R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Federation/Outbox/DeliveryService.cs

@@ -43,12 +43,24 @@ namespace PrivaPub.Federation.Outbox
 			_queue = queue;
 		}
 
+		// what the staff's moderation holds back (completion program R6): a suspended persona (by itself or with its banned
+		// login) delivers nothing, but the Delete of itself, which its deletion sends; and nothing goes to the own inbox of an
+		// account elsewhere the staff suspended (its server's shared inbox still serves the others there)
+		public static bool HeldBack(LocalActor signer, JsonNode activity) =>
+			signer is { Kind: LocalActorKind.Person, Suspended: true } && !DeletesItself(signer, activity);
+
+		static bool DeletesItself(LocalActor signer, JsonNode activity) =>
+			ActivityJson.Value(activity, "type") == "Delete" && ActivityJson.Id(activity?["object"]) == signer.Uri;
+
 		public async Task Enqueue(LocalActor signer, IEnumerable<string> inboxes, JsonObject activity, CancellationToken token, string again = default)
 		{
+			if (HeldBack(signer, activity))
+				return;
 			var body = activity.ToJsonString();
 			var activityId = activity["id"] is JsonValue id && id.TryGetValue<string>(out var text) ? text : default;
 			var targets = inboxes
-				.Where(i => !string.IsNullOrEmpty(i) && !i.StartsWith(signer.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+				.Where(i => !string.IsNullOrEmpty(i) && !i.StartsWith(signer.BaseAddress + "/", StringComparison.OrdinalIgnoreCase)
+					&& !Domain.Moderation.Restrictions.IsSuspendedInbox(i))
 				.Distinct(StringComparer.Ordinal)
 				.ToList();
 			// what goes to a relay carries the signer's proof (FEP-8b32): the relay passes it on as it came, signed with its own
@@ -223,6 +235,17 @@ namespace PrivaPub.Federation.Outbox
 				attempt.Reason = "signer-gone";
 				return JobOutcome.Dead("the signing actor no longer exists");
 			}
+			// suspended since it was queued, or the account it goes to (R6): never sent
+			if (signer.Suspended && DeliveryService.HeldBack(signer, JsonNode.Parse(payload.Body)))
+			{
+				attempt.Reason = "signer-suspended";
+				return JobOutcome.Dead("the signing persona is suspended");
+			}
+			if (Domain.Moderation.Restrictions.IsSuspendedInbox(payload.Inbox))
+			{
+				attempt.Reason = "inbox-suspended";
+				return JobOutcome.Dead("the inbox's account is suspended");
+			}
 
 			var body = Encoding.UTF8.GetBytes(payload.Body);
 			using var request = new HttpRequestMessage(HttpMethod.Post, inbox) { Content = new ByteArrayContent(body) };

PrivaPub/Federation/Outbox/OutboxPublisher.cs

@@ -52,9 +52,11 @@ namespace PrivaPub.Federation.Outbox
 			//nothing is addressed to an account that blocked the author (it would refuse it, and Mastodon counts on that)
 			var blockers = (await DB.Default.Find<BlockedBy>().Match(b => b.AvatarId == author.Id).ExecuteAsync(token))
 				.Select(b => b.ActorURI).ToHashSet(StringComparer.Ordinal);
+			//nor to an account elsewhere the staff suspended (R6), through its server's shared inbox either
 			var addressed = post.Mentions.Where(m => !m.IsLocal).Select(m => m.ActorURI)
 				.Concat(post.Visibility == PostVisibility.Direct ? post.To.Concat(post.Cc) : Enumerable.Empty<string>())
-				.Where(uri => !uri.StartsWith(author.BaseAddress + "/", StringComparison.OrdinalIgnoreCase) && !blockers.Contains(uri))
+				.Where(uri => !uri.StartsWith(author.BaseAddress + "/", StringComparison.OrdinalIgnoreCase) && !blockers.Contains(uri)
+					&& !Domain.Moderation.Restrictions.IsSuspendedActor(uri))
 				.Distinct(StringComparer.Ordinal)
 				.ToList();
 			foreach (var uri in addressed)
@@ -67,7 +69,7 @@ namespace PrivaPub.Federation.Outbox
 			if (post.Visibility != PostVisibility.Direct && !string.IsNullOrEmpty(post.InReplyToAccountId))
 			{
 				var parentAuthor = await _dbEntities.ForeignAvatars.MatchID(post.InReplyToAccountId).ExecuteFirstAsync(token);
-				if (Preferred(parentAuthor) is { } inbox && !blockers.Contains(parentAuthor.ActorURI))
+				if (Preferred(parentAuthor) is { } inbox && !blockers.Contains(parentAuthor.ActorURI) && !parentAuthor.SuspendedAt.HasValue)
 					inboxes.Add(inbox);
 			}
 
@@ -77,14 +79,15 @@ namespace PrivaPub.Federation.Outbox
 				var quotedAuthor = quoted is { IsFederatedCopy: true }
 					? await _dbEntities.ForeignAvatars.Match(a => a.ActorURI == quoted.ActorURI).ExecuteFirstAsync(token)
 					: default;
-				if (Preferred(quotedAuthor) is { } inbox)
+				if (Preferred(quotedAuthor) is { } inbox && !quotedAuthor.SuspendedAt.HasValue)
 					inboxes.Add(inbox);
 			}
 
 			// a persona's own public post, outside any group, also goes to the relays we subscribe to (owner decision
-			// 2026-10-06), its edits and deletion with it
+			// 2026-10-06), its edits and deletion with it; a silenced persona's never does (R6): the relays are where strangers
+			// read
 			if (_relays != default && post.Visibility == PostVisibility.Public && author.Kind == LocalActorKind.Person
-				&& string.IsNullOrEmpty(post.ReblogOfPostId) && string.IsNullOrEmpty(post.GroupId))
+				&& string.IsNullOrEmpty(post.ReblogOfPostId) && string.IsNullOrEmpty(post.GroupId) && !post.AuthorLimited && !author.Silenced)
 				inboxes.AddRange(await _relays.Inboxes(token));
 
 			return inboxes.Where(i => !string.IsNullOrEmpty(i)).Distinct(StringComparer.Ordinal).ToList();