Patrick Bass Area: Forums (re-run) (audit p2r) · Surface: Mention processing — ForumController::processMentions (POST reply / new-thread) · Dimension: competitor-gap · Severity: minor
Slack, Discord, and Discourse all let members ping a role/group (@moderators, @staff, @team) to reach the right subset without an all-hands @everyone or hunting for individual usernames. In a community with sub-moderators per forum (ForumModerator model exists), '@mods' is the natural way to flag a thread for attention. Today the only escalation broadcast is the blunt mod-only @everyone, which most members cannot use and which over-notifies when they can.
Evidence
processMentions supports exactly two shapes: individual @username, and a broadcast @everyone/@all restricted to mods. ForumController.php:2300 `// Process @mentions in the post body (includes @everyone / @all for mods)`, :4102 `// @everyone / @all broadcast (mods and higher only — checked below)`, :4128 strips @everyone/@all from the per-user scan. There is no group/role token: `grep -niE '@here|group.?mention|role.?mention|@mods|@admins' src/Controllers/ForumController.php templates/forums/thread.php` finds nothing beyond the everyone/all handling. App.initMentionAutocomplete (thread.php:1471) autocompletes usernames only.Suggested fix. Add a small set of resolvable group tokens — @mods/@moderators (forum + sub mods), @admins (tenant admins) — in processMentions and in the mention autocomplete, notifying only the resolved members of that forum. Keep @everyone gated as today.
Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.
Patrick Bass
@mobieus
