The admin CLI moves a persona to another login and deletes a login; the deploy no longer signs in

The owner took @thepra, which the deploy had made and kept under its own login deploy-smoke for its signed-in check, for
the administrator's login (owner decision 2026-10-17). No persona could change login, so:
- admin move-persona <persona> <root> re-points the persona's link first, so the old login can no longer exchange a token
  for it, then ends its Mastodon tokens and authorizations. Its actor, posts and followers stay; nobody outside is told,
  since nothing they hold changes.
- admin delete-root <root> deletes a login as the client deletes its own (RootRemoval): every persona it still has goes
  with it, announced deleted, and its sessions end.
- admin smoke and the deploy's signed-in step are gone, since the step would make deploy-smoke again and fail to make
  @thepra under it. The deploy keeps its anonymous checks; tools/smoke/oauth.sh stays for the pasture's privapub_token.

Tests: move-persona (the persona listed under its new login only, its old token refused, unknown persona or login exit 1)
and delete-root (the login and its persona deleted, the login refused); the whole suite passes (963).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

PrivaPub.Tests/Infrastructure/AdminCommandsTests.cs

@@ -121,27 +121,55 @@ namespace PrivaPub.Tests.Infrastructure
 			Assert.Contains(Policies.IsAdmin, stored.Policies);
 		}
 
+		async Task<List<string>> PersonaIds(Root root)
+		{
+			using var client = _host.As(root.Jwt);
+			return (await (await client.GetAsync("/clientapi/avatar/private/list", TestContext.Current.CancellationToken)).JsonItems())
+				.Select(a => a!["id"]!.GetValue<string>()).ToList();
+		}
+
+		async Task<HttpStatusCode> VerifyCredentials(string mastodonToken)
+		{
+			using var client = _host.As(mastodonToken);
+			return (await client.GetAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken)).StatusCode;
+		}
+
 		[Fact]
-		public async Task Smoke_keeps_one_undiscoverable_persona_and_a_new_password_each_run()
+		public async Task Move_persona_gives_a_persona_to_another_login_and_ends_its_tokens()
 		{
 			using var scope = _host.Services.CreateScope();
-			var persona = $"smoke{Guid.NewGuid():N}"[..20];
-			var first = new StringWriter();
-			var second = new StringWriter();
+			var giver = await _host.SignUp("giver");
+			var taker = await _host.SignUp("taker");
+			var persona = await _host.Persona(giver, "moved");
+			var token = await _host.MastodonToken(persona);
+			Assert.Equal(HttpStatusCode.OK, await VerifyCredentials(token));
 
-			Assert.Equal(0, await AdminCommands.Run(new[] { "smoke", persona }, scope.ServiceProvider, output: first));
-			Assert.Equal(0, await AdminCommands.Run(new[] { "smoke", persona }, scope.ServiceProvider, output: second));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "move-persona", "@" + persona.UserName, taker.UserName.ToUpperInvariant() }, scope.ServiceProvider, output: new StringWriter()));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "move-persona", persona.UserName, taker.UserName }, scope.ServiceProvider, output: new StringWriter()));
 
-			var (login, oldPassword) = (first.ToString().Trim().Split(' ')[0], first.ToString().Trim().Split(' ')[1]);
-			var newPassword = second.ToString().Trim().Split(' ')[1];
-			Assert.Equal(AdminCommands.SmokeLogin, login);
-			Assert.NotEqual(oldPassword, newPassword);
-			Assert.Equal(HttpStatusCode.OK, await LogIn(login, newPassword));
-			Assert.NotEqual(HttpStatusCode.OK, await LogIn(login, oldPassword));
-			var avatars = await DB.Default.Find<Avatar>().Match(a => a.UserName == persona).ExecuteAsync(TestContext.Current.CancellationToken);
-			var avatar = Assert.Single(avatars);
-			Assert.False(avatar.Settings.IsDiscoverable);
-			Assert.False(avatar.Settings.IsIndexable);
+			Assert.Equal(HttpStatusCode.Unauthorized, await VerifyCredentials(token));
+			Assert.DoesNotContain(persona.Id, await PersonaIds(giver));
+			Assert.Contains(persona.Id, await PersonaIds(taker));
+			Assert.Equal(1, await AdminCommands.Run(new[] { "move-persona", $"nobody{Guid.NewGuid():N}"[..20], taker.UserName }, scope.ServiceProvider));
+			Assert.Equal(1, await AdminCommands.Run(new[] { "move-persona", persona.UserName, $"nobody{Guid.NewGuid():N}" }, scope.ServiceProvider));
+		}
+
+		[Fact]
+		public async Task Delete_root_deletes_a_login_with_the_personas_it_still_has()
+		{
+			var cancellation = TestContext.Current.CancellationToken;
+			using var scope = _host.Services.CreateScope();
+			var root = await _host.SignUp("leaving");
+			var persona = await _host.Persona(root, "leaving");
+			var output = new StringWriter();
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "delete-root", root.UserName }, scope.ServiceProvider, output: output));
+			Assert.Equal(1, await AdminCommands.Run(new[] { "delete-root", root.UserName }, scope.ServiceProvider, output: new StringWriter()));
+
+			Assert.Contains("@" + persona.UserName, output.ToString());
+			Assert.NotEqual(HttpStatusCode.OK, await LogIn(root.UserName, root.Password));
+			Assert.NotNull((await DB.Default.Find<RootUser>().OneAsync(root.Id, cancellation)).DeletedAt);
+			Assert.NotNull((await DB.Default.Find<Avatar>().OneAsync(persona.Id, cancellation)).DeletionAt);
 		}
 	}
 }