docs: the two settings the reference called broken now work

MEI-139 and MEI-140 landed after the reference that documented them as
defects, so three passages described bugs the code no longer has.

The first-post moderation warning and the promotion warning in the
organiser guide are removed outright — both said "does not currently",
and it now does. The groups reference kept its paragraph on the
no-demotion guard, rewritten to say what the guard does today: a group it
does not rank is not compared at all, so a rule into a group you made runs
normally, and a move between two ranked groups in the wrong direction is
still refused. The line worth keeping from it is that the guard was never
what protected staff — a member in a protected group is skipped before any
rank is considered.

Author: claude

docs/antispam.md

@@ -27,20 +27,10 @@ pre-authentication limits below.
 | Hidden-field trap | `antispam.honeypot` | On | Bots that fill every field | Nothing. Leave it on. |
 | Minimum fill time | `antispam.min_form_seconds` | 3 seconds | Instant submissions | Occasionally somebody with a password manager. Keep it to a few seconds. |
 | A question challenge | `antispam.captcha_mode` | Off | Scripted registration | A moment, every time. Switch it on when you have a problem. |
-| Hold a new member's first posts | `antispam.moderate_first_posts` | Off | Most forum spam — but see the warning below | One wait per genuine new member. |
+| Hold a new member's first posts | `antispam.moderate_first_posts` | Off | Most forum spam | One wait per genuine new member. |
 | Hourly limits | `antispam.*_per_hour` | Off | A night's work by one script | Nothing, set sensibly. |
 | The four pre-auth limits | see below | On | Signup floods, reset-mail bombing, password spraying | Nothing. |
 
-> [!WARNING]
-> **`antispam.moderate_first_posts` does not currently hold anything.**
-> The check asks the authorizer a per-forum question without naming a
-> forum; the error that follows is swallowed and the answer defaults to
-> *not held*, so an ordinary member's first posts go straight up whatever
-> the threshold says. Use the forum's own **Hold new threads / new
-> replies for approval** switches, or the per-group *requires approval*
-> rows in [the matrix](./forums.md#reading-the-matrix), until this is
-> fixed.
-
 ## The registration questions
 
 Set **Registration challenge** to *Ask a question* and `/admin/antispam`

docs/groups.md

@@ -213,15 +213,18 @@ primary group is Banned, Administrators or Super moderators are skipped
 whatever a rule says. A promoted member keeps every secondary membership
 they held.
 
-> [!IMPORTANT]
-> **The no-demotion guard reads a fixed table of group ranks**, and only
-> Guests, Registered, Super moderators and Administrators are in it.
-> Every other group — including one you made — ranks as `0`, so a rule
-> promoting members *out of Registered* into a group of your own is
-> passed over as a demotion and moves nobody. The preview runs the same
-> evaluation as the task, so it reports this honestly: if the preview
-> says nobody would be promoted by a rule you believe is right, this is
-> the reason.
+The no-demotion guard reads a fixed table of ranks holding Guests,
+Registered, Super moderators and Administrators. **A group it does not
+rank — including every group you make — is not compared at all**, so a
+rule promoting members out of Registered into one of your own groups runs
+normally. What the guard still refuses is a move between two groups it
+does rank, in the wrong direction. The protection that matters does not
+depend on the table anyway: a member whose primary group is Banned,
+Administrators or Super moderators is skipped before any rank is
+considered.
+
+The preview runs the same evaluation as the task, so it always reports
+what the run will do.
 
 **Run it** applies exactly what the preview lists, asks for your password
 again, and records the count in the admin log. Deleting the target group

docs/organiser-guide.md

@@ -345,14 +345,6 @@ does not disturb that. The hourly task works through the membership
 board bigger than that a newly earned promotion arrives within a few
 runs rather than on the very next one.
 
-> [!WARNING]
-> A rule promoting members out of **Registered** into a group of your own
-> is currently refused by the safeguard that stops promotions demoting
-> anybody, and moves nobody. The preview says so honestly — if it reports
-> no members for a rule you believe is right, read
-> [Groups and promotions § Promotions](./groups.md#promotions) before
-> changing the rule.
-
 ### When somebody steps back
 
 Accounts belong to people; roles are group memberships. That one