purge: skip broadcasts of deleted authors, purge outbox log, guards, 410 inbox test

crates/bootstrap/tests/bootstrap_test.rs

@@ -300,3 +300,32 @@ async fn actor_document_for_a_tombstone_is_gone() {
     .await;
     assert_eq!(status, 404, "the classic profile page stays 404");
 }
+
+/// Remote servers posting to a deleted account's inbox are told it is gone,
+/// before any signature check.
+#[cfg(feature = "federation")]
+#[tokio::test]
+async fn posting_to_a_tombstones_inbox_is_gone() {
+    let (router, pool) = support::server().await;
+    let alice = support::register(&router, "alice", "alice@example.com").await;
+    let post = |path: String| {
+        axum::http::Request::builder()
+            .method("POST")
+            .uri(path)
+            .header("content-type", "application/activity+json")
+            .body(axum::body::Body::from("{}"))
+            .unwrap()
+    };
+    let path = format!("/users/{}/inbox", alice.user_id);
+    let (live, _, _) = support::send(&router, post(path.clone())).await;
+    assert_ne!(live, 410, "a live user's inbox is not gone");
+
+    sqlx::query("UPDATE users SET deleted_at = '2026-01-01T00:00:00Z' WHERE id = ?")
+        .bind(&alice.user_id)
+        .execute(&pool)
+        .await
+        .unwrap();
+
+    let (status, _, body) = support::send(&router, post(path)).await;
+    assert_eq!(status, 410, "{body}");
+}