@jamey [toot.cat] I was just having a conversation with a few ActivityPub developers about this exact thing. It is very confusing! I'm pretty sure my site is also doing things wrong but oh well.
@aaronpk I don't know which of the aspects I see of post visibility come from ActivityPub and which parts are Mastodon applying specific policy choices to the messages generated with it, either.
I do know that post visibility on Mastodon, regardless of whose "fault" it might be, is full of surprises and that's especially troublesome for people who need safety from harassment. I'm only mildly annoyed at the moment (I just didn't want to clutter people's timelines), but for others it matters.