User Journey

A guest submits a review; it lands in the moderation queue as pending. The owner runs Classify — Intake normalises the text, Layer 1 evaluates the immutable baseline rules, Layer 2 applies the owner overlay, and the metered stage produces the category, toxicity, and quality score with a suggested action. Spam, abuse, and PII steer toward reject; a low quality score below the owner threshold steers toward hold; clean, substantive reviews steer toward approve. The owner decides.

An approved review does not stay siloed: it is upserted into the shared core review store (the campsite-canon write) and renders on the property detail page, so the marketplace, recommendations, and trust analytics (#13) all read the same published review — no app holding a private copy. The decision emits a review.moderated event on the live bus and writes an audit-trail entry. A viewer's experiments are credential-scoped and reset-clearing, and can never mutate the canonical published review.