Moderation

A receipt has a moderation status — published, pending, or removed — and separately a credibility. Collapsing them into a single status makes a published-but-doubted receipt unrepresentable, and that is the state most receipts are actually in.

• A receipt flips to contested on its own past a downvote threshold. No moderator needed to register doubt.
• Rate limits are enforced in the database, not in the app: three receipts, sixty votes and five reports per account per day. They hold regardless of which client is talking to us.
• Double-voting is structurally impossible — one vote per account per receipt, enforced by the primary key.
• Transaction signatures are checked against the chain. A signature that does not exist, or does not touch the mint or wallet the receipt claims, does not get the verified mark.

• Set credibility
• Remove a receipt or a response, with a reason on the record
• Ban an account
• Merge duplicate profiles
• Create and edit tracked profiles

Every one of those appends to an append-only moderation log: who, what, when, and the detail. There is no silent edit and no silent delete.

No appeals workflow, no roles matrix, no automod, no reputation-weighted voting. A small honest queue beats a large ceremonial one. If something breaks twice, it gets a process.

Report something on any receipt, or read the takedown policy.