I agree with you on how core emoji reactions are. ... It's clear I'm going to have to settle in some respect.

So, in thinking about this in more concrete terms (as opposed to vague dissatisfaction), I suspect what we really want is a blogging platform with robust authenticated reader interaction tools.

The issue with AP, and therefore most of these servers, is that (a) it's expected to be public by default (the privacy point you mention), but almost more fundamentally (b) they're aggregators. People either to a bunch of people and get a feed of a bunch of posts by different people (Mastodon/X); or they join a community and see a bunch of posts by different people (Lemmy/Reddit).

I think what we want is blogging software, with an endless stream of content posted by a single user, but with reactions and threaded conversations per post. I've been thinking how this could be achieved on various AP platforms, but while you can almost get there with groups/channels/communities, the sticking point is that they are all ultimately designed around any member being able to post top-level content. I haven't seen any system yet that (easily) allows restricting posting by individual accounts.

I need to look at pump.io clients, because I think pump.io started as more of a blogging protocol. And the more I think about it, the more I believe a private blogo is a better foundational model.

Is federation or similar mandatory for you?

No. In fact, I suspect it may work against the privacy requirement. I expect that, even if one of the federated servers met all of the requirements, federation would have to be disabled to prevent leakage. Although, at least one server supports authenticated pull (one of the Misskey forks), I'm guessing it's not likely that federation will be needed.

As in, do you want something that allows your users to interact with users that are not part of your family and not on your platform, eventually able to completely replace the mainstream social media?

For me, no. I want my SIL to be able to easily post pictures and videos of my toddler niece, and all the family members to be able to oooh and aaaah, and react with little heart and exploding brain emojis, and comment on how the fact that she climbed a jungle gym is a sign she's sure to be an Olympic athlete. The parents absolutely do not want those videos showing up in TikTok.

Or is a completely closed platform ok, in terms of it's only your family and friends, and people have to go elsewhere (e.g. back to facebook) to interact with others?

Ideally, it'd support ActivityPub. I'm not sure how; perhaps through the user creating channels and setting a federation flag, or marking it as public. I think the expectation that people will understand that inviting someone from another platform effectively makes all of that content public, might be bit much to assume. So I think having private and public channels, where public channels are federate-able would be fine. But I'd rather not have federation than have a system where people are prone to make privacy mistakes. Is there an option I'm missing?

I use Nextcloud, developed by a company,

Yeessss; I think that's a little different, because NextCloud was forked off of the completely open source OwnCloud, which was well-established and license protected long before NextCloud came along. If NextCloud tried any shenanigans, they'd be eviscerated. HumHub is a bespoke solution, right? So they can't be accused of stealing an OpenSource project's s code.

I use Photoprism, which the base edition is FOSS but they have proprietary extras that you pay for (like HumHub).

Yeah, this is a good example. I use it, too, although I admit I've considered, and regularly revisit, alternatives purely because of this quasi-free nature. So much of PhotoPrism is built on free libraries; the project uses something like 120 OSS libraries. How much of their income do you think they contribute to those projects who's work their taking advantage of?

I use Home Assistant, though I think they recently transitioned to a non-profit

I've been using it for two or three years myself; it's always been OSS & free software, AFAIK.

they charge for a cloud connected component.

That's a service. I have no issue with charging for a service, because it's an ongoing cost to the hoster.

Actually, I don't have any issue with anyone charging for their software, either; it's just that I won't use it, and I don't trust quasi-free projects. That's just from experience. Most end badly, either by being bought out and going totally commercial, or just slow enshittification for the non-paying customers.

I write software for myself, and give it away free because it costs me nothing to do so. And I've written software libraries that I know, for a fact, are being used as backbone code for a not insignificant chunk of the internet. I've never been paid by any commercial company taking advantage of my work, and have little sympathy for people charging for software that's 90% other people's freely given code. Which is most software today. You write the entire stack from scratch, including the compiler, like Excel once was? Hell yeah, you deserve to charge for it. Otherwise, you're just profiting off other people's work.

HumHub have been around 10 years, so they aren't exactly new. Plus as it's extendable, perhaps one day a gfycat or emoji reaction plugin will be added (or if you have the skills, maybe you could make one).

Huh. Never heard of them before a week or so ago. I wouldn't completely discount them because of the semi-free model; I just am putting them down on the list.