The punitive surface

One door

In the entire SafeMeet codebase, exactly one code path is able to restrict a user. Every gate that checks "is this person banned?" imports the same single predicate; nothing else is allowed to invent its own.

This is not an accident of tidy code — it's an enforced invariant. When there is one door, you can audit the door. When every feature can improvise its own punishment, you audit forever and still miss one.

Failure is asymmetric on purpose

Two families of safety mechanisms, two opposite failure modes:

Rate limits here are soft throttles that shape load. If the counter infrastructure is down, they wave traffic through — a legitimate user being locked out by our outage is a worse failure than a spammer getting a burst. Actual sanctions live in the durable database and stay enforced regardless.

The asymmetry is the philosophy in one table: when a safety mechanism fails, it must fail in whichever direction protects users rather than punishes them.

The panic button punishes no one

Panic instantly ends the conversation for you. It does not sanction the other person. A panic press is evidence of your distress, not proof of their guilt — conflating the two would turn an escape hatch into a weapon.

Reporting is separate, deliberate, and evaluated on content.

Saying you're struggling is never punished

The self-harm policy has a sharp directional edge:

• Disclosing your own struggle → you get crisis resources, gently, and no enforcement of any kind. Reaching out is never a violation.
• Encouraging someone else's self-harm → the instant filter blocks “kill yourself” and “kys” before delivery. The AI check scores other encouragement, and in our evals it is flagged: a flagged text is delivered with a safety notice to its sender, and one the check scores high enough to block is withheld.

Same topic, opposite directions, opposite outcomes. Systems that keyword-match "self-harm" and punish both directions teach vulnerable people to stay silent.

Reports need distinct humans, and a false ban is a top-severity bug

One angry person filing five reports is one report. Temporary bans require multiple distinct reporters, adjudicated by AI — there is no human review queue, and we say so openly rather than pretending a moderator read your case.

Internally, a false-positive ban is ranked with the same severity as a missed predator. Not "regrettable" — equal severity. That single ranking decision shapes more of the system's design than any feature does.

Reports, reputation and appeals

An AI judges a report, not a person, and one report is not enough to restrict anyone: a temporary ban needs several different reporters. An upheld report can lower the reported account's internal reputation slightly, which affects matching only and is never shown to anyone, and a panic report counts toward neither a ban nor reputation. Appeals are decided the same way, and an accepted appeal withdraws the reputation effect of the reports it contested. The whole path, step by step, is in what happens when you report someone.