Pause suspended Reddit accounts

docs/architecture.md

@@ -68,6 +68,7 @@ SIGINT/SIGTERM abort shared loops, stop account runtimes, stop the web server, c
 - posts, messages, outcomes, activity, outbox, and conversation state repositories;
 - growth settings, community list, comment history, adaptive comment allowance, and isolated browsing policy/audit with optional submitted-vote state;
 - Matrix chat cache and sync cursor;
+- durable account suspension state; a Matrix `M_FORBIDDEN` or the periodic owned-profile check pauses only the affected runtime;
 - media index and files;
 - rate limiter and invitation cooldown;
 - response checker and conversation automation;

docs/data-flow.md

@@ -46,6 +46,8 @@ An account is eligible for new outreach only when its runtime is running, both i
 
 Matrix cooldowns retain the operation that triggered them. A room-creation or invitation limit pauses new outreach but does not suppress replies in existing rooms; a limit returned while sending into an existing room pauses those sends as well.
 
+An account-level Matrix `M_FORBIDDEN` is distinct from a room-level 403: it is treated as a definitive suspension signal. The account is durably marked suspended, its runtime is halted, and its historical content remains readable. Independently, every active account periodically reads its own Reddit profile; an explicit suspended profile result takes the same path. Missing profiles, network errors, and rate limits are not suspension evidence and do not pause an account.
+
 The operator can manually clear the unsent funnel from the authenticated dashboard. The repository atomically moves discovered, screening, ready, and retryable candidates to a terminal rejection with the reason `Cleared manually by operator`, releases their leases, and retains the audit rows so those candidates are not rediscovered. A `sending` lease is never changed because its remote Matrix outcome may already be in flight. Clearing does not change bot mode; running discovery may refill the funnel immediately.
 
 The same surface supports individual cancellation and prepared-message editing. Individual cancellation uses the same terminal audit transition and refuses `sending` or completed rows. Editing is limited to `ready` and `retryable` candidates with a preparation snapshot; it atomically replaces only the opener, clears generated strategy/experiment selection metadata, labels the model attribution `operator-edited`, and re-runs the deterministic outbound location/meeting safeguard. Both operations return HTTP 409 when a stale dashboard loses a race to dispatch.

docs/database.md

@@ -10,7 +10,7 @@ The application uses one `better-sqlite3` database, normally `data/reddit-bot.db
 
 ### Account registry and account content
 
-- `reddit_accounts`: verified Reddit/Matrix identity, encrypted-at-rest only to the degree provided by the host/volume, cookie JSON, Matrix credentials, active/status timestamps.
+- `reddit_accounts`: verified Reddit/Matrix identity, encrypted-at-rest only to the degree provided by the host/volume, cookie JSON, Matrix credentials, active/status timestamps. A confirmed suspension sets `status` to `suspended` and disables the account while retaining credentials and historical content for review.
 - `reddit_conversations`: account-scoped cached Matrix conversation payloads.
 - `reddit_account_sync_state`: account-scoped sync cursor, full/delta timestamps, and invitation cooldown.
 - `reddit_recipient_account_status`: process-global, case-insensitive recipient username status (`active`, `suspended`, or `deleted`) and last confirmed check time.

docs/services.md

@@ -13,6 +13,7 @@ This is an ownership map, not an API dump. Read the owning implementation and te
 | `services/reddit-account-runtime-builder.ts` | Concrete account dependency graph and account loop | Account-specific browser, Matrix, repos, limiter, automation, chat, and media live here. |
 | `services/account-runtime-event-wiring.ts` | Per-account chat-to-realtime event bridge | Every account runtime publishes reply, media, and sync events into the shared dashboard/push stream; sync IDs remain account-scoped. |
 | `services/reddit-accounts.ts` | Account import/activation orchestration | Verification must bind Reddit cookies and Matrix identity before activation. |
+| `services/account-suspension.ts` | Owned-account suspension monitor | A definitive Matrix `M_FORBIDDEN` or Reddit suspended-profile result durably pauses only that account. |
 | `services/account-auth-context.ts` | Current verified identity snapshot | Account work pauses unless both sides authenticate. |
 | `services/session-bound-runtime.ts` | Legacy auth-bound background lifecycle | Prevents background work while logged out. |