Minimum moderation surface to launch annotations safely

[vdvman1]

Question

What is the smallest moderation surface that makes launching public annotations safe?

Not a moderation system — the floor. The map explicitly rules a full moderation system out of scope; this ticket decides what cannot be skipped.

Settled going in: annotations are public by default and visible immediately. Gating writes on MCC Discord guild membership means much of the moderation has effectively already happened upstream. Promoting a correction to inline requires an elevated Discord role, and even then it renders as a visible community edit — so the highest-risk action is already gated. Resolved threads hide by default.

Decide:

• Reporting. Is there a report button at launch, and where does a report go — a Convex table, a Discord channel via the bot, a GitHub issue?
• Removal. Who can delete or hide an annotation, and is removal soft or hard? Public permanent content plus a solo maintainer argues for soft.
• Ban propagation. What happens to the existing annotations of someone banned from the Discord — hidden, attributed to a tombstone, left alone?
• Rate limiting. Is any needed at launch given the guild-membership gate, or is that deferred to the fog?
• Audit trail. Is there a record of moderation actions, and does it need to be visible?
• The maintainer's inbox. What must a maintainer actually look at, and how often? An answer that only works with a full-time moderator is the wrong answer.

State plainly what is deliberately not being built and what risk that accepts. Blocked on the annotation schema and the auth stack.

[vdvman1]

Constraint from #34 (better-auth on Convex research).

Relevant to this ticket's "ban propagation" and "how quickly a Discord ban takes effect" questions:

• Convex identity comes from a JWT with a 15-minute lifetime. ctx.auth.getUserIdentity() trusts it without checking the session, so a revoked session stays usable for up to 15 minutes. authComponent.getAuthUser(ctx) does a real session-table lookup and does not have that lag. Annotation write paths should use the latter if "a Discord ban takes effect quickly" is a requirement.
• Discord roles are only a sign-in snapshot — there is no push path Convex can host. Live ban propagation therefore depends entirely on commanderbot-py pushing events (Add Discord role and ban lookup to commanderbot-py #45). If that integration is deferred, ban enforcement degrades to "at next sign-in", which this ticket should either accept explicitly or reject.