# ADR: human-gated userinput.app intake

## Decision

Radial reads configured userinput.app boards only in the browser and presents their discussions in a project-level Userinput section. An active member must review and explicitly import a discussion through an editable goal composer before its text enters Radial's fold or any agent bundle.

The board link is an admin-authored `setFeedbackSource` record. Its `source` is always the board's `at://` URI, because that is what a repo read resolves — but nothing on userinput.app shows a human one, so the board's own page address is accepted wherever the URI is and converted before the record is written. One parser does it for the settings form and for `radial project feedback-source` alike, and a link to a single discussion is refused rather than coerced: the DID in one names its author, not the board's owner. Both spellings are held to the same shape — an `at://` source is accepted only when it names a DID and the board collection, which is exactly what the page address is spelled back out of — so nothing lands in the record that a reader could not resolve, and no other operator's fold has to carry it. Imported goals carry an optional `origin` strongref pinning the discussion version the member reviewed. Constellation supplies discussion locators only; each record is fetched from its author's PDS, while moderator grants and statuses are read directly from authorized repos and folded defensively.

Foreign strongrefs are honoured by what they buy. Authority — a `member` grant over the board, a moderator `status`, an author's `edit` — counts only when it pins the exact version of the board or discussion the tab fetched; a superseded pin falls back to the board owner alone, to `open`, or to the original text, and is reported on screen rather than dropped silently. Presentation resolves by URI: a discussion pinning an older version of the board is still feedback on that board, and `goalsByOrigin` groups imported goals by the discussion URI so a later edit cannot un-badge one.

Reading a board is a function of the board's address and nothing else. The fan-out is expensive and lands on strangers' PDSes, while the space it is drawn beside is republished on every sync tick whether or not a record moved, so discovery takes no index and the space's own account of what has been imported is joined to the result only at the point of drawing. Importing therefore updates the row without a second look at the board.

## Consequences

This adds no daemon automation. Foreign text remains view-time state and cannot trigger work. Import drafts retain an explicit untrusted-input delimiter as defense in depth. Status write-back and additional source kinds, including tangled issues, remain follow-ups.