R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Domain/Social/FollowService.cs

@@ -336,7 +336,8 @@ namespace PrivaPub.Domain.Social
 				return default;
 			if (!await _dbEntities.RootToAvatars.Match(ra => ra.RootId == rootUserId && ra.AvatarId == avatarId).ExecuteAnyAsync(token))
 				return default;
-			return await _localActors.FindById(LocalActorKind.Person, avatarId, token);
+			// a suspended persona does nothing through the client API either (R6)
+			return await _localActors.FindById(LocalActorKind.Person, avatarId, token) is { Suspended: false } persona ? persona : default;
 		}
 
 		static ViewFollowing ToView(Following following) => new()

PrivaPub/Domain/Social/Notifications.cs

@@ -47,5 +47,32 @@ namespace PrivaPub.Domain.Social
 			{
 			}
 		}
+
+		// A warning from this server's staff (completion program R6): Mastodon's moderation_warning, from the persona itself as
+		// Mastodon's are (an AccountWarning has no account behind it), never judged by the notification policy, one for each
+		// act. A suspended persona reads it once its suspension is lifted; until then its login sees it suspended in its list
+		// of personas (/clientapi/avatar/private/list).
+		public static async Task Warn(string avatarId, string personaUri, string action, string text, IReadOnlyList<string> postIds, CancellationToken token)
+		{
+			if (string.IsNullOrEmpty(avatarId))
+				return;
+			var ids = postIds?.Where(id => !string.IsNullOrEmpty(id)).Distinct().ToList() ?? new List<string>();
+			var notification = new Notification
+			{
+				AvatarId = avatarId,
+				Type = NotificationType.ModerationWarning,
+				FromAccountId = avatarId,
+				FromActorURI = personaUri,
+				PostId = ids.FirstOrDefault(),
+				StatusIds = ids.Count > 1 ? ids : null,
+				Text = string.IsNullOrWhiteSpace(text) ? default : text.Trim(),
+				WarningAction = action,
+				DedupeKey = $"{NotificationType.ModerationWarning}|{avatarId}|staff|{MongoDB.Bson.ObjectId.GenerateNewId()}"
+			};
+			await DB.Default.SaveAsync(notification, CancellationToken.None);//an act that was done is told even when its request went away
+			var told = new Timelines.Streams.Event("notification", notification.ID);
+			Timelines.Streams.ToPersona(avatarId, new Timelines.Streams.Key(Timelines.Streams.User), told);
+			Timelines.Streams.ToPersona(avatarId, new Timelines.Streams.Key(Timelines.Streams.UserNotification), told);
+		}
 	}
 }

PrivaPub/Domain/Social/Trends.cs

@@ -67,6 +67,7 @@ namespace PrivaPub.Domain.Social
 					.Match(p => p.Visibility == PostVisibility.Public && !p.DeletedAt.HasValue && !p.AuthorGone && !p.HasContentWarning && !p.IsLocalOnly
 						&& p.ReblogOfPostId == null && p.InReplyToURI == null && p.AnsweringToPostId == null && p.CreationDate >= since
 						&& p.FavouritesCount + p.ReblogsCount + p.RepliesCount > 0)
+					.Match(Privacy.VisibilityPolicy.IsPublic).Match(Privacy.VisibilityPolicy.IsListed)
 					.ExecuteAsync(token);
 				var discoverable = await Discoverable(posts.Select(p => p.AuthorAccountId ?? p.GroupUserId), token);
 				return posts.Where(p => discoverable.Contains(p.AuthorAccountId ?? p.GroupUserId))
@@ -80,6 +81,7 @@ namespace PrivaPub.Domain.Social
 			return _dbEntities.Posts
 				.Match(p => p.Visibility == PostVisibility.Public && !p.DeletedAt.HasValue && !p.AuthorGone && !p.HasContentWarning && !p.IsLocalOnly
 					&& p.ReblogOfPostId == null && p.CreationDate >= since)
+				.Match(Privacy.VisibilityPolicy.IsPublic).Match(Privacy.VisibilityPolicy.IsListed)
 				.Match(with)
 				.Project(p => p.Include(x => x.ID).Include(x => x.Tags).Include(x => x.Link).Include(x => x.CreationDate)
 					.Include(x => x.AuthorAccountId).Include(x => x.GroupUserId))
@@ -115,10 +117,12 @@ namespace PrivaPub.Domain.Social
 		static async Task<HashSet<string>> Discoverable(IEnumerable<string> accountIds, CancellationToken token)
 		{
 			var ids = accountIds.Where(id => !string.IsNullOrEmpty(id)).Distinct().ToList();
-			var barred = await Privacy.Counted.BarredPersonas(token);
-			var local = await DB.Default.Find<Avatar>().Match(a => ids.Contains(a.ID) && a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID))
+			var barred = await Privacy.Counted.HeldBackPersonas(token);
+			var local = await DB.Default.Find<Avatar>().Match(a => ids.Contains(a.ID) && a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID)
+					&& !a.SilencedAt.HasValue)
 				.Project(a => a.Include(x => x.ID)).ExecuteAsync(token);
-			var remote = await DB.Default.Find<ForeignAvatar>().Match(f => ids.Contains(f.ID) && f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue)
+			var remote = await DB.Default.Find<ForeignAvatar>().Match(f => ids.Contains(f.ID) && f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue
+					&& !f.SilencedAt.HasValue)
 				.Project(f => f.Include(x => x.ID)).ExecuteAsync(token);
 			return local.Select(a => a.ID).Concat(remote.Select(f => f.ID)).ToHashSet();
 		}