The crew moderates in real time: every chat message is checked by a moderator agent, which hides abuse and tells the admin #15

Goal (owner, 2026-10-20): complete, secure, public control of the real arm from the public forge URL, with a moderated community. Simple and amazing to use; every knob the owner might want is an admin setting.

Milestone 2. After the word filter, each message is also sent (asynchronously, never delaying the chat more than ~1 s) to a moderation model with the room's rules (admin setting: the rules text). Verdict ok / hide / mute-suggest. hide: removed for everyone and logged as "hidden by the crew" on /admin with Restore; mute-suggest: shown to admins as one click. Rate- and cost-limited (admin setting: on/off, max messages per minute checked); if the model is unavailable, the chat keeps working with the word filter only. Owner mentioned routing messages to "jev" - confirm with the steward which crew member/model that is before wiring; until then use the forge's default model. Tests with a fake model: hide removes and logs; outage leaves the chat working; cost cap holds.