diff --git a/.context/decisions/0022-web-approval-is-dispatched-not-page-driven.md b/.context/decisions/0022-web-approval-is-dispatched-not-page-driven.md
index 1f8e218..0d20772 100644
--- a/.context/decisions/0022-web-approval-is-dispatched-not-page-driven.md
+++ b/.context/decisions/0022-web-approval-is-dispatched-not-page-driven.md
@@ -45,3 +45,13 @@ A run's progress is only as fresh as the page's 20 second refresh.
 - website#407 (list fix and interim guard) and website#408 (this change).
 - nemar-cli `src/lib/api/publish.ts` (`approvePublication`, the loop) and `backend/src/services/publication-orchestrator.ts` (step 14, `hasMore`).
 - `nemarDatasets/.github` `onboard-openneuro.yml` (the existing Actions-runs-the-CLI pattern).
+
+## Update, 2026-10-14: Approve now carries a body
+
+The decision stands: the page asks the backend to start an approval, the backend asks an executor, and the page reads the result.
+What changed is the request the page sends.
+Approve and Deny now send a body that names the request (`request_id`), and Approve sends the review in force and the reasons shown when it approves over a non-pass.
+The page also reads the API's review detail before it offers Approve, and prints the API's own `statement` and neutral `cure` for each reason, never the terminal's sentences.
+It withholds Approve when that detail cannot be read, so the old bodyless click no longer exists.
+The deploy order in Consequences gains a consequence: the page needs an API that serves the review detail (nemar-cli#1731), so the API deploys first.
+See ADR 0027.
diff --git a/.context/decisions/0027-the-admin-approval-page-prints-the-apis-review-words.md b/.context/decisions/0027-the-admin-approval-page-prints-the-apis-review-words.md
new file mode 100644
index 0000000..40669fb
--- /dev/null
+++ b/.context/decisions/0027-the-admin-approval-page-prints-the-apis-review-words.md
@@ -0,0 +1,91 @@
+# ADR 0027: The admin approval page prints the API's review words and computes no verdict
+
+**Status:** accepted
+**Date:** 2026-10-14
+**Owner:** Seyed Yahya Shirazi
+
+## Context
+
+ADR 0022 made approval a dispatched action: the page asks the backend to start it and reads what the backend reports.
+Since then the Application Programming Interface (API) has learned to derive a verdict for each publication request, from an automated review and an identifier screen, and to gate approval on it (nemar-cli ADR 0102, with its Phase 4 amendment, and ADR 0103).
+The page still showed a status badge and sent an empty body, so an administrator could not see why a request was held, and the API's gates could only refuse the click after the fact.
+The terminal words a reason with a command inside it (its `line`, and a `cure` that names the command to run), so the page cannot print those as they are.
+The API sends each reason a neutral `statement` and `cure` beside them, and the page prints those.
+
+## Decision
+
+The page fetches the API's review detail for a request and prints the API's own words.
+Each reason shows its `statement` and its neutral `cure`, the identifier screen shows its `headline` and `lines`, and the model's text appears only under a label that says the model wrote it.
+The page does not print the terminal's sentences: the terminal's `cure` carries commands, so the page never prints `line`, `command`, `description.lines`, `description.next`, or the `message` of a refusal that names a terminal step.
+It transcribes only a 22-key table of the sentences the API words for a terminal, kept in `src/lib/publication-review-copy.ts` and checked against the nemar-cli copy by a drift test, the arrangement of ADR 0015.
+It never computes a verdict.
+It never offers Approve for a reason no override clears, and it sends `request_id` with every approve and deny and, for an override, the review in force and exactly the reasons it showed.
+The review start sends no `request_id`: it acts on the active request, and its own refusals cover a request that has moved.
+The rulings below settle the cases the design left open.
+
+- **A hard reason withholds Approve whatever `gate` says.**
+  The API does not gate on an advice-only review, but the page fails closed on a hard reason regardless, so an unknown `cleared_by` word is also a hard reason.
+  An administrator who needs to approve such a request uses the terminal.
+  A run that has started publishing is exempt: it passed the gates when it started, so its panel offers "Continue approval" whatever reasons now stand.
+- **A blocked request, and a screen that says `blocks`, `rerun` or `wait`, withhold Approve.**
+  The API refuses every blocked request, even a walked-back run, so the page withholds Approve for one before it looks at anything else.
+  The identifier screen's `blocks` (a direct identifier), `rerun` (no verdict) and `wait` (still running) each withhold it with the shared sentence for that gate, added to the hard-reason line when both apply.
+  Of the other screen words, `acknowledge` offers Approve with a reason to record, and `clear` and `exempt` offer it with none.
+- **When an override-class reason stands and there is no review row, the words depend on whether a review can be started.**
+  If the detail offers a start (`start_offered` is true), the line is the shared `gate.no_review_row` sentence.
+  If it does not, the line is a page-owned word in `src/lib/publication-review.ts`, outside the mirrored table: "No review of this commit is on record and none can be started from this page, so Approve is not offered."
+  The shared sentence ends by telling the reader to start the review, which is wrong for a request no start can reach.
+- **There is no fallback to the old bodyless click.**
+  If the detail cannot be read, the page withholds Approve and prints the shared "could not be read just now" sentence (`approve.unavailable`).
+  It says it is out of step with the API only when the API is older than the page or the answer cannot be trusted, and then it withholds the whole panel and prints no reason at all.
+  The answer cannot be trusted when any of these holds:
+  `request_id` is not an integer;
+  `request_status` is not a string;
+  `gate` is not one of `enforced`, `off` or `n/a`;
+  `screen_gate` is not one of `clear`, `blocks`, `acknowledge`, `rerun`, `wait` or `exempt`;
+  `anonymous`, `applies`, `started_publishing` or `start_offered` is not a boolean;
+  `reasons` is not a list in which every reason has string `code`, `class`, `cleared_by`, `sentence` and `cure` and a non-empty string `statement`;
+  `description` or `identifier_screen` lacks a string `headline` or `tone`, or the screen's `lines` is not a list of strings;
+  or `review` is neither null nor a record with an integer `id`, a list of fact notes and a list of findings.
+  An old API that sends no `statement`, or an empty one (the page prints `statement`, never `sentence`), therefore gets the out-of-step sentence and never has a terminal `line` printed in its place.
+  A fallback would be a way around the page's own rules.
+- **A detail that is not found prints the Worker's sentence.**
+  A 404 from the detail route means the request is closed, and the Worker's sentence says so; "reload" would be wrong advice, so the page prints that sentence and offers no refresh link.
+- **The reason for the identifier screen is always asked for when the screen says `acknowledge`.**
+  The API would pass without one when this administrator's own acknowledgment is already on the request, but the page does not read that, so it asks again.
+  Sending it again is accepted and recorded again, so the cost is friction and no wrong approval.
+- **A stopped approval that never started publishing is offered as a fresh approval.**
+  The API gates a stopped run like a fresh one, so the panel asks for the typed word, and for an override or a reason when they are needed.
+  Its button reads "Approve and publish" where the row's own button reads "Resume approval"; only a run that has started publishing is continued without the gates, and its panel button reads "Continue approval".
+  When the row's own button reads "Retry approval", an approve offered again, the panel's button says "Retry approval" too, so the two never name one action two ways.
+- **A failure is worded by the page, never by the Worker's sentence, where that sentence could name a terminal.**
+  A 401 or 403 that carries only a sentence prints the page's own "sign in again" word, because an inactive account's refusal names a terminal command.
+  The one exception is the origin guard's 403 (code `origin_not_allowed`): its sentence names no terminal, so the page prints the Worker's sentence for it.
+  An approve that gets no answer (a missed deadline, a dead connection, or the proxy's own `upstream_unreachable` or `upstream_redirect` 502) says the approval may have started and asks the administrator to refresh and check before trying again, because the dispatch may have gone out; the API's lease makes a retry a harmless refusal.
+- **The API deploys before the website.**
+  A page promoted ahead of the API gets a detail without `statement`, so it withholds the panel, prints "out of step" and offers no Approve, and it never falls back to the terminal's `line`.
+  The release that carries this page therefore waits for the API that carries nemar-cli#1731.
+
+## Consequences
+
+The page prints one authoritative reading of each request, and a cure that changes with the request (the dataset, whether a start can reach it, the detail of a failed question) needs no second copy on the website.
+A stale page is caught by the API's guards, which answer with a typed refusal; the page then refetches the detail rather than rendering the refusal's own reasons.
+The words with no counterpart in the API, the class tags and the "out of step" sentence among them, stay page-owned and unmirrored.
+The 22-key table is held by its own tests, a rule that every key has a consumer on the page, and a drift test against nemar-cli `dev`; the strict path in nemar-cli's continuous integration needs this file on `staging` first.
+An administrator cannot approve from the page a request whose only blocker is a hard reason or a missing review that cannot be started; the terminal remains for those.
+The page cannot run the identifier screen again (nemarOrg/website#461) or mail the depositor a comment (nemarOrg/website#462).
+The `identifiers_found` badge, "Identifiers found", also shows on the depositor's dashboard card, because both surfaces draw it from the one `PublishStateBadge` component.
+
+## Alternatives considered
+
+- **Transcribe all 24 reasons and their composition:** a second copy of what changes per request, which the drift tests of ADR 0015 exist to catch.
+- **Run the verdict in the browser:** a second implementation of the rules would drift from the API's, which is the failure ADR 0015 exists to prevent.
+- **Extend `ConfirmDialog` with a slot:** it is a shared component, and the page needs the controls (a confirmation and a recorded reason of 10 to 500 characters) before the typed `PUBLISH` dialog, which stays the last step and is unchanged.
+- **Keep the bodyless click when the detail fails:** it would let an administrator past the rules the page exists to show.
+
+## Receipts
+
+- nemar-cli#1731 (Phase 4) of epic nemar-cli#1726; website#459.
+- nemar-cli ADR 0102 (Phase 4 amendment) and ADR 0103.
+- Website ADR 0015 (mirrored copy and drift tests) and ADR 0022 (dispatched approval).
+- The captured API response fixtures under `test/fixtures/`, each with a note on how it was captured.
diff --git a/.context/decisions/README.md b/.context/decisions/README.md
index 583f4de..c7ec792 100644
--- a/.context/decisions/README.md
+++ b/.context/decisions/README.md
@@ -58,3 +58,4 @@ Add new entries here as you create ADRs:
 - ADR 0024 - [Embed calls are counted at the edge, from the request alone](0024-embed-calls-counted-at-the-edge.md) (accepted)
 - ADR 0025 - [Catalog reads are cached for minutes to hours and fall back to a stale copy](0025-catalog-reads-cached-with-stale-if-error.md) (accepted)
 - ADR 0026 - [Server-side calls to the API go over a service binding that names the visitor](0026-server-side-api-calls-go-over-a-service-binding.md) (accepted)
+- ADR 0027 - [The admin approval page prints the API's review words and computes no verdict](0027-the-admin-approval-page-prints-the-apis-review-words.md) (accepted)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3493569..8c44661 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,6 +105,10 @@ jobs:
       # sparse-checkout list is the whole cost of covering another contract.
       # test/private-site-contract-drift.test.ts is the third, against
       # shared/contract/private-site.ts.
+      # test/publication-review-copy-drift.test.ts is a FOURTH, against
+      # shared/contract/publication-review-copy.ts; same `dev` pairing.
+      # The same test also compares the page's numbers with shared/publication-limits.ts, which
+      # sits beside the contract directory; without it that test skips, visibly.
       - uses: actions/checkout@v4
         with:
           repository: nemarOrg/nemar-cli
@@ -113,6 +117,8 @@ jobs:
             /shared/contract/account-copy.ts
             /shared/contract/docs-auth.ts
             /shared/contract/private-site.ts
+            /shared/contract/publication-review-copy.ts
+            /shared/publication-limits.ts
           sparse-checkout-cone-mode: false
           ref: dev
       - name: Vitest
@@ -121,6 +127,7 @@ jobs:
           NEMAR_CLI_ACCOUNT_COPY: nemar-cli-contract/shared/contract/account-copy.ts
           NEMAR_CLI_DOCS_CONTRACT: nemar-cli-contract/shared/contract/docs-auth.ts
           NEMAR_CLI_PRIVATE_SITE_CONTRACT: nemar-cli-contract/shared/contract/private-site.ts
+          NEMAR_CLI_REVIEW_COPY: nemar-cli-contract/shared/contract/publication-review-copy.ts
 
   build:
     name: build
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fdfdc6b..ae1f2e6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,24 @@ The release pull request from `staging` to `main` moves those entries under the
 
 ## [Unreleased]
 
+### Added
+
+- **The admin publication page shows the review and the identifier screen** (#459, ADR 0027; nemar-cli#1731).
+  Each pending, approving or blocked request shows a review chip and a screen chip from the list.
+  A review panel, fetched when an administrator opens it, shows the reasons in the API's own `statement` and neutral `cure` (never the terminal's sentences, whose `cure` carries commands), the identifier screen, and the model's summary and notes under a label that says the model wrote them.
+  Approve is absent for a reason no override clears, needs an explicit confirmation to approve over a non-pass, and needs a recorded reason of 10 to 500 characters when the identifier screen found something to read.
+  Every Approve and Deny now names the request it was for, and each refusal the API gives is shown in plain words.
+  A review can be started from the panel when the API offers one.
+  There is no fallback to the old click that sent nothing: if the review detail cannot be read, the page says so and withholds Approve, and if the API predates the page or sends an answer the page cannot trust, it says it is out of step.
+  An approve that gets no answer, or only the proxy's own 502, says the approval may have started and asks for a refresh.
+  A 401 or 403 for a signed-out or not-allowed account shows the page's own "sign in again" sentence, never the API's, because an inactive account's refusal can name a terminal command.
+  The one exception is the origin guard's 403 (code `origin_not_allowed`), whose sentence names no terminal and is printed as the API words it.
+  A result for a review panel that was closed meanwhile appears in the page's error region instead of a hidden panel.
+  This needs the API side (nemar-cli#1731), which must be deployed to the API before the website: an older API sends no `statement`, so the page withholds the panel and Approve and says it is out of step.
+- **A request blocked by the identifier screen has its own badge** (#459).
+  The seventh block reason, `identifier_screen_findings`, reads "Identifiers found" instead of the neutral "Blocked".
+  The badge also shows on the depositor's dashboard card.
+
 ### Changed
 
 - **Account copy matches nemar-cli `dev` again** (#464).
diff --git a/src/components/ConfirmDialog.astro b/src/components/ConfirmDialog.astro
index e6b5c35..2ad572b 100644
--- a/src/components/ConfirmDialog.astro
+++ b/src/components/ConfirmDialog.astro
@@ -205,6 +205,9 @@ const bodyId = `${dialogId}-body`;
       if (e.detail?.dialogId !== id) return;
       if (verifyInput) verifyInput.value = "";
       syncSubmitEnabled();
+      // An Escape close leaves returnValue as the last confirm set it, so a stale "confirm" would
+      // fire the confirm event on the next Escape. Start every opening from nothing.
+      dialog.returnValue = "";
       dialog.showModal();
       (verifyInput ?? cancelBtn)?.focus();
     });
@@ -226,6 +229,7 @@ const bodyId = `${dialogId}-body`;
           );
         }
       }
+      dialog.returnValue = "";
       if (verifyInput) verifyInput.value = "";
       syncSubmitEnabled();
     });
diff --git a/src/components/PublicationRequestRow.astro b/src/components/PublicationRequestRow.astro
index c39e358..06aac79 100644
--- a/src/components/PublicationRequestRow.astro
+++ b/src/components/PublicationRequestRow.astro
@@ -3,6 +3,8 @@ import { type PublicationRequest, deriveAdminBadgeState } from "../lib/admin-api
 import { WEB_PUBLISH_APPROVE_ENABLED } from "../lib/flags";
 import { formatRelativeTime, parseBackendTimestamp } from "../lib/format";
 import { rowView } from "../lib/publication-queue";
+import { ACTIVE_STATUSES, rowChips } from "../lib/publication-review";
+import { titleIdOf, toggleLabels } from "../lib/publication-review-panel";
 import PublishStateBadge from "./PublishStateBadge.astro";
 
 interface Props {
@@ -43,6 +45,15 @@ const decided =
 // The username is nullable on the backend; fall back to the email so the line
 // is never blank.
 const requester = request.requested_by_username || request.requested_by_email;
+// The review chips and the review panel exist only for a request the detail route answers for: an
+// active one. The chips print the API's own headlines and decide nothing; the panel is filled by
+// the page script when an administrator opens it, so its `data-` attributes are all it is given.
+const reviewable = ACTIVE_STATUSES.includes(request.status);
+const chips = rowChips(request);
+const panelId = `pubreq-review-${datasetId}`;
+// The toggle's word and accessible name: the word is constant and the name starts with it; every
+// row's says the same, so the id tells them apart. A stylesheet draws the open state.
+const toggle = toggleLabels(false, datasetId);
 ---
 
 <article class="pubreq-row" data-pubreq-row data-dataset-id={datasetId}>
@@ -52,6 +63,21 @@ const requester = request.requested_by_username || request.requested_by_email;
     <PublishStateBadge state={state} />
   </div>
 
+  {(chips.review || chips.screen) && (
+    <div class="pubreq-chips">
+      {chips.review && (
+        <span class={`pubreq-chip pubreq-chip--${chips.review.tone}`} data-pubreq-review-chip>
+          {chips.review.text}
+        </span>
+      )}
+      {chips.screen && (
+        <span class={`pubreq-chip pubreq-chip--${chips.screen.tone}`} data-pubreq-screen-chip>
+          {chips.screen.text}
+        </span>
+      )}
+    </div>
+  )}
+
   <dl class="pubreq-row__meta">
     <div>
       <dt>Requested by</dt>
@@ -120,6 +146,25 @@ const requester = request.requested_by_username || request.requested_by_email;
     </p>
   )}
 
+  {reviewable && (
+    <p class="pubreq-review__live" role="status" data-pubreq-review-live></p>
+  )}
+
+  {reviewable && (
+    <section
+      class="pubreq-review"
+      id={panelId}
+      tabindex="-1"
+      aria-labelledby={titleIdOf(panelId)}
+      data-pubreq-review-panel
+      data-dataset-id={datasetId}
+      data-request-id={request.id}
+      data-row-start={view.start?.kind ?? "none"}
+      data-row-label={view.start?.label}
+      hidden
+    />
+  )}
+
   <footer class="pubreq-row__actions">
     <a class="pubreq-row__btn" href={`/dataset/${encodeURIComponent(datasetId)}`}>
       View dataset
@@ -130,10 +175,24 @@ const requester = request.requested_by_username || request.requested_by_email;
         class="pubreq-row__btn pubreq-row__btn--danger-ghost"
         data-pubreq-deny
         data-dataset-id={datasetId}
+        data-request-id={request.id}
       >
         Deny
       </button>
     )}
+    {reviewable && (
+      <button
+        type="button"
+        class="pubreq-row__btn pubreq-review-toggle"
+        data-pubreq-review-toggle
+        data-dataset-id={datasetId}
+        aria-label={toggle.ariaLabel}
+        aria-expanded={toggle.expanded}
+        aria-controls={panelId}
+      >
+        {toggle.text}
+      </button>
+    )}
     {view.start?.kind === "approve" && (
       <button
         type="button"
@@ -141,6 +200,7 @@ const requester = request.requested_by_username || request.requested_by_email;
         data-pubreq-approve
         data-anonymous={view.anonymous ? "true" : undefined}
         data-dataset-id={datasetId}
+        data-request-id={request.id}
       >
         {view.start.label}
       </button>
@@ -151,6 +211,7 @@ const requester = request.requested_by_username || request.requested_by_email;
         class="pubreq-row__btn pubreq-row__btn--primary"
         data-pubreq-resume
         data-dataset-id={datasetId}
+        data-request-id={request.id}
       >
         {view.start.label}
       </button>
@@ -188,6 +249,35 @@ const requester = request.requested_by_username || request.requested_by_email;
     letter-spacing: -0.005em;
     line-height: var(--lh-snug);
   }
+  .pubreq-chips {
+    display: flex;
+    flex-wrap: wrap;
+    gap: var(--space-2);
+  }
+  /* A chip prints the API's headline as it came. Its tone is a bar on the inline start edge, so the
+     words, not the color, carry the meaning. */
+  .pubreq-chip {
+    min-inline-size: 0;
+    padding: 2px var(--space-3);
+    border: 1px solid var(--color-border-strong);
+    border-radius: var(--radius-sm);
+    background: var(--admin-surface-2);
+    color: var(--color-fg);
+    font-size: var(--fs-xs);
+    overflow-wrap: anywhere;
+  }
+  .pubreq-chip--ok {
+    box-shadow: inset 3px 0 0 var(--admin-ok);
+  }
+  .pubreq-chip--note {
+    box-shadow: inset 3px 0 0 var(--admin-text-3);
+  }
+  .pubreq-chip--warn {
+    box-shadow: inset 3px 0 0 var(--admin-warn);
+  }
+  .pubreq-chip--stop {
+    box-shadow: inset 3px 0 0 var(--admin-error);
+  }
   .pubreq-row__meta {
     display: grid;
     grid-template-columns: repeat(auto-fit, minmax(9rem, 1fr));
@@ -328,7 +418,8 @@ const requester = request.requested_by_username || request.requested_by_email;
     }
   }
   @media (forced-colors: active) {
-    .pubreq-row__reason {
+    .pubreq-row__reason,
+    .pubreq-chip {
       border-inline-start: 3px solid CanvasText;
     }
   }
diff --git a/src/components/PublishStateBadge.astro b/src/components/PublishStateBadge.astro
index cb5de6f..05ff705 100644
--- a/src/components/PublishStateBadge.astro
+++ b/src/components/PublishStateBadge.astro
@@ -2,11 +2,12 @@
 /**
  * The badge on a dataset card and in the admin publication queue.
  *
- * Four of the eight states describe a blocked request (website#304), because
+ * Five of the nine states describe a blocked request (website#304), because
  * "Validation failed" was only ever right for the blocks that mean the
  * DATASET failed a gate. `owner_name_missing` is an account property,
  * `validation_pending` is validation that has not finished rather than
- * failed, and `blocked` is what an unrecognised reason gets — see
+ * failed, `identifiers_found` is the identifier screen finding a direct
+ * identifier in the dataset, and `blocked` is what an unrecognised reason gets — see
  * `src/lib/publication-block.ts` for the mapping.
  */
 import type { DatasetPublishState } from "../lib/dashboard-api";
@@ -24,6 +25,7 @@ const LABELS: Record<DatasetPublishState, string> = {
   validation_failed: "Validation failed",
   validation_pending: "Validation pending",
   name_required: "Name required",
+  identifiers_found: "Identifiers found",
   blocked: "Blocked",
   denied: "Denied",
 };
@@ -81,6 +83,25 @@ const label = LABELS[state];
     background: color-mix(in srgb, var(--color-warning) 12%, transparent);
     border-color: color-mix(in srgb, var(--color-warning) 35%, transparent);
   }
+  /* Red, like validation_failed: the dataset itself holds the identifier and
+     CI is not pending, so this is neither a wait nor an account fix. */
+  .publish-state-badge--identifiers_found {
+    color: var(--color-danger);
+    background: color-mix(in srgb, var(--color-danger) 10%, transparent);
+    border-color: color-mix(in srgb, var(--color-danger) 35%, transparent);
+  }
+  /* --color-danger has no dark value (about 2.5:1 on the dark card), so this badge, the one added
+     for the identifier screen, lifts its text with the admin error text token. Both branches are
+     required: the media query for the system default, the attribute for an explicit choice. The
+     older danger badges keep the shared token. */
+  @media (prefers-color-scheme: dark) {
+    :global(:root:not([data-theme="light"])) .publish-state-badge--identifiers_found {
+      color: var(--admin-error-text);
+    }
+  }
+  :global(:root[data-theme="dark"]) .publish-state-badge--identifiers_found {
+    color: var(--admin-error-text);
+  }
   /* The reason is unknown to this build, so the tone says "stopped" without
      claiming a cause. */
   .publish-state-badge--blocked {
diff --git a/src/lib/admin-api.test.ts b/src/lib/admin-api.test.ts
index 1a83814..8f33253 100644
--- a/src/lib/admin-api.test.ts
+++ b/src/lib/admin-api.test.ts
@@ -1,11 +1,18 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import fixture from "../../test/fixtures/admin-publish-requests.json";
+import { asResponse, fixture as captured } from "../../test/publication-review-fixtures";
 import {
   ADMIN_TIMEOUTS_MS,
+  PublicationApiError,
   denyPublicationRequest,
   dispatchPublicationApproval,
+  getPublicationReview,
   listPublicationRequests,
+  readFailure,
+  startPublicationReview,
 } from "./admin-api";
+import { DashboardApiError } from "./dashboard-api";
+import type { ApproveBody, PublicationReviewDetail } from "./publication-review";
 
 describe("listPublicationRequests", () => {
   it("hits /admin/publish/requests with no query when filter is empty", async () => {
@@ -78,7 +85,10 @@ describe("dispatchPublicationApproval", () => {
         { status: 202, headers: { "Content-Type": "application/json" } },
       );
     }) as unknown as typeof fetch;
-    const out = await dispatchPublicationApproval("nm000288", { fetch: fakeFetch });
+    const out = await dispatchPublicationApproval("nm000288", {
+      fetch: fakeFetch,
+      body: { request_id: 833 },
+    });
     expect(out).toEqual({
       status: "dispatched",
       dataset_id: "nm000288",
@@ -96,7 +106,7 @@ describe("dispatchPublicationApproval", () => {
         }),
     ) as unknown as typeof fetch;
     await expect(
-      dispatchPublicationApproval("nm000288", { fetch: fakeFetch }),
+      dispatchPublicationApproval("nm000288", { fetch: fakeFetch, body: { request_id: 833 } }),
     ).rejects.toMatchObject({ name: "DashboardApiError", status: 409, code: "already_in_flight" });
   });
 
@@ -110,9 +120,9 @@ describe("dispatchPublicationApproval", () => {
           statusText: "Not Found",
         }),
     ) as unknown as typeof fetch;
-    await expect(dispatchPublicationApproval("nm000288", { fetch: fakeFetch })).rejects.toThrow(
-      "No active publication request found",
-    );
+    await expect(
+      dispatchPublicationApproval("nm000288", { fetch: fakeFetch, body: { request_id: 833 } }),
+    ).rejects.toThrow("No active publication request found");
   });
 });
 
@@ -120,7 +130,7 @@ describe("denyPublicationRequest", () => {
   it("POSTs to /admin/publish/:id/deny with the reason body", async () => {
     const fakeFetch = vi.fn(async (url: string, init: RequestInit) => {
       expect(url).toBe("/api/v1/admin/publish/nm-xyz/deny");
-      expect(init.body).toBe(JSON.stringify({ reason: "BIDS validation failing" }));
+      expect(init.body).toBe(JSON.stringify({ reason: "BIDS validation failing", request_id: 5 }));
       // The shape nemar-cli's deny route answers with.
       return new Response(
         JSON.stringify({
@@ -133,6 +143,7 @@ describe("denyPublicationRequest", () => {
     }) as unknown as typeof fetch;
     const out = await denyPublicationRequest("nm-xyz", "BIDS validation failing", {
       fetch: fakeFetch,
+      requestId: 5,
     });
     expect(out.reason).toBe("BIDS validation failing");
   });
@@ -145,9 +156,9 @@ describe("denyPublicationRequest", () => {
           statusText: "Not Found",
         }),
     ) as unknown as typeof fetch;
-    await expect(denyPublicationRequest("nm-xyz", "spam", { fetch: fakeFetch })).rejects.toThrow(
-      "Deny failed: No active publication request found",
-    );
+    await expect(
+      denyPublicationRequest("nm-xyz", "spam", { fetch: fakeFetch, requestId: 5 }),
+    ).rejects.toThrow("Deny failed: No active publication request found");
   });
 
   it("rejects an empty reason before making the request", async () => {
@@ -155,7 +166,7 @@ describe("denyPublicationRequest", () => {
       async () => new Response(JSON.stringify({}), { status: 200 }),
     ) as unknown as typeof fetch;
     await expect(
-      denyPublicationRequest("nm-xyz", "   ", { fetch: fakeFetch }),
+      denyPublicationRequest("nm-xyz", "   ", { fetch: fakeFetch, requestId: 5 }),
     ).rejects.toMatchObject({
       name: "DashboardApiError",
       code: "missing_field",
@@ -165,7 +176,7 @@ describe("denyPublicationRequest", () => {
 
   it("trims the reason before sending", async () => {
     const fakeFetch = vi.fn(async (_url: string, init: RequestInit) => {
-      expect(init.body).toBe(JSON.stringify({ reason: "no" }));
+      expect(init.body).toBe(JSON.stringify({ reason: "no", request_id: 5 }));
       return new Response(
         JSON.stringify({
           message: "Publication request denied",
@@ -175,7 +186,7 @@ describe("denyPublicationRequest", () => {
         { status: 200 },
       );
     }) as unknown as typeof fetch;
-    await denyPublicationRequest("nm-xyz", "   no   ", { fetch: fakeFetch });
+    await denyPublicationRequest("nm-xyz", "   no   ", { fetch: fakeFetch, requestId: 5 });
     expect(fakeFetch).toHaveBeenCalledOnce();
   });
 });
@@ -199,13 +210,21 @@ describe("request deadlines", () => {
 
   it("aborts a hung dispatch rather than leaving the button stuck", async () => {
     await expect(
-      dispatchPublicationApproval("nm-xyz", { fetch: hangingFetch, timeoutMs: 10 }),
+      dispatchPublicationApproval("nm-xyz", {
+        fetch: hangingFetch,
+        timeoutMs: 10,
+        body: { request_id: 1 },
+      }),
     ).rejects.toMatchObject({ name: "TimeoutError" });
   });
 
   it("aborts a hung deny rather than leaving the button stuck", async () => {
     await expect(
-      denyPublicationRequest("nm-xyz", "spam", { fetch: hangingFetch, timeoutMs: 10 }),
+      denyPublicationRequest("nm-xyz", "spam", {
+        fetch: hangingFetch,
+        timeoutMs: 10,
+        requestId: 1,
+      }),
     ).rejects.toMatchObject({ name: "TimeoutError" });
   });
 
@@ -257,6 +276,7 @@ describe("deadline wiring", () => {
     const spy = vi.spyOn(AbortSignal, "timeout");
     await dispatchPublicationApproval("nm-xyz", {
       fetch: okFetch({ status: "dispatched", dataset_id: "nm-xyz", request_id: 1, resume: false }),
+      body: { request_id: 1 },
     });
     expect(spy).toHaveBeenCalledWith(ADMIN_TIMEOUTS_MS.dispatch);
   });
@@ -269,7 +289,434 @@ describe("deadline wiring", () => {
         dataset_id: "nm-xyz",
         reason: "spam",
       }),
+      requestId: 1,
     });
     expect(spy).toHaveBeenCalledWith(ADMIN_TIMEOUTS_MS.deny);
   });
 });
+
+// ---------------------------------------------------------------------------------------------
+// The review calls. Every answer below is a body the real Worker produced, captured under
+// `test/fixtures/publication-review/`; the fetch is a plain function that records the call and
+// returns that body as a real `Response`.
+// ---------------------------------------------------------------------------------------------
+
+interface Call {
+  readonly url: string;
+  readonly init: RequestInit;
+}
+
+function answering(name: string): { calls: Call[]; fetchImpl: typeof fetch } {
+  const calls: Call[] = [];
+  const fetchImpl = (async (url: string, init: RequestInit) => {
+    calls.push({ url, init });
+    return asResponse(captured(name));
+  }) as unknown as typeof fetch;
+  return { calls, fetchImpl };
+}
+
+/** The header names a call sent, lower-cased, so a test can say one is absent. */
+const headerNames = (init: RequestInit): string[] =>
+  Object.keys((init.headers ?? {}) as Record<string, string>).map((h) => h.toLowerCase());
+
+async function thrown(promise: Promise<unknown>): Promise<unknown> {
+  try {
+    await promise;
+  } catch (err) {
+    return err;
+  }
+  throw new Error("expected the call to throw");
+}
+
+describe("readFailure", () => {
+  it("files a gate refusal's code, refusal and headline", async () => {
+    expect(await readFailure(asResponse(captured("approve-needs-override")))).toEqual({
+      status: 409,
+      code: "publication_review_not_clear",
+      message: (captured("approve-needs-override").body as { message: string }).message,
+      refusal: "needs_override",
+      headline: "Publication review: FAIL",
+    });
+  });
+
+  it("files a screen refusal's gate", async () => {
+    const failure = await readFailure(asResponse(captured("approve-screen-acknowledge")));
+    expect(failure.code).toBe("identifier_screen_not_clear");
+    expect(failure.gate).toBe("acknowledge");
+    expect(failure.headline).toBe("Identifier screen: needs review");
+  });
+
+  it("takes the review routes' convention: a sentence in error and the word in code", async () => {
+    expect(await readFailure(asResponse(captured("start-bad-dataset")))).toEqual({
+      status: 400,
+      code: "bad_dataset",
+      message: "That is not a dataset id.",
+    });
+    expect((await readFailure(asResponse(captured("start-running")))).code).toBe("running");
+  });
+
+  it("takes the older convention: the word in error and a sentence in message", async () => {
+    const failure = await readFailure(asResponse(captured("approve-not-dispatchable")));
+    expect(failure.code).toBe("not_dispatchable");
+    expect(failure.message).toContain("blocked");
+  });
+
+  it("takes the origin guard's word, and its sentence from message", async () => {
+    expect(await readFailure(asResponse(captured("origin-not-allowed")))).toEqual({
+      status: 403,
+      code: "origin_not_allowed",
+      message: "This request did not come from a NEMAR page, so it was not accepted.",
+    });
+  });
+
+  it("files a lone sentence as a message with no code", async () => {
+    expect(await readFailure(asResponse(captured("deny-not-found")))).toEqual({
+      status: 404,
+      message: "No active publication request found",
+    });
+  });
+
+  it("reads an error that is an object as unknown: no code, no message", async () => {
+    // The deny route's validation failure is `{ success: false, error: { ...ZodError } }`.
+    expect(await readFailure(asResponse(captured("deny-invalid-body")))).toEqual({ status: 400 });
+  });
+
+  it.each([
+    ["an array", "[1, 2]"],
+    ["null", "null"],
+    ["a string", '"Bad gateway"'],
+    ["a number", "7"],
+  ])("keeps only the status of a JSON body that is %s", async (_what, raw) => {
+    // Derived inputs: JSON that parses but is not an object, which no capture is.
+    expect(await readFailure(new Response(raw, { status: 502 }))).toEqual({ status: 502 });
+  });
+
+  it("files an empty error string as neither a code nor a message", async () => {
+    const res = new Response(JSON.stringify({ error: "" }), { status: 500 });
+    expect(await readFailure(res)).toEqual({ status: 500 });
+  });
+
+  it("lets a message win over a sentence-valued error, and keeps the code from code", async () => {
+    const res = new Response(
+      JSON.stringify({ error: "A sentence in error", message: "The message", code: "a_word" }),
+      { status: 409 },
+    );
+    expect(await readFailure(res)).toEqual({
+      status: 409,
+      code: "a_word",
+      message: "The message",
+    });
+  });
+
+  it("rethrows a read error that is not a parse error", async () => {
+    // A derived input: a body that fails while it is read (a dropped connection), not while it parses.
+    const stream = new ReadableStream({
+      start(controller) {
+        controller.error(new TypeError("connection dropped"));
+      },
+    });
+    await expect(readFailure(new Response(stream, { status: 502 }))).rejects.toThrow(
+      "connection dropped",
+    );
+  });
+
+  it("keeps only the status of a body that is not JSON", async () => {
+    // A branch no capture reaches: a gateway page in place of the Worker's JSON.
+    const res = new Response("<html>Bad gateway</html>", { status: 502 });
+    expect(await readFailure(res)).toEqual({ status: 502 });
+  });
+});
+
+describe("getPublicationReview", () => {
+  it("GETs /admin/publish/:id/review with no body and no content type", async () => {
+    const { calls, fetchImpl } = answering("detail-pass");
+    const out = await getPublicationReview("nm000712", { fetch: fetchImpl });
+    expect(calls).toHaveLength(1);
+    expect(calls[0].url).toBe("/api/v1/admin/publish/nm000712/review");
+    expect(calls[0].init.method).toBe("GET");
+    expect(calls[0].init.credentials).toBe("include");
+    expect(calls[0].init.body).toBeUndefined();
+    expect(headerNames(calls[0].init)).toEqual(["accept"]);
+    expect(out.request_id).toBe(
+      (captured("detail-pass").body as PublicationReviewDetail).request_id,
+    );
+    expect(out.screen_gate).toBe("clear");
+  });
+
+  it("goes straight to the API with the cookie when rendered on the server", async () => {
+    const { calls, fetchImpl } = answering("detail-pass");
+    await getPublicationReview("nm000712", { fetch: fetchImpl, cookieHeader: "session=abc" });
+    expect(calls[0].url).toMatch(/\/admin\/publish\/nm000712\/review$/);
+    expect(calls[0].url.startsWith("/api/v1")).toBe(false);
+    expect((calls[0].init.headers as Record<string, string>).Cookie).toBe("session=abc");
+  });
+
+  it("throws what the Worker said when there is no active request", async () => {
+    const { fetchImpl } = answering("detail-not-found");
+    const err = await thrown(getPublicationReview("nm000726", { fetch: fetchImpl }));
+    expect(err).toBeInstanceOf(PublicationApiError);
+    expect(err).toBeInstanceOf(DashboardApiError);
+    const failure = (err as PublicationApiError).failure;
+    expect(failure.status).toBe(404);
+    expect(failure.code).toBe("not_found");
+    expect(failure.message).toBe("nm000726 has no active publication request.");
+    expect((err as PublicationApiError).code).toBe("not_found");
+  });
+});
+
+describe("startPublicationReview", () => {
+  it("POSTs to /review/start with no body and no content type", async () => {
+    const { calls, fetchImpl } = answering("start-202-dispatched");
+    const out = await startPublicationReview("nm000712", { fetch: fetchImpl });
+    expect(calls[0].url).toBe("/api/v1/admin/publish/nm000712/review/start");
+    expect(calls[0].init.method).toBe("POST");
+    expect(calls[0].init.credentials).toBe("include");
+    expect(calls[0].init.body).toBeUndefined();
+    expect(headerNames(calls[0].init)).toEqual(["accept"]);
+    expect(out).toMatchObject({ started: true, reason: "dispatched" });
+  });
+
+  it("treats the Worker's 502 as a failure carrying its word and sentence", async () => {
+    const { fetchImpl } = answering("start-502-unconfigured");
+    const err = await thrown(startPublicationReview("nm000712", { fetch: fetchImpl }));
+    expect(err).toBeInstanceOf(PublicationApiError);
+    const failure = (err as PublicationApiError).failure;
+    expect(failure.status).toBe(502);
+    expect(failure.code).toBe("dispatch_unconfigured");
+    expect(failure.message).toContain("credential");
+  });
+
+  it("carries a refusal's code (a 409 with the word in code)", async () => {
+    const { fetchImpl } = answering("start-review-disabled");
+    const err = await thrown(startPublicationReview("nm000712", { fetch: fetchImpl }));
+    expect((err as PublicationApiError).failure.code).toBe("review_disabled");
+  });
+});
+
+describe("dispatchPublicationApproval with a body", () => {
+  const body: ApproveBody = {
+    request_id: 7,
+    acknowledge_identifier_screen: "looked at the file list",
+    override_publication_review: { review_id: 3, reasons: ["question_failed"] },
+  };
+
+  it("sends exactly the body it was given", async () => {
+    const { calls, fetchImpl } = answering("approve-202");
+    await dispatchPublicationApproval("nm000745", { fetch: fetchImpl, body });
+    expect(calls[0].init.body).toBe(JSON.stringify(body));
+    expect((calls[0].init.headers as Record<string, string>)["Content-Type"]).toBe(
+      "application/json",
+    );
+  });
+
+  it("has no bodyless click: the body is required by the type", async () => {
+    const { calls, fetchImpl } = answering("approve-202");
+    // @ts-expect-error the body is required; the old bodyless Approve no longer exists
+    await dispatchPublicationApproval("nm000745", { fetch: fetchImpl });
+    // What a caller that got past the type would send: nothing the Worker could bind to a request.
+    expect(calls[0].init.body).toBeUndefined();
+  });
+
+  it("sends an override's body whole and returns the 202 the Worker gave it", async () => {
+    // The capture is of exactly this request: an override naming `question_failed` for review 1.
+    const { calls, fetchImpl } = answering("approve-202-override");
+    const sent: ApproveBody = {
+      request_id: 1,
+      override_publication_review: { review_id: 1, reasons: ["question_failed"] },
+    };
+    const out = await dispatchPublicationApproval("nm000746", { fetch: fetchImpl, body: sent });
+    expect(JSON.parse(calls[0].init.body as string)).toEqual(sent);
+    expect(out).toEqual(captured("approve-202-override").body);
+    expect(out.status).toBe("dispatched");
+  });
+
+  it("returns the 202 body", async () => {
+    const { fetchImpl } = answering("approve-202");
+    const out = await dispatchPublicationApproval("nm000745", { fetch: fetchImpl, body });
+    expect(out).toEqual(captured("approve-202").body);
+  });
+
+  it("carries a review refusal's refusal word, and keeps the older error text and code", async () => {
+    const { fetchImpl } = answering("approve-needs-override");
+    const err = await thrown(dispatchPublicationApproval("nm000727", { fetch: fetchImpl, body }));
+    expect(err).toBeInstanceOf(PublicationApiError);
+    expect(err).toBeInstanceOf(DashboardApiError);
+    const failure = (err as PublicationApiError).failure;
+    expect(failure.refusal).toBe("needs_override");
+    expect(failure.headline).toBe("Publication review: FAIL");
+    expect(failure.gate).toBeUndefined();
+    expect((err as PublicationApiError).code).toBe("publication_review_not_clear");
+    expect((err as PublicationApiError).status).toBe(409);
+    expect((err as Error).message).toMatch(/^Approval was not started: /);
+  });
+
+  it("carries a screen refusal's gate word", async () => {
+    const { fetchImpl } = answering("approve-screen-stale");
+    const err = await thrown(dispatchPublicationApproval("nm000736", { fetch: fetchImpl, body }));
+    expect((err as PublicationApiError).failure.gate).toBe("stale");
+    expect((err as PublicationApiError).code).toBe("identifier_screen_not_clear");
+  });
+
+  it("reads the origin guard's word as the code, as before", async () => {
+    const { fetchImpl } = answering("origin-not-allowed");
+    const err = await thrown(
+      dispatchPublicationApproval("nm000745", { fetch: fetchImpl, body: { request_id: 1 } }),
+    );
+    expect((err as PublicationApiError).code).toBe("origin_not_allowed");
+    expect((err as PublicationApiError).failure.message).toContain("NEMAR page");
+  });
+});
+
+describe("denyPublicationRequest with a request id", () => {
+  it("names the request the click was for", async () => {
+    const { calls, fetchImpl } = answering("deny-200");
+    await denyPublicationRequest("nm000747", "The README does not describe the recordings.", {
+      fetch: fetchImpl,
+      requestId: 12,
+    });
+    expect(calls[0].init.body).toBe(
+      JSON.stringify({ reason: "The README does not describe the recordings.", request_id: 12 }),
+    );
+  });
+
+  it("has no unbound denial: the request id is required by the type", async () => {
+    const { calls, fetchImpl } = answering("deny-200");
+    // @ts-expect-error the request id is required; a denial always names the request clicked
+    await denyPublicationRequest("nm000747", "spam", { fetch: fetchImpl });
+    // What a caller that got past the type would send: no `request_id` for the Worker to compare.
+    expect(JSON.parse(calls[0].init.body as string)).toEqual({ reason: "spam" });
+  });
+
+  it("trims the reason and still names the request", async () => {
+    const { calls, fetchImpl } = answering("deny-200");
+    await denyPublicationRequest("nm000747", "  spam  ", { fetch: fetchImpl, requestId: 3 });
+    expect(calls[0].init.body).toBe(JSON.stringify({ reason: "spam", request_id: 3 }));
+  });
+
+  it("carries the Worker's code and sentence for a stale request", async () => {
+    const { fetchImpl } = answering("deny-request-mismatch");
+    const err = await thrown(
+      denyPublicationRequest("nm000747", "spam", { fetch: fetchImpl, requestId: 99 }),
+    );
+    expect((err as PublicationApiError).failure.code).toBe("request_mismatch");
+    expect((err as PublicationApiError).failure.message).toContain("not the one you meant");
+    expect((err as PublicationApiError).status).toBe(409);
+  });
+
+  it("carries no code and no message for the validation failure", async () => {
+    const { fetchImpl } = answering("deny-invalid-body");
+    const err = await thrown(
+      denyPublicationRequest("nm000747", "x", { fetch: fetchImpl, requestId: 1 }),
+    );
+    expect((err as PublicationApiError).failure).toEqual({ status: 400 });
+    expect((err as PublicationApiError).code).toBeUndefined();
+  });
+});
+
+describe("PublicationApiError.code", () => {
+  // One meaning on every route: the Worker's WORD, or undefined when it sent only a sentence.
+  it("is the word on the approve and deny routes, as on the review routes", async () => {
+    const approve = await thrown(
+      dispatchPublicationApproval("nm000745", {
+        fetch: answering("approve-already-in-flight").fetchImpl,
+        body: { request_id: 1 },
+      }),
+    );
+    expect((approve as PublicationApiError).code).toBe("already_in_flight");
+    const review = await thrown(
+      startPublicationReview("nm000712", { fetch: answering("start-running").fetchImpl }),
+    );
+    expect((review as PublicationApiError).code).toBe("running");
+  });
+
+  it("is undefined, never a sentence, when the Worker sent only a sentence", async () => {
+    // Derived inputs: the Worker's own 401 body (`backend/src/middleware/auth.ts`) and the deny
+    // route's sentence-only 404 (`deny-not-found`).
+    const unauthenticated = (async () =>
+      new Response(JSON.stringify({ error: "Authentication required" }), {
+        status: 401,
+      })) as unknown as typeof fetch;
+    const approve = await thrown(
+      dispatchPublicationApproval("nm000745", {
+        fetch: unauthenticated,
+        body: { request_id: 1 },
+      }),
+    );
+    expect((approve as PublicationApiError).code).toBeUndefined();
+    expect((approve as PublicationApiError).failure.code).toBeUndefined();
+    // The message still carries the sentence, as it always did.
+    expect((approve as Error).message).toBe("Approval was not started: Authentication required");
+    const deny = await thrown(
+      denyPublicationRequest("nm000747", "spam", {
+        fetch: answering("deny-not-found").fetchImpl,
+        requestId: 1,
+      }),
+    );
+    expect((deny as PublicationApiError).code).toBeUndefined();
+    expect((deny as Error).message).toBe("Deny failed: No active publication request found");
+  });
+});
+
+describe("the review calls' URLs and credentials", () => {
+  it("encode the dataset id on every call", async () => {
+    const id = "nm 0/1";
+    const encoded = encodeURIComponent(id);
+    const get = answering("detail-pass");
+    await getPublicationReview(id, { fetch: get.fetchImpl });
+    expect(get.calls[0].url).toBe(`/api/v1/admin/publish/${encoded}/review`);
+    const start = answering("start-202-dispatched");
+    await startPublicationReview(id, { fetch: start.fetchImpl });
+    expect(start.calls[0].url).toBe(`/api/v1/admin/publish/${encoded}/review/start`);
+    const approve = answering("approve-202");
+    await dispatchPublicationApproval(id, { fetch: approve.fetchImpl, body: { request_id: 1 } });
+    expect(approve.calls[0].url).toBe(`/api/v1/admin/publish/${encoded}/approve-dispatch`);
+    const deny = answering("deny-200");
+    await denyPublicationRequest(id, "spam", { fetch: deny.fetchImpl, requestId: 1 });
+    expect(deny.calls[0].url).toBe(`/api/v1/admin/publish/${encoded}/deny`);
+  });
+
+  it("send the cookie of a server-rendered caller on a start, to the API directly", async () => {
+    const { calls, fetchImpl } = answering("start-202-dispatched");
+    await startPublicationReview("nm000712", { fetch: fetchImpl, cookieHeader: "session=abc" });
+    expect(calls[0].url).toMatch(/\/admin\/publish\/nm000712\/review\/start$/);
+    expect(calls[0].url.startsWith("/api/v1")).toBe(false);
+    expect((calls[0].init.headers as Record<string, string>).Cookie).toBe("session=abc");
+    expect(headerNames(calls[0].init)).toEqual(["accept", "cookie"]);
+  });
+});
+
+describe("deadlines of the review calls", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("gives the detail read ten seconds and the start fifteen, above a plain list read", () => {
+    expect(ADMIN_TIMEOUTS_MS.review).toBe(10_000);
+    expect(ADMIN_TIMEOUTS_MS.start).toBe(15_000);
+    expect(ADMIN_TIMEOUTS_MS.review).toBeGreaterThan(ADMIN_TIMEOUTS_MS.list);
+    expect(ADMIN_TIMEOUTS_MS.start).toBeGreaterThan(ADMIN_TIMEOUTS_MS.list);
+  });
+
+  it("passes the review deadline when reading the review", async () => {
+    const spy = vi.spyOn(AbortSignal, "timeout");
+    await getPublicationReview("nm000712", { fetch: answering("detail-pass").fetchImpl });
+    expect(spy).toHaveBeenCalledWith(ADMIN_TIMEOUTS_MS.review);
+  });
+
+  it("passes the start deadline when starting a review", async () => {
+    const spy = vi.spyOn(AbortSignal, "timeout");
+    await startPublicationReview("nm000712", {
+      fetch: answering("start-202-dispatched").fetchImpl,
+    });
+    expect(spy).toHaveBeenCalledWith(ADMIN_TIMEOUTS_MS.start);
+  });
+
+  it("aborts a hung detail read and a hung start", async () => {
+    await expect(
+      getPublicationReview("nm000712", { fetch: hangingFetch, timeoutMs: 10 }),
+    ).rejects.toMatchObject({ name: "TimeoutError" });
+    await expect(
+      startPublicationReview("nm000712", { fetch: hangingFetch, timeoutMs: 10 }),
+    ).rejects.toMatchObject({ name: "TimeoutError" });
+  });
+});
diff --git a/src/lib/admin-api.ts b/src/lib/admin-api.ts
index 53a2b0a..ce7f4e2 100644
--- a/src/lib/admin-api.ts
+++ b/src/lib/admin-api.ts
@@ -1,12 +1,19 @@
 /**
- * Admin API client: list publication requests, deny them, and start their
- * approval. SSR callers pass `cookieHeader` and hit `api.nemar.org` directly;
+ * Admin API client: list publication requests, read a request's publication
+ * review, start that review, deny a request, and start its approval. SSR callers pass `cookieHeader` and hit `api.nemar.org` directly;
  * browser callers go through the same-origin `/api/v1` proxy (see
  * `dashboardApiBase` in `./api-base.ts`) so the session cookie attaches
  * automatically without broadening it to other `*.nemar.org` hosts.
  */
 import { dashboardApiBase, readError } from "./api-base";
 import { DashboardApiError, deriveAdminBadgeState } from "./dashboard-api";
+import type {
+  ApiFailure,
+  ApproveBody,
+  PublicationReviewDetail,
+  StartStartedReason,
+  Tone,
+} from "./publication-review";
 import { DEFAULT_REQUEST_TIMEOUT_MS, resolveSignal } from "./request-deadline";
 
 type Init = {
@@ -28,11 +35,16 @@ type Init = {
  *   itself no longer runs inside this request: the backend hands it to a
  *   GitHub Action and answers 202 (website#200), so this is a short deadline,
  *   not the two minutes the old blocking approve needed.
+ * - `review`: the review detail reads several tables, so it sits above a plain
+ *   list read. A judgment, not a measurement.
+ * - `start`: one DB claim plus one GitHub `repository_dispatch`, like `dispatch`.
  */
 export const ADMIN_TIMEOUTS_MS = {
   list: DEFAULT_REQUEST_TIMEOUT_MS,
   deny: 15_000,
   dispatch: 15_000,
+  review: 10_000,
+  start: 15_000,
 } as const;
 
 /**
@@ -100,6 +112,33 @@ export interface PublicationRequest {
   readonly approval_requested_by?: number | null;
   readonly approval_dispatched_at?: string | null;
   readonly approval_in_flight?: boolean;
+  /**
+   * The identifier screen's verdict as the Worker words it, and the publication review's summary.
+   * List rows of a Worker that predates the review omit both, so the page reads them as optional.
+   */
+  readonly identifier_screen?: {
+    readonly state: string | null;
+    readonly headline: string;
+    readonly tone: Tone;
+    readonly lines: readonly string[];
+  };
+  /**
+   * The list row's review summary. `kind`, `gate` and `outcome` are LOOSE on purpose (plain
+   * strings, not the contract's unions): the page only prints the headline and tone and never
+   * branches on these words, so a word a newer Worker adds cannot break it.
+   */
+  readonly publication_review?: {
+    readonly kind: string;
+    readonly enabled: boolean;
+    readonly gate: string;
+    readonly outcome: string | null;
+    readonly headline: string;
+    readonly tone: Tone;
+    readonly reasons: readonly string[];
+    readonly start_offered: boolean;
+    readonly review_id: number | null;
+    readonly head_sha: string | null;
+  };
 }
 
 export interface PublicationRequestListResponse {
@@ -148,6 +187,82 @@ function failureText(detail: { message?: string; code?: string }, res: Response)
   return res.statusText;
 }
 
+/**
+ * A failed call of the publication routes: a `DashboardApiError` that also carries what the Worker
+ * said, so `describeFailure` can pick the words (the mapper in `publication-review.ts` reads
+ * `failure`; `message` and the `name` stay what every older caller reads).
+ *
+ * `code` is the Worker's WORD on every route (`failure.code`), or undefined when the Worker sent
+ * only a sentence; it is never a sentence. `failure` carries the rest, and is what callers read.
+ */
+export class PublicationApiError extends DashboardApiError {
+  readonly failure: ApiFailure;
+  constructor(message: string, status: number, code: string | undefined, failure: ApiFailure) {
+    super(message, status, code);
+    this.failure = failure;
+  }
+}
+
+const CODE_WORD = /^[a-z][a-z0-9_]*$/;
+
+/**
+ * Read a failed answer into what the page needs, whichever convention carried it.
+ *
+ * Three conventions meet at these routes: the approval, deny and gate routes send the code in
+ * `error` and a sentence in `message`; the review routes send a sentence in `error` and the code in
+ * `code`; the origin guard sends the word in both and a sentence in `message`. The deny route's
+ * validation failure sends an OBJECT in `error`, which names no code and no sentence, so it is read
+ * as unknown rather than printed. `readError` (shared by every client) is left as it is.
+ */
+export async function readFailure(res: Response): Promise<ApiFailure> {
+  let body: unknown;
+  try {
+    body = await res.json();
+  } catch (err) {
+    if (err instanceof SyntaxError) return { status: res.status };
+    throw err;
+  }
+  if (!body || typeof body !== "object") return { status: res.status };
+  const b = body as Record<string, unknown>;
+  const str = (v: unknown): string | undefined => (typeof v === "string" ? v : undefined);
+  const error = str(b.error);
+  const errorIsWord = error !== undefined && CODE_WORD.test(error);
+  const message =
+    typeof b.message === "string" && b.message.length > 0
+      ? b.message
+      : error !== undefined && error.length > 0 && !errorIsWord
+        ? error
+        : undefined;
+  const code = str(b.code) ?? (errorIsWord ? error : undefined);
+  const refusal = str(b.refusal);
+  const gate = str(b.gate);
+  const headline = str(b.headline);
+  return {
+    status: res.status,
+    ...(code === undefined ? {} : { code }),
+    ...(message === undefined ? {} : { message }),
+    ...(refusal === undefined ? {} : { refusal }),
+    ...(gate === undefined ? {} : { gate }),
+    ...(headline === undefined ? {} : { headline }),
+  };
+}
+
+/**
+ * Throw the failure of a mutation. The older message text (from `readError`, whose sentence-valued
+ * `code` becomes the message when nothing else says it) is kept so every existing caller and test
+ * reads what it always read; `code` is the word, as on the review routes, and `failure` the reading.
+ */
+async function throwFailure(res: Response, lead: string): Promise<never> {
+  const legacy = await readError(res.clone());
+  const failure = await readFailure(res);
+  throw new PublicationApiError(
+    `${lead}: ${failureText(legacy, res)}`,
+    res.status,
+    failure.code,
+    failure,
+  );
+}
+
 export interface PublicationDispatchResponse {
   readonly status: "dispatched";
   readonly dataset_id: string;
@@ -161,10 +276,13 @@ export interface PublicationDispatchResponse {
  * answers 202 as soon as the Action has been asked to start; the run then
  * reports through the request's own `status`, `current_step` and `last_error`.
  * Closing the page afterwards changes nothing.
+ *
+ * The body is REQUIRED: it names the request the click was for and carries the
+ * administrator's answers to the gates. There is no bodyless click.
  */
 export async function dispatchPublicationApproval(
   datasetId: string,
-  init: Init = {},
+  init: Init & { readonly body: ApproveBody },
 ): Promise<PublicationDispatchResponse> {
   const fetchImpl = init.fetch ?? fetch;
   const headers: Record<string, string> = {
@@ -178,18 +296,11 @@ export async function dispatchPublicationApproval(
       method: "POST",
       headers,
       credentials: "include",
-      body: "{}",
+      body: JSON.stringify(init.body),
       signal: resolveSignal(init, ADMIN_TIMEOUTS_MS.dispatch),
     },
   );
-  if (!res.ok) {
-    const detail = await readError(res);
-    throw new DashboardApiError(
-      `Approval was not started: ${failureText(detail, res)}`,
-      res.status,
-      detail.code,
-    );
-  }
+  if (!res.ok) await throwFailure(res, "Approval was not started");
   return (await res.json()) as PublicationDispatchResponse;
 }
 
@@ -200,10 +311,11 @@ export interface PublicationDenyResponse {
   readonly reason: string;
 }
 
+/** The request id is REQUIRED: a denial names the request the click was for, so a stale row is refused. */
 export async function denyPublicationRequest(
   datasetId: string,
   reason: string,
-  init: Init = {},
+  init: Init & { readonly requestId: number },
 ): Promise<PublicationDenyResponse> {
   const trimmed = reason.trim();
   if (trimmed.length === 0) {
@@ -221,20 +333,84 @@ export async function denyPublicationRequest(
       method: "POST",
       headers,
       credentials: "include",
-      body: JSON.stringify({ reason: trimmed }),
+      body: JSON.stringify({ reason: trimmed, request_id: init.requestId }),
       signal: resolveSignal(init, ADMIN_TIMEOUTS_MS.deny),
     },
   );
-  if (!res.ok) {
-    const detail = await readError(res);
-    throw new DashboardApiError(
-      `Deny failed: ${failureText(detail, res)}`,
-      res.status,
-      detail.code,
-    );
-  }
+  if (!res.ok) await throwFailure(res, "Deny failed");
   return (await res.json()) as PublicationDenyResponse;
 }
 
+/**
+ * What a started review answers (HTTP 202); a refusal is a failure, not this. Transcribed from
+ * `StartedPublicationReview` in nemar-cli `shared/contract/publication-review-admin.ts`. The page
+ * reads only `reason`, and a word it does not know says nothing (`describeStartSuccess`).
+ */
+export interface StartedPublicationReview {
+  readonly environment: "production" | "non-production";
+  readonly started: true;
+  readonly reason: StartStartedReason;
+  readonly review_id: number;
+}
+
+/** Throw the failure of a review route, whose `error` is a sentence and whose `code` is the word. */
+async function throwReviewFailure(res: Response, lead: string): Promise<never> {
+  const failure = await readFailure(res);
+  throw new PublicationApiError(
+    `${lead}: ${failure.message ?? res.statusText}`,
+    res.status,
+    failure.code,
+    failure,
+  );
+}
+
+/**
+ * The review of a dataset's active publication request: the reasons, the identifier screen and the
+ * model's text, in the API's own words. A GET with no body and no content type.
+ */
+export async function getPublicationReview(
+  datasetId: string,
+  init: Init = {},
+): Promise<PublicationReviewDetail> {
+  const fetchImpl = init.fetch ?? fetch;
+  const headers: Record<string, string> = { Accept: "application/json" };
+  if (init.cookieHeader) headers.Cookie = init.cookieHeader;
+  const res = await fetchImpl(
+    `${dashboardApiBase(init.cookieHeader)}/admin/publish/${encodeURIComponent(datasetId)}/review`,
+    {
+      method: "GET",
+      headers,
+      credentials: "include",
+      signal: resolveSignal(init, ADMIN_TIMEOUTS_MS.review),
+    },
+  );
+  if (!res.ok) await throwReviewFailure(res, "Could not read the review");
+  return (await res.json()) as PublicationReviewDetail;
+}
+
+/**
+ * Ask the API to start the review of the request's screened commit. The route reads no body, so
+ * this sends none and no content type.
+ */
+export async function startPublicationReview(
+  datasetId: string,
+  init: Init = {},
+): Promise<StartedPublicationReview> {
+  const fetchImpl = init.fetch ?? fetch;
+  const headers: Record<string, string> = { Accept: "application/json" };
+  if (init.cookieHeader) headers.Cookie = init.cookieHeader;
+  const res = await fetchImpl(
+    `${dashboardApiBase(init.cookieHeader)}/admin/publish/${encodeURIComponent(datasetId)}/review/start`,
+    {
+      method: "POST",
+      headers,
+      credentials: "include",
+      signal: resolveSignal(init, ADMIN_TIMEOUTS_MS.start),
+    },
+  );
+  if (!res.ok) await throwReviewFailure(res, "The review was not started");
+  return (await res.json()) as StartedPublicationReview;
+}
+
 /** Re-export to keep admin surfaces importing from a single module. */
 export { deriveAdminBadgeState };
diff --git a/src/lib/dashboard-api.test.ts b/src/lib/dashboard-api.test.ts
index 7a09649..9c8c22f 100644
--- a/src/lib/dashboard-api.test.ts
+++ b/src/lib/dashboard-api.test.ts
@@ -121,6 +121,9 @@ describe("derivePublishState", () => {
     // An account property, not a dataset one. "Validation failed" here sent
     // owners to read CI logs that were green.
     expect(derivePublishState(ds(), status("blocked", "owner_name_missing"))).toBe("name_required");
+    expect(derivePublishState(ds(), status("blocked", "identifier_screen_findings"))).toBe(
+      "identifiers_found",
+    );
     // Validation that has not finished is not validation that failed; the
     // backend's message for both of these says to wait.
     expect(derivePublishState(ds(), status("blocked", "bids_validation_pending"))).toBe(
diff --git a/src/lib/dashboard-api.ts b/src/lib/dashboard-api.ts
index 4d28c8b..b60e7bf 100644
--- a/src/lib/dashboard-api.ts
+++ b/src/lib/dashboard-api.ts
@@ -61,7 +61,8 @@ export type PublicationRequestStatus =
  * from `visibility + concept_doi + publication_request.status` and, for a
  * blocked request, its `block_reason`.
  *
- * `"validation_pending"`, `"name_required"` and `"blocked"` split off
+ * `"validation_pending"`, `"name_required"`, `"identifiers_found"` and
+ * `"blocked"` split off
  * `"validation_failed"` in website#304. Every blocked request used to render
  * "Validation failed", which was right only for the reasons that mean the
  * dataset failed a gate: `owner_name_missing` is an account property and sent
@@ -77,6 +78,7 @@ export type DatasetPublishState =
   | "validation_failed"
   | "validation_pending"
   | "name_required"
+  | "identifiers_found"
   | "blocked"
   | "denied";
 
diff --git a/src/lib/publication-block.test.ts b/src/lib/publication-block.test.ts
index 1a5f2a0..302793a 100644
--- a/src/lib/publication-block.test.ts
+++ b/src/lib/publication-block.test.ts
@@ -68,7 +68,7 @@ describe("blockBadgeState", () => {
     for (const reason of PUBLICATION_BLOCK_REASONS) {
       expect(blockBadgeState(reason), reason).not.toBe("blocked");
     }
-    expect(PUBLICATION_BLOCK_REASONS).toHaveLength(6);
+    expect(PUBLICATION_BLOCK_REASONS).toHaveLength(7);
   });
 
   // Exhaustive the other way round: the whole point of splitting the states
@@ -82,6 +82,7 @@ describe("blockBadgeState", () => {
       prescreen_failed: "validation_failed",
       min_requirements_failed: "validation_failed",
       owner_name_missing: "name_required",
+      identifier_screen_findings: "identifiers_found",
     };
     for (const reason of PUBLICATION_BLOCK_REASONS) {
       expect(blockBadgeState(reason), reason).toBe(expected[reason]);
@@ -89,7 +90,7 @@ describe("blockBadgeState", () => {
     // Every state except the unknown-reason fallback is reachable from a
     // real reason; an unreachable one would be a label nothing can render.
     expect(new Set(PUBLICATION_BLOCK_REASONS.map(blockBadgeState))).toEqual(
-      new Set(["validation_failed", "validation_pending", "name_required"]),
+      new Set(["validation_failed", "validation_pending", "name_required", "identifiers_found"]),
     );
   });
 });
diff --git a/src/lib/publication-block.ts b/src/lib/publication-block.ts
index d7ed2b1..02d89bb 100644
--- a/src/lib/publication-block.ts
+++ b/src/lib/publication-block.ts
@@ -37,12 +37,15 @@ export const PUBLICATION_BLOCK_REASONS = [
    *  them. An ACCOUNT property, not anything about the dataset — which is
    *  what makes "Validation failed" the wrong label for it. */
   "owner_name_missing",
+  /** nemar-cli epic #1610 phase 4: the identifier screen found a direct
+   *  identifier. The dataset, not the account, is what the owner fixes. */
+  "identifier_screen_findings",
 ] as const;
 
 export type PublicationBlockReason = (typeof PUBLICATION_BLOCK_REASONS)[number];
 
 /**
- * The four badge states a block can produce.
+ * The five badge states a block can produce.
  *
  * Each one exists because it answers a different question — "who fixes this,
  * and by doing what" — and the badge sits directly above the backend's own
@@ -59,6 +62,10 @@ export type PublicationBlockReason = (typeof PUBLICATION_BLOCK_REASONS)[number];
  * - `"name_required"` covers `owner_name_missing`, which is not about the
  *   dataset at all — the owner fixes it in their account, and telling them
  *   validation failed sends them to look at CI logs that are green.
+ * - `"identifiers_found"` covers `identifier_screen_findings`: the screen
+ *   found a direct identifier in the dataset itself. CI is not pending and
+ *   the account is not at fault, so neither "Validation pending" nor "Name
+ *   required" fits; the owner removes the identifier from the repository.
  * - `"blocked"` is the honest answer for a value this build has never heard
  *   of: the request IS blocked, and the backend's `message` is what explains
  *   it. Guessing a cause nothing established would be worse than saying only
@@ -68,6 +75,7 @@ export type BlockBadgeState =
   | "validation_failed"
   | "validation_pending"
   | "name_required"
+  | "identifiers_found"
   | "blocked";
 
 const BLOCK_BADGE_STATES: Record<PublicationBlockReason, BlockBadgeState> = {
@@ -77,6 +85,7 @@ const BLOCK_BADGE_STATES: Record<PublicationBlockReason, BlockBadgeState> = {
   prescreen_failed: "validation_failed",
   min_requirements_failed: "validation_failed",
   owner_name_missing: "name_required",
+  identifier_screen_findings: "identifiers_found",
 };
 
 /**
diff --git a/src/lib/publication-queue.test.ts b/src/lib/publication-queue.test.ts
index 0e6f8b9..59b99c9 100644
--- a/src/lib/publication-queue.test.ts
+++ b/src/lib/publication-queue.test.ts
@@ -187,6 +187,11 @@ describe("the row badge on a real queue row", () => {
     const blocked = variant(833, { status: "blocked", block_reason: "owner_name_missing" });
     expect(deriveAdminBadgeState(blocked)).toBe("name_required");
   });
+
+  it("shows a request blocked on a participant identifier as Identifiers found", () => {
+    const blocked = variant(833, { status: "blocked", block_reason: "identifier_screen_findings" });
+    expect(deriveAdminBadgeState(blocked)).toBe("identifiers_found");
+  });
 });
 
 describe("cliApproveCommand", () => {
diff --git a/src/lib/publication-review-copy.test.ts b/src/lib/publication-review-copy.test.ts
new file mode 100644
index 0000000..3c94236
--- /dev/null
+++ b/src/lib/publication-review-copy.test.ts
@@ -0,0 +1,203 @@
+import { describe, expect, it } from "vitest";
+import { stripComments } from "../../test/copy-drift";
+import { terminalFlaws } from "../../test/publication-review-web-words";
+import { PUBLICATION_REVIEW_COPY, type PublicationReviewCopyKey } from "./publication-review-copy";
+
+const ENTRIES = Object.entries(PUBLICATION_REVIEW_COPY) as Array<
+  [PublicationReviewCopyKey, string]
+>;
+
+/**
+ * The declared key set, written out so that adding or removing a key is a deliberate edit here as
+ * well as in the table and in nemar-cli's `shared/contract/publication-review-copy.ts`.
+ */
+const DECLARED_KEYS = [
+  "approve.blocked",
+  "approve.override_control",
+  "approve.resume",
+  "approve.unavailable",
+  "gate.hard_reason",
+  "gate.needs_override",
+  "gate.no_review_row",
+  "gate.override_not_covering",
+  "gate.review_changed",
+  "gate.unverified",
+  "review.model_findings_label",
+  "review.model_summary_label",
+  "review.not_assessed",
+  "screen_gate.acknowledge",
+  "screen_gate.blocks",
+  "screen_gate.rerun",
+  "screen_gate.stale",
+  "screen_gate.unverified",
+  "screen_gate.wait",
+  "start.dispatch_claimed",
+  "start.dispatched",
+  "start.redispatched",
+];
+
+describe("the copy table", () => {
+  it("has a non-empty string for every key", () => {
+    for (const [key, value] of ENTRIES) {
+      expect(typeof value, key).toBe("string");
+      expect(value.trim().length, key).toBeGreaterThan(0);
+    }
+  });
+
+  it("carries exactly the declared keys", () => {
+    expect(Object.keys(PUBLICATION_REVIEW_COPY).sort()).toEqual(DECLARED_KEYS);
+  });
+
+  it("keeps every key dotted, lowercase and stable", () => {
+    for (const [key] of ENTRIES) {
+      expect(key).toMatch(/^[a-z0-9_]+(\.[a-z0-9_]+)+$/);
+    }
+  });
+
+  it("carries no HTML entities", () => {
+    // Every value is rendered as TEXT, so an `&rsquo;` would show as five literal characters.
+    for (const [key, value] of ENTRIES) {
+      expect(value, key).not.toMatch(/&[a-z]+;|&#\d+;/i);
+    }
+  });
+
+  it("carries no double quotes", () => {
+    // The drift test reads the nemar-cli contract as TEXT and matches `"key": "value"` pairs.
+    for (const [key, value] of ENTRIES) {
+      expect(value, key).not.toContain('"');
+    }
+  });
+
+  it("carries no braces, so there is nothing to fill", () => {
+    for (const [key, value] of ENTRIES) {
+      expect(value, key).not.toMatch(/[{}]/);
+    }
+  });
+
+  it("is plain ASCII and has no em-dash", () => {
+    // Stricter than account copy, which allows curly quotes: this table follows nemar-cli's rule.
+    for (const [key, value] of ENTRIES) {
+      expect(value, key).toMatch(/^[\x20-\x7e]+$/);
+      expect(value, key).not.toContain(String.fromCharCode(0x2014));
+    }
+  });
+});
+
+describe("the sentences that embed a number", () => {
+  it("states the acknowledgment bounds as 10 to 500 characters", () => {
+    expect(PUBLICATION_REVIEW_COPY["screen_gate.acknowledge"]).toContain("10 to 500 characters");
+  });
+
+  // The sentence is tied to the page's own constants in `publication-review.ts`, the tie
+  // `account-copy.test.ts` makes for the why-hint. The file is read as text; the test fails, and
+  // never skips, if the file is renamed or moved.
+  const LOGIC = import.meta.glob("./publication-review.ts", {
+    query: "?raw",
+    import: "default",
+    eager: true,
+  }) as Record<string, string>;
+  const logicSource = Object.values(LOGIC)[0];
+
+  it("keeps the bounds in step with ACK_MIN and ACK_MAX", () => {
+    expect(logicSource, "src/lib/publication-review.ts was found by the glob").toBeDefined();
+    const min = /export const ACK_MIN\s*=\s*(\d+)/.exec(logicSource ?? "")?.[1];
+    const max = /export const ACK_MAX\s*=\s*(\d+)/.exec(logicSource ?? "")?.[1];
+    expect(min, "ACK_MIN is exported by publication-review.ts").toBeDefined();
+    expect(max, "ACK_MAX is exported by publication-review.ts").toBeDefined();
+    expect(PUBLICATION_REVIEW_COPY["screen_gate.acknowledge"]).toContain(
+      `${min} to ${max} characters`,
+    );
+  });
+});
+
+describe("what the copy must never say", () => {
+  // The page prints these words, so none may name a terminal (nemar-cli ADR 0102, section 8). The
+  // list is the website's copy of nemar-cli's own: `test/publication-review-web-words.ts`.
+  it("breaks no terminal-words rule, tier 1 or tier 2", () => {
+    for (const [key, value] of ENTRIES) {
+      expect(terminalFlaws(value, 2), key).toEqual([]);
+    }
+  });
+});
+
+/**
+ * Every `.astro` and `.ts` source under `src/`, as text, minus the copy table itself and the unit
+ * tests beside it (the construction of `test/profile-gaps-ui.test.ts`).
+ */
+const SRC_FILES: Record<string, string> = {
+  ...(import.meta.glob("../pages/**/*.astro", {
+    query: "?raw",
+    import: "default",
+    eager: true,
+  }) as Record<string, string>),
+  ...(import.meta.glob("../components/**/*.astro", {
+    query: "?raw",
+    import: "default",
+    eager: true,
+  }) as Record<string, string>),
+  ...(import.meta.glob("../layouts/**/*.astro", {
+    query: "?raw",
+    import: "default",
+    eager: true,
+  }) as Record<string, string>),
+  ...(import.meta.glob("./*.ts", {
+    query: "?raw",
+    import: "default",
+    eager: true,
+  }) as Record<string, string>),
+};
+
+/** The sources joined with comments removed, so a key quoted in prose is not a consumer. */
+const consumerText = (sources: readonly string[]): string =>
+  sources.map((source) => stripComments(source)).join("\n");
+
+/** The keys no source names as a quoted literal outside a comment. */
+const orphanKeys = (keys: readonly string[], sources: readonly string[]): string[] => {
+  const text = consumerText(sources);
+  return keys.filter((key) => !text.includes(`"${key}"`));
+};
+
+const CONSUMER_SOURCES = consumerText(
+  Object.entries(SRC_FILES)
+    .filter(([path]) => !path.endsWith("/publication-review-copy.ts") && !path.endsWith(".test.ts"))
+    .map(([, source]) => source),
+);
+
+describe("every copy key has a consumer", () => {
+  // The pure logic (`publication-review.ts`) names each key as a quoted literal in its mapper and
+  // state-machine tables. This proves a key is NAMED outside a comment, not that the line which
+  // reads it is reached: `publication-review.test.ts` drives every refusal and control through the
+  // real functions for that. An unconsumed key is copy nobody can see, kept in step with another
+  // repository for nothing.
+  it("finds each key named as a quoted literal by a page, component or lib", () => {
+    const orphans = Object.keys(PUBLICATION_REVIEW_COPY).filter(
+      (key) => !CONSUMER_SOURCES.includes(`"${key}"`),
+    );
+    expect(orphans, "unused copy keys: consume them or delete them").toEqual([]);
+  });
+
+  it("does not count a key that is only quoted in a comment", () => {
+    // Synthetic sources: a key in a line comment, a trailing comment and a block comment is an
+    // orphan; a key in code is not.
+    const source = [
+      '// "gate.hard_reason"',
+      'const a = 1; // "gate.needs_override"',
+      '/* "gate.unverified" */',
+      'const b = say("gate.review_changed");',
+    ].join("\n");
+    expect(
+      orphanKeys(
+        ["gate.hard_reason", "gate.needs_override", "gate.unverified", "gate.review_changed"],
+        [source],
+      ),
+    ).toEqual(["gate.hard_reason", "gate.needs_override", "gate.unverified"]);
+  });
+
+  it("is actually reading sources, not an empty haystack", () => {
+    // A glob that resolved to nothing would make the check above pass for every key at once.
+    expect(Object.keys(SRC_FILES).length).toBeGreaterThan(20);
+    expect(CONSUMER_SOURCES).toContain('ACCOUNT_COPY["gaps.title"]');
+    // The table itself is excluded: its own header names the rules, its keys are quoted in it.
+    expect(CONSUMER_SOURCES).not.toContain("export const PUBLICATION_REVIEW_COPY");
+  });
+});
diff --git a/src/lib/publication-review-copy.ts b/src/lib/publication-review-copy.ts
new file mode 100644
index 0000000..82b48c6
--- /dev/null
+++ b/src/lib/publication-review-copy.ts
@@ -0,0 +1,98 @@
+/**
+ * The words the administrator approval page owns where it must say what the CLI says: the review
+ * gate's and the identifier screen's refusals, the approve control's states, the review's standing
+ * line and the labels on the model's text, and the success of a review start (website#459,
+ * nemar-cli#1731, Phase 4 of epic nemar-cli#1726).
+ *
+ * **Source of truth: nemar-cli `shared/contract/publication-review-copy.ts`.** This file is its
+ * copy with the SAME KEYS and the same strings. The two repos share no package, so the values are
+ * transcribed rather than imported, and `test/publication-review-copy-drift.test.ts` compares the
+ * two files whenever a nemar-cli checkout is reachable (it skips, with a note, when none is, and
+ * fails when `NEMAR_CLI_REVIEW_COPY` names a file that is not there). Changing a sentence here
+ * means changing it there in the same breath.
+ *
+ * **Four rules this file has to keep, because the drift test and the mirroring depend on them:**
+ *
+ * 1. *Every value is a literal string.* No template literals, no concatenation, no interpolation
+ *    from a constant: the drift test reads the nemar-cli file as TEXT, so a computed value would
+ *    be invisible to it. Where a sentence embeds a number that lives somewhere else
+ *    (`screen_gate.acknowledge` and the 10 to 500 character bounds of the acknowledgment), the
+ *    literal is written out and `publication-review-copy.test.ts` asserts it still agrees with the
+ *    page's constants.
+ * 2. *Every value is a complete sentence the page prints as it is.* There are no placeholders and
+ *    no accessor.
+ * 3. *Keys are stable and dotted.* They are the mirroring contract; renaming one is a change on
+ *    both sides. Every key is mirrored, and the drift test fails on a key either side lacks.
+ * 4. *Every key here has a consumer, and none names a terminal.* A consumer names the key as a
+ *    quoted literal in a page, component or lib; no value contains a command, a flag, a
+ *    placeholder or a backtick, or the words "terminal", "command" or "CLI"
+ *    (`test/publication-review-web-words.ts`).
+ *
+ * What is deliberately NOT here:
+ *
+ * - **Words the Worker sends and the page prints.** A reason's sentence, statement and cure, the
+ *   identifier screen's headline and lines, and the message of a refusal that names no terminal
+ *   are printed from the response; a copy here would be a second place to drift.
+ * - **Page-owned UI words** (headings, button labels, the class tags of a finding): they have no
+ *   CLI counterpart and live beside the code that prints them.
+ * - **The existing friendly messages** of the approval page (`forbidden`, `not_found` and the
+ *   like).
+ *
+ * This module imports nothing and nothing in it is computed, so it can be lifted out whole.
+ */
+
+/** The copy table. Index it directly; the keys are typed. */
+export const PUBLICATION_REVIEW_COPY = {
+  // The review gate's refusal words (`REVIEW_GATE_REFUSALS`), by the `refusal` of a 409
+  // publication_review_not_clear. `hard_reason` and `unverified` are the Worker's own sentences,
+  // which name no terminal; the other four are worded for a page.
+  "gate.hard_reason":
+    "The publication review gives a reason that no override clears, so the approval is refused.",
+  "gate.needs_override":
+    "The publication review is not a pass. Read the reasons, then confirm that you approve despite them; the confirmation is recorded with your account.",
+  "gate.override_not_covering":
+    "The review now gives a reason that your confirmation was not given for. Read the reasons again before approving.",
+  "gate.review_changed":
+    "The review your confirmation was given for is no longer the review of this request, or it changed while the approval was being checked. Read the reasons again before approving.",
+  "gate.no_review_row":
+    "No review of this commit is on record to attach your confirmation to. Start the review, then approve.",
+  "gate.unverified":
+    "The publication review could not be checked just now, so the approval is refused. Try again.",
+
+  // The identifier screen's refusal words, by the `gate` of a 409 identifier_screen_not_clear.
+  // `acknowledge` is also the prompt above the reason field before the click.
+  "screen_gate.acknowledge":
+    "The identifier screen found something a person must look at, or could not read everything. Read what it reported, then give a reason of 10 to 500 characters to approve; the reason is recorded with your account.",
+  "screen_gate.blocks":
+    "The identifier screen found a direct identifier, which cannot be acknowledged. The depositor must remove it and request publication again, which runs the screen again.",
+  "screen_gate.wait":
+    "The identifier screen is still running, or its result has just changed. Reload to read its current result.",
+  "screen_gate.rerun":
+    "The identifier screen has no verdict about the current commit, so approval waits for a screen that produced one. An administrator runs the screen again.",
+  "screen_gate.stale":
+    "The identifier screen read a commit that is no longer the head of main, so its result is out of date. An administrator runs the screen again.",
+  "screen_gate.unverified":
+    "The identifier screen's result could not be checked against the current commit just now, so the approval is refused. Try again. If it keeps happening, an administrator runs the screen again.",
+
+  // The approve control.
+  "approve.unavailable":
+    "The publication review could not be read just now, so Approve is not offered. Reload to try again.",
+  "approve.blocked":
+    "This request is blocked, so it cannot be approved until the block is cleared.",
+  "approve.resume":
+    "This approval has started publishing; it passed the gates when it started and is continued without them.",
+  "approve.override_control":
+    "I have read the reasons above and approve despite them. This records an override with my account.",
+
+  // The review's standing word and the labels on the model's text.
+  "review.not_assessed": "Not assessed: whether the text names the depositors.",
+  "review.model_summary_label": "written by the model; the depositor's text can steer it",
+  "review.model_findings_label": "written by the model; the depositor's text can steer them",
+
+  // A review start that went (HTTP 202), by `reason`.
+  "start.dispatched": "The review was started.",
+  "start.redispatched": "The review was started again.",
+  "start.dispatch_claimed": "A review of this commit was already handed over and stands.",
+} as const;
+
+export type PublicationReviewCopyKey = keyof typeof PUBLICATION_REVIEW_COPY;
diff --git a/src/lib/publication-review-panel.test.ts b/src/lib/publication-review-panel.test.ts
new file mode 100644
index 0000000..fceb8ed
--- /dev/null
+++ b/src/lib/publication-review-panel.test.ts
@@ -0,0 +1,578 @@
+/**
+ * The drawing of the review panel, as data.
+ *
+ * Every model comes from a captured answer of the real Worker (`test/fixtures/publication-review/`)
+ * through the real `panelModel`; the tree is read back for the words it holds, so deleting one
+ * sentence, line, label, prompt or button from `panelTree` turns a test red. Three kinds of derived
+ * input appear, each marked where it is used: a captured detail with a field replaced (the review's
+ * fact notes and a document label that no capture carries, an unknown tone word), a literal failure
+ * built by the lib's own `FailureView` shape, and literal text fed to a leaf function.
+ */
+import { describe, expect, it } from "vitest";
+import { fixture } from "../../test/publication-review-fixtures";
+import { terminalFlaws } from "../../test/publication-review-web-words";
+import {
+  ACK_MAX,
+  HARD_REASON_LINE,
+  NO_START_LINE,
+  OUT_OF_STEP,
+  type PublicationReviewDetail,
+  UI_WORDS,
+  panelModel,
+} from "./publication-review";
+import { PUBLICATION_REVIEW_COPY as COPY } from "./publication-review-copy";
+import {
+  BUSY_FAILURE,
+  DRAW_FAILURE,
+  PANEL_WORDS,
+  type PanelNode,
+  STALE_ROW_FAILURE,
+  errorTree,
+  failureTree,
+  loadingTree,
+  panelTitle,
+  panelTree,
+  rowIsStale,
+  staleRowTree,
+  titleIdOf,
+  toggleLabels,
+  toneClass,
+} from "./publication-review-panel";
+import PANEL_SOURCE from "./publication-review-panel.ts?raw";
+
+const detail = (name: string): PublicationReviewDetail =>
+  fixture<PublicationReviewDetail>(name).body;
+
+/** A captured detail with some fields replaced: the openly altered input (see the header). */
+const altered = (name: string, patch: Record<string, unknown>): PublicationReviewDetail =>
+  ({ ...detail(name), ...patch }) as PublicationReviewDetail;
+
+const OPTS = {
+  datasetId: "nm000701",
+  panelId: "pubreq-review-nm000701",
+  retryLabel: false,
+  reloadHref: "https://example.org/admin/publication-requests",
+} as const;
+
+function treeOf(
+  d: PublicationReviewDetail,
+  rowStart: "approve" | "resume" | null = "approve",
+  extra: Partial<Parameters<typeof panelTree>[1]> = {},
+): PanelNode[] {
+  return panelTree(panelModel(d, { rowStart }), { ...OPTS, ...extra });
+}
+
+/** Every node of a forest, depth first. */
+function all(nodes: readonly PanelNode[]): PanelNode[] {
+  return nodes.flatMap((n) => [n, ...all(n.children ?? [])]);
+}
+/** Every word of a forest, in reading order. */
+const words = (nodes: readonly PanelNode[]): string[] =>
+  all(nodes).flatMap((n) => (n.text === undefined ? [] : [n.text]));
+const withAttr = (nodes: readonly PanelNode[], attr: string): PanelNode[] =>
+  all(nodes).filter((n) => n.attrs !== undefined && attr in n.attrs);
+const withClass = (nodes: readonly PanelNode[], cls: string): PanelNode[] =>
+  all(nodes).filter((n) => n.attrs?.class?.split(" ").includes(cls));
+const textsOfClass = (nodes: readonly PanelNode[], cls: string): string[] =>
+  withClass(nodes, cls).flatMap((n) => (n.text === undefined ? [] : [n.text]));
+
+describe("the title", () => {
+  it("names the dataset, so every row's panel has its own name", () => {
+    const [title] = treeOf(detail("detail-pass"));
+    expect(title.tag).toBe("h4");
+    expect(title.text).toBe(panelTitle("nm000701"));
+    expect(title.text).toContain("nm000701");
+    expect(title.text).toContain(UI_WORDS.headings.review);
+    expect(title.attrs?.id).toBe(titleIdOf(OPTS.panelId));
+  });
+});
+
+describe("the withheld and read-only lines of the Approve control", () => {
+  it("prints the hard-reason line and the screen-gate copy for a blocking screen", () => {
+    const controls = withClass(treeOf(detail("detail-hard-reason")), "pubreq-review__controls");
+    expect(controls).toHaveLength(1);
+    const lines = textsOfClass(controls, "pubreq-review__text");
+    expect(lines).toEqual([HARD_REASON_LINE, COPY["screen_gate.blocks"]]);
+  });
+
+  it("prints the blocked line for a blocked request", () => {
+    const controls = withClass(treeOf(detail("detail-blocked"), null), "pubreq-review__controls");
+    expect(textsOfClass(controls, "pubreq-review__text")).toEqual([COPY["approve.blocked"]]);
+  });
+
+  it("prints the no-review-row copy where the Worker offers a start, and the page's own line where it does not", () => {
+    const startable = withClass(
+      treeOf(detail("detail-not-started-startable")),
+      "pubreq-review__controls",
+    );
+    expect(textsOfClass(startable, "pubreq-review__text")).toEqual([COPY["gate.no_review_row"]]);
+    const notStartable = withClass(
+      treeOf(detail("detail-approving-not-startable")),
+      "pubreq-review__controls",
+    );
+    expect(textsOfClass(notStartable, "pubreq-review__text")).toEqual([NO_START_LINE]);
+  });
+
+  it("prints the unavailable control's sentence, and nothing of the review, for a detail the page cannot read", () => {
+    const outOfStep = altered("detail-pass", { start_offered: undefined });
+    const nodes = treeOf(outOfStep);
+    const w = words(nodes);
+    expect(w).toContain(OUT_OF_STEP);
+    expect(w).not.toContain(detail("detail-pass").description.headline);
+    expect(withAttr(nodes, "data-pubreq-panel-approve")).toEqual([]);
+  });
+
+  it("prints the unavailable words for no detail at all", () => {
+    const nodes = panelTree(panelModel(null, { rowStart: "approve" }), { ...OPTS });
+    expect(words(nodes)).toContain(COPY["approve.unavailable"]);
+    expect(withAttr(nodes, "data-pubreq-panel-approve")).toEqual([]);
+  });
+
+  it("prints the resume notice inside the controls for a run that has started publishing", () => {
+    const controls = withClass(
+      treeOf(detail("detail-started-publishing")),
+      "pubreq-review__controls",
+    );
+    expect(textsOfClass(controls, "pubreq-review__text")).toEqual([COPY["approve.resume"]]);
+  });
+});
+
+describe("the headline, the identifier screen and the standing line", () => {
+  const d = detail("detail-needs-override");
+  const nodes = treeOf(d);
+
+  it("prints the review's headline in its tone", () => {
+    const headline = withClass(nodes, toneClass(d.description.tone));
+    expect(headline.map((n) => n.text)).toContain(d.description.headline);
+  });
+
+  it("prints the screen's headline in its tone and every one of its lines", () => {
+    const screen = all(nodes).find(
+      (n) => n.tag === "section" && n.children?.some((c) => c.text === UI_WORDS.headings.screen),
+    );
+    expect(screen, "no screen section").toBeDefined();
+    const inside = all([screen as PanelNode]);
+    expect(inside.find((n) => n.text === d.identifier_screen.headline)?.attrs?.class).toBe(
+      toneClass(d.identifier_screen.tone),
+    );
+    const items = inside.filter((n) => n.tag === "li").map((n) => n.text);
+    expect(items).toEqual(d.identifier_screen.lines);
+    expect(items.length).toBeGreaterThan(0);
+  });
+
+  it("prints the standing line only for a request the review applies to", () => {
+    expect(textsOfClass(nodes, "pubreq-review__text--muted")).toEqual([
+      COPY["review.not_assessed"],
+    ]);
+    const notApplicable = treeOf(detail("detail-not-applicable"));
+    expect(textsOfClass(notApplicable, "pubreq-review__text--muted")).toEqual([]);
+  });
+});
+
+describe("the reasons", () => {
+  it("prints each reason's statement, its cure and both tags, hard first", () => {
+    const d = detail("detail-blocked");
+    const [hard, override] = d.reasons;
+    expect(hard.cleared_by).toBe("nothing");
+    expect(override.cleared_by).toBe("override");
+    const cards = withClass(treeOf(d, null), "pubreq-review__reason").map((card) => words([card]));
+    expect(cards).toHaveLength(2);
+    const classTag = (r: { class: "fail" | "unknown" }) => UI_WORDS.classTags[r.class];
+    expect(cards[0]).toEqual([
+      classTag(hard),
+      UI_WORDS.clearedTags.nothing,
+      hard.statement,
+      hard.cure,
+    ]);
+    expect(cards[1]).toEqual([
+      classTag(override),
+      UI_WORDS.clearedTags.override,
+      override.statement,
+      override.cure,
+    ]);
+  });
+
+  it("prints the withheld words in place of the cards when the Worker is out of step", () => {
+    const nodes = treeOf(altered("detail-needs-override", { start_offered: undefined }));
+    expect(withClass(nodes, "pubreq-review__reason")).toEqual([]);
+    expect(words(nodes)).toContain(OUT_OF_STEP);
+    expect(withAttr(nodes, "data-pubreq-panel-approve")).toEqual([]);
+  });
+});
+
+describe("what the platform's checks found and what the model wrote", () => {
+  it("prints each fact note under its heading", () => {
+    // Derived: no capture carries a fact note; the review record gets two.
+    const base = detail("detail-pass");
+    const d = {
+      ...base,
+      review: { ...base.review, fact_notes: [{ text: "FACT-ONE" }, { text: "FACT-TWO" }] },
+    } as PublicationReviewDetail;
+    const nodes = treeOf(d);
+    const section = all(nodes).find(
+      (n) => n.tag === "section" && n.children?.some((c) => c.text === UI_WORDS.headings.checks),
+    );
+    expect(section).toBeDefined();
+    expect(
+      all([section as PanelNode])
+        .filter((n) => n.tag === "li")
+        .map((n) => n.text),
+    ).toEqual(["FACT-ONE", "FACT-TWO"]);
+  });
+
+  it("prints no heading for fact notes when there are none", () => {
+    expect(words(treeOf(detail("detail-pass")))).not.toContain(UI_WORDS.headings.checks);
+  });
+
+  it("prints the model's summary and findings under labels that say the model wrote them", () => {
+    const d = detail("detail-needs-override");
+    const w = words(treeOf(d));
+    expect(w).toContain(`${UI_WORDS.headings.summary} (${COPY["review.model_summary_label"]})`);
+    expect(w).toContain(`${UI_WORDS.headings.notes} (${COPY["review.model_findings_label"]})`);
+    expect(w).toContain(d.review?.summary);
+    const finding = d.review?.findings[0];
+    expect(w).toContain(finding?.label);
+    expect(w).toContain(finding?.document_label);
+    expect(w).toContain(finding?.note);
+  });
+
+  it("prints no model section for a review the model never wrote", () => {
+    const w = words(treeOf(detail("detail-hard-reason")));
+    expect(w.join("\n")).not.toContain(COPY["review.model_summary_label"]);
+  });
+});
+
+describe("the controls the administrator fills in", () => {
+  it("offers the confirmation box with its label, and the reason field with its prompt, when both are asked for", () => {
+    const nodes = treeOf(detail("detail-needs-ack-and-override"));
+    const box = withAttr(nodes, "data-pubreq-override");
+    expect(box).toHaveLength(1);
+    expect(box[0].tag).toBe("input");
+    expect(box[0].attrs?.type).toBe("checkbox");
+    const check = withClass(nodes, "pubreq-review__check");
+    expect(words(check)).toEqual([COPY["approve.override_control"]]);
+
+    const area = withAttr(nodes, "data-pubreq-reason");
+    expect(area).toHaveLength(1);
+    expect(area[0].tag).toBe("textarea");
+    expect(area[0].attrs?.maxlength).toBe(String(ACK_MAX));
+    const label = all(nodes).find((n) => n.tag === "label" && n.attrs?.for === area[0].attrs?.id);
+    expect(label?.text).toBe(COPY["screen_gate.acknowledge"]);
+    expect(area[0].attrs?.id).toBe(`${OPTS.panelId}-reason`);
+  });
+
+  it("offers neither when neither is asked for", () => {
+    const nodes = treeOf(detail("detail-pass"));
+    expect(withAttr(nodes, "data-pubreq-override")).toEqual([]);
+    expect(withAttr(nodes, "data-pubreq-reason")).toEqual([]);
+  });
+
+  it("offers only the confirmation box when only an override is needed", () => {
+    const nodes = treeOf(detail("detail-needs-override"));
+    expect(withAttr(nodes, "data-pubreq-override")).toHaveLength(1);
+    expect(withAttr(nodes, "data-pubreq-reason")).toEqual([]);
+  });
+
+  it("keeps what the administrator typed, and counts it", () => {
+    const typed = "a reason typed before the panel was read again";
+    const nodes = treeOf(detail("detail-off-acknowledge"), "approve", { acknowledgment: typed });
+    const area = withAttr(nodes, "data-pubreq-reason");
+    expect(area[0].text).toBe(typed);
+    expect(withAttr(nodes, "data-pubreq-count")[0].text).toBe(`${typed.length} / ${ACK_MAX}`);
+  });
+
+  it("starts the reason field empty when nothing was typed", () => {
+    const nodes = treeOf(detail("detail-off-acknowledge"));
+    expect(withAttr(nodes, "data-pubreq-reason")[0].text).toBe("");
+    expect(withAttr(nodes, "data-pubreq-count")[0].text).toBe(`0 / ${ACK_MAX}`);
+  });
+});
+
+describe("the buttons", () => {
+  const buttonWords = (nodes: PanelNode[]) =>
+    all(nodes)
+      .filter((n) => n.tag === "button")
+      .map((n) => n.text);
+
+  it("offers Approve and Refresh for a request that can be approved", () => {
+    expect(buttonWords(treeOf(detail("detail-pass")))).toEqual([
+      UI_WORDS.buttons.approve,
+      UI_WORDS.buttons.refresh,
+    ]);
+  });
+
+  it("labels the panel's Approve with the row's own word for a retry", () => {
+    expect(buttonWords(treeOf(detail("detail-pass"), "approve", { retryLabel: true }))).toEqual([
+      UI_WORDS.buttons.retry,
+      UI_WORDS.buttons.refresh,
+    ]);
+  });
+
+  it("labels it Continue approval for a run that has started publishing, retry label or not", () => {
+    for (const retryLabel of [false, true]) {
+      expect(
+        buttonWords(treeOf(detail("detail-started-publishing"), "resume", { retryLabel })),
+      ).toEqual([UI_WORDS.buttons.resume, UI_WORDS.buttons.refresh]);
+    }
+  });
+
+  it("offers Start review exactly when the Worker offers it", () => {
+    const startable = treeOf(detail("detail-not-started-startable"));
+    expect(buttonWords(startable)).toContain(UI_WORDS.buttons.start);
+    expect(withAttr(startable, "data-pubreq-start")).toHaveLength(1);
+    expect(buttonWords(treeOf(detail("detail-pass")))).not.toContain(UI_WORDS.buttons.start);
+  });
+
+  it("offers no Approve for a withheld control, and always offers Refresh", () => {
+    const nodes = treeOf(detail("detail-hard-reason"));
+    expect(withAttr(nodes, "data-pubreq-panel-approve")).toEqual([]);
+    expect(buttonWords(nodes)).toEqual([UI_WORDS.buttons.refresh]);
+  });
+
+  it("marks every button as a plain button, so none submits a form", () => {
+    for (const n of all(treeOf(detail("detail-needs-ack-and-override")))) {
+      if (n.tag === "button") expect(n.attrs?.type).toBe("button");
+    }
+  });
+});
+
+describe("the error, the notice and the other states", () => {
+  const failure = { text: "FAILURE-WORDS", refetch: false, focusAck: false, refreshLink: false };
+
+  it("prints a failure in an alert after the title", () => {
+    const nodes = treeOf(detail("detail-pass"), "approve", { error: failure });
+    expect(nodes[1].attrs?.role).toBe("alert");
+    expect(nodes[1].text).toBe("FAILURE-WORDS");
+    expect(withAttr(nodes, "data-pubreq-review-error")).toHaveLength(1);
+    expect(all([nodes[1]]).some((n) => n.tag === "a")).toBe(false);
+  });
+
+  it("adds the link back to the page when the failure asks for one", () => {
+    const node = errorTree({ ...failure, refreshLink: true }, OPTS.reloadHref);
+    const link = node.children?.[0];
+    expect(link?.tag).toBe("a");
+    expect(link?.attrs?.href).toBe(OPTS.reloadHref);
+    expect(link?.text).toBe(PANEL_WORDS.reloadLink);
+    expect(node.text).toBe("FAILURE-WORDS ");
+  });
+
+  it("prints the notice a started review leaves, without a live role of its own", () => {
+    const nodes = treeOf(detail("detail-pass"), "approve", { notice: "NOTICE-WORDS" });
+    const notice = withClass(nodes, "pubreq-review__notice");
+    expect(notice.map((n) => n.text)).toEqual(["NOTICE-WORDS"]);
+    // The page announces it through a live region that exists before the words do.
+    expect(notice[0].attrs?.role).toBeUndefined();
+  });
+
+  it("prints neither when there is neither", () => {
+    const nodes = treeOf(detail("detail-pass"));
+    expect(withAttr(nodes, "data-pubreq-review-error")).toEqual([]);
+    expect(withClass(nodes, "pubreq-review__notice")).toEqual([]);
+  });
+
+  it("says it is loading under the same title", () => {
+    const nodes = loadingTree("nm000701", OPTS.panelId);
+    expect(words(nodes)).toEqual([panelTitle("nm000701"), UI_WORDS.buttons.loading]);
+  });
+
+  it("says what failed and offers a way to read again", () => {
+    const nodes = failureTree(failure, "nm000701", OPTS.panelId, OPTS.reloadHref);
+    expect(words(nodes)).toEqual([
+      panelTitle("nm000701"),
+      "FAILURE-WORDS",
+      UI_WORDS.buttons.refresh,
+    ]);
+    expect(withAttr(nodes, "data-pubreq-refresh")).toHaveLength(1);
+  });
+
+  it("draws a stale row as the alert and the link, with no control to act on", () => {
+    const nodes = staleRowTree("nm000701", OPTS.panelId, OPTS.reloadHref);
+    expect(words(nodes)).toEqual([
+      panelTitle("nm000701"),
+      `${PANEL_WORDS.staleRow} `,
+      PANEL_WORDS.reloadLink,
+    ]);
+    expect(nodes[1].attrs?.role).toBe("alert");
+    expect(all(nodes).some((n) => n.tag === "button")).toBe(false);
+  });
+
+  it("keeps the sentence a failed call left beside what the re-read produced, in every outcome", () => {
+    // The unconfirmed approve ("it may have started") asks for a re-read; the re-read's own
+    // outcome (a detail that failed, a row that moved on) must not replace that sentence.
+    const prior = {
+      text: "PRIOR-MAY-HAVE-STARTED",
+      refetch: true,
+      focusAck: false,
+      refreshLink: true,
+    };
+    const failed = failureTree(failure, "nm000701", OPTS.panelId, OPTS.reloadHref, prior);
+    expect(words(failed)).toEqual([
+      panelTitle("nm000701"),
+      "PRIOR-MAY-HAVE-STARTED ",
+      PANEL_WORDS.reloadLink,
+      "FAILURE-WORDS",
+      UI_WORDS.buttons.refresh,
+    ]);
+    const drawn = failureTree(DRAW_FAILURE, "nm000701", OPTS.panelId, OPTS.reloadHref, prior);
+    expect(words(drawn)).toContain("PRIOR-MAY-HAVE-STARTED ");
+    expect(words(drawn)).toContain(DRAW_FAILURE.text);
+    const stale = staleRowTree("nm000701", OPTS.panelId, OPTS.reloadHref, prior);
+    expect(words(stale)).toContain("PRIOR-MAY-HAVE-STARTED");
+    expect(words(stale)).not.toContain("PRIOR-MAY-HAVE-STARTED ");
+    expect(words(stale)).toContain(PANEL_WORDS.reloadLink);
+    expect(stale[0].tag).toBe("h4");
+    // Two alerts, but one way back to the page.
+    expect(all(stale).filter((n) => n.tag === "a")).toHaveLength(1);
+    expect(all(failed).filter((n) => n.tag === "a")).toHaveLength(1);
+  });
+
+  it("prints a failure once when the re-read produced the same sentence", () => {
+    const same = { ...failure };
+    const nodes = failureTree(same, "nm000701", OPTS.panelId, OPTS.reloadHref, same);
+    expect(withAttr(nodes, "data-pubreq-review-error")).toHaveLength(1);
+  });
+
+  it("words a fault in the drawing as out of step, never as the network", () => {
+    expect(DRAW_FAILURE.text).toBe(OUT_OF_STEP);
+    expect(DRAW_FAILURE.text).not.toContain("Could not reach the server");
+    expect(DRAW_FAILURE.refetch).toBe(false);
+  });
+
+  it("gives the stale row and the busy click their own words, neither naming a terminal", () => {
+    expect(STALE_ROW_FAILURE.text).toBe(PANEL_WORDS.staleRow);
+    expect(STALE_ROW_FAILURE.refreshLink).toBe(true);
+    expect(BUSY_FAILURE.text).toBe(PANEL_WORDS.busy);
+    for (const word of Object.values(PANEL_WORDS)) expect(terminalFlaws(word), word).toEqual([]);
+    expect(terminalFlaws(panelTitle("nm000701"))).toEqual([]);
+    expect(terminalFlaws(toggleLabels(true, "nm000701").ariaLabel)).toEqual([]);
+  });
+});
+
+describe("tones", () => {
+  it("styles the four tones the Worker sends", () => {
+    for (const tone of ["ok", "note", "warn", "stop"]) {
+      expect(toneClass(tone)).toBe(`pubreq-review-tone--${tone}`);
+    }
+  });
+
+  it("turns a word it does not know into a note, never a class of its own", () => {
+    for (const word of ["urgent", "stop extra", "", "__proto__", "constructor", "toString"]) {
+      expect(toneClass(word), word).toBe("pubreq-review-tone--note");
+    }
+  });
+
+  it("applies that to a headline and a screen headline from a newer Worker", () => {
+    // Derived: a captured detail whose two tone words are ones this page has no rule for.
+    const base = detail("detail-pass");
+    const d = {
+      ...base,
+      description: { ...base.description, tone: "urgent" },
+      identifier_screen: { ...base.identifier_screen, tone: "a b" },
+    } as unknown as PublicationReviewDetail;
+    const nodes = treeOf(d);
+    const classes = withClass(nodes, "pubreq-review-tone--note").map((n) => n.text);
+    expect(classes).toEqual([base.description.headline, base.identifier_screen.headline]);
+    for (const n of all(nodes)) {
+      expect(n.attrs?.class ?? "").not.toMatch(/urgent|\ba b\b/);
+    }
+  });
+});
+
+describe("rowIsStale", () => {
+  it("is false when the detail names the row's request", () => {
+    expect(rowIsStale(12, 12)).toBe(false);
+  });
+
+  it("is true when the detail names another request", () => {
+    expect(rowIsStale(13, 12)).toBe(true);
+  });
+
+  it("is true when the row names none, since it differs from every integer", () => {
+    expect(rowIsStale(13, Number.NaN)).toBe(true);
+    expect(rowIsStale(13, undefined)).toBe(true);
+  });
+
+  it("is false for a detail that names no integer: the model calls that out of step", () => {
+    expect(rowIsStale(undefined, 12)).toBe(false);
+    expect(rowIsStale("12", 12)).toBe(false);
+    expect(rowIsStale(null, 12)).toBe(false);
+  });
+});
+
+describe("toggleLabels", () => {
+  it("keeps the visible word constant and lets aria-expanded carry the state", () => {
+    expect(toggleLabels(false, "nm000701")).toEqual({
+      text: UI_WORDS.buttons.review,
+      ariaLabel: "Review for nm000701",
+      expanded: "false",
+    });
+    expect(toggleLabels(true, "nm000701")).toEqual({
+      text: UI_WORDS.buttons.review,
+      ariaLabel: "Review for nm000701",
+      expanded: "true",
+    });
+    expect(UI_WORDS.buttons.review).toBe("Review");
+  });
+
+  it("puts the visible word at the start of the accessible name (WCAG 2.5.3), open or closed", () => {
+    for (const open of [false, true]) {
+      const { text, ariaLabel } = toggleLabels(open, "nm000701");
+      expect(ariaLabel.toLowerCase().startsWith(text.toLowerCase()), String(open)).toBe(true);
+    }
+  });
+
+  it("never lets the accessible name flip with the state, and tells rows apart by id", () => {
+    expect(toggleLabels(true, "nm000701").ariaLabel).toBe(
+      toggleLabels(false, "nm000701").ariaLabel,
+    );
+    expect(toggleLabels(false, "nm000702").ariaLabel).not.toBe(
+      toggleLabels(false, "nm000701").ariaLabel,
+    );
+  });
+});
+
+describe("the tree holds data, never markup", () => {
+  it("lets a Worker string carrying markup stay a string in a text field", () => {
+    // Derived: the model's summary replaced by markup.
+    const base = detail("detail-pass");
+    const hostile = '<img src=x onerror="alert(1)"> & <script>';
+    const d = {
+      ...base,
+      review: { ...base.review, summary: hostile },
+    } as PublicationReviewDetail;
+    const nodes = treeOf(d);
+    expect(words(nodes)).toContain(hostile);
+    for (const n of all(nodes)) {
+      expect(n.tag).toMatch(/^[a-z0-9]+$/);
+      expect([
+        "h4",
+        "h5",
+        "p",
+        "div",
+        "span",
+        "section",
+        "ul",
+        "li",
+        "label",
+        "input",
+        "textarea",
+        "button",
+        "a",
+      ]).toContain(n.tag);
+      expect(Object.keys(n).every((k) => ["tag", "text", "attrs", "children"].includes(k))).toBe(
+        true,
+      );
+    }
+  });
+
+  it("is plain JSON: it survives a round trip unchanged", () => {
+    const nodes = treeOf(detail("detail-needs-ack-and-override"));
+    expect(JSON.parse(JSON.stringify(nodes))).toEqual(nodes);
+  });
+
+  it("names no DOM global and no markup API", () => {
+    const source = PANEL_SOURCE.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/.*$/gm, "");
+    expect(source).not.toMatch(/(?<![\w-])(document|window|location|navigator)(?![\w-])/);
+    expect(source).not.toMatch(/innerHTML|insertAdjacentHTML|outerHTML|createElement|textContent/);
+  });
+});
diff --git a/src/lib/publication-review-panel.ts b/src/lib/publication-review-panel.ts
new file mode 100644
index 0000000..99fd327
--- /dev/null
+++ b/src/lib/publication-review-panel.ts
@@ -0,0 +1,367 @@
+/**
+ * The drawing of the administrator approval page's review panel, as plain data (website#459).
+ *
+ * `lib/publication-review.ts` decides what the panel says (`PanelModel`); this module turns that
+ * model into the tree of nodes the page script mounts. A node is a tag, attributes, children and,
+ * for the words it holds, ONE `text` field: there is no HTML string anywhere, so the script can
+ * only reach the DOM with `createElement`, `setAttribute` and `textContent`, and a Worker string
+ * can never be read as markup. Because the tree is data, a test can say exactly which words the
+ * administrator sees, and deleting one fails it.
+ *
+ * Pure: no DOM, no network, no node module, so a browser script can import it
+ * (`test/client-bundle-guard.test.ts`). The few words this module owns have no counterpart in the
+ * mirrored copy table and name no terminal (`PANEL_WORDS`).
+ */
+import {
+  ACK_MAX,
+  type ApproveControl,
+  type FailureView,
+  OUT_OF_STEP,
+  type PanelModel,
+  type Tone,
+  UI_WORDS,
+} from "./publication-review";
+
+/** One node of the drawn panel. Words reach the DOM only through `text`. */
+export interface PanelNode {
+  readonly tag: string;
+  readonly text?: string;
+  readonly attrs?: Readonly<Record<string, string>>;
+  readonly children?: readonly PanelNode[];
+}
+
+/** Words the panel owns that the lib's `UI_WORDS` and the mirrored copy table do not carry. */
+export const PANEL_WORDS = {
+  /** Shown when the panel's request is not the one its row was drawn for. */
+  staleRow:
+    "This list is out of date: the request on this row is no longer the current one, so Approve is not offered.",
+  /** Shown when a click arrives while another call is still running. */
+  busy: "Another action is still running. Wait for it to finish, then try again.",
+  /** The refresh note's replacement while a review panel is open. */
+  refreshPaused: "Automatic refresh is paused while a review is open.",
+  /** The link at the end of a failure that asks for a reload. */
+  reloadLink: "Refresh to see the current state.",
+} as const;
+
+/** What a click that is refused for a call already in flight says (no redraw, no re-read). */
+export const BUSY_FAILURE: FailureView = {
+  text: PANEL_WORDS.busy,
+  refetch: false,
+  focusAck: false,
+  refreshLink: false,
+};
+
+/**
+ * The failure shown when the page could not draw what the API sent: a detail the lib did not
+ * expect, or a bug in the drawing. It is the out-of-step sentence, never the network one, so a
+ * fault in this page is not worded as a dead connection.
+ */
+export const DRAW_FAILURE: FailureView = {
+  text: OUT_OF_STEP,
+  refetch: false,
+  focusAck: false,
+  refreshLink: false,
+};
+
+/** The failure shown when the panel's request is not the row's. */
+export const STALE_ROW_FAILURE: FailureView = {
+  text: PANEL_WORDS.staleRow,
+  refetch: false,
+  focusAck: false,
+  refreshLink: true,
+};
+
+/**
+ * Whether a detail names a different request from the row it is shown under. A detail that names
+ * no integer is not "stale": `panelModel` already calls it out of step. A row with no readable id
+ * differs from every integer, so it is stale.
+ */
+export function rowIsStale(detailRequestId: unknown, rowRequestId: unknown): boolean {
+  return Number.isInteger(detailRequestId) && detailRequestId !== rowRequestId;
+}
+
+/**
+ * The toggle's visible word, its `aria-expanded` and its accessible name. The word and the name
+ * never change with the state: the state is `aria-expanded`'s to say (a stylesheet draws it for
+ * sighted users), so a name that also changed would be announced twice, once in the name and once
+ * as "expanded". The name begins with the visible word, so a voice user who says what they read
+ * ("click Review") reaches the control (WCAG 2.5.3, label in name); the dataset id tells the rows
+ * apart.
+ */
+export function toggleLabels(
+  open: boolean,
+  datasetId: string,
+): { readonly text: string; readonly ariaLabel: string; readonly expanded: "true" | "false" } {
+  return {
+    text: UI_WORDS.buttons.review,
+    ariaLabel: `${UI_WORDS.buttons.review} for ${datasetId}`,
+    expanded: open ? "true" : "false",
+  };
+}
+
+/** The panel's heading: the same on every row, so the dataset id makes it a name. */
+export const panelTitle = (datasetId: string): string =>
+  `${UI_WORDS.headings.review}: ${datasetId}`;
+
+/** The id of the heading the panel is labelled by. */
+export const titleIdOf = (panelId: string): string => `${panelId}-title`;
+
+const TONE_CLASS: Readonly<Record<Tone, string>> = {
+  ok: "pubreq-review-tone--ok",
+  note: "pubreq-review-tone--note",
+  warn: "pubreq-review-tone--warn",
+  stop: "pubreq-review-tone--stop",
+};
+
+/** The class of a tone; a word this page does not know is a note, never a class of its own. */
+export function toneClass(tone: string): string {
+  return Object.hasOwn(TONE_CLASS, tone) ? TONE_CLASS[tone as Tone] : TONE_CLASS.note;
+}
+
+const TEXT = "pubreq-review__text";
+const BUTTON = "pubreq-review__btn";
+
+function node(
+  tag: string,
+  className?: string,
+  text?: string,
+  rest: { attrs?: Record<string, string>; children?: PanelNode[] } = {},
+): PanelNode {
+  const attrs = { ...(className ? { class: className } : {}), ...rest.attrs };
+  return {
+    tag,
+    ...(text === undefined ? {} : { text }),
+    ...(Object.keys(attrs).length > 0 ? { attrs } : {}),
+    ...(rest.children ? { children: rest.children } : {}),
+  };
+}
+
+const button = (primary: boolean, text: string, marker: string): PanelNode =>
+  node("button", primary ? `${BUTTON} ${BUTTON}--primary` : BUTTON, text, {
+    attrs: { type: "button", [marker]: "" },
+  });
+
+function section(heading: string | null, ...children: PanelNode[]): PanelNode {
+  return node("section", "pubreq-review__section", undefined, {
+    children: [...(heading ? [node("h5", "pubreq-review__heading", heading)] : []), ...children],
+  });
+}
+
+const list = (items: readonly string[]): PanelNode =>
+  node("ul", "pubreq-review__list", undefined, {
+    children: items.map((item) => node("li", undefined, item)),
+  });
+
+/** A failure's alert, with the reload link when the failure asks for one. */
+export function errorTree(failure: FailureView, reloadHref: string): PanelNode {
+  return node(
+    "p",
+    "pubreq-review__error",
+    failure.refreshLink ? `${failure.text} ` : failure.text,
+    {
+      attrs: { role: "alert", "data-pubreq-review-error": "" },
+      children: failure.refreshLink
+        ? [node("a", undefined, PANEL_WORDS.reloadLink, { attrs: { href: reloadHref } })]
+        : [],
+    },
+  );
+}
+
+/** The heading every state of the panel starts with. */
+export function titleTree(datasetId: string, panelId: string): PanelNode {
+  return node("h4", "pubreq-review__title", panelTitle(datasetId), {
+    attrs: { id: titleIdOf(panelId) },
+  });
+}
+
+/** The panel while its detail is being read. */
+export function loadingTree(datasetId: string, panelId: string): PanelNode[] {
+  return [titleTree(datasetId, panelId), node("p", TEXT, UI_WORDS.buttons.loading)];
+}
+
+/**
+ * The alerts of a panel that has no body to draw. `prior` is the failure of the call that asked for
+ * this re-read (an approve that may have started): its sentence is shown first and survives
+ * whatever the re-read produced. The same sentence twice is shown once, and two reload links are
+ * one, because the second alert's link serves both.
+ */
+function alertTrees(
+  failure: FailureView,
+  reloadHref: string,
+  prior: FailureView | null | undefined,
+): PanelNode[] {
+  if (!prior || prior.text === failure.text) return [errorTree(failure, reloadHref)];
+  const shown = failure.refreshLink ? { ...prior, refreshLink: false } : prior;
+  return [errorTree(shown, reloadHref), errorTree(failure, reloadHref)];
+}
+
+/** The panel after a failure that left nothing to draw: the alert and a way to read again. */
+export function failureTree(
+  failure: FailureView,
+  datasetId: string,
+  panelId: string,
+  reloadHref: string,
+  prior?: FailureView | null,
+): PanelNode[] {
+  return [
+    titleTree(datasetId, panelId),
+    ...alertTrees(failure, reloadHref, prior),
+    button(false, UI_WORDS.buttons.refresh, "data-pubreq-refresh"),
+  ];
+}
+
+/** The panel for a request that is not the row's: the alert and a link back, and no controls. */
+export function staleRowTree(
+  datasetId: string,
+  panelId: string,
+  reloadHref: string,
+  prior?: FailureView | null,
+): PanelNode[] {
+  return [titleTree(datasetId, panelId), ...alertTrees(STALE_ROW_FAILURE, reloadHref, prior)];
+}
+
+/** What the panel needs besides the model. */
+export interface PanelTreeOptions {
+  readonly datasetId: string;
+  readonly panelId: string;
+  /** The row's own button said "Retry approval", so the panel's says it too. */
+  readonly retryLabel: boolean;
+  readonly reloadHref: string;
+  readonly error?: FailureView | null;
+  readonly notice?: string | null;
+  /** What the administrator had typed in the reason field, kept across a re-read. */
+  readonly acknowledgment?: string;
+}
+
+function approveLabel(control: Extract<ApproveControl, { kind: "offered" }>, retry: boolean) {
+  if (control.mode === "resume") return UI_WORDS.buttons.resume;
+  return retry ? UI_WORDS.buttons.retry : UI_WORDS.buttons.approve;
+}
+
+function controlsTree(model: PanelModel, opts: PanelTreeOptions): PanelNode {
+  const approve = model.approve;
+  const children: PanelNode[] = [];
+
+  if (approve.kind === "unavailable") {
+    children.push(node("p", TEXT, approve.text));
+  } else if (approve.kind !== "offered") {
+    for (const line of approve.lines) children.push(node("p", TEXT, line));
+  }
+
+  const actions: PanelNode[] = [];
+  if (approve.kind === "offered") {
+    if (approve.notice) children.push(node("p", TEXT, approve.notice));
+    if (model.overrideLabel) {
+      children.push(
+        node("label", "pubreq-review__check", undefined, {
+          children: [
+            node("input", undefined, undefined, {
+              attrs: { type: "checkbox", "data-pubreq-override": "" },
+            }),
+            node("span", undefined, model.overrideLabel),
+          ],
+        }),
+      );
+    }
+    if (model.ackPrompt) {
+      const typed = opts.acknowledgment ?? "";
+      const areaId = `${opts.panelId}-reason`;
+      children.push(
+        node("div", "pubreq-review__field", undefined, {
+          children: [
+            node("label", undefined, model.ackPrompt, { attrs: { for: areaId } }),
+            node("textarea", undefined, typed, {
+              attrs: {
+                id: areaId,
+                rows: "4",
+                maxlength: String(ACK_MAX),
+                "data-pubreq-reason": "",
+              },
+            }),
+            node("span", "pubreq-review__count", `${typed.length} / ${ACK_MAX}`, {
+              attrs: { "data-pubreq-count": "" },
+            }),
+          ],
+        }),
+      );
+    }
+    actions.push(button(true, approveLabel(approve, opts.retryLabel), "data-pubreq-panel-approve"));
+  }
+  if (model.start.offered) {
+    actions.push(button(false, UI_WORDS.buttons.start, "data-pubreq-start"));
+  }
+  actions.push(button(false, UI_WORDS.buttons.refresh, "data-pubreq-refresh"));
+  children.push(node("div", "pubreq-review__actions", undefined, { children: actions }));
+  return node("div", "pubreq-review__controls", undefined, { children });
+}
+
+/** Every word of the panel for a model, in reading order. */
+export function panelTree(model: PanelModel, opts: PanelTreeOptions): PanelNode[] {
+  const nodes: PanelNode[] = [titleTree(opts.datasetId, opts.panelId)];
+  if (opts.error) nodes.push(errorTree(opts.error, opts.reloadHref));
+  if (opts.notice) nodes.push(node("p", "pubreq-review__notice", opts.notice));
+  if (model.headline) nodes.push(node("p", toneClass(model.headline.tone), model.headline.text));
+  if (model.screen) {
+    nodes.push(
+      section(
+        UI_WORDS.headings.screen,
+        node("p", toneClass(model.screen.tone), model.screen.headline),
+        list(model.screen.lines),
+      ),
+    );
+  }
+  if (model.reasonsWithheld) {
+    nodes.push(section(UI_WORDS.headings.reasons, node("p", TEXT, model.reasonsWithheld)));
+  } else if (model.reasons.length > 0) {
+    nodes.push(
+      section(
+        UI_WORDS.headings.reasons,
+        ...model.reasons.map((reason) =>
+          node("div", "pubreq-review__reason", undefined, {
+            children: [
+              node("div", "pubreq-review__reason-tags", undefined, {
+                children: [
+                  node("span", "pubreq-review__tag", reason.classLabel),
+                  node("span", "pubreq-review__tag", reason.clearedLabel),
+                ],
+              }),
+              node("p", TEXT, reason.statement),
+              node("p", "pubreq-review__cure", reason.cure),
+            ],
+          }),
+        ),
+      ),
+    );
+  }
+  if (model.factNotes.length > 0) {
+    nodes.push(section(UI_WORDS.headings.checks, list(model.factNotes)));
+  }
+  if (model.model) {
+    const written: PanelNode[] = [];
+    if (model.model.summary !== null) {
+      written.push(section(model.model.summaryLabel, node("p", TEXT, model.model.summary)));
+    }
+    if (model.model.findings.length > 0) {
+      written.push(
+        section(
+          model.model.findingsLabel,
+          ...model.model.findings.map((finding) =>
+            node("div", "pubreq-review__finding", undefined, {
+              children: [
+                node("span", "pubreq-review__finding-label", finding.label),
+                ...(finding.documentLabel
+                  ? [node("span", "pubreq-review__finding-document", finding.documentLabel)]
+                  : []),
+                node("p", TEXT, finding.note),
+              ],
+            }),
+          ),
+        ),
+      );
+    }
+    nodes.push(node("div", "pubreq-review__model", undefined, { children: written }));
+  }
+  if (model.standing) nodes.push(node("p", `${TEXT} ${TEXT}--muted`, model.standing));
+  nodes.push(controlsTree(model, opts));
+  return nodes;
+}
diff --git a/src/lib/publication-review.test.ts b/src/lib/publication-review.test.ts
new file mode 100644
index 0000000..2ba037c
--- /dev/null
+++ b/src/lib/publication-review.test.ts
@@ -0,0 +1,2006 @@
+/**
+ * The pure logic behind the administrator approval page's review panel.
+ *
+ * Every input is a captured answer of the real Worker (`test/fixtures/publication-review/`, read
+ * through `test/publication-review-fixtures.ts`). Four kinds of derived input appear, each marked
+ * where it is used:
+ *
+ * - a captured object with one field removed, replaced or repeated (the only way to say "a Worker
+ *   that predates this field" or "a review with two failed questions");
+ * - a literal word fed to a pure vocabulary predicate;
+ * - a literal body fed to the real `readFailure` for a branch no capture reaches; where the Worker
+ *   sends that body, the text is the Worker's own, copied from its source (a 401, a 403 for a
+ *   non-administrator, an account that is not active, a start that failed);
+ * - a `PublicationApiError` built by hand, the only way to say "a word a newer Worker sends",
+ *   which is why those words (`a_newer_word`) are plainly invented.
+ *
+ * Nothing else is invented.
+ */
+import { describe, expect, it } from "vitest";
+import { asResponse, fixture, fixtureNames } from "../../test/publication-review-fixtures";
+import { terminalFlaws } from "../../test/publication-review-web-words";
+import {
+  PublicationApiError,
+  type PublicationRequest,
+  denyPublicationRequest,
+  dispatchPublicationApproval,
+  getPublicationReview,
+  readFailure,
+  startPublicationReview,
+} from "./admin-api";
+import { DashboardApiError } from "./dashboard-api";
+import {
+  ACK_MAX,
+  ACK_MIN,
+  ACTIVE_STATUSES,
+  FRIENDLY_WORDS,
+  type FailureOp,
+  GATE_REFUSAL_COPY,
+  HARD_REASON_LINE,
+  NO_START_LINE,
+  OUT_OF_STEP,
+  type OfferedControl,
+  type PublicationReviewDetail,
+  SCREEN_GATE_COPY,
+  START_STARTED_COPY,
+  UI_WORDS,
+  approveBody,
+  approveControl,
+  describeFailure,
+  describeStartSuccess,
+  isHardReason,
+  panelModel,
+  rowChips,
+  startOffered,
+} from "./publication-review";
+import { PUBLICATION_REVIEW_COPY } from "./publication-review-copy";
+
+const detail = (name: string): PublicationReviewDetail =>
+  fixture<PublicationReviewDetail>(name).body;
+
+/** A captured detail with some fields replaced: the openly altered input (see the header). */
+const altered = (name: string, patch: Record<string, unknown>): PublicationReviewDetail =>
+  ({ ...detail(name), ...patch }) as PublicationReviewDetail;
+
+/** A captured object with the named keys removed: "a Worker that predates this field". */
+function omit<T extends object>(value: T, ...keys: string[]): T {
+  return Object.fromEntries(Object.entries(value).filter(([k]) => !keys.includes(k))) as T;
+}
+
+/** A captured detail with one key removed. */
+const withoutKey = (name: string, key: string): PublicationReviewDetail => omit(detail(name), key);
+
+/** A captured detail with one of its reasons replaced: the openly altered input. */
+const withReasons = (name: string, reasons: unknown[]): PublicationReviewDetail =>
+  altered(name, { reasons });
+
+const COPY = PUBLICATION_REVIEW_COPY;
+const DETAIL_NAMES = fixtureNames().filter(
+  (n) => n.startsWith("detail-") && fixture<unknown>(n).status === 200,
+);
+
+function offered(name: string, rowStart: "approve" | "resume" = "approve"): OfferedControl {
+  const control = approveControl(detail(name), { rowStart });
+  if (control.kind !== "offered") {
+    throw new Error(`${name} should offer Approve, got ${control.kind}`);
+  }
+  return control;
+}
+
+describe("the constants the copy table and nemar-cli are tied to", () => {
+  it("states the acknowledgment bounds", () => {
+    expect(ACK_MIN).toBe(10);
+    expect(ACK_MAX).toBe(500);
+  });
+});
+
+describe("isHardReason (a pure vocabulary predicate over literal words)", () => {
+  it("clears only the two words the Worker defines", () => {
+    expect(isHardReason("override")).toBe(false);
+    expect(isHardReason("screen_acknowledgment")).toBe(false);
+    expect(isHardReason("nothing")).toBe(true);
+  });
+
+  it("treats a word it does not know as hard (fail closed)", () => {
+    expect(isHardReason("a_word_from_a_newer_worker")).toBe(true);
+    expect(isHardReason("")).toBe(true);
+  });
+});
+
+describe("approveControl: one case per row of the table", () => {
+  it("row 1: no detail gives unavailable, in the copy's words", () => {
+    expect(approveControl(null, { rowStart: "approve" })).toEqual({
+      kind: "unavailable",
+      text: COPY["approve.unavailable"],
+    });
+  });
+
+  describe("row 2: not a current Worker", () => {
+    it("a reason without a statement is out of step", () => {
+      const reasons = detail("detail-needs-override").reasons.map((r) => {
+        const { statement: _statement, ...rest } = r;
+        return rest;
+      });
+      const control = approveControl(altered("detail-needs-override", { reasons }), {
+        rowStart: "approve",
+      });
+      expect(control).toEqual({ kind: "unavailable", text: OUT_OF_STEP });
+    });
+
+    it("a reason whose statement is an empty string is out of step", () => {
+      // The page prints `statement`, never `sentence`, so an empty one has nothing to print.
+      const d = detail("detail-needs-override");
+      const reasons = d.reasons.map((r) => ({ ...r, statement: "" }));
+      const control = approveControl(altered("detail-needs-override", { reasons }), {
+        rowStart: "approve",
+      });
+      expect(control).toEqual({ kind: "unavailable", text: OUT_OF_STEP });
+    });
+
+    it("a detail without start_offered is out of step", () => {
+      expect(
+        approveControl(withoutKey("detail-pass", "start_offered"), { rowStart: "approve" }),
+      ).toEqual({
+        kind: "unavailable",
+        text: OUT_OF_STEP,
+      });
+    });
+
+    it("a detail without screen_gate is out of step", () => {
+      expect(
+        approveControl(withoutKey("detail-pass", "screen_gate"), { rowStart: "approve" }),
+      ).toEqual({
+        kind: "unavailable",
+        text: OUT_OF_STEP,
+      });
+    });
+
+    it("a screen_gate word the page does not know is out of step", () => {
+      const control = approveControl(altered("detail-pass", { screen_gate: "a_newer_gate" }), {
+        rowStart: "approve",
+      });
+      expect(control).toEqual({ kind: "unavailable", text: OUT_OF_STEP });
+    });
+
+    // Derived inputs: a captured detail with one field replaced or removed, the only way to say
+    // "a Worker whose answer this page cannot trust". A body with no request_id would be sent bodyless.
+    it.each([
+      ["request_id missing", withoutKey("detail-pass", "request_id")],
+      ["request_id a string", altered("detail-pass", { request_id: "7" })],
+      ["request_id not an integer", altered("detail-pass", { request_id: 1.5 })],
+      ["a gate word the page does not know", altered("detail-pass", { gate: "a_newer_gate" })],
+      ["gate missing", withoutKey("detail-pass", "gate")],
+      ["anonymous not a boolean", altered("detail-pass", { anonymous: "yes" })],
+      ["anonymous missing", withoutKey("detail-pass", "anonymous")],
+    ])("%s is out of step", (_what, bad) => {
+      expect(approveControl(bad, { rowStart: "approve" })).toEqual({
+        kind: "unavailable",
+        text: OUT_OF_STEP,
+      });
+      expect(panelModel(bad, { rowStart: "approve" }).reasonsWithheld).toBe(OUT_OF_STEP);
+      expect(startOffered(bad)).toBe(false);
+    });
+
+    // Derived inputs: a captured detail with one part of the wrong shape. Each is a Worker out of
+    // step, and none may throw (the panel is drawn from the model, so a throw is a broken page).
+    const firstReason = detail("detail-needs-override").reasons[0];
+    const review = detail("detail-needs-override").review as unknown as Record<string, unknown>;
+    it.each([
+      ["a null reason", altered("detail-needs-override", { reasons: [null] })],
+      ["a reason that is a string", altered("detail-needs-override", { reasons: ["x"] })],
+      ["a reason with no code", withReasons("detail-needs-override", [omit(firstReason, "code")])],
+      ["a reason with no cure", withReasons("detail-needs-override", [omit(firstReason, "cure")])],
+      [
+        "a reason with no sentence",
+        withReasons("detail-needs-override", [omit(firstReason, "sentence")]),
+      ],
+      [
+        "a reason with no class",
+        withReasons("detail-needs-override", [omit(firstReason, "class")]),
+      ],
+      [
+        "a reason with no cleared_by",
+        withReasons("detail-needs-override", [omit(firstReason, "cleared_by")]),
+      ],
+      ["reasons not an array", altered("detail-needs-override", { reasons: {} })],
+      ["no description", withoutKey("detail-pass", "description")],
+      ["a description with no headline", altered("detail-pass", { description: { tone: "ok" } })],
+      ["no identifier_screen", withoutKey("detail-pass", "identifier_screen")],
+      [
+        "a screen whose lines are not an array",
+        altered("detail-pass", {
+          identifier_screen: { ...detail("detail-pass").identifier_screen, lines: "x" },
+        }),
+      ],
+      [
+        "a review whose findings are an object",
+        altered("detail-needs-override", { review: { ...review, findings: {} } }),
+      ],
+      [
+        "a review whose fact_notes are not an array",
+        altered("detail-needs-override", { review: { ...review, fact_notes: null } }),
+      ],
+      [
+        "a review whose id is a string",
+        altered("detail-needs-override", { review: { ...review, id: "7" } }),
+      ],
+      [
+        "a review whose summary is a number",
+        altered("detail-needs-override", { review: { ...review, summary: 7 } }),
+      ],
+      ["a review that is a string", altered("detail-needs-override", { review: "x" })],
+      ["no review key at all", withoutKey("detail-needs-override", "review")],
+      ["no request_status", withoutKey("detail-pass", "request_status")],
+      ["no started_publishing", withoutKey("detail-pass", "started_publishing")],
+      ["no applies", withoutKey("detail-pass", "applies")],
+    ])("%s is out of step and throws nothing", (_what, bad) => {
+      expect(approveControl(bad, { rowStart: "approve" })).toEqual({
+        kind: "unavailable",
+        text: OUT_OF_STEP,
+      });
+      const model = panelModel(bad, { rowStart: "approve" });
+      expect(model.reasonsWithheld).toBe(OUT_OF_STEP);
+      expect(model.requestId).toBeNull();
+      expect(model.reasons).toEqual([]);
+      expect(startOffered(bad)).toBe(false);
+    });
+
+    it.each([
+      ["a string", "x"],
+      ["a number", 7],
+      ["an array", []],
+      ["an object with nothing", {}],
+    ])("a detail that is %s is out of step and throws nothing", (_what, bad) => {
+      const d = bad as unknown as PublicationReviewDetail;
+      expect(approveControl(d, { rowStart: "approve" })).toEqual({
+        kind: "unavailable",
+        text: OUT_OF_STEP,
+      });
+      expect(panelModel(d, { rowStart: "approve" }).reasonsWithheld).toBe(OUT_OF_STEP);
+      expect(startOffered(d)).toBe(false);
+    });
+
+    it("never throws for any captured detail with any one field removed or garbled", () => {
+      // Derived inputs, many: every top-level and one-level-down field of every captured detail,
+      // removed and then replaced by each of five wrong values. The answer is not asserted (a
+      // field a page does not read may be garbled harmlessly); only that no input throws, and that
+      // an answer the page cannot read never offers Approve.
+      const garbage = [null, "x", 7, [], {}];
+      let tried = 0;
+      for (const name of DETAIL_NAMES) {
+        const base = detail(name) as unknown as Record<string, unknown>;
+        const variants: Record<string, unknown>[] = [];
+        for (const [key, value] of Object.entries(base)) {
+          variants.push(omit(base, key));
+          for (const g of garbage) variants.push({ ...base, [key]: g });
+          if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+            for (const inner of Object.keys(value)) {
+              variants.push({ ...base, [key]: omit(value as object, inner) });
+              for (const g of garbage) variants.push({ ...base, [key]: { ...value, [inner]: g } });
+            }
+          }
+          if (Array.isArray(value) && value.length > 0 && typeof value[0] === "object") {
+            for (const inner of Object.keys(value[0])) {
+              variants.push({ ...base, [key]: [omit(value[0], inner), ...value.slice(1)] });
+              for (const g of garbage) {
+                variants.push({ ...base, [key]: [{ ...value[0], [inner]: g }, ...value.slice(1)] });
+              }
+            }
+          }
+        }
+        for (const v of variants) {
+          const d = v as unknown as PublicationReviewDetail;
+          for (const rowStart of ["approve", "resume", null] as const) {
+            const model = panelModel(d, { rowStart });
+            const control = approveControl(d, { rowStart });
+            startOffered(d);
+            if (model.reasonsWithheld !== null) expect(control.kind).toBe("unavailable");
+            tried += 1;
+          }
+        }
+      }
+      expect(tried).toBeGreaterThan(5000);
+    });
+
+    it.each(["enforced", "off", "n/a"])("the gate word %s is a current Worker's", (gate) => {
+      const ok = altered("detail-pass", { gate });
+      expect(approveControl(ok, { rowStart: "approve" }).kind).not.toBe("unavailable");
+    });
+
+    it("beats every later row, even a blocked request", () => {
+      const control = approveControl(withoutKey("detail-blocked", "screen_gate"), {
+        rowStart: "approve",
+      });
+      expect(control).toEqual({ kind: "unavailable", text: OUT_OF_STEP });
+    });
+  });
+
+  it("row 3: a blocked request withholds with approve.blocked", () => {
+    expect(approveControl(detail("detail-blocked"), { rowStart: "approve" })).toEqual({
+      kind: "withheld",
+      lines: [COPY["approve.blocked"]],
+    });
+  });
+
+  it("row 3 holds for the row the page really draws: a blocked row starts nothing", () => {
+    // `rowView` gives a blocked request no start, so `data-row-start` is "none" and the panel's
+    // `rowStart` is null: the one realistic call. Row 3 must come before row 4 for the line to show.
+    for (const name of ["detail-blocked", "detail-blocked-started"]) {
+      expect(approveControl(detail(name), { rowStart: null }), name).toEqual({
+        kind: "withheld",
+        lines: [COPY["approve.blocked"]],
+      });
+      expect(panelModel(detail(name), { rowStart: null }).approve, name).toEqual({
+        kind: "withheld",
+        lines: [COPY["approve.blocked"]],
+      });
+    }
+  });
+
+  it("row 3 comes before row 5: blocked and started is withheld, not resumed", () => {
+    const d = detail("detail-blocked-started");
+    expect(d.started_publishing).toBe(true);
+    expect(approveControl(d, { rowStart: "resume" })).toEqual({
+      kind: "withheld",
+      lines: [COPY["approve.blocked"]],
+    });
+  });
+
+  it("row 4: a row that starts nothing is read-only, with the reasons still shown", () => {
+    for (const name of ["detail-pass", "detail-hard-reason", "detail-needs-override"]) {
+      expect(approveControl(detail(name), { rowStart: null }), name).toEqual({
+        kind: "none",
+        lines: [],
+      });
+    }
+  });
+
+  it("row 5: a run that has started publishing is continued, without a gate", () => {
+    const d = detail("detail-started-publishing");
+    const control = approveControl(d, { rowStart: "resume" });
+    expect(control).toEqual({
+      kind: "offered",
+      mode: "resume",
+      dialogId: "admin-resume",
+      requestId: d.request_id,
+      reviewId: null,
+      overrideReasons: [],
+      needsOverride: false,
+      needsAck: false,
+      notice: COPY["approve.resume"],
+    });
+    // The detail still carries an override-class reason and no review row; row 5 ignores both.
+    expect(d.reasons.some((r) => r.cleared_by === "override")).toBe(true);
+  });
+
+  describe("row 6: a hard reason withholds Approve", () => {
+    it("with the screen gate clear (the screen has no stored report)", () => {
+      const d = detail("detail-hard-not-run");
+      expect(d.screen_gate).toBe("clear");
+      expect(approveControl(d, { rowStart: "approve" })).toEqual({
+        kind: "withheld",
+        lines: [HARD_REASON_LINE],
+      });
+    });
+
+    it("whatever the gate word says, an advice-only review included", () => {
+      const control = approveControl(altered("detail-hard-not-run", { gate: "off" }), {
+        rowStart: "approve",
+      });
+      expect(control).toEqual({ kind: "withheld", lines: [HARD_REASON_LINE] });
+    });
+
+    it("a cleared_by word the page does not know is hard, so Approve is not offered", () => {
+      // Derived inputs: captured reasons whose `cleared_by` is a word from a newer Worker. The
+      // page never approves over a reason it cannot read, whatever `gate` says.
+      for (const name of ["detail-needs-override", "detail-hard-reason"]) {
+        const reasons = detail(name).reasons.map((r) => ({ ...r, cleared_by: "a_newer_word" }));
+        for (const gate of ["enforced", "off"]) {
+          const control = approveControl(altered(name, { reasons, gate }), { rowStart: "approve" });
+          expect(control.kind, `${name} ${gate}`).toBe("withheld");
+          expect(control.kind === "withheld" && control.lines[0], `${name} ${gate}`).toBe(
+            HARD_REASON_LINE,
+          );
+        }
+      }
+    });
+
+    it("a prototype key as cleared_by is hard too", () => {
+      for (const word of ["__proto__", "constructor", "toString", "hasOwnProperty"]) {
+        const reasons = detail("detail-needs-override").reasons.map((r) => ({
+          ...r,
+          cleared_by: word,
+        }));
+        const control = approveControl(withReasons("detail-needs-override", reasons), {
+          rowStart: "approve",
+        });
+        expect(control, word).toEqual({ kind: "withheld", lines: [HARD_REASON_LINE] });
+      }
+    });
+
+    it("says the reasons are above it, because the line is drawn after them", () => {
+      expect(HARD_REASON_LINE).toMatch(/\babove\b/);
+      expect(HARD_REASON_LINE).not.toMatch(/\bbelow\b/);
+    });
+  });
+
+  describe("row 7: the screen gate withholds Approve", () => {
+    it("a hard reason and a screen that blocks give both lines, in that order", () => {
+      expect(approveControl(detail("detail-hard-reason"), { rowStart: "approve" })).toEqual({
+        kind: "withheld",
+        lines: [HARD_REASON_LINE, COPY["screen_gate.blocks"]],
+      });
+    });
+
+    it("a screen that must be run again names it", () => {
+      const d = detail("detail-screen-rerun");
+      expect(d.screen_gate).toBe("rerun");
+      expect(approveControl(d, { rowStart: "approve" })).toEqual({
+        kind: "withheld",
+        lines: [HARD_REASON_LINE, COPY["screen_gate.rerun"]],
+      });
+    });
+
+    it("blocks, rerun and wait each withhold alone (a captured pass with the gate word replaced)", () => {
+      for (const gate of ["blocks", "rerun", "wait"] as const) {
+        const control = approveControl(altered("detail-pass", { screen_gate: gate }), {
+          rowStart: "approve",
+        });
+        expect(control, gate).toEqual({
+          kind: "withheld",
+          lines: [COPY[`screen_gate.${gate}`]],
+        });
+      }
+    });
+
+    it("clear, acknowledge and exempt impose nothing of their own", () => {
+      for (const gate of ["clear", "acknowledge", "exempt"] as const) {
+        const control = approveControl(altered("detail-pass", { screen_gate: gate }), {
+          rowStart: "approve",
+        });
+        expect(control.kind, gate).toBe("offered");
+      }
+    });
+  });
+
+  describe("row 8: an override-class reason and no review row", () => {
+    it("says to start the review when the Worker offers a start", () => {
+      const d = detail("detail-not-started-startable");
+      expect(d.start_offered).toBe(true);
+      expect(approveControl(d, { rowStart: "approve" })).toEqual({
+        kind: "withheld",
+        lines: [COPY["gate.no_review_row"]],
+      });
+    });
+
+    it("says no start is possible when the Worker offers none (the page-owned line)", () => {
+      const d = detail("detail-approving-not-startable");
+      expect(d.start_offered).toBe(false);
+      expect(approveControl(d, { rowStart: "approve" })).toEqual({
+        kind: "withheld",
+        lines: [NO_START_LINE],
+      });
+    });
+
+    it("does not apply to an advice-only review, which attaches nothing", () => {
+      const control = approveControl(altered("detail-not-started-startable", { gate: "off" }), {
+        rowStart: "approve",
+      });
+      expect(control.kind).toBe("offered");
+    });
+  });
+
+  describe("row 9: Approve is offered", () => {
+    it("a pass needs no confirmation and no reason", () => {
+      const d = detail("detail-pass");
+      expect(approveControl(d, { rowStart: "approve" })).toEqual({
+        kind: "offered",
+        mode: "approve",
+        dialogId: "admin-approve",
+        requestId: d.request_id,
+        reviewId: 1,
+        overrideReasons: [],
+        needsOverride: false,
+        needsAck: false,
+        notice: null,
+      });
+    });
+
+    it("an override-class reason needs the confirmation, naming the reason shown", () => {
+      const control = offered("detail-needs-override");
+      expect(control.needsOverride).toBe(true);
+      expect(control.needsAck).toBe(false);
+      expect(control.overrideReasons).toEqual(["question_failed"]);
+      expect(control.reviewId).toBe(1);
+    });
+
+    it("a code that repeats is named once (one failed-question reason per failed question)", () => {
+      // A derived input: the Worker emits one `question_failed` reason per failed question, each
+      // with its own `detail`, and no capture has two. This is a captured reason repeated, with
+      // another `detail`, between the two reasons of a captured detail.
+      const d = detail("detail-needs-override-two");
+      const failed = d.reasons.find((r) => r.code === "question_failed");
+      expect(failed).toBeDefined();
+      const repeated = withReasons("detail-needs-override-two", [
+        ...d.reasons.slice(0, 1),
+        { ...failed, detail: "a second failed question" },
+        ...d.reasons.slice(1),
+      ]);
+      const control = approveControl(repeated, { rowStart: "approve" });
+      expect(control.kind).toBe("offered");
+      if (control.kind !== "offered") return;
+      expect(control.overrideReasons).toEqual(["question_failed", "steering_attempt"]);
+      const out = approveBody(control, { overrideConfirmed: true, acknowledgment: "" });
+      expect(out.ok && out.body.override_publication_review?.reasons).toEqual([
+        "question_failed",
+        "steering_attempt",
+      ]);
+    });
+
+    it("two override-class reasons are both named, in the order shown", () => {
+      const control = offered("detail-needs-override-two");
+      expect(control.overrideReasons).toEqual(["question_failed", "steering_attempt"]);
+      expect(control.overrideReasons).toEqual(
+        detail("detail-needs-override-two")
+          .reasons.filter((r) => r.cleared_by === "override")
+          .map((r) => r.code),
+      );
+    });
+
+    it("a screen that wants a reason needs one; an advice-only review needs no confirmation", () => {
+      const control = offered("detail-off-acknowledge");
+      expect(control.needsAck).toBe(true);
+      expect(control.needsOverride).toBe(false);
+      expect(control.overrideReasons).toEqual([]);
+      expect(control.reviewId).toBeNull();
+    });
+
+    it("both controls can be needed at once", () => {
+      const control = offered("detail-needs-ack-and-override");
+      expect(control.needsAck).toBe(true);
+      expect(control.needsOverride).toBe(true);
+      expect(control.overrideReasons).toEqual(["question_failed"]);
+    });
+
+    it("a request that is not reviewed at all (not applicable) is offered with nothing to confirm", () => {
+      const control = offered("detail-not-applicable");
+      expect(control.needsOverride).toBe(false);
+      expect(control.needsAck).toBe(false);
+    });
+
+    it("a resumed anonymous release keeps the resume dialog (a captured detail with the flag replaced)", () => {
+      const control = approveControl(altered("detail-started-publishing", { anonymous: true }), {
+        rowStart: "resume",
+      });
+      expect(control.kind === "offered" && control.dialogId).toBe("admin-resume");
+    });
+
+    it("an anonymous release uses the anonymous dialog (a captured pass with the flag replaced)", () => {
+      const control = approveControl(altered("detail-pass", { anonymous: true }), {
+        rowStart: "approve",
+      });
+      expect(control.kind === "offered" && control.dialogId).toBe("admin-approve-anonymous");
+    });
+  });
+});
+
+describe("startOffered", () => {
+  it("follows the Worker's own word and nothing else", () => {
+    expect(startOffered(detail("detail-not-started-startable"))).toBe(true);
+    expect(startOffered(detail("detail-pass"))).toBe(false);
+    expect(startOffered(detail("detail-hard-reason"))).toBe(false);
+  });
+
+  it("is false without a detail and for a Worker that predates the field", () => {
+    expect(startOffered(null)).toBe(false);
+    expect(startOffered(withoutKey("detail-not-started-startable", "screen_gate"))).toBe(false);
+  });
+
+  it("is offered next to a withheld Approve, because a start cures review_not_started", () => {
+    const d = detail("detail-not-started-startable");
+    expect(approveControl(d, { rowStart: "approve" }).kind).toBe("withheld");
+    expect(startOffered(d)).toBe(true);
+  });
+});
+
+describe("approveBody: one case per row of the body table", () => {
+  const ack = "a".repeat(ACK_MIN);
+
+  it("resume sends the request id and nothing else, whatever else is typed", () => {
+    const control = offered("detail-started-publishing", "resume");
+    const out = approveBody(control, { overrideConfirmed: true, acknowledgment: ack });
+    expect(out).toEqual({ ok: true, body: { request_id: control.requestId } });
+    if (out.ok) expect(Object.keys(out.body)).toEqual(["request_id"]);
+  });
+
+  it("an approval that needs nothing sends the request id and nothing else", () => {
+    const control = offered("detail-pass");
+    const out = approveBody(control, { overrideConfirmed: false, acknowledgment: "" });
+    expect(out.ok && Object.keys(out.body)).toEqual(["request_id"]);
+    expect(out.ok && out.body.request_id).toBe(detail("detail-pass").request_id);
+  });
+
+  it("ignores a confirmation and a reason nothing asked for", () => {
+    const out = approveBody(offered("detail-pass"), {
+      overrideConfirmed: true,
+      acknowledgment: ack,
+    });
+    expect(out.ok && Object.keys(out.body)).toEqual(["request_id"]);
+  });
+
+  it("an advice-only review sends no override even when its reasons are shown", () => {
+    const control = approveControl(altered("detail-needs-override", { gate: "off" }), {
+      rowStart: "approve",
+    });
+    expect(control.kind).toBe("offered");
+    if (control.kind !== "offered") return;
+    const out = approveBody(control, { overrideConfirmed: true, acknowledgment: "" });
+    expect(out.ok && Object.keys(out.body)).toEqual(["request_id"]);
+  });
+
+  describe("an override", () => {
+    it("is refused until the box is ticked", () => {
+      const out = approveBody(offered("detail-needs-override"), {
+        overrideConfirmed: false,
+        acknowledgment: "",
+      });
+      expect(out).toEqual({ ok: false, problem: "override_unconfirmed" });
+    });
+
+    it("names the review and the reason shown", () => {
+      const out = approveBody(offered("detail-needs-override"), {
+        overrideConfirmed: true,
+        acknowledgment: "",
+      });
+      expect(out).toEqual({
+        ok: true,
+        body: {
+          request_id: detail("detail-needs-override").request_id,
+          override_publication_review: { review_id: 1, reasons: ["question_failed"] },
+        },
+      });
+      expect(out.ok && Object.keys(out.body)).toEqual([
+        "request_id",
+        "override_publication_review",
+      ]);
+    });
+
+    it("names exactly the reasons shown when there are two", () => {
+      const out = approveBody(offered("detail-needs-override-two"), {
+        overrideConfirmed: true,
+        acknowledgment: "",
+      });
+      expect(out.ok && out.body.override_publication_review?.reasons).toEqual([
+        "question_failed",
+        "steering_attempt",
+      ]);
+    });
+  });
+
+  describe("an acknowledgment", () => {
+    const control = () => offered("detail-off-acknowledge");
+    const body = (text: string) =>
+      approveBody(control(), { overrideConfirmed: false, acknowledgment: text });
+
+    it("is refused under the minimum, counted after trimming", () => {
+      expect(body("a".repeat(ACK_MIN - 1))).toEqual({
+        ok: false,
+        problem: "acknowledgment_too_short",
+      });
+      expect(body(`   ${"a".repeat(ACK_MIN - 1)}   `)).toEqual({
+        ok: false,
+        problem: "acknowledgment_too_short",
+      });
+      expect(body("")).toEqual({ ok: false, problem: "acknowledgment_too_short" });
+    });
+
+    it("is accepted at the minimum and sent trimmed", () => {
+      const out = body(`  ${"a".repeat(ACK_MIN)}  `);
+      expect(out).toEqual({
+        ok: true,
+        body: {
+          request_id: detail("detail-off-acknowledge").request_id,
+          acknowledge_identifier_screen: "a".repeat(ACK_MIN),
+        },
+      });
+      expect(out.ok && Object.keys(out.body)).toEqual([
+        "request_id",
+        "acknowledge_identifier_screen",
+      ]);
+    });
+
+    it("is accepted at the maximum and refused above it", () => {
+      expect(body("a".repeat(ACK_MAX)).ok).toBe(true);
+      expect(body("a".repeat(ACK_MAX + 1))).toEqual({
+        ok: false,
+        problem: "acknowledgment_too_long",
+      });
+    });
+
+    it("keeps whitespace inside the reason", () => {
+      const out = body("looked at the file list and agree");
+      expect(out.ok && out.body.acknowledge_identifier_screen).toBe(
+        "looked at the file list and agree",
+      );
+    });
+  });
+
+  describe("both at once", () => {
+    const control = () => offered("detail-needs-ack-and-override");
+
+    it("sends both fields", () => {
+      const out = approveBody(control(), { overrideConfirmed: true, acknowledgment: ack });
+      expect(out.ok && Object.keys(out.body)).toEqual([
+        "request_id",
+        "acknowledge_identifier_screen",
+        "override_publication_review",
+      ]);
+    });
+
+    it("asks for the confirmation before the reason", () => {
+      expect(approveBody(control(), { overrideConfirmed: false, acknowledgment: "" })).toEqual({
+        ok: false,
+        problem: "override_unconfirmed",
+      });
+    });
+
+    it("refuses a short reason once the box is ticked", () => {
+      expect(approveBody(control(), { overrideConfirmed: true, acknowledgment: "short" })).toEqual({
+        ok: false,
+        problem: "acknowledgment_too_short",
+      });
+    });
+  });
+});
+
+describe("panelModel", () => {
+  /** Every string a panel prints, except the model's own text, which is checked separately. */
+  function printed(d: PublicationReviewDetail | null, rowStart: "approve" | "resume" | null) {
+    const m = panelModel(d, { rowStart });
+    const out: string[] = [];
+    if (m.headline) out.push(m.headline.text);
+    if (m.screen) out.push(m.screen.headline, ...m.screen.lines);
+    for (const r of m.reasons) out.push(r.statement, r.cure, r.classLabel, r.clearedLabel);
+    if (m.reasonsWithheld) out.push(m.reasonsWithheld);
+    out.push(...m.factNotes);
+    if (m.model) out.push(m.model.summaryLabel, m.model.findingsLabel);
+    for (const f of m.model?.findings ?? []) out.push(f.label);
+    for (const f of m.model?.findings ?? []) if (f.documentLabel) out.push(f.documentLabel);
+    if (m.standing) out.push(m.standing);
+    if (m.ackPrompt) out.push(m.ackPrompt);
+    if (m.overrideLabel) out.push(m.overrideLabel);
+    const a = m.approve;
+    if (a.kind === "unavailable") out.push(a.text);
+    else if (a.kind === "offered") {
+      if (a.notice) out.push(a.notice);
+    } else out.push(...a.lines);
+    return out;
+  }
+
+  it("has a captured detail to read (the loops below are not vacuous)", () => {
+    expect(DETAIL_NAMES.length).toBeGreaterThanOrEqual(14);
+  });
+
+  it.each(DETAIL_NAMES)("%s: no printed string names a terminal", (name) => {
+    for (const text of printed(detail(name), "approve")) {
+      expect(terminalFlaws(text, 2), `${name}: ${text}`).toEqual([]);
+    }
+  });
+
+  it.each(DETAIL_NAMES)("%s: nothing printed is a reason's line or command", (name) => {
+    const d = detail(name);
+    const strings = printed(d, "approve");
+    const words = strings.join("\n");
+    const raw = d.reasons as unknown as { line?: string; command?: string | null }[];
+    for (const r of raw) {
+      if (r.line) expect(words).not.toContain(r.line);
+      if (r.command) expect(words).not.toContain(r.command);
+    }
+    for (const s of strings) {
+      expect(s).not.toContain("--");
+      expect(s).not.toContain("nemar admin");
+    }
+  });
+
+  it("prints the Worker's headline and screen words as they came", () => {
+    const d = detail("detail-hard-reason");
+    const m = panelModel(d, { rowStart: "approve" });
+    expect(m.headline).toEqual({ text: d.description.headline, tone: d.description.tone });
+    expect(m.screen).toEqual({
+      headline: d.identifier_screen.headline,
+      tone: d.identifier_screen.tone,
+      lines: d.identifier_screen.lines,
+    });
+  });
+
+  describe("reasons", () => {
+    it("prints each reason's statement and neutral cure with the page's own tags", () => {
+      const d = detail("detail-needs-override");
+      const m = panelModel(d, { rowStart: "approve" });
+      expect(m.reasons).toEqual([
+        {
+          statement: d.reasons[0].statement,
+          cure: d.reasons[0].cure,
+          classLabel: UI_WORDS.classTags.fail,
+          clearedLabel: UI_WORDS.clearedTags.override,
+        },
+      ]);
+    });
+
+    it("tags each reason by what clears it", () => {
+      const tags = (name: string) =>
+        panelModel(detail(name), { rowStart: "approve" }).reasons.map((r) => [
+          r.classLabel,
+          r.clearedLabel,
+        ]);
+      expect(tags("detail-hard-reason")).toEqual([
+        [UI_WORDS.classTags.fail, UI_WORDS.clearedTags.nothing],
+      ]);
+      expect(tags("detail-hard-not-run")).toEqual([
+        [UI_WORDS.classTags.unknown, UI_WORDS.clearedTags.nothing],
+        [UI_WORDS.classTags.unknown, UI_WORDS.clearedTags.override],
+      ]);
+      expect(tags("detail-needs-ack-and-override")).toEqual([
+        [UI_WORDS.classTags.unknown, UI_WORDS.clearedTags.screen_acknowledgment],
+        [UI_WORDS.classTags.fail, UI_WORDS.clearedTags.override],
+      ]);
+    });
+
+    it("orders hard, then acknowledgment, then override, whatever order they arrive in", () => {
+      // A captured detail with its reasons reversed: the override-class one now comes first.
+      const d = detail("detail-hard-not-run");
+      const reversed = altered("detail-hard-not-run", { reasons: [...d.reasons].reverse() });
+      expect(reversed.reasons[0].cleared_by).toBe("override");
+      const m = panelModel(reversed, { rowStart: "approve" });
+      expect(m.reasons.map((r) => r.clearedLabel)).toEqual([
+        UI_WORDS.clearedTags.nothing,
+        UI_WORDS.clearedTags.override,
+      ]);
+    });
+
+    it("tags a cleared_by word it does not know as one nothing clears", () => {
+      const d = detail("detail-hard-reason");
+      const strange = altered("detail-hard-reason", {
+        reasons: d.reasons.map((r) => ({ ...r, cleared_by: "a_newer_word" })),
+      });
+      const m = panelModel(strange, { rowStart: "approve" });
+      expect(m.reasons[0].clearedLabel).toBe(UI_WORDS.clearedTags.nothing);
+    });
+
+    it("withholds the whole panel when one statement is empty, and prints no sentence", () => {
+      const d = detail("detail-needs-override");
+      const empty = altered("detail-needs-override", {
+        reasons: d.reasons.map((r) => ({ ...r, statement: "" })),
+      });
+      const m = panelModel(empty, { rowStart: "approve" });
+      expect(m.reasons).toEqual([]);
+      expect(m.reasonsWithheld).toBe(OUT_OF_STEP);
+      expect(m.approve).toEqual({ kind: "unavailable", text: OUT_OF_STEP });
+    });
+
+    it("keeps the Worker's order inside a class (the sort is stable)", () => {
+      const d = detail("detail-needs-override-two");
+      const statements = panelModel(d, { rowStart: "approve" }).reasons.map((r) => r.statement);
+      expect(statements).toEqual(d.reasons.map((r) => r.statement));
+      const swapped = withReasons("detail-needs-override-two", [...d.reasons].reverse());
+      expect(panelModel(swapped, { rowStart: "approve" }).reasons.map((r) => r.statement)).toEqual(
+        [...d.reasons].reverse().map((r) => r.statement),
+      );
+    });
+
+    it("sorts a prototype key as cleared_by with the hard reasons, not between two overrides", () => {
+      // A derived input: five captured-shape reasons with distinct statements and the words that
+      // used to read `Object.prototype` through the rank table.
+      const base = detail("detail-needs-override").reasons[0];
+      const words = ["nothing", "override", "__proto__", "nothing", "override", "constructor"];
+      const reasons = words.map((cleared_by, i) => ({
+        ...base,
+        statement: `reason ${i}`,
+        cleared_by,
+      }));
+      const m = panelModel(withReasons("detail-needs-override", reasons), { rowStart: "approve" });
+      expect(m.reasons.map((r) => r.statement)).toEqual([
+        "reason 0",
+        "reason 2",
+        "reason 3",
+        "reason 5",
+        "reason 1",
+        "reason 4",
+      ]);
+    });
+
+    it("shows no reasons for a review that has none", () => {
+      expect(panelModel(detail("detail-pass"), { rowStart: "approve" }).reasons).toEqual([]);
+    });
+  });
+
+  describe("tones", () => {
+    // Derived inputs: a captured detail whose tone is a word the page has no style for. The tone
+    // becomes a class name, so it is checked, as a list chip's tone is.
+    it.each(["a_newer_tone", "ok stop", "", "__proto__"])(
+      "falls back to the neutral tone for the word %j",
+      (word) => {
+        const d = detail("detail-hard-reason");
+        const strange = altered("detail-hard-reason", {
+          description: { ...d.description, tone: word },
+          identifier_screen: { ...d.identifier_screen, tone: word },
+        });
+        const m = panelModel(strange, { rowStart: "approve" });
+        expect(m.headline?.tone).toBe("note");
+        expect(m.screen?.tone).toBe("note");
+      },
+    );
+
+    it("keeps each of the four tones it knows", () => {
+      for (const tone of ["ok", "note", "warn", "stop"]) {
+        const d = detail("detail-pass");
+        const m = panelModel(
+          altered("detail-pass", {
+            description: { ...d.description, tone },
+            identifier_screen: { ...d.identifier_screen, tone },
+          }),
+          { rowStart: "approve" },
+        );
+        expect(m.headline?.tone).toBe(tone);
+        expect(m.screen?.tone).toBe(tone);
+      }
+    });
+  });
+
+  describe("the model's text", () => {
+    it("appears only under labels that say the model wrote it", () => {
+      const d = detail("detail-needs-override");
+      const m = panelModel(d, { rowStart: "approve" });
+      expect(m.model?.summary).toBe(d.review?.summary);
+      expect(m.model?.summaryLabel).toBe(
+        `${UI_WORDS.headings.summary} (${COPY["review.model_summary_label"]})`,
+      );
+      expect(m.model?.findingsLabel).toBe(
+        `${UI_WORDS.headings.notes} (${COPY["review.model_findings_label"]})`,
+      );
+      expect(m.model?.findings).toEqual([
+        {
+          label: "README does not match the dataset",
+          documentLabel: "README",
+          note: d.review?.findings[0].note,
+        },
+      ]);
+    });
+
+    it.each(DETAIL_NAMES)("%s: the model's words are nowhere else in the panel", (name) => {
+      const m = panelModel(detail(name), { rowStart: "approve" });
+      const rest = JSON.stringify({
+        ...m,
+        model: m.model && { ...m.model, summary: "", findings: [] },
+      });
+      expect(rest).not.toContain("SENTINEL");
+    });
+
+    it("is absent when there is no review", () => {
+      for (const name of ["detail-hard-reason", "detail-not-started-startable", "detail-blocked"]) {
+        expect(panelModel(detail(name), { rowStart: "approve" }).model, name).toBeNull();
+      }
+    });
+
+    it("drops an empty-string summary but keeps a finding with no document", () => {
+      const d = detail("detail-needs-override");
+      const findings = (d.review?.findings ?? []).map((f) => ({ ...f, document_label: null }));
+      const edited = altered("detail-needs-override", {
+        review: { ...d.review, summary: "", findings },
+      });
+      const m = panelModel(edited, { rowStart: "approve" });
+      expect(m.model?.summary).toBeNull();
+      expect(m.model?.findings[0].documentLabel).toBeNull();
+      expect(m.model?.findings[0].label).toBe("README does not match the dataset");
+    });
+
+    it("is absent for a review with no summary and no findings", () => {
+      const d = detail("detail-pass");
+      const bare = altered("detail-pass", { review: { ...d.review, summary: null } });
+      expect(panelModel(bare, { rowStart: "approve" }).model).toBeNull();
+    });
+
+    it("drops a finding that has no label, with its note, rather than print it under its code", () => {
+      const d = detail("detail-needs-override");
+      const review = d.review;
+      expect(review).not.toBeNull();
+      const findings = (review?.findings ?? []).map(({ label: _label, ...rest }) => rest);
+      const old = altered("detail-needs-override", { review: { ...review, findings } });
+      const m = panelModel(old, { rowStart: "approve" });
+      expect(m.model?.findings).toEqual([]);
+      expect(JSON.stringify(m)).not.toContain("NOTE-SENTINEL");
+      expect(JSON.stringify(m)).not.toContain("readme_mismatch");
+    });
+
+    it("keeps the summary under its label when every finding is dropped", () => {
+      const d = detail("detail-needs-override");
+      const findings = (d.review?.findings ?? []).map(({ label: _label, ...rest }) => rest);
+      const old = altered("detail-needs-override", { review: { ...d.review, findings } });
+      const m = panelModel(old, { rowStart: "approve" });
+      expect(m.model?.summary).toBe(d.review?.summary);
+    });
+  });
+
+  describe("the standing line, the notes and the start", () => {
+    it("states what the review does not assess whenever a review applies", () => {
+      expect(panelModel(detail("detail-pass"), { rowStart: "approve" }).standing).toBe(
+        COPY["review.not_assessed"],
+      );
+      expect(panelModel(detail("detail-hard-reason"), { rowStart: "approve" }).standing).toBe(
+        COPY["review.not_assessed"],
+      );
+    });
+
+    it("says nothing about assessment when no review applies", () => {
+      expect(
+        panelModel(detail("detail-not-applicable"), { rowStart: "approve" }).standing,
+      ).toBeNull();
+    });
+
+    it("offers a start only when the Worker does", () => {
+      expect(
+        panelModel(detail("detail-not-started-startable"), { rowStart: "approve" }).start,
+      ).toEqual({ offered: true });
+      expect(panelModel(detail("detail-pass"), { rowStart: "approve" }).start).toEqual({
+        offered: false,
+      });
+    });
+
+    it("carries the platform's own facts as plain strings", () => {
+      const d = detail("detail-pass");
+      expect(panelModel(d, { rowStart: "approve" }).factNotes).toEqual(
+        (d.review?.fact_notes ?? []).map((n) => n.text),
+      );
+    });
+
+    it("prompts for the reason exactly when the control asks for one", () => {
+      expect(panelModel(detail("detail-off-acknowledge"), { rowStart: "approve" }).ackPrompt).toBe(
+        COPY["screen_gate.acknowledge"],
+      );
+      expect(
+        panelModel(detail("detail-needs-ack-and-override"), { rowStart: "approve" }).ackPrompt,
+      ).toBe(COPY["screen_gate.acknowledge"]);
+      expect(panelModel(detail("detail-pass"), { rowStart: "approve" }).ackPrompt).toBeNull();
+      expect(panelModel(detail("detail-off-acknowledge"), { rowStart: null }).ackPrompt).toBeNull();
+    });
+
+    it("labels the confirmation box exactly when the control needs the confirmation", () => {
+      const label = (name: string) =>
+        panelModel(detail(name), { rowStart: "approve" }).overrideLabel;
+      expect(label("detail-needs-override")).toBe(COPY["approve.override_control"]);
+      expect(label("detail-needs-ack-and-override")).toBe(COPY["approve.override_control"]);
+      expect(label("detail-pass")).toBeNull();
+      expect(label("detail-off-acknowledge")).toBeNull();
+      expect(label("detail-hard-reason")).toBeNull();
+    });
+
+    it("names the request the detail is about, for the page to compare with its row", () => {
+      for (const name of DETAIL_NAMES) {
+        expect(panelModel(detail(name), { rowStart: "approve" }).requestId, name).toBe(
+          detail(name).request_id,
+        );
+      }
+      expect(panelModel(null, { rowStart: "approve" }).requestId).toBeNull();
+    });
+  });
+
+  describe("when the panel cannot be trusted", () => {
+    it("a missing detail draws nothing but the unavailable line", () => {
+      const m = panelModel(null, { rowStart: "approve" });
+      expect(m).toEqual({
+        requestId: null,
+        headline: null,
+        screen: null,
+        reasons: [],
+        reasonsWithheld: null,
+        factNotes: [],
+        model: null,
+        standing: null,
+        start: { offered: false },
+        approve: { kind: "unavailable", text: COPY["approve.unavailable"] },
+        overrideLabel: null,
+        ackPrompt: null,
+      });
+    });
+
+    it("a Worker that predates the page withholds the reasons and says why", () => {
+      const m = panelModel(withoutKey("detail-needs-override", "screen_gate"), {
+        rowStart: "approve",
+      });
+      expect(m.reasons).toEqual([]);
+      expect(m.reasonsWithheld).toBe(OUT_OF_STEP);
+      expect(m.headline).toBeNull();
+      expect(m.screen).toBeNull();
+      expect(m.model).toBeNull();
+      expect(m.start).toEqual({ offered: false });
+      expect(m.approve).toEqual({ kind: "unavailable", text: OUT_OF_STEP });
+    });
+  });
+});
+
+/**
+ * Failures are produced by the real client over the captured answer, so the error each case
+ * reads is the one the page would catch.
+ */
+async function failure(op: FailureOp, name: string): Promise<PublicationApiError> {
+  const fetchImpl = (async () => asResponse(fixture(name))) as unknown as typeof fetch;
+  const call =
+    op === "approve"
+      ? dispatchPublicationApproval("nm000700", { fetch: fetchImpl, body: { request_id: 1 } })
+      : op === "deny"
+        ? denyPublicationRequest("nm000700", "a reason", { fetch: fetchImpl, requestId: 1 })
+        : op === "start"
+          ? startPublicationReview("nm000700", { fetch: fetchImpl })
+          : getPublicationReview("nm000700", { fetch: fetchImpl });
+  try {
+    await call;
+  } catch (err) {
+    if (err instanceof PublicationApiError) return err;
+    throw err;
+  }
+  throw new Error(`${name} did not fail`);
+}
+
+/** A captured failure with its reading altered: the openly derived input (see the header). */
+function withFailure(
+  err: PublicationApiError,
+  patch: Record<string, unknown>,
+): PublicationApiError {
+  const failure = { ...err.failure, ...patch };
+  return new PublicationApiError(err.message, err.status, err.code, failure);
+}
+
+/**
+ * A derived input: a literal body and status run through the real `readFailure` and wrapped as the
+ * client wraps it. For a branch no capture reaches; the Worker's own text is used where it sends
+ * the body (see the header).
+ */
+async function answered(
+  status: number,
+  body: Record<string, unknown> | string,
+): Promise<PublicationApiError> {
+  const raw = typeof body === "string" ? body : JSON.stringify(body);
+  const failure = await readFailure(new Response(raw, { status }));
+  return new PublicationApiError("x", status, failure.code, failure);
+}
+
+const NONE = { refetch: false, focusAck: false, refreshLink: false };
+const UNCONFIRMED = {
+  text: FRIENDLY_WORDS.approve_unconfirmed,
+  ...NONE,
+  refetch: true,
+  refreshLink: true,
+};
+
+describe("describeFailure: approve", () => {
+  const joined = (headline: string, key: keyof typeof COPY) => `${headline}. ${COPY[key]}`;
+
+  it.each([
+    ["approve-needs-override", "Publication review: FAIL", "gate.needs_override"],
+    ["approve-hard-reason", "Publication review: FAIL", "gate.hard_reason"],
+    ["approve-override-not-covering", "Publication review: FAIL", "gate.override_not_covering"],
+    ["approve-review-changed", "Publication review: FAIL", "gate.review_changed"],
+    ["approve-no-review-row", "Publication review: action required", "gate.no_review_row"],
+  ] as const)(
+    "%s prints the headline and the copy, re-reads, and unticks the override",
+    async (name, headline, key) => {
+      const err = await failure("approve", name);
+      const out = describeFailure("approve", err);
+      expect(out).toEqual({
+        text: joined(headline, key),
+        ...NONE,
+        refetch: true,
+      });
+      // The Worker's own message names a terminal and is never printed.
+      const message = (fixture(name).body as { message: string }).message;
+      expect(out.text).not.toContain(message);
+    },
+  );
+
+  it("prints the copy alone when the refusal carries no headline", async () => {
+    const err = await failure("approve", "approve-needs-override");
+    const bare = new PublicationApiError(err.message, err.status, err.code, {
+      status: 409,
+      code: "publication_review_not_clear",
+      refusal: "unverified",
+    });
+    expect(describeFailure("approve", bare).text).toBe(COPY["gate.unverified"]);
+  });
+
+  it("a refusal word the page does not know is out of step, and re-reads", async () => {
+    const err = withFailure(await failure("approve", "approve-needs-override"), {
+      refusal: "a_newer_refusal",
+    });
+    expect(describeFailure("approve", err)).toEqual({
+      text: OUT_OF_STEP,
+      ...NONE,
+      refetch: true,
+    });
+  });
+
+  it.each([
+    ["approve-screen-blocks", "blocks", "Identifier screen: FOUND IDENTIFIERS"],
+    ["approve-screen-acknowledge", "acknowledge", "Identifier screen: needs review"],
+    ["approve-screen-rerun", "rerun", "Identifier screen: DID NOT REPORT"],
+    ["approve-screen-wait", "wait", "Identifier screen: running"],
+    ["approve-screen-stale", "stale", "Identifier screen: clean"],
+    ["approve-screen-unverified", "unverified", "Identifier screen: clean"],
+  ] as const)(
+    "%s prints the headline and the screen copy and re-reads",
+    async (name, gate, headline) => {
+      const err = await failure("approve", name);
+      const out = describeFailure("approve", err);
+      expect(out).toEqual({
+        text: `${headline}. ${COPY[`screen_gate.${gate}`]}`,
+        ...NONE,
+        refetch: true,
+        focusAck: gate === "acknowledge",
+      });
+      const message = (fixture(name).body as { message: string }).message;
+      expect(out.text).not.toContain(message);
+    },
+  );
+
+  it("a screen gate word the page does not know is out of step, and re-reads", async () => {
+    const err = withFailure(await failure("approve", "approve-screen-wait"), {
+      gate: "a_newer_gate",
+    });
+    expect(describeFailure("approve", err)).toEqual({ text: OUT_OF_STEP, ...NONE, refetch: true });
+  });
+
+  it("a blocked request prints approve.blocked, not the Worker's sentence", async () => {
+    const out = describeFailure("approve", await failure("approve", "approve-not-dispatchable"));
+    expect(out).toEqual({ text: COPY["approve.blocked"], ...NONE, refetch: true });
+  });
+
+  it("an approval already running prints the page's sentence and offers the refresh link", async () => {
+    const out = describeFailure("approve", await failure("approve", "approve-already-in-flight"));
+    expect(out).toEqual({ text: FRIENDLY_WORDS.already_in_flight, ...NONE, refreshLink: true });
+  });
+
+  it("a stale request prints the Worker's sentence and re-reads", async () => {
+    const out = describeFailure("approve", await failure("approve", "approve-request-mismatch"));
+    const message = (fixture("approve-request-mismatch").body as { message: string }).message;
+    expect(out).toEqual({ text: message, ...NONE, refetch: true });
+  });
+
+  it("a dataset id the web cannot approve prints the Worker's sentence and does not re-read", async () => {
+    // The Worker's own body (`INVALID_DATASET_ID_MESSAGE`, nemar-cli `shared/contract/publication.ts`).
+    const message =
+      "This is not a dataset id an approval can be started for from the web: it is nm or on followed by six digits (a development environment also accepts xx). Nothing was claimed and nothing was sent.";
+    const err = await answered(400, { error: "invalid_dataset_id", message });
+    expect(describeFailure("approve", err)).toEqual({ text: message, ...NONE });
+  });
+
+  it("a body the Worker rejects prints the page's word, not the Worker's field list", async () => {
+    const out = describeFailure("approve", await failure("approve", "approve-invalid-body"));
+    expect(out).toEqual({ text: FRIENDLY_WORDS.invalid_body, ...NONE });
+    expect(out.text).not.toContain("acknowledge_identifier_screen");
+  });
+
+  it("a request that is gone prints the page's word and offers the refresh link", async () => {
+    // The approve route's 404 has no capture of its own; this is the detail route's answer with the same word.
+    const out = describeFailure("approve", await failure("detail", "detail-not-found"));
+    expect(out).toEqual({
+      text: FRIENDLY_WORDS.not_found,
+      ...NONE,
+      refetch: true,
+      refreshLink: true,
+    });
+  });
+
+  it("a 404 that is only a sentence prints that sentence", async () => {
+    const out = describeFailure("approve", await failure("deny", "deny-not-found"));
+    expect(out.text).toBe("No active publication request found");
+    expect(out.refreshLink).toBe(true);
+  });
+
+  it.each([
+    ["approve-502-dispatch-failed", "dispatch_failed"],
+    ["approve-502-dispatch-unconfirmed", "dispatch_unconfirmed"],
+    ["approve-502-unconfigured", "dispatch_unconfigured"],
+  ] as const)(
+    "%s prints the page's own sentence and offers the refresh link",
+    async (name, word) => {
+      const out = describeFailure("approve", await failure("approve", name));
+      expect(out).toEqual({ text: FRIENDLY_WORDS[word], ...NONE, refreshLink: true });
+      // The Worker's sentence for a missing credential tells an administrator to use a terminal.
+      expect(out.text).not.toMatch(/terminal/i);
+    },
+  );
+
+  // Derived inputs: the answers of a gateway or edge in front of the Worker, which a capture of
+  // the Worker cannot hold. A server fault on an approve may follow a dispatch that went out.
+  it.each([
+    ["a 524 with no body", 524, ""],
+    ["a 502 with an HTML body", 502, "<html>Bad gateway</html>"],
+    ["a 503 with a plain sentence", 503, JSON.stringify({ error: "Service unavailable" })],
+    [
+      "a 500 whose word the page does not know",
+      500,
+      JSON.stringify({ error: "a_newer_word", message: "Something a newer Worker says" }),
+    ],
+    ["a 500 internal_error", 500, JSON.stringify({ error: "internal_error" })],
+  ])("%s says the approval may have started, and re-reads", async (_what, status, raw) => {
+    expect(describeFailure("approve", await answered(status, raw))).toEqual(UNCONFIRMED);
+  });
+
+  it("a server fault that is one of the dispatch refusals keeps its own sentence", async () => {
+    for (const word of [
+      "dispatch_failed",
+      "dispatch_unconfirmed",
+      "dispatch_unconfigured",
+    ] as const) {
+      expect(describeFailure("approve", await answered(500, { error: word })), word).toEqual({
+        text: FRIENDLY_WORDS[word],
+        ...NONE,
+        refreshLink: true,
+      });
+    }
+  });
+
+  it("a 4xx without a readable body is not 'may have started' (the Worker refused)", async () => {
+    expect(describeFailure("approve", await answered(400, "<html>Bad request</html>"))).toEqual({
+      text: FRIENDLY_WORDS.generic,
+      ...NONE,
+    });
+  });
+
+  it("a server fault on any other operation is not worded as an approval that may have started", async () => {
+    for (const op of ["deny", "start", "detail"] as const) {
+      expect(describeFailure(op, await answered(500, "<html>Oops</html>")).text, op).not.toBe(
+        FRIENDLY_WORDS.approve_unconfirmed,
+      );
+    }
+  });
+
+  it("a headline is joined by one full stop, and is dropped when it is only dots", async () => {
+    const base = await failure("approve", "approve-needs-override");
+    const copy = COPY["gate.needs_override"];
+    const text = (headline: string) =>
+      describeFailure("approve", withFailure(base, { headline })).text;
+    expect(text("Publication review: FAIL")).toBe(`Publication review: FAIL. ${copy}`);
+    expect(text("Publication review: FAIL.")).toBe(`Publication review: FAIL. ${copy}`);
+    expect(text("Publication review: FAIL...  ")).toBe(`Publication review: FAIL. ${copy}`);
+    expect(text("Is it clean?")).toBe(`Is it clean? ${copy}`);
+    expect(text("Stop!")).toBe(`Stop! ${copy}`);
+    expect(text("...")).toBe(copy);
+    expect(text("   ")).toBe(copy);
+    expect(text("")).toBe(copy);
+  });
+});
+
+describe("describeFailure: every operation", () => {
+  const OPS: FailureOp[] = ["approve", "deny", "start", "detail"];
+
+  it.each(OPS)("%s: the origin guard prints its sentence, never its word", async (op) => {
+    const out = describeFailure(op, await failure(op, "origin-not-allowed"));
+    expect(out.text).toBe("This request did not come from a NEMAR page, so it was not accepted.");
+    expect(out.text).not.toContain("origin_not_allowed");
+    expect({ ...out, text: "" }).toEqual({ text: "", ...NONE });
+  });
+
+  // An approve that got no answer may still have been dispatched, so it says so (see the next test).
+  it.each(OPS.filter((op) => op !== "approve"))(
+    "%s: a dead connection or a missed deadline is the network word",
+    (op) => {
+      expect(describeFailure(op, new TypeError("Failed to fetch"))).toEqual({
+        text: FRIENDLY_WORDS.network,
+        ...NONE,
+      });
+      expect(describeFailure(op, new DOMException("timed out", "TimeoutError")).text).toBe(
+        FRIENDLY_WORDS.network,
+      );
+      expect(describeFailure(op, "not even an error").text).toBe(FRIENDLY_WORDS.network);
+    },
+  );
+
+  it("approve: no answer may still be a dispatched approval, so it says so and offers the re-read", () => {
+    // A derived input: the real client raises these when the 15 second deadline fires or the link drops.
+    const errors = [
+      new DOMException("timed out", "TimeoutError"),
+      new DOMException("aborted", "AbortError"),
+      new TypeError("Failed to fetch"),
+      "not even an error",
+    ];
+    for (const err of errors) {
+      expect(describeFailure("approve", err)).toEqual({
+        text: FRIENDLY_WORDS.approve_unconfirmed,
+        ...NONE,
+        refetch: true,
+        refreshLink: true,
+      });
+    }
+    expect(FRIENDLY_WORDS.approve_unconfirmed).toMatch(/may have started/);
+    expect(FRIENDLY_WORDS.approve_unconfirmed).toMatch(/check/i);
+    expect(FRIENDLY_WORDS.approve_unconfirmed).not.toBe(FRIENDLY_WORDS.network);
+  });
+
+  // DERIVED inputs: the proxy's own 502 body (`{ error: <word> }`, as `/api/v1` answers when it
+  // cannot reach the API or meets a redirect) run through the real `readFailure`.
+  const proxy502 = async (word: string) => {
+    const failure = await readFailure(
+      new Response(JSON.stringify({ error: word }), { status: 502 }),
+    );
+    return new PublicationApiError("x", 502, failure.code, failure);
+  };
+
+  it.each(OPS.filter((op) => op !== "approve"))(
+    "%s: the proxy's own failures are the network word",
+    async (op) => {
+      for (const word of ["upstream_unreachable", "upstream_redirect"]) {
+        const out = describeFailure(op, await proxy502(word));
+        expect(out, word).toEqual({ text: FRIENDLY_WORDS.network, ...NONE });
+      }
+    },
+  );
+
+  it("approve: the proxy's own failures may follow a dispatch, so they say so like a timeout", async () => {
+    // The connection can die after the request went out, so the approval may have started.
+    for (const word of ["upstream_unreachable", "upstream_redirect"]) {
+      expect(describeFailure("approve", await proxy502(word)), word).toEqual({
+        text: FRIENDLY_WORDS.approve_unconfirmed,
+        ...NONE,
+        refetch: true,
+        refreshLink: true,
+      });
+    }
+  });
+
+  // No capture holds a 401 or 403 that carries only a sentence (the fixtures' envelope has a code
+  // word), so these are DERIVED inputs: a literal body run through the real `readFailure`. The
+  // second is the shape of an inactive account's refusal, whose sentence names a terminal.
+  const sentenceOnly = async (status: number, body: Record<string, string>) => {
+    const failure = await readFailure(new Response(JSON.stringify(body), { status }));
+    return new PublicationApiError("x", status, failure.code, failure);
+  };
+  // The Worker's own bodies, copied from its source: `inactiveAccountBody("pending")` in
+  // `backend/src/services/account-tier.ts`, and the refusals of `backend/src/middleware/auth.ts`.
+  const INACTIVE_ACCOUNT = {
+    error: "Account not approved",
+    status: "pending",
+    message:
+      "Verify your email address to activate your account. Check your inbox for the verification link, or run 'nemar auth resend-verification' to get a new one.",
+  };
+  const NOT_AN_ADMIN = { error: "Admin access required" };
+  const NOT_SIGNED_IN = { error: "Authentication required" };
+
+  it.each([401, 403])(
+    "a sentence-only %i prints the page's own word, never the Worker's sentence",
+    async (status) => {
+      for (const body of [NOT_AN_ADMIN, NOT_SIGNED_IN, INACTIVE_ACCOUNT]) {
+        const err = await sentenceOnly(status, body);
+        for (const op of ["approve", "deny", "start"] as const) {
+          const out = describeFailure(op, err);
+          expect(out, `${op} ${status} ${JSON.stringify(body)}`).toEqual({
+            text: FRIENDLY_WORDS.forbidden,
+            ...NONE,
+          });
+          expect(terminalFlaws(out.text, 2)).toEqual([]);
+        }
+      }
+    },
+  );
+
+  it("a word the page has a sentence for is printed in that sentence", () => {
+    // `forbidden` is the page's own word for a refused session: the Worker sends none (its 403 is
+    // a sentence), so this is a hand-built error.
+    const err = new PublicationApiError("x", 403, "forbidden", { status: 403, code: "forbidden" });
+    expect(describeFailure("approve", err).text).toBe(FRIENDLY_WORDS.forbidden);
+  });
+
+  it("a word nothing maps is the generic sentence, never the word", () => {
+    const err = new PublicationApiError("x", 400, "a_newer_word", {
+      status: 400,
+      code: "a_newer_word",
+      message: "Something a newer Worker says",
+    });
+    for (const op of ["approve", "deny", "start"] as const) {
+      expect(describeFailure(op, err), op).toEqual({ text: FRIENDLY_WORDS.generic, ...NONE });
+    }
+  });
+
+  it("a page-only sentence cannot be chosen by a word on the wire", async () => {
+    // The page's own sentences (`network`, `generic`, `approve_unconfirmed`, `deny_rejected`) are
+    // not codes the Worker sends, so a wire answer that carries one prints the generic sentence.
+    for (const word of ["network", "generic", "approve_unconfirmed", "deny_rejected"]) {
+      for (const op of ["approve", "deny", "start"] as const) {
+        const out = describeFailure(op, await answered(400, { error: word }));
+        expect(out, `${op} ${word}`).toEqual({ text: FRIENDLY_WORDS.generic, ...NONE });
+      }
+    }
+  });
+
+  it("a prototype key as a code, a refusal or a gate prints a fixed sentence", () => {
+    // Derived inputs: hand-built errors carrying the words that read `Object.prototype` through a
+    // plain table lookup (`readFailure` would file most of them as a sentence, not a code).
+    const fixed = [...Object.values(FRIENDLY_WORDS), COPY["approve.unavailable"]];
+    for (const word of ["__proto__", "constructor", "toString", "hasOwnProperty"]) {
+      for (const op of ["approve", "deny", "start", "detail"] as const) {
+        const err = new PublicationApiError("x", 400, word, { status: 400, code: word });
+        expect(fixed, `${op} code ${word}`).toContain(describeFailure(op, err).text);
+      }
+      const refusal = new PublicationApiError("x", 409, "publication_review_not_clear", {
+        status: 409,
+        code: "publication_review_not_clear",
+        refusal: word,
+      });
+      expect(describeFailure("approve", refusal), `refusal ${word}`).toEqual({
+        text: OUT_OF_STEP,
+        ...NONE,
+        refetch: true,
+      });
+      const gate = new PublicationApiError("x", 409, "identifier_screen_not_clear", {
+        status: 409,
+        code: "identifier_screen_not_clear",
+        gate: word,
+      });
+      expect(describeFailure("approve", gate), `gate ${word}`).toEqual({
+        text: OUT_OF_STEP,
+        ...NONE,
+        refetch: true,
+      });
+    }
+  });
+
+  it("a 401 or 403 that carries a code the page does not know is the sign-in sentence", async () => {
+    for (const status of [401, 403]) {
+      for (const op of ["approve", "deny", "start"] as const) {
+        const out = describeFailure(op, await answered(status, { error: "unauthorized" }));
+        expect(out, `${op} ${status}`).toEqual({ text: FRIENDLY_WORDS.forbidden, ...NONE });
+      }
+    }
+  });
+
+  it("the older client's own refusal of an empty denial reason is the page's sentence", () => {
+    const err = new DashboardApiError("Deny requires a non-empty reason", 0, "missing_field");
+    expect(describeFailure("deny", err).text).toBe(FRIENDLY_WORDS.missing_field);
+  });
+});
+
+describe("describeFailure: deny", () => {
+  it.each([
+    "deny-request-mismatch",
+    "deny-after-publishing",
+    "deny-approval-in-flight",
+    "deny-not-found",
+  ])("%s prints the Worker's sentence, re-reads and offers the refresh link", async (name) => {
+    const body = fixture(name).body as { message?: string; error: string };
+    const out = describeFailure("deny", await failure("deny", name));
+    expect(out).toEqual({
+      text: body.message ?? body.error,
+      ...NONE,
+      refetch: true,
+      refreshLink: true,
+    });
+  });
+
+  it("the validation failure, whose error is an object, prints the page's word and never the object", async () => {
+    const out = describeFailure("deny", await failure("deny", "deny-invalid-body"));
+    expect(out).toEqual({ text: FRIENDLY_WORDS.deny_rejected, ...NONE });
+    expect(out.text).not.toContain("ZodError");
+    expect(out.text).not.toContain("[object");
+  });
+});
+
+describe("describeFailure: start", () => {
+  it.each([
+    "start-review-disabled",
+    "start-not-applicable",
+    "start-not-owned-here",
+    "start-request-not-requested",
+    "start-screen-not-ready",
+    "start-running",
+    "start-has-result",
+    "start-platform-limit",
+    "start-502-dispatch-failed",
+    "start-502-unconfigured",
+    "start-not-found",
+  ])("%s prints the Worker's sentence and re-reads", async (name) => {
+    const body = fixture(name).body as { error: string };
+    const out = describeFailure("start", await failure("start", name));
+    expect(out).toEqual({ text: body.error, ...NONE, refetch: true });
+  });
+
+  it("a missing credential on a start is not the approve sentence (wrong subject)", async () => {
+    const out = describeFailure("start", await failure("start", "start-502-unconfigured"));
+    expect(out.text).not.toBe(FRIENDLY_WORDS.dispatch_unconfigured);
+    expect(out.text).toContain("review");
+  });
+
+  it("a fault of the start prints the Worker's sentence and does not re-read", async () => {
+    // The Worker's own body (`START_FAULT` in nemar-cli `backend/src/routes/admin/publication-review.ts`).
+    const sentence = "The publication review could not be started. Try again.";
+    const err = await answered(500, { error: sentence, code: "internal" });
+    expect(describeFailure("start", err)).toEqual({ text: sentence, ...NONE });
+  });
+
+  it("a malformed dataset id prints the Worker's sentence and does not re-read", async () => {
+    const out = describeFailure("start", await failure("start", "start-bad-dataset"));
+    expect(out).toEqual({ text: "That is not a dataset id.", ...NONE });
+  });
+
+  it("a refusal word the page does not know is the generic sentence", async () => {
+    const err = withFailure(await failure("start", "start-running"), { code: "a_newer_refusal" });
+    expect(describeFailure("start", err)).toEqual({ text: FRIENDLY_WORDS.generic, ...NONE });
+  });
+});
+
+describe("describeFailure: detail", () => {
+  it("a request that is closed says so in the Worker's sentence alone", async () => {
+    // The request is closed: "Reload to try again" would send the administrator in a circle.
+    const out = describeFailure("detail", await failure("detail", "detail-not-found"));
+    expect(out).toEqual({ text: "nm000726 has no active publication request.", ...NONE });
+    expect(out.text).not.toContain(COPY["approve.unavailable"]);
+  });
+
+  it("any other failure is the unavailable sentence alone", () => {
+    const err = new PublicationApiError("x", 500, "internal_error", {
+      status: 500,
+      code: "internal_error",
+    });
+    expect(describeFailure("detail", err)).toEqual({ text: COPY["approve.unavailable"], ...NONE });
+  });
+
+  it.each([401, 403])(
+    "a sentence-only %i prints the page's word, a full stop, then the unavailable sentence",
+    async (status) => {
+      // Derived inputs (see the header of the operations block): a literal body through the real parser.
+      for (const body of [
+        { error: "Authentication required" },
+        {
+          error: "Account not approved",
+          status: "pending",
+          message:
+            "Verify your email address to activate your account. Check your inbox for the verification link, or run 'nemar auth resend-verification' to get a new one.",
+        },
+      ]) {
+        const failure = await readFailure(new Response(JSON.stringify(body), { status }));
+        const err = new PublicationApiError("x", status, failure.code, failure);
+        const out = describeFailure("detail", err);
+        expect(out).toEqual({
+          text: `You no longer have admin access. Sign in again. ${COPY["approve.unavailable"]}`,
+          ...NONE,
+        });
+        expect(out.text).not.toMatch(/[.!?]\s*[.!?]|\.\./);
+      }
+    },
+  );
+
+  it("a 401 or 403 with a code the page does not know still prints the sign-in sentence", async () => {
+    for (const status of [401, 403]) {
+      const out = describeFailure("detail", await answered(status, { error: "unauthorized" }));
+      expect(out.text, String(status)).toBe(
+        `You no longer have admin access. Sign in again. ${COPY["approve.unavailable"]}`,
+      );
+    }
+  });
+
+  it("the forbidden word joins the unavailable sentence with one full stop", () => {
+    const err = new PublicationApiError("x", 403, "forbidden", { status: 403, code: "forbidden" });
+    expect(describeFailure("detail", err).text).toBe(
+      `You no longer have admin access. Sign in again. ${COPY["approve.unavailable"]}`,
+    );
+  });
+});
+
+describe("describeFailure: what is never printed", () => {
+  const ERROR_NAMES = fixtureNames().filter((n) => fixture<unknown>(n).status >= 400);
+  const opFor = (name: string): FailureOp =>
+    name.startsWith("deny-")
+      ? "deny"
+      : name.startsWith("start-")
+        ? "start"
+        : name.startsWith("detail-")
+          ? "detail"
+          : "approve";
+
+  it("has failures to read (the loops below are not vacuous)", () => {
+    expect(ERROR_NAMES.length).toBeGreaterThanOrEqual(30);
+  });
+
+  it.each(ERROR_NAMES)("%s: the words name no terminal", async (name) => {
+    const op = opFor(name);
+    const out = describeFailure(op, await failure(op, name));
+    expect(terminalFlaws(out.text, 2), out.text).toEqual([]);
+    expect(out.text.length).toBeGreaterThan(0);
+  });
+
+  it.each(["approve", "deny", "start", "detail"] as const)(
+    "%s: no failure is read through any other operation into a terminal word",
+    async (op) => {
+      for (const name of ERROR_NAMES) {
+        const out = describeFailure(op, await failure(op, name));
+        expect(terminalFlaws(out.text, 1), `${op} over ${name}: ${out.text}`).toEqual([]);
+      }
+    },
+  );
+
+  it("never prints a refusal's message, whose sentences name a terminal", async () => {
+    for (const name of [
+      "approve-needs-override",
+      "approve-hard-reason",
+      "approve-override-not-covering",
+      "approve-review-changed",
+      "approve-no-review-row",
+      "approve-screen-blocks",
+      "approve-screen-acknowledge",
+      "approve-screen-rerun",
+      "approve-screen-wait",
+      "approve-screen-stale",
+      "approve-screen-unverified",
+      "approve-not-dispatchable",
+    ]) {
+      const message = (fixture(name).body as { message: string }).message;
+      const out = describeFailure("approve", await failure("approve", name));
+      expect(out.text, name).not.toContain(message);
+    }
+  });
+});
+
+describe("describeStartSuccess (a pure vocabulary over the reason words)", () => {
+  it("prints the copy of the reason a 202 answered with", () => {
+    const body = fixture<{ reason: string }>("start-202-dispatched").body;
+    expect(describeStartSuccess(body)).toBe(COPY["start.dispatched"]);
+    expect(describeStartSuccess({ reason: "redispatched" })).toBe(COPY["start.redispatched"]);
+    expect(describeStartSuccess({ reason: "dispatch_claimed" })).toBe(
+      COPY["start.dispatch_claimed"],
+    );
+  });
+
+  it("prints nothing for a reason it does not know; the panel simply re-reads", () => {
+    expect(describeStartSuccess({ reason: "a_newer_reason" })).toBeNull();
+    expect(describeStartSuccess({ reason: "toString" })).toBeNull();
+    expect(describeStartSuccess({ reason: "__proto__" })).toBeNull();
+  });
+
+  it("is total: a 202 whose body is not an object with a reason says nothing and throws nothing", () => {
+    // Derived inputs: what `res.json()` can return for a 202 that is not the Worker's body.
+    for (const body of [null, undefined, "x", 7, [], {}, { reason: 7 }, { reason: null }]) {
+      expect(describeStartSuccess(body), JSON.stringify(body)).toBeNull();
+    }
+  });
+});
+
+describe("the page's friendly words", () => {
+  it("name no terminal and no em-dash", () => {
+    for (const [key, text] of Object.entries(FRIENDLY_WORDS)) {
+      expect(terminalFlaws(text, 1), key).toEqual([]);
+      expect(text, key).not.toContain(String.fromCharCode(0x2014));
+    }
+  });
+
+  it("keep the sentences the approval page already printed", () => {
+    expect(FRIENDLY_WORDS.already_in_flight).toBe(
+      "An approval is already running for this dataset. Give it a minute, then refresh.",
+    );
+    expect(FRIENDLY_WORDS.dispatch_failed).toBe(
+      "GitHub did not accept the request, so nothing was started. Try again in a moment.",
+    );
+    expect(FRIENDLY_WORDS.not_found).toBe("Request not found.");
+  });
+
+  it("drop the two the Worker's own words now replace, and the two no route sends", () => {
+    for (const word of [
+      "not_dispatchable",
+      "origin_not_allowed",
+      "not_invitable",
+      "internal_error",
+    ]) {
+      expect(Object.keys(FRIENDLY_WORDS), word).not.toContain(word);
+    }
+  });
+});
+
+describe("rowChips", () => {
+  const rows = (name: string) => fixture<{ requests: PublicationRequest[] }>(name).body.requests;
+  const byDataset = (name: string, id: string) => {
+    const row = rows(name).find((r) => r.dataset_id === id);
+    if (!row) throw new Error(`${id} is not in ${name}`);
+    return row;
+  };
+
+  it("has rows of every kind to read (the cases below are not vacuous)", () => {
+    expect(rows("list").map((r) => r.status)).toEqual(
+      expect.arrayContaining(["requested", "approving", "blocked", "published"]),
+    );
+  });
+
+  it("prints the Worker's two headlines and tones verbatim for a request waiting on a decision", () => {
+    const row = byDataset("list", "nm000702");
+    expect(rowChips(row)).toEqual({
+      review: { text: "Publication review: FAIL", tone: "stop" },
+      screen: { text: "Identifier screen: clean", tone: "ok" },
+    });
+  });
+
+  it("covers every active status", () => {
+    for (const id of ["nm000701", "nm000705", "nm000706"]) {
+      const chips = rowChips(byDataset("list", id));
+      expect(chips.review, id).not.toBeNull();
+      expect(chips.screen, id).not.toBeNull();
+    }
+  });
+
+  it("shows nothing on a published row", () => {
+    expect(rowChips(byDataset("list", "nm000708"))).toEqual({ review: null, screen: null });
+  });
+
+  it("says a mirror or an exemplar is not applicable, and decides nothing", () => {
+    expect(rowChips(byDataset("list", "nm000707")).review).toEqual({
+      text: "Publication review: not applicable",
+      tone: "note",
+    });
+  });
+
+  it("says the review is off when it is", () => {
+    const chips = rows("list-review-off").map(rowChips);
+    expect(chips[0].review?.text).toBe(
+      "Publication review: not reviewed (the automated review is off)",
+    );
+    expect(chips[0].screen?.text).toBe("Identifier screen: needs review");
+  });
+
+  it("gives null for a field a Worker that predates the review omits", () => {
+    const row = omit(byDataset("list", "nm000702"), "publication_review", "identifier_screen");
+    expect(rowChips(row)).toEqual({ review: null, screen: null });
+  });
+
+  it("gives null for a chip with no words to print", () => {
+    const row = {
+      ...byDataset("list", "nm000702"),
+      publication_review: { ...byDataset("list", "nm000702").publication_review, headline: "" },
+    } as unknown as PublicationRequest;
+    expect(rowChips(row).review).toBeNull();
+    expect(rowChips(row).screen).not.toBeNull();
+  });
+
+  it("falls back to the neutral tone for a tone word it does not know", () => {
+    const row = {
+      ...byDataset("list", "nm000702"),
+      identifier_screen: {
+        ...byDataset("list", "nm000702").identifier_screen,
+        tone: "a_newer_tone",
+      },
+    } as unknown as PublicationRequest;
+    expect(rowChips(row).screen?.tone).toBe("note");
+  });
+});
+
+describe("ACTIVE_STATUSES", () => {
+  it("is the three statuses the detail route answers for, shared by the chips and the panel", () => {
+    expect([...ACTIVE_STATUSES]).toEqual(["requested", "approving", "blocked"]);
+  });
+});
+
+describe("the literal-key tables", () => {
+  it("GATE_REFUSAL_COPY covers the six review-gate refusal words", () => {
+    expect(Object.keys(GATE_REFUSAL_COPY).sort()).toEqual([
+      "hard_reason",
+      "needs_override",
+      "no_review_row",
+      "override_not_covering",
+      "review_changed",
+      "unverified",
+    ]);
+    for (const [word, key] of Object.entries(GATE_REFUSAL_COPY)) {
+      expect(key).toBe(`gate.${word}`);
+      expect(COPY).toHaveProperty([key]);
+    }
+  });
+
+  it("SCREEN_GATE_COPY covers the six screen refusal words", () => {
+    expect(Object.keys(SCREEN_GATE_COPY).sort()).toEqual([
+      "acknowledge",
+      "blocks",
+      "rerun",
+      "stale",
+      "unverified",
+      "wait",
+    ]);
+    for (const [word, key] of Object.entries(SCREEN_GATE_COPY)) {
+      expect(key).toBe(`screen_gate.${word}`);
+      expect(COPY).toHaveProperty([key]);
+    }
+  });
+
+  it("START_STARTED_COPY covers the three reasons of a started review", () => {
+    expect(Object.keys(START_STARTED_COPY).sort()).toEqual([
+      "dispatch_claimed",
+      "dispatched",
+      "redispatched",
+    ]);
+    for (const [word, key] of Object.entries(START_STARTED_COPY)) {
+      expect(key).toBe(`start.${word}`);
+      expect(COPY).toHaveProperty([key]);
+    }
+  });
+});
+
+describe("the page-owned words", () => {
+  const owned: string[] = [
+    OUT_OF_STEP,
+    NO_START_LINE,
+    HARD_REASON_LINE,
+    ...Object.values(UI_WORDS.headings),
+    ...Object.values(UI_WORDS.buttons),
+    ...Object.values(UI_WORDS.classTags),
+    ...Object.values(UI_WORDS.clearedTags),
+  ];
+
+  it("name no terminal, in either tier", () => {
+    for (const text of owned) expect(terminalFlaws(text, 2), text).toEqual([]);
+  });
+
+  it("are plain: no em-dash, no braces, no entity", () => {
+    for (const text of owned) {
+      expect(text, text).not.toContain(String.fromCharCode(0x2014));
+      expect(text, text).not.toMatch(/[{}]|&[a-z]+;|&#\d+;/i);
+    }
+  });
+
+  it("say what the lead's ruling says about a request that cannot be started", () => {
+    expect(NO_START_LINE).toBe(
+      "No review of this commit is on record and none can be started from this page, so Approve is not offered.",
+    );
+  });
+});
+
+describe("the source of the pure logic", () => {
+  const SOURCES = import.meta.glob("./publication-review.ts", {
+    query: "?raw",
+    import: "default",
+    eager: true,
+  }) as Record<string, string>;
+  const source = Object.values(SOURCES)[0] ?? "";
+
+  it("is read (the guards below are not vacuous)", () => {
+    expect(source).toContain("export function approveControl");
+  });
+
+  it("states the bounds as plain numeric literals, which nemar-cli's tie reads", () => {
+    expect(source).toContain("export const ACK_MIN = 10;");
+    expect(source).toContain("export const ACK_MAX = 500;");
+    expect(source).toContain("export const DENIAL_MAX = 2000;");
+  });
+
+  it("never reads a field the Worker words for a terminal", () => {
+    expect(source).not.toMatch(/\.line\b/);
+    expect(source).not.toMatch(/\.command\b/);
+    expect(source).not.toMatch(/\.next\b/);
+    expect(source).not.toMatch(/\[\s*["'](line|command|next)["']\s*\]/);
+    expect(source).not.toMatch(/description\.lines/);
+    expect(source).not.toMatch(/description\.summary/);
+  });
+
+  it("never computes a verdict", () => {
+    expect(source).not.toMatch(/outcome\s*[!=]==?/);
+  });
+
+  it("never builds markup from text", () => {
+    expect(source).not.toMatch(/innerHTML|insertAdjacentHTML|outerHTML|set:html/);
+  });
+
+  it("is pure: no network call, no DOM, no node module, no request context", () => {
+    expect(source).not.toMatch(/\bfetch\s*\(/);
+    expect(source).not.toMatch(/\bdocument\./);
+    expect(source).not.toMatch(/\bwindow\./);
+    expect(source).not.toMatch(/from\s+["']node:/);
+    expect(source).not.toMatch(/api-fetch|request-context/);
+    // The only import from the client module is a type, which is erased.
+    for (const m of source.matchAll(/import\s+([^;]*?)\s+from\s+["']\.\/admin-api["']/g)) {
+      expect(m[1].startsWith("type ")).toBe(true);
+    }
+  });
+
+  it("names every state word the page prints as a quoted copy key", () => {
+    for (const key of [
+      "approve.unavailable",
+      "approve.blocked",
+      "approve.resume",
+      "gate.no_review_row",
+    ]) {
+      expect(source).toContain(`"${key}"`);
+    }
+  });
+});
diff --git a/src/lib/publication-review.ts b/src/lib/publication-review.ts
new file mode 100644
index 0000000..edabbcf
--- /dev/null
+++ b/src/lib/publication-review.ts
@@ -0,0 +1,918 @@
+/**
+ * The pure logic behind the administrator approval page's review panel (website#459,
+ * nemar-cli#1731, Phase 4 of epic nemar-cli#1726).
+ *
+ * The page prints the API's own words: a reason's `statement` and neutral `cure`, the identifier
+ * screen's headline and lines, the review's headline and the model's text under a label that says
+ * the model wrote it. It never computes a verdict, never offers Approve for a reason no override
+ * clears, and never prints the words the API words for a terminal. What it owns is below:
+ *
+ * - the wire types, as TRANSCRIPTIONS (each marked `transcribed from`) of nemar-cli
+ *   `shared/contract/publication-review-admin.ts` and its Phase 4 additions. The repositories share
+ *   no package, so a change there is a change here; the captured fixtures under
+ *   `test/fixtures/publication-review/` are what notices. The types leave out, on purpose, every
+ *   field a page must not print, so the compiler stops one from reaching the screen: the per-reason
+ *   terminal wording, the description's lines and next step, the review's evidence and history;
+ * - the state machine of the Approve control (`approveControl`), the body it sends
+ *   (`approveBody`), the model the panel is drawn from (`panelModel`) and the chips of a list row
+ *   (`rowChips`);
+ * - the words for a failed call (`describeFailure`) and a started review (`describeStartSuccess`);
+ * - the page-owned UI words, which have no CLI counterpart and so are not in the mirrored table.
+ *
+ * Pure: no network call, no DOM, no node module, nothing from the request context, so a browser
+ * script can import it (`test/client-bundle-guard.test.ts`). Each of the 22 mirrored copy keys is
+ * named below as a QUOTED LITERAL in a table or a call, because the consumer rule in
+ * `publication-review-copy.test.ts` greps for exactly that; a template literal would hide it.
+ */
+import type { PublicationRequest } from "./admin-api";
+import { PUBLICATION_REVIEW_COPY, type PublicationReviewCopyKey } from "./publication-review-copy";
+
+/** One word of the mirrored table. */
+const say = (key: PublicationReviewCopyKey): string => PUBLICATION_REVIEW_COPY[key];
+
+// ---------------------------------------------------------------------------------------------
+// Limits (comment-marked copies of nemar-cli `shared/publication-limits.ts`)
+// ---------------------------------------------------------------------------------------------
+
+/** Copy of nemar-cli `shared/publication-limits.ts`: the shortest acknowledgment reason. */
+export const ACK_MIN = 10;
+/** Copy of nemar-cli `shared/publication-limits.ts`: the longest acknowledgment reason. */
+export const ACK_MAX = 500;
+/** Copy of nemar-cli `shared/publication-limits.ts`: the longest denial reason. */
+export const DENIAL_MAX = 2000;
+
+// ---------------------------------------------------------------------------------------------
+// Wire types (transcriptions)
+// ---------------------------------------------------------------------------------------------
+
+/** transcribed from `ReasonView.cleared_by` in the contract. */
+export type ClearedBy = "nothing" | "screen_acknowledgment" | "override";
+/** transcribed from the screen gate's words in nemar-cli `shared/identifier-screen-report.ts`. */
+export type ScreenGate = "clear" | "blocks" | "acknowledge" | "rerun" | "wait";
+/** The five gate words plus `exempt`, which a detail may carry and which imposes nothing. */
+export type DetailScreenGate = ScreenGate | "exempt";
+/** transcribed from the review gate's refusal words in nemar-cli `shared/publication-review.ts`. */
+export type ReviewGateRefusal =
+  | "hard_reason"
+  | "needs_override"
+  | "override_not_covering"
+  | "review_changed"
+  | "no_review_row"
+  | "unverified";
+/** The `gate` of a 409 identifier_screen_not_clear: the detail's refusal words plus two found at the click. */
+export type ScreenGateRefusal =
+  | "blocks"
+  | "acknowledge"
+  | "rerun"
+  | "wait"
+  | "stale"
+  | "unverified";
+/** transcribed from the `reason` of a started review in the contract. */
+export type StartStartedReason = "dispatched" | "redispatched" | "dispatch_claimed";
+/** The tone words a headline carries. */
+export type Tone = "ok" | "note" | "warn" | "stop";
+const TONES: readonly string[] = ["ok", "note", "warn", "stop"];
+/** A tone word the page knows, or the neutral one: a tone becomes a class name, so it is checked. */
+const toneOf = (word: unknown): Tone =>
+  typeof word === "string" && TONES.includes(word) ? (word as Tone) : "note";
+
+/** transcribed from `ReasonView` in the contract; no per-reason terminal wording is typed. */
+export interface ReasonView {
+  /** The 24 codes are nemar-cli's vocabulary; the page needs only the word. */
+  readonly code: string;
+  readonly class: "fail" | "unknown";
+  readonly cleared_by: ClearedBy;
+  /** Never printed. */
+  readonly detail: string | null;
+  /** Absent from a Worker that predates the page. */
+  readonly statement?: string;
+  readonly sentence: string;
+  /** Neutral: it names no terminal. */
+  readonly cure: string;
+}
+
+/** transcribed from `PublicationReviewRecord` in the contract, minus evidence, history and override. */
+export interface PublicationReviewRecord {
+  readonly id: number;
+  /** The model's text. */
+  readonly summary: string | null;
+  readonly fact_notes: readonly { readonly text: string }[];
+  /** `label` is the Worker's word for the finding; a Worker that predates the page omits it. */
+  readonly findings: readonly {
+    readonly label?: string;
+    readonly document_label?: string | null;
+    readonly note: string;
+  }[];
+}
+
+/** transcribed from `PublicationReviewDetail` in the contract, plus the Phase 4 additions. */
+export interface PublicationReviewDetail {
+  readonly dataset_id: string;
+  readonly request_id: number;
+  readonly request_status: string;
+  readonly anonymous: boolean;
+  readonly applies: boolean;
+  readonly gate: "enforced" | "off" | "n/a";
+  readonly started_publishing: boolean;
+  readonly block_reason: string | null;
+  /** Phase 4; optional so an older Worker types honestly. */
+  readonly start_offered?: boolean;
+  /** Phase 4; optional so an older Worker types honestly. */
+  readonly screen_gate?: DetailScreenGate;
+  readonly identifier_screen: {
+    readonly state: string | null;
+    readonly headline: string;
+    readonly tone: Tone;
+    readonly lines: readonly string[];
+  };
+  readonly screen_acknowledgment: { readonly by: number; readonly at: string } | null;
+  readonly reasons: readonly ReasonView[];
+  /** The headline and tone only; the description's lines and next step are not typed. */
+  readonly description: { readonly headline: string; readonly tone: Tone };
+  readonly review: PublicationReviewRecord | null;
+}
+
+/** What `readFailure` extracts from a failed answer; every field but the status is optional. */
+export interface ApiFailure {
+  readonly status: number;
+  /** The WORD, whichever convention carried it. */
+  readonly code?: string;
+  /** A sentence the Worker meant for a person. */
+  readonly message?: string;
+  readonly refusal?: string;
+  readonly gate?: string;
+  readonly headline?: string;
+}
+
+/** The body of an Approve click. The Worker's schema is strict, so no other key is ever sent. */
+export interface ApproveBody {
+  readonly request_id: number;
+  readonly acknowledge_identifier_screen?: string;
+  readonly override_publication_review?: {
+    readonly review_id: number | null;
+    readonly reasons: readonly string[];
+  };
+}
+
+// ---------------------------------------------------------------------------------------------
+// Page-owned words (not mirrored: no CLI counterpart)
+// ---------------------------------------------------------------------------------------------
+
+/** A Worker newer or older than this page: the reasons are not shown and Approve is not offered. */
+export const OUT_OF_STEP =
+  "This page and the API are out of step, so the review's reasons are not shown and Approve is not offered. Try again after the API is updated.";
+
+/**
+ * Shown when an override-class reason stands, there is no review row to attach the override to and
+ * the Worker offers no start (an approving request that never started publishing). The mirrored
+ * `gate.no_review_row` says to start the review, which is wrong here, so this line is the page's own.
+ */
+export const NO_START_LINE =
+  "No review of this commit is on record and none can be started from this page, so Approve is not offered.";
+
+/**
+ * Shown above the other withheld lines when a reason stands that no override clears. The line is
+ * drawn after the reasons section, so the reasons it speaks of are above it.
+ */
+export const HARD_REASON_LINE =
+  "A reason above cannot be approved over, so Approve is not offered.";
+
+/** Headings, buttons and tags of the panel. */
+export const UI_WORDS = {
+  headings: {
+    review: "Publication review",
+    screen: "Identifier screen",
+    reasons: "Reasons",
+    checks: "What the platform's own checks found",
+    summary: "Summary",
+    notes: "Notes",
+  },
+  buttons: {
+    review: "Review",
+    loading: "Loading the review...",
+    start: "Start review",
+    refresh: "Refresh the review",
+    approve: "Approve and publish",
+    resume: "Continue approval",
+    retry: "Retry approval",
+  },
+  classTags: {
+    fail: "Failed",
+    unknown: "Could not be established",
+  },
+  clearedTags: {
+    nothing: "Cannot be approved over",
+    screen_acknowledgment: "Needs a recorded reason",
+    override: "Needs your confirmation to approve over it",
+  },
+} as const;
+
+// ---------------------------------------------------------------------------------------------
+// The literal-key tables (each key named as a quoted literal for the consumer rule)
+// ---------------------------------------------------------------------------------------------
+
+/** The copy key of each review-gate refusal word. */
+export const GATE_REFUSAL_COPY: Record<ReviewGateRefusal, PublicationReviewCopyKey> = {
+  hard_reason: "gate.hard_reason",
+  needs_override: "gate.needs_override",
+  override_not_covering: "gate.override_not_covering",
+  review_changed: "gate.review_changed",
+  no_review_row: "gate.no_review_row",
+  unverified: "gate.unverified",
+};
+
+/** The copy key of each identifier-screen refusal word. */
+export const SCREEN_GATE_COPY: Record<ScreenGateRefusal, PublicationReviewCopyKey> = {
+  acknowledge: "screen_gate.acknowledge",
+  blocks: "screen_gate.blocks",
+  wait: "screen_gate.wait",
+  rerun: "screen_gate.rerun",
+  stale: "screen_gate.stale",
+  unverified: "screen_gate.unverified",
+};
+
+/** The copy key of each reason a review start can answer with HTTP 202. */
+export const START_STARTED_COPY: Record<StartStartedReason, PublicationReviewCopyKey> = {
+  dispatched: "start.dispatched",
+  redispatched: "start.redispatched",
+  dispatch_claimed: "start.dispatch_claimed",
+};
+
+// ---------------------------------------------------------------------------------------------
+// The approve control
+// ---------------------------------------------------------------------------------------------
+
+export type ApproveControl =
+  | { readonly kind: "unavailable"; readonly text: string }
+  | { readonly kind: "none"; readonly lines: readonly string[] }
+  | { readonly kind: "withheld"; readonly lines: readonly string[] }
+  | {
+      readonly kind: "offered";
+      readonly mode: "approve" | "resume";
+      readonly dialogId: "admin-approve" | "admin-approve-anonymous" | "admin-resume";
+      readonly requestId: number;
+      readonly reviewId: number | null;
+      /** Every override-class code of the detail shown, each once, in shown order; empty when none is needed. */
+      readonly overrideReasons: readonly string[];
+      readonly needsOverride: boolean;
+      readonly needsAck: boolean;
+      readonly notice: string | null;
+    };
+
+export type OfferedControl = Extract<ApproveControl, { readonly kind: "offered" }>;
+
+/** What the row's own start says: the panel's row can approve, resume, or start nothing. */
+export interface ControlContext {
+  readonly rowStart: "approve" | "resume" | null;
+}
+
+const GATE_WORDS: readonly string[] = ["enforced", "off", "n/a"];
+
+const SCREEN_GATE_WORDS: readonly string[] = [
+  "clear",
+  "blocks",
+  "acknowledge",
+  "rerun",
+  "wait",
+  "exempt",
+];
+
+/**
+ * A reason is hard unless the Worker says an override or a recorded acknowledgment clears it. A
+ * word this page does not know is hard: the page never approves over what it cannot read.
+ */
+export function isHardReason(clearedBy: string): boolean {
+  return clearedBy !== "override" && clearedBy !== "screen_acknowledgment";
+}
+
+const isObject = (v: unknown): v is Record<string, unknown> =>
+  typeof v === "object" && v !== null && !Array.isArray(v);
+const isString = (v: unknown): v is string => typeof v === "string";
+const isStringArray = (v: unknown): v is string[] => Array.isArray(v) && v.every(isString);
+
+/** A headline and a tone word, which `panelModel` checks against the tones it knows. */
+const isHeadlined = (v: unknown): boolean =>
+  isObject(v) && isString(v.headline) && isString(v.tone);
+
+function isReasonView(r: unknown): boolean {
+  return (
+    isObject(r) &&
+    isString(r.code) &&
+    isString(r.class) &&
+    isString(r.cleared_by) &&
+    // The page prints `statement`, never `sentence`, so an empty one has nothing to print: out of step.
+    isString(r.statement) &&
+    r.statement.length > 0 &&
+    isString(r.sentence) &&
+    isString(r.cure)
+  );
+}
+
+function isReviewRecord(r: unknown): boolean {
+  return (
+    isObject(r) &&
+    Number.isInteger(r.id) &&
+    (r.summary === null || r.summary === undefined || isString(r.summary)) &&
+    Array.isArray(r.fact_notes) &&
+    r.fact_notes.every((n) => isObject(n) && isString(n.text)) &&
+    Array.isArray(r.findings) &&
+    r.findings.every(
+      (f) =>
+        isObject(f) &&
+        isString(f.note) &&
+        (f.label === undefined || isString(f.label)) &&
+        (f.document_label === undefined || f.document_label === null || isString(f.document_label)),
+    )
+  );
+}
+
+/**
+ * A detail the page can read: it carries the Phase 4 fields, the screen gate and the review gate
+ * are words the page knows, the request is named by an integer and says whether it is anonymous
+ * (the body of an Approve is built from them, and a missing `request_id` would send the old
+ * bodyless click), and every part `panelModel` reads has the shape it assumes. Anything else is a
+ * Worker out of step with the page. Total: it answers false for any value, whatever its shape, so
+ * a malformed answer is "out of step" and never an exception.
+ */
+function isCurrentWorker(detail: unknown): detail is PublicationReviewDetail {
+  return (
+    isObject(detail) &&
+    Number.isInteger(detail.request_id) &&
+    isString(detail.request_status) &&
+    typeof detail.gate === "string" &&
+    GATE_WORDS.includes(detail.gate) &&
+    typeof detail.anonymous === "boolean" &&
+    typeof detail.applies === "boolean" &&
+    typeof detail.started_publishing === "boolean" &&
+    typeof detail.start_offered === "boolean" &&
+    typeof detail.screen_gate === "string" &&
+    SCREEN_GATE_WORDS.includes(detail.screen_gate) &&
+    Array.isArray(detail.reasons) &&
+    detail.reasons.every(isReasonView) &&
+    isHeadlined(detail.description) &&
+    isHeadlined(detail.identifier_screen) &&
+    isStringArray((detail.identifier_screen as Record<string, unknown>).lines) &&
+    (detail.review === null || isReviewRecord(detail.review))
+  );
+}
+
+/** Whether the Worker offers to start a review: its own word, never the page's reasoning. */
+export function startOffered(detail: PublicationReviewDetail | null): boolean {
+  return detail !== null && isCurrentWorker(detail) && detail.start_offered === true;
+}
+
+const withheld = (lines: readonly string[]): ApproveControl => ({ kind: "withheld", lines });
+
+/**
+ * What the Approve control offers for a detail, evaluated top to bottom; the first row that
+ * applies decides, except that the two withheld rows (a hard reason, the screen gate) add their
+ * lines together.
+ */
+export function approveControl(
+  detail: PublicationReviewDetail | null,
+  ctx: ControlContext,
+): ApproveControl {
+  if (detail === null) return { kind: "unavailable", text: say("approve.unavailable") };
+  if (!isCurrentWorker(detail)) return { kind: "unavailable", text: OUT_OF_STEP };
+  // Blocked comes before started: approve-dispatch refuses every blocked request, even a walked-back run.
+  if (detail.request_status === "blocked") return withheld([say("approve.blocked")]);
+  if (ctx.rowStart === null) return { kind: "none", lines: [] };
+
+  const reviewId = detail.review?.id ?? null;
+  if (detail.started_publishing) {
+    // A run that has started publishing passed the gates when it started and passes none now.
+    return {
+      kind: "offered",
+      mode: "resume",
+      dialogId: "admin-resume",
+      requestId: detail.request_id,
+      reviewId,
+      overrideReasons: [],
+      needsOverride: false,
+      needsAck: false,
+      notice: say("approve.resume"),
+    };
+  }
+
+  const lines: string[] = [];
+  if (detail.reasons.some((r) => isHardReason(r.cleared_by))) lines.push(HARD_REASON_LINE);
+  const gate = detail.screen_gate;
+  if (gate === "blocks" || gate === "rerun" || gate === "wait") {
+    lines.push(say(SCREEN_GATE_COPY[gate]));
+  }
+  if (lines.length > 0) return withheld(lines);
+
+  const overrideReasons: string[] = [];
+  for (const r of detail.reasons) {
+    if (r.cleared_by === "override" && !overrideReasons.includes(r.code))
+      overrideReasons.push(r.code);
+  }
+  const needsOverride = detail.gate === "enforced" && overrideReasons.length > 0;
+  if (needsOverride && reviewId === null) {
+    // The web path refuses an override with no review row to attach it to.
+    return withheld([detail.start_offered === true ? say("gate.no_review_row") : NO_START_LINE]);
+  }
+  return {
+    kind: "offered",
+    mode: "approve",
+    dialogId: detail.anonymous ? "admin-approve-anonymous" : "admin-approve",
+    requestId: detail.request_id,
+    reviewId,
+    overrideReasons: needsOverride ? overrideReasons : [],
+    needsOverride,
+    needsAck: gate === "acknowledge",
+    notice: null,
+  };
+}
+
+export interface ApproveInput {
+  readonly overrideConfirmed: boolean;
+  readonly acknowledgment: string;
+}
+
+export type ApproveBodyResult =
+  | { readonly ok: true; readonly body: ApproveBody }
+  | {
+      readonly ok: false;
+      readonly problem:
+        | "override_unconfirmed"
+        | "acknowledgment_too_short"
+        | "acknowledgment_too_long";
+    };
+
+/**
+ * The body of an Approve click, built from the control the panel was drawn with so it names
+ * exactly what the administrator was looking at. `request_id` is always there; a field nothing
+ * asked for is never sent, because the Worker's schema is strict.
+ */
+export function approveBody(control: OfferedControl, input: ApproveInput): ApproveBodyResult {
+  if (control.mode === "resume") return { ok: true, body: { request_id: control.requestId } };
+  if (control.needsOverride && !input.overrideConfirmed) {
+    return { ok: false, problem: "override_unconfirmed" };
+  }
+  let acknowledgment: string | undefined;
+  if (control.needsAck) {
+    const trimmed = input.acknowledgment.trim();
+    if (trimmed.length < ACK_MIN) return { ok: false, problem: "acknowledgment_too_short" };
+    if (trimmed.length > ACK_MAX) return { ok: false, problem: "acknowledgment_too_long" };
+    acknowledgment = trimmed;
+  }
+  return {
+    ok: true,
+    body: {
+      request_id: control.requestId,
+      ...(acknowledgment === undefined ? {} : { acknowledge_identifier_screen: acknowledgment }),
+      ...(control.needsOverride
+        ? {
+            override_publication_review: {
+              review_id: control.reviewId,
+              reasons: control.overrideReasons,
+            },
+          }
+        : {}),
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------------------------
+// The panel model
+// ---------------------------------------------------------------------------------------------
+
+export interface PanelModel {
+  /**
+   * The request the detail is about (`detail.request_id`); null when the detail cannot be read.
+   * The page compares it with the row's own `data-request-id` before it offers a control, because
+   * the controls bind to this id and a row can be older than the detail.
+   */
+  readonly requestId: number | null;
+  readonly headline: { readonly text: string; readonly tone: Tone } | null;
+  readonly screen: {
+    readonly headline: string;
+    readonly tone: Tone;
+    readonly lines: readonly string[];
+  } | null;
+  /** Empty when the reasons are withheld. */
+  readonly reasons: readonly {
+    readonly statement: string;
+    readonly cure: string;
+    readonly classLabel: string;
+    readonly clearedLabel: string;
+  }[];
+  /** The out-of-step words when the reasons are withheld. */
+  readonly reasonsWithheld: string | null;
+  readonly factNotes: readonly string[];
+  readonly model: {
+    readonly summaryLabel: string;
+    readonly summary: string | null;
+    readonly findingsLabel: string;
+    readonly findings: readonly {
+      readonly label: string;
+      readonly documentLabel: string | null;
+      readonly note: string;
+    }[];
+  } | null;
+  readonly standing: string | null;
+  readonly start: { readonly offered: boolean };
+  readonly approve: ApproveControl;
+  /** The label of the confirmation box, present exactly when the control needs the confirmation. */
+  readonly overrideLabel: string | null;
+  readonly ackPrompt: string | null;
+}
+
+const RANK: Record<string, number> = { nothing: 0, screen_acknowledgment: 1, override: 2 };
+/** An own-property read: `__proto__` and `constructor` are not ranks, and a word unknown is hard. */
+const rankOf = (clearedBy: string): number =>
+  Object.hasOwn(RANK, clearedBy) ? RANK[clearedBy] : 0;
+
+function clearedLabel(clearedBy: string): string {
+  return clearedBy === "override"
+    ? UI_WORDS.clearedTags.override
+    : clearedBy === "screen_acknowledgment"
+      ? UI_WORDS.clearedTags.screen_acknowledgment
+      : UI_WORDS.clearedTags.nothing;
+}
+
+/**
+ * Everything the script draws, as plain data it assigns with `textContent`. A detail the page
+ * cannot read yields no headline, no screen, no reasons and no model text: only the control's
+ * line and, when the Worker is out of step, the words that say so.
+ */
+export function panelModel(
+  detail: PublicationReviewDetail | null,
+  ctx: ControlContext,
+): PanelModel {
+  const approve = approveControl(detail, ctx);
+  const empty: PanelModel = {
+    requestId: null,
+    headline: null,
+    screen: null,
+    reasons: [],
+    reasonsWithheld: null,
+    factNotes: [],
+    model: null,
+    standing: null,
+    start: { offered: false },
+    approve,
+    overrideLabel: null,
+    ackPrompt: null,
+  };
+  if (detail === null) return empty;
+  // `isCurrentWorker` is total and checks every part read below, so nothing here can throw.
+  if (!isCurrentWorker(detail)) return { ...empty, reasonsWithheld: OUT_OF_STEP };
+
+  // Hard first, then a recorded acknowledgment, then an override; stable within a class.
+  const reasons = detail.reasons
+    .map((r, index) => ({ r, index }))
+    .sort((a, b) => rankOf(a.r.cleared_by) - rankOf(b.r.cleared_by) || a.index - b.index)
+    .map(({ r }) => ({
+      statement: r.statement ?? "",
+      cure: r.cure,
+      classLabel: r.class === "fail" ? UI_WORDS.classTags.fail : UI_WORDS.classTags.unknown,
+      clearedLabel: clearedLabel(r.cleared_by),
+    }));
+
+  const review = detail.review;
+  const summary = review?.summary ? review.summary : null;
+  // A finding with no label comes from a Worker that predates the page: it is dropped with its note.
+  const findings = (review?.findings ?? []).flatMap((f) =>
+    typeof f.label === "string" && f.label.length > 0
+      ? [{ label: f.label, documentLabel: f.document_label ?? null, note: f.note }]
+      : [],
+  );
+  const model =
+    summary === null && findings.length === 0
+      ? null
+      : {
+          summaryLabel: `${UI_WORDS.headings.summary} (${say("review.model_summary_label")})`,
+          summary,
+          findingsLabel: `${UI_WORDS.headings.notes} (${say("review.model_findings_label")})`,
+          findings,
+        };
+
+  return {
+    requestId: detail.request_id,
+    headline: { text: detail.description.headline, tone: toneOf(detail.description.tone) },
+    screen: {
+      headline: detail.identifier_screen.headline,
+      tone: toneOf(detail.identifier_screen.tone),
+      lines: detail.identifier_screen.lines,
+    },
+    reasons,
+    reasonsWithheld: null,
+    factNotes: (review?.fact_notes ?? []).map((n) => n.text),
+    model,
+    standing: detail.applies ? say("review.not_assessed") : null,
+    start: { offered: startOffered(detail) },
+    approve,
+    overrideLabel:
+      approve.kind === "offered" && approve.needsOverride ? say("approve.override_control") : null,
+    ackPrompt:
+      approve.kind === "offered" && approve.needsAck ? say("screen_gate.acknowledge") : null,
+  };
+}
+
+// ---------------------------------------------------------------------------------------------
+// Chips of a list row
+// ---------------------------------------------------------------------------------------------
+
+export interface Chip {
+  readonly text: string;
+  readonly tone: Tone;
+}
+
+/**
+ * The statuses of a request the detail route answers for (the active ones), so a chip or a panel
+ * on a closed row is noise. One list for the chip rule here and the panel rule of the row
+ * component, which must agree.
+ */
+export const ACTIVE_STATUSES: readonly string[] = ["requested", "approving", "blocked"];
+
+function chipOf(
+  piece: { readonly headline?: string; readonly tone?: string } | undefined,
+): Chip | null {
+  if (!piece || typeof piece.headline !== "string" || piece.headline.length === 0) return null;
+  return { text: piece.headline, tone: toneOf(piece.tone) };
+}
+
+/** The review chip and the screen chip of a row: the Worker's headlines verbatim, decided by nothing. */
+export function rowChips(request: PublicationRequest): {
+  review: Chip | null;
+  screen: Chip | null;
+} {
+  if (!ACTIVE_STATUSES.includes(request.status)) return { review: null, screen: null };
+  return {
+    review: chipOf(request.publication_review),
+    screen: chipOf(request.identifier_screen),
+  };
+}
+
+// ---------------------------------------------------------------------------------------------
+// Failures and started reviews
+// ---------------------------------------------------------------------------------------------
+
+export type FailureOp = "approve" | "deny" | "start" | "detail";
+
+/** What the page does with a failure: the words, and what to do about the panel. */
+export interface FailureView {
+  readonly text: string;
+  /**
+   * Read the detail again: what the administrator saw may no longer be true. The redraw also
+   * unticks the override box, so no flag of its own asks for that.
+   */
+  readonly refetch: boolean;
+  /** Put the focus in the reason field. */
+  readonly focusAck: boolean;
+  /** Offer the link that reloads the page. */
+  readonly refreshLink: boolean;
+}
+
+/**
+ * The page's own sentences, of two kinds that must not be mixed up (`WIRE_CODES` lists the first):
+ * the sentence for a CODE the approval, denial or start routes can send, and the sentences only
+ * the page says (`deny_rejected`, `network`, `approve_unconfirmed`, `generic`), which no answer of
+ * the Worker can select. `not_dispatchable` is gone (the mirrored `approve.blocked` says it), and
+ * so is `origin_not_allowed` (the Worker's own sentence is printed instead), and so are
+ * `not_invitable` and `internal_error`, which no route of the API sends. They name no terminal.
+ */
+export const FRIENDLY_WORDS = {
+  forbidden: "You no longer have admin access. Sign in again.",
+  already_in_flight:
+    "An approval is already running for this dataset. Give it a minute, then refresh.",
+  dispatch_failed:
+    "GitHub did not accept the request, so nothing was started. Try again in a moment.",
+  dispatch_unconfirmed:
+    "GitHub did not confirm the request. It may have started, so check again in a few minutes before trying again.",
+  dispatch_unconfigured:
+    "The backend has no GitHub credential, so it cannot start an approval. Retrying will not help; tell an admin who manages the backend.",
+  not_found: "Request not found.",
+  missing_field: "Provide a reason for denial.",
+  invalid_body:
+    "The approval could not be sent as built. Reload this page and try again; if it keeps happening, tell an admin who manages the backend.",
+  deny_rejected:
+    "The denial was not accepted. Give a reason of 1 to 2,000 characters and try again.",
+  network: "Could not reach the server. Check your connection and try again.",
+  approve_unconfirmed:
+    "No answer came back, and the approval may have started. Refresh and check the request before trying again.",
+  generic: "The action did not complete. Try again in a moment.",
+} as const;
+
+/**
+ * The codes `common` may turn into a sentence of `FRIENDLY_WORDS`: what the routes send, plus
+ * `forbidden`, the word the page has always kept for a refused session, and `missing_field`, which
+ * the client itself raises for an empty denial reason. A page-only sentence is NOT listed, so a
+ * wire answer carrying `network` or `generic` cannot select one.
+ */
+const WIRE_CODES = [
+  "forbidden",
+  "already_in_flight",
+  "dispatch_failed",
+  "dispatch_unconfirmed",
+  "dispatch_unconfigured",
+  "not_found",
+  "missing_field",
+  "invalid_body",
+] as const satisfies readonly (keyof typeof FRIENDLY_WORDS)[];
+
+const NO_FLAGS = { refetch: false, focusAck: false, refreshLink: false };
+
+const view = (text: string, flags: Partial<Omit<FailureView, "text">> = {}): FailureView => ({
+  text,
+  ...NO_FLAGS,
+  ...flags,
+});
+
+/** An own-property test, so `toString` and `__proto__` are never words; narrows to the table's keys. */
+const isOwn = <T extends object>(table: T, word: unknown): word is keyof T & string =>
+  typeof word === "string" && Object.hasOwn(table, word);
+
+/**
+ * What a thrown value says about the Worker's answer, or null when it did not come from one (a
+ * dead connection, a missed deadline). `PublicationApiError` is recognized by its `failure`, so
+ * this module needs nothing from the client; the older client error carries a status and a code.
+ */
+function failureOf(err: unknown): ApiFailure | null {
+  if (typeof err !== "object" || err === null) return null;
+  const e = err as { failure?: unknown; status?: unknown; code?: unknown; name?: unknown };
+  if (typeof e.failure === "object" && e.failure !== null) {
+    const f = e.failure as { status?: unknown };
+    if (typeof f.status === "number") return e.failure as ApiFailure;
+  }
+  if (e.name === "DashboardApiError" && typeof e.status === "number") {
+    return { status: e.status, ...(typeof e.code === "string" ? { code: e.code } : {}) };
+  }
+  return null;
+}
+
+/**
+ * "Headline. Sentence": the Worker's headline, then the page's words, joined by one full stop. A
+ * headline with nothing but dots and spaces is no headline, and one that already ends a sentence
+ * with `?` or `!` is not given a second mark.
+ */
+function withHeadline(headline: string | undefined, sentence: string): string {
+  const stripped = (headline ?? "").replace(/[.\s]+$/, "").trim();
+  if (stripped.length === 0) return sentence;
+  return /[?!]$/.test(stripped) ? `${stripped} ${sentence}` : `${stripped}. ${sentence}`;
+}
+
+const sentenceOr = (f: ApiFailure): string => f.message ?? FRIENDLY_WORDS.generic;
+
+const isGateRefusal = (word: string | undefined): word is ReviewGateRefusal =>
+  isOwn(GATE_REFUSAL_COPY, word);
+const isScreenRefusal = (word: string | undefined): word is ScreenGateRefusal =>
+  isOwn(SCREEN_GATE_COPY, word);
+
+/**
+ * A 401 or 403, whatever it carries. The Worker's sentence is never printed: an inactive account's
+ * refusal words a terminal command, so the page says its own word for "not signed in or not
+ * allowed", and a code it does not know (a newer Worker's `unauthorized`) takes the same word. The
+ * origin guard's 403 is answered before this is asked.
+ */
+const isDenial = (f: ApiFailure): boolean => f.status === 401 || f.status === 403;
+
+/** The page's words for a code the routes send, then a 401 or 403, then the generic sentence. */
+function common(f: ApiFailure): FailureView {
+  const code = WIRE_CODES.find((c) => c === f.code);
+  if (code !== undefined) return view(FRIENDLY_WORDS[code]);
+  if (isDenial(f)) return view(FRIENDLY_WORDS.forbidden);
+  return view(FRIENDLY_WORDS.generic);
+}
+
+/** The three words of an approve whose dispatch the Worker itself says did not go out, or may not have. */
+const isDispatchCode = (code: string | undefined): boolean =>
+  code === "dispatch_failed" || code === "dispatch_unconfirmed" || code === "dispatch_unconfigured";
+
+/** The request is gone: the page's word for the code, or the Worker's sentence when it sent only that. */
+function notFound(f: ApiFailure): FailureView {
+  const text = f.code === undefined && f.message ? f.message : FRIENDLY_WORDS.not_found;
+  return view(text, { refetch: true, refreshLink: true });
+}
+
+function describeApprove(f: ApiFailure): FailureView {
+  if (f.status === 404) return notFound(f);
+  switch (f.code) {
+    case "publication_review_not_clear":
+      return isGateRefusal(f.refusal)
+        ? view(withHeadline(f.headline, say(GATE_REFUSAL_COPY[f.refusal])), {
+            refetch: true,
+          })
+        : view(OUT_OF_STEP, { refetch: true });
+    case "identifier_screen_not_clear":
+      return isScreenRefusal(f.gate)
+        ? view(withHeadline(f.headline, say(SCREEN_GATE_COPY[f.gate])), {
+            refetch: true,
+            focusAck: f.gate === "acknowledge",
+          })
+        : view(OUT_OF_STEP, { refetch: true });
+    case "not_dispatchable":
+      return view(say("approve.blocked"), { refetch: true });
+    case "already_in_flight":
+      return view(FRIENDLY_WORDS.already_in_flight, { refreshLink: true });
+    case "request_mismatch":
+      return view(sentenceOr(f), { refetch: true });
+    case "invalid_dataset_id":
+      return view(sentenceOr(f));
+    case "dispatch_failed":
+    case "dispatch_unconfirmed":
+    case "dispatch_unconfigured":
+      return view(FRIENDLY_WORDS[f.code], { refreshLink: true });
+    default:
+      return common(f);
+  }
+}
+
+function describeDeny(f: ApiFailure): FailureView {
+  if (f.status === 404) return notFound(f);
+  switch (f.code) {
+    case "request_mismatch":
+    case "deny_after_publishing":
+    case "approval_in_flight":
+      return view(sentenceOr(f), { refetch: true, refreshLink: true });
+    default:
+      // The route's validation failure names no code the page can read.
+      return f.status === 400 && f.code === undefined
+        ? view(FRIENDLY_WORDS.deny_rejected)
+        : common(f);
+  }
+}
+
+/** The review start's own words: its `error` sentence, web-safe and pinned, never the approval's map. */
+const START_MESSAGE_CODES: readonly string[] = [
+  "review_disabled",
+  "not_applicable",
+  "not_owned_here",
+  "request_not_requested",
+  "screen_not_ready",
+  "running",
+  "has_result",
+  "platform_limit",
+  "dispatch_failed",
+  "dispatch_unconfigured",
+  "not_found",
+];
+
+function describeStart(f: ApiFailure): FailureView {
+  if (f.code !== undefined && START_MESSAGE_CODES.includes(f.code)) {
+    return view(sentenceOr(f), { refetch: true });
+  }
+  if (f.code === "bad_dataset" || f.code === "internal") return view(sentenceOr(f));
+  return common(f);
+}
+
+function describeDetail(f: ApiFailure): FailureView {
+  // The request is closed: the Worker's sentence says so, and "Reload" would be wrong advice.
+  if (f.status === 404 && f.message) return view(f.message);
+  const unavailable = say("approve.unavailable");
+  if (f.code === "forbidden" || isDenial(f)) {
+    return view(withHeadline(FRIENDLY_WORDS.forbidden, unavailable));
+  }
+  return view(unavailable);
+}
+
+/**
+ * The words and the follow-up for a failed call. A value that is not the Worker's answer (a dead
+ * connection, a missed deadline) and the proxy's own 502 words are the network sentence, except for
+ * an approve, which may have started and says so. The order is: the proxy's own failures,
+ * the origin guard's sentence, then the operation's own table. A gate or screen refusal prints the
+ * mirrored copy, never the Worker's message, which words a terminal.
+ */
+export function describeFailure(op: FailureOp, err: unknown): FailureView {
+  const f = failureOf(err);
+  if (f === null) {
+    // A missed deadline can follow a dispatch that went out: the Worker's lease makes a retry a
+    // safe 409, but the administrator should look first.
+    return op === "approve"
+      ? view(FRIENDLY_WORDS.approve_unconfirmed, { refetch: true, refreshLink: true })
+      : view(FRIENDLY_WORDS.network);
+  }
+  if (f.status === 502 && (f.code === "upstream_unreachable" || f.code === "upstream_redirect")) {
+    // The link can die after the dispatch went out, exactly like a missed deadline.
+    return op === "approve"
+      ? view(FRIENDLY_WORDS.approve_unconfirmed, { refetch: true, refreshLink: true })
+      : view(FRIENDLY_WORDS.network);
+  }
+  if (f.code === "origin_not_allowed") return view(sentenceOr(f));
+  // A server fault on an approve that is not one of the dispatch refusals may follow a dispatch
+  // that went out (an edge timeout, an unreadable body): the page cannot know, so it says so.
+  if (op === "approve" && f.status >= 500 && !isDispatchCode(f.code)) {
+    return view(FRIENDLY_WORDS.approve_unconfirmed, { refetch: true, refreshLink: true });
+  }
+  switch (op) {
+    case "approve":
+      return describeApprove(f);
+    case "deny":
+      return describeDeny(f);
+    case "start":
+      return describeStart(f);
+    case "detail":
+      return describeDetail(f);
+  }
+}
+
+/**
+ * The words for a review start that went (HTTP 202); null for a reason this page does not know.
+ * Total: any value is accepted, and one that is not an object with a known `reason` is null.
+ */
+export function describeStartSuccess(body: unknown): string | null {
+  const reason = isObject(body) ? body.reason : undefined;
+  return isOwn(START_STARTED_COPY, reason) ? say(START_STARTED_COPY[reason]) : null;
+}
diff --git a/src/pages/admin/publication-requests.astro b/src/pages/admin/publication-requests.astro
index a38c0ff..b50b3ca 100644
--- a/src/pages/admin/publication-requests.astro
+++ b/src/pages/admin/publication-requests.astro
@@ -17,6 +17,9 @@ import {
   resolveQueueTab,
   rowView,
 } from "../../lib/publication-queue";
+// The review panel is built at runtime by the script below, so its rules are global (a scoped
+// <style> never reaches runtime-built nodes). See the header of the stylesheet.
+import "../../styles/publication-review-panel.css";
 
 const session = getSession(Astro.locals);
 const redirectTo = adminGate(session, Astro.url.pathname);
@@ -105,7 +108,7 @@ const activeMeta = QUEUE_TABS.find((t) => t.id === activeTab) ?? QUEUE_TABS[0];
 
   {refreshing && (
     <p class="admin-refresh-note" data-refresh-note>
-      This page refreshes every 20 seconds while an approval is active.
+      <span data-refresh-note-text>This page refreshes every 20 seconds while an approval is active.</span>
       <button type="button" class="admin-refresh-note__toggle" data-refresh-toggle>Pause</button>
     </p>
   )}
@@ -295,33 +298,57 @@ const activeMeta = QUEUE_TABS.find((t) => t.id === activeTab) ?? QUEUE_TABS[0];
 </style>
 
 <script>
-  import { denyPublicationRequest, dispatchPublicationApproval } from "../../lib/admin-api";
-  import { DashboardApiError } from "../../lib/dashboard-api";
+  import {
+    denyPublicationRequest,
+    dispatchPublicationApproval,
+    getPublicationReview,
+    startPublicationReview,
+  } from "../../lib/admin-api";
+  import {
+    ACK_MAX,
+    type ApproveBody,
+    DENIAL_MAX,
+    FRIENDLY_WORDS,
+    type FailureView,
+    type OfferedControl,
+    type PanelModel,
+    UI_WORDS,
+    approveBody,
+    describeFailure,
+    describeStartSuccess,
+    panelModel,
+  } from "../../lib/publication-review";
+  import {
+    BUSY_FAILURE,
+    DRAW_FAILURE,
+    PANEL_WORDS,
+    type PanelNode,
+    errorTree,
+    failureTree,
+    loadingTree,
+    panelTree,
+    rowIsStale,
+    staleRowTree,
+    toggleLabels,
+  } from "../../lib/publication-review-panel";
+
+  // This script wires events, calls the client, hands what comes back to the pure functions in
+  // `lib/publication-review.ts` and `lib/publication-review-panel.ts`, and mounts the tree they
+  // return. It decides nothing and words nothing: every sentence is the API's own, the mirrored
+  // copy table's, or one of the lib's page-owned words, and every node is built by `mount` from
+  // data (tag, attributes, children, one text field), so no string is ever read as markup.
 
   const errorEl = document.querySelector<HTMLElement>("[data-admin-action-error]");
 
-  const FRIENDLY: Record<string, string> = {
-    forbidden: "You no longer have admin access. Sign in again.",
-    not_invitable: "This request is no longer pending.",
-    already_in_flight: "An approval is already running for this dataset. Give it a minute, then refresh.",
-    not_dispatchable: "This request is blocked, so it cannot be approved until the block is cleared.",
-    dispatch_failed: "GitHub did not accept the request, so nothing was started. Try again in a moment.",
-    dispatch_unconfirmed:
-      "GitHub did not confirm the request. It may have started, so check again in a few minutes before trying again.",
-    dispatch_unconfigured:
-      "The backend has no GitHub credential, so it cannot start an approval. Retrying will not help; tell an admin who manages the backend.",
-    origin_not_allowed: "The request came from an unexpected origin. Reload this page and try again.",
-    not_found: "Request not found.",
-    missing_field: "Provide a reason for denial.",
-    internal_error: "Server error. Try again in a moment.",
-  };
-
-  function friendly(err: unknown): string {
-    if (err instanceof DashboardApiError && err.code && FRIENDLY[err.code]) {
-      return FRIENDLY[err.code];
-    }
-    return err instanceof Error ? err.message : "Action failed.";
+  // The one place a node reaches the DOM: createElement, setAttribute and textContent.
+  function mount(spec: PanelNode): HTMLElement {
+    const node = document.createElement(spec.tag);
+    for (const [name, value] of Object.entries(spec.attrs ?? {})) node.setAttribute(name, value);
+    if (spec.text !== undefined) node.textContent = spec.text;
+    for (const child of spec.children ?? []) node.append(mount(child));
+    return node;
   }
+
   // `refresh` adds a link back to this page. After a failed start the outcome
   // may not be what the buttons on screen say (a timed-out request can still
   // have dispatched, a 409 means someone else already did), so the admin gets a
@@ -332,9 +359,7 @@ const activeMeta = QUEUE_TABS.find((t) => t.id === activeTab) ?? QUEUE_TABS[0];
     errorEl.hidden = false;
     errorEl.textContent = msg;
     if (opts.refresh) {
-      const link = document.createElement("a");
-      link.href = location.href;
-      link.textContent = "Refresh to see the current state.";
+      const link = mount({ tag: "a", text: PANEL_WORDS.reloadLink, attrs: { href: location.href } });
       errorEl.append(" ", link);
     }
   }
@@ -345,8 +370,15 @@ const activeMeta = QUEUE_TABS.find((t) => t.id === activeTab) ?? QUEUE_TABS[0];
   }
 
   type PendingAction =
-    | { kind: "approve" | "resume"; datasetId: string; dialogId: string }
-    | { kind: "deny"; datasetId: string; reason: string };
+    | {
+        kind: "approve" | "resume";
+        datasetId: string;
+        dialogId: string;
+        /** Built by `approveBody` from the control the panel was drawn with. */
+        body: ApproveBody;
+        panel: HTMLElement;
+      }
+    | { kind: "deny"; datasetId: string; reason: string; requestId: number };
   let pending: PendingAction | null = null;
   let inFlight = false;
 
@@ -358,57 +390,395 @@ const activeMeta = QUEUE_TABS.find((t) => t.id === activeTab) ?? QUEUE_TABS[0];
     );
   }
 
-  function queue(next: PendingAction): void {
-    if (inFlight) return;
+  // True when the action was queued. A click during a call is refused, and its caller must not open
+  // a dialog whose confirmation would find nothing pending.
+  function queue(next: PendingAction): boolean {
+    if (inFlight) return false;
     if (pending) console.warn("[admin] overwriting un-confirmed pending action", pending);
     pending = next;
     clearError();
+    return true;
   }
 
-  document.querySelectorAll<HTMLButtonElement>("[data-pubreq-approve]").forEach((btn) => {
+  // ---------------------------------------------------------------------------------------------
+  // The review panel
+  // ---------------------------------------------------------------------------------------------
+
+  interface PanelState {
+    /** The offered control the panel was drawn with: the body names exactly what was shown. */
+    control: OfferedControl | null;
+    /** Bumped by every load and every close, so a slow answer never overwrites a newer panel. */
+    token: number;
+  }
+  const states = new WeakMap<HTMLElement, PanelState>();
+  function stateOf(panel: HTMLElement): PanelState {
+    let state = states.get(panel);
+    if (!state) {
+      state = { control: null, token: 0 };
+      states.set(panel, state);
+    }
+    return state;
+  }
+
+  interface DrawOptions {
+    error?: FailureView | null;
+    notice?: string | null;
+    /** What the administrator had typed in the reason field, kept across a re-read. */
+    acknowledgment?: string;
+    focusAck?: boolean;
+    focusPanel?: boolean;
+  }
+
+  // Show a failure without redrawing: the panel keeps what the administrator is looking at.
+  function setPanelError(panel: HTMLElement, failure: FailureView): void {
+    panel.querySelector("[data-pubreq-review-error]")?.remove();
+    const node = mount(errorTree(failure, location.href));
+    const title = panel.querySelector(".pubreq-review__title");
+    if (title) title.after(node);
+    else panel.prepend(node);
+  }
+
+  const RECHECK = "pubreq:recheck";
+  // Every panel's Approve is off for the length of a call, so a click on another row cannot be
+  // dropped without a word; when the call ends without a redraw each works out its own state again
+  // from the inputs, so a field the administrator emptied stays off.
+  function setApproveBusy(busy: boolean): void {
+    for (const button of document.querySelectorAll<HTMLButtonElement>(
+      "[data-pubreq-panel-approve]",
+    )) {
+      if (busy) button.disabled = true;
+      else button.dispatchEvent(new Event(RECHECK));
+    }
+  }
+
+  function rowStartOf(panel: HTMLElement): "approve" | "resume" | null {
+    const start = panel.dataset.rowStart;
+    return start === "approve" || start === "resume" ? start : null;
+  }
+  function panelOf(from: HTMLElement): HTMLElement | null {
+    return (
+      from
+        .closest("[data-pubreq-row]")
+        ?.querySelector<HTMLElement>("[data-pubreq-review-panel]") ?? null
+    );
+  }
+  function setToggle(panel: HTMLElement, open: boolean): void {
+    const toggle = panel
+      .closest("[data-pubreq-row]")
+      ?.querySelector<HTMLButtonElement>("[data-pubreq-review-toggle]");
+    if (!toggle) return;
+    const labels = toggleLabels(open, panel.dataset.datasetId ?? "");
+    toggle.setAttribute("aria-label", labels.ariaLabel);
+    toggle.setAttribute("aria-expanded", labels.expanded);
+  }
+
+  // The notice is announced through a status region that exists before its words do: a region
+  // inserted already filled is not announced by many screen readers. The words follow after a
+  // pause, and any later announce (a re-read, or `closePanel` with null) cancels a pause still
+  // running, so the notice of a panel that was closed or redrawn never appears after the fact.
+  const announcing = new WeakMap<HTMLElement, number>();
+  function announce(panel: HTMLElement, words: string | null | undefined): void {
+    const live = panel
+      .closest("[data-pubreq-row]")
+      ?.querySelector<HTMLElement>("[data-pubreq-review-live]");
+    if (!live) return;
+    window.clearTimeout(announcing.get(live));
+    announcing.delete(live);
+    live.textContent = "";
+    if (words) {
+      announcing.set(
+        live,
+        window.setTimeout(() => {
+          announcing.delete(live);
+          live.textContent = words;
+        }, 50),
+      );
+    }
+  }
+
+  // The automatic refresh does not run over an open panel, and the note says so.
+  const refreshNoteText = document.querySelector<HTMLElement>("[data-refresh-note-text]");
+  const runningNoteWords = refreshNoteText?.textContent ?? "";
+  function syncRefreshNote(): void {
+    if (!refreshNoteText) return;
+    const open = document.querySelector("[data-pubreq-review-panel]:not([hidden])") !== null;
+    refreshNoteText.textContent = open ? PANEL_WORDS.refreshPaused : runningNoteWords;
+  }
+
+  // The offered control of a freshly mounted panel: the inputs, the Approve button and what each
+  // does. The nodes were built by `panelTree`; this only finds them by their data attributes.
+  function wireControls(panel: HTMLElement, control: OfferedControl | null): void {
+    const box = panel.querySelector<HTMLInputElement>("[data-pubreq-override]");
+    const area = panel.querySelector<HTMLTextAreaElement>("[data-pubreq-reason]");
+    const count = panel.querySelector<HTMLElement>("[data-pubreq-count]");
+    const approve = panel.querySelector<HTMLButtonElement>("[data-pubreq-panel-approve]");
+    if (control && approve) {
+      const readInput = () => ({
+        overrideConfirmed: box?.checked ?? false,
+        acknowledgment: area?.value ?? "",
+      });
+      const refresh = () => {
+        approve.disabled = !approveBody(control, readInput()).ok || inFlight;
+        if (area && count) count.textContent = `${area.value.length} / ${ACK_MAX}`;
+      };
+      // `setApproveBusy(false)` asks for this when a call ends without a redraw.
+      approve.addEventListener(RECHECK, refresh);
+      box?.addEventListener("change", refresh);
+      area?.addEventListener("input", refresh);
+      refresh();
+      approve.addEventListener("click", () => {
+        const built = approveBody(control, readInput());
+        const datasetId = panel.dataset.datasetId;
+        if (!built.ok || !datasetId) return;
+        const queued = queue({
+          kind: control.mode,
+          datasetId,
+          dialogId: control.dialogId,
+          body: built.body,
+          panel,
+        });
+        if (!queued) return setPanelError(panel, BUSY_FAILURE);
+        openDialog(control.dialogId);
+      });
+    }
+    const start = panel.querySelector<HTMLButtonElement>("[data-pubreq-start]");
+    start?.addEventListener("click", () => void startReview(panel, start));
+    wireRefresh(panel);
+  }
+
+  // Refresh the review reads the detail again and keeps the reason the administrator typed.
+  function wireRefresh(panel: HTMLElement): void {
+    panel.querySelector("[data-pubreq-refresh]")?.addEventListener("click", () => {
+      const acknowledgment = panel.querySelector<HTMLTextAreaElement>(
+        "[data-pubreq-reason]",
+      )?.value;
+      void loadPanel(panel, { acknowledgment, focusPanel: true });
+    });
+  }
+
+  function showTree(panel: HTMLElement, nodes: readonly PanelNode[]): void {
+    panel.replaceChildren(...nodes.map(mount));
+    wireRefresh(panel);
+  }
+
+  function drawPanel(panel: HTMLElement, model: PanelModel, opts: DrawOptions): void {
+    const datasetId = panel.dataset.datasetId ?? "";
+    const state = stateOf(panel);
+    state.control = model.approve.kind === "offered" ? model.approve : null;
+    const nodes = panelTree(model, {
+      datasetId,
+      panelId: panel.id,
+      retryLabel: panel.dataset.rowLabel === UI_WORDS.buttons.retry,
+      reloadHref: location.href,
+      error: opts.error,
+      notice: opts.notice,
+      acknowledgment: opts.acknowledgment,
+    });
+    panel.replaceChildren(...nodes.map(mount));
+    wireControls(panel, state.control);
+    announce(panel, opts.notice);
+    const area = panel.querySelector<HTMLTextAreaElement>("[data-pubreq-reason]");
+    if (opts.focusAck && area) queueMicrotask(() => area.focus());
+    else if (opts.focusPanel) panel.focus();
+  }
+
+  // A confirmation dialog opened from this panel belongs to the render the panel is about to
+  // replace: it is closed and its action dropped, so a confirmation never sends a body the panel no
+  // longer shows. `close()` with no argument leaves the dialog's returnValue empty, so it confirms
+  // nothing.
+  function dropPendingApproval(panel: HTMLElement): void {
+    if (!pending || pending.kind === "deny" || pending.panel !== panel) return;
+    document
+      .querySelector<HTMLDialogElement>(`dialog[data-dialog-id="${pending.dialogId}"]`)
+      ?.close();
+    pending = null;
+  }
+
+  // Every open reads the detail again: there is no cache, so what is on screen is what the API
+  // said a moment ago, and the control is computed from exactly that answer.
+  async function loadPanel(panel: HTMLElement, opts: DrawOptions = {}): Promise<void> {
+    const datasetId = panel.dataset.datasetId;
+    if (!datasetId) return;
+    dropPendingApproval(panel);
+    const state = stateOf(panel);
+    state.control = null;
+    const token = ++state.token;
+    // The redraw removes the focused button, so a panel that held focus takes it back afterwards.
+    const focusPanel = opts.focusPanel === true || panel.contains(document.activeElement);
+    panel.setAttribute("aria-busy", "true");
+    announce(panel, null);
+    showTree(panel, loadingTree(datasetId, panel.id));
+    try {
+      const detail = await getPublicationReview(datasetId);
+      if (token !== state.token) return;
+      // A fault in the drawing is this page's, not the network's: it is logged and worded as
+      // out of step, and no control is left on screen.
+      try {
+        // The id compared is the model's: null for a detail the page cannot read, which is out
+        // of step (drawn as such below), not stale.
+        const model = panelModel(detail, { rowStart: rowStartOf(panel) });
+        if (rowIsStale(model.requestId, Number(panel.dataset.requestId))) {
+          showTree(panel, staleRowTree(datasetId, panel.id, location.href, opts.error));
+          if (focusPanel) panel.focus();
+        } else {
+          drawPanel(panel, model, {
+            ...opts,
+            focusPanel,
+          });
+        }
+      } catch (drawErr) {
+        console.error("[admin] the review panel could not be drawn", drawErr);
+        state.control = null;
+        showTree(
+          panel,
+          failureTree(DRAW_FAILURE, datasetId, panel.id, location.href, opts.error),
+        );
+        if (focusPanel) panel.focus();
+      }
+    } catch (err) {
+      if (token !== state.token) return;
+      showTree(
+        panel,
+        failureTree(
+          describeFailure("detail", err),
+          datasetId,
+          panel.id,
+          location.href,
+          opts.error,
+        ),
+      );
+      if (focusPanel) panel.focus();
+    } finally {
+      if (token === state.token) panel.removeAttribute("aria-busy");
+    }
+  }
+
+  async function openPanel(panel: HTMLElement, opts: DrawOptions = {}): Promise<void> {
+    panel.hidden = false;
+    setToggle(panel, true);
+    syncRefreshNote();
+    await loadPanel(panel, opts);
+  }
+
+  function closePanel(panel: HTMLElement): void {
+    stateOf(panel).token++;
+    stateOf(panel).control = null;
+    dropPendingApproval(panel);
+    panel.hidden = true;
+    panel.replaceChildren();
+    announce(panel, null);
+    setToggle(panel, false);
+    syncRefreshNote();
+  }
+
+  // Where a failure is shown. A panel that was closed while the call ran has nowhere to draw it, so
+  // the page's own error region says it instead; an open panel re-reads when the failure asks for
+  // that and otherwise keeps what the administrator is looking at. Either way the focus goes to the
+  // panel when the caller asks, because the button that held it may be gone or disabled.
+  async function reportFailure(
+    panel: HTMLElement,
+    failure: FailureView,
+    extra: DrawOptions = {},
+  ): Promise<void> {
+    if (panel.hidden) {
+      showError(failure.text, { refresh: failure.refreshLink });
+      return;
+    }
+    if (failure.refetch) {
+      await loadPanel(panel, { ...extra, error: failure });
+      return;
+    }
+    setPanelError(panel, failure);
+    if (extra.focusPanel) panel.focus();
+  }
+
+  async function startReview(panel: HTMLElement, button: HTMLButtonElement): Promise<void> {
+    const datasetId = panel.dataset.datasetId;
+    if (!datasetId) return;
+    button.disabled = true;
+    try {
+      const started = await startPublicationReview(datasetId);
+      // Closed meanwhile: the review has started, and opening the panel reads it fresh.
+      if (!panel.hidden) {
+        await loadPanel(panel, { notice: describeStartSuccess(started), focusPanel: true });
+      }
+    } catch (err) {
+      await reportFailure(panel, describeFailure("start", err), { focusPanel: true });
+      button.disabled = false;
+    }
+  }
+
+  // After a refused Approve the page reads the detail again, the one authoritative answer: the
+  // refusal's own body is not drawn. The override box comes back unticked (the panel is redrawn
+  // from the new answer) and the reason the administrator typed is kept.
+  async function afterApproveFailure(panel: HTMLElement, err: unknown): Promise<void> {
+    const failure = describeFailure("approve", err);
+    const typed = panel.querySelector<HTMLTextAreaElement>("[data-pubreq-reason]")?.value;
+    setApproveBusy(false);
+    await reportFailure(panel, failure, {
+      acknowledgment: typed,
+      focusAck: failure.focusAck,
+      focusPanel: true,
+    });
+  }
+
+  document.querySelectorAll<HTMLButtonElement>("[data-pubreq-review-toggle]").forEach((btn) => {
     btn.addEventListener("click", () => {
-      const id = btn.dataset.datasetId;
-      if (!id) return;
-      // An anonymous release has different consequences, so it gets its own words.
-      const dialogId =
-        btn.dataset.anonymous === "true" ? "admin-approve-anonymous" : "admin-approve";
-      queue({ kind: "approve", datasetId: id, dialogId });
-      openDialog(dialogId);
+      const panel = panelOf(btn);
+      if (!panel) return;
+      if (panel.hidden) void openPanel(panel);
+      else closePanel(panel);
     });
   });
 
+  // The row's Approve and Resume open the panel (which then offers the dialog), never the dialog:
+  // the dialog cannot hold the confirmation box or the reason field the API may require first. On a
+  // panel that is already open they only move the focus to it, so what was typed there is not lost
+  // to a re-read; Refresh the review is the button that reads again.
+  function openFromRow(btn: HTMLElement): void {
+    const panel = panelOf(btn);
+    if (!panel) return showError(FRIENDLY_WORDS.generic);
+    if (!panel.hidden) return panel.focus();
+    void openPanel(panel, { focusPanel: true });
+  }
+  document.querySelectorAll<HTMLButtonElement>("[data-pubreq-approve]").forEach((btn) => {
+    btn.addEventListener("click", () => openFromRow(btn));
+  });
+
   document.querySelectorAll<HTMLButtonElement>("[data-pubreq-resume]").forEach((btn) => {
-    btn.addEventListener("click", () => {
-      const id = btn.dataset.datasetId;
-      if (!id) return;
-      queue({ kind: "resume", datasetId: id, dialogId: "admin-resume" });
-      openDialog("admin-resume");
-    });
+    btn.addEventListener("click", () => openFromRow(btn));
   });
 
   document.querySelectorAll<HTMLButtonElement>("[data-pubreq-deny]").forEach((btn) => {
     btn.addEventListener("click", () => {
       const id = btn.dataset.datasetId;
+      const requestId = Number(btn.dataset.requestId);
       if (!id) return;
+      if (!Number.isInteger(requestId)) return showError(FRIENDLY_WORDS.generic);
+      // Before the prompt: a reason typed there would be refused and lost without a word.
+      if (inFlight) return showError(PANEL_WORDS.busy);
       const rawReason = window.prompt("Reason for denial?");
       if (rawReason === null) {
         pending = null;
         return;
       }
       const reason = rawReason.trim();
-      if (reason.length === 0) {
+      if (reason.length === 0 || reason.length > DENIAL_MAX) {
         pending = null;
-        showError("A denial reason is required. Click Deny again to retry.");
+        showError(reason.length === 0 ? FRIENDLY_WORDS.missing_field : FRIENDLY_WORDS.deny_rejected);
         return;
       }
-      queue({ kind: "deny", datasetId: id, reason });
+      if (!queue({ kind: "deny", datasetId: id, reason, requestId })) {
+        return showError(PANEL_WORDS.busy);
+      }
       openDialog("admin-deny");
     });
   });
 
   // While an approval is active the page refreshes itself. It waits for a quiet
   // moment: a hidden tab, an open dialog, a click in flight, an error message
-  // on screen or the admin's own pause must not be reloaded out from under them.
+  // on screen, an open review panel (a typed reason must survive) or the admin's
+  // own pause must not be reloaded out from under them.
   // The dialog check reads the DOM rather than `pending`: cancelling a dialog
   // never reaches this script, so `pending` can stay set for good.
   let paused = false;
@@ -424,6 +794,7 @@ const activeMeta = QUEUE_TABS.find((t) => t.id === activeTab) ?? QUEUE_TABS[0];
         !inFlight &&
         !paused &&
         !document.querySelector("dialog[open]") &&
+        !document.querySelector("[data-pubreq-review-panel]:not([hidden])") &&
         (errorEl?.hidden ?? true);
       if (quiet) location.reload();
     }, 20_000);
@@ -440,12 +811,13 @@ const activeMeta = QUEUE_TABS.find((t) => t.id === activeTab) ?? QUEUE_TABS[0];
       const target = pending;
       pending = null;
       inFlight = true;
+      setApproveBusy(true);
       try {
-        await dispatchPublicationApproval(target.datasetId);
+        await dispatchPublicationApproval(target.datasetId, { body: target.body });
         location.reload();
       } catch (err) {
-        showError(friendly(err), { refresh: true });
         inFlight = false;
+        await afterApproveFailure(target.panel, err);
       }
       return;
     }
@@ -453,12 +825,17 @@ const activeMeta = QUEUE_TABS.find((t) => t.id === activeTab) ?? QUEUE_TABS[0];
       const target = pending;
       pending = null;
       inFlight = true;
+      setApproveBusy(true);
       try {
-        await denyPublicationRequest(target.datasetId, target.reason);
+        await denyPublicationRequest(target.datasetId, target.reason, {
+          requestId: target.requestId,
+        });
         location.reload();
       } catch (err) {
-        showError(friendly(err));
+        const failure = describeFailure("deny", err);
+        showError(failure.text, { refresh: failure.refreshLink });
         inFlight = false;
+        setApproveBusy(false);
       }
       return;
     }
diff --git a/src/styles/publication-review-panel.css b/src/styles/publication-review-panel.css
new file mode 100644
index 0000000..33812db
--- /dev/null
+++ b/src/styles/publication-review-panel.css
@@ -0,0 +1,322 @@
+/* The review panel of the administrator publication page (website#459).
+
+   Global by necessity, not by choice: `pages/admin/publication-requests.astro` builds the panel's
+   DOM at runtime with `createElement`, so none of it carries an Astro scope attribute and a scoped
+   <style> could never match it. The same arrangement as `eeg-viewer.css`. The `.pubreq-review`
+   prefix is what keeps the global namespace safe; the server-rendered chips and the toggle belong
+   to `PublicationRequestRow.astro` and keep their scoped styles there.
+
+   Colors come from tokens alone. The tokens resolve per theme, so light and dark are the same
+   rules, and nothing here names a hue. */
+
+.pubreq-review {
+  display: grid;
+  gap: var(--space-4);
+  min-inline-size: 0;
+  padding: var(--space-4);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+  background: var(--admin-surface-2);
+  color: var(--color-fg);
+  font-size: var(--fs-sm);
+  line-height: var(--lh-normal);
+}
+/* The grid display above would otherwise beat the UA [hidden] rule and show every closed panel. */
+.pubreq-review[hidden] {
+  display: none;
+}
+.pubreq-review:focus {
+  outline: none;
+}
+.pubreq-review:focus-visible {
+  outline: 2px solid var(--color-focus);
+  outline-offset: 2px;
+}
+
+.pubreq-review__title {
+  margin: 0;
+  font-family: var(--font-display);
+  font-size: var(--fs-base);
+  font-weight: var(--fw-semibold);
+}
+.pubreq-review__section {
+  display: grid;
+  gap: var(--space-2);
+  min-inline-size: 0;
+}
+.pubreq-review__heading {
+  margin: 0;
+  color: var(--admin-text-3);
+  font-size: var(--fs-xs);
+  font-weight: var(--fw-semibold);
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+}
+.pubreq-review__text {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+.pubreq-review__text--muted {
+  color: var(--color-fg-muted);
+}
+.pubreq-review__list {
+  display: grid;
+  gap: var(--space-2);
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+.pubreq-review__list > li {
+  min-inline-size: 0;
+  overflow-wrap: anywhere;
+}
+
+/* A headline carries its tone as a bar on the inline start edge, in the admin cards' own
+   vocabulary, so the tone is never color alone: the words say it too. */
+.pubreq-review-tone--ok,
+.pubreq-review-tone--note,
+.pubreq-review-tone--warn,
+.pubreq-review-tone--stop {
+  padding: var(--space-3) var(--space-4);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+  background: var(--admin-surface);
+  font-weight: var(--fw-semibold);
+  overflow-wrap: anywhere;
+}
+.pubreq-review-tone--ok {
+  box-shadow: inset 3px 0 0 var(--admin-ok);
+}
+.pubreq-review-tone--note {
+  box-shadow: inset 3px 0 0 var(--admin-text-3);
+}
+.pubreq-review-tone--warn {
+  box-shadow: inset 3px 0 0 var(--admin-warn);
+}
+.pubreq-review-tone--stop {
+  box-shadow: inset 3px 0 0 var(--admin-error);
+}
+
+.pubreq-review__reason {
+  display: grid;
+  gap: var(--space-2);
+  min-inline-size: 0;
+  padding: var(--space-3) var(--space-4);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+  background: var(--admin-surface);
+}
+.pubreq-review__reason-tags {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--space-2);
+}
+.pubreq-review__tag {
+  padding: 2px var(--space-2);
+  border: 1px solid var(--color-border-strong);
+  border-radius: var(--radius-sm);
+  color: var(--color-fg-muted);
+  font-size: var(--fs-xs);
+}
+.pubreq-review__cure {
+  margin: 0;
+  color: var(--color-fg-muted);
+  overflow-wrap: anywhere;
+}
+
+/* The model's text is set apart: a dashed rule says it was written by something that can be wrong. */
+.pubreq-review__model {
+  display: grid;
+  gap: var(--space-3);
+  padding: var(--space-3) var(--space-4);
+  border: 1px dashed var(--color-border-strong);
+  border-radius: var(--radius-md);
+  background: var(--admin-surface);
+}
+.pubreq-review__finding {
+  display: grid;
+  gap: 2px;
+}
+.pubreq-review__finding-label {
+  font-weight: var(--fw-semibold);
+}
+.pubreq-review__finding-document {
+  color: var(--admin-text-3);
+  font-size: var(--fs-xs);
+  overflow-wrap: anywhere;
+}
+
+.pubreq-review__controls {
+  display: grid;
+  gap: var(--space-3);
+  padding-block-start: var(--space-3);
+  border-block-start: 1px solid var(--color-border);
+}
+.pubreq-review__check {
+  display: grid;
+  grid-template-columns: auto 1fr;
+  align-items: start;
+  gap: var(--space-2);
+  cursor: pointer;
+}
+.pubreq-review__check input {
+  inline-size: 1.125rem;
+  block-size: 1.125rem;
+  margin: 2px 0 0;
+  accent-color: var(--color-link);
+}
+.pubreq-review__field {
+  display: grid;
+  gap: var(--space-2);
+}
+.pubreq-review__field textarea {
+  inline-size: 100%;
+  min-block-size: 5rem;
+  box-sizing: border-box;
+  padding: var(--space-2) var(--space-3);
+  border: 1px solid var(--admin-control-border);
+  border-radius: var(--radius-md);
+  background: var(--color-bg);
+  color: var(--color-fg);
+  font: inherit;
+  resize: vertical;
+}
+.pubreq-review__count {
+  color: var(--admin-text-3);
+  font-size: var(--fs-xs);
+  font-variant-numeric: tabular-nums;
+}
+
+.pubreq-review__actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--space-2);
+}
+.pubreq-review__btn {
+  min-block-size: 36px;
+  padding: 0 var(--space-4);
+  border: 1px solid var(--color-border-strong);
+  border-radius: var(--radius-md);
+  background: var(--admin-surface);
+  color: var(--color-fg);
+  font: inherit;
+  font-weight: var(--fw-medium);
+  cursor: pointer;
+}
+.pubreq-review__btn:hover:not(:disabled) {
+  background: var(--admin-surface-3);
+  border-color: var(--admin-control-border);
+}
+.pubreq-review__btn--primary {
+  border-color: var(--color-link);
+  background: var(--color-link);
+  color: var(--color-bg);
+}
+.pubreq-review__btn--primary:hover:not(:disabled) {
+  border-color: var(--color-link-hover);
+  background: var(--color-link-hover);
+}
+.pubreq-review__btn:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.pubreq-review__notice,
+.pubreq-review__error {
+  margin: 0;
+  padding: var(--space-3) var(--space-4);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+  background: var(--admin-surface);
+  overflow-wrap: anywhere;
+}
+.pubreq-review__notice {
+  box-shadow: inset 3px 0 0 var(--admin-accent);
+}
+.pubreq-review__error {
+  box-shadow: inset 3px 0 0 var(--admin-error);
+}
+.pubreq-review__error[hidden] {
+  display: none;
+}
+.pubreq-review__error a {
+  color: var(--color-link);
+}
+
+.pubreq-review__btn:focus-visible,
+.pubreq-review__check input:focus-visible,
+.pubreq-review__field textarea:focus-visible,
+.pubreq-review__error a:focus-visible {
+  outline: 2px solid var(--color-focus);
+  outline-offset: 2px;
+}
+
+@media (max-width: 640px) {
+  .pubreq-review {
+    padding: var(--space-3);
+  }
+  .pubreq-review__actions {
+    display: grid;
+  }
+  .pubreq-review__btn {
+    inline-size: 100%;
+  }
+}
+
+/* The row's review toggle keeps one visible word ("Review"), so its accessible name can contain it;
+   `aria-expanded` carries the state and this chevron shows it. A shape drawn from borders: it is
+   decorative (empty content, so nothing is read aloud) and needs no glyph or image. */
+.pubreq-review-toggle::after {
+  content: "";
+  flex: none;
+  inline-size: 0.45em;
+  block-size: 0.45em;
+  margin-inline-start: var(--space-2);
+  border-inline-end: 2px solid currentColor;
+  border-block-end: 2px solid currentColor;
+  transform: translateY(-0.15em) rotate(45deg);
+}
+.pubreq-review-toggle[aria-expanded="true"]::after {
+  transform: translateY(0.1em) rotate(-135deg);
+}
+
+/* Forced colors drop box-shadow, so a tone and a notice keep their bar as a border. */
+@media (forced-colors: active) {
+  .pubreq-review-tone--ok,
+  .pubreq-review-tone--note,
+  .pubreq-review-tone--warn,
+  .pubreq-review-tone--stop,
+  .pubreq-review__notice,
+  .pubreq-review__error {
+    border-inline-start: 3px solid CanvasText;
+  }
+  .pubreq-review__btn--primary {
+    forced-color-adjust: none;
+    background: ButtonFace;
+    color: ButtonText;
+    border-color: ButtonText;
+  }
+  .pubreq-review__btn:disabled {
+    opacity: 1;
+    color: GrayText;
+    border-color: GrayText;
+  }
+  /* A border keeps its color in forced colors, but a named system color is the sure one. */
+  .pubreq-review-toggle::after {
+    border-color: ButtonText;
+  }
+}
+
+/* The status region the script announces a started review through. It exists, empty, before the
+   words do, so a screen reader announces them; sighted users read the notice in the panel. */
+.pubreq-review__live {
+  position: absolute;
+  inline-size: 1px;
+  block-size: 1px;
+  margin: -1px;
+  padding: 0;
+  overflow: hidden;
+  clip-path: inset(50%);
+  white-space: nowrap;
+  border: 0;
+}
diff --git a/test/copy-drift.ts b/test/copy-drift.ts
index eec83e6..6227a3e 100644
--- a/test/copy-drift.ts
+++ b/test/copy-drift.ts
@@ -3,6 +3,12 @@
  * `account-copy-drift.test.ts` so they can be tested on fixtures rather than
  * only on whatever happens to be on disk (website#309 review).
  *
+ * The readers here and nemar-cli's own (in its parity test) implement the same RULE, written
+ * independently in each repository, so neither imports the other: a quote-aware comment strip, the
+ * same `"key": "value"` pattern, and a throw on a key matched twice. They are not shared code. If
+ * one side's rule changes, the other is changed by hand, and each repository proves its reader
+ * against its own copy file.
+ *
  * Not a `.test.ts` file on purpose: vitest collects only `*.test.ts`, and
  * Biome's `noExportsInTest` forbids exporting from one — the same arrangement
  * `test/routes/harness.ts` already uses.
@@ -28,22 +34,85 @@ export interface CopyComparison {
   readonly contractOnly: readonly string[];
 }
 
+/**
+ * The source with its comments removed, string literals left whole.
+ *
+ * A scan, not a regular expression: a `//` or a quote inside a string literal is text (a URL in a
+ * copy value, an apostrophe), while the same characters in a comment are not, and a comment may
+ * follow code on the same line. Handles line comments, block comments, and `"`, `'` and template
+ * strings with backslash escapes. A regular-expression literal is NOT recognized as one, so a
+ * quote or a `//` inside one would confuse it; a copy table has none (the self-tests read each
+ * repository's own copy file back, which would notice).
+ */
+export function stripComments(source: string): string {
+  let out = "";
+  let i = 0;
+  const n = source.length;
+  while (i < n) {
+    const c = source[i];
+    const next = source[i + 1];
+    if (c === "/" && next === "/") {
+      while (i < n && source[i] !== "\n") i += 1;
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      const end = source.indexOf("*/", i + 2);
+      i = end === -1 ? n : end + 2;
+      out += " ";
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      out += c;
+      i += 1;
+      while (i < n) {
+        const d = source[i];
+        out += d;
+        i += 1;
+        if (d === "\\") {
+          if (i < n) {
+            out += source[i];
+            i += 1;
+          }
+          continue;
+        }
+        if (d === c) break;
+        // A raw newline ends a plain string (invalid source); never swallow the rest of the file.
+        if (d === "\n" && c !== "`") break;
+      }
+      continue;
+    }
+    out += c;
+    i += 1;
+  }
+  return out;
+}
+
 /**
  * Pull `"key": "value"` pairs out of a TypeScript source file.
  *
- * Comments are stripped first so a key quoted in prose cannot become an
- * entry. A value that is not a plain string literal — a template literal, a
- * concatenation, a reference to a constant — is invisible to this, which is
- * why `account-copy.ts` forbids them and `account-copy.test.ts` enforces the
- * ban; a silently unread key would be a silently unchecked key.
+ * Comments are stripped first (`stripComments`, which also removes a comment that follows code on
+ * the same line) so a key quoted in prose cannot become an entry. A key that is matched TWICE
+ * throws: a literal with a duplicate key is a TypeScript error anyway, and a second match is
+ * exactly what a commented-out or pasted-over copy of a line looks like, so a duplicate must never
+ * be settled by letting the last one win. A value that is not a plain string literal (a template
+ * literal, a concatenation, a reference to a constant) is invisible to this, which is why
+ * `account-copy.ts` forbids them and `account-copy.test.ts` enforces the ban; a silently unread key
+ * would be a silently unchecked key.
  */
 export function extractCopy(source: string): Map<string, string> {
-  const withoutComments = source.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/^[ \t]*\/\/.*$/gm, " ");
+  const withoutComments = stripComments(source);
   const entries = new Map<string, string>();
+  const duplicates = new Set<string>();
   const pattern = /"([A-Za-z0-9_.]+)"\s*:\s*"((?:[^"\\]|\\.)*)"/g;
   for (const match of withoutComments.matchAll(pattern)) {
+    if (entries.has(match[1])) duplicates.add(match[1]);
     entries.set(match[1], match[2].replace(/\\(.)/g, "$1"));
   }
+  if (duplicates.size > 0) {
+    throw new Error(
+      `copy key matched more than once (a duplicate or a leftover line): ${[...duplicates].join(", ")}`,
+    );
+  }
   return entries;
 }
 
diff --git a/test/fixtures/publication-review/approve-202-override.json b/test/fixtures/publication-review/approve-202-override.json
new file mode 100644
index 0000000..4348b6f
--- /dev/null
+++ b/test/fixtures/publication-review/approve-202-override.json
@@ -0,0 +1,17 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, failingReport review, override covering question_failed, stand-in answers the dispatch 204",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1,\"override_publication_review\":{\"review_id\":1,\"reasons\":[\"question_failed\"]}}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 202,
+  "body": {
+    "status": "dispatched",
+    "dataset_id": "nm000746",
+    "request_id": 1,
+    "resume": false
+  }
+}
diff --git a/test/fixtures/publication-review/approve-202.json b/test/fixtures/publication-review/approve-202.json
new file mode 100644
index 0000000..6ccf8a4
--- /dev/null
+++ b/test/fixtures/publication-review/approve-202.json
@@ -0,0 +1,17 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean at the stand-in's main, review passing, stand-in answers the dispatch 204, request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 202,
+  "body": {
+    "status": "dispatched",
+    "dataset_id": "nm000745",
+    "request_id": 1,
+    "resume": false
+  }
+}
diff --git a/test/fixtures/publication-review/approve-502-dispatch-failed.json b/test/fixtures/publication-review/approve-502-dispatch-failed.json
new file mode 100644
index 0000000..b6b4a60
--- /dev/null
+++ b/test/fixtures/publication-review/approve-502-dispatch-failed.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review passing, stand-in answers the dispatch 422 (a 4xx: definitely not sent), request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 502,
+  "body": {
+    "error": "dispatch_failed",
+    "message": "The approval could not be started. Nothing was changed; try again."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-502-dispatch-unconfirmed.json b/test/fixtures/publication-review/approve-502-dispatch-unconfirmed.json
new file mode 100644
index 0000000..067e542
--- /dev/null
+++ b/test/fixtures/publication-review/approve-502-dispatch-unconfirmed.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review passing, stand-in answers the dispatch 500 (a 5xx: possibly sent), request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 502,
+  "body": {
+    "error": "dispatch_unconfirmed",
+    "message": "GitHub did not confirm the request. It may have started; check again in a few minutes before trying again."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-502-unconfigured.json b/test/fixtures/publication-review/approve-502-unconfigured.json
new file mode 100644
index 0000000..0b3e8e7
--- /dev/null
+++ b/test/fixtures/publication-review/approve-502-unconfigured.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review passing, the Worker has no GitHub credential, request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 502,
+  "body": {
+    "error": "dispatch_unconfigured",
+    "message": "This server has no GitHub credential configured, so an approval cannot be dispatched from the web. Retrying will not help. Approve from a terminal, and ask an administrator to fix the configuration."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-already-in-flight.json b/test/fixtures/publication-review/approve-already-in-flight.json
new file mode 100644
index 0000000..1255182
--- /dev/null
+++ b/test/fixtures/publication-review/approve-already-in-flight.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "request approving with another administrator's live web claim made a minute ago, request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "already_in_flight",
+    "message": "An approval is already running for this dataset."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-hard-reason.json b/test/fixtures/publication-review/approve-hard-reason.json
new file mode 100644
index 0000000..bc455b3
--- /dev/null
+++ b/test/fixtures/publication-review/approve-hard-reason.json
@@ -0,0 +1,44 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review reported with every question passed but evidence minimums failed (name_too_short), which stands as the hard reason submission_minimum_failed; request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "publication_review_not_clear",
+    "refusal": "hard_reason",
+    "headline": "Publication review: FAIL",
+    "message": "The publication review gives a reason that no override clears, so the approval is refused. A submission minimum failed at the reviewed commit. The depositor fixes the dataset and requests publication again; a request still waiting for its decision is moved to blocked.",
+    "outcome": "fail",
+    "reasons": [
+      {
+        "code": "submission_minimum_failed",
+        "class": "fail",
+        "cleared_by": "nothing",
+        "detail": "name_too_short",
+        "statement": "A submission minimum failed at the reviewed commit (name_too_short).",
+        "sentence": "A submission minimum failed at the reviewed commit.",
+        "cure": "The depositor fixes the dataset and requests publication again; a request still waiting for its decision is moved to blocked.",
+        "command": null,
+        "line": "A submission minimum failed at the reviewed commit (name_too_short). The depositor fixes the dataset and requests publication again; a request still waiting for its decision is moved to blocked."
+      },
+      {
+        "code": "question_failed",
+        "class": "fail",
+        "cleared_by": "override",
+        "detail": "name_adequate",
+        "statement": "A question of the review failed (the name describes the dataset; the Name in dataset_description.json is shorter than 25 characters).",
+        "sentence": "A question of the review failed.",
+        "cure": "Read any findings and the dataset's text. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "A question of the review failed (the name describes the dataset; the Name in dataset_description.json is shorter than 25 characters). Read any findings and the dataset's text. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "uncovered": [],
+    "review_id": 1
+  }
+}
diff --git a/test/fixtures/publication-review/approve-invalid-body.json b/test/fixtures/publication-review/approve-invalid-body.json
new file mode 100644
index 0000000..fa1f2f0
--- /dev/null
+++ b/test/fixtures/publication-review/approve-invalid-body.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review passing, a body with an unknown key (resume)",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1,\"resume\":true}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 400,
+  "body": {
+    "error": "invalid_body",
+    "message": "The only fields this accepts are acknowledge_identifier_screen, a reason of 10 to 500 characters, override_publication_review, the review shown and the reasons shown, and request_id, the request this click is for."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-needs-override.json b/test/fixtures/publication-review/approve-needs-override.json
new file mode 100644
index 0000000..54f5fb9
--- /dev/null
+++ b/test/fixtures/publication-review/approve-needs-override.json
@@ -0,0 +1,33 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review reported with failingReport, request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "publication_review_not_clear",
+    "refusal": "needs_override",
+    "headline": "Publication review: FAIL",
+    "message": "The publication review is not a pass. Read it (nemar admin publish show nm000727), then approve over it with --force, which records the override with your account.",
+    "outcome": "fail",
+    "reasons": [
+      {
+        "code": "question_failed",
+        "class": "fail",
+        "cleared_by": "override",
+        "detail": "complete_and_honest",
+        "statement": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset).",
+        "sentence": "A question of the review failed.",
+        "cure": "Read any findings and the dataset's text. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset). Read any findings and the dataset's text. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "uncovered": ["question_failed"],
+    "review_id": 1
+  }
+}
diff --git a/test/fixtures/publication-review/approve-no-review-row.json b/test/fixtures/publication-review/approve-no-review-row.json
new file mode 100644
index 0000000..50c5ab9
--- /dev/null
+++ b/test/fixtures/publication-review/approve-no-review-row.json
@@ -0,0 +1,33 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review on, no review row, override with review_id null and reasons [review_not_started]",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1,\"override_publication_review\":{\"review_id\":null,\"reasons\":[\"review_not_started\"]}}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "publication_review_not_clear",
+    "refusal": "no_review_row",
+    "headline": "Publication review: action required",
+    "message": "No review of this commit is on record to attach the override to. Start it (nemar admin publish start nm000731), or approve from a terminal with --force.",
+    "outcome": "action_required",
+    "reasons": [
+      {
+        "code": "review_not_started",
+        "class": "unknown",
+        "cleared_by": "override",
+        "detail": null,
+        "statement": "No review of the screened commit has started.",
+        "sentence": "No review of the screened commit has started.",
+        "cure": "Start it. An administrator may approve over it; the approval records the override.",
+        "command": "nemar admin publish start nm000731",
+        "line": "No review of the screened commit has started. Start it: nemar admin publish start nm000731. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "uncovered": [],
+    "review_id": null
+  }
+}
diff --git a/test/fixtures/publication-review/approve-not-dispatchable.json b/test/fixtures/publication-review/approve-not-dispatchable.json
new file mode 100644
index 0000000..8535850
--- /dev/null
+++ b/test/fixtures/publication-review/approve-not-dispatchable.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "request blocked (min_requirements_failed), request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "not_dispatchable",
+    "message": "This request is blocked. Resolve the block before dispatching an approval, or approve it from a terminal."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-override-not-covering.json b/test/fixtures/publication-review/approve-override-not-covering.json
new file mode 100644
index 0000000..a679204
--- /dev/null
+++ b/test/fixtures/publication-review/approve-override-not-covering.json
@@ -0,0 +1,33 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, failingReport review, override with the review's id and an empty reasons list",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1,\"override_publication_review\":{\"review_id\":1,\"reasons\":[]}}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "publication_review_not_clear",
+    "refusal": "override_not_covering",
+    "headline": "Publication review: FAIL",
+    "message": "The review now gives a reason the override was not given for. Read it again (nemar admin publish show nm000729) before approving.",
+    "outcome": "fail",
+    "reasons": [
+      {
+        "code": "question_failed",
+        "class": "fail",
+        "cleared_by": "override",
+        "detail": "complete_and_honest",
+        "statement": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset).",
+        "sentence": "A question of the review failed.",
+        "cure": "Read any findings and the dataset's text. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset). Read any findings and the dataset's text. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "uncovered": ["question_failed"],
+    "review_id": 1
+  }
+}
diff --git a/test/fixtures/publication-review/approve-request-mismatch.json b/test/fixtures/publication-review/approve-request-mismatch.json
new file mode 100644
index 0000000..82a6038
--- /dev/null
+++ b/test/fixtures/publication-review/approve-request-mismatch.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review passing, request_id one higher than the request",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":2}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "request_mismatch",
+    "message": "The request in force for this dataset is not the one you meant (it was denied or filed again since). Read it again before going on."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-review-changed.json b/test/fixtures/publication-review/approve-review-changed.json
new file mode 100644
index 0000000..120359d
--- /dev/null
+++ b/test/fixtures/publication-review/approve-review-changed.json
@@ -0,0 +1,33 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, failingReport review, override naming a review id one higher than the review in force",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1,\"override_publication_review\":{\"review_id\":2,\"reasons\":[\"question_failed\"]}}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "publication_review_not_clear",
+    "refusal": "review_changed",
+    "headline": "Publication review: FAIL",
+    "message": "The review the override was given for is no longer the review of this request, or it changed while the approval was being checked. Read it again (nemar admin publish show nm000730) before approving.",
+    "outcome": "fail",
+    "reasons": [
+      {
+        "code": "question_failed",
+        "class": "fail",
+        "cleared_by": "override",
+        "detail": "complete_and_honest",
+        "statement": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset).",
+        "sentence": "A question of the review failed.",
+        "cure": "Read any findings and the dataset's text. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset). Read any findings and the dataset's text. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "uncovered": [],
+    "review_id": 1
+  }
+}
diff --git a/test/fixtures/publication-review/approve-screen-acknowledge.json b/test/fixtures/publication-review/approve-screen-acknowledge.json
new file mode 100644
index 0000000..b4087c2
--- /dev/null
+++ b/test/fixtures/publication-review/approve-screen-acknowledge.json
@@ -0,0 +1,17 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen status review, no review row (the screen's state gate answers before the review gate, no GitHub read), request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "identifier_screen_not_clear",
+    "gate": "acknowledge",
+    "headline": "Identifier screen: needs review",
+    "message": "Identifier screen: needs review. An admin must look at what the screen reported and approve with a recorded reason: nemar admin publish approve nm000733 --acknowledge-identifier-screen \"<reason>\"."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-screen-blocks.json b/test/fixtures/publication-review/approve-screen-blocks.json
new file mode 100644
index 0000000..e59604a
--- /dev/null
+++ b/test/fixtures/publication-review/approve-screen-blocks.json
@@ -0,0 +1,17 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen status direct-identifiers, no review row (the screen's state gate answers before the review gate, no GitHub read), request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "identifier_screen_not_clear",
+    "gate": "blocks",
+    "headline": "Identifier screen: FOUND IDENTIFIERS",
+    "message": "Identifier screen: FOUND IDENTIFIERS. A direct identifier cannot be acknowledged: the depositor must remove it and request publication again, which re-runs the screen."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-screen-rerun.json b/test/fixtures/publication-review/approve-screen-rerun.json
new file mode 100644
index 0000000..81d199f
--- /dev/null
+++ b/test/fixtures/publication-review/approve-screen-rerun.json
@@ -0,0 +1,17 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen status unreported, no review row (the screen's state gate answers before the review gate, no GitHub read), request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "identifier_screen_not_clear",
+    "gate": "rerun",
+    "headline": "Identifier screen: DID NOT REPORT",
+    "message": "Identifier screen: DID NOT REPORT. Approval waits for a screen that produced a verdict: run it again with nemar admin publish screen nm000734."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-screen-stale.json b/test/fixtures/publication-review/approve-screen-stale.json
new file mode 100644
index 0000000..0cd7bb0
--- /dev/null
+++ b/test/fixtures/publication-review/approve-screen-stale.json
@@ -0,0 +1,17 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean and review passing at a head that differs from the stand-in's main, request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "identifier_screen_not_clear",
+    "gate": "stale",
+    "headline": "Identifier screen: clean",
+    "message": "The identifier screen read commit ffffffffffff, and main is now at 0123456789ab: its verdict is about content that has since changed. Re-run it with nemar admin publish screen nm000736. If an approval already started and committed to the repository, continue it with --resume instead."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-screen-unverified.json b/test/fixtures/publication-review/approve-screen-unverified.json
new file mode 100644
index 0000000..2dbd3e8
--- /dev/null
+++ b/test/fixtures/publication-review/approve-screen-unverified.json
@@ -0,0 +1,17 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review passing, the GitHub stand-in answers 401 to the read of main so the head cannot be verified, request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "identifier_screen_not_clear",
+    "gate": "unverified",
+    "headline": "Identifier screen: clean",
+    "message": "Could not verify that the identifier screen read the current content: the repository's main branch could not be read. Approval is refused until it can be verified; try again, or re-run the screen with nemar admin publish screen nm000737."
+  }
+}
diff --git a/test/fixtures/publication-review/approve-screen-wait.json b/test/fixtures/publication-review/approve-screen-wait.json
new file mode 100644
index 0000000..ca65f11
--- /dev/null
+++ b/test/fixtures/publication-review/approve-screen-wait.json
@@ -0,0 +1,17 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen status pending, no review row (the screen's state gate answers before the review gate, no GitHub read), request_id only",
+    "request": "POST /admin/publish/<dataset>/approve-dispatch with {\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "identifier_screen_not_clear",
+    "gate": "wait",
+    "headline": "Identifier screen: running",
+    "message": "Identifier screen: running. The screen is still running; approve once it reports (admins are mailed when it does)."
+  }
+}
diff --git a/test/fixtures/publication-review/deny-200.json b/test/fixtures/publication-review/deny-200.json
new file mode 100644
index 0000000..50bb3d5
--- /dev/null
+++ b/test/fixtures/publication-review/deny-200.json
@@ -0,0 +1,16 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "a requested request, a reason, request_id of the request",
+    "request": "POST /admin/publish/<dataset>/deny with {\"reason\":\"The README does not describe the recordings.\",\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "message": "Publication request denied",
+    "dataset_id": "nm000747",
+    "reason": "The README does not describe the recordings."
+  }
+}
diff --git a/test/fixtures/publication-review/deny-after-publishing.json b/test/fixtures/publication-review/deny-after-publishing.json
new file mode 100644
index 0000000..7f9d0c4
--- /dev/null
+++ b/test/fixtures/publication-review/deny-after-publishing.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "approving request with three publishing steps done",
+    "request": "POST /admin/publish/<dataset>/deny with {\"reason\":\"No.\",\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "deny_after_publishing",
+    "message": "Steps of an approval of this request have already run, so the dataset may already be public and the request cannot be denied. Check the dataset first. A blocked request waits for its depositor to fix what blocked it; for any other, check whether approving it again can finish it, or repair it by hand."
+  }
+}
diff --git a/test/fixtures/publication-review/deny-approval-in-flight.json b/test/fixtures/publication-review/deny-approval-in-flight.json
new file mode 100644
index 0000000..3b81980
--- /dev/null
+++ b/test/fixtures/publication-review/deny-approval-in-flight.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "approving request with a live web claim made a minute ago",
+    "request": "POST /admin/publish/<dataset>/deny with {\"reason\":\"No.\",\"request_id\":1}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "approval_in_flight",
+    "message": "An approval of this request is running, so it cannot be denied right now. If the run stalls before it publishes anything, the request can be denied then."
+  }
+}
diff --git a/test/fixtures/publication-review/deny-invalid-body.json b/test/fixtures/publication-review/deny-invalid-body.json
new file mode 100644
index 0000000..c1d7199
--- /dev/null
+++ b/test/fixtures/publication-review/deny-invalid-body.json
@@ -0,0 +1,28 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "a requested request, an empty reason",
+    "request": "POST /admin/publish/<dataset>/deny with {\"reason\":\"\"}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 400,
+  "body": {
+    "success": false,
+    "error": {
+      "issues": [
+        {
+          "code": "too_small",
+          "minimum": 1,
+          "type": "string",
+          "inclusive": true,
+          "exact": false,
+          "message": "Reason is required",
+          "path": ["reason"]
+        }
+      ],
+      "name": "ZodError"
+    }
+  }
+}
diff --git a/test/fixtures/publication-review/deny-not-found.json b/test/fixtures/publication-review/deny-not-found.json
new file mode 100644
index 0000000..27b5c61
--- /dev/null
+++ b/test/fixtures/publication-review/deny-not-found.json
@@ -0,0 +1,14 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "the dataset's only request is published",
+    "request": "POST /admin/publish/<dataset>/deny with {\"reason\":\"No.\"}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 404,
+  "body": {
+    "error": "No active publication request found"
+  }
+}
diff --git a/test/fixtures/publication-review/deny-request-mismatch.json b/test/fixtures/publication-review/deny-request-mismatch.json
new file mode 100644
index 0000000..16ac780
--- /dev/null
+++ b/test/fixtures/publication-review/deny-request-mismatch.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "a requested request, request_id one higher",
+    "request": "POST /admin/publish/<dataset>/deny with {\"reason\":\"No.\",\"request_id\":2}",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "error": "request_mismatch",
+    "message": "The request in force for this dataset is not the one you meant (it was denied or filed again since). Read it again before going on."
+  }
+}
diff --git a/test/fixtures/publication-review/detail-approving-not-startable.json b/test/fixtures/publication-review/detail-approving-not-startable.json
new file mode 100644
index 0000000..3811f67
--- /dev/null
+++ b/test/fixtures/publication-review/detail-approving-not-startable.json
@@ -0,0 +1,64 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "review on, request approving with no publishing step done, no review row",
+    "request": "GET /admin/publish/nm000721/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000721",
+    "request_id": 1,
+    "request_status": "approving",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "clean",
+      "headline": "Identifier screen: clean",
+      "tone": "ok",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": false,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "action_required",
+    "start_offered": false,
+    "screen_gate": "clear",
+    "reasons": [
+      {
+        "code": "review_not_started",
+        "class": "unknown",
+        "cleared_by": "override",
+        "detail": null,
+        "statement": "No review of the screened commit has started.",
+        "sentence": "No review of the screened commit has started.",
+        "cure": "A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "No review of the screened commit has started. A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "description": {
+      "headline": "Publication review: action required",
+      "tone": "warn",
+      "lines": [
+        "No review of the screened commit has started. A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override (--force).",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": null,
+      "next": "nemar admin publish approve nm000721 --resume --force"
+    },
+    "review": null,
+    "history": [],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-blocked-started.json b/test/fixtures/publication-review/detail-blocked-started.json
new file mode 100644
index 0000000..f0a302a
--- /dev/null
+++ b/test/fixtures/publication-review/detail-blocked-started.json
@@ -0,0 +1,77 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "request blocked with block_reason owner_name_missing and three publishing steps done",
+    "request": "GET /admin/publish/nm000723/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000723",
+    "request_id": 1,
+    "request_status": "blocked",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "clean",
+      "headline": "Identifier screen: clean",
+      "tone": "ok",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": "owner_name_missing",
+    "started_publishing": true,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "fail",
+    "start_offered": false,
+    "screen_gate": "clear",
+    "reasons": [
+      {
+        "code": "request_blocked",
+        "class": "fail",
+        "cleared_by": "nothing",
+        "detail": "owner_name_missing",
+        "statement": "The request is blocked (owner_name_missing).",
+        "sentence": "The request is blocked.",
+        "cure": "The depositor fixes what blocked it and requests publication again.",
+        "command": null,
+        "line": "The request is blocked (owner_name_missing). The depositor fixes what blocked it and requests publication again."
+      },
+      {
+        "code": "review_not_started",
+        "class": "unknown",
+        "cleared_by": "override",
+        "detail": null,
+        "statement": "No review of the screened commit has started.",
+        "sentence": "No review of the screened commit has started.",
+        "cure": "A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "No review of the screened commit has started. A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "description": {
+      "headline": "Publication review: FAIL",
+      "tone": "stop",
+      "lines": [
+        "The request is blocked (owner_name_missing). The depositor fixes what blocked it and requests publication again.",
+        "No review of the screened commit has started. A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override (--force).",
+        "This approval has started publishing; it passed the gates when it started and is continued without them.",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": null,
+      "next": "nemar admin publish approve nm000723 --resume"
+    },
+    "review": null,
+    "history": [],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-blocked.json b/test/fixtures/publication-review/detail-blocked.json
new file mode 100644
index 0000000..990750d
--- /dev/null
+++ b/test/fixtures/publication-review/detail-blocked.json
@@ -0,0 +1,76 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "request blocked with block_reason min_requirements_failed, no steps done, no review row",
+    "request": "GET /admin/publish/nm000722/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000722",
+    "request_id": 1,
+    "request_status": "blocked",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "clean",
+      "headline": "Identifier screen: clean",
+      "tone": "ok",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": "min_requirements_failed",
+    "started_publishing": false,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "fail",
+    "start_offered": false,
+    "screen_gate": "clear",
+    "reasons": [
+      {
+        "code": "request_blocked",
+        "class": "fail",
+        "cleared_by": "nothing",
+        "detail": "min_requirements_failed",
+        "statement": "The request is blocked (min_requirements_failed).",
+        "sentence": "The request is blocked.",
+        "cure": "The depositor fixes what blocked it and requests publication again.",
+        "command": null,
+        "line": "The request is blocked (min_requirements_failed). The depositor fixes what blocked it and requests publication again."
+      },
+      {
+        "code": "review_not_started",
+        "class": "unknown",
+        "cleared_by": "override",
+        "detail": null,
+        "statement": "No review of the screened commit has started.",
+        "sentence": "No review of the screened commit has started.",
+        "cure": "A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "No review of the screened commit has started. A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "description": {
+      "headline": "Publication review: FAIL",
+      "tone": "stop",
+      "lines": [
+        "The request is blocked (min_requirements_failed). The depositor fixes what blocked it and requests publication again.",
+        "No review of the screened commit has started. A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override (--force).",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": null,
+      "next": null
+    },
+    "review": null,
+    "history": [],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-hard-not-run.json b/test/fixtures/publication-review/detail-hard-not-run.json
new file mode 100644
index 0000000..af24c5a
--- /dev/null
+++ b/test/fixtures/publication-review/detail-hard-not-run.json
@@ -0,0 +1,72 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen status clean with identifier_screen_report set to NULL (the screen did not run), no review row, review on",
+    "request": "GET /admin/publish/nm000716/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000716",
+    "request_id": 1,
+    "request_status": "requested",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "clean",
+      "headline": "Identifier screen: clean",
+      "tone": "ok",
+      "lines": []
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": false,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "action_required",
+    "start_offered": false,
+    "screen_gate": "clear",
+    "reasons": [
+      {
+        "code": "identifier_screen_not_run",
+        "class": "unknown",
+        "cleared_by": "nothing",
+        "detail": null,
+        "statement": "The identifier screen has no verdict about the current commit.",
+        "sentence": "The identifier screen has no verdict about the current commit.",
+        "cure": "An administrator runs the screen again.",
+        "command": "nemar admin publish screen nm000716",
+        "line": "The identifier screen has no verdict about the current commit. An administrator runs the screen again: nemar admin publish screen nm000716."
+      },
+      {
+        "code": "review_not_started",
+        "class": "unknown",
+        "cleared_by": "override",
+        "detail": null,
+        "statement": "No review of the screened commit has started.",
+        "sentence": "No review of the screened commit has started.",
+        "cure": "Start it. An administrator may approve over it; the approval records the override.",
+        "command": "nemar admin publish start nm000716",
+        "line": "No review of the screened commit has started. Start it: nemar admin publish start nm000716. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "description": {
+      "headline": "Publication review: action required",
+      "tone": "warn",
+      "lines": [
+        "The identifier screen has no verdict about the current commit. An administrator runs the screen again: nemar admin publish screen nm000716.",
+        "No review of the screened commit has started. Start it: nemar admin publish start nm000716. An administrator may approve over it; the approval records the override (--force).",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": null,
+      "next": "nemar admin publish screen nm000716"
+    },
+    "review": null,
+    "history": [],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-hard-reason.json b/test/fixtures/publication-review/detail-hard-reason.json
new file mode 100644
index 0000000..7e49085
--- /dev/null
+++ b/test/fixtures/publication-review/detail-hard-reason.json
@@ -0,0 +1,64 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen status direct-identifiers, no review row, review on",
+    "request": "GET /admin/publish/nm000715/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000715",
+    "request_id": 1,
+    "request_status": "requested",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "direct-identifiers",
+      "headline": "Identifier screen: FOUND IDENTIFIERS",
+      "tone": "stop",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": false,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "fail",
+    "start_offered": false,
+    "screen_gate": "blocks",
+    "reasons": [
+      {
+        "code": "identifier_screen_blocks",
+        "class": "fail",
+        "cleared_by": "nothing",
+        "detail": null,
+        "statement": "The identifier screen found a direct identifier.",
+        "sentence": "The identifier screen found a direct identifier.",
+        "cure": "The depositor removes it and requests publication again, which runs the screen again.",
+        "command": null,
+        "line": "The identifier screen found a direct identifier. The depositor removes it and requests publication again, which runs the screen again."
+      }
+    ],
+    "description": {
+      "headline": "Publication review: FAIL",
+      "tone": "stop",
+      "lines": [
+        "The identifier screen found a direct identifier. The depositor removes it and requests publication again, which runs the screen again.",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": null,
+      "next": null
+    },
+    "review": null,
+    "history": [],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-needs-ack-and-override.json b/test/fixtures/publication-review/detail-needs-ack-and-override.json
new file mode 100644
index 0000000..9ba3ee9
--- /dev/null
+++ b/test/fixtures/publication-review/detail-needs-ack-and-override.json
@@ -0,0 +1,159 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "review on, screen status review, review reported with failingReport",
+    "request": "GET /admin/publish/nm000719/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000719",
+    "request_id": 1,
+    "request_status": "requested",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "review",
+      "headline": "Identifier screen: needs review",
+      "tone": "warn",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": false,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "fail",
+    "start_offered": false,
+    "screen_gate": "acknowledge",
+    "reasons": [
+      {
+        "code": "identifier_screen_needs_acknowledgment",
+        "class": "unknown",
+        "cleared_by": "screen_acknowledgment",
+        "detail": null,
+        "statement": "The identifier screen found something a person must look at, or could not read everything.",
+        "sentence": "The identifier screen found something a person must look at, or could not read everything.",
+        "cure": "An administrator reads what the screen reported and approves with a recorded reason.",
+        "command": "nemar admin publish approve nm000719 --acknowledge-identifier-screen \"<reason>\"",
+        "line": "The identifier screen found something a person must look at, or could not read everything. An administrator reads what the screen reported and approves with a recorded reason: nemar admin publish approve nm000719 --acknowledge-identifier-screen \"<reason>\"."
+      },
+      {
+        "code": "question_failed",
+        "class": "fail",
+        "cleared_by": "override",
+        "detail": "complete_and_honest",
+        "statement": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset).",
+        "sentence": "A question of the review failed.",
+        "cure": "Read any findings and the dataset's text. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset). Read any findings and the dataset's text. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "description": {
+      "headline": "Publication review: FAIL",
+      "tone": "stop",
+      "lines": [
+        "The identifier screen found something a person must look at, or could not read everything. An administrator reads what the screen reported and approves with a recorded reason: nemar admin publish approve nm000719 --acknowledge-identifier-screen \"<reason>\".",
+        "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset). Read any findings and the dataset's text. An administrator may approve over it; the approval records the override (--force).",
+        "Reviewed by claude-haiku-5-5, at commit 0123456789ab, version 1.0.0.",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": "SUMMARY-SENTINEL-the-model-wrote-this",
+      "next": "nemar admin publish approve nm000719 --acknowledge-identifier-screen \"<reason>\" --force"
+    },
+    "review": {
+      "id": 1,
+      "head_sha": "0123456789abcdef0123456789abcdef01234567",
+      "anonymous": false,
+      "state": "reported",
+      "detail": null,
+      "stored_verdict": "fail",
+      "model": "claude-haiku-5-5",
+      "version": "1.0.0",
+      "created_at": "2026-10-15 17:14:54",
+      "decided_at": "2026-10-15 17:14:54",
+      "started_by": null,
+      "override": null,
+      "questions": {
+        "complete_and_honest": "fail",
+        "meets_standards": "pass",
+        "authors_and_license": "pass",
+        "name_adequate": "pass"
+      },
+      "fact_notes": [],
+      "findings": [
+        {
+          "question": "complete_and_honest",
+          "severity": "blocker",
+          "code": "readme_mismatch",
+          "label": "README does not match the dataset",
+          "document": "readme",
+          "document_label": "README",
+          "note": "NOTE-SENTINEL-the-model-wrote-this-too"
+        }
+      ],
+      "summary": "SUMMARY-SENTINEL-the-model-wrote-this",
+      "evidence": {
+        "head": "0123456789abcdef0123456789abcdef01234567",
+        "anonymous": false,
+        "version": "1.0.0",
+        "version_shape": "ok",
+        "tag": "absent",
+        "bids": "pass",
+        "minimums": "met",
+        "minimum_failures": [],
+        "name_length": 48,
+        "license_field": true,
+        "authors_count": 2,
+        "placeholder_authors": 0,
+        "documents": {
+          "readme": "sent",
+          "dataset_description": "sent",
+          "changes": "sent",
+          "license": "sent",
+          "participants_json": "absent"
+        },
+        "withheld_findings": {},
+        "description_keys_shown": 9,
+        "description_keys_not_shown": 1,
+        "summary": {
+          "subjects": 4,
+          "sessions": 0,
+          "recordings": 4,
+          "datatypes": ["eeg"],
+          "formats": {
+            ".edf": 4
+          },
+          "has_derivatives": false,
+          "has_sourcedata": false,
+          "has_code": false,
+          "sampling_rates_hz": [256],
+          "channel_counts": [32],
+          "sidecars_read": 4,
+          "sidecars_total": 4
+        }
+      }
+    },
+    "history": [
+      {
+        "id": 1,
+        "head_sha": "0123456789abcdef0123456789abcdef01234567",
+        "anonymous": false,
+        "state": "reported",
+        "stored_verdict": "fail",
+        "created_at": "2026-10-15 17:14:54",
+        "decided_at": "2026-10-15 17:14:54"
+      }
+    ],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-needs-override-two.json b/test/fixtures/publication-review/detail-needs-override-two.json
new file mode 100644
index 0000000..2237972
--- /dev/null
+++ b/test/fixtures/publication-review/detail-needs-override-two.json
@@ -0,0 +1,159 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review reported with failingReport plus steering: true; the two override-class codes are question_failed and steering_attempt; review on",
+    "request": "GET /admin/publish/nm000714/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000714",
+    "request_id": 1,
+    "request_status": "requested",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "clean",
+      "headline": "Identifier screen: clean",
+      "tone": "ok",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": false,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "fail",
+    "start_offered": false,
+    "screen_gate": "clear",
+    "reasons": [
+      {
+        "code": "question_failed",
+        "class": "fail",
+        "cleared_by": "override",
+        "detail": "complete_and_honest",
+        "statement": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset).",
+        "sentence": "A question of the review failed.",
+        "cure": "Read any findings and the dataset's text. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset). Read any findings and the dataset's text. An administrator may approve over it; the approval records the override (--force)."
+      },
+      {
+        "code": "steering_attempt",
+        "class": "fail",
+        "cleared_by": "override",
+        "detail": null,
+        "statement": "Text in the dataset tried to instruct the reviewer.",
+        "sentence": "Text in the dataset tried to instruct the reviewer.",
+        "cure": "Read the dataset's text yourself; the review's answers cannot be relied on. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "Text in the dataset tried to instruct the reviewer. Read the dataset's text yourself; the review's answers cannot be relied on. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "description": {
+      "headline": "Publication review: FAIL",
+      "tone": "stop",
+      "lines": [
+        "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset). Read any findings and the dataset's text. An administrator may approve over it; the approval records the override (--force).",
+        "Text in the dataset tried to instruct the reviewer. Read the dataset's text yourself; the review's answers cannot be relied on. An administrator may approve over it; the approval records the override (--force).",
+        "Reviewed by claude-haiku-5-5, at commit 0123456789ab, version 1.0.0.",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": "SUMMARY-SENTINEL-the-model-wrote-this",
+      "next": "nemar admin publish approve nm000714 --force"
+    },
+    "review": {
+      "id": 1,
+      "head_sha": "0123456789abcdef0123456789abcdef01234567",
+      "anonymous": false,
+      "state": "reported",
+      "detail": null,
+      "stored_verdict": "fail",
+      "model": "claude-haiku-5-5",
+      "version": "1.0.0",
+      "created_at": "2026-10-15 17:14:54",
+      "decided_at": "2026-10-15 17:14:54",
+      "started_by": null,
+      "override": null,
+      "questions": {
+        "complete_and_honest": "fail",
+        "meets_standards": "pass",
+        "authors_and_license": "pass",
+        "name_adequate": "pass"
+      },
+      "fact_notes": [],
+      "findings": [
+        {
+          "question": "complete_and_honest",
+          "severity": "blocker",
+          "code": "readme_mismatch",
+          "label": "README does not match the dataset",
+          "document": "readme",
+          "document_label": "README",
+          "note": "NOTE-SENTINEL-the-model-wrote-this-too"
+        }
+      ],
+      "summary": "SUMMARY-SENTINEL-the-model-wrote-this",
+      "evidence": {
+        "head": "0123456789abcdef0123456789abcdef01234567",
+        "anonymous": false,
+        "version": "1.0.0",
+        "version_shape": "ok",
+        "tag": "absent",
+        "bids": "pass",
+        "minimums": "met",
+        "minimum_failures": [],
+        "name_length": 48,
+        "license_field": true,
+        "authors_count": 2,
+        "placeholder_authors": 0,
+        "documents": {
+          "readme": "sent",
+          "dataset_description": "sent",
+          "changes": "sent",
+          "license": "sent",
+          "participants_json": "absent"
+        },
+        "withheld_findings": {},
+        "description_keys_shown": 9,
+        "description_keys_not_shown": 1,
+        "summary": {
+          "subjects": 4,
+          "sessions": 0,
+          "recordings": 4,
+          "datatypes": ["eeg"],
+          "formats": {
+            ".edf": 4
+          },
+          "has_derivatives": false,
+          "has_sourcedata": false,
+          "has_code": false,
+          "sampling_rates_hz": [256],
+          "channel_counts": [32],
+          "sidecars_read": 4,
+          "sidecars_total": 4
+        }
+      }
+    },
+    "history": [
+      {
+        "id": 1,
+        "head_sha": "0123456789abcdef0123456789abcdef01234567",
+        "anonymous": false,
+        "state": "reported",
+        "stored_verdict": "fail",
+        "created_at": "2026-10-15 17:14:54",
+        "decided_at": "2026-10-15 17:14:54"
+      }
+    ],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-needs-override.json b/test/fixtures/publication-review/detail-needs-override.json
new file mode 100644
index 0000000..935b204
--- /dev/null
+++ b/test/fixtures/publication-review/detail-needs-override.json
@@ -0,0 +1,147 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review reported with failingReport (one failed question, one blocker finding), review on",
+    "request": "GET /admin/publish/nm000713/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000713",
+    "request_id": 1,
+    "request_status": "requested",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "clean",
+      "headline": "Identifier screen: clean",
+      "tone": "ok",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": false,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "fail",
+    "start_offered": false,
+    "screen_gate": "clear",
+    "reasons": [
+      {
+        "code": "question_failed",
+        "class": "fail",
+        "cleared_by": "override",
+        "detail": "complete_and_honest",
+        "statement": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset).",
+        "sentence": "A question of the review failed.",
+        "cure": "Read any findings and the dataset's text. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset). Read any findings and the dataset's text. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "description": {
+      "headline": "Publication review: FAIL",
+      "tone": "stop",
+      "lines": [
+        "A question of the review failed (the README is complete and agrees with the dataset; findings: README does not match the dataset). Read any findings and the dataset's text. An administrator may approve over it; the approval records the override (--force).",
+        "Reviewed by claude-haiku-5-5, at commit 0123456789ab, version 1.0.0.",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": "SUMMARY-SENTINEL-the-model-wrote-this",
+      "next": "nemar admin publish approve nm000713 --force"
+    },
+    "review": {
+      "id": 1,
+      "head_sha": "0123456789abcdef0123456789abcdef01234567",
+      "anonymous": false,
+      "state": "reported",
+      "detail": null,
+      "stored_verdict": "fail",
+      "model": "claude-haiku-5-5",
+      "version": "1.0.0",
+      "created_at": "2026-10-15 17:14:54",
+      "decided_at": "2026-10-15 17:14:54",
+      "started_by": null,
+      "override": null,
+      "questions": {
+        "complete_and_honest": "fail",
+        "meets_standards": "pass",
+        "authors_and_license": "pass",
+        "name_adequate": "pass"
+      },
+      "fact_notes": [],
+      "findings": [
+        {
+          "question": "complete_and_honest",
+          "severity": "blocker",
+          "code": "readme_mismatch",
+          "label": "README does not match the dataset",
+          "document": "readme",
+          "document_label": "README",
+          "note": "NOTE-SENTINEL-the-model-wrote-this-too"
+        }
+      ],
+      "summary": "SUMMARY-SENTINEL-the-model-wrote-this",
+      "evidence": {
+        "head": "0123456789abcdef0123456789abcdef01234567",
+        "anonymous": false,
+        "version": "1.0.0",
+        "version_shape": "ok",
+        "tag": "absent",
+        "bids": "pass",
+        "minimums": "met",
+        "minimum_failures": [],
+        "name_length": 48,
+        "license_field": true,
+        "authors_count": 2,
+        "placeholder_authors": 0,
+        "documents": {
+          "readme": "sent",
+          "dataset_description": "sent",
+          "changes": "sent",
+          "license": "sent",
+          "participants_json": "absent"
+        },
+        "withheld_findings": {},
+        "description_keys_shown": 9,
+        "description_keys_not_shown": 1,
+        "summary": {
+          "subjects": 4,
+          "sessions": 0,
+          "recordings": 4,
+          "datatypes": ["eeg"],
+          "formats": {
+            ".edf": 4
+          },
+          "has_derivatives": false,
+          "has_sourcedata": false,
+          "has_code": false,
+          "sampling_rates_hz": [256],
+          "channel_counts": [32],
+          "sidecars_read": 4,
+          "sidecars_total": 4
+        }
+      }
+    },
+    "history": [
+      {
+        "id": 1,
+        "head_sha": "0123456789abcdef0123456789abcdef01234567",
+        "anonymous": false,
+        "state": "reported",
+        "stored_verdict": "fail",
+        "created_at": "2026-10-15 17:14:54",
+        "decided_at": "2026-10-15 17:14:54"
+      }
+    ],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-not-applicable.json b/test/fixtures/publication-review/detail-not-applicable.json
new file mode 100644
index 0000000..bc1802c
--- /dev/null
+++ b/test/fixtures/publication-review/detail-not-applicable.json
@@ -0,0 +1,52 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "dataset source openneuro (a mirror), review on",
+    "request": "GET /admin/publish/nm000725/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000725",
+    "request_id": 1,
+    "request_status": "requested",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "clean",
+      "headline": "Identifier screen: clean",
+      "tone": "ok",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": false,
+    "total_files": null,
+    "applies": false,
+    "gate": "n/a",
+    "outcome": null,
+    "start_offered": false,
+    "screen_gate": "clear",
+    "reasons": [],
+    "description": {
+      "headline": "Publication review: not applicable",
+      "tone": "note",
+      "lines": [
+        "OpenNeuro mirrors and exemplars passed an upstream review, so the automated review does not apply.",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": null,
+      "next": null
+    },
+    "review": null,
+    "history": [],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-not-found.json b/test/fixtures/publication-review/detail-not-found.json
new file mode 100644
index 0000000..e201ce0
--- /dev/null
+++ b/test/fixtures/publication-review/detail-not-found.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "the dataset's only request is published, so no active request",
+    "request": "GET /admin/publish/nm000726/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 404,
+  "body": {
+    "error": "nm000726 has no active publication request.",
+    "code": "not_found"
+  }
+}
diff --git a/test/fixtures/publication-review/detail-not-started-startable.json b/test/fixtures/publication-review/detail-not-started-startable.json
new file mode 100644
index 0000000..fdc9ec2
--- /dev/null
+++ b/test/fixtures/publication-review/detail-not-started-startable.json
@@ -0,0 +1,64 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "review on, screen clean, request requested, no review row",
+    "request": "GET /admin/publish/nm000720/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000720",
+    "request_id": 1,
+    "request_status": "requested",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "clean",
+      "headline": "Identifier screen: clean",
+      "tone": "ok",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": false,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "action_required",
+    "start_offered": true,
+    "screen_gate": "clear",
+    "reasons": [
+      {
+        "code": "review_not_started",
+        "class": "unknown",
+        "cleared_by": "override",
+        "detail": null,
+        "statement": "No review of the screened commit has started.",
+        "sentence": "No review of the screened commit has started.",
+        "cure": "Start it. An administrator may approve over it; the approval records the override.",
+        "command": "nemar admin publish start nm000720",
+        "line": "No review of the screened commit has started. Start it: nemar admin publish start nm000720. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "description": {
+      "headline": "Publication review: action required",
+      "tone": "warn",
+      "lines": [
+        "No review of the screened commit has started. Start it: nemar admin publish start nm000720. An administrator may approve over it; the approval records the override (--force).",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": null,
+      "next": "nemar admin publish start nm000720"
+    },
+    "review": null,
+    "history": [],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-off-acknowledge.json b/test/fixtures/publication-review/detail-off-acknowledge.json
new file mode 100644
index 0000000..4b69f2e
--- /dev/null
+++ b/test/fixtures/publication-review/detail-off-acknowledge.json
@@ -0,0 +1,52 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "review off (PUBLICATION_REVIEW_ENABLED unset), no review row, screen status review",
+    "request": "GET /admin/publish/nm000718/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": false,
+    "dataset_id": "nm000718",
+    "request_id": 1,
+    "request_status": "requested",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "review",
+      "headline": "Identifier screen: needs review",
+      "tone": "warn",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": false,
+    "total_files": null,
+    "applies": true,
+    "gate": "off",
+    "outcome": null,
+    "start_offered": false,
+    "screen_gate": "acknowledge",
+    "reasons": [],
+    "description": {
+      "headline": "Publication review: not reviewed (the automated review is off)",
+      "tone": "note",
+      "lines": [
+        "The automated review is off, so this request was not reviewed and no review gates its approval.",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": null,
+      "next": null
+    },
+    "review": null,
+    "history": [],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-pass.json b/test/fixtures/publication-review/detail-pass.json
new file mode 100644
index 0000000..bce9ee6
--- /dev/null
+++ b/test/fixtures/publication-review/detail-pass.json
@@ -0,0 +1,124 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, review reported with goodPublicationReport, review on",
+    "request": "GET /admin/publish/nm000712/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000712",
+    "request_id": 1,
+    "request_status": "requested",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "clean",
+      "headline": "Identifier screen: clean",
+      "tone": "ok",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": false,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "pass",
+    "start_offered": false,
+    "screen_gate": "clear",
+    "reasons": [],
+    "description": {
+      "headline": "Publication review: pass",
+      "tone": "ok",
+      "lines": [
+        "Reviewed by claude-haiku-5-5, at commit 0123456789ab, version 1.0.0.",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": "The README describes the recordings, how they were made and how to use them.",
+      "next": "nemar admin publish approve nm000712"
+    },
+    "review": {
+      "id": 1,
+      "head_sha": "0123456789abcdef0123456789abcdef01234567",
+      "anonymous": false,
+      "state": "reported",
+      "detail": null,
+      "stored_verdict": "pass",
+      "model": "claude-haiku-5-5",
+      "version": "1.0.0",
+      "created_at": "2026-10-15 17:14:54",
+      "decided_at": "2026-10-15 17:14:54",
+      "started_by": null,
+      "override": null,
+      "questions": {
+        "complete_and_honest": "pass",
+        "meets_standards": "pass",
+        "authors_and_license": "pass",
+        "name_adequate": "pass"
+      },
+      "fact_notes": [],
+      "findings": [],
+      "summary": "The README describes the recordings, how they were made and how to use them.",
+      "evidence": {
+        "head": "0123456789abcdef0123456789abcdef01234567",
+        "anonymous": false,
+        "version": "1.0.0",
+        "version_shape": "ok",
+        "tag": "absent",
+        "bids": "pass",
+        "minimums": "met",
+        "minimum_failures": [],
+        "name_length": 48,
+        "license_field": true,
+        "authors_count": 2,
+        "placeholder_authors": 0,
+        "documents": {
+          "readme": "sent",
+          "dataset_description": "sent",
+          "changes": "sent",
+          "license": "sent",
+          "participants_json": "absent"
+        },
+        "withheld_findings": {},
+        "description_keys_shown": 9,
+        "description_keys_not_shown": 1,
+        "summary": {
+          "subjects": 4,
+          "sessions": 0,
+          "recordings": 4,
+          "datatypes": ["eeg"],
+          "formats": {
+            ".edf": 4
+          },
+          "has_derivatives": false,
+          "has_sourcedata": false,
+          "has_code": false,
+          "sampling_rates_hz": [256],
+          "channel_counts": [32],
+          "sidecars_read": 4,
+          "sidecars_total": 4
+        }
+      }
+    },
+    "history": [
+      {
+        "id": 1,
+        "head_sha": "0123456789abcdef0123456789abcdef01234567",
+        "anonymous": false,
+        "state": "reported",
+        "stored_verdict": "pass",
+        "created_at": "2026-10-15 17:14:54",
+        "decided_at": "2026-10-15 17:14:54"
+      }
+    ],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-screen-rerun.json b/test/fixtures/publication-review/detail-screen-rerun.json
new file mode 100644
index 0000000..566226a
--- /dev/null
+++ b/test/fixtures/publication-review/detail-screen-rerun.json
@@ -0,0 +1,62 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen status unreported (the screen produced no verdict), no review row, review on",
+    "request": "GET /admin/publish/nm000717/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000717",
+    "request_id": 1,
+    "request_status": "requested",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "unreported",
+      "headline": "Identifier screen: DID NOT REPORT",
+      "tone": "stop",
+      "lines": [
+        "Cause: no report arrived from the screen workflow in time (it may never have started)."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": false,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "action_required",
+    "start_offered": false,
+    "screen_gate": "rerun",
+    "reasons": [
+      {
+        "code": "identifier_screen_not_run",
+        "class": "unknown",
+        "cleared_by": "nothing",
+        "detail": null,
+        "statement": "The identifier screen has no verdict about the current commit.",
+        "sentence": "The identifier screen has no verdict about the current commit.",
+        "cure": "An administrator runs the screen again.",
+        "command": "nemar admin publish screen nm000717",
+        "line": "The identifier screen has no verdict about the current commit. An administrator runs the screen again: nemar admin publish screen nm000717."
+      }
+    ],
+    "description": {
+      "headline": "Publication review: action required",
+      "tone": "warn",
+      "lines": [
+        "The identifier screen has no verdict about the current commit. An administrator runs the screen again: nemar admin publish screen nm000717.",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": null,
+      "next": "nemar admin publish screen nm000717"
+    },
+    "review": null,
+    "history": [],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/detail-started-publishing.json b/test/fixtures/publication-review/detail-started-publishing.json
new file mode 100644
index 0000000..fe7b871
--- /dev/null
+++ b/test/fixtures/publication-review/detail-started-publishing.json
@@ -0,0 +1,65 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "request approving with three publishing steps done, no review row",
+    "request": "GET /admin/publish/nm000724/review",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "environment": "production",
+    "enabled": true,
+    "dataset_id": "nm000724",
+    "request_id": 1,
+    "request_status": "approving",
+    "anonymous": false,
+    "identifier_screen": {
+      "state": "clean",
+      "headline": "Identifier screen: clean",
+      "tone": "ok",
+      "lines": [
+        "Files: 10; EDF/BDF headers read: 4 of 4.",
+        "Not read: the contents of sidecars and tables in earlier commits.",
+        "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+      ]
+    },
+    "screen_acknowledgment": null,
+    "block_reason": null,
+    "started_publishing": true,
+    "total_files": null,
+    "applies": true,
+    "gate": "enforced",
+    "outcome": "action_required",
+    "start_offered": false,
+    "screen_gate": "clear",
+    "reasons": [
+      {
+        "code": "review_not_started",
+        "class": "unknown",
+        "cleared_by": "override",
+        "detail": null,
+        "statement": "No review of the screened commit has started.",
+        "sentence": "No review of the screened commit has started.",
+        "cure": "A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override.",
+        "command": null,
+        "line": "No review of the screened commit has started. A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override (--force)."
+      }
+    ],
+    "description": {
+      "headline": "Publication review: action required",
+      "tone": "warn",
+      "lines": [
+        "No review of the screened commit has started. A review starts only for a request that is waiting for its decision. An administrator may approve over it; the approval records the override (--force).",
+        "This approval has started publishing; it passed the gates when it started and is continued without them.",
+        "Not assessed: whether the text names the depositors."
+      ],
+      "summary": null,
+      "next": "nemar admin publish approve nm000724 --resume"
+    },
+    "review": null,
+    "history": [],
+    "history_truncated": false
+  }
+}
diff --git a/test/fixtures/publication-review/list-review-off.json b/test/fixtures/publication-review/list-review-off.json
new file mode 100644
index 0000000..18ae378
--- /dev/null
+++ b/test/fixtures/publication-review/list-review-off.json
@@ -0,0 +1,136 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "review switched off (PUBLICATION_REVIEW_ENABLED unset), two requests with no review row: one with screen status review, one clean",
+    "request": "GET /admin/publish/requests",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "requests": [
+      {
+        "id": 1,
+        "dataset_id": "nm000710",
+        "status": "requested",
+        "requested_at": "2026-10-15 17:14:54",
+        "requested_by": 3,
+        "approved_at": null,
+        "approved_by": null,
+        "denied_at": null,
+        "denied_by": null,
+        "denied_reason": null,
+        "block_reason": null,
+        "steps_completed": [],
+        "current_step": null,
+        "last_error": null,
+        "updated_at": "2026-10-15 17:14:54",
+        "prescreen_status": null,
+        "prescreen_issue_url": null,
+        "prescreen_at": null,
+        "prescreen_reasons": null,
+        "min_requirements_reasons": null,
+        "anonymous": 0,
+        "approval_requested_by": null,
+        "approval_dispatched_at": null,
+        "identifier_screen_status": "review",
+        "identifier_screen_dispatched_at": null,
+        "identifier_screen_at": "2026-10-15 17:14:54",
+        "identifier_screen_emailed_at": "2026-10-15 17:14:54",
+        "identifier_screen_mail_claimed_at": null,
+        "identifier_screen_ack_by": null,
+        "identifier_screen_ack_reason": null,
+        "identifier_screen_ack_at": null,
+        "withdrawn_at": null,
+        "requested_by_username": "depositor_nm000710",
+        "requested_by_email": "depositor_nm000710@example.org",
+        "dataset_name": "A sufficiently descriptive title for nm000710",
+        "approval_in_flight": false,
+        "identifier_screen": {
+          "state": "review",
+          "headline": "Identifier screen: needs review",
+          "tone": "warn",
+          "lines": [
+            "Files: 10; EDF/BDF headers read: 4 of 4.",
+            "Not read: the contents of sidecars and tables in earlier commits.",
+            "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+          ]
+        },
+        "publication_review": {
+          "kind": "off",
+          "enabled": false,
+          "gate": "off",
+          "outcome": null,
+          "headline": "Publication review: not reviewed (the automated review is off)",
+          "tone": "note",
+          "reasons": [],
+          "start_offered": false,
+          "review_id": null,
+          "head_sha": null
+        }
+      },
+      {
+        "id": 2,
+        "dataset_id": "nm000711",
+        "status": "requested",
+        "requested_at": "2026-10-15 17:14:54",
+        "requested_by": 4,
+        "approved_at": null,
+        "approved_by": null,
+        "denied_at": null,
+        "denied_by": null,
+        "denied_reason": null,
+        "block_reason": null,
+        "steps_completed": [],
+        "current_step": null,
+        "last_error": null,
+        "updated_at": "2026-10-15 17:14:54",
+        "prescreen_status": null,
+        "prescreen_issue_url": null,
+        "prescreen_at": null,
+        "prescreen_reasons": null,
+        "min_requirements_reasons": null,
+        "anonymous": 0,
+        "approval_requested_by": null,
+        "approval_dispatched_at": null,
+        "identifier_screen_status": "clean",
+        "identifier_screen_dispatched_at": null,
+        "identifier_screen_at": "2026-10-15 17:14:54",
+        "identifier_screen_emailed_at": "2026-10-15 17:14:54",
+        "identifier_screen_mail_claimed_at": null,
+        "identifier_screen_ack_by": null,
+        "identifier_screen_ack_reason": null,
+        "identifier_screen_ack_at": null,
+        "withdrawn_at": null,
+        "requested_by_username": "depositor_nm000711",
+        "requested_by_email": "depositor_nm000711@example.org",
+        "dataset_name": "A sufficiently descriptive title for nm000711",
+        "approval_in_flight": false,
+        "identifier_screen": {
+          "state": "clean",
+          "headline": "Identifier screen: clean",
+          "tone": "ok",
+          "lines": [
+            "Files: 10; EDF/BDF headers read: 4 of 4.",
+            "Not read: the contents of sidecars and tables in earlier commits.",
+            "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+          ]
+        },
+        "publication_review": {
+          "kind": "off",
+          "enabled": false,
+          "gate": "off",
+          "outcome": null,
+          "headline": "Publication review: not reviewed (the automated review is off)",
+          "tone": "note",
+          "reasons": [],
+          "start_offered": false,
+          "review_id": null,
+          "head_sha": null
+        }
+      }
+    ],
+    "count": 2
+  }
+}
diff --git a/test/fixtures/publication-review/list.json b/test/fixtures/publication-review/list.json
new file mode 100644
index 0000000..e23c82a
--- /dev/null
+++ b/test/fixtures/publication-review/list.json
@@ -0,0 +1,556 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "nine requests on one database: a passing review, an override-class failing review, direct identifiers found, review not started and startable, blocked (min_requirements_failed), approving with publishing steps done, an exemplar, published, and an OpenNeuro mirror",
+    "request": "GET /admin/publish/requests",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 200,
+  "body": {
+    "requests": [
+      {
+        "id": 1,
+        "dataset_id": "nm000701",
+        "status": "requested",
+        "requested_at": "2026-10-15 17:14:54",
+        "requested_by": 3,
+        "approved_at": null,
+        "approved_by": null,
+        "denied_at": null,
+        "denied_by": null,
+        "denied_reason": null,
+        "block_reason": null,
+        "steps_completed": [],
+        "current_step": null,
+        "last_error": null,
+        "updated_at": "2026-10-15 17:14:54",
+        "prescreen_status": null,
+        "prescreen_issue_url": null,
+        "prescreen_at": null,
+        "prescreen_reasons": null,
+        "min_requirements_reasons": null,
+        "anonymous": 0,
+        "approval_requested_by": null,
+        "approval_dispatched_at": null,
+        "identifier_screen_status": "clean",
+        "identifier_screen_dispatched_at": null,
+        "identifier_screen_at": "2026-10-15 17:14:54",
+        "identifier_screen_emailed_at": "2026-10-15 17:14:54",
+        "identifier_screen_mail_claimed_at": null,
+        "identifier_screen_ack_by": null,
+        "identifier_screen_ack_reason": null,
+        "identifier_screen_ack_at": null,
+        "withdrawn_at": null,
+        "requested_by_username": "depositor_nm000701",
+        "requested_by_email": "depositor_nm000701@example.org",
+        "dataset_name": "A sufficiently descriptive title for nm000701",
+        "approval_in_flight": false,
+        "identifier_screen": {
+          "state": "clean",
+          "headline": "Identifier screen: clean",
+          "tone": "ok",
+          "lines": [
+            "Files: 10; EDF/BDF headers read: 4 of 4.",
+            "Not read: the contents of sidecars and tables in earlier commits.",
+            "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+          ]
+        },
+        "publication_review": {
+          "kind": "decided",
+          "enabled": true,
+          "gate": "enforced",
+          "outcome": "pass",
+          "headline": "Publication review: pass",
+          "tone": "ok",
+          "reasons": [],
+          "start_offered": false,
+          "review_id": 1,
+          "head_sha": "0123456789abcdef0123456789abcdef01234567"
+        }
+      },
+      {
+        "id": 2,
+        "dataset_id": "nm000702",
+        "status": "requested",
+        "requested_at": "2026-10-15 17:14:54",
+        "requested_by": 4,
+        "approved_at": null,
+        "approved_by": null,
+        "denied_at": null,
+        "denied_by": null,
+        "denied_reason": null,
+        "block_reason": null,
+        "steps_completed": [],
+        "current_step": null,
+        "last_error": null,
+        "updated_at": "2026-10-15 17:14:54",
+        "prescreen_status": null,
+        "prescreen_issue_url": null,
+        "prescreen_at": null,
+        "prescreen_reasons": null,
+        "min_requirements_reasons": null,
+        "anonymous": 0,
+        "approval_requested_by": null,
+        "approval_dispatched_at": null,
+        "identifier_screen_status": "clean",
+        "identifier_screen_dispatched_at": null,
+        "identifier_screen_at": "2026-10-15 17:14:54",
+        "identifier_screen_emailed_at": "2026-10-15 17:14:54",
+        "identifier_screen_mail_claimed_at": null,
+        "identifier_screen_ack_by": null,
+        "identifier_screen_ack_reason": null,
+        "identifier_screen_ack_at": null,
+        "withdrawn_at": null,
+        "requested_by_username": "depositor_nm000702",
+        "requested_by_email": "depositor_nm000702@example.org",
+        "dataset_name": "A sufficiently descriptive title for nm000702",
+        "approval_in_flight": false,
+        "identifier_screen": {
+          "state": "clean",
+          "headline": "Identifier screen: clean",
+          "tone": "ok",
+          "lines": [
+            "Files: 10; EDF/BDF headers read: 4 of 4.",
+            "Not read: the contents of sidecars and tables in earlier commits.",
+            "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+          ]
+        },
+        "publication_review": {
+          "kind": "decided",
+          "enabled": true,
+          "gate": "enforced",
+          "outcome": "fail",
+          "headline": "Publication review: FAIL",
+          "tone": "stop",
+          "reasons": ["question_failed"],
+          "start_offered": false,
+          "review_id": 2,
+          "head_sha": "0123456789abcdef0123456789abcdef01234567"
+        }
+      },
+      {
+        "id": 3,
+        "dataset_id": "nm000703",
+        "status": "requested",
+        "requested_at": "2026-10-15 17:14:54",
+        "requested_by": 5,
+        "approved_at": null,
+        "approved_by": null,
+        "denied_at": null,
+        "denied_by": null,
+        "denied_reason": null,
+        "block_reason": null,
+        "steps_completed": [],
+        "current_step": null,
+        "last_error": null,
+        "updated_at": "2026-10-15 17:14:54",
+        "prescreen_status": null,
+        "prescreen_issue_url": null,
+        "prescreen_at": null,
+        "prescreen_reasons": null,
+        "min_requirements_reasons": null,
+        "anonymous": 0,
+        "approval_requested_by": null,
+        "approval_dispatched_at": null,
+        "identifier_screen_status": "direct-identifiers",
+        "identifier_screen_dispatched_at": null,
+        "identifier_screen_at": "2026-10-15 17:14:54",
+        "identifier_screen_emailed_at": "2026-10-15 17:14:54",
+        "identifier_screen_mail_claimed_at": null,
+        "identifier_screen_ack_by": null,
+        "identifier_screen_ack_reason": null,
+        "identifier_screen_ack_at": null,
+        "withdrawn_at": null,
+        "requested_by_username": "depositor_nm000703",
+        "requested_by_email": "depositor_nm000703@example.org",
+        "dataset_name": "A sufficiently descriptive title for nm000703",
+        "approval_in_flight": false,
+        "identifier_screen": {
+          "state": "direct-identifiers",
+          "headline": "Identifier screen: FOUND IDENTIFIERS",
+          "tone": "stop",
+          "lines": [
+            "Files: 10; EDF/BDF headers read: 4 of 4.",
+            "Not read: the contents of sidecars and tables in earlier commits.",
+            "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+          ]
+        },
+        "publication_review": {
+          "kind": "not_reviewed",
+          "enabled": true,
+          "gate": "enforced",
+          "outcome": "fail",
+          "headline": "Publication review: FAIL",
+          "tone": "stop",
+          "reasons": ["identifier_screen_blocks"],
+          "start_offered": false,
+          "review_id": null,
+          "head_sha": null
+        }
+      },
+      {
+        "id": 4,
+        "dataset_id": "nm000704",
+        "status": "requested",
+        "requested_at": "2026-10-15 17:14:54",
+        "requested_by": 6,
+        "approved_at": null,
+        "approved_by": null,
+        "denied_at": null,
+        "denied_by": null,
+        "denied_reason": null,
+        "block_reason": null,
+        "steps_completed": [],
+        "current_step": null,
+        "last_error": null,
+        "updated_at": "2026-10-15 17:14:54",
+        "prescreen_status": null,
+        "prescreen_issue_url": null,
+        "prescreen_at": null,
+        "prescreen_reasons": null,
+        "min_requirements_reasons": null,
+        "anonymous": 0,
+        "approval_requested_by": null,
+        "approval_dispatched_at": null,
+        "identifier_screen_status": "clean",
+        "identifier_screen_dispatched_at": null,
+        "identifier_screen_at": "2026-10-15 17:14:54",
+        "identifier_screen_emailed_at": "2026-10-15 17:14:54",
+        "identifier_screen_mail_claimed_at": null,
+        "identifier_screen_ack_by": null,
+        "identifier_screen_ack_reason": null,
+        "identifier_screen_ack_at": null,
+        "withdrawn_at": null,
+        "requested_by_username": "depositor_nm000704",
+        "requested_by_email": "depositor_nm000704@example.org",
+        "dataset_name": "A sufficiently descriptive title for nm000704",
+        "approval_in_flight": false,
+        "identifier_screen": {
+          "state": "clean",
+          "headline": "Identifier screen: clean",
+          "tone": "ok",
+          "lines": [
+            "Files: 10; EDF/BDF headers read: 4 of 4.",
+            "Not read: the contents of sidecars and tables in earlier commits.",
+            "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+          ]
+        },
+        "publication_review": {
+          "kind": "not_reviewed",
+          "enabled": true,
+          "gate": "enforced",
+          "outcome": "action_required",
+          "headline": "Publication review: action required",
+          "tone": "warn",
+          "reasons": ["review_not_started"],
+          "start_offered": true,
+          "review_id": null,
+          "head_sha": null
+        }
+      },
+      {
+        "id": 5,
+        "dataset_id": "nm000705",
+        "status": "blocked",
+        "requested_at": "2026-10-15 17:14:54",
+        "requested_by": 7,
+        "approved_at": null,
+        "approved_by": null,
+        "denied_at": null,
+        "denied_by": null,
+        "denied_reason": null,
+        "block_reason": "min_requirements_failed",
+        "steps_completed": [],
+        "current_step": null,
+        "last_error": null,
+        "updated_at": "2026-10-15 17:14:54",
+        "prescreen_status": null,
+        "prescreen_issue_url": null,
+        "prescreen_at": null,
+        "prescreen_reasons": null,
+        "min_requirements_reasons": null,
+        "anonymous": 0,
+        "approval_requested_by": null,
+        "approval_dispatched_at": null,
+        "identifier_screen_status": "clean",
+        "identifier_screen_dispatched_at": null,
+        "identifier_screen_at": "2026-10-15 17:14:54",
+        "identifier_screen_emailed_at": "2026-10-15 17:14:54",
+        "identifier_screen_mail_claimed_at": null,
+        "identifier_screen_ack_by": null,
+        "identifier_screen_ack_reason": null,
+        "identifier_screen_ack_at": null,
+        "withdrawn_at": null,
+        "requested_by_username": "depositor_nm000705",
+        "requested_by_email": "depositor_nm000705@example.org",
+        "dataset_name": "A sufficiently descriptive title for nm000705",
+        "approval_in_flight": false,
+        "identifier_screen": {
+          "state": "clean",
+          "headline": "Identifier screen: clean",
+          "tone": "ok",
+          "lines": [
+            "Files: 10; EDF/BDF headers read: 4 of 4.",
+            "Not read: the contents of sidecars and tables in earlier commits.",
+            "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+          ]
+        },
+        "publication_review": {
+          "kind": "not_reviewed",
+          "enabled": true,
+          "gate": "enforced",
+          "outcome": "fail",
+          "headline": "Publication review: FAIL",
+          "tone": "stop",
+          "reasons": ["request_blocked", "review_not_started"],
+          "start_offered": false,
+          "review_id": null,
+          "head_sha": null
+        }
+      },
+      {
+        "id": 6,
+        "dataset_id": "nm000706",
+        "status": "approving",
+        "requested_at": "2026-10-15 17:14:54",
+        "requested_by": 8,
+        "approved_at": null,
+        "approved_by": null,
+        "denied_at": null,
+        "denied_by": null,
+        "denied_reason": null,
+        "block_reason": null,
+        "steps_completed": ["ci_check", "enrichment_check", "s3_public_read"],
+        "current_step": null,
+        "last_error": null,
+        "updated_at": "2026-10-15 17:14:54",
+        "prescreen_status": null,
+        "prescreen_issue_url": null,
+        "prescreen_at": null,
+        "prescreen_reasons": null,
+        "min_requirements_reasons": null,
+        "anonymous": 0,
+        "approval_requested_by": null,
+        "approval_dispatched_at": null,
+        "identifier_screen_status": "clean",
+        "identifier_screen_dispatched_at": null,
+        "identifier_screen_at": "2026-10-15 17:14:54",
+        "identifier_screen_emailed_at": "2026-10-15 17:14:54",
+        "identifier_screen_mail_claimed_at": null,
+        "identifier_screen_ack_by": null,
+        "identifier_screen_ack_reason": null,
+        "identifier_screen_ack_at": null,
+        "withdrawn_at": null,
+        "requested_by_username": "depositor_nm000706",
+        "requested_by_email": "depositor_nm000706@example.org",
+        "dataset_name": "A sufficiently descriptive title for nm000706",
+        "approval_in_flight": true,
+        "identifier_screen": {
+          "state": "clean",
+          "headline": "Identifier screen: clean",
+          "tone": "ok",
+          "lines": [
+            "Files: 10; EDF/BDF headers read: 4 of 4.",
+            "Not read: the contents of sidecars and tables in earlier commits.",
+            "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+          ]
+        },
+        "publication_review": {
+          "kind": "not_reviewed",
+          "enabled": true,
+          "gate": "enforced",
+          "outcome": "action_required",
+          "headline": "Publication review: action required",
+          "tone": "warn",
+          "reasons": ["review_not_started"],
+          "start_offered": false,
+          "review_id": null,
+          "head_sha": null
+        }
+      },
+      {
+        "id": 7,
+        "dataset_id": "nm000707",
+        "status": "requested",
+        "requested_at": "2026-10-15 17:14:54",
+        "requested_by": 9,
+        "approved_at": null,
+        "approved_by": null,
+        "denied_at": null,
+        "denied_by": null,
+        "denied_reason": null,
+        "block_reason": null,
+        "steps_completed": [],
+        "current_step": null,
+        "last_error": null,
+        "updated_at": "2026-10-15 17:14:54",
+        "prescreen_status": null,
+        "prescreen_issue_url": null,
+        "prescreen_at": null,
+        "prescreen_reasons": null,
+        "min_requirements_reasons": null,
+        "anonymous": 0,
+        "approval_requested_by": null,
+        "approval_dispatched_at": null,
+        "identifier_screen_status": "clean",
+        "identifier_screen_dispatched_at": null,
+        "identifier_screen_at": "2026-10-15 17:14:54",
+        "identifier_screen_emailed_at": "2026-10-15 17:14:54",
+        "identifier_screen_mail_claimed_at": null,
+        "identifier_screen_ack_by": null,
+        "identifier_screen_ack_reason": null,
+        "identifier_screen_ack_at": null,
+        "withdrawn_at": null,
+        "requested_by_username": "depositor_nm000707",
+        "requested_by_email": "depositor_nm000707@example.org",
+        "dataset_name": "A sufficiently descriptive title for nm000707",
+        "approval_in_flight": false,
+        "identifier_screen": {
+          "state": "clean",
+          "headline": "Identifier screen: clean",
+          "tone": "ok",
+          "lines": [
+            "Files: 10; EDF/BDF headers read: 4 of 4.",
+            "Not read: the contents of sidecars and tables in earlier commits.",
+            "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+          ]
+        },
+        "publication_review": {
+          "kind": "not_applicable",
+          "enabled": true,
+          "gate": "n/a",
+          "outcome": null,
+          "headline": "Publication review: not applicable",
+          "tone": "note",
+          "reasons": [],
+          "start_offered": false,
+          "review_id": null,
+          "head_sha": null
+        }
+      },
+      {
+        "id": 8,
+        "dataset_id": "nm000708",
+        "status": "published",
+        "requested_at": "2026-10-15 17:14:54",
+        "requested_by": 10,
+        "approved_at": null,
+        "approved_by": null,
+        "denied_at": null,
+        "denied_by": null,
+        "denied_reason": null,
+        "block_reason": null,
+        "steps_completed": [],
+        "current_step": null,
+        "last_error": null,
+        "updated_at": "2026-10-15 17:14:54",
+        "prescreen_status": null,
+        "prescreen_issue_url": null,
+        "prescreen_at": null,
+        "prescreen_reasons": null,
+        "min_requirements_reasons": null,
+        "anonymous": 0,
+        "approval_requested_by": null,
+        "approval_dispatched_at": null,
+        "identifier_screen_status": "clean",
+        "identifier_screen_dispatched_at": null,
+        "identifier_screen_at": "2026-10-15 17:14:54",
+        "identifier_screen_emailed_at": "2026-10-15 17:14:54",
+        "identifier_screen_mail_claimed_at": null,
+        "identifier_screen_ack_by": null,
+        "identifier_screen_ack_reason": null,
+        "identifier_screen_ack_at": null,
+        "withdrawn_at": null,
+        "requested_by_username": "depositor_nm000708",
+        "requested_by_email": "depositor_nm000708@example.org",
+        "dataset_name": "A sufficiently descriptive title for nm000708",
+        "approval_in_flight": false,
+        "identifier_screen": {
+          "state": "clean",
+          "headline": "Identifier screen: clean",
+          "tone": "ok",
+          "lines": [
+            "Files: 10; EDF/BDF headers read: 4 of 4.",
+            "Not read: the contents of sidecars and tables in earlier commits.",
+            "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+          ]
+        },
+        "publication_review": {
+          "kind": "not_reviewed",
+          "enabled": true,
+          "gate": "enforced",
+          "outcome": null,
+          "headline": "Publication review: not reviewed (the request is closed)",
+          "tone": "note",
+          "reasons": [],
+          "start_offered": false,
+          "review_id": null,
+          "head_sha": null
+        }
+      },
+      {
+        "id": 9,
+        "dataset_id": "nm000709",
+        "status": "requested",
+        "requested_at": "2026-10-15 17:14:54",
+        "requested_by": 11,
+        "approved_at": null,
+        "approved_by": null,
+        "denied_at": null,
+        "denied_by": null,
+        "denied_reason": null,
+        "block_reason": null,
+        "steps_completed": [],
+        "current_step": null,
+        "last_error": null,
+        "updated_at": "2026-10-15 17:14:54",
+        "prescreen_status": null,
+        "prescreen_issue_url": null,
+        "prescreen_at": null,
+        "prescreen_reasons": null,
+        "min_requirements_reasons": null,
+        "anonymous": 0,
+        "approval_requested_by": null,
+        "approval_dispatched_at": null,
+        "identifier_screen_status": "clean",
+        "identifier_screen_dispatched_at": null,
+        "identifier_screen_at": "2026-10-15 17:14:54",
+        "identifier_screen_emailed_at": "2026-10-15 17:14:54",
+        "identifier_screen_mail_claimed_at": null,
+        "identifier_screen_ack_by": null,
+        "identifier_screen_ack_reason": null,
+        "identifier_screen_ack_at": null,
+        "withdrawn_at": null,
+        "requested_by_username": "depositor_nm000709",
+        "requested_by_email": "depositor_nm000709@example.org",
+        "dataset_name": "A sufficiently descriptive title for nm000709",
+        "approval_in_flight": false,
+        "identifier_screen": {
+          "state": "clean",
+          "headline": "Identifier screen: clean",
+          "tone": "ok",
+          "lines": [
+            "Files: 10; EDF/BDF headers read: 4 of 4.",
+            "Not read: the contents of sidecars and tables in earlier commits.",
+            "Scanner identifier-scan@abcdef1; commit 0123456789ab."
+          ]
+        },
+        "publication_review": {
+          "kind": "not_applicable",
+          "enabled": true,
+          "gate": "n/a",
+          "outcome": null,
+          "headline": "Publication review: not applicable",
+          "tone": "note",
+          "reasons": [],
+          "start_offered": false,
+          "review_id": null,
+          "head_sha": null
+        }
+      }
+    ],
+    "count": 9
+  }
+}
diff --git a/test/fixtures/publication-review/origin-not-allowed.json b/test/fixtures/publication-review/origin-not-allowed.json
new file mode 100644
index 0000000..cd4d691
--- /dev/null
+++ b/test/fixtures/publication-review/origin-not-allowed.json
@@ -0,0 +1,16 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "an administrator's session cookie and no Origin header",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 403,
+  "body": {
+    "error": "origin_not_allowed",
+    "code": "origin_not_allowed",
+    "message": "This request did not come from a NEMAR page, so it was not accepted."
+  }
+}
diff --git a/test/fixtures/publication-review/start-202-dispatched.json b/test/fixtures/publication-review/start-202-dispatched.json
new file mode 100644
index 0000000..2a507eb
--- /dev/null
+++ b/test/fixtures/publication-review/start-202-dispatched.json
@@ -0,0 +1,17 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "screen clean, requested, no review row, stand-in answers the dispatch 204",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 202,
+  "body": {
+    "environment": "production",
+    "started": true,
+    "reason": "dispatched",
+    "review_id": 1
+  }
+}
diff --git a/test/fixtures/publication-review/start-502-dispatch-failed.json b/test/fixtures/publication-review/start-502-dispatch-failed.json
new file mode 100644
index 0000000..c9b96fe
--- /dev/null
+++ b/test/fixtures/publication-review/start-502-dispatch-failed.json
@@ -0,0 +1,19 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "stand-in answers the dispatch 500",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 502,
+  "body": {
+    "environment": "production",
+    "started": false,
+    "reason": "dispatch_failed",
+    "review_id": 1,
+    "code": "dispatch_failed",
+    "error": "The review could not be handed to GitHub. Try again."
+  }
+}
diff --git a/test/fixtures/publication-review/start-502-unconfigured.json b/test/fixtures/publication-review/start-502-unconfigured.json
new file mode 100644
index 0000000..f70d38d
--- /dev/null
+++ b/test/fixtures/publication-review/start-502-unconfigured.json
@@ -0,0 +1,19 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "the Worker has no GITHUB_ADMIN_PAT",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 502,
+  "body": {
+    "environment": "production",
+    "started": false,
+    "reason": "dispatch_unconfigured",
+    "review_id": 1,
+    "code": "dispatch_unconfigured",
+    "error": "This Worker cannot hand a review to GitHub: a credential is not configured."
+  }
+}
diff --git a/test/fixtures/publication-review/start-bad-dataset.json b/test/fixtures/publication-review/start-bad-dataset.json
new file mode 100644
index 0000000..4593a19
--- /dev/null
+++ b/test/fixtures/publication-review/start-bad-dataset.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "a malformed dataset id in the path",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 400,
+  "body": {
+    "error": "That is not a dataset id.",
+    "code": "bad_dataset"
+  }
+}
diff --git a/test/fixtures/publication-review/start-has-result.json b/test/fixtures/publication-review/start-has-result.json
new file mode 100644
index 0000000..08b5153
--- /dev/null
+++ b/test/fixtures/publication-review/start-has-result.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "a review row in state reported for the screened commit",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "code": "has_result",
+    "error": "A review of this commit has already reported. A new screened commit starts a new review."
+  }
+}
diff --git a/test/fixtures/publication-review/start-not-applicable.json b/test/fixtures/publication-review/start-not-applicable.json
new file mode 100644
index 0000000..2132f1c
--- /dev/null
+++ b/test/fixtures/publication-review/start-not-applicable.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "dataset source openneuro (a mirror)",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "code": "not_applicable",
+    "error": "This dataset is not reviewed: it is an OpenNeuro mirror or an exemplar."
+  }
+}
diff --git a/test/fixtures/publication-review/start-not-found.json b/test/fixtures/publication-review/start-not-found.json
new file mode 100644
index 0000000..a11534f
--- /dev/null
+++ b/test/fixtures/publication-review/start-not-found.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "a well-formed dataset id with no request",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 404,
+  "body": {
+    "error": "nm000999 has no active publication request.",
+    "code": "not_found"
+  }
+}
diff --git a/test/fixtures/publication-review/start-not-owned-here.json b/test/fixtures/publication-review/start-not-owned-here.json
new file mode 100644
index 0000000..361333a
--- /dev/null
+++ b/test/fixtures/publication-review/start-not-owned-here.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "a reserved dev-owned fixture id asked of the production-environment harness",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "code": "not_owned_here",
+    "error": "The other environment's Worker answers for that dataset."
+  }
+}
diff --git a/test/fixtures/publication-review/start-platform-limit.json b/test/fixtures/publication-review/start-platform-limit.json
new file mode 100644
index 0000000..7abbc6b
--- /dev/null
+++ b/test/fixtures/publication-review/start-platform-limit.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "fifty reviews of other depositors' datasets reached a model in the last day (the platform's daily allowance)",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "code": "platform_limit",
+    "error": "The platform's allowance of reviews for the last 24 hours is spent. A start works again as earlier reviews pass 24 hours."
+  }
+}
diff --git a/test/fixtures/publication-review/start-request-not-requested.json b/test/fixtures/publication-review/start-request-not-requested.json
new file mode 100644
index 0000000..7695d74
--- /dev/null
+++ b/test/fixtures/publication-review/start-request-not-requested.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "request approving",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "code": "request_not_requested",
+    "error": "Only a request that is waiting for its decision can be reviewed."
+  }
+}
diff --git a/test/fixtures/publication-review/start-review-disabled.json b/test/fixtures/publication-review/start-review-disabled.json
new file mode 100644
index 0000000..75eb5d1
--- /dev/null
+++ b/test/fixtures/publication-review/start-review-disabled.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "review switched off (PUBLICATION_REVIEW_ENABLED unset)",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "code": "review_disabled",
+    "error": "The publication review is switched off on this Worker."
+  }
+}
diff --git a/test/fixtures/publication-review/start-running.json b/test/fixtures/publication-review/start-running.json
new file mode 100644
index 0000000..0a9d531
--- /dev/null
+++ b/test/fixtures/publication-review/start-running.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "a review row in state dispatched, created five minutes ago",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "code": "running",
+    "error": "A review of this commit is running. Wait for its report, or for its deadline."
+  }
+}
diff --git a/test/fixtures/publication-review/start-screen-not-ready.json b/test/fixtures/publication-review/start-screen-not-ready.json
new file mode 100644
index 0000000..7fcec71
--- /dev/null
+++ b/test/fixtures/publication-review/start-screen-not-ready.json
@@ -0,0 +1,15 @@
+{
+  "_provenance": {
+    "captured_from": "nemar-cli backend test harness, real routes and real SQLite D1, GitHub stand-in at the boundary",
+    "nemar_cli_commit": "7f3aedd95dd2d2123a93ea5200d822fa95003860",
+    "captured_on": "2026-10-15",
+    "scenario": "identifier screen pending",
+    "request": "POST /admin/publish/<dataset>/review/start with no body",
+    "note": "ids and timestamps are the harness's; no real person or credential"
+  },
+  "status": 409,
+  "body": {
+    "code": "screen_not_ready",
+    "error": "The identifier screen has no clear result for a commit yet, so there is nothing to review."
+  }
+}
diff --git a/test/publication-review-copy-drift.test.ts b/test/publication-review-copy-drift.test.ts
new file mode 100644
index 0000000..1c1876e
--- /dev/null
+++ b/test/publication-review-copy-drift.test.ts
@@ -0,0 +1,316 @@
+/**
+ * Drift check between `src/lib/publication-review-copy.ts` and nemar-cli's
+ * `shared/contract/publication-review-copy.ts` (website#459 / nemar-cli#1731, Phase 4 of epic
+ * nemar-cli#1726). The structure is `account-copy-drift.test.ts`'s; read its header for the
+ * reasoning (text extraction rather than import, the pure halves in `./copy-drift.ts`, the
+ * strict and soft modes). What differs is stated here.
+ *
+ * **Stricter than account copy.** The nemar-cli table has no CLI-only keys: every one of its keys
+ * is for the page. So a key in the contract that this repo lacks is a drift, not a note, and
+ * `contractOnly` must be empty as well as `changed` and `unmirrored`.
+ *
+ * **Strict and soft mode.** `NEMAR_CLI_REVIEW_COPY` set means STRICT: its path (relative paths
+ * resolve against `process.cwd()`) IS the contract, and a missing file there FAILS, naming the
+ * variable and `.github/workflows/ci.yml`. Unset means soft: search `CONTRACT_CANDIDATES`, and an
+ * absent contract is a VISIBLE skip (`describe.skipIf` and a `console.info` line), never an early
+ * return.
+ */
+
+import { describe, expect, it } from "vitest";
+import { ACK_MAX, ACK_MIN, DENIAL_MAX, FRIENDLY_WORDS } from "../src/lib/publication-review";
+import { PUBLICATION_REVIEW_COPY } from "../src/lib/publication-review-copy";
+import { compareCopy, extractCopy, formatDifference, stripComments } from "./copy-drift";
+
+/**
+ * `node:fs`, reached without a static import: `astro check` type-checks every file and this
+ * project has no `@types/node`, so a dynamic import with a non-literal specifier (typed `any`) is
+ * the escape hatch for the one test that must read a file OUTSIDE the repo.
+ */
+async function nodeFs(): Promise<{
+  existsSync(path: string): boolean;
+  readFileSync(path: string, encoding: string): string;
+}> {
+  const specifier = "node:fs";
+  return await import(/* @vite-ignore */ specifier);
+}
+
+/** `node:process`, reached the same way and for the same reason as `nodeFs`. */
+async function nodeProcess(): Promise<{
+  cwd(): string;
+  env: Record<string, string | undefined>;
+}> {
+  const specifier = "node:process";
+  return await import(/* @vite-ignore */ specifier);
+}
+
+function pathFromUrl(url: URL): string {
+  return decodeURIComponent(url.pathname);
+}
+
+/**
+ * Resolve a possibly-relative path against the process's working directory: the CI variable names
+ * a path relative to the workspace root, not to this file. An absolute value is returned unchanged.
+ */
+function resolveFromCwd(maybeRelative: string, cwd: string): string {
+  return maybeRelative.startsWith("/") ? maybeRelative : `${cwd}/${maybeRelative}`;
+}
+
+/**
+ * Where a nemar-cli checkout is expected to sit relative to this file, used only when
+ * `NEMAR_CLI_REVIEW_COPY` is unset. In order: the epic worktree and then the main checkout, each
+ * from a website worktree (one directory deeper, under `website-worktrees/`) and from the main
+ * website checkout. The three older drift tests carry candidates that are one directory too
+ * shallow from a worktree; these cover both.
+ */
+const CONTRACT_CANDIDATES = [
+  "../../../nemar-cli-worktrees/epic-publication-review/shared/contract/publication-review-copy.ts",
+  "../../nemar-cli-worktrees/epic-publication-review/shared/contract/publication-review-copy.ts",
+  "../../../nemar-cli/shared/contract/publication-review-copy.ts",
+  "../../nemar-cli/shared/contract/publication-review-copy.ts",
+];
+
+const OURS = new Map(Object.entries(PUBLICATION_REVIEW_COPY));
+
+// Resolved once, at module load, so `describe.skipIf` below has a plain boolean.
+const fs = await nodeFs();
+const proc = await nodeProcess();
+
+const NEMAR_CLI_REVIEW_COPY = proc.env.NEMAR_CLI_REVIEW_COPY;
+const STRICT_CONTRACT_PATH = NEMAR_CLI_REVIEW_COPY
+  ? resolveFromCwd(NEMAR_CLI_REVIEW_COPY, proc.cwd())
+  : undefined;
+const FOUND_CANDIDATE = STRICT_CONTRACT_PATH
+  ? undefined
+  : CONTRACT_CANDIDATES.map((rel) => pathFromUrl(new URL(rel, import.meta.url))).find((path) =>
+      fs.existsSync(path),
+    );
+const CONTRACT_PATH = STRICT_CONTRACT_PATH ?? FOUND_CANDIDATE;
+const CONTRACT_EXISTS = CONTRACT_PATH !== undefined && fs.existsSync(CONTRACT_PATH);
+
+// Skip only in soft mode (no env var) with nothing found. Strict mode never skips: a missing file
+// there is a failure, produced inside the test below as a failed assertion.
+const SHOULD_SKIP = !STRICT_CONTRACT_PATH && !CONTRACT_EXISTS;
+
+if (!STRICT_CONTRACT_PATH && !FOUND_CANDIDATE) {
+  console.info(
+    `[publication-review-copy drift] skipped: no nemar-cli contract found at any of ${CONTRACT_CANDIDATES.join(", ")} (relative to test/), and NEMAR_CLI_REVIEW_COPY is unset. Set NEMAR_CLI_REVIEW_COPY to point at a checkout's shared/contract/publication-review-copy.ts to run the comparison.`,
+  );
+}
+
+describe("the extractor", () => {
+  it("reads this repo's own copy module back exactly", () => {
+    // The reader is the load-bearing half of the comparison below, and the file it is pointed at
+    // is one nobody in this repo can see, so it is proved against a file of exactly that shape.
+    const self = pathFromUrl(new URL("../src/lib/publication-review-copy.ts", import.meta.url));
+    expect(fs.existsSync(self)).toBe(true);
+    const extracted = extractCopy(fs.readFileSync(self, "utf8"));
+    expect(Object.fromEntries(extracted)).toEqual({ ...PUBLICATION_REVIEW_COPY });
+  });
+
+  it("ignores a key quoted inside a comment", () => {
+    const source = [
+      '/* the key "gate.hard_reason": "Not this one" appears in prose */',
+      'const X = { "gate.hard_reason": "The real one." };',
+    ].join("\n");
+    expect(extractCopy(source).get("gate.hard_reason")).toBe("The real one.");
+    expect(extractCopy(source).size).toBe(1);
+  });
+
+  it("ignores a comment that follows code on the same line", () => {
+    // The hole a start-of-line strip leaves: the commented pair would be matched last and win.
+    const source =
+      'const X = { "gate.hard_reason": "The real one.", // "gate.hard_reason": "Not this one"\n};';
+    expect(extractCopy(source).get("gate.hard_reason")).toBe("The real one.");
+    expect(extractCopy(source).size).toBe(1);
+  });
+
+  it("keeps a // or a quote that sits inside a string value", () => {
+    const source = [
+      'const X = { "a.b": "See https://example.org/x and don\'t stop", // trailing',
+      '  "c.d": "plain" };',
+    ].join("\n");
+    const extracted = extractCopy(source);
+    expect(extracted.get("a.b")).toBe("See https://example.org/x and don't stop");
+    expect(extracted.get("c.d")).toBe("plain");
+  });
+
+  it("strips a block comment between entries and one that ends the file unterminated", () => {
+    const source = 'const X = { "a.b": "one", /* "a.b": "two" */ "c.d": "three" }; /* "e.f": "x"';
+    const extracted = extractCopy(source);
+    expect([...extracted.keys()]).toEqual(["a.b", "c.d"]);
+  });
+
+  it("refuses a key matched twice, instead of letting the last one win", () => {
+    const source = 'const X = { "a.b": "first", "c.d": "x", "a.b": "second" };';
+    expect(() => extractCopy(source)).toThrow(/more than once.*a\.b/);
+  });
+
+  it("does not invent an entry for a computed value", () => {
+    // The failure the literal-strings-only rule prevents: the key is simply absent, and the
+    // comparison reports it as unmirrored rather than as matching.
+    const source = 'const X = { "a.b": `${MIN} to ${MAX} characters`, "c.d": "plain" };';
+    const extracted = extractCopy(source);
+    expect(extracted.has("a.b")).toBe(false);
+    expect(extracted.get("c.d")).toBe("plain");
+  });
+});
+
+describe("the numbers the page copies from nemar-cli's shared/publication-limits.ts", () => {
+  it("says 1 to 2,000 for a denial reason, from DENIAL_MAX", () => {
+    expect(FRIENDLY_WORDS.deny_rejected).toContain(`1 to ${DENIAL_MAX.toLocaleString("en-US")}`);
+  });
+
+  it("says 10 to 500 for an acknowledgment, from ACK_MIN and ACK_MAX", () => {
+    expect(PUBLICATION_REVIEW_COPY["screen_gate.acknowledge"]).toContain(
+      `${ACK_MIN} to ${ACK_MAX} characters`,
+    );
+  });
+});
+
+describe("compareCopy", () => {
+  const ours = new Map([
+    ["gate.hard_reason", "A reason that no override clears."],
+    ["start.dispatched", "The review was started."],
+  ]);
+
+  it("reports a changed value as drift, and nothing else", () => {
+    const result = compareCopy(
+      ours,
+      new Map([
+        ["gate.hard_reason", "A reason that nothing clears."],
+        ["start.dispatched", "The review was started."],
+      ]),
+    );
+    expect(result.changed).toEqual([
+      {
+        key: "gate.hard_reason",
+        ours: "A reason that no override clears.",
+        contract: "A reason that nothing clears.",
+      },
+    ]);
+    expect(result.unmirrored).toEqual([]);
+    expect(result.contractOnly).toEqual([]);
+  });
+
+  it("reports a contract-only key, which this test treats as drift", () => {
+    const result = compareCopy(ours, new Map([...ours, ["start.extra", "An extra sentence."]]));
+    expect(result.contractOnly).toEqual(["start.extra"]);
+    expect(result.changed).toEqual([]);
+    expect(result.unmirrored).toEqual([]);
+  });
+
+  it("reports a website-only key as unmirrored", () => {
+    const result = compareCopy(
+      ours,
+      new Map([["gate.hard_reason", "A reason that no override clears."]]),
+    );
+    expect(result.unmirrored).toEqual(["start.dispatched"]);
+    expect(result.changed).toEqual([]);
+  });
+
+  it("calls every key unmirrored against an empty contract", () => {
+    // The shape of a contract file that exists but could not be parsed; it must not read as clear.
+    const result = compareCopy(ours, new Map());
+    expect(result.unmirrored).toEqual(["gate.hard_reason", "start.dispatched"]);
+    expect(result.changed).toEqual([]);
+    expect(result.contractOnly).toEqual([]);
+  });
+
+  it("says nothing when the two sides agree", () => {
+    expect(compareCopy(ours, new Map(ours))).toEqual({
+      changed: [],
+      unmirrored: [],
+      contractOnly: [],
+    });
+  });
+
+  it("formats a difference with both sides on their own line", () => {
+    const text = formatDifference({ key: "a.b", ours: "one", contract: "two" });
+    expect(text).toContain("website:   one");
+    expect(text).toContain("nemar-cli: two");
+  });
+});
+
+// `describe.skipIf` (not a per-`it` check) so every test declared inside is marked skipped in the
+// run summary rather than silently absent.
+describe.skipIf(SHOULD_SKIP)("website copy vs the nemar-cli contract", () => {
+  it("matches string for string, key for key, in both directions", () => {
+    if (STRICT_CONTRACT_PATH && !CONTRACT_EXISTS) {
+      throw new Error(
+        `[publication-review-copy drift] NEMAR_CLI_REVIEW_COPY=${NEMAR_CLI_REVIEW_COPY} resolved to ${STRICT_CONTRACT_PATH}, which does not exist. This test enforces the contract when the env var is set; it does not skip on a missing file. Check the sparse-checkout step in .github/workflows/ci.yml.`,
+      );
+    }
+
+    // SHOULD_SKIP is false here, and the strict-missing case threw above, so a path exists.
+    const found = CONTRACT_PATH as string;
+    const result = compareCopy(OURS, extractCopy(fs.readFileSync(found, "utf8")));
+
+    expect(
+      result.changed.map(formatDifference),
+      `Copy drifted from ${found}. Update whichever side is wrong; the contract is the source of truth.`,
+    ).toEqual([]);
+    expect(
+      result.unmirrored,
+      `Keys missing from ${found}. Every website key is mirrored in the contract; add them there or remove them here.`,
+    ).toEqual([]);
+    expect(
+      result.contractOnly,
+      `Keys in ${found} that this repo lacks. Unlike account copy, the nemar-cli table has no CLI-only keys (every key is for the page), so a key missing here is a drift; add it to src/lib/publication-review-copy.ts and give it a consumer.`,
+    ).toEqual([]);
+  });
+});
+
+/**
+ * The limits file sits beside the contract directory: `<checkout>/shared/publication-limits.ts`.
+ * Derived from the contract path, so the same variable (strict) or the same candidate (soft)
+ * decides which checkout is read. The CI sparse checkout carries only the contract files, so a
+ * missing limits file is a VISIBLE skip (a `console.info` line and a skipped test), never a pass;
+ * adding `shared/publication-limits.ts` to the sparse checkout of `.github/workflows/ci.yml` makes
+ * CI compare the numbers. A present file that does not hold the three exports is a failure.
+ */
+const LIMITS_PATH = CONTRACT_PATH?.replace(
+  /\/shared\/contract\/publication-review-copy\.ts$/,
+  "/shared/publication-limits.ts",
+);
+const LIMITS_EXIST = LIMITS_PATH !== undefined && fs.existsSync(LIMITS_PATH);
+if (CONTRACT_EXISTS && !LIMITS_EXIST && !STRICT_CONTRACT_PATH) {
+  console.info(
+    `[publication-review limits drift] skipped: ${LIMITS_PATH ?? "(no path)"} is not checked out. Add shared/publication-limits.ts to the sparse checkout in .github/workflows/ci.yml to enforce it.`,
+  );
+}
+
+// Strict mode (the variable is set) never skips: a missing limits file fails the first test below,
+// as a missing contract file fails the copy test. Only the soft search may skip, and visibly.
+describe.skipIf(SHOULD_SKIP || (!STRICT_CONTRACT_PATH && !LIMITS_EXIST))(
+  "page limits vs nemar-cli publication-limits",
+  () => {
+    const read = (): string => {
+      return fs.readFileSync(LIMITS_PATH as string, "utf8");
+    };
+    it("finds the limits file beside the contract when the variable is set", () => {
+      if (!STRICT_CONTRACT_PATH) return;
+      expect(
+        LIMITS_EXIST,
+        `NEMAR_CLI_REVIEW_COPY=${NEMAR_CLI_REVIEW_COPY} is set, so ${LIMITS_PATH} must exist; it does not skip. Check the sparse-checkout step in .github/workflows/ci.yml for shared/publication-limits.ts.`,
+      ).toBe(true);
+    });
+    const constant = (source: string, name: string): number => {
+      const match = new RegExp(`export const ${name}\\s*=\\s*(\\d+)`).exec(stripComments(source));
+      if (!match) throw new Error(`${name} is not a plain numeric export of ${LIMITS_PATH}`);
+      return Number(match[1]);
+    };
+
+    it("keeps ACK_MIN, ACK_MAX and DENIAL_MAX equal to the Worker's bounds", () => {
+      const source = read();
+      expect(ACK_MIN, "ACKNOWLEDGMENT_MIN_LENGTH").toBe(
+        constant(source, "ACKNOWLEDGMENT_MIN_LENGTH"),
+      );
+      expect(ACK_MAX, "ACKNOWLEDGMENT_MAX_LENGTH").toBe(
+        constant(source, "ACKNOWLEDGMENT_MAX_LENGTH"),
+      );
+      expect(DENIAL_MAX, "DENIAL_REASON_MAX_LENGTH").toBe(
+        constant(source, "DENIAL_REASON_MAX_LENGTH"),
+      );
+    });
+  },
+);
diff --git a/test/publication-review-fixtures.test.ts b/test/publication-review-fixtures.test.ts
new file mode 100644
index 0000000..4753852
--- /dev/null
+++ b/test/publication-review-fixtures.test.ts
@@ -0,0 +1,229 @@
+import { describe, expect, it } from "vitest";
+import { asResponse, envelopes, fixture, fixtureNames } from "./publication-review-fixtures";
+
+/**
+ * The guard over the captured review answers (`test/fixtures/publication-review/`).
+ *
+ * Every other test of the review page reads these through `fixture()`, so a fixture that lost its
+ * provenance, or a directory that went empty, must fail here and not pass quietly everywhere
+ * else. The non-vacuity block pins that the scenarios the typed tests lean on are really in the
+ * set: a test over "every reason" or "the detail with two override-class reasons" would pass
+ * over an empty list.
+ */
+
+const PROVENANCE_KEYS = [
+  "captured_from",
+  "nemar_cli_commit",
+  "captured_on",
+  "scenario",
+  "request",
+  "note",
+];
+
+/** The scenarios the page tests need; the capture script writes one file for each. */
+const REQUIRED = [
+  "list",
+  "detail-pass",
+  "detail-needs-override",
+  "detail-needs-override-two",
+  "detail-hard-reason",
+  "detail-hard-not-run",
+  "detail-off-acknowledge",
+  "detail-needs-ack-and-override",
+  "detail-not-started-startable",
+  "detail-approving-not-startable",
+  "detail-blocked",
+  "detail-blocked-started",
+  "detail-started-publishing",
+  "detail-not-applicable",
+  "detail-not-found",
+  "approve-needs-override",
+  "approve-hard-reason",
+  "approve-override-not-covering",
+  "approve-review-changed",
+  "approve-no-review-row",
+  "approve-screen-blocks",
+  "approve-screen-acknowledge",
+  "approve-screen-rerun",
+  "approve-screen-wait",
+  "approve-screen-stale",
+  "approve-screen-unverified",
+  "approve-request-mismatch",
+  "approve-not-dispatchable",
+  "approve-already-in-flight",
+  "approve-invalid-body",
+  "approve-202",
+  "origin-not-allowed",
+  "deny-200",
+  "deny-request-mismatch",
+  "deny-after-publishing",
+  "deny-approval-in-flight",
+  "deny-not-found",
+  "deny-invalid-body",
+  "start-202-dispatched",
+  "start-502-dispatch-failed",
+  "start-502-unconfigured",
+  "start-bad-dataset",
+  "start-not-found",
+];
+
+interface ReasonShape {
+  code: string;
+  class: string;
+  cleared_by: string;
+  statement: string;
+  cure: string;
+}
+
+interface DetailShape {
+  start_offered: boolean;
+  screen_gate: string;
+  reasons: ReasonShape[];
+}
+
+/** The reasons a body carries: a detail's, or a gate refusal's. */
+function reasonsIn(body: unknown): ReasonShape[] {
+  const reasons = (body as { reasons?: unknown }).reasons;
+  return Array.isArray(reasons) ? (reasons as ReasonShape[]) : [];
+}
+
+const details = fixtureNames()
+  .filter((n) => n.startsWith("detail-"))
+  .map((n) => ({ name: n, ...fixture<DetailShape>(n) }))
+  .filter((f) => f.status === 200);
+
+describe("every captured file", () => {
+  it("is a non-empty directory holding every scenario the page tests use", () => {
+    const names = fixtureNames();
+    expect(names.length).toBeGreaterThan(0);
+    expect(names.filter((n) => REQUIRED.includes(n)).sort()).toEqual([...REQUIRED].sort());
+  });
+
+  it("is an envelope of provenance, status and body, and nothing else", () => {
+    for (const { name, envelope } of envelopes()) {
+      expect(Object.keys(envelope).sort(), name).toEqual(["_provenance", "body", "status"]);
+    }
+  });
+
+  it("carries every provenance key as a non-empty string", () => {
+    for (const { name, envelope } of envelopes()) {
+      expect(Object.keys(envelope._provenance).sort(), name).toEqual([...PROVENANCE_KEYS].sort());
+      for (const [key, value] of Object.entries(envelope._provenance)) {
+        expect(typeof value, `${name}.${key}`).toBe("string");
+        expect(value.trim().length, `${name}.${key}`).toBeGreaterThan(0);
+      }
+    }
+  });
+
+  it("names the nemar-cli commit it was captured on as 40 hex digits, and a date", () => {
+    for (const { name, envelope } of envelopes()) {
+      expect(envelope._provenance.nemar_cli_commit, name).toMatch(/^[0-9a-f]{40}$/);
+      expect(envelope._provenance.captured_on, name).toMatch(/^\d{4}-\d{2}-\d{2}$/);
+    }
+  });
+
+  it("has an HTTP status and a body", () => {
+    for (const { name, envelope } of envelopes()) {
+      expect(Number.isInteger(envelope.status), name).toBe(true);
+      expect(envelope.status, name).toBeGreaterThanOrEqual(200);
+      expect(envelope.status, name).toBeLessThan(600);
+      expect(envelope.body, name).toBeDefined();
+      expect(envelope.body, name).not.toBeNull();
+    }
+  });
+
+  it("carries no filesystem path, host name, credential or address that is not the harness's", () => {
+    // The repository is public: a capture that picked up a real path, host or key must not land.
+    for (const { name, envelope } of envelopes()) {
+      const text = JSON.stringify(envelope);
+      expect(text, name).not.toMatch(/\/Users\/|\/home\/|\/private\/|\/tmp\//);
+      expect(text, name).not.toMatch(/https?:\/\//);
+      expect(text, name).not.toMatch(/ghp_|Bearer |re_[A-Za-z0-9]{6}/);
+      for (const address of text.match(/[\w.+-]+@[\w-]+(?:\.[\w-]+)+/g) ?? []) {
+        expect(address, name).toMatch(/@example\.org$/);
+      }
+    }
+  });
+
+  it("never touches a live dataset (nm000103 to nm000107)", () => {
+    for (const { name, envelope } of envelopes()) {
+      expect(JSON.stringify(envelope), name).not.toMatch(/nm00010[3-7]/);
+    }
+  });
+});
+
+describe("fixture() and asResponse()", () => {
+  it("reads a fixture by name and refuses a name that is not there", () => {
+    expect(fixture("detail-pass").status).toBe(200);
+    expect(fixture("detail-not-found").status).toBe(404);
+    expect(() => fixture("no-such-fixture")).toThrow(/no-such-fixture/);
+  });
+
+  it("makes a Response with the captured status, a JSON content type and the captured body", async () => {
+    for (const name of ["approve-202", "approve-needs-override", "deny-invalid-body"]) {
+      const f = fixture(name);
+      const response = asResponse(f);
+      expect(response.status, name).toBe(f.status);
+      expect(response.headers.get("Content-Type"), name).toBe("application/json");
+      expect(await response.json(), name).toEqual(f.body);
+    }
+  });
+});
+
+describe("the set is not vacuous", () => {
+  it("holds several details, so a loop over them is a loop", () => {
+    expect(details.length).toBeGreaterThanOrEqual(10);
+  });
+
+  it("has a detail with two override-class reasons, and a detail with none", () => {
+    const overrideCount = (reasons: ReasonShape[]) =>
+      reasons.filter((r) => r.cleared_by === "override").length;
+    expect(details.some((f) => overrideCount(f.body.reasons) === 2)).toBe(true);
+    expect(details.some((f) => f.body.reasons.length === 0)).toBe(true);
+  });
+
+  it("has details with a hard reason, a screen reason and an offered start", () => {
+    expect(details.some((f) => f.body.reasons.some((r) => r.cleared_by === "nothing"))).toBe(true);
+    expect(
+      details.some((f) => f.body.reasons.some((r) => r.cleared_by === "screen_acknowledgment")),
+    ).toBe(true);
+    expect(details.some((f) => f.body.start_offered === true)).toBe(true);
+    expect(details.some((f) => f.body.start_offered === false)).toBe(true);
+  });
+
+  it("covers every screen gate the detail can report except the one only an exempt id gives", () => {
+    const gates = new Set(details.map((f) => f.body.screen_gate));
+    for (const gate of ["clear", "blocks", "acknowledge", "rerun"]) {
+      expect(gates.has(gate), gate).toBe(true);
+    }
+  });
+
+  it("puts start_offered and screen_gate on every detail", () => {
+    for (const f of details) {
+      expect(typeof f.body.start_offered, f.name).toBe("boolean");
+      expect(typeof f.body.screen_gate, f.name).toBe("string");
+    }
+  });
+
+  it("puts a statement on every reason a detail or a gate refusal carries", () => {
+    const withReasons = envelopes().filter(({ envelope }) => reasonsIn(envelope.body).length > 0);
+    expect(withReasons.length).toBeGreaterThanOrEqual(10);
+    for (const { name, envelope } of withReasons) {
+      for (const reason of reasonsIn(envelope.body)) {
+        expect(typeof reason.statement, `${name} ${reason.code}`).toBe("string");
+        expect(reason.statement.length, `${name} ${reason.code}`).toBeGreaterThan(0);
+      }
+    }
+  });
+
+  it("keeps every captured cure free of terminal words (no command, no flag)", () => {
+    // The page prints the cure as the Worker sent it; a cure that named `nemar ...` or a `--flag`
+    // would send an administrator to a terminal from a web page.
+    for (const { name, envelope } of envelopes()) {
+      for (const reason of reasonsIn(envelope.body)) {
+        expect(reason.cure, `${name} ${reason.code}`).not.toContain("nemar ");
+        expect(reason.cure, `${name} ${reason.code}`).not.toContain("--");
+      }
+    }
+  });
+});
diff --git a/test/publication-review-fixtures.ts b/test/publication-review-fixtures.ts
new file mode 100644
index 0000000..06393f4
--- /dev/null
+++ b/test/publication-review-fixtures.ts
@@ -0,0 +1,94 @@
+/**
+ * The captured answers of the publication review's API, read by name.
+ *
+ * Each file in `test/fixtures/publication-review/` is one real answer of the nemar-cli Worker:
+ * `{ _provenance, status, body }`. They were captured by driving the Worker's real routes over a
+ * real SQLite database with the nemar-cli backend test harness (a stand-in answers only at the
+ * GitHub boundary), and `_provenance` says which nemar-cli commit, which seed and which request
+ * produced each. Nothing here is typed from memory of the contract.
+ *
+ * What is real and what is the harness's: the routes, the status codes, the field names and the
+ * wording of every refusal are the Worker's own. The CONTENT of a review is not a model's answer:
+ * the model text (`SUMMARY-SENTINEL-...`, `NOTE-SENTINEL-...`), the model name, the head commit
+ * sha, the scanner id and the evidence block are fixed sentinel values of the harness, and the
+ * tests rely on the sentinels to prove the model's words appear only under their label. Dataset
+ * ids (`nm0007xx`) and the depositor addresses (`example.org`) are inert strings, not allocated
+ * datasets or real people; ids and timestamps are the harness's.
+ *
+ * Refreshing: when the nemar-cli contract moves, re-run the capture at the new nemar-cli head and
+ * replace the files. The diff shows exactly which words or fields moved; update the page's types
+ * and the mirrored copy keys if it says so, and the typed tests go red first where a field
+ * vanished. The capture script is not committed; the pull request that last refreshed the files
+ * describes how it was run.
+ *
+ * Not a `.test.ts` file on purpose: vitest collects only `*.test.ts`, and Biome's
+ * `noExportsInTest` forbids exporting from one (the arrangement of `test/copy-drift.ts`).
+ */
+
+/** The six keys every file's `_provenance` carries. */
+export interface Provenance {
+  captured_from: string;
+  nemar_cli_commit: string;
+  captured_on: string;
+  scenario: string;
+  request: string;
+  note: string;
+}
+
+/** A file as it is on disk. `body` is whatever the Worker answered. */
+export interface Envelope {
+  _provenance: Provenance;
+  status: number;
+  body: unknown;
+}
+
+/** A captured answer, as a test reads it. */
+export interface Captured<T> {
+  status: number;
+  body: T;
+}
+
+const files = import.meta.glob<Envelope>("./fixtures/publication-review/*.json", {
+  eager: true,
+  import: "default",
+});
+
+const byName = new Map<string, Envelope>(
+  Object.entries(files).map(([path, envelope]) => [
+    (path.split("/").pop() as string).replace(/\.json$/, ""),
+    envelope,
+  ]),
+);
+
+/** Every captured name, in file order. */
+export function fixtureNames(): string[] {
+  return [...byName.keys()];
+}
+
+/** Every file whole, with its provenance, for the guard test. */
+export function envelopes(): { name: string; envelope: Envelope }[] {
+  return [...byName.entries()].map(([name, envelope]) => ({ name, envelope }));
+}
+
+/**
+ * One captured answer by name. The single cast in this file is here: JSON imports are widened to
+ * their literals' types, so the body is asserted to be the page's `T`, and a test that wants the
+ * captured shape to be checked reads it as `unknown` and narrows.
+ */
+export function fixture<T>(name: string): Captured<T> {
+  const envelope = byName.get(name);
+  if (!envelope) {
+    throw new Error(
+      `no captured review fixture named "${name}" (have: ${fixtureNames().join(", ")})`,
+    );
+  }
+  return { status: envelope.status, body: envelope.body as T };
+}
+
+/** The captured answer as the `Response` a `fetch` would have returned, for a test's fetch. */
+export function asResponse(f: Captured<unknown>): Response {
+  return new Response(JSON.stringify(f.body), {
+    status: f.status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
diff --git a/test/publication-review-page.test.ts b/test/publication-review-page.test.ts
new file mode 100644
index 0000000..7971034
--- /dev/null
+++ b/test/publication-review-page.test.ts
@@ -0,0 +1,925 @@
+/**
+ * Source-level guards for the administrator approval page's script (website#459).
+ *
+ * The words the panel prints are not tested here: the panel is drawn as a plain tree by
+ * `src/lib/publication-review-panel.ts`, and `src/lib/publication-review-panel.test.ts` reads that
+ * tree over captured fixtures, so deleting a sentence, line, label, prompt or button fails there.
+ * What stays in the script is wiring, and that is what this file pins, each against the exact
+ * statement that implements it: which client function is called with what, the in-flight guard, the
+ * stale-answer token, the quiet-refresh guard, the busy buttons, the typed reason kept across a
+ * re-read, the retry label, the row-versus-detail request check, the guard around the drawing,
+ * focus and the announcement of a notice.
+ *
+ * There is no rendering harness: no jsdom or happy-dom, and Playwright is installed but has no spec
+ * for this page. Layout, focus order and forced colors are the maintainer's browser checklist in
+ * the pull request.
+ *
+ * Same pattern as `test/account-tiers-ui.test.ts` and `test/publish-block-reason.test.ts`: Vite's
+ * `?raw`, not `node:fs`, for scripts and components (`astro check` has no node types).
+ */
+
+import { describe, expect, it } from "vitest";
+import CONFIRM_DIALOG from "../src/components/ConfirmDialog.astro?raw";
+import ROW from "../src/components/PublicationRequestRow.astro?raw";
+import PANEL from "../src/lib/publication-review-panel.ts?raw";
+import PAGE from "../src/pages/admin/publication-requests.astro?raw";
+import { fixture } from "./publication-review-fixtures";
+import { terminalFlaws } from "./publication-review-web-words";
+
+/**
+ * `node:fs`, reached without a static import (`astro check` has no node types; the same escape
+ * hatch as `test/publication-review-copy-drift.test.ts`). Vitest blanks every stylesheet it
+ * imports, `?raw` included, unless `vitest.config.ts` lets it through, so the two stylesheets this
+ * file reads are read from disk instead.
+ */
+async function readStyle(name: string): Promise<string> {
+  const specifier = "node:fs";
+  const fs: { readFileSync(path: string, encoding: string): string } = await import(
+    /* @vite-ignore */ specifier
+  );
+  return fs.readFileSync(
+    decodeURIComponent(new URL(`../src/styles/${name}`, import.meta.url).pathname),
+    "utf8",
+  );
+}
+
+const STYLES = await readStyle("publication-review-panel.css");
+const TOKENS = await readStyle("tokens.css");
+
+/** Drop comments so an assertion reads code, not the prose that explains why a word is absent. */
+function code(src: string): string {
+  return src
+    .replace(/\{\/\*[\s\S]*?\*\/\}/g, " ")
+    .replace(/<!--[\s\S]*?-->/g, " ")
+    .replace(/\/\*[\s\S]*?\*\//g, " ")
+    .replace(/(^|[^:"'`])\/\/.*$/gm, "$1");
+}
+
+/** The page's client `<script>`, comments dropped. */
+function pageScript(): string {
+  const match = /<script>([\s\S]*?)<\/script>/.exec(PAGE);
+  if (!match) throw new Error("publication-requests.astro has no client <script>");
+  return code(match[1]);
+}
+
+const SCRIPT = pageScript();
+const ROW_CODE = code(ROW);
+const PANEL_CODE = code(PANEL);
+const PAGE_CODE = code(PAGE);
+
+/** Every argument list of a call, from the opening parenthesis to its matching one. */
+function callArguments(src: string, name: string): string[] {
+  const out: string[] = [];
+  let at = src.indexOf(`${name}(`);
+  while (at !== -1) {
+    let depth = 0;
+    let end = at + name.length;
+    for (let i = end; i < src.length; i++) {
+      if (src[i] === "(") depth++;
+      else if (src[i] === ")") {
+        depth--;
+        if (depth === 0) {
+          end = i;
+          break;
+        }
+      }
+    }
+    out.push(src.slice(at + name.length + 1, end));
+    at = src.indexOf(`${name}(`, end);
+  }
+  return out;
+}
+
+/**
+ * Every string literal of a source, of any quote kind, as its raw text without the quotes. A
+ * template literal is one literal, its `${...}` parts included. A scan, not a regular expression, so
+ * that a quote inside another kind of literal is text, and the tests below can say how many it
+ * found. The page script has no regular-expression literal holding a quote; the count checks
+ * below would notice one that confused it.
+ */
+function stringLiterals(src: string): string[] {
+  const out: string[] = [];
+  let i = 0;
+  while (i < src.length) {
+    const quote = src[i];
+    if (quote !== '"' && quote !== "'" && quote !== "`") {
+      i++;
+      continue;
+    }
+    let j = i + 1;
+    let depth = 0;
+    while (j < src.length) {
+      const c = src[j];
+      if (c === "\\") {
+        j += 2;
+        continue;
+      }
+      if (quote === "`" && c === "$" && src[j + 1] === "{") {
+        depth++;
+        j += 2;
+        continue;
+      }
+      if (quote === "`" && depth > 0 && c === "}") depth--;
+      else if (c === quote && depth === 0) break;
+      else if (c === "\n" && quote !== "`") break;
+      j++;
+    }
+    out.push(src.slice(i + 1, j));
+    i = j + 1;
+  }
+  return out;
+}
+
+/** The body of the click handler registered on a selector, up to the next registration. */
+function handlerOf(selector: string): string {
+  const start = SCRIPT.indexOf(`"${selector}"`);
+  if (start === -1) throw new Error(`the script registers nothing on ${selector}`);
+  const next = SCRIPT.indexOf("querySelectorAll", start + 1);
+  return SCRIPT.slice(start, next === -1 ? undefined : next);
+}
+
+/** The text of a top-level function of the script, from its keyword to its closing brace. */
+function functionOf(name: string): string {
+  const match = new RegExp(`(?:async )?function ${name}\\([\\s\\S]*?\\n {2}\\}`).exec(SCRIPT);
+  if (!match) throw new Error(`the script has no function ${name}`);
+  return match[0];
+}
+
+describe("the four files are read (the guards below are not vacuous)", () => {
+  it("finds the script, the row, the panel module, the stylesheet and the tokens", () => {
+    expect(SCRIPT).toContain("getPublicationReview(");
+    expect(ROW_CODE).toContain("data-pubreq-row");
+    expect(PANEL_CODE).toContain("export function panelTree");
+    expect(STYLES).toContain(".pubreq-review");
+    expect(TOKENS).toContain("--color-bg:");
+  });
+
+  it("reads the functions it pins", () => {
+    for (const name of [
+      "mount",
+      "queue",
+      "drawPanel",
+      "loadPanel",
+      "closePanel",
+      "dropPendingApproval",
+      "reportFailure",
+      "startReview",
+      "afterApproveFailure",
+      "setApproveBusy",
+      "setToggle",
+      "announce",
+      "syncRefreshNote",
+      "wireControls",
+      "wireRefresh",
+      "openFromRow",
+      "setPanelError",
+    ]) {
+      expect(functionOf(name).length, name).toBeGreaterThan(40);
+    }
+  });
+});
+
+describe("the script words the panel through the lib, never by itself", () => {
+  it("imports the pure functions and the page-owned words from both lib modules", () => {
+    for (const [from, wanted] of [
+      [
+        "publication-review",
+        [
+          "panelModel",
+          "approveBody",
+          "describeFailure",
+          "describeStartSuccess",
+          "UI_WORDS",
+          "FRIENDLY_WORDS",
+          "ACK_MAX",
+          "DENIAL_MAX",
+        ],
+      ],
+      [
+        "publication-review-panel",
+        [
+          "panelTree",
+          "loadingTree",
+          "failureTree",
+          "staleRowTree",
+          "errorTree",
+          "rowIsStale",
+          "toggleLabels",
+          "PANEL_WORDS",
+          "BUSY_FAILURE",
+          "DRAW_FAILURE",
+        ],
+      ],
+    ] as const) {
+      const imports = new RegExp(
+        `import\\s*\\{([^}]*)\\}\\s*from\\s*"\\.\\./\\.\\./lib/${from}"`,
+      ).exec(SCRIPT);
+      expect(imports, `no import from lib/${from}`).not.toBeNull();
+      const names = (imports?.[1] ?? "").split(",").map((n) => n.trim().replace(/^type\s+/, ""));
+      for (const name of wanted) expect(names, `${from}: ${name}`).toContain(name);
+    }
+  });
+
+  it("builds the panel from panelModel with the row's own start", () => {
+    expect(SCRIPT).toMatch(/panelModel\(detail,\s*\{\s*rowStart:\s*rowStartOf\(panel\)\s*\}\)/);
+  });
+
+  it("hands panelTree the row, the kept reason, the notice and the failure, and nothing is drawn by hand", () => {
+    const draw = functionOf("drawPanel");
+    expect(draw).toMatch(/panelTree\(model,\s*\{/);
+    for (const key of [
+      "datasetId",
+      "panelId: panel.id",
+      "retryLabel: panel.dataset.rowLabel === UI_WORDS.buttons.retry",
+      "reloadHref: location.href",
+      "error: opts.error",
+      "notice: opts.notice",
+      "acknowledgment: opts.acknowledgment",
+    ]) {
+      expect(draw, key).toContain(key);
+    }
+    expect(draw).toMatch(/replaceChildren\(\.\.\.nodes\.map\(mount\)\)/);
+  });
+
+  it("reads no word of the model itself: only the control, which decides what is wired, and the request it names", () => {
+    const read = [...SCRIPT.matchAll(/\bmodel\.(\w+)/g)].map((m) => m[1]);
+    expect(read.length).toBeGreaterThan(0);
+    expect([...new Set(read)].sort()).toEqual(["approve", "requestId"]);
+  });
+
+  it("mounts a node in one place, with createElement, setAttribute and textContent", () => {
+    expect(SCRIPT.match(/createElement\(/g)).toHaveLength(1);
+    const mount = functionOf("mount");
+    expect(mount).toContain("document.createElement(spec.tag)");
+    expect(mount).toContain("node.setAttribute(name, value)");
+    expect(mount).toContain("node.textContent = spec.text");
+    expect(mount).toMatch(
+      /for \(const child of spec\.children \?\? \[\]\) node\.append\(mount\(child\)\)/,
+    );
+    expect(mount).not.toMatch(/innerHTML|insertAdjacentHTML|outerHTML/);
+  });
+
+  it("words a started review through describeStartSuccess and a failure through describeFailure", () => {
+    expect(SCRIPT).toContain("describeStartSuccess(started)");
+    for (const op of ["approve", "deny", "start", "detail"]) {
+      expect(SCRIPT, op).toContain(`describeFailure("${op}"`);
+    }
+  });
+
+  it("acts on every follow-up a failure asks for", () => {
+    // A failure carries no flag for the override box: a re-read redraws the panel from the new
+    // answer, so the box always comes back unticked.
+    const report = functionOf("reportFailure");
+    expect(report).toContain("if (failure.refetch)");
+    expect(report).toContain("showError(failure.text, { refresh: failure.refreshLink })");
+    expect(functionOf("afterApproveFailure")).toContain("focusAck: failure.focusAck");
+    expect(SCRIPT).toContain("showError(failure.text, { refresh: failure.refreshLink })");
+  });
+
+  it("takes the retry word from UI_WORDS and every other button and heading word from the tree", () => {
+    expect(SCRIPT).toContain("UI_WORDS.buttons.retry");
+    for (const word of [
+      "headings",
+      "buttons.review",
+      "buttons.start",
+      "buttons.approve",
+    ]) {
+      expect(SCRIPT, word).not.toContain(`UI_WORDS.${word}`);
+    }
+  });
+
+  it("holds no sentence of the Worker's, however it arrived", () => {
+    for (const name of [
+      "approve-needs-override",
+      "approve-hard-reason",
+      "approve-override-not-covering",
+      "approve-review-changed",
+      "approve-no-review-row",
+      "approve-screen-blocks",
+      "approve-screen-acknowledge",
+      "approve-screen-rerun",
+      "approve-screen-wait",
+      "approve-not-dispatchable",
+    ]) {
+      const { body } = fixture<{ message?: string }>(name);
+      expect(typeof body.message, `${name} has a message`).toBe("string");
+      expect(SCRIPT, name).not.toContain(body.message as string);
+      expect(PANEL_CODE, name).not.toContain(body.message as string);
+    }
+  });
+
+  it("holds no sentence at all: a literal of three words or more is a log line or a listed word", () => {
+    // The fixture check above catches a Worker sentence only word for word; a paraphrase of one
+    // would pass it. So the script may hold no literal of any quote kind that reads as a sentence,
+    // except the page's own, named here: the log lines (which never reach the screen), the
+    // denial dialog's prompt, and the reason counter's template.
+    const pageOwned = new Set([
+      "[admin] overwriting un-confirmed pending action",
+      "[admin] the review panel could not be drawn",
+      "[admin] confirm-dialog event did not match queued pending action",
+      "Reason for denial?",
+      "${area.value.length} / ${ACK_MAX}",
+    ]);
+    const literals = stringLiterals(SCRIPT);
+    expect(literals.length).toBeGreaterThan(40);
+    const sentences = literals.filter((l) => l.trim().split(/\s+/).length >= 3);
+    for (const known of pageOwned) expect(sentences, known).toContain(known);
+    expect(sentences.filter((l) => !pageOwned.has(l))).toEqual([]);
+  });
+
+  it("finds a paraphrase of a Worker sentence (the scan is not vacuous)", () => {
+    const planted = `const a = 'Your account cannot do this yet';\nconst b = \`Try again in a ${"minute"}\`;`;
+    expect(stringLiterals(planted).filter((l) => l.trim().split(/\s+/).length >= 3)).toHaveLength(
+      2,
+    );
+  });
+
+  it("holds no string literal that words a terminal", () => {
+    // Every quote kind: a sentence in a single-quoted or template literal is a sentence too.
+    const literals = stringLiterals(SCRIPT);
+    expect(literals.length).toBeGreaterThan(40);
+    const flawed = literals.flatMap((l) => terminalFlaws(l, 1).map((f) => `${l}: ${f}`));
+    expect(flawed).toEqual([]);
+    // The panel module's words (a literal with a space in it is a sentence, not a class or a key).
+    // A class list built from two constants (`${BUTTON} ${BUTTON}--primary`) is not a sentence.
+    const classList = /^(\$\{[A-Z_]+\}(--[a-z]+)?\s?)+$/;
+    const sentences = stringLiterals(PANEL_CODE).filter((l) => /\s/.test(l) && !classList.test(l));
+    expect(sentences.length).toBeGreaterThan(3);
+    expect(sentences.flatMap((l) => terminalFlaws(l).map((f) => `${l}: ${f}`))).toEqual([]);
+  });
+
+  it("reads a terminal word in a single-quoted or a template literal", () => {
+    const planted = stringLiterals(
+      "const a = 'Run nemar dataset publish nm000701';\nconst b = `then run: nemar admin ${x}`;",
+    );
+    expect(planted).toHaveLength(2);
+    expect(planted.flatMap((l) => terminalFlaws(l, 1))).not.toEqual([]);
+  });
+});
+
+describe("the Approve body comes from the builder and nowhere else", () => {
+  it("calls dispatchPublicationApproval only with a body argument", () => {
+    const calls = callArguments(SCRIPT, "dispatchPublicationApproval");
+    expect(calls.length).toBeGreaterThan(0);
+    for (const args of calls) expect(args, args).toMatch(/\{\s*body:\s*target\.body\s*\}/);
+  });
+
+  it("computes the body with approveBody from the control stored at render time", () => {
+    expect(SCRIPT).toContain(
+      'state.control = model.approve.kind === "offered" ? model.approve : null;',
+    );
+    expect(SCRIPT).toContain("const built = approveBody(control, readInput());");
+    expect(SCRIPT).toMatch(/body:\s*built\.body/);
+  });
+
+  it("names no field of the body itself", () => {
+    expect(SCRIPT).not.toMatch(/request_id\s*:/);
+    expect(SCRIPT).not.toContain("override_publication_review");
+    expect(SCRIPT).not.toContain("acknowledge_identifier_screen");
+    expect(SCRIPT).not.toContain("JSON.stringify");
+  });
+
+  it("disables Approve until the builder says the inputs are complete, and while a call runs", () => {
+    expect(SCRIPT).toContain(
+      "approve.disabled = !approveBody(control, readInput()).ok || inFlight;",
+    );
+  });
+
+  it("refuses to queue a click that carries an incomplete body", () => {
+    expect(SCRIPT).toMatch(/if \(!built\.ok \|\| !datasetId\) return;/);
+  });
+});
+
+describe("Approve and Resume open the panel, and the typed dialog stays the last step", () => {
+  it("sends the row's Approve and Resume buttons to openFromRow, never to a dialog", () => {
+    for (const selector of ["[data-pubreq-approve]", "[data-pubreq-resume]"]) {
+      const handler = handlerOf(selector);
+      expect(handler, selector).toContain("openFromRow(btn)");
+      expect(handler, selector).not.toContain("openDialog(");
+    }
+  });
+
+  it("opens the panel from a closed row, and only moves the focus on an open one", () => {
+    const open = functionOf("openFromRow");
+    expect(open).toContain("void openPanel(panel, { focusPanel: true })");
+    expect(open).not.toContain("openDialog(");
+    expect(open).not.toContain("loadPanel(");
+    // The open panel is left alone (its typed reason survives), and that comes first.
+    expect(open).toMatch(/if \(!panel\.hidden\) return panel\.focus\(\);/);
+    expect(open.indexOf("panel.hidden")).toBeLessThan(open.indexOf("openPanel("));
+  });
+
+  it("opens the existing dialog only from the panel's own Approve button", () => {
+    const opens = [...SCRIPT.matchAll(/(?<!function )openDialog\(([^)]*)\)/g)].map((m) =>
+      m[1].trim(),
+    );
+    expect(opens.sort()).toEqual(['"admin-deny"', "control.dialogId"].sort());
+  });
+
+  it("refetches the detail on every open", () => {
+    const open = functionOf("openPanel");
+    expect(open).toContain("await loadPanel(panel, opts)");
+    expect(SCRIPT.match(/getPublicationReview\(/g)?.length).toBe(1);
+  });
+
+  it("keeps the three confirmation dialogs, with the typed word on both approvals", () => {
+    for (const id of ["admin-approve", "admin-approve-anonymous", "admin-resume", "admin-deny"]) {
+      expect(PAGE_CODE, id).toContain(`dialogId="${id}"`);
+    }
+    for (const id of ["admin-approve", "admin-approve-anonymous"]) {
+      const block = new RegExp(`<ConfirmDialog[^>]*dialogId="${id}"[^>]*>`).exec(PAGE_CODE);
+      expect(block?.[0], id).toContain('requireTyping="PUBLISH"');
+    }
+    const resume = /<ConfirmDialog[^>]*dialogId="admin-resume"[^>]*>/.exec(PAGE_CODE);
+    expect(resume?.[0]).not.toContain("requireTyping");
+  });
+
+  it("moves focus to the reason field on an acknowledge refusal", () => {
+    expect(functionOf("drawPanel")).toContain(
+      "if (opts.focusAck && area) queueMicrotask(() => area.focus());",
+    );
+  });
+
+  it("shows a refusal without a redraw through the lib's alert node, after the title", () => {
+    const set = functionOf("setPanelError");
+    expect(set).toContain("mount(errorTree(failure, location.href))");
+    expect(set).toContain('panel.querySelector("[data-pubreq-review-error]")?.remove()');
+    expect(set).toContain("title.after(node)");
+  });
+});
+
+describe("a result never lands in a hidden panel, and a second click never opens a dialog", () => {
+  it("shows a failure for a closed panel in the page's own error region", () => {
+    const report = functionOf("reportFailure");
+    expect(report).toContain("if (panel.hidden)");
+    expect(report).toContain("showError(failure.text, { refresh: failure.refreshLink })");
+    expect(report).toContain("loadPanel(");
+    expect(report).toContain("setPanelError(");
+    // The closed-panel check comes before anything is drawn.
+    expect(report.indexOf("panel.hidden")).toBeLessThan(report.indexOf("loadPanel("));
+    expect(report.indexOf("panel.hidden")).toBeLessThan(report.indexOf("setPanelError("));
+  });
+
+  it("sends every approve and start failure through it", () => {
+    expect(functionOf("afterApproveFailure")).toContain("reportFailure(");
+    expect(functionOf("startReview")).toContain("reportFailure(");
+    for (const name of ["afterApproveFailure", "startReview"]) {
+      expect(functionOf(name), name).not.toContain("setPanelError(");
+      expect(functionOf(name), name).not.toContain("loadPanel(panel, { error");
+    }
+  });
+
+  it("does not re-read a panel that was closed while a start was running", () => {
+    expect(functionOf("startReview")).toMatch(/if \(!panel\.hidden\) \{\s*await loadPanel\(/);
+  });
+
+  it("answers queue with a boolean and refuses while a call is in flight", () => {
+    const queue = functionOf("queue");
+    expect(queue).toMatch(/function queue\(next: PendingAction\): boolean/);
+    expect(queue).toMatch(/if \(inFlight\) return false/);
+    expect(queue).toMatch(/return true/);
+  });
+
+  it("opens a dialog only when queue accepted the action, and says so when it did not", () => {
+    const opens = [...SCRIPT.matchAll(/(?<!function )openDialog\(/g)];
+    expect(opens.length).toBe(2);
+    expect(SCRIPT).toMatch(
+      /const queued = queue\([\s\S]*?\);\s*if \(!queued\) return setPanelError\(panel, BUSY_FAILURE\);\s*openDialog\(control\.dialogId\)/,
+    );
+    expect(SCRIPT).toMatch(
+      /if \(!queue\(\{ kind: "deny"[^\n]*\)\) \{\s*return showError\(PANEL_WORDS\.busy\);\s*\}\s*openDialog\("admin-deny"\)/,
+    );
+  });
+
+  it("refuses a Deny during a call before it asks for a reason that would be thrown away", () => {
+    const deny = handlerOf("[data-pubreq-deny]");
+    expect(deny).toContain("if (inFlight) return showError(PANEL_WORDS.busy);");
+    expect(deny.indexOf("if (inFlight)")).toBeLessThan(deny.indexOf("window.prompt("));
+  });
+});
+
+describe("every panel's Approve is off for the length of a call", () => {
+  it("switches every panel's button off, and asks each to work out its own state afterwards", () => {
+    const busy = functionOf("setApproveBusy");
+    expect(busy).toContain(
+      'document.querySelectorAll<HTMLButtonElement>(\n      "[data-pubreq-panel-approve]",\n    )',
+    );
+    expect(busy).toContain("if (busy) button.disabled = true;");
+    expect(busy).toContain("else button.dispatchEvent(new Event(RECHECK));");
+    expect(SCRIPT).toContain("approve.addEventListener(RECHECK, refresh);");
+  });
+
+  it("is set before the call goes out, for an approval and for a denial, and lifted on a failure", () => {
+    const confirm = SCRIPT.slice(SCRIPT.indexOf('"nemar:confirm-dialog-confirm"'));
+    const approve = confirm.slice(0, confirm.indexOf('e.detail.dialogId === "admin-deny"'));
+    const deny = confirm.slice(confirm.indexOf('e.detail.dialogId === "admin-deny"'));
+    expect(approve.indexOf("setApproveBusy(true)")).toBeGreaterThan(-1);
+    expect(approve.indexOf("setApproveBusy(true)")).toBeLessThan(
+      approve.indexOf("await dispatchPublicationApproval("),
+    );
+    expect(deny.indexOf("setApproveBusy(true)")).toBeGreaterThan(-1);
+    expect(deny.indexOf("setApproveBusy(true)")).toBeLessThan(
+      deny.indexOf("await denyPublicationRequest("),
+    );
+    expect(deny).toContain("setApproveBusy(false)");
+    expect(functionOf("afterApproveFailure")).toContain("setApproveBusy(false)");
+  });
+});
+
+describe("a slow answer never overwrites a newer panel or a closed one", () => {
+  it("takes a token on every load and checks it after every await", () => {
+    const load = functionOf("loadPanel");
+    expect(load).toContain("const token = ++state.token;");
+    expect(load.match(/if \(token !== state\.token\) return;/g)).toHaveLength(2);
+    // The first check follows the read and precedes the draw; the second guards the failure path.
+    expect(load.indexOf("await getPublicationReview(")).toBeLessThan(
+      load.indexOf("if (token !== state.token) return;"),
+    );
+    expect(load.indexOf("if (token !== state.token) return;")).toBeLessThan(
+      load.indexOf("panelModel("),
+    );
+    expect(load.indexOf("} catch (err) {")).toBeLessThan(
+      load.lastIndexOf("if (token !== state.token) return;"),
+    );
+  });
+
+  it("clears aria-busy only for the load that is still current", () => {
+    expect(functionOf("loadPanel")).toContain(
+      'if (token === state.token) panel.removeAttribute("aria-busy");',
+    );
+    expect(functionOf("loadPanel")).toContain('panel.setAttribute("aria-busy", "true")');
+  });
+
+  it("closing a panel bumps the token, so an answer in flight is dropped", () => {
+    expect(functionOf("closePanel")).toContain("stateOf(panel).token++;");
+  });
+});
+
+describe("a confirmation never sends a body the panel no longer shows", () => {
+  it("drops the pending approval of a panel before it is read again, and closes its dialog", () => {
+    const load = functionOf("loadPanel");
+    expect(load).toContain("dropPendingApproval(panel);");
+    expect(load.indexOf("dropPendingApproval(panel)")).toBeLessThan(
+      load.indexOf("await getPublicationReview("),
+    );
+    const drop = functionOf("dropPendingApproval");
+    expect(drop).toContain(
+      'if (!pending || pending.kind === "deny" || pending.panel !== panel) return;',
+    );
+    expect(drop).toContain('`dialog[data-dialog-id="${pending.dialogId}"]`');
+    expect(drop).toMatch(/\?\.close\(\);\s*pending = null;/);
+    expect(functionOf("closePanel")).toContain("dropPendingApproval(panel);");
+  });
+});
+
+describe("the reason the administrator typed survives a re-read", () => {
+  it("keeps it across a refused Approve", () => {
+    const after = functionOf("afterApproveFailure");
+    expect(after).toContain(
+      'panel.querySelector<HTMLTextAreaElement>("[data-pubreq-reason]")?.value',
+    );
+    expect(after).toMatch(/reportFailure\(panel, failure, \{\s*acknowledgment: typed,/);
+    expect(functionOf("reportFailure")).toContain("loadPanel(panel, { ...extra, error: failure })");
+  });
+
+  it("keeps it across Refresh the review", () => {
+    const refresh = functionOf("wireRefresh");
+    expect(refresh).toContain('"[data-pubreq-reason]"');
+    expect(refresh).toContain("void loadPanel(panel, { acknowledgment, focusPanel: true });");
+  });
+
+  it("passes it from the load to the tree", () => {
+    expect(functionOf("loadPanel")).toMatch(/drawPanel\(panel, model,\s*\{\s*\.\.\.opts,/);
+    expect(functionOf("drawPanel")).toContain("acknowledgment: opts.acknowledgment");
+  });
+});
+
+describe("the panel is the one for the row's own request, and a fault in the drawing is not the network's", () => {
+  it("compares the model's request with the row's before drawing anything", () => {
+    const load = functionOf("loadPanel");
+    // The id compared is the lib's `PanelModel.requestId`, which is null for a detail the page
+    // cannot read (and so out of step, not stale); never the raw `detail.request_id`.
+    expect(load).toContain("const model = panelModel(detail, { rowStart: rowStartOf(panel) })");
+    expect(load).toContain("rowIsStale(model.requestId, Number(panel.dataset.requestId))");
+    expect(load).not.toContain("rowIsStale(detail.request_id");
+    expect(load).toContain("staleRowTree(datasetId, panel.id, location.href, opts.error)");
+    expect(load).toContain("drawPanel(panel, model,");
+    expect(load.indexOf("panelModel(")).toBeLessThan(load.indexOf("rowIsStale("));
+    expect(load.indexOf("rowIsStale(")).toBeLessThan(load.indexOf("staleRowTree("));
+    expect(load.indexOf("staleRowTree(")).toBeLessThan(load.indexOf("drawPanel("));
+  });
+
+  it("wraps the model and the drawing in their own try, logs, and words it as out of step", () => {
+    const load = functionOf("loadPanel");
+    expect(load).toMatch(
+      /const detail = await getPublicationReview\(datasetId\);[\s\S]*?try \{[\s\S]*?panelModel\([\s\S]*?\} catch \(drawErr\) \{\s*console\.error\("\[admin\] the review panel could not be drawn", drawErr\);[\s\S]*?failureTree\(DRAW_FAILURE,/,
+    );
+    // The outer catch is the call's own failure and keeps the network wording.
+    expect(load).toContain('describeFailure("detail", err)');
+  });
+
+  it("hands the failure that asked for the re-read to every outcome of the re-read", () => {
+    const load = functionOf("loadPanel");
+    expect(load).toContain(
+      "failureTree(DRAW_FAILURE, datasetId, panel.id, location.href, opts.error)",
+    );
+    expect(load).toMatch(
+      /failureTree\(\s*describeFailure\("detail", err\),\s*datasetId,\s*panel\.id,\s*location\.href,\s*opts\.error,?\s*\)/,
+    );
+    // The drawn outcome carries it through `...opts` into the panel tree's `error`.
+    expect(load).toMatch(/drawPanel\(panel, model, \{\s*\.\.\.opts,/);
+    expect(functionOf("drawPanel")).toContain("error: opts.error");
+  });
+
+  it("leaves no control wired after a fault", () => {
+    expect(functionOf("loadPanel")).toMatch(/console\.error\([^)]*\);\s*state\.control = null;/);
+  });
+});
+
+describe("focus follows a redraw, and a notice is announced", () => {
+  it("takes the focus back after a redraw when the panel held it or the caller asked", () => {
+    expect(functionOf("loadPanel")).toContain(
+      "const focusPanel = opts.focusPanel === true || panel.contains(document.activeElement);",
+    );
+  });
+
+  it("puts the focus on the panel after a failure that is not redrawn", () => {
+    expect(functionOf("reportFailure")).toMatch(
+      /setPanelError\(panel, failure\);\s*if \(extra\.focusPanel\) panel\.focus\(\);/,
+    );
+  });
+
+  it("asks for the focus after a refused Approve, a started review and a failed start", () => {
+    expect(functionOf("afterApproveFailure")).toContain("focusPanel: true,");
+    const start = functionOf("startReview");
+    expect(start).toContain("describeStartSuccess(started), focusPanel: true");
+    expect(start).toContain('describeFailure("start", err), { focusPanel: true }');
+  });
+
+  it("announces the notice through a status region that exists before the words do", () => {
+    expect(functionOf("drawPanel")).toContain("announce(panel, opts.notice);");
+    const announce = functionOf("announce");
+    expect(announce).toContain('"[data-pubreq-review-live]"');
+    expect(announce.indexOf('live.textContent = ""')).toBeLessThan(
+      announce.indexOf("window.setTimeout("),
+    );
+    expect(announce).toContain("live.textContent = words");
+    expect(functionOf("closePanel")).toContain("announce(panel, null);");
+    expect(functionOf("loadPanel")).toContain("announce(panel, null);");
+  });
+
+  it("cancels a pending announcement when a later announce or a close supersedes it", () => {
+    // The words are set after a pause so the region is announced as a change. A later
+    // `announce(panel, null)` (a re-read, or `closePanel`) must cancel that pause, or the notice
+    // of a panel that has been closed or redrawn appears after the fact.
+    const announce = functionOf("announce");
+    expect(SCRIPT).toMatch(/const announcing = new WeakMap<HTMLElement, number>\(\);/);
+    const clear = announce.indexOf("window.clearTimeout(announcing.get(live))");
+    expect(clear, "announce cancels the pending timer").toBeGreaterThan(-1);
+    // Before the empty-words early path and before the new timer is set, so null cancels too.
+    expect(clear).toBeLessThan(announce.indexOf('live.textContent = ""'));
+    expect(clear).toBeLessThan(announce.indexOf("window.setTimeout("));
+    expect(announce).toMatch(/announcing\.set\(\s*live,\s*window\.setTimeout\(/);
+    expect(announce).toContain("announcing.delete(live)");
+    // `announce(panel, null)` is how closePanel and loadPanel reach it.
+    expect(functionOf("closePanel")).toContain("announce(panel, null);");
+    expect(functionOf("loadPanel")).toContain("announce(panel, null);");
+  });
+
+  it("names the panel after its heading, and the toggle after its row", () => {
+    expect(ROW_CODE).toMatch(/aria-labelledby=\{titleIdOf\(panelId\)\}/);
+    expect(ROW_CODE).toMatch(
+      /<p class="pubreq-review__live" role="status" data-pubreq-review-live>/,
+    );
+    expect(ROW_CODE).toContain("aria-label={toggle.ariaLabel}");
+    expect(ROW_CODE).toContain("aria-expanded={toggle.expanded}");
+    const toggle = functionOf("setToggle");
+    expect(toggle).toContain('toggleLabels(open, panel.dataset.datasetId ?? "")');
+    expect(toggle).toContain('toggle.setAttribute("aria-label", labels.ariaLabel)');
+    // The visible word is constant, so the script never rewrites it: only aria-expanded moves.
+    expect(toggle).not.toContain("textContent");
+    expect(toggle).not.toContain("labels.text");
+    expect(toggle).toContain('toggle.setAttribute("aria-expanded", labels.expanded)');
+  });
+});
+
+describe("a denial names its request", () => {
+  it("passes requestId on every denyPublicationRequest call", () => {
+    const calls = callArguments(SCRIPT, "denyPublicationRequest");
+    expect(calls.length).toBeGreaterThan(0);
+    for (const args of calls) expect(args, args).toMatch(/\brequestId\b/);
+  });
+
+  it("reads the request id from the button and bounds the reason", () => {
+    expect(handlerOf("[data-pubreq-deny]")).toContain("dataset.requestId");
+    expect(SCRIPT).toMatch(/\.length\s*>\s*DENIAL_MAX/);
+  });
+});
+
+describe("the quiet auto-refresh never runs over an open panel, and the note says so", () => {
+  it("names the visible panel in the quiet test", () => {
+    const quiet = /const quiet =[\s\S]*?;\n/.exec(SCRIPT);
+    expect(quiet, "no quiet test").not.toBeNull();
+    expect(quiet?.[0]).toContain("[data-pubreq-review-panel]:not([hidden])");
+  });
+
+  it("swaps the note's words while a panel is open, and back when none is", () => {
+    const sync = functionOf("syncRefreshNote");
+    expect(sync).toContain(
+      'document.querySelector("[data-pubreq-review-panel]:not([hidden])") !== null',
+    );
+    expect(sync).toContain("open ? PANEL_WORDS.refreshPaused : runningNoteWords");
+    expect(functionOf("openPanel")).toContain("syncRefreshNote();");
+    expect(functionOf("closePanel")).toContain("syncRefreshNote();");
+    expect(PAGE_CODE).toMatch(
+      /<span data-refresh-note-text>[^<]*refreshes every 20 seconds[^<]*<\/span>/,
+    );
+  });
+});
+
+describe("text reaches the DOM only as text", () => {
+  it.each([
+    ["the page", PAGE_CODE],
+    ["the row", ROW_CODE],
+    ["the panel module", PANEL_CODE],
+  ])("%s builds no markup from a string", (_name, src) => {
+    expect(src).not.toMatch(/innerHTML|insertAdjacentHTML|outerHTML|set:html/);
+  });
+
+  it.each([
+    ["the script", SCRIPT],
+    // The row's one existing `.command` is the terminal hint of a backend that cannot dispatch an
+    // approval (`rowView().terminal`), not a field of the review detail; nothing else may read one.
+    ["the row", ROW_CODE.replace("view.terminal.command", "")],
+    ["the panel module", PANEL_CODE],
+  ])("%s never reads a field the Worker words for a terminal", (_name, src) => {
+    expect(src).not.toMatch(/\.line\b/);
+    expect(src).not.toMatch(/\.command\b/);
+    expect(src).not.toMatch(/\.next\b/);
+    expect(src).not.toMatch(/\[\s*["'](line|command|next)["']\s*\]/);
+    expect(src).not.toMatch(/description\.lines/);
+  });
+
+  it.each([
+    ["the script", SCRIPT],
+    ["the row", ROW_CODE],
+    ["the panel module", PANEL_CODE],
+  ])("%s never computes a verdict", (_name, src) => {
+    expect(src).not.toMatch(/outcome\s*[!=]==?/);
+  });
+});
+
+describe("the row", () => {
+  it("draws the chips from rowChips and decides nothing", () => {
+    expect(ROW_CODE).toContain("rowChips(");
+    expect(ROW_CODE).toContain("data-pubreq-review-chip");
+    expect(ROW_CODE).toContain("data-pubreq-screen-chip");
+    for (const tone of ["ok", "note", "warn", "stop"]) {
+      expect(ROW_CODE, tone).toContain(`.pubreq-chip--${tone}`);
+    }
+  });
+
+  it("carries the panel and its toggle, closed, for an active request", () => {
+    expect(ROW_CODE).toContain("data-pubreq-review-toggle");
+    expect(ROW_CODE).toContain("data-pubreq-review-panel");
+    expect(ROW_CODE).toContain("aria-controls");
+    expect(ROW_CODE).toMatch(/<section[^>]*data-pubreq-review-panel[^>]*\shidden[\s>]/);
+  });
+
+  it("hands the script the request, the row's own start and its label", () => {
+    expect(ROW_CODE).toContain("data-request-id={request.id}");
+    expect(ROW_CODE).toContain("data-row-start");
+    expect(ROW_CODE).toContain("data-row-label");
+    const buttons = ROW_CODE.match(/<button[\s\S]*?>/g) ?? [];
+    for (const attr of ["data-pubreq-approve", "data-pubreq-resume", "data-pubreq-deny"]) {
+      const tag = buttons.find((b) => b.includes(attr));
+      expect(tag, attr).toBeDefined();
+      expect(tag, attr).toContain("data-request-id");
+    }
+  });
+
+  it("takes the active statuses from the lib and keeps no list of its own", () => {
+    expect(ROW_CODE).toMatch(
+      /import\s*\{[^}]*\bACTIVE_STATUSES\b[^}]*\}\s*from\s*"\.\.\/lib\/publication-review"/,
+    );
+    expect(ROW_CODE).toContain("ACTIVE_STATUSES.includes(request.status)");
+    // A second list of the three words is how the row and the lib drift apart.
+    expect(ROW_CODE).not.toMatch(/\[\s*"requested"\s*,\s*"approving"\s*,\s*"blocked"\s*\]/);
+    expect(ROW_CODE).not.toContain("REVIEWABLE");
+  });
+
+  it("labels the toggle from the panel module's own words", () => {
+    expect(ROW_CODE).toContain("toggleLabels(false, datasetId)");
+    expect(ROW_CODE).toContain("{toggle.text}");
+  });
+});
+
+describe("the page loads the panel's stylesheet", () => {
+  it("imports it in the frontmatter", () => {
+    const frontmatter = /^---\n([\s\S]*?)\n---/.exec(PAGE)?.[1] ?? "";
+    expect(frontmatter).toContain('import "../../styles/publication-review-panel.css"');
+  });
+});
+
+describe("the panel's stylesheet", () => {
+  const css = code(STYLES);
+
+  it("uses tokens for every color and defines no palette of its own", () => {
+    expect(css).not.toMatch(/#[0-9a-fA-F]{3,8}\b/);
+    expect(css).not.toMatch(/\brgba?\(|\bhsla?\(/);
+    expect(css).not.toMatch(/:\s*(white|black|red|green|blue|gray|grey)\b/);
+  });
+
+  it("uses only custom properties the tokens define", () => {
+    const own = new Set([...css.matchAll(/(--[a-z0-9-]+)\s*:/g)].map((m) => m[1]));
+    const used = [...css.matchAll(/var\((--[a-z0-9-]+)/g)].map((m) => m[1]);
+    expect(used.length).toBeGreaterThan(10);
+    const unknown = used.filter((name) => !own.has(name) && !TOKENS.includes(`${name}:`));
+    expect([...new Set(unknown)]).toEqual([]);
+  });
+
+  it("follows the theme through tokens alone, with no dark rule of its own", () => {
+    expect(css).not.toContain("prefers-color-scheme");
+    expect(css).not.toContain("data-theme");
+  });
+
+  it("styles each tone the panel module can draw, and each class it gives a node", () => {
+    for (const tone of ["ok", "note", "warn", "stop"]) {
+      expect(PANEL_CODE, tone).toContain(`pubreq-review-tone--${tone}`);
+      expect(css, tone).toContain(`.pubreq-review-tone--${tone}`);
+    }
+    const classes = new Set(
+      [...PANEL_CODE.matchAll(/"(pubreq-review__[a-z-]+)"/g)].map((m) => m[1]),
+    );
+    expect(classes.size).toBeGreaterThan(8);
+    for (const name of classes) expect(css, name).toContain(`.${name}`);
+    expect(css).toContain(".pubreq-review__live");
+  });
+
+  it("draws the toggle's open or closed state from aria-expanded, in forced colors too", () => {
+    expect(ROW_CODE).toMatch(/class="pubreq-row__btn pubreq-review-toggle"/);
+    expect(css).toMatch(/\.pubreq-review-toggle::after\s*\{/);
+    expect(css).toMatch(/\.pubreq-review-toggle\[aria-expanded="true"\]::after\s*\{/);
+    // A shape drawn from borders, never a glyph or an emoji, and never read aloud.
+    const forced = /@media \(forced-colors: active\)\s*\{[\s\S]*$/.exec(css)?.[0] ?? "";
+    expect(forced).toContain(".pubreq-review-toggle::after");
+    expect(forced).toContain("ButtonText");
+  });
+
+  it("has a forced-colors fallback, a visible focus ring and a narrow wrap", () => {
+    expect(css).toContain("@media (forced-colors: active)");
+    expect(css).toContain(":focus-visible");
+    expect(css).toContain("overflow-wrap: anywhere");
+    expect(css).toMatch(/@media \(max-width: 640px\)/);
+  });
+
+  it("scopes every rule under the panel's own prefix", () => {
+    // Every prelude before a `{`, at any depth: the first selector inside an @media block follows
+    // a `{`, not a `}`, so a scan that starts a selector after `}` never sees it. A prelude that
+    // starts with `@` is an at-rule's own condition (`@media (...)`), not a selector.
+    const preludes = [...css.replace(/\/\*[\s\S]*?\*\//g, "").matchAll(/([^{};]+)\{/g)].map((m) =>
+      m[1].trim(),
+    );
+    const selectors = preludes.filter((p) => !p.startsWith("@")).flatMap((p) => p.split(","));
+    expect(selectors.length).toBeGreaterThan(20);
+    const stray = selectors.map((s) => s.trim()).filter((s) => s && !/\.pubreq-review/.test(s));
+    expect(stray).toEqual([]);
+    // Each @media block is read, and its first selector is among those checked.
+    const mediaBlocks = [...css.matchAll(/@media[^{]*\{\s*([^{}]+)\{/g)].map((m) => m[1].trim());
+    expect(mediaBlocks.length).toBeGreaterThanOrEqual(2);
+    for (const first of mediaBlocks) expect(first, first).toMatch(/\.pubreq-review/);
+  });
+});
+
+describe("the shared confirm dialog never confirms from a stale returnValue", () => {
+  // An Escape close leaves `returnValue` alone, so a value left by an earlier confirm would make the
+  // next Escape fire the confirm event again: resume and deny need no typing, so Escape alone would
+  // send them. The value is cleared before the dialog opens and again when it closes.
+  const dialogScript = (/<script>([\s\S]*?)<\/script>/.exec(CONFIRM_DIALOG)?.[1] ?? "").replace(
+    /\/\/.*$/gm,
+    "",
+  );
+  const closeHandler = /dialog\.addEventListener\("close", \(\) => \{([\s\S]*?)\n {4}\}\);/.exec(
+    dialogScript,
+  )?.[1];
+
+  it("finds the open and close handlers (the pins below are not vacuous)", () => {
+    expect(dialogScript).toContain("dialog.showModal()");
+    expect(closeHandler, "no close handler").toBeDefined();
+  });
+
+  it("clears returnValue before showModal()", () => {
+    const clear = dialogScript.indexOf('dialog.returnValue = ""');
+    const show = dialogScript.indexOf("dialog.showModal()");
+    expect(clear).toBeGreaterThan(-1);
+    expect(clear).toBeLessThan(show);
+  });
+
+  it("clears returnValue again after the close handler has read it", () => {
+    const body = closeHandler ?? "";
+    const read = body.indexOf('dialog.returnValue === "confirm"');
+    const clear = body.lastIndexOf('dialog.returnValue = ""');
+    expect(read).toBeGreaterThan(-1);
+    expect(clear).toBeGreaterThan(read);
+  });
+});
diff --git a/test/publication-review-web-words.test.ts b/test/publication-review-web-words.test.ts
new file mode 100644
index 0000000..8b743d0
--- /dev/null
+++ b/test/publication-review-web-words.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+import { terminalFlaws } from "./publication-review-web-words";
+
+describe("terminalFlaws tier 1 (what only a terminal can act on)", () => {
+  it("flags a nemar command", () => {
+    expect(terminalFlaws("Run nemar admin publish start nm000123 now.", 1)).toContain(
+      "a nemar command",
+    );
+    expect(terminalFlaws("nemar admin pr-reviews", 1)).toContain("a nemar command");
+  });
+
+  it("flags a flag", () => {
+    expect(terminalFlaws("Approve anyway (--force).", 1)).toContain("a flag");
+  });
+
+  it("flags a placeholder", () => {
+    expect(terminalFlaws("Open <dataset> first.", 1)).toContain("a placeholder");
+  });
+
+  it("flags a backtick", () => {
+    expect(terminalFlaws("Open `main` first.", 1)).toContain("a backtick");
+  });
+
+  it("passes the platform name NEMAR and plain prose", () => {
+    expect(terminalFlaws("NEMAR has a release of it", 1)).toEqual([]);
+    expect(terminalFlaws("Nothing here names a terminal.", 1)).toEqual([]);
+  });
+
+  it("does not apply the tier 2 words", () => {
+    expect(terminalFlaws("from a terminal, the command, the CLI", 1)).toEqual([]);
+  });
+});
+
+describe("terminalFlaws tier 2 (words that point at a terminal)", () => {
+  it("is the default tier and flags terminal, command and CLI", () => {
+    expect(terminalFlaws("from a terminal")).toContain("the word terminal");
+    expect(terminalFlaws("Run the command")).toContain("the word command");
+    expect(terminalFlaws("Use the CLI")).toContain("the word CLI");
+  });
+
+  it("applies tier 1 as well", () => {
+    expect(terminalFlaws("nemar admin docs (--force)", 2)).toEqual(
+      expect.arrayContaining(["a nemar command", "a flag"]),
+    );
+  });
+
+  it("passes NEMAR and words that merely contain a flagged one", () => {
+    expect(terminalFlaws("NEMAR has a release of it")).toEqual([]);
+    expect(terminalFlaws("A commander and a client climbed.")).toEqual([]);
+  });
+});
diff --git a/test/publication-review-web-words.ts b/test/publication-review-web-words.ts
new file mode 100644
index 0000000..1df6982
--- /dev/null
+++ b/test/publication-review-web-words.ts
@@ -0,0 +1,39 @@
+/**
+ * What a web page must not print: the words only a terminal can act on, and the words that point
+ * at one (nemar-cli ADR 0102, section 8; Phase 4 of epic nemarOrg/nemar-cli#1726; website#459).
+ *
+ * **This is a comment-marked COPY of nemar-cli `test/helpers/terminal-words.ts`.** The two
+ * repositories share no package, so the list is transcribed; keep the two in step when either
+ * changes. The self-test is `test/publication-review-web-words.test.ts`.
+ *
+ * Not a `.test.ts` file on purpose: vitest collects only `*.test.ts`, and Biome's
+ * `noExportsInTest` forbids exporting from one (the arrangement `test/copy-drift.ts` has).
+ *
+ * `nemar ` is case-sensitive and needs a lowercase letter after it: the platform is written NEMAR
+ * in a reason's sentence and in the identifier screen's date warning, and neither names a command.
+ */
+
+/** Tier 1: what only a terminal can act on. Applies to every string a page prints. */
+const TIER1: ReadonlyArray<[string, RegExp]> = [
+  ["a nemar command", /(^|[^A-Za-z])nemar [a-z]/],
+  ["a flag", /--[a-z]/],
+  ["a placeholder", /<[a-z_]+>/],
+  ["a backtick", /`/],
+];
+
+/**
+ * Tier 2: words that point at a terminal. Applies to reason sentences, cures, statements,
+ * headlines, screen lines, the copy table and the page's own words; not to a sentence that only
+ * names "the command line tool", which describes it and tells nobody to type anything.
+ */
+const TIER2: ReadonlyArray<[string, RegExp]> = [
+  ["the word terminal", /\bterminal\b/i],
+  ["the word command", /\bcommand\b/i],
+  ["the word CLI", /\bCLI\b/],
+];
+
+/** The names of the rules `text` breaks: tier 1 alone, or tiers 1 and 2 (the default). */
+export function terminalFlaws(text: string, tier: 1 | 2 = 2): string[] {
+  const rules = tier === 1 ? TIER1 : [...TIER1, ...TIER2];
+  return rules.filter(([, pattern]) => pattern.test(text)).map(([name]) => name);
+}
diff --git a/test/publish-block-reason.test.ts b/test/publish-block-reason.test.ts
index 195c02a..17d8784 100644
--- a/test/publish-block-reason.test.ts
+++ b/test/publish-block-reason.test.ts
@@ -15,6 +15,23 @@ import MY_DATASET_CARD from "../src/components/MyDatasetCard.astro?raw";
 import PUBLISH_STATE_BADGE from "../src/components/PublishStateBadge.astro?raw";
 import { PUBLICATION_BLOCK_REASONS, blockBadgeState } from "../src/lib/publication-block";
 
+/**
+ * The tokens, read from disk: Vitest blanks every stylesheet it imports, `?raw` included, and
+ * `astro check` has no node types, so `node:fs` is reached without a static import (the same escape
+ * hatch as `test/publication-review-page.test.ts`).
+ */
+async function readTokens(): Promise<string> {
+  const specifier = "node:fs";
+  const fs: { readFileSync(path: string, encoding: string): string } = await import(
+    /* @vite-ignore */ specifier
+  );
+  return fs.readFileSync(
+    decodeURIComponent(new URL("../src/styles/tokens.css", import.meta.url).pathname),
+    "utf8",
+  );
+}
+const TOKENS = await readTokens();
+
 describe("PublishStateBadge labels every block state", () => {
   it("carries a label for each state the block reasons map to", () => {
     expect(PUBLISH_STATE_BADGE).toContain('validation_failed: "Validation failed"');
@@ -22,9 +39,47 @@ describe("PublishStateBadge labels every block state", () => {
     // badge says to wait, and the two must not disagree.
     expect(PUBLISH_STATE_BADGE).toContain('validation_pending: "Validation pending"');
     expect(PUBLISH_STATE_BADGE).toContain('name_required: "Name required"');
+    expect(PUBLISH_STATE_BADGE).toContain('identifiers_found: "Identifiers found"');
     expect(PUBLISH_STATE_BADGE).toContain('blocked: "Blocked"');
   });
 
+  it("styles identifiers_found in the danger family, not the amber one", () => {
+    // The dataset itself holds the identifier and CI is not pending, so this
+    // is neither the amber "wait" nor the amber "fix your account" tone.
+    const rule = PUBLISH_STATE_BADGE.match(
+      /\.publish-state-badge--identifiers_found \{([^}]*)\}/,
+    )?.[1];
+    expect(rule).toBeDefined();
+    expect(rule).toContain("var(--color-danger)");
+    expect(rule).not.toContain("var(--color-warning)");
+  });
+
+  it("lifts its text in both dark theme branches, because --color-danger has no dark value", () => {
+    // `--color-danger` (#b91c1c) is the same in every theme: about 2.5:1 on the dark card, well
+    // under the 4.5:1 that 12 px text needs. The admin error text token has a lifted dark value
+    // (about 8.6:1 on the same card), so the dark rules use it. Both branches are required: the
+    // media query for the operating system's default and the attribute for an explicit choice.
+    expect(TOKENS).toMatch(/--admin-error-text:\s*#b91c1c/);
+    const values = [...TOKENS.matchAll(/--admin-error-text:\s*(#[0-9a-f]{6})/g)].map((m) => m[1]);
+    expect(values, "one light value and one per dark branch").toHaveLength(3);
+    const [light, ...dark] = values;
+    expect(light).toBe("#b91c1c");
+    for (const value of dark) {
+      expect(value, "a dark branch that repeats the light value lifts nothing").not.toBe(light);
+    }
+    expect(dark[0], "the two dark branches say one colour").toBe(dark[1]);
+    const media = PUBLISH_STATE_BADGE.match(
+      /@media \(prefers-color-scheme: dark\) \{\s*:global\(:root:not\(\[data-theme="light"\]\)\) \.publish-state-badge--identifiers_found \{([^}]*)\}/,
+    )?.[1];
+    const attribute = PUBLISH_STATE_BADGE.match(
+      /:global\(:root\[data-theme="dark"\]\) \.publish-state-badge--identifiers_found \{([^}]*)\}/,
+    )?.[1];
+    for (const rule of [media, attribute]) {
+      expect(rule).toBeDefined();
+      expect(rule).toMatch(/color:\s*var\(--admin-error-text\)/);
+    }
+  });
+
   it("styles each of them, so a new state cannot land unstyled", () => {
     // A missing rule renders as the neutral base pill, which reads as
     // "Draft" — the one state a blocked dataset must not look like.