Review pages: one door, not four

Where a person approves what Clara wants to do, why we ended up with four screens plus Slack, and the proposal to make it one.

Proposed — D1, D2 and D3 decided (Fede, 2026-10-14); D4 pending · 2026-10-12 · sources: PR bodies #2438 #6399 #6654 #11412 #13125 #18046 #18427, ADR-0141, the supervised-mode evidence page, the staff-loop v2 page, public vendor docs

Recommendation: one review page for everyone. A customer reviewer sees their company. PropFlow staff see every company on the same page with a filter. Slack and email keep their buttons, and every link lands on that one page. The admin copy, the email-only page and the Admin chrome a customer saw yesterday all go away.

1. Today 2. How we got here 3. Why four 4. Do staff need their own? 5. What others do 6. Proposal 7. Your decisions

The full proposal

1. Today

Four screens, one record. The code that decides and sends is already shared; only the doors differ. The renewal list sits on the email-link page, which is why a test reviewer landed in Admin yesterday.

	/review	/held-messages/<id>	/admin/escalation-holds
Who	Operators and admins at a company	Chosen reviewers for a module (ADR-0141)	PropFlow staff only
List?	Yes	No, email link only	Yes, all companies
Items	Tenant claims, vendor outreach, rent reminders, renewal corrections, new-lease packages, held prospect emails	One held text or email, the monthly renewal list	Held team emails, owner reports, renewal lists
Slack	Partly	No (email)	Yes, this is the Slack home
Phone	No	Cards	No

2. How we got here

When	Page	Why, in plain words
Jun 17	/review	Callers claiming a unit needed a PM's yes before account access. First queue. (#2438)
Aug 27	One-tap rent reminder	A PM on a phone taps once, no password prompt. (#6399)
Aug 30	Admin hold page + Slack card	Fede: Camellia team emails get "a human in the loop final review… on Slack." The web page was only the link target. (#6654)
Sep 24	Held emails inside /review	Holds had no list, only Slack links. Added as a feed, not a row type, because holds resolve through their own writer. (#11412)
Sep 28	Admin hold list	Same gap on the staff side. (#13125)
Oct 8	/held-messages/<id>	Gera overturned the Sep 19 "customers never review" rule. Reviewers needed a door, and /admin is staff-only. (ADR-0141, #18046)
Oct 10	Renewal list on that page	Monthly list as a table with renew yes/no and new rent. (#18427)

3. Why four

Each page was the smallest thing for one audience. Nobody planned a review family. No doc says why held messages are not a row of /review.
Slack came first. The bake gate was a safety net for Fede at Camellia. The page was an afterthought, and its list came four weeks later.
Policy moved three times. "No PM review queues" (Aug), then an exception for the bake gate, then "customers never review" (Sep 19), then customers do review (Oct 8). Each ruling added a door instead of moving one.
Trust was modelled as URLs, not permissions. /admin is staff-only by path, so a customer needed a second path to the same view.
The staff-loop v2 page (Sep 28) says "no review queues" while Supervised mode (Oct 1) requires one. Both are in force on paper. This proposal resolves that: Supervised mode has exactly one queue.

4. Do PropFlow staff need their own page?

No. Everything the admin page does is a permission, not a page: see every company, act on behalf of a customer in Supervised mode, and the Slack rewrite buttons. On one page, staff get a company filter and the same rows. A separate copy is how the renewal list ended up showing "Admin" and "escalation holds" to a reviewer, and how the two lists drifted (the customer queue got held emails, never renewal lists). One exception stays: life-safety pages and engineering alerts are not reviews and never enter the queue.

5. What others do

Public detail from property-management vendors is thin: AppFolio Realm-X flows "pause for a human", EliseAI, Zuma and Entrata say staff can take over, none shows a second admin screen. The clearer pattern is from AI support agents: Intercom Fin hands off into one Inbox; Salesforce Agentforce parks a draft as "Pending Agent Review" in one queue. Agent frameworks (LangGraph interrupt, OpenAI approvals, Anthropic's checkpoints) all model it as one paused action with one resume. Design writing agrees on five things: gate only what is hard to undo (outside messages, money); one canonical page; Slack and email carry buttons but deep-link to it; an append-only trail of who decided; and an aging number, because a queue approved 95% of the time is a queue to delete.

6. Proposal: one review page

Before

4 pages, 3 auth models
Renewal list reachable only by email link
Customer sees Admin chrome
Staff list and customer list drift

After

/review is the page. /review/<id> is the item.
Who sees what is a permission: reviewer = their module at their company; operator = their company; staff = all, with a filter
Email links, Slack cards, the one-tap link all land there
The monthly renewal list is one row that opens the table
Old URLs redirect, then get deleted

Four small PRs, each dark: (1) /review/<id> renders the shared held-message view under the merged permission; (2) email links and Slack cards point there; (3) the two old pages become redirects; (4) staff company filter, then delete the old pages. Approvals on a record itself (a work order quote, a turnover charge) stay on the record and also appear as a row while Clara waits. The coding-agent Decisions tab is internal and untouched.

7. Your decisions

Decided A (Fede, 2026-10-14) D1. Consolidate? A: one page as above (recommended). B: keep /review for operators and a separate approvals page for reviewers. C: leave it, rename the admin page.
Build starts after the Western Slope renewals flip is proven end to end; nothing is built tonight (Fede, 2026-10-14: 'i dont want to build more tonight').
Decided: same page with an all-companies filter, no separate admin page (Fede, 2026-10-14) D2. Staff view. Same page with an all-companies filter (recommended), or keep a separate admin page.
Decided: keep as is (Fede, 2026-10-14) D3. Slack. Keep Approve/Reject buttons in the Slack card plus a link (recommended), or link only.
D4. Renewal testing today. Keep testing on the current page now and move it to the one page after (recommended, the backend is shared), or wait for the consolidation.

Earlier rulings this touches: Sep 19 "customers never review" (overturned Oct 8 by Gera); Sep 28 staff-loop "no review queues"; Oct 1 Supervised mode named and applied to every module.