Levels and limits

They answer genuinely different questions, so collapsing them into a single score would throw away the distinction that makes any of it useful. Somebody can be trusted with the site and know nothing about topology; somebody can be excellent at topology and new here.

An earlier sketch had a single ladder whose top rung was “your moderation takes effect immediately”. That does not survive connecting a university’s student register. Granting the top rung to every verified member would hand tens of thousands of people a one-click delete button, and an appeal panel of “peers at or above the person who acted” would then mean everybody — which is no panel at all.

So the two were split. A university can vouch that you are a real, enrolled person; that is an identity claim. It is not evidence of judgement about somebody else’s work, and it is never treated as such.

Cumulative: each tier keeps everything the ones below it grant. Reached either by earning REP or, for a member of a connected university, immediately.

Never granted by identity, never by a university connection, never by your capability tier. Only ever earned, and only ever granted by somebody already above you.

Immediate, unqueued effect belongs to M3 and above only. That one rule is what keeps appeals meaningful once a capability tier is being handed out in bulk.

Authority is also capped by competence: an M2 may only act in fields where their own SKILL is C or better. Otherwise somebody with authority can delete specialist work they have no ability to judge, which is exactly the failure the skill axis exists to prevent.

Keyed to the REP you actually earned — not to the tier you hold. This is where the two ladders visibly pay off.

A newly verified first-year holds the top capability tier — they may upload, link, review and comment freely, which is what trusting a real student ought to mean — while their vote still weighs nothing until they have a record. Without that split, one fresher could hide anything on the site on their first afternoon.

Hiding content takes 16 points of weighted downvote, and the content must also have been put in the queue by somebody at M1 or above. It is a consensus of people who have built standing, not a single click.

Connecting a university account grants the top tier at once, because the university’s own register is a far stronger claim than anything the steps below approximate. Everybody else earns it. EdMat is a public study resource, not one university’s intranet: a graduate, a student somewhere else, or somebody revising alone must still have a real way in.

Affiliation lapses. Students graduate and staff leave, so a tier granted once and never re-checked becomes a permanent grant to somebody the university no longer knows. Re-verification runs on a schedule, and when it lapses you fall back to the tier you EARNED rather than dropping to read-only — somebody who contributed for three years should not be demoted for graduating.

Energy is the rate limit that scales with standing instead of with your IP address. Voting is free on purpose: making people pay to express an opinion would bias the vote toward whoever has energy to spare.

Votes alone can earn you at most 50 REP a day. Without that cap a coordinated group could farm somebody up the ladder in an afternoon.

• You promote at the threshold but only demote at 80% of it. Reach 200 for tier B and you keep B until you fall below 160 — otherwise anybody sitting on a boundary changes tier daily.
• Seven days minimum at a tier before you can promote again, so a single burst of activity cannot vault a new account to A. Moving from E to D is exempt: it should follow email confirmation straight away.
• Inactivity costs 2% of your REP a month, floored at the bottom of your current tier. It applies to REP only, never to SKILL — standing lapses, knowledge does not.
• Every change writes a record: who, from what, to what, why, and when. A level must never change silently.
• F is never automatic. Suspension takes a real moderation decision and never a REP threshold, because auto-suspending on negative REP is the easiest thing in this design to weaponise by brigading somebody.

Immediate, unreviewable removal by one person is the most dangerous thing here. It is confined to M3 and above, but it still has to be answerable, so every hide and every immediate action writes an appealable record.

• An appeal convenes peers at or above the mod level the person actually used — not their capability tier, which after a university connection says nothing about judgement — excluding both the person who acted and the author. Three of them for an ordinary hide, five for an immediate action by an M3 or above.
• Upheld, and the person who acted gains 15 REP.
• Overturned, and they lose REP scaled by the authority they used: 20 at M1, 60 at M2, 160 at M3, 250 at M4. The more power you used, the more being wrong costs.
• Three overturns in 90 days costs one mod level. It can be earned back.
• Demotion never touches your capability tier. Being wrong about somebody else’s work is not evidence that you can no longer be trusted with your own, and conflating the two would make every moderator quietly reluctant to make a call.
• Panel members who vote against the panel’s own eventual conclusion take a small penalty, so sitting on a panel is not a free rubber stamp.

Everything above is a design. This section describes the code as it stands, and is the only part of this page that claims to describe the present.

• Moderation is a single staff flag, plus field- and branch-scoped governors. There is nothing between “nothing” and “everything”.
• One contributor flag stands in for the whole capability tier.
• There is no REP, no SKILL and no ENERGY. Nothing is metered per action, and no level exists to be shown to you.
• What does limit you is a plain rate limit on the address you are coming from, or on the account you are using.

These are counted per server process, so on a multi-process deployment each worker keeps its own tally and the real limit is higher than the number above. Correct for the single-process prototype this currently is; a shared cache is needed before the figures mean exactly what they say.