From 85ddad897d5bfbd85a3034e3beb9d921c08c75fa Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Wed, 3 Jun 2026 23:22:54 +0100
Subject: [PATCH 01/26] feat(moderation): auto-approve clean NULL-status posts
 after a delay
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Members whose group posting status is NULL ('auto-moderated' — never explicitly
set) previously had their posts stuck in Pending until a mod acted or the 48-hour
fallback fired. NULL is now reinterpreted as a fast, safe path: their
content-check-clean posts auto-approve after a configurable delay (default 20 min),
giving mods and microvolunteers a window to intervene, unless a danger signal is
present, with a configurable quality-check sample held back for manual review.

Backend (iznik-batch):
- AutoApproveCleanService + messages:auto-approve-clean command (scheduled every
  minute). Eligible = NULL posting status, content-check clean (checked_at set,
  reasons NULL), past the per-group/site delay, group not moderated/closed/Big-Switch,
  not held/deleted/spam-flagged.
- Danger-signal vetoes: microvolunteering rejects, mod notes, recent negative mod
  logs (rejections/deletions/modmails/spam classifications), known-spammer records,
  pending membership reviews.
- Quality-check sample held deterministically per message.
- Spam unaffected: only posts that already passed messages:contentcheck are eligible;
  suspect posts keep their reasons and stay Pending (or move to Spam) as before.
- config/freegle.php autoapprove block (delay_minutes=20, quality_check_percent=0,
  danger_log_days=90); per-group override via settings.autoapprove.* (0/absent = site
  default). No schema migration and no routing change.

Go API:
- /modtools/messages gains a filter param: autoapproved (approvedby IS NULL),
  recentjoin (joined <7d), outsidecga (location outside group polygon).

Frontend (modtools):
- Approved page filter dropdown (defaults to All; switches to summary view for
  Auto-approved).
- Group settings controls for the delay and quality-check percentage.

Tests: 25 service + 4 command unit tests (Laravel); 3 Go endpoint tests.
---
 .../Message/AutoApproveCleanCommand.php       |  48 +++
 .../app/Services/AutoApproveCleanService.php  | 306 ++++++++++++++
 iznik-batch/config/freegle.php                |  24 ++
 iznik-batch/routes/console.php                |   9 +
 .../Message/AutoApproveCleanCommandTest.php   |  69 +++
 .../Services/AutoApproveCleanServiceTest.php  | 400 ++++++++++++++++++
 .../modtools/components/ModSettingsGroup.vue  |  16 +
 .../messages/approved/[[id]]/[[term]].vue     |  35 ++
 iznik-server-go/message/message_list.go       |  26 ++
 iznik-server-go/test/message_test.go          | 132 ++++++
 plans/active/autoapprove-delay.md             | 133 ++++++
 11 files changed, 1198 insertions(+)
 create mode 100644 iznik-batch/app/Console/Commands/Message/AutoApproveCleanCommand.php
 create mode 100644 iznik-batch/app/Services/AutoApproveCleanService.php
 create mode 100644 iznik-batch/tests/Unit/Commands/Message/AutoApproveCleanCommandTest.php
 create mode 100644 iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
 create mode 100644 plans/active/autoapprove-delay.md

diff --git a/iznik-batch/app/Console/Commands/Message/AutoApproveCleanCommand.php b/iznik-batch/app/Console/Commands/Message/AutoApproveCleanCommand.php
new file mode 100644
index 0000000000..c3ccf691c2
--- /dev/null
+++ b/iznik-batch/app/Console/Commands/Message/AutoApproveCleanCommand.php
@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Console\Commands\Message;
+
+use App\Services\AutoApproveCleanService;
+use App\Traits\GracefulShutdown;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Log;
+
+class AutoApproveCleanCommand extends Command
+{
+    use GracefulShutdown;
+
+    protected $signature = 'messages:auto-approve-clean
+                            {--dry-run : Show what would be approved without actually approving}';
+
+    protected $description = 'Auto-approve content-check-clean posts from NULL-status members after the configured delay';
+
+    public function handle(AutoApproveCleanService $service): int
+    {
+        $this->registerShutdownHandlers();
+
+        $dryRun = (bool) $this->option('dry-run');
+
+        if ($dryRun) {
+            $this->info('DRY RUN — no changes will be made.');
+        }
+
+        Log::info('Starting auto-approve-clean processing', ['dry_run' => $dryRun]);
+        $this->info('Processing content-check-clean pending messages for auto-approval...');
+
+        $stats = $service->process($dryRun);
+
+        $prefix = $dryRun ? '[DRY RUN] ' : '';
+        $this->info(
+            "{$prefix}Approved: {$stats['approved']}, Held (quality): {$stats['held_quality']}, " .
+            "Vetoed: {$stats['vetoed']}, Skipped: {$stats['skipped']}, Errors: {$stats['errors']}"
+        );
+
+        if ($stats['errors'] > 0) {
+            $this->warn("Errors: {$stats['errors']}");
+        }
+
+        Log::info('Auto-approve-clean processing complete', $stats);
+
+        return $stats['errors'] > 0 ? Command::FAILURE : Command::SUCCESS;
+    }
+}
diff --git a/iznik-batch/app/Services/AutoApproveCleanService.php b/iznik-batch/app/Services/AutoApproveCleanService.php
new file mode 100644
index 0000000000..3e3c4e600f
--- /dev/null
+++ b/iznik-batch/app/Services/AutoApproveCleanService.php
@@ -0,0 +1,306 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\BackgroundTask;
+use App\Models\Group;
+use App\Models\Message;
+use App\Models\MessageGroup;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Auto-approve content-check-clean posts from NULL-posting-status ("auto-moderated")
+ * members after a configurable delay (default 20 minutes).
+ *
+ * Members whose memberships.ourPostingStatus is NULL have never been given an explicit
+ * posting status. Historically NULL was treated as MODERATED, so their posts sat in
+ * Pending until a moderator acted or the 48-hour AutoApproveService fallback fired.
+ *
+ * This service reinterprets NULL as "auto-moderated": their posts are held in Pending for
+ * a short window — giving moderators and microvolunteers a chance to intervene — and are
+ * then released automatically, UNLESS a danger signal is present. A configurable
+ * percentage is held back as a manual quality-check sample.
+ *
+ * Posts only become eligible AFTER messages:contentcheck has run and found them clean
+ * (contentcheck_checked_at set, contentcheck_reasons NULL). Suspect posts keep their
+ * contentcheck_reasons and are never auto-approved here — they stay in Pending (or are
+ * moved to Spam) exactly as before.
+ *
+ * Trusted members (DEFAULT/UNMODERATED) are unaffected — contentcheck already approves
+ * their clean posts immediately. Explicit MODERATED/PROHIBITED members are unaffected too.
+ */
+class AutoApproveCleanService
+{
+    /** Negative moderation log subtypes that veto auto-approval. */
+    private const DANGER_MESSAGE_SUBTYPES = ['Rejected', 'Deleted', 'Replied'];
+    private const DANGER_USER_SUBTYPES    = ['Mailed', 'Rejected', 'Deleted', 'Suspect', 'ClassifiedSpam'];
+
+    public function defaultDelayMinutes(): int
+    {
+        return (int) config('freegle.autoapprove.delay_minutes', 20);
+    }
+
+    public function defaultQualityCheckPercent(): int
+    {
+        return (int) config('freegle.autoapprove.quality_check_percent', 0);
+    }
+
+    public function dangerLogDays(): int
+    {
+        return (int) config('freegle.autoapprove.danger_log_days', 90);
+    }
+
+    /**
+     * Process all eligible pending messages.
+     *
+     * @return array{approved:int, held_quality:int, vetoed:int, skipped:int, errors:int}
+     */
+    public function process(bool $dryRun = false): array
+    {
+        $stats = ['approved' => 0, 'held_quality' => 0, 'vetoed' => 0, 'skipped' => 0, 'errors' => 0];
+
+        // The delay is per-group (settings.autoapprove.delay_minutes) with a site-wide
+        // fallback, so it must be resolved in SQL — a single global threshold would ignore
+        // group overrides. A 0/absent override means "use the site default".
+        $candidates = DB::table('messages_groups as mg')
+            ->join('messages as m', 'm.id', '=', 'mg.msgid')
+            ->join('users as u', 'u.id', '=', 'm.fromuser')
+            ->join('memberships as mem', function ($j) {
+                $j->on('mem.userid', '=', 'm.fromuser')->on('mem.groupid', '=', 'mg.groupid');
+            })
+            ->join('groups as g', 'g.id', '=', 'mg.groupid')
+            ->select('mg.msgid', 'mg.groupid', 'm.fromuser', 'm.spamtype', 'm.subject', DB::raw('m.type as msgtype'))
+            ->where('mg.collection', MessageGroup::COLLECTION_PENDING)
+            ->whereNull('mg.heldby')
+            ->whereNull('m.heldby')
+            ->whereNull('mg.spamreason')
+            ->whereNull('m.spamreason')
+            ->where('mg.deleted', 0)
+            ->whereNull('m.deleted')
+            ->whereNull('u.deleted')
+            ->whereNull('mem.ourPostingStatus')           // the auto-moderated tier
+            ->whereNotNull('mg.contentcheck_checked_at')   // content check has run ...
+            ->whereNull('mg.contentcheck_reasons')         // ... and the post was clean
+            ->whereRaw(
+                "mg.arrival <= (NOW() - INTERVAL COALESCE(NULLIF(CAST(JSON_UNQUOTE(JSON_EXTRACT(g.settings, '$.autoapprove.delay_minutes')) AS UNSIGNED), 0), ?) MINUTE)",
+                [$this->defaultDelayMinutes()]
+            )
+            ->orderBy('mg.msgid')
+            ->orderBy('mg.groupid')
+            ->get();
+
+        foreach ($candidates as $row) {
+            try {
+                if (!$this->groupAllowsAutoApprove((int) $row->groupid)) {
+                    $stats['skipped']++;
+                    continue;
+                }
+
+                if ($this->hasDangerSignals((int) $row->msgid, (int) $row->groupid, (int) $row->fromuser)) {
+                    $stats['vetoed']++;
+                    continue;
+                }
+
+                if ($this->isQualitySampled((int) $row->msgid, (int) $row->groupid)) {
+                    $stats['held_quality']++;
+                    continue;
+                }
+
+                if ($dryRun) {
+                    $stats['approved']++;
+                    Log::info("Dry run: would auto-approve clean message #{$row->msgid} on group #{$row->groupid}");
+                    continue;
+                }
+
+                $this->approve($row);
+                $stats['approved']++;
+            } catch (\Exception $e) {
+                Log::error("AutoApproveClean: error processing message #{$row->msgid}: " . $e->getMessage());
+                $stats['errors']++;
+            }
+        }
+
+        return $stats;
+    }
+
+    /**
+     * The group must be open, published and NOT moderated — a moderated group (or one
+     * under the Big Switch) deliberately wants every post reviewed by a human.
+     */
+    protected function groupAllowsAutoApprove(int $groupid): bool
+    {
+        $group = Group::find($groupid);
+        if (!$group) {
+            return false;
+        }
+        if (!$group->getSetting('publish', true)) {
+            return false;
+        }
+        if ($group->isClosed()) {
+            return false;
+        }
+        if ($group->getAttribute('autofunctionoverride')) {
+            return false;
+        }
+        if ($group->getAttribute('overridemoderation') === 'ModerateAll') {
+            return false;
+        }
+        if (!empty($group->getSetting('moderated', 0))) {
+            return false;
+        }
+        $rules = $group->rules ?? [];
+        if (!empty($rules['fullymoderated'])) {
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Any one of these "danger signals" keeps the post in Pending for a moderator to handle.
+     */
+    protected function hasDangerSignals(int $msgid, int $groupid, int $fromuser): bool
+    {
+        // A microvolunteer flagged the post as not OK.
+        if (DB::table('microactions')
+            ->where('msgid', $msgid)
+            ->where('actiontype', 'CheckMessage')
+            ->where('result', 'Reject')
+            ->exists()) {
+            return true;
+        }
+
+        // A moderator has left a note on this member.
+        if (DB::table('users_comments')->where('userid', $fromuser)->exists()) {
+            return true;
+        }
+
+        // A recent negative moderation action against this member (rejection, deletion,
+        // modmail, spam classification) — not a self-initiated action.
+        if (DB::table('logs')
+            ->where('user', $fromuser)
+            ->where('timestamp', '>=', now()->subDays($this->dangerLogDays()))
+            ->where(function ($q) {
+                $q->whereColumn('byuser', '!=', 'user')->orWhereNull('byuser');
+            })
+            ->where(function ($q) {
+                $q->where(function ($q2) {
+                    $q2->where('type', 'Message')->whereIn('subtype', self::DANGER_MESSAGE_SUBTYPES);
+                })->orWhere(function ($q2) {
+                    $q2->where('type', 'User')->whereIn('subtype', self::DANGER_USER_SUBTYPES);
+                });
+            })
+            ->exists()) {
+            return true;
+        }
+
+        // A known or suspected spammer.
+        if (DB::table('spam_users')
+            ->where('userid', $fromuser)
+            ->whereIn('collection', ['Spammer', 'PendingAdd'])
+            ->exists()) {
+            return true;
+        }
+
+        // A moderation review is outstanding on this membership.
+        if (DB::table('memberships')
+            ->where('userid', $fromuser)
+            ->where('groupid', $groupid)
+            ->whereNotNull('reviewrequestedat')
+            ->where(function ($q) {
+                $q->whereNull('reviewedat')->orWhereColumn('reviewedat', '<', 'reviewrequestedat');
+            })
+            ->exists()) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * Deterministically hold a configurable percentage of otherwise-eligible posts in
+     * Pending so a moderator spot-checks the auto-approval quality. Deterministic on msgid
+     * so a held message never oscillates between runs.
+     */
+    protected function isQualitySampled(int $msgid, int $groupid): bool
+    {
+        $percent = $this->qualityPercentForGroup($groupid);
+        if ($percent <= 0) {
+            return false;
+        }
+        if ($percent >= 100) {
+            return true;
+        }
+
+        return (abs(crc32((string) $msgid)) % 100) < $percent;
+    }
+
+    protected function qualityPercentForGroup(int $groupid): int
+    {
+        $group    = Group::find($groupid);
+        $settings = $group?->settings ?? [];
+        $val      = $settings['autoapprove']['quality_check_percent'] ?? null;
+        if ($val === null || $val === '') {
+            return $this->defaultQualityCheckPercent();
+        }
+
+        return (int) $val;
+    }
+
+    /**
+     * Approve a message on a group. Mirrors AutoApproveService::approveOnGroup side effects
+     * (NULL approvedby, reset arrival, Autoapproved log, Ham recording) and additionally
+     * queues a freebie-alert task for Offers, matching the immediate contentcheck approval.
+     */
+    protected function approve(object $row): void
+    {
+        // notSpam parity: whitelist the subject when it was flagged for cross-group reuse.
+        if ($row->spamtype === 'SubjectUsedForDifferentGroups' && $row->subject) {
+            DB::table('spam_whitelist_subjects')->insertOrIgnore([
+                'subject' => AutoApproveService::getPrunedSubject($row->subject),
+                'comment' => 'Marked as not spam',
+            ]);
+        }
+
+        // notSpam parity: record HAM when the message had been marked spam.
+        if ($row->spamtype) {
+            DB::table('messages_spamham')->upsert(
+                ['msgid' => $row->msgid, 'spamham' => 'Ham'],
+                ['msgid'],
+                ['spamham']
+            );
+        }
+
+        DB::transaction(function () use ($row) {
+            DB::table('messages_groups')
+                ->where('msgid', $row->msgid)
+                ->where('groupid', $row->groupid)
+                ->where('collection', '!=', MessageGroup::COLLECTION_APPROVED)
+                ->update([
+                    'collection' => MessageGroup::COLLECTION_APPROVED,
+                    'approvedby' => null,            // NULL marks an auto-approval
+                    'approvedat' => now(),
+                    'arrival'    => now(),           // so the digest picks it up as new
+                ]);
+
+            DB::table('logs')->insert([
+                'timestamp' => now(),
+                'type'      => 'Message',
+                'subtype'   => 'Autoapproved',
+                'msgid'     => $row->msgid,
+                'groupid'   => $row->groupid,
+                'user'      => $row->fromuser,
+            ]);
+
+            if ($row->msgtype === Message::TYPE_OFFER) {
+                DB::table('background_tasks')->insert([
+                    'task_type' => BackgroundTask::TASK_FREEBIE_ALERTS_ADD,
+                    'data'      => json_encode(['msgid' => (int) $row->msgid]),
+                ]);
+            }
+        });
+
+        Log::info("AutoApproveClean: approved message #{$row->msgid} on group #{$row->groupid}");
+    }
+}
diff --git a/iznik-batch/config/freegle.php b/iznik-batch/config/freegle.php
index e89fd047d7..bd6728c1d9 100644
--- a/iznik-batch/config/freegle.php
+++ b/iznik-batch/config/freegle.php
@@ -601,6 +601,30 @@
         'api_key' => env('FREEBIE_ALERTS_KEY', ''),
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Auto-approve (delayed) for NULL-status ("auto-moderated") members
+    |--------------------------------------------------------------------------
+    |
+    | Site-wide defaults for messages:auto-approve-clean. A group may override
+    | delay_minutes / quality_check_percent via settings.autoapprove.* (an
+    | absent or 0 delay override falls back to the site default below).
+    |
+    | - delay_minutes:          how long a content-check-clean post stays in
+    |                           Pending before auto-approval, giving mods and
+    |                           microvolunteers a chance to intervene.
+    | - quality_check_percent:  percentage of otherwise-eligible posts held back
+    |                           in Pending for a manual mod quality check (0 = none).
+    | - danger_log_days:        how far back to look for negative moderation log
+    |                           entries that veto auto-approval.
+    |
+    */
+    'autoapprove' => [
+        'delay_minutes'         => (int) env('FREEGLE_AUTOAPPROVE_DELAY_MINUTES', 20),
+        'quality_check_percent' => (int) env('FREEGLE_AUTOAPPROVE_QUALITY_CHECK_PCT', 0),
+        'danger_log_days'       => (int) env('FREEGLE_AUTOAPPROVE_DANGER_LOG_DAYS', 90),
+    ],
+
     'email_health' => [
         'incoming_window_hours' => env('FREEGLE_EMAIL_HEALTH_INCOMING_WINDOW_HOURS', 2),
         'outgoing_min_per_hour' => env('FREEGLE_EMAIL_HEALTH_OUTGOING_MIN_PER_HOUR', 10),
diff --git a/iznik-batch/routes/console.php b/iznik-batch/routes/console.php
index 883deae89d..4ea0e9524a 100644
--- a/iznik-batch/routes/console.php
+++ b/iznik-batch/routes/console.php
@@ -163,6 +163,15 @@ function cronLog(string $command): string
     ->sendOutputTo(cronLog('ripple:proximity-notes'))
     ->runInBackground();
 
+// Auto-approve content-check-clean posts from NULL-status ("auto-moderated") members
+// after the configured delay (default 20 min), unless danger signals are present and
+// excluding a quality-check sample. Runs every minute so the window is honoured tightly.
+Schedule::command('messages:auto-approve-clean')
+    ->everyMinute()
+    ->withoutOverlapping()
+    ->sendOutputTo(cronLog('messages:auto-approve-clean'))
+    ->runInBackground();
+
 // Update UK spatial data - runs monthly.
 // Downloads UK OSM PBF file and rebuilds deprivation quintile CSV for spatial server.
 // Signals Go spatial server to reload after update.
diff --git a/iznik-batch/tests/Unit/Commands/Message/AutoApproveCleanCommandTest.php b/iznik-batch/tests/Unit/Commands/Message/AutoApproveCleanCommandTest.php
new file mode 100644
index 0000000000..07ac8314b2
--- /dev/null
+++ b/iznik-batch/tests/Unit/Commands/Message/AutoApproveCleanCommandTest.php
@@ -0,0 +1,69 @@
+<?php
+
+namespace Tests\Unit\Commands\Message;
+
+use App\Services\AutoApproveCleanService;
+use Illuminate\Console\Command;
+use Tests\TestCase;
+
+class AutoApproveCleanCommandTest extends TestCase
+{
+    private function stats(array $overrides = []): array
+    {
+        return array_merge([
+            'approved' => 0, 'held_quality' => 0, 'vetoed' => 0, 'skipped' => 0, 'errors' => 0,
+        ], $overrides);
+    }
+
+    public function test_success_with_no_errors(): void
+    {
+        $service = $this->createMock(AutoApproveCleanService::class);
+        $service->method('process')->willReturn($this->stats([
+            'approved' => 5, 'held_quality' => 1, 'vetoed' => 2, 'skipped' => 3,
+        ]));
+        $this->app->instance(AutoApproveCleanService::class, $service);
+
+        $this->artisan('messages:auto-approve-clean')
+            ->expectsOutputToContain('Approved: 5, Held (quality): 1, Vetoed: 2, Skipped: 3, Errors: 0')
+            ->assertExitCode(Command::SUCCESS);
+    }
+
+    public function test_failure_when_errors_present(): void
+    {
+        $service = $this->createMock(AutoApproveCleanService::class);
+        $service->method('process')->willReturn($this->stats(['approved' => 1, 'errors' => 3]));
+        $this->app->instance(AutoApproveCleanService::class, $service);
+
+        $this->artisan('messages:auto-approve-clean')
+            ->expectsOutputToContain('Errors: 3')
+            ->assertExitCode(Command::FAILURE);
+    }
+
+    public function test_dry_run_announces_mode_and_passes_flag(): void
+    {
+        $service = $this->createMock(AutoApproveCleanService::class);
+        $service->expects($this->once())
+            ->method('process')
+            ->with(true)
+            ->willReturn($this->stats());
+        $this->app->instance(AutoApproveCleanService::class, $service);
+
+        $this->artisan('messages:auto-approve-clean', ['--dry-run' => true])
+            ->expectsOutputToContain('no changes will be made')
+            ->expectsOutputToContain('[DRY RUN] Approved: 0')
+            ->assertExitCode(Command::SUCCESS);
+    }
+
+    public function test_passes_false_when_not_dry_run(): void
+    {
+        $service = $this->createMock(AutoApproveCleanService::class);
+        $service->expects($this->once())
+            ->method('process')
+            ->with(false)
+            ->willReturn($this->stats());
+        $this->app->instance(AutoApproveCleanService::class, $service);
+
+        $this->artisan('messages:auto-approve-clean')
+            ->assertExitCode(Command::SUCCESS);
+    }
+}
diff --git a/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php b/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
new file mode 100644
index 0000000000..1d3533f365
--- /dev/null
+++ b/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
@@ -0,0 +1,400 @@
+<?php
+
+namespace Tests\Unit\Services;
+
+use App\Models\Group;
+use App\Models\Membership;
+use App\Models\Message;
+use App\Models\MessageGroup;
+use App\Models\User;
+use App\Services\AutoApproveCleanService;
+use Illuminate\Support\Facades\DB;
+use Tests\TestCase;
+
+/**
+ * Auto-approve of content-check-clean posts from NULL-posting-status ("auto-moderated")
+ * members after a configurable delay, with danger-signal vetoes and a quality-check sample.
+ */
+class AutoApproveCleanServiceTest extends TestCase
+{
+    protected AutoApproveCleanService $service;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->service = new AutoApproveCleanService();
+
+        // Deterministic site defaults for the tests.
+        config([
+            'freegle.autoapprove.delay_minutes' => 20,
+            'freegle.autoapprove.quality_check_percent' => 0,
+            'freegle.autoapprove.danger_log_days' => 90,
+        ]);
+    }
+
+    /**
+     * Build a clean, content-checked, NULL-status pending post that is eligible for
+     * auto-approval (arrival older than the default 20-minute delay).
+     *
+     * @return array{0: User, 1: Group, 2: Message}
+     */
+    private function makeApprovable(array $opts = []): array
+    {
+        $user  = $this->createTestUser();
+        $group = $this->createTestGroup($opts['group'] ?? []);
+        $this->createMembership($user, $group, array_merge([
+            'added' => now()->subDays(2),
+            // ourPostingStatus left NULL — the auto-moderated tier.
+        ], $opts['membership'] ?? []));
+
+        $message = $this->createTestMessage($user, $group, $opts['message'] ?? []);
+
+        DB::table('messages_groups')
+            ->where('msgid', $message->id)
+            ->where('groupid', $group->id)
+            ->update(array_merge([
+                'collection'              => MessageGroup::COLLECTION_PENDING,
+                'arrival'                 => now()->subMinutes(21),
+                'contentcheck_checked_at' => now()->subMinutes(20),
+                'contentcheck_reasons'    => null,
+            ], $opts['mg'] ?? []));
+
+        return [$user, $group, $message];
+    }
+
+    private function assertApproved(int $msgid, int $groupid): void
+    {
+        $mg = DB::table('messages_groups')->where('msgid', $msgid)->where('groupid', $groupid)->first();
+        $this->assertEquals(MessageGroup::COLLECTION_APPROVED, $mg->collection, 'message should be Approved');
+        $this->assertNull($mg->approvedby, 'auto-approval leaves approvedby NULL');
+        $this->assertDatabaseHas('logs', [
+            'msgid' => $msgid, 'groupid' => $groupid, 'type' => 'Message', 'subtype' => 'Autoapproved',
+        ]);
+    }
+
+    private function assertStillPending(int $msgid, int $groupid): void
+    {
+        $this->assertDatabaseHas('messages_groups', [
+            'msgid' => $msgid, 'groupid' => $groupid, 'collection' => MessageGroup::COLLECTION_PENDING,
+        ]);
+        $this->assertDatabaseMissing('logs', [
+            'msgid' => $msgid, 'type' => 'Message', 'subtype' => 'Autoapproved',
+        ]);
+    }
+
+    public function test_stats_structure(): void
+    {
+        $stats = $this->service->process();
+        foreach (['approved', 'held_quality', 'vetoed', 'skipped', 'errors'] as $key) {
+            $this->assertArrayHasKey($key, $stats);
+        }
+    }
+
+    public function test_approves_clean_null_status_post_after_delay(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+
+        $stats = $this->service->process();
+
+        $this->assertGreaterThanOrEqual(1, $stats['approved']);
+        $this->assertApproved($message->id, $group->id);
+    }
+
+    public function test_does_not_approve_before_delay(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable([
+            'mg' => ['arrival' => now()->subMinutes(19)],
+        ]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_skips_default_posting_status(): void
+    {
+        // DEFAULT members are trusted and approved immediately by contentcheck — not our job.
+        [$user, $group, $message] = $this->makeApprovable([
+            'membership' => ['ourPostingStatus' => 'DEFAULT'],
+        ]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_skips_moderated_posting_status(): void
+    {
+        // Explicit MODERATED stays moderated.
+        [$user, $group, $message] = $this->makeApprovable([
+            'membership' => ['ourPostingStatus' => 'MODERATED'],
+        ]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_skips_when_content_check_not_run(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable([
+            'mg' => ['contentcheck_checked_at' => null],
+        ]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_skips_when_content_check_flagged_reasons(): void
+    {
+        // Suspect content (reasons present) must keep the post in Pending for a mod.
+        [$user, $group, $message] = $this->makeApprovable([
+            'mg' => ['contentcheck_reasons' => json_encode([['check' => 'Money', 'action' => 'flag']])],
+        ]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_skips_held_message(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+        DB::table('messages_groups')
+            ->where('msgid', $message->id)
+            ->where('groupid', $group->id)
+            ->update(['heldby' => $user->id]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_skips_message_with_spamreason(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+        DB::table('messages')->where('id', $message->id)->update(['spamreason' => 'CountryBlocked']);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_skips_soft_deleted_message(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+        DB::table('messages')->where('id', $message->id)->update(['deleted' => now()]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_skips_moderated_group(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable([
+            'group' => ['settings' => ['moderated' => 1]],
+        ]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_skips_closed_group(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable([
+            'group' => ['settings' => ['closed' => true]],
+        ]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_veto_microvolunteering_reject(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+        $reviewer = $this->createTestUser();
+        DB::table('microactions')->insert([
+            'userid'         => $reviewer->id,
+            'msgid'          => $message->id,
+            'actiontype'     => 'CheckMessage',
+            'result'         => 'Reject',
+            'score_negative' => 1,
+        ]);
+
+        $stats = $this->service->process();
+
+        $this->assertGreaterThanOrEqual(1, $stats['vetoed']);
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_does_not_veto_microvolunteering_approve(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+        $reviewer = $this->createTestUser();
+        DB::table('microactions')->insert([
+            'userid'         => $reviewer->id,
+            'msgid'          => $message->id,
+            'actiontype'     => 'CheckMessage',
+            'result'         => 'Approve',
+            'score_negative' => 0,
+        ]);
+
+        $this->service->process();
+
+        $this->assertApproved($message->id, $group->id);
+    }
+
+    public function test_veto_user_note(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+        DB::table('users_comments')->insert([
+            'userid'  => $user->id,
+            'groupid' => $group->id,
+            'user1'   => 'Keep an eye on this member.',
+        ]);
+
+        $stats = $this->service->process();
+
+        $this->assertGreaterThanOrEqual(1, $stats['vetoed']);
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_veto_recent_negative_mod_log(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+        $mod = $this->createTestUser();
+        DB::table('logs')->insert([
+            'timestamp' => now()->subDays(1),
+            'type'      => 'User',
+            'subtype'   => 'Mailed',
+            'user'      => $user->id,
+            'byuser'    => $mod->id,
+            'groupid'   => $group->id,
+        ]);
+
+        $stats = $this->service->process();
+
+        $this->assertGreaterThanOrEqual(1, $stats['vetoed']);
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_does_not_veto_old_negative_log(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+        $mod = $this->createTestUser();
+        DB::table('logs')->insert([
+            'timestamp' => now()->subDays(120), // outside the 90-day danger window
+            'type'      => 'User',
+            'subtype'   => 'Mailed',
+            'user'      => $user->id,
+            'byuser'    => $mod->id,
+            'groupid'   => $group->id,
+        ]);
+
+        $this->service->process();
+
+        $this->assertApproved($message->id, $group->id);
+    }
+
+    public function test_veto_known_spammer(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+        DB::table('spam_users')->insert([
+            'userid'     => $user->id,
+            'collection' => 'Spammer',
+        ]);
+
+        $stats = $this->service->process();
+
+        $this->assertGreaterThanOrEqual(1, $stats['vetoed']);
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_veto_membership_review_pending(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+        DB::table('memberships')
+            ->where('userid', $user->id)
+            ->where('groupid', $group->id)
+            ->update(['reviewrequestedat' => now()->subHour(), 'reviewedat' => null]);
+
+        $stats = $this->service->process();
+
+        $this->assertGreaterThanOrEqual(1, $stats['vetoed']);
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_quality_sample_100_holds_all(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable([
+            'group' => ['settings' => ['autoapprove' => ['quality_check_percent' => 100]]],
+        ]);
+
+        $stats = $this->service->process();
+
+        $this->assertGreaterThanOrEqual(1, $stats['held_quality']);
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_quality_sample_zero_holds_none(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable([
+            'group' => ['settings' => ['autoapprove' => ['quality_check_percent' => 0]]],
+        ]);
+
+        $this->service->process();
+
+        $this->assertApproved($message->id, $group->id);
+    }
+
+    public function test_per_group_delay_override(): void
+    {
+        // Site default is 20 min; this group overrides to 5 min, so a 6-min-old post approves.
+        [$user, $group, $message] = $this->makeApprovable([
+            'group' => ['settings' => ['autoapprove' => ['delay_minutes' => 5]]],
+            'mg'    => ['arrival' => now()->subMinutes(6)],
+        ]);
+
+        $this->service->process();
+
+        $this->assertApproved($message->id, $group->id);
+    }
+
+    public function test_zero_group_delay_falls_back_to_site_default(): void
+    {
+        // A 0 override means "use the site default" (20), so a 6-min-old post stays pending.
+        [$user, $group, $message] = $this->makeApprovable([
+            'group' => ['settings' => ['autoapprove' => ['delay_minutes' => 0]]],
+            'mg'    => ['arrival' => now()->subMinutes(6)],
+        ]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_dry_run_does_not_modify_database(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+
+        $stats = $this->service->process(dryRun: true);
+
+        $this->assertGreaterThanOrEqual(1, $stats['approved']);
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_records_ham_for_spam_message(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable();
+        DB::table('messages')->where('id', $message->id)->update(['spamtype' => 'SubjectUsedForDifferentGroups']);
+
+        $this->service->process();
+
+        $this->assertApproved($message->id, $group->id);
+        $this->assertDatabaseHas('messages_spamham', ['msgid' => $message->id, 'spamham' => 'Ham']);
+    }
+}
diff --git a/iznik-nuxt3/modtools/components/ModSettingsGroup.vue b/iznik-nuxt3/modtools/components/ModSettingsGroup.vue
index 5c2e5f3b21..4225147a16 100644
--- a/iznik-nuxt3/modtools/components/ModSettingsGroup.vue
+++ b/iznik-nuxt3/modtools/components/ModSettingsGroup.vue
@@ -569,6 +569,22 @@
               toggle-checked="Yes"
               toggle-unchecked="No"
             />
+            <ModGroupSetting
+              :groupid="groupid"
+              name="settings.autoapprove.delay_minutes"
+              label="Auto-approve delay (minutes)"
+              description="For members on Group Settings (not moderated), their posts are held briefly so you and microvolunteers can spot anything wrong, then auto-approved if no danger signals are found. This is how long to wait. Leave blank or 0 to use the site default (20 minutes)."
+              type="number"
+              :step="1"
+            />
+            <ModGroupSetting
+              :groupid="groupid"
+              name="settings.autoapprove.quality_check_percent"
+              label="Auto-approve quality-check sample (%)"
+              description="Percentage of otherwise auto-approvable posts to hold in Pending anyway, so you can spot-check the quality of auto-approval. 0 (or blank) means none are held."
+              type="number"
+              :step="1"
+            />
             <ModGroupSetting
               :groupid="groupid"
               name="settings.autoadmins"
diff --git a/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue b/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue
index 41236251f7..f715bcbe1b 100644
--- a/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue
+++ b/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue
@@ -19,6 +19,14 @@
       />
       <span v-else class="mt-2"> Select a community to search messages. </span>
       <ModtoolsViewControl misckey="modtoolsMessagesApprovedSummary" />
+      <b-form-select
+        v-model="filter"
+        size="sm"
+        class="mt-2 ms-2"
+        style="max-width: 220px"
+        :options="filterOptions"
+        aria-label="Filter approved messages"
+      />
     </div>
     <div>
       <NoticeMessage v-if="loaded && !messages.length && !busy" class="mt-2">
@@ -56,11 +64,13 @@
 import { ref, computed, watch, onMounted, nextTick } from 'vue'
 import { useRoute, useRouter } from '#imports'
 import { useMessageStore } from '@/stores/message'
+import { useMiscStore } from '@/stores/misc'
 import { setupModMessages } from '@/composables/useModMessages'
 import { useMe } from '~/composables/useMe'
 
 // Stores
 const messageStore = useMessageStore()
+const miscStore = useMiscStore()
 
 // Composables
 const modMessages = setupModMessages(true)
@@ -87,6 +97,13 @@ const {
 // Local state (formerly data())
 const chosengroupid = ref(0)
 const bump = ref(0)
+const filter = ref('')
+const filterOptions = [
+  { value: '', text: 'All messages' },
+  { value: 'recentjoin', text: 'Joined last 7 days' },
+  { value: 'autoapproved', text: 'Auto-approved' },
+  { value: 'outsidecga', text: 'Outside group area' },
+]
 const urlOverride = ref(false)
 const loaded = ref(false)
 const highlightMsgId = ref(null)
@@ -215,6 +232,21 @@ function searchedMessage(term) {
   }
 }
 
+watch(filter, (newVal) => {
+  // The auto-approved view is for scanning posts that went out without a human
+  // checking, so default it to the compact summary view.
+  if (newVal === 'autoapproved') {
+    miscStore.set({ key: 'modtoolsMessagesApprovedSummary', value: true })
+  }
+  show.value = 0
+  context.value = null
+  modMessages.listingIds.value = new Set()
+  modMessages.listingIdOrder.value = []
+  messageStore.clear()
+  bump.value++
+})
+
+
 function searchedMember(term) {
   show.value = 0
   messageTerm.value = null
@@ -289,6 +321,9 @@ async function loadMore($state) {
         modtools: true,
         summary: false,
       }
+      if (filter.value) {
+        params.filter = filter.value
+      }
     }
 
     params.context = context.value
diff --git a/iznik-server-go/message/message_list.go b/iznik-server-go/message/message_list.go
index 5a77062815..189e526d5b 100644
--- a/iznik-server-go/message/message_list.go
+++ b/iznik-server-go/message/message_list.go
@@ -448,6 +448,11 @@ func ListMessagesMT(c *fiber.Ctx) error {
 	search := c.Query("search", "")
 	fromuserStr := c.Query("fromuser", "0")
 	fromuser, _ := strconv.ParseUint(fromuserStr, 10, 64)
+	// Optional moderation filter for the standard (non-search) listing:
+	//   autoapproved — posts approved without a moderator (mg.approvedby IS NULL)
+	//   recentjoin   — posts from members who joined this group in the last 7 days
+	//   outsidecga   — posts whose location falls outside the group's area polygon
+	filter := c.Query("filter", "")
 
 	var msgIDs []uint64
 
@@ -552,11 +557,32 @@ func ListMessagesMT(c *fiber.Ctx) error {
 			branchArgs = []interface{}{utils.COLLECTION_PENDING, utils.COLLECTION_SPAM}
 		}
 
+		// Optional moderation filter. Values are matched against a fixed set, so the
+		// injected SQL is constant (no user-supplied text reaches the query).
+		filterJoin := ""
+		filterWhere := ""
+		switch filter {
+		case "autoapproved":
+			filterWhere = "AND mg.approvedby IS NULL "
+		case "recentjoin":
+			filterJoin = "INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "
+			filterWhere = "AND mem.added >= NOW() - INTERVAL 7 DAY "
+		case "outsidecga":
+			// Use the canonical spatial point (messages_spatial), matching how
+			// location containment is checked elsewhere. Unmappable posts (no
+			// spatial row) can't be "outside" and are excluded by the INNER JOIN.
+			filterJoin = "INNER JOIN `groups` g ON g.id = mg.groupid " +
+				"INNER JOIN messages_spatial ms ON ms.msgid = mg.msgid AND ms.groupid = mg.groupid "
+			filterWhere = "AND g.polyindex IS NOT NULL AND NOT ST_Contains(g.polyindex, ms.point) "
+		}
+
 		branchSQL := "SELECT mg.msgid, mg.arrival FROM messages_groups mg " +
 			"INNER JOIN messages m ON m.id = mg.msgid " +
 			"INNER JOIN users u ON u.id = m.fromuser " +
+			filterJoin +
 			"WHERE mg.groupid = %GID% AND " + collectionFilter + " AND mg.deleted = 0 " +
 			"AND m.deleted IS NULL AND m.fromuser IS NOT NULL AND u.deleted IS NULL " +
+			filterWhere +
 			contentcheckFilter + " "
 
 		if fromuser > 0 {
diff --git a/iznik-server-go/test/message_test.go b/iznik-server-go/test/message_test.go
index 7688519631..2f20e5d3eb 100644
--- a/iznik-server-go/test/message_test.go
+++ b/iznik-server-go/test/message_test.go
@@ -5552,6 +5552,138 @@ func TestListMessagesMT_LimboUserMessageNotReturned(t *testing.T) {
 	db.Exec("UPDATE users SET deleted = NULL WHERE id = ?", posterID)
 }
 
+func TestListMessagesMT_FilterAutoApproved(t *testing.T) {
+	// filter=autoapproved returns only posts approved without a moderator
+	// (messages_groups.approvedby IS NULL).
+	prefix := uniquePrefix("lstmt_autoapp")
+	db := database.DBConn
+
+	groupID := CreateTestGroup(t, prefix)
+	posterID := CreateTestUser(t, prefix+"_poster", "User")
+	modID := CreateTestUser(t, prefix+"_mod", "User")
+	CreateTestMembership(t, posterID, groupID, "Member")
+	CreateTestMembership(t, modID, groupID, "Moderator")
+	_, modToken := CreateTestSession(t, modID)
+
+	autoMsg := CreateTestMessage(t, posterID, groupID, prefix+" auto approved", 52.0, -1.0)
+	manualMsg := CreateTestMessage(t, posterID, groupID, prefix+" mod approved", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL WHERE msgid=?", autoMsg)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=? WHERE msgid=?", modID, manualMsg)
+
+	resp, err := getApp().Test(httptest.NewRequest("GET",
+		fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Approved&filter=autoapproved&jwt=%s", groupID, modToken), nil))
+	assert.NoError(t, err)
+	assert.Equal(t, 200, resp.StatusCode)
+
+	var body map[string]interface{}
+	json.NewDecoder(resp.Body).Decode(&body)
+	msgs, _ := body["messages"].([]interface{})
+	foundAuto, foundManual := false, false
+	for _, id := range msgs {
+		if id == float64(autoMsg) {
+			foundAuto = true
+		}
+		if id == float64(manualMsg) {
+			foundManual = true
+		}
+	}
+	assert.True(t, foundAuto, "auto-approved message should appear under autoapproved filter")
+	assert.False(t, foundManual, "mod-approved message should not appear under autoapproved filter")
+
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?)", autoMsg, manualMsg)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", autoMsg, manualMsg)
+}
+
+func TestListMessagesMT_FilterRecentJoin(t *testing.T) {
+	// filter=recentjoin returns only posts from members who joined this group
+	// within the last 7 days.
+	prefix := uniquePrefix("lstmt_recentjoin")
+	db := database.DBConn
+
+	groupID := CreateTestGroup(t, prefix)
+	recentID := CreateTestUser(t, prefix+"_recent", "User")
+	oldID := CreateTestUser(t, prefix+"_old", "User")
+	modID := CreateTestUser(t, prefix+"_mod", "User")
+	CreateTestMembership(t, recentID, groupID, "Member")
+	CreateTestMembership(t, oldID, groupID, "Member")
+	CreateTestMembership(t, modID, groupID, "Moderator")
+	_, modToken := CreateTestSession(t, modID)
+
+	// The old member joined 30 days ago.
+	db.Exec("UPDATE memberships SET added = NOW() - INTERVAL 30 DAY WHERE userid = ? AND groupid = ?", oldID, groupID)
+
+	recentMsg := CreateTestMessage(t, recentID, groupID, prefix+" recent joiner post", 52.0, -1.0)
+	oldMsg := CreateTestMessage(t, oldID, groupID, prefix+" old joiner post", 52.0, -1.0)
+
+	resp, err := getApp().Test(httptest.NewRequest("GET",
+		fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Approved&filter=recentjoin&jwt=%s", groupID, modToken), nil))
+	assert.NoError(t, err)
+	assert.Equal(t, 200, resp.StatusCode)
+
+	var body map[string]interface{}
+	json.NewDecoder(resp.Body).Decode(&body)
+	msgs, _ := body["messages"].([]interface{})
+	foundRecent, foundOld := false, false
+	for _, id := range msgs {
+		if id == float64(recentMsg) {
+			foundRecent = true
+		}
+		if id == float64(oldMsg) {
+			foundOld = true
+		}
+	}
+	assert.True(t, foundRecent, "recent joiner's post should appear under recentjoin filter")
+	assert.False(t, foundOld, "long-standing member's post should not appear under recentjoin filter")
+
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?)", recentMsg, oldMsg)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", recentMsg, oldMsg)
+}
+
+func TestListMessagesMT_FilterOutsideCGA(t *testing.T) {
+	// filter=outsidecga returns only posts whose location falls outside the
+	// group's area polygon.
+	prefix := uniquePrefix("lstmt_outcga")
+	db := database.DBConn
+
+	groupID := CreateTestGroup(t, prefix)
+	posterID := CreateTestUser(t, prefix+"_poster", "User")
+	modID := CreateTestUser(t, prefix+"_mod", "User")
+	CreateTestMembership(t, posterID, groupID, "Member")
+	CreateTestMembership(t, modID, groupID, "Moderator")
+	_, modToken := CreateTestSession(t, modID)
+
+	// Define the group's area: a small box around (lng -1.0, lat 52.0). Freegle
+	// stores degrees labelled SRID 3857, matching messages_spatial.point.
+	db.Exec("UPDATE `groups` SET polyindex = ST_GeomFromText('POLYGON((-1.1 51.9, -0.9 51.9, -0.9 52.1, -1.1 52.1, -1.1 51.9))', 3857) WHERE id = ?", groupID)
+
+	insideMsg := CreateTestMessage(t, posterID, groupID, prefix+" inside area", 52.0, -1.0)
+	outsideMsg := CreateTestMessage(t, posterID, groupID, prefix+" outside area", 52.0, -5.0)
+
+	resp, err := getApp().Test(httptest.NewRequest("GET",
+		fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Approved&filter=outsidecga&jwt=%s", groupID, modToken), nil))
+	assert.NoError(t, err)
+	assert.Equal(t, 200, resp.StatusCode)
+
+	var body map[string]interface{}
+	json.NewDecoder(resp.Body).Decode(&body)
+	msgs, _ := body["messages"].([]interface{})
+	foundInside, foundOutside := false, false
+	for _, id := range msgs {
+		if id == float64(insideMsg) {
+			foundInside = true
+		}
+		if id == float64(outsideMsg) {
+			foundOutside = true
+		}
+	}
+	assert.True(t, foundOutside, "out-of-area post should appear under outsidecga filter")
+	assert.False(t, foundInside, "in-area post should not appear under outsidecga filter")
+
+	db.Exec("DELETE FROM messages_spatial WHERE msgid IN (?, ?)", insideMsg, outsideMsg)
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?)", insideMsg, outsideMsg)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", insideMsg, outsideMsg)
+}
+
 func TestListMessagesPendingUnauthorized(t *testing.T) {
 	prefix := uniquePrefix("lstmsg_pend_unauth")
 
diff --git a/plans/active/autoapprove-delay.md b/plans/active/autoapprove-delay.md
new file mode 100644
index 0000000000..85611c9a97
--- /dev/null
+++ b/plans/active/autoapprove-delay.md
@@ -0,0 +1,133 @@
+# Auto-approve NULL-status posts after a configurable delay
+
+Branch: `feature/autoapprove-delay` (worktree `autoapprove`)
+
+## Goal
+
+Members whose group posting status is **NULL** ("auto-moderated" tier — never explicitly
+set) currently have their posts stuck in Pending until a mod acts or the 48-hour fallback
+fires. Introduce a faster, safer path: their **content-check-clean** posts auto-approve
+after a configurable delay (default **20 minutes**), giving mods and microvolunteers a
+window to intervene, **unless** danger signals are present, with a configurable
+**quality-check sample** held back for manual review.
+
+Plus a modtools Approved-page filter dropdown (auto-approved / recently-joined / outside
+CGA) that defaults to summary view for the auto-approved variant.
+
+## Production sizing (live, last 30 days)
+
+- 66,074 posts; 11.3% from members who joined that group in the last 30 days.
+- Of recent-joiner posts: **NULL 76.5%**, DEFAULT 22.9%, MODERATED 0.3%, UNMODERATED 0.3%.
+- The 20-minute path carries ~5,700 posts/30d (~190/day) — today they wait for a mod or 48h.
+
+## Key architecture (from code exploration)
+
+- **All posts already land in Pending.** Go `handleJoinAndPost` always inserts Pending;
+  PHP `JoinAndPost`/email (MailRouter) route NULL → Pending. **No routing change needed.**
+- `messages:contentcheck` (every minute, `ContentCheckService::processUnprocessed`)
+  runs spam/worry/PII/language checks **once** per fresh pending row:
+  - clean + user not-moderated (DEFAULT/UNMODERATED) + group not moderated → promote now.
+  - clean + user **NULL**/MODERATED **or** group moderated → kept Pending, sets
+    `contentcheck_checked_at=now`, `contentcheck_reasons=NULL`.
+  - flagged (`action=flag`) → kept Pending with `contentcheck_reasons` JSON.
+  - blocked (`action=block`) → collection Spam.
+- `messages:auto-approve` (hourly, `AutoApproveService`, 48h) is the existing safety net.
+- Approve = `UPDATE messages_groups SET collection='Approved', approvedby=NULL,
+  approvedat=NOW(), arrival=NOW()` + log `Autoapproved` + spatial index + freebie alerts
+  for OFFERs. Digest cron mails it (reads collection='Approved', arrival>lastsent).
+
+## Design — new batch service `AutoApproveCleanService`
+
+`messages:auto-approve-clean`, scheduled **every minute** (`withoutOverlapping`,
+`runInBackground`). Picks up Pending rows that:
+
+1. poster's `memberships.ourPostingStatus IS NULL` — the auto-moderated tier (the
+   "reinterpret NULL as group settings" change; explicit MODERATED stays moderated,
+   DEFAULT/UNMODERATED already approved immediately by contentcheck).
+2. `contentcheck_checked_at IS NOT NULL AND contentcheck_reasons IS NULL` — content
+   check ran and was **clean**. (This is how "all posts still go through spam checks;
+   suspect → Pending" is honoured: suspect rows have reasons and are excluded.)
+3. `mg.arrival <= NOW() - INTERVAL {delay} MINUTE`, where `{delay}` is the per-group
+   `settings.autoapprove.delay_minutes` (JSON_EXTRACT) falling back to
+   `config('freegle.autoapprove.delay_minutes', 20)`.
+4. `mg.heldby IS NULL`, `m.heldby IS NULL`, `mg.spamreason IS NULL`, `m.spamreason IS NULL`,
+   `mg.deleted=0`, `m.deleted IS NULL`, `u.deleted IS NULL`.
+5. Group is **not moderated**: `settings.moderated` falsy AND `rules.fullymoderated` falsy
+   AND `overridemoderation != 'ModerateAll'` AND publish AND not closed AND not
+   `autofunctionoverride` (mirrors AutoApproveService gating, minus the 48h membership age).
+6. **No danger signals** (per msgid/groupid/fromuser) — see below.
+7. **Not** in the quality-check sample (deterministic per msgid; percent from
+   `settings.autoapprove.quality_check_percent` ?? `config(...quality_check_percent, 0)`).
+
+Then approve (same side effects as `AutoApproveService::approveOnGroup`) + log Autoapproved.
+
+### Danger signals (veto → leave Pending for a mod)
+
+- **Microvolunteering reject**: `microactions` where `msgid=`, `actiontype='CheckMessage'`,
+  `result='Reject'` → count ≥ 1.
+- **User notes**: `users_comments` where `userid=fromuser` → any row.
+- **Recent negative mod action**: `logs` where `user=fromuser` AND `byuser<>user` AND
+  `timestamp >= NOW()-{danger_log_days}` AND
+  ((type='Message' AND subtype IN ('Rejected','Deleted','Replied')) OR
+   (type='User' AND subtype IN ('Mailed','Rejected','Deleted','Suspect','ClassifiedSpam'))).
+- **Known spammer**: `spam_users` where `userid=fromuser` AND collection IN ('Spammer','PendingAdd').
+- **Membership review pending**: `memberships.reviewrequestedat IS NOT NULL` AND
+  (`reviewedat IS NULL` OR `reviewedat < reviewrequestedat`).
+
+(Worry-words / concern keywords already excluded via `contentcheck_reasons IS NULL`.)
+
+### Quality-check sample
+
+`abs(crc32((string)$msgid)) % 100 < percent` → **held** (skip; mod reviews, or 48h fallback
+catches it). Deterministic so a message never oscillates.
+
+## Frontend / Go API filter (secondary)
+
+- Go `ListMessagesMT` (`/api/modtools/messages`): new `filter` param — `autoapproved`
+  (`mg.approvedby IS NULL`), `recentjoin` (join memberships added ≥ NOW()-7d),
+  `outsidecga` (spatial: message point not within group polygon). Go tests for each.
+- Approved page `[[id]]/[[term]].vue`: `<b-form-select>` dropdown (default "All"); pass
+  `filter` to `fetchMessagesMT`; when `autoapproved` selected set the summary miscStore key.
+- `ModSettingsGroup.vue`: two `<ModGroupSetting>` controls (delay minutes, quality %).
+
+## Config / settings
+
+- `config/freegle.php` → `autoapprove` block (delay_minutes=20, quality_check_percent=0,
+  danger_log_days=90).
+- `iznik-server/include/group/Group.php` `defaultSettings['autoapprove']` gains
+  `delay_minutes`/`quality_check_percent` (for the modtools UI + PHP parity).
+
+## Gotchas (thought through)
+
+1. **Re-evaluation**: contentcheck only touches each row once (`contentcheck_checked_at IS
+   NULL`). This service must query already-checked rows → keys off `checked_at NOT NULL AND
+   reasons NULL`, NOT `checked_at NULL`.
+2. **Per-group delay** must be in the SQL (JSON_EXTRACT COALESCE default) so a group's
+   shorter/longer override is honoured; a single global threshold would be wrong.
+3. **Moderated groups**: contentcheck keeps clean posts Pending with reasons=NULL even on
+   moderated groups, so this service must explicitly exclude moderated/Big-Switch groups.
+4. **Races**: query filters `collection='Pending'` and the UPDATE uses `collection<>'Approved'`
+   so a mod approve/reject in the window can't double-fire; held rows excluded.
+5. **48h service overlap**: both set approvedby=NULL and guard on collection; harmless.
+6. **Deleted user/message**: filtered out (no Autoapproved log on invisible rows).
+7. **No membership-age gate** (unlike 48h service): the brief wants NULL members to post
+   after the delay regardless of join age; danger signals + content checks + QA sample
+   carry the risk. New-member visibility is also covered by the recent-join filter.
+8. **arrival reset on approve**: digest keys off arrival>lastsent; per-(msgid,groupid)
+   update only resets the row being approved. Correct for multi-group posts.
+9. **No schema migration / no routing change** → minimal blast radius.
+
+## Status
+
+| # | Task | Status | Notes |
+|---|------|--------|-------|
+| 1 | Design doc | ✅ | this file |
+| 2 | AutoApproveCleanService + tests (TDD) | ✅ | 25 unit tests; 29/29 green after held-FK fix |
+| 3 | AutoApproveCleanCommand + test | ✅ | 4 command tests |
+| 4 | Schedule entry (console.php) | ✅ | everyMinute, withoutOverlapping |
+| 5 | config/freegle.php defaults | ✅ | autoapprove block (no Group.php change — absent=site default) |
+| 6 | Go ListMessagesMT filter + tests | ✅ | autoapproved/recentjoin/outsidecga + 3 Go tests; suite running |
+| 7 | Frontend approved-page dropdown + summary | ✅ | b-form-select; summary on autoapproved |
+| 8 | ModSettingsGroup.vue settings controls | ✅ | delay_minutes + quality_check_percent |
+| 9 | Run all suites via worktree status API | 🔄 | Laravel green; Go running; Vitest pending |
+| 10 | PR | ⬜ | never merge |

From 9c4ae84982a3829da235ff0d7d6429c2915d526c Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Wed, 3 Jun 2026 23:34:09 +0100
Subject: [PATCH 02/26] docs(autoapprove): record green test runs and PR link
 in plan

---
 plans/active/autoapprove-delay.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/plans/active/autoapprove-delay.md b/plans/active/autoapprove-delay.md
index 85611c9a97..9792f96946 100644
--- a/plans/active/autoapprove-delay.md
+++ b/plans/active/autoapprove-delay.md
@@ -129,5 +129,5 @@ catches it). Deterministic so a message never oscillates.
 | 6 | Go ListMessagesMT filter + tests | ✅ | autoapproved/recentjoin/outsidecga + 3 Go tests; suite running |
 | 7 | Frontend approved-page dropdown + summary | ✅ | b-form-select; summary on autoapproved |
 | 8 | ModSettingsGroup.vue settings controls | ✅ | delay_minutes + quality_check_percent |
-| 9 | Run all suites via worktree status API | 🔄 | Laravel green; Go running; Vitest pending |
-| 10 | PR | ⬜ | never merge |
+| 9 | Run all suites via worktree status API | ✅ | full Laravel 3962/3962 ✓; Go 3004/3004 ✓; Vitest modtools 4475/4475 ✓ |
+| 10 | Push + PR (Freegle/Iznik) | ✅ | PR #639 — https://github.com/Freegle/Iznik/pull/639 (awaiting CI; never merge) |

From dfcd70953d2bcc9f7774baa765c64e7b742cb856 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Thu, 4 Jun 2026 08:33:27 +0100
Subject: [PATCH 03/26] feat(modtools): restructure moderation views into
 Pending/Checked/Trusted/Approved
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the Approved-page filter dropdown with four nav views:
- Pending  — unchanged: full pending queue (incl. posts still in their auto-approve
             hold window, where a mod can stop them before they go live).
- Checked  — live posts auto-approved via the automated checks, from auto-moderated
             (NULL posting status) members. Oversight only.
- Trusted  — live posts that went live without moderation from trusted (group-settings)
             members. Oversight only.
- Approved — unchanged: all live messages (Checked/Trusted are focused subsets).

- Go /modtools/messages: replace the autoapproved/recentjoin/outsidecga filters with
  view filters checked (approvedby NULL + poster status NULL) and trusted
  (approvedby NULL + poster status DEFAULT/UNMODERATED).
- Session work counts: add checked + trusted counts (last 24h, informational/blue,
  not added to the actionable total). Nav shows Pending red, Checked/Trusted blue,
  Approved none.
- New Checked/Trusted pages default to summary view; revert the Approved-page dropdown.
- Tests: replace the Go filter tests with checked/trusted; add Vitest specs for both pages.
---
 iznik-nuxt3/modtools/layouts/default.vue      |  16 ++
 .../messages/approved/[[id]]/[[term]].vue     |  35 ----
 .../messages/checked/[[id]]/[[term]].vue      | 170 ++++++++++++++++++
 .../messages/trusted/[[id]]/[[term]].vue      | 168 +++++++++++++++++
 .../pages/modtools/messages/checked.spec.js   | 158 ++++++++++++++++
 .../pages/modtools/messages/trusted.spec.js   | 158 ++++++++++++++++
 iznik-server-go/message/message_list.go       |  26 ++-
 iznik-server-go/session/session.go            |  39 ++++
 iznik-server-go/test/message_test.go          | 150 +++++++---------
 9 files changed, 780 insertions(+), 140 deletions(-)
 create mode 100644 iznik-nuxt3/modtools/pages/messages/checked/[[id]]/[[term]].vue
 create mode 100644 iznik-nuxt3/modtools/pages/messages/trusted/[[id]]/[[term]].vue
 create mode 100644 iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js
 create mode 100644 iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js

diff --git a/iznik-nuxt3/modtools/layouts/default.vue b/iznik-nuxt3/modtools/layouts/default.vue
index aac47517d2..df1b47d38e 100644
--- a/iznik-nuxt3/modtools/layouts/default.vue
+++ b/iznik-nuxt3/modtools/layouts/default.vue
@@ -92,6 +92,22 @@
           indent
           @mobilehidemenu="mobilehidemenu"
         />
+        <ModMenuItemLeft
+          link="/messages/checked"
+          name="Checked"
+          :count="['checked']"
+          count-variant="info"
+          indent
+          @mobilehidemenu="mobilehidemenu"
+        />
+        <ModMenuItemLeft
+          link="/messages/trusted"
+          name="Trusted"
+          :count="['trusted']"
+          count-variant="info"
+          indent
+          @mobilehidemenu="mobilehidemenu"
+        />
         <ModMenuItemLeft
           link="/messages/approved"
           name="Approved"
diff --git a/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue b/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue
index f715bcbe1b..41236251f7 100644
--- a/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue
+++ b/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue
@@ -19,14 +19,6 @@
       />
       <span v-else class="mt-2"> Select a community to search messages. </span>
       <ModtoolsViewControl misckey="modtoolsMessagesApprovedSummary" />
-      <b-form-select
-        v-model="filter"
-        size="sm"
-        class="mt-2 ms-2"
-        style="max-width: 220px"
-        :options="filterOptions"
-        aria-label="Filter approved messages"
-      />
     </div>
     <div>
       <NoticeMessage v-if="loaded && !messages.length && !busy" class="mt-2">
@@ -64,13 +56,11 @@
 import { ref, computed, watch, onMounted, nextTick } from 'vue'
 import { useRoute, useRouter } from '#imports'
 import { useMessageStore } from '@/stores/message'
-import { useMiscStore } from '@/stores/misc'
 import { setupModMessages } from '@/composables/useModMessages'
 import { useMe } from '~/composables/useMe'
 
 // Stores
 const messageStore = useMessageStore()
-const miscStore = useMiscStore()
 
 // Composables
 const modMessages = setupModMessages(true)
@@ -97,13 +87,6 @@ const {
 // Local state (formerly data())
 const chosengroupid = ref(0)
 const bump = ref(0)
-const filter = ref('')
-const filterOptions = [
-  { value: '', text: 'All messages' },
-  { value: 'recentjoin', text: 'Joined last 7 days' },
-  { value: 'autoapproved', text: 'Auto-approved' },
-  { value: 'outsidecga', text: 'Outside group area' },
-]
 const urlOverride = ref(false)
 const loaded = ref(false)
 const highlightMsgId = ref(null)
@@ -232,21 +215,6 @@ function searchedMessage(term) {
   }
 }
 
-watch(filter, (newVal) => {
-  // The auto-approved view is for scanning posts that went out without a human
-  // checking, so default it to the compact summary view.
-  if (newVal === 'autoapproved') {
-    miscStore.set({ key: 'modtoolsMessagesApprovedSummary', value: true })
-  }
-  show.value = 0
-  context.value = null
-  modMessages.listingIds.value = new Set()
-  modMessages.listingIdOrder.value = []
-  messageStore.clear()
-  bump.value++
-})
-
-
 function searchedMember(term) {
   show.value = 0
   messageTerm.value = null
@@ -321,9 +289,6 @@ async function loadMore($state) {
         modtools: true,
         summary: false,
       }
-      if (filter.value) {
-        params.filter = filter.value
-      }
     }
 
     params.context = context.value
diff --git a/iznik-nuxt3/modtools/pages/messages/checked/[[id]]/[[term]].vue b/iznik-nuxt3/modtools/pages/messages/checked/[[id]]/[[term]].vue
new file mode 100644
index 0000000000..22e0f303e0
--- /dev/null
+++ b/iznik-nuxt3/modtools/pages/messages/checked/[[id]]/[[term]].vue
@@ -0,0 +1,170 @@
+<template>
+  <div>
+    <client-only>
+      <ScrollToTop />
+      <div class="d-flex justify-content-between">
+        <ModGroupSelect
+          v-model="groupid"
+          all
+          modonly
+          remember="checked"
+          :url-override="urlOverride"
+        />
+        <ModtoolsViewControl :misckey="summaryKey" />
+      </div>
+      <NoticeMessage
+        v-if="!messages.length && !busy && groupsreceived"
+        class="mt-2"
+      >
+        No auto-checked messages have gone live yet. These are posts from
+        auto-moderated members that passed the automated checks.
+      </NoticeMessage>
+      <div v-if="groupsreceived">
+        <ModMessages />
+        <infinite-loading
+          direction="top"
+          :identifier="bump"
+          @infinite="loadMore"
+        >
+          <template #spinner>
+            <Spinner :size="50" />
+          </template>
+        </infinite-loading>
+      </div>
+      <NoticeMessage v-else class="mt-2"> Please wait... </NoticeMessage>
+    </client-only>
+  </div>
+</template>
+
+<script setup>
+// Oversight list of messages that have already gone live via the automated
+// content checks — i.e. auto-approved posts from auto-moderated (NULL posting
+// status) members. Posts still inside their hold window appear under Pending,
+// where a moderator can stop them before they go live.
+import { ref, computed, watch, onMounted, nextTick } from 'vue'
+import { useRoute, useRouter } from '#imports'
+import { setupModMessages } from '~/composables/useModMessages'
+import { useMessageStore } from '@/stores/message'
+import { useMiscStore } from '@/stores/misc'
+import { useModGroupStore } from '@/stores/modgroup'
+import { useMe } from '~/composables/useMe'
+
+const messageStore = useMessageStore()
+const miscStore = useMiscStore()
+const modGroupStore = useModGroupStore()
+const route = useRoute()
+
+const FILTER = 'checked'
+const summaryKey = 'modtoolsMessagesCheckedSummary'
+// Oversight lists default to the compact summary view.
+if (miscStore.get(summaryKey) === undefined) {
+  miscStore.set({ key: summaryKey, value: true })
+}
+
+const {
+  busy,
+  context,
+  group,
+  groupid,
+  show,
+  collection,
+  distance,
+  summarykey,
+  messages,
+  listingIds,
+} = setupModMessages(true)
+
+summarykey.value = summaryKey
+collection.value = 'Approved'
+
+const { me } = useMe()
+
+const id = computed(() =>
+  'id' in route.params && route.params.id ? parseInt(route.params.id) : 0
+)
+const groupsreceived = computed(() => modGroupStore.received)
+
+const bump = ref(0)
+const urlOverride = ref(false)
+
+watch(groupid, async (newVal) => {
+  const router = useRouter()
+  context.value = null
+  await modGroupStore.fetchIfNeedBeMT(newVal)
+  group.value = modGroupStore.get(newVal)
+  show.value = 0
+  bump.value++
+  if (newVal !== id.value) {
+    nextTick(() => {
+      router.push(
+        newVal === 0 ? '/messages/checked/' : '/messages/checked/' + newVal
+      )
+    })
+  }
+})
+
+onMounted(() => {
+  if (id.value) {
+    groupid.value = id.value
+    urlOverride.value = true
+  }
+  // Start from a clean slate so we don't show messages cached by another view.
+  show.value = 0
+  context.value = null
+  listingIds.value = new Set()
+  messageStore.clear()
+  bump.value++
+})
+
+async function loadMore($state) {
+  busy.value = true
+
+  if (!me.value) {
+    $state.loaded()
+    busy.value = false
+    return
+  } else if (show.value < messages.value.length) {
+    show.value = messages.value.length
+    $state.loaded()
+  } else {
+    const currentCount = Object.keys(messageStore.list).length
+
+    const params = {
+      groupid: groupid.value,
+      collection: collection.value,
+      filter: FILTER,
+      modtools: true,
+      summary: false,
+      context: context.value,
+      limit: messages.value.length + distance.value,
+    }
+
+    const fetchedIds = await messageStore.fetchMessagesMT(params)
+    if (fetchedIds) {
+      fetchedIds.forEach((mid) => listingIds.value.add(mid))
+    }
+    context.value = messageStore.context
+
+    const newCount = Object.keys(messageStore.list).length
+    if (currentCount === newCount) {
+      $state.complete()
+    } else {
+      $state.loaded()
+      show.value++
+    }
+  }
+  busy.value = false
+}
+
+defineExpose({
+  bump,
+  urlOverride,
+  id,
+  groupsreceived,
+  me,
+  busy,
+  messages,
+  groupid,
+  loadMore,
+})
+</script>
diff --git a/iznik-nuxt3/modtools/pages/messages/trusted/[[id]]/[[term]].vue b/iznik-nuxt3/modtools/pages/messages/trusted/[[id]]/[[term]].vue
new file mode 100644
index 0000000000..8e01084e12
--- /dev/null
+++ b/iznik-nuxt3/modtools/pages/messages/trusted/[[id]]/[[term]].vue
@@ -0,0 +1,168 @@
+<template>
+  <div>
+    <client-only>
+      <ScrollToTop />
+      <div class="d-flex justify-content-between">
+        <ModGroupSelect
+          v-model="groupid"
+          all
+          modonly
+          remember="trusted"
+          :url-override="urlOverride"
+        />
+        <ModtoolsViewControl :misckey="summaryKey" />
+      </div>
+      <NoticeMessage
+        v-if="!messages.length && !busy && groupsreceived"
+        class="mt-2"
+      >
+        No posts from trusted members have gone live recently. These are posts
+        from members on Group Settings that publish without moderation.
+      </NoticeMessage>
+      <div v-if="groupsreceived">
+        <ModMessages />
+        <infinite-loading
+          direction="top"
+          :identifier="bump"
+          @infinite="loadMore"
+        >
+          <template #spinner>
+            <Spinner :size="50" />
+          </template>
+        </infinite-loading>
+      </div>
+      <NoticeMessage v-else class="mt-2"> Please wait... </NoticeMessage>
+    </client-only>
+  </div>
+</template>
+
+<script setup>
+// Oversight list of messages that went live without moderation from trusted
+// (group-settings / DEFAULT posting status) members.
+import { ref, computed, watch, onMounted, nextTick } from 'vue'
+import { useRoute, useRouter } from '#imports'
+import { setupModMessages } from '~/composables/useModMessages'
+import { useMessageStore } from '@/stores/message'
+import { useMiscStore } from '@/stores/misc'
+import { useModGroupStore } from '@/stores/modgroup'
+import { useMe } from '~/composables/useMe'
+
+const messageStore = useMessageStore()
+const miscStore = useMiscStore()
+const modGroupStore = useModGroupStore()
+const route = useRoute()
+
+const FILTER = 'trusted'
+const summaryKey = 'modtoolsMessagesTrustedSummary'
+// Oversight lists default to the compact summary view.
+if (miscStore.get(summaryKey) === undefined) {
+  miscStore.set({ key: summaryKey, value: true })
+}
+
+const {
+  busy,
+  context,
+  group,
+  groupid,
+  show,
+  collection,
+  distance,
+  summarykey,
+  messages,
+  listingIds,
+} = setupModMessages(true)
+
+summarykey.value = summaryKey
+collection.value = 'Approved'
+
+const { me } = useMe()
+
+const id = computed(() =>
+  'id' in route.params && route.params.id ? parseInt(route.params.id) : 0
+)
+const groupsreceived = computed(() => modGroupStore.received)
+
+const bump = ref(0)
+const urlOverride = ref(false)
+
+watch(groupid, async (newVal) => {
+  const router = useRouter()
+  context.value = null
+  await modGroupStore.fetchIfNeedBeMT(newVal)
+  group.value = modGroupStore.get(newVal)
+  show.value = 0
+  bump.value++
+  if (newVal !== id.value) {
+    nextTick(() => {
+      router.push(
+        newVal === 0 ? '/messages/trusted/' : '/messages/trusted/' + newVal
+      )
+    })
+  }
+})
+
+onMounted(() => {
+  if (id.value) {
+    groupid.value = id.value
+    urlOverride.value = true
+  }
+  // Start from a clean slate so we don't show messages cached by another view.
+  show.value = 0
+  context.value = null
+  listingIds.value = new Set()
+  messageStore.clear()
+  bump.value++
+})
+
+async function loadMore($state) {
+  busy.value = true
+
+  if (!me.value) {
+    $state.loaded()
+    busy.value = false
+    return
+  } else if (show.value < messages.value.length) {
+    show.value = messages.value.length
+    $state.loaded()
+  } else {
+    const currentCount = Object.keys(messageStore.list).length
+
+    const params = {
+      groupid: groupid.value,
+      collection: collection.value,
+      filter: FILTER,
+      modtools: true,
+      summary: false,
+      context: context.value,
+      limit: messages.value.length + distance.value,
+    }
+
+    const fetchedIds = await messageStore.fetchMessagesMT(params)
+    if (fetchedIds) {
+      fetchedIds.forEach((mid) => listingIds.value.add(mid))
+    }
+    context.value = messageStore.context
+
+    const newCount = Object.keys(messageStore.list).length
+    if (currentCount === newCount) {
+      $state.complete()
+    } else {
+      $state.loaded()
+      show.value++
+    }
+  }
+  busy.value = false
+}
+
+defineExpose({
+  bump,
+  urlOverride,
+  id,
+  groupsreceived,
+  me,
+  busy,
+  messages,
+  groupid,
+  loadMore,
+})
+</script>
diff --git a/iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js b/iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js
new file mode 100644
index 0000000000..40ca473488
--- /dev/null
+++ b/iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js
@@ -0,0 +1,158 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import { ref, computed } from 'vue'
+import CheckedPage from '~/modtools/pages/messages/checked/[[id]]/[[term]].vue'
+
+const mockBusy = ref(false)
+const mockContext = ref(null)
+const mockGroup = ref(null)
+const mockGroupid = ref(0)
+const mockShow = ref(0)
+const mockCollection = ref(null)
+const mockDistance = ref(10)
+const mockSummarykey = ref(false)
+const mockMessages = ref([])
+const mockListingIds = ref(new Set())
+
+vi.mock('~/composables/useModMessages', () => ({
+  setupModMessages: () => ({
+    busy: mockBusy,
+    context: mockContext,
+    group: mockGroup,
+    groupid: mockGroupid,
+    show: mockShow,
+    collection: mockCollection,
+    distance: mockDistance,
+    summarykey: mockSummarykey,
+    messages: mockMessages,
+    listingIds: mockListingIds,
+  }),
+}))
+
+const mockMessageStore = {
+  list: {},
+  context: null,
+  fetchMessagesMT: vi.fn().mockResolvedValue([]),
+  clear: vi.fn(),
+}
+vi.mock('@/stores/message', () => ({
+  useMessageStore: () => mockMessageStore,
+}))
+
+const mockMiscStore = { get: vi.fn(), set: vi.fn() }
+vi.mock('@/stores/misc', () => ({
+  useMiscStore: () => mockMiscStore,
+}))
+
+const mockModGroupStore = {
+  received: true,
+  get: vi.fn(),
+  fetchIfNeedBeMT: vi.fn().mockResolvedValue(undefined),
+}
+vi.mock('@/stores/modgroup', () => ({
+  useModGroupStore: () => mockModGroupStore,
+}))
+
+vi.mock('~/composables/useMe', () => ({
+  useMe: () => ({ me: ref({ id: 1, displayname: 'Test User' }) }),
+}))
+
+const mockRouteParams = ref({ id: undefined, term: undefined })
+const mockRouterPush = vi.fn()
+
+vi.mock('#imports', async () => {
+  const actual = await vi.importActual('#imports')
+  return {
+    ...actual,
+    useRoute: () => ({ params: mockRouteParams.value, query: {} }),
+    useRouter: () => ({ push: mockRouterPush }),
+  }
+})
+
+globalThis.__testUseRoute = () => ({ params: mockRouteParams.value, query: {} })
+globalThis.__testUseRouter = () => ({
+  push: mockRouterPush,
+  replace: mockRouterPush,
+  currentRoute: { value: { path: '/' } },
+})
+
+describe('messages/checked/[[id]]/[[term]].vue page', () => {
+  function mountComponent() {
+    return mount(CheckedPage, {
+      global: {
+        plugins: [createPinia()],
+        stubs: {
+          'client-only': { template: '<div><slot /></div>' },
+          ScrollToTop: { template: '<div class="scroll-to-top" />' },
+          ModGroupSelect: {
+            template: '<div class="mod-group-select" />',
+            props: ['modelValue', 'all', 'modonly', 'remember', 'urlOverride'],
+          },
+          ModtoolsViewControl: {
+            template: '<div class="modtools-view-control" />',
+            props: ['misckey'],
+          },
+          NoticeMessage: {
+            template: '<div class="notice-message"><slot /></div>',
+          },
+          ModMessages: { template: '<div class="mod-messages" />' },
+          Spinner: { template: '<div class="spinner" />', props: ['size'] },
+          'infinite-loading': {
+            template:
+              '<div class="infinite-loading"><slot name="spinner" /></div>',
+            props: ['direction', 'distance', 'identifier'],
+            emits: ['infinite'],
+          },
+        },
+      },
+    })
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    setActivePinia(createPinia())
+    mockBusy.value = false
+    mockContext.value = null
+    mockGroupid.value = 0
+    mockShow.value = 0
+    mockCollection.value = null
+    mockMessages.value = []
+    mockListingIds.value = new Set()
+    mockMessageStore.list = {}
+    mockMessageStore.context = null
+    mockMiscStore.get.mockReturnValue(undefined)
+    mockRouteParams.value = { id: undefined, term: undefined }
+  })
+
+  it('mounts and targets the Approved collection', () => {
+    const wrapper = mountComponent()
+    expect(wrapper.exists()).toBe(true)
+    expect(mockCollection.value).toBe('Approved')
+  })
+
+  it('defaults the oversight list to summary view', () => {
+    mountComponent()
+    expect(mockMiscStore.set).toHaveBeenCalledWith({
+      key: 'modtoolsMessagesCheckedSummary',
+      value: true,
+    })
+  })
+
+  it('loadMore fetches with the checked filter on the Approved collection', async () => {
+    const wrapper = mountComponent()
+    const $state = { loaded: vi.fn(), complete: vi.fn(), error: vi.fn() }
+    await wrapper.vm.loadMore($state)
+    expect(mockMessageStore.fetchMessagesMT).toHaveBeenCalled()
+    const params = mockMessageStore.fetchMessagesMT.mock.calls[0][0]
+    expect(params.filter).toBe('checked')
+    expect(params.collection).toBe('Approved')
+  })
+
+  it('reads the group id from the route param', () => {
+    mockRouteParams.value = { id: '42', term: undefined }
+    const wrapper = mountComponent()
+    expect(wrapper.vm.id).toBe(42)
+    expect(mockGroupid.value).toBe(42)
+  })
+})
diff --git a/iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js b/iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js
new file mode 100644
index 0000000000..952a2aef2d
--- /dev/null
+++ b/iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js
@@ -0,0 +1,158 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import { ref } from 'vue'
+import TrustedPage from '~/modtools/pages/messages/trusted/[[id]]/[[term]].vue'
+
+const mockBusy = ref(false)
+const mockContext = ref(null)
+const mockGroup = ref(null)
+const mockGroupid = ref(0)
+const mockShow = ref(0)
+const mockCollection = ref(null)
+const mockDistance = ref(10)
+const mockSummarykey = ref(false)
+const mockMessages = ref([])
+const mockListingIds = ref(new Set())
+
+vi.mock('~/composables/useModMessages', () => ({
+  setupModMessages: () => ({
+    busy: mockBusy,
+    context: mockContext,
+    group: mockGroup,
+    groupid: mockGroupid,
+    show: mockShow,
+    collection: mockCollection,
+    distance: mockDistance,
+    summarykey: mockSummarykey,
+    messages: mockMessages,
+    listingIds: mockListingIds,
+  }),
+}))
+
+const mockMessageStore = {
+  list: {},
+  context: null,
+  fetchMessagesMT: vi.fn().mockResolvedValue([]),
+  clear: vi.fn(),
+}
+vi.mock('@/stores/message', () => ({
+  useMessageStore: () => mockMessageStore,
+}))
+
+const mockMiscStore = { get: vi.fn(), set: vi.fn() }
+vi.mock('@/stores/misc', () => ({
+  useMiscStore: () => mockMiscStore,
+}))
+
+const mockModGroupStore = {
+  received: true,
+  get: vi.fn(),
+  fetchIfNeedBeMT: vi.fn().mockResolvedValue(undefined),
+}
+vi.mock('@/stores/modgroup', () => ({
+  useModGroupStore: () => mockModGroupStore,
+}))
+
+vi.mock('~/composables/useMe', () => ({
+  useMe: () => ({ me: ref({ id: 1, displayname: 'Test User' }) }),
+}))
+
+const mockRouteParams = ref({ id: undefined, term: undefined })
+const mockRouterPush = vi.fn()
+
+vi.mock('#imports', async () => {
+  const actual = await vi.importActual('#imports')
+  return {
+    ...actual,
+    useRoute: () => ({ params: mockRouteParams.value, query: {} }),
+    useRouter: () => ({ push: mockRouterPush }),
+  }
+})
+
+globalThis.__testUseRoute = () => ({ params: mockRouteParams.value, query: {} })
+globalThis.__testUseRouter = () => ({
+  push: mockRouterPush,
+  replace: mockRouterPush,
+  currentRoute: { value: { path: '/' } },
+})
+
+describe('messages/trusted/[[id]]/[[term]].vue page', () => {
+  function mountComponent() {
+    return mount(TrustedPage, {
+      global: {
+        plugins: [createPinia()],
+        stubs: {
+          'client-only': { template: '<div><slot /></div>' },
+          ScrollToTop: { template: '<div class="scroll-to-top" />' },
+          ModGroupSelect: {
+            template: '<div class="mod-group-select" />',
+            props: ['modelValue', 'all', 'modonly', 'remember', 'urlOverride'],
+          },
+          ModtoolsViewControl: {
+            template: '<div class="modtools-view-control" />',
+            props: ['misckey'],
+          },
+          NoticeMessage: {
+            template: '<div class="notice-message"><slot /></div>',
+          },
+          ModMessages: { template: '<div class="mod-messages" />' },
+          Spinner: { template: '<div class="spinner" />', props: ['size'] },
+          'infinite-loading': {
+            template:
+              '<div class="infinite-loading"><slot name="spinner" /></div>',
+            props: ['direction', 'distance', 'identifier'],
+            emits: ['infinite'],
+          },
+        },
+      },
+    })
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    setActivePinia(createPinia())
+    mockBusy.value = false
+    mockContext.value = null
+    mockGroupid.value = 0
+    mockShow.value = 0
+    mockCollection.value = null
+    mockMessages.value = []
+    mockListingIds.value = new Set()
+    mockMessageStore.list = {}
+    mockMessageStore.context = null
+    mockMiscStore.get.mockReturnValue(undefined)
+    mockRouteParams.value = { id: undefined, term: undefined }
+  })
+
+  it('mounts and targets the Approved collection', () => {
+    const wrapper = mountComponent()
+    expect(wrapper.exists()).toBe(true)
+    expect(mockCollection.value).toBe('Approved')
+  })
+
+  it('defaults the oversight list to summary view', () => {
+    mountComponent()
+    expect(mockMiscStore.set).toHaveBeenCalledWith({
+      key: 'modtoolsMessagesTrustedSummary',
+      value: true,
+    })
+  })
+
+  it('loadMore fetches with the trusted filter on the Approved collection', async () => {
+    const wrapper = mountComponent()
+    const $state = { loaded: vi.fn(), complete: vi.fn(), error: vi.fn() }
+    await wrapper.vm.loadMore($state)
+    expect(mockMessageStore.fetchMessagesMT).toHaveBeenCalled()
+    const params = mockMessageStore.fetchMessagesMT.mock.calls[0][0]
+    expect(params.filter).toBe('trusted')
+    expect(params.collection).toBe('Approved')
+  })
+
+  it('reads the group id from the route param', () => {
+    mockRouteParams.value = { id: '42', term: undefined }
+    const wrapper = mountComponent()
+    expect(wrapper.vm.id).toBe(42)
+    expect(mockGroupid.value).toBe(42)
+  })
+})
diff --git a/iznik-server-go/message/message_list.go b/iznik-server-go/message/message_list.go
index 189e526d5b..f10d7c2388 100644
--- a/iznik-server-go/message/message_list.go
+++ b/iznik-server-go/message/message_list.go
@@ -448,10 +448,10 @@ func ListMessagesMT(c *fiber.Ctx) error {
 	search := c.Query("search", "")
 	fromuserStr := c.Query("fromuser", "0")
 	fromuser, _ := strconv.ParseUint(fromuserStr, 10, 64)
-	// Optional moderation filter for the standard (non-search) listing:
-	//   autoapproved — posts approved without a moderator (mg.approvedby IS NULL)
-	//   recentjoin   — posts from members who joined this group in the last 7 days
-	//   outsidecga   — posts whose location falls outside the group's area polygon
+	// Optional oversight view of the Approved collection (non-search listing):
+	//   checked — live posts auto-approved via the automated checks, from
+	//             auto-moderated (NULL posting status) members
+	//   trusted — live posts from trusted (group-settings) members
 	filter := c.Query("filter", "")
 
 	var msgIDs []uint64
@@ -562,18 +562,14 @@ func ListMessagesMT(c *fiber.Ctx) error {
 		filterJoin := ""
 		filterWhere := ""
 		switch filter {
-		case "autoapproved":
-			filterWhere = "AND mg.approvedby IS NULL "
-		case "recentjoin":
+		case "checked":
+			// Auto-approved (approvedby NULL) from auto-moderated (NULL) members.
 			filterJoin = "INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "
-			filterWhere = "AND mem.added >= NOW() - INTERVAL 7 DAY "
-		case "outsidecga":
-			// Use the canonical spatial point (messages_spatial), matching how
-			// location containment is checked elsewhere. Unmappable posts (no
-			// spatial row) can't be "outside" and are excluded by the INNER JOIN.
-			filterJoin = "INNER JOIN `groups` g ON g.id = mg.groupid " +
-				"INNER JOIN messages_spatial ms ON ms.msgid = mg.msgid AND ms.groupid = mg.groupid "
-			filterWhere = "AND g.polyindex IS NOT NULL AND NOT ST_Contains(g.polyindex, ms.point) "
+			filterWhere = "AND mg.approvedby IS NULL AND mem.ourPostingStatus IS NULL "
+		case "trusted":
+			// Went live without moderation from trusted (group-settings) members.
+			filterJoin = "INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "
+			filterWhere = "AND mg.approvedby IS NULL AND (mem.ourPostingStatus = 'DEFAULT' OR mem.ourPostingStatus = 'UNMODERATED') "
 		}
 
 		branchSQL := "SELECT mg.msgid, mg.arrival FROM messages_groups mg " +
diff --git a/iznik-server-go/session/session.go b/iznik-server-go/session/session.go
index 0c3a5aea7d..ebdec5f7a4 100644
--- a/iznik-server-go/session/session.go
+++ b/iznik-server-go/session/session.go
@@ -1030,6 +1030,10 @@ func GetSession(c *fiber.Ctx) error {
 		var housekeeping, cronjobs int64
 		var emailin, emailout int64
 		var helperEscalated int64
+		// Informational (blue) counts of recently-live posts for the oversight
+		// views: checked = auto-approved posts from auto-moderated (NULL) members;
+		// trusted = posts that went live from trusted (group-settings) members.
+		var checked, trusted int64
 
 		var wg2 sync.WaitGroup
 
@@ -1076,6 +1080,39 @@ func GetSession(c *fiber.Ctx) error {
 			}
 		}()
 
+		// --- Checked: recently auto-approved posts from auto-moderated (NULL) members.
+		// Informational oversight count (blue), bounded to the last 24h so it stays
+		// useful rather than the unbounded all-time approved total. ---
+		wg2.Add(1)
+		go func() {
+			defer wg2.Done()
+			db.Raw("SELECT COUNT(*) FROM messages_groups mg "+
+				"INNER JOIN messages m ON m.id = mg.msgid "+
+				"INNER JOIN users u ON u.id = m.fromuser "+
+				"INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "+
+				"WHERE mg.groupid IN ? AND mg.collection = ? AND mg.deleted = 0 "+
+				"AND m.deleted IS NULL AND u.deleted IS NULL "+
+				"AND mg.approvedby IS NULL AND mem.ourPostingStatus IS NULL "+
+				"AND mg.arrival >= NOW() - INTERVAL 1 DAY",
+				modGroupIDs, utils.COLLECTION_APPROVED).Scan(&checked)
+		}()
+
+		// --- Trusted: recently-live posts from trusted (group-settings) members.
+		// Informational oversight count (blue), bounded to the last 24h. ---
+		wg2.Add(1)
+		go func() {
+			defer wg2.Done()
+			db.Raw("SELECT COUNT(*) FROM messages_groups mg "+
+				"INNER JOIN messages m ON m.id = mg.msgid "+
+				"INNER JOIN users u ON u.id = m.fromuser "+
+				"INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "+
+				"WHERE mg.groupid IN ? AND mg.collection = ? AND mg.deleted = 0 "+
+				"AND m.deleted IS NULL AND u.deleted IS NULL "+
+				"AND mg.approvedby IS NULL AND mem.ourPostingStatus IN ('DEFAULT', 'UNMODERATED') "+
+				"AND mg.arrival >= NOW() - INTERVAL 1 DAY",
+				modGroupIDs, utils.COLLECTION_APPROVED).Scan(&trusted)
+		}()
+
 		// --- Spam messages (only for active groups) ---
 		wg2.Add(1)
 		go func() {
@@ -1452,6 +1489,8 @@ func GetSession(c *fiber.Ctx) error {
 		work = fiber.Map{
 			"pending":              pending,
 			"pendingother":         pendingother,
+			"checked":              checked,
+			"trusted":              trusted,
 			"spam":                 spam,
 			"pendingmembers":       pendingmembers,
 			"spammembers":          spammembers,
diff --git a/iznik-server-go/test/message_test.go b/iznik-server-go/test/message_test.go
index 2f20e5d3eb..51d74d02c4 100644
--- a/iznik-server-go/test/message_test.go
+++ b/iznik-server-go/test/message_test.go
@@ -5552,136 +5552,106 @@ func TestListMessagesMT_LimboUserMessageNotReturned(t *testing.T) {
 	db.Exec("UPDATE users SET deleted = NULL WHERE id = ?", posterID)
 }
 
-func TestListMessagesMT_FilterAutoApproved(t *testing.T) {
-	// filter=autoapproved returns only posts approved without a moderator
-	// (messages_groups.approvedby IS NULL).
-	prefix := uniquePrefix("lstmt_autoapp")
+func TestListMessagesMT_FilterChecked(t *testing.T) {
+	// filter=checked returns live posts auto-approved (approvedby IS NULL) from
+	// auto-moderated (NULL posting status) members — not trusted-member posts and
+	// not mod-approved posts.
+	prefix := uniquePrefix("lstmt_checked")
 	db := database.DBConn
 
 	groupID := CreateTestGroup(t, prefix)
-	posterID := CreateTestUser(t, prefix+"_poster", "User")
+	nullPoster := CreateTestUser(t, prefix+"_null", "User")
+	defaultPoster := CreateTestUser(t, prefix+"_default", "User")
 	modID := CreateTestUser(t, prefix+"_mod", "User")
-	CreateTestMembership(t, posterID, groupID, "Member")
+	CreateTestMembership(t, nullPoster, groupID, "Member")
+	CreateTestMembership(t, defaultPoster, groupID, "Member")
 	CreateTestMembership(t, modID, groupID, "Moderator")
+	db.Exec("UPDATE memberships SET ourPostingStatus = NULL WHERE userid = ? AND groupid = ?", nullPoster, groupID)
+	db.Exec("UPDATE memberships SET ourPostingStatus = 'DEFAULT' WHERE userid = ? AND groupid = ?", defaultPoster, groupID)
 	_, modToken := CreateTestSession(t, modID)
 
-	autoMsg := CreateTestMessage(t, posterID, groupID, prefix+" auto approved", 52.0, -1.0)
-	manualMsg := CreateTestMessage(t, posterID, groupID, prefix+" mod approved", 52.0, -1.0)
-	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL WHERE msgid=?", autoMsg)
-	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=? WHERE msgid=?", modID, manualMsg)
+	checkedMsg := CreateTestMessage(t, nullPoster, groupID, prefix+" auto checked", 52.0, -1.0)
+	trustedMsg := CreateTestMessage(t, defaultPoster, groupID, prefix+" trusted live", 52.0, -1.0)
+	modApprovedMsg := CreateTestMessage(t, nullPoster, groupID, prefix+" mod approved", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL WHERE msgid IN (?, ?)", checkedMsg, trustedMsg)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=? WHERE msgid=?", modID, modApprovedMsg)
 
 	resp, err := getApp().Test(httptest.NewRequest("GET",
-		fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Approved&filter=autoapproved&jwt=%s", groupID, modToken), nil))
+		fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Approved&filter=checked&jwt=%s", groupID, modToken), nil))
 	assert.NoError(t, err)
 	assert.Equal(t, 200, resp.StatusCode)
 
 	var body map[string]interface{}
 	json.NewDecoder(resp.Body).Decode(&body)
 	msgs, _ := body["messages"].([]interface{})
-	foundAuto, foundManual := false, false
+	foundChecked, foundTrusted, foundMod := false, false, false
 	for _, id := range msgs {
-		if id == float64(autoMsg) {
-			foundAuto = true
-		}
-		if id == float64(manualMsg) {
-			foundManual = true
+		switch id {
+		case float64(checkedMsg):
+			foundChecked = true
+		case float64(trustedMsg):
+			foundTrusted = true
+		case float64(modApprovedMsg):
+			foundMod = true
 		}
 	}
-	assert.True(t, foundAuto, "auto-approved message should appear under autoapproved filter")
-	assert.False(t, foundManual, "mod-approved message should not appear under autoapproved filter")
+	assert.True(t, foundChecked, "auto-approved post from NULL member should appear under checked")
+	assert.False(t, foundTrusted, "trusted-member post should not appear under checked")
+	assert.False(t, foundMod, "mod-approved post should not appear under checked")
 
-	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?)", autoMsg, manualMsg)
-	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", autoMsg, manualMsg)
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg)
 }
 
-func TestListMessagesMT_FilterRecentJoin(t *testing.T) {
-	// filter=recentjoin returns only posts from members who joined this group
-	// within the last 7 days.
-	prefix := uniquePrefix("lstmt_recentjoin")
+func TestListMessagesMT_FilterTrusted(t *testing.T) {
+	// filter=trusted returns live posts (approvedby IS NULL) from trusted
+	// (DEFAULT/UNMODERATED posting status) members — not auto-moderated NULL
+	// members and not mod-approved posts.
+	prefix := uniquePrefix("lstmt_trusted")
 	db := database.DBConn
 
 	groupID := CreateTestGroup(t, prefix)
-	recentID := CreateTestUser(t, prefix+"_recent", "User")
-	oldID := CreateTestUser(t, prefix+"_old", "User")
+	nullPoster := CreateTestUser(t, prefix+"_null", "User")
+	defaultPoster := CreateTestUser(t, prefix+"_default", "User")
 	modID := CreateTestUser(t, prefix+"_mod", "User")
-	CreateTestMembership(t, recentID, groupID, "Member")
-	CreateTestMembership(t, oldID, groupID, "Member")
+	CreateTestMembership(t, nullPoster, groupID, "Member")
+	CreateTestMembership(t, defaultPoster, groupID, "Member")
 	CreateTestMembership(t, modID, groupID, "Moderator")
+	db.Exec("UPDATE memberships SET ourPostingStatus = NULL WHERE userid = ? AND groupid = ?", nullPoster, groupID)
+	db.Exec("UPDATE memberships SET ourPostingStatus = 'DEFAULT' WHERE userid = ? AND groupid = ?", defaultPoster, groupID)
 	_, modToken := CreateTestSession(t, modID)
 
-	// The old member joined 30 days ago.
-	db.Exec("UPDATE memberships SET added = NOW() - INTERVAL 30 DAY WHERE userid = ? AND groupid = ?", oldID, groupID)
-
-	recentMsg := CreateTestMessage(t, recentID, groupID, prefix+" recent joiner post", 52.0, -1.0)
-	oldMsg := CreateTestMessage(t, oldID, groupID, prefix+" old joiner post", 52.0, -1.0)
+	checkedMsg := CreateTestMessage(t, nullPoster, groupID, prefix+" auto checked", 52.0, -1.0)
+	trustedMsg := CreateTestMessage(t, defaultPoster, groupID, prefix+" trusted live", 52.0, -1.0)
+	modApprovedMsg := CreateTestMessage(t, defaultPoster, groupID, prefix+" mod approved", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL WHERE msgid IN (?, ?)", checkedMsg, trustedMsg)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=? WHERE msgid=?", modID, modApprovedMsg)
 
 	resp, err := getApp().Test(httptest.NewRequest("GET",
-		fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Approved&filter=recentjoin&jwt=%s", groupID, modToken), nil))
+		fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Approved&filter=trusted&jwt=%s", groupID, modToken), nil))
 	assert.NoError(t, err)
 	assert.Equal(t, 200, resp.StatusCode)
 
 	var body map[string]interface{}
 	json.NewDecoder(resp.Body).Decode(&body)
 	msgs, _ := body["messages"].([]interface{})
-	foundRecent, foundOld := false, false
+	foundChecked, foundTrusted, foundMod := false, false, false
 	for _, id := range msgs {
-		if id == float64(recentMsg) {
-			foundRecent = true
-		}
-		if id == float64(oldMsg) {
-			foundOld = true
-		}
-	}
-	assert.True(t, foundRecent, "recent joiner's post should appear under recentjoin filter")
-	assert.False(t, foundOld, "long-standing member's post should not appear under recentjoin filter")
-
-	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?)", recentMsg, oldMsg)
-	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", recentMsg, oldMsg)
-}
-
-func TestListMessagesMT_FilterOutsideCGA(t *testing.T) {
-	// filter=outsidecga returns only posts whose location falls outside the
-	// group's area polygon.
-	prefix := uniquePrefix("lstmt_outcga")
-	db := database.DBConn
-
-	groupID := CreateTestGroup(t, prefix)
-	posterID := CreateTestUser(t, prefix+"_poster", "User")
-	modID := CreateTestUser(t, prefix+"_mod", "User")
-	CreateTestMembership(t, posterID, groupID, "Member")
-	CreateTestMembership(t, modID, groupID, "Moderator")
-	_, modToken := CreateTestSession(t, modID)
-
-	// Define the group's area: a small box around (lng -1.0, lat 52.0). Freegle
-	// stores degrees labelled SRID 3857, matching messages_spatial.point.
-	db.Exec("UPDATE `groups` SET polyindex = ST_GeomFromText('POLYGON((-1.1 51.9, -0.9 51.9, -0.9 52.1, -1.1 52.1, -1.1 51.9))', 3857) WHERE id = ?", groupID)
-
-	insideMsg := CreateTestMessage(t, posterID, groupID, prefix+" inside area", 52.0, -1.0)
-	outsideMsg := CreateTestMessage(t, posterID, groupID, prefix+" outside area", 52.0, -5.0)
-
-	resp, err := getApp().Test(httptest.NewRequest("GET",
-		fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Approved&filter=outsidecga&jwt=%s", groupID, modToken), nil))
-	assert.NoError(t, err)
-	assert.Equal(t, 200, resp.StatusCode)
-
-	var body map[string]interface{}
-	json.NewDecoder(resp.Body).Decode(&body)
-	msgs, _ := body["messages"].([]interface{})
-	foundInside, foundOutside := false, false
-	for _, id := range msgs {
-		if id == float64(insideMsg) {
-			foundInside = true
-		}
-		if id == float64(outsideMsg) {
-			foundOutside = true
+		switch id {
+		case float64(checkedMsg):
+			foundChecked = true
+		case float64(trustedMsg):
+			foundTrusted = true
+		case float64(modApprovedMsg):
+			foundMod = true
 		}
 	}
-	assert.True(t, foundOutside, "out-of-area post should appear under outsidecga filter")
-	assert.False(t, foundInside, "in-area post should not appear under outsidecga filter")
+	assert.True(t, foundTrusted, "trusted-member post should appear under trusted")
+	assert.False(t, foundChecked, "auto-moderated NULL-member post should not appear under trusted")
+	assert.False(t, foundMod, "mod-approved post should not appear under trusted")
 
-	db.Exec("DELETE FROM messages_spatial WHERE msgid IN (?, ?)", insideMsg, outsideMsg)
-	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?)", insideMsg, outsideMsg)
-	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", insideMsg, outsideMsg)
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg)
 }
 
 func TestListMessagesPendingUnauthorized(t *testing.T) {

From 26c7fd8b2ea300f8d822fb05537c7da6ab06c880 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Thu, 4 Jun 2026 09:08:50 +0100
Subject: [PATCH 04/26] feat(modtools): track moderator review of
 auto-published posts (checkedby/checkedat)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Auto-published posts (auto-moderated Checked + trusted Trusted members) have no
field recording that a mod has reviewed them — approvedby is NULL, contentcheck_*
is only the automated pass. Add checkedat/checkedby to messages_groups so the
Checked/Trusted oversight queues become real, clearable 'unchecked' queues.

- Migration: messages_groups.checkedat + checkedby (FK users), composite index.
- session.go: Checked/Trusted counts now = UNCHECKED within the auto-check window
  (was 24h volume), so the badge is outstanding work that drops as mods check.
- message_list.go: checked/trusted views show only unchecked-within-window posts.
- POST /modtools/messages/markchecked: mark posts (or a whole bucket) checked.
- Window is a named constant (utils.MESSAGE_CHECK_WINDOW_DAYS=7), not hardcoded
  in SQL strings; posts auto-check after the window so the queue can't pile up.
---
 ...add_checked_columns_to_messages_groups.php | 39 +++++++++
 iznik-server-go/message/markchecked.go        | 86 +++++++++++++++++++
 iznik-server-go/message/message_list.go       | 12 ++-
 iznik-server-go/router/routes.go              |  1 +
 iznik-server-go/session/session.go            | 24 ++++--
 iznik-server-go/utils/utils.go                |  5 ++
 6 files changed, 157 insertions(+), 10 deletions(-)
 create mode 100644 iznik-batch/database/migrations/2026_06_04_000001_add_checked_columns_to_messages_groups.php
 create mode 100644 iznik-server-go/message/markchecked.go

diff --git a/iznik-batch/database/migrations/2026_06_04_000001_add_checked_columns_to_messages_groups.php b/iznik-batch/database/migrations/2026_06_04_000001_add_checked_columns_to_messages_groups.php
new file mode 100644
index 0000000000..5ffd009837
--- /dev/null
+++ b/iznik-batch/database/migrations/2026_06_04_000001_add_checked_columns_to_messages_groups.php
@@ -0,0 +1,39 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Track moderator review of auto-published posts.
+ *
+ * Posts that go live without a manual approval (auto-moderated "Checked" members
+ * and trusted "Trusted" members) have no field recording that a moderator has
+ * since eyeballed them — approvedby is NULL, contentcheck_* is only the automated
+ * pass, and heldby/spamreason/reviewrequestedat are unrelated. These columns give
+ * the ModTools Checked/Trusted oversight queues a real, clearable "unchecked"
+ * count: a mod marks a post checked, and it leaves the queue.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('messages_groups', function (Blueprint $table) {
+            $table->timestamp('checkedat')->nullable()->after('rejectedat');
+            $table->unsignedBigInteger('checkedby')->nullable()->after('checkedat');
+
+            $table->foreign('checkedby')->references('id')->on('users')->onDelete('set null');
+            // Composite index supports the "unchecked in this group" oversight query.
+            $table->index(['groupid', 'checkedat'], 'messages_groups_groupid_checkedat_idx');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('messages_groups', function (Blueprint $table) {
+            $table->dropForeign(['checkedby']);
+            $table->dropIndex('messages_groups_groupid_checkedat_idx');
+            $table->dropColumn(['checkedat', 'checkedby']);
+        });
+    }
+};
diff --git a/iznik-server-go/message/markchecked.go b/iznik-server-go/message/markchecked.go
new file mode 100644
index 0000000000..39b0f28257
--- /dev/null
+++ b/iznik-server-go/message/markchecked.go
@@ -0,0 +1,86 @@
+package message
+
+import (
+	"fmt"
+
+	"github.com/freegle/iznik-server-go/database"
+	"github.com/freegle/iznik-server-go/user"
+	"github.com/freegle/iznik-server-go/utils"
+	"github.com/gofiber/fiber/v2"
+)
+
+// MarkCheckedRequest is the request body for marking auto-published posts as
+// checked by a moderator (clearing them from the Checked/Trusted oversight queues).
+type MarkCheckedRequest struct {
+	Groupid uint64   `json:"groupid"`          // 0 = all of the mod's groups
+	Filter  string   `json:"filter"`           // "checked" or "trusted" (used when no ids given)
+	IDs     []uint64 `json:"ids,omitempty"`    // specific messages, else mark the whole bucket
+}
+
+// MarkChecked records that a moderator has reviewed auto-published posts. These
+// are posts that went live without a manual approval (auto-moderated and trusted
+// members), so there is no approvedby/heldby to key off — this sets a dedicated
+// checkedat/checkedby marker that drives the Checked/Trusted counts.
+//
+// @Summary Mark auto-published posts as checked by a moderator
+// @Tags message
+// @Accept json
+// @Produce json
+// @Success 200 {object} map[string]interface{}
+// @Router /modtools/messages/markchecked [post]
+func MarkChecked(c *fiber.Ctx) error {
+	myid := user.WhoAmI(c)
+	if myid == 0 {
+		return fiber.NewError(fiber.StatusUnauthorized, "Not logged in")
+	}
+
+	var req MarkCheckedRequest
+	if err := c.BodyParser(&req); err != nil {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid request body")
+	}
+
+	db := database.DBConn
+
+	// Resolve the groups the mod may act on.
+	var groupIDs []uint64
+	if req.Groupid == 0 {
+		groupIDs = user.GetActiveModGroupIDs(myid)
+		if len(groupIDs) == 0 {
+			return c.JSON(fiber.Map{"success": true, "checked": 0})
+		}
+	} else {
+		if !user.IsModOfGroup(myid, req.Groupid) {
+			return fiber.NewError(fiber.StatusForbidden, "Not a moderator for this group")
+		}
+		groupIDs = []uint64{req.Groupid}
+	}
+
+	var rowsAffected int64
+	if len(req.IDs) > 0 {
+		// Mark the specified posts checked — only ones still unchecked, and only
+		// on groups the mod moderates.
+		r := db.Exec("UPDATE messages_groups SET checkedat = NOW(), checkedby = ? "+
+			"WHERE msgid IN ? AND groupid IN ? AND checkedat IS NULL",
+			myid, req.IDs, groupIDs)
+		rowsAffected = r.RowsAffected
+	} else {
+		// Mark the whole bucket checked (the "mark all as checked" action). The
+		// bucket condition mirrors the Checked/Trusted list filter so exactly the
+		// posts a mod is looking at get cleared.
+		statusWhere := "mem.ourPostingStatus IS NULL"
+		if req.Filter == "trusted" {
+			statusWhere = "(mem.ourPostingStatus = 'DEFAULT' OR mem.ourPostingStatus = 'UNMODERATED')"
+		}
+		r := db.Exec("UPDATE messages_groups mg "+
+			"INNER JOIN messages m ON m.id = mg.msgid "+
+			"INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "+
+			"SET mg.checkedat = NOW(), mg.checkedby = ? "+
+			"WHERE mg.groupid IN ? AND mg.collection = ? AND mg.deleted = 0 "+
+			"AND mg.approvedby IS NULL AND "+statusWhere+" "+
+			fmt.Sprintf("AND mg.checkedat IS NULL AND mg.arrival >= NOW() - INTERVAL %d DAY", utils.MESSAGE_CHECK_WINDOW_DAYS),
+			myid, groupIDs, utils.COLLECTION_APPROVED)
+		rowsAffected = r.RowsAffected
+	}
+
+	return c.JSON(fiber.Map{"success": true, "checked": rowsAffected})
+}
diff --git a/iznik-server-go/message/message_list.go b/iznik-server-go/message/message_list.go
index f10d7c2388..25b685dc38 100644
--- a/iznik-server-go/message/message_list.go
+++ b/iznik-server-go/message/message_list.go
@@ -2,6 +2,7 @@ package message
 
 import (
 	"encoding/json"
+	"fmt"
 	"os"
 	"strconv"
 	"strings"
@@ -561,15 +562,22 @@ func ListMessagesMT(c *fiber.Ctx) error {
 		// injected SQL is constant (no user-supplied text reaches the query).
 		filterJoin := ""
 		filterWhere := ""
+		// The Checked/Trusted oversight queues show only posts a mod has NOT yet
+		// marked checked, within the auto-check window — so the list matches the
+		// session work-count badge and clears as posts are checked.
+		checkedWindow := fmt.Sprintf(
+			"AND mg.checkedat IS NULL AND mg.arrival >= NOW() - INTERVAL %d DAY ",
+			utils.MESSAGE_CHECK_WINDOW_DAYS,
+		)
 		switch filter {
 		case "checked":
 			// Auto-approved (approvedby NULL) from auto-moderated (NULL) members.
 			filterJoin = "INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "
-			filterWhere = "AND mg.approvedby IS NULL AND mem.ourPostingStatus IS NULL "
+			filterWhere = "AND mg.approvedby IS NULL AND mem.ourPostingStatus IS NULL " + checkedWindow
 		case "trusted":
 			// Went live without moderation from trusted (group-settings) members.
 			filterJoin = "INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "
-			filterWhere = "AND mg.approvedby IS NULL AND (mem.ourPostingStatus = 'DEFAULT' OR mem.ourPostingStatus = 'UNMODERATED') "
+			filterWhere = "AND mg.approvedby IS NULL AND (mem.ourPostingStatus = 'DEFAULT' OR mem.ourPostingStatus = 'UNMODERATED') " + checkedWindow
 		}
 
 		branchSQL := "SELECT mg.msgid, mg.arrival FROM messages_groups mg " +
diff --git a/iznik-server-go/router/routes.go b/iznik-server-go/router/routes.go
index 3cfb4dd53c..6cfd423999 100644
--- a/iznik-server-go/router/routes.go
+++ b/iznik-server-go/router/routes.go
@@ -868,6 +868,7 @@ func SetupRoutes(app *fiber.App) {
 		// @Tags message
 		rg.Get("/messages", deprecation.Marker("GET /messages", "2026-08-01"), message.ListMessages)
 		rg.Get("/modtools/messages", message.ListMessagesMT)
+		rg.Post("/modtools/messages/markchecked", message.MarkChecked)
 
 		// Message Count
 		// @Router /message/count [get]
diff --git a/iznik-server-go/session/session.go b/iznik-server-go/session/session.go
index ebdec5f7a4..260231ae8c 100644
--- a/iznik-server-go/session/session.go
+++ b/iznik-server-go/session/session.go
@@ -1030,13 +1030,21 @@ func GetSession(c *fiber.Ctx) error {
 		var housekeeping, cronjobs int64
 		var emailin, emailout int64
 		var helperEscalated int64
-		// Informational (blue) counts of recently-live posts for the oversight
+		// Informational (blue) counts of UNCHECKED live posts for the oversight
 		// views: checked = auto-approved posts from auto-moderated (NULL) members;
 		// trusted = posts that went live from trusted (group-settings) members.
+		// A post leaves the count when a mod marks it checked (checkedat set) or
+		// after 7 days (auto-checked, so the queue can't pile up indefinitely).
 		var checked, trusted int64
 
 		var wg2 sync.WaitGroup
 
+		// Oversight queues count only unchecked posts within the auto-check window.
+		checkedWindowSQL := fmt.Sprintf(
+			"AND mg.checkedat IS NULL AND mg.arrival >= NOW() - INTERVAL %d DAY",
+			utils.MESSAGE_CHECK_WINDOW_DAYS,
+		)
+
 		// --- Pending messages: active groups split by held, inactive all → pendingother ---
 		// Only count messages where contentcheck_checked_at IS NOT NULL: the content
 		// check has run and left the message pending (moderated user/group or flagged
@@ -1080,9 +1088,9 @@ func GetSession(c *fiber.Ctx) error {
 			}
 		}()
 
-		// --- Checked: recently auto-approved posts from auto-moderated (NULL) members.
-		// Informational oversight count (blue), bounded to the last 24h so it stays
-		// useful rather than the unbounded all-time approved total. ---
+		// --- Checked: UNCHECKED auto-approved posts from auto-moderated (NULL) members.
+		// Outstanding oversight work (blue): a mod hasn't marked it checked and it
+		// is within the 7-day auto-check window. ---
 		wg2.Add(1)
 		go func() {
 			defer wg2.Done()
@@ -1093,12 +1101,12 @@ func GetSession(c *fiber.Ctx) error {
 				"WHERE mg.groupid IN ? AND mg.collection = ? AND mg.deleted = 0 "+
 				"AND m.deleted IS NULL AND u.deleted IS NULL "+
 				"AND mg.approvedby IS NULL AND mem.ourPostingStatus IS NULL "+
-				"AND mg.arrival >= NOW() - INTERVAL 1 DAY",
+				checkedWindowSQL,
 				modGroupIDs, utils.COLLECTION_APPROVED).Scan(&checked)
 		}()
 
-		// --- Trusted: recently-live posts from trusted (group-settings) members.
-		// Informational oversight count (blue), bounded to the last 24h. ---
+		// --- Trusted: UNCHECKED live posts from trusted (group-settings) members.
+		// Outstanding oversight work (blue), same 7-day auto-check window. ---
 		wg2.Add(1)
 		go func() {
 			defer wg2.Done()
@@ -1109,7 +1117,7 @@ func GetSession(c *fiber.Ctx) error {
 				"WHERE mg.groupid IN ? AND mg.collection = ? AND mg.deleted = 0 "+
 				"AND m.deleted IS NULL AND u.deleted IS NULL "+
 				"AND mg.approvedby IS NULL AND mem.ourPostingStatus IN ('DEFAULT', 'UNMODERATED') "+
-				"AND mg.arrival >= NOW() - INTERVAL 1 DAY",
+				checkedWindowSQL,
 				modGroupIDs, utils.COLLECTION_APPROVED).Scan(&trusted)
 		}()
 
diff --git a/iznik-server-go/utils/utils.go b/iznik-server-go/utils/utils.go
index a86abd08af..b34cd26314 100644
--- a/iznik-server-go/utils/utils.go
+++ b/iznik-server-go/utils/utils.go
@@ -100,6 +100,11 @@ const COLLECTION_REJECTED = "Rejected"
 const COLLECTION_BANNED = "Banned"
 const COLLECTION_DRAFT = "Draft"
 
+// MESSAGE_CHECK_WINDOW_DAYS is how long an auto-published post stays in the
+// ModTools Checked/Trusted oversight queues (and their work-count badges) before
+// it is treated as auto-checked, so the queue cannot pile up indefinitely.
+const MESSAGE_CHECK_WINDOW_DAYS = 7
+
 const POSTING_STATUS_MODERATED = "MODERATED"
 const POSTING_STATUS_PROHIBITED = "PROHIBITED"
 const POSTING_STATUS_DEFAULT = "DEFAULT"

From b44a0e78ead11f9e288660ba8ac3e9355b4b4697 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Thu, 4 Jun 2026 09:15:27 +0100
Subject: [PATCH 05/26] feat(modtools): mark-all-as-checked action + tests for
 the oversight queues

- Checked/Trusted pages get a 'Mark all as checked' button that clears the
  bucket (POST /modtools/messages/markchecked) and refreshes the nav badge.
- MessageAPI.markChecked + message store action.
- Go tests: checked filter excludes already-checked posts; markchecked endpoint
  sets checkedat/checkedby and removes posts from the queue; non-mod gets 403.
- Vitest: markAllChecked clears the bucket and refreshes work counts.
---
 iznik-nuxt3/api/MessageAPI.js                 |  6 ++
 .../messages/checked/[[id]]/[[term]].vue      | 39 ++++++++-
 .../messages/trusted/[[id]]/[[term]].vue      | 39 ++++++++-
 iznik-nuxt3/stores/message.js                 |  7 ++
 .../pages/modtools/messages/checked.spec.js   | 18 ++++
 .../pages/modtools/messages/trusted.spec.js   | 18 ++++
 iznik-server-go/test/message_test.go          | 85 ++++++++++++++++++-
 7 files changed, 202 insertions(+), 10 deletions(-)

diff --git a/iznik-nuxt3/api/MessageAPI.js b/iznik-nuxt3/api/MessageAPI.js
index 5d150533f6..f97197649a 100644
--- a/iznik-nuxt3/api/MessageAPI.js
+++ b/iznik-nuxt3/api/MessageAPI.js
@@ -70,6 +70,12 @@ export default class MessageAPI extends BaseAPI {
     return this.$getv2('/modtools/messages', params)
   }
 
+  // Mark auto-published posts (Checked/Trusted oversight queues) as reviewed by a
+  // moderator. Pass {groupid, filter} to clear a whole bucket, or {groupid, ids}.
+  markChecked(params) {
+    return this.$postv2('/modtools/messages/markchecked', params)
+  }
+
   update(event) {
     return this.$postv2('/message', event)
   }
diff --git a/iznik-nuxt3/modtools/pages/messages/checked/[[id]]/[[term]].vue b/iznik-nuxt3/modtools/pages/messages/checked/[[id]]/[[term]].vue
index 22e0f303e0..e26932be4c 100644
--- a/iznik-nuxt3/modtools/pages/messages/checked/[[id]]/[[term]].vue
+++ b/iznik-nuxt3/modtools/pages/messages/checked/[[id]]/[[term]].vue
@@ -10,14 +10,26 @@
           remember="checked"
           :url-override="urlOverride"
         />
-        <ModtoolsViewControl :misckey="summaryKey" />
+        <div class="d-flex">
+          <ModtoolsViewControl :misckey="summaryKey" />
+          <b-button
+            variant="primary"
+            size="sm"
+            class="ms-2 mt-2"
+            :disabled="marking || !messages.length"
+            @click="markAllChecked"
+          >
+            {{ marking ? 'Marking…' : 'Mark all as checked' }}
+          </b-button>
+        </div>
       </div>
       <NoticeMessage
         v-if="!messages.length && !busy && groupsreceived"
         class="mt-2"
       >
-        No auto-checked messages have gone live yet. These are posts from
-        auto-moderated members that passed the automated checks.
+        Nothing to check. These are posts that went live automatically from
+        auto-moderated members — once you've checked them they drop off here, and
+        anything older than a week is treated as checked.
       </NoticeMessage>
       <div v-if="groupsreceived">
         <ModMessages />
@@ -48,11 +60,13 @@ import { useMessageStore } from '@/stores/message'
 import { useMiscStore } from '@/stores/misc'
 import { useModGroupStore } from '@/stores/modgroup'
 import { useMe } from '~/composables/useMe'
+import { useModMe } from '~/composables/useModMe'
 
 const messageStore = useMessageStore()
 const miscStore = useMiscStore()
 const modGroupStore = useModGroupStore()
 const route = useRoute()
+const { checkWork } = useModMe()
 
 const FILTER = 'checked'
 const summaryKey = 'modtoolsMessagesCheckedSummary'
@@ -86,6 +100,23 @@ const groupsreceived = computed(() => modGroupStore.received)
 
 const bump = ref(0)
 const urlOverride = ref(false)
+const marking = ref(false)
+
+// Mark every post currently in this oversight queue as checked, then refresh.
+async function markAllChecked() {
+  marking.value = true
+  try {
+    await messageStore.markChecked({ groupid: groupid.value, filter: FILTER })
+    show.value = 0
+    context.value = null
+    listingIds.value = new Set()
+    messageStore.clear()
+    bump.value++
+    await checkWork(true)
+  } finally {
+    marking.value = false
+  }
+}
 
 watch(groupid, async (newVal) => {
   const router = useRouter()
@@ -165,6 +196,8 @@ defineExpose({
   busy,
   messages,
   groupid,
+  marking,
+  markAllChecked,
   loadMore,
 })
 </script>
diff --git a/iznik-nuxt3/modtools/pages/messages/trusted/[[id]]/[[term]].vue b/iznik-nuxt3/modtools/pages/messages/trusted/[[id]]/[[term]].vue
index 8e01084e12..ac3b204e70 100644
--- a/iznik-nuxt3/modtools/pages/messages/trusted/[[id]]/[[term]].vue
+++ b/iznik-nuxt3/modtools/pages/messages/trusted/[[id]]/[[term]].vue
@@ -10,14 +10,26 @@
           remember="trusted"
           :url-override="urlOverride"
         />
-        <ModtoolsViewControl :misckey="summaryKey" />
+        <div class="d-flex">
+          <ModtoolsViewControl :misckey="summaryKey" />
+          <b-button
+            variant="primary"
+            size="sm"
+            class="ms-2 mt-2"
+            :disabled="marking || !messages.length"
+            @click="markAllChecked"
+          >
+            {{ marking ? 'Marking…' : 'Mark all as checked' }}
+          </b-button>
+        </div>
       </div>
       <NoticeMessage
         v-if="!messages.length && !busy && groupsreceived"
         class="mt-2"
       >
-        No posts from trusted members have gone live recently. These are posts
-        from members on Group Settings that publish without moderation.
+        Nothing to check. These are posts that went live without moderation from
+        trusted (Group Settings) members — once you've checked them they drop off
+        here, and anything older than a week is treated as checked.
       </NoticeMessage>
       <div v-if="groupsreceived">
         <ModMessages />
@@ -46,11 +58,13 @@ import { useMessageStore } from '@/stores/message'
 import { useMiscStore } from '@/stores/misc'
 import { useModGroupStore } from '@/stores/modgroup'
 import { useMe } from '~/composables/useMe'
+import { useModMe } from '~/composables/useModMe'
 
 const messageStore = useMessageStore()
 const miscStore = useMiscStore()
 const modGroupStore = useModGroupStore()
 const route = useRoute()
+const { checkWork } = useModMe()
 
 const FILTER = 'trusted'
 const summaryKey = 'modtoolsMessagesTrustedSummary'
@@ -84,6 +98,23 @@ const groupsreceived = computed(() => modGroupStore.received)
 
 const bump = ref(0)
 const urlOverride = ref(false)
+const marking = ref(false)
+
+// Mark every post currently in this oversight queue as checked, then refresh.
+async function markAllChecked() {
+  marking.value = true
+  try {
+    await messageStore.markChecked({ groupid: groupid.value, filter: FILTER })
+    show.value = 0
+    context.value = null
+    listingIds.value = new Set()
+    messageStore.clear()
+    bump.value++
+    await checkWork(true)
+  } finally {
+    marking.value = false
+  }
+}
 
 watch(groupid, async (newVal) => {
   const router = useRouter()
@@ -163,6 +194,8 @@ defineExpose({
   busy,
   messages,
   groupid,
+  marking,
+  markAllChecked,
   loadMore,
 })
 </script>
diff --git a/iznik-nuxt3/stores/message.js b/iznik-nuxt3/stores/message.js
index 09aeeb727a..4b40c5036f 100644
--- a/iznik-nuxt3/stores/message.js
+++ b/iznik-nuxt3/stores/message.js
@@ -656,6 +656,13 @@ export const useMessageStore = defineStore({
       )
       return fetched.filter((id) => id !== null)
     },
+    // Mark auto-published posts as reviewed by a moderator, clearing them from
+    // the Checked/Trusted oversight queues. Returns the number marked.
+    async markChecked(params) {
+      const data = await api(this.config).message.markChecked(params)
+      return data?.checked ?? 0
+    },
+
     async fetchMessagesMT(params) {
       if (params.context) {
         // Server expects context as a JSON-encoded string; URLSearchParams
diff --git a/iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js b/iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js
index 40ca473488..8aa082eab3 100644
--- a/iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js
+++ b/iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js
@@ -34,12 +34,18 @@ const mockMessageStore = {
   list: {},
   context: null,
   fetchMessagesMT: vi.fn().mockResolvedValue([]),
+  markChecked: vi.fn().mockResolvedValue(2),
   clear: vi.fn(),
 }
 vi.mock('@/stores/message', () => ({
   useMessageStore: () => mockMessageStore,
 }))
 
+const mockCheckWork = vi.fn().mockResolvedValue(undefined)
+vi.mock('~/composables/useModMe', () => ({
+  useModMe: () => ({ checkWork: mockCheckWork }),
+}))
+
 const mockMiscStore = { get: vi.fn(), set: vi.fn() }
 vi.mock('@/stores/misc', () => ({
   useMiscStore: () => mockMiscStore,
@@ -155,4 +161,16 @@ describe('messages/checked/[[id]]/[[term]].vue page', () => {
     expect(wrapper.vm.id).toBe(42)
     expect(mockGroupid.value).toBe(42)
   })
+
+  it('markAllChecked clears the checked bucket and refreshes work counts', async () => {
+    mockGroupid.value = 7
+    const wrapper = mountComponent()
+    await wrapper.vm.markAllChecked()
+    expect(mockMessageStore.markChecked).toHaveBeenCalledWith({
+      groupid: 7,
+      filter: 'checked',
+    })
+    expect(mockMessageStore.clear).toHaveBeenCalled()
+    expect(mockCheckWork).toHaveBeenCalled()
+  })
 })
diff --git a/iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js b/iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js
index 952a2aef2d..6e7c5d60f5 100644
--- a/iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js
+++ b/iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js
@@ -34,12 +34,18 @@ const mockMessageStore = {
   list: {},
   context: null,
   fetchMessagesMT: vi.fn().mockResolvedValue([]),
+  markChecked: vi.fn().mockResolvedValue(2),
   clear: vi.fn(),
 }
 vi.mock('@/stores/message', () => ({
   useMessageStore: () => mockMessageStore,
 }))
 
+const mockCheckWork = vi.fn().mockResolvedValue(undefined)
+vi.mock('~/composables/useModMe', () => ({
+  useModMe: () => ({ checkWork: mockCheckWork }),
+}))
+
 const mockMiscStore = { get: vi.fn(), set: vi.fn() }
 vi.mock('@/stores/misc', () => ({
   useMiscStore: () => mockMiscStore,
@@ -155,4 +161,16 @@ describe('messages/trusted/[[id]]/[[term]].vue page', () => {
     expect(wrapper.vm.id).toBe(42)
     expect(mockGroupid.value).toBe(42)
   })
+
+  it('markAllChecked clears the trusted bucket and refreshes work counts', async () => {
+    mockGroupid.value = 7
+    const wrapper = mountComponent()
+    await wrapper.vm.markAllChecked()
+    expect(mockMessageStore.markChecked).toHaveBeenCalledWith({
+      groupid: 7,
+      filter: 'trusted',
+    })
+    expect(mockMessageStore.clear).toHaveBeenCalled()
+    expect(mockCheckWork).toHaveBeenCalled()
+  })
 })
diff --git a/iznik-server-go/test/message_test.go b/iznik-server-go/test/message_test.go
index 51d74d02c4..7a90f9e0fc 100644
--- a/iznik-server-go/test/message_test.go
+++ b/iznik-server-go/test/message_test.go
@@ -5573,8 +5573,11 @@ func TestListMessagesMT_FilterChecked(t *testing.T) {
 	checkedMsg := CreateTestMessage(t, nullPoster, groupID, prefix+" auto checked", 52.0, -1.0)
 	trustedMsg := CreateTestMessage(t, defaultPoster, groupID, prefix+" trusted live", 52.0, -1.0)
 	modApprovedMsg := CreateTestMessage(t, nullPoster, groupID, prefix+" mod approved", 52.0, -1.0)
-	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL WHERE msgid IN (?, ?)", checkedMsg, trustedMsg)
+	// A post a mod has already marked checked must drop off the queue.
+	alreadyCheckedMsg := CreateTestMessage(t, nullPoster, groupID, prefix+" already checked", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL WHERE msgid IN (?, ?, ?)", checkedMsg, trustedMsg, alreadyCheckedMsg)
 	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=? WHERE msgid=?", modID, modApprovedMsg)
+	db.Exec("UPDATE messages_groups SET checkedat=NOW(), checkedby=? WHERE msgid=?", modID, alreadyCheckedMsg)
 
 	resp, err := getApp().Test(httptest.NewRequest("GET",
 		fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Approved&filter=checked&jwt=%s", groupID, modToken), nil))
@@ -5584,7 +5587,7 @@ func TestListMessagesMT_FilterChecked(t *testing.T) {
 	var body map[string]interface{}
 	json.NewDecoder(resp.Body).Decode(&body)
 	msgs, _ := body["messages"].([]interface{})
-	foundChecked, foundTrusted, foundMod := false, false, false
+	foundChecked, foundTrusted, foundMod, foundAlready := false, false, false, false
 	for _, id := range msgs {
 		switch id {
 		case float64(checkedMsg):
@@ -5593,14 +5596,17 @@ func TestListMessagesMT_FilterChecked(t *testing.T) {
 			foundTrusted = true
 		case float64(modApprovedMsg):
 			foundMod = true
+		case float64(alreadyCheckedMsg):
+			foundAlready = true
 		}
 	}
 	assert.True(t, foundChecked, "auto-approved post from NULL member should appear under checked")
 	assert.False(t, foundTrusted, "trusted-member post should not appear under checked")
 	assert.False(t, foundMod, "mod-approved post should not appear under checked")
+	assert.False(t, foundAlready, "a post already marked checked should not appear under checked")
 
-	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg)
-	db.Exec("DELETE FROM messages WHERE id IN (?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg)
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg, alreadyCheckedMsg)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg, alreadyCheckedMsg)
 }
 
 func TestListMessagesMT_FilterTrusted(t *testing.T) {
@@ -5654,6 +5660,77 @@ func TestListMessagesMT_FilterTrusted(t *testing.T) {
 	db.Exec("DELETE FROM messages WHERE id IN (?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg)
 }
 
+func TestListMessagesMT_MarkChecked(t *testing.T) {
+	// Marking the checked bucket sets checkedat/checkedby and removes the posts
+	// from the checked oversight queue.
+	prefix := uniquePrefix("lstmt_markchk")
+	db := database.DBConn
+
+	groupID := CreateTestGroup(t, prefix)
+	nullPoster := CreateTestUser(t, prefix+"_null", "User")
+	modID := CreateTestUser(t, prefix+"_mod", "User")
+	CreateTestMembership(t, nullPoster, groupID, "Member")
+	CreateTestMembership(t, modID, groupID, "Moderator")
+	db.Exec("UPDATE memberships SET ourPostingStatus = NULL WHERE userid = ? AND groupid = ?", nullPoster, groupID)
+	_, modToken := CreateTestSession(t, modID)
+
+	msg1 := CreateTestMessage(t, nullPoster, groupID, prefix+" auto checked 1", 52.0, -1.0)
+	msg2 := CreateTestMessage(t, nullPoster, groupID, prefix+" auto checked 2", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL WHERE msgid IN (?, ?)", msg1, msg2)
+
+	listURL := fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Approved&filter=checked&jwt=%s", groupID, modToken)
+	resp, _ := getApp().Test(httptest.NewRequest("GET", listURL, nil))
+	var before map[string]interface{}
+	json.NewDecoder(resp.Body).Decode(&before)
+	beforeMsgs, _ := before["messages"].([]interface{})
+	assert.GreaterOrEqual(t, len(beforeMsgs), 2, "both posts should be in the checked queue before marking")
+
+	// Mark the whole checked bucket for this group checked.
+	markBody := fmt.Sprintf(`{"groupid": %d, "filter": "checked"}`, groupID)
+	markReq := httptest.NewRequest("POST",
+		fmt.Sprintf("/api/modtools/messages/markchecked?jwt=%s", modToken), strings.NewReader(markBody))
+	markReq.Header.Set("Content-Type", "application/json")
+	markResp, err := getApp().Test(markReq)
+	assert.NoError(t, err)
+	assert.Equal(t, 200, markResp.StatusCode)
+
+	// checkedat/checkedby are now set.
+	var checkedCount int64
+	db.Raw("SELECT COUNT(*) FROM messages_groups WHERE msgid IN (?, ?) AND checkedat IS NOT NULL AND checkedby = ?",
+		msg1, msg2, modID).Scan(&checkedCount)
+	assert.Equal(t, int64(2), checkedCount, "both posts should be marked checked")
+
+	// They no longer appear under the checked queue.
+	resp2, _ := getApp().Test(httptest.NewRequest("GET", listURL, nil))
+	var after map[string]interface{}
+	json.NewDecoder(resp2.Body).Decode(&after)
+	afterMsgs, _ := after["messages"].([]interface{})
+	for _, id := range afterMsgs {
+		assert.NotEqual(t, float64(msg1), id, "checked post should leave the queue")
+		assert.NotEqual(t, float64(msg2), id, "checked post should leave the queue")
+	}
+
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?)", msg1, msg2)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", msg1, msg2)
+}
+
+func TestMarkCheckedUnauthorized(t *testing.T) {
+	// Non-mods can't mark posts checked.
+	prefix := uniquePrefix("markchk_unauth")
+	groupID := CreateTestGroup(t, prefix)
+	regularID := CreateTestUser(t, prefix+"_regular", "User")
+	CreateTestMembership(t, regularID, groupID, "Member")
+	_, regularToken := CreateTestSession(t, regularID)
+
+	markBody := fmt.Sprintf(`{"groupid": %d, "filter": "checked"}`, groupID)
+	markReq := httptest.NewRequest("POST",
+		fmt.Sprintf("/api/modtools/messages/markchecked?jwt=%s", regularToken), strings.NewReader(markBody))
+	markReq.Header.Set("Content-Type", "application/json")
+	resp, err := getApp().Test(markReq)
+	assert.NoError(t, err)
+	assert.Equal(t, 403, resp.StatusCode)
+}
+
 func TestListMessagesPendingUnauthorized(t *testing.T) {
 	prefix := uniquePrefix("lstmsg_pend_unauth")
 

From 797e0a39baa1bddf843162076ebc500c72d369a8 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Thu, 4 Jun 2026 09:34:39 +0100
Subject: [PATCH 06/26] feat(modtools): SysAdmin moderation analytics +
 quality-sample tracking
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a 'Moderation' tab to the SysAdmin section (Admin/Support) to judge whether
auto-approving is working over a selectable period:
- Where posts went: arrived, manually approved/rejected, auto-approved (Checked
  delay path vs 48h fallback), trusted (immediate).
- Did auto-approving go wrong: of auto-approved posts, how many a mod later marked
  checked, and how many later needed intervention (rejected/deleted/edited/held) —
  the auto-publish error rate.
- Quality-check sample: posts held back for manual review, and how many a mod then
  rejected — cross-checked against the auto-publish error rate to give a verdict.

- Migration: messages_groups.quality_sample marks posts the auto-approve service
  held back (AutoApproveCleanService sets it), so the sample is measurable.
- Go GET /modtools/moderationstats (Admin/Support) computes the metrics from the
  logs table + messages_groups, parallel per-metric queries.
- MessageAPI.moderationStats + message store action; ModSysAdminModerationStats.vue.
- Tests: Go endpoint (admin/forbidden/dates/counts), Laravel quality_sample marker,
  Vitest component (fetch on mount, percentages, re-fetch).
---
 .../app/Services/AutoApproveCleanService.php  |  10 +
 ..._add_quality_sample_to_messages_groups.php |  33 +++
 .../Services/AutoApproveCleanServiceTest.php  |   6 +
 iznik-nuxt3/api/MessageAPI.js                 |   5 +
 .../components/ModSysAdminModerationStats.vue | 206 ++++++++++++++++++
 iznik-nuxt3/modtools/pages/sysadmin/index.vue |  20 ++
 iznik-nuxt3/stores/message.js                 |   5 +
 .../ModSysAdminModerationStats.spec.js        |  83 +++++++
 iznik-server-go/moderation/moderationstats.go | 143 ++++++++++++
 iznik-server-go/router/routes.go              |   4 +
 iznik-server-go/test/moderationstats_test.go  |  79 +++++++
 11 files changed, 594 insertions(+)
 create mode 100644 iznik-batch/database/migrations/2026_06_04_000002_add_quality_sample_to_messages_groups.php
 create mode 100644 iznik-nuxt3/modtools/components/ModSysAdminModerationStats.vue
 create mode 100644 iznik-nuxt3/tests/unit/components/modtools/ModSysAdminModerationStats.spec.js
 create mode 100644 iznik-server-go/moderation/moderationstats.go
 create mode 100644 iznik-server-go/test/moderationstats_test.go

diff --git a/iznik-batch/app/Services/AutoApproveCleanService.php b/iznik-batch/app/Services/AutoApproveCleanService.php
index 3e3c4e600f..d7dc374bc6 100644
--- a/iznik-batch/app/Services/AutoApproveCleanService.php
+++ b/iznik-batch/app/Services/AutoApproveCleanService.php
@@ -103,6 +103,16 @@ public function process(bool $dryRun = false): array
                 }
 
                 if ($this->isQualitySampled((int) $row->msgid, (int) $row->groupid)) {
+                    if (!$dryRun) {
+                        // Mark it as a quality-check sample so the moderation-stats
+                        // dashboard can compare the mod's verdict on the sample
+                        // against the auto-approved population's later error rate.
+                        DB::table('messages_groups')
+                            ->where('msgid', $row->msgid)
+                            ->where('groupid', $row->groupid)
+                            ->where('quality_sample', 0)
+                            ->update(['quality_sample' => 1]);
+                    }
                     $stats['held_quality']++;
                     continue;
                 }
diff --git a/iznik-batch/database/migrations/2026_06_04_000002_add_quality_sample_to_messages_groups.php b/iznik-batch/database/migrations/2026_06_04_000002_add_quality_sample_to_messages_groups.php
new file mode 100644
index 0000000000..b20c1fbbde
--- /dev/null
+++ b/iznik-batch/database/migrations/2026_06_04_000002_add_quality_sample_to_messages_groups.php
@@ -0,0 +1,33 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Mark posts held back by the auto-approve quality-check sample.
+ *
+ * AutoApproveCleanService holds a configurable percentage of otherwise-eligible
+ * posts in Pending for a moderator to review, instead of auto-approving them. To
+ * measure whether auto-approval is working (the moderation-stats dashboard), we
+ * need to know which posts were sampled so we can compare the mod's verdict on
+ * the sample against the post-go-live error rate of the auto-approved population.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('messages_groups', function (Blueprint $table) {
+            $table->boolean('quality_sample')->default(false)->after('checkedby');
+            $table->index(['groupid', 'quality_sample'], 'messages_groups_groupid_qsample_idx');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('messages_groups', function (Blueprint $table) {
+            $table->dropIndex('messages_groups_groupid_qsample_idx');
+            $table->dropColumn('quality_sample');
+        });
+    }
+};
diff --git a/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php b/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
index 1d3533f365..6c62b4906e 100644
--- a/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
+++ b/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
@@ -338,6 +338,12 @@ public function test_quality_sample_100_holds_all(): void
 
         $this->assertGreaterThanOrEqual(1, $stats['held_quality']);
         $this->assertStillPending($message->id, $group->id);
+        // Held posts are marked as a quality-check sample for the stats dashboard.
+        $this->assertDatabaseHas('messages_groups', [
+            'msgid' => $message->id,
+            'groupid' => $group->id,
+            'quality_sample' => 1,
+        ]);
     }
 
     public function test_quality_sample_zero_holds_none(): void
diff --git a/iznik-nuxt3/api/MessageAPI.js b/iznik-nuxt3/api/MessageAPI.js
index f97197649a..121c229659 100644
--- a/iznik-nuxt3/api/MessageAPI.js
+++ b/iznik-nuxt3/api/MessageAPI.js
@@ -76,6 +76,11 @@ export default class MessageAPI extends BaseAPI {
     return this.$postv2('/modtools/messages/markchecked', params)
   }
 
+  // SysAdmin moderation analytics for a date range ({start, end}).
+  moderationStats(params) {
+    return this.$getv2('/modtools/moderationstats', params)
+  }
+
   update(event) {
     return this.$postv2('/message', event)
   }
diff --git a/iznik-nuxt3/modtools/components/ModSysAdminModerationStats.vue b/iznik-nuxt3/modtools/components/ModSysAdminModerationStats.vue
new file mode 100644
index 0000000000..017e6bf29b
--- /dev/null
+++ b/iznik-nuxt3/modtools/components/ModSysAdminModerationStats.vue
@@ -0,0 +1,206 @@
+<template>
+  <div>
+    <h3>Moderation &amp; auto-approve analytics</h3>
+    <p class="text-muted">
+      How posts were handled over the period, and whether auto-approving is
+      working — the rate at which auto-published posts later needed a moderator,
+      compared with the moderator's verdict on the quality-check sample.
+    </p>
+
+    <div class="d-flex flex-wrap align-items-end gap-2 mb-3">
+      <b-form-group label="From" class="mb-0">
+        <b-form-input v-model="startDate" type="date" />
+      </b-form-group>
+      <b-form-group label="To" class="mb-0">
+        <b-form-input v-model="endDate" type="date" />
+      </b-form-group>
+      <b-button variant="primary" :disabled="loading" @click="fetchStats">
+        {{ loading ? 'Loading…' : 'Update' }}
+      </b-button>
+    </div>
+
+    <NoticeMessage v-if="error" variant="danger">
+      Couldn't load moderation stats: {{ error }}
+    </NoticeMessage>
+
+    <div v-else-if="stats">
+      <!-- Flow -->
+      <b-card class="mb-3" header="Where posts went">
+        <b-table-simple small responsive>
+          <b-tbody>
+            <b-tr>
+              <b-td>Posts arrived</b-td>
+              <b-td class="text-end fw-bold">{{ stats.arrived }}</b-td>
+              <b-td />
+            </b-tr>
+            <b-tr>
+              <b-td>Approved by a moderator</b-td>
+              <b-td class="text-end">{{ stats.manualApproved }}</b-td>
+              <b-td class="text-muted">{{ pct(stats.manualApproved, stats.arrived) }}</b-td>
+            </b-tr>
+            <b-tr>
+              <b-td>Rejected/deleted by a moderator</b-td>
+              <b-td class="text-end">{{ stats.manualRejected }}</b-td>
+              <b-td class="text-muted">{{ pct(stats.manualRejected, stats.arrived) }}</b-td>
+            </b-tr>
+            <b-tr>
+              <b-td>Auto-approved (Checked)</b-td>
+              <b-td class="text-end">{{ stats.autoApproved }}</b-td>
+              <b-td class="text-muted">{{ pct(stats.autoApproved, stats.arrived) }}</b-td>
+            </b-tr>
+            <b-tr>
+              <b-td>Went live immediately (Trusted members)</b-td>
+              <b-td class="text-end">{{ stats.trusted }}</b-td>
+              <b-td class="text-muted">{{ pct(stats.trusted, stats.arrived) }}</b-td>
+            </b-tr>
+          </b-tbody>
+        </b-table-simple>
+      </b-card>
+
+      <!-- Auto-approve quality -->
+      <b-card class="mb-3" header="Did auto-approving go wrong?">
+        <b-table-simple small responsive>
+          <b-tbody>
+            <b-tr>
+              <b-td>Posts auto-approved (Checked + fallback)</b-td>
+              <b-td class="text-end fw-bold">{{ stats.autoApproved }}</b-td>
+              <b-td />
+            </b-tr>
+            <b-tr>
+              <b-td>…a moderator later marked checked</b-td>
+              <b-td class="text-end">{{ stats.autoModChecked }}</b-td>
+              <b-td class="text-muted">{{ pct(stats.autoModChecked, stats.autoApproved) }} reviewed</b-td>
+            </b-tr>
+            <b-tr :variant="laterActionedVariant">
+              <b-td>…later rejected/deleted/edited/held after going live</b-td>
+              <b-td class="text-end fw-bold">{{ stats.autoLaterActioned }}</b-td>
+              <b-td class="fw-bold">{{ autoErrorRate }} needed intervention</b-td>
+            </b-tr>
+          </b-tbody>
+        </b-table-simple>
+        <small class="text-muted">
+          "Needed intervention" counts auto-published posts that a moderator (or a
+          user-triggered removal) acted on afterwards — the closest signal we have
+          for "auto-approve let a bad one through". A precise user-report figure
+          isn't tracked separately.
+        </small>
+      </b-card>
+
+      <!-- Quality-check sample -->
+      <b-card class="mb-3" header="Quality-check sample (manual cross-check)">
+        <b-table-simple small responsive>
+          <b-tbody>
+            <b-tr>
+              <b-td>Posts held back for a manual quality check</b-td>
+              <b-td class="text-end fw-bold">{{ stats.qualitySampled }}</b-td>
+              <b-td />
+            </b-tr>
+            <b-tr>
+              <b-td>…a moderator then rejected/deleted</b-td>
+              <b-td class="text-end fw-bold">{{ stats.qualitySampleBad }}</b-td>
+              <b-td class="fw-bold">{{ sampleBadRate }} were bad</b-td>
+            </b-tr>
+          </b-tbody>
+        </b-table-simple>
+      </b-card>
+
+      <!-- Justification -->
+      <b-card header="Is auto-approving working?" :border-variant="verdictVariant">
+        <p class="mb-1">
+          Of the posts a moderator manually checked (the sample),
+          <strong>{{ sampleBadRate }}</strong> were bad. Of the posts we
+          auto-published, <strong>{{ autoErrorRate }}</strong> later needed a
+          moderator.
+        </p>
+        <p class="mb-0">{{ verdict }}</p>
+      </b-card>
+    </div>
+
+    <NoticeMessage v-else-if="loading" variant="info">
+      Loading…
+    </NoticeMessage>
+  </div>
+</template>
+
+<script setup>
+import { ref, computed, onMounted } from 'vue'
+import dayjs from 'dayjs'
+import { useMessageStore } from '@/stores/message'
+
+const messageStore = useMessageStore()
+
+const endDate = ref(dayjs().format('YYYY-MM-DD'))
+const startDate = ref(dayjs().subtract(30, 'day').format('YYYY-MM-DD'))
+const stats = ref(null)
+const loading = ref(false)
+const error = ref(null)
+
+function pct(num, denom) {
+  if (!denom) return '—'
+  return ((100 * num) / denom).toFixed(1) + '%'
+}
+
+// Rate of auto-published posts that later needed intervention.
+const autoErrorRate = computed(() =>
+  stats.value ? pct(stats.value.autoLaterActioned, stats.value.autoApproved) : '—'
+)
+// Rate of quality-sample posts a mod then rejected.
+const sampleBadRate = computed(() =>
+  stats.value ? pct(stats.value.qualitySampleBad, stats.value.qualitySampled) : '—'
+)
+
+const autoErrorRateNum = computed(() => {
+  if (!stats.value || !stats.value.autoApproved) return 0
+  return (100 * stats.value.autoLaterActioned) / stats.value.autoApproved
+})
+const sampleBadRateNum = computed(() => {
+  if (!stats.value || !stats.value.qualitySampled) return null
+  return (100 * stats.value.qualitySampleBad) / stats.value.qualitySampled
+})
+
+const laterActionedVariant = computed(() =>
+  autoErrorRateNum.value > 5 ? 'warning' : ''
+)
+
+// Compare the auto-publish error rate against the manually-checked sample's
+// bad rate to judge whether auto-approving is missing problems.
+const verdictVariant = computed(() => {
+  if (sampleBadRateNum.value === null) return 'secondary'
+  if (sampleBadRateNum.value <= autoErrorRateNum.value + 1) return 'success'
+  if (sampleBadRateNum.value <= autoErrorRateNum.value + 5) return 'warning'
+  return 'danger'
+})
+
+const verdict = computed(() => {
+  if (sampleBadRateNum.value === null) {
+    return 'No quality-check sample in this period — set a quality-check percentage on some groups to start cross-checking.'
+  }
+  const diff = sampleBadRateNum.value - autoErrorRateNum.value
+  if (diff <= 1) {
+    return 'Auto-approving looks safe: the manual sample finds about as few bad posts as we catch after auto-publishing.'
+  }
+  if (diff <= 5) {
+    return 'Worth watching: the manual sample is catching somewhat more bad posts than we catch after auto-publishing — some may be slipping through unnoticed.'
+  }
+  return 'Concern: the manual sample catches many more bad posts than we catch after auto-publishing, suggesting auto-approve is letting problems through that nobody notices. Consider tightening the checks or raising the quality-check percentage.'
+})
+
+async function fetchStats() {
+  loading.value = true
+  error.value = null
+  try {
+    stats.value = await messageStore.fetchModerationStats({
+      start: startDate.value,
+      end: endDate.value,
+    })
+  } catch (e) {
+    error.value = e?.message || 'request failed'
+  } finally {
+    loading.value = false
+  }
+}
+
+onMounted(fetchStats)
+
+defineExpose({ startDate, endDate, stats, fetchStats, pct })
+</script>
diff --git a/iznik-nuxt3/modtools/pages/sysadmin/index.vue b/iznik-nuxt3/modtools/pages/sysadmin/index.vue
index 73bf37dd14..1804ac0f6f 100644
--- a/iznik-nuxt3/modtools/pages/sysadmin/index.vue
+++ b/iznik-nuxt3/modtools/pages/sysadmin/index.vue
@@ -109,6 +109,17 @@
             :key="'recommendations-' + recommendationsBump"
           />
         </b-tab>
+
+        <!-- Moderation Tab -->
+        <b-tab @click="onModerationTab">
+          <template #title>
+            <h2 class="ms-2 me-2">Moderation</h2>
+          </template>
+          <ModSysAdminModerationStats
+            v-if="showModeration"
+            :key="'moderation-' + moderationBump"
+          />
+        </b-tab>
       </b-tabs>
     </div>
     <NoticeMessage v-else variant="warning">
@@ -142,6 +153,8 @@ const showRippling = ref(false)
 const ripplingBump = ref(0)
 const showRecommendations = ref(false)
 const recommendationsBump = ref(0)
+const showModeration = ref(false)
+const moderationBump = ref(0)
 
 const topTabMap = {
   housekeeping: 0,
@@ -151,6 +164,7 @@ const topTabMap = {
   incoming: 4,
   rippling: 5,
   recommendations: 6,
+  moderation: 7,
 }
 
 function onHousekeepingTab() {
@@ -188,6 +202,11 @@ function onRecommendationsTab() {
   recommendationsBump.value = Date.now()
 }
 
+function onModerationTab() {
+  showModeration.value = true
+  moderationBump.value = Date.now()
+}
+
 onMounted(() => {
   const tab = route.query.tab
   if (tab && topTabMap[tab] !== undefined) {
@@ -200,6 +219,7 @@ onMounted(() => {
     else if (tab === 'incoming') onIncomingEmailTab()
     else if (tab === 'rippling') onRipplingTab()
     else if (tab === 'recommendations') onRecommendationsTab()
+    else if (tab === 'moderation') onModerationTab()
   } else {
     // Default to showing housekeeping
     onHousekeepingTab()
diff --git a/iznik-nuxt3/stores/message.js b/iznik-nuxt3/stores/message.js
index 4b40c5036f..4ffd95c168 100644
--- a/iznik-nuxt3/stores/message.js
+++ b/iznik-nuxt3/stores/message.js
@@ -663,6 +663,11 @@ export const useMessageStore = defineStore({
       return data?.checked ?? 0
     },
 
+    // Fetch SysAdmin moderation analytics for a date range ({start, end}).
+    async fetchModerationStats(params) {
+      return await api(this.config).message.moderationStats(params)
+    },
+
     async fetchMessagesMT(params) {
       if (params.context) {
         // Server expects context as a JSON-encoded string; URLSearchParams
diff --git a/iznik-nuxt3/tests/unit/components/modtools/ModSysAdminModerationStats.spec.js b/iznik-nuxt3/tests/unit/components/modtools/ModSysAdminModerationStats.spec.js
new file mode 100644
index 0000000000..0ce85e2ac5
--- /dev/null
+++ b/iznik-nuxt3/tests/unit/components/modtools/ModSysAdminModerationStats.spec.js
@@ -0,0 +1,83 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { shallowMount, flushPromises } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import ModSysAdminModerationStats from '~/modtools/components/ModSysAdminModerationStats.vue'
+
+const sampleStats = {
+  arrived: 100,
+  manualApproved: 20,
+  manualRejected: 5,
+  autoChecked: 60,
+  autoFallback: 5,
+  trusted: 10,
+  autoApproved: 65,
+  autoModChecked: 30,
+  autoLaterActioned: 2,
+  qualitySampled: 40,
+  qualitySampleBad: 1,
+}
+
+const mockMessageStore = {
+  fetchModerationStats: vi.fn().mockResolvedValue(sampleStats),
+}
+vi.mock('@/stores/message', () => ({
+  useMessageStore: () => mockMessageStore,
+}))
+
+describe('ModSysAdminModerationStats.vue', () => {
+  function mountComponent() {
+    return shallowMount(ModSysAdminModerationStats, {
+      global: {
+        plugins: [createPinia()],
+        stubs: {
+          'b-form-group': true,
+          'b-form-input': true,
+          'b-button': true,
+          'b-card': true,
+          'b-table-simple': true,
+          'b-tbody': true,
+          'b-tr': true,
+          'b-td': true,
+          NoticeMessage: true,
+        },
+      },
+    })
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    setActivePinia(createPinia())
+    mockMessageStore.fetchModerationStats.mockResolvedValue(sampleStats)
+  })
+
+  it('fetches stats for the default 30-day range on mount', async () => {
+    const wrapper = mountComponent()
+    await flushPromises()
+    expect(mockMessageStore.fetchModerationStats).toHaveBeenCalledTimes(1)
+    const params = mockMessageStore.fetchModerationStats.mock.calls[0][0]
+    expect(params.start).toMatch(/^\d{4}-\d{2}-\d{2}$/)
+    expect(params.end).toMatch(/^\d{4}-\d{2}-\d{2}$/)
+    expect(new Date(params.start) <= new Date(params.end)).toBe(true)
+    expect(wrapper.vm.stats).toEqual(sampleStats)
+  })
+
+  it('formats percentages and guards divide-by-zero', () => {
+    const wrapper = mountComponent()
+    expect(wrapper.vm.pct(1, 2)).toBe('50.0%')
+    expect(wrapper.vm.pct(2, 65)).toBe('3.1%')
+    expect(wrapper.vm.pct(5, 0)).toBe('—')
+  })
+
+  it('re-fetches when Update is triggered', async () => {
+    const wrapper = mountComponent()
+    await flushPromises()
+    mockMessageStore.fetchModerationStats.mockClear()
+    wrapper.vm.startDate = '2026-01-01'
+    wrapper.vm.endDate = '2026-01-31'
+    await wrapper.vm.fetchStats()
+    expect(mockMessageStore.fetchModerationStats).toHaveBeenCalledWith({
+      start: '2026-01-01',
+      end: '2026-01-31',
+    })
+  })
+})
diff --git a/iznik-server-go/moderation/moderationstats.go b/iznik-server-go/moderation/moderationstats.go
new file mode 100644
index 0000000000..8d76301a63
--- /dev/null
+++ b/iznik-server-go/moderation/moderationstats.go
@@ -0,0 +1,143 @@
+package moderation
+
+import (
+	"strings"
+	"sync"
+
+	"github.com/freegle/iznik-server-go/database"
+	"github.com/freegle/iznik-server-go/user"
+	"github.com/gofiber/fiber/v2"
+)
+
+// ModerationStats summarises how posts were moderated over a period, so admins
+// can judge whether auto-approving is working: the volume down each path, the
+// rate at which auto-published posts later needed intervention, and the
+// moderator's verdict on the quality-check sample for comparison.
+type ModerationStats struct {
+	Start string `json:"start"`
+	End   string `json:"end"`
+
+	// How posts were handled in the period.
+	Arrived        int64 `json:"arrived"`        // posts that arrived (Received log)
+	ManualApproved int64 `json:"manualApproved"` // approved by a moderator
+	ManualRejected int64 `json:"manualRejected"` // rejected/deleted by a moderator
+	AutoApproved   int64 `json:"autoApproved"`   // auto-approved (Checked) — Autoapproved log
+	Trusted        int64 `json:"trusted"`        // went live immediately (trusted members)
+
+	// Quality of the auto-published population (posts auto-approved in the period).
+	// NB: 'auto-approved' (Autoapproved log) covers both the Checked delay path and
+	// the 48h fallback — they aren't distinguished retrospectively. Trusted posts
+	// (no log) are excluded from this error-rate denominator.
+	AutoModChecked    int64 `json:"autoModChecked"`    // a moderator later marked it checked
+	AutoLaterActioned int64 `json:"autoLaterActioned"` // later rejected/deleted/edited/held after going live
+
+	// Quality-check sample held back for manual review.
+	QualitySampled   int64 `json:"qualitySampled"`   // posts held back for a manual quality check
+	QualitySampleBad int64 `json:"qualitySampleBad"` // of those, ones a moderator then rejected/deleted
+}
+
+// Stats handles GET /modtools/moderationstats?start=&end= (Admin/Support only).
+//
+// @Summary Moderation analytics for the auto-approve approach
+// @Tags moderation
+// @Produce json
+// @Param start query string true "Start date (YYYY-MM-DD)"
+// @Param end query string true "End date (YYYY-MM-DD)"
+// @Success 200 {object} ModerationStats
+// @Router /modtools/moderationstats [get]
+func Stats(c *fiber.Ctx) error {
+	myid := user.WhoAmI(c)
+	if myid == 0 {
+		return fiber.NewError(fiber.StatusUnauthorized, "Not logged in")
+	}
+	if !user.IsAdminOrSupport(myid) {
+		return fiber.NewError(fiber.StatusForbidden, "Support or Admin role required")
+	}
+
+	start := c.Query("start", "")
+	end := c.Query("end", "")
+	if start == "" || end == "" {
+		return fiber.NewError(fiber.StatusBadRequest, "start and end dates are required")
+	}
+	// Make a bare end date inclusive of the whole day.
+	if !strings.Contains(end, " ") && !strings.Contains(end, "T") {
+		end += " 23:59:59"
+	}
+
+	db := database.DBConn
+	stats := ModerationStats{Start: c.Query("start", ""), End: c.Query("end", "")}
+
+	var wg sync.WaitGroup
+	run := func(fn func()) {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			fn()
+		}()
+	}
+
+	// --- Flow in the period ---
+	run(func() {
+		db.Raw("SELECT COUNT(*) FROM logs l WHERE l.type='Message' AND l.subtype='Received' "+
+			"AND l.timestamp BETWEEN ? AND ?", start, end).Scan(&stats.Arrived)
+	})
+	run(func() {
+		db.Raw("SELECT COUNT(*) FROM logs l WHERE l.type='Message' AND l.subtype='Approved' "+
+			"AND l.byuser IS NOT NULL AND l.timestamp BETWEEN ? AND ?", start, end).Scan(&stats.ManualApproved)
+	})
+	run(func() {
+		db.Raw("SELECT COUNT(*) FROM logs l WHERE l.type='Message' AND l.subtype IN ('Rejected','Deleted') "+
+			"AND l.byuser IS NOT NULL AND l.byuser <> l.user AND l.timestamp BETWEEN ? AND ?", start, end).Scan(&stats.ManualRejected)
+	})
+	run(func() {
+		db.Raw("SELECT COUNT(*) FROM logs l WHERE l.type='Message' AND l.subtype='Autoapproved' "+
+			"AND l.timestamp BETWEEN ? AND ?", start, end).Scan(&stats.AutoApproved)
+	})
+	run(func() {
+		// Trusted: went live without moderation (approvedby NULL, content-checked,
+		// trusted member) and with no Autoapproved log.
+		db.Raw("SELECT COUNT(*) FROM messages_groups mg "+
+			"JOIN messages m ON m.id=mg.msgid "+
+			"JOIN memberships mem ON mem.userid=m.fromuser AND mem.groupid=mg.groupid "+
+			"WHERE mg.approvedat BETWEEN ? AND ? AND mg.approvedby IS NULL "+
+			"AND mg.contentcheck_checked_at IS NOT NULL AND mg.deleted=0 "+
+			"AND (mem.ourPostingStatus='DEFAULT' OR mem.ourPostingStatus='UNMODERATED') "+
+			"AND NOT EXISTS (SELECT 1 FROM logs l WHERE l.msgid=mg.msgid AND l.type='Message' AND l.subtype='Autoapproved')",
+			start, end).Scan(&stats.Trusted)
+	})
+
+	// --- Quality of the auto-published population (AutoApproved counted above) ---
+	run(func() {
+		db.Raw("SELECT COUNT(DISTINCT l.msgid) FROM logs l "+
+			"JOIN messages_groups mg ON mg.msgid=l.msgid AND mg.groupid=l.groupid "+
+			"WHERE l.type='Message' AND l.subtype='Autoapproved' AND l.timestamp BETWEEN ? AND ? "+
+			"AND mg.checkedat IS NOT NULL", start, end).Scan(&stats.AutoModChecked)
+	})
+	run(func() {
+		// Auto-approved posts that later needed intervention: a rejection, deletion,
+		// edit or hold by someone other than the author, after the auto-approval.
+		db.Raw("SELECT COUNT(DISTINCT a.msgid) FROM logs a "+
+			"JOIN logs x ON x.msgid=a.msgid AND x.groupid=a.groupid "+
+			"WHERE a.type='Message' AND a.subtype='Autoapproved' AND a.timestamp BETWEEN ? AND ? "+
+			"AND x.type='Message' AND x.subtype IN ('Rejected','Deleted','Edit','Hold') "+
+			"AND x.byuser IS NOT NULL AND x.byuser <> a.user AND x.timestamp > a.timestamp",
+			start, end).Scan(&stats.AutoLaterActioned)
+	})
+
+	// --- Quality-check sample ---
+	run(func() {
+		db.Raw("SELECT COUNT(*) FROM messages_groups mg WHERE mg.quality_sample=1 "+
+			"AND mg.arrival BETWEEN ? AND ?", start, end).Scan(&stats.QualitySampled)
+	})
+	run(func() {
+		db.Raw("SELECT COUNT(DISTINCT mg.msgid) FROM messages_groups mg "+
+			"JOIN logs l ON l.msgid=mg.msgid AND l.groupid=mg.groupid "+
+			"WHERE mg.quality_sample=1 AND mg.arrival BETWEEN ? AND ? "+
+			"AND l.type='Message' AND l.subtype IN ('Rejected','Deleted') "+
+			"AND l.byuser IS NOT NULL AND l.byuser <> l.user", start, end).Scan(&stats.QualitySampleBad)
+	})
+
+	wg.Wait()
+
+	return c.JSON(stats)
+}
diff --git a/iznik-server-go/router/routes.go b/iznik-server-go/router/routes.go
index 6cfd423999..1fae7fec78 100644
--- a/iznik-server-go/router/routes.go
+++ b/iznik-server-go/router/routes.go
@@ -47,6 +47,7 @@ import (
 	"github.com/freegle/iznik-server-go/group"
 	"github.com/freegle/iznik-server-go/housekeeper"
 	"github.com/freegle/iznik-server-go/image"
+	"github.com/freegle/iznik-server-go/moderation"
 	"github.com/freegle/iznik-server-go/isochrone"
 	"github.com/freegle/iznik-server-go/job"
 	"github.com/freegle/iznik-server-go/location"
@@ -1370,6 +1371,9 @@ func SetupRoutes(app *fiber.App) {
 		// @Failure 403 {object} fiber.Error "Forbidden"
 		rg.Get("/modtools/email/stats", emailtracking.Stats)
 
+		// Moderation analytics for the auto-approve approach (Admin/Support only).
+		rg.Get("/modtools/moderationstats", moderation.Stats)
+
 		// Email Statistics Time Series (authenticated, admin only)
 		// @Router /email/stats/timeseries [get]
 		// @Summary Get daily email statistics for charting
diff --git a/iznik-server-go/test/moderationstats_test.go b/iznik-server-go/test/moderationstats_test.go
new file mode 100644
index 0000000000..292a349b24
--- /dev/null
+++ b/iznik-server-go/test/moderationstats_test.go
@@ -0,0 +1,79 @@
+package test
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/freegle/iznik-server-go/database"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestModerationStats_NonAdminForbidden(t *testing.T) {
+	prefix := uniquePrefix("modstats_unauth")
+	userID := CreateTestUser(t, prefix, "User")
+	_, token := CreateTestSession(t, userID)
+
+	today := time.Now().Format("2006-01-02")
+	resp, err := getApp().Test(httptest.NewRequest("GET",
+		fmt.Sprintf("/api/modtools/moderationstats?start=%s&end=%s&jwt=%s", today, today, token), nil))
+	assert.NoError(t, err)
+	assert.Equal(t, 403, resp.StatusCode)
+}
+
+func TestModerationStats_RequiresDates(t *testing.T) {
+	prefix := uniquePrefix("modstats_nodate")
+	adminID := CreateTestUser(t, prefix, "Admin")
+	_, token := CreateTestSession(t, adminID)
+
+	resp, err := getApp().Test(httptest.NewRequest("GET",
+		fmt.Sprintf("/api/modtools/moderationstats?jwt=%s", token), nil))
+	assert.NoError(t, err)
+	assert.Equal(t, 400, resp.StatusCode)
+}
+
+func TestModerationStats_CountsAutoApprovedAndSample(t *testing.T) {
+	prefix := uniquePrefix("modstats")
+	db := database.DBConn
+
+	groupID := CreateTestGroup(t, prefix)
+	nullPoster := CreateTestUser(t, prefix+"_null", "User")
+	adminID := CreateTestUser(t, prefix+"_admin", "Admin")
+	CreateTestMembership(t, nullPoster, groupID, "Member")
+	db.Exec("UPDATE memberships SET ourPostingStatus = NULL WHERE userid = ? AND groupid = ?", nullPoster, groupID)
+	_, adminToken := CreateTestSession(t, adminID)
+
+	// An auto-approved (Checked path) post: Autoapproved log + content-checked.
+	autoMsg := CreateTestMessage(t, nullPoster, groupID, prefix+" auto checked", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL, approvedat=NOW(), contentcheck_checked_at=NOW() WHERE msgid=?", autoMsg)
+	db.Exec("INSERT INTO logs (timestamp, type, subtype, msgid, groupid, user) VALUES (NOW(), 'Message', 'Autoapproved', ?, ?, ?)",
+		autoMsg, groupID, nullPoster)
+
+	// A quality-check sample post (held back for manual review).
+	sampleMsg := CreateTestMessage(t, nullPoster, groupID, prefix+" quality sample", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Pending', quality_sample=1, arrival=NOW() WHERE msgid=?", sampleMsg)
+
+	today := time.Now().Format("2006-01-02")
+	resp, err := getApp().Test(httptest.NewRequest("GET",
+		fmt.Sprintf("/api/modtools/moderationstats?start=%s&end=%s&jwt=%s", today, today, adminToken), nil))
+	assert.NoError(t, err)
+	assert.Equal(t, 200, resp.StatusCode)
+
+	var stats map[string]interface{}
+	json.NewDecoder(resp.Body).Decode(&stats)
+
+	asFloat := func(k string) float64 {
+		v, _ := stats[k].(float64)
+		return v
+	}
+	// The auto-approved post is counted in the auto-approved (Checked) total.
+	assert.GreaterOrEqual(t, asFloat("autoApproved"), float64(1))
+	// The quality-check sample is counted.
+	assert.GreaterOrEqual(t, asFloat("qualitySampled"), float64(1))
+
+	db.Exec("DELETE FROM logs WHERE msgid IN (?, ?)", autoMsg, sampleMsg)
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?)", autoMsg, sampleMsg)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", autoMsg, sampleMsg)
+}

From 859515ab2511a5d373a8970deff7fd8d6235f444 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Mon, 15 Jun 2026 18:57:44 +0100
Subject: [PATCH 07/26] feat(batch): add messages_groups.autoapprove_hold_until
 column + index (A1)

Nullable timestamp with a groupid composite index. Both auto-approve services
respect a hold predicate (next commit); NULL = no hold (behaviour unchanged
for existing rows).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 ...oapprove_hold_until_to_messages_groups.php | 38 +++++++++++++++++++
 .../AutoApproveHoldUntilMigrationTest.php     | 26 +++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 iznik-batch/database/migrations/2026_06_15_000001_add_autoapprove_hold_until_to_messages_groups.php
 create mode 100644 iznik-batch/tests/Unit/Services/AutoApproveHoldUntilMigrationTest.php

diff --git a/iznik-batch/database/migrations/2026_06_15_000001_add_autoapprove_hold_until_to_messages_groups.php b/iznik-batch/database/migrations/2026_06_15_000001_add_autoapprove_hold_until_to_messages_groups.php
new file mode 100644
index 0000000000..89d0360b41
--- /dev/null
+++ b/iznik-batch/database/migrations/2026_06_15_000001_add_autoapprove_hold_until_to_messages_groups.php
@@ -0,0 +1,38 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Add a hold-until timestamp to messages_groups for the auto-approve countdown.
+ *
+ * When a moderator opens the Pending page, the server bumps autoapprove_hold_until
+ * to at least NOW() + 10 minutes for every fetched row (extend-only). Both
+ * AutoApproveCleanService and AutoApproveService skip rows where the column is
+ * set and still in the future, giving mods a guaranteed review window.
+ *
+ * NULL means "no hold" — the existing auto-approve timing applies unchanged.
+ * No backfill: all existing rows default to NULL, so the behaviour of the two
+ * auto-approve services is identical to before the migration is run.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('messages_groups', function (Blueprint $table) {
+            $table->timestamp('autoapprove_hold_until')->nullable()->after('quality_sample');
+            // Keeps the candidate-query predicate fast: both auto-approvers gain
+            // AND (mg.autoapprove_hold_until IS NULL OR mg.autoapprove_hold_until <= NOW())
+            $table->index(['groupid', 'autoapprove_hold_until'], 'messages_groups_groupid_hold_until_idx');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('messages_groups', function (Blueprint $table) {
+            $table->dropIndex('messages_groups_groupid_hold_until_idx');
+            $table->dropColumn('autoapprove_hold_until');
+        });
+    }
+};
diff --git a/iznik-batch/tests/Unit/Services/AutoApproveHoldUntilMigrationTest.php b/iznik-batch/tests/Unit/Services/AutoApproveHoldUntilMigrationTest.php
new file mode 100644
index 0000000000..14b5a4ade0
--- /dev/null
+++ b/iznik-batch/tests/Unit/Services/AutoApproveHoldUntilMigrationTest.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace Tests\Unit\Services;
+
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+use Tests\TestCase;
+
+class AutoApproveHoldUntilMigrationTest extends TestCase
+{
+    public function test_autoapprove_hold_until_column_exists(): void
+    {
+        $this->assertTrue(
+            Schema::hasColumn('messages_groups', 'autoapprove_hold_until'),
+            'messages_groups.autoapprove_hold_until column must exist after migration'
+        );
+    }
+
+    public function test_autoapprove_hold_until_index_exists(): void
+    {
+        $indexes = collect(
+            DB::select("SHOW INDEX FROM messages_groups WHERE Key_name = 'messages_groups_groupid_hold_until_idx'")
+        );
+        $this->assertNotEmpty($indexes, 'messages_groups_groupid_hold_until_idx index must exist');
+    }
+}

From 3dc96341dbf97a0c48f552ba93f37c25da161e60 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Mon, 15 Jun 2026 18:57:44 +0100
Subject: [PATCH 08/26] fix(batch): hold predicate, cross-group Spam guard,
 quality-sample filter (A2,D1,D3,D6)

- A2: both AutoApproveCleanService and AutoApproveService skip rows whose
  autoapprove_hold_until is set and in the future.
- D1: add the cross-group Spam-collection whereNotExists guard to the clean
  service (Discourse #9654 parity) so a message in Spam on another group is
  never auto-approved. Test included.
- D3: exclude already-sampled rows from the candidate query and only count
  held_quality outside dry-run, fixing per-minute rescans and stat inflation.
- D6: assert an approved OFFER queues TASK_FREEBIE_ALERTS_ADD (WANTED does not).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../app/Services/AutoApproveCleanService.php  |  17 ++-
 .../app/Services/AutoApproveService.php       |   6 +
 .../Services/AutoApproveCleanServiceTest.php  | 133 ++++++++++++++++++
 .../Services/AutoApproveServiceHoldTest.php   |  70 +++++++++
 4 files changed, 225 insertions(+), 1 deletion(-)
 create mode 100644 iznik-batch/tests/Unit/Services/AutoApproveServiceHoldTest.php

diff --git a/iznik-batch/app/Services/AutoApproveCleanService.php b/iznik-batch/app/Services/AutoApproveCleanService.php
index d7dc374bc6..1e340f3326 100644
--- a/iznik-batch/app/Services/AutoApproveCleanService.php
+++ b/iznik-batch/app/Services/AutoApproveCleanService.php
@@ -76,16 +76,31 @@ public function process(bool $dryRun = false): array
             ->whereNull('m.heldby')
             ->whereNull('mg.spamreason')
             ->whereNull('m.spamreason')
+            // Never auto-approve a message that is in the Spam collection on ANY
+            // group (Discourse #9654). Spam-collection messages surface in the
+            // Pending review queue but must be actioned by a human — mirroring
+            // the identical guard in AutoApproveService.
+            ->whereNotExists(function ($q) {
+                $q->select(DB::raw(1))
+                    ->from('messages_groups as spam_mg')
+                    ->whereColumn('spam_mg.msgid', 'mg.msgid')
+                    ->where('spam_mg.collection', MessageGroup::COLLECTION_SPAM)
+                    ->where('spam_mg.deleted', 0);
+            })
             ->where('mg.deleted', 0)
             ->whereNull('m.deleted')
             ->whereNull('u.deleted')
             ->whereNull('mem.ourPostingStatus')           // the auto-moderated tier
             ->whereNotNull('mg.contentcheck_checked_at')   // content check has run ...
             ->whereNull('mg.contentcheck_reasons')         // ... and the post was clean
+            ->where('mg.quality_sample', 0)               // already-sampled rows are excluded entirely
             ->whereRaw(
                 "mg.arrival <= (NOW() - INTERVAL COALESCE(NULLIF(CAST(JSON_UNQUOTE(JSON_EXTRACT(g.settings, '$.autoapprove.delay_minutes')) AS UNSIGNED), 0), ?) MINUTE)",
                 [$this->defaultDelayMinutes()]
             )
+            ->whereRaw(
+                '(mg.autoapprove_hold_until IS NULL OR mg.autoapprove_hold_until <= NOW())'
+            )
             ->orderBy('mg.msgid')
             ->orderBy('mg.groupid')
             ->get();
@@ -112,8 +127,8 @@ public function process(bool $dryRun = false): array
                             ->where('groupid', $row->groupid)
                             ->where('quality_sample', 0)
                             ->update(['quality_sample' => 1]);
+                        $stats['held_quality']++;
                     }
-                    $stats['held_quality']++;
                     continue;
                 }
 
diff --git a/iznik-batch/app/Services/AutoApproveService.php b/iznik-batch/app/Services/AutoApproveService.php
index a631b1e209..e152a245d7 100644
--- a/iznik-batch/app/Services/AutoApproveService.php
+++ b/iznik-batch/app/Services/AutoApproveService.php
@@ -103,6 +103,12 @@ public function process(bool $dryRun = false): array
                     ->whereColumn('messages_outcomes.msgid', 'messages_groups.msgid')
                     ->whereIn('messages_outcomes.outcome', ['Taken', 'Received']);
             })
+            // Respect a moderator-set hold window (set by the Go Pending list fetch,
+            // extend-only to NOW()+10m) so a post a mod is actively reviewing is not
+            // auto-approved out from under them.
+            ->whereRaw(
+                '(messages_groups.autoapprove_hold_until IS NULL OR messages_groups.autoapprove_hold_until <= NOW())'
+            )
             ->where(function ($q) {
                 // Normal posts: the 48h fallback (unchanged).
                 $q->where(function ($q2) {
diff --git a/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php b/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
index 6c62b4906e..4eb1df2b5e 100644
--- a/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
+++ b/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
@@ -403,4 +403,137 @@ public function test_records_ham_for_spam_message(): void
         $this->assertApproved($message->id, $group->id);
         $this->assertDatabaseHas('messages_spamham', ['msgid' => $message->id, 'spamham' => 'Ham']);
     }
+
+    // --- A2: autoapprove_hold_until predicate ---
+
+    public function test_hold_until_future_keeps_post_pending(): void
+    {
+        // A post whose autoapprove_hold_until is 5 minutes in the future must
+        // be skipped by the auto-approver even though the delay has elapsed.
+        [$user, $group, $message] = $this->makeApprovable();
+        DB::table('messages_groups')
+            ->where('msgid', $message->id)
+            ->where('groupid', $group->id)
+            ->update(['autoapprove_hold_until' => now()->addMinutes(5)]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_hold_until_past_allows_approval(): void
+    {
+        // A post whose autoapprove_hold_until has already expired must still
+        // be auto-approved normally.
+        [$user, $group, $message] = $this->makeApprovable();
+        DB::table('messages_groups')
+            ->where('msgid', $message->id)
+            ->where('groupid', $group->id)
+            ->update(['autoapprove_hold_until' => now()->subMinutes(1)]);
+
+        $this->service->process();
+
+        $this->assertApproved($message->id, $group->id);
+    }
+
+    // --- D1: cross-group Spam-collection guard ---
+
+    public function test_spam_on_another_group_blocks_approval_on_this_group(): void
+    {
+        // Message is clean and pending on group A (eligible for auto-approval),
+        // BUT also in the Spam collection on group B.
+        // AutoApproveCleanService must NOT auto-approve it on group A.
+        [$user, $groupA, $message] = $this->makeApprovable();
+
+        $groupB = $this->createTestGroup();
+        // Insert a Spam-collection row for the same message on group B.
+        DB::table('messages_groups')->insert([
+            'msgid'      => $message->id,
+            'groupid'    => $groupB->id,
+            'collection' => MessageGroup::COLLECTION_SPAM,
+            'arrival'    => now(),
+            'deleted'    => 0,
+        ]);
+
+        $this->service->process();
+
+        $this->assertStillPending($message->id, $groupA->id);
+    }
+
+    // --- D3: quality-sample filter + dry-run stat placement ---
+
+    public function test_already_quality_sampled_row_is_excluded_from_candidate_query(): void
+    {
+        // A row already marked quality_sample=1 must not appear in the candidate
+        // query at all. This verifies the ->where('mg.quality_sample', 0) guard.
+        [$user, $group, $message] = $this->makeApprovable([
+            'group' => ['settings' => ['autoapprove' => ['quality_check_percent' => 0]]],
+        ]);
+        // Manually pre-mark the row as already sampled (e.g. by a previous run).
+        DB::table('messages_groups')
+            ->where('msgid', $message->id)
+            ->where('groupid', $group->id)
+            ->update(['quality_sample' => 1]);
+
+        $stats = $this->service->process();
+
+        // The row is excluded from the candidate set entirely — held_quality is 0
+        // because the service never even sees it.
+        $this->assertEquals(0, $stats['held_quality'], 'already-sampled row must not increment held_quality again');
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    public function test_held_quality_stat_not_incremented_in_dry_run(): void
+    {
+        // $stats['held_quality']++ must be inside the if(!$dryRun) block so a
+        // dry-run pass doesn't falsely inflate the cron stat.
+        [$user, $group, $message] = $this->makeApprovable([
+            'group' => ['settings' => ['autoapprove' => ['quality_check_percent' => 100]]],
+        ]);
+
+        $stats = $this->service->process(dryRun: true);
+
+        $this->assertEquals(0, $stats['held_quality'], 'held_quality must be 0 in a dry run');
+        $this->assertStillPending($message->id, $group->id);
+    }
+
+    // --- D6: OFFER freebie-alert background task ---
+
+    public function test_approved_offer_queues_freebie_alert_background_task(): void
+    {
+        // An approved OFFER must insert a background_tasks row with
+        // task_type=TASK_FREEBIE_ALERTS_ADD containing the msgid, so the Go
+        // background-task processor can fan out push notifications to nearby users.
+        [$user, $group, $message] = $this->makeApprovable([
+            'message' => ['type' => \App\Models\Message::TYPE_OFFER],
+        ]);
+
+        $this->service->process();
+
+        $this->assertApproved($message->id, $group->id);
+        $this->assertDatabaseHas('background_tasks', [
+            'task_type' => \App\Models\BackgroundTask::TASK_FREEBIE_ALERTS_ADD,
+        ]);
+        // Verify the data payload contains the correct msgid.
+        $task = DB::table('background_tasks')
+            ->where('task_type', \App\Models\BackgroundTask::TASK_FREEBIE_ALERTS_ADD)
+            ->first();
+        $data = json_decode($task->data, true);
+        $this->assertEquals((int) $message->id, $data['msgid']);
+    }
+
+    public function test_approved_wanted_does_not_queue_freebie_alert(): void
+    {
+        // Only OFFERs trigger freebie alerts; WANTEDs must not insert a row.
+        [$user, $group, $message] = $this->makeApprovable([
+            'message' => ['type' => \App\Models\Message::TYPE_WANTED],
+        ]);
+
+        $this->service->process();
+
+        $this->assertApproved($message->id, $group->id);
+        $this->assertDatabaseMissing('background_tasks', [
+            'task_type' => \App\Models\BackgroundTask::TASK_FREEBIE_ALERTS_ADD,
+        ]);
+    }
 }
diff --git a/iznik-batch/tests/Unit/Services/AutoApproveServiceHoldTest.php b/iznik-batch/tests/Unit/Services/AutoApproveServiceHoldTest.php
new file mode 100644
index 0000000000..a8207c1d2b
--- /dev/null
+++ b/iznik-batch/tests/Unit/Services/AutoApproveServiceHoldTest.php
@@ -0,0 +1,70 @@
+<?php
+
+namespace Tests\Unit\Services;
+
+use App\Models\MessageGroup;
+use App\Services\AutoApproveService;
+use Illuminate\Support\Facades\DB;
+use Tests\TestCase;
+
+class AutoApproveServiceHoldTest extends TestCase
+{
+    protected AutoApproveService $service;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->service = new AutoApproveService();
+    }
+
+    private function makeApprovable48h(): array
+    {
+        $user  = $this->createTestUser();
+        $group = $this->createTestGroup();
+        $this->createMembership($user, $group, ['added' => now()->subDays(5)]);
+        $message = $this->createTestMessage($user, $group);
+        DB::table('messages_groups')
+            ->where('msgid', $message->id)
+            ->where('groupid', $group->id)
+            ->update([
+                'collection' => MessageGroup::COLLECTION_PENDING,
+                'arrival'    => now()->subHours(50),
+            ]);
+
+        return [$user, $group, $message];
+    }
+
+    public function test_48h_hold_until_future_keeps_post_pending(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable48h();
+        DB::table('messages_groups')
+            ->where('msgid', $message->id)
+            ->where('groupid', $group->id)
+            ->update(['autoapprove_hold_until' => now()->addMinutes(10)]);
+
+        $this->service->process();
+
+        $this->assertDatabaseHas('messages_groups', [
+            'msgid'      => $message->id,
+            'groupid'    => $group->id,
+            'collection' => MessageGroup::COLLECTION_PENDING,
+        ]);
+    }
+
+    public function test_48h_hold_until_past_allows_approval(): void
+    {
+        [$user, $group, $message] = $this->makeApprovable48h();
+        DB::table('messages_groups')
+            ->where('msgid', $message->id)
+            ->where('groupid', $group->id)
+            ->update(['autoapprove_hold_until' => now()->subMinutes(1)]);
+
+        $this->service->process();
+
+        $this->assertDatabaseHas('messages_groups', [
+            'msgid'      => $message->id,
+            'groupid'    => $group->id,
+            'collection' => MessageGroup::COLLECTION_APPROVED,
+        ]);
+    }
+}

From 78b12ce275c30050355a559f3cdb8bd0bcd74898 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Mon, 15 Jun 2026 19:10:59 +0100
Subject: [PATCH 09/26] feat(go): Pending hold-bump, accurate autoapproveat, +
 review fixes (A3,A4,D2,D4,D9,D10,D11)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- A3: ListMessagesMT bumps autoapprove_hold_until >=NOW()+10m (extend-only) for
  fetched Pending rows, so loading the page guarantees a review window.
- A4: GET /message/:id exposes per-group autoapproveat for Pending posts viewed
  by a mod (new message/autoapproveat.go). Accurate: a concurrent danger-signal
  query (mirrors AutoApproveCleanService::hasDangerSignals) + group-allows +
  quality-sample => clean-path delay, 48h fallback, or nil (danger/spam/held).
- D2: reword session.go/utils.go comments — older posts drop off the queue (no
  checkedat write), so AutoModChecked keeps measuring real mod checks.
- D4: scope moderationstats Trusted NOT EXISTS by groupid (cross-post miscount).
- D9/D10/D11: markchecked guards collection=Approved on the ids path, 400 on an
  unknown filter, 403 for a non-mod with groupid=0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../{[[id]]/[[term]].vue => [[id]].vue}       |   0
 .../{[[id]]/[[term]].vue => [[id]].vue}       |   0
 iznik-server-go/message/autoapproveat.go      | 173 ++++++++++++++++++
 iznik-server-go/message/markchecked.go        |  10 +-
 iznik-server-go/message/message.go            |  11 +-
 iznik-server-go/message/messageGroup.go       |  14 ++
 iznik-server-go/message/message_list.go       |  16 ++
 iznik-server-go/moderation/moderationstats.go |   2 +-
 iznik-server-go/session/session.go            |   9 +-
 iznik-server-go/utils/utils.go                |   6 +-
 10 files changed, 230 insertions(+), 11 deletions(-)
 rename iznik-nuxt3/modtools/pages/messages/checked/{[[id]]/[[term]].vue => [[id]].vue} (100%)
 rename iznik-nuxt3/modtools/pages/messages/trusted/{[[id]]/[[term]].vue => [[id]].vue} (100%)
 create mode 100644 iznik-server-go/message/autoapproveat.go

diff --git a/iznik-nuxt3/modtools/pages/messages/checked/[[id]]/[[term]].vue b/iznik-nuxt3/modtools/pages/messages/checked/[[id]].vue
similarity index 100%
rename from iznik-nuxt3/modtools/pages/messages/checked/[[id]]/[[term]].vue
rename to iznik-nuxt3/modtools/pages/messages/checked/[[id]].vue
diff --git a/iznik-nuxt3/modtools/pages/messages/trusted/[[id]]/[[term]].vue b/iznik-nuxt3/modtools/pages/messages/trusted/[[id]].vue
similarity index 100%
rename from iznik-nuxt3/modtools/pages/messages/trusted/[[id]]/[[term]].vue
rename to iznik-nuxt3/modtools/pages/messages/trusted/[[id]].vue
diff --git a/iznik-server-go/message/autoapproveat.go b/iznik-server-go/message/autoapproveat.go
new file mode 100644
index 0000000000..0778e88b5c
--- /dev/null
+++ b/iznik-server-go/message/autoapproveat.go
@@ -0,0 +1,173 @@
+package message
+
+import (
+	"encoding/json"
+	"hash/crc32"
+	"strconv"
+	"time"
+
+	"github.com/freegle/iznik-server-go/utils"
+	"gorm.io/gorm"
+)
+
+// phpTruthy mirrors PHP's !empty(): nil, false, 0, "" and "0" are falsy; everything
+// else is truthy. Used so the Go group-allows check matches AutoApproveCleanService's
+// PHP getSetting()/empty() semantics exactly.
+func phpTruthy(v interface{}) bool {
+	switch x := v.(type) {
+	case nil:
+		return false
+	case bool:
+		return x
+	case float64:
+		return x != 0
+	case string:
+		return x != "" && x != "0"
+	default:
+		return true
+	}
+}
+
+// computeAutoapproveat fills MessageGroup.Autoapproveat for the Pending group entries of
+// a message a moderator is viewing. It is an ACCURATE estimate of when the post will be
+// auto-approved:
+//
+//   - danger-signalled / Spam-on-any-group / held  -> nil (no auto-approval expected)
+//   - clean path (NULL posting status, content-check clean, group allows, not sampled)
+//     -> arrival + group delay (site default 20m)
+//   - otherwise (not clean, but not held/spam) -> arrival + 48h (the broad fallback)
+//
+// then capped below by autoapprove_hold_until (the extend-only hold set on Pending load).
+//
+// PARITY: the clean-path eligibility and danger signals mirror
+// app/Services/AutoApproveCleanService.php (hasDangerSignals, groupAllowsAutoApprove,
+// isQualitySampled). Keep the two in sync.
+func computeAutoapproveat(db *gorm.DB, message *Message, groups []MessageGroup, idStr string) {
+	// Spam on ANY group blocks auto-approval everywhere (Discourse #9654 parity).
+	for _, mg := range groups {
+		if mg.Collection == utils.COLLECTION_SPAM {
+			return
+		}
+	}
+
+	var pendingIdx []int
+	var gids []uint64
+	for i := range groups {
+		if groups[i].Collection == utils.COLLECTION_PENDING && groups[i].Heldby == nil {
+			pendingIdx = append(pendingIdx, i)
+			gids = append(gids, groups[i].Groupid)
+		}
+	}
+	if len(pendingIdx) == 0 {
+		return
+	}
+
+	idNum, _ := strconv.ParseUint(idStr, 10, 64)
+
+	// Danger signals — mirror AutoApproveCleanService::hasDangerSignals exactly. One
+	// combined query: danger=1 if ANY signal fires for this poster/message/groups.
+	var danger bool
+	db.Raw(`SELECT (
+		EXISTS (SELECT 1 FROM microactions WHERE msgid = ? AND actiontype = 'CheckMessage' AND result = 'Reject')
+		OR EXISTS (SELECT 1 FROM users_comments WHERE userid = ?)
+		OR EXISTS (SELECT 1 FROM logs WHERE user = ? AND timestamp >= NOW() - INTERVAL 90 DAY
+			AND (byuser != user OR byuser IS NULL)
+			AND ((type = 'Message' AND subtype IN ('Rejected','Deleted','Replied'))
+			  OR (type = 'User' AND subtype IN ('Mailed','Rejected','Deleted','Suspect','ClassifiedSpam'))))
+		OR EXISTS (SELECT 1 FROM spam_users WHERE userid = ? AND collection IN ('Spammer','PendingAdd'))
+		OR EXISTS (SELECT 1 FROM memberships WHERE userid = ? AND groupid IN ?
+			AND reviewrequestedat IS NOT NULL
+			AND (reviewedat IS NULL OR reviewedat < reviewrequestedat))
+	) AS danger`,
+		idNum, message.Fromuser, message.Fromuser, message.Fromuser, message.Fromuser, gids,
+	).Scan(&danger)
+	if danger {
+		return
+	}
+
+	for _, i := range pendingIdx {
+		mg := &groups[i]
+
+		var row struct {
+			OurPostingStatus     *string `gorm:"column:ourpostingstatus"`
+			Settings             *string `gorm:"column:settings"`
+			Rules                *string `gorm:"column:rules"`
+			Autofunctionoverride *string `gorm:"column:autofunctionoverride"`
+			Overridemoderation   *string `gorm:"column:overridemoderation"`
+		}
+		db.Raw("SELECT mem.ourPostingStatus AS ourpostingstatus, g.settings AS settings, g.rules AS rules, "+
+			"g.autofunctionoverride AS autofunctionoverride, g.overridemoderation AS overridemoderation "+
+			"FROM `groups` g LEFT JOIN memberships mem ON mem.groupid = g.id AND mem.userid = ? "+
+			"WHERE g.id = ? LIMIT 1", message.Fromuser, mg.Groupid).Scan(&row)
+
+		var settings map[string]interface{}
+		if row.Settings != nil && *row.Settings != "" {
+			_ = json.Unmarshal([]byte(*row.Settings), &settings)
+		}
+
+		// groupAllowsAutoApprove parity (PHP AutoApproveCleanService::groupAllowsAutoApprove).
+		groupAllows := true
+		if settings != nil {
+			if v, ok := settings["publish"]; ok && !phpTruthy(v) { // getSetting('publish', true)
+				groupAllows = false
+			}
+		}
+		if groupAllows && settings != nil && phpTruthy(settings["closed"]) { // isClosed()
+			groupAllows = false
+		}
+		if groupAllows && row.Autofunctionoverride != nil && phpTruthy(*row.Autofunctionoverride) {
+			groupAllows = false
+		}
+		if groupAllows && row.Overridemoderation != nil && *row.Overridemoderation == "ModerateAll" {
+			groupAllows = false
+		}
+		if groupAllows && settings != nil && phpTruthy(settings["moderated"]) { // getSetting('moderated', 0)
+			groupAllows = false
+		}
+		if groupAllows && row.Rules != nil && *row.Rules != "" {
+			var rules map[string]interface{}
+			if json.Unmarshal([]byte(*row.Rules), &rules) == nil && phpTruthy(rules["fullymoderated"]) {
+				groupAllows = false
+			}
+		}
+
+		onCleanPath := groupAllows &&
+			row.OurPostingStatus == nil &&
+			mg.ContentcheckCheckedAt != nil &&
+			mg.ContentcheckReasons == nil &&
+			mg.QualitySample == 0
+
+		// delay_minutes / quality_check_percent from settings.autoapprove (0/absent => default).
+		delayMinutes := 20
+		qualityPercent := 0
+		if settings != nil {
+			if aa, ok := settings["autoapprove"].(map[string]interface{}); ok {
+				if dm, ok := aa["delay_minutes"].(float64); ok && dm > 0 {
+					delayMinutes = int(dm)
+				}
+				if qp, ok := aa["quality_check_percent"].(float64); ok && qp > 0 {
+					qualityPercent = int(qp)
+				}
+			}
+		}
+		// Deterministic quality sample (mirror PHP isQualitySampled: crc32(msgid) % 100 < percent).
+		qualitySampled := qualityPercent > 0 && int(crc32.ChecksumIEEE([]byte(idStr))%100) < qualityPercent
+
+		var base time.Time
+		if onCleanPath && !qualitySampled {
+			base = mg.Arrival.Add(time.Duration(delayMinutes) * time.Minute)
+		} else if mg.Spamtype == nil {
+			// Not on the clean path (or quality-sampled), but not spam/held: 48h fallback.
+			// (Estimate nuance: the fallback also needs >=48h membership, which we ignore.)
+			base = mg.Arrival.Add(48 * time.Hour)
+		}
+
+		if !base.IsZero() {
+			t := base
+			if mg.AutoapproveHoldUntil != nil && mg.AutoapproveHoldUntil.After(t) {
+				t = *mg.AutoapproveHoldUntil
+			}
+			groups[i].Autoapproveat = &t
+		}
+	}
+}
diff --git a/iznik-server-go/message/markchecked.go b/iznik-server-go/message/markchecked.go
index 39b0f28257..c6fd73f480 100644
--- a/iznik-server-go/message/markchecked.go
+++ b/iznik-server-go/message/markchecked.go
@@ -46,7 +46,8 @@ func MarkChecked(c *fiber.Ctx) error {
 	if req.Groupid == 0 {
 		groupIDs = user.GetActiveModGroupIDs(myid)
 		if len(groupIDs) == 0 {
-			return c.JSON(fiber.Map{"success": true, "checked": 0})
+			// Not a moderator of any group — cannot mark anything checked (D11).
+			return fiber.NewError(fiber.StatusForbidden, "Not a moderator")
 		}
 	} else {
 		if !user.IsModOfGroup(myid, req.Groupid) {
@@ -60,13 +61,16 @@ func MarkChecked(c *fiber.Ctx) error {
 		// Mark the specified posts checked — only ones still unchecked, and only
 		// on groups the mod moderates.
 		r := db.Exec("UPDATE messages_groups SET checkedat = NOW(), checkedby = ? "+
-			"WHERE msgid IN ? AND groupid IN ? AND checkedat IS NULL",
-			myid, req.IDs, groupIDs)
+			"WHERE msgid IN ? AND groupid IN ? AND collection = ? AND deleted = 0 AND checkedat IS NULL",
+			myid, req.IDs, groupIDs, utils.COLLECTION_APPROVED)
 		rowsAffected = r.RowsAffected
 	} else {
 		// Mark the whole bucket checked (the "mark all as checked" action). The
 		// bucket condition mirrors the Checked/Trusted list filter so exactly the
 		// posts a mod is looking at get cleared.
+		if req.Filter != "checked" && req.Filter != "trusted" {
+			return fiber.NewError(fiber.StatusBadRequest, "filter must be 'checked' or 'trusted' (D10)")
+		}
 		statusWhere := "mem.ourPostingStatus IS NULL"
 		if req.Filter == "trusted" {
 			statusWhere = "(mem.ourPostingStatus = 'DEFAULT' OR mem.ourPostingStatus = 'UNMODERATED')"
diff --git a/iznik-server-go/message/message.go b/iznik-server-go/message/message.go
index 205e89a565..2f1a19dbed 100644
--- a/iznik-server-go/message/message.go
+++ b/iznik-server-go/message/message.go
@@ -485,7 +485,7 @@ func GetMessagesByIds(myid uint64, ids []string, isPartner bool) []Message {
 				// Both APPROVED and PENDING messages are visible to all users. This is not a privacy
 				// issue because these messages were posted with the intention of being public. It also
 				// allows shared links to work even before moderation approval.
-				db.Raw("SELECT groupid, msgid, arrival, collection, autoreposts, approvedby, heldby, spamtype, spamreason, contentcheck_checked_at, contentcheck_reasons, rippled_in FROM messages_groups WHERE msgid = ? AND deleted = 0", id).Scan(&messageGroups)
+				db.Raw("SELECT groupid, msgid, arrival, collection, autoreposts, approvedby, heldby, spamtype, spamreason, contentcheck_checked_at, contentcheck_reasons, rippled_in, quality_sample, autoapprove_hold_until FROM messages_groups WHERE msgid = ? AND deleted = 0", id).Scan(&messageGroups)
 
 				// Moderator-only "quicker to get to" P/Q note, kept in its own rippling_proximity
 				// table (off the hot messages_groups path). Best-effort: only for mods, and a
@@ -607,6 +607,15 @@ func GetMessagesByIds(myid uint64, ids []string, isPartner bool) []Message {
 				isGroupMod = isModForMessage(db, myid, idNum)
 			}
 
+			// A4. Auto-approve countdown: for Pending posts viewed by a moderator,
+			// compute the per-group autoapproveat estimate (clean-path delay or 48h
+			// fallback, capped by autoapprove_hold_until; nil if danger-signalled,
+			// spam, held, or not on an auto-approve path). Mirrors the eligibility of
+			// AutoApproveCleanService/AutoApproveService — see message/autoapproveat.go.
+			if isGroupMod && myid > 0 {
+				computeAutoapproveat(db, &message, messageGroups, id)
+			}
+
 			// Postings (history of which groups this message was on) are public information,
 			// returned to all callers — matching V1 behaviour.
 			var messagePostings []MessagePosting
diff --git a/iznik-server-go/message/messageGroup.go b/iznik-server-go/message/messageGroup.go
index eeb62f6f5e..24b1ed8221 100644
--- a/iznik-server-go/message/messageGroup.go
+++ b/iznik-server-go/message/messageGroup.go
@@ -42,4 +42,18 @@ type MessageGroup struct {
 	// routing/KNN calls failed at ripple-in time — the frontend shows nothing in all three cases.
 	RippleProximityP *string `json:"ripple_proximity_p,omitempty"`
 	RippleProximityQ *string `json:"ripple_proximity_q,omitempty"`
+
+	// QualitySample is set by AutoApproveCleanService when a clean post is held back
+	// for a manual quality check. Scanned for the autoapproveat estimate; not serialised.
+	QualitySample int `json:"-" gorm:"column:quality_sample"`
+
+	// AutoapproveHoldUntil is the server-side extend-only hold set when the Pending
+	// queue is viewed (see ListMessagesMT). Scanned but not serialised — the frontend
+	// uses the computed Autoapproveat below.
+	AutoapproveHoldUntil *time.Time `json:"-" gorm:"column:autoapprove_hold_until"`
+
+	// Autoapproveat is the earliest time this post may be auto-approved, exposed only
+	// on Pending messages viewed by a group moderator. nil = no auto-approval expected
+	// (held / spam / danger-signalled, or not on any auto-approve path).
+	Autoapproveat *time.Time `json:"autoapproveat,omitempty" gorm:"-"`
 }
diff --git a/iznik-server-go/message/message_list.go b/iznik-server-go/message/message_list.go
index 25b685dc38..6a9fec4e7d 100644
--- a/iznik-server-go/message/message_list.go
+++ b/iznik-server-go/message/message_list.go
@@ -608,6 +608,22 @@ func ListMessagesMT(c *fiber.Ctx) error {
 		return c.JSON(fiber.Map{"messages": []uint64{}})
 	}
 
+	// A3. Reset-to-minimum hold (extend-only) for the messages just loaded. When a
+	// moderator views the Pending queue, every fetched post is given at least 10 more
+	// minutes before it becomes eligible for auto-approval, so nothing vanishes while
+	// the page is open. GREATEST(COALESCE(autoapprove_hold_until, NOW()), NOW()+10m) is
+	// extend-only: an existing hold further out is never shortened. Scope: Pending,
+	// heldby IS NULL, deleted=0, only the mod's groups.
+	if collection == utils.COLLECTION_PENDING && len(groupIDs) > 0 {
+		db.Exec(
+			"UPDATE messages_groups "+
+				"SET autoapprove_hold_until = GREATEST(COALESCE(autoapprove_hold_until, NOW()), NOW() + INTERVAL 10 MINUTE) "+
+				"WHERE msgid IN ? AND groupid IN ? "+
+				"AND collection = 'Pending' AND heldby IS NULL AND deleted = 0",
+			msgIDs, groupIDs,
+		)
+	}
+
 	// Build pagination context from last ID.
 	var respCtx *PaginationContext
 	if len(msgIDs) == limit {
diff --git a/iznik-server-go/moderation/moderationstats.go b/iznik-server-go/moderation/moderationstats.go
index 8d76301a63..9232cef1fb 100644
--- a/iznik-server-go/moderation/moderationstats.go
+++ b/iznik-server-go/moderation/moderationstats.go
@@ -102,7 +102,7 @@ func Stats(c *fiber.Ctx) error {
 			"WHERE mg.approvedat BETWEEN ? AND ? AND mg.approvedby IS NULL "+
 			"AND mg.contentcheck_checked_at IS NOT NULL AND mg.deleted=0 "+
 			"AND (mem.ourPostingStatus='DEFAULT' OR mem.ourPostingStatus='UNMODERATED') "+
-			"AND NOT EXISTS (SELECT 1 FROM logs l WHERE l.msgid=mg.msgid AND l.type='Message' AND l.subtype='Autoapproved')",
+			"AND NOT EXISTS (SELECT 1 FROM logs l WHERE l.msgid=mg.msgid AND l.groupid=mg.groupid AND l.type='Message' AND l.subtype='Autoapproved')",
 			start, end).Scan(&stats.Trusted)
 	})
 
diff --git a/iznik-server-go/session/session.go b/iznik-server-go/session/session.go
index 260231ae8c..7a476cff62 100644
--- a/iznik-server-go/session/session.go
+++ b/iznik-server-go/session/session.go
@@ -1034,12 +1034,13 @@ func GetSession(c *fiber.Ctx) error {
 		// views: checked = auto-approved posts from auto-moderated (NULL) members;
 		// trusted = posts that went live from trusted (group-settings) members.
 		// A post leaves the count when a mod marks it checked (checkedat set) or
-		// after 7 days (auto-checked, so the queue can't pile up indefinitely).
+		// once it is older than the window — older posts simply drop off the queue
+		// (no checkedat is written), so the queue can't pile up indefinitely.
 		var checked, trusted int64
 
 		var wg2 sync.WaitGroup
 
-		// Oversight queues count only unchecked posts within the auto-check window.
+		// Oversight queues count only unchecked posts within the check window.
 		checkedWindowSQL := fmt.Sprintf(
 			"AND mg.checkedat IS NULL AND mg.arrival >= NOW() - INTERVAL %d DAY",
 			utils.MESSAGE_CHECK_WINDOW_DAYS,
@@ -1090,7 +1091,7 @@ func GetSession(c *fiber.Ctx) error {
 
 		// --- Checked: UNCHECKED auto-approved posts from auto-moderated (NULL) members.
 		// Outstanding oversight work (blue): a mod hasn't marked it checked and it
-		// is within the 7-day auto-check window. ---
+		// is within the 7-day check window. ---
 		wg2.Add(1)
 		go func() {
 			defer wg2.Done()
@@ -1106,7 +1107,7 @@ func GetSession(c *fiber.Ctx) error {
 		}()
 
 		// --- Trusted: UNCHECKED live posts from trusted (group-settings) members.
-		// Outstanding oversight work (blue), same 7-day auto-check window. ---
+		// Outstanding oversight work (blue), same 7-day check window. ---
 		wg2.Add(1)
 		go func() {
 			defer wg2.Done()
diff --git a/iznik-server-go/utils/utils.go b/iznik-server-go/utils/utils.go
index b34cd26314..eef0a32dd3 100644
--- a/iznik-server-go/utils/utils.go
+++ b/iznik-server-go/utils/utils.go
@@ -101,8 +101,10 @@ const COLLECTION_BANNED = "Banned"
 const COLLECTION_DRAFT = "Draft"
 
 // MESSAGE_CHECK_WINDOW_DAYS is how long an auto-published post stays in the
-// ModTools Checked/Trusted oversight queues (and their work-count badges) before
-// it is treated as auto-checked, so the queue cannot pile up indefinitely.
+// ModTools Checked/Trusted oversight queues (and their work-count badges). Once a
+// post is older than this it simply drops off the queue — no checkedat is written,
+// so it is NOT counted as moderator-checked — which bounds the queue without
+// inflating the "a mod checked this" moderation-stats metric.
 const MESSAGE_CHECK_WINDOW_DAYS = 7
 
 const POSTING_STATUS_MODERATED = "MODERATED"

From 3a9dd8695e01f05f348420429c03a5ed294f097c Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Mon, 15 Jun 2026 19:10:59 +0100
Subject: [PATCH 10/26] test(go): countdown hold-bump, autoapproveat gating,
 markchecked guards (A3,A4,D9,D11)

TestListMessagesMTPendingBumpsHold (extend-only), TestAutoapproveatPendingModGating
(clean=>time, danger=>nil, non-mod=>nil), TestMarkCheckedSpecificIDs (collection
guard + group scoping), TestMarkCheckedCrossGroupAndNonMod (403 paths). All green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../test/autoapprove_countdown_test.go        | 181 ++++++++++++++++++
 1 file changed, 181 insertions(+)
 create mode 100644 iznik-server-go/test/autoapprove_countdown_test.go

diff --git a/iznik-server-go/test/autoapprove_countdown_test.go b/iznik-server-go/test/autoapprove_countdown_test.go
new file mode 100644
index 0000000000..4e7e234838
--- /dev/null
+++ b/iznik-server-go/test/autoapprove_countdown_test.go
@@ -0,0 +1,181 @@
+package test
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/freegle/iznik-server-go/database"
+	"github.com/stretchr/testify/assert"
+)
+
+// getAutoapproveatField fetches a message as the given user and returns the
+// autoapproveat value for the named group (nil if absent / not a mod / not pending).
+func getAutoapproveatField(t *testing.T, msgid uint64, groupid uint64, token string) interface{} {
+	resp, err := getApp().Test(httptest.NewRequest("GET",
+		fmt.Sprintf("/api/message/%d?jwt=%s", msgid, token), nil))
+	assert.NoError(t, err)
+	assert.Equal(t, 200, resp.StatusCode)
+	var body map[string]interface{}
+	json.NewDecoder(resp.Body).Decode(&body)
+	groups, _ := body["groups"].([]interface{})
+	for _, g := range groups {
+		gm, _ := g.(map[string]interface{})
+		if gid, ok := gm["groupid"].(float64); ok && uint64(gid) == groupid {
+			return gm["autoapproveat"]
+		}
+	}
+	return nil
+}
+
+// A3: loading the Pending queue bumps autoapprove_hold_until to >= NOW()+10m
+// (extend-only — an existing longer hold is never shortened).
+func TestListMessagesMTPendingBumpsHold(t *testing.T) {
+	prefix := uniquePrefix("hold_bump")
+	db := database.DBConn
+
+	groupID := CreateTestGroup(t, prefix)
+	poster := CreateTestUser(t, prefix+"_poster", "User")
+	modID := CreateTestUser(t, prefix+"_mod", "User")
+	CreateTestMembership(t, poster, groupID, "Member")
+	CreateTestMembership(t, modID, groupID, "Moderator")
+	db.Exec("UPDATE memberships SET ourPostingStatus = NULL WHERE userid = ? AND groupid = ?", poster, groupID)
+	_, modToken := CreateTestSession(t, modID)
+
+	// Fresh pending post with no hold. contentcheck_checked_at must be set so the
+	// post is visible in the Pending list (else the content-check filter hides it).
+	freshMsg := CreateTestMessage(t, poster, groupID, prefix+" fresh pending", 52.0, -1.0)
+	// Pending post already held 60 min out — extend-only must not shorten it.
+	heldMsg := CreateTestMessage(t, poster, groupID, prefix+" held pending", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Pending', arrival=NOW(), contentcheck_checked_at=NOW(), autoapprove_hold_until=NULL WHERE msgid=?", freshMsg)
+	db.Exec("UPDATE messages_groups SET collection='Pending', arrival=NOW(), contentcheck_checked_at=NOW(), autoapprove_hold_until=NOW() + INTERVAL 60 MINUTE WHERE msgid=?", heldMsg)
+
+	resp, err := getApp().Test(httptest.NewRequest("GET",
+		fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Pending&jwt=%s", groupID, modToken), nil))
+	assert.NoError(t, err)
+	assert.Equal(t, 200, resp.StatusCode)
+
+	var freshSecs int64
+	db.Raw("SELECT TIMESTAMPDIFF(SECOND, NOW(), autoapprove_hold_until) FROM messages_groups WHERE msgid=? AND groupid=?", freshMsg, groupID).Scan(&freshSecs)
+	assert.GreaterOrEqual(t, freshSecs, int64(9*60), "fresh pending post should be held >= ~10 min after load")
+
+	var heldSecs int64
+	db.Raw("SELECT TIMESTAMPDIFF(SECOND, NOW(), autoapprove_hold_until) FROM messages_groups WHERE msgid=? AND groupid=?", heldMsg, groupID).Scan(&heldSecs)
+	assert.Greater(t, heldSecs, int64(30*60), "existing longer hold must not be shortened (extend-only)")
+
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?)", freshMsg, heldMsg)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", freshMsg, heldMsg)
+}
+
+// A4: GET /message/:id exposes autoapproveat only for Pending posts viewed by a
+// moderator; clean-path posts get a time, danger-signalled posts get nil, and
+// non-mods never see it.
+func TestAutoapproveatPendingModGating(t *testing.T) {
+	prefix := uniquePrefix("autoapproveat")
+	db := database.DBConn
+
+	groupID := CreateTestGroup(t, prefix)
+	poster := CreateTestUser(t, prefix+"_poster", "User")
+	modID := CreateTestUser(t, prefix+"_mod", "User")
+	regularID := CreateTestUser(t, prefix+"_reg", "User")
+	CreateTestMembership(t, poster, groupID, "Member")
+	CreateTestMembership(t, modID, groupID, "Moderator")
+	CreateTestMembership(t, regularID, groupID, "Member")
+	db.Exec("UPDATE memberships SET ourPostingStatus = NULL WHERE userid = ? AND groupid = ?", poster, groupID)
+	_, modToken := CreateTestSession(t, modID)
+	_, regToken := CreateTestSession(t, regularID)
+
+	// Clean-path pending post: NULL poster, content-check clean, arrival 5 min ago.
+	cleanMsg := CreateTestMessage(t, poster, groupID, prefix+" clean pending", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Pending', arrival=NOW() - INTERVAL 5 MINUTE, contentcheck_checked_at=NOW() - INTERVAL 4 MINUTE, contentcheck_reasons=NULL, autoapprove_hold_until=NULL WHERE msgid=?", cleanMsg)
+
+	// Mod sees autoapproveat.
+	assert.NotNil(t, getAutoapproveatField(t, cleanMsg, groupID, modToken),
+		"mod should see autoapproveat on a clean pending post")
+	// Non-mod does not.
+	assert.Nil(t, getAutoapproveatField(t, cleanMsg, groupID, regToken),
+		"non-mod must not see autoapproveat")
+
+	// Danger-signalled post (poster is a known spammer) → no countdown.
+	dangerMsg := CreateTestMessage(t, poster, groupID, prefix+" danger pending", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Pending', arrival=NOW() - INTERVAL 5 MINUTE, contentcheck_checked_at=NOW() - INTERVAL 4 MINUTE WHERE msgid=?", dangerMsg)
+	db.Exec("INSERT INTO spam_users (userid, collection, added) VALUES (?, 'Spammer', NOW())", poster)
+	assert.Nil(t, getAutoapproveatField(t, dangerMsg, groupID, modToken),
+		"danger-signalled post must not show a countdown")
+
+	db.Exec("DELETE FROM spam_users WHERE userid=?", poster)
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?)", cleanMsg, dangerMsg)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", cleanMsg, dangerMsg)
+}
+
+// D9: markchecked with explicit ids marks only Approved rows on the mod's groups,
+// leaving Pending rows and other-group rows untouched.
+func TestMarkCheckedSpecificIDs(t *testing.T) {
+	prefix := uniquePrefix("markchk_ids")
+	db := database.DBConn
+
+	groupA := CreateTestGroup(t, prefix+"_a")
+	groupB := CreateTestGroup(t, prefix+"_b")
+	poster := CreateTestUser(t, prefix+"_poster", "User")
+	modID := CreateTestUser(t, prefix+"_mod", "User")
+	CreateTestMembership(t, poster, groupA, "Member")
+	CreateTestMembership(t, poster, groupB, "Member")
+	CreateTestMembership(t, modID, groupA, "Moderator") // mod of A only
+	_, modToken := CreateTestSession(t, modID)
+
+	approvedA := CreateTestMessage(t, poster, groupA, prefix+" approved a", 52.0, -1.0)
+	pendingA := CreateTestMessage(t, poster, groupA, prefix+" pending a", 52.0, -1.0)
+	approvedB := CreateTestMessage(t, poster, groupB, prefix+" approved b", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL WHERE msgid IN (?, ?)", approvedA, approvedB)
+	db.Exec("UPDATE messages_groups SET collection='Pending' WHERE msgid=?", pendingA)
+
+	body := fmt.Sprintf(`{"groupid": %d, "ids": [%d, %d, %d]}`, groupA, approvedA, pendingA, approvedB)
+	req := httptest.NewRequest("POST", fmt.Sprintf("/api/modtools/messages/markchecked?jwt=%s", modToken), strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := getApp().Test(req)
+	assert.NoError(t, err)
+	assert.Equal(t, 200, resp.StatusCode)
+
+	var aChecked, pendChecked, bChecked int64
+	db.Raw("SELECT COUNT(*) FROM messages_groups WHERE msgid=? AND groupid=? AND checkedat IS NOT NULL", approvedA, groupA).Scan(&aChecked)
+	db.Raw("SELECT COUNT(*) FROM messages_groups WHERE msgid=? AND groupid=? AND checkedat IS NOT NULL", pendingA, groupA).Scan(&pendChecked)
+	db.Raw("SELECT COUNT(*) FROM messages_groups WHERE msgid=? AND groupid=? AND checkedat IS NOT NULL", approvedB, groupB).Scan(&bChecked)
+	assert.Equal(t, int64(1), aChecked, "Approved post on the mod's group should be checked")
+	assert.Equal(t, int64(0), pendChecked, "Pending post must not be marked checked (collection guard, D9)")
+	assert.Equal(t, int64(0), bChecked, "post on a non-moderated group must not be checked")
+
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?, ?)", approvedA, pendingA, approvedB)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?, ?)", approvedA, pendingA, approvedB)
+}
+
+// D11: markchecked returns 403 for a mod acting on a group they don't moderate,
+// and for a non-mod using groupid=0.
+func TestMarkCheckedCrossGroupAndNonMod(t *testing.T) {
+	prefix := uniquePrefix("markchk_403")
+
+	groupA := CreateTestGroup(t, prefix+"_a")
+	groupB := CreateTestGroup(t, prefix+"_b")
+	modB := CreateTestUser(t, prefix+"_modb", "User")
+	CreateTestMembership(t, modB, groupB, "Moderator") // mod of B only
+	_, modBToken := CreateTestSession(t, modB)
+
+	// Mod of B targeting group A → 403.
+	bodyA := fmt.Sprintf(`{"groupid": %d, "filter": "checked"}`, groupA)
+	reqA := httptest.NewRequest("POST", fmt.Sprintf("/api/modtools/messages/markchecked?jwt=%s", modBToken), strings.NewReader(bodyA))
+	reqA.Header.Set("Content-Type", "application/json")
+	respA, err := getApp().Test(reqA)
+	assert.NoError(t, err)
+	assert.Equal(t, 403, respA.StatusCode, "mod of B must not mark group A")
+
+	// Non-mod with groupid=0 → 403.
+	regID := CreateTestUser(t, prefix+"_reg", "User")
+	_, regToken := CreateTestSession(t, regID)
+	body0 := `{"groupid": 0, "filter": "checked"}`
+	req0 := httptest.NewRequest("POST", fmt.Sprintf("/api/modtools/messages/markchecked?jwt=%s", regToken), strings.NewReader(body0))
+	req0.Header.Set("Content-Type", "application/json")
+	resp0, err := getApp().Test(req0)
+	assert.NoError(t, err)
+	assert.Equal(t, 403, resp0.StatusCode, "non-mod with groupid=0 must get 403")
+}

From f28588ba7998df4257d105a5717b5bef806a2fd6 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Mon, 15 Jun 2026 19:17:27 +0100
Subject: [PATCH 11/26] feat(modtools): Pending auto-approve countdown +
 oversight help boxes (A5,C,D2,D5,D8,D12)

- A5: live countdown badge on Pending messages (ModMessage.vue) from per-group
  autoapproveat: >1h muted, <=30m prominent, <=0 Auto-approving..., null=hidden.
- C: ModHelpPending/Checked/Trusted/Approved help boxes (useHelpBox), wired into
  the four queue pages, explaining what goes where.
- D2: oversight empty-state copy now says posts "drop off this queue" (not the
  inaccurate "treated as checked").
- D5: drop the unused [[term]] route segment from the checked/trusted pages.
- D8: align the moderation-stats auto-approved row label (Checked delay + 48h fallback).
- D12: remove orphaned autoChecked/autoFallback from the stats spec fixture.
Vitest: countdown (5 cases), four ModHelp specs, and the stats spec all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../modtools/components/ModHelpApproved.vue   | 19 +++++++
 .../modtools/components/ModHelpChecked.vue    | 20 +++++++
 .../modtools/components/ModHelpPending.vue    | 23 ++++++++
 .../modtools/components/ModHelpTrusted.vue    | 20 +++++++
 .../modtools/components/ModMessage.vue        | 53 ++++++++++++++++++
 .../components/ModSysAdminModerationStats.vue |  2 +-
 .../messages/approved/[[id]]/[[term]].vue     |  1 +
 .../pages/messages/checked/[[id]].vue         |  3 +-
 .../messages/pending/[[id]]/[[term]].vue      |  1 +
 .../pages/messages/trusted/[[id]].vue         |  3 +-
 .../modtools/ModHelpApproved.spec.js          | 52 ++++++++++++++++++
 .../modtools/ModHelpChecked.spec.js           | 53 ++++++++++++++++++
 .../modtools/ModHelpPending.spec.js           | 51 +++++++++++++++++
 .../modtools/ModHelpTrusted.spec.js           | 52 ++++++++++++++++++
 .../components/modtools/ModMessage.spec.js    | 55 +++++++++++++++++++
 .../ModSysAdminModerationStats.spec.js        |  4 +-
 16 files changed, 407 insertions(+), 5 deletions(-)
 create mode 100644 iznik-nuxt3/modtools/components/ModHelpApproved.vue
 create mode 100644 iznik-nuxt3/modtools/components/ModHelpChecked.vue
 create mode 100644 iznik-nuxt3/modtools/components/ModHelpPending.vue
 create mode 100644 iznik-nuxt3/modtools/components/ModHelpTrusted.vue
 create mode 100644 iznik-nuxt3/tests/unit/components/modtools/ModHelpApproved.spec.js
 create mode 100644 iznik-nuxt3/tests/unit/components/modtools/ModHelpChecked.spec.js
 create mode 100644 iznik-nuxt3/tests/unit/components/modtools/ModHelpPending.spec.js
 create mode 100644 iznik-nuxt3/tests/unit/components/modtools/ModHelpTrusted.spec.js

diff --git a/iznik-nuxt3/modtools/components/ModHelpApproved.vue b/iznik-nuxt3/modtools/components/ModHelpApproved.vue
new file mode 100644
index 0000000000..b21837ac16
--- /dev/null
+++ b/iznik-nuxt3/modtools/components/ModHelpApproved.vue
@@ -0,0 +1,19 @@
+<template>
+  <NoticeMessage v-if="showHelp" variant="info" class="mt-2 mb-2">
+    <b-button variant="white" class="float-end" @click="toggleHelp">
+      Hide Help
+    </b-button>
+    <p class="mb-0">
+      Every live post on your group(s). Checked and Trusted are focused
+      oversight subsets of this.
+    </p>
+  </NoticeMessage>
+  <b-button v-else variant="link" class="float-end pt-0" @click="toggleHelp">
+    Help
+  </b-button>
+</template>
+<script setup>
+import { useHelpBox } from '~/composables/useHelpBox'
+
+const { toggleHelp, showHelp } = useHelpBox()
+</script>
diff --git a/iznik-nuxt3/modtools/components/ModHelpChecked.vue b/iznik-nuxt3/modtools/components/ModHelpChecked.vue
new file mode 100644
index 0000000000..fbc2804f19
--- /dev/null
+++ b/iznik-nuxt3/modtools/components/ModHelpChecked.vue
@@ -0,0 +1,20 @@
+<template>
+  <NoticeMessage v-if="showHelp" variant="info" class="mt-2 mb-2">
+    <b-button variant="white" class="float-end" @click="toggleHelp">
+      Hide Help
+    </b-button>
+    <p class="mb-0">
+      Posts that went live automatically from auto-moderated members. Review
+      them here as a safety net; "Mark as checked" clears them. Posts older than
+      a week drop off this queue.
+    </p>
+  </NoticeMessage>
+  <b-button v-else variant="link" class="float-end pt-0" @click="toggleHelp">
+    Help
+  </b-button>
+</template>
+<script setup>
+import { useHelpBox } from '~/composables/useHelpBox'
+
+const { toggleHelp, showHelp } = useHelpBox()
+</script>
diff --git a/iznik-nuxt3/modtools/components/ModHelpPending.vue b/iznik-nuxt3/modtools/components/ModHelpPending.vue
new file mode 100644
index 0000000000..21d56fb222
--- /dev/null
+++ b/iznik-nuxt3/modtools/components/ModHelpPending.vue
@@ -0,0 +1,23 @@
+<template>
+  <NoticeMessage v-if="showHelp" variant="info" class="mt-2 mb-2">
+    <b-button variant="white" class="float-end" @click="toggleHelp">
+      Hide Help
+    </b-button>
+    <p>
+      Posts waiting to go live. Clean posts from auto-moderated members publish
+      automatically after a short delay — the countdown on each post shows how
+      long you have. Opening this page guarantees at least 10 minutes on every
+      post, so nothing disappears while you're looking.
+    </p>
+    <p class="mb-0">Reject or hold anything that shouldn't go live.</p>
+  </NoticeMessage>
+  <b-button v-else variant="link" class="float-end pt-0" @click="toggleHelp">
+    Help
+  </b-button>
+</template>
+<script setup>
+import { useHelpBox } from '~/composables/useHelpBox'
+
+// Defaults to shown (useHelpBox initialises showHelp = true); a mod can hide it.
+const { toggleHelp, showHelp } = useHelpBox()
+</script>
diff --git a/iznik-nuxt3/modtools/components/ModHelpTrusted.vue b/iznik-nuxt3/modtools/components/ModHelpTrusted.vue
new file mode 100644
index 0000000000..80959763ba
--- /dev/null
+++ b/iznik-nuxt3/modtools/components/ModHelpTrusted.vue
@@ -0,0 +1,20 @@
+<template>
+  <NoticeMessage v-if="showHelp" variant="info" class="mt-2 mb-2">
+    <b-button variant="white" class="float-end" @click="toggleHelp">
+      Hide Help
+    </b-button>
+    <p class="mb-0">
+      Posts that went live without moderation from trusted members (set in your
+      group settings). Oversight only — review if you want. Posts older than a
+      week drop off this queue.
+    </p>
+  </NoticeMessage>
+  <b-button v-else variant="link" class="float-end pt-0" @click="toggleHelp">
+    Help
+  </b-button>
+</template>
+<script setup>
+import { useHelpBox } from '~/composables/useHelpBox'
+
+const { toggleHelp, showHelp } = useHelpBox()
+</script>
diff --git a/iznik-nuxt3/modtools/components/ModMessage.vue b/iznik-nuxt3/modtools/components/ModMessage.vue
index 15c93b46b4..b983ed0fac 100644
--- a/iznik-nuxt3/modtools/components/ModMessage.vue
+++ b/iznik-nuxt3/modtools/components/ModMessage.vue
@@ -133,6 +133,14 @@
             >
               Pending
             </span>
+            <span
+              v-if="pending && countdownLabel"
+              data-testid="autoapprove-countdown"
+              class="small ms-2"
+              :class="countdownLabel.cls"
+            >
+              {{ countdownLabel.text }}
+            </span>
             <!-- Approved-by is shown by MessageHistory with resolved name -->
             <div v-if="message.deadline" class="text-danger small">
               Deadline: end {{ dateonly(message.deadline) }}
@@ -901,6 +909,11 @@ const userStore = useUserStore()
 
 const message = computed(() => messageStore.byId(props.messageid))
 
+// --- Auto-approve countdown (A5) ---
+// `now` ticks every second (see onMounted) so the countdown label recomputes live.
+const now = ref(Date.now())
+let countdownInterval = null
+
 watch(
   () => props.messageid,
   async (id) => {
@@ -1184,6 +1197,37 @@ const pending = computed(() => {
   return hasCollection('Pending')
 })
 
+// The soonest non-null autoapproveat across all Pending groups for this message.
+const soonestAutoapproveat = computed(() => {
+  if (!message.value?.groups) return null
+  let best = null
+  for (const g of message.value.groups) {
+    if (g.collection === 'Pending' && g.autoapproveat) {
+      const t = new Date(g.autoapproveat).getTime()
+      if (best === null || t < best) best = t
+    }
+  }
+  return best
+})
+
+// Live countdown label + CSS class, recomputed every second via `now`.
+const countdownLabel = computed(() => {
+  const target = soonestAutoapproveat.value
+  if (target === null) return null
+  const secsLeft = Math.floor((target - now.value) / 1000)
+  if (secsLeft <= 0) return { text: 'Auto-approving…', cls: 'text-info' }
+  const totalMins = Math.floor(secsLeft / 60)
+  const secs = secsLeft % 60
+  if (totalMins >= 60) {
+    const hrs = Math.floor(totalMins / 60)
+    return { text: `Auto-approves in ~${hrs}h`, cls: 'text-muted' }
+  }
+  return {
+    text: `Auto-approves in ${totalMins}m ${String(secs).padStart(2, '0')}s`,
+    cls: 'text-warning fw-bold',
+  }
+})
+
 const eSubject = computed(() => {
   if (!message.value) return ''
   return twem(message.value.subject)
@@ -1471,12 +1515,21 @@ onMounted(() => {
       userStore.fetch(message.value.heldby)
     }
   }
+
+  // Per-second ticker for the auto-approve countdown badge.
+  countdownInterval = setInterval(() => {
+    now.value = Date.now()
+  }, 1000)
 })
 
 onBeforeUnmount(() => {
   if (message.value) {
     emit('destroy', message.value.id, props.next)
   }
+  if (countdownInterval) {
+    clearInterval(countdownInterval)
+    countdownInterval = null
+  }
 })
 
 function updateComments() {
diff --git a/iznik-nuxt3/modtools/components/ModSysAdminModerationStats.vue b/iznik-nuxt3/modtools/components/ModSysAdminModerationStats.vue
index 017e6bf29b..c08212ff43 100644
--- a/iznik-nuxt3/modtools/components/ModSysAdminModerationStats.vue
+++ b/iznik-nuxt3/modtools/components/ModSysAdminModerationStats.vue
@@ -44,7 +44,7 @@
               <b-td class="text-muted">{{ pct(stats.manualRejected, stats.arrived) }}</b-td>
             </b-tr>
             <b-tr>
-              <b-td>Auto-approved (Checked)</b-td>
+              <b-td>Auto-approved (Checked delay + 48h fallback)</b-td>
               <b-td class="text-end">{{ stats.autoApproved }}</b-td>
               <b-td class="text-muted">{{ pct(stats.autoApproved, stats.arrived) }}</b-td>
             </b-tr>
diff --git a/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue b/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue
index 41236251f7..39c75cffd4 100644
--- a/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue
+++ b/iznik-nuxt3/modtools/pages/messages/approved/[[id]]/[[term]].vue
@@ -1,6 +1,7 @@
 <template>
   <client-only>
     <ScrollToTop :prepend="groupName" />
+    <ModHelpApproved />
     <div class="d-flex justify-content-between flex-wrap">
       <ModGroupSelect
         v-model="chosengroupid"
diff --git a/iznik-nuxt3/modtools/pages/messages/checked/[[id]].vue b/iznik-nuxt3/modtools/pages/messages/checked/[[id]].vue
index e26932be4c..1f9bc1a62b 100644
--- a/iznik-nuxt3/modtools/pages/messages/checked/[[id]].vue
+++ b/iznik-nuxt3/modtools/pages/messages/checked/[[id]].vue
@@ -2,6 +2,7 @@
   <div>
     <client-only>
       <ScrollToTop />
+      <ModHelpChecked />
       <div class="d-flex justify-content-between">
         <ModGroupSelect
           v-model="groupid"
@@ -29,7 +30,7 @@
       >
         Nothing to check. These are posts that went live automatically from
         auto-moderated members — once you've checked them they drop off here, and
-        anything older than a week is treated as checked.
+        anything older than a week is excluded from this queue.
       </NoticeMessage>
       <div v-if="groupsreceived">
         <ModMessages />
diff --git a/iznik-nuxt3/modtools/pages/messages/pending/[[id]]/[[term]].vue b/iznik-nuxt3/modtools/pages/messages/pending/[[id]]/[[term]].vue
index b02a619776..1567f5a967 100644
--- a/iznik-nuxt3/modtools/pages/messages/pending/[[id]]/[[term]].vue
+++ b/iznik-nuxt3/modtools/pages/messages/pending/[[id]]/[[term]].vue
@@ -2,6 +2,7 @@
   <div>
     <client-only>
       <ScrollToTop />
+      <ModHelpPending />
       <ModAimsModal
         v-if="showAimsModal"
         ref="showAimsModal"
diff --git a/iznik-nuxt3/modtools/pages/messages/trusted/[[id]].vue b/iznik-nuxt3/modtools/pages/messages/trusted/[[id]].vue
index ac3b204e70..d200c0c438 100644
--- a/iznik-nuxt3/modtools/pages/messages/trusted/[[id]].vue
+++ b/iznik-nuxt3/modtools/pages/messages/trusted/[[id]].vue
@@ -2,6 +2,7 @@
   <div>
     <client-only>
       <ScrollToTop />
+      <ModHelpTrusted />
       <div class="d-flex justify-content-between">
         <ModGroupSelect
           v-model="groupid"
@@ -29,7 +30,7 @@
       >
         Nothing to check. These are posts that went live without moderation from
         trusted (Group Settings) members — once you've checked them they drop off
-        here, and anything older than a week is treated as checked.
+        here, and anything older than a week is excluded from this queue.
       </NoticeMessage>
       <div v-if="groupsreceived">
         <ModMessages />
diff --git a/iznik-nuxt3/tests/unit/components/modtools/ModHelpApproved.spec.js b/iznik-nuxt3/tests/unit/components/modtools/ModHelpApproved.spec.js
new file mode 100644
index 0000000000..e9ddd37997
--- /dev/null
+++ b/iznik-nuxt3/tests/unit/components/modtools/ModHelpApproved.spec.js
@@ -0,0 +1,52 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { ref } from 'vue'
+import ModHelpApproved from '~/modtools/components/ModHelpApproved.vue'
+
+const mockShowHelp = ref(true)
+const mockToggleHelp = vi.fn()
+vi.mock('~/composables/useHelpBox', () => ({
+  useHelpBox: () => ({
+    hide: vi.fn(),
+    show: vi.fn(),
+    showHelp: mockShowHelp,
+    toggleHelp: mockToggleHelp,
+  }),
+}))
+
+const stubs = {
+  NoticeMessage: {
+    template: '<div class="notice-message"><slot /></div>',
+    props: ['variant'],
+  },
+  'b-button': {
+    template: "<button @click=\"$emit('click')\"><slot /></button>",
+  },
+}
+
+describe('ModHelpApproved', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockShowHelp.value = true
+  })
+
+  it('explains that Approved is every live post and Checked/Trusted are subsets', () => {
+    const wrapper = mount(ModHelpApproved, { global: { stubs } })
+    expect(wrapper.text()).toContain('Every live post')
+    expect(wrapper.text()).toContain('focused')
+    expect(wrapper.text()).toContain('oversight subsets')
+  })
+
+  it('collapses to a Help button when hidden', () => {
+    mockShowHelp.value = false
+    const wrapper = mount(ModHelpApproved, { global: { stubs } })
+    expect(wrapper.find('.notice-message').exists()).toBe(false)
+    expect(wrapper.text()).toContain('Help')
+  })
+
+  it('toggles help when the button is clicked', async () => {
+    const wrapper = mount(ModHelpApproved, { global: { stubs } })
+    await wrapper.find('button').trigger('click')
+    expect(mockToggleHelp).toHaveBeenCalled()
+  })
+})
diff --git a/iznik-nuxt3/tests/unit/components/modtools/ModHelpChecked.spec.js b/iznik-nuxt3/tests/unit/components/modtools/ModHelpChecked.spec.js
new file mode 100644
index 0000000000..473c466d28
--- /dev/null
+++ b/iznik-nuxt3/tests/unit/components/modtools/ModHelpChecked.spec.js
@@ -0,0 +1,53 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { ref } from 'vue'
+import ModHelpChecked from '~/modtools/components/ModHelpChecked.vue'
+
+const mockShowHelp = ref(true)
+const mockToggleHelp = vi.fn()
+vi.mock('~/composables/useHelpBox', () => ({
+  useHelpBox: () => ({
+    hide: vi.fn(),
+    show: vi.fn(),
+    showHelp: mockShowHelp,
+    toggleHelp: mockToggleHelp,
+  }),
+}))
+
+const stubs = {
+  NoticeMessage: {
+    template: '<div class="notice-message"><slot /></div>',
+    props: ['variant'],
+  },
+  'b-button': {
+    template: "<button @click=\"$emit('click')\"><slot /></button>",
+  },
+}
+
+describe('ModHelpChecked', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockShowHelp.value = true
+  })
+
+  it('explains the checked oversight queue with accurate wording', () => {
+    const wrapper = mount(ModHelpChecked, { global: { stubs } })
+    expect(wrapper.text()).toContain('went live automatically from auto-moderated members')
+    expect(wrapper.text()).toContain('drop off this queue')
+    // Must NOT use the inaccurate "treated as checked" phrasing (review finding D2).
+    expect(wrapper.text()).not.toContain('treated as checked')
+  })
+
+  it('collapses to a Help button when hidden', () => {
+    mockShowHelp.value = false
+    const wrapper = mount(ModHelpChecked, { global: { stubs } })
+    expect(wrapper.find('.notice-message').exists()).toBe(false)
+    expect(wrapper.text()).toContain('Help')
+  })
+
+  it('toggles help when the button is clicked', async () => {
+    const wrapper = mount(ModHelpChecked, { global: { stubs } })
+    await wrapper.find('button').trigger('click')
+    expect(mockToggleHelp).toHaveBeenCalled()
+  })
+})
diff --git a/iznik-nuxt3/tests/unit/components/modtools/ModHelpPending.spec.js b/iznik-nuxt3/tests/unit/components/modtools/ModHelpPending.spec.js
new file mode 100644
index 0000000000..41fa26b9ad
--- /dev/null
+++ b/iznik-nuxt3/tests/unit/components/modtools/ModHelpPending.spec.js
@@ -0,0 +1,51 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { ref } from 'vue'
+import ModHelpPending from '~/modtools/components/ModHelpPending.vue'
+
+const mockShowHelp = ref(true)
+const mockToggleHelp = vi.fn()
+vi.mock('~/composables/useHelpBox', () => ({
+  useHelpBox: () => ({
+    hide: vi.fn(),
+    show: vi.fn(),
+    showHelp: mockShowHelp,
+    toggleHelp: mockToggleHelp,
+  }),
+}))
+
+const stubs = {
+  NoticeMessage: {
+    template: '<div class="notice-message"><slot /></div>',
+    props: ['variant'],
+  },
+  'b-button': {
+    template: "<button @click=\"$emit('click')\"><slot /></button>",
+  },
+}
+
+describe('ModHelpPending', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockShowHelp.value = true
+  })
+
+  it('explains the pending queue and the 10-minute guarantee when shown', () => {
+    const wrapper = mount(ModHelpPending, { global: { stubs } })
+    expect(wrapper.text()).toContain('Posts waiting to go live')
+    expect(wrapper.text()).toContain('at least 10 minutes')
+  })
+
+  it('collapses to a Help button when hidden', () => {
+    mockShowHelp.value = false
+    const wrapper = mount(ModHelpPending, { global: { stubs } })
+    expect(wrapper.find('.notice-message').exists()).toBe(false)
+    expect(wrapper.text()).toContain('Help')
+  })
+
+  it('toggles help when the button is clicked', async () => {
+    const wrapper = mount(ModHelpPending, { global: { stubs } })
+    await wrapper.find('button').trigger('click')
+    expect(mockToggleHelp).toHaveBeenCalled()
+  })
+})
diff --git a/iznik-nuxt3/tests/unit/components/modtools/ModHelpTrusted.spec.js b/iznik-nuxt3/tests/unit/components/modtools/ModHelpTrusted.spec.js
new file mode 100644
index 0000000000..d05f8682e6
--- /dev/null
+++ b/iznik-nuxt3/tests/unit/components/modtools/ModHelpTrusted.spec.js
@@ -0,0 +1,52 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { ref } from 'vue'
+import ModHelpTrusted from '~/modtools/components/ModHelpTrusted.vue'
+
+const mockShowHelp = ref(true)
+const mockToggleHelp = vi.fn()
+vi.mock('~/composables/useHelpBox', () => ({
+  useHelpBox: () => ({
+    hide: vi.fn(),
+    show: vi.fn(),
+    showHelp: mockShowHelp,
+    toggleHelp: mockToggleHelp,
+  }),
+}))
+
+const stubs = {
+  NoticeMessage: {
+    template: '<div class="notice-message"><slot /></div>',
+    props: ['variant'],
+  },
+  'b-button': {
+    template: "<button @click=\"$emit('click')\"><slot /></button>",
+  },
+}
+
+describe('ModHelpTrusted', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockShowHelp.value = true
+  })
+
+  it('explains the trusted oversight queue', () => {
+    const wrapper = mount(ModHelpTrusted, { global: { stubs } })
+    expect(wrapper.text()).toContain('went live without moderation from trusted members')
+    expect(wrapper.text()).toContain('Oversight only')
+    expect(wrapper.text()).toContain('drop off this queue')
+  })
+
+  it('collapses to a Help button when hidden', () => {
+    mockShowHelp.value = false
+    const wrapper = mount(ModHelpTrusted, { global: { stubs } })
+    expect(wrapper.find('.notice-message').exists()).toBe(false)
+    expect(wrapper.text()).toContain('Help')
+  })
+
+  it('toggles help when the button is clicked', async () => {
+    const wrapper = mount(ModHelpTrusted, { global: { stubs } })
+    await wrapper.find('button').trigger('click')
+    expect(mockToggleHelp).toHaveBeenCalled()
+  })
+})
diff --git a/iznik-nuxt3/tests/unit/components/modtools/ModMessage.spec.js b/iznik-nuxt3/tests/unit/components/modtools/ModMessage.spec.js
index 3955c35228..d7ef42150d 100644
--- a/iznik-nuxt3/tests/unit/components/modtools/ModMessage.spec.js
+++ b/iznik-nuxt3/tests/unit/components/modtools/ModMessage.spec.js
@@ -1709,4 +1709,59 @@ describe('ModMessage', () => {
       expect(labelSpan.text()).toBe('Back to Pending')
     })
   })
+
+  describe('auto-approve countdown badge (A5)', () => {
+    const pendingGroups = (autoapproveat) => [
+      { groupid: 789, namedisplay: 'Test Group', collection: 'Pending', autoapproveat },
+    ]
+
+    it('shows no badge when there is no autoapproveat', () => {
+      const wrapper = mountComponent({}, { groups: pendingGroups(null) })
+      expect(
+        wrapper.find('[data-testid="autoapprove-countdown"]').exists()
+      ).toBe(false)
+    })
+
+    it('shows a prominent m/s countdown when <=30m away', () => {
+      const soon = new Date(Date.now() + 15 * 60 * 1000).toISOString()
+      const wrapper = mountComponent({}, { groups: pendingGroups(soon) })
+      const badge = wrapper.find('[data-testid="autoapprove-countdown"]')
+      expect(badge.exists()).toBe(true)
+      expect(badge.text()).toMatch(/Auto-approves in \d+m \d{2}s/)
+    })
+
+    it('shows a muted ~Nh badge when >1h away', () => {
+      const later = new Date(Date.now() + 3 * 60 * 60 * 1000).toISOString()
+      const wrapper = mountComponent({}, { groups: pendingGroups(later) })
+      const badge = wrapper.find('[data-testid="autoapprove-countdown"]')
+      expect(badge.exists()).toBe(true)
+      expect(badge.text()).toMatch(/Auto-approves in ~3h/)
+    })
+
+    it('shows Auto-approving… when the time has passed', () => {
+      const past = new Date(Date.now() - 5000).toISOString()
+      const wrapper = mountComponent({}, { groups: pendingGroups(past) })
+      expect(
+        wrapper.find('[data-testid="autoapprove-countdown"]').text()
+      ).toBe('Auto-approving…')
+    })
+
+    it('picks the soonest autoapproveat across multiple Pending groups', () => {
+      const sooner = new Date(Date.now() + 10 * 60 * 1000).toISOString()
+      const later = new Date(Date.now() + 40 * 60 * 1000).toISOString()
+      const wrapper = mountComponent(
+        {},
+        {
+          groups: [
+            { groupid: 789, collection: 'Pending', autoapproveat: later },
+            { groupid: 790, collection: 'Pending', autoapproveat: sooner },
+          ],
+        }
+      )
+      const badge = wrapper.find('[data-testid="autoapprove-countdown"]')
+      expect(badge.exists()).toBe(true)
+      // 10 min is <=30m, so prominent m/s formatting (the sooner one wins).
+      expect(badge.text()).toMatch(/Auto-approves in \d+m \d{2}s/)
+    })
+  })
 })
diff --git a/iznik-nuxt3/tests/unit/components/modtools/ModSysAdminModerationStats.spec.js b/iznik-nuxt3/tests/unit/components/modtools/ModSysAdminModerationStats.spec.js
index 0ce85e2ac5..ff9bc1bb92 100644
--- a/iznik-nuxt3/tests/unit/components/modtools/ModSysAdminModerationStats.spec.js
+++ b/iznik-nuxt3/tests/unit/components/modtools/ModSysAdminModerationStats.spec.js
@@ -7,8 +7,6 @@ const sampleStats = {
   arrived: 100,
   manualApproved: 20,
   manualRejected: 5,
-  autoChecked: 60,
-  autoFallback: 5,
   trusted: 10,
   autoApproved: 65,
   autoModChecked: 30,
@@ -59,6 +57,8 @@ describe('ModSysAdminModerationStats.vue', () => {
     expect(params.end).toMatch(/^\d{4}-\d{2}-\d{2}$/)
     expect(new Date(params.start) <= new Date(params.end)).toBe(true)
     expect(wrapper.vm.stats).toEqual(sampleStats)
+    // autoApproved is the single real auto-approved figure (no autoChecked/autoFallback).
+    expect(wrapper.vm.stats.autoApproved).toBe(65)
   })
 
   it('formats percentages and guards divide-by-zero', () => {

From 5df700f3d3f367e6e938380eea3aa990dce882b0 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Mon, 15 Jun 2026 19:17:28 +0100
Subject: [PATCH 12/26] docs(plan): align autoapprove-delay plan with shipped
 design (D13)

Replace the reverted autoapproved/recentjoin/outsidecga Approved-page dropdown
description with the shipped checked/trusted pages, countdown + hold, and help
boxes; fix status rows 6-7.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 plans/active/autoapprove-delay.md | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/plans/active/autoapprove-delay.md b/plans/active/autoapprove-delay.md
index 9792f96946..6fcc8e4ce2 100644
--- a/plans/active/autoapprove-delay.md
+++ b/plans/active/autoapprove-delay.md
@@ -11,8 +11,12 @@ after a configurable delay (default **20 minutes**), giving mods and microvolunt
 window to intervene, **unless** danger signals are present, with a configurable
 **quality-check sample** held back for manual review.
 
-Plus a modtools Approved-page filter dropdown (auto-approved / recently-joined / outside
-CGA) that defaults to summary view for the auto-approved variant.
+Plus ModTools oversight: dedicated **Checked** and **Trusted** views (`/messages/checked`,
+`/messages/trusted`; Go `filter=checked|trusted`), a live **auto-approve countdown** on
+Pending posts with a ≥10-minute on-load review guarantee (`messages_groups.autoapprove_hold_until`
++ a per-group `autoapproveat`), and help boxes explaining each queue. (An earlier experiment with
+an Approved-page `autoapproved/recentjoin/outsidecga` dropdown was reverted — it is NOT in the
+shipped design.)
 
 ## Production sizing (live, last 30 days)
 
@@ -81,13 +85,16 @@ Then approve (same side effects as `AutoApproveService::approveOnGroup`) + log A
 `abs(crc32((string)$msgid)) % 100 < percent` → **held** (skip; mod reviews, or 48h fallback
 catches it). Deterministic so a message never oscillates.
 
-## Frontend / Go API filter (secondary)
+## Frontend / Go API oversight (shipped design)
 
-- Go `ListMessagesMT` (`/api/modtools/messages`): new `filter` param — `autoapproved`
-  (`mg.approvedby IS NULL`), `recentjoin` (join memberships added ≥ NOW()-7d),
-  `outsidecga` (spatial: message point not within group polygon). Go tests for each.
-- Approved page `[[id]]/[[term]].vue`: `<b-form-select>` dropdown (default "All"); pass
-  `filter` to `fetchMessagesMT`; when `autoapproved` selected set the summary miscStore key.
+- Go `ListMessagesMT` (`/api/modtools/messages`): `filter=checked|trusted` over the Approved
+  collection (checked = auto-approved from NULL-status members; trusted = DEFAULT/UNMODERATED),
+  restricted to unchecked posts within `MESSAGE_CHECK_WINDOW_DAYS`. Also bumps
+  `autoapprove_hold_until` (extend-only, ≥NOW()+10m) for fetched Pending rows.
+- New pages `/messages/checked/[[id]].vue` and `/messages/trusted/[[id]].vue` (summary view,
+  "Mark all as checked"). Approved page unchanged apart from a help box.
+- `ModMessage.vue`: live countdown badge from per-group `autoapproveat` (Pending only).
+- `ModHelpPending/Checked/Trusted/Approved.vue`: dismissible help boxes (useHelpBox).
 - `ModSettingsGroup.vue`: two `<ModGroupSetting>` controls (delay minutes, quality %).
 
 ## Config / settings
@@ -126,8 +133,8 @@ catches it). Deterministic so a message never oscillates.
 | 3 | AutoApproveCleanCommand + test | ✅ | 4 command tests |
 | 4 | Schedule entry (console.php) | ✅ | everyMinute, withoutOverlapping |
 | 5 | config/freegle.php defaults | ✅ | autoapprove block (no Group.php change — absent=site default) |
-| 6 | Go ListMessagesMT filter + tests | ✅ | autoapproved/recentjoin/outsidecga + 3 Go tests; suite running |
-| 7 | Frontend approved-page dropdown + summary | ✅ | b-form-select; summary on autoapproved |
+| 6 | Go ListMessagesMT filter + tests | ✅ | filter=checked\|trusted (autoapproved/recentjoin/outsidecga experiment reverted) |
+| 7 | Checked/Trusted pages + countdown + help boxes | ✅ | /messages/checked,/trusted; autoapproveat countdown; ModHelp* boxes |
 | 8 | ModSettingsGroup.vue settings controls | ✅ | delay_minutes + quality_check_percent |
 | 9 | Run all suites via worktree status API | ✅ | full Laravel 3962/3962 ✓; Go 3004/3004 ✓; Vitest modtools 4475/4475 ✓ |
 | 10 | Push + PR (Freegle/Iznik) | ✅ | PR #639 — https://github.com/Freegle/Iznik/pull/639 (awaiting CI; never merge) |

From 4b1905146dffa02e2f4f4526fb8ab60bec6894c6 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Mon, 15 Jun 2026 19:35:03 +0100
Subject: [PATCH 13/26] test(go): moderationstats Trusted group-scope +
 all-nine-fields exact counts (D4,D7)

TestModerationStats_TrustedScopedByGroup proves a cross-posted trusted row still
counts despite an Autoapproved log on another group. TestModerationStats_AllFieldsExactCounts
asserts exact counts for all nine fields in an isolated historical window.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 iznik-server-go/test/moderationstats_test.go | 116 +++++++++++++++++++
 1 file changed, 116 insertions(+)

diff --git a/iznik-server-go/test/moderationstats_test.go b/iznik-server-go/test/moderationstats_test.go
index 292a349b24..d5999db0b8 100644
--- a/iznik-server-go/test/moderationstats_test.go
+++ b/iznik-server-go/test/moderationstats_test.go
@@ -77,3 +77,119 @@ func TestModerationStats_CountsAutoApprovedAndSample(t *testing.T) {
 	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?)", autoMsg, sampleMsg)
 	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", autoMsg, sampleMsg)
 }
+
+// D4: the Trusted count's NOT EXISTS is scoped by groupid, so a cross-posted message
+// that was auto-approved on one group still counts as trusted on the OTHER group.
+func TestModerationStats_TrustedScopedByGroup(t *testing.T) {
+	prefix := uniquePrefix("modstats_trustscope")
+	db := database.DBConn
+
+	// Isolated historical window so the global counts are exact.
+	const winStart = "2005-06-14 00:00:00"
+	const winEnd = "2005-06-14 12:00:00"
+	const day = "2005-06-14"
+
+	groupA := CreateTestGroup(t, prefix+"_a")
+	groupB := CreateTestGroup(t, prefix+"_b")
+	poster := CreateTestUser(t, prefix+"_poster", "User")
+	adminID := CreateTestUser(t, prefix+"_admin", "Admin")
+	CreateTestMembership(t, poster, groupA, "Member")
+	CreateTestMembership(t, poster, groupB, "Member")
+	db.Exec("UPDATE memberships SET ourPostingStatus='DEFAULT' WHERE userid=? AND groupid IN (?, ?)", poster, groupA, groupB)
+	_, adminToken := CreateTestSession(t, adminID)
+
+	// Cross-posted, trusted-live message: approved (approvedby NULL, content-checked)
+	// on group A; an Autoapproved log exists only for group B.
+	msgT := CreateTestMessage(t, poster, groupA, prefix+" trusted xpost", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL, approvedat=?, contentcheck_checked_at=? WHERE msgid=? AND groupid=?",
+		winStart, winStart, msgT, groupA)
+	db.Exec("INSERT INTO messages_groups (msgid, groupid, arrival, collection, autoreposts, approvedby, approvedat, contentcheck_checked_at, deleted) "+
+		"VALUES (?, ?, ?, 'Approved', 0, NULL, ?, ?, 0)", msgT, groupB, winStart, winStart, winStart)
+	db.Exec("INSERT INTO logs (timestamp, type, subtype, msgid, groupid, user) VALUES (?, 'Message', 'Autoapproved', ?, ?, ?)",
+		winStart, msgT, groupB, poster)
+
+	resp, err := getApp().Test(httptest.NewRequest("GET",
+		fmt.Sprintf("/api/modtools/moderationstats?start=%s&end=%s&jwt=%s", day, day, adminToken), nil))
+	assert.NoError(t, err)
+	assert.Equal(t, 200, resp.StatusCode)
+	var stats map[string]interface{}
+	json.NewDecoder(resp.Body).Decode(&stats)
+
+	// Group A's row must count as trusted; the Autoapproved log on group B must not
+	// exclude it (it would, without the groupid-scoped NOT EXISTS).
+	trusted, _ := stats["trusted"].(float64)
+	assert.Equal(t, float64(1), trusted, "cross-posted trusted row on group A should count despite a group-B Autoapproved log")
+	_ = winEnd
+
+	db.Exec("DELETE FROM logs WHERE msgid=?", msgT)
+	db.Exec("DELETE FROM messages_groups WHERE msgid=?", msgT)
+	db.Exec("DELETE FROM messages WHERE id=?", msgT)
+}
+
+// D7: exact-count coverage for all nine moderation-stats fields, isolated in a unique
+// historical window so the (mostly un-group-scoped) counts are deterministic.
+func TestModerationStats_AllFieldsExactCounts(t *testing.T) {
+	prefix := uniquePrefix("modstats_all")
+	db := database.DBConn
+
+	const day = "2005-06-13"
+	const tEarly = "2005-06-13 09:00:00"
+	const tAuto = "2005-06-13 10:00:00"
+	const tLater = "2005-06-13 11:00:00"
+
+	groupID := CreateTestGroup(t, prefix)
+	poster := CreateTestUser(t, prefix+"_poster", "User")
+	mod := CreateTestUser(t, prefix+"_mod", "User")
+	adminID := CreateTestUser(t, prefix+"_admin", "Admin")
+	CreateTestMembership(t, poster, groupID, "Member")
+	db.Exec("UPDATE memberships SET ourPostingStatus='DEFAULT' WHERE userid=? AND groupid=?", poster, groupID)
+	_, adminToken := CreateTestSession(t, adminID)
+
+	// arrived = 3 Received logs.
+	for i := 0; i < 3; i++ {
+		db.Exec("INSERT INTO logs (timestamp, type, subtype, user) VALUES (?, 'Message', 'Received', ?)", tEarly, poster)
+	}
+	// manualApproved = 1.
+	db.Exec("INSERT INTO logs (timestamp, type, subtype, byuser, user) VALUES (?, 'Message', 'Approved', ?, ?)", tEarly, mod, poster)
+	// A standalone manual Rejected (contributes 1 to manualRejected).
+	db.Exec("INSERT INTO logs (timestamp, type, subtype, byuser, user) VALUES (?, 'Message', 'Rejected', ?, ?)", tEarly, mod, poster)
+
+	// autoApproved = 1 (msgA): Autoapproved log + a checked messages_groups row.
+	msgA := CreateTestMessage(t, poster, groupID, prefix+" auto", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL, approvedat=?, contentcheck_checked_at=?, checkedat=?, checkedby=? WHERE msgid=?",
+		tAuto, tAuto, tAuto, mod, msgA)
+	db.Exec("INSERT INTO logs (timestamp, type, subtype, msgid, groupid, user) VALUES (?, 'Message', 'Autoapproved', ?, ?, ?)", tAuto, msgA, groupID, poster)
+	// autoLaterActioned = 1: a later Rejected on msgA by the mod (also +1 to manualRejected).
+	db.Exec("INSERT INTO logs (timestamp, type, subtype, msgid, groupid, byuser, user) VALUES (?, 'Message', 'Rejected', ?, ?, ?, ?)", tLater, msgA, groupID, mod, poster)
+
+	// trusted = 1 (msgT): approved-live, DEFAULT member, no Autoapproved log.
+	msgT := CreateTestMessage(t, poster, groupID, prefix+" trusted", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL, approvedat=?, contentcheck_checked_at=? WHERE msgid=?", tAuto, tAuto, msgT)
+
+	// qualitySampled = 1 (msgQ) + qualitySampleBad = 1 (a Rejected on it, also +1 manualRejected).
+	msgQ := CreateTestMessage(t, poster, groupID, prefix+" sample", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Pending', quality_sample=1, arrival=? WHERE msgid=?", tEarly, msgQ)
+	db.Exec("INSERT INTO logs (timestamp, type, subtype, msgid, groupid, byuser, user) VALUES (?, 'Message', 'Rejected', ?, ?, ?, ?)", tEarly, msgQ, groupID, mod, poster)
+
+	resp, err := getApp().Test(httptest.NewRequest("GET",
+		fmt.Sprintf("/api/modtools/moderationstats?start=%s&end=%s&jwt=%s", day, day, adminToken), nil))
+	assert.NoError(t, err)
+	assert.Equal(t, 200, resp.StatusCode)
+	var stats map[string]interface{}
+	json.NewDecoder(resp.Body).Decode(&stats)
+	f := func(k string) float64 { v, _ := stats[k].(float64); return v }
+
+	assert.Equal(t, float64(3), f("arrived"), "arrived")
+	assert.Equal(t, float64(1), f("manualApproved"), "manualApproved")
+	assert.Equal(t, float64(3), f("manualRejected"), "manualRejected (standalone + msgA-later + msgQ-bad)")
+	assert.Equal(t, float64(1), f("autoApproved"), "autoApproved")
+	assert.Equal(t, float64(1), f("trusted"), "trusted")
+	assert.Equal(t, float64(1), f("autoModChecked"), "autoModChecked")
+	assert.Equal(t, float64(1), f("autoLaterActioned"), "autoLaterActioned")
+	assert.Equal(t, float64(1), f("qualitySampled"), "qualitySampled")
+	assert.Equal(t, float64(1), f("qualitySampleBad"), "qualitySampleBad")
+
+	db.Exec("DELETE FROM logs WHERE timestamp BETWEEN ? AND ?", "2005-06-13 00:00:00", "2005-06-13 23:59:59")
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?, ?)", msgA, msgT, msgQ)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?, ?)", msgA, msgT, msgQ)
+}

From ccda0eaaf686786a1fe93a70bdd6647ea3667c7b Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Sat, 20 Jun 2026 00:36:57 +0100
Subject: [PATCH 14/26] fix(modtools): fix message-page specs + auto-approve
 badge rounding (unmasked by srvx)

The srvx lock failure had stopped vitest from ever running on this branch, so
several of its own specs were broken-but-unrun. With the lock fixed they now run:

- pending/approved spec: page renders <ModHelpPending>/<ModHelpApproved> (this
  branch's help panels) but the spec didn't stub them -> 'Failed to resolve
  component' Vue warning -> strict no-warning check fails. Add the stubs.
- checked/trusted spec: imported the wrong page path
  (.../[[id]]/[[term]].vue, which doesn't exist) instead of the actual
  .../[[id]].vue, so the files failed to load. Fix the import + add the
  ModHelpChecked/ModHelpTrusted stub.
- ModMessage auto-approve countdown badge: '~Nh' used Math.floor, so now+3h
  (minus the few ms elapsed = 2h59m) showed '~2h'. Round instead, since the
  label is explicitly approximate.

Verified locally: 66 message-page specs + 468 ModMessage specs all pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgWPgdxq4drrQ1jjrynVVZ
---
 iznik-nuxt3/modtools/components/ModMessage.vue               | 2 +-
 .../tests/unit/pages/modtools/messages/approved.spec.js      | 3 +++
 .../tests/unit/pages/modtools/messages/checked.spec.js       | 5 +++--
 .../tests/unit/pages/modtools/messages/pending.spec.js       | 3 +++
 .../tests/unit/pages/modtools/messages/trusted.spec.js       | 5 +++--
 5 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/iznik-nuxt3/modtools/components/ModMessage.vue b/iznik-nuxt3/modtools/components/ModMessage.vue
index b983ed0fac..8be73ba246 100644
--- a/iznik-nuxt3/modtools/components/ModMessage.vue
+++ b/iznik-nuxt3/modtools/components/ModMessage.vue
@@ -1219,7 +1219,7 @@ const countdownLabel = computed(() => {
   const totalMins = Math.floor(secsLeft / 60)
   const secs = secsLeft % 60
   if (totalMins >= 60) {
-    const hrs = Math.floor(totalMins / 60)
+    const hrs = Math.round(totalMins / 60)
     return { text: `Auto-approves in ~${hrs}h`, cls: 'text-muted' }
   }
   return {
diff --git a/iznik-nuxt3/tests/unit/pages/modtools/messages/approved.spec.js b/iznik-nuxt3/tests/unit/pages/modtools/messages/approved.spec.js
index 66bc96f6a2..9506bdbe70 100644
--- a/iznik-nuxt3/tests/unit/pages/modtools/messages/approved.spec.js
+++ b/iznik-nuxt3/tests/unit/pages/modtools/messages/approved.spec.js
@@ -119,6 +119,9 @@ describe('messages/approved/[[id]]/[[term]].vue page', () => {
           'client-only': {
             template: '<div><slot /></div>',
           },
+          ModHelpApproved: {
+            template: '<div class="mod-help-approved" />',
+          },
           ScrollToTop: {
             template: '<div class="scroll-to-top" />',
             props: ['prepend'],
diff --git a/iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js b/iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js
index 8aa082eab3..728cfe61b0 100644
--- a/iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js
+++ b/iznik-nuxt3/tests/unit/pages/modtools/messages/checked.spec.js
@@ -2,7 +2,7 @@ import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { mount } from '@vue/test-utils'
 import { createPinia, setActivePinia } from 'pinia'
 import { ref, computed } from 'vue'
-import CheckedPage from '~/modtools/pages/messages/checked/[[id]]/[[term]].vue'
+import CheckedPage from '~/modtools/pages/messages/checked/[[id]].vue'
 
 const mockBusy = ref(false)
 const mockContext = ref(null)
@@ -83,13 +83,14 @@ globalThis.__testUseRouter = () => ({
   currentRoute: { value: { path: '/' } },
 })
 
-describe('messages/checked/[[id]]/[[term]].vue page', () => {
+describe('messages/checked/[[id]].vue page', () => {
   function mountComponent() {
     return mount(CheckedPage, {
       global: {
         plugins: [createPinia()],
         stubs: {
           'client-only': { template: '<div><slot /></div>' },
+          ModHelpChecked: { template: '<div class="mod-help-checked" />' },
           ScrollToTop: { template: '<div class="scroll-to-top" />' },
           ModGroupSelect: {
             template: '<div class="mod-group-select" />',
diff --git a/iznik-nuxt3/tests/unit/pages/modtools/messages/pending.spec.js b/iznik-nuxt3/tests/unit/pages/modtools/messages/pending.spec.js
index ab770ce11f..81b5941990 100644
--- a/iznik-nuxt3/tests/unit/pages/modtools/messages/pending.spec.js
+++ b/iznik-nuxt3/tests/unit/pages/modtools/messages/pending.spec.js
@@ -143,6 +143,9 @@ describe('PendingPage', () => {
           'client-only': {
             template: '<div><slot /></div>',
           },
+          ModHelpPending: {
+            template: '<div class="mod-help-pending" />',
+          },
           ScrollToTop: {
             template: '<div class="scroll-to-top" />',
           },
diff --git a/iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js b/iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js
index 6e7c5d60f5..143114cd32 100644
--- a/iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js
+++ b/iznik-nuxt3/tests/unit/pages/modtools/messages/trusted.spec.js
@@ -2,7 +2,7 @@ import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { mount } from '@vue/test-utils'
 import { createPinia, setActivePinia } from 'pinia'
 import { ref } from 'vue'
-import TrustedPage from '~/modtools/pages/messages/trusted/[[id]]/[[term]].vue'
+import TrustedPage from '~/modtools/pages/messages/trusted/[[id]].vue'
 
 const mockBusy = ref(false)
 const mockContext = ref(null)
@@ -83,13 +83,14 @@ globalThis.__testUseRouter = () => ({
   currentRoute: { value: { path: '/' } },
 })
 
-describe('messages/trusted/[[id]]/[[term]].vue page', () => {
+describe('messages/trusted/[[id]].vue page', () => {
   function mountComponent() {
     return mount(TrustedPage, {
       global: {
         plugins: [createPinia()],
         stubs: {
           'client-only': { template: '<div><slot /></div>' },
+          ModHelpTrusted: { template: '<div class="mod-help-trusted" />' },
           ScrollToTop: { template: '<div class="scroll-to-top" />' },
           ModGroupSelect: {
             template: '<div class="mod-group-select" />',

From 7c762ad5f082343ffb687243a3ed825c42e0463c Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Thu, 25 Jun 2026 18:21:47 +0100
Subject: [PATCH 15/26] fix(moderation): keep rippled-in rows out of the clean
 auto-approve path + oversight queues

Now that rippling-out is live, a rippled-in messages_groups row (rippled_in=1) is
Approved-by-default with approvedby/checkedat NULL and an auto-joined NULL
ourPostingStatus membership, which collides with this branch's new post-moderation
surfaces:

- AutoApproveCleanService candidate query had no rippled_in filter. Once
  ContentCheckService stamps a rippled-in Pending row (non-default
  rippled_in_pending_hours > 0), the clean path would approve it at +20min,
  bypassing the configured rippled-in mod-veto window. Rippled-in rows belong
  solely to AutoApproveService's rippled_in branch (which carries the
  Taken/Received guard, config-driven rippled_in_pending_hours and the recentLogs
  bypass). Guard the clean candidate query with ->where('mg.rippled_in', 0).

- The Checked oversight queue, the session work-count badge and mark-all-checked
  (message_list.go, session.go, markchecked.go) matched rippled-in Approved rows
  on the receiving group, polluting the queue and inflating the AutoModChecked
  analytic. Add AND mg.rippled_in = 0.

- The autoapprove_hold_until extend-only UPDATE could keep deferring a rippled-in
  Pending row's approval past its window; exclude rippled_in rows (defensive).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MwC1Gw6UczMnthan5gPJD4
---
 iznik-batch/app/Services/AutoApproveCleanService.php | 1 +
 iznik-server-go/message/markchecked.go               | 2 +-
 iznik-server-go/message/message_list.go              | 4 ++--
 iznik-server-go/session/session.go                   | 2 +-
 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/iznik-batch/app/Services/AutoApproveCleanService.php b/iznik-batch/app/Services/AutoApproveCleanService.php
index 1e340f3326..2dc63a5ef6 100644
--- a/iznik-batch/app/Services/AutoApproveCleanService.php
+++ b/iznik-batch/app/Services/AutoApproveCleanService.php
@@ -94,6 +94,7 @@ public function process(bool $dryRun = false): array
             ->whereNotNull('mg.contentcheck_checked_at')   // content check has run ...
             ->whereNull('mg.contentcheck_reasons')         // ... and the post was clean
             ->where('mg.quality_sample', 0)               // already-sampled rows are excluded entirely
+            ->where('mg.rippled_in', 0)                   // rippled-in rows belong to AutoApproveService (carries the Taken/Received + rippled_in_pending_hours + recentLogs-bypass guards)
             ->whereRaw(
                 "mg.arrival <= (NOW() - INTERVAL COALESCE(NULLIF(CAST(JSON_UNQUOTE(JSON_EXTRACT(g.settings, '$.autoapprove.delay_minutes')) AS UNSIGNED), 0), ?) MINUTE)",
                 [$this->defaultDelayMinutes()]
diff --git a/iznik-server-go/message/markchecked.go b/iznik-server-go/message/markchecked.go
index c6fd73f480..361815ea5b 100644
--- a/iznik-server-go/message/markchecked.go
+++ b/iznik-server-go/message/markchecked.go
@@ -80,7 +80,7 @@ func MarkChecked(c *fiber.Ctx) error {
 			"INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "+
 			"SET mg.checkedat = NOW(), mg.checkedby = ? "+
 			"WHERE mg.groupid IN ? AND mg.collection = ? AND mg.deleted = 0 "+
-			"AND mg.approvedby IS NULL AND "+statusWhere+" "+
+			"AND mg.approvedby IS NULL AND mg.rippled_in = 0 AND "+statusWhere+" "+
 			fmt.Sprintf("AND mg.checkedat IS NULL AND mg.arrival >= NOW() - INTERVAL %d DAY", utils.MESSAGE_CHECK_WINDOW_DAYS),
 			myid, groupIDs, utils.COLLECTION_APPROVED)
 		rowsAffected = r.RowsAffected
diff --git a/iznik-server-go/message/message_list.go b/iznik-server-go/message/message_list.go
index 6a9fec4e7d..8cd4d788a0 100644
--- a/iznik-server-go/message/message_list.go
+++ b/iznik-server-go/message/message_list.go
@@ -573,7 +573,7 @@ func ListMessagesMT(c *fiber.Ctx) error {
 		case "checked":
 			// Auto-approved (approvedby NULL) from auto-moderated (NULL) members.
 			filterJoin = "INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "
-			filterWhere = "AND mg.approvedby IS NULL AND mem.ourPostingStatus IS NULL " + checkedWindow
+			filterWhere = "AND mg.approvedby IS NULL AND mg.rippled_in = 0 AND mem.ourPostingStatus IS NULL " + checkedWindow
 		case "trusted":
 			// Went live without moderation from trusted (group-settings) members.
 			filterJoin = "INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "
@@ -619,7 +619,7 @@ func ListMessagesMT(c *fiber.Ctx) error {
 			"UPDATE messages_groups "+
 				"SET autoapprove_hold_until = GREATEST(COALESCE(autoapprove_hold_until, NOW()), NOW() + INTERVAL 10 MINUTE) "+
 				"WHERE msgid IN ? AND groupid IN ? "+
-				"AND collection = 'Pending' AND heldby IS NULL AND deleted = 0",
+				"AND collection = 'Pending' AND heldby IS NULL AND deleted = 0 AND rippled_in = 0",
 			msgIDs, groupIDs,
 		)
 	}
diff --git a/iznik-server-go/session/session.go b/iznik-server-go/session/session.go
index 7a476cff62..ac5b662b26 100644
--- a/iznik-server-go/session/session.go
+++ b/iznik-server-go/session/session.go
@@ -1101,7 +1101,7 @@ func GetSession(c *fiber.Ctx) error {
 				"INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "+
 				"WHERE mg.groupid IN ? AND mg.collection = ? AND mg.deleted = 0 "+
 				"AND m.deleted IS NULL AND u.deleted IS NULL "+
-				"AND mg.approvedby IS NULL AND mem.ourPostingStatus IS NULL "+
+				"AND mg.approvedby IS NULL AND mg.rippled_in = 0 AND mem.ourPostingStatus IS NULL "+
 				checkedWindowSQL,
 				modGroupIDs, utils.COLLECTION_APPROVED).Scan(&checked)
 		}()

From 68e1dae91cdf318cf9844aae6b4e7b8a181b489e Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Thu, 25 Jun 2026 19:38:31 +0100
Subject: [PATCH 16/26] docs(moderation): mod guide + earned-reach review-gate
 design for auto-approve x rippling

- AUTO-APPROVE-FOR-MODERATORS.md: mod-facing guide for post-moderation, modelled on
  RIPPLING-OUT-FOR-MODERATORS.md (queues, countdown, reject, and how reach is earned by
  review under rippling).
- docs/superpowers/specs/2026-06-25-autoapprove-earned-reach-review-gate-design.md: design
  for the earned-reach review gate - 1h hold, per-N quorum (weight 2N; microvol 1, mod 2),
  capped reach (B1), reviewer pools (both in max ripple area, closeness-ordered), reject
  action, and await-review delay tracking on the SysAdmin rippling page.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MwC1Gw6UczMnthan5gPJD4
---
 AUTO-APPROVE-FOR-MODERATORS.md                | 139 +++++++++++++++
 ...approve-earned-reach-review-gate-design.md | 163 ++++++++++++++++++
 2 files changed, 302 insertions(+)
 create mode 100644 AUTO-APPROVE-FOR-MODERATORS.md
 create mode 100644 docs/superpowers/specs/2026-06-25-autoapprove-earned-reach-review-gate-design.md

diff --git a/AUTO-APPROVE-FOR-MODERATORS.md b/AUTO-APPROVE-FOR-MODERATORS.md
new file mode 100644
index 0000000000..42e008ae18
--- /dev/null
+++ b/AUTO-APPROVE-FOR-MODERATORS.md
@@ -0,0 +1,139 @@
+# Auto-Approve - A Guide for Moderators
+
+> **Current reference document.** Explains post-moderation (auto-approve) for
+> moderators. Read alongside [`RIPPLING-OUT-FOR-MODERATORS.md`](RIPPLING-OUT-FOR-MODERATORS.md) -
+> the two features work together, and the section "How this works with rippling out"
+> below is where they meet.
+
+---
+
+## The one big change
+
+> ### Settled members' posts now go live first, and you review them after - not before
+>
+> Until now, almost every member post sat in **Pending** until a moderator approved it.
+> With auto-approve, a content-checked, clean post from a **settled, auto-moderated
+> member** goes live by itself after a short delay (about 20 minutes by default), and you
+> review it **after** it is live, in a dedicated oversight queue.
+>
+> This is deliberate. It gets good posts moving quickly and focuses your attention on the
+> small number that actually need a human, instead of rubber-stamping the majority that
+> are obviously fine.
+
+Nothing about a **suspect** post changes: if the content check flags it, or there is any
+danger signal (a recent mod note, a held/unheld history, a known-spammer record, a pending
+membership review, microvolunteer rejections), it **stays in Pending** exactly as before
+and waits for you.
+
+---
+
+## What still comes to you first (Pending)
+
+The Pending queue is still the full queue, and you can still stop anything here before it
+goes live. Two things are new:
+
+- **A live countdown.** Each post that is on the clean auto-approve path shows a small
+  countdown to when it will auto-approve - a muted "~Nh" when it is more than an hour away,
+  a prominent "Mm Ss" inside the last 30 minutes, and "Auto-approving..." at zero. Posts
+  that are **not** auto-approving (suspect, spam, held) show no countdown.
+- **A guaranteed review window.** The moment you open the Pending queue, every post on it
+  is given **at least 10 more minutes** before it can auto-approve. Nothing ever
+  auto-approves out from under you while you are looking at the page.
+
+---
+
+## The new queues
+
+Alongside **Pending** and **Approved** you now have two oversight queues:
+
+- **Checked** - posts that went live via the automatic checks (your auto-moderated
+  members). This is your **oversight queue**: a chance to glance over what published
+  without you.
+- **Trusted** - posts that went live without moderation because they came from a
+  **trusted** member (set in your group settings). Same idea, different reason they
+  skipped review.
+
+The counts on **Checked** and **Trusted** show **how many are still unchecked** (shown in
+blue, not the red of Pending), and they drop as you check things off. A **"Mark all as
+checked"** button clears the bucket in one go. Posts older than **7 days** fall off the
+queue on their own, so it always reflects recent activity rather than growing forever.
+
+---
+
+## Rejecting a post after it has gone live
+
+The oversight queues are not just for looking - they are **actionable**. If you find a
+post in **Checked** or **Trusted** that should not be live, you can **reject it straight
+from that queue**. It is pulled back out of the live feed and returned to Pending/held so
+it can be dealt with properly, exactly as if it had never auto-approved.
+
+This is the safety net for the rare post that slips through the automatic checks: it went
+live quickly, but you can still take it down quickly.
+
+---
+
+## How this works with rippling out
+
+This is where auto-approve and rippling out meet, so it is worth understanding.
+
+A live post can **ripple out** to neighbouring communities (see the rippling guide). A
+post that auto-approved has not yet been looked at by a human, so we do **not** let it
+spread network-wide unchecked. Instead, **reach is earned by review**:
+
+- **A head start before any spread.** A freshly auto-approved post waits about **an hour**
+  before it starts rippling at all, giving its home community's reviewers first look.
+- **Wider reach needs proportional review.** To ripple into more communities, a post has
+  to earn review in step with how far it is going. **Each new community it reaches needs
+  its own light sign-off: 2 microvolunteer approvals, or 1 moderator check, from within
+  that community's reach.** So reaching **2 new communities needs 4 microvolunteer
+  approvals or 2 moderator checks** (or a mix - a moderator check counts as two
+  microvolunteer approvals).
+- **No review means it stays local.** If a post does not earn that sign-off, it simply
+  **stops spreading** and stays close to home. It is not withdrawn - it just does not go
+  wider. Well-reviewed posts spread fast and far; unreviewed ones stay local.
+- **Stopping it is easy and does not scale.** The opposite of approval is cheap: **2
+  microvolunteer rejections, or 1 moderator rejection**, on *any* copy halts the spread and
+  pulls that copy back. Easy to stop, proportionally hard to spread.
+
+The short version: **a post's reach can only run as far ahead as its review.**
+
+---
+
+## Who does the reviewing
+
+The review that earns reach comes from two pools, and **both are drawn from inside the
+post's maximum ripple area, nearest first**:
+
+- **Microvolunteers** inside the area the post can reach are asked to look, with the people
+  **closest to the post** asked first - they are the ones most likely to have useful local
+  context.
+- **Moderators** of communities inside that same area provide the moderator sign-off. A
+  moderator of a community the post will never reach does not gate it - which is only fair,
+  since it was never going to land on them.
+
+In short: we only ask the people the post can actually reach, closest first.
+
+---
+
+## What to expect, and the habits to build
+
+1. **Don't be alarmed that posts are live before you saw them.** That is the design. Your
+   job shifts from approving everything up front to keeping half an eye on the **Checked**
+   and **Trusted** queues and acting on the rare one that is wrong.
+2. **Use the reject action** for a genuinely unsuitable post you find live - it pulls it
+   straight back.
+3. **"Out of area" is still never a reason to reject** (see the rippling guide). A post
+   reaching you from a neighbouring community is the system working, not a fault.
+
+Everything else about your day-to-day moderation routine stays the same.
+
+---
+
+## Reference: how we know a post was checked
+
+When you check an auto-published post (individually or via "Mark all as checked"), we
+record **who** checked it and **when**. This is what makes the unchecked counts drop, and
+it feeds the **Moderation** tab under SysAdmin, which shows where posts went (arrived,
+approved or rejected by hand, auto-approved, trusted) and the **auto-publish error rate** -
+how often an auto-published post later needed a moderator to step in. That number is how we
+know auto-approve is safe, and how we tune it.
diff --git a/docs/superpowers/specs/2026-06-25-autoapprove-earned-reach-review-gate-design.md b/docs/superpowers/specs/2026-06-25-autoapprove-earned-reach-review-gate-design.md
new file mode 100644
index 0000000000..7997866020
--- /dev/null
+++ b/docs/superpowers/specs/2026-06-25-autoapprove-earned-reach-review-gate-design.md
@@ -0,0 +1,163 @@
+# Auto-Approve x Rippling: Earned-Reach Review Gate - Design
+
+> Status: design, for review. Extends PR #639 (post-moderation) to be safe under
+> live rippling-out. Mod-facing summary: `AUTO-APPROVE-FOR-MODERATORS.md`.
+> Background + interaction review: memory `finding_pr639_stale_vs_rippling.md`,
+> workflow `w9jtr672a`.
+
+## Problem
+
+Pre-#639, every NULL-status member's post was human-approved before it could enter
+`messages_spatial` and therefore before it could ripple. #639 auto-publishes clean posts
+(~20 min, `collection=Approved`, `approvedby=NULL`), so an **unreviewed** post becomes
+ripple-eligible ~26 min after arrival and can spread network-wide before any human looks.
+The C4/C9/D1 guards (already merged + CI-green) stop rippled-in rows polluting the
+oversight queues, but they do not address the core issue: **reach currently runs ahead of
+review**.
+
+## Principle: reach is earned by review
+
+Auto-published posts spread only as far as their review supports. Well-reviewed posts go
+fast and far; unreviewed ones stay local. Review comes from two pools (microvolunteers and
+moderators) feeding one window.
+
+### The numbers (agreed)
+
+- **Review weight**: microvolunteer approve = **1**; moderator check = **2**.
+- **Required weight to be rippled into N communities = 2 x N.** (2 new communities => 4
+  microvol approvals, or 2 mod checks, or any mix to weight 4.)
+- **Reject is easy and does NOT scale**: 2 microvol rejects, or 1 mod reject, on any copy
+  halts expansion and withdraws that copy.
+- **~1h hold** before the first ripple (origin reviewers get first look).
+- **Capped reach (b1)**: if weight does not keep up, the post simply stops expanding. It is
+  not delayed-then-released; it stays at its current reach. Already-reached copies remain
+  until a reject withdraws them.
+
+### Threshold: global, scaled by N (not strictly per-group-local)
+
+"Per rippled-out group" sets the **threshold** (2 x N); the **sources** are pooled across
+the post's max ripple area (not tied to one receiving group). So the gate is:
+
+> cumulative review weight for the post >= 2 x (number of communities it has rippled into),
+> where any in-area microvolunteer approve counts 1 and any in-area moderator check counts 2.
+
+Both pools share the same in-area catchment and closeness ordering (see Reviewer pools), so
+"scaled per group" governs how much review is needed while the area bound governs who may
+supply it. A strictly per-group "2 of *this* group's own microvols" model is not used.
+
+## Reviewer pools
+
+**Both pools are drawn from within the post's maximum ripple area, ordered by closeness to
+the post.** Same catchment, same ordering - we ask the people the post can actually reach,
+nearest first.
+
+- **Microvolunteers** - eligible if they are inside the post's max ripple area; the
+  CheckMessage challenge selection (`getApprovedMessageChallenge`, Go) is ordered by
+  distance from the member to the post (nearest first). Existing eligibility (not own post,
+  trust gates, one-vote-per-(user,msgid)) is unchanged; we add the max-ripple-area bound +
+  closeness ordering and drop the implicit own-group-only restriction.
+- **Moderators** - a mod check counts toward weight only if it comes from a community
+  inside the post's max ripple area. In practice a mod check is recorded
+  (`messages_groups.checkedat`) against the origin row or a rippled-in row, and those
+  communities are within reach by construction.
+
+The closeness ordering is selection/surfacing only; any in-area approve/check still counts
+the same weight (microvol = 1, mod = 2) wherever in the area it comes from.
+
+## Components
+
+1. **Ratification weight (read model).** A function, given `msgid`, returns current weight:
+   `(# microactions WHERE msgid=? AND result='Approve')` + `2 * (# in-area
+   messages_groups rows for the msgid WHERE checkedat IS NOT NULL)`. Lives in the batch
+   ripple path (PHP), mirrored in Go only if the countdown/UI needs to show it.
+
+2. **ExpandService expansion gate (PHP).** Two changes in
+   `iznik-batch/app/Services/Ripple/ExpandService.php`:
+   - **Hold**: do not `initialiseNew()` a post until `arrival <= NOW() - INTERVAL 1 HOUR`
+     OR it has a mod check (`checkedat`). (Auto-published posts only; mod-approved/manually
+     approved posts are unaffected because they carry `approvedby`/`checkedat`.)
+   - **Earned-reach cap**: before rippling into the next community(ies) (the
+     `rippleIntoNewGroups` / reach-advance step), require `weight(msgid) >= 2 *
+     (currentRippledGroups + newGroupsThisStep)`. If not met, **pause** this post's
+     expansion this run (leave reach + existing rippled-in rows untouched); it resumes a
+     later run once weight catches up.
+
+3. **Reject action (Go + ModTools).** `iznik-server-go/message/markchecked.go`: add a
+   `Reject` path to the oversight endpoint (`collection='Pending'`, set `heldby`,
+   `checkedat=NULL`) scoped to the mod's group; ModTools Checked/Trusted pages get a Reject
+   control alongside "Mark as checked". A mod reject on the origin copy halts ripple (the
+   post leaves `messages_spatial`, so ExpandService stops); on a rippled-in copy it trims
+   that community (mirrors the existing rippled-in secondary-reject behaviour).
+
+4. **Microvolunteer reject quorum (existing).** 2 microvol rejects already call
+   `sendForReview()` (Approved->Pending on that group). For the origin copy this removes it
+   from `messages_spatial` and so halts ripple - reuse as-is; just confirm ExpandService
+   halts cleanly when the origin row is no longer Approved.
+
+5. **Review-gate observability (the delay we are imposing must be visible).** Capping reach
+   on under-review silently slows rippling, so we instrument and surface it:
+   - **Instrument**: when the gate pauses a post (weight < 2N), stamp the start of the
+     await-review hold; clear it when the post resumes (weight caught up) or terminates
+     (rippled to its full extent / withdrawn / capped-out). Store on `rippling_reach`
+     (e.g. `awaiting_review_since` nullable + `awaiting_review_seconds` accumulator), so a
+     post that pauses/resumes repeatedly accrues total delay.
+   - **Surface on the SysAdmin rippling page** (`ModSysAdminRippling.vue` <-
+     `iznik-server-go/.../rippling/metrics.go`, the existing dashboard with the reply/reach
+     KPIs). New tiles/series over the page's date range:
+     - **Posts currently awaiting review** (count) and **median time awaiting review**.
+     - **Reach delayed by review** - total await-review post-hours over the range (how much
+       rippling the review gate is holding back).
+     - **Capped-out posts** - posts that ended below their reachable extent purely because
+       review never arrived (the reach we are forgoing for safety), vs those that resumed.
+   This is the dial that tells us whether the review pools can keep up, or whether the
+   `2 x N` weighting / 1h hold needs tuning.
+
+## Data / flow
+
+- Weight is derived from `microactions` + `messages_groups.checkedat` (no new tally table
+  for v1; add a cached `messages.ratify_weight` only if the per-minute loop proves hot).
+- The await-review instrumentation **does** need persisted state on `rippling_reach`
+  (`awaiting_review_since`, `awaiting_review_seconds`) so the dashboard can report delay
+  without reconstructing it from logs. Additive migration.
+- `ripple:expand` already runs every minute and is the natural place to re-evaluate the
+  gate and update the await-review accumulator, so paused posts resume automatically as
+  weight accrues and the delay metric stays current.
+
+## Testing
+
+- **PHP (ExpandService)**: hold (no ripple < 1h, ripples >= 1h or with a check); cap (N=1
+  needs weight 2, N=2 needs weight 4; weight from microvol approves vs mod checks vs mix;
+  paused post resumes when weight catches up; reject/halt). 
+- **Go**: markchecked Reject path (collection/heldby/scope/403s); challenge selection
+  closeness ordering + network-wide pool; mod-check-in-area weighting boundary;
+  `metrics.go` await-review fields (currently-awaiting count, median wait, delayed
+  post-hours, capped-out vs resumed) over a date range with exact counts.
+- **PHP**: await-review accumulator (pause stamps `awaiting_review_since`, resume adds to
+  `awaiting_review_seconds`, repeated pause/resume accrues correctly).
+- **Vitest**: Reject control on Checked/Trusted pages; the new await-review tiles/series on
+  `ModSysAdminRippling.vue`.
+
+## Out of scope (sibling spec)
+
+Chat "rippled-out review": extend `widerchatreview` (already UNIONs flagged chats across
+opted-in groups, `chatmessage.go:955-1021`, currently single-mod/no-quorum) with the same
+weighting + quorum + active widening. Separate spec + PR after this lands.
+
+## Decisions (defaults taken; veto any on review)
+
+1. **Capped reach (B1)** - confirmed. No quorum => the post stops expanding and stays local;
+   not delayed-then-released. The forgone reach is measured (component 5) so we can see the
+   safety/reach trade-off.
+2. **Global threshold scaled by N** - `weight >= 2N`. Both pools (microvols + mods) are
+   drawn from within the post's max ripple area and surfaced **ordered by closeness**; any
+   in-area approve/check counts its weight (microvol 1, mod 2) regardless of where in the
+   area it came from. The strictly per-group-local model is not used.
+3. **In-area catchment** - "max ripple area" is the post's full reachable polygon. A mod
+   check is counted via `messages_groups.checkedat` on the post's own rows (origin /
+   rippled-in), which are in-area by construction; microvol challenge selection is bounded
+   to the same polygon and distance-ordered.
+4. **Hold exemption** - a manually/mod-approved post (`approvedby` set) skips the 1h hold
+   and ripples immediately; the hold and the earned-reach cap apply only to auto-published
+   posts (`approvedby IS NULL`).
+
+Anything to change here is cheap to revise before build; otherwise these stand.

From df5e899a9517442dde8f4706a9d1d897c79d0ed4 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Thu, 25 Jun 2026 19:51:00 +0100
Subject: [PATCH 17/26] feat(moderation): reject action on the Checked/Trusted
 oversight queue

markchecked gains a `reject` mode: instead of marking auto-published posts checked, it
pulls the specified posts back to Pending and holds them by the acting mod
(collection=Pending, heldby=mod, checkedat cleared). This makes the oversight queue
actionable - a mod who finds a bad auto-published post can take it straight back out of
the live feed for a proper decision. Setting Pending removes it from messages_spatial so
rippling stops drawing it, and heldby blocks the auto-approve cron from re-publishing it.
Targeted (explicit ids) only - no bulk reject. Scoped to the mod's groups, Approved rows.

Test: TestMarkCheckedReject (pulls to Pending+held, clears checkedat, requires ids => 400).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MwC1Gw6UczMnthan5gPJD4
---
 iznik-server-go/message/markchecked.go        | 16 +++++++
 .../test/autoapprove_countdown_test.go        | 42 +++++++++++++++++++
 2 files changed, 58 insertions(+)

diff --git a/iznik-server-go/message/markchecked.go b/iznik-server-go/message/markchecked.go
index 361815ea5b..e142aa08fe 100644
--- a/iznik-server-go/message/markchecked.go
+++ b/iznik-server-go/message/markchecked.go
@@ -15,6 +15,7 @@ type MarkCheckedRequest struct {
 	Groupid uint64   `json:"groupid"`          // 0 = all of the mod's groups
 	Filter  string   `json:"filter"`           // "checked" or "trusted" (used when no ids given)
 	IDs     []uint64 `json:"ids,omitempty"`    // specific messages, else mark the whole bucket
+	Reject  bool     `json:"reject,omitempty"` // true = pull the specified posts back to Pending (held) instead of marking checked
 }
 
 // MarkChecked records that a moderator has reviewed auto-published posts. These
@@ -56,6 +57,21 @@ func MarkChecked(c *fiber.Ctx) error {
 		groupIDs = []uint64{req.Groupid}
 	}
 
+	// Reject: pull the specified auto-published posts back out of the live feed for a
+	// proper moderation decision. Setting collection=Pending removes them from
+	// messages_spatial (so rippling stops drawing them), and heldby blocks the
+	// auto-approve cron from immediately re-publishing them. Targeted only — there is
+	// no bulk "reject the whole bucket" (that would be far too blunt).
+	if req.Reject {
+		if len(req.IDs) == 0 {
+			return fiber.NewError(fiber.StatusBadRequest, "reject requires specific ids")
+		}
+		r := db.Exec("UPDATE messages_groups SET collection = ?, heldby = ?, checkedat = NULL "+
+			"WHERE msgid IN ? AND groupid IN ? AND collection = ? AND deleted = 0",
+			utils.COLLECTION_PENDING, myid, req.IDs, groupIDs, utils.COLLECTION_APPROVED)
+		return c.JSON(fiber.Map{"success": true, "rejected": r.RowsAffected})
+	}
+
 	var rowsAffected int64
 	if len(req.IDs) > 0 {
 		// Mark the specified posts checked — only ones still unchecked, and only
diff --git a/iznik-server-go/test/autoapprove_countdown_test.go b/iznik-server-go/test/autoapprove_countdown_test.go
index 4e7e234838..a6d49796d3 100644
--- a/iznik-server-go/test/autoapprove_countdown_test.go
+++ b/iznik-server-go/test/autoapprove_countdown_test.go
@@ -179,3 +179,45 @@ func TestMarkCheckedCrossGroupAndNonMod(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, 403, resp0.StatusCode, "non-mod with groupid=0 must get 403")
 }
+
+// Reject pulls the specified Approved auto-published posts back to Pending, held by the
+// mod, clearing checkedat; it requires explicit ids (no bulk reject).
+func TestMarkCheckedReject(t *testing.T) {
+	prefix := uniquePrefix("markchk_reject")
+	db := database.DBConn
+
+	groupA := CreateTestGroup(t, prefix+"_a")
+	poster := CreateTestUser(t, prefix+"_poster", "User")
+	modID := CreateTestUser(t, prefix+"_mod", "User")
+	CreateTestMembership(t, poster, groupA, "Member")
+	CreateTestMembership(t, modID, groupA, "Moderator")
+	_, modToken := CreateTestSession(t, modID)
+
+	approved := CreateTestMessage(t, poster, groupA, prefix+" approved", 52.0, -1.0)
+	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL, checkedat=NOW(), checkedby=? WHERE msgid=?", modID, approved)
+
+	// Reject requires explicit ids.
+	noIDs := fmt.Sprintf(`{"groupid": %d, "reject": true}`, groupA)
+	reqNo := httptest.NewRequest("POST", fmt.Sprintf("/api/modtools/messages/markchecked?jwt=%s", modToken), strings.NewReader(noIDs))
+	reqNo.Header.Set("Content-Type", "application/json")
+	respNo, err := getApp().Test(reqNo)
+	assert.NoError(t, err)
+	assert.Equal(t, 400, respNo.StatusCode, "reject without ids must be 400")
+
+	// Reject the approved post.
+	body := fmt.Sprintf(`{"groupid": %d, "reject": true, "ids": [%d]}`, groupA, approved)
+	req := httptest.NewRequest("POST", fmt.Sprintf("/api/modtools/messages/markchecked?jwt=%s", modToken), strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := getApp().Test(req)
+	assert.NoError(t, err)
+	assert.Equal(t, 200, resp.StatusCode)
+
+	var pendingHeld, stillChecked int64
+	db.Raw("SELECT COUNT(*) FROM messages_groups WHERE msgid=? AND groupid=? AND collection='Pending' AND heldby=? AND checkedat IS NULL", approved, groupA, modID).Scan(&pendingHeld)
+	db.Raw("SELECT COUNT(*) FROM messages_groups WHERE msgid=? AND groupid=? AND checkedat IS NOT NULL", approved, groupA).Scan(&stillChecked)
+	assert.Equal(t, int64(1), pendingHeld, "rejected post is Pending, held by the mod, checkedat cleared")
+	assert.Equal(t, int64(0), stillChecked, "checkedat must be cleared on reject")
+
+	db.Exec("DELETE FROM messages_groups WHERE msgid=?", approved)
+	db.Exec("DELETE FROM messages WHERE id=?", approved)
+}

From 63e149f7574e50b0921d9b0e20100b52ccf19aa7 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Thu, 25 Jun 2026 20:32:41 +0100
Subject: [PATCH 18/26] feat(ripple): earned-reach gate - 1h hold + per-N
 review cap + await-review instrumentation

Dark behind RIPPLE_EARNED_REACH_ENABLED (default off): when off ExpandService behaves exactly as
before. When on, an auto-published post (approvedby NULL) must be 1h old before it starts rippling
(RIPPLE_AUTOAPPROVE_HOLD_SECONDS; a mod approve/check skips it), and may ripple into N communities
only while its review weight >= 2*N (weight = 1 per microvol Approve + 2 per mod check). Below that it
pauses (no new rippled-in rows, reach_capped++, awaiting_review_since stamped); when weight catches up
it resumes and banks the waited time into awaiting_review_seconds. Mod-approved posts are exempt.

- config: earned_reach_enabled + autoapprove_hold_seconds.
- ExpandService: 1h hold in initialiseNew; reviewWeight(); earned-reach cap + await-review
  instrumentation in rippleIntoNewGroups.
- migration: rippling_reach.awaiting_review_since + awaiting_review_seconds (additive, idempotent SQL).
- 13 ExpandService tests (hold on/off/skip/bypass; cap N=1/N=2 by microvol vs mod-check weight;
  mod-approved exempt; pause->resume banks await seconds; await stamp not reset on re-pause; gate dark
  by default). Full ExpandService suite green (60/60).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MwC1Gw6UczMnthan5gPJD4
---
 .../app/Services/Ripple/ExpandService.php     |  87 ++++++-
 iznik-batch/config/freegle.php                |   8 +
 ...001_add_await_review_to_rippling_reach.php |  44 ++++
 ...ait_review_to_rippling_reach_migration.sql |  16 ++
 .../Services/Ripple/ExpandServiceTest.php     | 222 ++++++++++++++++++
 5 files changed, 375 insertions(+), 2 deletions(-)
 create mode 100644 iznik-batch/database/migrations/2026_06_25_000001_add_await_review_to_rippling_reach.php
 create mode 100644 iznik-batch/database/migrations/2026_06_25_000001_add_await_review_to_rippling_reach_migration.sql

diff --git a/iznik-batch/app/Services/Ripple/ExpandService.php b/iznik-batch/app/Services/Ripple/ExpandService.php
index be54cbb5c8..104ed7dfed 100644
--- a/iznik-batch/app/Services/Ripple/ExpandService.php
+++ b/iznik-batch/app/Services/Ripple/ExpandService.php
@@ -92,7 +92,7 @@ public function process(bool $dryRun = false, int $limit = 500, ?int $onlyMsgid
             'initialized' => 0, 'expanded' => 0, 'completed' => 0,
             'removed' => 0, 'skipped' => 0, 'errors' => 0, 'rippled_in' => 0, 'mailed' => 0,
             'memberships_added' => 0, 'pulled_on_leave' => 0,
-            'pulled_on_removal' => 0, 'memberships_removed' => 0,
+            'pulled_on_removal' => 0, 'memberships_removed' => 0, 'reach_capped' => 0,
         ];
 
         // A scoped run ($onlyMsgid or $withinPolyWkt) targets a chosen subset of posts (controlled/area
@@ -698,6 +698,24 @@ private function initialiseNew(bool $dryRun, int $limit, array &$stats, ?int $on
                 $params[] = $satStop;
             }
         }
+
+        // 1h HOLD (earned-reach gate; dark unless RIPPLE_EARNED_REACH_ENABLED). An auto-published
+        // post - approvedby IS NULL AND checkedat IS NULL on its origin row - must be at least
+        // RIPPLE_AUTOAPPROVE_HOLD_SECONDS old before it starts rippling, so a mod or the microvol
+        // pool can catch a bad one before it fans out. A post a mod approved (approvedby NOT NULL)
+        // or checked (checkedat NOT NULL) skips the hold; an explicit --msgid run bypasses it,
+        // exactly like the arrival cutoff. The hold param is pushed before $limit so it binds in order.
+        $holdSql = '';
+        if (config('freegle.ripple.earned_reach_enabled', false) && $onlyMsgid === null) {
+            $holdSeconds = (int) config('freegle.ripple.autoapprove_hold_seconds', 3600);
+            if ($holdSeconds > 0) {
+                $holdSql = ' AND (EXISTS (SELECT 1 FROM messages_groups mg_h'
+                    . ' WHERE mg_h.msgid = ms.msgid AND (mg_h.approvedby IS NOT NULL OR mg_h.checkedat IS NOT NULL))'
+                    . ' OR ms.arrival <= DATE_SUB(NOW(), INTERVAL ? SECOND))';
+                $params[] = $holdSeconds;
+            }
+        }
+
         $params[] = $limit;
 
         // Candidate source: live posts with NO reach row yet (anti-join).
@@ -708,7 +726,7 @@ private function initialiseNew(bool $dryRun, int $limit, array &$stats, ?int $on
                     MIN(ms.arrival) AS arrival
              FROM messages_spatial ms
              LEFT JOIN rippling_reach mr ON mr.msgid = ms.msgid
-             WHERE mr.msgid IS NULL' . $scopeSql . $cutoffSql . $satSql . '
+             WHERE mr.msgid IS NULL' . $scopeSql . $cutoffSql . $satSql . $holdSql . '
              GROUP BY ms.msgid
              LIMIT ?',
             $params
@@ -1117,6 +1135,25 @@ private function reachableGateEnabled(): bool
      * (the default - no Pending flicker, since the post was already vetted on origin), else
      * Pending so AutoApproveService approves it after the mod-veto window.
      */
+    /**
+     * Review weight for the earned-reach cap: 1 per microvol Approve on the post, plus 2 per
+     * messages_groups row with checkedat set (a mod check, on any of the post's groups). The cap
+     * lets a post ripple into N communities while weight >= 2*N.
+     */
+    private function reviewWeight(int $msgid): int
+    {
+        $microvolApproves = (int) DB::selectOne(
+            "SELECT COUNT(*) AS n FROM microactions WHERE msgid = ? AND result = 'Approve'",
+            [$msgid]
+        )->n;
+        $modChecks = (int) DB::selectOne(
+            'SELECT COUNT(*) AS n FROM messages_groups WHERE msgid = ? AND checkedat IS NOT NULL',
+            [$msgid]
+        )->n;
+
+        return $microvolApproves + 2 * $modChecks;
+    }
+
     private function rippleIntoNewGroups(int $msgid, string $reachWkt, array &$stats, ?array $reachableGroupIds = null): void
     {
         try {
@@ -1230,6 +1267,52 @@ private function rippleIntoNewGroups(int $msgid, string $reachWkt, array &$stats
                 [$reachWkt, $msgid, $msg->fromuser, $msg->fromuser, $msg->fromuser]
             );
 
+            // EARNED-REACH CAP (dark unless RIPPLE_EARNED_REACH_ENABLED). An auto-published post
+            // (approvedby IS NULL on its origin row) may be rippled into at most N communities
+            // while its review weight >= 2*N (weight = 1 per microvol Approve + 2 per mod check).
+            // If the weight does not cover the communities this step would reach, pause: insert
+            // nothing, stamp awaiting_review_since, count it, return. When the weight later catches
+            // up the wait is banked into awaiting_review_seconds and the stamp is cleared. A
+            // mod-approved post (approvedby NOT NULL) is trusted and never capped.
+            if (config('freegle.ripple.earned_reach_enabled', false)) {
+                $originRow = DB::selectOne(
+                    'SELECT approvedby FROM messages_groups WHERE msgid = ? ORDER BY arrival ASC LIMIT 1',
+                    [$msgid]
+                );
+                if ($originRow !== null && $originRow->approvedby === null) {
+                    $candidateCount = count($targetGroups);
+
+                    if ($candidateCount > 0) {
+                        $alreadyRippledIn = (int) DB::table('messages_groups')
+                            ->where('msgid', $msgid)->where('rippled_in', 1)->where('deleted', 0)->count();
+                        $requiredWeight = 2 * ($alreadyRippledIn + $candidateCount);
+
+                        if ($this->reviewWeight($msgid) < $requiredWeight) {
+                            DB::statement(
+                                'UPDATE rippling_reach
+                                 SET awaiting_review_since = IF(awaiting_review_since IS NULL, NOW(), awaiting_review_since),
+                                     updated_at = NOW()
+                                 WHERE msgid = ?',
+                                [$msgid]
+                            );
+                            $stats['reach_capped']++;
+
+                            return;
+                        }
+
+                        // Sufficient weight: if we were paused, bank the waited time and clear the stamp.
+                        DB::statement(
+                            'UPDATE rippling_reach
+                             SET awaiting_review_seconds = awaiting_review_seconds
+                                     + TIMESTAMPDIFF(SECOND, awaiting_review_since, NOW()),
+                                 awaiting_review_since = NULL, updated_at = NOW()
+                             WHERE msgid = ? AND awaiting_review_since IS NOT NULL',
+                            [$msgid]
+                        );
+                    }
+                }
+            }
+
             $n = 0;
             foreach ($targetGroups as $g) {
                 $inserted = DB::affectingStatement(
diff --git a/iznik-batch/config/freegle.php b/iznik-batch/config/freegle.php
index bd6728c1d9..9fa3903184 100644
--- a/iznik-batch/config/freegle.php
+++ b/iznik-batch/config/freegle.php
@@ -357,6 +357,14 @@
         // rippling) and per tick (a post that becomes saturated stops fanning out). 0 disables.
         // 5 = the figure from the Discourse rippling thread.
         'reply_saturation_stop' => (int) env('RIPPLE_REPLY_SATURATION_STOP', 5),
+        // EARNED-REACH GATE (auto-approve x rippling). Ships DARK: when false, ExpandService
+        // behaves exactly as before - no 1h hold, no review-weight cap, no await-review
+        // instrumentation. Go-live is a deliberate env flip, exactly like RIPPLE_ENABLED.
+        'earned_reach_enabled' => (bool) env('RIPPLE_EARNED_REACH_ENABLED', false),
+        // When the gate is on: minimum age (seconds) an auto-published, unreviewed post must
+        // reach before it may start rippling. A post with approvedby or checkedat set (a mod
+        // approved or checked it) skips the hold. Default 3600 (1h); 0 disables just the hold.
+        'autoapprove_hold_seconds' => (int) env('RIPPLE_AUTOAPPROVE_HOLD_SECONDS', 3600),
         // Hours a rippled-in (messages_groups.rippled_in=1) post, already Approved on its
         // origin group, waits before it is approved onto the rippled-in group (it was already
         // vetted on origin). Default 0 = approve AT ripple-in time, so it never even flickers
diff --git a/iznik-batch/database/migrations/2026_06_25_000001_add_await_review_to_rippling_reach.php b/iznik-batch/database/migrations/2026_06_25_000001_add_await_review_to_rippling_reach.php
new file mode 100644
index 0000000000..7090e02589
--- /dev/null
+++ b/iznik-batch/database/migrations/2026_06_25_000001_add_await_review_to_rippling_reach.php
@@ -0,0 +1,44 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * rippling_reach: awaiting_review_since + awaiting_review_seconds - earned-reach gate
+ * instrumentation (auto-approve x rippling).
+ *
+ * awaiting_review_since: set to NOW() the first time a post's earned-reach expansion is
+ * paused (review weight < required); cleared to NULL when expansion resumes or terminates.
+ * awaiting_review_seconds: accumulates the total wall-clock seconds a post spent paused across
+ * all pause-then-resume cycles. Both are surfaced on the sysadmin rippling page.
+ *
+ * Additive only; existing rows read as "not currently paused, zero elapsed". INSTANT adds in
+ * MySQL 8.
+ */
+return new class extends Migration {
+    public function up(): void
+    {
+        if (!Schema::hasTable('rippling_reach')) {
+            return;
+        }
+        if (!Schema::hasColumn('rippling_reach', 'awaiting_review_since')) {
+            DB::statement(
+                'ALTER TABLE rippling_reach'
+                . ' ADD COLUMN awaiting_review_since TIMESTAMP NULL DEFAULT NULL,'
+                . ' ADD COLUMN awaiting_review_seconds INT UNSIGNED NOT NULL DEFAULT 0'
+            );
+        }
+    }
+
+    public function down(): void
+    {
+        if (Schema::hasTable('rippling_reach') && Schema::hasColumn('rippling_reach', 'awaiting_review_since')) {
+            DB::statement(
+                'ALTER TABLE rippling_reach'
+                . ' DROP COLUMN awaiting_review_since,'
+                . ' DROP COLUMN awaiting_review_seconds'
+            );
+        }
+    }
+};
diff --git a/iznik-batch/database/migrations/2026_06_25_000001_add_await_review_to_rippling_reach_migration.sql b/iznik-batch/database/migrations/2026_06_25_000001_add_await_review_to_rippling_reach_migration.sql
new file mode 100644
index 0000000000..7add942658
--- /dev/null
+++ b/iznik-batch/database/migrations/2026_06_25_000001_add_await_review_to_rippling_reach_migration.sql
@@ -0,0 +1,16 @@
+-- Production idempotent SQL: rippling_reach.awaiting_review_since + awaiting_review_seconds
+-- (earned-reach gate instrumentation, auto-approve x rippling).
+--
+-- awaiting_review_since: TIMESTAMP NULL - set when a post's earned-reach expansion is paused
+--   (review weight < required), cleared on resume or termination.
+-- awaiting_review_seconds: INT UNSIGNED NOT NULL DEFAULT 0 - accumulates total seconds spent
+--   paused across all pause-resume cycles. Both surfaced on the sysadmin rippling page.
+--
+-- Both are INSTANT adds in MySQL 8 (no rebuild), so safe to run online. Idempotent.
+SET @col_exists := (SELECT COUNT(*) FROM information_schema.columns
+    WHERE table_schema = DATABASE() AND table_name = 'rippling_reach'
+      AND column_name = 'awaiting_review_since');
+SET @ddl := IF(@col_exists = 0,
+    'ALTER TABLE rippling_reach ADD COLUMN awaiting_review_since TIMESTAMP NULL DEFAULT NULL, ADD COLUMN awaiting_review_seconds INT UNSIGNED NOT NULL DEFAULT 0',
+    'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
diff --git a/iznik-batch/tests/Unit/Services/Ripple/ExpandServiceTest.php b/iznik-batch/tests/Unit/Services/Ripple/ExpandServiceTest.php
index af62c102f6..edc9fe009e 100644
--- a/iznik-batch/tests/Unit/Services/Ripple/ExpandServiceTest.php
+++ b/iznik-batch/tests/Unit/Services/Ripple/ExpandServiceTest.php
@@ -3078,4 +3078,226 @@ public function test_advance_bounds_respect_secondary_reject_clip(): void
         )->c;
         $this->assertSame(0, $innerAccepts, 'inner bound must not cover the clipped-out rejected area');
     }
+
+    // ───────────────────────── Earned-reach gate (dark unless RIPPLE_EARNED_REACH_ENABLED) ─────
+
+    private function addMicrovolApprove(int $msgid): void
+    {
+        DB::table('microactions')->insert([
+            'actiontype' => 'CheckMessage', 'userid' => $this->createTestUser()->id,
+            'msgid' => $msgid, 'result' => 'Approve', 'timestamp' => now(),
+        ]);
+    }
+
+    public function test_autoapprove_hold_prevents_young_unreviewed_post_from_rippling(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 3600]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(30)); // younger than the 1h hold
+
+        $stats = $this->service()->process(false, 500);
+
+        $this->assertSame(0, $stats['initialized'], 'auto-published post within the hold window must not start rippling');
+        $this->assertSame(0, DB::table('rippling_reach')->where('msgid', $msgid)->count(), 'no reach row while held');
+    }
+
+    public function test_autoapprove_hold_allows_old_enough_unreviewed_post(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 3600]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(90)); // past the 1h hold
+
+        $stats = $this->service()->process(false, 500);
+
+        $this->assertSame(1, $stats['initialized'], 'post past the hold ripples normally');
+        $this->assertSame(1, DB::table('rippling_reach')->where('msgid', $msgid)->count());
+    }
+
+    public function test_autoapprove_hold_skipped_when_approvedby_is_set(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 3600]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(5));
+        $modId = (int) DB::table('messages')->where('id', $msgid)->value('fromuser');
+        DB::table('messages_groups')->where('msgid', $msgid)->update(['approvedby' => $modId]);
+
+        $stats = $this->service()->process(false, 500);
+
+        $this->assertSame(1, $stats['initialized'], 'a mod-approved post bypasses the hold');
+    }
+
+    public function test_autoapprove_hold_skipped_when_checkedat_is_set(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 3600]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(5));
+        DB::table('messages_groups')->where('msgid', $msgid)->update(['checkedat' => now()]);
+
+        $stats = $this->service()->process(false, 500);
+
+        $this->assertSame(1, $stats['initialized'], 'a mod-checked post bypasses the hold');
+    }
+
+    public function test_autoapprove_hold_bypassed_for_only_msgid_run(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 3600]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(5)); // under the hold
+
+        $stats = $this->service()->process(false, 500, $msgid);
+
+        $this->assertSame(1, $stats['initialized'], '--msgid bypasses the hold, like the arrival cutoff');
+    }
+
+    public function test_review_weight_counts_microvol_approves_and_mod_checks(): void
+    {
+        $svc = $this->service();
+        $msgid = $this->seedSpatialPost(now()->subMinutes(90));
+        $ref = new \ReflectionMethod($svc, 'reviewWeight');
+        $ref->setAccessible(true);
+
+        $this->assertSame(0, $ref->invoke($svc, $msgid), 'baseline weight 0');
+        $this->addMicrovolApprove($msgid);
+        $this->assertSame(1, $ref->invoke($svc, $msgid), '1 microvol approve = weight 1');
+        DB::table('messages_groups')->where('msgid', $msgid)->update(['checkedat' => now()]);
+        $this->assertSame(3, $ref->invoke($svc, $msgid), '+1 mod check = weight 3 (1 + 2)');
+    }
+
+    public function test_earned_reach_cap_blocks_with_weight_below_2_for_one_group(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(90));
+        $groupB = $this->seedCoveringGroup();
+        $this->addMicrovolApprove($msgid); // weight 1 < required 2 for N=1
+
+        $stats = $this->service()->process(false, 500);
+
+        $this->assertSame(1, $stats['initialized'], 'reach is still initialised');
+        $this->assertSame(0, $stats['rippled_in'], 'not rippled in while weight < required');
+        $this->assertSame(1, $stats['reach_capped']);
+        $this->assertNull(DB::table('messages_groups')->where('msgid', $msgid)->where('groupid', $groupB)->first());
+        $this->assertNotNull(
+            DB::table('rippling_reach')->where('msgid', $msgid)->value('awaiting_review_since'),
+            'awaiting_review_since stamped on pause'
+        );
+    }
+
+    public function test_earned_reach_cap_passes_with_two_microvol_approves(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(90));
+        $groupB = $this->seedCoveringGroup();
+        $this->addMicrovolApprove($msgid);
+        $this->addMicrovolApprove($msgid); // weight 2 >= required 2
+
+        $stats = $this->service()->process(false, 500);
+
+        $this->assertSame(1, $stats['rippled_in'], 'weight 2 meets N=1; ripples in');
+        $this->assertSame(0, $stats['reach_capped']);
+    }
+
+    public function test_earned_reach_cap_passes_with_one_mod_check(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(90));
+        $groupB = $this->seedCoveringGroup();
+        DB::table('messages_groups')->where('msgid', $msgid)->update(['checkedat' => now()]); // weight 2
+
+        $stats = $this->service()->process(false, 500);
+
+        $this->assertSame(1, $stats['rippled_in'], 'one mod check (weight 2) meets N=1');
+        $this->assertSame(0, $stats['reach_capped']);
+    }
+
+    public function test_earned_reach_cap_does_not_apply_to_mod_approved_post(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(90));
+        $this->seedCoveringGroup();
+        $modId = (int) DB::table('messages')->where('id', $msgid)->value('fromuser');
+        DB::table('messages_groups')->where('msgid', $msgid)->update(['approvedby' => $modId]); // mod-approved, zero weight
+
+        $stats = $this->service()->process(false, 500);
+
+        $this->assertSame(0, $stats['reach_capped'], 'mod-approved post is exempt from the cap');
+        $this->assertGreaterThanOrEqual(1, $stats['rippled_in'], 'mod-approved post ripples without review weight');
+    }
+
+    public function test_earned_reach_cap_pause_then_resume_accumulates_await_seconds(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(90));
+        $groupB = $this->seedCoveringGroup();
+
+        // Run 1: weight 1 < 2, capped.
+        $this->addMicrovolApprove($msgid);
+        $stats1 = $this->service()->process(false, 500);
+        $this->assertSame(1, $stats1['reach_capped']);
+        $this->assertNotNull(DB::table('rippling_reach')->where('msgid', $msgid)->value('awaiting_review_since'));
+
+        // Simulate time passing while paused, and make a LATER tick genuinely due. advanceDue only
+        // re-enters the cap when target > current tick, so age the reach back to the final hazard
+        // step and reset the tick to force a real advance.
+        DB::table('rippling_reach')->where('msgid', $msgid)->update([
+            'awaiting_review_since' => now()->subSeconds(60),
+            'arrival' => now()->subHours(7),
+            'tick' => 0,
+            'next_expansion_at' => now()->subMinute(),
+        ]);
+
+        // Run 2: second approve -> weight 2 >= 2, resumes and ripples.
+        $this->addMicrovolApprove($msgid);
+        $stats2 = $this->service()->process(false, 500);
+
+        $this->assertSame(0, $stats2['reach_capped'], 'cap lifted on resume');
+        $this->assertGreaterThanOrEqual(1, $stats2['rippled_in'], 'ripples on resume');
+        $row = DB::table('rippling_reach')->where('msgid', $msgid)->first();
+        $this->assertNull($row->awaiting_review_since, 'await stamp cleared on resume');
+        $this->assertGreaterThanOrEqual(60, (int) $row->awaiting_review_seconds, 'waited time banked');
+    }
+
+    public function test_earned_reach_cap_does_not_reset_await_since_on_repeated_pause(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(90));
+        $this->seedCoveringGroup();
+
+        $this->addMicrovolApprove($msgid);
+        $this->service()->process(false, 500); // capped, stamp set
+
+        $original = now()->subMinutes(10);
+        DB::table('rippling_reach')->where('msgid', $msgid)
+            ->update(['awaiting_review_since' => $original, 'arrival' => now()->subHours(7), 'tick' => 0, 'next_expansion_at' => now()->subMinute()]);
+
+        $this->service()->process(false, 500); // still weight 1 < 2, still capped
+
+        $row = DB::table('rippling_reach')->where('msgid', $msgid)->first();
+        $this->assertEqualsWithDelta(
+            $original->timestamp,
+            \Carbon\Carbon::parse($row->awaiting_review_since)->timestamp,
+            2,
+            'awaiting_review_since must not be reset on a second consecutive pause'
+        );
+    }
+
+    public function test_earned_reach_gate_is_dark_by_default(): void
+    {
+        // Flag off (default): a young auto-published post with zero review weight ripples
+        // exactly as before - no hold, no cap.
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(30));
+        $this->seedCoveringGroup();
+
+        $stats = $this->service()->process(false, 500);
+
+        $this->assertSame(1, $stats['initialized'], 'gate off: young post still ripples (no hold)');
+        $this->assertSame(0, $stats['reach_capped'], 'gate off: cap never fires');
+        $this->assertGreaterThanOrEqual(1, $stats['rippled_in'], 'gate off: unreviewed post ripples freely');
+    }
 }

From 76e45ead1dc59748e477ef84f39004c0f71e81f0 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Fri, 26 Jun 2026 09:14:01 +0100
Subject: [PATCH 19/26] feat(rippling): earned-reach reviewer pool, await
 metrics, oversight reject

Build out the remaining earned-reach review-gate slices (all dark behind
RIPPLE_EARNED_REACH_ENABLED, default off):

- Slice B (microvolunteering.go): bound the CheckMessage approved-message
  reviewer pool to each post's rippled-out reach. When the gate is on and the
  reviewer has a location (settings.mylocation, falling back to lastlocation),
  candidates are restricted to posts whose rippling_reach max_drive_min covers
  the reviewer (ST_Distance_Sphere <= max_drive_min * 1400 m) and ordered
  nearest-first. Posts with no reach row or no computed max_drive_min are
  included regardless (fail-open). Gate off => byte-identical to the prior query.

- Slice C (rippling/metrics.go + ModSysAdminRippling.vue): surface review-gate
  await metrics on the sysadmin rippling page - posts awaiting review now,
  average current wait, previously-held-now-resumed, and post-hours delayed over
  the selected period. Two fail-soft passes over rippling_reach
  (awaiting_review_since / awaiting_review_seconds); all zero if unmigrated.

- Slice D (ModMessageButtons.vue + stores/message.js + checked/trusted pages):
  per-message "Reject (back to Pending)" button on the checked/trusted oversight
  queues, shown only for Approved posts (oversight && approved). Pulls an
  auto-published post back to Pending via markChecked({reject:true}).

Tests: 2 Go reviewer-pool tests (reach-bounded, nearest-first), 3 Go metrics
tests (fields present, awaiting, post-hours), 4 Vue oversight-button tests,
4 Vue review-gate-tile tests. Full Go suite green (3293); both specs green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../modtools/components/ModMessage.vue        |   8 ++
 .../modtools/components/ModMessageButtons.vue |  25 ++++
 .../modtools/components/ModMessages.vue       |   4 +
 .../ModSysAdminRipplingAnalytics.vue          |  54 +++++++-
 .../pages/messages/checked/[[id]].vue         |   2 +-
 .../pages/messages/trusted/[[id]].vue         |   2 +-
 iznik-nuxt3/stores/message.js                 |  11 ++
 .../modtools/ModMessageButtons.spec.js        |  44 ++++++
 .../ModSysAdminRipplingAnalytics.spec.js      |  56 ++++++++
 .../microvolunteering/microvolunteering.go    |  75 +++++++++-
 iznik-server-go/rippling/metrics.go           |  51 +++++++
 .../test/microvolunteering_reach_test.go      | 128 ++++++++++++++++++
 iznik-server-go/test/rippling_metrics_test.go |  88 ++++++++++++
 13 files changed, 539 insertions(+), 9 deletions(-)
 create mode 100644 iznik-server-go/test/microvolunteering_reach_test.go

diff --git a/iznik-nuxt3/modtools/components/ModMessage.vue b/iznik-nuxt3/modtools/components/ModMessage.vue
index 8be73ba246..0cf460cd68 100644
--- a/iznik-nuxt3/modtools/components/ModMessage.vue
+++ b/iznik-nuxt3/modtools/components/ModMessage.vue
@@ -770,6 +770,7 @@
           :editreview="editreview"
           :cantpost="membership && membership.ourpostingstatus === 'PROHIBITED'"
           :is-home-group="isHomeGroup"
+          :oversight="oversight"
         />
         <b-button
           v-if="editing"
@@ -893,6 +894,13 @@ const props = defineProps({
     required: false,
     default: null,
   },
+  // Passed down from the checked/trusted oversight pages to unlock the per-message Reject button
+  // in ModMessageButtons. Not set on any other page.
+  oversight: {
+    type: Boolean,
+    required: false,
+    default: false,
+  },
 })
 
 const emit = defineEmits(['destroy'])
diff --git a/iznik-nuxt3/modtools/components/ModMessageButtons.vue b/iznik-nuxt3/modtools/components/ModMessageButtons.vue
index 92a9b0313d..4a78251a52 100644
--- a/iznik-nuxt3/modtools/components/ModMessageButtons.vue
+++ b/iznik-nuxt3/modtools/components/ModMessageButtons.vue
@@ -91,6 +91,16 @@
         leave
         label="Blank Reply"
       />
+      <SpinButton
+        v-if="oversight && approved"
+        variant="warning"
+        class="m-1"
+        icon-name="times"
+        label="Reject (back to Pending)"
+        confirm
+        :flex="false"
+        @handle="rejectFromOversight"
+      />
       <ModMessageButton
         v-if="isHomeGroup"
         :messageid="message.id"
@@ -221,6 +231,14 @@ const props = defineProps({
     required: false,
     default: true,
   },
+  // Set to true ONLY from the checked/trusted oversight pages: shows a "Reject (back to Pending)"
+  // button for Approved posts so a mod can pull an auto-published post back into Pending via the
+  // markChecked endpoint. Not shown in the regular Approved view.
+  oversight: {
+    type: Boolean,
+    required: false,
+    default: false,
+  },
 })
 
 const messageStore = useMessageStore()
@@ -329,4 +347,11 @@ function outcome(callback, type) {
   })
   if (callback) callback()
 }
+
+// Oversight Reject button (checked/trusted pages only): send the post back to Pending via
+// markChecked({reject:true}) and drop it from the local store so it leaves the oversight list.
+async function rejectFromOversight(callback) {
+  await messageStore.rejectFromOversight(props.messageid, props.groupid)
+  if (callback) callback()
+}
 </script>
diff --git a/iznik-nuxt3/modtools/components/ModMessages.vue b/iznik-nuxt3/modtools/components/ModMessages.vue
index 87099995c8..a462e9b49a 100644
--- a/iznik-nuxt3/modtools/components/ModMessages.vue
+++ b/iznik-nuxt3/modtools/components/ModMessages.vue
@@ -17,6 +17,7 @@
         :next-after-removed="nextAfterRemoved"
         :summary="summary"
         :search="messageTerm"
+        :oversight="oversight"
         @destroy="destroy"
       />
       <div :ref="'bottom' + message.id" />
@@ -46,6 +47,9 @@ const {
 // eslint-disable-next-line no-unused-vars
 const props = defineProps({
   editreview: { type: Boolean, required: false, default: false },
+  // Set by the checked/trusted oversight pages to expose the per-message Reject (back to Pending)
+  // button. Forwarded to each ModMessage instance.
+  oversight: { type: Boolean, required: false, default: false },
 })
 
 onMounted(async () => {
diff --git a/iznik-nuxt3/modtools/components/ModSysAdminRipplingAnalytics.vue b/iznik-nuxt3/modtools/components/ModSysAdminRipplingAnalytics.vue
index 1e3531ea5c..d137b005da 100644
--- a/iznik-nuxt3/modtools/components/ModSysAdminRipplingAnalytics.vue
+++ b/iznik-nuxt3/modtools/components/ModSysAdminRipplingAnalytics.vue
@@ -417,6 +417,41 @@
           </b-tr>
         </b-tbody>
       </b-table-simple>
+
+      <!-- Earned-reach review gate (dark unless RIPPLE_EARNED_REACH_ENABLED) -->
+      <h5 class="section-h">Review gate — auto-published post holds</h5>
+      <p class="text-muted small mb-2">
+        When the earned-reach gate is on, an auto-published post ripples into
+        more communities only as review accrues (weight must reach
+        2&times; the number of communities it has reached); below that it
+        pauses. These show how many posts are gated now and how much total
+        delay the gate has added over the selected period.
+      </p>
+      <b-table-simple v-if="reviewDelay" hover responsive small>
+        <b-tbody>
+          <b-tr>
+            <b-td class="text-muted small fw-semibold">
+              Posts awaiting review now
+            </b-td>
+            <b-td>{{ reviewDelay.awaiting_count }}</b-td>
+          </b-tr>
+          <b-tr>
+            <b-td class="text-muted small">Average current wait</b-td>
+            <b-td>{{ formatAwaitSeconds(reviewDelay.median_await_seconds) }}</b-td>
+          </b-tr>
+          <b-tr>
+            <b-td class="text-muted small">Previously held, now resumed</b-td>
+            <b-td>{{ reviewDelay.resumed_count }}</b-td>
+          </b-tr>
+          <b-tr>
+            <b-td class="text-muted small">
+              Post-hours delayed (selected period)
+            </b-td>
+            <b-td>{{ (reviewDelay.post_hours_delayed || 0).toFixed(1) }}</b-td>
+          </b-tr>
+        </b-tbody>
+      </b-table-simple>
+      <p v-else class="text-muted small">No review gate data yet.</p>
     </div>
     <p v-else class="text-muted small">No data yet.</p>
   </div>
@@ -470,6 +505,8 @@ const replySource = ref([])
 const hotspots = ref([])
 const attributionCaptureFrom = ref('')
 const heldBySource = ref([])
+// Earned-reach review gate: how many auto-published posts are held now + total delay over the period.
+const reviewDelay = ref(null)
 
 const stratumLabel = computed(() =>
   stratum.value === 'all' ? 'all-density' : stratum.value
@@ -699,6 +736,14 @@ const bullseyeAria = computed(() => {
   )} in the ${outer.min_lo}-${outer.min_hi} minute ring.`
 })
 
+// Format a seconds value as a human-readable duration for the review-gate wait display.
+function formatAwaitSeconds(secs) {
+  if (!secs || secs <= 0) return '—'
+  if (secs < 60) return '< 1 min'
+  if (secs < 3600) return `${Math.round(secs / 60)} min`
+  return `${(secs / 3600).toFixed(1)} h`
+}
+
 async function fetchAnalytics() {
   loading.value = true
   error.value = null
@@ -719,6 +764,7 @@ async function fetchAnalytics() {
     hotspots.value = metrics?.hotspots || []
     attributionCaptureFrom.value = metrics?.attribution_capture_from || ''
     heldBySource.value = metrics?.held_reply_by_source || []
+    reviewDelay.value = metrics?.review_delay || null
   } catch (e) {
     error.value = e.message || 'Unknown error'
   } finally {
@@ -796,7 +842,13 @@ function onFilterFetch({ start, end }) {
   fetchAnalytics()
 }
 
-defineExpose({ fetchAnalytics, stratum, setStratum, onFilterFetch })
+defineExpose({
+  fetchAnalytics,
+  stratum,
+  setStratum,
+  onFilterFetch,
+  reviewDelay,
+})
 </script>
 
 <style scoped lang="scss">
diff --git a/iznik-nuxt3/modtools/pages/messages/checked/[[id]].vue b/iznik-nuxt3/modtools/pages/messages/checked/[[id]].vue
index 1f9bc1a62b..7c52931618 100644
--- a/iznik-nuxt3/modtools/pages/messages/checked/[[id]].vue
+++ b/iznik-nuxt3/modtools/pages/messages/checked/[[id]].vue
@@ -33,7 +33,7 @@
         anything older than a week is excluded from this queue.
       </NoticeMessage>
       <div v-if="groupsreceived">
-        <ModMessages />
+        <ModMessages :oversight="true" />
         <infinite-loading
           direction="top"
           :identifier="bump"
diff --git a/iznik-nuxt3/modtools/pages/messages/trusted/[[id]].vue b/iznik-nuxt3/modtools/pages/messages/trusted/[[id]].vue
index d200c0c438..5868d5833f 100644
--- a/iznik-nuxt3/modtools/pages/messages/trusted/[[id]].vue
+++ b/iznik-nuxt3/modtools/pages/messages/trusted/[[id]].vue
@@ -33,7 +33,7 @@
         here, and anything older than a week is excluded from this queue.
       </NoticeMessage>
       <div v-if="groupsreceived">
-        <ModMessages />
+        <ModMessages :oversight="true" />
         <infinite-loading
           direction="top"
           :identifier="bump"
diff --git a/iznik-nuxt3/stores/message.js b/iznik-nuxt3/stores/message.js
index 4ffd95c168..0c4b56740e 100644
--- a/iznik-nuxt3/stores/message.js
+++ b/iznik-nuxt3/stores/message.js
@@ -770,6 +770,17 @@ export const useMessageStore = defineStore({
         this.remove({ id })
       }
     },
+    // Reject an auto-published post from the oversight (checked/trusted) queue: pulls it back
+    // to Pending (held) via the markChecked endpoint's reject flag, and removes it from the
+    // local store so it leaves the oversight list immediately.
+    async rejectFromOversight(id, groupid) {
+      await api(this.config).message.markChecked({
+        groupid,
+        ids: [id],
+        reject: true,
+      })
+      this.remove({ id })
+    },
     async approve(id, groupid, subject, stdmsgid, body) {
       const msg = this.byId(id)
       const fromuser = msg?.fromuser
diff --git a/iznik-nuxt3/tests/unit/components/modtools/ModMessageButtons.spec.js b/iznik-nuxt3/tests/unit/components/modtools/ModMessageButtons.spec.js
index f880b4c792..d2a74100ee 100644
--- a/iznik-nuxt3/tests/unit/components/modtools/ModMessageButtons.spec.js
+++ b/iznik-nuxt3/tests/unit/components/modtools/ModMessageButtons.spec.js
@@ -8,6 +8,7 @@ const { mockMessageStore, mockModConfigStore } = vi.hoisted(() => {
     byId: vi.fn(),
     fetch: vi.fn().mockResolvedValue(),
     updateMT: vi.fn().mockResolvedValue(),
+    rejectFromOversight: vi.fn().mockResolvedValue(),
   }
   const mockModConfigStore = {
     configsById: {},
@@ -749,4 +750,47 @@ describe('ModMessageButtons', () => {
       expect(wrapper.vm.filtered).toEqual([])
     })
   })
+
+  describe('oversight context (checked/trusted pages)', () => {
+    function rejectBtn(wrapper) {
+      return wrapper
+        .findAll('.spin-button')
+        .find((b) => b.text().includes('Reject (back to Pending)'))
+    }
+
+    it('shows Reject when oversight=true and the message is Approved', () => {
+      const wrapper = mountComponent(
+        { oversight: true },
+        { groups: [{ groupid: 456, collection: 'Approved' }] }
+      )
+      expect(rejectBtn(wrapper)).toBeDefined()
+    })
+
+    it('does NOT show Reject when oversight is false (default) for Approved', () => {
+      const wrapper = mountComponent(
+        {},
+        { groups: [{ groupid: 456, collection: 'Approved' }] }
+      )
+      expect(rejectBtn(wrapper)).toBeUndefined()
+    })
+
+    it('does NOT show Reject for Pending even with oversight=true', () => {
+      const wrapper = mountComponent(
+        { oversight: true },
+        { groups: [{ groupid: 456, collection: 'Pending' }] }
+      )
+      expect(rejectBtn(wrapper)).toBeUndefined()
+    })
+
+    it('calls rejectFromOversight with messageid and groupid on click', async () => {
+      const wrapper = mountComponent(
+        { oversight: true, groupid: 456 },
+        { id: 123, groups: [{ groupid: 456, collection: 'Approved' }] }
+      )
+      const btn = rejectBtn(wrapper)
+      expect(btn).toBeDefined()
+      await btn.trigger('click')
+      expect(mockMessageStore.rejectFromOversight).toHaveBeenCalledWith(123, 456)
+    })
+  })
 })
diff --git a/iznik-nuxt3/tests/unit/components/modtools/ModSysAdminRipplingAnalytics.spec.js b/iznik-nuxt3/tests/unit/components/modtools/ModSysAdminRipplingAnalytics.spec.js
index e2430d3fb1..f0f8f4c26c 100644
--- a/iznik-nuxt3/tests/unit/components/modtools/ModSysAdminRipplingAnalytics.spec.js
+++ b/iznik-nuxt3/tests/unit/components/modtools/ModSysAdminRipplingAnalytics.spec.js
@@ -327,6 +327,62 @@ describe('ModSysAdminRipplingAnalytics', () => {
     wrapper.unmount()
   })
 
+  describe('review_delay section (earned-reach gate)', () => {
+    it('renders the review gate heading', async () => {
+      mockFetchAnalytics.mockResolvedValue(fastOf(FULL))
+      mockFetchMetrics.mockResolvedValueOnce({})
+      const wrapper = mountComponent()
+      await flushPromises()
+      expect(wrapper.html()).toContain('Review gate')
+      wrapper.unmount()
+    })
+
+    it('shows the empty state when review_delay is absent', async () => {
+      mockFetchAnalytics.mockResolvedValue(fastOf(FULL))
+      mockFetchMetrics.mockResolvedValueOnce({})
+      const wrapper = mountComponent()
+      await flushPromises()
+      expect(wrapper.html()).toContain('No review gate data yet')
+      wrapper.unmount()
+    })
+
+    it('renders counts and formatted wait from review_delay', async () => {
+      mockFetchAnalytics.mockResolvedValue(fastOf(FULL))
+      mockFetchMetrics.mockResolvedValueOnce({
+        review_delay: {
+          awaiting_count: 3,
+          median_await_seconds: 2700,
+          post_hours_delayed: 8.5,
+          resumed_count: 12,
+        },
+      })
+      const wrapper = mountComponent()
+      await flushPromises()
+      const html = wrapper.html()
+      expect(html).toContain('45 min') // 2700s formatted
+      expect(html).toContain('8.5') // post_hours_delayed.toFixed(1)
+      expect(html).toContain('12') // resumed_count
+      wrapper.unmount()
+    })
+
+    it('exposes reviewDelay via vm', async () => {
+      mockFetchAnalytics.mockResolvedValue(fastOf(FULL))
+      const payload = {
+        review_delay: {
+          awaiting_count: 2,
+          median_await_seconds: 0,
+          post_hours_delayed: 1.0,
+          resumed_count: 5,
+        },
+      }
+      mockFetchMetrics.mockResolvedValueOnce(payload)
+      const wrapper = mountComponent()
+      await flushPromises()
+      expect(wrapper.vm.reviewDelay).toEqual(payload.review_delay)
+      wrapper.unmount()
+    })
+  })
+
   it('draws the reliability bullseye: a ring per drive-time band, empty rings greyed', async () => {
     mockFetchAnalytics.mockResolvedValue(fastOf(FULL))
     const wrapper = mountComponent()
diff --git a/iznik-server-go/microvolunteering/microvolunteering.go b/iznik-server-go/microvolunteering/microvolunteering.go
index 9a5afffd35..0fb073a9e5 100644
--- a/iznik-server-go/microvolunteering/microvolunteering.go
+++ b/iznik-server-go/microvolunteering/microvolunteering.go
@@ -101,6 +101,15 @@ func isValidEEECondition(v string) bool { return validEEEConditions[v] }
 func isValidEEEWeight(v string) bool    { return validEEEWeights[v] }
 func isValidEEESize(v string) bool      { return validEEESizes[v] }
 
+// earnedReachEnabled reports whether the earned-reach review gate is on (env
+// RIPPLE_EARNED_REACH_ENABLED). When off, the approved-message reviewer pool is
+// unrestricted - byte-for-byte the pre-gate query. Kept local to avoid an import
+// cycle with the message package; mirrors the same env var ExpandService reads.
+func earnedReachEnabled() bool {
+	v := os.Getenv("RIPPLE_EARNED_REACH_ENABLED")
+	return v == "true" || v == "1"
+}
+
 // CoinFlip picks between AI image review and approved message review when both
 // are available. Overridable from tests so both branches can be exercised
 // deterministically; otherwise `rand.Intn(2)` leaves the fallback paths
@@ -221,16 +230,38 @@ func GetChallenge(c *fiber.Ctx) error {
 	wantCheckMessage := contains(challengeTypes, ChallengeCheckMessage) && len(groupIDs) > 0
 	wantAIImage := contains(challengeTypes, ChallengeAIImageReview)
 
+	// Reviewer location for the earned-reach reviewer-pool bound (only fetched when the gate is
+	// on). Prefer settings.mylocation, fall back to lastlocation; both are WGS84 degrees. nil when
+	// neither is set - getApprovedMessageChallenge then treats it (and a disabled gate) as fail-open.
+	var reviewerLat, reviewerLng *float64
+	if wantCheckMessage && earnedReachEnabled() {
+		type locResult struct {
+			Lat *float64
+			Lng *float64
+		}
+		var rl locResult
+		db.Raw(`
+			SELECT
+				COALESCE(NULLIF(CAST(JSON_UNQUOTE(JSON_EXTRACT(u.settings, '$.mylocation.lat')) AS DECIMAL(11,7)), 0), l.lat) AS lat,
+				COALESCE(NULLIF(CAST(JSON_UNQUOTE(JSON_EXTRACT(u.settings, '$.mylocation.lng')) AS DECIMAL(11,7)), 0), l.lng) AS lng
+			FROM users u
+			LEFT JOIN locations l ON l.id = u.lastlocation
+			WHERE u.id = ?
+		`, userID).Scan(&rl)
+		reviewerLat = rl.Lat
+		reviewerLng = rl.Lng
+	}
+
 	if wantCheckMessage && wantAIImage {
 		if CoinFlip() == 0 {
 			if challenge := getAIImageReviewChallenge(db, userID); challenge != nil {
 				return c.JSON(challenge)
 			}
-			if challenge := getApprovedMessageChallenge(db, userID, groupIDs); challenge != nil {
+			if challenge := getApprovedMessageChallenge(db, userID, groupIDs, reviewerLat, reviewerLng); challenge != nil {
 				return c.JSON(challenge)
 			}
 		} else {
-			if challenge := getApprovedMessageChallenge(db, userID, groupIDs); challenge != nil {
+			if challenge := getApprovedMessageChallenge(db, userID, groupIDs, reviewerLat, reviewerLng); challenge != nil {
 				return c.JSON(challenge)
 			}
 			if challenge := getAIImageReviewChallenge(db, userID); challenge != nil {
@@ -238,7 +269,7 @@ func GetChallenge(c *fiber.Ctx) error {
 			}
 		}
 	} else if wantCheckMessage {
-		if challenge := getApprovedMessageChallenge(db, userID, groupIDs); challenge != nil {
+		if challenge := getApprovedMessageChallenge(db, userID, groupIDs, reviewerLat, reviewerLng); challenge != nil {
 			return c.JSON(challenge)
 		}
 	} else if wantAIImage {
@@ -403,7 +434,13 @@ func getPendingMessageChallenge(db *gorm.DB, userID uint64, groupIDs []uint64) *
 }
 
 // getApprovedMessageChallenge returns an approved message for any user to review
-func getApprovedMessageChallenge(db *gorm.DB, userID uint64, groupIDs []uint64) *Challenge {
+// getApprovedMessageChallenge returns an approved message for any user to review.
+// When the earned-reach gate is on and reviewerLat/reviewerLng are non-nil, candidates are
+// restricted to posts whose rippling_reach max_drive_min covers the reviewer (straight-line
+// distance <= max_drive_min * 1400 m, ~84 km/h - a generous upper bound, always wider than the
+// real isochrone), and results are ordered nearest-first. Posts with no reach row or no computed
+// max_drive_min are included regardless (fail-open) and sort last.
+func getApprovedMessageChallenge(db *gorm.DB, userID uint64, groupIDs []uint64, reviewerLat, reviewerLng *float64) *Challenge {
 	if len(groupIDs) == 0 {
 		return nil
 	}
@@ -422,6 +459,30 @@ func getApprovedMessageChallenge(db *gorm.DB, userID uint64, groupIDs []uint64)
 
 	resultApprove := "Approve"
 
+	queryArgs := []interface{}{resultApprove, userID, userID, utils.COLLECTION_APPROVED}
+	reachJoin := ""
+	reachWhere := ""
+	orderExpr := "messages_groups.arrival ASC"
+
+	useReach := earnedReachEnabled() && reviewerLat != nil && reviewerLng != nil
+	if useReach {
+		reachJoin = "LEFT JOIN rippling_reach rr ON rr.msgid = messages_spatial.msgid"
+		// Fail-open: no reach row, or max_drive_min not yet computed. rr.lat/rr.lng are WGS84
+		// degrees (NOT the SRID-3857 polygon). POINT() / ST_Distance_Sphere take (lng, lat).
+		reachWhere = `AND (rr.msgid IS NULL OR rr.max_drive_min IS NULL
+			           OR ST_Distance_Sphere(POINT(?, ?), POINT(rr.lng, rr.lat)) <= rr.max_drive_min * 1400)`
+		queryArgs = append(queryArgs, *reviewerLng, *reviewerLat)
+	}
+
+	queryArgs = append(queryArgs, ApprovalQuorum, DissentingQuorum)
+
+	if useReach {
+		// Nearest-first; no-reach-row posts get a sentinel distance so they sort last.
+		orderExpr = `COALESCE(ST_Distance_Sphere(POINT(?, ?), POINT(rr.lng, rr.lat)), 9999999) ASC,
+		             messages_groups.arrival ASC`
+		queryArgs = append(queryArgs, *reviewerLng, *reviewerLat)
+	}
+
 	err := db.Raw(`
 		SELECT messages_spatial.msgid,
 			(SELECT COUNT(*) AS count FROM microactions WHERE msgid = messages_spatial.msgid) AS reviewcount,
@@ -432,6 +493,7 @@ func getApprovedMessageChallenge(db *gorm.DB, userID uint64, groupIDs []uint64)
 		INNER JOIN `+"`groups`"+` ON groups.id = messages_groups.groupid
 		LEFT JOIN microactions ON microactions.msgid = messages_spatial.msgid AND microactions.userid = ?
 		LEFT JOIN messages_outcomes ON messages_outcomes.msgid = messages_spatial.msgid
+		`+reachJoin+`
 		WHERE messages_groups.groupid IN (`+groupIDsStr+`)
 			AND DATE(messages.arrival) = CURDATE()
 			AND fromuser != ?
@@ -442,9 +504,10 @@ func getApprovedMessageChallenge(db *gorm.DB, userID uint64, groupIDs []uint64)
 			AND (microvolunteeringoptions IS NULL OR JSON_EXTRACT(microvolunteeringoptions, '$.approvedmessages') = 1)
 			AND collection = ?
 			AND autoreposts = 0
+			`+reachWhere+`
 		HAVING approvalcount < ? AND reviewcount < ?
-		ORDER BY messages_groups.arrival ASC LIMIT 1
-	`, resultApprove, userID, userID, utils.COLLECTION_APPROVED, ApprovalQuorum, DissentingQuorum).Scan(&msg).Error
+		ORDER BY `+orderExpr+` LIMIT 1
+	`, queryArgs...).Scan(&msg).Error
 
 	if err == nil && msg.Msgid > 0 {
 		return &Challenge{
diff --git a/iznik-server-go/rippling/metrics.go b/iznik-server-go/rippling/metrics.go
index 1f3c763b13..7d55a6786e 100644
--- a/iznik-server-go/rippling/metrics.go
+++ b/iznik-server-go/rippling/metrics.go
@@ -379,6 +379,24 @@ func Metrics(c *fiber.Ctx) error {
 	takenRates := []TakenRateRow{}
 	groupOpts := []GroupOption{}
 
+	// Earned-reach review-gate await metrics. reviewDelayMetrics is the JSON shape; rdSnap is the
+	// point-in-time snapshot (current rippling_reach state), rdHours the arrival-range-bounded
+	// post-hours delayed. Uses awaiting_review_since (set exactly while the cap pauses a post) and
+	// awaiting_review_seconds (lifetime accumulator). All zero if the columns aren't migrated.
+	type reviewDelayMetrics struct {
+		AwaitingCount      int64   `json:"awaiting_count"`
+		MedianAwaitSeconds float64 `json:"median_await_seconds"` // AVG, not true median - matches HeldReplySummary.MedianH
+		PostHoursDelayed   float64 `json:"post_hours_delayed"`
+		ResumedCount       int64   `json:"resumed_count"`
+	}
+	type reviewDelaySnapshotRaw struct {
+		AwaitingCount      int64   `gorm:"column:awaiting_count"`
+		MedianAwaitSeconds float64 `gorm:"column:median_await_seconds"`
+		ResumedCount       int64   `gorm:"column:resumed_count"`
+	}
+	var rdSnap reviewDelaySnapshotRaw
+	var rdHours float64
+
 	// ---- Run all independent DB queries concurrently --------------------------------
 	var wg sync.WaitGroup
 
@@ -691,10 +709,42 @@ func Metrics(c *fiber.Ctx) error {
 			"ORDER BY g.nameshort").Scan(&groupOpts)
 	}()
 
+	// Review-gate snapshot: count + average wait of posts currently paused by the cap
+	// (awaiting_review_since set), and posts previously paused but now running (resumed:
+	// seconds accumulated but no longer paused). One small pass over rippling_reach.
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		db.Raw(`SELECT
+			COALESCE(SUM(CASE WHEN awaiting_review_since IS NOT NULL THEN 1 ELSE 0 END), 0) AS awaiting_count,
+			COALESCE(AVG(CASE WHEN awaiting_review_since IS NOT NULL
+			                  THEN TIMESTAMPDIFF(SECOND, awaiting_review_since, NOW()) END), 0) AS median_await_seconds,
+			COALESCE(SUM(CASE WHEN awaiting_review_since IS NULL AND awaiting_review_seconds > 0
+			               THEN 1 ELSE 0 END), 0) AS resumed_count
+		FROM rippling_reach`).Scan(&rdSnap)
+	}()
+
+	// Review-gate post-hours delayed: total awaiting_review_seconds for posts whose arrival is in
+	// the selected window, as post-hours. Bounded by arrival (not updated_at) so it's stable on re-query.
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		db.Raw(`SELECT COALESCE(SUM(awaiting_review_seconds), 0) / 3600.0
+			FROM rippling_reach
+			WHERE arrival >= ? AND arrival < ?`, start, end).Scan(&rdHours)
+	}()
+
 	wg.Wait()
 
 	// ---- Post-processing (serial; all goroutines done) --------------------------------
 
+	reviewDelay := reviewDelayMetrics{
+		AwaitingCount:      rdSnap.AwaitingCount,
+		MedianAwaitSeconds: rdSnap.MedianAwaitSeconds,
+		PostHoursDelayed:   rdHours,
+		ResumedCount:       rdSnap.ResumedCount,
+	}
+
 	// Compute derived percentage fields for reply-rate rows (overall + home/ripple cohorts).
 	// Days whose arrival is within 36h of now are still maturing (their 36h reply window hasn't
 	// fully elapsed) — flag them so the client dashes the tail. Day-granularity is enough for the
@@ -793,6 +843,7 @@ func Metrics(c *fiber.Ctx) error {
 		"attribution_capture_from": captureFrom,
 		"reply_distance_median":    replyDistances,
 		"taken_rate":               takenRates,
+		"review_delay":             reviewDelay,
 		"groups":                   groupOpts,
 		"groupid":                  gid,
 		"start":                    start,
diff --git a/iznik-server-go/test/microvolunteering_reach_test.go b/iznik-server-go/test/microvolunteering_reach_test.go
new file mode 100644
index 0000000000..84d5b34844
--- /dev/null
+++ b/iznik-server-go/test/microvolunteering_reach_test.go
@@ -0,0 +1,128 @@
+package test
+
+import (
+	json2 "encoding/json"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/freegle/iznik-server-go/database"
+	"github.com/freegle/iznik-server-go/microvolunteering"
+	"github.com/stretchr/testify/assert"
+)
+
+// When the earned-reach gate is on (RIPPLE_EARNED_REACH_ENABLED), the CheckMessage reviewer pool
+// is bounded to the post's reach: only posts whose rippling_reach max_drive_min covers the reviewer
+// (straight-line distance <= max_drive_min * 1400 m) are offered; posts with no reach row are
+// included regardless (fail-open). With the gate off the bound is lifted entirely.
+func TestGetMicrovolunteering_CheckMessage_ReachBounded(t *testing.T) {
+	db := database.DBConn
+	prefix := uniquePrefix("mv_reachbound")
+
+	reviewerID := CreateTestUser(t, prefix+"_reviewer", "User")
+	db.Exec(`UPDATE users SET settings = '{"mylocation":{"lat":51.5,"lng":-0.1}}' WHERE id = ?`, reviewerID)
+	_, token := CreateTestSession(t, reviewerID)
+	senderID := CreateTestUser(t, prefix+"_sender", "User")
+
+	groupID := CreateTestGroup(t, prefix)
+	db.Exec("UPDATE `groups` SET microvolunteering = 1 WHERE id = ?", groupID)
+	CreateTestMembership(t, reviewerID, groupID, "Member")
+	CreateTestMembership(t, senderID, groupID, "Member")
+
+	// Suppress the Invite challenge for this reviewer.
+	db.Exec("INSERT INTO microactions (actiontype, userid, version, timestamp, score_negative) VALUES (?, ?, 4, NOW(), 0)",
+		microvolunteering.ChallengeInvite, reviewerID)
+	defer db.Exec("DELETE FROM microactions WHERE userid = ?", reviewerID)
+
+	nearID := CreateTestMessage(t, senderID, groupID, "OFFER: near "+prefix, 51.5, -0.1)
+	defer db.Exec("DELETE FROM messages WHERE id = ?", nearID)
+	defer db.Exec("DELETE FROM messages_spatial WHERE msgid = ?", nearID)
+	defer db.Exec("DELETE FROM messages_groups WHERE msgid = ?", nearID)
+	farID := CreateTestMessage(t, senderID, groupID, "OFFER: far "+prefix, 57.0, -3.0)
+	defer db.Exec("DELETE FROM messages WHERE id = ?", farID)
+	defer db.Exec("DELETE FROM messages_spatial WHERE msgid = ?", farID)
+	defer db.Exec("DELETE FROM messages_groups WHERE msgid = ?", farID)
+
+	// Near: max_drive_min=60 -> ~84 km radius; reviewer at the origin -> included.
+	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, max_drive_min) VALUES "+
+		"(?, 51.5, -0.1, ST_GeomFromText('POLYGON((-0.2 51.4,0.0 51.4,0.0 51.6,-0.2 51.6,-0.2 51.4))', 3857), 60) "+
+		"ON DUPLICATE KEY UPDATE max_drive_min=60", nearID)
+	// Far: max_drive_min=30 -> ~42 km radius; reviewer ~600 km away -> excluded.
+	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, max_drive_min) VALUES "+
+		"(?, 57.0, -3.0, ST_GeomFromText('POLYGON((-3.1 56.9,-2.9 56.9,-2.9 57.1,-3.1 57.1,-3.1 56.9))', 3857), 30) "+
+		"ON DUPLICATE KEY UPDATE max_drive_min=30", farID)
+	defer db.Exec("DELETE FROM rippling_reach WHERE msgid IN (?, ?)", nearID, farID)
+
+	// Gate on: only the near post is in reach.
+	t.Setenv("RIPPLE_EARNED_REACH_ENABLED", "true")
+	resp, _ := getApp().Test(httptest.NewRequest("GET", "/api/microvolunteering?jwt="+token+"&types=CheckMessage", nil))
+	assert.Equal(t, 200, resp.StatusCode)
+	var got microvolunteering.Challenge
+	json2.Unmarshal(rsp(resp), &got)
+	assert.Equal(t, microvolunteering.ChallengeCheckMessage, got.Type)
+	if assert.NotNil(t, got.Msgid, "expected a near-post challenge") {
+		assert.Equal(t, nearID, *got.Msgid, "near post served")
+		assert.NotEqual(t, farID, *got.Msgid, "far post must be excluded under the reach bound")
+	}
+
+	// Exhaust the near post for this reviewer, then with the gate off the far post becomes accessible.
+	db.Exec("INSERT INTO microactions (userid, msgid, actiontype, result, timestamp, score_negative) "+
+		"VALUES (?, ?, 'CheckMessage', 'Approve', NOW(), 0)", reviewerID, nearID)
+
+	t.Setenv("RIPPLE_EARNED_REACH_ENABLED", "false")
+	resp2, _ := getApp().Test(httptest.NewRequest("GET", "/api/microvolunteering?jwt="+token+"&types=CheckMessage", nil))
+	assert.Equal(t, 200, resp2.StatusCode)
+	var got2 microvolunteering.Challenge
+	json2.Unmarshal(rsp(resp2), &got2)
+	if got2.Type == microvolunteering.ChallengeCheckMessage && got2.Msgid != nil {
+		assert.Equal(t, farID, *got2.Msgid, "with the gate off, the far post is accessible (fail-open)")
+	}
+}
+
+// With the gate on, the nearest in-reach post is offered first even when a farther (but still
+// in-reach) post was posted earlier - the ORDER BY is distance-first, arrival as tiebreak.
+func TestGetMicrovolunteering_CheckMessage_NearFirst(t *testing.T) {
+	db := database.DBConn
+	prefix := uniquePrefix("mv_nearfirst")
+	t.Setenv("RIPPLE_EARNED_REACH_ENABLED", "true")
+
+	reviewerID := CreateTestUser(t, prefix+"_reviewer", "User")
+	db.Exec(`UPDATE users SET settings = '{"mylocation":{"lat":51.5,"lng":-0.1}}' WHERE id = ?`, reviewerID)
+	_, token := CreateTestSession(t, reviewerID)
+	senderID := CreateTestUser(t, prefix+"_sender", "User")
+	groupID := CreateTestGroup(t, prefix)
+	db.Exec("UPDATE `groups` SET microvolunteering = 1 WHERE id = ?", groupID)
+	CreateTestMembership(t, reviewerID, groupID, "Member")
+	CreateTestMembership(t, senderID, groupID, "Member")
+
+	db.Exec("INSERT INTO microactions (actiontype, userid, version, timestamp, score_negative) VALUES (?, ?, 4, NOW(), 0)",
+		microvolunteering.ChallengeInvite, reviewerID)
+	defer db.Exec("DELETE FROM microactions WHERE userid = ?", reviewerID)
+
+	// Far-but-in-reach post, inserted FIRST (earlier arrival); max_drive_min=180 covers London.
+	farNorthID := CreateTestMessage(t, senderID, groupID, "OFFER: midlands "+prefix, 52.4, -1.9)
+	defer db.Exec("DELETE FROM messages WHERE id = ?", farNorthID)
+	defer db.Exec("DELETE FROM messages_spatial WHERE msgid = ?", farNorthID)
+	defer db.Exec("DELETE FROM messages_groups WHERE msgid = ?", farNorthID)
+	// Near post, inserted SECOND (later arrival).
+	nearID := CreateTestMessage(t, senderID, groupID, "OFFER: close "+prefix, 51.51, -0.09)
+	defer db.Exec("DELETE FROM messages WHERE id = ?", nearID)
+	defer db.Exec("DELETE FROM messages_spatial WHERE msgid = ?", nearID)
+	defer db.Exec("DELETE FROM messages_groups WHERE msgid = ?", nearID)
+
+	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, max_drive_min) VALUES "+
+		"(?, 52.4, -1.9, ST_GeomFromText('POLYGON((-2.0 52.3,-1.8 52.3,-1.8 52.5,-2.0 52.5,-2.0 52.3))', 3857), 180) "+
+		"ON DUPLICATE KEY UPDATE max_drive_min=180", farNorthID)
+	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, max_drive_min) VALUES "+
+		"(?, 51.51, -0.09, ST_GeomFromText('POLYGON((-0.1 51.5,0.0 51.5,0.0 51.52,-0.1 51.52,-0.1 51.5))', 3857), 60) "+
+		"ON DUPLICATE KEY UPDATE max_drive_min=60", nearID)
+	defer db.Exec("DELETE FROM rippling_reach WHERE msgid IN (?, ?)", farNorthID, nearID)
+
+	resp, _ := getApp().Test(httptest.NewRequest("GET", "/api/microvolunteering?jwt="+token+"&types=CheckMessage", nil))
+	assert.Equal(t, 200, resp.StatusCode)
+	var got microvolunteering.Challenge
+	json2.Unmarshal(rsp(resp), &got)
+	assert.Equal(t, microvolunteering.ChallengeCheckMessage, got.Type)
+	if assert.NotNil(t, got.Msgid, "expected a challenge") {
+		assert.Equal(t, nearID, *got.Msgid, "nearest in-reach post is offered first despite an earlier-arrival farther post")
+	}
+}
diff --git a/iznik-server-go/test/rippling_metrics_test.go b/iznik-server-go/test/rippling_metrics_test.go
index f5e6bc732b..b5b75c0e4f 100644
--- a/iznik-server-go/test/rippling_metrics_test.go
+++ b/iznik-server-go/test/rippling_metrics_test.go
@@ -779,3 +779,91 @@ func TestRipplingMetricsAnchorsRippledCohortOnFirstRippleDate(t *testing.T) {
 	assert.True(t, foundOnRippleDay,
 		"rippled post appears on its first-ripple day, proving the cohort anchors on the ripple date")
 }
+
+// review_delay is always present with its numeric fields, even before the await columns are written
+// (all zeros is a valid empty state; the snapshot query fails-soft to zero if columns are absent).
+func TestRipplingMetricsReviewDelayFieldsPresent(t *testing.T) {
+	prefix := uniquePrefix("ripplerdfields")
+	adminID := CreateTestUser(t, prefix+"_admin", "Support")
+	_, token := CreateTestSession(t, adminID)
+
+	resp, _ := getApp().Test(httptest.NewRequest("GET", fmt.Sprintf("/api/rippling/metrics?jwt=%s", token), nil))
+	assert.Equal(t, 200, resp.StatusCode)
+	var result map[string]interface{}
+	json.Unmarshal(rsp(resp), &result)
+
+	rd, ok := result["review_delay"].(map[string]interface{})
+	assert.True(t, ok, "review_delay field present")
+	for _, k := range []string{"awaiting_count", "median_await_seconds", "post_hours_delayed", "resumed_count"} {
+		_, has := rd[k]
+		assert.True(t, has, "%s field present", k)
+	}
+}
+
+// A rippling_reach row currently cap-paused (awaiting_review_since set) lifts awaiting_count and
+// yields a non-negative average wait.
+func TestRipplingMetricsReviewDelayAwaiting(t *testing.T) {
+	prefix := uniquePrefix("ripplerdawait")
+	adminID := CreateTestUser(t, prefix+"_admin", "Support")
+	_, token := CreateTestSession(t, adminID)
+	posterID := CreateTestUser(t, prefix+"_poster", "User")
+	groupID := CreateTestGroup(t, prefix)
+
+	db := database.DBConn
+	// Self-bootstrap the await columns if the Go test DB clone predates the migration.
+	db.Exec("ALTER TABLE rippling_reach ADD COLUMN awaiting_review_since TIMESTAMP NULL")
+	db.Exec("ALTER TABLE rippling_reach ADD COLUMN awaiting_review_seconds INT UNSIGNED NOT NULL DEFAULT 0")
+
+	msgID := CreateTestMessage(t, posterID, groupID, prefix+" awaiting widget", 51.5, -0.1)
+	defer db.Exec("DELETE FROM rippling_reach WHERE msgid = ?", msgID)
+	defer db.Exec("DELETE FROM messages_groups WHERE msgid = ?", msgID)
+	defer db.Exec("DELETE FROM messages WHERE id = ?", msgID)
+
+	db.Exec(
+		"INSERT INTO rippling_reach (msgid, lat, lng, polygon, arrival, awaiting_review_since, awaiting_review_seconds) "+
+			"VALUES (?, 51.5, -0.1, ST_GeomFromText('POLYGON((-0.2 51.4,0.0 51.4,0.0 51.6,-0.2 51.6,-0.2 51.4))', 3857), "+
+			"NOW() - INTERVAL 2 HOUR, NOW() - INTERVAL 30 MINUTE, 0) "+
+			"ON DUPLICATE KEY UPDATE awaiting_review_since = NOW() - INTERVAL 30 MINUTE",
+		msgID)
+
+	resp, _ := getApp().Test(httptest.NewRequest("GET", fmt.Sprintf("/api/rippling/metrics?jwt=%s", token), nil))
+	assert.Equal(t, 200, resp.StatusCode)
+	var result map[string]interface{}
+	json.Unmarshal(rsp(resp), &result)
+	rd, _ := result["review_delay"].(map[string]interface{})
+	assert.GreaterOrEqual(t, rd["awaiting_count"].(float64), float64(1), "cap-paused row counted in awaiting_count")
+	assert.GreaterOrEqual(t, rd["median_await_seconds"].(float64), float64(0), "median_await_seconds non-negative")
+}
+
+// A reach row with awaiting_review_seconds accumulated and arrival in the default window lifts
+// post_hours_delayed (7200s / 3600 = 2 post-hours).
+func TestRipplingMetricsReviewDelayPostHours(t *testing.T) {
+	prefix := uniquePrefix("ripplerdhours")
+	adminID := CreateTestUser(t, prefix+"_admin", "Support")
+	_, token := CreateTestSession(t, adminID)
+	posterID := CreateTestUser(t, prefix+"_poster", "User")
+	groupID := CreateTestGroup(t, prefix)
+
+	db := database.DBConn
+	db.Exec("ALTER TABLE rippling_reach ADD COLUMN awaiting_review_since TIMESTAMP NULL")
+	db.Exec("ALTER TABLE rippling_reach ADD COLUMN awaiting_review_seconds INT UNSIGNED NOT NULL DEFAULT 0")
+
+	msgID := CreateTestMessage(t, posterID, groupID, prefix+" delayed lamp", 51.5, -0.1)
+	defer db.Exec("DELETE FROM rippling_reach WHERE msgid = ?", msgID)
+	defer db.Exec("DELETE FROM messages_groups WHERE msgid = ?", msgID)
+	defer db.Exec("DELETE FROM messages WHERE id = ?", msgID)
+
+	db.Exec(
+		"INSERT INTO rippling_reach (msgid, lat, lng, polygon, arrival, awaiting_review_since, awaiting_review_seconds) "+
+			"VALUES (?, 51.5, -0.1, ST_GeomFromText('POLYGON((-0.2 51.4,0.0 51.4,0.0 51.6,-0.2 51.6,-0.2 51.4))', 3857), "+
+			"NOW() - INTERVAL 3 DAY, NULL, 7200) "+
+			"ON DUPLICATE KEY UPDATE awaiting_review_seconds = 7200",
+		msgID)
+
+	resp, _ := getApp().Test(httptest.NewRequest("GET", fmt.Sprintf("/api/rippling/metrics?jwt=%s", token), nil))
+	assert.Equal(t, 200, resp.StatusCode)
+	var result map[string]interface{}
+	json.Unmarshal(rsp(resp), &result)
+	rd, _ := result["review_delay"].(map[string]interface{})
+	assert.GreaterOrEqual(t, rd["post_hours_delayed"].(float64), float64(2.0), "7200s = 2 post-hours")
+}

From 12fa94fd6231be50b798228a410b63e2ead0e9d8 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Sat, 4 Jul 2026 09:53:07 +0100
Subject: [PATCH 20/26] fix(dev): stop file-sync deleting host files through
 the batch bind mount

The batch container bind-mounts ./iznik-batch at /var/www/html, so 'syncing'
iznik-batch files into it was a self-copy: docker cp's unlink+recreate re-fired
inotify (an endless sync loop, visible in host-scripts logs), and the delete
propagation racing that unlink window ran docker exec rm THROUGH the mount,
deleting the just-edited file on the host. Remove the iznik-batch mapping
entirely - the bind mount already delivers every edit instantly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHiCAjJKX7CemYZEJUntt9
---
 file-sync.sh | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/file-sync.sh b/file-sync.sh
index 519345820d..672ba21608 100755
--- a/file-sync.sh
+++ b/file-sync.sh
@@ -109,11 +109,14 @@ get_container_info() {
     elif [[ "$relative_path" == iznik-server-go/* ]]; then
         echo "${CN}-apiv2 /app/${relative_path#iznik-server-go/} API-v2"
     elif [[ "$relative_path" == iznik-batch/* ]]; then
-        # Skip bootstrap/cache files - these are generated by Laravel and should not be synced
-        # Syncing these causes race conditions when Laravel regenerates them during tests
-        if [[ "$relative_path" != iznik-batch/bootstrap/cache/* ]]; then
-            echo "${CN}-batch /var/www/html/${relative_path#iznik-batch/} Batch"
-        fi
+        # NO sync for iznik-batch: the batch container BIND-MOUNTS ./iznik-batch at
+        # /var/www/html (docker-compose.yml), so the container already sees every host
+        # edit instantly. Worse than pointless, syncing is destructive: docker cp onto
+        # the bind mount rewrites the very file that triggered the event (unlink +
+        # recreate), which re-fires inotify and loops the sync forever; and a racing
+        # do_delete during that unlink window runs `docker exec rm` THROUGH the bind
+        # mount, deleting the file on the HOST - edits silently vanish from the tree.
+        :
     fi
 }
 

From 4878cc47a37e2cc9b6e30cb9b4055c255e4dcd5c Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Sat, 4 Jul 2026 09:53:26 +0100
Subject: [PATCH 21/26] feat(moderation): dark-by-default rollout gate +
 re-review hardening

Rollout gate: the clean-path auto-approve now ships OFF. FREEGLE_AUTOAPPROVE_ENABLED
is the master switch; FREEGLE_AUTOAPPROVE_TRIAL_GROUPS phases a per-group trial while
it stays off (mirroring the rippling group experiment). The Go Pending countdown
mirrors the gate (a countdown that will never fire must not be shown), and compose
passes the flags to both apiv2 services so the cron and the countdown cannot disagree.

Fixes from the adversarial re-review of the branch merged onto current master:
- Trusted oversight queue, its badge count and the moderation-stats Trusted analytic
  gain the rippled_in=0 guard Checked already had - rippled-in copies polluted all three.
- markchecked targeted check/reject gain the same guard: oversight actions only ever
  touch a post's origin row.
- Oversight reject now writes the Message/Rejected log (feeds the error-rate KPI and
  the danger-signal veto on the member's next post) and synchronously stops the post's
  rippling_reach row instead of leaving the reach engine to notice for up to ~6 minutes.
- AutoApproveService's 48h fallback no longer sweeps up quality-sample posts (they wait
  for a human, keeping the sample-vs-population comparison honest), re-checks the mod
  hold at write time so a page-view hold bumped mid-run wins, and only logs Autoapproved
  when the approval actually landed.
- AutoApproveCleanService approval seeds messages_spatial immediately (parity with the
  Go manual-approve path) so the post is browsable/reach-eligible at once.
- messages:auto-approve-clean gets master's cron conventions: withoutOverlapping(15)
  instead of an unbounded 24h mutex, and a 500-per-tick candidate bound.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHiCAjJKX7CemYZEJUntt9
---
 docker-compose.yml                            |  14 +++
 .../app/Services/AutoApproveCleanService.php  |  58 ++++++++++
 .../app/Services/AutoApproveService.php       |  18 +++-
 iznik-batch/config/freegle.php                |   9 ++
 iznik-batch/routes/console.php                |   5 +-
 .../Services/AutoApproveCleanServiceTest.php  |  84 ++++++++++++++-
 .../Services/AutoApproveServiceHoldTest.php   |  63 +++++++++++
 iznik-server-go/message/autoapproveat.go      |  25 ++++-
 iznik-server-go/message/markchecked.go        |  47 +++++++-
 iznik-server-go/message/message_list.go       |   5 +-
 iznik-server-go/moderation/moderationstats.go |   2 +-
 iznik-server-go/session/session.go            |   2 +-
 .../test/autoapprove_countdown_test.go        | 102 ++++++++++++++++++
 iznik-server-go/test/message_test.go          |  16 ++-
 14 files changed, 436 insertions(+), 14 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 485ef16dd3..e9a2a32281 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -717,6 +717,13 @@ services:
       # render — matching how V1 derives its base from TUS_UPLOADER.
       - UPLOADS=http://tusd:8080/tus/
       - PARTNER_KEY_FILE=/run/secrets/PARTNER_KEY
+      # Auto-approve rollout gate: the Go Pending countdown (autoapproveat) must agree
+      # with the Laravel clean-path cron about whether the 20-minute path is on, or mods
+      # would see countdowns that never fire. Mirror whatever the batch env sets.
+      - FREEGLE_AUTOAPPROVE_ENABLED=${FREEGLE_AUTOAPPROVE_ENABLED:-}
+      - FREEGLE_AUTOAPPROVE_TRIAL_GROUPS=${FREEGLE_AUTOAPPROVE_TRIAL_GROUPS:-}
+      # Earned-reach review gate (reviewer-pool bounding in microvolunteering.go).
+      - RIPPLE_EARNED_REACH_ENABLED=${RIPPLE_EARNED_REACH_ENABLED:-}
       - LOKI_ENABLED=true
       - LOKI_URL=http://loki:3100
       - LOKI_JSON_PATH=/var/log/freegle
@@ -912,6 +919,13 @@ services:
       - RIPPLE_ANALYTICS_SAMPLE=${RIPPLE_ANALYTICS_SAMPLE:-250}
       - RIPPLE_ANALYTICS_CONCURRENCY=${RIPPLE_ANALYTICS_CONCURRENCY:-16}
       - PARTNER_KEY_FILE=/run/secrets/PARTNER_KEY
+      # Auto-approve rollout gate: the Go Pending countdown (autoapproveat) must agree
+      # with the Laravel clean-path cron about whether the 20-minute path is on, or mods
+      # would see countdowns that never fire. Mirror whatever the batch env sets.
+      - FREEGLE_AUTOAPPROVE_ENABLED=${FREEGLE_AUTOAPPROVE_ENABLED:-}
+      - FREEGLE_AUTOAPPROVE_TRIAL_GROUPS=${FREEGLE_AUTOAPPROVE_TRIAL_GROUPS:-}
+      # Earned-reach review gate (reviewer-pool bounding in microvolunteering.go).
+      - RIPPLE_EARNED_REACH_ENABLED=${RIPPLE_EARNED_REACH_ENABLED:-}
       - LOKI_ENABLED=true
       - LOKI_URL=http://loki:3100
       - LOKI_JSON_PATH=/var/log/freegle
diff --git a/iznik-batch/app/Services/AutoApproveCleanService.php b/iznik-batch/app/Services/AutoApproveCleanService.php
index 2dc63a5ef6..9fab418d06 100644
--- a/iznik-batch/app/Services/AutoApproveCleanService.php
+++ b/iznik-batch/app/Services/AutoApproveCleanService.php
@@ -51,6 +51,27 @@ public function dangerLogDays(): int
         return (int) config('freegle.autoapprove.danger_log_days', 90);
     }
 
+    /**
+     * Rollout gate for the clean-path auto-approve.
+     *
+     * @return int[]|null null  = enabled everywhere (subject to per-group checks);
+     *                    []    = fully off (the default — deploying this code is a no-op);
+     *                    [ids] = phased trial: enabled only for these groups.
+     */
+    public function enabledGroupIds(): ?array
+    {
+        if (config('freegle.autoapprove.enabled', false)) {
+            return null;
+        }
+
+        $csv = trim((string) config('freegle.autoapprove.trial_group_ids', ''));
+        if ($csv === '') {
+            return [];
+        }
+
+        return array_values(array_filter(array_map('intval', explode(',', $csv))));
+    }
+
     /**
      * Process all eligible pending messages.
      *
@@ -60,6 +81,13 @@ public function process(bool $dryRun = false): array
     {
         $stats = ['approved' => 0, 'held_quality' => 0, 'vetoed' => 0, 'skipped' => 0, 'errors' => 0];
 
+        $enabledGroupIds = $this->enabledGroupIds();
+        if ($enabledGroupIds === []) {
+            // Feature dark (default): posts follow the pre-existing behaviour — Pending
+            // until a moderator acts or the 48h AutoApproveService fallback fires.
+            return $stats;
+        }
+
         // The delay is per-group (settings.autoapprove.delay_minutes) with a site-wide
         // fallback, so it must be resolved in SQL — a single global threshold would ignore
         // group overrides. A 0/absent override means "use the site default".
@@ -102,8 +130,16 @@ public function process(bool $dryRun = false): array
             ->whereRaw(
                 '(mg.autoapprove_hold_until IS NULL OR mg.autoapprove_hold_until <= NOW())'
             )
+            // Phased trial: while the master switch is off, only the listed groups take part.
+            ->when($enabledGroupIds !== null, function ($q) use ($enabledGroupIds) {
+                $q->whereIn('mg.groupid', $enabledGroupIds);
+            })
             ->orderBy('mg.msgid')
             ->orderBy('mg.groupid')
+            // Bound the per-tick batch like the sibling every-minute crons (ripple:expand
+            // etc.): a post-outage backlog drains at 500/minute instead of one huge run
+            // outliving its overlap mutex. Oldest msgids first, so the backlog is FIFO.
+            ->limit(500)
             ->get();
 
         foreach ($candidates as $row) {
@@ -325,6 +361,28 @@ protected function approve(object $row): void
                     'data'      => json_encode(['msgid' => (int) $row->msgid]),
                 ]);
             }
+
+            // Mirror the Go manual-approve path (addApprovedMessageToSpatialIndex): seed
+            // messages_spatial now so the post appears in browse/search — and becomes
+            // visible to the rippling engine — immediately, instead of waiting up to
+            // 5 minutes for the spatial reconciler cron. Re-checks Approved so it is a
+            // no-op if anything above did not land.
+            DB::statement(
+                "INSERT INTO messages_spatial (msgid, point, groupid, msgtype, arrival)
+                 SELECT m.id, ST_GeomFromText(CONCAT('POINT(', m.lng, ' ', m.lat, ')'), 3857),
+                        mg.groupid, m.type, mg.arrival
+                 FROM messages m
+                 INNER JOIN messages_groups mg ON mg.msgid = m.id
+                 LEFT JOIN messages_outcomes mo ON mo.msgid = m.id
+                 WHERE m.id = ? AND mg.groupid = ? AND mg.collection = 'Approved'
+                   AND mg.deleted = 0 AND m.deleted IS NULL
+                   AND m.lat IS NOT NULL AND m.lng IS NOT NULL
+                   AND NOT (m.lat = 0 AND m.lng = 0)
+                   AND mo.id IS NULL
+                 ON DUPLICATE KEY UPDATE point = VALUES(point), msgtype = VALUES(msgtype),
+                                         arrival = VALUES(arrival)",
+                [$row->msgid, $row->groupid]
+            );
         });
 
         Log::info("AutoApproveClean: approved message #{$row->msgid} on group #{$row->groupid}");
diff --git a/iznik-batch/app/Services/AutoApproveService.php b/iznik-batch/app/Services/AutoApproveService.php
index e152a245d7..3c5162ba80 100644
--- a/iznik-batch/app/Services/AutoApproveService.php
+++ b/iznik-batch/app/Services/AutoApproveService.php
@@ -109,6 +109,11 @@ public function process(bool $dryRun = false): array
             ->whereRaw(
                 '(messages_groups.autoapprove_hold_until IS NULL OR messages_groups.autoapprove_hold_until <= NOW())'
             )
+            // Posts held back as a manual quality-check sample stay held for a human:
+            // letting the 48h fallback sweep them up would silently drain the sample
+            // AutoApproveCleanService set aside, breaking the sample-vs-population
+            // error-rate comparison on the moderation stats.
+            ->where('messages_groups.quality_sample', 0)
             ->where(function ($q) {
                 // Normal posts: the 48h fallback (unchanged).
                 $q->where(function ($q2) {
@@ -287,10 +292,14 @@ protected function approveOnGroup(object $candidate, int $groupid): void
         // V1 approve(): UPDATE messages_groups SET collection='Approved', approvedby=whoAmId(),
         // approvedat=NOW(), arrival=NOW() WHERE msgid=? AND groupid=? AND collection!='Approved'
         // V1 whoAmId() returns NULL in cron context (no session).
-        DB::table('messages_groups')
+        $updated = DB::table('messages_groups')
             ->where('msgid', $candidate->msgid)
             ->where('groupid', $groupid)
             ->where('collection', '!=', MessageGroup::COLLECTION_APPROVED)
+            // Re-check the mod hold at write time: a moderator loading the Pending
+            // queue between the candidate query and this UPDATE bumps
+            // autoapprove_hold_until, and their guaranteed review window must win.
+            ->whereRaw('(autoapprove_hold_until IS NULL OR autoapprove_hold_until <= NOW())')
             ->update([
                 'collection' => MessageGroup::COLLECTION_APPROVED,
                 'approvedby' => null,
@@ -298,6 +307,13 @@ protected function approveOnGroup(object $candidate, int $groupid): void
                 'arrival' => now(),
             ]);
 
+        if ($updated === 0) {
+            // Hold bumped mid-run, or someone else approved it first — either way the
+            // approval did not happen here, so no Autoapproved log (the moderation
+            // stats count those logs as real auto-approvals).
+            return;
+        }
+
         // V1 autoapprove() log: type=Message, subtype=Autoapproved.
         DB::table('logs')->insert([
             'timestamp' => now(),
diff --git a/iznik-batch/config/freegle.php b/iznik-batch/config/freegle.php
index 9fa3903184..52dd95e166 100644
--- a/iznik-batch/config/freegle.php
+++ b/iznik-batch/config/freegle.php
@@ -618,6 +618,13 @@
     | delay_minutes / quality_check_percent via settings.autoapprove.* (an
     | absent or 0 delay override falls back to the site default below).
     |
+    | - enabled:                master switch for the clean-path auto-approve.
+    |                           DEFAULT OFF: merging/deploying this code changes
+    |                           nothing until the switch is deliberately flipped.
+    | - trial_group_ids:        comma-separated group ids for a phased trial while
+    |                           the master switch is off (mirrors the rippling
+    |                           group experiment: RIPPLE_WITHIN_GROUPS with
+    |                           RIPPLE_ENABLED false). Ignored when enabled=true.
     | - delay_minutes:          how long a content-check-clean post stays in
     |                           Pending before auto-approval, giving mods and
     |                           microvolunteers a chance to intervene.
@@ -628,6 +635,8 @@
     |
     */
     'autoapprove' => [
+        'enabled'               => (bool) env('FREEGLE_AUTOAPPROVE_ENABLED', false),
+        'trial_group_ids'       => env('FREEGLE_AUTOAPPROVE_TRIAL_GROUPS', ''),
         'delay_minutes'         => (int) env('FREEGLE_AUTOAPPROVE_DELAY_MINUTES', 20),
         'quality_check_percent' => (int) env('FREEGLE_AUTOAPPROVE_QUALITY_CHECK_PCT', 0),
         'danger_log_days'       => (int) env('FREEGLE_AUTOAPPROVE_DANGER_LOG_DAYS', 90),
diff --git a/iznik-batch/routes/console.php b/iznik-batch/routes/console.php
index 4ea0e9524a..d4f2fa1b54 100644
--- a/iznik-batch/routes/console.php
+++ b/iznik-batch/routes/console.php
@@ -166,9 +166,12 @@ function cronLog(string $command): string
 // Auto-approve content-check-clean posts from NULL-status ("auto-moderated") members
 // after the configured delay (default 20 min), unless danger signals are present and
 // excluding a quality-check sample. Runs every minute so the window is honoured tightly.
+// Dark by default: FREEGLE_AUTOAPPROVE_ENABLED / FREEGLE_AUTOAPPROVE_TRIAL_GROUPS gate it
+// inside the service. Overlap expiry bounded (minutes) so a killed run can't leave a
+// mutex behind that stalls auto-approval for the default 24h.
 Schedule::command('messages:auto-approve-clean')
     ->everyMinute()
-    ->withoutOverlapping()
+    ->withoutOverlapping(15)
     ->sendOutputTo(cronLog('messages:auto-approve-clean'))
     ->runInBackground();
 
diff --git a/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php b/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
index 4eb1df2b5e..e78d3bc502 100644
--- a/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
+++ b/iznik-batch/tests/Unit/Services/AutoApproveCleanServiceTest.php
@@ -24,8 +24,12 @@ protected function setUp(): void
         parent::setUp();
         $this->service = new AutoApproveCleanService();
 
-        // Deterministic site defaults for the tests.
+        // Deterministic site defaults for the tests. The rollout gate defaults OFF in
+        // config; these tests exercise the behaviour WHEN ENABLED, so switch it on here.
+        // The gate itself is covered by the test_rollout_gate_* tests below.
         config([
+            'freegle.autoapprove.enabled' => true,
+            'freegle.autoapprove.trial_group_ids' => '',
             'freegle.autoapprove.delay_minutes' => 20,
             'freegle.autoapprove.quality_check_percent' => 0,
             'freegle.autoapprove.danger_log_days' => 90,
@@ -536,4 +540,82 @@ public function test_approved_wanted_does_not_queue_freebie_alert(): void
             'task_type' => \App\Models\BackgroundTask::TASK_FREEBIE_ALERTS_ADD,
         ]);
     }
+
+    public function test_approval_seeds_spatial_index_immediately(): void
+    {
+        // Parity with the Go manual-approve path: the post must hit messages_spatial at
+        // approval time (browse/search/rippling visibility), not after the 5-min cron.
+        [$user, $group, $message] = $this->makeApprovable();
+        DB::table('messages_spatial')->where('msgid', $message->id)->delete();
+
+        $this->service->process();
+
+        $this->assertApproved($message->id, $group->id);
+        $this->assertSame(
+            1,
+            DB::table('messages_spatial')->where('msgid', $message->id)->where('groupid', $group->id)->count(),
+            'auto-approved post is in messages_spatial immediately'
+        );
+    }
+
+    // ───────────────────────── Rollout gate (dark by default) ─────────────────────────
+
+    public function test_rollout_gate_off_by_default_approves_nothing(): void
+    {
+        // The config default (enabled=false, no trial groups) must make deploying this
+        // code a no-op: an otherwise-eligible post stays in Pending untouched.
+        config(['freegle.autoapprove.enabled' => false, 'freegle.autoapprove.trial_group_ids' => '']);
+        [$user, $group, $message] = $this->makeApprovable();
+
+        $stats = $this->service->process();
+
+        $this->assertStillPending($message->id, $group->id);
+        $this->assertSame(0, array_sum($stats), 'feature dark: nothing approved, held, vetoed or skipped');
+    }
+
+    public function test_rollout_gate_trial_groups_enable_only_those_groups(): void
+    {
+        // Phased trial: with the master switch off, only posts on the listed groups
+        // auto-approve; identical posts on other groups are untouched.
+        [$userA, $groupA, $messageA] = $this->makeApprovable();
+        [$userB, $groupB, $messageB] = $this->makeApprovable();
+        config([
+            'freegle.autoapprove.enabled' => false,
+            'freegle.autoapprove.trial_group_ids' => (string) $groupA->id,
+        ]);
+
+        $this->service->process();
+
+        $this->assertApproved($messageA->id, $groupA->id);
+        $this->assertStillPending($messageB->id, $groupB->id);
+    }
+
+    public function test_rollout_gate_trial_list_tolerates_spaces_and_multiple_ids(): void
+    {
+        [$userA, $groupA, $messageA] = $this->makeApprovable();
+        [$userB, $groupB, $messageB] = $this->makeApprovable();
+        config([
+            'freegle.autoapprove.enabled' => false,
+            'freegle.autoapprove.trial_group_ids' => ' ' . $groupA->id . ' , ' . $groupB->id . ' ',
+        ]);
+
+        $this->service->process();
+
+        $this->assertApproved($messageA->id, $groupA->id);
+        $this->assertApproved($messageB->id, $groupB->id);
+    }
+
+    public function test_rollout_gate_enabled_ignores_trial_list(): void
+    {
+        // enabled=true is the master switch: the trial list no longer restricts anything.
+        [$user, $group, $message] = $this->makeApprovable();
+        config([
+            'freegle.autoapprove.enabled' => true,
+            'freegle.autoapprove.trial_group_ids' => '999999999',
+        ]);
+
+        $this->service->process();
+
+        $this->assertApproved($message->id, $group->id);
+    }
 }
diff --git a/iznik-batch/tests/Unit/Services/AutoApproveServiceHoldTest.php b/iznik-batch/tests/Unit/Services/AutoApproveServiceHoldTest.php
index a8207c1d2b..fe5c15eccf 100644
--- a/iznik-batch/tests/Unit/Services/AutoApproveServiceHoldTest.php
+++ b/iznik-batch/tests/Unit/Services/AutoApproveServiceHoldTest.php
@@ -67,4 +67,67 @@ public function test_48h_hold_until_past_allows_approval(): void
             'collection' => MessageGroup::COLLECTION_APPROVED,
         ]);
     }
+
+    public function test_48h_fallback_leaves_quality_sample_for_a_human(): void
+    {
+        // A post AutoApproveCleanService held back as a quality-check sample is waiting
+        // for a moderator's verdict. The 48h fallback must not sweep it up — that would
+        // silently drain the sample and break the sample-vs-population error comparison.
+        [$user, $group, $message] = $this->makeApprovable48h();
+        DB::table('messages_groups')
+            ->where('msgid', $message->id)
+            ->where('groupid', $group->id)
+            ->update(['quality_sample' => 1]);
+
+        $this->service->process();
+
+        $this->assertDatabaseHas('messages_groups', [
+            'msgid'      => $message->id,
+            'groupid'    => $group->id,
+            'collection' => MessageGroup::COLLECTION_PENDING,
+        ]);
+        $this->assertDatabaseMissing('logs', [
+            'msgid'   => $message->id,
+            'type'    => 'Message',
+            'subtype' => 'Autoapproved',
+        ]);
+    }
+
+    public function test_48h_hold_rechecked_at_write_time(): void
+    {
+        // The candidate query and the UPDATE both check the hold, so a hold bumped
+        // between them (mod opens the Pending page mid-run) wins. Simulate the write-time
+        // side directly: candidate eligible, but the row's hold is bumped before
+        // approveOnGroup's UPDATE executes — the UPDATE must not fire, and crucially no
+        // Autoapproved log may be written for an approval that did not happen.
+        [$user, $group, $message] = $this->makeApprovable48h();
+
+        $candidate = (object) [
+            'msgid'    => $message->id,
+            'groupid'  => $group->id,
+            'fromuser' => $user->id,
+            'spamtype' => null,
+            'subject'  => $message->subject,
+        ];
+
+        DB::table('messages_groups')
+            ->where('msgid', $message->id)
+            ->where('groupid', $group->id)
+            ->update(['autoapprove_hold_until' => now()->addMinutes(10)]);
+
+        $method = new \ReflectionMethod($this->service, 'approveOnGroup');
+        $method->setAccessible(true);
+        $method->invoke($this->service, $candidate, $group->id);
+
+        $this->assertDatabaseHas('messages_groups', [
+            'msgid'      => $message->id,
+            'groupid'    => $group->id,
+            'collection' => MessageGroup::COLLECTION_PENDING,
+        ]);
+        $this->assertDatabaseMissing('logs', [
+            'msgid'   => $message->id,
+            'type'    => 'Message',
+            'subtype' => 'Autoapproved',
+        ]);
+    }
 }
diff --git a/iznik-server-go/message/autoapproveat.go b/iznik-server-go/message/autoapproveat.go
index 0778e88b5c..fcd8faef3d 100644
--- a/iznik-server-go/message/autoapproveat.go
+++ b/iznik-server-go/message/autoapproveat.go
@@ -3,13 +3,35 @@ package message
 import (
 	"encoding/json"
 	"hash/crc32"
+	"os"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/freegle/iznik-server-go/utils"
 	"gorm.io/gorm"
 )
 
+// cleanPathEnabledFor mirrors the PHP rollout gate (AutoApproveCleanService::enabledGroupIds):
+// FREEGLE_AUTOAPPROVE_ENABLED truthy enables the 20-minute clean path everywhere; otherwise
+// only the groups listed in FREEGLE_AUTOAPPROVE_TRIAL_GROUPS (comma-separated ids) take part.
+// When the clean path is off for a group, the countdown falls back to the 48h estimate — a
+// countdown that will never fire must not be shown to moderators.
+func cleanPathEnabledFor(gid uint64) bool {
+	v := os.Getenv("FREEGLE_AUTOAPPROVE_ENABLED")
+	if v == "true" || v == "1" {
+		return true
+	}
+
+	for _, part := range strings.Split(os.Getenv("FREEGLE_AUTOAPPROVE_TRIAL_GROUPS"), ",") {
+		if id, err := strconv.ParseUint(strings.TrimSpace(part), 10, 64); err == nil && id == gid {
+			return true
+		}
+	}
+
+	return false
+}
+
 // phpTruthy mirrors PHP's !empty(): nil, false, 0, "" and "0" are falsy; everything
 // else is truthy. Used so the Go group-allows check matches AutoApproveCleanService's
 // PHP getSetting()/empty() semantics exactly.
@@ -131,7 +153,8 @@ func computeAutoapproveat(db *gorm.DB, message *Message, groups []MessageGroup,
 			}
 		}
 
-		onCleanPath := groupAllows &&
+		onCleanPath := cleanPathEnabledFor(mg.Groupid) &&
+			groupAllows &&
 			row.OurPostingStatus == nil &&
 			mg.ContentcheckCheckedAt != nil &&
 			mg.ContentcheckReasons == nil &&
diff --git a/iznik-server-go/message/markchecked.go b/iznik-server-go/message/markchecked.go
index e142aa08fe..c17a630fe2 100644
--- a/iznik-server-go/message/markchecked.go
+++ b/iznik-server-go/message/markchecked.go
@@ -61,23 +61,62 @@ func MarkChecked(c *fiber.Ctx) error {
 	// proper moderation decision. Setting collection=Pending removes them from
 	// messages_spatial (so rippling stops drawing them), and heldby blocks the
 	// auto-approve cron from immediately re-publishing them. Targeted only — there is
-	// no bulk "reject the whole bucket" (that would be far too blunt).
+	// no bulk "reject the whole bucket" (that would be far too blunt). rippled_in = 0:
+	// oversight actions apply to a post's ORIGIN row only — rippled-in copies are the
+	// origin community's responsibility and are retracted by the reach engine, never
+	// yanked directly from another group's queue.
 	if req.Reject {
 		if len(req.IDs) == 0 {
 			return fiber.NewError(fiber.StatusBadRequest, "reject requires specific ids")
 		}
+
+		// Snapshot the rows the reject will hit, so the log rows and the reach stop
+		// below apply to exactly the posts actually rejected (not e.g. ids the mod
+		// lacks permission for, which the WHERE filters out).
+		var hit []struct {
+			Msgid    uint64
+			Groupid  uint64
+			Fromuser uint64
+		}
+		db.Raw("SELECT mg.msgid, mg.groupid, m.fromuser FROM messages_groups mg "+
+			"INNER JOIN messages m ON m.id = mg.msgid "+
+			"WHERE mg.msgid IN ? AND mg.groupid IN ? AND mg.collection = ? AND mg.deleted = 0 AND mg.rippled_in = 0",
+			req.IDs, groupIDs, utils.COLLECTION_APPROVED).Scan(&hit)
+
 		r := db.Exec("UPDATE messages_groups SET collection = ?, heldby = ?, checkedat = NULL "+
-			"WHERE msgid IN ? AND groupid IN ? AND collection = ? AND deleted = 0",
+			"WHERE msgid IN ? AND groupid IN ? AND collection = ? AND deleted = 0 AND rippled_in = 0",
 			utils.COLLECTION_PENDING, myid, req.IDs, groupIDs, utils.COLLECTION_APPROVED)
+
+		for _, h := range hit {
+			// The Rejected log row is load-bearing, not just audit: the moderation-stats
+			// "rejected" analytic counts these, and AutoApproveCleanService's danger-signal
+			// veto (recent negative moderation logs) is what stops this member's NEXT post
+			// from auto-publishing.
+			db.Exec("INSERT INTO logs (timestamp, type, subtype, msgid, groupid, user, byuser) "+
+				"VALUES (NOW(), 'Message', 'Rejected', ?, ?, ?, ?)",
+				h.Msgid, h.Groupid, h.Fromuser, myid)
+
+			// Halt rippling immediately rather than waiting for the spatial prune +
+			// expand tick (up to ~6 minutes) to notice the post left the browsable set —
+			// in that window the reach engine could still mail newly-reached members.
+			// advanceDue only advances status='expanding' rows, so this is a hard stop;
+			// the rippled-in copies themselves are retracted by the engine's existing
+			// stale-post retraction on its next tick.
+			db.Exec("UPDATE rippling_reach SET status = 'stopped' WHERE msgid = ?", h.Msgid)
+		}
+
 		return c.JSON(fiber.Map{"success": true, "rejected": r.RowsAffected})
 	}
 
 	var rowsAffected int64
 	if len(req.IDs) > 0 {
 		// Mark the specified posts checked — only ones still unchecked, and only
-		// on groups the mod moderates.
+		// on groups the mod moderates. rippled_in = 0 for the same reason as the
+		// bucket update below: rippled-in copies are not part of this group's
+		// oversight, and a checkedat stamped on one would corrupt the AutoModChecked
+		// analytic (it measures review of posts that auto-published HERE).
 		r := db.Exec("UPDATE messages_groups SET checkedat = NOW(), checkedby = ? "+
-			"WHERE msgid IN ? AND groupid IN ? AND collection = ? AND deleted = 0 AND checkedat IS NULL",
+			"WHERE msgid IN ? AND groupid IN ? AND collection = ? AND deleted = 0 AND checkedat IS NULL AND rippled_in = 0",
 			myid, req.IDs, groupIDs, utils.COLLECTION_APPROVED)
 		rowsAffected = r.RowsAffected
 	} else {
diff --git a/iznik-server-go/message/message_list.go b/iznik-server-go/message/message_list.go
index 8cd4d788a0..123ac82d18 100644
--- a/iznik-server-go/message/message_list.go
+++ b/iznik-server-go/message/message_list.go
@@ -576,8 +576,11 @@ func ListMessagesMT(c *fiber.Ctx) error {
 			filterWhere = "AND mg.approvedby IS NULL AND mg.rippled_in = 0 AND mem.ourPostingStatus IS NULL " + checkedWindow
 		case "trusted":
 			// Went live without moderation from trusted (group-settings) members.
+			// rippled_in = 0 matches "checked": a copy the rippling engine inserted
+			// (Approved, approvedby NULL) is not this group's oversight work, and the
+			// poster's trusted status on the receiving group is coincidental.
 			filterJoin = "INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "
-			filterWhere = "AND mg.approvedby IS NULL AND (mem.ourPostingStatus = 'DEFAULT' OR mem.ourPostingStatus = 'UNMODERATED') " + checkedWindow
+			filterWhere = "AND mg.approvedby IS NULL AND mg.rippled_in = 0 AND (mem.ourPostingStatus = 'DEFAULT' OR mem.ourPostingStatus = 'UNMODERATED') " + checkedWindow
 		}
 
 		branchSQL := "SELECT mg.msgid, mg.arrival FROM messages_groups mg " +
diff --git a/iznik-server-go/moderation/moderationstats.go b/iznik-server-go/moderation/moderationstats.go
index 9232cef1fb..615cfb4d0d 100644
--- a/iznik-server-go/moderation/moderationstats.go
+++ b/iznik-server-go/moderation/moderationstats.go
@@ -99,7 +99,7 @@ func Stats(c *fiber.Ctx) error {
 		db.Raw("SELECT COUNT(*) FROM messages_groups mg "+
 			"JOIN messages m ON m.id=mg.msgid "+
 			"JOIN memberships mem ON mem.userid=m.fromuser AND mem.groupid=mg.groupid "+
-			"WHERE mg.approvedat BETWEEN ? AND ? AND mg.approvedby IS NULL "+
+			"WHERE mg.approvedat BETWEEN ? AND ? AND mg.approvedby IS NULL AND mg.rippled_in = 0 "+
 			"AND mg.contentcheck_checked_at IS NOT NULL AND mg.deleted=0 "+
 			"AND (mem.ourPostingStatus='DEFAULT' OR mem.ourPostingStatus='UNMODERATED') "+
 			"AND NOT EXISTS (SELECT 1 FROM logs l WHERE l.msgid=mg.msgid AND l.groupid=mg.groupid AND l.type='Message' AND l.subtype='Autoapproved')",
diff --git a/iznik-server-go/session/session.go b/iznik-server-go/session/session.go
index ac5b662b26..b1850c2d96 100644
--- a/iznik-server-go/session/session.go
+++ b/iznik-server-go/session/session.go
@@ -1117,7 +1117,7 @@ func GetSession(c *fiber.Ctx) error {
 				"INNER JOIN memberships mem ON mem.userid = m.fromuser AND mem.groupid = mg.groupid "+
 				"WHERE mg.groupid IN ? AND mg.collection = ? AND mg.deleted = 0 "+
 				"AND m.deleted IS NULL AND u.deleted IS NULL "+
-				"AND mg.approvedby IS NULL AND mem.ourPostingStatus IN ('DEFAULT', 'UNMODERATED') "+
+				"AND mg.approvedby IS NULL AND mg.rippled_in = 0 AND mem.ourPostingStatus IN ('DEFAULT', 'UNMODERATED') "+
 				checkedWindowSQL,
 				modGroupIDs, utils.COLLECTION_APPROVED).Scan(&trusted)
 		}()
diff --git a/iznik-server-go/test/autoapprove_countdown_test.go b/iznik-server-go/test/autoapprove_countdown_test.go
index a6d49796d3..b7edd8aa48 100644
--- a/iznik-server-go/test/autoapprove_countdown_test.go
+++ b/iznik-server-go/test/autoapprove_countdown_test.go
@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/freegle/iznik-server-go/database"
 	"github.com/stretchr/testify/assert"
@@ -73,6 +74,9 @@ func TestListMessagesMTPendingBumpsHold(t *testing.T) {
 // moderator; clean-path posts get a time, danger-signalled posts get nil, and
 // non-mods never see it.
 func TestAutoapproveatPendingModGating(t *testing.T) {
+	// This test exercises the clean 20-minute path, which is dark by default —
+	// enable it (the rollout gate itself is covered by TestAutoapproveatRolloutGate).
+	t.Setenv("FREEGLE_AUTOAPPROVE_ENABLED", "true")
 	prefix := uniquePrefix("autoapproveat")
 	db := database.DBConn
 
@@ -110,6 +114,62 @@ func TestAutoapproveatPendingModGating(t *testing.T) {
 	db.Exec("DELETE FROM messages WHERE id IN (?, ?)", cleanMsg, dangerMsg)
 }
 
+
+// The rollout gate (FREEGLE_AUTOAPPROVE_ENABLED / FREEGLE_AUTOAPPROVE_TRIAL_GROUPS)
+// mirrors AutoApproveCleanService::enabledGroupIds. With the gate off (the default) a
+// clean pending post must NOT show the 20-minute countdown — the clean path will not
+// run, so showing it would promise moderators an auto-approval that never fires. It
+// falls back to the 48h estimate instead. A trial group restores the 20-minute path
+// for that group only.
+func TestAutoapproveatRolloutGate(t *testing.T) {
+	t.Setenv("FREEGLE_AUTOAPPROVE_ENABLED", "")
+	t.Setenv("FREEGLE_AUTOAPPROVE_TRIAL_GROUPS", "")
+	prefix := uniquePrefix("aagate")
+	db := database.DBConn
+
+	groupID := CreateTestGroup(t, prefix)
+	poster := CreateTestUser(t, prefix+"_poster", "User")
+	modID := CreateTestUser(t, prefix+"_mod", "User")
+	CreateTestMembership(t, poster, groupID, "Member")
+	CreateTestMembership(t, modID, groupID, "Moderator")
+	db.Exec("UPDATE memberships SET ourPostingStatus = NULL WHERE userid = ? AND groupid = ?", poster, groupID)
+	_, modToken := CreateTestSession(t, modID)
+
+	msg := CreateTestMessage(t, poster, groupID, prefix+" gated pending", 52.0, -1.0)
+	defer db.Exec("DELETE FROM messages_groups WHERE msgid = ?", msg)
+	defer db.Exec("DELETE FROM messages WHERE id = ?", msg)
+	db.Exec("UPDATE messages_groups SET collection='Pending', arrival=NOW() - INTERVAL 5 MINUTE, contentcheck_checked_at=NOW() - INTERVAL 4 MINUTE, contentcheck_reasons=NULL, autoapprove_hold_until=NULL WHERE msgid=?", msg)
+
+	parseAt := func(v interface{}) time.Time {
+		s, ok := v.(string)
+		assert.True(t, ok, "autoapproveat should be a timestamp string")
+		at, err := time.Parse(time.RFC3339, s)
+		assert.NoError(t, err)
+		return at
+	}
+
+	// Gate fully off: the countdown falls back to the 48h estimate.
+	v := getAutoapproveatField(t, msg, groupID, modToken)
+	assert.NotNil(t, v, "gate off: clean pending post still shows the 48h fallback estimate")
+	assert.True(t, parseAt(v).After(time.Now().Add(40*time.Hour)),
+		"gate off: estimate must be the 48h fallback, not the 20-minute clean path")
+
+	// This group in the trial list: the 20-minute clean path applies again.
+	t.Setenv("FREEGLE_AUTOAPPROVE_TRIAL_GROUPS", fmt.Sprintf(" %d ", groupID))
+	v = getAutoapproveatField(t, msg, groupID, modToken)
+	assert.NotNil(t, v)
+	assert.True(t, parseAt(v).Before(time.Now().Add(time.Hour)),
+		"trial group: the 20-minute clean-path estimate applies")
+
+	// Global switch on: clean path everywhere, trial list irrelevant.
+	t.Setenv("FREEGLE_AUTOAPPROVE_TRIAL_GROUPS", "999999999")
+	t.Setenv("FREEGLE_AUTOAPPROVE_ENABLED", "true")
+	v = getAutoapproveatField(t, msg, groupID, modToken)
+	assert.NotNil(t, v)
+	assert.True(t, parseAt(v).Before(time.Now().Add(time.Hour)),
+		"global switch on: the 20-minute clean-path estimate applies")
+}
+
 // D9: markchecked with explicit ids marks only Approved rows on the mod's groups,
 // leaving Pending rows and other-group rows untouched.
 func TestMarkCheckedSpecificIDs(t *testing.T) {
@@ -196,6 +256,16 @@ func TestMarkCheckedReject(t *testing.T) {
 	approved := CreateTestMessage(t, poster, groupA, prefix+" approved", 52.0, -1.0)
 	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL, checkedat=NOW(), checkedby=? WHERE msgid=?", modID, approved)
 
+	// The post is mid-ripple: an expanding reach row, and a rippled-in copy on another
+	// group. The reject must hard-stop the reach and must NOT touch the rippled-in copy
+	// (the engine's own retraction handles those).
+	groupB := CreateTestGroup(t, prefix+"_b")
+	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, arrival) "+
+		"VALUES (?, 52.0, -1.0, ST_GeomFromText('POLYGON((-1.2 51.9,-0.8 51.9,-0.8 52.1,-1.2 52.1,-1.2 51.9))', 3857), NOW())", approved)
+	db.Exec("INSERT INTO messages_groups (msgid, groupid, arrival, collection, autoreposts, rippled_in) "+
+		"VALUES (?, ?, NOW(), 'Approved', 0, 1)", approved, groupB)
+	defer db.Exec("DELETE FROM rippling_reach WHERE msgid=?", approved)
+
 	// Reject requires explicit ids.
 	noIDs := fmt.Sprintf(`{"groupid": %d, "reject": true}`, groupA)
 	reqNo := httptest.NewRequest("POST", fmt.Sprintf("/api/modtools/messages/markchecked?jwt=%s", modToken), strings.NewReader(noIDs))
@@ -218,6 +288,38 @@ func TestMarkCheckedReject(t *testing.T) {
 	assert.Equal(t, int64(1), pendingHeld, "rejected post is Pending, held by the mod, checkedat cleared")
 	assert.Equal(t, int64(0), stillChecked, "checkedat must be cleared on reject")
 
+	// The Rejected log row is what feeds the moderation-stats KPI and the clean
+	// auto-approver's danger-signal veto for this member's next post.
+	var rejectedLogs int64
+	db.Raw("SELECT COUNT(*) FROM logs WHERE type='Message' AND subtype='Rejected' AND msgid=? AND groupid=? AND user=? AND byuser=?",
+		approved, groupA, poster, modID).Scan(&rejectedLogs)
+	assert.Equal(t, int64(1), rejectedLogs, "reject must write a Message/Rejected log row")
+
+	// The reach engine is hard-stopped immediately, not left to expand for another tick.
+	var reachStatus string
+	db.Raw("SELECT status FROM rippling_reach WHERE msgid=?", approved).Scan(&reachStatus)
+	assert.Equal(t, "stopped", reachStatus, "reject must stop the reach row synchronously")
+
+	// The rippled-in copy on the other group is untouched (the engine retracts those).
+	var rippledCopy int64
+	db.Raw("SELECT COUNT(*) FROM messages_groups WHERE msgid=? AND groupid=? AND collection='Approved' AND rippled_in=1", approved, groupB).Scan(&rippledCopy)
+	assert.Equal(t, int64(1), rippledCopy, "reject must not directly touch rippled-in copies")
+
+	// A mod of the RECEIVING group cannot reject the rippled-in copy through this
+	// endpoint either — oversight actions are origin-row only.
+	modB := CreateTestUser(t, prefix+"_modb", "User")
+	CreateTestMembership(t, modB, groupB, "Moderator")
+	_, modBToken := CreateTestSession(t, modB)
+	bodyB := fmt.Sprintf(`{"groupid": %d, "reject": true, "ids": [%d]}`, groupB, approved)
+	reqB := httptest.NewRequest("POST", fmt.Sprintf("/api/modtools/messages/markchecked?jwt=%s", modBToken), strings.NewReader(bodyB))
+	reqB.Header.Set("Content-Type", "application/json")
+	respB, err := getApp().Test(reqB)
+	assert.NoError(t, err)
+	assert.Equal(t, 200, respB.StatusCode)
+	db.Raw("SELECT COUNT(*) FROM messages_groups WHERE msgid=? AND groupid=? AND collection='Approved' AND rippled_in=1", approved, groupB).Scan(&rippledCopy)
+	assert.Equal(t, int64(1), rippledCopy, "a receiving-group mod's reject must not yank a rippled-in copy")
+
+	db.Exec("DELETE FROM logs WHERE type='Message' AND subtype='Rejected' AND msgid=?", approved)
 	db.Exec("DELETE FROM messages_groups WHERE msgid=?", approved)
 	db.Exec("DELETE FROM messages WHERE id=?", approved)
 }
diff --git a/iznik-server-go/test/message_test.go b/iznik-server-go/test/message_test.go
index 7a90f9e0fc..64355faaaa 100644
--- a/iznik-server-go/test/message_test.go
+++ b/iznik-server-go/test/message_test.go
@@ -5633,6 +5633,13 @@ func TestListMessagesMT_FilterTrusted(t *testing.T) {
 	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=NULL WHERE msgid IN (?, ?)", checkedMsg, trustedMsg)
 	db.Exec("UPDATE messages_groups SET collection='Approved', approvedby=? WHERE msgid=?", modID, modApprovedMsg)
 
+	// A copy the rippling engine inserted (rippled_in=1) from a member who happens to
+	// be trusted here is NOT this group's oversight work and must not appear.
+	otherGroup := CreateTestGroup(t, prefix+"_origin")
+	rippledMsg := CreateTestMessage(t, defaultPoster, otherGroup, prefix+" rippled in", 52.0, -1.0)
+	db.Exec("INSERT INTO messages_groups (msgid, groupid, arrival, collection, autoreposts, rippled_in) "+
+		"VALUES (?, ?, NOW(), 'Approved', 0, 1)", rippledMsg, groupID)
+
 	resp, err := getApp().Test(httptest.NewRequest("GET",
 		fmt.Sprintf("/api/modtools/messages?groupid=%d&collection=Approved&filter=trusted&jwt=%s", groupID, modToken), nil))
 	assert.NoError(t, err)
@@ -5641,7 +5648,7 @@ func TestListMessagesMT_FilterTrusted(t *testing.T) {
 	var body map[string]interface{}
 	json.NewDecoder(resp.Body).Decode(&body)
 	msgs, _ := body["messages"].([]interface{})
-	foundChecked, foundTrusted, foundMod := false, false, false
+	foundChecked, foundTrusted, foundMod, foundRippled := false, false, false, false
 	for _, id := range msgs {
 		switch id {
 		case float64(checkedMsg):
@@ -5650,14 +5657,17 @@ func TestListMessagesMT_FilterTrusted(t *testing.T) {
 			foundTrusted = true
 		case float64(modApprovedMsg):
 			foundMod = true
+		case float64(rippledMsg):
+			foundRippled = true
 		}
 	}
 	assert.True(t, foundTrusted, "trusted-member post should appear under trusted")
 	assert.False(t, foundChecked, "auto-moderated NULL-member post should not appear under trusted")
 	assert.False(t, foundMod, "mod-approved post should not appear under trusted")
+	assert.False(t, foundRippled, "a rippled-in copy must not appear in the trusted oversight queue")
 
-	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg)
-	db.Exec("DELETE FROM messages WHERE id IN (?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg)
+	db.Exec("DELETE FROM messages_groups WHERE msgid IN (?, ?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg, rippledMsg)
+	db.Exec("DELETE FROM messages WHERE id IN (?, ?, ?, ?)", checkedMsg, trustedMsg, modApprovedMsg, rippledMsg)
 }
 
 func TestListMessagesMT_MarkChecked(t *testing.T) {

From c2e331d5f67cc6a0a191316edec4632a34c5280b Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Sat, 4 Jul 2026 09:53:37 +0100
Subject: [PATCH 22/26] docs(moderation): lead the mod guide with an honest
 objections/mitigations table

Rewritten around the moderator discussion in Discourse topic 9620 (Evolution of our
approach): every substantial objection raised there - 16 rows, with who raised it and
post references - now opens the document, each answered honestly, including the ones
the design does not fully mitigate (new-member post quality, the volunteer-morale
cost, the trust-differentiator judgment call). Documents the switched-off-by-default
rollout, the trial phasing, and flags plainly that the analytics live on a page
ordinary moderators cannot currently see, so trial numbers must be published to them.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHiCAjJKX7CemYZEJUntt9
---
 AUTO-APPROVE-FOR-MODERATORS.md | 119 +++++++++++++++++++++++++++------
 1 file changed, 97 insertions(+), 22 deletions(-)

diff --git a/AUTO-APPROVE-FOR-MODERATORS.md b/AUTO-APPROVE-FOR-MODERATORS.md
index 42e008ae18..2134cc57cc 100644
--- a/AUTO-APPROVE-FOR-MODERATORS.md
+++ b/AUTO-APPROVE-FOR-MODERATORS.md
@@ -2,28 +2,90 @@
 
 > **Current reference document.** Explains post-moderation (auto-approve) for
 > moderators. Read alongside [`RIPPLING-OUT-FOR-MODERATORS.md`](RIPPLING-OUT-FOR-MODERATORS.md) -
-> the two features work together, and the section "How this works with rippling out"
+> the two features interact, and the section "How this works with rippling out"
 > below is where they meet.
 
+**The change in one sentence:** a content-checked, clean post from a settled, auto-moderated
+member goes live by itself after a short delay (about 20 minutes by default), and you review
+it **after** it is live in a dedicated oversight queue, instead of approving it beforehand.
+
+**The state of the decision:** this is **built but switched off**. Nothing changes on any
+group until it is deliberately switched on, and the plan is to start with a small number of
+volunteer trial groups and published error rates, not a network-wide flip. The final
+decision rests with the Board, informed by the trial.
+
+---
+
+## The objections, taken seriously
+
+This change was discussed at length by moderators in
+[Evolution of our approach](https://discourse.ilovefreegle.org/t/evolution-of-our-approach-improving-the-freegle-experience/9620)
+(over 300 posts). Those objections shaped what was actually built. Before anything else,
+here is each substantial objection raised there, who raised it, and an honest statement of
+how the design answers it - or does not. Post numbers refer to that thread.
+
+| The objection | Honest response |
+|---|---|
+| **"You've already decided - this consultation is fake."** (Louise, Jeni, Matty, Vee, Emma, Angelika and others; posts 31, 78, 118, 138, 290) | The criticism of how this was communicated is fair, and announcing progress in a passing comment on another thread was handled badly. What the code now guarantees: the feature ships **switched off by default**. Deploying it changes nothing. Turning it on is a deliberate, reversible act, group by group if need be, and the decision rests with the Board, not with the code being merged. |
+| **"Where's the evidence this is a problem? 97% approval could just mean moderation works."** (Jeni, Angelika, Sylvain, Matty, Derek and others; posts 26, 30, 51, 137) | Partly conceded: we cannot prove in advance that faster posting grows Freegle. That is exactly why the build includes measurement rather than faith: every auto-published post is tracked, a random sample can be held back for human checking as a control, and the **auto-publish error rate** (how often a mod later had to step in) is computed continuously. If the trial shows the error rate is too high or the benefit too small, it gets switched off again and the numbers will show why. One honest limitation: the analytics page currently sits under SysAdmin, which ordinary moderators cannot see - so trial results must be actively published to moderators (on Discourse), not just "available". Widening who can see that page is a fair ask. |
+| **"A bad post is live before anyone can stop it - post-hoc review can't undo harm."** (Mike_Jury, Derek, Matty, Louise, Michael, Angelika; posts 5, 8, 29, 68, 132) | True, and not spun away: with auto-approve on, a bad post that passes the filters is publicly visible until someone acts. What bounds the harm: every post still goes through the content checks **before** publication; a suspect post stays in Pending exactly as now; there is a hold window (default 20 minutes) before anything goes live, during which it sits in your Pending queue and can be stopped; and a live post can be pulled straight back from the oversight queue with one click. Wider spread is also gated - see the rippling row below. The exposure is bounded, not zero. That is the trade being made, and the error rate will tell us its real size. |
+| **"The filters already miss dangerous things - phone numbers, addresses, child-safety risks."** (Bunny, Jane_L, Jax, Jeni, Mr_Men; posts 2, 4, 54, 277) | Also true - no filter is perfect, and specific misses reported in the thread (like multi-word phrases such as "discounted price") have already led to filter fixes. But note what does *not* change: the content checks run before publication for everyone, exactly as today, and a flagged post never auto-approves. The gap is posts that are dangerous in ways no filter recognises. Those get through **today** for the roughly half of posts that already publish instantly (trusted and unmoderated members). Auto-approve extends instant-ish publishing to more members, with *more* safeguards than the trusted tier has ever had: a delay, a danger-signal check on the poster, and an oversight queue. |
+| **"New members post incoherent rubbish - 'Any', 'Pond fish' - and no worry-word list catches that."** (Neville_Reid, Jeni, Jos, Andy, Sylvain; posts 13, 95, 112, 209, 306, 309) | The weakest spot in the design, said plainly. Vague-but-harmless posts are not what the filters or danger signals catch, so under auto-approve some will go live that you would have caught in Pending. What softens it: they appear in your Checked queue so they are findable without trawling the board; your group can lengthen its own delay (for example to a few hours) to widen the catch window; and a group that wants to keep full pre-moderation can (see autonomy row). If the trial shows Wanteds dominate the error rate, restricting auto-approve by post type (Offers first, as Jos and Neville suggested) is the obvious next lever - that is not built yet, and the error-rate split by type will show whether it is needed. |
+| **"I keep certain members on moderation for good reasons. Automation can't know that."** (Bunny, Matty, Neville_Reid, Jeni, Louise, Jax; posts 100, 114, 123, 134, 162) | This one is directly and fully honoured. A member you have explicitly set to **Moderated** (or Prohibited) is completely untouched - their posts wait for you, forever, exactly as now. Auto-approve only applies to members with **no explicit setting**. And even for those, it declines to act when there is any recorded reason for caution: a note on the member, a microvolunteer rejection on the post, a negative moderation action in the last 90 days, a spammer record, or an outstanding membership review. If you have ever written a note about someone, that note keeps them in Pending. |
+| **"Scammers and rule-breakers will exploit unchecked posting - they already reword to dodge filters."** (Matty, Saira, Jeni, Jane_L; posts 114, 122, 213, 216) | Known spammers and suspected spammers never auto-approve (any spammer record vetoes it, and a post in the Spam collection on *any* group blocks approval on all of them). A repeat offender your team has actioned in the last 90 days does not auto-approve either. The honest gap: a **first-time** bad actor with a clean record can get one post live for a while. That post is in the oversight queue, can be rejected in one click, and doing so creates exactly the negative history that stops their next one. |
+| **"Members don't report bad posts. The 'eagle-eyed members' safety net is imaginary."** (Jeni, Sylvain; posts 30, 110, 114) | Agreed, and the design does not rely on member reports. The active safety nets are the ones we run: your oversight queue, microvolunteer checks, the quality-check sample, and the automated checks. Member reports remain a bonus, not the mechanism. |
+| **"This means MORE work: wading through live posts, fixing errant ones, thanking reporters."** (Derek, Angelika, Jacky, Neville_Reid, Jos; posts 5, 87, 184, 306, 311, 312) | You do not have to wade through the board - that is what the **Checked** and **Trusted** queues are for. They contain exactly the posts that went live without a human, newest first, with a count of how many you have not yet seen, a one-click "mark all as checked", and a 7-day window so they never pile up into a mountain. Derek's point (post 311) that rippling has already made board-scanning impractical is precisely why oversight is a queue and not a scan. Whether *total* work goes up or down is measured in the trial, not asserted: if 97% of held posts genuinely need nothing, clicks should fall. If the fallout work exceeds the saved clicks - Saira reported exactly that from an earlier local experiment (post 41) - the numbers will show it. |
+| **"Groups set their rules deliberately. This overrides local autonomy with central control."** (Derek, Angelika, Vee, Liz_S, Gary_S, Melissa; posts 25, 87, 90, 130, 165) | A group keeps control. Auto-approve never runs on a group that is closed, unpublished, set to moderate everything (the Big Switch or "all posts moderated"), or whose rules say fully moderated. Each group can also set its own delay and its own quality-sample percentage. Explicit member posting statuses always win. What a group cannot do is stop *other* groups' posts reaching its members through rippling - that debate belongs to the rippling guide. |
+| **"This is really about making moderators redundant. Take away the work we enjoy and we leave."** (Louise, Angelika, Derek; posts 237, 245, 279 - and several mods said they would resign, posts 34, 41, 141) | No code change answers a feeling of being devalued, and people quitting over this is a real, already-partly-realised cost. What is factually true: the judgment work stays yours - suspect posts, flagged members, reports, rejections, member disputes all still come to you, and the routine 97% is what goes. The stated aim is redirecting volunteer attention, not removing it. Whether that is how it plays out is fair to judge by results, and the trial-first, switched-off-by-default rollout exists so that judgment can happen while it is still reversible. |
+| **"Human pre-moderation is Freegle's trust differentiator - dropping it risks members' and funders' confidence."** (Emma, Jacky, Louise, Susan; posts 27, 97, 103, 158) | A judgment call, honestly labelled as such. Two facts for the scales: about half of Freegle posts already publish without pre-moderation today (trusted and unmoderated members), and that has been true for years without being the thing members or funders notice; and human oversight does not disappear - it moves after publication and stays visible and provable (every check is recorded, see the last section). Freegle remains far more moderated than any of the platforms it is compared to. |
+| **"Instant posting breeds fastest-finger-first and undermines Fair Chance."** (Louise; posts 35, 114) | The delay means posting is not instant, and groups that run Fair Chance keep every tool they have now. But it is true that faster publication rewards quick responders slightly more than a moderation delay does. Nothing in this change alters reply handling or allocation; if a group's Fair Chance practice depends on the moderation delay itself, its own configurable delay is the lever. |
+| **"Pilot it properly or not at all."** (Craig, Matty, Jax, Susan, Louise, Gary_S, Mr_Men; posts 37, 49, 73, 170, 280) | That is the plan, and the code enforces it: switched off everywhere by default, an explicit trial-group list for a phased start, per-group opt-outs, live error-rate measurement, and a reversible switch. No big bang. |
+| **"A bad auto-approved post won't just hit my group - rippling will spread it to my neighbours."** (Jeni, post 306; Louise, post 302) | Addressed by the **earned-reach gate**: an auto-published post (one no human has looked at) waits about an hour before it starts rippling at all, and it can only keep spreading while human review keeps pace - each additional community it reaches requires sign-off from microvolunteers or a moderator check. No review, no spread: it stays local. Two microvolunteer rejections or one moderator rejection stop it and pull the copy back. Posts a moderator approved by hand are exempt, because they have had their human look. (Louise's observation in post 302 - instant rippling with no delay - describes rippling *today*, where nearly all posts have been human-approved; the hold arrives with auto-approve, for the posts that need it.) |
+| **"Something illegal goes live - flytipped goods, kerbside free-for-alls. Who is liable? Me?"** (Jane_L, post 4; Bunny, Derek, Louise; posts 226, 238, 258) | Legal responsibility for a post sits with the person who posted it - that principle is what lets any user-content platform operate, and it does not change here. What Freegle controls is how fast a problem post is caught: the checks before publication, the hold window, your oversight queue and the one-click reject are that machinery. Groups with rules about kerbside posts keep enforcing them exactly as now - nothing about auto-approve weakens a rejection. |
+
+If you raised something in that thread that is not represented above, or the response
+misstates your point, say so on the thread - this table is meant to be kept honest.
+
 ---
 
 ## The one big change
 
-> ### Settled members' posts now go live first, and you review them after - not before
+> ### Settled members' posts go live first, and you review them after - not before
 >
-> Until now, almost every member post sat in **Pending** until a moderator approved it.
-> With auto-approve, a content-checked, clean post from a **settled, auto-moderated
-> member** goes live by itself after a short delay (about 20 minutes by default), and you
-> review it **after** it is live, in a dedicated oversight queue.
+> Until now, a post from an **auto-moderated member** (one with no explicit posting
+> status) sat in **Pending** until a moderator approved it. With auto-approve switched
+> on, a content-checked, clean post from such a member goes live by itself after a short
+> delay (about 20 minutes by default), and you review it **after** it is live, in a
+> dedicated oversight queue.
 >
 > This is deliberate. It gets good posts moving quickly and focuses your attention on the
 > small number that actually need a human, instead of rubber-stamping the majority that
-> are obviously fine.
+> are approved unchanged.
 
 Nothing about a **suspect** post changes: if the content check flags it, or there is any
-danger signal (a recent mod note, a held/unheld history, a known-spammer record, a pending
-membership review, microvolunteer rejections), it **stays in Pending** exactly as before
-and waits for you.
+danger signal (a mod note on the member, a negative moderation action in the last 90 days,
+a known-spammer record, a pending membership review, a microvolunteer rejection), it
+**stays in Pending** exactly as before and waits for you.
+
+For scale: roughly half of all posts already publish without pre-moderation today, because
+they come from members you (or defaults) have marked trusted. Auto-approve extends
+quick publishing to the auto-moderated tier, with more safeguards attached than the
+trusted tier has.
+
+---
+
+## Switched off until deliberately switched on
+
+The feature is **dark by default**. Merging and deploying the code changes nothing.
+Rollout, when it comes, is phased:
+
+- A **trial-group list** lets it run on a handful of volunteer groups first, everywhere
+  else untouched.
+- Every group keeps its **opt-outs**: closed groups, "moderate everything" settings and
+  fully-moderated rules all exclude a group entirely.
+- Per group, the **delay** and the **quality-check sample percentage** are configurable.
+- The **error rate is measured from day one** (see the last section), so the decision to
+  widen, hold or reverse is made on numbers.
 
 ---
 
@@ -35,7 +97,8 @@ goes live. Two things are new:
 - **A live countdown.** Each post that is on the clean auto-approve path shows a small
   countdown to when it will auto-approve - a muted "~Nh" when it is more than an hour away,
   a prominent "Mm Ss" inside the last 30 minutes, and "Auto-approving..." at zero. Posts
-  that are **not** auto-approving (suspect, spam, held) show no countdown.
+  that are **not** auto-approving (suspect, spam, held, or feature off for your group) show
+  no 20-minute countdown.
 - **A guaranteed review window.** The moment you open the Pending queue, every post on it
   is given **at least 10 more minutes** before it can auto-approve. Nothing ever
   auto-approves out from under you while you are looking at the page.
@@ -58,6 +121,10 @@ blue, not the red of Pending), and they drop as you check things off. A **"Mark
 checked"** button clears the bucket in one go. Posts older than **7 days** fall off the
 queue on their own, so it always reflects recent activity rather than growing forever.
 
+Posts that merely **rippled in** from another community do not appear in your oversight
+queues - overseeing those is the job of the community they were posted to, plus the
+review that gates their spread (below).
+
 ---
 
 ## Rejecting a post after it has gone live
@@ -68,7 +135,7 @@ from that queue**. It is pulled back out of the live feed and returned to Pendin
 it can be dealt with properly, exactly as if it had never auto-approved.
 
 This is the safety net for the rare post that slips through the automatic checks: it went
-live quickly, but you can still take it down quickly.
+live quickly, but you can take it down just as quickly.
 
 ---
 
@@ -77,7 +144,7 @@ live quickly, but you can still take it down quickly.
 This is where auto-approve and rippling out meet, so it is worth understanding.
 
 A live post can **ripple out** to neighbouring communities (see the rippling guide). A
-post that auto-approved has not yet been looked at by a human, so we do **not** let it
+post that auto-approved has not been looked at by a human, so we do **not** let it
 spread network-wide unchecked. Instead, **reach is earned by review**:
 
 - **A head start before any spread.** A freshly auto-approved post waits about **an hour**
@@ -94,6 +161,8 @@ spread network-wide unchecked. Instead, **reach is earned by review**:
 - **Stopping it is easy and does not scale.** The opposite of approval is cheap: **2
   microvolunteer rejections, or 1 moderator rejection**, on *any* copy halts the spread and
   pulls that copy back. Easy to stop, proportionally hard to spread.
+- **Mod-approved posts are exempt.** A post you approved by hand has had its human look
+  and ripples normally.
 
 The short version: **a post's reach can only run as far ahead as its review.**
 
@@ -117,12 +186,16 @@ In short: we only ask the people the post can actually reach, closest first.
 
 ## What to expect, and the habits to build
 
-1. **Don't be alarmed that posts are live before you saw them.** That is the design. Your
-   job shifts from approving everything up front to keeping half an eye on the **Checked**
-   and **Trusted** queues and acting on the rare one that is wrong.
-2. **Use the reject action** for a genuinely unsuitable post you find live - it pulls it
+1. **Nothing changes until it is switched on for your group** - and if your group is set
+   to moderate everything, it stays that way.
+2. **Posts being live before you saw them is the design, not a fault.** Your job shifts
+   from approving everything up front to keeping half an eye on the **Checked** and
+   **Trusted** queues and acting on the rare one that is wrong.
+3. **Use the reject action** for a genuinely unsuitable post you find live - it pulls it
    straight back.
-3. **"Out of area" is still never a reason to reject** (see the rippling guide). A post
+4. **Your member notes matter more than ever.** A note on a member keeps their posts in
+   Pending. If you know a reason someone needs a human eye, write it down.
+5. **"Out of area" is still never a reason to reject** (see the rippling guide). A post
    reaching you from a neighbouring community is the system working, not a fault.
 
 Everything else about your day-to-day moderation routine stays the same.
@@ -133,7 +206,9 @@ Everything else about your day-to-day moderation routine stays the same.
 
 When you check an auto-published post (individually or via "Mark all as checked"), we
 record **who** checked it and **when**. This is what makes the unchecked counts drop, and
-it feeds the **Moderation** tab under SysAdmin, which shows where posts went (arrived,
-approved or rejected by hand, auto-approved, trusted) and the **auto-publish error rate** -
-how often an auto-published post later needed a moderator to step in. That number is how we
-know auto-approve is safe, and how we tune it.
+it feeds the **Moderation** analytics under SysAdmin: where posts went (arrived, approved
+or rejected by hand, auto-approved, trusted), the **auto-publish error rate** - how often
+an auto-published post later needed a moderator to step in - and how the held-back
+quality-check sample compares against it. Those numbers are how the trial gets judged,
+how auto-approve is tuned, and how it would be caught out if the objections above turn
+out to be right.

From 93dba7b5edcc98abcc21f556ad872b51d70be842 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Sat, 4 Jul 2026 10:32:28 +0100
Subject: [PATCH 23/26] docs(moderation): objections table - anonymous
 attributions, honest consultation and autonomy rows

Per review: personal names removed from the objection attributions (post numbers
kept - the thread carries the names for anyone who wants them); the consultation
row answers the process objection on its own terms (input visibly changed the
design; 'no' remains an available outcome; success criteria to be stated before
the trial) instead of pointing at rollout switches; the autonomy row states
plainly that groups will not be able to opt out of post-moderation itself, and
lists what does stay under local control; the Fair Chance row notes the model is
old and a better allocation design deserves its own proposal.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHiCAjJKX7CemYZEJUntt9
---
 AUTO-APPROVE-FOR-MODERATORS.md | 44 +++++++++++++++++-----------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/AUTO-APPROVE-FOR-MODERATORS.md b/AUTO-APPROVE-FOR-MODERATORS.md
index 2134cc57cc..78d6289c0e 100644
--- a/AUTO-APPROVE-FOR-MODERATORS.md
+++ b/AUTO-APPROVE-FOR-MODERATORS.md
@@ -21,27 +21,27 @@ decision rests with the Board, informed by the trial.
 This change was discussed at length by moderators in
 [Evolution of our approach](https://discourse.ilovefreegle.org/t/evolution-of-our-approach-improving-the-freegle-experience/9620)
 (over 300 posts). Those objections shaped what was actually built. Before anything else,
-here is each substantial objection raised there, who raised it, and an honest statement of
-how the design answers it - or does not. Post numbers refer to that thread.
+here is each substantial objection raised there and an honest statement of how the design
+answers it - or does not. Post numbers refer to that thread.
 
 | The objection | Honest response |
 |---|---|
-| **"You've already decided - this consultation is fake."** (Louise, Jeni, Matty, Vee, Emma, Angelika and others; posts 31, 78, 118, 138, 290) | The criticism of how this was communicated is fair, and announcing progress in a passing comment on another thread was handled badly. What the code now guarantees: the feature ships **switched off by default**. Deploying it changes nothing. Turning it on is a deliberate, reversible act, group by group if need be, and the decision rests with the Board, not with the code being merged. |
-| **"Where's the evidence this is a problem? 97% approval could just mean moderation works."** (Jeni, Angelika, Sylvain, Matty, Derek and others; posts 26, 30, 51, 137) | Partly conceded: we cannot prove in advance that faster posting grows Freegle. That is exactly why the build includes measurement rather than faith: every auto-published post is tracked, a random sample can be held back for human checking as a control, and the **auto-publish error rate** (how often a mod later had to step in) is computed continuously. If the trial shows the error rate is too high or the benefit too small, it gets switched off again and the numbers will show why. One honest limitation: the analytics page currently sits under SysAdmin, which ordinary moderators cannot see - so trial results must be actively published to moderators (on Discourse), not just "available". Widening who can see that page is a fair ask. |
-| **"A bad post is live before anyone can stop it - post-hoc review can't undo harm."** (Mike_Jury, Derek, Matty, Louise, Michael, Angelika; posts 5, 8, 29, 68, 132) | True, and not spun away: with auto-approve on, a bad post that passes the filters is publicly visible until someone acts. What bounds the harm: every post still goes through the content checks **before** publication; a suspect post stays in Pending exactly as now; there is a hold window (default 20 minutes) before anything goes live, during which it sits in your Pending queue and can be stopped; and a live post can be pulled straight back from the oversight queue with one click. Wider spread is also gated - see the rippling row below. The exposure is bounded, not zero. That is the trade being made, and the error rate will tell us its real size. |
-| **"The filters already miss dangerous things - phone numbers, addresses, child-safety risks."** (Bunny, Jane_L, Jax, Jeni, Mr_Men; posts 2, 4, 54, 277) | Also true - no filter is perfect, and specific misses reported in the thread (like multi-word phrases such as "discounted price") have already led to filter fixes. But note what does *not* change: the content checks run before publication for everyone, exactly as today, and a flagged post never auto-approves. The gap is posts that are dangerous in ways no filter recognises. Those get through **today** for the roughly half of posts that already publish instantly (trusted and unmoderated members). Auto-approve extends instant-ish publishing to more members, with *more* safeguards than the trusted tier has ever had: a delay, a danger-signal check on the poster, and an oversight queue. |
-| **"New members post incoherent rubbish - 'Any', 'Pond fish' - and no worry-word list catches that."** (Neville_Reid, Jeni, Jos, Andy, Sylvain; posts 13, 95, 112, 209, 306, 309) | The weakest spot in the design, said plainly. Vague-but-harmless posts are not what the filters or danger signals catch, so under auto-approve some will go live that you would have caught in Pending. What softens it: they appear in your Checked queue so they are findable without trawling the board; your group can lengthen its own delay (for example to a few hours) to widen the catch window; and a group that wants to keep full pre-moderation can (see autonomy row). If the trial shows Wanteds dominate the error rate, restricting auto-approve by post type (Offers first, as Jos and Neville suggested) is the obvious next lever - that is not built yet, and the error-rate split by type will show whether it is needed. |
-| **"I keep certain members on moderation for good reasons. Automation can't know that."** (Bunny, Matty, Neville_Reid, Jeni, Louise, Jax; posts 100, 114, 123, 134, 162) | This one is directly and fully honoured. A member you have explicitly set to **Moderated** (or Prohibited) is completely untouched - their posts wait for you, forever, exactly as now. Auto-approve only applies to members with **no explicit setting**. And even for those, it declines to act when there is any recorded reason for caution: a note on the member, a microvolunteer rejection on the post, a negative moderation action in the last 90 days, a spammer record, or an outstanding membership review. If you have ever written a note about someone, that note keeps them in Pending. |
-| **"Scammers and rule-breakers will exploit unchecked posting - they already reword to dodge filters."** (Matty, Saira, Jeni, Jane_L; posts 114, 122, 213, 216) | Known spammers and suspected spammers never auto-approve (any spammer record vetoes it, and a post in the Spam collection on *any* group blocks approval on all of them). A repeat offender your team has actioned in the last 90 days does not auto-approve either. The honest gap: a **first-time** bad actor with a clean record can get one post live for a while. That post is in the oversight queue, can be rejected in one click, and doing so creates exactly the negative history that stops their next one. |
-| **"Members don't report bad posts. The 'eagle-eyed members' safety net is imaginary."** (Jeni, Sylvain; posts 30, 110, 114) | Agreed, and the design does not rely on member reports. The active safety nets are the ones we run: your oversight queue, microvolunteer checks, the quality-check sample, and the automated checks. Member reports remain a bonus, not the mechanism. |
-| **"This means MORE work: wading through live posts, fixing errant ones, thanking reporters."** (Derek, Angelika, Jacky, Neville_Reid, Jos; posts 5, 87, 184, 306, 311, 312) | You do not have to wade through the board - that is what the **Checked** and **Trusted** queues are for. They contain exactly the posts that went live without a human, newest first, with a count of how many you have not yet seen, a one-click "mark all as checked", and a 7-day window so they never pile up into a mountain. Derek's point (post 311) that rippling has already made board-scanning impractical is precisely why oversight is a queue and not a scan. Whether *total* work goes up or down is measured in the trial, not asserted: if 97% of held posts genuinely need nothing, clicks should fall. If the fallout work exceeds the saved clicks - Saira reported exactly that from an earlier local experiment (post 41) - the numbers will show it. |
-| **"Groups set their rules deliberately. This overrides local autonomy with central control."** (Derek, Angelika, Vee, Liz_S, Gary_S, Melissa; posts 25, 87, 90, 130, 165) | A group keeps control. Auto-approve never runs on a group that is closed, unpublished, set to moderate everything (the Big Switch or "all posts moderated"), or whose rules say fully moderated. Each group can also set its own delay and its own quality-sample percentage. Explicit member posting statuses always win. What a group cannot do is stop *other* groups' posts reaching its members through rippling - that debate belongs to the rippling guide. |
-| **"This is really about making moderators redundant. Take away the work we enjoy and we leave."** (Louise, Angelika, Derek; posts 237, 245, 279 - and several mods said they would resign, posts 34, 41, 141) | No code change answers a feeling of being devalued, and people quitting over this is a real, already-partly-realised cost. What is factually true: the judgment work stays yours - suspect posts, flagged members, reports, rejections, member disputes all still come to you, and the routine 97% is what goes. The stated aim is redirecting volunteer attention, not removing it. Whether that is how it plays out is fair to judge by results, and the trial-first, switched-off-by-default rollout exists so that judgment can happen while it is still reversible. |
-| **"Human pre-moderation is Freegle's trust differentiator - dropping it risks members' and funders' confidence."** (Emma, Jacky, Louise, Susan; posts 27, 97, 103, 158) | A judgment call, honestly labelled as such. Two facts for the scales: about half of Freegle posts already publish without pre-moderation today (trusted and unmoderated members), and that has been true for years without being the thing members or funders notice; and human oversight does not disappear - it moves after publication and stays visible and provable (every check is recorded, see the last section). Freegle remains far more moderated than any of the platforms it is compared to. |
-| **"Instant posting breeds fastest-finger-first and undermines Fair Chance."** (Louise; posts 35, 114) | The delay means posting is not instant, and groups that run Fair Chance keep every tool they have now. But it is true that faster publication rewards quick responders slightly more than a moderation delay does. Nothing in this change alters reply handling or allocation; if a group's Fair Chance practice depends on the moderation delay itself, its own configurable delay is the lever. |
-| **"Pilot it properly or not at all."** (Craig, Matty, Jax, Susan, Louise, Gary_S, Mr_Men; posts 37, 49, 73, 170, 280) | That is the plan, and the code enforces it: switched off everywhere by default, an explicit trial-group list for a phased start, per-group opt-outs, live error-rate measurement, and a reversible switch. No big bang. |
-| **"A bad auto-approved post won't just hit my group - rippling will spread it to my neighbours."** (Jeni, post 306; Louise, post 302) | Addressed by the **earned-reach gate**: an auto-published post (one no human has looked at) waits about an hour before it starts rippling at all, and it can only keep spreading while human review keeps pace - each additional community it reaches requires sign-off from microvolunteers or a moderator check. No review, no spread: it stays local. Two microvolunteer rejections or one moderator rejection stop it and pull the copy back. Posts a moderator approved by hand are exempt, because they have had their human look. (Louise's observation in post 302 - instant rippling with no delay - describes rippling *today*, where nearly all posts have been human-approved; the hold arrives with auto-approve, for the posts that need it.) |
-| **"Something illegal goes live - flytipped goods, kerbside free-for-alls. Who is liable? Me?"** (Jane_L, post 4; Bunny, Derek, Louise; posts 226, 238, 258) | Legal responsibility for a post sits with the person who posted it - that principle is what lets any user-content platform operate, and it does not change here. What Freegle controls is how fast a problem post is caught: the checks before publication, the hold window, your oversight queue and the one-click reject are that machinery. Groups with rules about kerbside posts keep enforcing them exactly as now - nothing about auto-approve weakens a rejection. |
+| **"You've already decided - this consultation is fake."** (many moderators; posts 31, 78, 118, 138, 290) | The criticism of the process is fair: progress was announced in a passing comment on another thread, and that was handled badly. The only honest test of whether consultation is real is whether input changes outcomes, so judge it on that: the objections in this thread are why explicitly-moderated members stay moderated, why member notes veto auto-approval, why oversight is a queue rather than a board-scan, why there is a quality-check control sample and a published error rate at all, and why the rollout is a small opt-in trial rather than a network-wide switch. The decision to go beyond a trial has not been made, "no" remains an available answer, and it should be made against error-rate results shared with moderators - with the success and failure criteria stated before the trial starts, not after. |
+| **"Where's the evidence this is a problem? 97% approval could just mean moderation works."** (many moderators; posts 26, 30, 51, 137) | Partly conceded: we cannot prove in advance that faster posting grows Freegle. That is exactly why the build includes measurement rather than faith: every auto-published post is tracked, a random sample can be held back for human checking as a control, and the **auto-publish error rate** (how often a mod later had to step in) is computed continuously. If the trial shows the error rate is too high or the benefit too small, it gets switched off again and the numbers will show why. One honest limitation: the analytics page currently sits under SysAdmin, which ordinary moderators cannot see - so trial results must be actively published to moderators (on Discourse), not just "available". Widening who can see that page is a fair ask. |
+| **"A bad post is live before anyone can stop it - post-hoc review can't undo harm."** (several moderators; posts 5, 8, 29, 68, 132) | True, and not spun away: with auto-approve on, a bad post that passes the filters is publicly visible until someone acts. What bounds the harm: every post still goes through the content checks **before** publication; a suspect post stays in Pending exactly as now; there is a hold window (default 20 minutes) before anything goes live, during which it sits in your Pending queue and can be stopped; and a live post can be pulled straight back from the oversight queue with one click. Wider spread is also gated - see the rippling row below. The exposure is bounded, not zero. That is the trade being made, and the error rate will tell us its real size. |
+| **"The filters already miss dangerous things - phone numbers, addresses, child-safety risks."** (several moderators; posts 2, 4, 54, 277) | Also true - no filter is perfect, and specific misses reported in the thread (like multi-word phrases such as "discounted price") have already led to filter fixes. But note what does *not* change: the content checks run before publication for everyone, exactly as today, and a flagged post never auto-approves. The gap is posts that are dangerous in ways no filter recognises. Those get through **today** for the roughly half of posts that already publish instantly (trusted and unmoderated members). Auto-approve extends instant-ish publishing to more members, with *more* safeguards than the trusted tier has ever had: a delay, a danger-signal check on the poster, and an oversight queue. |
+| **"New members post incoherent rubbish - 'Any', 'Pond fish' - and no worry-word list catches that."** (several moderators; posts 13, 95, 112, 209, 306, 309) | The weakest spot in the design, said plainly. Vague-but-harmless posts are not what the filters or danger signals catch, so under auto-approve some will go live that you would have caught in Pending. What softens it: they appear in your Checked queue so they are findable without trawling the board, and your group can lengthen its own delay (for example to a few hours) to widen the catch window. If the trial shows Wanteds dominate the error rate, restricting auto-approve by post type (Offers first, as suggested in posts 13 and 308) is the obvious next lever - that is not built yet, and the error-rate split by type will show whether it is needed. |
+| **"I keep certain members on moderation for good reasons. Automation can't know that."** (several moderators; posts 100, 114, 123, 134, 162) | This one is directly and fully honoured. A member you have explicitly set to **Moderated** (or Prohibited) is completely untouched - their posts wait for you, forever, exactly as now. Auto-approve only applies to members with **no explicit setting**. And even for those, it declines to act when there is any recorded reason for caution: a note on the member, a microvolunteer rejection on the post, a negative moderation action in the last 90 days, a spammer record, or an outstanding membership review. If you have ever written a note about someone, that note keeps them in Pending. |
+| **"Scammers and rule-breakers will exploit unchecked posting - they already reword to dodge filters."** (several moderators; posts 114, 122, 213, 216) | Known spammers and suspected spammers never auto-approve (any spammer record vetoes it, and a post in the Spam collection on *any* group blocks approval on all of them). A repeat offender your team has actioned in the last 90 days does not auto-approve either. The honest gap: a **first-time** bad actor with a clean record can get one post live for a while. That post is in the oversight queue, can be rejected in one click, and doing so creates exactly the negative history that stops their next one. |
+| **"Members don't report bad posts. The 'eagle-eyed members' safety net is imaginary."** (posts 30, 110, 114) | Agreed, and the design does not rely on member reports. The active safety nets are the ones we run: your oversight queue, microvolunteer checks, the quality-check sample, and the automated checks. Member reports remain a bonus, not the mechanism. |
+| **"This means MORE work: wading through live posts, fixing errant ones, thanking reporters."** (several moderators; posts 5, 87, 184, 306, 311, 312) | You do not have to wade through the board - that is what the **Checked** and **Trusted** queues are for. They contain exactly the posts that went live without a human, newest first, with a count of how many you have not yet seen, a one-click "mark all as checked", and a 7-day window so they never pile up into a mountain. The point made in post 311 - that rippling has already made board-scanning impractical - is precisely why oversight is a queue and not a scan. Whether *total* work goes up or down is measured in the trial, not asserted: if 97% of held posts genuinely need nothing, clicks should fall. If the fallout work exceeds the saved clicks - one moderator reported exactly that from an earlier local experiment (post 41) - the numbers will show it. |
+| **"Groups set their rules deliberately. This overrides local autonomy with central control."** (several moderators; posts 25, 87, 90, 130, 165) | Stated plainly rather than softened: post-moderation is intended as how Freegle works, network-wide - groups will not have a setting to opt out of it, because a patchwork of moderation models would confuse members and undo the point of the change. What stays under local control: every explicit member posting status you set is honoured absolutely (a member you keep on Moderated waits for you, forever), your notes on members veto auto-approval, your group tunes its own delay and quality-sample percentage, and your rules are enforced by you exactly as now - rejecting a rule-breaking post is unchanged. Rippling questions belong to the rippling guide. |
+| **"This is really about making moderators redundant. Take away the work we enjoy and we leave."** (posts 237, 245, 279 - and several moderators said they would resign, posts 34, 41, 141) | No code change answers a feeling of being devalued, and people quitting over this is a real, already-partly-realised cost. What is factually true: the judgment work stays yours - suspect posts, flagged members, reports, rejections, member disputes all still come to you, and the routine 97% is what goes. The stated aim is redirecting volunteer attention, not removing it. Whether that is how it plays out is fair to judge by results, and the trial-first, switched-off-by-default rollout exists so that judgment can happen while it is still reversible. |
+| **"Human pre-moderation is Freegle's trust differentiator - dropping it risks members' and funders' confidence."** (several moderators; posts 27, 97, 103, 158) | A judgment call, honestly labelled as such. Two facts for the scales: about half of Freegle posts already publish without pre-moderation today (trusted and unmoderated members), and that has been true for years without being the thing members or funders notice; and human oversight does not disappear - it moves after publication and stays visible and provable (every check is recorded, see the last section). Freegle remains far more moderated than any of the platforms it is compared to. |
+| **"Instant posting breeds fastest-finger-first and undermines Fair Chance."** (posts 35, 114) | The delay means posting is not instant, and nothing in this change alters reply handling or allocation. But the underlying point is fair: faster publication does reward quick responders, and leaning on a moderation delay to blunt that was always indirect. Fair Chance itself is a very old model, and a better one is worth designing in its own right - for example a short reply-gathering window on each post before the offerer chooses, so being first matters less than being suitable. Faster publication makes that work more worthwhile, not less; it deserves its own proposal rather than a footnote here. |
+| **"Pilot it properly or not at all."** (many moderators; posts 37, 49, 73, 170, 280) | That is the plan, and the code enforces it: switched off everywhere by default, an explicit trial-group list for a phased start, live error-rate measurement, and a reversible switch. No big bang. |
+| **"A bad auto-approved post won't just hit my group - rippling will spread it to my neighbours."** (posts 302, 306) | Addressed by the **earned-reach gate**: an auto-published post (one no human has looked at) waits about an hour before it starts rippling at all, and it can only keep spreading while human review keeps pace - each additional community it reaches requires sign-off from microvolunteers or a moderator check. No review, no spread: it stays local. Two microvolunteer rejections or one moderator rejection stop it and pull the copy back. Posts a moderator approved by hand are exempt, because they have had their human look. (The observation in post 302 - instant rippling with no delay - describes rippling *today*, where nearly all posts have been human-approved; the hold arrives with auto-approve, for the posts that need it.) |
+| **"Something illegal goes live - flytipped goods, kerbside free-for-alls. Who is liable? Me?"** (posts 4, 226, 238, 258) | Legal responsibility for a post sits with the person who posted it - that principle is what lets any user-content platform operate, and it does not change here. What Freegle controls is how fast a problem post is caught: the checks before publication, the hold window, your oversight queue and the one-click reject are that machinery. Groups with rules about kerbside posts keep enforcing them exactly as now - nothing about auto-approve weakens a rejection. |
 
 If you raised something in that thread that is not represented above, or the response
 misstates your point, say so on the thread - this table is meant to be kept honest.
@@ -81,9 +81,10 @@ Rollout, when it comes, is phased:
 
 - A **trial-group list** lets it run on a handful of volunteer groups first, everywhere
   else untouched.
-- Every group keeps its **opt-outs**: closed groups, "moderate everything" settings and
-  fully-moderated rules all exclude a group entirely.
 - Per group, the **delay** and the **quality-check sample percentage** are configurable.
+- There is no per-group setting to opt out of post-moderation itself: once rolled out it
+  is how Freegle works everywhere, so members get one consistent experience. Member-level
+  control (explicit posting statuses, notes) is untouched.
 - The **error rate is measured from day one** (see the last section), so the decision to
   widen, hold or reverse is made on numbers.
 
@@ -186,8 +187,7 @@ In short: we only ask the people the post can actually reach, closest first.
 
 ## What to expect, and the habits to build
 
-1. **Nothing changes until it is switched on for your group** - and if your group is set
-   to moderate everything, it stays that way.
+1. **Nothing changes until it is switched on for your group.**
 2. **Posts being live before you saw them is the design, not a fault.** Your job shifts
    from approving everything up front to keeping half an eye on the **Checked** and
    **Trusted** queues and acting on the rare one that is wrong.

From 8f427da83c33f45e28aba0ac806965e3523e3cdd Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Sat, 4 Jul 2026 10:40:25 +0100
Subject: [PATCH 24/26] feat(ripple): earn reach by clean exposure, not
 reviewer sign-off

Requiring microvolunteer/moderator approval per community before a post may
ripple could never keep pace with post volume - it would quietly stop rippling
for most posts. The earned-reach cap now keys on views-without-complaint:
a post may ripple into N communities while RIPPLE_CLEAN_VIEWS_PER_GROUP
(default 5) distinct members per community have seen it (messages_likes View,
poster excluded) and nobody has flagged it. A flag - a member report to the
mods (User2Mod chat message referencing the post) or a microvolunteer Reject -
pauses all further spread; a moderator look (approvedby/checkedat) clears the
gate outright. The 1h hold, pause instrumentation and dark-by-default flag are
unchanged. Mod guide updated to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHiCAjJKX7CemYZEJUntt9
---
 AUTO-APPROVE-FOR-MODERATORS.md                |  54 ++++---
 .../app/Services/Ripple/ExpandService.php     |  78 +++++++---
 iznik-batch/config/freegle.php                |   9 +-
 .../Services/Ripple/ExpandServiceTest.php     | 142 +++++++++++++-----
 4 files changed, 203 insertions(+), 80 deletions(-)

diff --git a/AUTO-APPROVE-FOR-MODERATORS.md b/AUTO-APPROVE-FOR-MODERATORS.md
index 78d6289c0e..4a833daeb4 100644
--- a/AUTO-APPROVE-FOR-MODERATORS.md
+++ b/AUTO-APPROVE-FOR-MODERATORS.md
@@ -40,7 +40,7 @@ answers it - or does not. Post numbers refer to that thread.
 | **"Human pre-moderation is Freegle's trust differentiator - dropping it risks members' and funders' confidence."** (several moderators; posts 27, 97, 103, 158) | A judgment call, honestly labelled as such. Two facts for the scales: about half of Freegle posts already publish without pre-moderation today (trusted and unmoderated members), and that has been true for years without being the thing members or funders notice; and human oversight does not disappear - it moves after publication and stays visible and provable (every check is recorded, see the last section). Freegle remains far more moderated than any of the platforms it is compared to. |
 | **"Instant posting breeds fastest-finger-first and undermines Fair Chance."** (posts 35, 114) | The delay means posting is not instant, and nothing in this change alters reply handling or allocation. But the underlying point is fair: faster publication does reward quick responders, and leaning on a moderation delay to blunt that was always indirect. Fair Chance itself is a very old model, and a better one is worth designing in its own right - for example a short reply-gathering window on each post before the offerer chooses, so being first matters less than being suitable. Faster publication makes that work more worthwhile, not less; it deserves its own proposal rather than a footnote here. |
 | **"Pilot it properly or not at all."** (many moderators; posts 37, 49, 73, 170, 280) | That is the plan, and the code enforces it: switched off everywhere by default, an explicit trial-group list for a phased start, live error-rate measurement, and a reversible switch. No big bang. |
-| **"A bad auto-approved post won't just hit my group - rippling will spread it to my neighbours."** (posts 302, 306) | Addressed by the **earned-reach gate**: an auto-published post (one no human has looked at) waits about an hour before it starts rippling at all, and it can only keep spreading while human review keeps pace - each additional community it reaches requires sign-off from microvolunteers or a moderator check. No review, no spread: it stays local. Two microvolunteer rejections or one moderator rejection stop it and pull the copy back. Posts a moderator approved by hand are exempt, because they have had their human look. (The observation in post 302 - instant rippling with no delay - describes rippling *today*, where nearly all posts have been human-approved; the hold arrives with auto-approve, for the posts that need it.) |
+| **"A bad auto-approved post won't just hit my group - rippling will spread it to my neighbours."** (posts 302, 306) | Addressed by the **earned-reach gate**: an auto-published post (one no human has looked at) waits about an hour before it starts rippling at all, and it then spreads only as fast as clean exposure accumulates - each additional community it reaches requires that a number of members have already seen the post with nobody flagging it. A single member report, or a microvolunteer rejection, pauses further spread until a moderator looks; a moderator check clears it, and a rejection pulls it back. Posts a moderator approved by hand are exempt, because they have had their human look. (Requiring active reviewer sign-off per community was considered and dropped - review capacity could never keep up with post volume, so it would have quietly stopped rippling for most posts.) (The observation in post 302 - instant rippling with no delay - describes rippling *today*, where nearly all posts have been human-approved; the hold arrives with auto-approve, for the posts that need it.) |
 | **"Something illegal goes live - flytipped goods, kerbside free-for-alls. Who is liable? Me?"** (posts 4, 226, 238, 258) | Legal responsibility for a post sits with the person who posted it - that principle is what lets any user-content platform operate, and it does not change here. What Freegle controls is how fast a problem post is caught: the checks before publication, the hold window, your oversight queue and the one-click reject are that machinery. Groups with rules about kerbside posts keep enforcing them exactly as now - nothing about auto-approve weakens a rejection. |
 
 If you raised something in that thread that is not represented above, or the response
@@ -146,42 +146,46 @@ This is where auto-approve and rippling out meet, so it is worth understanding.
 
 A live post can **ripple out** to neighbouring communities (see the rippling guide). A
 post that auto-approved has not been looked at by a human, so we do **not** let it
-spread network-wide unchecked. Instead, **reach is earned by review**:
+spread network-wide unchecked. Instead, **reach is earned by exposure without
+complaint** - the people who have already seen the post vouch for it by not objecting:
 
 - **A head start before any spread.** A freshly auto-approved post waits about **an hour**
-  before it starts rippling at all, giving its home community's reviewers first look.
-- **Wider reach needs proportional review.** To ripple into more communities, a post has
-  to earn review in step with how far it is going. **Each new community it reaches needs
-  its own light sign-off: 2 microvolunteer approvals, or 1 moderator check, from within
-  that community's reach.** So reaching **2 new communities needs 4 microvolunteer
-  approvals or 2 moderator checks** (or a mix - a moderator check counts as two
-  microvolunteer approvals).
-- **No review means it stays local.** If a post does not earn that sign-off, it simply
-  **stops spreading** and stays close to home. It is not withdrawn - it just does not go
-  wider. Well-reviewed posts spread fast and far; unreviewed ones stay local.
-- **Stopping it is easy and does not scale.** The opposite of approval is cheap: **2
-  microvolunteer rejections, or 1 moderator rejection**, on *any* copy halts the spread and
-  pulls that copy back. Easy to stop, proportionally hard to spread.
+  before it starts rippling at all, giving its home community first look.
+- **Wider reach needs more quiet eyes.** Each additional community a post ripples into
+  requires that a number of members have **already seen it and nobody has flagged it**.
+  Views accumulate naturally as people browse, so a normal post earns its spread simply
+  by being seen; a post nobody is seeing stays local.
+- **One complaint pauses it.** A member reporting the post to the mods, or a
+  microvolunteer rejecting it, **pauses all further spread** until a moderator looks.
+  Copies it has already reached stay put; it just goes no further.
+- **A moderator look settles it.** Your check clears the gate entirely (a human look
+  outranks the crowd signal); your rejection pulls it back. Requiring active
+  microvolunteer or moderator sign-off for every community was considered and dropped:
+  review capacity could never keep pace with post volume, and rippling would have
+  quietly stopped working for most posts.
 - **Mod-approved posts are exempt.** A post you approved by hand has had its human look
   and ripples normally.
 
-The short version: **a post's reach can only run as far ahead as its review.**
+The short version: **a post spreads as far as the quiet approval of the people who have
+already seen it - and one objection stops it until a human decides.**
 
 ---
 
 ## Who does the reviewing
 
-The review that earns reach comes from two pools, and **both are drawn from inside the
-post's maximum ripple area, nearest first**:
+The earning is passive - members seeing the post as they browse. The active roles are
+the brakes and the all-clear, and both are drawn from **inside the post's maximum ripple
+area, nearest first**:
 
-- **Microvolunteers** inside the area the post can reach are asked to look, with the people
-  **closest to the post** asked first - they are the ones most likely to have useful local
-  context.
-- **Moderators** of communities inside that same area provide the moderator sign-off. A
-  moderator of a community the post will never reach does not gate it - which is only fair,
-  since it was never going to land on them.
+- **Microvolunteers** inside the area the post can reach are asked to look, with the
+  people **closest to the post** asked first - they are the ones most likely to have
+  useful local context. Their rejection pauses the post's spread.
+- **Moderators** of communities inside that same area can check a post (clearing its
+  gate) or reject it (pulling it back). A moderator of a community the post will never
+  reach is never involved - which is only fair, since it was never going to land on them.
 
-In short: we only ask the people the post can actually reach, closest first.
+In short: everyone who sees the post quietly vouches for it; the people it can actually
+reach, closest first, hold the brake.
 
 ---
 
diff --git a/iznik-batch/app/Services/Ripple/ExpandService.php b/iznik-batch/app/Services/Ripple/ExpandService.php
index 104ed7dfed..ebc36d7ecc 100644
--- a/iznik-batch/app/Services/Ripple/ExpandService.php
+++ b/iznik-batch/app/Services/Ripple/ExpandService.php
@@ -1136,22 +1136,56 @@ private function reachableGateEnabled(): bool
      * Pending so AutoApproveService approves it after the mod-veto window.
      */
     /**
-     * Review weight for the earned-reach cap: 1 per microvol Approve on the post, plus 2 per
-     * messages_groups row with checkedat set (a mod check, on any of the post's groups). The cap
-     * lets a post ripple into N communities while weight >= 2*N.
+     * Earned-reach signals. Reach is earned by clean EXPOSURE, not by active reviewer
+     * sign-off: a per-community microvolunteer/moderator approval requirement could never
+     * keep up with post volume, so it would stall rippling for nearly every post. Instead,
+     * members who have seen the post without anyone flagging it vouch for it passively.
      */
-    private function reviewWeight(int $msgid): int
+
+    /** Distinct members other than the poster who have viewed the post (browse dwell,
+     *  expand-in-list and message-page views all record a messages_likes View row). */
+    private function cleanViews(int $msgid, int $fromuser): int
     {
-        $microvolApproves = (int) DB::selectOne(
-            "SELECT COUNT(*) AS n FROM microactions WHERE msgid = ? AND result = 'Approve'",
-            [$msgid]
+        return (int) DB::selectOne(
+            "SELECT COUNT(DISTINCT userid) AS n FROM messages_likes
+             WHERE msgid = ? AND type = 'View' AND userid != ?",
+            [$msgid, $fromuser]
         )->n;
-        $modChecks = (int) DB::selectOne(
-            'SELECT COUNT(*) AS n FROM messages_groups WHERE msgid = ? AND checkedat IS NOT NULL',
-            [$msgid]
+    }
+
+    /**
+     * Someone flagged the post: a member wrote to a mod team about it (a User2Mod chat
+     * message referencing the post, which is exactly what the front-end report flow sends),
+     * or a microvolunteer rejected it. Conservative on purpose - a false positive merely
+     * pauses further spread until a moderator looks.
+     */
+    private function isFlagged(int $msgid, int $fromuser): bool
+    {
+        $reported = (int) DB::selectOne(
+            "SELECT COUNT(*) AS n FROM chat_messages cm
+             INNER JOIN chat_rooms cr ON cr.id = cm.chatid AND cr.chattype = 'User2Mod'
+             WHERE cm.refmsgid = ? AND cm.userid != ?",
+            [$msgid, $fromuser]
         )->n;
+        if ($reported > 0) {
+            return true;
+        }
 
-        return $microvolApproves + 2 * $modChecks;
+        return (int) DB::selectOne(
+            "SELECT COUNT(*) AS n FROM microactions WHERE msgid = ? AND result = 'Reject'",
+            [$msgid]
+        )->n > 0;
+    }
+
+    /** A moderator has looked at the post (approved or checked any of its rows) - a human
+     *  look supersedes the crowd signals and clears the gate entirely. */
+    private function modLooked(int $msgid): bool
+    {
+        return (int) DB::selectOne(
+            'SELECT COUNT(*) AS n FROM messages_groups
+             WHERE msgid = ? AND (approvedby IS NOT NULL OR checkedat IS NOT NULL)',
+            [$msgid]
+        )->n > 0;
     }
 
     private function rippleIntoNewGroups(int $msgid, string $reachWkt, array &$stats, ?array $reachableGroupIds = null): void
@@ -1269,25 +1303,29 @@ private function rippleIntoNewGroups(int $msgid, string $reachWkt, array &$stats
 
             // EARNED-REACH CAP (dark unless RIPPLE_EARNED_REACH_ENABLED). An auto-published post
             // (approvedby IS NULL on its origin row) may be rippled into at most N communities
-            // while its review weight >= 2*N (weight = 1 per microvol Approve + 2 per mod check).
-            // If the weight does not cover the communities this step would reach, pause: insert
-            // nothing, stamp awaiting_review_since, count it, return. When the weight later catches
-            // up the wait is banked into awaiting_review_seconds and the stamp is cleared. A
-            // mod-approved post (approvedby NOT NULL) is trusted and never capped.
+            // while it has clean_views_per_group distinct clean views per community and nobody
+            // has flagged it. A flag (member report / microvol Reject) pauses spread outright;
+            // a moderator look (approvedby or checkedat anywhere) clears the gate entirely.
+            // While capped: insert nothing, stamp awaiting_review_since, count it, return. When
+            // exposure later catches up (or a mod looks) the wait is banked into
+            // awaiting_review_seconds and the stamp is cleared.
             if (config('freegle.ripple.earned_reach_enabled', false)) {
                 $originRow = DB::selectOne(
                     'SELECT approvedby FROM messages_groups WHERE msgid = ? ORDER BY arrival ASC LIMIT 1',
                     [$msgid]
                 );
-                if ($originRow !== null && $originRow->approvedby === null) {
+                $viewsPerGroup = (int) config('freegle.ripple.clean_views_per_group', 5);
+                if ($originRow !== null && $originRow->approvedby === null
+                    && $viewsPerGroup > 0 && !$this->modLooked($msgid)) {
                     $candidateCount = count($targetGroups);
 
                     if ($candidateCount > 0) {
                         $alreadyRippledIn = (int) DB::table('messages_groups')
                             ->where('msgid', $msgid)->where('rippled_in', 1)->where('deleted', 0)->count();
-                        $requiredWeight = 2 * ($alreadyRippledIn + $candidateCount);
+                        $requiredViews = $viewsPerGroup * ($alreadyRippledIn + $candidateCount);
 
-                        if ($this->reviewWeight($msgid) < $requiredWeight) {
+                        if ($this->isFlagged($msgid, (int) $msg->fromuser)
+                            || $this->cleanViews($msgid, (int) $msg->fromuser) < $requiredViews) {
                             DB::statement(
                                 'UPDATE rippling_reach
                                  SET awaiting_review_since = IF(awaiting_review_since IS NULL, NOW(), awaiting_review_since),
@@ -1300,7 +1338,7 @@ private function rippleIntoNewGroups(int $msgid, string $reachWkt, array &$stats
                             return;
                         }
 
-                        // Sufficient weight: if we were paused, bank the waited time and clear the stamp.
+                        // Sufficient exposure: if we were paused, bank the waited time and clear the stamp.
                         DB::statement(
                             'UPDATE rippling_reach
                              SET awaiting_review_seconds = awaiting_review_seconds
diff --git a/iznik-batch/config/freegle.php b/iznik-batch/config/freegle.php
index 52dd95e166..bf43ec0c20 100644
--- a/iznik-batch/config/freegle.php
+++ b/iznik-batch/config/freegle.php
@@ -358,13 +358,20 @@
         // 5 = the figure from the Discourse rippling thread.
         'reply_saturation_stop' => (int) env('RIPPLE_REPLY_SATURATION_STOP', 5),
         // EARNED-REACH GATE (auto-approve x rippling). Ships DARK: when false, ExpandService
-        // behaves exactly as before - no 1h hold, no review-weight cap, no await-review
+        // behaves exactly as before - no 1h hold, no exposure cap, no await-review
         // instrumentation. Go-live is a deliberate env flip, exactly like RIPPLE_ENABLED.
         'earned_reach_enabled' => (bool) env('RIPPLE_EARNED_REACH_ENABLED', false),
         // When the gate is on: minimum age (seconds) an auto-published, unreviewed post must
         // reach before it may start rippling. A post with approvedby or checkedat set (a mod
         // approved or checked it) skips the hold. Default 3600 (1h); 0 disables just the hold.
         'autoapprove_hold_seconds' => (int) env('RIPPLE_AUTOAPPROVE_HOLD_SECONDS', 3600),
+        // When the gate is on: distinct clean VIEWS required per community an auto-published
+        // post ripples into. Reach is earned by exposure without complaint - members seeing
+        // the post and nobody flagging it - not by active reviewer sign-off (a per-community
+        // reviewer requirement could never keep up with post volume). Any flag (member report
+        // to the mods referencing the post, or a microvolunteer Reject) pauses further spread
+        // until a moderator look (approvedby/checkedat) clears it. 0 disables just the cap.
+        'clean_views_per_group' => (int) env('RIPPLE_CLEAN_VIEWS_PER_GROUP', 5),
         // Hours a rippled-in (messages_groups.rippled_in=1) post, already Approved on its
         // origin group, waits before it is approved onto the rippled-in group (it was already
         // vetted on origin). Default 0 = approve AT ripple-in time, so it never even flickers
diff --git a/iznik-batch/tests/Unit/Services/Ripple/ExpandServiceTest.php b/iznik-batch/tests/Unit/Services/Ripple/ExpandServiceTest.php
index edc9fe009e..0268cde954 100644
--- a/iznik-batch/tests/Unit/Services/Ripple/ExpandServiceTest.php
+++ b/iznik-batch/tests/Unit/Services/Ripple/ExpandServiceTest.php
@@ -3081,11 +3081,41 @@ public function test_advance_bounds_respect_secondary_reject_clip(): void
 
     // ───────────────────────── Earned-reach gate (dark unless RIPPLE_EARNED_REACH_ENABLED) ─────
 
-    private function addMicrovolApprove(int $msgid): void
+    /** Record $n distinct members (not the poster) viewing the post. */
+    private function addCleanViews(int $msgid, int $n): void
+    {
+        for ($i = 0; $i < $n; $i++) {
+            DB::table('messages_likes')->insert([
+                'msgid' => $msgid, 'userid' => $this->createTestUser()->id,
+                'type' => 'View', 'timestamp' => now(),
+            ]);
+        }
+    }
+
+    /** A member reports the post to the mods - a User2Mod chat message referencing it,
+     *  exactly what the front-end report flow sends. */
+    private function reportToMods(int $msgid): void
+    {
+        $reporter = $this->createTestUser();
+        $groupid = (int) DB::table('messages_groups')->where('msgid', $msgid)->value('groupid');
+        $room = \App\Models\ChatRoom::create([
+            'chattype' => \App\Models\ChatRoom::TYPE_USER2MOD,
+            'user1' => $reporter->id, 'groupid' => $groupid, 'created' => now(),
+        ]);
+        DB::table('chat_messages')->insert([
+            'chatid' => $room->id, 'userid' => $reporter->id, 'refmsgid' => $msgid,
+            'message' => "I'm reporting this post as inappropriate", 'type' => 'Default',
+            'date' => now(), 'reviewrequired' => 0, 'processingrequired' => 0,
+            'processingsuccessful' => 1, 'mailedtoall' => 0, 'seenbyall' => 0,
+            'reviewrejected' => 0, 'platform' => 1,
+        ]);
+    }
+
+    private function addMicrovolReject(int $msgid): void
     {
         DB::table('microactions')->insert([
             'actiontype' => 'CheckMessage', 'userid' => $this->createTestUser()->id,
-            'msgid' => $msgid, 'result' => 'Approve', 'timestamp' => now(),
+            'msgid' => $msgid, 'result' => 'Reject', 'timestamp' => now(),
         ]);
     }
 
@@ -3149,32 +3179,36 @@ public function test_autoapprove_hold_bypassed_for_only_msgid_run(): void
         $this->assertSame(1, $stats['initialized'], '--msgid bypasses the hold, like the arrival cutoff');
     }
 
-    public function test_review_weight_counts_microvol_approves_and_mod_checks(): void
+    public function test_clean_views_counts_distinct_viewers_excluding_poster(): void
     {
         $svc = $this->service();
         $msgid = $this->seedSpatialPost(now()->subMinutes(90));
-        $ref = new \ReflectionMethod($svc, 'reviewWeight');
+        $poster = (int) DB::table('messages')->where('id', $msgid)->value('fromuser');
+        $ref = new \ReflectionMethod($svc, 'cleanViews');
         $ref->setAccessible(true);
 
-        $this->assertSame(0, $ref->invoke($svc, $msgid), 'baseline weight 0');
-        $this->addMicrovolApprove($msgid);
-        $this->assertSame(1, $ref->invoke($svc, $msgid), '1 microvol approve = weight 1');
-        DB::table('messages_groups')->where('msgid', $msgid)->update(['checkedat' => now()]);
-        $this->assertSame(3, $ref->invoke($svc, $msgid), '+1 mod check = weight 3 (1 + 2)');
+        $this->assertSame(0, $ref->invoke($svc, $msgid, $poster), 'baseline 0 views');
+        $this->addCleanViews($msgid, 2);
+        $this->assertSame(2, $ref->invoke($svc, $msgid, $poster), 'two distinct viewers');
+        DB::table('messages_likes')->insert([
+            'msgid' => $msgid, 'userid' => $poster, 'type' => 'View', 'timestamp' => now(),
+        ]);
+        $this->assertSame(2, $ref->invoke($svc, $msgid, $poster), "the poster's own view does not count");
     }
 
-    public function test_earned_reach_cap_blocks_with_weight_below_2_for_one_group(): void
+    public function test_earned_reach_cap_blocks_below_view_threshold(): void
     {
-        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0]);
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0,
+            'freegle.ripple.clean_views_per_group' => 2]);
         $this->fakeRouting(3);
         $msgid = $this->seedSpatialPost(now()->subMinutes(90));
         $groupB = $this->seedCoveringGroup();
-        $this->addMicrovolApprove($msgid); // weight 1 < required 2 for N=1
+        $this->addCleanViews($msgid, 1); // 1 view < required 2 for N=1
 
         $stats = $this->service()->process(false, 500);
 
         $this->assertSame(1, $stats['initialized'], 'reach is still initialised');
-        $this->assertSame(0, $stats['rippled_in'], 'not rippled in while weight < required');
+        $this->assertSame(0, $stats['rippled_in'], 'not rippled in while views < required');
         $this->assertSame(1, $stats['reach_capped']);
         $this->assertNull(DB::table('messages_groups')->where('msgid', $msgid)->where('groupid', $groupB)->first());
         $this->assertNotNull(
@@ -3183,32 +3217,70 @@ public function test_earned_reach_cap_blocks_with_weight_below_2_for_one_group()
         );
     }
 
-    public function test_earned_reach_cap_passes_with_two_microvol_approves(): void
+    public function test_earned_reach_cap_passes_with_enough_clean_views(): void
     {
-        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0]);
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0,
+            'freegle.ripple.clean_views_per_group' => 2]);
         $this->fakeRouting(3);
         $msgid = $this->seedSpatialPost(now()->subMinutes(90));
         $groupB = $this->seedCoveringGroup();
-        $this->addMicrovolApprove($msgid);
-        $this->addMicrovolApprove($msgid); // weight 2 >= required 2
+        $this->addCleanViews($msgid, 2); // 2 views >= required 2
 
         $stats = $this->service()->process(false, 500);
 
-        $this->assertSame(1, $stats['rippled_in'], 'weight 2 meets N=1; ripples in');
+        $this->assertSame(1, $stats['rippled_in'], '2 clean views meet N=1; ripples in');
         $this->assertSame(0, $stats['reach_capped']);
     }
 
-    public function test_earned_reach_cap_passes_with_one_mod_check(): void
+    public function test_earned_reach_cap_pauses_when_flagged_despite_views(): void
     {
-        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0]);
+        // A member report to the mods outweighs any number of quiet views: spread pauses
+        // until a moderator look clears it.
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0,
+            'freegle.ripple.clean_views_per_group' => 2]);
         $this->fakeRouting(3);
         $msgid = $this->seedSpatialPost(now()->subMinutes(90));
-        $groupB = $this->seedCoveringGroup();
-        DB::table('messages_groups')->where('msgid', $msgid)->update(['checkedat' => now()]); // weight 2
+        $this->seedCoveringGroup();
+        $this->addCleanViews($msgid, 10);
+        $this->reportToMods($msgid);
+
+        $stats = $this->service()->process(false, 500);
+
+        $this->assertSame(0, $stats['rippled_in'], 'a reported post must not spread');
+        $this->assertSame(1, $stats['reach_capped']);
+    }
+
+    public function test_earned_reach_cap_pauses_on_microvol_reject_despite_views(): void
+    {
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0,
+            'freegle.ripple.clean_views_per_group' => 2]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(90));
+        $this->seedCoveringGroup();
+        $this->addCleanViews($msgid, 10);
+        $this->addMicrovolReject($msgid);
+
+        $stats = $this->service()->process(false, 500);
+
+        $this->assertSame(0, $stats['rippled_in'], 'a microvol-rejected post must not spread');
+        $this->assertSame(1, $stats['reach_capped']);
+    }
+
+    public function test_earned_reach_cap_cleared_by_mod_check_even_when_flagged(): void
+    {
+        // A moderator look supersedes the crowd signals: checkedat clears the gate outright,
+        // zero views and an outstanding report notwithstanding.
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0,
+            'freegle.ripple.clean_views_per_group' => 2]);
+        $this->fakeRouting(3);
+        $msgid = $this->seedSpatialPost(now()->subMinutes(90));
+        $this->seedCoveringGroup();
+        $this->reportToMods($msgid);
+        DB::table('messages_groups')->where('msgid', $msgid)->update(['checkedat' => now()]);
 
         $stats = $this->service()->process(false, 500);
 
-        $this->assertSame(1, $stats['rippled_in'], 'one mod check (weight 2) meets N=1');
+        $this->assertGreaterThanOrEqual(1, $stats['rippled_in'], 'a mod-checked post ripples');
         $this->assertSame(0, $stats['reach_capped']);
     }
 
@@ -3219,23 +3291,24 @@ public function test_earned_reach_cap_does_not_apply_to_mod_approved_post(): voi
         $msgid = $this->seedSpatialPost(now()->subMinutes(90));
         $this->seedCoveringGroup();
         $modId = (int) DB::table('messages')->where('id', $msgid)->value('fromuser');
-        DB::table('messages_groups')->where('msgid', $msgid)->update(['approvedby' => $modId]); // mod-approved, zero weight
+        DB::table('messages_groups')->where('msgid', $msgid)->update(['approvedby' => $modId]); // mod-approved, zero views
 
         $stats = $this->service()->process(false, 500);
 
         $this->assertSame(0, $stats['reach_capped'], 'mod-approved post is exempt from the cap');
-        $this->assertGreaterThanOrEqual(1, $stats['rippled_in'], 'mod-approved post ripples without review weight');
+        $this->assertGreaterThanOrEqual(1, $stats['rippled_in'], 'mod-approved post ripples without any views');
     }
 
     public function test_earned_reach_cap_pause_then_resume_accumulates_await_seconds(): void
     {
-        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0]);
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0,
+            'freegle.ripple.clean_views_per_group' => 2]);
         $this->fakeRouting(3);
         $msgid = $this->seedSpatialPost(now()->subMinutes(90));
         $groupB = $this->seedCoveringGroup();
 
-        // Run 1: weight 1 < 2, capped.
-        $this->addMicrovolApprove($msgid);
+        // Run 1: 1 view < 2, capped.
+        $this->addCleanViews($msgid, 1);
         $stats1 = $this->service()->process(false, 500);
         $this->assertSame(1, $stats1['reach_capped']);
         $this->assertNotNull(DB::table('rippling_reach')->where('msgid', $msgid)->value('awaiting_review_since'));
@@ -3250,8 +3323,8 @@ public function test_earned_reach_cap_pause_then_resume_accumulates_await_second
             'next_expansion_at' => now()->subMinute(),
         ]);
 
-        // Run 2: second approve -> weight 2 >= 2, resumes and ripples.
-        $this->addMicrovolApprove($msgid);
+        // Run 2: a second viewer -> 2 views >= 2, resumes and ripples.
+        $this->addCleanViews($msgid, 1);
         $stats2 = $this->service()->process(false, 500);
 
         $this->assertSame(0, $stats2['reach_capped'], 'cap lifted on resume');
@@ -3263,19 +3336,20 @@ public function test_earned_reach_cap_pause_then_resume_accumulates_await_second
 
     public function test_earned_reach_cap_does_not_reset_await_since_on_repeated_pause(): void
     {
-        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0]);
+        config(['freegle.ripple.earned_reach_enabled' => true, 'freegle.ripple.autoapprove_hold_seconds' => 0,
+            'freegle.ripple.clean_views_per_group' => 2]);
         $this->fakeRouting(3);
         $msgid = $this->seedSpatialPost(now()->subMinutes(90));
         $this->seedCoveringGroup();
 
-        $this->addMicrovolApprove($msgid);
+        $this->addCleanViews($msgid, 1);
         $this->service()->process(false, 500); // capped, stamp set
 
         $original = now()->subMinutes(10);
         DB::table('rippling_reach')->where('msgid', $msgid)
             ->update(['awaiting_review_since' => $original, 'arrival' => now()->subHours(7), 'tick' => 0, 'next_expansion_at' => now()->subMinute()]);
 
-        $this->service()->process(false, 500); // still weight 1 < 2, still capped
+        $this->service()->process(false, 500); // still 1 view < 2, still capped
 
         $row = DB::table('rippling_reach')->where('msgid', $msgid)->first();
         $this->assertEqualsWithDelta(
@@ -3288,7 +3362,7 @@ public function test_earned_reach_cap_does_not_reset_await_since_on_repeated_pau
 
     public function test_earned_reach_gate_is_dark_by_default(): void
     {
-        // Flag off (default): a young auto-published post with zero review weight ripples
+        // Flag off (default): a young auto-published post with zero views ripples
         // exactly as before - no hold, no cap.
         $this->fakeRouting(3);
         $msgid = $this->seedSpatialPost(now()->subMinutes(30));

From 289a5388bf23b549182e051ddd0fecd4a80e17cd Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Sat, 4 Jul 2026 10:45:54 +0100
Subject: [PATCH 25/26] docs(moderation): correct the 'nearly all posts
 human-approved' claim

By the thread's own figures (post 1: 46% of posts held for moderation), roughly
half of what ripples today was never human-approved - it passed the automated
checks and went. Framed accurately, the earned-reach gate ADDS a brake that
today's rippling lacks, which is a stronger and truer argument.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHiCAjJKX7CemYZEJUntt9
---
 AUTO-APPROVE-FOR-MODERATORS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AUTO-APPROVE-FOR-MODERATORS.md b/AUTO-APPROVE-FOR-MODERATORS.md
index 4a833daeb4..92ee43ed1e 100644
--- a/AUTO-APPROVE-FOR-MODERATORS.md
+++ b/AUTO-APPROVE-FOR-MODERATORS.md
@@ -40,7 +40,7 @@ answers it - or does not. Post numbers refer to that thread.
 | **"Human pre-moderation is Freegle's trust differentiator - dropping it risks members' and funders' confidence."** (several moderators; posts 27, 97, 103, 158) | A judgment call, honestly labelled as such. Two facts for the scales: about half of Freegle posts already publish without pre-moderation today (trusted and unmoderated members), and that has been true for years without being the thing members or funders notice; and human oversight does not disappear - it moves after publication and stays visible and provable (every check is recorded, see the last section). Freegle remains far more moderated than any of the platforms it is compared to. |
 | **"Instant posting breeds fastest-finger-first and undermines Fair Chance."** (posts 35, 114) | The delay means posting is not instant, and nothing in this change alters reply handling or allocation. But the underlying point is fair: faster publication does reward quick responders, and leaning on a moderation delay to blunt that was always indirect. Fair Chance itself is a very old model, and a better one is worth designing in its own right - for example a short reply-gathering window on each post before the offerer chooses, so being first matters less than being suitable. Faster publication makes that work more worthwhile, not less; it deserves its own proposal rather than a footnote here. |
 | **"Pilot it properly or not at all."** (many moderators; posts 37, 49, 73, 170, 280) | That is the plan, and the code enforces it: switched off everywhere by default, an explicit trial-group list for a phased start, live error-rate measurement, and a reversible switch. No big bang. |
-| **"A bad auto-approved post won't just hit my group - rippling will spread it to my neighbours."** (posts 302, 306) | Addressed by the **earned-reach gate**: an auto-published post (one no human has looked at) waits about an hour before it starts rippling at all, and it then spreads only as fast as clean exposure accumulates - each additional community it reaches requires that a number of members have already seen the post with nobody flagging it. A single member report, or a microvolunteer rejection, pauses further spread until a moderator looks; a moderator check clears it, and a rejection pulls it back. Posts a moderator approved by hand are exempt, because they have had their human look. (Requiring active reviewer sign-off per community was considered and dropped - review capacity could never keep up with post volume, so it would have quietly stopped rippling for most posts.) (The observation in post 302 - instant rippling with no delay - describes rippling *today*, where nearly all posts have been human-approved; the hold arrives with auto-approve, for the posts that need it.) |
+| **"A bad auto-approved post won't just hit my group - rippling will spread it to my neighbours."** (posts 302, 306) | Addressed by the **earned-reach gate**: an auto-published post (one no human has looked at) waits about an hour before it starts rippling at all, and it then spreads only as fast as clean exposure accumulates - each additional community it reaches requires that a number of members have already seen the post with nobody flagging it. A single member report, or a microvolunteer rejection, pauses further spread until a moderator looks; a moderator check clears it, and a rejection pulls it back. Posts a moderator approved by hand are exempt, because they have had their human look. (Requiring active reviewer sign-off per community was considered and dropped - review capacity could never keep up with post volume, so it would have quietly stopped rippling for most posts.) (The observation in post 302 - instant rippling with no delay - is right, and worth being precise about: by the thread's own figures (post 1), only around 46% of posts are held for human approval, so roughly half of what ripples today was never human-approved either - it passed the automated checks and went. The hold and the exposure gate arrive with auto-approve precisely to give unreviewed posts a brake that today's rippling does not have.) |
 | **"Something illegal goes live - flytipped goods, kerbside free-for-alls. Who is liable? Me?"** (posts 4, 226, 238, 258) | Legal responsibility for a post sits with the person who posted it - that principle is what lets any user-content platform operate, and it does not change here. What Freegle controls is how fast a problem post is caught: the checks before publication, the hold window, your oversight queue and the one-click reject are that machinery. Groups with rules about kerbside posts keep enforcing them exactly as now - nothing about auto-approve weakens a rejection. |
 
 If you raised something in that thread that is not represented above, or the response

From 2cd2512457fe7b027bb06e8380e3fa16a60c0810 Mon Sep 17 00:00:00 2001
From: edwh <edward@ehibbert.org.uk>
Date: Fri, 17 Jul 2026 23:27:58 +0100
Subject: [PATCH 26/26] test(rippling): seed outer_bound in #639 rippling_reach
 fixtures (sandwich-bounds)

#639's autoapprove/microvolunteering/rippling-metrics tests insert rippling_reach
rows without outer_bound. #1098's sandwich-bounds schema made that column GEOMETRY
NOT NULL with no default, so post-rebase those inserts error, no reach row exists,
and the review-delay / near-first / countdown assertions read 0 and fail. Same
crossed-in-flight issue as #953, fixed the same way (f9cf8f466): seed the polygon's
envelope as outer_bound; band semantics keep the exact polygon authoritative, so
the assertions are unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQZ56NwFYEuhrtaoU7oYoM
---
 .../test/autoapprove_countdown_test.go        |  5 +++--
 .../test/microvolunteering_reach_test.go      | 20 +++++++++++--------
 iznik-server-go/test/rippling_metrics_test.go |  6 ++++--
 3 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/iznik-server-go/test/autoapprove_countdown_test.go b/iznik-server-go/test/autoapprove_countdown_test.go
index b7edd8aa48..e6ab561b40 100644
--- a/iznik-server-go/test/autoapprove_countdown_test.go
+++ b/iznik-server-go/test/autoapprove_countdown_test.go
@@ -260,8 +260,9 @@ func TestMarkCheckedReject(t *testing.T) {
 	// group. The reject must hard-stop the reach and must NOT touch the rippled-in copy
 	// (the engine's own retraction handles those).
 	groupB := CreateTestGroup(t, prefix+"_b")
-	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, arrival) "+
-		"VALUES (?, 52.0, -1.0, ST_GeomFromText('POLYGON((-1.2 51.9,-0.8 51.9,-0.8 52.1,-1.2 52.1,-1.2 51.9))', 3857), NOW())", approved)
+	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, outer_bound, arrival) "+
+		"VALUES (?, 52.0, -1.0, ST_GeomFromText('POLYGON((-1.2 51.9,-0.8 51.9,-0.8 52.1,-1.2 52.1,-1.2 51.9))', 3857), "+
+		"ST_Envelope(ST_GeomFromText('POLYGON((-1.2 51.9,-0.8 51.9,-0.8 52.1,-1.2 52.1,-1.2 51.9))', 3857)), NOW())", approved)
 	db.Exec("INSERT INTO messages_groups (msgid, groupid, arrival, collection, autoreposts, rippled_in) "+
 		"VALUES (?, ?, NOW(), 'Approved', 0, 1)", approved, groupB)
 	defer db.Exec("DELETE FROM rippling_reach WHERE msgid=?", approved)
diff --git a/iznik-server-go/test/microvolunteering_reach_test.go b/iznik-server-go/test/microvolunteering_reach_test.go
index 84d5b34844..e0db769f55 100644
--- a/iznik-server-go/test/microvolunteering_reach_test.go
+++ b/iznik-server-go/test/microvolunteering_reach_test.go
@@ -43,12 +43,14 @@ func TestGetMicrovolunteering_CheckMessage_ReachBounded(t *testing.T) {
 	defer db.Exec("DELETE FROM messages_groups WHERE msgid = ?", farID)
 
 	// Near: max_drive_min=60 -> ~84 km radius; reviewer at the origin -> included.
-	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, max_drive_min) VALUES "+
-		"(?, 51.5, -0.1, ST_GeomFromText('POLYGON((-0.2 51.4,0.0 51.4,0.0 51.6,-0.2 51.6,-0.2 51.4))', 3857), 60) "+
+	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, outer_bound, max_drive_min) VALUES "+
+		"(?, 51.5, -0.1, ST_GeomFromText('POLYGON((-0.2 51.4,0.0 51.4,0.0 51.6,-0.2 51.6,-0.2 51.4))', 3857), "+
+		"ST_Envelope(ST_GeomFromText('POLYGON((-0.2 51.4,0.0 51.4,0.0 51.6,-0.2 51.6,-0.2 51.4))', 3857)), 60) "+
 		"ON DUPLICATE KEY UPDATE max_drive_min=60", nearID)
 	// Far: max_drive_min=30 -> ~42 km radius; reviewer ~600 km away -> excluded.
-	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, max_drive_min) VALUES "+
-		"(?, 57.0, -3.0, ST_GeomFromText('POLYGON((-3.1 56.9,-2.9 56.9,-2.9 57.1,-3.1 57.1,-3.1 56.9))', 3857), 30) "+
+	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, outer_bound, max_drive_min) VALUES "+
+		"(?, 57.0, -3.0, ST_GeomFromText('POLYGON((-3.1 56.9,-2.9 56.9,-2.9 57.1,-3.1 57.1,-3.1 56.9))', 3857), "+
+		"ST_Envelope(ST_GeomFromText('POLYGON((-3.1 56.9,-2.9 56.9,-2.9 57.1,-3.1 57.1,-3.1 56.9))', 3857)), 30) "+
 		"ON DUPLICATE KEY UPDATE max_drive_min=30", farID)
 	defer db.Exec("DELETE FROM rippling_reach WHERE msgid IN (?, ?)", nearID, farID)
 
@@ -109,11 +111,13 @@ func TestGetMicrovolunteering_CheckMessage_NearFirst(t *testing.T) {
 	defer db.Exec("DELETE FROM messages_spatial WHERE msgid = ?", nearID)
 	defer db.Exec("DELETE FROM messages_groups WHERE msgid = ?", nearID)
 
-	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, max_drive_min) VALUES "+
-		"(?, 52.4, -1.9, ST_GeomFromText('POLYGON((-2.0 52.3,-1.8 52.3,-1.8 52.5,-2.0 52.5,-2.0 52.3))', 3857), 180) "+
+	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, outer_bound, max_drive_min) VALUES "+
+		"(?, 52.4, -1.9, ST_GeomFromText('POLYGON((-2.0 52.3,-1.8 52.3,-1.8 52.5,-2.0 52.5,-2.0 52.3))', 3857), "+
+		"ST_Envelope(ST_GeomFromText('POLYGON((-2.0 52.3,-1.8 52.3,-1.8 52.5,-2.0 52.5,-2.0 52.3))', 3857)), 180) "+
 		"ON DUPLICATE KEY UPDATE max_drive_min=180", farNorthID)
-	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, max_drive_min) VALUES "+
-		"(?, 51.51, -0.09, ST_GeomFromText('POLYGON((-0.1 51.5,0.0 51.5,0.0 51.52,-0.1 51.52,-0.1 51.5))', 3857), 60) "+
+	db.Exec("INSERT INTO rippling_reach (msgid, lat, lng, polygon, outer_bound, max_drive_min) VALUES "+
+		"(?, 51.51, -0.09, ST_GeomFromText('POLYGON((-0.1 51.5,0.0 51.5,0.0 51.52,-0.1 51.52,-0.1 51.5))', 3857), "+
+		"ST_Envelope(ST_GeomFromText('POLYGON((-0.1 51.5,0.0 51.5,0.0 51.52,-0.1 51.52,-0.1 51.5))', 3857)), 60) "+
 		"ON DUPLICATE KEY UPDATE max_drive_min=60", nearID)
 	defer db.Exec("DELETE FROM rippling_reach WHERE msgid IN (?, ?)", farNorthID, nearID)
 
diff --git a/iznik-server-go/test/rippling_metrics_test.go b/iznik-server-go/test/rippling_metrics_test.go
index b5b75c0e4f..fbfd516a5a 100644
--- a/iznik-server-go/test/rippling_metrics_test.go
+++ b/iznik-server-go/test/rippling_metrics_test.go
@@ -820,8 +820,9 @@ func TestRipplingMetricsReviewDelayAwaiting(t *testing.T) {
 	defer db.Exec("DELETE FROM messages WHERE id = ?", msgID)
 
 	db.Exec(
-		"INSERT INTO rippling_reach (msgid, lat, lng, polygon, arrival, awaiting_review_since, awaiting_review_seconds) "+
+		"INSERT INTO rippling_reach (msgid, lat, lng, polygon, outer_bound, arrival, awaiting_review_since, awaiting_review_seconds) "+
 			"VALUES (?, 51.5, -0.1, ST_GeomFromText('POLYGON((-0.2 51.4,0.0 51.4,0.0 51.6,-0.2 51.6,-0.2 51.4))', 3857), "+
+			"ST_Envelope(ST_GeomFromText('POLYGON((-0.2 51.4,0.0 51.4,0.0 51.6,-0.2 51.6,-0.2 51.4))', 3857)), "+
 			"NOW() - INTERVAL 2 HOUR, NOW() - INTERVAL 30 MINUTE, 0) "+
 			"ON DUPLICATE KEY UPDATE awaiting_review_since = NOW() - INTERVAL 30 MINUTE",
 		msgID)
@@ -854,8 +855,9 @@ func TestRipplingMetricsReviewDelayPostHours(t *testing.T) {
 	defer db.Exec("DELETE FROM messages WHERE id = ?", msgID)
 
 	db.Exec(
-		"INSERT INTO rippling_reach (msgid, lat, lng, polygon, arrival, awaiting_review_since, awaiting_review_seconds) "+
+		"INSERT INTO rippling_reach (msgid, lat, lng, polygon, outer_bound, arrival, awaiting_review_since, awaiting_review_seconds) "+
 			"VALUES (?, 51.5, -0.1, ST_GeomFromText('POLYGON((-0.2 51.4,0.0 51.4,0.0 51.6,-0.2 51.6,-0.2 51.4))', 3857), "+
+			"ST_Envelope(ST_GeomFromText('POLYGON((-0.2 51.4,0.0 51.4,0.0 51.6,-0.2 51.6,-0.2 51.4))', 3857)), "+
 			"NOW() - INTERVAL 3 DAY, NULL, 7200) "+
 			"ON DUPLICATE KEY UPDATE awaiting_review_seconds = 7200",
 		msgID)