R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Models/AdminAction.cs

@@ -45,6 +45,21 @@ namespace PrivaPub.Models
 		public const string RootDelete = "root.delete";
 		public const string RootResetTotp = "root.reset_totp";
 		public const string PersonaMove = "persona.move";
+		// moderation (completion program R6)
+		public const string RootRole = "root.role";
+		public const string RootBan = "root.ban";
+		public const string RootUnban = "root.unban";
+		public const string PersonaSilence = "persona.silence";
+		public const string PersonaUnsilence = "persona.unsilence";
+		public const string PersonaSuspend = "persona.suspend";
+		public const string PersonaUnsuspend = "persona.unsuspend";
+		public const string PersonaDelete = "persona.delete";
+		public const string AccountSilence = "account.silence";
+		public const string AccountUnsilence = "account.unsilence";
+		public const string AccountSuspend = "account.suspend";
+		public const string AccountUnsuspend = "account.unsuspend";
+		public const string GroupDelete = "group.delete";
+		public const string PostRemove = "post.remove";
 	}
 
 	public static class AdminTargets
@@ -60,5 +75,7 @@ namespace PrivaPub.Models
 		public const string Emoji = "emoji";
 		public const string Relay = "relay";
 		public const string Backup = "backup";
+		public const string Group = "group";
+		public const string Post = "post";
 	}
 }

PrivaPub/Models/Post/Post.cs

@@ -59,6 +59,14 @@ namespace PrivaPub.Models.Post
 		public bool HasContentWarning { get; set; } = false;
 		public bool IsLocalOnly { get; set; }
 		public bool AuthorGone { get; set; }//its remote author deleted their account: kept, but hidden everywhere (VisibilityPolicy)
+		// the staff's moderation (completion program R6, Domain/Moderation/AccountModeration.cs), copied from the author so a
+		// query needs no join: suspended, it is hidden everywhere as AuthorGone is (until the suspension is lifted); limited
+		// (the author or its server silenced), it stays out of the public and hashtag timelines, trends, search and the
+		// relays, and its followers still get it. A banned login's personas are never flagged (that would pair them):
+		// Restrictions treats them as suspended when posts are read.
+		public bool AuthorSuspended { get; set; }
+		public bool AuthorLimited { get; set; }
+		public DateTime? ModeratedAt { get; set; }//a remote copy the staff took down: kept, hidden everywhere, never fetched again
 
 		public bool IsFederatedCopy { get; set; }
 		public string ObjectURI { get; set; }//the Note's id

PrivaPub/Models/Social/Notification.cs

@@ -13,6 +13,10 @@ namespace PrivaPub.Models.Social
 		public string Emoji { get; set; }//a reaction's emoji
 		public string EmojiURL { get; set; }
 		public string Text { get; set; }//a moderation warning's reason
+		[MongoDB.Bson.Serialization.Attributes.BsonIgnoreIfNull]
+		public string WarningAction { get; set; }//a warning from this server's staff: Mastodon's AccountWarning action (silence, suspend, delete_statuses)
+		[MongoDB.Bson.Serialization.Attributes.BsonIgnoreIfNull]
+		public List<string> StatusIds { get; set; }//the posts a warning is about, when more than PostId
 		public bool IsRead { get; set; }
 		public bool Filtered { get; set; }//held back by the persona's notification policy, in a NotificationRequest
 		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;

PrivaPub/Models/Social/Relationships.cs

@@ -77,6 +77,8 @@ namespace PrivaPub.Models.Social
 		public bool Forwarded { get; set; }
 		public bool IsResolved { get; set; }
 		public string ResolvedBy { get; set; }
+		public string Resolution { get; set; }//what the staff did when resolving it (R6): none, silence, suspend, remove_posts
+		public string ResolutionNote { get; set; }
 		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime? ResolvedAt { get; set; }
 		public DateTime? RemoteResolvedAt { get; set; }//the server holding the reported content says it dealt with it (Lemmy's Resolve{Flag})

PrivaPub/Models/User/RootUser.cs

@@ -25,15 +25,45 @@ namespace PrivaPub.Models.User
 		public RootTotp Totp { get; set; }//two-factor sign-in, when the login set it up (Services/TwoFactor.cs)
 
 		/// <summary>An administrator is a moderator too (IsAdminPolicy asks for both); otherwise a plain user.</summary>
-		public void SetAdmin(bool admin)
+		public void SetAdmin(bool admin) => SetRole(admin ? RootRole.Admin : RootRole.User);
+
+		/// <summary>The login's role, as its policies say it: every login is a user, a moderator is one too, and an
+		/// administrator is all three.</summary>
+		public void SetRole(RootRole role)
 		{
 			Policies.RemoveAll(p => p is ClientModels.Policies.IsAdmin or ClientModels.Policies.IsModerator);
-			if (admin)
-				Policies.AddRange([ClientModels.Policies.IsAdmin, ClientModels.Policies.IsModerator]);
+			if (role is RootRole.Moderator or RootRole.Admin)
+				Policies.Add(ClientModels.Policies.IsModerator);
+			if (role == RootRole.Admin)
+				Policies.Add(ClientModels.Policies.IsAdmin);
 			if (!Policies.Contains(ClientModels.Policies.IsUser))
 				Policies.Add(ClientModels.Policies.IsUser);
 			UpdatedAt = DateTime.UtcNow;
 		}
+
+		public RootRole Role => Policies.Contains(ClientModels.Policies.IsAdmin) ? RootRole.Admin
+			: Policies.Contains(ClientModels.Policies.IsModerator) ? RootRole.Moderator
+			: RootRole.User;
+
+		public static bool TryParseRole(string value, out RootRole role)
+		{
+			role = value?.Trim().ToLowerInvariant() switch
+			{
+				"user" => RootRole.User,
+				"moderator" => RootRole.Moderator,
+				"admin" or "administrator" => RootRole.Admin,
+				_ => (RootRole)(-1)
+			};
+			return Enum.IsDefined(role);
+		}
+	}
+
+	// never stored: a login's role lives in its Policies
+	public enum RootRole
+	{
+		User,
+		Moderator,
+		Admin
 	}
 
 	// TOTP (RFC 6238: 30 s, 6 digits, SHA-1, as every authenticator app reads it). PendingSecret waits for its first code;