Only publish blocks that are still in force

ipblock_registered and domain_blocked only ever meant "we posted this
block once" — they said nothing about whether it still exists. When the
API went live it was publishing 24 /32 ranges that had been removed by
hand on 2026-07-21, so ~17% of the IP list didn't block anything. That's
a bad thing to hand another admin an importer for.

app/reconcile_blocks.py fetches Mastodon's live Admin::IpBlock and
Admin::EmailDomainBlock lists and maintains a new block_active column on
both tables: off for rows whose block is gone or whose expires_at has
elapsed, back on for any that reappear. The API serves only active rows.
Re-registering a block reactivates its row, so a range the bot blocks
again after a manual cleanup comes back on its own.

A failed fetch changes nothing — not a 403 from a missing scope, not
Mastodon being down, not a half-failure where one list answers and the
other doesn't. An outage must never be read as "every block was
removed"; the list degrades to over-reporting rather than emptying
itself, and there's a test for each of those paths.

Needs admin:read:ip_blocks + admin:read:email_domain_blocks, added to
the live token in place (scopes updated on the existing Doorkeeper
token, matched by digest) rather than by minting and rotating, so the
token value is unchanged and .env needed no edit.

app/main.py

@@ -301,6 +301,8 @@ def _init_db() -> None:
             "  flagged    INTEGER,"
             "  ipblock_registered INTEGER DEFAULT 0,"
             "  block_cidr TEXT,"
+            "  block_active INTEGER DEFAULT 1,"
+            "  block_checked_at TEXT,"
             "  classified_at TEXT DEFAULT CURRENT_TIMESTAMP"
             ")"
         )
@@ -312,6 +314,18 @@ def _init_db() -> None:
         # ASN route CIDR only started 2026-07-15.
         if not _column_exists(conn, "signup_ip", "block_cidr"):
             conn.execute("ALTER TABLE signup_ip ADD COLUMN block_cidr TEXT")
+        # block_active tracks whether the block we registered is STILL present
+        # on the Mastodon side. ipblock_registered only ever meant "we posted
+        # it once"; a moderator clearing blocks by hand (as happened to 24
+        # rows on 2026-07-21) or an expires_at elapsing would leave us
+        # publishing entries that no longer block anything. Maintained by
+        # app/reconcile_blocks.py; rows default to active until it says
+        # otherwise, so a reconcile that never runs degrades to the old
+        # behaviour rather than emptying the list.
+        if not _column_exists(conn, "signup_ip", "block_active"):
+            conn.execute("ALTER TABLE signup_ip ADD COLUMN block_active INTEGER DEFAULT 1")
+        if not _column_exists(conn, "signup_ip", "block_checked_at"):
+            conn.execute("ALTER TABLE signup_ip ADD COLUMN block_checked_at TEXT")
         conn.execute(
             "CREATE TABLE IF NOT EXISTS ipapi_range_cache ("
             "  family        INTEGER NOT NULL,"  # 4 or 6
@@ -337,9 +351,15 @@ def _init_db() -> None:
             "  risk       INTEGER,"
             "  flagged    INTEGER,"
             "  domain_blocked INTEGER DEFAULT 0,"
+            "  block_active INTEGER DEFAULT 1,"
+            "  block_checked_at TEXT,"
             "  classified_at TEXT DEFAULT CURRENT_TIMESTAMP"
             ")"
         )
+        if not _column_exists(conn, "signup_email", "block_active"):
+            conn.execute("ALTER TABLE signup_email ADD COLUMN block_active INTEGER DEFAULT 1")
+        if not _column_exists(conn, "signup_email", "block_checked_at"):
+            conn.execute("ALTER TABLE signup_email ADD COLUMN block_checked_at TEXT")
         conn.execute(
             "CREATE TABLE IF NOT EXISTS check_mail_cache ("
             "  domain     TEXT PRIMARY KEY,"
@@ -431,9 +451,12 @@ def get_signup_flag(account_id: str) -> bool:
 
 
 def mark_ipblock_registered(account_id: str) -> None:
+    # block_active is reset too: if this range was reconciled away earlier and
+    # we've just registered it again, it is live again.
     with _db() as conn:
         conn.execute(
-            "UPDATE signup_ip SET ipblock_registered = 1 WHERE account_id = ?",
+            "UPDATE signup_ip SET ipblock_registered = 1, block_active = 1 "
+            "WHERE account_id = ?",
             (account_id,),
         )
 
@@ -528,7 +551,8 @@ def get_signup_email(account_id: str) -> tuple[str, bool]:
 def mark_email_domain_blocked(account_id: str) -> None:
     with _db() as conn:
         conn.execute(
-            "UPDATE signup_email SET domain_blocked = 1 WHERE account_id = ?",
+            "UPDATE signup_email SET domain_blocked = 1, block_active = 1 "
+            "WHERE account_id = ?",
             (account_id,),
         )
 
@@ -579,8 +603,10 @@ def _fallback_cidr(ip: str) -> str:
 
 
 def blocked_ip_ranges(limit: int = 0) -> list[dict]:
-    """Every network this bot has registered an Admin::IpBlock for, newest
-    first, collapsed to one entry per distinct CIDR.
+    """Every network this bot has registered an Admin::IpBlock for that is
+    still present on the Mastodon side, newest first, collapsed to one entry
+    per distinct CIDR. Rows the reconcile pass found gone or expired are
+    excluded — see app/reconcile_blocks.py.
 
     Repeat signups out of the same range are common (that's the point of
     blocking the range rather than the address), so entries carry a `signups`
@@ -596,7 +622,7 @@ def blocked_ip_ranges(limit: int = 0) -> list[dict]:
     with _db() as conn:
         rows = conn.execute(
             "SELECT block_cidr, ip, classified_at "
-            "FROM signup_ip WHERE ipblock_registered = 1 "
+            "FROM signup_ip WHERE ipblock_registered = 1 AND block_active = 1 "
             "ORDER BY classified_at DESC"
         ).fetchall()
 
@@ -622,8 +648,9 @@ def blocked_ip_ranges(limit: int = 0) -> list[dict]:
 
 
 def blocked_email_domains(limit: int = 0) -> list[dict]:
-    """Every domain this bot has registered an Admin::EmailDomainBlock for,
-    newest first, one entry per distinct domain.
+    """Every domain this bot has registered an Admin::EmailDomainBlock for
+    that is still present on the Mastodon side, newest first, one entry per
+    distinct domain. See app/reconcile_blocks.py.
 
     Domains only — the bot never stores or forwards a full signup address (see
     classify_email_domain), so there is none to expose here.
@@ -635,7 +662,7 @@ def blocked_email_domains(limit: int = 0) -> list[dict]:
     with _db() as conn:
         rows = conn.execute(
             "SELECT domain, classified_at "
-            "FROM signup_email WHERE domain_blocked = 1 "
+            "FROM signup_email WHERE domain_blocked = 1 AND block_active = 1 "
             "ORDER BY classified_at DESC"
         ).fetchall()