R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Domain/Privacy/Counted.cs

@@ -46,6 +46,17 @@ namespace PrivaPub.Domain.Privacy
 				: (await DB.Default.Find<RootToAvatar>().Match(ra => roots.Contains(ra.RootId)).ExecuteAsync(token)).Select(ra => ra.AvatarId).ToList();
 		}
 
+		// Personas nobody finds or is shown: the barred ones, and those the staff suspended (completion program R6). A
+		// suspended persona still counts among the users and its posts among the posts: the counts other servers read tell
+		// nothing new of it (owner decision 2026-10-17). Moderation's Restrictions holds the same set in memory.
+		public static async Task<List<string>> HeldBackPersonas(CancellationToken token)
+		{
+			var held = await BarredPersonas(token);
+			held.AddRange((await DB.Default.Find<Avatar>().Match(a => a.SuspendedAt != null).Project(a => a.Include(x => x.ID)).ExecuteAsync(token))
+				.Select(a => a.ID));
+			return held.Distinct().ToList();
+		}
+
 		public static async Task<long> Users(CancellationToken token)
 		{
 			var barred = await BarredPersonas(token);

PrivaPub/Domain/Privacy/VisibilityPolicy.cs

@@ -14,16 +14,27 @@ namespace PrivaPub.Domain.Privacy
 {
 	public static class VisibilityPolicy
 	{
-		//neither deleted nor kept back after its remote author deleted their account (owner decision, 2026-10-03)
-		public static readonly Expression<Func<Post, bool>> IsShown = p => !p.DeletedAt.HasValue && !p.AuthorGone;
+		//neither deleted nor kept back after its remote author deleted their account (owner decision, 2026-10-03), nor held
+		//back by the staff: its author suspended, or the post itself taken down (completion program R6)
+		public static readonly Expression<Func<Post, bool>> IsShown = p => !p.DeletedAt.HasValue && !p.AuthorGone && !p.AuthorSuspended && !p.ModeratedAt.HasValue;
 
 		public static readonly Expression<Func<Post, bool>> IsPublic = p =>
-			!p.DeletedAt.HasValue && !p.AuthorGone && (p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted);
+			!p.DeletedAt.HasValue && !p.AuthorGone && !p.AuthorSuspended && !p.ModeratedAt.HasValue
+			&& (p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted);
+
+		// where strangers browse (the public and hashtag timelines and streams, trends, search, the relays): never a post of a
+		// silenced author or server, which its followers still get and anyone may still open (R6)
+		public static readonly Expression<Func<Post, bool>> IsListed = p => !p.AuthorLimited;
 
 		static readonly Func<Post, bool> IsShownCompiled = IsShown.Compile();
 		static readonly Func<Post, bool> IsPublicCompiled = IsPublic.Compile();
 
-		public static bool Shown(Post post) => post != default && IsShownCompiled(post);
+		// a banned login's personas are suspended in Restrictions alone, never on their posts, so a post read one at a time
+		// is asked there too; a query that lists posts leaves theirs to the Mastodon mapper, which shows no account of theirs
+		public static bool Shown(Post post) => post != default && IsShownCompiled(post) && !Barred(post);
+
+		public static bool Barred(Post post) =>
+			!post.IsFederatedCopy && !string.IsNullOrEmpty(post.GroupUserId) && Moderation.Restrictions.IsSuspended(post.GroupUserId);
 
 		public static async Task<bool> CanSee(Post post, string viewerAvatarId, CancellationToken token)
 		{