I think Activities without a to field, see here, are one of the oddities being allowed by ActivityPub.

I think they are allowed due to splitting ActivityPub in S2S and C2S. However, I'm not sure. It just feels odd. Of course, they might also be allowed because the ActivityPub authors believed in keeping track of the processing history of an ActivityPub, so one would have a record of the inbox being used to receive the activity (maybe even the http signature being used).

@helge bto/bcc exists but is stripped before delivery so if it looks like there are no addressing properties but it arrived in your inbox anyway, the most likely reason is that you were in either bto or bcc before they got stripped

No and No.

I know that explaining ActivityPub with no grounding in reality is a tradition. But can you please not do it when replying to me?

@helge ??? i don’t know how else to say that if you received an activity then you received an activity. it’s a tautological statement.

but if we’re linking to source code then maybe you’d be interested in https://git.pleroma.social/pleroma/pleroma/-/blob/develop/lib/pleroma/web/activity_pub/publisher.ex or https://git.pleroma.social/pleroma/pleroma/-/blob/develop/lib/pleroma/web/activity_pub/transmogrifier.ex perhaps

or i don’t know if you consider “activitypub” to include only mastodon, but mastodon’s equivalent of bto/bcc is that it just POSTs directly to inboxes of private recipients. which is functionally the exact same thing.

@helge or even more generally, consider how one might send an LDN payload to an inbox without activitypub at all. which, again, is functionally exactly what mastodon does, by POSTing to inboxes.