+  const r3 = await AP.ingestOutboxActivity(site, user, { type: 'Note', content: '<p>x</p>', to: ['not-a-uri'], cc: [] });
+  assert.equal(r3.status, 400);
+  assert.equal(r3.error, 'no_recipients');
+  assert.ok(r && r2); // shapes above answered too (not the point of this test)
+});
+
+test('C2S Announce/Like of a non-public local post is refused (403)', async () => {
+  db.prepare(`INSERT INTO posts (id, site_id, slug, author_id, title, content, status, type, fan_only, ap_visibility, created_at, updated_at, published_at)
+    VALUES ('pf','s1','geheim','u1','','<p>prive</p>','published','post',1,'friends',datetime('now'),datetime('now'),datetime('now'))`).run();
+  const noteUrl = 'https://test.example/ap/notes/pf';
+  const boost = await AP.ingestOutboxActivity(site, user, { type: 'Announce', object: noteUrl });
+  assert.equal(boost.status, 403);
+  assert.equal(boost.error, 'not_public');
+  const like = await AP.ingestOutboxActivity(site, user, { type: 'Like', object: noteUrl });
+  assert.equal(like.status, 403);
+});