R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Federation/Outbox/DeliveryService.cs

@@ -43,12 +43,24 @@ namespace PrivaPub.Federation.Outbox
 			_queue = queue;
 		}
 
+		// what the staff's moderation holds back (completion program R6): a suspended persona (by itself or with its banned
+		// login) delivers nothing, but the Delete of itself, which its deletion sends; and nothing goes to the own inbox of an
+		// account elsewhere the staff suspended (its server's shared inbox still serves the others there)
+		public static bool HeldBack(LocalActor signer, JsonNode activity) =>
+			signer is { Kind: LocalActorKind.Person, Suspended: true } && !DeletesItself(signer, activity);
+
+		static bool DeletesItself(LocalActor signer, JsonNode activity) =>
+			ActivityJson.Value(activity, "type") == "Delete" && ActivityJson.Id(activity?["object"]) == signer.Uri;
+
 		public async Task Enqueue(LocalActor signer, IEnumerable<string> inboxes, JsonObject activity, CancellationToken token, string again = default)
 		{
+			if (HeldBack(signer, activity))
+				return;
 			var body = activity.ToJsonString();
 			var activityId = activity["id"] is JsonValue id && id.TryGetValue<string>(out var text) ? text : default;
 			var targets = inboxes
-				.Where(i => !string.IsNullOrEmpty(i) && !i.StartsWith(signer.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+				.Where(i => !string.IsNullOrEmpty(i) && !i.StartsWith(signer.BaseAddress + "/", StringComparison.OrdinalIgnoreCase)
+					&& !Domain.Moderation.Restrictions.IsSuspendedInbox(i))
 				.Distinct(StringComparer.Ordinal)
 				.ToList();
 			// what goes to a relay carries the signer's proof (FEP-8b32): the relay passes it on as it came, signed with its own
@@ -223,6 +235,17 @@ namespace PrivaPub.Federation.Outbox
 				attempt.Reason = "signer-gone";
 				return JobOutcome.Dead("the signing actor no longer exists");
 			}
+			// suspended since it was queued, or the account it goes to (R6): never sent
+			if (signer.Suspended && DeliveryService.HeldBack(signer, JsonNode.Parse(payload.Body)))
+			{
+				attempt.Reason = "signer-suspended";
+				return JobOutcome.Dead("the signing persona is suspended");
+			}
+			if (Domain.Moderation.Restrictions.IsSuspendedInbox(payload.Inbox))
+			{
+				attempt.Reason = "inbox-suspended";
+				return JobOutcome.Dead("the inbox's account is suspended");
+			}
 
 			var body = Encoding.UTF8.GetBytes(payload.Body);
 			using var request = new HttpRequestMessage(HttpMethod.Post, inbox) { Content = new ByteArrayContent(body) };