Changelog

Trustpilot is the second review rail, and it rides the same interface Google Business Profile does — one poll, one classifier, one drafter, one morning queue. A location on each is two rows with two watermarks, and both land on the same list.

The reply is published as a named business user, which is Trustpilot's own requirement rather than ours.

A reply to a 1 or 2 star review already could not take the unattended path in code — the check is the first branch in the routing decision, before the autonomy mode is read.

It now also cannot in storage: a trigger forces the approval flag on insert and rejects any update that clears it. A bug in a route, a bad migration, or the service role in a hurry still cannot produce a low-star reply the queue thinks may post.

Approving a reply stages it rather than sending it. The publisher claims a row only once its window has elapsed, and undo inside the window is a conditional status flip — so a killed reply was never public, rather than public and then deleted.

For a review reply those are not the same thing: one that appears for eleven seconds has still been read, screenshotted and emailed.

One OAuth connect hands over every location on the account. Each keeps its own watermark, and the overnight pass advances it per review after that review is committed — so a pass that dies halfway re-reads rather than skips.