T8: inbox gaps, jobs, migrations and pages; a deleted remote account's posts are hidden

Owner decision (2026-10-03, "A remote account deletes itself"): its posts are kept but
hidden everywhere.
- Post.AuthorGone (additive bool). DeleteHandler's actor-delete branch sets it on every
  post whose ActorURI is the actor (one update-many), besides dropping its follows and
  timeline rows as before. RemotePosts.Build sets it on a post stored later for an
  account already marked Deleted.
- One rule in VisibilityPolicy: IsShown (not deleted, author not gone), IsPublic and
  CanSee exclude AuthorGone, plus Shown(post) for loaded posts.
- Lookups by id answer 404 through CanSee (statuses/:id and every sub-route, context,
  bookmarks, favourites, polls, reactions, search); provenance, account statuses,
  home/public/tag timelines, notifications, conversations, reblogged_by, the clientapi
  home and post/DM lists, a community's outbox and our Announces filter on IsShown or
  IsPublic; the Mastodon mapper never renders a hidden post or a boost of one.

Tests (30 new):
- AuthorGoneTests: the rule, the handler (posts kept, boosts included, follows and rows
  gone), a post fetched after the delete, and 20 Mastodon/ActivityPub lookups over HTTP
  seen before and hidden after.
- InboxGapTests: actor Update refresh (name, sanitised summary, key rotation in place
  and to a new key id) even with an older `updated`; Undo{Follow} by activity id and by
  object; Reject of our QuoteRequest (and a stranger's ignored); group-wrapped
  Announce{Like} and Announce{Undo{Like}}; a locked persona's pending follow,
  FollowRequest notification, and Decide accepting and rejecting with the original Follow.
- JobHandlerTests: AncestorsJobHandler up to its depth limit; PollRefreshJob and
  PollCloseJob (local and remote polls); InstanceDescriber from a peer's NodeInfo and
  the weekly dedupe through ObjectRecords; LinkPreviews for public posts only;
  DeliveryJobHandler outcomes (2xx, 404/410, 429/503 with Retry-After in seconds and as
  a date, 5xx) and a signature and Digest the peer can verify; MediaJanitor.Sweep;
  OAuthPruner.Prune.
- MigrationTests: _003, _004, _006 and _007 on seeded rows.
- PublicPagesTests: /@user and /@user/{id} (visibility, junk ids, exact CSP,
  Referrer-Policy and nosniff), circle 404, community page, the instance actor,
  ActivityPub redirects, and markup escaped in posts, titles and bios.

Production changes besides the rule:
- LinkPreviews.Handle re-checks that a post is still shown and public (the rule
  Wanted applies) before fetching anything; before, only enqueueing checked it.
- The legacy /clientapi post and DM lists no longer return soft-deleted posts.
- MediaJanitor.Sweep and OAuthPruner.Prune are the loop bodies, now public and tested.
- InstanceDescriber.Address: a protected virtual identity seam so a test can point
  the https NodeInfo addresses at a plain-http peer; production behaviour unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

PrivaPub/Domain/Content/LinkPreviews.cs

@@ -6,6 +6,7 @@ using MongoDB.Entities;
 
 using PrivaPub.Infrastructure.Statistics;
 using PrivaPub.Models.Statistics;
+using PrivaPub.Domain.Privacy;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Objects;
 using PrivaPub.Infrastructure.Http;
@@ -68,8 +69,7 @@ namespace PrivaPub.Domain.Content
 
 		public async Task Wanted(PostEntity post, CancellationToken token)
 		{
-			if (!_options.CurrentValue.FetchLinkPreviews || post.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted) || post.IsLocalOnly
-				|| post.ReblogOfPostId != default || post.Link?.Title != default || post.Link == default && post.Media.Count > 0)
+			if (!_options.CurrentValue.FetchLinkPreviews || !Previewable(post) || post.Link == default && post.Media.Count > 0)
 				return;
 			var url = post.Link?.Href ?? FirstLink(post, _localActors.BaseAddress);
 			if (url == default)
@@ -87,7 +87,7 @@ namespace PrivaPub.Domain.Content
 		public async Task<JobOutcome> Handle(Job job, CancellationToken token)
 		{
 			var post = await _dbEntities.Posts.MatchID(job.Payload).ExecuteFirstAsync(token);
-			if (post == default || post.DeletedAt.HasValue || post.Link?.Title != default)
+			if (!VisibilityPolicy.Shown(post) || !Previewable(post))
 				return JobOutcome.Done;
 			var url = post.Link?.Href ?? FirstLink(post, _localActors.BaseAddress);
 			if (url == default)
@@ -135,6 +135,10 @@ namespace PrivaPub.Domain.Content
 			return preview;
 		}
 
+		//only public posts (owner decision 1), checked again when the job runs; never a boost or a post whose card is complete
+		static bool Previewable(PostEntity post) => post.Visibility is (PostVisibility.Public or PostVisibility.Unlisted) && !post.IsLocalOnly
+			&& post.ReblogOfPostId == default && post.Link?.Title == default;
+
 		public static LinkPreview Read(string url, Uri finalUri, string html)
 		{
 			var document = Parser.ParseDocument(html);

PrivaPub/Domain/Media/MediaProxy.cs

@@ -144,10 +144,7 @@ namespace PrivaPub.Domain.Media
 				try
 				{
 					await Task.Delay(Interval, stoppingToken);
-					var cutoff = DateTime.UtcNow - UnattachedLifetime;
-					foreach (var stale in await DB.Default.Find<MediaAttachment>().Match(m => m.PostId == null && m.CreatedAt < cutoff).Limit(500).ExecuteAsync(stoppingToken))
-						await _media.Delete(stale);
-					TrimProxyCache();
+					await Sweep(stoppingToken);
 				}
 				catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
 				{
@@ -160,6 +157,15 @@ namespace PrivaPub.Domain.Media
 			}
 		}
 
+		//one pass: uploads left unattached for a day go, then the proxy cache is trimmed to its size, oldest first
+		public async Task Sweep(CancellationToken token)
+		{
+			var cutoff = DateTime.UtcNow - UnattachedLifetime;
+			foreach (var stale in await DB.Default.Find<MediaAttachment>().Match(m => m.PostId == null && m.CreatedAt < cutoff).Limit(500).ExecuteAsync(token))
+				await _media.Delete(stale);
+			TrimProxyCache();
+		}
+
 		void TrimProxyCache()
 		{
 			var directory = new DirectoryInfo(_media.ProxyRoot);

PrivaPub/Domain/Privacy/VisibilityPolicy.cs

@@ -11,14 +11,20 @@ namespace PrivaPub.Domain.Privacy
 {
 	public static class VisibilityPolicy
 	{
-		public static readonly Expression<Func<Post, bool>> IsPublic = p =>
-			!p.DeletedAt.HasValue && (p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted);
+		//neither deleted nor kept back after its remote author deleted their account (owner decision, 2026-10-03)
+		public static readonly Expression<Func<Post, bool>> IsShown = p => !p.DeletedAt.HasValue && !p.AuthorGone;
 
+		public static readonly Expression<Func<Post, bool>> IsPublic = p =>
+			!p.DeletedAt.HasValue && !p.AuthorGone && (p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted);
+
+		static readonly Func<Post, bool> IsShownCompiled = IsShown.Compile();
 		static readonly Func<Post, bool> IsPublicCompiled = IsPublic.Compile();
 
+		public static bool Shown(Post post) => post != default && IsShownCompiled(post);
+
 		public static async Task<bool> CanSee(Post post, string viewerAvatarId, CancellationToken token)
 		{
-			if (post == default || post.DeletedAt.HasValue)
+			if (!Shown(post))
 				return false;
 			if (IsPublicCompiled(post))
 				return true;

PrivaPub/Domain/Timelines/TimelineService.cs

@@ -5,6 +5,7 @@ using MongoDB.Entities;
 using PrivaPub.ClientModels;
 using PrivaPub.ClientModels.Post;
 using PrivaPub.ClientModels.Social;
+using PrivaPub.Domain.Privacy;
 using PrivaPub.Models.Post;
 using PrivaPub.Models.Social;
 using PrivaPub.Resources;
@@ -46,7 +47,7 @@ namespace PrivaPub.Domain.Timelines
 			var ids = entries.Select(e => e.PostId).Concat(entries.Where(e => e.ReblogOfPostId != default).Select(e => e.ReblogOfPostId)).Distinct().ToList();
 			var posts = ids.Count == 0
 				? new Dictionary<string, Post>()
-				: (await _dbEntities.Posts.Match(p => ids.Contains(p.ID) && !p.DeletedAt.HasValue).ExecuteAsync(token)).ToDictionary(p => p.ID);
+				: (await _dbEntities.Posts.Match(p => ids.Contains(p.ID)).Match(VisibilityPolicy.IsShown).ExecuteAsync(token)).ToDictionary(p => p.ID);
 
 			result.Data = entries
 				.Where(e => posts.ContainsKey(e.PostId) && (e.ReblogOfPostId == default || posts.ContainsKey(e.ReblogOfPostId)))