R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Api/Mastodon/Auth/TokenController.cs

@@ -82,7 +82,8 @@ namespace PrivaPub.Api.Mastodon.Auth
 			var link = await _dbEntities.RootToAvatars.Match(r => r.AvatarId == avatarId).ExecuteFirstAsync(token);
 			var root = link == default ? default : await _dbEntities.RootUsers.MatchID(link.RootId).ExecuteFirstAsync(token);
 			var avatar = await _dbEntities.Avatars.MatchID(avatarId).ExecuteFirstAsync(token);
-			return root is { IsBanned: false, DeletedAt: null } && avatar is { DeletionAt: null };
+			// a suspended persona gets no token (R6), as its tokens were revoked when it was suspended
+			return root is { IsBanned: false, DeletedAt: null } && avatar is { DeletionAt: null, SuspendedAt: null };
 		}
 
 		ForbidResult Refuse(string error, string description) => Forbid(new AuthenticationProperties(new Dictionary<string, string>

PrivaPub/Api/Mastodon/Controllers/AccountsController.cs

@@ -158,11 +158,12 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			if (parts.Length == 1 || parts[1].Equals(localDomain, StringComparison.OrdinalIgnoreCase))
 			{
 				var local = await _localActors.FindByUserName(parts[0], token);
-				return local is { IsFederated: true, IsCircle: false, IsServerActor: false } ? Json(await _mapper.Local(local, false, token)) : NotFoundError();
+				return local is { IsFederated: true, IsCircle: false, IsServerActor: false, Suspended: false } ? Json(await _mapper.Local(local, false, token)) : NotFoundError();
 			}
 			var userName = parts[0];
 			var domain = parts[1].ToLowerInvariant();
-			var foreign = await _dbEntities.ForeignAvatars.Match(f => f.UserName == userName && f.Domain == domain && !f.DeletionAt.HasValue).ExecuteFirstAsync(token);
+			var foreign = await _dbEntities.ForeignAvatars.Match(f => f.UserName == userName && f.Domain == domain && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue)
+				.ExecuteFirstAsync(token);
 			return foreign == default ? NotFoundError() : Json(_mapper.Foreign(foreign));
 		}
 
@@ -203,7 +204,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		public async Task<IActionResult> Statuses(string id, CancellationToken token)
 		{
 			var (local, remote) = await Find(id, token);
-			if (local == default && remote == default)
+			// a suspended account's posts answer 404, as its account does (R6)
+			if (local == default && remote == default || local is { Suspended: true } || remote is { SuspendedAt: not null })
 				return NotFoundError();
 			if (Params.Bool("pinned") == true)
 			{
@@ -292,7 +294,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		public async Task<IActionResult> Follow(string id, CancellationToken token)
 		{
 			var (local, remote) = await Find(id, token);
-			if (local == default && remote == default)
+			// nobody follows a suspended account (R6), here or elsewhere: it is not shown
+			if (local == default && remote == default || local is { Suspended: true } || remote is { SuspendedAt: not null })
 				return NotFoundError();
 			// a feed is read through the server, whose reader follows its communities; the persona follows nothing
 			if (remote is { AvatarType: AvatarType.Feed })

PrivaPub/Api/Mastodon/Controllers/InstanceController.cs

@@ -65,7 +65,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			if (string.IsNullOrEmpty(id))
 				return default;
 			var avatar = await DB.Default.Find<Avatar>().Match(a => a.ID == id && !a.DeletionAt.HasValue).ExecuteFirstAsync(token);
-			if (avatar == default || (await Counted.BarredPersonas(token)).Contains(id))
+			if (avatar == default || (await Counted.HeldBackPersonas(token)).Contains(id))
 				return default;
 			return await _mapper.Local(_localActors.FromAvatar(avatar), false, token);
 		}

PrivaPub/Api/Mastodon/Controllers/SearchController.cs

@@ -93,7 +93,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		// named in, and public posts of authors who let themselves be indexed; newest first, what the persona may see only
 		async Task<List<Status>> Words(string q, int offset, int limit, CancellationToken token)
 		{
-			var candidates = await _dbEntities.Posts.Match(f => f.Text(q)).Match(p => !p.DeletedAt.HasValue && p.ReblogOfPostId == null && !p.AuthorGone)
+			var candidates = await _dbEntities.Posts.Match(f => f.Text(q)).Match(p => p.ReblogOfPostId == null).Match(VisibilityPolicy.IsShown)
 				.Sort(p => p.ID, MongoDB.Entities.Order.Descending).Limit(WordCandidates).ExecuteAsync(token);
 			if (candidates.Count == 0)
 				return new List<Status>();
@@ -128,7 +128,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			{
 				var author = post.AuthorAccountId ?? post.GroupUserId;
 				var reachable = author == MyId && !post.IsFederatedCopy || mine.Contains(post.ID) || post.Mentions.Any(m => m.AccountId == MyId)
-					|| post.Visibility == PostVisibility.Public && Searchable(post, author);
+					|| post.Visibility == PostVisibility.Public && !post.AuthorLimited && Searchable(post, author);//a silenced author's only to who met it (R6)
 				if (reachable && await VisibilityPolicy.CanSee(post, MyId, token))
 					found.Add(post);
 				if (found.Count >= offset + limit)

PrivaPub/Api/Mastodon/Controllers/StreamingController.cs

@@ -159,6 +159,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 						continue;
 					await Send(new JsonObject { ["stream"] = new JsonArray(key.Wire.Select(w => (JsonNode)w).ToArray()), ["event"] = e.Name, ["payload"] = payload });
 				}
+				// the queue ends only when the stream was closed from here (the persona was suspended): the socket goes too
+				done.Cancel();
 				await reading;
 			}
 			catch (Exception ex) when (ex is OperationCanceledException or WebSocketException)
@@ -202,20 +204,23 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			try
 			{
 				await Write(":)\n\n");
+				using var done = CancellationTokenSource.CreateLinkedTokenSource(token);
 				var beating = Task.Run(async () =>
 				{
-					while (!token.IsCancellationRequested)
+					while (!done.IsCancellationRequested)
 					{
-						await Task.Delay(KeepAlive, token);
+						await Task.Delay(KeepAlive, done.Token);
 						await Write(":thump\n\n");
 					}
-				}, token);
+				}, done.Token);
 				await foreach (var (_, e) in listener.Queue.Reader.ReadAllAsync(token))
 				{
 					if (await Payload(e, token) is not { } payload)
 						continue;
 					await Write($"event: {e.Name}\ndata: {payload}\n\n");
 				}
+				// closed from here (the persona was suspended): the response ends
+				done.Cancel();
 				await beating;
 			}
 			catch (OperationCanceledException)

PrivaPub/Api/Mastodon/Controllers/TagsController.cs

@@ -44,6 +44,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			var since = today.AddDays(-6);
 			var posts = await dbEntities.Posts
 				.Match(p => p.Tags.Contains(tag) && p.Visibility == PostVisibility.Public && !p.DeletedAt.HasValue && p.CreationDate >= since)
+				.Match(PrivaPub.Domain.Privacy.VisibilityPolicy.IsPublic).Match(PrivaPub.Domain.Privacy.VisibilityPolicy.IsListed)
 				.Project(p => p.Include(x => x.CreationDate).Include(x => x.AuthorAccountId).Include(x => x.GroupUserId))
 				.ExecuteAsync(token);
 			return Enumerable.Range(0, 7).Select(back => today.AddDays(-back)).Select(day =>

PrivaPub/Api/Mastodon/Controllers/TimelinesController.cs

@@ -54,7 +54,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		[HttpGet("/api/v1/timelines/public"), Scope("read:statuses", requiresUser: false), Microsoft.AspNetCore.Authorization.AllowAnonymous]
 		public async Task<IActionResult> Public(CancellationToken token)
 		{
-			var query = _dbEntities.Posts.Match(p => p.Visibility == PostVisibility.Public && p.ReblogOfPostId == null).Match(VisibilityPolicy.IsPublic);
+			var query = _dbEntities.Posts.Match(p => p.Visibility == PostVisibility.Public && p.ReblogOfPostId == null).Match(VisibilityPolicy.IsPublic)
+				.Match(VisibilityPolicy.IsListed);
 			if (Params.Bool("local") == true)
 				query.Match(p => !p.IsFederatedCopy);
 			if (Params.Bool("remote") == true)
@@ -88,7 +89,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		public async Task<IActionResult> Tag(string hashtag, CancellationToken token)
 		{
 			var tag = hashtag.TrimStart('#').ToLowerInvariant();
-			var query = _dbEntities.Posts.Match(p => p.Tags.Contains(tag) && p.Visibility == PostVisibility.Public && p.ReblogOfPostId == null).Match(VisibilityPolicy.IsPublic);
+			var query = _dbEntities.Posts.Match(p => p.Tags.Contains(tag) && p.Visibility == PostVisibility.Public && p.ReblogOfPostId == null).Match(VisibilityPolicy.IsPublic)
+				.Match(VisibilityPolicy.IsListed);
 			if (Params.Bool("local") == true)
 				query.Match(p => !p.IsFederatedCopy);
 			return await Respond(query, $"/api/v1/timelines/tag/{hashtag}", token);

PrivaPub/Api/Mastodon/Controllers/TrendsController.cs

@@ -90,30 +90,30 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			var offset = Math.Max(0, Params.Int("offset") ?? 0);
 			var limit = Limit(40, 80);
 			var localOnly = Params.Bool("local") == true;
-			var barred = await Counted.BarredPersonas(token);
+			var barred = await Counted.HeldBackPersonas(token);
 			var wanted = offset + limit;
 			var ordered = new List<string>();
 			if (Params.Get("order") == "new")
 			{
 				// many share a day: the first `wanted` are read with every other of the last one's day, so each page is cut the same way
-				var personas = await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID))
+				var personas = await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID) && !a.SilencedAt.HasValue)
 					.Sort(a => a.PublishedOn, Order.Descending).Limit(wanted).ExecuteAsync(token);
 				if (personas.Count == wanted)
 				{
 					var edge = personas[^1].PublishedOn;
 					var known = personas.Select(a => a.ID).ToList();
-					personas.AddRange(await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID)
+					personas.AddRange(await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID) && !a.SilencedAt.HasValue
 						&& a.PublishedOn == edge && !known.Contains(a.ID)).ExecuteAsync(token));
 				}
 				var remote = localOnly
 					? new List<ForeignAvatar>()
-					: await _dbEntities.ForeignAvatars.Match(f => f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue && f.Published != null)
+					: await _dbEntities.ForeignAvatars.Match(f => f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue && !f.SilencedAt.HasValue && f.Published != null)
 						.Sort(f => f.Published, Order.Descending).Limit(wanted).ExecuteAsync(token);
 				if (remote.Count == wanted)
 				{
 					var edge = remote[^1].Published;
 					var known = remote.Select(f => f.ID).ToList();
-					remote.AddRange(await _dbEntities.ForeignAvatars.Match(f => f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue
+					remote.AddRange(await _dbEntities.ForeignAvatars.Match(f => f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue && !f.SilencedAt.HasValue
 						&& f.Published == edge && !known.Contains(f.ID)).ExecuteAsync(token));
 				}
 				ordered = personas.Select(a => (a.ID, Joined: a.PublishedOn, Tie: Tie(a.UserName)))
@@ -123,7 +123,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			}
 			else
 			{
-				var discoverableLocal = (await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID))
+				var discoverableLocal = (await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID) && !a.SilencedAt.HasValue)
 					.Project(a => a.Include(x => x.ID)).ExecuteAsync(token)).Select(a => a.ID).ToHashSet();
 				var seen = new HashSet<string>();
 				var maxId = default(string);
@@ -144,7 +144,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 					var remoteIds = fresh.Where(a => a.IsFederatedCopy).Select(a => a.Id).ToList();
 					var discoverableRemote = remoteIds.Count == 0
 						? new HashSet<string>()
-						: (await _dbEntities.ForeignAvatars.Match(f => remoteIds.Contains(f.ID) && f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue)
+						: (await _dbEntities.ForeignAvatars.Match(f => remoteIds.Contains(f.ID) && f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue && !f.SilencedAt.HasValue)
 							.Project(f => f.Include(x => x.ID)).ExecuteAsync(token)).Select(f => f.ID).ToHashSet();
 					ordered.AddRange(fresh.Where(a => a.IsFederatedCopy ? discoverableRemote.Contains(a.Id) : discoverableLocal.Contains(a.Id)).Select(a => a.Id));
 				}

PrivaPub/Api/Mastodon/Entities/Entities.cs

@@ -28,6 +28,7 @@
 		public List<CustomEmojiEntity> Emojis { get; set; } = new();
 		public List<object> Roles { get; set; } = new();
 		public bool? Memorial { get; set; }
+		public bool? Limited { get; set; }//silenced by this server's staff, or its server silenced (Mastodon's `limited`)
 		public string AvatarDescription { get; set; } = string.Empty;
 		public string HeaderDescription { get; set; } = string.Empty;
 		public List<Field> Fields { get; set; } = new();

PrivaPub/Api/Mastodon/Infrastructure/MastodonController.cs

@@ -53,7 +53,15 @@ namespace PrivaPub.Api.Mastodon.Infrastructure
 					context.Result = Error(StatusCodes.Status403Forbidden, "This action is outside the authorized scopes");
 					return;
 				}
-				Me = await Resolve(User.GetClaim(Claims.Subject), HttpContext.RequestAborted);
+				var subject = User.GetClaim(Claims.Subject);
+				Me = await Resolve(subject, HttpContext.RequestAborted);
+				// a persona's token whose persona can no longer act (suspended, its login banned or deleted) is refused
+				// everywhere, as Mastodon refuses a revoked token; an application's own token has no persona
+				if (Me == default && !string.IsNullOrEmpty(subject) && !subject.StartsWith("app:", StringComparison.Ordinal))
+				{
+					context.Result = Error(StatusCodes.Status401Unauthorized, "The access token is invalid");
+					return;
+				}
 			}
 			if (scope?.RequiresUser == true && Me == default)
 			{
@@ -75,7 +83,10 @@ namespace PrivaPub.Api.Mastodon.Infrastructure
 			var root = await db.RootUsers.MatchID(link.RootId).ExecuteFirstAsync(token);
 			if (root is not { IsBanned: false, DeletedAt: null })
 				return default;
-			return await services.GetRequiredService<ILocalActorService>().FindById(LocalActorKind.Person, avatarId, token);
+			var avatar = await db.Avatars.MatchID(avatarId).ExecuteFirstAsync(token);
+			if (avatar is not { DeletionAt: null, SuspendedAt: null })
+				return default;
+			return services.GetRequiredService<ILocalActorService>().FromAvatar(avatar) is { Suspended: false } me ? me : default;
 		}
 
 		protected JsonResult Json(object value, int status = StatusCodes.Status200OK) =>

PrivaPub/Api/Mastodon/Mappers/AccountSearch.cs

@@ -64,22 +64,25 @@ namespace PrivaPub.Api.Mastodon.Mappers
 					var actorUri = await _remoteActors.ResolveHandle(q, token);
 					known = actorUri == default ? default : await _remoteActors.GetActor(actorUri, refresh: false, token);
 				}
-				if (known is { DeletionAt: null } && offset == 0)
+				if (known is { DeletionAt: null, SuspendedAt: null } && offset == 0)
 					results.Add(_mapper.Foreign(known));
 				return results;
 			}
 
 			var prefix = parts[0].ToLowerInvariant();
-			var barred = await Domain.Privacy.Counted.BarredPersonas(token);
+			var barred = await Domain.Privacy.Counted.HeldBackPersonas(token);
 			var locals = await _dbEntities.Avatars
-				.Match(a => a.UserName.StartsWith(prefix) && !a.DeletionAt.HasValue && a.Settings.IsDiscoverable != false && !barred.Contains(a.ID))
+				// a silenced persona is found only by its exact name (R6), as its followers look for it
+				.Match(a => a.UserName.StartsWith(prefix) && !a.DeletionAt.HasValue && a.Settings.IsDiscoverable != false && !barred.Contains(a.ID)
+					&& (!a.SilencedAt.HasValue || a.UserName == prefix))
 				.Sort(a => a.UserName, MongoDB.Entities.Order.Ascending)
 				.Limit(offset + limit).ExecuteAsync(token);
 			foreach (var avatar in locals.Skip(offset))
 				results.Add(await _mapper.Local(_localActors.FromAvatar(avatar), false, token));
 			var skipRemote = Math.Max(0, offset - locals.Count);
 			if (results.Count < limit)
-				foreach (var foreign in await _dbEntities.ForeignAvatars.Match(f => f.UserName.StartsWith(parts[0]) && f.IsDiscoverable && !f.DeletionAt.HasValue)
+				foreach (var foreign in await _dbEntities.ForeignAvatars.Match(f => f.UserName.StartsWith(parts[0]) && f.IsDiscoverable && !f.DeletionAt.HasValue
+						&& !f.SuspendedAt.HasValue && !f.SilencedAt.HasValue)
 					.Sort(f => f.UserName, MongoDB.Entities.Order.Ascending)
 					.Skip(skipRemote).Limit(limit - results.Count).ExecuteAsync(token))
 					results.Add(_mapper.Foreign(foreign));

PrivaPub/Api/Mastodon/Mappers/MastodonMapper.cs

@@ -28,12 +28,15 @@ namespace PrivaPub.Api.Mastodon.Mappers
 		readonly DbEntities _dbEntities;
 		readonly ILocalActorService _localActors;
 		readonly IMediaProxy _proxy;
+		readonly PrivaPub.Federation.Moderation.IDomainBlocks _domainBlocks;
 
-		public MastodonMapper(DbEntities dbEntities, ILocalActorService localActors, IMediaProxy proxy = default)
+		public MastodonMapper(DbEntities dbEntities, ILocalActorService localActors, IMediaProxy proxy = default,
+			PrivaPub.Federation.Moderation.IDomainBlocks domainBlocks = default)
 		{
 			_dbEntities = dbEntities;
 			_localActors = localActors;
 			_proxy = proxy;
+			_domainBlocks = domainBlocks;
 		}
 
 		string Proxied(string url) => _proxy == default ? url : _proxy.Wrap(url);
@@ -51,7 +54,9 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			var statuses = (await Statuses(posts, viewerId, token)).ToDictionary(s => s.Id);
 			var warned = notifications.Any(n => n.Type == NotificationType.ModerationWarning) && viewerId != default ? await Account(viewerId, token) : default;
 			return notifications
-				.Where(n => accounts.ContainsKey(n.FromAccountId ?? string.Empty) && (n.PostId == default || statuses.ContainsKey(n.PostId)))
+				// a warning names the posts it is about, which the staff may have removed
+				.Where(n => accounts.ContainsKey(n.FromAccountId ?? string.Empty)
+					&& (n.PostId == default || n.Type == NotificationType.ModerationWarning || statuses.ContainsKey(n.PostId)))
 				.Select(n => new Entities.Notification
 				{
 					Id = n.ID,
@@ -66,8 +71,9 @@ namespace PrivaPub.Api.Mastodon.Mappers
 					ModerationWarning = n.Type != NotificationType.ModerationWarning ? default : new AccountWarning
 					{
 						Id = n.ID,
+						Action = n.WarningAction ?? "none",
 						Text = n.Text ?? string.Empty,
-						StatusIds = n.PostId == default ? new List<string>() : new List<string> { n.PostId },
+						StatusIds = n.StatusIds ?? (n.PostId == default ? new List<string>() : new List<string> { n.PostId }),
 						TargetAccount = warned,
 						CreatedAt = MastodonJson.Time(n.CreatedAt)
 					}
@@ -104,6 +110,7 @@ namespace PrivaPub.Api.Mastodon.Mappers
 				Noindex = !actor.Indexable,
 				HideCollections = true,//follower and following lists are never shown to others, only their counts
 				Group = actor.Kind == LocalActorKind.Group,
+				Limited = actor.Silenced ? true : default(bool?),//silenced by the staff (R6), as Mastodon says it
 				CreatedAt = MastodonJson.Day(actor.Published),
 				Note = ActivityPubRenderer.Html(actor.Summary),
 				Url = actor.HtmlUrl,
@@ -144,6 +151,7 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			Discoverable = foreign.IsDiscoverable,
 			Indexable = foreign.IsIndexable,
 			Memorial = foreign.IsMemorial ? true : default(bool?),
+			Limited = foreign.SilencedAt.HasValue || DomainSilenced(foreign) ? true : default(bool?),
 			CreatedAt = MastodonJson.Day(foreign.Published ?? foreign.CreatedAt),
 			Emojis = Emojis(foreign.Emojis),
 			Fields = foreign.Fields.Select(f => new Field { Name = f.Key, Value = f.Value }).ToList(),
@@ -161,6 +169,10 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			StatusesCount = foreign.StatusesCount ?? 0
 		};
 
+		bool DomainSilenced(ForeignAvatar foreign) =>
+			_domainBlocks != default && Uri.TryCreate(foreign.ActorURI, UriKind.Absolute, out var uri)
+			&& _domainBlocks.Find(uri.Host)?.Severity == DomainBlockSeverity.Silence;
+
 		public async Task<Account> Account(string id, CancellationToken token) =>
 			(await Accounts(new[] { id }, token)).GetValueOrDefault(id);
 
@@ -171,11 +183,14 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			if (wanted.Count == 0)
 				return accounts;
 
-			foreach (var avatar in await _dbEntities.Avatars.Match(a => wanted.Contains(a.ID) && !a.DeletionAt.HasValue).ExecuteAsync(token))
-				accounts[avatar.ID] = await Local(_localActors.FromAvatar(avatar), false, token);
+			// a suspended account, here or elsewhere, and a banned login's personas are shown to nobody (R6): their posts and
+			// what they notify are left out with them, wherever a list holds them
+			foreach (var avatar in await _dbEntities.Avatars.Match(a => wanted.Contains(a.ID) && !a.DeletionAt.HasValue && !a.SuspendedAt.HasValue).ExecuteAsync(token))
+				if (_localActors.FromAvatar(avatar) is { Suspended: false } persona)
+					accounts[avatar.ID] = await Local(persona, false, token);
 			foreach (var group in await _dbEntities.Groups.Match(g => wanted.Contains(g.ID) && !g.DeletionAt.HasValue && g.Kind == GroupKind.Community).ExecuteAsync(token))
 				accounts[group.ID] = await Local(_localActors.FromGroup(group), false, token);
-			var foreigns = await _dbEntities.ForeignAvatars.Match(f => wanted.Contains(f.ID) && !f.DeletionAt.HasValue).ExecuteAsync(token);
+			var foreigns = await _dbEntities.ForeignAvatars.Match(f => wanted.Contains(f.ID) && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue).ExecuteAsync(token);
 			foreach (var foreign in foreigns)
 				accounts[foreign.ID] = Foreign(foreign);
 			// an account that moved shows where to, once the new account names it as one of its own (as a Move is believed)

PrivaPub/Controllers/ClientToServer/AdminController.cs

@@ -2,50 +2,90 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Localization;
 
+using MongoDB.Entities;
+
 using PrivaPub.ClientModels;
+using PrivaPub.ClientModels.Admin;
 using PrivaPub.ClientModels.User;
+using PrivaPub.Domain.Moderation;
+using PrivaPub.Domain.Timelines;
 using PrivaPub.Extensions;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Models;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.User;
 using PrivaPub.Resources;
 using PrivaPub.Services;
+using PrivaPub.StaticServices;
 
 using System.ComponentModel.DataAnnotations;
 
+using GroupEntity = PrivaPub.Models.Group.Group;
+
 namespace PrivaPub.Controllers.ClientToServer
 {
+	// What only administrators do to logins (completion program R6): read them with their personas (the one place a login
+	// is shown next to its personas), change their role, ban and unban them, delete them, a persona or a group, and turn a
+	// login's two-factor sign-in off. Every act is kept in the staff's log; an entry about a login names none of its
+	// personas.
 	[ApiController,
-		Route("clientapi/admin")]
+		Route("clientapi/admin"),
+		Authorize(Policy = Policies.IsAdmin)]
 	public class AdminController : ControllerBase
 	{
+		const int MaxRootsPage = 100;
+
 		readonly IRootUsersService RootUsersService;
 		readonly ILogger<RootUserController> Logger;
 		readonly IStringLocalizer Localizer;
+		readonly IModerationLog _log;
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
 
 		public AdminController(ILogger<RootUserController> logger,
 				IStringLocalizer<GenericRes> localizer,
-				IRootUsersService rootUsersService)
+				IRootUsersService rootUsersService,
+				IModerationLog log,
+				DbEntities dbEntities,
+				ILocalActorService localActors)
 		{
 			Logger = logger;
 			Localizer = localizer;
 			RootUsersService = rootUsersService;
+			_log = log;
+			_dbEntities = dbEntities;
+			_localActors = localActors;
 		}
 
 		// an administrator never removes, bans or unbans itself; the request's own list is left as it came
 		UsersIds Others(UsersIds usersIds)
 		{
 			var selfId = User.GetUserId();
-			return new UsersIds { UserIdList = usersIds.UserIdList.Where(id => id != selfId).ToList() };
+			return new UsersIds { UserIdList = usersIds.UserIdList.Where(id => id != selfId).Distinct().ToList() };
 		}
 
-		[HttpDelete, Route("/clientapi/admin/remove/users"), Authorize(Policy = Policies.IsAdmin)]
-		public async Task<IActionResult> RemoveUsers([Required] UsersIds usersIds)
+		// the logins a request names that exist and are not deleted, by id: what the log names them
+		static async Task<Dictionary<string, string>> Named(UsersIds usersIds, CancellationToken token)
+		{
+			var ids = usersIds.UserIdList;
+			return ids.Count == 0
+				? new Dictionary<string, string>()
+				: (await DB.Default.Find<RootUser>().Match(u => ids.Contains(u.ID) && u.DeletedAt == null).ExecuteAsync(token)).ToDictionary(u => u.ID, u => u.UserName);
+		}
+
+		[HttpDelete, Route("/clientapi/admin/remove/users")]
+		public async Task<IActionResult> RemoveUsers([Required] UsersIds usersIds, CancellationToken token)
 		{
 			var result = new WebResult();
 			try
 			{
-				result = await RootUsersService.RemoveUserAsync(Others(usersIds));
+				var others = Others(usersIds);
+				var named = await Named(others, token);
+				result = await RootUsersService.RemoveUserAsync(others);
 				if (!result.IsValid)
 					return StatusCode(result.StatusCode, result);
-
+				foreach (var (id, name) in named)
+					await _log.Write(User.GetUserId(), AdminActions.RootDelete, AdminTargets.Root, id, name, token: CancellationToken.None);
 				return Ok();
 			}
 			catch (Exception ex)
@@ -55,19 +95,31 @@ namespace PrivaPub.Controllers.ClientToServer
 			}
 		}
 
-		[HttpPost, Authorize(Policy = Policies.IsAdmin), Route("/clientapi/admin/ban/users")]
-		public async Task<IActionResult> BanUsers([Required] UsersIds usersIds)
+		// A ban ends the login's sessions and holds its personas back as suspended ones (Restrictions), without writing a word
+		// on any of them; unbanning gives them back as they were.
+		[HttpPost, Route("/clientapi/admin/ban/users")]
+		public async Task<IActionResult> BanUsers([Required] UsersIds usersIds, [FromServices] IRootSessions sessions, CancellationToken token)
 		{
 			if (!ModelState.IsValid)
 				return BadRequest(usersIds);
 			var result = new WebResult();
 			try
 			{
-				result = await RootUsersService.BanUserAsync(Others(usersIds));
+				var others = Others(usersIds);
+				var named = await Named(others, token);
+				var banned = (await DB.Default.Find<RootUser>().Match(u => others.UserIdList.Contains(u.ID) && u.IsBanned).ExecuteAsync(token)).Select(u => u.ID).ToHashSet();
+				result = await RootUsersService.BanUserAsync(others);
 
 				if (!result.IsValid)
 					return StatusCode(result.StatusCode, result);
-
+				await Restrictions.Reload(CancellationToken.None);
+				foreach (var (id, name) in named.Where(n => !banned.Contains(n.Key)))
+				{
+					await sessions.Revoke(id, CancellationToken.None);
+					foreach (var link in await _dbEntities.RootToAvatars.Match(ra => ra.RootId == id).ExecuteAsync(token))
+						Streams.CloseFor(link.AvatarId);
+					await _log.Write(User.GetUserId(), AdminActions.RootBan, AdminTargets.Root, id, name, token: CancellationToken.None);
+				}
 				return Ok();
 			}
 			catch (Exception ex)
@@ -77,18 +129,23 @@ namespace PrivaPub.Controllers.ClientToServer
 			}
 		}
 
-		[HttpPost, Authorize(Policy = Policies.IsAdmin), Route("/clientapi/admin/unban/users")]
-		public async Task<IActionResult> UnbanUsers([Required] UsersIds usersIds)
+		[HttpPost, Route("/clientapi/admin/unban/users")]
+		public async Task<IActionResult> UnbanUsers([Required] UsersIds usersIds, CancellationToken token)
 		{
 			if (!ModelState.IsValid)
 				return BadRequest(usersIds);
 			var result = new WebResult();
 			try
 			{
-				result = await RootUsersService.UnbanUserAsync(Others(usersIds));
+				var others = Others(usersIds);
+				var named = await Named(others, token);
+				var banned = (await DB.Default.Find<RootUser>().Match(u => others.UserIdList.Contains(u.ID) && u.IsBanned).ExecuteAsync(token)).Select(u => u.ID).ToHashSet();
+				result = await RootUsersService.UnbanUserAsync(others);
 				if (!result.IsValid)
 					return StatusCode(result.StatusCode, result);
-
+				await Restrictions.Reload(CancellationToken.None);
+				foreach (var (id, name) in named.Where(n => banned.Contains(n.Key)))
+					await _log.Write(User.GetUserId(), AdminActions.RootUnban, AdminTargets.Root, id, name, token: CancellationToken.None);
 				return Ok();
 			}
 			catch (Exception ex)
@@ -97,5 +154,187 @@ namespace PrivaPub.Controllers.ClientToServer
 				return BadRequest(result.Invalidate(Localizer["Something went wrong."]));
 			}
 		}
+
+		// The logins, newest first, each with its personas and the groups they own; q finds a login by its name, or by the
+		// name of one of its personas.
+		[HttpGet, Route("/clientapi/admin/roots")]
+		public async Task<IActionResult> Roots([FromQuery] string q, [FromQuery] string before, [FromQuery] int limit = 50, CancellationToken token = default)
+		{
+			limit = Math.Clamp(limit, 1, MaxRootsPage);
+			var query = DB.Default.Find<RootUser>().Match(u => u.DeletedAt == null);
+			var name = q?.Trim().TrimStart('@').Split('@')[0].ToLowerInvariant();
+			if (!string.IsNullOrEmpty(name))
+			{
+				var personaIds = (await DB.Default.Find<Avatar>().Match(a => a.UserName.StartsWith(name) && !a.DeletionAt.HasValue)
+					.Project(a => a.Include(x => x.ID)).Limit(500).ExecuteAsync(token)).Select(a => a.ID).ToList();
+				var owners = personaIds.Count == 0
+					? new List<string>()
+					: (await DB.Default.Find<RootToAvatar>().Match(ra => personaIds.Contains(ra.AvatarId)).ExecuteAsync(token)).Select(ra => ra.RootId).Distinct().ToList();
+				query.Match(u => u.UserName.StartsWith(name) || owners.Contains(u.ID));
+			}
+			if (!string.IsNullOrEmpty(before))
+			{
+				if (!MongoDB.Bson.ObjectId.TryParse(before, out _))
+					return BadRequest();
+				query.Match(f => f.Lt(u => u.ID, before));
+			}
+			var roots = await query.Sort(u => u.ID, Order.Descending).Limit(limit).ExecuteAsync(token);
+			return Ok(new ViewAdminRootsPage
+			{
+				Items = await Views(roots, token),
+				Next = roots.Count == limit ? roots[^1].ID : default
+			});
+		}
+
+		[HttpGet, Route("/clientapi/admin/roots/{id}")]
+		public async Task<IActionResult> Root(string id, CancellationToken token)
+		{
+			var root = await DB.Default.Find<RootUser>().MatchID(id).Match(u => u.DeletedAt == null).ExecuteFirstAsync(token);
+			return root == default ? NotFound() : Ok((await Views(new List<RootUser> { root }, token))[0]);
+		}
+
+		// A login's role: user, moderator or administrator. Never one's own, and never the last administrator's.
+		[HttpPost, Route("/clientapi/admin/roots/{id}/role")]
+		public async Task<IActionResult> Role(string id, RootRoleForm form, CancellationToken token)
+		{
+			if (!ModelState.IsValid || !RootUser.TryParseRole(form.Role, out var role))
+				return UnprocessableEntity(new WebResult().Invalidate(Localizer["Unknown role."], StatusCodes.Status422UnprocessableEntity));
+			if (id == User.GetUserId())
+				return Conflict(new WebResult().Invalidate(Localizer["You can't change your own role."], StatusCodes.Status409Conflict));
+			var root = await DB.Default.Find<RootUser>().MatchID(id).Match(u => u.DeletedAt == null).ExecuteFirstAsync(token);
+			if (root == default)
+				return NotFound();
+			var was = root.Role;
+			if (was == role)
+				return Ok((await Views(new List<RootUser> { root }, token))[0]);
+			if (was == RootRole.Admin && !await OtherAdministrators(root.ID, token))
+				return Conflict(new WebResult().Invalidate(Localizer["The last administrator can't be demoted."], StatusCodes.Status409Conflict));
+			root.SetRole(role);
+			await DB.Default.Update<RootUser>().MatchID(root.ID).Modify(u => u.Policies, root.Policies).Modify(u => u.UpdatedAt, root.UpdatedAt)
+				.ExecuteAsync(CancellationToken.None);
+			// two administrators demoting each other at once: this one's act is undone, so one always remains
+			if (was == RootRole.Admin && !await OtherAdministrators(root.ID, CancellationToken.None))
+			{
+				root.SetRole(was);
+				await DB.Default.Update<RootUser>().MatchID(root.ID).Modify(u => u.Policies, root.Policies).ExecuteAsync(CancellationToken.None);
+				return Conflict(new WebResult().Invalidate(Localizer["The last administrator can't be demoted."], StatusCodes.Status409Conflict));
+			}
+			if (role == RootRole.Admin)
+				await ServerSetup.Seal(root.ID, default);//an administrator exists: the client's setup is closed
+			await _log.Write(User.GetUserId(), AdminActions.RootRole, AdminTargets.Root, root.ID, root.UserName,
+				note: $"{RoleName(was)} → {RoleName(role)}", token: CancellationToken.None);
+			return Ok((await Views(new List<RootUser> { root }, token))[0]);
+		}
+
+		// an administrator other than this login that can still act
+		static Task<bool> OtherAdministrators(string rootId, CancellationToken token) =>
+			DB.Default.Find<RootUser>().Match(u => u.ID != rootId && u.DeletedAt == null && !u.IsBanned && u.Policies.Contains(Policies.IsAdmin)).ExecuteAnyAsync(token);
+
+		// A login that lost its authenticator and its recovery codes, as `PrivaPub admin reset-totp` does it: its two-factor
+		// sign-in goes, its password and sessions stay. Never one's own (that is /clientapi/user/totp/disable, with a code).
+		[HttpPost, Route("/clientapi/admin/roots/{id}/totp/reset")]
+		public async Task<IActionResult> ResetTotp(string id, CancellationToken token)
+		{
+			if (id == User.GetUserId())
+				return Conflict(new WebResult().Invalidate(Localizer["Turn your own two-factor sign-in off from your account."], StatusCodes.Status409Conflict));
+			var root = await DB.Default.Find<RootUser>().MatchID(id).Match(u => u.DeletedAt == null).ExecuteFirstAsync(token);
+			if (root == default)
+				return NotFound();
+			await DB.Default.Update<RootUser>().MatchID(root.ID).Modify(u => u.Totp, null).ExecuteAsync(CancellationToken.None);
+			await _log.Write(User.GetUserId(), AdminActions.RootResetTotp, AdminTargets.Root, root.ID, root.UserName, token: CancellationToken.None);
+			return Ok();
+		}
+
+		// A persona deleted by an administrator, who types their own password again: as its login would delete it
+		// (PersonaRemoval), the groups it owns with it. The log keeps it without who acted when it is the administrator's own.
+		[HttpPost, Route("/clientapi/admin/personas/{id}/delete")]
+		public async Task<IActionResult> DeletePersona(string id, AdminPasswordForm form, [FromServices] IPersonaRemoval personas, CancellationToken token)
+		{
+			if (!ModelState.IsValid)
+				return BadRequest(new WebResult().Invalidate(Localizer["Invalid model."]));
+			if (!await RootUsersService.PasswordMatches(User.GetUserId(), form.Password))
+				return StatusCode(StatusCodes.Status403Forbidden, new WebResult().Invalidate(Localizer[Services.RootUsersService.NoMatch], StatusCodes.Status403Forbidden));
+			var avatar = await _dbEntities.Avatars.MatchID(id).Match(a => !a.DeletionAt.HasValue).ExecuteFirstAsync(token);
+			if (avatar == default)
+				return NotFound();
+			var label = "@" + _localActors.FromAvatar(avatar).Handle;
+			if (!await personas.Remove(avatar.ID, CancellationToken.None))
+				return NotFound();
+			await _log.Write(User.GetUserId(), AdminActions.PersonaDelete, AdminTargets.Persona, avatar.ID, label, note: form.Note, token: CancellationToken.None);
+			return Ok();
+		}
+
+		[HttpPost, Route("/clientapi/admin/groups/{id}/delete")]
+		public async Task<IActionResult> DeleteGroup(string id, AdminPasswordForm form, [FromServices] IGroupRemoval groups, CancellationToken token)
+		{
+			if (!ModelState.IsValid)
+				return BadRequest(new WebResult().Invalidate(Localizer["Invalid model."]));
+			if (!await RootUsersService.PasswordMatches(User.GetUserId(), form.Password))
+				return StatusCode(StatusCodes.Status403Forbidden, new WebResult().Invalidate(Localizer[Services.RootUsersService.NoMatch], StatusCodes.Status403Forbidden));
+			var group = await _dbEntities.Groups.MatchID(id).Match(g => !g.DeletionAt.HasValue).ExecuteFirstAsync(token);
+			if (group == default)
+				return NotFound();
+			var label = "@" + _localActors.FromGroup(group).Handle;
+			if (!await groups.Remove(group.ID, CancellationToken.None))
+				return NotFound();
+			await _log.Write(User.GetUserId(), AdminActions.GroupDelete, AdminTargets.Group, group.ID, label, note: form.Note, token: CancellationToken.None);
+			return Ok();
+		}
+
+		async Task<List<ViewAdminRoot>> Views(List<RootUser> roots, CancellationToken token)
+		{
+			var ids = roots.Select(r => r.ID).ToList();
+			var links = ids.Count == 0 ? new List<RootToAvatar>() : await _dbEntities.RootToAvatars.Match(ra => ids.Contains(ra.RootId)).ExecuteAsync(token);
+			var avatarIds = links.Select(l => l.AvatarId).Distinct().ToList();
+			var avatars = avatarIds.Count == 0
+				? new Dictionary<string, Avatar>()
+				: (await _dbEntities.Avatars.Match(a => avatarIds.Contains(a.ID) && !a.DeletionAt.HasValue).ExecuteAsync(token)).ToDictionary(a => a.ID);
+			var owned = avatarIds.Count == 0
+				? new List<GroupEntity>()
+				: await _dbEntities.Groups.Match(g => avatarIds.Contains(g.OwnerAvatarId) && !g.DeletionAt.HasValue).ExecuteAsync(token);
+			var me = User.GetUserId();
+			return roots.Select(root => new ViewAdminRoot
+			{
+				Id = root.ID,
+				UserName = root.UserName,
+				Role = RoleName(root.Role),
+				IsBanned = root.IsBanned,
+				HasEmail = !string.IsNullOrEmpty(root.Email),
+				IsEmailValidated = root.IsEmailValidated,
+				HasTotp = root.Totp?.EnabledAt != default,
+				IsYou = root.ID == me,
+				CreatedAt = root.CreatedAt,
+				Personas = links.Where(l => l.RootId == root.ID && avatars.ContainsKey(l.AvatarId)).Select(l => avatars[l.AvatarId])
+					.OrderBy(a => a.UserName, StringComparer.Ordinal)
+					.Select(a =>
+					{
+						var persona = _localActors.FromAvatar(a);
+						return new ViewAdminPersona
+						{
+							Id = a.ID,
+							UserName = a.UserName,
+							DisplayName = persona.Name,
+							Handle = persona.Handle,
+							SilencedAt = a.SilencedAt,
+							SuspendedAt = a.SuspendedAt,
+							Groups = owned.Where(g => g.OwnerAvatarId == a.ID).Select(g => new ViewAdminGroup
+							{
+								Id = g.ID,
+								UserName = g.UserName,
+								Name = g.Name,
+								IsCommunity = g.Kind == GroupKind.Community,
+								MembersCount = g.Members.Count
+							}).ToList()
+						};
+					}).ToList()
+			}).ToList();
+		}
+
+		static string RoleName(RootRole role) => role switch
+		{
+			RootRole.Admin => "admin",
+			RootRole.Moderator => "moderator",
+			_ => "user"
+		};
 	}
 }

PrivaPub/Controllers/ClientToServer/DomainBlockController.cs

@@ -24,9 +24,12 @@ namespace PrivaPub.Controllers.ClientToServer
 		readonly IStringLocalizer _localizer;
 		readonly Domain.Media.IMediaProxy _proxy;
 		readonly IModerationLog _log;
+		readonly IAccountModeration _moderation;
 
-		public DomainBlockController(IDomainBlocks domainBlocks, IStringLocalizer<GenericRes> localizer, Domain.Media.IMediaProxy proxy, IModerationLog log)
+		public DomainBlockController(IDomainBlocks domainBlocks, IStringLocalizer<GenericRes> localizer, Domain.Media.IMediaProxy proxy, IModerationLog log,
+			IAccountModeration moderation)
 		{
+			_moderation = moderation;
 			_domainBlocks = domainBlocks;
 			_localizer = localizer;
 			_proxy = proxy;
@@ -57,6 +60,8 @@ namespace PrivaPub.Controllers.ClientToServer
 				.Option(o => o.IsUpsert = true)
 				.ExecuteAsync(token);
 			await _domainBlocks.Reload(token);
+			// a silenced server's posts are limited from now on, and no longer once it is not (R6)
+			await _moderation.DomainChanged(domain, token);
 			// what the media proxy holds of it goes with the block
 			if (block.Severity == DomainBlockSeverity.Suspend || block.RejectMedia)
 				_proxy.Purge(domain);
@@ -72,6 +77,8 @@ namespace PrivaPub.Controllers.ClientToServer
 			domain = DomainBlocks.Normalise(domain);
 			var deleted = await DB.Default.DeleteAsync<DomainBlock>(b => b.Domain == domain);
 			await _domainBlocks.Reload(token);
+			if (deleted.DeletedCount > 0)
+				await _moderation.DomainChanged(domain, token);
 			if (deleted.DeletedCount > 0)
 				await _log.Write(User.GetUserId(), AdminActions.DomainBlockDelete, AdminTargets.Domain, domain, domain, token: token);
 			return Ok();

PrivaPub/Controllers/ClientToServer/GroupController.cs

@@ -60,6 +60,27 @@ namespace PrivaPub.Controllers.ClientToServer
 		public async Task<IActionResult> Remove(GroupMembershipForm form, CancellationToken token) =>
 			!ModelState.IsValid ? Invalid() : Answer(await _groupUsersService.RemoveMember(User.GetUserId(), form, token));
 
+		// the group's owner deletes it, with the login's password (R6): its members and followers are told, its name stays
+		// taken (GroupRemoval)
+		[HttpPost, Route("/clientapi/group/delete"), Microsoft.AspNetCore.RateLimiting.EnableRateLimiting(Infrastructure.RateLimiting.Accounts)]
+		public async Task<IActionResult> Delete(DeleteGroupForm form, [FromServices] IRootUsersService users, [FromServices] IGroupRemoval groups,
+			[FromServices] StaticServices.DbEntities dbEntities, CancellationToken token)
+		{
+			if (!ModelState.IsValid)
+				return Invalid();
+			var rootId = User.GetUserId();
+			if (!await users.PasswordMatches(rootId, form.Password))
+				return StatusCode(StatusCodes.Status403Forbidden, new WebResult().Invalidate(_localizer[RootUsersService.NoMatch], StatusCodes.Status403Forbidden));
+			var owns = await dbEntities.RootToAvatars.Match(ra => ra.RootId == rootId && ra.AvatarId == form.AvatarId).ExecuteAnyAsync(token);
+			var group = owns ? await dbEntities.Groups.MatchID(form.GroupId).Match(g => !g.DeletionAt.HasValue).ExecuteFirstAsync(token) : default;
+			if (group == default)
+				return NotFound(new WebResult().Invalidate(_localizer["Group not found."], StatusCodes.Status404NotFound));
+			if (group.OwnerAvatarId != form.AvatarId)
+				return StatusCode(StatusCodes.Status403Forbidden, new WebResult().Invalidate(_localizer["Only the group's owner can delete it."], StatusCodes.Status403Forbidden));
+			await groups.Remove(group.ID, CancellationToken.None);
+			return Ok();
+		}
+
 		IActionResult Invalid() => BadRequest(new WebResult().Invalidate(_localizer["Invalid model."]));
 
 		IActionResult Answer(WebResult result) => result.IsValid ? Ok(result.Data) : StatusCode(result.StatusCode, result);

PrivaPub/Controllers/ClientToServer/InstanceAdminController.cs

@@ -230,7 +230,7 @@ namespace PrivaPub.Controllers.ClientToServer
 		// a local persona whose login may act: the contact is shown to everyone as the one who runs the server
 		static async Task<bool> IsContactable(string avatarId, CancellationToken token) =>
 			await DB.Default.Find<Avatar>().Match(a => a.ID == avatarId && !a.DeletionAt.HasValue).ExecuteAnyAsync(token)
-				&& !(await Counted.BarredPersonas(token)).Contains(avatarId);
+				&& !(await Counted.HeldBackPersonas(token)).Contains(avatarId);
 
 		static string Clean(string text) => string.IsNullOrWhiteSpace(text) ? default : text.Trim();
 

PrivaPub/Controllers/ClientToServer/ModeratorController.cs

@@ -21,13 +21,22 @@ namespace PrivaPub.Controllers.ClientToServer
 	{
 		const int MaxLogPage = 100;
 
+		const int MaxAccountsPage = 100;
+
 		readonly IInstanceSettings _settings;
 		readonly IModerationLog _log;
+		readonly IAccountModeration _moderation;
+		readonly Federation.Actors.ILocalActorService _localActors;
+		readonly Microsoft.Extensions.Localization.IStringLocalizer<Resources.GenericRes> _localizer;
 
-		public ModeratorController(IInstanceSettings settings, IModerationLog log)
+		public ModeratorController(IInstanceSettings settings, IModerationLog log, IAccountModeration moderation,
+			Federation.Actors.ILocalActorService localActors, Microsoft.Extensions.Localization.IStringLocalizer<Resources.GenericRes> localizer)
 		{
 			_settings = settings;
 			_log = log;
+			_moderation = moderation;
+			_localActors = localActors;
+			_localizer = localizer;
 		}
 
 		[HttpGet, Route("/clientapi/moderator/reports")]
@@ -49,6 +58,8 @@ namespace PrivaPub.Controllers.ClientToServer
 					Comment = r.Comment,
 					Forwarded = r.Forwarded,
 					IsResolved = r.IsResolved,
+					Resolution = r.Resolution,
+					ResolutionNote = r.ResolutionNote,
 					CreatedAt = r.CreatedAt,
 					ResolvedAt = r.ResolvedAt,
 					RemoteResolvedAt = r.RemoteResolvedAt,
@@ -56,22 +67,136 @@ namespace PrivaPub.Controllers.ClientToServer
 				}));
 		}
 
+		// A report resolved, and with it what the staff does about it (R6): nothing more, the reported account silenced or
+		// suspended, or the reported posts removed. The act comes first: one that fails leaves the report open. The body is
+		// optional (a report only marked resolved, as before R6).
 		[HttpPost, Route("/clientapi/moderator/reports/{id}/resolve")]
-		public async Task<IActionResult> Resolve(string id, CancellationToken token)
+		public async Task<IActionResult> Resolve(string id, [FromBody(EmptyBodyBehavior = Microsoft.AspNetCore.Mvc.ModelBinding.EmptyBodyBehavior.Allow)] ResolveReportForm form,
+			CancellationToken token)
 		{
+			form ??= new ResolveReportForm();
+			var action = string.IsNullOrWhiteSpace(form.Action) ? ModerationActions.None : form.Action.Trim().ToLowerInvariant();
+			if (!ModerationActions.IsResolution(action))
+				return UnprocessableEntity(new WebResult().Invalidate(_localizer["Unknown moderation action."], StatusCodes.Status422UnprocessableEntity));
 			var by = User.GetUserId();
-			var result = await DB.Default.Update<Report>().MatchID(id)
+			var report = await DB.Default.Find<Report>().MatchID(id).ExecuteFirstAsync(token);
+			if (report == default)
+				return NotFound();
+			switch (action)
+			{
+				case ModerationActions.Silence or ModerationActions.Suspend:
+					var moderated = await _moderation.Moderate(by, report.TargetAccountId, action, form.Note, form.Warning, report.ID, token);
+					if (!moderated.IsValid)
+						return StatusCode(moderated.StatusCode, moderated);
+					break;
+				case ModerationActions.RemovePosts:
+					if (report.PostIds.Count == 0)
+						return UnprocessableEntity(new WebResult().Invalidate(_localizer["The report names no posts."], StatusCodes.Status422UnprocessableEntity));
+					foreach (var postId in report.PostIds)
+					{
+						var removed = await _moderation.RemovePost(by, postId, form.Note, form.Warning, report.ID, token);
+						if (!removed.IsValid && removed.StatusCode != StatusCodes.Status404NotFound)//one already gone is removed
+							return StatusCode(removed.StatusCode, removed);
+					}
+					break;
+			}
+			await DB.Default.Update<Report>().MatchID(id)
 				.Modify(r => r.IsResolved, true)
 				.Modify(r => r.ResolvedAt, DateTime.UtcNow)
 				.Modify(r => r.ResolvedBy, by)
-				.ExecuteAsync(token);
-			if (result.MatchedCount == 0)
-				return NotFound();
-			var report = await DB.Default.Find<Report>().MatchID(id).ExecuteFirstAsync(token);
-			await _log.Write(by, AdminActions.ReportResolve, AdminTargets.Report, id, report?.Category, reportId: id, token: token);
+				.Modify(r => r.Resolution, action)
+				.Modify(r => r.ResolutionNote, string.IsNullOrWhiteSpace(form.Note) ? null : form.Note.Trim())
+				.ExecuteAsync(CancellationToken.None);
+			await _log.Write(by, AdminActions.ReportResolve, AdminTargets.Report, id, report.Category, reportId: id,
+				note: action == ModerationActions.None ? form.Note : string.IsNullOrWhiteSpace(form.Note) ? action : $"{action}: {form.Note.Trim()}",
+				token: CancellationToken.None);
 			return Ok();
 		}
 
+		// Accounts to moderate, found by a name (a persona's, or user@host for an account elsewhere) or an actor's address:
+		// personas here, never their logins, and accounts elsewhere PrivaPub holds
+		[HttpGet, Route("/clientapi/moderator/accounts")]
+		public async Task<IActionResult> Accounts([FromQuery] string q, [FromQuery] int limit = 20, CancellationToken token = default)
+		{
+			limit = Math.Clamp(limit, 1, 40);
+			q = q?.Trim().TrimStart('@');
+			var items = new List<ViewModeratedAccount>();
+			if (string.IsNullOrEmpty(q) || q.Length > 300)
+				return Ok(new ViewModeratedAccountsPage { Items = items });
+			if (Uri.TryCreate(q, UriKind.Absolute, out var address) && address.Scheme is "https" or "http")
+			{
+				if (await _localActors.FindByUri(q, token) is { Kind: Models.Federation.LocalActorKind.Person } local
+					&& await DB.Default.Find<Avatar>().MatchID(local.Id).ExecuteFirstAsync(token) is { } persona)
+					items.Add(_moderation.View(persona));
+				items.AddRange((await DB.Default.Find<ForeignAvatar>().Match(f => f.ActorURI == q || f.Url == q).Limit(limit).ExecuteAsync(token)).Select(_moderation.View));
+				return Ok(new ViewModeratedAccountsPage { Items = items.Take(limit).ToList() });
+			}
+			var parts = q.Split('@', 2);
+			var name = parts[0];
+			var domain = parts.Length > 1 ? parts[1].ToLowerInvariant() : default;
+			var here = new Uri(_localActors.BaseAddress).Authority;
+			if (domain == default || domain == here)
+			{
+				var lowered = name.ToLowerInvariant();
+				items.AddRange((await DB.Default.Find<Avatar>().Match(a => a.UserName.StartsWith(lowered) && !a.DeletionAt.HasValue)
+					.Sort(a => a.UserName, Order.Ascending).Limit(limit).ExecuteAsync(token)).Select(_moderation.View));
+			}
+			if (domain != here && items.Count < limit && name.Length > 0)
+			{
+				var userName = new MongoDB.Bson.BsonRegularExpression("^" + System.Text.RegularExpressions.Regex.Escape(name), "i");
+				var remote = DB.Default.Find<ForeignAvatar>().Match(f => f.Regex(a => a.UserName, userName));
+				if (domain != default)
+					remote.Match(f => f.Regex(a => a.Domain, new MongoDB.Bson.BsonRegularExpression("^" + System.Text.RegularExpressions.Regex.Escape(domain), "i")));
+				items.AddRange((await remote.Match(f => !f.DeletionAt.HasValue).Sort(f => f.UserName, Order.Ascending).Limit(limit - items.Count).ExecuteAsync(token))
+					.Select(_moderation.View));
+			}
+			return Ok(new ViewModeratedAccountsPage { Items = items });
+		}
+
+		// what the staff silenced or suspended, here and elsewhere, most recently moderated first (a banned login's personas
+		// are never among them: the ban is the login's, and only administrators see logins)
+		[HttpGet, Route("/clientapi/moderator/accounts/moderated")]
+		public async Task<IActionResult> Moderated([FromQuery] int offset = 0, [FromQuery] int limit = 50, CancellationToken token = default)
+		{
+			offset = Math.Max(0, offset);
+			limit = Math.Clamp(limit, 1, MaxAccountsPage);
+			var locals = await DB.Default.Find<Avatar>().Match(a => (a.SilencedAt != null || a.SuspendedAt != null) && a.DeletionAt == null).ExecuteAsync(token);
+			var remotes = await DB.Default.Find<ForeignAvatar>().Match(f => f.SilencedAt != null || f.SuspendedAt != null).ExecuteAsync(token);
+			var all = locals.Select(_moderation.View).Concat(remotes.Select(_moderation.View))
+				.OrderByDescending(a => Latest(a.SilencedAt, a.SuspendedAt)).ThenBy(a => a.Id, StringComparer.Ordinal).ToList();
+			return Ok(new ViewModeratedAccountsPage
+			{
+				Items = all.Skip(offset).Take(limit).ToList(),
+				Next = all.Count > offset + limit ? offset + limit : default(int?)
+			});
+		}
+
+		static DateTime Latest(DateTime? a, DateTime? b) => (a ?? DateTime.MinValue) > (b ?? DateTime.MinValue) ? a ?? DateTime.MinValue : b ?? DateTime.MinValue;
+
+		[HttpGet, Route("/clientapi/moderator/accounts/{id}")]
+		public async Task<IActionResult> Account(string id, CancellationToken token) =>
+			await _moderation.View(id, token) is { } account ? Ok(account) : NotFound();
+
+		// silence, unsilence, suspend or unsuspend a persona here or an account elsewhere
+		[HttpPost, Route("/clientapi/moderator/accounts/moderate")]
+		public async Task<IActionResult> Moderate(ModerateAccountForm form, CancellationToken token)
+		{
+			if (!ModelState.IsValid)
+				return BadRequest(new WebResult().Invalidate(_localizer["Invalid model."]));
+			var result = await _moderation.Moderate(User.GetUserId(), form.AccountId, form.Action.Trim().ToLowerInvariant(), form.Note, form.Warning, default, token);
+			return result.IsValid ? Ok(result.Data) : StatusCode(result.StatusCode, result);
+		}
+
+		// a post taken down: deleted when it is ours (the deletion federates), hidden here when it is a copy
+		[HttpPost, Route("/clientapi/moderator/posts/remove")]
+		public async Task<IActionResult> RemovePost(RemovePostForm form, CancellationToken token)
+		{
+			if (!ModelState.IsValid)
+				return BadRequest(new WebResult().Invalidate(_localizer["Invalid model."]));
+			var result = await _moderation.RemovePost(User.GetUserId(), form.PostId, form.Note, form.Warning, default, token);
+			return result.IsValid ? Ok() : StatusCode(result.StatusCode, result);
+		}
+
 		// The staff's log, newest first, a page at a time (before: the last id of the page before). Administrators read all
 		// of it; a moderator who isn't one reads what isn't about a login, and who acted only when it was the command line or
 		// themselves.

PrivaPub/Controllers/ClientToServer/PersonaArchiveController.cs

@@ -110,6 +110,9 @@ namespace PrivaPub.Controllers.ClientToServer
 		{
 			if (!await Owns(avatarId, token))
 				return NotFound();
+			// a suspended persona may take its archive away, never bring one in (R6): an import follows, blocks and posts
+			if (await DB.Default.Find<Avatar>().MatchID(avatarId).Match(a => a.SuspendedAt != null).ExecuteAnyAsync(token))
+				return StatusCode(StatusCodes.Status403Forbidden, new WebResult().Invalidate("This persona is suspended.", StatusCodes.Status403Forbidden));
 			var state = await PersonaArchives.Of(avatarId, token);
 			if (state.ImportState is "queued" or "running")
 				return Conflict(new WebResult().Invalidate("An import is running."));

PrivaPub/Controllers/ClientToServer/PrivateAvatarController.cs

@@ -5,6 +5,7 @@ using PrivaPub.ClientModels;
 using PrivaPub.Extensions;
 using PrivaPub.Resources;
 using PrivaPub.Services.ClientToServer.Private;
+using PrivaPub.ClientModels.User;
 using PrivaPub.ClientModels.User.Avatar;
 
 namespace PrivaPub.Controllers.ClientToServer
@@ -56,6 +57,23 @@ namespace PrivaPub.Controllers.ClientToServer
 			}
 		}
 
+		// A login deletes one of its personas, with its password again (R6): everything public it had goes, the groups it owns
+		// with it, as when the whole login is deleted (PersonaRemoval). A suspended persona may be deleted too.
+		[HttpPost, Route("/clientapi/avatar/private/delete"), Microsoft.AspNetCore.RateLimiting.EnableRateLimiting(Infrastructure.RateLimiting.Accounts)]
+		public async Task<IActionResult> DeleteAvatar(DeletePersonaForm form, [FromServices] Services.IRootUsersService users,
+			[FromServices] Services.IPersonaRemoval personas, [FromServices] StaticServices.DbEntities dbEntities, CancellationToken token)
+		{
+			if (!ModelState.IsValid)
+				return BadRequest(new WebResult().Invalidate(_localizer["Invalid model."]));
+			var rootId = User.GetUserId();
+			if (!await users.PasswordMatches(rootId, form.Password))
+				return StatusCode(StatusCodes.Status403Forbidden, new WebResult().Invalidate(_localizer[Services.RootUsersService.NoMatch], StatusCodes.Status403Forbidden));
+			if (!await dbEntities.RootToAvatars.Match(ra => ra.RootId == rootId && ra.AvatarId == form.AvatarId).ExecuteAnyAsync(token)
+				|| !await personas.Remove(form.AvatarId, CancellationToken.None))
+				return NotFound(new WebResult().Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound));
+			return Ok();
+		}
+
 		[HttpPost, Route("/clientapi/avatar/private/update")]
 		public async Task<IActionResult> UpdateAvatar(UpdateAvatarForm model)
 		{

PrivaPub/Domain/Moderation/AccountModeration.cs

@@ -0,0 +1,339 @@
+using Microsoft.Extensions.Localization;
+
+using MongoDB.Entities;
+
+using OpenIddict.Abstractions;
+
+using PrivaPub.ClientModels;
+using PrivaPub.ClientModels.Admin;
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Domain.Timelines;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Moderation;
+using PrivaPub.Models;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.User;
+using PrivaPub.Resources;
+using PrivaPub.StaticServices;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Domain.Moderation
+{
+	public interface IAccountModeration
+	{
+		/// <summary>Silences, unsilences, suspends or unsuspends a persona here or an account elsewhere (ModerationActions);
+		/// Data is the account as moderators see it.</summary>
+		Task<WebResult> Moderate(string byRootId, string accountId, string action, string note, string warning, string reportId, CancellationToken token);
+
+		/// <summary>Takes a post down: a post here is deleted as its author deletes it, a copy of one from elsewhere is hidden
+		/// here (Post.ModeratedAt).</summary>
+		Task<WebResult> RemovePost(string byRootId, string postId, string note, string warning, string reportId, CancellationToken token);
+
+		/// <summary>A server's block changed: its accounts' posts are limited while it is silenced, and only then.</summary>
+		Task DomainChanged(string domain, CancellationToken token);
+
+		Task<ViewModeratedAccount> View(string accountId, CancellationToken token);
+		ViewModeratedAccount View(Avatar avatar);
+		ViewModeratedAccount View(ForeignAvatar account);
+	}
+
+	// The staff's acts on accounts and posts (completion program R6; moderators' and administrators' alike). What they do,
+	// following the AuthorGone pattern: the account carries when it was silenced or suspended, its posts carry
+	// AuthorLimited or AuthorSuspended so every query can leave them out, and Restrictions knows it in memory.
+	//
+	// A persona here:
+	// - silenced: out of the public and hashtag timelines, trends, the directory, search and the relays; its followers still
+	//   get what it posts, and it is told (a moderation_warning);
+	// - suspended: its tokens are revoked and refused, its open streams close, it delivers nothing, its posts and collections
+	//   answer 404 to everyone, and nothing new is told to other servers (owner decision 2026-10-17): its actor stays as it
+	//   was, so lifting the suspension gives everything back as it was. It is warned; it reads the warning once it is lifted,
+	//   and its login sees it suspended among its personas meanwhile.
+	// An account elsewhere: the same flags on its posts here; suspended, what it sends is dropped (its own Delete aside)
+	// and nothing is delivered to its own inbox. It is told nothing.
+	//
+	// Every act is kept in the staff's log (ModerationLog), without who acted when the persona is the acting login's own.
+	public class AccountModeration : IAccountModeration
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IModerationLog _log;
+		readonly IOpenIddictTokenManager _tokens;
+		readonly IOpenIddictAuthorizationManager _authorizations;
+		readonly IStatusService _statuses;
+		readonly IDomainBlocks _domainBlocks;
+		readonly IStringLocalizer<GenericRes> _localizer;
+		readonly ILogger<AccountModeration> _logger;
+
+		public AccountModeration(DbEntities dbEntities, ILocalActorService localActors, IModerationLog log, IOpenIddictTokenManager tokens,
+			IOpenIddictAuthorizationManager authorizations, IStatusService statuses, IDomainBlocks domainBlocks, IStringLocalizer<GenericRes> localizer,
+			ILogger<AccountModeration> logger)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_log = log;
+			_tokens = tokens;
+			_authorizations = authorizations;
+			_statuses = statuses;
+			_domainBlocks = domainBlocks;
+			_localizer = localizer;
+			_logger = logger;
+		}
+
+		public async Task<WebResult> Moderate(string byRootId, string accountId, string action, string note, string warning, string reportId,
+			CancellationToken token)
+		{
+			var result = new WebResult();
+			if (!ModerationActions.IsAccountAction(action))
+				return result.Invalidate(_localizer["Unknown moderation action."], StatusCodes.Status422UnprocessableEntity);
+			try
+			{
+				var avatar = string.IsNullOrEmpty(accountId) ? default : await _dbEntities.Avatars.MatchID(accountId).Match(a => !a.DeletionAt.HasValue).ExecuteFirstAsync(token);
+				if (avatar != default)
+				{
+					result.Data = await Persona(byRootId, avatar, action, note, warning, reportId, token);
+					return result;
+				}
+				var account = string.IsNullOrEmpty(accountId) ? default : await _dbEntities.ForeignAvatars.MatchID(accountId).ExecuteFirstAsync(token);
+				if (account == default)
+					return result.Invalidate(_localizer["Account not found."], StatusCodes.Status404NotFound);
+				result.Data = await Remote(byRootId, account, action, note, reportId, token);
+				return result;
+			}
+			catch (Exception ex)
+			{
+				_logger.LogError(ex, "{Service}.{Method}({Action})", nameof(AccountModeration), nameof(Moderate), action);
+				return result.Invalidate(_localizer["Something went wrong."], exception: ex);
+			}
+		}
+
+		async Task<ViewModeratedAccount> Persona(string byRootId, Avatar avatar, string action, string note, string warning, string reportId,
+			CancellationToken token)
+		{
+			var now = DateTime.UtcNow;
+			var (silenced, suspended) = (avatar.SilencedAt, avatar.SuspendedAt);
+			switch (action)
+			{
+				case ModerationActions.Silence:
+					silenced ??= now;
+					break;
+				case ModerationActions.Unsilence:
+					silenced = null;
+					break;
+				case ModerationActions.Suspend:
+					suspended ??= now;
+					break;
+				case ModerationActions.Unsuspend:
+					suspended = null;
+					break;
+			}
+			var changed = silenced.HasValue != avatar.SilencedAt.HasValue || suspended.HasValue != avatar.SuspendedAt.HasValue;
+			avatar.SilencedAt = silenced;
+			avatar.SuspendedAt = suspended;
+			avatar.AccountState = suspended.HasValue ? AvatarAccountState.Suspended : silenced.HasValue ? AvatarAccountState.Silenced : AvatarAccountState.Normal;
+			if (!string.IsNullOrWhiteSpace(note))
+				avatar.ModerationNote = note.Trim();
+			await DB.Default.Update<Avatar>().MatchID(avatar.ID)
+				.Modify(a => a.SilencedAt, avatar.SilencedAt)
+				.Modify(a => a.SuspendedAt, avatar.SuspendedAt)
+				.Modify(a => a.AccountState, avatar.AccountState)
+				.Modify(a => a.ModerationNote, avatar.ModerationNote)
+				.ExecuteAsync(CancellationToken.None);
+			if (!changed)
+				return View(avatar);
+
+			// its own posts and boosts, everywhere they are read
+			await DB.Default.Update<PostEntity>().Match(p => p.GroupUserId == avatar.ID && !p.IsFederatedCopy)
+				.Modify(p => p.AuthorSuspended, suspended.HasValue)
+				.Modify(p => p.AuthorLimited, silenced.HasValue)
+				.ExecuteAsync(CancellationToken.None);
+			await Restrictions.Reload(CancellationToken.None);
+			var persona = _localActors.FromAvatar(avatar);
+			if (action == ModerationActions.Suspend)
+			{
+				// nothing acts as it from now on: its Mastodon tokens end and its open streams close
+				await _tokens.RevokeBySubjectAsync(avatar.ID, CancellationToken.None);
+				await _authorizations.RevokeBySubjectAsync(avatar.ID, CancellationToken.None);
+				Streams.CloseFor(avatar.ID);
+			}
+			if (action is ModerationActions.Silence or ModerationActions.Suspend)
+				await Social.Notifications.Warn(avatar.ID, persona.Uri, action, warning, default, token);
+			await _log.Write(byRootId, action switch
+			{
+				ModerationActions.Silence => AdminActions.PersonaSilence,
+				ModerationActions.Unsilence => AdminActions.PersonaUnsilence,
+				ModerationActions.Suspend => AdminActions.PersonaSuspend,
+				_ => AdminActions.PersonaUnsuspend
+			}, AdminTargets.Persona, avatar.ID, "@" + persona.Handle, reportId, note, CancellationToken.None);
+			return View(avatar);
+		}
+
+		async Task<ViewModeratedAccount> Remote(string byRootId, ForeignAvatar account, string action, string note, string reportId, CancellationToken token)
+		{
+			var now = DateTime.UtcNow;
+			var (silenced, suspended) = (account.SilencedAt, account.SuspendedAt);
+			switch (action)
+			{
+				case ModerationActions.Silence:
+					silenced ??= now;
+					break;
+				case ModerationActions.Unsilence:
+					silenced = null;
+					break;
+				case ModerationActions.Suspend:
+					suspended ??= now;
+					break;
+				case ModerationActions.Unsuspend:
+					suspended = null;
+					break;
+			}
+			var changed = silenced.HasValue != account.SilencedAt.HasValue || suspended.HasValue != account.SuspendedAt.HasValue;
+			account.SilencedAt = silenced;
+			account.SuspendedAt = suspended;
+			// an account that deleted itself stays deleted, whatever is done to it
+			if (account.AccountState != AvatarAccountState.Deleted)
+				account.AccountState = suspended.HasValue ? AvatarAccountState.Suspended : silenced.HasValue ? AvatarAccountState.Silenced : AvatarAccountState.Normal;
+			if (!string.IsNullOrWhiteSpace(note))
+				account.ModerationNote = note.Trim();
+			await DB.Default.Update<ForeignAvatar>().MatchID(account.ID)
+				.Modify(a => a.SilencedAt, account.SilencedAt)
+				.Modify(a => a.SuspendedAt, account.SuspendedAt)
+				.Modify(a => a.AccountState, account.AccountState)
+				.Modify(a => a.ModerationNote, account.ModerationNote)
+				.ExecuteAsync(CancellationToken.None);
+			if (!changed)
+				return View(account);
+
+			// what it wrote and boosted, as it arrived and arrives (RemotePosts)
+			var limited = silenced.HasValue || IsDomainSilenced(account.ActorURI);
+			await DB.Default.Update<PostEntity>().Match(p => p.ActorURI == account.ActorURI && p.IsFederatedCopy)
+				.Modify(p => p.AuthorSuspended, suspended.HasValue)
+				.Modify(p => p.AuthorLimited, limited)
+				.ExecuteAsync(CancellationToken.None);
+			await Restrictions.Reload(CancellationToken.None);
+			await _log.Write(byRootId, action switch
+			{
+				ModerationActions.Silence => AdminActions.AccountSilence,
+				ModerationActions.Unsilence => AdminActions.AccountUnsilence,
+				ModerationActions.Suspend => AdminActions.AccountSuspend,
+				_ => AdminActions.AccountUnsuspend
+			}, AdminTargets.Account, account.ID, Handle(account), reportId, note, CancellationToken.None);
+			return View(account);
+		}
+
+		public async Task<WebResult> RemovePost(string byRootId, string postId, string note, string warning, string reportId, CancellationToken token)
+		{
+			var result = new WebResult();
+			try
+			{
+				var post = string.IsNullOrEmpty(postId) ? default : await _dbEntities.Posts.MatchID(postId).ExecuteFirstAsync(token);
+				if (post == default || post.DeletedAt.HasValue || post.ModeratedAt.HasValue)
+					return result.Invalidate(_localizer["Post not found."], StatusCodes.Status404NotFound);
+
+				if (!post.IsFederatedCopy)
+				{
+					var author = await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
+					if (author == default)
+						return result.Invalidate(_localizer["Post not found."], StatusCodes.Status404NotFound);
+					// deleted as its author deletes it: emptied, out of every timeline, and a Delete to its audience (but from a
+					// suspended persona, which delivers nothing)
+					var outcome = await _statuses.Remove(author, post.ID, CancellationToken.None);
+					if (!outcome.Ok)
+						return result.Invalidate(_localizer["Post not found."], outcome.Status);
+					await Social.Notifications.Warn(author.Id, author.Uri, "delete_statuses", warning, new[] { post.ID }, token);
+					await _log.Write(byRootId, AdminActions.PostRemove, AdminTargets.Post, post.ID, $"@{author.Handle}: {post.ObjectURI}", reportId, note,
+						CancellationToken.None);
+					return result;
+				}
+
+				// a copy of a post from elsewhere: kept (its address stays known, so it is never taken in again), hidden here
+				await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.ModeratedAt, DateTime.UtcNow).ExecuteAsync(CancellationToken.None);
+				await Fanout.Deleting(post, CancellationToken.None);
+				await _log.Write(byRootId, AdminActions.PostRemove, AdminTargets.Post, post.ID, post.Url ?? post.ObjectURI, reportId, note, CancellationToken.None);
+				return result;
+			}
+			catch (Exception ex)
+			{
+				_logger.LogError(ex, "{Service}.{Method}()", nameof(AccountModeration), nameof(RemovePost));
+				return result.Invalidate(_localizer["Something went wrong."], exception: ex);
+			}
+		}
+
+		public async Task DomainChanged(string domain, CancellationToken token)
+		{
+			domain = DomainBlocks.Normalise(domain);
+			if (string.IsNullOrEmpty(domain))
+				return;
+			var silenced = _domainBlocks.Find(domain)?.Severity == DomainBlockSeverity.Silence;
+			// the posts of that server and of its subdomains, by their authors' addresses
+			var pattern = ModerationFlags.OfDomain(domain);
+			await DB.Default.Update<PostEntity>().Match(f => f.Regex(p => p.ActorURI, pattern) & f.Eq(p => p.IsFederatedCopy, true))
+				.Modify(p => p.AuthorLimited, silenced)
+				.ExecuteAsync(token);
+			if (silenced)
+				return;
+			// an account silenced on its own stays limited, whatever its server is
+			var own = (await DB.Default.Find<ForeignAvatar>().Match(f => f.Regex(a => a.ActorURI, pattern) & f.Ne(a => a.SilencedAt, null))
+				.Project(a => a.Include(x => x.ActorURI)).ExecuteAsync(token)).Select(a => a.ActorURI).Where(u => !string.IsNullOrEmpty(u)).ToList();
+			foreach (var batch in own.Chunk(500))
+				await DB.Default.Update<PostEntity>().Match(p => batch.Contains(p.ActorURI) && p.IsFederatedCopy)
+					.Modify(p => p.AuthorLimited, true)
+					.ExecuteAsync(token);
+		}
+
+		bool IsDomainSilenced(string actorUri) =>
+			Uri.TryCreate(actorUri, UriKind.Absolute, out var uri) && _domainBlocks.Find(uri.Host)?.Severity == DomainBlockSeverity.Silence;
+
+		public async Task<ViewModeratedAccount> View(string accountId, CancellationToken token)
+		{
+			var avatar = await _dbEntities.Avatars.MatchID(accountId).ExecuteFirstAsync(token);
+			if (avatar != default)
+				return View(avatar);
+			var account = await _dbEntities.ForeignAvatars.MatchID(accountId).ExecuteFirstAsync(token);
+			return account == default ? default : View(account);
+		}
+
+		// a persona as moderators see it: never its login
+		public ViewModeratedAccount View(Avatar avatar)
+		{
+			var persona = _localActors.FromAvatar(avatar);
+			return new ViewModeratedAccount
+			{
+				Id = avatar.ID,
+				IsLocal = true,
+				UserName = avatar.UserName,
+				DisplayName = persona.Name,
+				Handle = persona.Handle,
+				Url = persona.Uri,
+				Domain = persona.Domain,
+				SilencedAt = avatar.SilencedAt,
+				SuspendedAt = avatar.SuspendedAt,
+				Note = avatar.ModerationNote
+			};
+		}
+
+		public ViewModeratedAccount View(ForeignAvatar account)
+		{
+			var block = Uri.TryCreate(account.ActorURI, UriKind.Absolute, out var uri) ? _domainBlocks.Find(uri.Host) : default;
+			return new ViewModeratedAccount
+			{
+				Id = account.ID,
+				IsLocal = false,
+				UserName = account.UserName,
+				DisplayName = account.Name ?? account.UserName,
+				Handle = Handle(account),
+				Url = account.ActorURI,
+				Domain = account.Domain ?? uri?.Host,
+				SilencedAt = account.SilencedAt,
+				SuspendedAt = account.SuspendedAt,
+				DomainSilenced = block?.Severity == DomainBlockSeverity.Silence,
+				DomainSuspended = block?.Severity == DomainBlockSeverity.Suspend,
+				Note = account.ModerationNote
+			};
+		}
+
+		static string Handle(ForeignAvatar account) =>
+			string.IsNullOrEmpty(account.UserName) ? account.ActorURI
+			: $"{account.UserName}@{account.Domain ?? (Uri.TryCreate(account.ActorURI, UriKind.Absolute, out var uri) ? uri.Host : string.Empty)}";
+	}
+}

PrivaPub/Domain/Moderation/ModerationFlags.cs

@@ -0,0 +1,75 @@
+using MongoDB.Bson;
+using MongoDB.Driver;
+
+namespace PrivaPub.Domain.Moderation
+{
+	// Every post's AuthorSuspended and AuthorLimited worked out again from its author's and its server's moderation (R6),
+	// and every account's AccountState from when it was silenced or suspended: after a restore merged the moderation it keeps
+	// (ProtectiveMerge), and once by migration _020 for the servers silenced before posts carried the flags. Raw documents,
+	// since a restore runs before the entities are used. A banned login's personas are never flagged (Restrictions).
+	public static class ModerationFlags
+	{
+		public static async Task<long> Recompute(IMongoDatabase database, CancellationToken token)
+		{
+			var posts = database.GetCollection<BsonDocument>("Post");
+			var flagged = 0L;
+			await posts.UpdateManyAsync(new BsonDocument("AuthorSuspended", true), Builders<BsonDocument>.Update.Set("AuthorSuspended", false), cancellationToken: token);
+			await posts.UpdateManyAsync(new BsonDocument("AuthorLimited", true), Builders<BsonDocument>.Update.Set("AuthorLimited", false), cancellationToken: token);
+
+			var moderated = new BsonDocument("$or", new BsonArray
+			{
+				new BsonDocument("SuspendedAt", new BsonDocument("$ne", BsonNull.Value)),
+				new BsonDocument("SilencedAt", new BsonDocument("$ne", BsonNull.Value))
+			});
+
+			// personas here: their own posts and boosts
+			var avatars = database.GetCollection<BsonDocument>("Avatar");
+			await avatars.UpdateManyAsync(new BsonDocument("AccountState", new BsonDocument("$in", new BsonArray { 1, 2 })),
+				Builders<BsonDocument>.Update.Set("AccountState", 0), cancellationToken: token);
+			foreach (var avatar in await (await avatars.FindAsync(moderated, cancellationToken: token)).ToListAsync(token))
+			{
+				var (suspended, silenced) = (IsSet(avatar, "SuspendedAt"), IsSet(avatar, "SilencedAt"));
+				await avatars.UpdateOneAsync(new BsonDocument("_id", avatar["_id"]), Builders<BsonDocument>.Update.Set("AccountState", suspended ? 2 : 1),
+					cancellationToken: token);
+				flagged += (await posts.UpdateManyAsync(new BsonDocument { { "GroupUserId", avatar["_id"].ToString() }, { "IsFederatedCopy", false } },
+					Builders<BsonDocument>.Update.Set("AuthorSuspended", suspended).Set("AuthorLimited", silenced), cancellationToken: token)).ModifiedCount;
+			}
+
+			// accounts elsewhere: what they wrote and boosted (an account that deleted itself stays Deleted)
+			var foreign = database.GetCollection<BsonDocument>("ForeignAvatar");
+			await foreign.UpdateManyAsync(new BsonDocument("AccountState", new BsonDocument("$in", new BsonArray { 1, 2 })),
+				Builders<BsonDocument>.Update.Set("AccountState", 0), cancellationToken: token);
+			foreach (var account in await (await foreign.FindAsync(moderated, cancellationToken: token)).ToListAsync(token))
+			{
+				if (account.GetValue("ActorURI", BsonNull.Value) is not BsonString actor)
+					continue;
+				var (suspended, silenced) = (IsSet(account, "SuspendedAt"), IsSet(account, "SilencedAt"));
+				if (account.GetValue("AccountState", 0).ToInt32() != 4)
+					await foreign.UpdateOneAsync(new BsonDocument("_id", account["_id"]), Builders<BsonDocument>.Update.Set("AccountState", suspended ? 2 : 1),
+						cancellationToken: token);
+				var update = Builders<BsonDocument>.Update.Set("AuthorSuspended", suspended);
+				if (silenced)
+					update = update.Set("AuthorLimited", true);
+				flagged += (await posts.UpdateManyAsync(new BsonDocument { { "ActorURI", actor }, { "IsFederatedCopy", true } }, update, cancellationToken: token))
+					.ModifiedCount;
+			}
+
+			// servers silenced: every post of theirs, and of their subdomains
+			var blocks = database.GetCollection<BsonDocument>("DomainBlock");
+			foreach (var block in await (await blocks.FindAsync(new BsonDocument("Severity", 1), cancellationToken: token)).ToListAsync(token))
+				if (block.GetValue("Domain", BsonNull.Value) is BsonString domain && !string.IsNullOrWhiteSpace(domain.AsString))
+					flagged += (await posts.UpdateManyAsync(new BsonDocument
+					{
+						{ "ActorURI", OfDomain(domain.AsString) },
+						{ "IsFederatedCopy", true }
+					}, Builders<BsonDocument>.Update.Set("AuthorLimited", true), cancellationToken: token)).ModifiedCount;
+			return flagged;
+		}
+
+		// an actor's address on a server or one of its subdomains
+		public static BsonRegularExpression OfDomain(string domain) =>
+			new($"^https?://([^/]*\\.)?{System.Text.RegularExpressions.Regex.Escape(Federation.Moderation.DomainBlocks.Normalise(domain))}(:[0-9]+)?(/|$)", "i");
+
+		static bool IsSet(BsonDocument row, string field) => row.TryGetValue(field, out var value) && !value.IsBsonNull;
+	}
+}

PrivaPub/Domain/Moderation/ModerationLog.cs

@@ -15,7 +15,8 @@ namespace PrivaPub.Domain.Moderation
 
 	// The staff's log (completion program R5): administrators read all of it, moderators what isn't about a login
 	// (ModeratorController's /clientapi/moderator/log). An entry never holds an IP address, and never pairs a root with its
-	// own personas: an act on a persona that the acting root owns is kept without who acted.
+	// own personas: an act on a persona that the acting root owns, on a post of it, a group it owns or a report about it
+	// (R6), is kept without who acted.
 	public class ModerationLog : IModerationLog
 	{
 		const int MaxLabel = 200;
@@ -33,8 +34,7 @@ namespace PrivaPub.Domain.Moderation
 		{
 			try
 			{
-				if (targetKind == AdminTargets.Persona && byRootId != default && byRootId != AdminAction.Cli && targetId != default
-					&& await DB.Default.Find<RootToAvatar>().Match(r => r.RootId == byRootId && r.AvatarId == targetId).ExecuteAnyAsync(token))
+				if (byRootId != default && byRootId != AdminAction.Cli && await OwnPersona(byRootId, targetKind, targetId, reportId, token))
 					byRootId = default;
 				await DB.Default.SaveAsync(new AdminAction
 				{
@@ -53,6 +53,37 @@ namespace PrivaPub.Domain.Moderation
 			}
 		}
 
+		// whether what an entry is about is a persona of the acting login: the persona itself, a post of it, a group it owns,
+		// or a report about it (R6) — any of them would pair the login with that persona
+		static async Task<bool> OwnPersona(string rootId, string targetKind, string targetId, string reportId, CancellationToken token)
+		{
+			var personas = new List<string>();
+			if (targetId != default)
+				switch (targetKind)
+				{
+					case AdminTargets.Persona:
+						personas.Add(targetId);
+						break;
+					case AdminTargets.Post when MongoDB.Bson.ObjectId.TryParse(targetId, out _):
+						if (await DB.Default.Find<Models.Post.Post>().MatchID(targetId).Match(p => !p.IsFederatedCopy)
+							.Project(p => p.Include(x => x.GroupUserId)).ExecuteFirstAsync(token) is { GroupUserId: { } author })
+							personas.Add(author);
+						break;
+					case AdminTargets.Group when MongoDB.Bson.ObjectId.TryParse(targetId, out _):
+						if (await DB.Default.Find<Models.Group.Group>().MatchID(targetId).Project(g => g.Include(x => x.OwnerAvatarId))
+							.ExecuteFirstAsync(token) is { OwnerAvatarId: { } owner })
+							personas.Add(owner);
+						break;
+				}
+			var report = reportId ?? (targetKind == AdminTargets.Report ? targetId : default);
+			if (report != default && MongoDB.Bson.ObjectId.TryParse(report, out _)
+				&& await DB.Default.Find<Models.Social.Report>().MatchID(report).Project(r => r.Include(x => x.TargetAccountId)).ExecuteFirstAsync(token)
+					is { TargetAccountId: { } reported })
+				personas.Add(reported);
+			return personas.Count > 0
+				&& await DB.Default.Find<RootToAvatar>().Match(r => r.RootId == rootId && personas.Contains(r.AvatarId)).ExecuteAnyAsync(token);
+		}
+
 		static string Cut(string text, int max) =>
 			string.IsNullOrEmpty(text) ? text : text.Length <= max ? text : text[..(max - 1)] + "…";
 	}

PrivaPub/Domain/Moderation/Restrictions.cs

@@ -0,0 +1,111 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Models.User;
+
+namespace PrivaPub.Domain.Moderation
+{
+	// Who the staff's moderation holds back right now, in memory (completion program R6), for the places that decide one
+	// item at a time and must not ask the database each time: a token's persona, a delivery's signer and inbox, a post
+	// shown or not, a stream. The posts of a suspended or silenced account carry their own flags (Post.AuthorSuspended,
+	// AuthorLimited) for queries; a banned login's personas never do, since flagging all of them at once would pair them
+	// in stored data, so they are suspended here alone (Counted.HeldBackPersonas).
+	//
+	// Read at start, again after every act that changes it (AccountModeration, a ban, a removal) and when five minutes old;
+	// a process that never loaded it (the CLI) starts with nobody held back and loads it on first use.
+	public static class Restrictions
+	{
+		static readonly TimeSpan Staleness = TimeSpan.FromMinutes(5);
+
+		public sealed class Set
+		{
+			public static readonly Set Empty = new(new HashSet<string>(), new HashSet<string>(), new HashSet<string>(), new HashSet<string>());
+
+			public Set(IReadOnlySet<string> suspendedPersonas, IReadOnlySet<string> silencedPersonas, IReadOnlySet<string> suspendedActors,
+				IReadOnlySet<string> suspendedInboxes)
+			{
+				SuspendedPersonas = suspendedPersonas;
+				SilencedPersonas = silencedPersonas;
+				SuspendedActors = suspendedActors;
+				SuspendedInboxes = suspendedInboxes;
+			}
+
+			// suspended themselves, or held back with their login (banned or deleted)
+			public IReadOnlySet<string> SuspendedPersonas { get; }
+			public IReadOnlySet<string> SilencedPersonas { get; }
+			// accounts elsewhere the staff suspended: their actors' ids, and their own inboxes (never a shared one, which
+			// serves the rest of their server)
+			public IReadOnlySet<string> SuspendedActors { get; }
+			public IReadOnlySet<string> SuspendedInboxes { get; }
+		}
+
+		static volatile Set _current = Set.Empty;
+		static DateTime _loadedAt = DateTime.MinValue;
+		static int _reloading;
+
+		public static Set Current
+		{
+			get
+			{
+				RefreshIfStale();
+				return _current;
+			}
+		}
+
+		public static bool IsSuspended(string personaId) => !string.IsNullOrEmpty(personaId) && Current.SuspendedPersonas.Contains(personaId);
+
+		public static bool IsSilenced(string personaId) => !string.IsNullOrEmpty(personaId) && Current.SilencedPersonas.Contains(personaId);
+
+		public static bool IsSuspendedActor(string actorUri) => !string.IsNullOrEmpty(actorUri) && Current.SuspendedActors.Contains(actorUri);
+
+		public static bool IsSuspendedInbox(string inbox) => !string.IsNullOrEmpty(inbox) && Current.SuspendedInboxes.Contains(inbox);
+
+		public static async Task Reload(CancellationToken token = default)
+		{
+			var suspended = (await Counted.HeldBackPersonas(token)).ToHashSet(StringComparer.Ordinal);
+			var silenced = (await DB.Default.Find<Avatar>().Match(a => a.SilencedAt != null && a.DeletionAt == null)
+				.Project(a => a.Include(x => x.ID)).ExecuteAsync(token)).Select(a => a.ID).ToHashSet(StringComparer.Ordinal);
+			var actors = await DB.Default.Find<ForeignAvatar>().Match(f => f.SuspendedAt != null)
+				.Project(f => f.Include(x => x.ActorURI).Include(x => x.InboxURL).Include(x => x.SharedInboxURL)).ExecuteAsync(token);
+			// a single-user server's actor may name its server's shared inbox as its own: that one still serves the others there
+			var inboxes = actors.Where(a => !string.IsNullOrEmpty(a.InboxURL) && a.InboxURL != a.SharedInboxURL)
+				.Select(a => a.InboxURL).ToHashSet(StringComparer.Ordinal);
+			if (inboxes.Count > 0)
+			{
+				var candidates = inboxes.ToList();
+				var shared = await DB.Default.Find<ForeignAvatar>().Match(f => candidates.Contains(f.SharedInboxURL))
+					.Project(f => f.Include(x => x.SharedInboxURL)).ExecuteAsync(token);
+				inboxes.ExceptWith(shared.Select(f => f.SharedInboxURL));
+			}
+			_current = new Set(suspended, silenced,
+				actors.Select(a => a.ActorURI).Where(u => !string.IsNullOrEmpty(u)).ToHashSet(StringComparer.Ordinal),
+				inboxes);
+			_loadedAt = DateTime.UtcNow;
+		}
+
+		// what a reload says, without waiting for it where waiting is not possible
+		public static void ReloadSoon() => _loadedAt = DateTime.MinValue;
+
+		static void RefreshIfStale()
+		{
+			if (DateTime.UtcNow - _loadedAt < Staleness || Interlocked.Exchange(ref _reloading, 1) == 1)
+				return;
+			_ = Task.Run(async () =>
+			{
+				try
+				{
+					await Reload(CancellationToken.None);
+				}
+				catch (Exception ex)
+				{
+					Serilog.Log.ForContext(typeof(Restrictions)).Warning(ex, "The moderation's restrictions could not be reloaded");
+				}
+				finally
+				{
+					Interlocked.Exchange(ref _reloading, 0);
+				}
+			});
+		}
+	}
+}

PrivaPub/Domain/Portability/ImportArchiveJob.cs

@@ -328,6 +328,7 @@ namespace PrivaPub.Domain.Portability
 				ID = id,
 				GroupUserId = me.Id,
 				AuthorAccountId = me.Id,
+				AuthorLimited = me.Silenced,
 				ActorURI = me.Uri,
 				Visibility = visibility,
 				Title = Clean(Text(note["name"])),
@@ -492,6 +493,7 @@ namespace PrivaPub.Domain.Portability
 					ID = id,
 					GroupUserId = run.Me.Id,
 					AuthorAccountId = run.Me.Id,
+					AuthorLimited = run.Me.Silenced,
 					ActorURI = run.Me.Uri,
 					Visibility = PostVisibility.LocalGeo,
 					IsLocalOnly = true,

PrivaPub/Domain/Privacy/Counted.cs

@@ -46,6 +46,17 @@ namespace PrivaPub.Domain.Privacy
 				: (await DB.Default.Find<RootToAvatar>().Match(ra => roots.Contains(ra.RootId)).ExecuteAsync(token)).Select(ra => ra.AvatarId).ToList();
 		}
 
+		// Personas nobody finds or is shown: the barred ones, and those the staff suspended (completion program R6). A
+		// suspended persona still counts among the users and its posts among the posts: the counts other servers read tell
+		// nothing new of it (owner decision 2026-10-17). Moderation's Restrictions holds the same set in memory.
+		public static async Task<List<string>> HeldBackPersonas(CancellationToken token)
+		{
+			var held = await BarredPersonas(token);
+			held.AddRange((await DB.Default.Find<Avatar>().Match(a => a.SuspendedAt != null).Project(a => a.Include(x => x.ID)).ExecuteAsync(token))
+				.Select(a => a.ID));
+			return held.Distinct().ToList();
+		}
+
 		public static async Task<long> Users(CancellationToken token)
 		{
 			var barred = await BarredPersonas(token);

PrivaPub/Domain/Privacy/VisibilityPolicy.cs

@@ -14,16 +14,27 @@ namespace PrivaPub.Domain.Privacy
 {
 	public static class VisibilityPolicy
 	{
-		//neither deleted nor kept back after its remote author deleted their account (owner decision, 2026-10-03)
-		public static readonly Expression<Func<Post, bool>> IsShown = p => !p.DeletedAt.HasValue && !p.AuthorGone;
+		//neither deleted nor kept back after its remote author deleted their account (owner decision, 2026-10-03), nor held
+		//back by the staff: its author suspended, or the post itself taken down (completion program R6)
+		public static readonly Expression<Func<Post, bool>> IsShown = p => !p.DeletedAt.HasValue && !p.AuthorGone && !p.AuthorSuspended && !p.ModeratedAt.HasValue;
 
 		public static readonly Expression<Func<Post, bool>> IsPublic = p =>
-			!p.DeletedAt.HasValue && !p.AuthorGone && (p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted);
+			!p.DeletedAt.HasValue && !p.AuthorGone && !p.AuthorSuspended && !p.ModeratedAt.HasValue
+			&& (p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted);
+
+		// where strangers browse (the public and hashtag timelines and streams, trends, search, the relays): never a post of a
+		// silenced author or server, which its followers still get and anyone may still open (R6)
+		public static readonly Expression<Func<Post, bool>> IsListed = p => !p.AuthorLimited;
 
 		static readonly Func<Post, bool> IsShownCompiled = IsShown.Compile();
 		static readonly Func<Post, bool> IsPublicCompiled = IsPublic.Compile();
 
-		public static bool Shown(Post post) => post != default && IsShownCompiled(post);
+		// a banned login's personas are suspended in Restrictions alone, never on their posts, so a post read one at a time
+		// is asked there too; a query that lists posts leaves theirs to the Mastodon mapper, which shows no account of theirs
+		public static bool Shown(Post post) => post != default && IsShownCompiled(post) && !Barred(post);
+
+		public static bool Barred(Post post) =>
+			!post.IsFederatedCopy && !string.IsNullOrEmpty(post.GroupUserId) && Moderation.Restrictions.IsSuspended(post.GroupUserId);
 
 		public static async Task<bool> CanSee(Post post, string viewerAvatarId, CancellationToken token)
 		{

PrivaPub/Domain/Social/FollowService.cs

@@ -336,7 +336,8 @@ namespace PrivaPub.Domain.Social
 				return default;
 			if (!await _dbEntities.RootToAvatars.Match(ra => ra.RootId == rootUserId && ra.AvatarId == avatarId).ExecuteAnyAsync(token))
 				return default;
-			return await _localActors.FindById(LocalActorKind.Person, avatarId, token);
+			// a suspended persona does nothing through the client API either (R6)
+			return await _localActors.FindById(LocalActorKind.Person, avatarId, token) is { Suspended: false } persona ? persona : default;
 		}
 
 		static ViewFollowing ToView(Following following) => new()

PrivaPub/Domain/Social/Notifications.cs

@@ -47,5 +47,32 @@ namespace PrivaPub.Domain.Social
 			{
 			}
 		}
+
+		// A warning from this server's staff (completion program R6): Mastodon's moderation_warning, from the persona itself as
+		// Mastodon's are (an AccountWarning has no account behind it), never judged by the notification policy, one for each
+		// act. A suspended persona reads it once its suspension is lifted; until then its login sees it suspended in its list
+		// of personas (/clientapi/avatar/private/list).
+		public static async Task Warn(string avatarId, string personaUri, string action, string text, IReadOnlyList<string> postIds, CancellationToken token)
+		{
+			if (string.IsNullOrEmpty(avatarId))
+				return;
+			var ids = postIds?.Where(id => !string.IsNullOrEmpty(id)).Distinct().ToList() ?? new List<string>();
+			var notification = new Notification
+			{
+				AvatarId = avatarId,
+				Type = NotificationType.ModerationWarning,
+				FromAccountId = avatarId,
+				FromActorURI = personaUri,
+				PostId = ids.FirstOrDefault(),
+				StatusIds = ids.Count > 1 ? ids : null,
+				Text = string.IsNullOrWhiteSpace(text) ? default : text.Trim(),
+				WarningAction = action,
+				DedupeKey = $"{NotificationType.ModerationWarning}|{avatarId}|staff|{MongoDB.Bson.ObjectId.GenerateNewId()}"
+			};
+			await DB.Default.SaveAsync(notification, CancellationToken.None);//an act that was done is told even when its request went away
+			var told = new Timelines.Streams.Event("notification", notification.ID);
+			Timelines.Streams.ToPersona(avatarId, new Timelines.Streams.Key(Timelines.Streams.User), told);
+			Timelines.Streams.ToPersona(avatarId, new Timelines.Streams.Key(Timelines.Streams.UserNotification), told);
+		}
 	}
 }

PrivaPub/Domain/Social/Trends.cs

@@ -67,6 +67,7 @@ namespace PrivaPub.Domain.Social
 					.Match(p => p.Visibility == PostVisibility.Public && !p.DeletedAt.HasValue && !p.AuthorGone && !p.HasContentWarning && !p.IsLocalOnly
 						&& p.ReblogOfPostId == null && p.InReplyToURI == null && p.AnsweringToPostId == null && p.CreationDate >= since
 						&& p.FavouritesCount + p.ReblogsCount + p.RepliesCount > 0)
+					.Match(Privacy.VisibilityPolicy.IsPublic).Match(Privacy.VisibilityPolicy.IsListed)
 					.ExecuteAsync(token);
 				var discoverable = await Discoverable(posts.Select(p => p.AuthorAccountId ?? p.GroupUserId), token);
 				return posts.Where(p => discoverable.Contains(p.AuthorAccountId ?? p.GroupUserId))
@@ -80,6 +81,7 @@ namespace PrivaPub.Domain.Social
 			return _dbEntities.Posts
 				.Match(p => p.Visibility == PostVisibility.Public && !p.DeletedAt.HasValue && !p.AuthorGone && !p.HasContentWarning && !p.IsLocalOnly
 					&& p.ReblogOfPostId == null && p.CreationDate >= since)
+				.Match(Privacy.VisibilityPolicy.IsPublic).Match(Privacy.VisibilityPolicy.IsListed)
 				.Match(with)
 				.Project(p => p.Include(x => x.ID).Include(x => x.Tags).Include(x => x.Link).Include(x => x.CreationDate)
 					.Include(x => x.AuthorAccountId).Include(x => x.GroupUserId))
@@ -115,10 +117,12 @@ namespace PrivaPub.Domain.Social
 		static async Task<HashSet<string>> Discoverable(IEnumerable<string> accountIds, CancellationToken token)
 		{
 			var ids = accountIds.Where(id => !string.IsNullOrEmpty(id)).Distinct().ToList();
-			var barred = await Privacy.Counted.BarredPersonas(token);
-			var local = await DB.Default.Find<Avatar>().Match(a => ids.Contains(a.ID) && a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID))
+			var barred = await Privacy.Counted.HeldBackPersonas(token);
+			var local = await DB.Default.Find<Avatar>().Match(a => ids.Contains(a.ID) && a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID)
+					&& !a.SilencedAt.HasValue)
 				.Project(a => a.Include(x => x.ID)).ExecuteAsync(token);
-			var remote = await DB.Default.Find<ForeignAvatar>().Match(f => ids.Contains(f.ID) && f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue)
+			var remote = await DB.Default.Find<ForeignAvatar>().Match(f => ids.Contains(f.ID) && f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue
+					&& !f.SilencedAt.HasValue)
 				.Project(f => f.Include(x => x.ID)).ExecuteAsync(token);
 			return local.Select(a => a.ID).Concat(remote.Select(f => f.ID)).ToHashSet();
 		}

PrivaPub/Domain/Statuses/ScheduledStatuses.cs

@@ -105,6 +105,11 @@ namespace PrivaPub.Domain.Statuses
 			if (scheduled == default || scheduled.ScheduledAt > DateTime.UtcNow.AddSeconds(30))
 				return JobOutcome.Done;//dropped, or moved to a later time that has its own job
 			using var scope = _scopes.CreateScope();
+			// a persona suspended since, or whose login was banned, waits: lifting it publishes what came due meanwhile
+			// (R6), unless that was a month ago
+			if (Moderation.Restrictions.IsSuspended(scheduled.AvatarId) && scheduled.ScheduledAt > DateTime.UtcNow.AddDays(-30)
+				&& await DB.Default.Find<Avatar>().Match(a => a.ID == scheduled.AvatarId && !a.DeletionAt.HasValue).ExecuteAnyAsync(token))
+				return JobOutcome.Defer(DateTime.UtcNow.AddHours(1), "its author is suspended");
 			// a persona deleted or banned since it was scheduled publishes nothing, and what it held is trashed
 			if (!await ScheduledStatuses.MayPublish(scheduled.AvatarId, token))
 			{

PrivaPub/Domain/Statuses/StatusService.cs

@@ -203,6 +203,7 @@ namespace PrivaPub.Domain.Statuses
 			{
 				GroupUserId = author.Id,
 				AuthorAccountId = author.Id,
+				AuthorLimited = author.Silenced,//a silenced persona's posts stay out of the public timelines (R6)
 				GroupId = group?.Id,
 				Visibility = visibility,
 				Title = Clean(draft.Title),
@@ -621,6 +622,7 @@ namespace PrivaPub.Domain.Statuses
 					ID = reblogId,
 					GroupUserId = me.Id,
 					AuthorAccountId = me.Id,
+					AuthorLimited = me.Silenced,
 					ReblogOfPostId = original.ID,
 					Visibility = visibility == PostVisibility.Unlisted ? PostVisibility.Unlisted : PostVisibility.Public,
 					ObjectURI = announceId,

PrivaPub/Domain/Timelines/Fanout.cs

@@ -57,8 +57,9 @@ namespace PrivaPub.Domain.Timelines
 						foreach (var follower in await _dbEntities.Followings.Match(f => f.TargetActorURI == post.WallOwnerURI && f.State == FollowState.Accepted).ExecuteAsync(token))
 							recipients.Add(follower.AvatarId);
 					}
-					// a public post (not a boost, not a reply) comes to those following one of its hashtags, as on Mastodon
-					if (post.Visibility == PostVisibility.Public && post.Tags.Count > 0 && string.IsNullOrEmpty(post.ReblogOfPostId)
+					// a public post (not a boost, not a reply) comes to those following one of its hashtags, as on Mastodon,
+					// but a silenced author's (R6)
+					if (post.Visibility == PostVisibility.Public && post.Tags.Count > 0 && string.IsNullOrEmpty(post.ReblogOfPostId) && !post.AuthorLimited
 						&& string.IsNullOrEmpty(post.InReplyToURI) && string.IsNullOrEmpty(post.AnsweringToPostId))
 					{
 						var tags = post.Tags.ToList();
@@ -126,7 +127,7 @@ namespace PrivaPub.Domain.Timelines
 						Streams.ToPersona(avatarId, new Streams.Key(Streams.List, listId), update);
 				}
 			}
-			if (post.Visibility != PostVisibility.Public || !string.IsNullOrEmpty(post.ReblogOfPostId) || !Privacy.VisibilityPolicy.Shown(post))
+			if (post.Visibility != PostVisibility.Public || !string.IsNullOrEmpty(post.ReblogOfPostId) || !Privacy.VisibilityPolicy.Shown(post) || post.AuthorLimited)
 				return;
 			var local = !post.IsFederatedCopy;
 			if (!post.IsLocalOnly)
@@ -177,7 +178,7 @@ namespace PrivaPub.Domain.Timelines
 			var homes = (await DB.Default.Find<TimelineEntry>().Match(e => e.PostId == post.ID).ExecuteAsync(token)).Select(e => e.AvatarId).Distinct();
 			foreach (var avatarId in homes.Where(Streams.Listening))
 				Streams.ToPersona(avatarId, new Streams.Key(Streams.User), update);
-			if (post.Visibility == PostVisibility.Public && Privacy.VisibilityPolicy.Shown(post))
+			if (post.Visibility == PostVisibility.Public && Privacy.VisibilityPolicy.Shown(post) && !post.AuthorLimited)
 			{
 				if (!post.IsLocalOnly)
 					Streams.ToAll(new Streams.Key(Streams.Public), update);

PrivaPub/Domain/Timelines/Streams.cs

@@ -73,6 +73,13 @@ namespace PrivaPub.Domain.Timelines
 			listener.Queue.Writer.TryComplete();
 		}
 
+		// every connection of a persona ends (its suspension, R6): its queue completes, and the connection closes behind it
+		public static void CloseFor(string avatarId)
+		{
+			foreach (var listener in Listeners.Keys.Where(l => l.AvatarId == avatarId).ToList())
+				Close(listener);
+		}
+
 		public static int Count => Listeners.Count;
 
 		// whether the persona has a connection open, so the work of finding its lists can be skipped when it has none

PrivaPub/Federation/Actors/LocalActorService.cs

@@ -34,6 +34,11 @@ namespace PrivaPub.Federation.Actors
 		public bool PostingRestrictedToModerators { get; init; }
 		public bool IsBot { get; init; }
 		public bool Indexable { get; init; }
+		// the staff's moderation of a persona (completion program R6): suspended (by itself or with its banned login), it
+		// delivers nothing, its posts and collections answer 404 and its tokens are refused, while its actor stays as it was;
+		// silenced, its posts stay out of the public timelines, trends, search and the relays
+		public bool Suspended { get; init; }
+		public bool Silenced { get; init; }
 		public AvatarSettings Settings { get; init; } = new();
 		public DateTime Published { get; init; }
 		public string BaseAddress { get; init; }
@@ -335,6 +340,8 @@ namespace PrivaPub.Federation.Actors
 			IsBot = avatar.Settings?.IsBot == true,
 			Indexable = avatar.Settings?.IsIndexable == true,
 			Settings = avatar.Settings ?? new AvatarSettings(),
+			Suspended = avatar.SuspendedAt.HasValue || Domain.Moderation.Restrictions.IsSuspended(avatar.ID),
+			Silenced = avatar.SilencedAt.HasValue,
 			BaseAddress = BaseAddress
 		};
 

PrivaPub/Federation/Controllers/PeasantsController.cs

@@ -110,6 +110,8 @@ namespace PrivaPub.Federation.Controllers
 			var items = new List<JsonNode>();
 			foreach (var post in latest)
 			{
+				if (VisibilityPolicy.Barred(post))
+					continue;
 				if (local.Kind == LocalActorKind.Group)
 				{
 					items.Add(ActivityPubRenderer.Announce(local, post.ObjectURI, $"announce-{post.ID}", post.CreationDate));
@@ -152,7 +154,8 @@ namespace PrivaPub.Federation.Controllers
 			if (local is not { HasWall: true })
 				return NotFound();
 			var wall = local.Wall;
-			System.Linq.Expressions.Expression<Func<PostEntity, bool>> onWall = p => !p.DeletedAt.HasValue && !p.AuthorGone && !p.IsLocalOnly
+			System.Linq.Expressions.Expression<Func<PostEntity, bool>> onWall = p => !p.DeletedAt.HasValue && !p.AuthorGone && !p.AuthorSuspended
+				&& !p.ModeratedAt.HasValue && !p.IsLocalOnly
 				&& (p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted)
 				&& (p.WallURI == wall
 					|| p.GroupUserId == local.Id && !p.IsFederatedCopy && p.ReblogOfPostId == null && p.AnsweringToPostId == null && p.InReplyToURI == null && p.GroupId == null);
@@ -282,6 +285,7 @@ namespace PrivaPub.Federation.Controllers
 				return NotFound();
 			var replies = await _dbEntities.Posts.Match(p => p.AnsweringToPostId == post.ID && !p.IsLocalOnly && p.ReblogOfPostId == null)
 				.Match(VisibilityPolicy.IsPublic).Sort(p => p.CreationDate, Order.Ascending).Limit(MaxThread).ExecuteAsync(token);
+			replies.RemoveAll(VisibilityPolicy.Barred);
 			return Activity(ActivityPubRenderer.OrderedCollection(local.PostUri(post.ID) + "/replies", replies.Count,
 				replies.Select(r => (JsonNode)r.ObjectURI)));
 		}
@@ -299,7 +303,7 @@ namespace PrivaPub.Federation.Controllers
 			{
 				var next = await _dbEntities.Posts.Match(p => level.Contains(p.AnsweringToPostId) && !p.IsLocalOnly && p.ReblogOfPostId == null)
 					.Match(VisibilityPolicy.IsPublic).Sort(p => p.CreationDate, Order.Ascending).Limit(MaxThread - thread.Count).ExecuteAsync(token);
-				thread.AddRange(next);
+				thread.AddRange(next.Where(p => !VisibilityPolicy.Barred(p)));
 				level = next.Select(p => p.ID).ToList();
 			}
 			var collection = ActivityPubRenderer.OrderedCollection(root.ContextURI, thread.Count, thread.Select(p => (JsonNode)p.ObjectURI));
@@ -541,6 +545,15 @@ namespace PrivaPub.Federation.Controllers
 				context.Result = StatusCode(StatusCodes.Status401Unauthorized);
 				return;
 			}
+			// a suspended persona (by itself or with its banned login) answers 404 for everything but its actor and its inbox:
+			// nothing new is told of it, and lifting the suspension serves it all again (owner decision 2026-10-17)
+			if (HttpMethods.IsGet(Request.Method) && context.RouteData.Values["actor"] is string name
+				&& context.ActionDescriptor is Microsoft.AspNetCore.Mvc.Controllers.ControllerActionDescriptor { ActionName: not nameof(GetActor) }
+				&& await _localActors.FindByUserName(name, HttpContext.RequestAborted) is { Kind: LocalActorKind.Person, Suspended: true })
+			{
+				context.Result = NotFound();
+				return;
+			}
 			await next();
 		}
 

PrivaPub/Federation/Inbox/Handlers/AnnounceHandler.cs

@@ -39,10 +39,13 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		public IEnumerable<IActivityHandler> Relays { get; set; }
 
 		readonly PrivaPub.Federation.Relays.IRelays _relayService;
+		readonly PrivaPub.Federation.Moderation.IDomainBlocks _domainBlocks;
 
 		public AnnounceHandler(DbEntities dbEntities, ILocalActorService localActors, IRemotePosts remotePosts, IFanout fanout, IRemoteActorService remoteActors,
-			IObjectRecords records, IQuoteService quotes, IServiceProvider services = default, PrivaPub.Federation.Relays.IRelays relays = default)
+			IObjectRecords records, IQuoteService quotes, IServiceProvider services = default, PrivaPub.Federation.Relays.IRelays relays = default,
+			PrivaPub.Federation.Moderation.IDomainBlocks domainBlocks = default)
 		{
+			_domainBlocks = domainBlocks;
 			_relayService = relays;
 			_services = services;
 			_records = records;
@@ -121,6 +124,8 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				To = to,
 				Cc = cc,
 				IsFederatedCopy = true,
+				AuthorSuspended = actor.SuspendedAt.HasValue,
+				AuthorLimited = RemotePosts.Limited(actor, _domainBlocks),
 				CreationDate = published,
 				UpdateDate = published
 			};

PrivaPub/Federation/Inbox/Handlers/FollowHandler.cs

@@ -49,6 +49,13 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				Arrival.Drop("unknown-recipient");
 				return;
 			}
+			// a suspended persona answers nothing, so it takes no follower it could not answer (R6): the request stays
+			// pending on the follower's side, as it would for any persona that has not answered yet
+			if (target is { Kind: LocalActorKind.Person, Suspended: true })
+			{
+				Arrival.Drop("recipient-suspended");
+				return;
+			}
 			if (target.Kind == LocalActorKind.Person
 				&& await DB.Default.Find<Models.Social.Block>().Match(b => b.AvatarId == target.Id && b.TargetActorURI == follower.ActorURI).ExecuteAnyAsync(token))
 			{

PrivaPub/Federation/Inbox/InboxProcessor.cs

@@ -65,6 +65,13 @@ namespace PrivaPub.Federation.Inbox
 				Record(job, payload, activity, type, started, new ArrivalVerdict(), Interactions.Deferred, "actor-unavailable");
 				return JobOutcome.Retry("the actor could not be loaded");
 			}
+			// an account the staff suspended (R6): what it sends is dropped, but a Delete or an Undo of what it sent, which only
+			// take away what we hold (a post, a follow, a like)
+			if (actor.SuspendedAt.HasValue && type is not ("Delete" or "Undo"))
+			{
+				Record(job, payload, activity, type, started, new ArrivalVerdict(), Interactions.Dropped, "account-suspended");
+				return JobOutcome.Done;
+			}
 			if (payload.ForwardedBy != default && Forwarded.NamesUnknownKey(activity, actor))
 				actor = await _remoteActors.GetActor(actor.ActorURI, refresh: true, token) ?? actor;
 			if (payload.ForwardedBy != default && !Forwarded.Proven(activity, actor))

PrivaPub/Federation/Inbox/RemotePosts.cs

@@ -133,6 +133,9 @@ namespace PrivaPub.Federation.Inbox
 				InReplyToAccountId = parent?.AuthorAccountId ?? parent?.GroupUserId,
 				IsFederatedCopy = true,
 				AuthorGone = author.AccountState == AvatarAccountState.Deleted,
+				// the staff's moderation of its author or its server (R6), as AccountModeration sets it on what came before
+				AuthorSuspended = author.SuspendedAt.HasValue,
+				AuthorLimited = Limited(author, _domainBlocks),
 				CreationDate = note.Published,
 				UpdateDate = note.Updated ?? note.Published,
 				EditedAt = note.Updated,
@@ -143,6 +146,11 @@ namespace PrivaPub.Federation.Inbox
 			return post;
 		}
 
+		// an account elsewhere is limited when the staff silenced it or its server
+		public static bool Limited(ForeignAvatar author, IDomainBlocks domainBlocks) =>
+			author.SilencedAt.HasValue || Uri.TryCreate(author.ActorURI, UriKind.Absolute, out var uri)
+			&& domainBlocks?.Find(uri.Host)?.Severity == DomainBlockSeverity.Silence;
+
 		// a post's flairs, filled in from its community's list
 		public static async Task<List<PostFlair>> Flairs(NoteDocument note, string communityUri, CancellationToken token)
 		{

PrivaPub/Federation/Outbox/DeliveryService.cs

@@ -43,12 +43,24 @@ namespace PrivaPub.Federation.Outbox
 			_queue = queue;
 		}
 
+		// what the staff's moderation holds back (completion program R6): a suspended persona (by itself or with its banned
+		// login) delivers nothing, but the Delete of itself, which its deletion sends; and nothing goes to the own inbox of an
+		// account elsewhere the staff suspended (its server's shared inbox still serves the others there)
+		public static bool HeldBack(LocalActor signer, JsonNode activity) =>
+			signer is { Kind: LocalActorKind.Person, Suspended: true } && !DeletesItself(signer, activity);
+
+		static bool DeletesItself(LocalActor signer, JsonNode activity) =>
+			ActivityJson.Value(activity, "type") == "Delete" && ActivityJson.Id(activity?["object"]) == signer.Uri;
+
 		public async Task Enqueue(LocalActor signer, IEnumerable<string> inboxes, JsonObject activity, CancellationToken token, string again = default)
 		{
+			if (HeldBack(signer, activity))
+				return;
 			var body = activity.ToJsonString();
 			var activityId = activity["id"] is JsonValue id && id.TryGetValue<string>(out var text) ? text : default;
 			var targets = inboxes
-				.Where(i => !string.IsNullOrEmpty(i) && !i.StartsWith(signer.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+				.Where(i => !string.IsNullOrEmpty(i) && !i.StartsWith(signer.BaseAddress + "/", StringComparison.OrdinalIgnoreCase)
+					&& !Domain.Moderation.Restrictions.IsSuspendedInbox(i))
 				.Distinct(StringComparer.Ordinal)
 				.ToList();
 			// what goes to a relay carries the signer's proof (FEP-8b32): the relay passes it on as it came, signed with its own
@@ -223,6 +235,17 @@ namespace PrivaPub.Federation.Outbox
 				attempt.Reason = "signer-gone";
 				return JobOutcome.Dead("the signing actor no longer exists");
 			}
+			// suspended since it was queued, or the account it goes to (R6): never sent
+			if (signer.Suspended && DeliveryService.HeldBack(signer, JsonNode.Parse(payload.Body)))
+			{
+				attempt.Reason = "signer-suspended";
+				return JobOutcome.Dead("the signing persona is suspended");
+			}
+			if (Domain.Moderation.Restrictions.IsSuspendedInbox(payload.Inbox))
+			{
+				attempt.Reason = "inbox-suspended";
+				return JobOutcome.Dead("the inbox's account is suspended");
+			}
 
 			var body = Encoding.UTF8.GetBytes(payload.Body);
 			using var request = new HttpRequestMessage(HttpMethod.Post, inbox) { Content = new ByteArrayContent(body) };

PrivaPub/Federation/Outbox/OutboxPublisher.cs

@@ -52,9 +52,11 @@ namespace PrivaPub.Federation.Outbox
 			//nothing is addressed to an account that blocked the author (it would refuse it, and Mastodon counts on that)
 			var blockers = (await DB.Default.Find<BlockedBy>().Match(b => b.AvatarId == author.Id).ExecuteAsync(token))
 				.Select(b => b.ActorURI).ToHashSet(StringComparer.Ordinal);
+			//nor to an account elsewhere the staff suspended (R6), through its server's shared inbox either
 			var addressed = post.Mentions.Where(m => !m.IsLocal).Select(m => m.ActorURI)
 				.Concat(post.Visibility == PostVisibility.Direct ? post.To.Concat(post.Cc) : Enumerable.Empty<string>())
-				.Where(uri => !uri.StartsWith(author.BaseAddress + "/", StringComparison.OrdinalIgnoreCase) && !blockers.Contains(uri))
+				.Where(uri => !uri.StartsWith(author.BaseAddress + "/", StringComparison.OrdinalIgnoreCase) && !blockers.Contains(uri)
+					&& !Domain.Moderation.Restrictions.IsSuspendedActor(uri))
 				.Distinct(StringComparer.Ordinal)
 				.ToList();
 			foreach (var uri in addressed)
@@ -67,7 +69,7 @@ namespace PrivaPub.Federation.Outbox
 			if (post.Visibility != PostVisibility.Direct && !string.IsNullOrEmpty(post.InReplyToAccountId))
 			{
 				var parentAuthor = await _dbEntities.ForeignAvatars.MatchID(post.InReplyToAccountId).ExecuteFirstAsync(token);
-				if (Preferred(parentAuthor) is { } inbox && !blockers.Contains(parentAuthor.ActorURI))
+				if (Preferred(parentAuthor) is { } inbox && !blockers.Contains(parentAuthor.ActorURI) && !parentAuthor.SuspendedAt.HasValue)
 					inboxes.Add(inbox);
 			}
 
@@ -77,14 +79,15 @@ namespace PrivaPub.Federation.Outbox
 				var quotedAuthor = quoted is { IsFederatedCopy: true }
 					? await _dbEntities.ForeignAvatars.Match(a => a.ActorURI == quoted.ActorURI).ExecuteFirstAsync(token)
 					: default;
-				if (Preferred(quotedAuthor) is { } inbox)
+				if (Preferred(quotedAuthor) is { } inbox && !quotedAuthor.SuspendedAt.HasValue)
 					inboxes.Add(inbox);
 			}
 
 			// a persona's own public post, outside any group, also goes to the relays we subscribe to (owner decision
-			// 2026-10-06), its edits and deletion with it
+			// 2026-10-06), its edits and deletion with it; a silenced persona's never does (R6): the relays are where strangers
+			// read
 			if (_relays != default && post.Visibility == PostVisibility.Public && author.Kind == LocalActorKind.Person
-				&& string.IsNullOrEmpty(post.ReblogOfPostId) && string.IsNullOrEmpty(post.GroupId))
+				&& string.IsNullOrEmpty(post.ReblogOfPostId) && string.IsNullOrEmpty(post.GroupId) && !post.AuthorLimited && !author.Silenced)
 				inboxes.AddRange(await _relays.Inboxes(token));
 
 			return inboxes.Where(i => !string.IsNullOrEmpty(i)).Distinct(StringComparer.Ordinal).ToList();

PrivaPub/Infrastructure/Backup/ProtectiveMerge.cs

@@ -10,7 +10,8 @@ namespace PrivaPub.Infrastructure.Backup
 	// - blocks, mutes, domain blocks (the server's and the personas'), being blocked, reserved names, deletion tombstones,
 	//   reports, filters and OAuth applications are the union of both, P's row winning;
 	// - deletions win: a root, persona, group, post or remote account deleted since is deleted again (P's row, as its
-	//   deletion left it), with what a deletion takes away; P's moderation of a persona (silenced, suspended, banned) stays;
+	//   deletion left it), with what a deletion takes away; P's moderation of a persona or of an account elsewhere (silenced,
+//   suspended) stays, as do the posts the staff took down, and every post's moderation flags are worked out again;
 	// - a root keeps P's password, e-mail, ban and policies;
 	// - roots, personas and groups made since become tombstones: deleted, their names kept; local posts made since answer
 	//   410; media made since go to the trash, as do media trashed since (and they leave the posts restored with them),
@@ -103,9 +104,12 @@ namespace PrivaPub.Infrastructure.Backup
 						await database.GetCollection<BsonDocument>(collection).DeleteManyAsync(new BsonDocument("AvatarId", avatar["_id"].ToString()), token);
 					continue;
 				}
-				var moderated = new[] { "SilencedAt", "SuspendedAt", "BannedAt" }.Where(field => IsSet(avatar, field)).ToArray();
+				var moderated = new[] { "SilencedAt", "SuspendedAt", "BannedAt", "ModerationNote" }.Where(field => IsSet(avatar, field)).ToArray();
 				if (moderated.Length > 0)
+				{
 					await avatars.UpdateOneAsync(Id(avatar["_id"]), Copy(avatar, moderated), cancellationToken: token);
+					report.ProtectiveKept++;
+				}
 			}
 
 			var links = database.GetCollection<BsonDocument>("RootToAvatar");
@@ -131,13 +135,27 @@ namespace PrivaPub.Infrastructure.Backup
 				await groups.ReplaceOneAsync(Id(group["_id"]), group, cancellationToken: token);
 			}
 
-			// remote accounts deleted or gone since: as P has them
+			// remote accounts deleted or gone since: as P has them; the staff's silence or suspension of one stays (R6)
 			var foreign = database.GetCollection<BsonDocument>("ForeignAvatar");
-			foreach (var account in P("ForeignAvatar").Where(a => IsSet(a, "DeletionAt") || IsSet(a, "ForgottenAt")))
-				await foreign.ReplaceOneAsync(Id(account["_id"]), account, cancellationToken: token);
+			foreach (var account in P("ForeignAvatar"))
+			{
+				if (IsSet(account, "DeletionAt") || IsSet(account, "ForgottenAt"))
+				{
+					await foreign.ReplaceOneAsync(Id(account["_id"]), account, cancellationToken: token);
+					continue;
+				}
+				var moderated = new[] { "SilencedAt", "SuspendedAt", "ModerationNote" }.Where(field => IsSet(account, field)).ToArray();
+				if (moderated.Length > 0 && (await foreign.UpdateOneAsync(Id(account["_id"]), Copy(account, moderated), cancellationToken: token)).MatchedCount > 0)
+					report.ProtectiveKept++;
+			}
 
 			await Posts(database, P("Post"), report, token);
 			await Media(database, P("MediaAttachment"), report, token);
+			// what the staff took down stays down, and every post's flags follow the moderation now kept (R6)
+			foreach (var post in P("Post").Where(p => IsSet(p, "ModeratedAt")))
+				await database.GetCollection<BsonDocument>("Post").UpdateOneAsync(
+					new BsonDocument { { "_id", post["_id"] }, { "ModeratedAt", BsonNull.Value } }, Copy(post, "ModeratedAt"), cancellationToken: token);
+			await Domain.Moderation.ModerationFlags.Recompute(database, token);
 
 			// every session ends: a new stamp for each root's tokens, and the personas' OAuth tokens go
 			foreach (var root in await (await roots.FindAsync(FilterDefinition<BsonDocument>.Empty, cancellationToken: token)).ToListAsync(token))

PrivaPub/Infrastructure/Cli/AdminCommands.cs

@@ -19,6 +19,7 @@ namespace PrivaPub.Infrastructure.Cli
 	{
 		const string Usage = """
 			usage: PrivaPub admin promote|demote <root>
+			       PrivaPub admin role <root> <user|moderator|admin>   a login's role; promote and demote are role admin and user
 			       PrivaPub admin create-root <login> [--admin]   the password is read from standard input
 			       PrivaPub admin move-persona <persona> <root>   gives a persona to another login; its Mastodon tokens end
 			       PrivaPub admin delete-root <root>              deletes a login and every persona it still has
@@ -47,7 +48,9 @@ namespace PrivaPub.Infrastructure.Cli
 			switch (args)
 			{
 				case [("promote" or "demote") and var verb, var userName]:
-					return await Promote(services, verb == "promote", userName, output);
+					return await Role(services, userName, verb == "promote" ? RootRole.Admin : RootRole.User, output);
+				case ["role", var userName, var role] when RootUser.TryParseRole(role, out var parsed):
+					return await Role(services, userName, parsed, output);
 				case ["create-root", var login, .. var flags] when flags.All(f => f == "--admin"):
 					return await CreateRoot(services, login, input.ReadLine(), flags.Contains("--admin"), output);
 				case ["move-persona", var persona, var root]:
@@ -194,27 +197,37 @@ namespace PrivaPub.Infrastructure.Cli
 		static Task Log(IServiceProvider services, string action, string kind, string id, string label, string note = default) =>
 			services.GetRequiredService<IModerationLog>().Write(AdminAction.Cli, action, kind, id, label, note: note);
 
-		static async Task<int> Promote(IServiceProvider services, bool promote, string userName, TextWriter output, bool created = false)
+		// The command line is the way back, so it may leave the server without an administrator (the client's route refuses
+		// to); it says so, and `role <root> admin` gives one back.
+		static async Task<int> Role(IServiceProvider services, string userName, RootRole role, TextWriter output, bool created = false)
 		{
 			userName = userName.ToLowerInvariant();
-			var user = await DB.Default.Find<RootUser>().Match(u => u.UserName == userName).ExecuteFirstAsync();
+			var user = await DB.Default.Find<RootUser>().Match(u => u.UserName == userName && u.DeletedAt == null).ExecuteFirstAsync();
 			if (user == default)
 			{
 				Console.Error.WriteLine($"no root user '{userName}'");
 				return 1;
 			}
 
-			user.SetAdmin(promote);
-			await DB.Default.SaveAsync(user);
-			if (promote)
+			var was = user.Role;
+			user.SetRole(role);
+			await DB.Default.Update<RootUser>().MatchID(user.ID).Modify(u => u.Policies, user.Policies).Modify(u => u.UpdatedAt, user.UpdatedAt).ExecuteAsync();
+			if (role == RootRole.Admin)
 				await ServerSetup.Seal(user.ID, default);//an administrator exists: the client's setup is closed
-			if (!created)
-				await Log(services, promote ? AdminActions.RootPromote : AdminActions.RootDemote, AdminTargets.Root, user.ID, userName);
+			if (!created && was != role)
+				await Log(services, role == RootRole.Admin && was == RootRole.User ? AdminActions.RootPromote
+					: role == RootRole.User && was == RootRole.Admin ? AdminActions.RootDemote
+					: AdminActions.RootRole, AdminTargets.Root, user.ID, userName, $"{Name(was)} → {Name(role)}");
 
 			output.WriteLine($"{userName}: {string.Join(", ", user.Policies)}");
+			if (was == RootRole.Admin && role != RootRole.Admin
+				&& !await DB.Default.Find<RootUser>().Match(u => u.DeletedAt == null && !u.IsBanned && u.Policies.Contains(Policies.IsAdmin)).ExecuteAnyAsync())
+				Console.Error.WriteLine("no administrator is left: `PrivaPub admin role <root> admin` makes one");
 			return 0;
 		}
 
+		static string Name(RootRole role) => role switch { RootRole.Admin => "admin", RootRole.Moderator => "moderator", _ => "user" };
+
 		// With sign-up closed, this or the client's setup (while no administrator exists) makes the first root; group invitations
 		// make the rest.
 		static async Task<int> CreateRoot(IServiceProvider services, string login, string password, bool admin, TextWriter output)
@@ -234,7 +247,7 @@ namespace PrivaPub.Infrastructure.Cli
 			}
 			var made = await DB.Default.Find<RootUser>().Match(u => u.UserName == login.ToLowerInvariant()).ExecuteFirstAsync();
 			await Log(services, AdminActions.RootCreate, AdminTargets.Root, made?.ID, login.ToLowerInvariant(), admin ? "administrator" : default);
-			return admin ? await Promote(services, true, login, output, created: true) : await Report(login, output);
+			return admin ? await Role(services, login, RootRole.Admin, output, created: true) : await Report(login, output);
 		}
 
 		static Task<int> Report(string login, TextWriter output)

PrivaPub/Infrastructure/Data/Indexes.cs

@@ -62,6 +62,14 @@ namespace PrivaPub.Infrastructure.Data
 
 			await Unique<ForeignAvatar>(a => a.ActorURI, Builders<ForeignAvatar>.Filter.Gt(a => a.ActorURI, ""), token);
 			await Plain<ForeignAvatar>(token, a => a.PublicKeyId);
+			// the staff's moderation (R6): the moderated accounts, here and elsewhere, and the posts taken down
+			await Plain<ForeignAvatar>(token, a => a.SuspendedAt);
+			await Plain<ForeignAvatar>(token, a => a.SilencedAt);
+			await Plain<Avatar>(token, a => a.SuspendedAt);
+			await Plain<Avatar>(token, a => a.SilencedAt);
+			await DB.Default.Index<Post>().Key(p => p.ModeratedAt, KeyType.Ascending)
+				.Option(o => o.PartialFilterExpression = Builders<Post>.Filter.Type(p => p.ModeratedAt, MongoDB.Bson.BsonType.DateTime))
+				.CreateAsync(token);
 
 			await DB.Default.Index<Follower>()
 				.Key(f => f.LocalActorId, KeyType.Ascending)

PrivaPub/Infrastructure/Data/Migrations/_020_silenced_servers_limit_their_posts.cs

@@ -0,0 +1,13 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Infrastructure.Data.Migrations
+{
+	// Posts carry their author's moderation since completion program R6 (Post.AuthorLimited, AuthorSuspended): the posts
+	// already held from servers silenced before then are limited, as those arriving from now on are, and any account
+	// already silenced or suspended gets the same (Domain/Moderation/ModerationFlags.cs, which a restore runs too)
+	public class _020_silenced_servers_limit_their_posts : IMigration
+	{
+		public async Task UpgradeAsync() =>
+			await Domain.Moderation.ModerationFlags.Recompute(DB.Default.Database(), CancellationToken.None);
+	}
+}

PrivaPub/Middleware/SocialPubConfigurations.cs

@@ -230,6 +230,9 @@ namespace PrivaPub.Middleware
 				.AddTransient<IStatusService, StatusService>()
 				.AddTransient<IRelationshipService, RelationshipService>()
 				.AddTransient<IReportService, ReportService>()
+				.AddTransient<Domain.Moderation.IAccountModeration, Domain.Moderation.AccountModeration>()
+				.AddScoped<IPersonaRemoval, PersonaRemoval>()
+				.AddScoped<IGroupRemoval, GroupRemoval>()
 				.AddTransient<IFollowService, FollowService>()
 				.AddTransient<IFeedFollows, FeedFollows>()
 				.AddTransient<ITimelineService, TimelineService>()

PrivaPub/Models/AdminAction.cs

@@ -45,6 +45,21 @@ namespace PrivaPub.Models
 		public const string RootDelete = "root.delete";
 		public const string RootResetTotp = "root.reset_totp";
 		public const string PersonaMove = "persona.move";
+		// moderation (completion program R6)
+		public const string RootRole = "root.role";
+		public const string RootBan = "root.ban";
+		public const string RootUnban = "root.unban";
+		public const string PersonaSilence = "persona.silence";
+		public const string PersonaUnsilence = "persona.unsilence";
+		public const string PersonaSuspend = "persona.suspend";
+		public const string PersonaUnsuspend = "persona.unsuspend";
+		public const string PersonaDelete = "persona.delete";
+		public const string AccountSilence = "account.silence";
+		public const string AccountUnsilence = "account.unsilence";
+		public const string AccountSuspend = "account.suspend";
+		public const string AccountUnsuspend = "account.unsuspend";
+		public const string GroupDelete = "group.delete";
+		public const string PostRemove = "post.remove";
 	}
 
 	public static class AdminTargets
@@ -60,5 +75,7 @@ namespace PrivaPub.Models
 		public const string Emoji = "emoji";
 		public const string Relay = "relay";
 		public const string Backup = "backup";
+		public const string Group = "group";
+		public const string Post = "post";
 	}
 }

PrivaPub/Models/Post/Post.cs

@@ -59,6 +59,14 @@ namespace PrivaPub.Models.Post
 		public bool HasContentWarning { get; set; } = false;
 		public bool IsLocalOnly { get; set; }
 		public bool AuthorGone { get; set; }//its remote author deleted their account: kept, but hidden everywhere (VisibilityPolicy)
+		// the staff's moderation (completion program R6, Domain/Moderation/AccountModeration.cs), copied from the author so a
+		// query needs no join: suspended, it is hidden everywhere as AuthorGone is (until the suspension is lifted); limited
+		// (the author or its server silenced), it stays out of the public and hashtag timelines, trends, search and the
+		// relays, and its followers still get it. A banned login's personas are never flagged (that would pair them):
+		// Restrictions treats them as suspended when posts are read.
+		public bool AuthorSuspended { get; set; }
+		public bool AuthorLimited { get; set; }
+		public DateTime? ModeratedAt { get; set; }//a remote copy the staff took down: kept, hidden everywhere, never fetched again
 
 		public bool IsFederatedCopy { get; set; }
 		public string ObjectURI { get; set; }//the Note's id

PrivaPub/Models/Social/Notification.cs

@@ -13,6 +13,10 @@ namespace PrivaPub.Models.Social
 		public string Emoji { get; set; }//a reaction's emoji
 		public string EmojiURL { get; set; }
 		public string Text { get; set; }//a moderation warning's reason
+		[MongoDB.Bson.Serialization.Attributes.BsonIgnoreIfNull]
+		public string WarningAction { get; set; }//a warning from this server's staff: Mastodon's AccountWarning action (silence, suspend, delete_statuses)
+		[MongoDB.Bson.Serialization.Attributes.BsonIgnoreIfNull]
+		public List<string> StatusIds { get; set; }//the posts a warning is about, when more than PostId
 		public bool IsRead { get; set; }
 		public bool Filtered { get; set; }//held back by the persona's notification policy, in a NotificationRequest
 		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;

PrivaPub/Models/Social/Relationships.cs

@@ -77,6 +77,8 @@ namespace PrivaPub.Models.Social
 		public bool Forwarded { get; set; }
 		public bool IsResolved { get; set; }
 		public string ResolvedBy { get; set; }
+		public string Resolution { get; set; }//what the staff did when resolving it (R6): none, silence, suspend, remove_posts
+		public string ResolutionNote { get; set; }
 		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime? ResolvedAt { get; set; }
 		public DateTime? RemoteResolvedAt { get; set; }//the server holding the reported content says it dealt with it (Lemmy's Resolve{Flag})

PrivaPub/Models/User/RootUser.cs

@@ -25,15 +25,45 @@ namespace PrivaPub.Models.User
 		public RootTotp Totp { get; set; }//two-factor sign-in, when the login set it up (Services/TwoFactor.cs)
 
 		/// <summary>An administrator is a moderator too (IsAdminPolicy asks for both); otherwise a plain user.</summary>
-		public void SetAdmin(bool admin)
+		public void SetAdmin(bool admin) => SetRole(admin ? RootRole.Admin : RootRole.User);
+
+		/// <summary>The login's role, as its policies say it: every login is a user, a moderator is one too, and an
+		/// administrator is all three.</summary>
+		public void SetRole(RootRole role)
 		{
 			Policies.RemoveAll(p => p is ClientModels.Policies.IsAdmin or ClientModels.Policies.IsModerator);
-			if (admin)
-				Policies.AddRange([ClientModels.Policies.IsAdmin, ClientModels.Policies.IsModerator]);
+			if (role is RootRole.Moderator or RootRole.Admin)
+				Policies.Add(ClientModels.Policies.IsModerator);
+			if (role == RootRole.Admin)
+				Policies.Add(ClientModels.Policies.IsAdmin);
 			if (!Policies.Contains(ClientModels.Policies.IsUser))
 				Policies.Add(ClientModels.Policies.IsUser);
 			UpdatedAt = DateTime.UtcNow;
 		}
+
+		public RootRole Role => Policies.Contains(ClientModels.Policies.IsAdmin) ? RootRole.Admin
+			: Policies.Contains(ClientModels.Policies.IsModerator) ? RootRole.Moderator
+			: RootRole.User;
+
+		public static bool TryParseRole(string value, out RootRole role)
+		{
+			role = value?.Trim().ToLowerInvariant() switch
+			{
+				"user" => RootRole.User,
+				"moderator" => RootRole.Moderator,
+				"admin" or "administrator" => RootRole.Admin,
+				_ => (RootRole)(-1)
+			};
+			return Enum.IsDefined(role);
+		}
+	}
+
+	// never stored: a login's role lives in its Policies
+	public enum RootRole
+	{
+		User,
+		Moderator,
+		Admin
 	}
 
 	// TOTP (RFC 6238: 30 s, 6 digits, SHA-1, as every authenticator app reads it). PendingSecret waits for its first code;

PrivaPub/Program.cs

@@ -231,6 +231,7 @@ try
 		var dbClient = app.Services.GetService(typeof(DbEntities)) as DbEntities;
 		await dbClient.Init();
 		await app.Services.GetRequiredService<PrivaPub.Federation.Moderation.IDomainBlocks>().Reload(CancellationToken.None);
+		await PrivaPub.Domain.Moderation.Restrictions.Reload(CancellationToken.None);//who the staff's moderation holds back (R6)
 		await PrivaPub.Api.Mastodon.Auth.PersonaExchange.EnsureFirstPartyClient(app.Services, CancellationToken.None);
 	}
 	catch (Exception ex)

PrivaPub/Services/ClientToServer/Private/IPrivateAvatarUsersService.cs

@@ -111,6 +111,9 @@ namespace PrivaPub.Services.ClientToServer.Private
 				var avatar = await _dbEntities.Avatars.MatchID(form.AvatarId).ExecuteFirstAsync();
 				if (avatar == default || avatar.DeletionAt.HasValue)
 					return result.Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound);
+				// a suspended persona's actor stays as it was until the suspension is lifted (R6)
+				if (avatar.SuspendedAt.HasValue)
+					return result.Invalidate(_localizer["This persona is suspended."], StatusCodes.Status403Forbidden);
 
 				avatar.Name = form.Name;
 				avatar.Biography = form.Biography;

PrivaPub/Services/GroupUsersService.cs

@@ -476,8 +476,9 @@ namespace PrivaPub.Services
 			return role is GroupRole.Owner or GroupRole.Moderator ? group : default;
 		}
 
+		// a suspended persona does nothing in its groups (R6)
 		async Task<bool> OwnsAvatar(string rootUserId, string avatarId, CancellationToken token) =>
-			!string.IsNullOrEmpty(rootUserId) && !string.IsNullOrEmpty(avatarId)
+			!string.IsNullOrEmpty(rootUserId) && !string.IsNullOrEmpty(avatarId) && !Domain.Moderation.Restrictions.IsSuspended(avatarId)
 			&& await _dbEntities.RootToAvatars.Match(ra => ra.RootId == rootUserId && ra.AvatarId == avatarId).ExecuteAnyAsync(token);
 
 		static PostingPolicy? Policy(string value) => value?.ToLowerInvariant() switch

PrivaPub/Services/IRootUsersService.cs

@@ -18,6 +18,9 @@ namespace PrivaPub.Services
 		Task<WebResult> RemoveUserAsync(UsersIds usersIds);
 		Task<WebResult> RemoveSelfAsync(string rootId, string password);
 
+		/// <summary>Whether a login's password is this one, after the same hashing whatever the answer.</summary>
+		Task<bool> PasswordMatches(string rootId, string password);
+
 		Task<WebResult> UpdateUserPasswordAsync(UserPasswordForm userPasswordForm, string userId);
 
 		Task<WebResult> GetUserSettingsAsync(string userId, LoginForm loginForm = default);

PrivaPub/Services/PersonaRemoval.cs

@@ -0,0 +1,173 @@
+using MongoDB.Entities;
+
+using OpenIddict.Abstractions;
+
+using PrivaPub.Domain.Media;
+using PrivaPub.Domain.Timelines;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Services
+{
+	public interface IPersonaRemoval
+	{
+		/// <summary>Deletes one persona, and every group it owns: false when there is no such persona, or it is gone.</summary>
+		Task<bool> Remove(string avatarId, CancellationToken token);
+	}
+
+	public interface IGroupRemoval
+	{
+		/// <summary>Deletes one group: false when there is no such group, or it is gone.</summary>
+		Task<bool> Remove(string groupId, CancellationToken token);
+	}
+
+	// What deleting an actor tells: Delete{Actor} to its followers' (shared) inboxes, and to the inboxes of the other accounts
+	// named (those a persona follows, a group's members elsewhere). A suspended persona sends it too: it is the one thing a
+	// suspension lets through (DeliveryService.HeldBack).
+	public static class ActorDeletion
+	{
+		public static async Task Announce(LocalActor actor, IEnumerable<string> others, DbEntities dbEntities, IDeliveryService delivery, CancellationToken token)
+		{
+			var inboxes = (await delivery.FollowerInboxes(actor, token)).ToList();
+			var named = others.Where(uri => !string.IsNullOrEmpty(uri)).Distinct().ToList();
+			if (named.Count > 0)
+				inboxes.AddRange((await dbEntities.ForeignAvatars.Match(a => named.Contains(a.ActorURI)).ExecuteAsync(token))
+					.Select(a => string.IsNullOrEmpty(a.SharedInboxURL) ? a.InboxURL : a.SharedInboxURL));
+			await delivery.Enqueue(actor, inboxes.Where(i => !string.IsNullOrEmpty(i)).Distinct(), new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.Context(),
+				["id"] = actor.ActivityUri("delete-actor"),
+				["type"] = "Delete",
+				["actor"] = actor.Uri,
+				["object"] = actor.Uri,
+				["to"] = new JsonArray(ActivityPubRenderer.Public),
+				["cc"] = new JsonArray(actor.Followers)
+			}, token);
+		}
+	}
+
+	// Deleting a persona (completion program R6: by its own login with its password, by an administrator with theirs, and
+	// for each persona of a deleted login through RootRemoval) deletes everything public it had, as a deleted login's
+	// personas always were: its Mastodon tokens end first, each group it owns goes (GroupRemoval), a Delete of the actor goes
+	// to its followers and to the accounts it follows, its posts are emptied, and its name stays reserved while its documents
+	// answer 410. What it kept for itself (lists, filters, followed hashtags, scheduled posts, what it did with the
+	// announcements, the feeds it read, its media) goes with it. Its link to its login stays, so the login keeps no other
+	// trace than that.
+	public class PersonaRemoval : IPersonaRemoval
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IDeliveryService _delivery;
+		readonly IMediaService _media;
+		readonly IGroupRemoval _groups;
+		readonly IOpenIddictTokenManager _tokens;
+		readonly IOpenIddictAuthorizationManager _authorizations;
+
+		public PersonaRemoval(DbEntities dbEntities, ILocalActorService localActors, IDeliveryService delivery, IMediaService media, IGroupRemoval groups,
+			IOpenIddictTokenManager tokens, IOpenIddictAuthorizationManager authorizations)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_delivery = delivery;
+			_media = media;
+			_groups = groups;
+			_tokens = tokens;
+			_authorizations = authorizations;
+		}
+
+		public async Task<bool> Remove(string avatarId, CancellationToken token)
+		{
+			var avatar = string.IsNullOrEmpty(avatarId) ? default : await _dbEntities.Avatars.MatchID(avatarId).Match(a => !a.DeletionAt.HasValue).ExecuteFirstAsync(token);
+			if (avatar == default)
+				return false;
+			var now = DateTime.UtcNow;
+			// nothing acts as it while it goes
+			await _tokens.RevokeBySubjectAsync(avatar.ID, token);
+			await _authorizations.RevokeBySubjectAsync(avatar.ID, token);
+			Streams.CloseFor(avatar.ID);
+
+			foreach (var group in await _dbEntities.Groups.Match(g => g.OwnerAvatarId == avatar.ID && !g.DeletionAt.HasValue).ExecuteAsync(token))
+				await _groups.Remove(group.ID, token);
+			var persona = _localActors.FromAvatar(avatar);
+			var followed = (await _dbEntities.Followings.Match(f => f.AvatarId == avatar.ID && !f.TargetIsLocal).ExecuteAsync(token))
+				.Select(f => f.TargetActorURI);
+			await ActorDeletion.Announce(persona, followed, _dbEntities, _delivery, token);
+			await DB.Default.Update<Avatar>().MatchID(avatar.ID).Modify(a => a.DeletionAt, now).ExecuteAsync(token);
+			await Empty(avatar.ID, now, token);
+			await DB.Default.DeleteAsync<PersonaListMember>(m => m.AvatarId == avatar.ID);
+			await DB.Default.DeleteAsync<PersonaList>(l => l.AvatarId == avatar.ID);
+			await DB.Default.DeleteAsync<PersonaFilter>(f => f.AvatarId == avatar.ID);
+			await DB.Default.DeleteAsync<FollowedTag>(t => t.AvatarId == avatar.ID);
+			// what it did with the server's announcements, kept for it alone
+			await DB.Default.DeleteAsync<AnnouncementRead>(r => r.AvatarId == avatar.ID);
+			await DB.Default.DeleteAsync<AnnouncementReaction>(r => r.AvatarId == avatar.ID);
+			// (the reader of feeds stops following what nobody reads any more at its next round)
+			await DB.Default.DeleteAsync<FeedSubscription>(s => s.AvatarId == avatar.ID);
+			// nothing of it publishes later, and none of its files stays served: its posts' media, its pictures and what its
+			// scheduled posts held
+			await DB.Default.DeleteAsync<ScheduledStatus>(s => s.AvatarId == avatar.ID);
+			await _media.Trash(m => m.OwnerAvatarId == avatar.ID, "persona removed", token);
+			return true;
+		}
+
+		// a persona's posts keep their ids and lose their content, like a single deleted post; a group writes none of its own
+		static async Task Empty(string avatarId, DateTime now, CancellationToken token)
+		{
+			var postIds = (await DB.Default.Find<PostEntity>().Match(p => p.GroupUserId == avatarId && !p.IsFederatedCopy && !p.DeletedAt.HasValue)
+				.Project(p => p.Include(x => x.ID)).ExecuteAsync(token)).Select(p => p.ID).ToList();
+			if (postIds.Count == 0)
+				return;
+			await DB.Default.Update<PostEntity>().Match(p => postIds.Contains(p.ID))
+				.Modify(p => p.DeletedAt, now)
+				.Modify(p => p.Text, null)
+				.Modify(p => p.ContentHtml, null)
+				.Modify(p => p.Title, null)
+				.Modify(p => p.SpoilerText, null)
+				.Modify(p => p.Media, new List<Models.Post.PostMedia>())
+				.Modify(p => p.Revisions, new List<Models.Post.PostRevision>())
+				.ExecuteAsync(token);
+			await DB.Default.DeleteAsync<TimelineEntry>(e => postIds.Contains(e.PostId) || postIds.Contains(e.ReblogOfPostId));
+		}
+	}
+
+	// Deleting a group (completion program R6: by its owner with the login's password, by an administrator with theirs, and
+	// with the persona that owns it): a Delete of the group's actor to its followers and its members elsewhere, its name kept
+	// reserved while its documents answer 410, and the personas here that followed or joined it no longer do. The posts made
+	// in it stay their authors'.
+	public class GroupRemoval : IGroupRemoval
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IDeliveryService _delivery;
+
+		public GroupRemoval(DbEntities dbEntities, ILocalActorService localActors, IDeliveryService delivery)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_delivery = delivery;
+		}
+
+		public async Task<bool> Remove(string groupId, CancellationToken token)
+		{
+			var group = string.IsNullOrEmpty(groupId) ? default : await _dbEntities.Groups.MatchID(groupId).Match(g => !g.DeletionAt.HasValue).ExecuteFirstAsync(token);
+			if (group == default)
+				return false;
+			var actor = _localActors.FromGroup(group);
+			await ActorDeletion.Announce(actor, group.Members.Where(m => m.IsForeign).Select(m => m.AvatarId), _dbEntities, _delivery, token);
+			await DB.Default.Update<GroupEntity>().MatchID(group.ID).Modify(g => g.DeletionAt, DateTime.UtcNow).ExecuteAsync(token);
+			await DB.Default.DeleteAsync<Following>(f => f.TargetActorURI == actor.Uri);
+			await DB.Default.DeleteAsync<Follower>(f => f.LocalActorId == group.ID && f.LocalActorKind == LocalActorKind.Group);
+			return true;
+		}
+	}
+}

PrivaPub/Services/PostsService.cs

@@ -125,7 +125,7 @@ namespace PrivaPub.Services
 				}
 
 				var posts = await query.Match(VisibilityPolicy.IsShown).Sort(p => p.CreationDate, Order.Descending).Limit(PageSize).ExecuteAsync(token);
-				result.Data = posts.Select(ToView).ToList();
+				result.Data = posts.Where(p => !VisibilityPolicy.Barred(p)).Select(ToView).ToList();
 				return result;
 			}
 			catch (Exception ex)
@@ -188,7 +188,7 @@ namespace PrivaPub.Services
 					.Sort(p => p.CreationDate, Order.Descending)
 					.Limit(PageSize)
 					.ExecuteAsync(token);
-				result.Data = dms.Select(ToView).ToList();
+				result.Data = dms.Where(p => !VisibilityPolicy.Barred(p)).Select(ToView).ToList();
 				return result;
 			}
 			catch (Exception ex)
@@ -263,7 +263,8 @@ namespace PrivaPub.Services
 				return default;
 			if (!await _dbEntities.RootToAvatars.Match(ra => ra.RootId == rootUserId && ra.AvatarId == avatarId).ExecuteAnyAsync(token))
 				return default;
-			return await _localActors.FindById(LocalActorKind.Person, avatarId, token);
+			// a suspended persona does nothing through the client API either (R6)
+			return await _localActors.FindById(LocalActorKind.Person, avatarId, token) is { Suspended: false } persona ? persona : default;
 		}
 
 		static ViewPost ToView(PostEntity post) => new()

PrivaPub/Services/RootRemoval.cs

@@ -1,18 +1,7 @@
 using MongoDB.Entities;
 
-using PrivaPub.Federation.Actors;
-using PrivaPub.Federation.Outbox;
-using PrivaPub.Federation.Rendering;
-using PrivaPub.Models.Federation;
-using PrivaPub.Models.Social;
 using PrivaPub.Models.User;
 using PrivaPub.StaticServices;
-using PrivaPub.Domain.Media;
-
-using System.Text.Json.Nodes;
-
-using GroupEntity = PrivaPub.Models.Group.Group;
-using PostEntity = PrivaPub.Models.Post.Post;
 
 namespace PrivaPub.Services
 {
@@ -21,25 +10,21 @@ namespace PrivaPub.Services
 		Task<bool> Remove(string rootId, CancellationToken token);
 	}
 
-	// Deleting a root deletes everything public it had (owner decision 2026-10-04): each persona, and each group a persona
-	// owns, is announced deleted with a Delete of the actor to everyone who follows it, every member and everyone it
-	// follows; their posts are emptied; their names stay reserved, and their documents answer 410 from then on. The root's
-	// sessions end first, so nothing acts as it while it goes.
+	// Deleting a root deletes everything public it had (owner decision 2026-10-04): each of its personas goes as a persona
+	// is deleted (PersonaRemoval: each group it owns, a Delete of the actor to everyone who follows it and everyone it
+	// follows, its posts emptied, its name kept reserved and its documents answering 410). The root's sessions end first, so
+	// nothing acts as it while it goes, and it keeps only a deleted-{id} name.
 	public class RootRemoval : IRootRemoval
 	{
 		readonly DbEntities _dbEntities;
-		readonly ILocalActorService _localActors;
-		readonly IDeliveryService _delivery;
 		readonly IRootSessions _sessions;
-		readonly IMediaService _media;
+		readonly IPersonaRemoval _personas;
 
-		public RootRemoval(DbEntities dbEntities, ILocalActorService localActors, IDeliveryService delivery, IRootSessions sessions, IMediaService media)
+		public RootRemoval(DbEntities dbEntities, IRootSessions sessions, IPersonaRemoval personas)
 		{
-			_media = media;
 			_dbEntities = dbEntities;
-			_localActors = localActors;
-			_delivery = delivery;
 			_sessions = sessions;
+			_personas = personas;
 		}
 
 		public async Task<bool> Remove(string rootId, CancellationToken token)
@@ -51,34 +36,8 @@ namespace PrivaPub.Services
 			var now = DateTime.UtcNow;
 
 			var avatarIds = (await _dbEntities.RootToAvatars.Match(ra => ra.RootId == root.ID).ExecuteAsync(token)).Select(ra => ra.AvatarId).ToList();
-			var avatars = await _dbEntities.Avatars.Match(a => avatarIds.Contains(a.ID) && !a.DeletionAt.HasValue).ExecuteAsync(token);
-			foreach (var avatar in avatars)
-			{
-				foreach (var group in await _dbEntities.Groups.Match(g => g.OwnerAvatarId == avatar.ID && !g.DeletionAt.HasValue).ExecuteAsync(token))
-				{
-					await Announce(_localActors.FromGroup(group), group.Members.Where(m => m.IsForeign).Select(m => m.AvatarId), token);
-					await DB.Default.Update<GroupEntity>().MatchID(group.ID).Modify(g => g.DeletionAt, now).ExecuteAsync(token);
-				}
-				var persona = _localActors.FromAvatar(avatar);
-				var followed = (await _dbEntities.Followings.Match(f => f.AvatarId == avatar.ID && !f.TargetIsLocal).ExecuteAsync(token))
-					.Select(f => f.TargetActorURI);
-				await Announce(persona, followed, token);
-				await DB.Default.Update<Avatar>().MatchID(avatar.ID).Modify(a => a.DeletionAt, now).ExecuteAsync(token);
-				await Empty(avatar.ID, now, token);
-				await DB.Default.DeleteAsync<Models.Social.PersonaListMember>(m => m.AvatarId == avatar.ID);
-				await DB.Default.DeleteAsync<Models.Social.PersonaList>(l => l.AvatarId == avatar.ID);
-				await DB.Default.DeleteAsync<Models.Social.PersonaFilter>(f => f.AvatarId == avatar.ID);
-				await DB.Default.DeleteAsync<Models.Social.FollowedTag>(t => t.AvatarId == avatar.ID);
-				// what it did with the server's announcements, kept for it alone
-				await DB.Default.DeleteAsync<Models.Social.AnnouncementRead>(r => r.AvatarId == avatar.ID);
-				await DB.Default.DeleteAsync<Models.Social.AnnouncementReaction>(r => r.AvatarId == avatar.ID);
-				// (the reader of feeds stops following what nobody reads any more at its next round)
-				await DB.Default.DeleteAsync<Models.Social.FeedSubscription>(s => s.AvatarId == avatar.ID);
-				// nothing of it publishes later, and none of its files stays served: its posts' media, its pictures and
-				// what its scheduled posts held
-				await DB.Default.DeleteAsync<Models.Social.ScheduledStatus>(s => s.AvatarId == avatar.ID);
-				await _media.Trash(m => m.OwnerAvatarId == avatar.ID, "root removed", token);
-			}
+			foreach (var avatarId in avatarIds)
+				await _personas.Remove(avatarId, token);
 
 			await DB.Default.Update<RootUser>().MatchID(root.ID)
 				.Modify(u => u.UserName, $"deleted-{root.ID}")//unique, so a second deletion never collides with the first
@@ -90,46 +49,8 @@ namespace PrivaPub.Services
 				.Modify(u => u.DeletedAt, now)
 				.ExecuteAsync(token);
 			await DB.Default.DeleteAsync<EmailRecovery>(r => r.RootUserId == root.ID);
+			await Domain.Moderation.Restrictions.Reload(CancellationToken.None);
 			return true;
 		}
-
-		// Delete{Actor}: to its followers' (shared) inboxes, and to the inboxes of the other accounts named
-		async Task Announce(LocalActor actor, IEnumerable<string> others, CancellationToken token)
-		{
-			var inboxes = (await _delivery.FollowerInboxes(actor, token)).ToList();
-			var named = others.Where(uri => !string.IsNullOrEmpty(uri)).Distinct().ToList();
-			if (named.Count > 0)
-				inboxes.AddRange((await _dbEntities.ForeignAvatars.Match(a => named.Contains(a.ActorURI)).ExecuteAsync(token))
-					.Select(a => string.IsNullOrEmpty(a.SharedInboxURL) ? a.InboxURL : a.SharedInboxURL));
-			await _delivery.Enqueue(actor, inboxes.Where(i => !string.IsNullOrEmpty(i)).Distinct(), new JsonObject
-			{
-				["@context"] = ActivityPubRenderer.Context(),
-				["id"] = actor.ActivityUri("delete-actor"),
-				["type"] = "Delete",
-				["actor"] = actor.Uri,
-				["object"] = actor.Uri,
-				["to"] = new JsonArray(ActivityPubRenderer.Public),
-				["cc"] = new JsonArray(actor.Followers)
-			}, token);
-		}
-
-		// a persona's posts keep their ids and lose their content, like a single deleted post; a group writes none of its own
-		static async Task Empty(string avatarId, DateTime now, CancellationToken token)
-		{
-			var postIds = (await DB.Default.Find<PostEntity>().Match(p => p.GroupUserId == avatarId && !p.IsFederatedCopy && !p.DeletedAt.HasValue)
-				.Project(p => p.Include(x => x.ID)).ExecuteAsync(token)).Select(p => p.ID).ToList();
-			if (postIds.Count == 0)
-				return;
-			await DB.Default.Update<PostEntity>().Match(p => postIds.Contains(p.ID))
-				.Modify(p => p.DeletedAt, now)
-				.Modify(p => p.Text, null)
-				.Modify(p => p.ContentHtml, null)
-				.Modify(p => p.Title, null)
-				.Modify(p => p.SpoilerText, null)
-				.Modify(p => p.Media, new List<Models.Post.PostMedia>())
-				.Modify(p => p.Revisions, new List<Models.Post.PostRevision>())
-				.ExecuteAsync(token);
-			await DB.Default.DeleteAsync<TimelineEntry>(e => postIds.Contains(e.PostId) || postIds.Contains(e.ReblogOfPostId));
-		}
 	}
 }

PrivaPub/Services/RootUsersService.cs

@@ -258,6 +258,14 @@ namespace PrivaPub.Services
 			}
 		}
 
+		// what can't be undone asks for the password again (a persona's or a group's deletion, by its login or an administrator)
+		public async Task<bool> PasswordMatches(string rootId, string password)
+		{
+			var user = string.IsNullOrEmpty(rootId) ? default : await DbEntities.RootUsers.MatchID(rootId).Match(u => u.DeletedAt == null).ExecuteFirstAsync();
+			var (verified, _) = PasswordHasher.Check(user?.HashedPassword ?? Decoy, password ?? string.Empty);
+			return user?.HashedPassword != default && verified;
+		}
+
 		public async Task<WebResult> BanUserAsync(UsersIds usersIds)
 		{
 			var result = new WebResult();

PrivaPub/Web/Pages/OAuth/OAuthPages.cs

@@ -112,7 +112,7 @@ namespace PrivaPub.Web.Pages.OAuth
 			var owns = !string.IsNullOrEmpty(avatarId)
 				&& await _dbEntities.RootToAvatars.Match(r => r.RootId == rootId && r.AvatarId == avatarId).ExecuteAnyAsync(token);
 			var avatar = owns ? await _localActors.FindById(LocalActorKind.Person, avatarId, token) : default;
-			if (avatar == default)
+			if (avatar is not { Suspended: false })//a suspended persona signs in nowhere (R6)
 				return await Show(token);
 
 			var identity = new ClaimsIdentity(TokenValidationParameters.DefaultAuthenticationType, Claims.Name, Claims.Role);
@@ -145,7 +145,7 @@ namespace PrivaPub.Web.Pages.OAuth
 			var avatarIds = (await _dbEntities.RootToAvatars.Match(r => r.RootId == rootId).ExecuteAsync(token)).Select(r => r.AvatarId).ToList();
 			var avatars = new List<LocalActor>();
 			foreach (var id in avatarIds)
-				if (await _localActors.FindById(LocalActorKind.Person, id, token) is { } avatar)
+				if (await _localActors.FindById(LocalActorKind.Person, id, token) is { Suspended: false } avatar)
 					avatars.Add(avatar);
 			Avatars = avatars;
 			Parameters = request.GetParameters()

PrivaPub/Web/Pages/Pages.cs

@@ -61,7 +61,7 @@ namespace PrivaPub.Web.Pages
 		public async Task<IActionResult> OnGetAsync(string user, CancellationToken token)
 		{
 			Actor = await _localActors.FindByUserName(user, token);
-			if (Actor is not { IsFederated: true, IsCircle: false } || Actor.IsServerActor)
+			if (Actor is not { IsFederated: true, IsCircle: false, Suspended: false } || Actor.IsServerActor)
 				return NotFound();
 			if (WantsActivityJson())
 				return Redirect(Actor.Uri);
@@ -84,7 +84,7 @@ namespace PrivaPub.Web.Pages
 					continue;
 				if (!authors.TryGetValue(post.GroupUserId, out var author))
 					authors[post.GroupUserId] = author = await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
-				if (author != default)
+				if (author is { Suspended: false })
 					views.Add(PostView.From(post, author));
 			}
 			Posts = views;
@@ -118,6 +118,7 @@ namespace PrivaPub.Web.Pages
 			var posts = await _dbEntities.Posts
 				.Match(p => p.Tags.Contains(Tag) && !p.IsFederatedCopy && p.ReblogOfPostId == null && p.Visibility == PostVisibility.Public)
 				.Match(VisibilityPolicy.IsPublic)
+				.Match(VisibilityPolicy.IsListed)
 				.Sort(p => p.ID, Order.Descending)
 				.Limit(PageSize)
 				.ExecuteAsync(token);
@@ -127,7 +128,7 @@ namespace PrivaPub.Web.Pages
 			{
 				if (!authors.TryGetValue(post.GroupUserId, out var author))
 					authors[post.GroupUserId] = author = await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
-				if (author is { IsFederated: true })
+				if (author is { IsFederated: true, Suspended: false })
 					views.Add(PostView.From(post, author));
 			}
 			Posts = views;
@@ -153,7 +154,7 @@ namespace PrivaPub.Web.Pages
 		public async Task<IActionResult> OnGetAsync(string user, string id, CancellationToken token)
 		{
 			Actor = await _localActors.FindByUserName(user, token);
-			if (Actor is not { IsFederated: true, Kind: LocalActorKind.Person })
+			if (Actor is not { IsFederated: true, Kind: LocalActorKind.Person, Suspended: false })
 				return NotFound();
 			var post = await _dbEntities.Posts
 				.Match(p => p.ID == id && p.GroupUserId == Actor.Id && !p.IsFederatedCopy && p.ReblogOfPostId == null)