# Workflow — Ops Moderation (Reports & Suggestions Intake)

The trust-and-safety inbox flow. Customer Care reviews user reports and product suggestions and takes manual action.

---

## Sequence

```
Client / Vendor on public app
       │
       ├── Reports a vendor       (Path A)
       │
       └── Submits a suggestion   (Path B)
                 │                          │
                 ▼                          ▼
       INSERT user_reports          INSERT app_suggestions
       (OotboAPI writes)            (OotboAPI writes)
                 │                          │
                 │                          │
   ┌─────────────┴────────────┐ ┌──────────┴──────────────┐
   │ Customer Care logs into  │ │ Ops user logs into      │
   │ VisoAdmin (perm 4)       │ │ VisoAdmin (perm 1)      │
   └────────┬─────────────────┘ └─────────┬───────────────┘
            │                              │
            ▼                              ▼
   ┌────────────────────────┐    ┌────────────────────────┐
   │ /reports list          │    │ /suggestions list      │
   │ → /ajaxReportList JSON │    │ → /ajaxSuggestionList  │
   └────────┬───────────────┘    └────────┬───────────────┘
            │ "View"                       │ "Take Action"
            ▼                              ▼
   ┌────────────────────────┐    ┌────────────────────────┐
   │ GET /report/{id}       │    │ (no-op — button dead)  │
   │ {description: ...}     │    │                        │
   └────────┬───────────────┘    └────────────────────────┘
            │
            ▼
   ┌─────────────────────────────────────────────────────────┐
   │  Out-of-band action: ops decides to delete a vendor,    │
   │  contact a client, or escalate. Action happens in       │
   │  Feature 05 Vendor Management (vendor delete) or        │
   │  externally. There is no "Mark Resolved" mechanism.     │
   └─────────────────────────────────────────────────────────┘
```

---

## Step-by-Step

| # | Step | Feature(s) | Endpoint / Action |
|---|------|------------|------------------|
| 1A | End user reports a vendor from the public app | (OotboApps + OotboAPI) | OotboAPI INSERT `user_reports` |
| 1B | End user submits a suggestion | (OotboApps + OotboAPI) | OotboAPI INSERT `app_suggestions` |
| 2 | Ops sees the new row in VisoAdmin | [18 User Reports](../18-user-reports/spec.md) / [19 Suggestions](../19-suggestions/spec.md) | `GET /reports` / `GET /suggestions` |
| 3 | Ops opens detail (reports only) | [18 User Reports](../18-user-reports/spec.md) | `GET /report/{id}` |
| 4 | Out-of-band: ops takes action (vendor delete, email user, escalate) | [05 Vendor Mgmt](../05-vendor-management/spec.md) etc. | `GET /user/deleteVendor/{id}` (if applicable) |
| 5 | Activity is logged (only if action triggered a non-AJAX route) | [20 User Activity Log](../20-user-activity-log/spec.md) | `viso_user_activity_log` INSERT |

---

## Touched Tables

`user_reports`, `app_suggestions`, `users`, `events`, `viso_user_activity_log` (and downstream cascade tables from Feature 05 if vendor delete).

---

## Failure Modes

- **No resolution state** — the same report stays "open" in the list forever. Ops keep a separate spreadsheet or just re-skim.
- **"Take Action" button on suggestions is dead** — clicking it does nothing.
- **`user_reports.event_id` type drift** — see Feature 18 spec; the join to `events` may silently drop reports.
- **Deleting a reported vendor** (Feature 05 cascade) **also deletes the report itself** — losing the audit trail.
- **No notification to the reporter** — clients never hear back about what happened with their report.

---

## Improvement Opportunities (Not Implemented)

- Add `status` to `user_reports` and `app_suggestions`.
- Add "Suspend vendor" action that toggles `users.status = 0` instead of full cascade.
- Send a reply-acknowledgement when a report is closed.
- Wire the "Take Action" button on `/suggestions`.