Index: src/routes/posts.js
===================================================================
--- src/routes/posts.js	(revision 0688b5fcf8935a7e243f429c90946fd67027fb3c)
+++ src/routes/posts.js	(revision 1c2dcbaa5456f3903606d3d13a56c7661366fdda)
@@ -585,6 +585,7 @@
   const followed = !!req.query.followed;
   const voted = !!req.query.voted;
+  const reported = !!req.query.reported;
   let target = null, followTarget = null;
-  if (!sent && !followed && !voted && uri) {
+  if (!sent && !followed && !voted && !reported && uri) {
     try { target = await ActivityPubService.resolveRemoteNote(uri); } catch { /* ignore */ }
     // Not a post? Maybe the URI is a profile/actor → offer Follow, not reply.
@@ -600,4 +601,5 @@
     followed,
     voted: !!req.query.voted,
+    reported: !!req.query.reported,
     liked: !!req.query.liked,
     boosted: !!req.query.boosted,
@@ -617,4 +619,14 @@
   if (site && uri && choice.length) { try { await ActivityPubService.voteOnRemotePoll(site, uri, choice.map(String)); } catch { /* ignore */ } }
   res.redirect('/authorize_interaction?voted=1&uri=' + encodeURIComponent(uri));
+});
+
+// 🚩 Report a remote post/account to its home instance (sends an AS2 Flag).
+router.post('/authorize_interaction/report', requireSiteManager, async (req, res) => {
+  const site = res.locals.site;
+  const uri = (req.body.uri || '').toString();
+  const actorUri = (req.body.actor_uri || '').toString();
+  const reason = (req.body.reason || '').toString();
+  if (site && (uri || actorUri)) { try { await ActivityPubService.sendReport(site, { objectUri: uri, actorUri, reason }); } catch { /* ignore */ } }
+  res.redirect('/authorize_interaction?reported=1&uri=' + encodeURIComponent(uri || actorUri));
 });