R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Federation/Inbox/Handlers/AnnounceHandler.cs

@@ -39,10 +39,13 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		public IEnumerable<IActivityHandler> Relays { get; set; }
 
 		readonly PrivaPub.Federation.Relays.IRelays _relayService;
+		readonly PrivaPub.Federation.Moderation.IDomainBlocks _domainBlocks;
 
 		public AnnounceHandler(DbEntities dbEntities, ILocalActorService localActors, IRemotePosts remotePosts, IFanout fanout, IRemoteActorService remoteActors,
-			IObjectRecords records, IQuoteService quotes, IServiceProvider services = default, PrivaPub.Federation.Relays.IRelays relays = default)
+			IObjectRecords records, IQuoteService quotes, IServiceProvider services = default, PrivaPub.Federation.Relays.IRelays relays = default,
+			PrivaPub.Federation.Moderation.IDomainBlocks domainBlocks = default)
 		{
+			_domainBlocks = domainBlocks;
 			_relayService = relays;
 			_services = services;
 			_records = records;
@@ -121,6 +124,8 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				To = to,
 				Cc = cc,
 				IsFederatedCopy = true,
+				AuthorSuspended = actor.SuspendedAt.HasValue,
+				AuthorLimited = RemotePosts.Limited(actor, _domainBlocks),
 				CreationDate = published,
 				UpdateDate = published
 			};

PrivaPub/Federation/Inbox/Handlers/FollowHandler.cs

@@ -49,6 +49,13 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				Arrival.Drop("unknown-recipient");
 				return;
 			}
+			// a suspended persona answers nothing, so it takes no follower it could not answer (R6): the request stays
+			// pending on the follower's side, as it would for any persona that has not answered yet
+			if (target is { Kind: LocalActorKind.Person, Suspended: true })
+			{
+				Arrival.Drop("recipient-suspended");
+				return;
+			}
 			if (target.Kind == LocalActorKind.Person
 				&& await DB.Default.Find<Models.Social.Block>().Match(b => b.AvatarId == target.Id && b.TargetActorURI == follower.ActorURI).ExecuteAnyAsync(token))
 			{

PrivaPub/Federation/Inbox/InboxProcessor.cs

@@ -65,6 +65,13 @@ namespace PrivaPub.Federation.Inbox
 				Record(job, payload, activity, type, started, new ArrivalVerdict(), Interactions.Deferred, "actor-unavailable");
 				return JobOutcome.Retry("the actor could not be loaded");
 			}
+			// an account the staff suspended (R6): what it sends is dropped, but a Delete or an Undo of what it sent, which only
+			// take away what we hold (a post, a follow, a like)
+			if (actor.SuspendedAt.HasValue && type is not ("Delete" or "Undo"))
+			{
+				Record(job, payload, activity, type, started, new ArrivalVerdict(), Interactions.Dropped, "account-suspended");
+				return JobOutcome.Done;
+			}
 			if (payload.ForwardedBy != default && Forwarded.NamesUnknownKey(activity, actor))
 				actor = await _remoteActors.GetActor(actor.ActorURI, refresh: true, token) ?? actor;
 			if (payload.ForwardedBy != default && !Forwarded.Proven(activity, actor))

PrivaPub/Federation/Inbox/RemotePosts.cs

@@ -133,6 +133,9 @@ namespace PrivaPub.Federation.Inbox
 				InReplyToAccountId = parent?.AuthorAccountId ?? parent?.GroupUserId,
 				IsFederatedCopy = true,
 				AuthorGone = author.AccountState == AvatarAccountState.Deleted,
+				// the staff's moderation of its author or its server (R6), as AccountModeration sets it on what came before
+				AuthorSuspended = author.SuspendedAt.HasValue,
+				AuthorLimited = Limited(author, _domainBlocks),
 				CreationDate = note.Published,
 				UpdateDate = note.Updated ?? note.Published,
 				EditedAt = note.Updated,
@@ -143,6 +146,11 @@ namespace PrivaPub.Federation.Inbox
 			return post;
 		}
 
+		// an account elsewhere is limited when the staff silenced it or its server
+		public static bool Limited(ForeignAvatar author, IDomainBlocks domainBlocks) =>
+			author.SilencedAt.HasValue || Uri.TryCreate(author.ActorURI, UriKind.Absolute, out var uri)
+			&& domainBlocks?.Find(uri.Host)?.Severity == DomainBlockSeverity.Silence;
+
 		// a post's flairs, filled in from its community's list
 		public static async Task<List<PostFlair>> Flairs(NoteDocument note, string communityUri, CancellationToken token)
 		{