@darius I think the current best practice is to only use inclusion by ID for the `Announce` activity, for this very reason.

But I agree that the public-except-unpublished-denylist access mode is really hard to make work right.

I also think there are trade-offs between the efficiency of sending activities with lots of data, and the level of control when sending minimal activities. I have a long section about this in my book, but it might be good to include guidance in the Primer or the next AP.