R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Infrastructure/Backup/ProtectiveMerge.cs

@@ -10,7 +10,8 @@ namespace PrivaPub.Infrastructure.Backup
 	// - blocks, mutes, domain blocks (the server's and the personas'), being blocked, reserved names, deletion tombstones,
 	//   reports, filters and OAuth applications are the union of both, P's row winning;
 	// - deletions win: a root, persona, group, post or remote account deleted since is deleted again (P's row, as its
-	//   deletion left it), with what a deletion takes away; P's moderation of a persona (silenced, suspended, banned) stays;
+	//   deletion left it), with what a deletion takes away; P's moderation of a persona or of an account elsewhere (silenced,
+//   suspended) stays, as do the posts the staff took down, and every post's moderation flags are worked out again;
 	// - a root keeps P's password, e-mail, ban and policies;
 	// - roots, personas and groups made since become tombstones: deleted, their names kept; local posts made since answer
 	//   410; media made since go to the trash, as do media trashed since (and they leave the posts restored with them),
@@ -103,9 +104,12 @@ namespace PrivaPub.Infrastructure.Backup
 						await database.GetCollection<BsonDocument>(collection).DeleteManyAsync(new BsonDocument("AvatarId", avatar["_id"].ToString()), token);
 					continue;
 				}
-				var moderated = new[] { "SilencedAt", "SuspendedAt", "BannedAt" }.Where(field => IsSet(avatar, field)).ToArray();
+				var moderated = new[] { "SilencedAt", "SuspendedAt", "BannedAt", "ModerationNote" }.Where(field => IsSet(avatar, field)).ToArray();
 				if (moderated.Length > 0)
+				{
 					await avatars.UpdateOneAsync(Id(avatar["_id"]), Copy(avatar, moderated), cancellationToken: token);
+					report.ProtectiveKept++;
+				}
 			}
 
 			var links = database.GetCollection<BsonDocument>("RootToAvatar");
@@ -131,13 +135,27 @@ namespace PrivaPub.Infrastructure.Backup
 				await groups.ReplaceOneAsync(Id(group["_id"]), group, cancellationToken: token);
 			}
 
-			// remote accounts deleted or gone since: as P has them
+			// remote accounts deleted or gone since: as P has them; the staff's silence or suspension of one stays (R6)
 			var foreign = database.GetCollection<BsonDocument>("ForeignAvatar");
-			foreach (var account in P("ForeignAvatar").Where(a => IsSet(a, "DeletionAt") || IsSet(a, "ForgottenAt")))
-				await foreign.ReplaceOneAsync(Id(account["_id"]), account, cancellationToken: token);
+			foreach (var account in P("ForeignAvatar"))
+			{
+				if (IsSet(account, "DeletionAt") || IsSet(account, "ForgottenAt"))
+				{
+					await foreign.ReplaceOneAsync(Id(account["_id"]), account, cancellationToken: token);
+					continue;
+				}
+				var moderated = new[] { "SilencedAt", "SuspendedAt", "ModerationNote" }.Where(field => IsSet(account, field)).ToArray();
+				if (moderated.Length > 0 && (await foreign.UpdateOneAsync(Id(account["_id"]), Copy(account, moderated), cancellationToken: token)).MatchedCount > 0)
+					report.ProtectiveKept++;
+			}
 
 			await Posts(database, P("Post"), report, token);
 			await Media(database, P("MediaAttachment"), report, token);
+			// what the staff took down stays down, and every post's flags follow the moderation now kept (R6)
+			foreach (var post in P("Post").Where(p => IsSet(p, "ModeratedAt")))
+				await database.GetCollection<BsonDocument>("Post").UpdateOneAsync(
+					new BsonDocument { { "_id", post["_id"] }, { "ModeratedAt", BsonNull.Value } }, Copy(post, "ModeratedAt"), cancellationToken: token);
+			await Domain.Moderation.ModerationFlags.Recompute(database, token);
 
 			// every session ends: a new stamp for each root's tokens, and the personas' OAuth tokens go
 			foreach (var root in await (await roots.FindAsync(FilterDefinition<BsonDocument>.Empty, cancellationToken: token)).ToListAsync(token))