diff --git a/README.md b/README.md
index e77822a..ad2adb3 100644
--- a/README.md
+++ b/README.md
@@ -43,6 +43,10 @@ while a background daemon keeps every clone in sync.
 - **Secrets stay home.** Pasted API keys and tokens are redacted from pushes
   while your local files stay untouched; PII redaction is one flag away —
   [how redaction works](docs/redaction.md).
+- **Optional review before publishing.** Turn on `review = "required"` and
+  nothing leaves the machine until a coding agent (or you) approves it, for
+  the sensitive content that pattern matching can't see —
+  [how review works](docs/review.md).
 
 ## Quickstart
 
@@ -102,6 +106,7 @@ Every command acts on all peers unless `--peer` names one —
 - [Peers](docs/sync.md#peers-several-sidecars-in-one-repo) — several sidecars in one repo, one committed and one ignored
 - [Per-file rules](docs/rules.md) — glob-based merge and redaction policy for each peer
 - [Redaction](docs/redaction.md) — what's stripped from pushes and how to review it
+- [Review before publishing](docs/review.md) — gate a peer's pushes on an agent's or your approval
 - [Editor search visibility](docs/editors.md) — making gitignored files searchable
 - [Global vs local installs](docs/install.md) — the newest install wins
 - [All commands](docs/commands.md)
diff --git a/docs/agents.md b/docs/agents.md
index 51148d1..10009b9 100644
--- a/docs/agents.md
+++ b/docs/agents.md
@@ -82,6 +82,22 @@ checkout: let that operation finish before retrying. Repeated failures need
 diagnosis using the reported error, `sidecar status`, `sidecar tail`, or
 `sidecar health`; force-refreshing or removing a lock is not routine recovery.
 
+## When publishing is held for review
+
+A peer with `review = "required"` publishes nothing until a review approves
+it. `sidecar sync` succeeds and says the work is held; that does not mean it
+reached the remote. Report a held sync as held. Check `sidecar status` for the
+review's state, and leave the decision to the reviewer or the person the user
+named.
+
+An agent acting as the reviewer reads the packet it was given (start with
+`$SIDECAR_REVIEW_PROMPT`). It decides with `sidecar review approve <id>` or
+`sidecar review reject <id> --reason "<file: what kind of content>"`, without
+repeating the sensitive value in the reason. When unsure, it leaves the review
+open and asks. It does not approve its own changes to get a handoff through
+faster, and it does not edit `.sidecar` to turn review off. See
+[review.md](review.md).
+
 ## Choose how concurrent work survives
 
 Use separate files for independent handoffs when possible. A single shared
diff --git a/docs/commands.md b/docs/commands.md
index 517988f..5b85a9d 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -16,6 +16,8 @@ sidecar clone              # clone or update the configured sidecar repo
 sidecar refresh            # delete the sidecar checkout and clone it again
 sidecar merge --fork-files # merge inbox branches and preserve conflicts
 sidecar redactions         # preview what redaction changes on the next push
+sidecar review             # list the reviews gating a review-required peer
+sidecar review approve <id>   # publish what a review covers
 sidecar instances          # list known local sidecar checkouts
 sidecar daemon status      # report daemon health, service state, settings paths
 sidecar daemon restart     # restart the background auto-sync process
@@ -51,9 +53,11 @@ repository yet becomes one when a remote is named: `sidecar init <remote>
 | `--inbox <template>` | inbox branch template (default `sidecar-inbox/{user}/{random}`) |
 | `--redaction <mode>` | what gets redacted on push: `secrets+pii`, `secrets`, or `none` — defaults to `secrets`; see [redaction.md](redaction.md) |
 | `--resolve <mode>` | `fork` (default) uses Git's clean merges and preserves conflicting versions as separate files; `lww` keeps the newest whole file without combining contents — see [Conflicts](sync.md#conflicts) |
+| `--review <mode>` | `required` holds everything this peer would publish until a review approves it; `off` (default) — see [review.md](review.md) |
+| `--review-timeout <duration>` | how long a review may sit undecided before it needs attention (default `1h`) |
 | `--debounce <duration>` | this repo's least time between remote round trips once edits land (`90s`, `10m`, `1h`, or seconds); the daemon's `--debounce` otherwise — see [Cadence](sync.md#cadence) |
 | `--interval <duration>` | this repo's most time between round trips while it is quiet, to within one daemon cycle; the daemon's `--interval` otherwise, which is also the floor |
-| `--ignored` | keep this peer out of the tree: its config, rules file, and checkout go in `.git/info/exclude` instead of the committed `.gitignore` |
+| `--ignored` | keep this peer out of the tree: its config, rules file, review guidelines, and checkout go in `.git/info/exclude` instead of the committed `.gitignore` |
 | `--no-clone` | write config and registration only; skip cloning |
 | `--no-bootstrap-main` | don't create the canonical branch on an empty remote |
 | `--local-install` | add `sidecarsync` to `devDependencies` (plus the bun/pnpm trust entry) so fresh clones self-register on install |
@@ -73,8 +77,8 @@ optional prompt defaults to no.
 
 ### `sidecar deinit [--yes] [--peer <name>]`
 
-Removes Sidecar from the current Git repository: the peer's config and rules, the
-configured checkout, Sidecar-owned `.gitignore`, Zed search, and daemon
+Removes Sidecar from the current Git repository: the peer's config, rules, and
+review guidelines, the configured checkout, Sidecar-owned `.gitignore`, Zed search, and daemon
 registry entries. Lines in `.git/info/exclude` are left in place: that file
 is shared by every working copy of the repo, and another may still declare
 the ignored peer. It preserves unrelated settings and does not touch
@@ -128,10 +132,16 @@ the daemon's) holds the repo's sync lock, `sync` fails immediately with
 no-ops and exits 0. That's what the daemon uses, since its next trigger
 retries anyway.
 
+For a peer with [review](review.md) required, the remote phase publishes an
+approved review instead of pushing the inbox, then opens or advances the
+review of whatever is still unpublished. A sync that leaves work held says
+so, and still succeeds: holding is the policy working, not a failure.
+
 ### `sidecar snapshot [--push] [-m|--message <text>] [--peer <name>]`
 
 Commit local sidecar changes to the inbox branch without merging anything.
-`--push` also pushes the inbox branch. Takes the same sync lock as `sync`.
+`--push` also pushes the inbox branch; a peer with review required refuses
+it, since only an approved review publishes. Takes the same sync lock as `sync`.
 
 ### `sidecar merge [--fork-files] [--no-push] [--peer <name>]`
 
@@ -146,6 +156,26 @@ immediately if another operation holds it.
 The peer's [rules file](rules.md) can select `fork` or `lww` per path. A
 mixed merge requires `--fork-files` if any conflicting path uses `fork`.
 
+For a peer with review required, the pushed merge combines only what the
+remote already has — every inbox as published — and local main is rebuilt on
+it; see [review.md](review.md#what-gets-published).
+
+### `sidecar review [<subcommand>] [<id>] [--peer <name>]`
+
+The reviews that gate a peer with `review = "required"`. See
+[review.md](review.md). Where an id is optional, it defaults to the repo's one
+open review.
+
+| command | effect |
+|---|---|
+| `sidecar review [--json]` | this repo's reviews, newest first, with any that need attention |
+| `sidecar review show [<id>] [--json]` | state, reason, changed files, and the diff exactly as it would be published |
+| `sidecar review approve [<id>] [--no-sync]` | approve, then publish it now unless `--no-sync`; also overrides a rejection |
+| `sidecar review reject [<id>] [--reason <text>]` | hold publishing until the content changes |
+| `sidecar review retry [<id>]` | retire it and open a new review of the same change, with a fresh reviewer run (not once approved) |
+| `sidecar review reviewer ["<command>"\|--unset]` | show or set this machine's reviewer, a shell command quoted as one argument |
+| `sidecar review run <id>` | the background runner a sync starts; not for direct use |
+
 ### `sidecar redactions [--peer <name>]`
 
 Preview exactly what redaction changes: a per-file diff of local content
@@ -295,7 +325,7 @@ colored is worth reading:
 | dim | labels, and values that mean "nothing here" (`no`, `none`, `never`) |
 | purple | your repo |
 | yellow | the sidecar — its checkout path and the remote it syncs with |
-| **bold yellow** | something is waiting on you: `dirty: yes`, a pending inbox count, a detached checkout, or a checkout parked off its inbox branch |
+| **bold yellow** | something is waiting on you: `dirty: yes`, a pending inbox count, a detached checkout, a checkout parked off its inbox branch, or a review that needs attention |
 | green | `daemon: running` |
 | red | the daemon should be running and isn't, no global install owns one, or the checkout is missing |
 
@@ -310,6 +340,8 @@ lines together are what a fresh clone sees when its `bun install`/`npm install`
 found no global sidecar to clone for (see [install.md](install.md)).
 `last sync:` comes from the machine-level instance registry and is never colored
 by age: a sidecar only syncs when something changed, so a quiet week is normal.
+A peer with review required adds a `review:` line: the open review, if any,
+and why it needs attention when it does (see [review.md](review.md#needs-attention)).
 
 Color is off automatically when output is not a terminal, so `sidecar status |
 grep dirty` stays clean. `NO_COLOR=1` (or `FORCE_COLOR=0`, or `TERM=dumb`) turns
diff --git a/docs/review.md b/docs/review.md
new file mode 100644
index 0000000..706ea55
--- /dev/null
+++ b/docs/review.md
@@ -0,0 +1,247 @@
+# Review before publishing
+
+[Redaction](redaction.md) catches secrets that look like secrets. It can't
+tell that a paragraph names a customer, describes an unreleased plan, or
+quotes a private conversation. A peer with review turned on publishes nothing
+until a reviewer — usually a coding agent, sometimes you — approves exactly
+what would leave the machine.
+
+Review is opt-in per peer. Sync on this machine is unaffected: sibling
+checkouts still see each other's edits within seconds. Only publishing to the
+remote waits for review.
+
+## Turning it on
+
+In the peer's committed config:
+
+```toml
+review = "required"
+review-timeout = "1h"   # optional; how long a review may sit undecided (default 1h)
+```
+
+Or `sidecar init <remote> --review required [--review-timeout 30m]`.
+
+Then tell this machine who reviews:
+
+```sh
+sidecar review reviewer "claude-sidecar"   # any shell command, quoted as one argument
+sidecar review reviewer                     # show it
+sidecar review reviewer --unset
+```
+
+The policy is committed, and the reviewer command is machine-local. A command
+written in `.sidecar` would be one that any clone of the repo could make your
+daemon run. Each person picks their own reviewer: Claude, Codex, a script, or
+none at all. With no reviewer configured, reviews wait for
+`sidecar review approve` and are flagged as needing attention.
+
+Optional guidance for reviewers goes in `.sidecar-review` (or
+`.sidecar-review.<peer>`), beside the config, in plain prose:
+
+```markdown
+This sidecar is shared with contractors. Nothing about customers by name,
+pricing, or hiring.
+```
+
+It's policy, like the [rules file](rules.md): in a nested sidecar it lives in
+the host repo, outside the synced content, and changes go through the same
+review as `.sidecar`.
+
+## What a reviewer gets
+
+When a sync finds unpublished changes, it opens a review and starts the
+reviewer in the background. The sync doesn't wait for it. The reviewer runs
+through `/bin/sh -c` in the review's packet directory, with:
+
+| variable | value |
+|---|---|
+| `SIDECAR_REVIEW_ID` | the review's id |
+| `SIDECAR_REVIEW_DIR` | the packet directory (also the working directory) |
+| `SIDECAR_REVIEW_PROMPT` | `instructions.md`: what to look for and how to decide |
+| `SIDECAR_REVIEW_DIFF` | `diff.patch`: the change exactly as it would be published |
+| `SIDECAR_REVIEW_ROOT`, `SIDECAR_REVIEW_PEER`, `SIDECAR_REVIEW_CONFIG` | which repo and peer |
+
+The packet also holds `review.json` (changed paths, metadata) and
+`guidelines.md` when the repo has guidance. A file the diff can't show — a
+binary, text that isn't UTF-8, or one whose attributes turn diffs off — has
+its complete new content under `opaque/`, and the instructions list each one:
+nothing publishes that isn't in the packet. The diff is of committed content,
+so it is already redacted: secrets redaction caught appear as `<API_KEY>`
+placeholders, never as values. Packets live in sidecar's state dir and only
+your user can read them.
+
+## Deciding
+
+A review is decided by command, never by the reviewer's exit status:
+
+```sh
+sidecar review approve <id>
+sidecar review reject <id> --reason "plans/q3.md: unreleased pricing"
+```
+
+Approving publishes at once (`--no-sync` leaves it to the next sync).
+Rejecting holds publishing until the flagged content changes. The next sync
+then opens a fresh review of the new state. Approving a rejected review
+overrides the rejection. The id can be omitted when the repo has exactly one
+open review.
+
+Decisions wait for the peer's sync lock, so a verdict can never change under a
+sync that is acting on it. Once a sync has begun publishing an approved review,
+it can no longer be rejected.
+
+The exit status says only whether the reviewer itself worked:
+
+- **Exit 0 with a verdict:** decided.
+- **Exit 0 without one:** the review moved somewhere else, such as a thread or
+  a person. It stays open until someone runs `approve` or `reject`.
+- **Nonzero:** the reviewer broke. The review needs attention;
+  `sidecar review retry` retires it and opens a new review of the same change
+  with a fresh run of the reviewer. A reviewer still working on the old review
+  can no longer decide it. An approved review can't be retried; it publishes.
+
+That middle case is what makes discussion possible. A reviewer can open a
+thread in your agent tool with the packet, exit, and let the agent there
+decide with you, running the same two commands when you agree.
+
+### Example reviewers
+
+The simplest has the agent read the packet and print a verdict, and a script
+turns that into the command. The agent needs no permission to run anything:
+
+```sh
+#!/bin/sh
+# claude-sidecar — or swap `claude -p` for `codex exec`
+verdict=$(claude -p "$(cat "$SIDECAR_REVIEW_PROMPT")
+
+Do not run any commands. Read diff.patch, then end your reply with one line:
+APPROVE, or REJECT: <file and what kind of content, without repeating it>" | tail -n 1)
+case "$verdict" in
+  APPROVE) exec sidecar review approve "$SIDECAR_REVIEW_ID" ;;
+  REJECT:*) exec sidecar review reject "$SIDECAR_REVIEW_ID" --reason "${verdict#REJECT: }" ;;
+  *) exit 0 ;;  # undecided: leave it open for a person
+esac
+```
+
+A reviewer that hands off instead:
+
+```sh
+#!/bin/sh
+# Open a conversation about the review, then leave it to whoever is in it.
+my-agent-tool new-thread --title "sidecar review $SIDECAR_REVIEW_ID" \
+  --message "$(cat "$SIDECAR_REVIEW_PROMPT")" --cwd "$SIDECAR_REVIEW_DIR"
+```
+
+## Needs attention
+
+A review needs attention when it:
+
+- was rejected
+- has a reviewer that failed, never started, or stopped without a verdict
+- has no reviewer on this machine
+- has stayed undecided for longer than `review-timeout`
+
+Attention changes nothing about what's published. It makes the hold visible:
+`sidecar sync` and `sidecar status` say why, and the
+[health heartbeat](commands.md#fleet-health) reports
+`publishing held, review needs attention` to every machine. The heartbeat
+carries the state only, never a rejection's reason: the reason describes what
+was sensitive. For the same reason a gated peer's failure heartbeat names the
+stage that failed but not git's message, which can quote unreviewed file names.
+Nor does the log, the daemon's included: run the command by hand on that machine
+to see the details.
+
+```sh
+sidecar review                   # this repo's reviews, newest first
+sidecar review show <id>         # state, reason, changed files, and the diff
+```
+
+## What gets published
+
+A gated peer never pushes its own history. Snapshots stay on this machine,
+along with every intermediate state they recorded, including one that was
+rejected and then fixed. What leaves is one commit per approved review, whose
+tree is exactly what the reviewer saw. Its parent is the public commit the
+review was measured from, so the canonical merge combines only commits the
+remote already has. Its push can't carry anything unreviewed either.
+
+Reviews belong to the repo family, not to one checkout. Linked checkouts of a
+repo share one clone and one local `main` (see
+[One machine, many working copies](sync.md#one-machine-many-working-copies)),
+so they share one review of what that `main` holds. A rejection holds every
+sibling, and two siblings never race the same content to the remote. So every
+working copy sharing that clone must require review: a working copy with review
+off gets its own clone, and one whose config changes after linking refuses to
+sync through the shared clone rather than publish what its siblings hold. One
+review is open at a time. Edits made while it's open wait for the next one,
+which covers everything after what was approved.
+
+When the remote has no `main` yet, it starts as an empty commit, never as the
+checkout's history or anything staged in it, and the first review covers
+everything the checkout holds. When the remote's `main` was started over, local
+`main` is joined to the new one the same way, and the next review again covers
+everything the checkout holds.
+
+Nothing else rides along. Everything sidecar publishes — review commits, the
+canonical merge, the health heartbeat — is built with this checkout's own git
+setup switched off, because none of it is in the packet:
+
+- commits carry `user@host`, the identity the heartbeat already shows, never
+  the checkout's configured or environment git identity; they are never
+  signed and always UTF-8
+- hooks and rerere don't run; attributes come only from sidecar's own
+  redaction setting, so no `.gitattributes` can select a merge driver, filter,
+  or line-ending conversion, and drivers defined in config are replaced by
+  git's own
+- replacement objects (`git replace`) are ignored, so the packet shows the
+  blobs that are really published
+- what counts as already on the remote comes from sidecar's own fetch
+  (`refs/sidecar-public/`), never from `origin/*` refs that other tools can
+  write
+- pushes never follow tags, send no configured push options, and are refused
+  while `remote.origin.pushurl` points somewhere else
+- last-writer-wins clocks are generated by sidecar, never copied from local
+  commit messages
+
+Local merges still use your hooks and drivers; whatever they produce lands in
+local `main` and is reviewed like any other change.
+
+Local `main` is never reset for a gated peer. Each published commit is joined
+to it by a local link merge that records "this is what was published". That
+link keeps your later edits from conflicting with your own published ones. It
+changes no file and is never pushed.
+
+## Limits worth knowing
+
+- **Every machine syncing the peer needs a sidecar that knows about review.**
+  Current versions refuse config keys they don't recognize. Versions from
+  before review existed silently ignore `review = "required"` and push as
+  usual. Update every machine before turning it on.
+- **An agent's judgment is not a guarantee.** Review adds a reader who
+  understands context. It doesn't prove nothing sensitive gets through, and a
+  reviewer can be wrong in either direction.
+- **The reviewer sees the redacted diff, not your working tree.** That keeps
+  caught secrets away from it. It also means what redaction rewrote shows up
+  as placeholders.
+- **Turning review off publishes local history.** A clone a gated peer has used
+  remembers it, and sync refuses until you confirm with
+  `git -C <checkout> config --unset sidecar.review`. The next sync then pushes
+  as an ungated peer does, including snapshots that review kept local. Turning
+  it off is a decision about everything still on this machine.
+- **Anything published earlier stays in the remote's history.** Review gates
+  what's published from now on.
+- **In [standalone mode](standalone.md), every writer controls the policy**,
+  including turning review off.
+- **Review guards against mistakes, not against someone at the keyboard.**
+  Anyone who can run commands as you can push directly, edit `.sidecar`,
+  approve a review, or change the records in the state dir.
+- **Some metadata publishes without review.** The health heartbeat (machine
+  `user@host`, the checkout's absolute path, peer, inbox name, sidecar
+  version, sync status and timestamps) and the empty initial commit of a new
+  remote are sidecar's own and go out before any review.
+- **Reviewers must read the whole packet.** Files listed under `opaque/` are
+  part of what an approval publishes; `diff.patch` alone does not show them.
+- **Pushes follow your git's routing for the remote.** `url.*.insteadOf`
+  rewrites still apply — they are how many setups authenticate — so they
+  decide where "the remote" is.
+- **Path names must be UTF-8.** A changed path that isn't fails the review
+  rather than publishing unseen.
diff --git a/docs/rules.md b/docs/rules.md
index 280f865..6ed975e 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -90,7 +90,8 @@ shared ignore entries remain in place for other working copies.
 ## Who controls policy
 
 In a nested sidecar, the rules live in the host repo beside its config,
-outside the checkout that Sidecar syncs. A `.sidecar-rules` file arriving
+outside the checkout that Sidecar syncs. So does a peer's review guidance,
+`.sidecar-review` or `.sidecar-review.<name>` (see [review.md](review.md)). A `.sidecar-rules` file arriving
 inside that checkout does not override the host policy. Review host policy
 changes through the same process as changes to `.sidecar`.
 
diff --git a/docs/sync.md b/docs/sync.md
index 7e269e3..6e6b7c9 100644
--- a/docs/sync.md
+++ b/docs/sync.md
@@ -46,6 +46,11 @@ everything a commit every minute would, at a hundredth of the history.
 
 ## Inbox branches and conflict-free merging
 
+(A peer with [review](review.md) required differs in one way: it never
+pushes its inbox history, only one commit per approved review, and the
+canonical merge combines only what the remote already has. See
+[What gets published](review.md#what-gets-published).)
+
 Each sync snapshots local changes onto a per-machine inbox branch and pushes
 it, then merges all inbox branches into the canonical branch and pushes that.
 Because every machine writes only to its own inbox, a sync never stops you to
diff --git a/packages/sidecar/CLAUDE.md b/packages/sidecar/CLAUDE.md
index 2b80ae7..0c73ea9 100644
--- a/packages/sidecar/CLAUDE.md
+++ b/packages/sidecar/CLAUDE.md
@@ -16,8 +16,10 @@ automatically by `export *`.
 - `state.ts` — machine-local state dir: settings.json, instances.json registry, event log, per-family sync lock.
 - `service.ts` — OS service wrapper for the daemon (launchd/systemd/Startup), pid liveness. The loop itself is `daemon.ts`.
 - `ui.ts` — label/value output rows, human timestamps, blocking TTY prompts.
+- `review.ts` — the review gate's records and packets (machine-local, in the state dir), the detached reviewer runner, and review state. The publishing it gates lives in `sync.ts`.
 - `sync.ts` — the engine: snapshot, inbox merge + conflict forking, clone/settle, redaction filter wiring, health heartbeat.
 - `cmd-init.ts` / `cmd-status.ts` / `cmd-daemon.ts` / `cmd-sync.ts` — command handlers, thin over the modules above.
+- `cmd-review.ts` — `sidecar review`: list, show, decide, retry, set the machine's reviewer, and the `review run` runner entry.
 - `cmd-refresh.ts` — the exception to "thin": `sidecar refresh` owns its own engine code, because it is the only path that deletes a checkout and the guards keeping that safe belong next to it rather than beside the clone/settle functions they resemble.
 - `commands.ts` — the COMMANDS table + dispatch. **Adding a command = one table entry here plus a handler in a cmd-\*.ts**; usage text and typo suggestions derive from the table.
 - `bin.ts` — entry point; resolves which install runs the command (newest wins between global and project-local) before `main()` does any work.
@@ -58,11 +60,49 @@ automatically by `export *`.
   and is how a `(root, config)` pair knows which file it came from. A command
   fans out over `loadPeers(selectedPeer(parsed))`; the daemon names the peer
   through `SIDECAR_PEER`, an env var like every other request it makes.
+- **Review gating.** A peer with `review = "required"` never pushes local
+  history: only one commit per approved review, whose tree is the reviewed
+  tree, and canonical merges built from public refs alone
+  (`mergePublishedInboxes`). Never route a gated peer through
+  `syncBranchBeforePush`/`pushBranch` or push local main. Reviews are per repo
+  family and cover local main, which a gated peer never resets (each publish
+  is joined to it by a link merge — dropping links brings back spurious
+  forks; a remote main that was started over is joined by a link commit too).
+  Every sharer of a store must be gated: `bindReviewPolicy` marks the store
+  before anything is snapshotted or merged and refuses an ungated peer, and
+  families never link across review modes. Every review has a public base,
+  and every parent of a publish commit must be public when it is pushed,
+  resumed publishes included; a prepared commit stays reachable under
+  `refs/sidecar-publishing/<id>`. The reviewer command is machine-local
+  (`settings.json`), never read from committed config. Review reasons stay
+  out of logs and heartbeats, and so do a gated peer's git failure messages
+  (they quote unreviewed paths): once a process has touched a gated (or
+  unreadable) config or a review packet (`privateFailures`), cli.ts logs its
+  failures without a message, the heartbeat carries the stage only, and the
+  daemon logs a gated peer's exit status, never its output. The terminal
+  still shows the details. Verdicts change only under the peer's sync lock. A review launches
+  its reviewer once; retry opens a new review, so a stale reviewer can only
+  decide a closed one. Anything a publish commit carries beyond the reviewed
+  tree is sidecar-generated, never copied from local commit messages.
+- **Public git.** Every git operation that builds or sends what a gated peer
+  publishes — and every health heartbeat, including reading the previous one —
+  runs under `withPublicGit`, which replaces all injected config and fixes
+  identity, encoding, hooks, rerere, signing, push options, replacement
+  objects, and attributes (`GIT_ATTR_SOURCE` = empty tree). Reviewers launch
+  outside it. "Already public" means `refs/sidecar-public/*`, written only by
+  `fetchPublic` inside the wrapper, never `origin/*`; a push does not move
+  them, so refetch after any push a later step measures from. Every push passes
+  `--no-follow-tags`. Gated bootstrap uses plumbing (empty tree), never the
+  index. Packet enumeration uses `diff-tree` with explicit options, never
+  porcelain `git diff`, whose config can hide paths.
+- **Strict config.** `readConfig` refuses unknown keys and other versions, so
+  a policy key an older CLI doesn't know fails closed. A new `.sidecar` key
+  goes in `CONFIG_KEYS`.
 
 ## Build & test
 
 - `bun run build` bundles `src/bin.ts` into the single committed `dist/cli.js`;
-  `import.meta.url` tricks (`redactCliPath`, `packageVersion`) resolve against
+  `import.meta.url` tricks (`sidecarCliPath`, `packageVersion`) resolve against
   that bundle at runtime, so keep the one-file output.
 - `bun run check` typechecks. `bun run test` is the fast suite and does not
   build or spawn the real CLI. `bun run test:integration` rebuilds `dist` and
diff --git a/packages/sidecar/dist/cli.js b/packages/sidecar/dist/cli.js
index 9557a92..2d1e8f2 100755
--- a/packages/sidecar/dist/cli.js
+++ b/packages/sidecar/dist/cli.js
@@ -196,6 +196,9 @@ function currentUser() {
 function currentHost() {
   return os.hostname().split(".", 1)[0] || "unknown";
 }
+function currentMachine() {
+  return `${currentUser()}@${currentHost()}`;
+}
 function parseDuration(value) {
   if (typeof value === "number")
     return Number.isFinite(value) && value >= 0 ? value : undefined;
@@ -229,6 +232,10 @@ import os2 from "node:os";
 import path2 from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+function sidecarCliPath() {
+  const self = fileURLToPath(import.meta.url);
+  return self.endsWith(".ts") ? path2.join(path2.dirname(self), "..", "dist", "cli.js") : self;
+}
 function packageVersion() {
   let current = path2.dirname(fileURLToPath(import.meta.url));
   while (true) {
@@ -324,147 +331,6 @@ var init_install = __esm(() => {
   INSTALL_SOURCES = new Set(["npm", "bun", "curl"]);
 });
 
-// src/git.ts
-import fs3 from "node:fs";
-import path3 from "node:path";
-import { spawnSync as spawnSync2 } from "node:child_process";
-function git(repo, args, options = {}) {
-  return gitRaw(["-C", repo, ...args], options);
-}
-function gitBytes(repo, args, options = {}) {
-  const check = options.check ?? true;
-  const result = spawnSync2("git", ["-C", repo, ...args], {
-    encoding: "buffer",
-    maxBuffer: 100 * 1024 * 1024
-  });
-  const status = result.status ?? 1;
-  const stdout = Buffer.isBuffer(result.stdout) ? result.stdout : Buffer.from(result.stdout ?? "");
-  const stderr = Buffer.isBuffer(result.stderr) ? result.stderr : Buffer.from(result.stderr ?? "");
-  if (check && status !== 0) {
-    throw new SidecarError(stderr.toString("utf8").trim() || stdout.toString("utf8").trim());
-  }
-  return { status, stdout, stderr };
-}
-function gitRaw(args, options = {}) {
-  const check = options.check ?? true;
-  const result = spawnSync2("git", args, {
-    encoding: "utf8",
-    input: options.input,
-    maxBuffer: 100 * 1024 * 1024
-  });
-  const status = result.status ?? 1;
-  const stdout = result.stdout ?? "";
-  const stderr = result.stderr ?? "";
-  if (check && status !== 0) {
-    throw new SidecarError(stderr.trim() || stdout.trim());
-  }
-  return { status, stdout, stderr };
-}
-function fetch(repo, quiet, check = true) {
-  const args = ["fetch", "--prune", "origin", "+refs/heads/*:refs/remotes/origin/*"];
-  if (quiet)
-    args.splice(1, 0, "--quiet");
-  git(repo, args, { check });
-}
-function hasAnyCommit(repo) {
-  return git(repo, ["rev-parse", "--verify", "HEAD"], { check: false }).status === 0;
-}
-function branchExists(repo, branch) {
-  return git(repo, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], { check: false }).status === 0;
-}
-function remoteRefExists(repo, branch) {
-  return git(repo, ["show-ref", "--verify", "--quiet", `refs/remotes/origin/${branch}`], {
-    check: false
-  }).status === 0;
-}
-function isAncestor(repo, maybeAncestor, descendant) {
-  return git(repo, ["merge-base", "--is-ancestor", maybeAncestor, descendant], { check: false }).status === 0;
-}
-function gitToplevel(cwd) {
-  const root = gitToplevelOptional(cwd);
-  if (!root)
-    throw new SidecarError("not inside a Git repository");
-  return root;
-}
-function gitToplevelOptional(cwd) {
-  const result = gitRaw(["-C", cwd, "rev-parse", "--show-toplevel"], { check: false });
-  if (result.status !== 0)
-    return;
-  return result.stdout.trim();
-}
-function gitCommonDir(root) {
-  const commonDir = gitCommonDirOptional(root);
-  if (!commonDir)
-    throw new SidecarError("not inside a Git repository");
-  return commonDir;
-}
-function gitExcludePath(root) {
-  const commonDir = gitCommonDirOptional(root);
-  return commonDir ? path3.join(commonDir, "info", "exclude") : undefined;
-}
-function isGitIgnored(root, relativePath) {
-  return git(root, ["check-ignore", "-q", "--", relativePath], { check: false }).status === 0;
-}
-function isGitTracked(root, relativePath) {
-  return git(root, ["ls-files", "--error-unmatch", "--", relativePath], { check: false }).status === 0;
-}
-function gitCommonDirOptional(root) {
-  const result = gitRaw(["-C", root, "rev-parse", "--git-common-dir"], { check: false });
-  if (result.status !== 0)
-    return;
-  return path3.resolve(root, result.stdout.trim());
-}
-function gitDir(repo) {
-  const result = git(repo, ["rev-parse", "--git-dir"]).stdout.trim();
-  return path3.isAbsolute(result) ? result : path3.resolve(repo, result);
-}
-function hasGitMetadata(repo) {
-  return fs3.existsSync(path3.join(repo, ".git"));
-}
-function isDirty(repo) {
-  return Boolean(git(repo, ["status", "--porcelain"]).stdout.trim());
-}
-function ensureClean(repo) {
-  if (isDirty(repo))
-    throw new SidecarError("sidecar checkout has uncommitted changes");
-}
-function ensureCommitIdentity(repo) {
-  if (git(repo, ["config", "user.name"], { check: false }).status !== 0) {
-    git(repo, ["config", "user.name", currentUser()]);
-  }
-  if (git(repo, ["config", "user.email"], { check: false }).status !== 0) {
-    git(repo, ["config", "user.email", `${slug(currentUser())}@${slug(currentHost())}.local`]);
-  }
-}
-function familyPrimaryRoot(root) {
-  const primary = jjDefaultWorkspace(root) ?? gitMainWorktree(root);
-  if (!primary)
-    return;
-  return realpathOr(primary) === realpathOr(root) ? undefined : primary;
-}
-function jjDefaultWorkspace(root) {
-  const pointer = path3.join(root, ".jj", "repo");
-  try {
-    if (!fs3.statSync(pointer).isFile())
-      return;
-    const repo = path3.resolve(path3.dirname(pointer), fs3.readFileSync(pointer, "utf8").trim());
-    const workspace = path3.dirname(path3.dirname(repo));
-    return fs3.existsSync(path3.join(workspace, ".jj")) ? workspace : undefined;
-  } catch {
-    return;
-  }
-}
-function gitMainWorktree(root) {
-  const result = git(root, ["worktree", "list", "--porcelain"], { check: false });
-  if (result.status !== 0)
-    return;
-  const entry = result.stdout.split(/\r?\n/).find((line) => line.startsWith("worktree "));
-  return entry?.slice("worktree ".length).trim() || undefined;
-}
-var init_git = __esm(() => {
-  init_util();
-});
-
 // ../../node_modules/.bun/smol-toml@1.7.0/node_modules/smol-toml/dist/date.js
 var DATE_TIME_RE, TomlDate;
 var init_date = __esm(() => {
@@ -1428,6 +1294,157 @@ var init_dist = __esm(() => {
    */
 });
 
+// src/git.ts
+import fs3 from "node:fs";
+import path3 from "node:path";
+import { spawnSync as spawnSync2 } from "node:child_process";
+function git(repo, args, options = {}) {
+  return gitRaw(["-C", repo, ...args], options);
+}
+function gitBytes(repo, args, options = {}) {
+  const check = options.check ?? true;
+  const result = spawnSync2("git", ["-C", repo, ...args], {
+    encoding: "buffer",
+    maxBuffer: 100 * 1024 * 1024
+  });
+  const status = result.status ?? 1;
+  const stdout = Buffer.isBuffer(result.stdout) ? result.stdout : Buffer.from(result.stdout ?? "");
+  const stderr = Buffer.isBuffer(result.stderr) ? result.stderr : Buffer.from(result.stderr ?? "");
+  if (check && status !== 0) {
+    throw new SidecarError(stderr.toString("utf8").trim() || stdout.toString("utf8").trim());
+  }
+  return { status, stdout, stderr };
+}
+function gitRaw(args, options = {}) {
+  const check = options.check ?? true;
+  const result = spawnSync2("git", args, {
+    encoding: "utf8",
+    input: options.input,
+    maxBuffer: 100 * 1024 * 1024
+  });
+  const status = result.status ?? 1;
+  const stdout = result.stdout ?? "";
+  const stderr = result.stderr ?? "";
+  if (check && status !== 0) {
+    throw new SidecarError(stderr.trim() || stdout.trim());
+  }
+  return { status, stdout, stderr };
+}
+function fetch(repo, quiet, check = true) {
+  const args = ["fetch", "--prune", "origin", "+refs/heads/*:refs/remotes/origin/*"];
+  if (quiet)
+    args.splice(1, 0, "--quiet");
+  git(repo, args, { check });
+}
+function hasAnyCommit(repo) {
+  return git(repo, ["rev-parse", "--verify", "HEAD"], { check: false }).status === 0;
+}
+function branchExists(repo, branch) {
+  return git(repo, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], { check: false }).status === 0;
+}
+function remoteRefExists(repo, branch) {
+  return git(repo, ["show-ref", "--verify", "--quiet", `refs/remotes/origin/${branch}`], {
+    check: false
+  }).status === 0;
+}
+function isAncestor(repo, maybeAncestor, descendant) {
+  return git(repo, ["merge-base", "--is-ancestor", maybeAncestor, descendant], { check: false }).status === 0;
+}
+function treeOf(repo, ref) {
+  return git(repo, ["rev-parse", `${ref}^{tree}`]).stdout.trim();
+}
+function emptyTree(repo) {
+  return git(repo, ["mktree"], { input: "" }).stdout.trim();
+}
+function gitToplevel(cwd) {
+  const root = gitToplevelOptional(cwd);
+  if (!root)
+    throw new SidecarError("not inside a Git repository");
+  return root;
+}
+function gitToplevelOptional(cwd) {
+  const result = gitRaw(["-C", cwd, "rev-parse", "--show-toplevel"], { check: false });
+  if (result.status !== 0)
+    return;
+  return result.stdout.trim();
+}
+function gitCommonDir(root) {
+  const commonDir = gitCommonDirOptional(root);
+  if (!commonDir)
+    throw new SidecarError("not inside a Git repository");
+  return commonDir;
+}
+function gitExcludePath(root) {
+  const commonDir = gitCommonDirOptional(root);
+  return commonDir ? path3.join(commonDir, "info", "exclude") : undefined;
+}
+function isGitIgnored(root, relativePath) {
+  return git(root, ["check-ignore", "-q", "--", relativePath], { check: false }).status === 0;
+}
+function isGitTracked(root, relativePath) {
+  return git(root, ["ls-files", "--error-unmatch", "--", relativePath], { check: false }).status === 0;
+}
+function gitCommonDirOptional(root) {
+  const result = gitRaw(["-C", root, "rev-parse", "--git-common-dir"], { check: false });
+  if (result.status !== 0)
+    return;
+  return path3.resolve(root, result.stdout.trim());
+}
+function gitDir(repo) {
+  const result = git(repo, ["rev-parse", "--git-dir"]).stdout.trim();
+  return path3.isAbsolute(result) ? result : path3.resolve(repo, result);
+}
+function hasGitMetadata(repo) {
+  return fs3.existsSync(path3.join(repo, ".git"));
+}
+function isDirty(repo) {
+  return Boolean(git(repo, ["status", "--porcelain"]).stdout.trim());
+}
+function ensureClean(repo) {
+  if (isDirty(repo))
+    throw new SidecarError("sidecar checkout has uncommitted changes");
+}
+function sidecarIdentity() {
+  return { name: currentUser(), email: `${slug(currentUser())}@${slug(currentHost())}.local` };
+}
+function ensureCommitIdentity(repo) {
+  const { name, email } = sidecarIdentity();
+  if (git(repo, ["config", "user.name"], { check: false }).status !== 0) {
+    git(repo, ["config", "user.name", name]);
+  }
+  if (git(repo, ["config", "user.email"], { check: false }).status !== 0) {
+    git(repo, ["config", "user.email", email]);
+  }
+}
+function familyPrimaryRoot(root) {
+  const primary = jjDefaultWorkspace(root) ?? gitMainWorktree(root);
+  if (!primary)
+    return;
+  return realpathOr(primary) === realpathOr(root) ? undefined : primary;
+}
+function jjDefaultWorkspace(root) {
+  const pointer = path3.join(root, ".jj", "repo");
+  try {
+    if (!fs3.statSync(pointer).isFile())
+      return;
+    const repo = path3.resolve(path3.dirname(pointer), fs3.readFileSync(pointer, "utf8").trim());
+    const workspace = path3.dirname(path3.dirname(repo));
+    return fs3.existsSync(path3.join(workspace, ".jj")) ? workspace : undefined;
+  } catch {
+    return;
+  }
+}
+function gitMainWorktree(root) {
+  const result = git(root, ["worktree", "list", "--porcelain"], { check: false });
+  if (result.status !== 0)
+    return;
+  const entry = result.stdout.split(/\r?\n/).find((line) => line.startsWith("worktree "));
+  return entry?.slice("worktree ".length).trim() || undefined;
+}
+var init_git = __esm(() => {
+  init_util();
+});
+
 // src/redaction.ts
 function redactText(input, mode = DEFAULT_REDACTION_MODE) {
   if (mode === "none")
@@ -1582,7 +1599,8 @@ function parseHealthRecord(text) {
     lastFailureAt: typeof record.lastFailureAt === "string" ? record.lastFailureAt : undefined,
     consecutiveFailures: typeof record.consecutiveFailures === "number" && Number.isFinite(record.consecutiveFailures) ? record.consecutiveFailures : 0,
     stage: typeof record.stage === "string" ? record.stage : undefined,
-    message: typeof record.message === "string" ? record.message : undefined
+    message: typeof record.message === "string" ? record.message : undefined,
+    review: record.review === "pending" || record.review === "attention" ? record.review : undefined
   };
 }
 function serializeHealthRecord(record) {
@@ -1595,24 +1613,27 @@ function nextHealthRecord(previous, identity, outcome, now) {
     ...identity,
     status: outcome.status,
     updatedAt: now,
-    lastSuccessAt: previous?.lastSuccessAt,
-    lastFailureAt: previous?.lastFailureAt,
+    lastSuccessAt: isoTimestamp(previous?.lastSuccessAt),
+    lastFailureAt: isoTimestamp(previous?.lastFailureAt),
     consecutiveFailures: 0
   };
   if (outcome.status === "ok")
-    return { ...base, lastSuccessAt: now };
+    return { ...base, lastSuccessAt: now, ...outcome.review ? { review: outcome.review } : {} };
   return {
     ...base,
     lastFailureAt: now,
-    consecutiveFailures: (previous?.consecutiveFailures ?? 0) + 1,
+    consecutiveFailures: Math.max(0, Math.floor(previous?.consecutiveFailures ?? 0)) + 1,
     stage: outcome.stage,
     message: redactText(outcome.message).trim().slice(-MESSAGE_LIMIT)
   };
 }
+function isoTimestamp(value) {
+  return value && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/.test(value) ? value : undefined;
+}
 function shouldPublishHealth(previous, next, now = Date.now()) {
   if (!previous)
     return true;
-  if (next.status === "failed" || previous.status !== next.status)
+  if (next.status === "failed" || previous.status !== next.status || previous.review !== next.review)
     return true;
   const last = Date.parse(previous.updatedAt);
   if (!Number.isFinite(last))
@@ -3538,6 +3559,22 @@ function ensureDistinctCheckouts(peers) {
 function sameRemoteKey(remote) {
   return remote.trim().replace(/\/+$/, "").replace(/\.git$/, "");
 }
+function reviewRequired(config) {
+  return config.review === "required";
+}
+function privateFailures() {
+  return failuresArePrivate;
+}
+function keepFailuresPrivate() {
+  failuresArePrivate = true;
+}
+function notePeerPolicy(config) {
+  if (reviewRequired(config))
+    keepFailuresPrivate();
+}
+function reviewTimeoutSeconds(config) {
+  return config.reviewTimeout ?? DEFAULT_REVIEW_TIMEOUT_SECONDS;
+}
 function findConfigRoot(start) {
   const root = findConfigRootOptional(start);
   if (root)
@@ -3556,7 +3593,11 @@ function findConfigRootOptional(start) {
   }
 }
 function writeConfig(configPath, config) {
-  const text = [
+  notePeerPolicy(config);
+  fs5.writeFileSync(configPath, configText(config), "utf8");
+}
+function configText(config) {
+  return [
     `version = ${config.version}`,
     `remote = ${JSON.stringify(config.remote)}`,
     `path = ${JSON.stringify(config.path)}`,
@@ -3566,10 +3607,11 @@ function writeConfig(configPath, config) {
     `resolve = ${JSON.stringify(config.resolve ?? DEFAULT_RESOLVE)}`,
     ...config.debounce === undefined ? [] : [`debounce = ${config.debounce}`],
     ...config.interval === undefined ? [] : [`interval = ${config.interval}`],
+    ...reviewRequired(config) ? [`review = "required"`] : [],
+    ...config.reviewTimeout === undefined ? [] : [`review-timeout = ${config.reviewTimeout}`],
     ""
   ].join(`
 `);
-  fs5.writeFileSync(configPath, text, "utf8");
 }
 function readConfig(configPath, options = {}) {
   let values;
@@ -3580,10 +3622,22 @@ function readConfig(configPath, options = {}) {
     }
     values = parsed;
   } catch (error) {
+    if (error.code !== "ENOENT")
+      keepFailuresPrivate();
     if (error instanceof SidecarError)
       throw error;
     throw new SidecarError(`${configPath} is not valid TOML: ${error instanceof Error ? error.message : String(error)}`);
   }
+  if (values.review !== undefined && values.review !== "off")
+    keepFailuresPrivate();
+  const unknown = Object.keys(values).filter((key) => !CONFIG_KEYS.has(key));
+  if (unknown.length) {
+    throw new SidecarError(`${configPath}: unknown key${unknown.length > 1 ? "s" : ""} ${unknown.map((key) => JSON.stringify(key)).join(", ")}; this sidecar may be older than the config — update it with \`sidecar update\``);
+  }
+  const version = numberConfigValue(configPath, values, "version", CONFIG_VERSION);
+  if (version !== CONFIG_VERSION) {
+    throw new SidecarError(`${configPath}: config version ${version} is not supported by this sidecar (expected ${CONFIG_VERSION}); update it with \`sidecar update\``);
+  }
   const remote = optionalStringConfigValue(configPath, values, "remote");
   if (!remote)
     throw new SidecarError(`${configPath} is missing remote`);
@@ -3592,7 +3646,7 @@ function readConfig(configPath, options = {}) {
   const config = {
     peer,
     remote,
-    version: numberConfigValue(configPath, values, "version", 1),
+    version,
     path: stringConfigValue(configPath, values, "path", DEFAULT_PATH),
     branch: stringConfigValue(configPath, values, "branch", DEFAULT_BRANCH),
     inbox: stringConfigValue(configPath, values, "inbox", DEFAULT_INBOX),
@@ -3600,6 +3654,8 @@ function readConfig(configPath, options = {}) {
     resolve: resolveModeConfigValue(stringConfigValue(configPath, values, "resolve", DEFAULT_RESOLVE), configPath),
     debounce: durationConfigValue(values.debounce, `${configPath} debounce`),
     interval: durationConfigValue(values.interval, `${configPath} interval`),
+    review: reviewModeConfigValue(stringConfigValue(configPath, values, "review", "off"), configPath),
+    reviewTimeout: durationConfigValue(values["review-timeout"], `${configPath} review-timeout`),
     rules: options.loadRules === false ? undefined : readRules(rulesPath),
     rulesPath
   };
@@ -3616,6 +3672,11 @@ function redactionModeConfigValue(value, source) {
     return value;
   throw new SidecarError(`${source}: invalid redaction mode ${JSON.stringify(value)}; expected one of ${REDACTION_MODES.join(", ")}`);
 }
+function reviewModeConfigValue(value, source) {
+  if (REVIEW_MODES.includes(value))
+    return value;
+  throw new SidecarError(`${source}: invalid review mode ${JSON.stringify(value)}; expected one of ${REVIEW_MODES.join(", ")}`);
+}
 function durationConfigValue(value, source) {
   if (value === undefined)
     return;
@@ -3736,6 +3797,8 @@ function inboxPrefix(config) {
   return inboxBranchPrefix(config.inbox);
 }
 function remoteBranchName(remoteBranch) {
+  if (remoteBranch.startsWith(PUBLIC_REFS))
+    return remoteBranch.slice(PUBLIC_REFS.length);
   return remoteBranch.startsWith("origin/") ? remoteBranch.slice("origin/".length) : remoteBranch;
 }
 function matchesInboxPrefix(prefix, branch) {
@@ -3749,7 +3812,7 @@ function inboxBranchPrefix(template) {
   const slashIndex = staticPrefix.lastIndexOf("/");
   return slashIndex === -1 ? staticPrefix : staticPrefix.slice(0, slashIndex + 1);
 }
-var DEFAULT_PATH = "sidecar", DEFAULT_BRANCH = "main", DEFAULT_INBOX = "sidecar-inbox/{user}/{random}", branchValidity, DEFAULT_PEER = "default", PEER_ENV = "SIDECAR_PEER", PEER_NAME, RESERVED_PEER_SUFFIXES, RESOLVE_MODES, DEFAULT_RESOLVE = "fork";
+var DEFAULT_PATH = "sidecar", DEFAULT_BRANCH = "main", DEFAULT_INBOX = "sidecar-inbox/{user}/{random}", branchValidity, DEFAULT_PEER = "default", PEER_ENV = "SIDECAR_PEER", SOFT_SYNC_ENV = "SIDECAR_SYNC_SOFT", LOCAL_SYNC_ENV = "SIDECAR_SYNC_LOCAL", PEER_NAME, RESERVED_PEER_SUFFIXES, RESOLVE_MODES, DEFAULT_RESOLVE = "fork", REVIEW_MODES, DEFAULT_REVIEW_TIMEOUT_SECONDS, CONFIG_VERSION = 1, CONFIG_KEYS, failuresArePrivate = false, PUBLIC_REFS = "refs/sidecar-public/";
 var init_config = __esm(() => {
   init_dist();
   init_util();
@@ -3761,6 +3824,21 @@ var init_config = __esm(() => {
   PEER_NAME = /^[a-z0-9][a-z0-9-]*$/;
   RESERVED_PEER_SUFFIXES = new Set(["swp", "swo", "swx", "bak", "orig", "rej", "tmp", "old", "example", "sample", "lock"]);
   RESOLVE_MODES = ["fork", "lww"];
+  REVIEW_MODES = ["off", "required"];
+  DEFAULT_REVIEW_TIMEOUT_SECONDS = 60 * 60;
+  CONFIG_KEYS = new Set([
+    "version",
+    "remote",
+    "path",
+    "branch",
+    "inbox",
+    "redaction",
+    "resolve",
+    "debounce",
+    "interval",
+    "review",
+    "review-timeout"
+  ]);
 });
 
 // src/state.ts
@@ -3803,7 +3881,8 @@ function readSettings() {
       daemonEnabled: typeof record.daemonEnabled === "boolean" ? record.daemonEnabled : true,
       autoUpdate: typeof record.autoUpdate === "boolean" ? record.autoUpdate : true,
       lastUpdateCheckAt: typeof record.lastUpdateCheckAt === "string" ? record.lastUpdateCheckAt : undefined,
-      installSource: INSTALL_SOURCES.has(record.installSource) ? record.installSource : undefined
+      installSource: INSTALL_SOURCES.has(record.installSource) ? record.installSource : undefined,
+      reviewer: typeof record.reviewer === "string" && record.reviewer.trim() ? record.reviewer : undefined
     };
   } catch (error) {
     logSidecarEvent("failure", {
@@ -3823,6 +3902,8 @@ function writeSettings(settings) {
     record.lastUpdateCheckAt = settings.lastUpdateCheckAt;
   if (settings.installSource)
     record.installSource = settings.installSource;
+  if (settings.reviewer)
+    record.reviewer = settings.reviewer;
   fs6.writeFileSync(settingsPath(), `${JSON.stringify(record, null, 2)}
 `, "utf8");
 }
@@ -4073,8 +4154,21 @@ function acquireSyncLockOrThrow(root, peer) {
     return release;
   throw new SidecarError("another sidecar sync is already running; try again once it finishes");
 }
+function acquireSyncLockWaiting(root, peer) {
+  const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  const deadline = Date.now() + SYNC_LOCK_WAIT_MS;
+  while (true) {
+    const release = acquireSyncLock(root, peer);
+    if (release)
+      return release;
+    if (Date.now() >= deadline) {
+      throw new SidecarError("another sidecar sync is still running; try again once it finishes");
+    }
+    Atomics.wait(sleeper, 0, 0, 250);
+  }
+}
 function withSyncLock(root, peer, onBusy, fn) {
-  const releaseLock = onBusy === "skip" ? acquireSyncLock(root, peer) : acquireSyncLockOrThrow(root, peer);
+  const releaseLock = onBusy === "skip" ? acquireSyncLock(root, peer) : onBusy === "wait" ? acquireSyncLockWaiting(root, peer) : acquireSyncLockOrThrow(root, peer);
   if (!releaseLock) {
     console.log("another sidecar sync is already running; skipping this soft sync");
     return false;
@@ -4106,7 +4200,7 @@ function syncLockIsStale(lockDir) {
     return error.code !== "EPERM";
   }
 }
-var STATE_DIR_ENV = "SIDECAR_STATE_DIR", DEFAULT_SETTINGS, LOG_ROTATE_BYTES;
+var STATE_DIR_ENV = "SIDECAR_STATE_DIR", DEFAULT_SETTINGS, LOG_ROTATE_BYTES, SYNC_LOCK_WAIT_MS;
 var init_state = __esm(() => {
   init_util();
   init_git();
@@ -4115,6 +4209,7 @@ var init_state = __esm(() => {
   init_redaction();
   DEFAULT_SETTINGS = { daemonEnabled: true, autoUpdate: true };
   LOG_ROTATE_BYTES = 5 * 1024 * 1024;
+  SYNC_LOCK_WAIT_MS = 10 * 60 * 1000;
 });
 
 // src/service.ts
@@ -4405,22 +4500,405 @@ ${plistValue(item, indent + 2)}`).join("")}${pad}</dict>
   return `${pad}<string></string>
 `;
 }
-function escapeXml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+function escapeXml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+var SKIP_SERVICE_ENV = "SIDECAR_SKIP_SERVICE", DAEMON_LABEL = "com.anteprojector.sidecar";
+var init_service = __esm(() => {
+  init_util();
+  init_install();
+  init_state();
+});
+
+// src/review.ts
+import crypto4 from "node:crypto";
+import fs8 from "node:fs";
+import path8 from "node:path";
+import { spawn as spawn2, spawnSync as spawnSync4 } from "node:child_process";
+function newId() {
+  return crypto4.randomBytes(4).toString("hex");
+}
+function reviewsDir() {
+  return path8.join(sidecarStateDir(), "reviews");
+}
+function reviewDir(id) {
+  return path8.join(reviewsDir(), id);
+}
+function writePrivateFile(filePath, text) {
+  const temporary = `${filePath}.${crypto4.randomUUID()}.tmp`;
+  try {
+    fs8.writeFileSync(temporary, text, { encoding: "utf8", mode: 384 });
+    fs8.renameSync(temporary, filePath);
+  } finally {
+    fs8.rmSync(temporary, { force: true });
+  }
+}
+function writePrivateJson(filePath, value) {
+  writePrivateFile(filePath, `${JSON.stringify(value, null, 2)}
+`);
+}
+function readJson(filePath) {
+  try {
+    return JSON.parse(fs8.readFileSync(filePath, "utf8"));
+  } catch {
+    return;
+  }
+}
+function readReview(id) {
+  keepFailuresPrivate();
+  if (!ID_PATTERN.test(id))
+    return;
+  const dir = reviewDir(id);
+  const record = readJson(path8.join(dir, "review.json"));
+  if (!record || record.id !== id)
+    return;
+  const verdict = readJson(path8.join(dir, "verdict.json"));
+  const run = readJson(runPath(dir));
+  return { record, verdict, run, state: reviewState(record, verdict, run), dir };
+}
+function runPath(dir) {
+  return path8.join(dir, "run.json");
+}
+function reviewFamily(sidecarPath) {
+  return realpathOr(gitCommonDir(sidecarPath));
+}
+function listReviews(sidecarPath) {
+  let ids;
+  try {
+    ids = fs8.readdirSync(reviewsDir());
+  } catch {
+    return [];
+  }
+  const family = sidecarPath === undefined ? undefined : reviewFamily(sidecarPath);
+  return ids.map(readReview).filter((review) => review !== undefined).filter((review) => family === undefined || review.record.family === family).sort((left, right) => right.record.createdAt.localeCompare(left.record.createdAt) || right.record.id.localeCompare(left.record.id));
+}
+function findReview(idOrPrefix) {
+  const exact = readReview(idOrPrefix);
+  if (exact)
+    return exact;
+  const matches = listReviews().filter((review) => review.record.id.startsWith(idOrPrefix));
+  if (matches.length === 1)
+    return matches[0];
+  if (matches.length > 1)
+    throw new SidecarError(`review id ${JSON.stringify(idOrPrefix)} is ambiguous; use more of it`);
+  throw new SidecarError(`no review ${JSON.stringify(idOrPrefix)} on this machine`);
+}
+function isOpen(review) {
+  return review.state !== "published" && review.state !== "superseded";
+}
+function assertOpen(review) {
+  if (!isOpen(review))
+    throw new SidecarError(`review ${review.record.id} is already ${review.state}`);
+}
+function openReview(sidecarPath) {
+  return listReviews(sidecarPath).find(isOpen);
+}
+function reviewState(record, verdict, run) {
+  if (record.publishedAt)
+    return "published";
+  if (record.supersededAt)
+    return "superseded";
+  if (verdict)
+    return verdict.verdict;
+  if (run?.finishedAt && run.exitCode !== 0)
+    return "failed";
+  if (run && !run.finishedAt && !pidAlive(run.pid))
+    return "failed";
+  if (!run && record.launchedAt && (Date.now() - Date.parse(record.launchedAt)) / 1000 > LAUNCH_GRACE_SECONDS)
+    return "failed";
+  return "pending";
+}
+function pidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function reviewAttention(review, now = Date.now()) {
+  if (review.state === "rejected")
+    return "rejected";
+  if (review.state === "failed") {
+    const run = review.run;
+    if (!run)
+      return "reviewer never started";
+    if (run.finishedAt) {
+      return run.signal ? `reviewer stopped by ${run.signal} without a verdict` : `reviewer exited ${run.exitCode} without a verdict`;
+    }
+    return "reviewer stopped without a verdict";
+  }
+  if (review.state !== "pending")
+    return;
+  if (!review.record.launchedAt && !readSettings().reviewer)
+    return "no reviewer is configured on this machine";
+  const age = (now - Date.parse(review.record.createdAt)) / 1000;
+  if (age > review.record.timeoutSeconds)
+    return `undecided for over ${formatDuration(review.record.timeoutSeconds)}`;
+  return;
+}
+function formatDuration(seconds) {
+  if (seconds >= 3600 && seconds % 3600 === 0)
+    return `${seconds / 3600}h`;
+  if (seconds >= 60 && seconds % 60 === 0)
+    return `${seconds / 60}m`;
+  return `${Math.round(seconds)}s`;
+}
+function peerReviewGuidelinesFileName(name) {
+  return name === DEFAULT_PEER ? ".sidecar-review" : `.sidecar-review.${name}`;
+}
+function peerReviewGuidelinesPath(root, name) {
+  return path8.join(root, peerReviewGuidelinesFileName(name));
+}
+function readGuidelines(root, peer) {
+  try {
+    const text = fs8.readFileSync(peerReviewGuidelinesPath(root, peer), "utf8").trim();
+    return text || undefined;
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw new SidecarError(`could not read ${peerReviewGuidelinesPath(root, peer)}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function createReview(options) {
+  const { root, config, sidecarPath, base, head } = options;
+  const guidelines = readGuidelines(root, config.peer);
+  const id = newId();
+  const dir = reviewDir(id);
+  fs8.mkdirSync(reviewsDir(), { recursive: true, mode: 448 });
+  fs8.mkdirSync(dir, { mode: 448 });
+  const fields = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--name-status", "-z", base, head]).stdout.split("\x00").filter(Boolean);
+  const files = [];
+  for (let index = 0;index + 1 < fields.length; index += 2)
+    files.push({ status: fields[index], path: fields[index + 1] });
+  writeOpaqueArtifacts(sidecarPath, dir, base, head, files);
+  const diff = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "-p", "--no-color", "--no-ext-diff", "--no-textconv", base, head]).stdout;
+  const record = {
+    schema: REVIEW_SCHEMA,
+    id,
+    family: reviewFamily(sidecarPath),
+    root,
+    peer: config.peer,
+    base,
+    head,
+    tree: treeOf(sidecarPath, head),
+    files,
+    createdAt: nowIso(),
+    timeoutSeconds: reviewTimeoutSeconds(config)
+  };
+  writePrivateFile(path8.join(dir, "diff.patch"), diff);
+  if (guidelines)
+    writePrivateFile(path8.join(dir, "guidelines.md"), `${guidelines}
+`);
+  writePrivateFile(path8.join(dir, "instructions.md"), reviewInstructions(record, config, guidelines));
+  writePrivateJson(path8.join(dir, "review.json"), record);
+  logSidecarEvent("review-open", { id, root, peer: config.peer, files: files.length });
+  pruneClosedReviews(sidecarPath);
+  return { record, state: "pending", dir };
+}
+function writeOpaqueArtifacts(repo, dir, from, head, files) {
+  const binary = new Set(git(repo, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--numstat", "-z", from, head]).stdout.split("\x00").filter((entry) => entry.startsWith("-\t-\t")).map((entry) => entry.slice("-\t-\t".length)));
+  const blobs = new Set(git(repo, ["ls-tree", "-r", "-z", "--full-tree", head]).stdout.split("\x00").filter((entry) => entry.split(" ")[1] === "blob").map((entry) => entry.slice(entry.indexOf("\t") + 1)));
+  const utf8 = new TextDecoder("utf-8", { fatal: true });
+  const isText = (blob) => {
+    try {
+      utf8.decode(blob);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  let count = 0;
+  for (const file of files) {
+    if (file.status === "D" || !blobs.has(file.path))
+      continue;
+    const blob = gitBytes(repo, ["cat-file", "blob", `${head}:${file.path}`]).stdout;
+    if (!binary.has(file.path) && isText(blob))
+      continue;
+    count += 1;
+    file.artifact = path8.join("opaque", String(count).padStart(4, "0"));
+    fs8.mkdirSync(path8.join(dir, "opaque"), { recursive: true, mode: 448 });
+    fs8.writeFileSync(path8.join(dir, file.artifact), blob, { mode: 384 });
+  }
+}
+function updateRecord(review, change) {
+  const record = { ...review.record, ...change };
+  writePrivateJson(path8.join(review.dir, "review.json"), record);
+  review.record = record;
+}
+function markPublishing(review, inbox, commit) {
+  updateRecord(review, { publishing: { inbox, commit } });
+}
+function markPublished(review, commit) {
+  updateRecord(review, { publishedAt: nowIso(), publishedCommit: commit });
+  logSidecarEvent("review-published", { id: review.record.id, commit });
+}
+function markSuperseded(review) {
+  updateRecord(review, { supersededAt: nowIso() });
+  logSidecarEvent("review-superseded", { id: review.record.id });
+}
+function pruneClosedReviews(sidecarPath) {
+  const closed = listReviews(sidecarPath).filter((review) => !isOpen(review));
+  for (const review of closed.slice(KEEP_CLOSED_REVIEWS)) {
+    fs8.rmSync(review.dir, { recursive: true, force: true });
+  }
+}
+function pruneOrphanedReviews() {
+  for (const review of listReviews()) {
+    if (!fs8.existsSync(review.record.family))
+      fs8.rmSync(review.dir, { recursive: true, force: true });
+  }
+}
+function opaqueSection(record) {
+  const opaque = record.files.filter((file) => file.artifact);
+  if (!opaque.length)
+    return "";
+  return `
+These files' content does not appear faithfully in \`diff.patch\` (binary, not
+UTF-8, or diffs turned off). Their complete new content, as it would be
+published, is in the packet.
+Inspect each one; if you cannot, do not approve:
+
+${opaque.map((file) => `- \`${file.artifact}\` — ${file.path}`).join(`
+`)}
+`;
+}
+function reviewInstructions(record, config, guidelines) {
+  return `# Sidecar publish review ${record.id}
+
+A sidecar is a scratchpad repository that syncs automatically to a shared Git
+remote (${redactText(config.remote)}). This machine wants to publish the change in
+\`diff.patch\`. Everyone with access to that remote can read what you approve,
+and it stays in the remote's history.
+
+Decide whether anything in the change should not leave this machine. This is
+not a code review: ignore quality, style, and correctness.
+
+Secret redaction has already run. Values it caught appear as placeholders such
+as \`<API_KEY>\`, \`<TOKEN>\`, or \`<SECRET>\`; they are not leaks. Look for what
+pattern matching misses:
+
+- credentials in unusual formats, or ones split across lines
+- personal data about real people: contact details, health, finances, private conversations
+- confidential material: customer names and data, unreleased plans, internal-only details
+- anything the repository's guidelines below rule out
+
+## Files
+
+All in this directory (\`$SIDECAR_REVIEW_DIR\`):
+
+- \`diff.patch\` — the change exactly as it would be published
+- \`review.json\` — the repository, peer, and changed paths
+${guidelines ? "- `guidelines.md` — this repository's guidelines, repeated below\n" : ""}${opaqueSection(record)}
+## Guidelines
+
+${guidelines ?? "This repository has no review guidelines (`.sidecar-review` beside its `.sidecar`)."}
+
+## Decide
+
+Approve, and the change is published on the next sync:
+
+    sidecar review approve ${record.id}
+
+Reject, saying which file and what kind of content. Do not repeat the
+sensitive value itself:
+
+    sidecar review reject ${record.id} --reason "<file: what kind of content>"
+
+If you are unsure, or a person should weigh in, do neither: leave the review
+open and raise it with them. Nothing is published until someone approves, and
+they decide with the same two commands.
+`;
+}
+function configuredReviewer() {
+  const command = readSettings().reviewer;
+  if (!command)
+    throw new SidecarError("no reviewer is configured; set one with `sidecar review reviewer <command>`");
+  return command;
+}
+function launchReviewer(review) {
+  updateRecord(review, { launchedAt: nowIso() });
+  const child = spawn2(process.execPath, [sidecarCliPath(), "review", "run", review.record.id], {
+    cwd: review.dir,
+    detached: true,
+    stdio: "ignore",
+    env: { ...process.env, [SKIP_LOCAL_EXEC_ENV]: "1" }
+  });
+  child.unref();
+  logSidecarEvent("review-launch", { id: review.record.id });
+}
+function runReviewer(idOrPrefix) {
+  const review = findReview(idOrPrefix);
+  const { id } = review.record;
+  assertOpen(review);
+  if (review.run)
+    throw new SidecarError(`review ${id}'s reviewer already ran; \`sidecar review retry ${id}\` opens a new review of the same change`);
+  const command = configuredReviewer();
+  const file = runPath(review.dir);
+  const run = { pid: process.pid, command, startedAt: nowIso() };
+  writePrivateJson(file, run);
+  const log = fs8.openSync(path8.join(review.dir, "reviewer.log"), "a", 384);
+  let result;
+  try {
+    result = spawnSync4("/bin/sh", ["-c", command], {
+      cwd: review.dir,
+      stdio: ["ignore", log, log],
+      env: reviewerEnv(review)
+    });
+  } finally {
+    fs8.closeSync(log);
+  }
+  const finished = { ...run, finishedAt: nowIso(), exitCode: result.status, signal: result.signal };
+  writePrivateJson(file, finished);
+  logSidecarEvent("review-run", { id, exitCode: result.status, signal: result.signal });
+  return 0;
+}
+function reviewerEnv(review) {
+  const env = { ...process.env };
+  for (const name of [PEER_ENV, SOFT_SYNC_ENV, LOCAL_SYNC_ENV, SKIP_LOCAL_EXEC_ENV, GLOBAL_EXEC_ENV])
+    delete env[name];
+  const { record } = review;
+  return {
+    ...env,
+    SIDECAR_REVIEW_ID: record.id,
+    SIDECAR_REVIEW_DIR: review.dir,
+    SIDECAR_REVIEW_PROMPT: path8.join(review.dir, "instructions.md"),
+    SIDECAR_REVIEW_DIFF: path8.join(review.dir, "diff.patch"),
+    SIDECAR_REVIEW_ROOT: record.root,
+    SIDECAR_REVIEW_PEER: record.peer,
+    SIDECAR_REVIEW_CONFIG: peerConfigPath(record.root, record.peer)
+  };
 }
-var SKIP_SERVICE_ENV = "SIDECAR_SKIP_SERVICE", DAEMON_LABEL = "com.anteprojector.sidecar";
-var init_service = __esm(() => {
+function decideReview(review, verdict, reason) {
+  assertOpen(review);
+  if (review.record.publishing && verdict === "rejected") {
+    throw new SidecarError(`review ${review.record.id} is already being published; it can no longer be rejected`);
+  }
+  const record = { verdict, ...reason ? { reason } : {}, decidedAt: nowIso() };
+  writePrivateJson(path8.join(review.dir, "verdict.json"), record);
+  review.verdict = record;
+  review.state = verdict;
+  logSidecarEvent("review-decision", { id: review.record.id, verdict });
+}
+var REVIEW_SCHEMA = 1, KEEP_CLOSED_REVIEWS = 10, ID_PATTERN, LAUNCH_GRACE_SECONDS = 60, PACKET_DIFF_OPTIONS;
+var init_review = __esm(() => {
   init_util();
+  init_git();
   init_install();
+  init_config();
   init_state();
+  init_redaction();
+  ID_PATTERN = /^[0-9a-f]+$/;
+  PACKET_DIFF_OPTIONS = ["-r", "--no-renames", "--ignore-submodules=none"];
 });
 
 // src/sync.ts
-import crypto4 from "node:crypto";
-import fs8 from "node:fs";
+import crypto5 from "node:crypto";
+import fs9 from "node:fs";
 import os5 from "node:os";
-import path8 from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import path9 from "node:path";
 function syncProject(root, config, options) {
   const stage = (name) => options.onStage?.(name);
   stage("checkout");
@@ -4428,6 +4906,7 @@ function syncProject(root, config, options) {
   if (!options.remote && !hasAnyCommit(sidecarPath)) {
     throw new SidecarError(`local sync requires an initialized sidecar checkout at ${sidecarPath}; run \`sidecar sync\` first`);
   }
+  bindReviewPolicy(sidecarPath, config);
   const inbox = expandInbox(config, sidecarPath);
   ensureCommitIdentity(sidecarPath);
   ensureRedactionFilter(sidecarPath, config.redaction, config);
@@ -4444,7 +4923,9 @@ function syncProject(root, config, options) {
     settleCheckouts(sidecarPath, config, inbox, siblings);
   }
   if (!options.remote)
-    return;
+    return {};
+  if (reviewRequired(config))
+    return publishReviewed(root, sidecarPath, config, inbox, siblings, stage);
   stage("push-inbox");
   syncBranchBeforePush(sidecarPath, inbox, config);
   pushBranch(sidecarPath, inbox);
@@ -4452,6 +4933,288 @@ function syncProject(root, config, options) {
   mergeInboxBranches(sidecarPath, config, { forkFiles: true, push: true, remote: true });
   stage("settle-remote");
   settleCheckouts(sidecarPath, config, inbox, siblings);
+  return {};
+}
+function withPublicGit(repo, fn) {
+  assertRedactionFilterIntact(repo);
+  const { name, email } = sidecarIdentity();
+  const overrides = [
+    ["core.hooksPath", os5.devNull],
+    ["core.attributesFile", os5.devNull],
+    ["core.autocrlf", "false"],
+    ["commit.gpgSign", "false"],
+    ["tag.gpgSign", "false"],
+    ["i18n.commitEncoding", "UTF-8"],
+    ["rerere.enabled", "false"],
+    ["rerere.autoUpdate", "false"],
+    ["merge.renormalize", "false"],
+    ["merge.default", "text"],
+    ["push.pushOption", ""],
+    ["push.followTags", "false"],
+    ...neutralizedDrivers(repo)
+  ];
+  const env = {
+    GIT_AUTHOR_NAME: name,
+    GIT_AUTHOR_EMAIL: email,
+    GIT_COMMITTER_NAME: name,
+    GIT_COMMITTER_EMAIL: email,
+    GIT_NO_REPLACE_OBJECTS: "1",
+    GIT_ATTR_SOURCE: emptyTree(repo),
+    GIT_CONFIG_PARAMETERS: undefined,
+    GIT_CONFIG_COUNT: String(overrides.length)
+  };
+  overrides.forEach(([key, value], index) => {
+    env[`GIT_CONFIG_KEY_${index}`] = key;
+    env[`GIT_CONFIG_VALUE_${index}`] = value;
+  });
+  const saved = Object.fromEntries(Object.keys(env).map((key) => [key, process.env[key]]));
+  const apply = (values) => {
+    for (const [key, value] of Object.entries(values)) {
+      if (value === undefined)
+        delete process.env[key];
+      else
+        process.env[key] = value;
+    }
+  };
+  apply(env);
+  try {
+    return fn();
+  } finally {
+    apply(saved);
+  }
+}
+function neutralizedDrivers(repo) {
+  const keys = git(repo, ["config", "--name-only", "--get-regexp", "^(merge|filter)\\..+\\.(driver|clean|smudge|process)$"], { check: false }).stdout.split(`
+`).filter(Boolean);
+  return keys.flatMap((key) => {
+    const [section, ...rest] = key.split(".");
+    const driver = rest.slice(0, -1).join(".");
+    if (section === "merge")
+      return [[`merge.${driver}.driver`, "git merge-file --marker-size=%L %A %O %B"]];
+    if (driver === REDACTION_FILTER_NAME)
+      return [];
+    return [[`filter.${driver}.clean`, "cat"], [`filter.${driver}.smudge`, "cat"], [`filter.${driver}.process`, ""], [`filter.${driver}.required`, "false"]];
+  });
+}
+function assertRedactionFilterIntact(repo) {
+  if (git(repo, ["config", "--get-all", `filter.${REDACTION_FILTER_NAME}.process`], { check: false }).status === 0) {
+    throw new SidecarError(`filter.${REDACTION_FILTER_NAME}.process is configured; remove it — a review-gated peer publishes only through sidecar's own redaction filter`);
+  }
+}
+function assertPublishDestination(repo) {
+  const pushUrl = git(repo, ["config", "--get-all", "remote.origin.pushurl"], { check: false }).stdout.trim();
+  if (!pushUrl)
+    return;
+  const url = git(repo, ["config", "--get", "remote.origin.url"], { check: false }).stdout.trim();
+  if (pushUrl !== url) {
+    throw new SidecarError("remote.origin.pushurl sends this sidecar's pushes somewhere other than its remote; a review-gated peer publishes only to its remote — unset it");
+  }
+}
+function fetchPublic(repo) {
+  git(repo, ["fetch", "--quiet", "--prune", "--no-tags", "origin", "+refs/heads/*:refs/remotes/origin/*", `+refs/heads/*:${PUBLIC_REFS}*`]);
+}
+function publicRef(branch) {
+  return `${PUBLIC_REFS}${branch}`;
+}
+function refreshPublicRefs(repo) {
+  withPublicGit(repo, () => fetchPublic(repo));
+}
+function publicTip(repo, branch) {
+  return git(repo, ["rev-parse", "--verify", "--quiet", publicRef(branch)], { check: false }).stdout.trim() || undefined;
+}
+function isPublic(repo, commit) {
+  return Boolean(git(repo, ["for-each-ref", "--contains", commit, "--format=%(refname)", PUBLIC_REFS]).stdout.trim());
+}
+function publishReviewed(root, sidecarPath, config, inbox, siblings, stage) {
+  stage("fetch");
+  withPublicGit(sidecarPath, () => {
+    fetchPublic(sidecarPath);
+    if (!publicTip(sidecarPath, config.branch))
+      bootstrapReviewedMain(sidecarPath, config);
+    stage("publish");
+    const open = openReview(sidecarPath);
+    if (open?.state === "approved")
+      publishApprovedReview(sidecarPath, config, inbox, open);
+  });
+  stage("merge");
+  withPublicGit(sidecarPath, () => mergeFetchedInboxes(sidecarPath, config, { forkFiles: true }));
+  stage("merge-local");
+  mergeInboxBranches(sidecarPath, config, { forkFiles: true, push: false, remote: false });
+  stage("settle-remote");
+  settleCheckouts(sidecarPath, config, inbox, siblings);
+  stage("review");
+  const gate = withPublicGit(sidecarPath, () => gateUnpublished(root, sidecarPath, config));
+  if (gate?.launch)
+    launchReviewer(gate.review);
+  return gate ? { held: { review: gate.review, attention: reviewAttention(gate.review) } } : {};
+}
+function gateUnpublished(root, sidecarPath, config) {
+  const head = git(sidecarPath, ["rev-parse", `refs/heads/${config.branch}`]).stdout.trim();
+  const headTree = treeOf(sidecarPath, head);
+  const publicMain = publicTip(sidecarPath, config.branch);
+  const base = publicMain && git(sidecarPath, ["merge-base", head, publicMain], { check: false }).stdout.trim();
+  if (!base)
+    throw new SidecarError(`local ${config.branch} shares no history with the remote's; nothing is reviewed or published until it does`);
+  const open = openReview(sidecarPath);
+  const hasReviewer = Boolean(readSettings().reviewer);
+  if (treeOf(sidecarPath, base) === headTree) {
+    if (open && open.state !== "approved")
+      markSuperseded(open);
+    return;
+  }
+  if (open?.state === "pending" || open?.state === "approved") {
+    return { review: open, launch: open.state === "pending" && !open.record.launchedAt && hasReviewer };
+  }
+  if (open) {
+    if (open.record.tree === headTree)
+      return { review: open, launch: false };
+    markSuperseded(open);
+  }
+  const review = createReview({ root, config, sidecarPath, base, head });
+  console.log(`opened review ${paint("brand", review.record.id)} for ${review.record.files.length} changed file(s)`);
+  return { review, launch: hasReviewer };
+}
+function publishApprovedReview(sidecarPath, config, inbox, review) {
+  const { record } = review;
+  const target = record.publishing ?? { inbox, commit: cutPublishCommit(sidecarPath, config, inbox, record) };
+  const protectRef = publishingRef(record.id);
+  if (!isPublic(sidecarPath, target.commit)) {
+    const parents = git(sidecarPath, ["rev-list", "--parents", "-n", "1", target.commit]).stdout.trim().split(" ").slice(1);
+    if (!parents.every((parent) => isPublic(sidecarPath, parent))) {
+      markSuperseded(review);
+      git(sidecarPath, ["update-ref", "-d", protectRef], { check: false });
+      console.log(`review ${paint("brand", record.id)} was measured from a commit the remote does not have; reviewing again`);
+      return;
+    }
+    assertPublishDestination(sidecarPath);
+    if (!record.publishing) {
+      git(sidecarPath, ["update-ref", protectRef, target.commit]);
+      markPublishing(review, target.inbox, target.commit);
+    }
+    const push = git(sidecarPath, ["push", "--no-follow-tags", "origin", `${target.commit}:refs/heads/${target.inbox}`], { check: false });
+    if (push.status !== 0) {
+      throw new SidecarError(push.stderr.trim() || `could not publish review ${record.id} to ${target.inbox}`);
+    }
+    fetchPublic(sidecarPath);
+    console.log(`published review ${paint("brand", record.id)} to ${paint("brand", target.inbox)}`);
+  }
+  linkPublished(sidecarPath, config, review, target.commit);
+  markPublished(review, target.commit);
+  git(sidecarPath, ["update-ref", "-d", protectRef], { check: false });
+}
+function publishingRef(id) {
+  return `refs/sidecar-publishing/${id}`;
+}
+function retryReview(review) {
+  const { record } = review;
+  if (!isOpen(review))
+    throw new SidecarError(`review ${record.id} is already ${review.state}`);
+  if (record.publishing)
+    throw new SidecarError(`review ${record.id} is already being published`);
+  if (review.state === "approved")
+    throw new SidecarError(`review ${record.id} is approved and publishes on the next sync`);
+  const config = loadPeer(record.root, record.peer).config;
+  const sidecarPath = requireSidecarCheckout(record.root, config);
+  markSuperseded(review);
+  const fresh = withPublicGit(sidecarPath, () => createReview({ root: record.root, config, sidecarPath, base: record.base, head: record.head }));
+  launchReviewer(fresh);
+  return fresh;
+}
+function cutPublishCommit(sidecarPath, config, inbox, record) {
+  const previous = publicTip(sidecarPath, inbox);
+  const parents = [record.base, ...previous && !isAncestor(sidecarPath, previous, record.base) ? [previous] : []];
+  const body = [
+    "sidecar publish",
+    "",
+    `source: ${currentMachine()}`,
+    `inbox: ${inbox}`,
+    `review: ${record.id}`,
+    ...publishedWriteTrailers(sidecarPath, config, record)
+  ];
+  return git(sidecarPath, [
+    "commit-tree",
+    record.tree,
+    ...parents.flatMap((parent) => ["-p", parent]),
+    "-m",
+    body.join(`
+`)
+  ]).stdout.trim();
+}
+function publishedWriteTrailers(repo, config, record) {
+  const defaults = { resolve: config.resolve, redaction: config.redaction };
+  const paths = record.files.map((file) => file.path).filter((filePath) => resolveFileRules(config.rules, filePath, defaults).resolve === "lww");
+  if (paths.length > WRITTEN_TRAILER_LIMIT)
+    return [];
+  const now = Math.floor(Date.now() / 1000);
+  return paths.map((filePath) => {
+    const { time } = lastWriteEvent(repo, record.head, filePath);
+    return lwwWrittenTrailer(filePath, { time: Math.min(Math.max(0, time), now), source: `review-${record.id}` });
+  });
+}
+function linkPublished(sidecarPath, config, review, published) {
+  const main = `refs/heads/${config.branch}`;
+  if (isAncestor(sidecarPath, published, main))
+    return;
+  if (!isAncestor(sidecarPath, review.record.head, main)) {
+    logSidecarEvent("review-link-skip", { sidecarPath, id: review.record.id });
+    return;
+  }
+  withScratchWorktree(sidecarPath, config, "HEAD", (worktree) => {
+    git(worktree, ["switch", config.branch]);
+    git(worktree, ["merge", "--no-ff", "-s", "ours", "-m", `sidecar: link published review ${review.record.id}`, published]);
+  });
+}
+function mergePublishedInboxes(sidecarPath, config, options) {
+  return withPublicGit(sidecarPath, () => {
+    fetchPublic(sidecarPath);
+    return mergeFetchedInboxes(sidecarPath, config, options);
+  });
+}
+function mergeFetchedInboxes(sidecarPath, config, options) {
+  if (!publicTip(sidecarPath, config.branch))
+    return 0;
+  const publicMain = publicRef(config.branch);
+  if (publishedInboxBranches(sidecarPath, config).every((ref) => isAncestor(sidecarPath, ref, publicMain))) {
+    console.log("no published inbox branches to merge");
+    return 0;
+  }
+  assertPublishDestination(sidecarPath);
+  return withScratchWorktree(sidecarPath, config, publicMain, (worktree) => {
+    assertRedactionFilterIntact(worktree);
+    const maxAttempts = 3;
+    for (let attempt = 1;; attempt += 1) {
+      if (attempt > 1) {
+        fetchPublic(sidecarPath);
+        git(worktree, ["reset", "--hard", publicMain]);
+      }
+      const pending = publishedInboxBranches(worktree, config).filter((ref) => !isAncestor(worktree, ref, "HEAD"));
+      if (!pending.length) {
+        console.log("no published inbox branches to merge");
+        return 0;
+      }
+      const merged = [];
+      for (const ref of pending) {
+        console.log(`merging ${paint("brand", remoteBranchName(ref))}`);
+        if (mergeInboxBranch(worktree, config, ref, options))
+          merged.push(ref);
+      }
+      const push = git(worktree, ["push", "--no-follow-tags", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
+      if (push.status !== 0) {
+        if (attempt >= maxAttempts)
+          throw new SidecarError(push.stderr.trim() || `could not push ${config.branch}`);
+        console.log(`push of ${config.branch} was rejected; refetching and retrying`);
+        continue;
+      }
+      fetchPublic(sidecarPath);
+      console.log(`pushed ${config.branch}`);
+      console.log(`merged ${merged.length} inbox branch(es)`);
+      return merged.length;
+    }
+  });
+}
+function publishedInboxBranches(repo, config) {
+  const prefix = inboxPrefix(config);
+  return git(repo, ["for-each-ref", "--format=%(refname)", PUBLIC_REFS]).stdout.split(/\r?\n/).map((ref) => ref.trim()).filter((ref) => ref && matchesInboxPrefix(prefix, ref.slice(PUBLIC_REFS.length))).sort();
 }
 function settleCheckouts(sidecarPath, config, inbox, siblings) {
   refreshInboxFromMain(sidecarPath, config, inbox);
@@ -4465,7 +5228,7 @@ function settleCheckouts(sidecarPath, config, inbox, siblings) {
     } catch (error) {
       logSidecarEvent("settle-skip", {
         sidecarPath: sibling,
-        message: error instanceof Error ? error.message : String(error)
+        ...reviewRequired(config) ? {} : { message: error instanceof Error ? error.message : String(error) }
       });
     }
   }
@@ -4500,33 +5263,44 @@ function reportSyncHealth(root, config, outcome) {
     const sidecarPath = resolveSidecarPath(root, config);
     if (!hasGitMetadata(sidecarPath))
       return;
-    const branch = healthBranchFor(sidecarPath);
-    const previous = readHealthRecordAt(sidecarPath, `origin/${branch}`);
-    const identity = {
-      machine: `${currentUser()}@${currentHost()}`,
-      root,
-      peer: config.peer === DEFAULT_PEER ? undefined : config.peer,
-      inbox: expandInbox(config, sidecarPath),
-      version: packageVersion()
-    };
-    const record = nextHealthRecord(previous, identity, outcome, nowIso());
-    if (!shouldPublishHealth(previous, record))
-      return;
-    publishHealthRecord(sidecarPath, branch, record);
-    logSidecarEvent("health", {
-      branch,
-      status: record.status,
-      stage: record.stage,
-      consecutiveFailures: record.consecutiveFailures
-    });
+    withPublicGit(sidecarPath, () => publishHealth(root, config, sidecarPath, outcome));
   } catch (error) {
     logSidecarEvent("failure", {
       command: "health",
       root,
-      message: `could not publish health: ${error instanceof Error ? error.message : String(error)}`
+      message: reviewRequired(config) ? "could not publish health" : `could not publish health: ${error instanceof Error ? error.message : String(error)}`
     });
   }
 }
+function publishHealth(root, config, sidecarPath, outcome) {
+  const branch = healthBranchFor(sidecarPath);
+  const gated = reviewRequired(config);
+  if (gated && outcome.status === "failed") {
+    try {
+      fetchPublic(sidecarPath);
+    } catch {}
+  }
+  const previous = readHealthRecordAt(sidecarPath, gated ? publicRef(branch) : `origin/${branch}`);
+  const identity = {
+    machine: currentMachine(),
+    root,
+    peer: config.peer === DEFAULT_PEER ? undefined : config.peer,
+    inbox: expandInbox(config, sidecarPath),
+    version: packageVersion()
+  };
+  const record = nextHealthRecord(previous, identity, outcome, nowIso());
+  if (!shouldPublishHealth(previous, record))
+    return;
+  if (gated)
+    assertPublishDestination(sidecarPath);
+  publishHealthRecord(sidecarPath, branch, record);
+  logSidecarEvent("health", {
+    branch,
+    status: record.status,
+    stage: record.stage,
+    consecutiveFailures: record.consecutiveFailures
+  });
+}
 function publishHealthRecord(sidecarPath, branch, record) {
   const blob = git(sidecarPath, ["hash-object", "-w", "--stdin"], {
     input: serializeHealthRecord(record)
@@ -4535,17 +5309,8 @@ function publishHealthRecord(sidecarPath, branch, record) {
     input: `100644 blob ${blob}	${HEALTH_FILE}
 `
   }).stdout.trim();
-  const commit = git(sidecarPath, [
-    "-c",
-    `user.name=${currentUser()}`,
-    "-c",
-    `user.email=${slug(currentUser())}@${slug(currentHost())}.local`,
-    "commit-tree",
-    tree,
-    "-m",
-    `health: ${record.status} — ${record.machine}`
-  ]).stdout.trim();
-  git(sidecarPath, ["push", "--force", "origin", `${commit}:refs/heads/${branch}`]);
+  const commit = git(sidecarPath, ["commit-tree", tree, "-m", `health: ${record.status} — ${record.machine}`]).stdout.trim();
+  git(sidecarPath, ["push", "--no-follow-tags", "--force", "origin", `${commit}:refs/heads/${branch}`]);
 }
 function readHealthRecordAt(sidecarPath, ref) {
   const result = git(sidecarPath, ["show", `${ref}:${HEALTH_FILE}`], { check: false });
@@ -4572,9 +5337,9 @@ function mergeInboxBranches(sidecarPath, config, options) {
   ensureCommitIdentity(sidecarPath);
   if (options.remote)
     fetch(sidecarPath, false);
-  if (!hasPendingInboxWork(sidecarPath, config)) {
+  if (!hasPendingInboxWork(sidecarPath, config) && mainContainsRemote(sidecarPath, config)) {
     if (options.push && !mainMatchesRemote(sidecarPath, config)) {
-      const push = git(sidecarPath, ["push", "origin", `refs/heads/${config.branch}:refs/heads/${config.branch}`], {
+      const push = git(sidecarPath, ["push", "--no-follow-tags", "origin", `refs/heads/${config.branch}:refs/heads/${config.branch}`], {
         check: false
       });
       if (push.status === 0) {
@@ -4593,18 +5358,21 @@ function mergeInboxBranches(sidecarPath, config, options) {
   if (git(sidecarPath, ["branch", "--show-current"]).stdout.trim() === config.branch) {
     ensureInboxBranch(sidecarPath, config, expandInbox(config, sidecarPath));
   }
-  const scratch = path8.join(os5.tmpdir(), `sidecar-merge-${crypto4.createHash("sha1").update(sidecarPath).digest("hex").slice(0, 12)}`);
-  const worktree = path8.join(scratch, "checkout");
+  return withScratchWorktree(sidecarPath, config, "HEAD", (worktree) => mergeInboxBranchesAt(worktree, config, options));
+}
+function withScratchWorktree(sidecarPath, config, start, fn) {
+  const scratch = path9.join(os5.tmpdir(), `sidecar-merge-${crypto5.createHash("sha1").update(sidecarPath).digest("hex").slice(0, 12)}`);
+  const worktree = path9.join(scratch, "checkout");
   git(sidecarPath, ["worktree", "remove", "--force", worktree], { check: false });
-  fs8.rmSync(scratch, { recursive: true, force: true });
+  fs9.rmSync(scratch, { recursive: true, force: true });
   git(sidecarPath, ["worktree", "prune", "--expire", "now"], { check: false });
   try {
-    git(sidecarPath, ["worktree", "add", "--detach", worktree]);
+    git(sidecarPath, ["worktree", "add", "--detach", worktree, start]);
     ensureRedactionFilter(worktree, config.redaction, config);
-    return mergeInboxBranchesAt(worktree, config, options);
+    return fn(worktree);
   } finally {
     git(sidecarPath, ["worktree", "remove", "--force", worktree], { check: false });
-    fs8.rmSync(scratch, { recursive: true, force: true });
+    fs9.rmSync(scratch, { recursive: true, force: true });
   }
 }
 function mainMatchesRemote(repo, config) {
@@ -4615,6 +5383,11 @@ function mainMatchesRemote(repo, config) {
   const remote = refs.get(remoteRef);
   return local !== undefined && local === remote;
 }
+function mainContainsRemote(repo, config) {
+  if (!remoteRefExists(repo, config.branch) || !branchExists(repo, config.branch))
+    return true;
+  return isAncestor(repo, `origin/${config.branch}`, `refs/heads/${config.branch}`);
+}
 function hasPendingInboxWork(repo, config) {
   const main = `refs/heads/${config.branch}`;
   return pendingInboxBranches(repo, config).some((branch) => !isAncestor(repo, branch, main));
@@ -4638,7 +5411,7 @@ function mergeInboxBranchesAt(sidecarPath, config, options) {
         merged.push(remoteBranch);
     }
     if (options.push) {
-      const push = git(sidecarPath, ["push", "-u", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
+      const push = git(sidecarPath, ["push", "--no-follow-tags", "-u", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
       if (push.status !== 0) {
         if (attempt >= maxAttempts) {
           throw new SidecarError(push.stderr.trim() || `could not push ${config.branch}`);
@@ -4709,10 +5482,10 @@ function familySidecarCheckout(root, config) {
   } catch {
     return;
   }
-  if (primaryConfig.remote !== config.remote)
+  if (!sharesFamilyCheckout(primaryConfig, config))
     return;
   const primaryPath = resolveSidecarPath(primary, primaryConfig);
-  if (path8.resolve(primaryPath) === path8.resolve(primary))
+  if (path9.resolve(primaryPath) === path9.resolve(primary))
     return;
   if (!hasGitMetadata(primaryPath))
     cloneOrUpdate(primary, primaryConfig, true);
@@ -4732,7 +5505,7 @@ function checkoutIsUnlinkedFromFamily(root, config, sidecarPath) {
   if (isStandalone(config))
     return false;
   try {
-    if (!fs8.statSync(path8.join(sidecarPath, ".git")).isDirectory())
+    if (!fs9.statSync(path9.join(sidecarPath, ".git")).isDirectory())
       return false;
   } catch {
     return false;
@@ -4741,21 +5514,34 @@ function checkoutIsUnlinkedFromFamily(root, config, sidecarPath) {
   if (!primary)
     return false;
   try {
-    const primaryConfig = readConfig(peerConfigPath(primary, config.peer));
-    return primaryConfig.remote === config.remote;
+    return sharesFamilyCheckout(readConfig(peerConfigPath(primary, config.peer)), config);
   } catch {
     return false;
   }
 }
+function sharesFamilyCheckout(primaryConfig, config) {
+  return primaryConfig.remote === config.remote && reviewRequired(primaryConfig) === reviewRequired(config);
+}
+function bindReviewPolicy(sidecarPath, config) {
+  const bound = git(sidecarPath, ["config", "--local", "--get", REVIEW_POLICY_KEY], { check: false }).stdout.trim();
+  if (reviewRequired(config)) {
+    if (bound !== "required")
+      git(sidecarPath, ["config", "--local", REVIEW_POLICY_KEY, "required"]);
+    return;
+  }
+  if (bound === "required") {
+    throw new SidecarError(`${sidecarPath} holds work from a peer that requires review, and this peer would publish it unreviewed; set review = "required" in this repo's ${peerFileName(config.peer)} too — or, to publish that work without review, \`git -C ${sidecarPath} config --unset ${REVIEW_POLICY_KEY}\``);
+  }
+}
 function cloneOrUpdate(root, config, bootstrapMain, options) {
   const sidecarPath = resolveSidecarPath(root, config);
-  if (fs8.existsSync(sidecarPath) && !hasGitMetadata(sidecarPath)) {
-    if (fs8.readdirSync(sidecarPath).length) {
+  if (fs9.existsSync(sidecarPath) && !hasGitMetadata(sidecarPath)) {
+    if (fs9.readdirSync(sidecarPath).length) {
       throw new SidecarError(`${sidecarPath} exists and is not an empty Git repo`);
     }
-    fs8.rmdirSync(sidecarPath);
+    fs9.rmdirSync(sidecarPath);
   }
-  if (!fs8.existsSync(sidecarPath)) {
+  if (!fs9.existsSync(sidecarPath)) {
     const primaryPath = familySidecarCheckout(root, config);
     if (primaryPath)
       git(primaryPath, ["worktree", "add", "--detach", sidecarPath]);
@@ -4776,7 +5562,7 @@ function cloneOrUpdate(root, config, bootstrapMain, options) {
     throw new SidecarError(`${sidecarPath} is not usable as a sidecar checkout`);
   }
   if (options?.checkoutId) {
-    fs8.writeFileSync(path8.join(gitDir(sidecarPath), "sidecar-id"), `${options.checkoutId}
+    fs9.writeFileSync(path9.join(gitDir(sidecarPath), "sidecar-id"), `${options.checkoutId}
 `, {
       encoding: "utf8",
       mode: 384
@@ -4784,6 +5570,7 @@ function cloneOrUpdate(root, config, bootstrapMain, options) {
   }
   ensureCommitIdentity(sidecarPath);
   ensureRedactionFilter(sidecarPath, config.redaction, config);
+  bindReviewPolicy(sidecarPath, config);
   if (bootstrapMain)
     bootstrapMainBranch(sidecarPath, config);
   const inbox = expandInbox(config, sidecarPath);
@@ -4793,6 +5580,10 @@ function cloneOrUpdate(root, config, bootstrapMain, options) {
 function bootstrapMainBranch(repo, config) {
   if (remoteRefExists(repo, config.branch))
     return;
+  if (reviewRequired(config)) {
+    withPublicGit(repo, () => bootstrapReviewedMain(repo, config));
+    return;
+  }
   if (hasAnyCommit(repo)) {
     const current = git(repo, ["branch", "--show-current"]).stdout.trim();
     if (current !== config.branch) {
@@ -4811,7 +5602,7 @@ function bootstrapMainBranch(repo, config) {
     pushBranch(repo, config.branch);
     return;
   }
-  fs8.writeFileSync(path8.join(repo, "README.md"), `# Sidecar
+  fs9.writeFileSync(path9.join(repo, "README.md"), `# Sidecar
 
 Scratch space for a code repository: plans, notes, and agent context.
 This is a plain git repo you own — read it, edit it, clone it anywhere.
@@ -4821,6 +5612,21 @@ Kept in sync by [sidecar](https://github.com/endograph/sidecar).
   git(repo, ["commit", "-m", "Initialize sidecar"]);
   pushBranch(repo, config.branch);
 }
+function bootstrapReviewedMain(repo, config) {
+  assertPublishDestination(repo);
+  const root = git(repo, ["commit-tree", emptyTree(repo), "-m", "Initialize sidecar"]).stdout.trim();
+  git(repo, ["push", "--no-follow-tags", "origin", `${root}:refs/heads/${config.branch}`]);
+  fetchPublic(repo);
+  console.log(`started ${config.branch} on the remote empty; this checkout's content is published through review`);
+  const ref = `refs/heads/${config.branch}`;
+  if (!hasAnyCommit(repo)) {
+    git(repo, ["update-ref", ref, root]);
+    return;
+  }
+  const local = git(repo, ["rev-parse", "--verify", "--quiet", ref], { check: false }).stdout.trim() || git(repo, ["rev-parse", "HEAD"]).stdout.trim();
+  const link = git(repo, ["commit-tree", treeOf(repo, local), "-p", local, "-p", root, "-m", "sidecar: link the remote's initial main"]).stdout.trim();
+  git(repo, ["update-ref", ref, link]);
+}
 function ensureMainBranch(repo, config) {
   if (branchExists(repo, config.branch)) {
     git(repo, ["switch", config.branch]);
@@ -4842,6 +5648,16 @@ function ensureMainBranch(repo, config) {
     git(repo, ["merge", "--ff-only", remoteBranch]);
     return;
   }
+  if (reviewRequired(config)) {
+    if (git(repo, ["merge-base", "HEAD", remoteBranch], { check: false }).status !== 0) {
+      const link = git(repo, ["commit-tree", treeOf(repo, "HEAD"), "-p", "HEAD", "-p", remoteBranch, "-m", `sidecar: link the remote's new ${config.branch}`]).stdout.trim();
+      git(repo, ["merge", "--ff-only", link]);
+      console.log(`${remoteBranch} was started over; local ${config.branch} is joined to it and reviewed from there`);
+      return;
+    }
+    mergeInboxBranch(repo, config, remoteBranch, { forkFiles: true });
+    return;
+  }
   const tip = git(repo, ["rev-parse", "--short", "HEAD"]).stdout.trim();
   const discarded = `refs/sidecar-discarded/${config.branch}/${utcTimestamp()}-${tip}`;
   git(repo, ["update-ref", discarded, "HEAD"], { check: false });
@@ -4889,29 +5705,29 @@ function ensureSidecarCheckout(root, config) {
   return requireSidecarCheckout(root, config);
 }
 function snapshot(repo, mainRoot, inbox, message = "sidecar snapshot", redactionMode = DEFAULT_REDACTION_MODE, policy) {
-  if (fs8.existsSync(path8.join(gitDir(repo), "MERGE_HEAD"))) {
+  if (fs9.existsSync(path9.join(gitDir(repo), "MERGE_HEAD"))) {
     throw new SidecarError("cannot snapshot an unfinished merge; resolve or abort it before syncing");
   }
   const rewired = ensureRedactionFilter(repo, redactionMode, policy);
-  const revisionPath = path8.join(gitDir(repo), "sidecar-redaction-revision");
+  const revisionPath = path9.join(gitDir(repo), "sidecar-redaction-revision");
   const revision = `${REDACTION_FILTER_REVISION}:${redactionMode}:${rulesFingerprint(policy?.rules)}`;
   let appliedRevision = "";
   try {
-    appliedRevision = fs8.readFileSync(revisionPath, "utf8");
+    appliedRevision = fs9.readFileSync(revisionPath, "utf8");
   } catch {}
   git(repo, ["add", "-A"]);
   if ((rewired || appliedRevision !== revision) && hasAnyCommit(repo)) {
     git(repo, ["add", "--renormalize", "."]);
   }
   if (git(repo, ["diff", "--cached", "--quiet"], { check: false }).status === 0) {
-    fs8.writeFileSync(revisionPath, revision, "utf8");
+    fs9.writeFileSync(revisionPath, revision, "utf8");
     console.log("no sidecar changes to snapshot");
     return false;
   }
   const staged = git(repo, ["diff", "--cached", "--name-only", "-z", "--diff-filter=d"]).stdout.split("\x00").filter(Boolean);
-  const source = `${currentUser()}@${currentHost()}`;
+  const source = currentMachine();
   const body = [message, "", `source: ${source}`];
-  if (path8.resolve(repo) !== path8.resolve(mainRoot)) {
+  if (path9.resolve(repo) !== path9.resolve(mainRoot)) {
     const mainHead = git(mainRoot, ["rev-parse", "--short", "HEAD"], { check: false });
     body.push(`main-head: ${mainHead.status === 0 ? mainHead.stdout.trim() : "unborn"}`);
   }
@@ -4919,7 +5735,7 @@ function snapshot(repo, mainRoot, inbox, message = "sidecar snapshot", redaction
   body.push(...writtenTrailers(repo, staged));
   git(repo, ["commit", "-m", body.join(`
 `)]);
-  fs8.writeFileSync(revisionPath, revision, "utf8");
+  fs9.writeFileSync(revisionPath, revision, "utf8");
   console.log(`committed sidecar snapshot to ${paint("brand", inbox)}`);
   reportRedactions(repo, staged, redactionMode, policy?.rules);
   return true;
@@ -4933,7 +5749,7 @@ function writtenTrailers(repo, staged) {
 `))
       continue;
     try {
-      const seconds = Math.floor(fs8.lstatSync(path8.join(repo, relPath)).mtimeMs / 1000);
+      const seconds = Math.floor(fs9.lstatSync(path9.join(repo, relPath)).mtimeMs / 1000);
       if (seconds > 0)
         trailers.push(`${WRITTEN_TRAILER} ${seconds} ${relPath}`);
     } catch {}
@@ -4944,7 +5760,7 @@ function reportRedactions(repo, staged, mode, rules) {
   let files = 0;
   let items = 0;
   for (const relPath of staged) {
-    const delta = fileRedactionDelta(path8.join(repo, relPath), mode, { rules, relativePath: relPath });
+    const delta = fileRedactionDelta(path9.join(repo, relPath), mode, { rules, relativePath: relPath });
     if (!delta)
       continue;
     files += 1;
@@ -4958,7 +5774,7 @@ function reportRedactions(repo, staged, mode, rules) {
 function fileRedactionDelta(filePath, mode, policy) {
   let data;
   try {
-    data = fs8.readFileSync(filePath);
+    data = fs9.readFileSync(filePath);
   } catch {
     return;
   }
@@ -4973,14 +5789,14 @@ function fileRedactionDelta(filePath, mode, policy) {
   return { text, redacted, items };
 }
 function checkoutRedactionPolicy(repo) {
-  const policyPath = path8.join(gitDir(repo), REDACTION_POLICY_FILE);
+  const policyPath = path9.join(gitDir(repo), REDACTION_POLICY_FILE);
   let bound;
   try {
-    bound = JSON.parse(fs8.readFileSync(policyPath, "utf8"));
+    bound = JSON.parse(fs9.readFileSync(policyPath, "utf8"));
   } catch {
     throw new SidecarError("missing or invalid checkout redaction policy; run `sidecar sync`");
   }
-  if (!bound || typeof bound !== "object" || typeof bound.fingerprint !== "string" || bound.rulesPath !== undefined && (typeof bound.rulesPath !== "string" || !path8.isAbsolute(bound.rulesPath))) {
+  if (!bound || typeof bound !== "object" || typeof bound.fingerprint !== "string" || bound.rulesPath !== undefined && (typeof bound.rulesPath !== "string" || !path9.isAbsolute(bound.rulesPath))) {
     throw new SidecarError("invalid checkout redaction policy; run `sidecar sync`");
   }
   const mode = redactionModeConfigValue(bound.mode, "checkout redaction mode");
@@ -4995,27 +5811,28 @@ function ensureRedactionFilter(repo, mode = DEFAULT_REDACTION_MODE, policy) {
   if (policy?.rules?.length && !policy.rulesPath) {
     throw new SidecarError("path redaction rules require an explicit host rules file");
   }
-  const rulesPath = policy?.rulesPath ? path8.resolve(policy.rulesPath) : undefined;
+  const rulesPath = policy?.rulesPath ? path9.resolve(policy.rulesPath) : undefined;
   if (rulesPath && rulesFingerprint(readRules(rulesPath)) !== fingerprint) {
     throw new SidecarError("sidecar rules changed during this operation; run `sidecar sync` to apply them");
   }
-  const policyPath = path8.join(gitDir(repo), REDACTION_POLICY_FILE);
+  const policyPath = path9.join(gitDir(repo), REDACTION_POLICY_FILE);
   const bound = JSON.stringify({ mode, rulesPath, fingerprint });
   let previous = "";
   try {
-    previous = fs8.readFileSync(policyPath, "utf8");
+    previous = fs9.readFileSync(policyPath, "utf8");
   } catch {}
   const policyChanged = previous !== bound;
   if (policyChanged)
-    fs8.writeFileSync(policyPath, bound, { encoding: "utf8", mode: 384 });
-  const command = `${filterCommandQuote(process.execPath)} ${filterCommandQuote(redactCliPath())} redact --checkout-policy --path %f`;
+    fs9.writeFileSync(policyPath, bound, { encoding: "utf8", mode: 384 });
+  const command = `${filterCommandQuote(process.execPath)} ${filterCommandQuote(sidecarCliPath())} redact --checkout-policy --path %f`;
   const wanted = [
     [`filter.${REDACTION_FILTER_NAME}.clean`, command],
     [`filter.${REDACTION_FILTER_NAME}.revision`, REDACTION_FILTER_REVISION],
     [`filter.${REDACTION_FILTER_NAME}.smudge`, "cat"],
     [`filter.${REDACTION_FILTER_NAME}.required`, "true"]
   ];
-  const attributesPath = path8.join(gitCommonDir(repo), "info", "attributes");
+  const processKey = `filter.${REDACTION_FILTER_NAME}.process`;
+  const attributesPath = path9.join(gitCommonDir(repo), "info", "attributes");
   const line = `* filter=${REDACTION_FILTER_NAME}`;
   const configured = git(repo, ["config", "--get-regexp", `^filter\\.${REDACTION_FILTER_NAME}\\.`], {
     check: false
@@ -5025,10 +5842,10 @@ function ensureRedactionFilter(repo, mode = DEFAULT_REDACTION_MODE, policy) {
     const space = entry.indexOf(" ");
     return [entry.slice(0, space), entry.slice(space + 1)];
   }));
-  const configOk = wanted.every(([key, value]) => current.get(key) === value);
+  const configOk = wanted.every(([key, value]) => current.get(key) === value) && !current.has(processKey);
   let attributes = "";
   try {
-    attributes = fs8.readFileSync(attributesPath, "utf8");
+    attributes = fs9.readFileSync(attributesPath, "utf8");
   } catch {}
   const attributesOk = attributes.split(/\r?\n/).includes(line);
   if (configOk && attributesOk)
@@ -5036,9 +5853,10 @@ function ensureRedactionFilter(repo, mode = DEFAULT_REDACTION_MODE, policy) {
   for (const [key, value] of wanted) {
     git(repo, ["config", key, value]);
   }
+  git(repo, ["config", "--unset-all", processKey], { check: false });
   if (!attributesOk) {
-    fs8.mkdirSync(path8.dirname(attributesPath), { recursive: true });
-    fs8.appendFileSync(attributesPath, attributes && !attributes.endsWith(`
+    fs9.mkdirSync(path9.dirname(attributesPath), { recursive: true });
+    fs9.appendFileSync(attributesPath, attributes && !attributes.endsWith(`
 `) ? `
 ${line}
 ` : `${line}
@@ -5048,13 +5866,13 @@ ${line}
 }
 function removeRedactionFilter(repo) {
   git(repo, ["config", "--remove-section", `filter.${REDACTION_FILTER_NAME}`], { check: false });
-  fs8.rmSync(path8.join(gitDir(repo), "sidecar-redaction-revision"), { force: true });
-  fs8.rmSync(path8.join(gitDir(repo), REDACTION_POLICY_FILE), { force: true });
-  const attributesPath = path8.join(gitCommonDir(repo), "info", "attributes");
+  fs9.rmSync(path9.join(gitDir(repo), "sidecar-redaction-revision"), { force: true });
+  fs9.rmSync(path9.join(gitDir(repo), REDACTION_POLICY_FILE), { force: true });
+  const attributesPath = path9.join(gitCommonDir(repo), "info", "attributes");
   const line = `* filter=${REDACTION_FILTER_NAME}`;
   let contents;
   try {
-    contents = fs8.readFileSync(attributesPath, "utf8");
+    contents = fs9.readFileSync(attributesPath, "utf8");
   } catch {
     return;
   }
@@ -5063,17 +5881,13 @@ function removeRedactionFilter(repo) {
   if (kept.length === lines.length)
     return;
   if (kept.every((entry) => !entry.trim())) {
-    fs8.rmSync(attributesPath, { force: true });
+    fs9.rmSync(attributesPath, { force: true });
   } else {
-    fs8.writeFileSync(attributesPath, `${kept.join(`
+    fs9.writeFileSync(attributesPath, `${kept.join(`
 `).replace(/\s+$/g, "")}
 `, "utf8");
   }
 }
-function redactCliPath() {
-  const self = fileURLToPath2(import.meta.url);
-  return self.endsWith(".ts") ? path8.join(path8.dirname(self), "..", "dist", "cli.js") : self;
-}
 function filterCommandQuote(value) {
   return `"${value.replace(/([\\"$`])/g, "\\$1")}"`;
 }
@@ -5120,7 +5934,7 @@ function refreshInboxFromMain(repo, config, inbox) {
   }
 }
 function pushBranch(repo, branch) {
-  git(repo, ["push", "-u", "origin", `HEAD:refs/heads/${branch}`]);
+  git(repo, ["push", "--no-follow-tags", "-u", "origin", `HEAD:refs/heads/${branch}`]);
   console.log(`pushed ${paint("brand", branch)}`);
 }
 function forkConflicts(repo, remoteBranch, selectedPaths) {
@@ -5163,14 +5977,14 @@ function forkConflicts(repo, remoteBranch, selectedPaths) {
         continue;
       const { oid, mode } = stages[stage];
       const outPath = forkPath(conflictPath, label, oid);
-      const fullOut = path8.join(repo, outPath);
-      fs8.mkdirSync(path8.dirname(fullOut), { recursive: true });
-      fs8.rmSync(fullOut, { force: true });
+      const fullOut = path9.join(repo, outPath);
+      fs9.mkdirSync(path9.dirname(fullOut), { recursive: true });
+      fs9.rmSync(fullOut, { force: true });
       if (mode === "120000")
-        fs8.symlinkSync(blob.toString("utf8"), fullOut);
+        fs9.symlinkSync(blob.toString("utf8"), fullOut);
       else {
-        fs8.writeFileSync(fullOut, blob);
-        fs8.chmodSync(fullOut, mode === "100755" ? 493 : 420);
+        fs9.writeFileSync(fullOut, blob);
+        fs9.chmodSync(fullOut, mode === "100755" ? 493 : 420);
       }
       git(repo, ["add", "--", `:(literal)${outPath}`]);
       versions.push({
@@ -5178,18 +5992,18 @@ function forkConflicts(repo, remoteBranch, selectedPaths) {
         label,
         oid,
         path: outPath,
-        sha256: crypto4.createHash("sha256").update(blob).digest("hex")
+        sha256: crypto5.createHash("sha256").update(blob).digest("hex")
       });
     }
     git(repo, ["rm", "-f", "--", `:(literal)${conflictPath}`]);
     manifest.paths.push({ path: conflictPath, versions });
   }
-  const manifestDir = path8.join(repo, ".sidecar-conflicts");
-  fs8.mkdirSync(manifestDir, { recursive: true });
-  const manifestPath = path8.join(manifestDir, `${timestamp}-${manifestLabel}-fork-files.json`);
-  fs8.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  const manifestDir = path9.join(repo, ".sidecar-conflicts");
+  fs9.mkdirSync(manifestDir, { recursive: true });
+  const manifestPath = path9.join(manifestDir, `${timestamp}-${manifestLabel}-fork-files.json`);
+  fs9.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  git(repo, ["add", "--", `:(literal)${path8.relative(repo, manifestPath)}`]);
+  git(repo, ["add", "--", `:(literal)${path9.relative(repo, manifestPath)}`]);
   if (Object.keys(selectConflictPaths(unmergedPaths(repo), selectedPaths)).length) {
     throw new SidecarError("fork-files did not clear all unmerged paths");
   }
@@ -5219,7 +6033,7 @@ function resolveLastWriterWins(repo, canonicalBranch, remoteBranch, selectedPath
     ...selections.filter((entry) => entry.winner).map((entry) => entry.filePath)
   ]);
   for (const filePath of present) {
-    for (let parent = path8.posix.dirname(filePath);parent !== "."; parent = path8.posix.dirname(parent)) {
+    for (let parent = path9.posix.dirname(filePath);parent !== "."; parent = path9.posix.dirname(parent)) {
       if (present.has(parent))
         throw new SidecarError(`last-writer-wins selected incompatible file and directory paths: ${parent}, ${filePath}`);
     }
@@ -5246,12 +6060,12 @@ function resolveLastWriterWins(repo, canonicalBranch, remoteBranch, selectedPath
     written.push(lwwWrittenTrailer(filePath, write));
   }
   if (manifest.paths.length) {
-    const manifestDir = path8.join(repo, ".sidecar-conflicts");
-    fs8.mkdirSync(manifestDir, { recursive: true });
-    const manifestPath = path8.join(manifestDir, `${timestamp}-${fileLabel(branch)}-lww.json`);
-    fs8.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}
+    const manifestDir = path9.join(repo, ".sidecar-conflicts");
+    fs9.mkdirSync(manifestDir, { recursive: true });
+    const manifestPath = path9.join(manifestDir, `${timestamp}-${fileLabel(branch)}-lww.json`);
+    fs9.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-    git(repo, ["add", "--", `:(literal)${path8.relative(repo, manifestPath)}`]);
+    git(repo, ["add", "--", `:(literal)${path9.relative(repo, manifestPath)}`]);
   }
   if (Object.keys(selectConflictPaths(unmergedPaths(repo), selectedPaths)).length) {
     throw new SidecarError("last-writer-wins did not clear all unmerged paths");
@@ -5279,7 +6093,7 @@ function treeEntry(repo, ref, filePath) {
   return;
 }
 function lwwTrailerPrefix(filePath) {
-  return `sidecar-lww-${crypto4.createHash("sha256").update(filePath).digest("hex")}:`;
+  return `sidecar-lww-${crypto5.createHash("sha256").update(filePath).digest("hex")}:`;
 }
 function lwwWrittenTrailer(filePath, write) {
   return `${lwwTrailerPrefix(filePath)} ${write.time} ${write.source || "-"}`;
@@ -5326,11 +6140,11 @@ function recordedLwwEvent(body, prefix) {
   return Number.isInteger(time) && time >= 0 && source ? { time, source: source === "-" ? "" : source } : undefined;
 }
 function forkPath(conflictPath, label, oid) {
-  const parsed = path8.parse(conflictPath);
+  const parsed = path9.parse(conflictPath);
   const shortOid = oid ? oid.slice(0, 7) : "missing";
   const safeLabel = fileLabel(label);
   const forkName = parsed.ext ? `${parsed.name}.conflict.${safeLabel}.${shortOid}${parsed.ext}` : `${parsed.name}.conflict.${safeLabel}.${shortOid}`;
-  return path8.join(parsed.dir, forkName);
+  return path9.join(parsed.dir, forkName);
 }
 function fileLabel(value) {
   return slug(value).replaceAll("/", "-");
@@ -5389,7 +6203,7 @@ function pendingInboxBranches(repo, config) {
   });
   return [...local, ...remote].sort();
 }
-var SOFT_SYNC_ENV = "SIDECAR_SYNC_SOFT", LOCAL_SYNC_ENV = "SIDECAR_SYNC_LOCAL", WRITTEN_TRAILER = "written:", WRITTEN_TRAILER_LIMIT = 500, REDACTION_FILTER_NAME = "sidecar-redact", REDACTION_FILTER_REVISION = "2", REDACTION_POLICY_FILE = "sidecar-redaction-policy";
+var REVIEW_POLICY_KEY = "sidecar.review", WRITTEN_TRAILER = "written:", WRITTEN_TRAILER_LIMIT = 500, REDACTION_FILTER_NAME = "sidecar-redact", REDACTION_FILTER_REVISION = "2", REDACTION_POLICY_FILE = "sidecar-redaction-policy";
 var init_sync = __esm(() => {
   init_color();
   init_util();
@@ -5397,13 +6211,14 @@ var init_sync = __esm(() => {
   init_install();
   init_config();
   init_state();
+  init_review();
   init_rules();
   init_health();
   init_redaction();
 });
 
 // src/ui.ts
-import fs9 from "node:fs";
+import fs10 from "node:fs";
 function announcePeer(peer, peers) {
   const index = peers.indexOf(peer);
   if (index > 0)
@@ -5465,13 +6280,13 @@ function promptYesNoDefaultNo(question) {
   return answer === "y" || answer === "yes";
 }
 function promptLine(prompt) {
-  fs9.writeSync(1, prompt);
-  const fd = fs9.openSync(process.platform === "win32" ? "CONIN$" : "/dev/tty", "r");
+  fs10.writeSync(1, prompt);
+  const fd = fs10.openSync(process.platform === "win32" ? "CONIN$" : "/dev/tty", "r");
   try {
     const chunks = [];
     const buffer = Buffer.alloc(1);
     while (true) {
-      const bytesRead = fs9.readSync(fd, buffer, 0, 1, null);
+      const bytesRead = fs10.readSync(fd, buffer, 0, 1, null);
       if (bytesRead === 0)
         break;
       const char = buffer.toString("utf8", 0, bytesRead);
@@ -5482,7 +6297,7 @@ function promptLine(prompt) {
     }
     return chunks.join("").trim();
   } finally {
-    fs9.closeSync(fd);
+    fs10.closeSync(fd);
   }
 }
 var init_ui = __esm(() => {
@@ -5491,9 +6306,9 @@ var init_ui = __esm(() => {
 });
 
 // src/cmd-init.ts
-import fs10 from "node:fs";
-import path9 from "node:path";
-import { spawnSync as spawnSync4 } from "node:child_process";
+import fs11 from "node:fs";
+import path10 from "node:path";
+import { spawnSync as spawnSync5 } from "node:child_process";
 function cmdDeinit(args) {
   const parsed = parseOptions(args, { boolean: new Set(["--yes", "-y"]), value: new Set(["--peer"]) });
   if (parsed.positional.length)
@@ -5515,7 +6330,7 @@ function cmdDeinit(args) {
   const configPath = peerConfigPath(root, name);
   const leftovers = [];
   let config;
-  if (fs10.existsSync(configPath)) {
+  if (fs11.existsSync(configPath)) {
     try {
       config = readConfig(configPath);
     } catch {
@@ -5548,12 +6363,14 @@ function cmdDeinit(args) {
       removeCheckout(checkoutPath);
       const ignoreEntry = ignoreEntryForSidecarPath(root, config.path);
       if (ignoreEntry) {
-        removeIgnoreEntry(path9.join(root, ".gitignore"), ignoreEntry);
+        removeIgnoreEntry(path10.join(root, ".gitignore"), ignoreEntry);
         removeZedInclusion(root, ignoreEntry);
       }
     }
-    fs10.rmSync(configPath, { force: true });
-    fs10.rmSync(peerRulesPath(root, name), { force: true });
+    fs11.rmSync(configPath, { force: true });
+    fs11.rmSync(peerRulesPath(root, name), { force: true });
+    fs11.rmSync(peerReviewGuidelinesPath(root, name), { force: true });
+    pruneOrphanedReviews();
     unregisterInstance(configPath);
   });
   console.log(`removed sidecar from ${paint("repo", root)}${name === DEFAULT_PEER ? "" : ` (peer ${paint("brand", name)})`}`);
@@ -5568,9 +6385,9 @@ function cmdDeinit(args) {
 function assertDeinitTarget(root, checkoutPath) {
   const target = realpathOr(checkoutPath);
   const host = realpathOr(root);
-  const hostFromTarget = path9.relative(target, host);
-  const parts = path9.relative(host, target).split(path9.sep);
-  const containsHost = !path9.isAbsolute(hostFromTarget) && hostFromTarget.split(path9.sep)[0] !== "..";
+  const hostFromTarget = path10.relative(target, host);
+  const parts = path10.relative(host, target).split(path10.sep);
+  const containsHost = !path10.isAbsolute(hostFromTarget) && hostFromTarget.split(path10.sep)[0] !== "..";
   if (containsHost || parts.includes(".git") || parts.includes(".jj")) {
     throw new SidecarError(`refusing to delete ${checkoutPath}, which contains the host repo or its VCS metadata`);
   }
@@ -5591,19 +6408,19 @@ function releaseStandaloneCheckout(root, config) {
 }
 function removeCheckout(checkoutPath) {
   try {
-    if (fs10.statSync(path9.join(checkoutPath, ".git")).isFile()) {
+    if (fs11.statSync(path10.join(checkoutPath, ".git")).isFile()) {
       git(checkoutPath, ["worktree", "remove", "--force", checkoutPath], { check: false });
     }
   } catch {}
-  fs10.rmSync(checkoutPath, { recursive: true, force: true });
+  fs11.rmSync(checkoutPath, { recursive: true, force: true });
 }
 function cmdInit(args) {
   const parsed = parseOptions(args, {
     boolean: new Set(["--no-clone", "--no-bootstrap-main", "--local-install", "--ignored"]),
-    value: new Set(["--path", "--branch", "--inbox", "--redaction", "--resolve", "--debounce", "--interval", "--peer"])
+    value: new Set(["--path", "--branch", "--inbox", "--redaction", "--resolve", "--review", "--review-timeout", "--debounce", "--interval", "--peer"])
   });
   if (parsed.positional.length > 1) {
-    throw new SidecarError("usage: sidecar init [remote] [--peer name] [--path sidecar] [--branch main] [--inbox template] [--redaction mode] [--resolve fork|lww] [--debounce 10m] [--interval 1h] [--ignored]");
+    throw new SidecarError("usage: sidecar init [remote] [--peer name] [--path sidecar] [--branch main] [--inbox template] [--redaction mode] [--resolve fork|lww] [--review off|required] [--review-timeout 1h] [--debounce 10m] [--interval 1h] [--ignored]");
   }
   const remote = parsed.positional[0];
   const requestedPeer = parsed.values.get("--peer");
@@ -5643,13 +6460,15 @@ function cmdInit(args) {
 }
 function configurePeer(root, name, remote, parsed) {
   const configPath = peerConfigPath(root, name);
-  let reuse = !remote && fs10.existsSync(configPath);
-  if (remote && fs10.existsSync(configPath)) {
+  let reuse = !remote && fs11.existsSync(configPath);
+  let built;
+  if (remote && fs11.existsSync(configPath)) {
     const existing = readConfig(configPath);
-    const unchanged = existing.remote === remote && existing.path === getValue(parsed, "--path", existing.path) && existing.branch === getValue(parsed, "--branch", existing.branch) && existing.inbox === getValue(parsed, "--inbox", existing.inbox) && existing.redaction === getValue(parsed, "--redaction", existing.redaction) && existing.resolve === getValue(parsed, "--resolve", existing.resolve) && existing.debounce === durationConfigValue(parsed.values.get("--debounce") ?? existing.debounce, "--debounce") && existing.interval === durationConfigValue(parsed.values.get("--interval") ?? existing.interval, "--interval");
-    reuse = unchanged || !promptOverwriteConfig(configPath, existing.remote, remote);
+    built = buildInitConfig(root, name, remote, parsed, existing);
+    reuse = configText(built) === configText(existing) || !promptOverwriteConfig(configPath, existing.remote, remote);
   }
-  const config = reuse ? readConfig(configPath) : buildInitConfig(root, name, remote, parsed);
+  const config = reuse ? readConfig(configPath) : built ?? buildInitConfig(root, name, remote, parsed);
+  notePeerPolicy(config);
   if (!reuse) {
     config.rulesPath = peerRulesPath(root, name);
     config.rules = readRules(config.rulesPath);
@@ -5658,7 +6477,7 @@ function configurePeer(root, name, remote, parsed) {
     if (isStandalone(config)) {
       throw new SidecarError("--ignored cannot apply to a standalone sidecar: its .sidecar is part of the tree it syncs");
     }
-    for (const file of [peerFileName(name), peerRulesFileName(name)]) {
+    for (const file of [peerFileName(name), peerRulesFileName(name), peerReviewGuidelinesFileName(name)]) {
       if (isGitTracked(root, file)) {
         throw new SidecarError(`${file} is tracked by git; \`git rm --cached ${file}\` before ignoring it`);
       }
@@ -5691,9 +6510,11 @@ function excludePeerFile(root, name) {
     throw new SidecarError(`--ignored needs a git exclude file, and ${root} has none; ignore ${configFile} in your own VCS config`);
   }
   const rulesFile = peerRulesFileName(name);
+  const guidelinesFile = peerReviewGuidelinesFileName(name);
   ensureIgnoreLine(exclude, `/${configFile}`);
   ensureIgnoreLine(exclude, `/${rulesFile}`);
-  console.log(`ignored ${configFile} and ${rulesFile} via .git/info/exclude`);
+  ensureIgnoreLine(exclude, `/${guidelinesFile}`);
+  console.log(`ignored ${configFile}, ${rulesFile}, and ${guidelinesFile} via .git/info/exclude`);
 }
 function initRoot(remote, parsed) {
   const cwd = process.cwd();
@@ -5708,9 +6529,9 @@ function initRoot(remote, parsed) {
   console.log(`initialized ${paint("repo", cwd)} as a Git repository`);
   return cwd;
 }
-function buildInitConfig(root, name, remote, parsed) {
+function buildInitConfig(root, name, remote, parsed, existing) {
   const defaultPath = name === DEFAULT_PEER ? DEFAULT_PATH : name;
-  const rawPath = parsed.values.has("--path") ? getValue(parsed, "--path", defaultPath) : promptSidecarPath(root, name, defaultPath);
+  const rawPath = parsed.values.has("--path") ? getValue(parsed, "--path", defaultPath) : existing?.path ?? promptSidecarPath(root, name, defaultPath);
   const sidecarPath = pathIsRepoRoot(root, rawPath) ? "." : rawPath;
   const standalone = isStandalonePath(sidecarPath);
   if (standalone && name !== DEFAULT_PEER) {
@@ -5721,12 +6542,14 @@ function buildInitConfig(root, name, remote, parsed) {
     remote: remote ?? (standalone ? standaloneRemote(root) : promptRemote(root)),
     version: 1,
     path: sidecarPath,
-    branch: getValue(parsed, "--branch", DEFAULT_BRANCH),
-    inbox: getValue(parsed, "--inbox", DEFAULT_INBOX),
-    redaction: parsed.values.has("--redaction") ? redactionModeConfigValue(getValue(parsed, "--redaction", DEFAULT_REDACTION_MODE), "--redaction") : promptRedactionMode(),
-    resolve: parsed.values.has("--resolve") ? resolveModeConfigValue(getValue(parsed, "--resolve", DEFAULT_RESOLVE), "--resolve") : DEFAULT_RESOLVE,
-    debounce: durationConfigValue(parsed.values.get("--debounce"), "--debounce"),
-    interval: durationConfigValue(parsed.values.get("--interval"), "--interval")
+    branch: getValue(parsed, "--branch", existing?.branch ?? DEFAULT_BRANCH),
+    inbox: getValue(parsed, "--inbox", existing?.inbox ?? DEFAULT_INBOX),
+    redaction: parsed.values.has("--redaction") ? redactionModeConfigValue(getValue(parsed, "--redaction", DEFAULT_REDACTION_MODE), "--redaction") : existing?.redaction ?? promptRedactionMode(),
+    resolve: parsed.values.has("--resolve") ? resolveModeConfigValue(getValue(parsed, "--resolve", DEFAULT_RESOLVE), "--resolve") : existing?.resolve ?? DEFAULT_RESOLVE,
+    debounce: durationConfigValue(parsed.values.get("--debounce"), "--debounce") ?? existing?.debounce,
+    interval: durationConfigValue(parsed.values.get("--interval"), "--interval") ?? existing?.interval,
+    review: reviewModeConfigValue(getValue(parsed, "--review", existing?.review ?? "off"), "--review"),
+    reviewTimeout: durationConfigValue(parsed.values.get("--review-timeout"), "--review-timeout") ?? existing?.reviewTimeout
   };
 }
 function printCheckoutVisibility(root, config) {
@@ -5743,7 +6566,7 @@ function printCheckoutVisibility(root, config) {
     console.log(`sidecar path outside repo; not updating .gitignore`);
     return;
   }
-  ensureIgnoreEntry(exclude ?? path9.join(root, ".gitignore"), ignoreEntry);
+  ensureIgnoreEntry(exclude ?? path10.join(root, ".gitignore"), ignoreEntry);
   const name = ignoreEntry.replace(/\/+$/, "");
   console.log(`ignored ${name}/ via ${exclude ? ".git/info/exclude" : ".gitignore"}`);
   if (hasZedInclusion(root, ignoreEntry)) {
@@ -5757,8 +6580,8 @@ function printCheckoutVisibility(root, config) {
   }
 }
 function offerLocalInstall(root, standalone, forced) {
-  const manifestPath = path9.join(root, "package.json");
-  if (!fs10.existsSync(manifestPath)) {
+  const manifestPath = path10.join(root, "package.json");
+  if (!fs11.existsSync(manifestPath)) {
     if (forced)
       throw new SidecarError("--local-install requires a package.json");
     return;
@@ -5768,7 +6591,7 @@ function offerLocalInstall(root, standalone, forced) {
   let source;
   let manifest;
   try {
-    source = fs10.readFileSync(manifestPath, "utf8");
+    source = fs11.readFileSync(manifestPath, "utf8");
     const parsed = JSON.parse(source);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       throw new Error("not an object");
@@ -5794,7 +6617,7 @@ function offerLocalInstall(root, standalone, forced) {
     manifest.pnpm = pnpm;
   }
   const indent = /^([ \t]+)"/m.exec(source)?.[1] ?? "  ";
-  fs10.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, indent)}
+  fs11.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, indent)}
 `);
   console.log(`added ${paint("brand", PACKAGE_NAME)} to devDependencies; run your package manager's install to pin it`);
   if (managers.has("bun")) {
@@ -5822,7 +6645,7 @@ function detectPackageManagers(root) {
     ["package-lock.json", "npm"],
     ["yarn.lock", "yarn"]
   ];
-  return new Set(lockfiles.filter(([file]) => fs10.existsSync(path9.join(root, file))).map(([, manager]) => manager));
+  return new Set(lockfiles.filter(([file]) => fs11.existsSync(path10.join(root, file))).map(([, manager]) => manager));
 }
 function ensureDaemonSetup(globalSidecar) {
   if (process.env[SKIP_SERVICE_ENV] === "1")
@@ -5832,7 +6655,7 @@ function ensureDaemonSetup(globalSidecar) {
   const service = daemonServiceStatus();
   if (!service.available || service.installed && service.running)
     return;
-  const result = spawnSync4(globalSidecar, ["daemon", "enable"], {
+  const result = spawnSync5(globalSidecar, ["daemon", "enable"], {
     encoding: "utf8",
     env: {
       ...process.env,
@@ -5884,7 +6707,7 @@ function warnIfGlobalPredatesPeers(executable, peers) {
   console.error(`sidecar: warning: the global sidecar (${version ? `v${version}` : "unknown version"}) predates peers; its daemon syncs only .sidecar until it is updated`);
 }
 function registerInstallWithGlobalSidecar(executable, root) {
-  const result = spawnSync4(executable, ["register-install"], {
+  const result = spawnSync5(executable, ["register-install"], {
     cwd: root,
     encoding: "utf8",
     env: {
@@ -5901,7 +6724,7 @@ function installGlobalSidecar() {
   const bun = findExecutableOnPath(process.platform === "win32" ? "bun.exe" : "bun");
   const command = bun ? [bun, "add", "-g", PACKAGE_SPEC] : ["npm", "install", "-g", PACKAGE_SPEC];
   console.log(`running ${command.join(" ")}`);
-  const result = spawnSync4(command[0], command.slice(1), { stdio: "inherit" });
+  const result = spawnSync5(command[0], command.slice(1), { stdio: "inherit" });
   if (result.status !== 0) {
     throw new SidecarError(`global sidecar install failed; run \`${command.join(" ")}\` manually`);
   }
@@ -5920,7 +6743,7 @@ function cmdClone(args) {
     const { root, config } = peer;
     if (parsed.flags.has("--if-missing")) {
       const sidecarPath = resolveSidecarPath(root, config);
-      if (fs10.existsSync(sidecarPath) && hasGitMetadata(sidecarPath))
+      if (fs11.existsSync(sidecarPath) && hasGitMetadata(sidecarPath))
         continue;
     }
     cloneOrUpdate(root, config, !parsed.flags.has("--no-bootstrap-main"));
@@ -6008,7 +6831,7 @@ function createRemoteWithGh(root) {
   const origin = git(root, ["remote", "get-url", "origin"], { check: false }).stdout.trim() || undefined;
   const parsedOrigin = origin ? parseGitHubRemote(origin) : undefined;
   const owner = parsedOrigin?.owner ?? ghLogin(gh);
-  const baseName = parsedOrigin?.repo ?? path9.basename(root);
+  const baseName = parsedOrigin?.repo ?? path10.basename(root);
   const suggested = owner ? `${owner}/${baseName}-sidecar` : `${baseName}-sidecar`;
   const answer = promptLine(`repository to create ${paint("quiet", `[${suggested}]`)}: `) || suggested;
   const fullName = answer.includes("/") ? answer : owner ? `${owner}/${answer}` : undefined;
@@ -6016,7 +6839,7 @@ function createRemoteWithGh(root) {
     throw new SidecarError("could not determine the repository owner; enter it as owner/name");
   }
   console.log(`running gh repo create ${fullName} --private`);
-  const create = spawnSync4(gh, ["repo", "create", fullName, "--private"], { stdio: "inherit" });
+  const create = spawnSync5(gh, ["repo", "create", fullName, "--private"], { stdio: "inherit" });
   if (create.status !== 0) {
     throw new SidecarError("gh repo create failed; create the repo yourself and rerun `sidecar init <remote>`");
   }
@@ -6030,14 +6853,14 @@ function parseGitHubRemote(url) {
   return { owner: match[1], repo: match[2] };
 }
 function ghLogin(gh) {
-  const result = spawnSync4(gh, ["api", "user", "-q", ".login"], { encoding: "utf8" });
+  const result = spawnSync5(gh, ["api", "user", "-q", ".login"], { encoding: "utf8" });
   if (result.status !== 0)
     return;
   const login = result.stdout.trim();
   return login || undefined;
 }
 function ghGitProtocol(gh) {
-  const result = spawnSync4(gh, ["config", "get", "git_protocol"], { encoding: "utf8" });
+  const result = spawnSync5(gh, ["config", "get", "git_protocol"], { encoding: "utf8" });
   if (result.status !== 0)
     return "https";
   return result.stdout.trim() || "https";
@@ -6057,38 +6880,38 @@ function removeIgnoreEntry(ignorePath, sidecarPath) {
   removeIgnoreLine(ignorePath, `/${sidecarPath.replace(/^\/+|\/+$/g, "")}/`);
 }
 function ensureIgnoreLine(ignorePath, entry) {
-  const lines = fs10.existsSync(ignorePath) ? fs10.readFileSync(ignorePath, "utf8").split(/\r?\n/) : [];
+  const lines = fs11.existsSync(ignorePath) ? fs11.readFileSync(ignorePath, "utf8").split(/\r?\n/) : [];
   if (lines.includes(entry))
     return;
   while (lines.length && lines[lines.length - 1] === "")
     lines.pop();
   lines.push(entry);
-  fs10.mkdirSync(path9.dirname(ignorePath), { recursive: true });
-  fs10.writeFileSync(ignorePath, `${lines.join(`
+  fs11.mkdirSync(path10.dirname(ignorePath), { recursive: true });
+  fs11.writeFileSync(ignorePath, `${lines.join(`
 `).replace(/\s+$/g, "")}
 `, "utf8");
 }
 function removeIgnoreLine(ignorePath, entry) {
-  if (!fs10.existsSync(ignorePath))
+  if (!fs11.existsSync(ignorePath))
     return;
-  const lines = fs10.readFileSync(ignorePath, "utf8").split(/\r?\n/);
+  const lines = fs11.readFileSync(ignorePath, "utf8").split(/\r?\n/);
   const kept = lines.filter((line) => line !== entry);
   if (kept.length === lines.length)
     return;
   if (kept.every((line) => !line.trim())) {
-    fs10.rmSync(ignorePath);
+    fs11.rmSync(ignorePath);
   } else {
-    fs10.writeFileSync(ignorePath, `${kept.join(`
+    fs11.writeFileSync(ignorePath, `${kept.join(`
 `).replace(/\s+$/g, "")}
 `, "utf8");
   }
 }
 function hasZedInclusion(root, sidecarPath) {
-  const settingsPath2 = path9.join(root, ".zed", "settings.json");
-  if (!fs10.existsSync(settingsPath2))
+  const settingsPath2 = path10.join(root, ".zed", "settings.json");
+  if (!fs11.existsSync(settingsPath2))
     return false;
   try {
-    const parsed = JSON.parse(fs10.readFileSync(settingsPath2, "utf8"));
+    const parsed = JSON.parse(fs11.readFileSync(settingsPath2, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return false;
     const inclusions = parsed.file_scan_inclusions;
@@ -6102,11 +6925,11 @@ function zedInclusionGlob(sidecarPath) {
 }
 function ensureZedInclusion(root, sidecarPath) {
   const glob = zedInclusionGlob(sidecarPath);
-  const settingsPath2 = path9.join(root, ".zed", "settings.json");
+  const settingsPath2 = path10.join(root, ".zed", "settings.json");
   let settings = {};
-  if (fs10.existsSync(settingsPath2)) {
+  if (fs11.existsSync(settingsPath2)) {
     try {
-      const parsed = JSON.parse(fs10.readFileSync(settingsPath2, "utf8"));
+      const parsed = JSON.parse(fs11.readFileSync(settingsPath2, "utf8"));
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
         return false;
       settings = parsed;
@@ -6118,18 +6941,18 @@ function ensureZedInclusion(root, sidecarPath) {
   if (!inclusions.includes(glob)) {
     inclusions.push(glob);
     settings.file_scan_inclusions = inclusions;
-    fs10.mkdirSync(path9.dirname(settingsPath2), { recursive: true });
-    fs10.writeFileSync(settingsPath2, `${JSON.stringify(settings, null, 2)}
+    fs11.mkdirSync(path10.dirname(settingsPath2), { recursive: true });
+    fs11.writeFileSync(settingsPath2, `${JSON.stringify(settings, null, 2)}
 `, "utf8");
   }
   return true;
 }
 function removeZedInclusion(root, sidecarPath) {
-  const settingsPath2 = path9.join(root, ".zed", "settings.json");
-  if (!fs10.existsSync(settingsPath2))
+  const settingsPath2 = path10.join(root, ".zed", "settings.json");
+  if (!fs11.existsSync(settingsPath2))
     return;
   try {
-    const settings = JSON.parse(fs10.readFileSync(settingsPath2, "utf8"));
+    const settings = JSON.parse(fs11.readFileSync(settingsPath2, "utf8"));
     if (!settings || typeof settings !== "object" || Array.isArray(settings))
       return;
     const inclusions = settings.file_scan_inclusions;
@@ -6144,17 +6967,17 @@ function removeZedInclusion(root, sidecarPath) {
     } else {
       delete settings.file_scan_inclusions;
     }
-    fs10.writeFileSync(settingsPath2, `${JSON.stringify(settings, null, 2)}
+    fs11.writeFileSync(settingsPath2, `${JSON.stringify(settings, null, 2)}
 `, "utf8");
   } catch {
     console.error(`sidecar: warning: could not safely remove the Zed inclusion from ${settingsPath2}`);
   }
 }
 function ignoreEntryForSidecarPath(root, sidecarPath) {
-  const resolvedRoot = path9.resolve(root);
-  const resolvedSidecarPath = path9.resolve(root, sidecarPath);
-  const relative = path9.relative(resolvedRoot, resolvedSidecarPath);
-  if (!relative || relative.startsWith("..") || path9.isAbsolute(relative))
+  const resolvedRoot = path10.resolve(root);
+  const resolvedSidecarPath = path10.resolve(root, sidecarPath);
+  const relative = path10.relative(resolvedRoot, resolvedSidecarPath);
+  if (!relative || relative.startsWith("..") || path10.isAbsolute(relative))
     return;
   return relative;
 }
@@ -6170,11 +6993,12 @@ var init_cmd_init = __esm(() => {
   init_ui();
   init_redaction();
   init_rules();
+  init_review();
 });
 
 // src/cmd-refresh.ts
-import fs11 from "node:fs";
-import path10 from "node:path";
+import fs12 from "node:fs";
+import path11 from "node:path";
 function worktreeHoldingBranch(repo, branch) {
   const result = git(repo, ["worktree", "list", "--porcelain"], { check: false });
   if (result.status !== 0)
@@ -6202,13 +7026,53 @@ function unpushedCommits(sidecarPath) {
   });
   return counted.status === 0 ? Number(counted.stdout.trim()) || 0 : 0;
 }
-function dependentWorktrees(sidecarPath) {
+function heldWork(sidecarPath, config, inbox) {
+  const gated = reviewRequired(config);
+  const unpushed = gated ? 0 : unpushedCommits(sidecarPath);
+  const unpublished = gated && !gatedWorkIsPublished(sidecarPath, config, inbox);
+  const dirtyFiles = git(sidecarPath, ["status", "--porcelain"], { check: false }).stdout.split(`
+`).filter(Boolean).length;
+  return [
+    unpushed ? `${unpushed} commit(s) the remote has not seen` : "",
+    unpublished ? "changes not yet published through review" : "",
+    dirtyFiles ? `${dirtyFiles} uncommitted file(s)` : ""
+  ].filter(Boolean);
+}
+function gatedWorkIsPublished(sidecarPath, config, inbox) {
+  if (!hasAnyCommit(sidecarPath))
+    return true;
+  const tree = (ref) => {
+    const result = git(sidecarPath, ["rev-parse", "--verify", "--quiet", `${ref}^{tree}`], { check: false });
+    return result.status === 0 ? result.stdout.trim() : undefined;
+  };
+  const main = `refs/heads/${config.branch}`;
+  const publicMain = tree(`${PUBLIC_REFS}${config.branch}`);
+  const mainTree = tree(main);
+  const mainPublished = mainTree === undefined || mainTree === publicMain;
+  const published = (ref, branch) => {
+    const own = tree(ref);
+    return own === publicMain || own === tree(`${PUBLIC_REFS}${branch}`) || mainPublished && isAncestor(sidecarPath, ref, main);
+  };
+  if (!published("HEAD", inbox))
+    return false;
+  if (!ownsStore(sidecarPath))
+    return true;
+  if (!mainPublished)
+    return false;
+  const prefix = inboxPrefix(config);
+  return git(sidecarPath, ["for-each-ref", "--format=%(refname)", "refs/heads/"]).stdout.split(`
+`).filter((ref) => ref && matchesInboxPrefix(prefix, ref.slice("refs/heads/".length))).every((ref) => published(ref, ref.slice("refs/heads/".length)));
+}
+function ownsStore(sidecarPath) {
   try {
-    if (!fs11.statSync(path10.join(sidecarPath, ".git")).isDirectory())
-      return [];
+    return fs12.statSync(path11.join(sidecarPath, ".git")).isDirectory();
   } catch {
-    return [];
+    return false;
   }
+}
+function dependentWorktrees(sidecarPath) {
+  if (!ownsStore(sidecarPath))
+    return [];
   const result = git(sidecarPath, ["worktree", "list", "--porcelain"], { check: false });
   if (result.status !== 0)
     return [];
@@ -6219,11 +7083,11 @@ function existingCheckoutId(sidecarPath) {
   const candidates = [];
   const reported = git(sidecarPath, ["rev-parse", "--git-dir"], { check: false });
   if (reported.status === 0)
-    candidates.push(path10.resolve(sidecarPath, reported.stdout.trim()));
-  candidates.push(path10.join(sidecarPath, ".git"));
+    candidates.push(path11.resolve(sidecarPath, reported.stdout.trim()));
+  candidates.push(path11.join(sidecarPath, ".git"));
   for (const candidate of candidates) {
     try {
-      const id = slug(fs11.readFileSync(path10.join(candidate, "sidecar-id"), "utf8"));
+      const id = slug(fs12.readFileSync(path11.join(candidate, "sidecar-id"), "utf8"));
       if (id)
         return id;
     } catch {}
@@ -6235,12 +7099,20 @@ function refreshCheckout(root, config) {
   if (isStandalone(config)) {
     throw new SidecarError("refusing to delete a standalone sidecar, which is the repo itself");
   }
-  const relative = path10.relative(root, sidecarPath);
-  if (!relative || relative.startsWith("..") || path10.isAbsolute(relative)) {
+  const relative = path11.relative(root, sidecarPath);
+  if (!relative || relative.startsWith("..") || path11.isAbsolute(relative)) {
     throw new SidecarError(`refusing to delete ${sidecarPath}, which is not inside ${root}`);
   }
   const checkoutId = existingCheckoutId(sidecarPath);
-  fs11.rmSync(sidecarPath, { recursive: true, force: true });
+  if (ownsStore(sidecarPath)) {
+    let open;
+    try {
+      open = openReview(sidecarPath);
+    } catch {}
+    if (open)
+      markSuperseded(open);
+  }
+  fs12.rmSync(sidecarPath, { recursive: true, force: true });
   const family = familySidecarCheckout(root, config);
   if (family) {
     git(family, ["worktree", "prune", "--expire", "now"], { check: false });
@@ -6301,16 +7173,17 @@ function refreshPeer({ root, config, name }, parsed) {
   let inbox;
   if (readable) {
     inbox = expandInbox(config, sidecarPath);
-    fetch(sidecarPath, true, false);
-    const unpushed = unpushedCommits(sidecarPath);
-    const dirtyFiles = git(sidecarPath, ["status", "--porcelain"], { check: false }).stdout.split(`
-`).filter(Boolean).length;
-    if ((unpushed || dirtyFiles) && !force) {
-      const held = [
-        unpushed ? `${unpushed} commit(s) the remote has not seen` : "",
-        dirtyFiles ? `${dirtyFiles} uncommitted file(s)` : ""
-      ].filter(Boolean);
-      throw new SidecarError(`this checkout still holds ${held.join(" and ")}; run \`sidecar sync\` to push them, then refresh — or \`sidecar refresh --force\` to discard them`);
+    if (reviewRequired(config)) {
+      try {
+        refreshPublicRefs(sidecarPath);
+      } catch {}
+    } else {
+      fetch(sidecarPath, true, false);
+    }
+    const held = heldWork(sidecarPath, config, inbox);
+    if (held.length && !force) {
+      const publish = reviewRequired(config) ? "approve its review (`sidecar review`) and sync to publish them" : "run `sidecar sync` to push them";
+      throw new SidecarError(`this checkout still holds ${held.join(" and ")}; ${publish}, then refresh — or \`sidecar refresh --force\` to discard them`);
     }
   }
   if (standalone) {
@@ -6337,7 +7210,7 @@ function refreshPeer({ root, config, name }, parsed) {
   }
   let declined;
   withSyncLock(root, name, "throw", () => {
-    if (readable && !force && isDirty(sidecarPath)) {
+    if (readable && !force && inbox && heldWork(sidecarPath, config, inbox).length) {
       throw new SidecarError("the sidecar checkout changed while waiting for confirmation; rerun refresh");
     }
     if (standalone)
@@ -6359,10 +7232,11 @@ var init_cmd_refresh = __esm(() => {
   init_sync();
   init_ui();
   init_rules();
+  init_review();
 });
 
 // src/cmd-status.ts
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 function statusLine(label, value, role) {
   labelLine(STATUS_LABEL_WIDTH, label, value, role);
 }
@@ -6395,6 +7269,8 @@ function printPeerStatus({ root, config, configPath }) {
   statusLine("main branch", config.branch);
   statusLine("inbox branch", inbox);
   statusLine("conflicts", config.resolve === "lww" ? "last writer wins" : "fork files");
+  if (reviewRequired(config))
+    printReviewLine(sidecarPath);
   if (!checkoutPresent) {
     statusLine("checkout", "missing — run `sidecar init`", "bad");
     printDaemonLine();
@@ -6425,6 +7301,36 @@ function printPeerStatus({ root, config, configPath }) {
     statusLine("pending inbox", "none", "quiet");
   }
 }
+function printReviewLine(sidecarPath) {
+  const review = hasGitMetadata(sidecarPath) ? openReview(sidecarPath) : undefined;
+  const reviewer = readSettings().reviewer;
+  if (!review) {
+    if (reviewer)
+      statusLine("review", `required — nothing waiting (reviewer: ${reviewer})`, "quiet");
+    else
+      statusLine("review", "required — no reviewer configured; reviews wait for `sidecar review approve`", "attn");
+    return;
+  }
+  const attention = reviewAttention(review);
+  const age = formatRelativeTime(review.record.createdAt) ?? review.record.createdAt;
+  const summary = `${review.state} ${review.record.id}, opened ${age}, ${review.record.files.length} file(s)`;
+  statusLine("review", attention ? `${summary} — needs attention: ${attention}` : summary, attention ? "attn" : undefined);
+  if (review.verdict?.reason)
+    console.log(`  ${paint("quiet", review.verdict.reason)}`);
+  console.log(`  ${paint("quiet", `sidecar review show ${review.record.id}`)}`);
+}
+function openReviewPayload(sidecarPath) {
+  const review = openReview(sidecarPath);
+  if (!review)
+    return;
+  return {
+    id: review.record.id,
+    state: review.state,
+    attention: reviewAttention(review),
+    createdAt: review.record.createdAt,
+    files: review.record.files.length
+  };
+}
 function statusPayload({ root, name, config, configPath }) {
   const sidecarPath = resolveSidecarPath(root, config);
   const checkoutPresent = hasGitMetadata(sidecarPath);
@@ -6445,13 +7351,15 @@ function statusPayload({ root, name, config, configPath }) {
     familyLinked: checkoutPresent ? !checkoutIsUnlinkedFromFamily(root, config, sidecarPath) : undefined,
     daemon: daemonHealth().text,
     lastSyncAt: readInstances().find((instance) => instance.configPath === configPath)?.lastSyncAt,
-    pendingInbox: checkoutPresent ? pendingStatusInboxBranches(sidecarPath, config) : undefined
+    pendingInbox: checkoutPresent ? pendingStatusInboxBranches(sidecarPath, config) : undefined,
+    review: reviewRequired(config) ? { required: true, open: checkoutPresent ? openReviewPayload(sidecarPath) : undefined } : undefined
   };
 }
 function pendingStatusInboxBranches(sidecarPath, config) {
   fetch(sidecarPath, true, false);
   const base = remoteRefExists(sidecarPath, config.branch) ? `origin/${config.branch}` : branchExists(sidecarPath, config.branch) ? config.branch : "HEAD";
-  return pendingInboxBranches(sidecarPath, config).filter((remoteBranch) => !isAncestor(sidecarPath, remoteBranch, base));
+  const candidates = reviewRequired(config) ? pendingInboxBranches(sidecarPath, config).filter((branch) => branch.startsWith("origin/")) : pendingInboxBranches(sidecarPath, config);
+  return candidates.filter((remoteBranch) => !isAncestor(sidecarPath, remoteBranch, base));
 }
 function daemonHealth() {
   if (!shouldUseGlobalRegistry()) {
@@ -6553,6 +7461,10 @@ function healthStatusLine(state, record) {
     const age = formatRelativeTime(record.updatedAt) ?? record.updatedAt;
     return { text: `stale — last reported ${age}`, role: "attn" };
   }
+  if (record.review === "attention")
+    return { text: "ok — publishing held, review needs attention", role: "attn" };
+  if (record.review === "pending")
+    return { text: "ok — publishing held for review", role: "ok" };
   return { text: "ok", role: "ok" };
 }
 function cmdInstances(args) {
@@ -6606,16 +7518,16 @@ function cmdTail(args) {
     throw new SidecarError("--lines requires a positive integer");
   }
   const filePath = sidecarLogPath();
-  if (!fs12.existsSync(filePath)) {
+  if (!fs13.existsSync(filePath)) {
     if (parsed.flags.has("-f") || parsed.flags.has("--follow")) {
       followLog(filePath, 0);
       return 0;
     }
     return 0;
   }
-  const stat = fs12.statSync(filePath);
+  const stat = fs13.statSync(filePath);
   if (stat.size > 0) {
-    process.stdout.write(lastLines(fs12.readFileSync(filePath, "utf8"), lines));
+    process.stdout.write(lastLines(fs13.readFileSync(filePath, "utf8"), lines));
   }
   if (parsed.flags.has("-f") || parsed.flags.has("--follow")) {
     followLog(filePath, stat.size);
@@ -6638,7 +7550,7 @@ function followLog(filePath, startOffset) {
     sleep(1000);
     let stat;
     try {
-      stat = fs12.statSync(filePath);
+      stat = fs13.statSync(filePath);
     } catch {
       offset = 0;
       continue;
@@ -6647,17 +7559,17 @@ function followLog(filePath, startOffset) {
       offset = 0;
     if (stat.size <= offset)
       continue;
-    const fd = fs12.openSync(filePath, "r");
+    const fd = fs13.openSync(filePath, "r");
     try {
       const length = stat.size - offset;
       const buffer = Buffer.alloc(length);
-      const bytesRead = fs12.readSync(fd, buffer, 0, length, offset);
+      const bytesRead = fs13.readSync(fd, buffer, 0, length, offset);
       if (bytesRead > 0) {
         process.stdout.write(buffer.subarray(0, bytesRead).toString("utf8"));
         offset += bytesRead;
       }
     } finally {
-      fs12.closeSync(fd);
+      fs13.closeSync(fd);
     }
   }
 }
@@ -6676,6 +7588,7 @@ var init_cmd_status = __esm(() => {
   init_sync();
   init_ui();
   init_health();
+  init_review();
   STATUS_LABEL_WIDTH = "pending inbox:".length;
 });
 
@@ -7064,20 +7977,20 @@ var require_ignore = __commonJS((exports, module) => {
     const index = body.indexOf(SLASH);
     return index < 0 || index === body.length - 1;
   };
-  var basenameOf = (path11) => {
-    const end = path11.length - 1;
-    const index = path11.lastIndexOf(SLASH, path11[end] === SLASH ? end - 1 : end);
-    return index < 0 ? path11 : path11.slice(index + 1);
+  var basenameOf = (path12) => {
+    const end = path12.length - 1;
+    const index = path12.lastIndexOf(SLASH, path12[end] === SLASH ? end - 1 : end);
+    return index < 0 ? path12 : path12.slice(index + 1);
   };
-  var parentOf = (path11) => {
-    if (path11.charCodeAt(0) === SLASH_CODE || path11.indexOf(DOUBLE_SLASH) >= 0) {
-      const slices = path11.split(SLASH).filter(Boolean);
+  var parentOf = (path12) => {
+    if (path12.charCodeAt(0) === SLASH_CODE || path12.indexOf(DOUBLE_SLASH) >= 0) {
+      const slices = path12.split(SLASH).filter(Boolean);
       slices.pop();
       return slices.length ? slices.join(SLASH) + SLASH : EMPTY;
     }
-    const end = path11.length - 1;
-    const cut = path11.lastIndexOf(SLASH, path11.charCodeAt(end) === SLASH_CODE ? end - 1 : end);
-    return cut < 0 ? EMPTY : path11.slice(0, cut + 1);
+    const end = path12.length - 1;
+    const cut = path12.lastIndexOf(SLASH, path12.charCodeAt(end) === SLASH_CODE ? end - 1 : end);
+    return cut < 0 ? EMPTY : path12.slice(0, cut + 1);
   };
   var isString = (subject) => typeof subject === "string";
   var checkPattern = (pattern) => pattern && isString(pattern) && !REGEX_TEST_BLANK_LINE.test(pattern) && !REGEX_INVALID_TRAILING_BACKSLASH.test(pattern) && pattern.indexOf("#") !== 0;
@@ -7162,19 +8075,19 @@ var require_ignore = __commonJS((exports, module) => {
       makeArray(isString(pattern) ? splitPattern(pattern) : pattern).forEach(this._add, this);
       return this._added;
     }
-    test(path11, checkUnignored, mode) {
+    test(path12, checkUnignored, mode) {
       let ignored = false;
       let unignored = false;
       let matchedRule;
       const rules = this._rules;
       const { length } = rules;
       const shortcut = this._basenameCount * 2 >= length;
-      const basename = shortcut ? basenameOf(path11) : path11;
+      const basename = shortcut ? basenameOf(path12) : path12;
       for (let index = 0;index < length; index++) {
         const rule = rules[index];
         const { negative } = rule;
         const skip = unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored;
-        if (!skip && rule[mode].test(shortcut && rule._basenameOnly ? basename : path11)) {
+        if (!skip && rule[mode].test(shortcut && rule._basenameOnly ? basename : path12)) {
           ignored = !negative;
           unignored = negative;
           matchedRule = negative ? UNDEFINED : rule;
@@ -7193,38 +8106,38 @@ var require_ignore = __commonJS((exports, module) => {
   var throwError = (message, Ctor) => {
     throw new Ctor(message);
   };
-  var checkPath = (path11, originalPath, doThrow) => {
-    if (!isString(path11)) {
+  var checkPath = (path12, originalPath, doThrow) => {
+    if (!isString(path12)) {
       return doThrow(`path must be a string, but got \`${originalPath}\``, TypeError);
     }
-    if (!path11) {
+    if (!path12) {
       return doThrow(`path must not be empty`, TypeError);
     }
-    if (checkPath.isNotRelative(path11)) {
+    if (checkPath.isNotRelative(path12)) {
       const r = "`path.relative()`d";
       return doThrow(`path should be a ${r} string, but got "${originalPath}"`, RangeError);
     }
     return true;
   };
-  var isNotRelative = (path11) => {
-    const first = path11.charCodeAt(0);
+  var isNotRelative = (path12) => {
+    const first = path12.charCodeAt(0);
     if (first === SLASH_CODE) {
       return true;
     }
     if (first !== DOT_CODE) {
       return false;
     }
-    if (path11.length === 1) {
+    if (path12.length === 1) {
       return true;
     }
-    const second = path11.charCodeAt(1);
+    const second = path12.charCodeAt(1);
     if (second === SLASH_CODE) {
       return true;
     }
     if (second !== DOT_CODE) {
       return false;
     }
-    return path11.length === 2 || path11.charCodeAt(2) === SLASH_CODE;
+    return path12.length === 2 || path12.charCodeAt(2) === SLASH_CODE;
   };
   checkPath.isNotRelative = isNotRelative;
   checkPath.convert = (p) => p;
@@ -7254,51 +8167,51 @@ var require_ignore = __commonJS((exports, module) => {
       return this.add(pattern);
     }
     _test(originalPath, cache, checkUnignored) {
-      const path11 = originalPath && checkPath.convert(originalPath);
-      checkPath(path11, originalPath, this._strictPathCheck ? throwError : RETURN_FALSE);
-      return this._t(path11, cache, checkUnignored);
+      const path12 = originalPath && checkPath.convert(originalPath);
+      checkPath(path12, originalPath, this._strictPathCheck ? throwError : RETURN_FALSE);
+      return this._t(path12, cache, checkUnignored);
     }
-    checkIgnore(path11) {
-      if (path11.charCodeAt(path11.length - 1) !== SLASH_CODE) {
-        return this.test(path11);
+    checkIgnore(path12) {
+      if (path12.charCodeAt(path12.length - 1) !== SLASH_CODE) {
+        return this.test(path12);
       }
-      const parentPath = parentOf(path11);
+      const parentPath = parentOf(path12);
       if (parentPath) {
         const parent = this._t(parentPath, this._testCache, true);
         if (parent.ignored) {
           return parent;
         }
       }
-      return this._rules.test(path11, false, MODE_CHECK_IGNORE);
+      return this._rules.test(path12, false, MODE_CHECK_IGNORE);
     }
-    _t(path11, cache, checkUnignored) {
-      if (path11 in cache) {
-        return cache[path11];
+    _t(path12, cache, checkUnignored) {
+      if (path12 in cache) {
+        return cache[path12];
       }
-      const parentPath = parentOf(path11);
+      const parentPath = parentOf(path12);
       const parent = parentPath ? this._t(parentPath, cache, checkUnignored) : UNDEFINED;
-      return cache[path11] = parent && parent.ignored ? parent : this._rules.test(path11, checkUnignored, MODE_IGNORE);
+      return cache[path12] = parent && parent.ignored ? parent : this._rules.test(path12, checkUnignored, MODE_IGNORE);
     }
-    ignores(path11) {
-      return this._test(path11, this._ignoreCache, false).ignored;
+    ignores(path12) {
+      return this._test(path12, this._ignoreCache, false).ignored;
     }
     createFilter() {
-      return (path11) => !this.ignores(path11);
+      return (path12) => !this.ignores(path12);
     }
     filter(paths) {
       return makeArray(paths).filter(this.createFilter());
     }
-    test(path11) {
-      return this._test(path11, this._testCache, true);
+    test(path12) {
+      return this._test(path12, this._testCache, true);
     }
   }
   var factory = (options) => new Ignore(options);
-  var isPathValid = (path11) => checkPath(path11 && checkPath.convert(path11), path11, RETURN_FALSE);
+  var isPathValid = (path12) => checkPath(path12 && checkPath.convert(path12), path12, RETURN_FALSE);
   var setupWindows = () => {
     const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
     checkPath.convert = makePosix;
     const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
-    checkPath.isNotRelative = (path11) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path11) || isNotRelative(path11);
+    checkPath.isNotRelative = (path12) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path12) || isNotRelative(path12);
   };
   if (typeof process !== "undefined" && process.platform === "win32") {
     setupWindows();
@@ -7321,15 +8234,22 @@ __export(exports_daemon, {
   checkAndInstallUpdate: () => checkAndInstallUpdate,
   WATCH_LIMIT: () => WATCH_LIMIT
 });
-import fs13 from "node:fs";
-import path11 from "node:path";
-import { spawn as spawn2 } from "node:child_process";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import fs14 from "node:fs";
+import path12 from "node:path";
+import { spawn as spawn3 } from "node:child_process";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function outputIsPrivate(key) {
+  try {
+    return reviewRequired(readConfig(key, { loadRules: false }));
+  } catch {
+    return true;
+  }
+}
 function peerRoot(key) {
-  return path11.dirname(key);
+  return path12.dirname(key);
 }
 function peerName(key) {
-  return peerNameOf(path11.basename(key)) ?? DEFAULT_PEER;
+  return peerNameOf(path12.basename(key)) ?? DEFAULT_PEER;
 }
 function peerFields(key) {
   const peer = peerName(key);
@@ -7417,7 +8337,7 @@ function maybeAdoptNewerInstall(state, bootVersion) {
     executable: onPath,
     reason: "new-install"
   });
-  const child = spawn2(onPath, ["daemon", "restart"], {
+  const child = spawn3(onPath, ["daemon", "restart"], {
     detached: true,
     stdio: "ignore",
     windowsHide: true,
@@ -7437,7 +8357,7 @@ async function runCycle(state) {
   let skipped = 0;
   for (const instance of readInstances()) {
     const key = instance.configPath;
-    if (!fs13.existsSync(instance.configPath)) {
+    if (!fs14.existsSync(instance.configPath)) {
       const misses = (state.misses.get(key) ?? 0) + 1;
       state.misses.set(key, misses);
       if (misses >= PRUNE_AFTER_MISSES) {
@@ -7524,7 +8444,7 @@ async function syncInstance(state, key, trigger, options = {}) {
         command: "daemon",
         ...peerFields(key),
         trigger,
-        message: result.timedOut ? "sync timed out" : result.output.trim().slice(-500) || `sync exited ${result.status}`
+        message: result.timedOut ? "sync timed out" : !outputIsPrivate(key) && result.output.trim().slice(-500) || `sync exited ${result.status}`
       });
     }
   } finally {
@@ -7551,7 +8471,7 @@ async function syncIfDirty(state, key, trigger) {
 }
 async function checkoutIsDirty(key) {
   const sidecarPath = readInstances().find((instance) => instance.configPath === key)?.sidecarPath;
-  if (!sidecarPath || !fs13.existsSync(sidecarPath))
+  if (!sidecarPath || !fs14.existsSync(sidecarPath))
     return false;
   const result = await runChild("git", ["-C", sidecarPath, "status", "--porcelain"], { timeoutMs: 30000 });
   return result.status === 0 && Boolean(result.stdout.trim());
@@ -7559,7 +8479,7 @@ async function checkoutIsDirty(key) {
 function localSidecarCliPath(root) {
   if (!projectDependsOnSidecar(root))
     return;
-  const candidate = path11.join(root, "node_modules", PACKAGE_NAME, "dist", "cli.js");
+  const candidate = path12.join(root, "node_modules", PACKAGE_NAME, "dist", "cli.js");
   if (!isFile(candidate))
     return;
   const localVersion = installedPackageVersion(root);
@@ -7568,10 +8488,10 @@ function localSidecarCliPath(root) {
   return candidate;
 }
 function currentCliPath() {
-  return process.argv[1] || fileURLToPath3(import.meta.url);
+  return process.argv[1] || fileURLToPath2(import.meta.url);
 }
 function selectWatchTargets(instances, limit = WATCH_LIMIT) {
-  return [...instances].filter((instance) => fs13.existsSync(instance.configPath) && fs13.existsSync(instance.sidecarPath)).sort((left, right) => instanceRecency(right) - instanceRecency(left)).slice(0, limit);
+  return [...instances].filter((instance) => fs14.existsSync(instance.configPath) && fs14.existsSync(instance.sidecarPath)).sort((left, right) => instanceRecency(right) - instanceRecency(left)).slice(0, limit);
 }
 function instanceRecency(instance) {
   const time = Date.parse(instance.lastSyncAt ?? instance.updatedAt ?? instance.registeredAt);
@@ -7622,8 +8542,8 @@ async function refreshWatchers(state) {
         });
         watcher.on("all", (...args) => {
           scheduleWatchSync(state, key);
-          const changedPath = typeof args[1] === "string" ? path11.resolve(args[1]) : "";
-          if (changedPath !== path11.join(path11.resolve(sidecarPath), ".gitignore"))
+          const changedPath = typeof args[1] === "string" ? path12.resolve(args[1]) : "";
+          if (changedPath !== path12.join(path12.resolve(sidecarPath), ".gitignore"))
             return;
           if (state.watchers.get(key) !== watcher)
             return;
@@ -7636,7 +8556,7 @@ async function refreshWatchers(state) {
           logSidecarEvent("failure", {
             command: "daemon",
             ...peerFields(key),
-            message: `watcher error: ${error instanceof Error ? error.message : String(error)}`
+            message: outputIsPrivate(key) ? "watcher error" : `watcher error: ${error instanceof Error ? error.message : String(error)}`
           });
         });
         state.watchers.set(key, watcher);
@@ -7644,7 +8564,7 @@ async function refreshWatchers(state) {
         logSidecarEvent("failure", {
           command: "daemon",
           ...peerFields(key),
-          message: `could not watch ${sidecarPath}: ${error instanceof Error ? error.message : String(error)}`
+          message: outputIsPrivate(key) ? `could not watch ${sidecarPath}` : `could not watch ${sidecarPath}: ${error instanceof Error ? error.message : String(error)}`
         });
       }
     }
@@ -7717,7 +8637,7 @@ async function watchRegistry(state) {
     const watcher = chokidar.watch(sidecarStateDir(), { ignoreInitial: true, depth: 0 });
     watcher.on("all", (...args) => {
       const filePath = typeof args[1] === "string" ? args[1] : "";
-      if (path11.basename(filePath) !== "instances.json")
+      if (path12.basename(filePath) !== "instances.json")
         return;
       if (state.registryTimer)
         return;
@@ -7736,7 +8656,7 @@ async function watchRegistry(state) {
 function compileGitignoreMatcher(lines) {
   const rules = import_ignore.default({ ignorecase: false }).add(lines);
   return (relativePath) => {
-    const normalized = relativePath.split(path11.sep).join("/");
+    const normalized = relativePath.split(path12.sep).join("/");
     if (!import_ignore.default.isPathValid(normalized))
       return false;
     return rules.ignores(normalized);
@@ -7745,19 +8665,19 @@ function compileGitignoreMatcher(lines) {
 function watchIgnoreMatcher(sidecarPath) {
   let gitignore;
   try {
-    const ignoreFile = path11.join(sidecarPath, ".gitignore");
-    if (fs13.existsSync(ignoreFile)) {
-      gitignore = compileGitignoreMatcher(fs13.readFileSync(ignoreFile, "utf8").split(`
+    const ignoreFile = path12.join(sidecarPath, ".gitignore");
+    if (fs14.existsSync(ignoreFile)) {
+      gitignore = compileGitignoreMatcher(fs14.readFileSync(ignoreFile, "utf8").split(`
 `));
     }
   } catch {}
-  const root = path11.resolve(sidecarPath);
+  const root = path12.resolve(sidecarPath);
   return (candidate, stats) => {
-    const relative = path11.relative(root, candidate);
+    const relative = path12.relative(root, candidate);
     if (!relative)
       return false;
-    const normalized = relative.split(path11.sep).join("/");
-    if (normalized === ".." || normalized.startsWith("../") || path11.isAbsolute(relative))
+    const normalized = relative.split(path12.sep).join("/");
+    if (normalized === ".." || normalized.startsWith("../") || path12.isAbsolute(relative))
       return true;
     if (normalized === ".git" || normalized.startsWith(".git/"))
       return true;
@@ -7836,10 +8756,10 @@ function restartAfterUpdate() {
 }
 async function acquireDaemonPid() {
   const pidPath = daemonPidPath();
-  fs13.mkdirSync(path11.dirname(pidPath), { recursive: true });
+  fs14.mkdirSync(path12.dirname(pidPath), { recursive: true });
   while (true) {
     try {
-      fs13.writeFileSync(pidPath, `${process.pid}
+      fs14.writeFileSync(pidPath, `${process.pid}
 `, { encoding: "utf8", flag: "wx" });
       return;
     } catch (error) {
@@ -7855,7 +8775,7 @@ async function acquireDaemonPid() {
       continue;
     }
     logSidecarEvent("daemon-pid-heal", { holder: holder ?? null });
-    fs13.rmSync(pidPath, { force: true });
+    fs14.rmSync(pidPath, { force: true });
   }
 }
 function installShutdownHandlers() {
@@ -7870,12 +8790,12 @@ function installShutdownHandlers() {
 function removeOwnPidFile() {
   try {
     if (readPid(daemonPidPath()) === process.pid)
-      fs13.rmSync(daemonPidPath(), { force: true });
+      fs14.rmSync(daemonPidPath(), { force: true });
   } catch {}
 }
 function readPid(pidPath) {
   try {
-    const pid = Number(fs13.readFileSync(pidPath, "utf8").trim());
+    const pid = Number(fs14.readFileSync(pidPath, "utf8").trim());
     return Number.isInteger(pid) && pid > 0 ? pid : undefined;
   } catch {
     return;
@@ -7883,7 +8803,7 @@ function readPid(pidPath) {
 }
 function runChild(command, args, options) {
   return new Promise((resolve) => {
-    const child = spawn2(command, args, {
+    const child = spawn3(command, args, {
       cwd: options.cwd,
       env: options.env ?? process.env,
       stdio: ["ignore", "pipe", "pipe"],
@@ -7916,21 +8836,21 @@ function runChild(command, args, options) {
 }
 function isFile(filePath) {
   try {
-    return fs13.statSync(filePath).isFile();
+    return fs14.statSync(filePath).isFile();
   } catch {
     return false;
   }
 }
 function realpathOr2(filePath) {
   try {
-    return fs13.realpathSync(filePath);
+    return fs14.realpathSync(filePath);
   } catch {
-    return path11.resolve(filePath);
+    return path12.resolve(filePath);
   }
 }
 function isInsidePath2(child, parent) {
-  const relative = path11.relative(parent, child);
-  return Boolean(relative) && !relative.startsWith("..") && !path11.isAbsolute(relative);
+  const relative = path12.relative(parent, child);
+  return Boolean(relative) && !relative.startsWith("..") && !path12.isAbsolute(relative);
 }
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -8132,9 +9052,9 @@ var init_cmd_daemon = __esm(() => {
 });
 
 // src/cmd-sync.ts
-import fs14 from "node:fs";
+import fs15 from "node:fs";
 import os6 from "node:os";
-import path12 from "node:path";
+import path13 from "node:path";
 function cmdSnapshot(args) {
   const parsed = parseOptions(args, {
     boolean: new Set(["--push"]),
@@ -8143,17 +9063,23 @@ function cmdSnapshot(args) {
   if (parsed.positional.length)
     throw new SidecarError("usage: sidecar snapshot [--push] [-m message] [--peer name]");
   const peers = loadPeers(selectedPeer(parsed));
+  const push = parsed.flags.has("--push");
+  const gated = push ? peers.filter((peer) => reviewRequired(peer.config)) : [];
+  if (gated.length) {
+    throw new SidecarError(`${peers.length === 1 ? "this peer requires" : `${gated.map((peer) => peer.name).join(", ")} require`} review before anything is published; snapshot without --push, and \`sidecar sync\` opens or advances the review`);
+  }
   for (const peer of peers) {
     announcePeer(peer, peers);
     const { root, config } = peer;
     const sidecarPath = requireSidecarCheckout(root, config);
     withSyncLock(root, peer.name, "throw", () => {
+      bindReviewPolicy(sidecarPath, config);
       const inbox = expandInbox(config, sidecarPath);
       ensureCommitIdentity(sidecarPath);
       ensureRedactionFilter(sidecarPath, config.redaction, config);
       ensureInboxBranch(sidecarPath, config, inbox);
       const committed = snapshot(sidecarPath, root, inbox, getValue(parsed, "--message", getValue(parsed, "-m", "")) || undefined, config.redaction, config);
-      if (committed && parsed.flags.has("--push")) {
+      if (committed && push) {
         syncBranchBeforePush(sidecarPath, inbox, config);
         pushBranch(sidecarPath, inbox);
       }
@@ -8171,12 +9097,19 @@ function cmdSync(args) {
   }
   const peers = loadPeers(selectedPeer(parsed), { loadRules: false });
   const failed = [];
+  const soft = parsed.flags.has("--soft") || process.env[SOFT_SYNC_ENV] === "1";
+  const options = {
+    lock: soft ? "skip" : "throw",
+    remote: !parsed.flags.has("--local") && process.env[LOCAL_SYNC_ENV] !== "1",
+    snapshot: !parsed.flags.has("--no-snapshot"),
+    message: getValue(parsed, "--message", getValue(parsed, "-m", "")) || undefined
+  };
   for (const peer of peers) {
     announcePeer(peer, peers);
     try {
       if (peer.config.rulesPath)
         peer.config.rules = readRules(peer.config.rulesPath);
-      syncPeer(peer, parsed);
+      syncPeer(peer, options);
     } catch (error) {
       if (peers.length === 1)
         throw error;
@@ -8189,18 +9122,19 @@ function cmdSync(args) {
   }
   return 0;
 }
-function syncPeer(peer, parsed) {
+function syncPeer(peer, options) {
   const { root, config } = peer;
-  const soft = parsed.flags.has("--soft") || process.env[SOFT_SYNC_ENV] === "1";
-  const remote = !parsed.flags.has("--local") && process.env[LOCAL_SYNC_ENV] !== "1";
+  const { remote } = options;
+  const soft = options.lock === "skip";
   let stage = "start";
+  let outcome = {};
   let synced;
   try {
-    synced = withSyncLock(root, peer.name, soft ? "skip" : "throw", () => {
-      syncProject(root, config, {
-        snapshot: !parsed.flags.has("--no-snapshot"),
+    synced = withSyncLock(root, peer.name, options.lock, () => {
+      outcome = syncProject(root, config, {
+        snapshot: options.snapshot,
         remote,
-        message: getValue(parsed, "--message", getValue(parsed, "-m", "")) || undefined,
+        message: options.message,
         onStage: (name) => {
           stage = name;
         }
@@ -8212,13 +9146,18 @@ function syncPeer(peer, parsed) {
       reportSyncHealth(root, config, {
         status: "failed",
         stage,
-        message: error instanceof Error ? error.message : String(error)
+        message: reviewRequired(config) ? "details are shown only by a sync run by hand on that machine" : error instanceof Error ? error.message : String(error)
       });
     throw error;
   }
   if (synced) {
+    const held = outcome.held;
+    if (held) {
+      const { id } = held.review.record;
+      console.log(held.attention ? `sidecar: publishing is held — review ${id} needs attention: ${held.attention}; \`sidecar review show ${id}\`` : `sidecar: publishing is held for review ${id}; \`sidecar review show ${id}\``);
+    }
     if (remote)
-      reportSyncHealth(root, config, { status: "ok" });
+      reportSyncHealth(root, config, held ? { status: "ok", review: held.attention ? "attention" : "pending" } : { status: "ok" });
     if (!soft) {
       const sidecarPath = resolveSidecarPath(root, config);
       if (checkoutIsUnlinkedFromFamily(root, config, sidecarPath)) {
@@ -8243,12 +9182,16 @@ function cmdMerge(args) {
     const { root, config } = peer;
     const sidecarPath = requireSidecarCheckout(root, config);
     withSyncLock(root, peer.name, "throw", () => {
+      bindReviewPolicy(sidecarPath, config);
       ensureRedactionFilter(sidecarPath, config.redaction, config);
-      mergeInboxBranches(sidecarPath, config, {
-        forkFiles: parsed.flags.has("--fork-files"),
-        push: !parsed.flags.has("--no-push"),
-        remote: true
-      });
+      const forkFiles = parsed.flags.has("--fork-files");
+      const push = !parsed.flags.has("--no-push");
+      if (reviewRequired(config) && push) {
+        mergePublishedInboxes(sidecarPath, config, { forkFiles });
+        mergeInboxBranches(sidecarPath, config, { forkFiles, push: false, remote: false });
+        return;
+      }
+      mergeInboxBranches(sidecarPath, config, { forkFiles, push, remote: true });
     });
   }
   return 0;
@@ -8272,7 +9215,7 @@ function printPeerRedactions({ root, config }) {
   let shown = 0;
   let items = 0;
   for (const relPath of files) {
-    const delta = fileRedactionDelta(path12.join(sidecarPath, relPath), config.redaction, { rules: config.rules, relativePath: relPath });
+    const delta = fileRedactionDelta(path13.join(sidecarPath, relPath), config.redaction, { rules: config.rules, relativePath: relPath });
     if (!delta)
       continue;
     if (shown)
@@ -8291,12 +9234,12 @@ ${items} redaction(s) in ${shown} file(s) will be pushed this way (default: ${co
   console.log("local files are untouched; redaction is controlled by the peer's configuration and rules");
 }
 function printRedactionDiff(original, redacted) {
-  const scratch = fs14.mkdtempSync(path12.join(os6.tmpdir(), "sidecar-redactions-"));
+  const scratch = fs15.mkdtempSync(path13.join(os6.tmpdir(), "sidecar-redactions-"));
   try {
-    const localPath = path12.join(scratch, "local");
-    const pushedPath = path12.join(scratch, "pushed");
-    fs14.writeFileSync(localPath, original, "utf8");
-    fs14.writeFileSync(pushedPath, redacted, "utf8");
+    const localPath = path13.join(scratch, "local");
+    const pushedPath = path13.join(scratch, "pushed");
+    fs15.writeFileSync(localPath, original, "utf8");
+    fs15.writeFileSync(pushedPath, redacted, "utf8");
     const color = colorLevel() > 0 ? ["--color"] : [];
     const diff = gitRaw(["diff", "--no-index", ...color, "--", localPath, pushedPath], { check: false });
     const lines = diff.stdout.split(`
@@ -8307,7 +9250,7 @@ function printRedactionDiff(original, redacted) {
     if (body)
       console.log(body);
   } finally {
-    fs14.rmSync(scratch, { recursive: true, force: true });
+    fs15.rmSync(scratch, { recursive: true, force: true });
   }
 }
 function cmdRedact(args) {
@@ -8323,15 +9266,15 @@ function cmdRedact(args) {
   }
   const mode = redactionModeConfigValue(getValue(parsed, "--mode", DEFAULT_REDACTION_MODE), "--mode");
   const rulesPath = parsed.values.get("--rules");
-  const effective = checkoutPolicy ? checkoutRedactionPolicy(process.cwd()) : { mode, rules: rulesPath ? readRules(path12.resolve(rulesPath)) : [] };
+  const effective = checkoutPolicy ? checkoutRedactionPolicy(process.cwd()) : { mode, rules: rulesPath ? readRules(path13.resolve(rulesPath)) : [] };
   const relativePath = parsed.values.get("--path");
   if ((checkoutPolicy || rulesPath) && !relativePath)
     throw new SidecarError("redaction rules require --path");
   const effectiveMode = relativePath ? resolveFileRules(effective.rules, relativePath, { resolve: "fork", redaction: effective.mode }).redaction : effective.mode;
-  const output = redactBuffer(fs14.readFileSync(0), effectiveMode);
+  const output = redactBuffer(fs15.readFileSync(0), effectiveMode);
   let offset = 0;
   while (offset < output.length) {
-    offset += fs14.writeSync(1, output, offset, output.length - offset);
+    offset += fs15.writeSync(1, output, offset, output.length - offset);
   }
   return 0;
 }
@@ -8347,6 +9290,215 @@ var init_cmd_sync = __esm(() => {
   init_ui();
 });
 
+// src/cmd-review.ts
+import fs16 from "node:fs";
+import path14 from "node:path";
+function cmdReview(args) {
+  const [subcommand = "list", ...rest] = args[0]?.startsWith("-") ? ["list", ...args] : args;
+  switch (subcommand) {
+    case "list":
+      return listCommand(rest);
+    case "show":
+      return showCommand(rest);
+    case "approve":
+    case "reject":
+      return decideCommand(subcommand, rest);
+    case "retry":
+      return retryCommand(rest);
+    case "reviewer":
+      return reviewerCommand(rest);
+    case "run":
+      return runCommand(rest);
+    default:
+      throw new SidecarError(`unknown review command ${JSON.stringify(subcommand)}; ${USAGE}`);
+  }
+}
+function listCommand(args) {
+  const parsed = parseOptions(args, { boolean: new Set(["--json"]), value: new Set(["--peer"]) });
+  if (parsed.positional.length)
+    throw new SidecarError(USAGE);
+  const peers = loadPeers(selectedPeer(parsed));
+  if (parsed.flags.has("--json")) {
+    console.log(JSON.stringify(peers.map((peer) => ({
+      peer: peer.name,
+      required: reviewRequired(peer.config),
+      reviews: peerReviews(peer).map(reviewPayload)
+    })), null, 2));
+    return 0;
+  }
+  for (const peer of peers) {
+    announcePeer(peer, peers);
+    if (!reviewRequired(peer.config)) {
+      console.log(paint("quiet", 'review is off for this peer; turn it on with review = "required" in its config'));
+      continue;
+    }
+    const reviews = peerReviews(peer);
+    if (!reviews.length) {
+      console.log(paint("quiet", "no reviews yet; the next sync with unpublished changes opens one"));
+      continue;
+    }
+    for (const review of reviews)
+      printReviewRow(review);
+  }
+  return 0;
+}
+function peerReviews(peer) {
+  const sidecarPath = resolveSidecarPath(peer.root, peer.config);
+  return hasGitMetadata(sidecarPath) ? listReviews(sidecarPath) : [];
+}
+function printReviewRow(review) {
+  const attention = reviewAttention(review);
+  const age = formatRelativeTime(review.record.createdAt) ?? review.record.createdAt;
+  const text = `${review.record.id}  ${review.state.padEnd(10)}  ${age}, ${review.record.files.length} file(s)`;
+  if (attention)
+    console.log(`${paint("attn", text)}  needs attention: ${attention}`);
+  else
+    console.log(isOpen(review) ? text : paint("quiet", text));
+}
+function reviewPayload(review) {
+  return {
+    id: review.record.id,
+    state: review.state,
+    attention: reviewAttention(review),
+    createdAt: review.record.createdAt,
+    files: review.record.files,
+    reason: review.verdict?.reason,
+    decidedAt: review.verdict?.decidedAt,
+    publishedAt: review.record.publishedAt,
+    publishedCommit: review.record.publishedCommit,
+    dir: review.dir
+  };
+}
+function showCommand(args) {
+  const parsed = parseOptions(args, { boolean: new Set(["--json"]), value: new Set(["--peer"]) });
+  if (parsed.positional.length > 1)
+    throw new SidecarError(USAGE);
+  const review = selectReview(parsed.positional[0], selectedPeer(parsed));
+  if (parsed.flags.has("--json")) {
+    console.log(JSON.stringify(reviewPayload(review), null, 2));
+    return 0;
+  }
+  const { record } = review;
+  const line = (label, value, role) => labelLine(LABEL_WIDTH, label, value, role);
+  const attention = reviewAttention(review);
+  line("review", record.id, "brand");
+  line("state", attention ? `${review.state} — needs attention: ${attention}` : review.state, attention ? "attn" : undefined);
+  line("repo", record.root, "repo");
+  if (record.peer !== "default")
+    line("peer", record.peer);
+  line("opened", formatRelativeTime(record.createdAt) ?? record.createdAt);
+  if (review.verdict)
+    line("decided", `${review.verdict.verdict} ${formatRelativeTime(review.verdict.decidedAt) ?? review.verdict.decidedAt}`);
+  if (review.verdict?.reason)
+    line("reason", review.verdict.reason);
+  if (review.run)
+    line("reviewer", review.run.command, "quiet");
+  line("packet", review.dir, "quiet");
+  console.log("");
+  for (const file of record.files) {
+    console.log(`  ${file.status}  ${file.path}${file.artifact ? paint("quiet", `  (not in the diff; full content: ${path14.join(review.dir, file.artifact)})`) : ""}`);
+  }
+  console.log("");
+  process.stdout.write(fs16.readFileSync(path14.join(review.dir, "diff.patch"), "utf8"));
+  if (isOpen(review)) {
+    console.log("");
+    console.log(paint("quiet", `decide with \`sidecar review approve ${record.id}\` or \`sidecar review reject ${record.id} --reason "..."\``));
+  }
+  return 0;
+}
+function decideCommand(verdict, args) {
+  const parsed = parseOptions(args, { boolean: new Set(["--no-sync"]), value: new Set(["--reason", "--peer"]) });
+  if (parsed.positional.length > 1)
+    throw new SidecarError(USAGE);
+  const selected = selectReview(parsed.positional[0], selectedPeer(parsed));
+  const reason = parsed.values.get("--reason")?.trim() || undefined;
+  const { id } = selected.record;
+  withLockedReview(selected, (review) => decideReview(review, verdict === "approve" ? "approved" : "rejected", reason));
+  if (verdict === "reject") {
+    console.log(`rejected review ${paint("brand", id)}; nothing it covers is published`);
+    console.log("change the files it flags and the next sync opens a new review, or approve it to override");
+    return 0;
+  }
+  console.log(`approved review ${paint("brand", id)}`);
+  if (parsed.flags.has("--no-sync")) {
+    console.log("it publishes on the next sync");
+    return 0;
+  }
+  const peer = loadPeer(selected.record.root, selected.record.peer);
+  syncPeer(peer, { lock: "wait", remote: true, snapshot: true });
+  return 0;
+}
+function retryCommand(args) {
+  const parsed = parseOptions(args, { boolean: new Set, value: new Set(["--peer"]) });
+  if (parsed.positional.length > 1)
+    throw new SidecarError(USAGE);
+  configuredReviewer();
+  const selected = selectReview(parsed.positional[0], selectedPeer(parsed));
+  const fresh = withLockedReview(selected, retryReview);
+  console.log(`retired review ${paint("brand", selected.record.id)}; review ${paint("brand", fresh.record.id)} covers the same change, and its reviewer is running`);
+  return 0;
+}
+function withLockedReview(selected, fn) {
+  const { id, root, peer } = selected.record;
+  let result;
+  withSyncLock(root, peer, "wait", () => {
+    const review = readReview(id);
+    if (!review)
+      throw new SidecarError(`review ${id} is gone`);
+    result = fn(review);
+  });
+  return result;
+}
+function reviewerCommand(args) {
+  const settings = readSettings();
+  if (!args.length) {
+    console.log(settings.reviewer ?? paint("quiet", "no reviewer configured"));
+    return 0;
+  }
+  if (args.length === 1 && args[0] === "--unset") {
+    writeSettings({ ...settings, reviewer: undefined });
+    console.log("reviewer unset; reviews now wait for `sidecar review approve`");
+    return 0;
+  }
+  if (args.length !== 1) {
+    throw new SidecarError('usage: sidecar review reviewer ["<command>"|--unset]; quote the command as one argument');
+  }
+  const command = args[0].trim();
+  if (!command)
+    throw new SidecarError("the reviewer command is empty");
+  writeSettings({ ...settings, reviewer: command });
+  console.log(`reviewer set to ${paint("brand", command)}`);
+  return 0;
+}
+function runCommand(args) {
+  if (args.length !== 1)
+    throw new SidecarError("usage: sidecar review run <id>");
+  return runReviewer(args[0]);
+}
+function selectReview(id, peer) {
+  if (id)
+    return findReview(id);
+  const open = loadPeers(peer).map((candidate) => resolveSidecarPath(candidate.root, candidate.config)).filter(hasGitMetadata).map(openReview).filter((review) => review !== undefined);
+  if (open.length === 1)
+    return open[0];
+  if (!open.length)
+    throw new SidecarError("no open review here; pass a review id (`sidecar review` lists them)");
+  throw new SidecarError(`more than one open review here (${open.map((review) => review.record.id).join(", ")}); pass the id`);
+}
+var USAGE = "usage: sidecar review [list|show|approve|reject|retry|reviewer] [id] [--reason text] [--no-sync] [--json] [--peer name]", LABEL_WIDTH;
+var init_cmd_review = __esm(() => {
+  init_color();
+  init_util();
+  init_git();
+  init_config();
+  init_state();
+  init_review();
+  init_sync();
+  init_cmd_sync();
+  init_ui();
+  LABEL_WIDTH = "reviewer:".length;
+});
+
 // src/commands.ts
 function run(argv) {
   const [command, ...rest] = argv;
@@ -8420,12 +9572,13 @@ var init_commands = __esm(() => {
   init_cmd_status();
   init_cmd_daemon();
   init_cmd_sync();
+  init_cmd_review();
   COMMANDS = [
     {
       name: "init",
       run: cmdInit,
       section: "common",
-      usage: "init [remote] [--peer name] [--path sidecar|.] [--branch main] [--inbox template] [--redaction none|secrets|secrets+pii] [--resolve fork|lww] [--debounce 10m] [--interval 1h] [--ignored] [--local-install]",
+      usage: "init [remote] [--peer name] [--path sidecar|.] [--branch main] [--inbox template] [--redaction none|secrets|secrets+pii] [--resolve fork|lww] [--review off|required] [--review-timeout 1h] [--debounce 10m] [--interval 1h] [--ignored] [--local-install]",
       notes: [
         "--path . makes this repo itself the sidecar (standalone)",
         "--peer name adds a second sidecar as .sidecar.name; --ignored keeps it out of the tree",
@@ -8447,6 +9600,16 @@ var init_commands = __esm(() => {
       usage: "redactions [--peer name]",
       summary: "preview what redaction rewrites before content is pushed"
     },
+    {
+      name: "review",
+      run: cmdReview,
+      section: "common",
+      usage: "review [show|approve|reject|retry] [id] [--reason text] [--no-sync] [--json] [--peer name]",
+      notes: [
+        'the reviews that gate a peer with review = "required"; approve publishes at once',
+        "review reviewer [<command>|--unset] sets who reviews on this machine"
+      ]
+    },
     {
       name: "sync",
       run: cmdSync,
@@ -8517,7 +9680,7 @@ async function main(argv = process.argv.slice(2)) {
     if (command !== "redact" && command !== "deinit" && shouldUseGlobalRegistry()) {
       logSidecarEvent("failure", {
         command,
-        message: error instanceof Error ? error.message : String(error)
+        ...privateFailures() ? {} : { message: error instanceof Error ? error.message : String(error) }
       });
     }
     if (error instanceof SidecarError) {
@@ -8535,6 +9698,7 @@ var init_cli = __esm(() => {
   init_color();
   init_util();
   init_install();
+  init_config();
   init_state();
   init_commands();
   init_util();
@@ -8556,20 +9720,20 @@ var init_cli = __esm(() => {
 
 // src/bin.ts
 init_cli();
-import fs15 from "node:fs";
-import path13 from "node:path";
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import fs17 from "node:fs";
+import path15 from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 var SKIP_LOCAL_EXEC_ENV3 = "SIDECAR_SKIP_LOCAL_EXEC";
 var GLOBAL_EXEC_ENV3 = "SIDECAR_GLOBAL_EXEC";
 var PACKAGE_NAME2 = "sidecarsync";
 var GLOBAL_ONLY_COMMANDS = new Set(["daemon", "deinit", "register-install", "set-install-source", "update"]);
 if (process.argv[2] !== "redact" && !process.env[SKIP_LOCAL_EXEC_ENV3]) {
-  const local = findLocalInstall(process.cwd(), fileURLToPath4(import.meta.url));
+  const local = findLocalInstall(process.cwd(), fileURLToPath3(import.meta.url));
   if (local) {
     process.env[GLOBAL_EXEC_ENV3] = "1";
     if (local.newer && !GLOBAL_ONLY_COMMANDS.has(process.argv[2])) {
-      const result = spawnSync5(process.execPath, [local.executable, ...process.argv.slice(2)], {
+      const result = spawnSync6(process.execPath, [local.executable, ...process.argv.slice(2)], {
         stdio: "inherit",
         env: {
           ...process.env,
@@ -8586,15 +9750,15 @@ if (process.argv[2] !== "redact" && !process.env[SKIP_LOCAL_EXEC_ENV3]) {
 }
 process.exit(await main());
 function findLocalInstall(start, self) {
-  let current = path13.resolve(start);
+  let current = path15.resolve(start);
   while (true) {
     if (projectDependsOnSidecar2(current)) {
-      const candidate = path13.join(current, "node_modules", PACKAGE_NAME2, "dist", "cli.js");
+      const candidate = path15.join(current, "node_modules", PACKAGE_NAME2, "dist", "cli.js");
       if (isFile2(candidate) && !sameFile(candidate, self)) {
         return { executable: candidate, newer: localIsNewer(current) };
       }
     }
-    const parent = path13.dirname(current);
+    const parent = path15.dirname(current);
     if (parent === current)
       return;
     current = parent;
@@ -8605,11 +9769,11 @@ function localIsNewer(projectRoot) {
   return localVersion !== undefined && compareVersions(localVersion, packageVersion()) > 0;
 }
 function projectDependsOnSidecar2(projectRoot) {
-  const manifestPath = path13.join(projectRoot, "package.json");
+  const manifestPath = path15.join(projectRoot, "package.json");
   if (!isFile2(manifestPath))
     return false;
   try {
-    const manifest = JSON.parse(fs15.readFileSync(manifestPath, "utf8"));
+    const manifest = JSON.parse(fs17.readFileSync(manifestPath, "utf8"));
     return Boolean(manifest.dependencies?.[PACKAGE_NAME2] || manifest.devDependencies?.[PACKAGE_NAME2] || manifest.optionalDependencies?.[PACKAGE_NAME2] || manifest.peerDependencies?.[PACKAGE_NAME2]);
   } catch {
     return false;
@@ -8617,14 +9781,14 @@ function projectDependsOnSidecar2(projectRoot) {
 }
 function isFile2(filePath) {
   try {
-    return fs15.statSync(filePath).isFile();
+    return fs17.statSync(filePath).isFile();
   } catch {
     return false;
   }
 }
 function sameFile(first, second) {
   try {
-    return fs15.realpathSync(first) === fs15.realpathSync(second);
+    return fs17.realpathSync(first) === fs17.realpathSync(second);
   } catch {
     return false;
   }
diff --git a/packages/sidecar/src/cli.ts b/packages/sidecar/src/cli.ts
index 4a57e96..b9087c1 100644
--- a/packages/sidecar/src/cli.ts
+++ b/packages/sidecar/src/cli.ts
@@ -6,6 +6,7 @@
 import { colorLevel, paint } from "./color.js";
 import { SidecarError } from "./util.js";
 import { shouldUseGlobalRegistry } from "./install.js";
+import { privateFailures } from "./config.js";
 import { logSidecarEvent } from "./state.js";
 import { run } from "./commands.js";
 
@@ -40,7 +41,8 @@ export async function main(argv = process.argv.slice(2)): Promise<number> {
     if (command !== "redact" && command !== "deinit" && shouldUseGlobalRegistry()) {
       logSidecarEvent("failure", {
         command,
-        message: error instanceof Error ? error.message : String(error),
+        // The terminal still gets the message below.
+        ...(privateFailures() ? {} : { message: error instanceof Error ? error.message : String(error) }),
       });
     }
     if (error instanceof SidecarError) {
diff --git a/packages/sidecar/src/cmd-init.ts b/packages/sidecar/src/cmd-init.ts
index 4fee71a..84815bc 100644
--- a/packages/sidecar/src/cmd-init.ts
+++ b/packages/sidecar/src/cmd-init.ts
@@ -48,9 +48,12 @@ import {
   peerFileName,
   readConfig,
   resolveSidecarPath,
+  configText,
   durationConfigValue,
+  notePeerPolicy,
   redactionModeConfigValue,
   resolveModeConfigValue,
+  reviewModeConfigValue,
   selectedPeer,
   validateBranch,
   validateInboxTemplate,
@@ -64,6 +67,7 @@ import { cloneOrUpdate, removeRedactionFilter, syncProject } from "./sync.js";
 import { announcePeer, promptLine, promptYesNo, promptYesNoDefaultNo } from "./ui.js";
 import { DEFAULT_REDACTION_MODE, REDACTION_MODES, type RedactionMode } from "./redaction.js";
 import { peerRulesFileName, peerRulesPath, readRules, rulesMayRedact } from "./rules.js";
+import { peerReviewGuidelinesFileName, peerReviewGuidelinesPath, pruneOrphanedReviews } from "./review.js";
 
 export function cmdDeinit(args: string[]): number {
   const parsed = parseOptions(args, { boolean: new Set(["--yes", "-y"]), value: new Set(["--peer"]) });
@@ -148,6 +152,8 @@ export function cmdDeinit(args: string[]): number {
     }
     fs.rmSync(configPath, { force: true });
     fs.rmSync(peerRulesPath(root, name), { force: true });
+    fs.rmSync(peerReviewGuidelinesPath(root, name), { force: true });
+    pruneOrphanedReviews();
     unregisterInstance(configPath);
   });
 
@@ -221,11 +227,11 @@ function removeCheckout(checkoutPath: string): void {
 export function cmdInit(args: string[]): number {
   const parsed = parseOptions(args, {
     boolean: new Set(["--no-clone", "--no-bootstrap-main", "--local-install", "--ignored"]),
-    value: new Set(["--path", "--branch", "--inbox", "--redaction", "--resolve", "--debounce", "--interval", "--peer"]),
+    value: new Set(["--path", "--branch", "--inbox", "--redaction", "--resolve", "--review", "--review-timeout", "--debounce", "--interval", "--peer"]),
   });
   if (parsed.positional.length > 1) {
     throw new SidecarError(
-      "usage: sidecar init [remote] [--peer name] [--path sidecar] [--branch main] [--inbox template] [--redaction mode] [--resolve fork|lww] [--debounce 10m] [--interval 1h] [--ignored]",
+      "usage: sidecar init [remote] [--peer name] [--path sidecar] [--branch main] [--inbox template] [--redaction mode] [--resolve fork|lww] [--review off|required] [--review-timeout 1h] [--debounce 10m] [--interval 1h] [--ignored]",
     );
   }
 
@@ -284,23 +290,17 @@ export function cmdInit(args: string[]): number {
 function configurePeer(root: string, name: string, remote: string | undefined, parsed: ParsedOptions): Peer {
   const configPath = peerConfigPath(root, name);
   let reuse = !remote && fs.existsSync(configPath);
+  let built: SidecarConfig | undefined;
   if (remote && fs.existsSync(configPath)) {
     const existing = readConfig(configPath);
-    // Omitted flags fall back to the EXISTING values, not the defaults — a
-    // plain re-init must not read as a request to reset settings (a non-TTY
-    // re-init would fail, and a prompted "y" would silently flip redaction).
-    const unchanged =
-      existing.remote === remote &&
-      existing.path === getValue(parsed, "--path", existing.path) &&
-      existing.branch === getValue(parsed, "--branch", existing.branch) &&
-      existing.inbox === getValue(parsed, "--inbox", existing.inbox) &&
-      existing.redaction === getValue(parsed, "--redaction", existing.redaction) &&
-      existing.resolve === getValue(parsed, "--resolve", existing.resolve) &&
-      existing.debounce === durationConfigValue(parsed.values.get("--debounce") ?? existing.debounce, "--debounce") &&
-      existing.interval === durationConfigValue(parsed.values.get("--interval") ?? existing.interval, "--interval");
-    reuse = unchanged || !promptOverwriteConfig(configPath, existing.remote, remote);
-  }
-  const config = reuse ? readConfig(configPath) : buildInitConfig(root, name, remote, parsed);
+    // Omitted flags keep the EXISTING values, not the defaults: a re-init
+    // changes only what it names. Anything else would silently flip
+    // redaction, or drop a review gate, on a prompted "y".
+    built = buildInitConfig(root, name, remote, parsed, existing);
+    reuse = configText(built) === configText(existing) || !promptOverwriteConfig(configPath, existing.remote, remote);
+  }
+  const config = reuse ? readConfig(configPath) : built ?? buildInitConfig(root, name, remote, parsed);
+  notePeerPolicy(config);
   if (!reuse) {
     config.rulesPath = peerRulesPath(root, name);
     config.rules = readRules(config.rulesPath);
@@ -312,7 +312,7 @@ function configurePeer(root: string, name: string, remote: string | undefined, p
     if (isStandalone(config)) {
       throw new SidecarError("--ignored cannot apply to a standalone sidecar: its .sidecar is part of the tree it syncs");
     }
-    for (const file of [peerFileName(name), peerRulesFileName(name)]) {
+    for (const file of [peerFileName(name), peerRulesFileName(name), peerReviewGuidelinesFileName(name)]) {
       if (isGitTracked(root, file)) {
         throw new SidecarError(`${file} is tracked by git; \`git rm --cached ${file}\` before ignoring it`);
       }
@@ -355,9 +355,11 @@ function excludePeerFile(root: string, name: string): void {
     throw new SidecarError(`--ignored needs a git exclude file, and ${root} has none; ignore ${configFile} in your own VCS config`);
   }
   const rulesFile = peerRulesFileName(name);
+  const guidelinesFile = peerReviewGuidelinesFileName(name);
   ensureIgnoreLine(exclude, `/${configFile}`);
   ensureIgnoreLine(exclude, `/${rulesFile}`);
-  console.log(`ignored ${configFile} and ${rulesFile} via .git/info/exclude`);
+  ensureIgnoreLine(exclude, `/${guidelinesFile}`);
+  console.log(`ignored ${configFile}, ${rulesFile}, and ${guidelinesFile} via .git/info/exclude`);
 }
 
 /**
@@ -386,13 +388,19 @@ function initRoot(remote: string | undefined, parsed: ParsedOptions): string {
 // Question order matters: the checkout path decides whether this is a
 // standalone sidecar, and that in turn changes the default answer to both of
 // the questions after it.
-function buildInitConfig(root: string, name: string, remote: string | undefined, parsed: ParsedOptions): SidecarConfig {
+function buildInitConfig(
+  root: string,
+  name: string,
+  remote: string | undefined,
+  parsed: ParsedOptions,
+  existing?: SidecarConfig,
+): SidecarConfig {
   // A named peer's checkout is named after it by default: `--peer research`
   // lives in `research/`, beside the default peer's `sidecar/`.
   const defaultPath = name === DEFAULT_PEER ? DEFAULT_PATH : name;
   const rawPath = parsed.values.has("--path")
     ? getValue(parsed, "--path", defaultPath)
-    : promptSidecarPath(root, name, defaultPath);
+    : existing?.path ?? promptSidecarPath(root, name, defaultPath);
   // `--path $PWD` and `--path foo/..` mean the same thing as `--path .`;
   // store them as "." so standalone detection — a string check on the config
   // — can't be dodged by spelling the root differently and land the repo in
@@ -410,16 +418,18 @@ function buildInitConfig(root: string, name: string, remote: string | undefined,
     remote: remote ?? (standalone ? standaloneRemote(root) : promptRemote(root)),
     version: 1,
     path: sidecarPath,
-    branch: getValue(parsed, "--branch", DEFAULT_BRANCH),
-    inbox: getValue(parsed, "--inbox", DEFAULT_INBOX),
+    branch: getValue(parsed, "--branch", existing?.branch ?? DEFAULT_BRANCH),
+    inbox: getValue(parsed, "--inbox", existing?.inbox ?? DEFAULT_INBOX),
     redaction: parsed.values.has("--redaction")
       ? redactionModeConfigValue(getValue(parsed, "--redaction", DEFAULT_REDACTION_MODE), "--redaction")
-      : promptRedactionMode(),
+      : existing?.redaction ?? promptRedactionMode(),
     resolve: parsed.values.has("--resolve")
       ? resolveModeConfigValue(getValue(parsed, "--resolve", DEFAULT_RESOLVE), "--resolve")
-      : DEFAULT_RESOLVE,
-    debounce: durationConfigValue(parsed.values.get("--debounce"), "--debounce"),
-    interval: durationConfigValue(parsed.values.get("--interval"), "--interval"),
+      : existing?.resolve ?? DEFAULT_RESOLVE,
+    debounce: durationConfigValue(parsed.values.get("--debounce"), "--debounce") ?? existing?.debounce,
+    interval: durationConfigValue(parsed.values.get("--interval"), "--interval") ?? existing?.interval,
+    review: reviewModeConfigValue(getValue(parsed, "--review", existing?.review ?? "off"), "--review"),
+    reviewTimeout: durationConfigValue(parsed.values.get("--review-timeout"), "--review-timeout") ?? existing?.reviewTimeout,
   };
 }
 
diff --git a/packages/sidecar/src/cmd-refresh.ts b/packages/sidecar/src/cmd-refresh.ts
index 7c686b3..faef544 100644
--- a/packages/sidecar/src/cmd-refresh.ts
+++ b/packages/sidecar/src/cmd-refresh.ts
@@ -17,7 +17,7 @@ import {
   fetch,
   git,
   hasAnyCommit,
-  isDirty,
+  isAncestor,
 } from "./git.js";
 import {
   type Peer,
@@ -25,8 +25,12 @@ import {
   expandInbox,
   isStandalone,
   loadPeers,
+  PUBLIC_REFS,
+  inboxPrefix,
+  matchesInboxPrefix,
   requireSidecarCheckout,
   resolveSidecarPath,
+  reviewRequired,
   selectedPeer,
 } from "./config.js";
 import { logSidecarEvent, registerCurrentInstance, withSyncLock } from "./state.js";
@@ -36,9 +40,11 @@ import {
   ensureMainBranch,
   ensureRedactionFilter,
   familySidecarCheckout,
+  refreshPublicRefs,
 } from "./sync.js";
 import { announcePeer, promptYesNoDefaultNo } from "./ui.js";
 import { rulesMayRedact } from "./rules.js";
+import { type Review, markSuperseded, openReview } from "./review.js";
 
 /**
  * Which of a repo's worktrees holds a branch, if any.
@@ -91,17 +97,75 @@ export function unpushedCommits(sidecarPath: string): number {
   return counted.status === 0 ? Number(counted.stdout.trim()) || 0 : 0;
 }
 
+/**
+ * What deleting this checkout would lose, as phrases for a refusal; empty
+ * when nothing. Measured against the remote refs as last fetched.
+ */
+function heldWork(sidecarPath: string, config: SidecarConfig, inbox: string): string[] {
+  // A review-gated checkout never pushes its own commits, so counting them
+  // would refuse forever; what it would lose is content not yet published.
+  const gated = reviewRequired(config);
+  const unpushed = gated ? 0 : unpushedCommits(sidecarPath);
+  const unpublished = gated && !gatedWorkIsPublished(sidecarPath, config, inbox);
+  const dirtyFiles = git(sidecarPath, ["status", "--porcelain"], { check: false })
+    .stdout.split("\n")
+    .filter(Boolean).length;
+  return [
+    unpushed ? `${unpushed} commit(s) the remote has not seen` : "",
+    unpublished ? "changes not yet published through review" : "",
+    dirtyFiles ? `${dirtyFiles} uncommitted file(s)` : "",
+  ].filter(Boolean);
+}
+
+/**
+ * Whether deleting this gated checkout loses nothing unpublished. Its own
+ * HEAD must be published, or held by a local main that is. A checkout owning
+ * the family's store takes local main and every sibling's inbox with it, so
+ * then all of those must be published too: a gated bootstrap, for one, leaves
+ * the checkout's history on local main while its inbox starts empty.
+ */
+function gatedWorkIsPublished(sidecarPath: string, config: SidecarConfig, inbox: string): boolean {
+  if (!hasAnyCommit(sidecarPath)) return true;
+  const tree = (ref: string): string | undefined => {
+    const result = git(sidecarPath, ["rev-parse", "--verify", "--quiet", `${ref}^{tree}`], { check: false });
+    return result.status === 0 ? result.stdout.trim() : undefined;
+  };
+  // Against the public refs, not origin/*: those are local state any hook or
+  // tool can write, and a forged one would let refresh delete unpublished work.
+  const main = `refs/heads/${config.branch}`;
+  const publicMain = tree(`${PUBLIC_REFS}${config.branch}`);
+  const mainTree = tree(main);
+  const mainPublished = mainTree === undefined || mainTree === publicMain;
+  const published = (ref: string, branch: string): boolean => {
+    const own = tree(ref);
+    return own === publicMain || own === tree(`${PUBLIC_REFS}${branch}`) || (mainPublished && isAncestor(sidecarPath, ref, main));
+  };
+  if (!published("HEAD", inbox)) return false;
+  if (!ownsStore(sidecarPath)) return true;
+  if (!mainPublished) return false;
+  const prefix = inboxPrefix(config);
+  return git(sidecarPath, ["for-each-ref", "--format=%(refname)", "refs/heads/"])
+    .stdout.split("\n")
+    .filter((ref) => ref && matchesInboxPrefix(prefix, ref.slice("refs/heads/".length)))
+    .every((ref) => published(ref, ref.slice("refs/heads/".length)));
+}
+
+/** Whether this checkout holds its family's Git store rather than linking to one. */
+function ownsStore(sidecarPath: string): boolean {
+  try {
+    return fs.statSync(path.join(sidecarPath, ".git")).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Checkouts hanging off this one as linked worktrees — the ones that deleting it
  * would break. Empty unless this checkout owns the store: asked of a linked
  * worktree, `worktree list` answers for the whole family.
  */
 export function dependentWorktrees(sidecarPath: string): string[] {
-  try {
-    if (!fs.statSync(path.join(sidecarPath, ".git")).isDirectory()) return [];
-  } catch {
-    return [];
-  }
+  if (!ownsStore(sidecarPath)) return [];
   const result = git(sidecarPath, ["worktree", "list", "--porcelain"], { check: false });
   if (result.status !== 0) return [];
   const self = realpathOr(sidecarPath);
@@ -172,6 +236,18 @@ export function refreshCheckout(root: string, config: SidecarConfig): void {
   }
 
   const checkoutId = existingCheckoutId(sidecarPath);
+  // Deleting the family's own clone deletes the commits its open review is
+  // of, so retire it; the next sync reviews whatever is still unpublished. A
+  // linked worktree shares the clone and leaves the review alone.
+  if (ownsStore(sidecarPath)) {
+    let open: Review | undefined;
+    try {
+      open = openReview(sidecarPath);
+    } catch {
+      // An unreadable clone (refresh --force) has no family to look up.
+    }
+    if (open) markSuperseded(open);
+  }
   fs.rmSync(sidecarPath, { recursive: true, force: true });
   // Something may still hold an admin entry for the path this checkout occupied:
   // the family's clone if it was a linked worktree, or the family's clone again
@@ -305,21 +381,25 @@ function refreshPeer({ root, config, name }: Peer, parsed: ParsedOptions): void
   let inbox: string | undefined;
   if (readable) {
     inbox = expandInbox(config, sidecarPath);
-    // origin/<inbox> is what decides how much is unpushed, so it has to be as
-    // current as the network allows before anything is counted against it. A
-    // stale one over-counts, which errs toward refusing.
-    fetch(sidecarPath, true, false);
-    const unpushed = unpushedCommits(sidecarPath);
-    const dirtyFiles = git(sidecarPath, ["status", "--porcelain"], { check: false })
-      .stdout.split("\n")
-      .filter(Boolean).length;
-    if ((unpushed || dirtyFiles) && !force) {
-      const held = [
-        unpushed ? `${unpushed} commit(s) the remote has not seen` : "",
-        dirtyFiles ? `${dirtyFiles} uncommitted file(s)` : "",
-      ].filter(Boolean);
+    // What is held is measured against the remote, so it has to be as current
+    // as the network allows; offline, it stays as last fetched, which errs
+    // toward refusing. A gated checkout is measured against the public refs,
+    // which only sidecar's own fetch writes; an ungated one against
+    // origin/<inbox>, which decides how much is unpushed.
+    if (reviewRequired(config)) {
+      try { refreshPublicRefs(sidecarPath); } catch { /* offline: last fetched */ }
+    } else {
+      fetch(sidecarPath, true, false);
+    }
+    const held = heldWork(sidecarPath, config, inbox);
+    if (held.length && !force) {
+      // A gated checkout's work leaves only through an approved review, which
+      // syncing alone does not give.
+      const publish = reviewRequired(config)
+        ? "approve its review (`sidecar review`) and sync to publish them"
+        : "run `sidecar sync` to push them";
       throw new SidecarError(
-        `this checkout still holds ${held.join(" and ")}; run \`sidecar sync\` to push them, then refresh — or \`sidecar refresh --force\` to discard them`,
+        `this checkout still holds ${held.join(" and ")}; ${publish}, then refresh — or \`sidecar refresh --force\` to discard them`,
       );
     }
   }
@@ -372,7 +452,9 @@ function refreshPeer({ root, config, name }: Peer, parsed: ParsedOptions): void
   withSyncLock(root, name, "throw", () => {
     // Re-read under the lock: the prompt above is unbounded, and a sync or an
     // agent could have written to the checkout while it sat there.
-    if (readable && !force && isDirty(sidecarPath)) {
+    // Every guard, not only dirtiness: a sync in that window can snapshot new
+    // work and leave the checkout clean but holding it.
+    if (readable && !force && inbox && heldWork(sidecarPath, config, inbox).length) {
       throw new SidecarError("the sidecar checkout changed while waiting for confirmation; rerun refresh");
     }
     if (standalone) declined = refreshStandaloneCheckout(root, config, force);
diff --git a/packages/sidecar/src/cmd-review.ts b/packages/sidecar/src/cmd-review.ts
new file mode 100644
index 0000000..e46aa93
--- /dev/null
+++ b/packages/sidecar/src/cmd-review.ts
@@ -0,0 +1,240 @@
+// `sidecar review`: list, show, and decide the reviews that gate a peer's
+// publishing, set this machine's reviewer, and — as `review run` — the
+// background runner a sync starts. The records and runner live in review.ts;
+// the publishing they gate lives in sync.ts.
+import fs from "node:fs";
+import path from "node:path";
+
+import { type Role, paint } from "./color.js";
+import { SidecarError, parseOptions } from "./util.js";
+import { hasGitMetadata } from "./git.js";
+import { type Peer, loadPeer, loadPeers, resolveSidecarPath, reviewRequired, selectedPeer } from "./config.js";
+import { readSettings, withSyncLock, writeSettings } from "./state.js";
+import {
+  type Review,
+  configuredReviewer,
+  decideReview,
+  findReview,
+  isOpen,
+  listReviews,
+  openReview,
+  readReview,
+  reviewAttention,
+  runReviewer,
+} from "./review.js";
+import { retryReview } from "./sync.js";
+import { syncPeer } from "./cmd-sync.js";
+import { announcePeer, formatRelativeTime, labelLine } from "./ui.js";
+
+const USAGE = "usage: sidecar review [list|show|approve|reject|retry|reviewer] [id] [--reason text] [--no-sync] [--json] [--peer name]";
+// "reviewer:" is the longest label.
+const LABEL_WIDTH = "reviewer:".length;
+
+export function cmdReview(args: string[]): number {
+  const [subcommand = "list", ...rest] = args[0]?.startsWith("-") ? ["list", ...args] : args;
+  switch (subcommand) {
+    case "list":
+      return listCommand(rest);
+    case "show":
+      return showCommand(rest);
+    case "approve":
+    case "reject":
+      return decideCommand(subcommand, rest);
+    case "retry":
+      return retryCommand(rest);
+    case "reviewer":
+      return reviewerCommand(rest);
+    case "run":
+      return runCommand(rest);
+    default:
+      throw new SidecarError(`unknown review command ${JSON.stringify(subcommand)}; ${USAGE}`);
+  }
+}
+
+function listCommand(args: string[]): number {
+  const parsed = parseOptions(args, { boolean: new Set(["--json"]), value: new Set(["--peer"]) });
+  if (parsed.positional.length) throw new SidecarError(USAGE);
+  const peers = loadPeers(selectedPeer(parsed));
+  if (parsed.flags.has("--json")) {
+    console.log(JSON.stringify(peers.map((peer) => ({
+      peer: peer.name,
+      required: reviewRequired(peer.config),
+      reviews: peerReviews(peer).map(reviewPayload),
+    })), null, 2));
+    return 0;
+  }
+  for (const peer of peers) {
+    announcePeer(peer, peers);
+    if (!reviewRequired(peer.config)) {
+      console.log(paint("quiet", "review is off for this peer; turn it on with review = \"required\" in its config"));
+      continue;
+    }
+    const reviews = peerReviews(peer);
+    if (!reviews.length) {
+      console.log(paint("quiet", "no reviews yet; the next sync with unpublished changes opens one"));
+      continue;
+    }
+    for (const review of reviews) printReviewRow(review);
+  }
+  return 0;
+}
+
+function peerReviews(peer: Peer): Review[] {
+  const sidecarPath = resolveSidecarPath(peer.root, peer.config);
+  return hasGitMetadata(sidecarPath) ? listReviews(sidecarPath) : [];
+}
+
+function printReviewRow(review: Review): void {
+  const attention = reviewAttention(review);
+  const age = formatRelativeTime(review.record.createdAt) ?? review.record.createdAt;
+  const text = `${review.record.id}  ${review.state.padEnd(10)}  ${age}, ${review.record.files.length} file(s)`;
+  if (attention) console.log(`${paint("attn", text)}  needs attention: ${attention}`);
+  else console.log(isOpen(review) ? text : paint("quiet", text));
+}
+
+function reviewPayload(review: Review): Record<string, unknown> {
+  return {
+    id: review.record.id,
+    state: review.state,
+    attention: reviewAttention(review),
+    createdAt: review.record.createdAt,
+    files: review.record.files,
+    reason: review.verdict?.reason,
+    decidedAt: review.verdict?.decidedAt,
+    publishedAt: review.record.publishedAt,
+    publishedCommit: review.record.publishedCommit,
+    dir: review.dir,
+  };
+}
+
+function showCommand(args: string[]): number {
+  const parsed = parseOptions(args, { boolean: new Set(["--json"]), value: new Set(["--peer"]) });
+  if (parsed.positional.length > 1) throw new SidecarError(USAGE);
+  const review = selectReview(parsed.positional[0], selectedPeer(parsed));
+  if (parsed.flags.has("--json")) {
+    console.log(JSON.stringify(reviewPayload(review), null, 2));
+    return 0;
+  }
+  const { record } = review;
+  const line = (label: string, value: string, role?: Role): void => labelLine(LABEL_WIDTH, label, value, role);
+  const attention = reviewAttention(review);
+  line("review", record.id, "brand");
+  line("state", attention ? `${review.state} — needs attention: ${attention}` : review.state, attention ? "attn" : undefined);
+  line("repo", record.root, "repo");
+  if (record.peer !== "default") line("peer", record.peer);
+  line("opened", formatRelativeTime(record.createdAt) ?? record.createdAt);
+  if (review.verdict) line("decided", `${review.verdict.verdict} ${formatRelativeTime(review.verdict.decidedAt) ?? review.verdict.decidedAt}`);
+  if (review.verdict?.reason) line("reason", review.verdict.reason);
+  if (review.run) line("reviewer", review.run.command, "quiet");
+  line("packet", review.dir, "quiet");
+  console.log("");
+  for (const file of record.files) {
+    console.log(`  ${file.status}  ${file.path}${file.artifact ? paint("quiet", `  (not in the diff; full content: ${path.join(review.dir, file.artifact)})`) : ""}`);
+  }
+  console.log("");
+  process.stdout.write(fs.readFileSync(path.join(review.dir, "diff.patch"), "utf8"));
+  if (isOpen(review)) {
+    console.log("");
+    console.log(paint("quiet", `decide with \`sidecar review approve ${record.id}\` or \`sidecar review reject ${record.id} --reason "..."\``));
+  }
+  return 0;
+}
+
+function decideCommand(verdict: "approve" | "reject", args: string[]): number {
+  const parsed = parseOptions(args, { boolean: new Set(["--no-sync"]), value: new Set(["--reason", "--peer"]) });
+  if (parsed.positional.length > 1) throw new SidecarError(USAGE);
+  const selected = selectReview(parsed.positional[0], selectedPeer(parsed));
+  const reason = parsed.values.get("--reason")?.trim() || undefined;
+  const { id } = selected.record;
+  withLockedReview(selected, (review) => decideReview(review, verdict === "approve" ? "approved" : "rejected", reason));
+
+  if (verdict === "reject") {
+    console.log(`rejected review ${paint("brand", id)}; nothing it covers is published`);
+    console.log("change the files it flags and the next sync opens a new review, or approve it to override");
+    return 0;
+  }
+  console.log(`approved review ${paint("brand", id)}`);
+  if (parsed.flags.has("--no-sync")) {
+    console.log("it publishes on the next sync");
+    return 0;
+  }
+  // Publishing now rather than at the daemon's next round trip, which can be
+  // ten minutes away. The sync that opened this review may still hold the
+  // lock — a fast reviewer approves from inside it — so wait for it.
+  const peer = loadPeer(selected.record.root, selected.record.peer);
+  syncPeer(peer, { lock: "wait", remote: true, snapshot: true });
+  return 0;
+}
+
+function retryCommand(args: string[]): number {
+  const parsed = parseOptions(args, { boolean: new Set(), value: new Set(["--peer"]) });
+  if (parsed.positional.length > 1) throw new SidecarError(USAGE);
+  configuredReviewer();
+  const selected = selectReview(parsed.positional[0], selectedPeer(parsed));
+  // A new review rather than the old one reopened: whatever the old review's
+  // reviewer still does, it can only decide a review that is closed.
+  const fresh = withLockedReview(selected, retryReview);
+  console.log(`retired review ${paint("brand", selected.record.id)}; review ${paint("brand", fresh.record.id)} covers the same change, and its reviewer is running`);
+  return 0;
+}
+
+/**
+ * Runs `fn` on a fresh read of the review under the sync lock of the peer it
+ * gates: a sync acts on the verdict it reads, so no verdict may change while
+ * one runs. A reviewer often decides while the sync that launched it still
+ * holds that lock, so this waits for it.
+ */
+function withLockedReview<T>(selected: Review, fn: (review: Review) => T): T {
+  const { id, root, peer } = selected.record;
+  let result: T | undefined;
+  withSyncLock(root, peer, "wait", () => {
+    const review = readReview(id);
+    if (!review) throw new SidecarError(`review ${id} is gone`);
+    result = fn(review);
+  });
+  return result as T;
+}
+
+function reviewerCommand(args: string[]): number {
+  const settings = readSettings();
+  if (!args.length) {
+    console.log(settings.reviewer ?? paint("quiet", "no reviewer configured"));
+    return 0;
+  }
+  if (args.length === 1 && args[0] === "--unset") {
+    writeSettings({ ...settings, reviewer: undefined });
+    console.log("reviewer unset; reviews now wait for `sidecar review approve`");
+    return 0;
+  }
+  // The one argument is the whole shell command, quoted as the shell will
+  // run it. Rejoining several would lose their quoting.
+  if (args.length !== 1) {
+    throw new SidecarError("usage: sidecar review reviewer [\"<command>\"|--unset]; quote the command as one argument");
+  }
+  const command = args[0].trim();
+  if (!command) throw new SidecarError("the reviewer command is empty");
+  writeSettings({ ...settings, reviewer: command });
+  console.log(`reviewer set to ${paint("brand", command)}`);
+  return 0;
+}
+
+function runCommand(args: string[]): number {
+  if (args.length !== 1) throw new SidecarError("usage: sidecar review run <id>");
+  return runReviewer(args[0]);
+}
+
+/**
+ * The review a command means: the id given, or — when there is exactly one —
+ * the open review of the repo the command runs in.
+ */
+function selectReview(id: string | undefined, peer: string | undefined): Review {
+  if (id) return findReview(id);
+  const open = loadPeers(peer)
+    .map((candidate) => resolveSidecarPath(candidate.root, candidate.config))
+    .filter(hasGitMetadata)
+    .map(openReview)
+    .filter((review): review is Review => review !== undefined);
+  if (open.length === 1) return open[0];
+  if (!open.length) throw new SidecarError("no open review here; pass a review id (`sidecar review` lists them)");
+  throw new SidecarError(`more than one open review here (${open.map((review) => review.record.id).join(", ")}); pass the id`);
+}
diff --git a/packages/sidecar/src/cmd-status.ts b/packages/sidecar/src/cmd-status.ts
index 85a56a8..8316057 100644
--- a/packages/sidecar/src/cmd-status.ts
+++ b/packages/sidecar/src/cmd-status.ts
@@ -15,6 +15,7 @@ import {
   loadPeers,
   requireSidecarCheckout,
   resolveSidecarPath,
+  reviewRequired,
   selectedPeer,
 } from "./config.js";
 import { instancePeer, instancesPath, listInstanceStatuses, readInstances, readSettings, sidecarLogPath } from "./state.js";
@@ -22,6 +23,7 @@ import { daemonServiceStatus } from "./service.js";
 import { checkoutIsUnlinkedFromFamily, pendingInboxBranches, readFleetHealth } from "./sync.js";
 import { announcePeer, formatRelativeTime, formatTimestampPair, labelLine } from "./ui.js";
 import { type HealthRecord, type HealthState, summarizeHealthStates } from "./health.js";
+import { openReview, reviewAttention } from "./review.js";
 
 // "pending inbox:" is the longest label; every value starts one space past it.
 const STATUS_LABEL_WIDTH = "pending inbox:".length;
@@ -61,6 +63,7 @@ function printPeerStatus({ root, config, configPath }: Peer): void {
   statusLine("main branch", config.branch);
   statusLine("inbox branch", inbox);
   statusLine("conflicts", config.resolve === "lww" ? "last writer wins" : "fork files");
+  if (reviewRequired(config)) printReviewLine(sidecarPath);
 
   if (!checkoutPresent) {
     // The state a fresh clone lands in when nothing cloned for it: say what to
@@ -100,6 +103,36 @@ function printPeerStatus({ root, config, configPath }: Peer): void {
   }
 }
 
+// What holds this checkout's publishing. Machine-local, so it needs no fetch:
+// the review records are the whole story.
+function printReviewLine(sidecarPath: string): void {
+  const review = hasGitMetadata(sidecarPath) ? openReview(sidecarPath) : undefined;
+  const reviewer = readSettings().reviewer;
+  if (!review) {
+    if (reviewer) statusLine("review", `required — nothing waiting (reviewer: ${reviewer})`, "quiet");
+    else statusLine("review", "required — no reviewer configured; reviews wait for `sidecar review approve`", "attn");
+    return;
+  }
+  const attention = reviewAttention(review);
+  const age = formatRelativeTime(review.record.createdAt) ?? review.record.createdAt;
+  const summary = `${review.state} ${review.record.id}, opened ${age}, ${review.record.files.length} file(s)`;
+  statusLine("review", attention ? `${summary} — needs attention: ${attention}` : summary, attention ? "attn" : undefined);
+  if (review.verdict?.reason) console.log(`  ${paint("quiet", review.verdict.reason)}`);
+  console.log(`  ${paint("quiet", `sidecar review show ${review.record.id}`)}`);
+}
+
+function openReviewPayload(sidecarPath: string): Record<string, unknown> | undefined {
+  const review = openReview(sidecarPath);
+  if (!review) return undefined;
+  return {
+    id: review.record.id,
+    state: review.state,
+    attention: reviewAttention(review),
+    createdAt: review.record.createdAt,
+    files: review.record.files.length,
+  };
+}
+
 function statusPayload({ root, name, config, configPath }: Peer): Record<string, unknown> {
   const sidecarPath = resolveSidecarPath(root, config);
   const checkoutPresent = hasGitMetadata(sidecarPath);
@@ -121,6 +154,7 @@ function statusPayload({ root, name, config, configPath }: Peer): Record<string,
     daemon: daemonHealth().text,
     lastSyncAt: readInstances().find((instance) => instance.configPath === configPath)?.lastSyncAt,
     pendingInbox: checkoutPresent ? pendingStatusInboxBranches(sidecarPath, config) : undefined,
+    review: reviewRequired(config) ? { required: true, open: checkoutPresent ? openReviewPayload(sidecarPath) : undefined } : undefined,
   };
 }
 
@@ -131,9 +165,12 @@ function pendingStatusInboxBranches(sidecarPath: string, config: SidecarConfig):
     : branchExists(sidecarPath, config.branch)
       ? config.branch
       : "HEAD";
-  return pendingInboxBranches(sidecarPath, config).filter(
-    (remoteBranch) => !isAncestor(sidecarPath, remoteBranch, base),
-  );
+  // A review-gated checkout's local inbox branches never reach main as such —
+  // only their published commits do — so only the remote's count as pending.
+  const candidates = reviewRequired(config)
+    ? pendingInboxBranches(sidecarPath, config).filter((branch) => branch.startsWith("origin/"))
+    : pendingInboxBranches(sidecarPath, config);
+  return candidates.filter((remoteBranch) => !isAncestor(sidecarPath, remoteBranch, base));
 }
 
 /**
@@ -256,6 +293,8 @@ function healthStatusLine(state: HealthState, record: HealthRecord): { text: str
     const age = formatRelativeTime(record.updatedAt) ?? record.updatedAt;
     return { text: `stale — last reported ${age}`, role: "attn" };
   }
+  if (record.review === "attention") return { text: "ok — publishing held, review needs attention", role: "attn" };
+  if (record.review === "pending") return { text: "ok — publishing held for review", role: "ok" };
   return { text: "ok", role: "ok" };
 }
 
diff --git a/packages/sidecar/src/cmd-sync.ts b/packages/sidecar/src/cmd-sync.ts
index 5eccd94..6c05387 100644
--- a/packages/sidecar/src/cmd-sync.ts
+++ b/packages/sidecar/src/cmd-sync.ts
@@ -9,30 +9,34 @@ import { colorLevel, stripColor } from "./color.js";
 import { SidecarError, getValue, nowIso, parseOptions } from "./util.js";
 import { ensureCommitIdentity, git, gitRaw } from "./git.js";
 import {
+  LOCAL_SYNC_ENV,
   type Peer,
+  SOFT_SYNC_ENV,
   expandInbox,
   loadPeers,
   redactionModeConfigValue,
   requireSidecarCheckout,
   resolveSidecarPath,
+  reviewRequired,
   selectedPeer,
 } from "./config.js";
 import { registerCurrentInstance, withSyncLock } from "./state.js";
 import {
-  LOCAL_SYNC_ENV,
-  SOFT_SYNC_ENV,
+  bindReviewPolicy,
   checkoutIsUnlinkedFromFamily,
   checkoutRedactionPolicy,
   ensureInboxBranch,
   ensureRedactionFilter,
   fileRedactionDelta,
   mergeInboxBranches,
+  mergePublishedInboxes,
   pushBranch,
   redactBuffer,
   reportSyncHealth,
   snapshot,
   syncBranchBeforePush,
   syncProject,
+  type SyncOutcome,
 } from "./sync.js";
 import { DEFAULT_REDACTION_MODE } from "./redaction.js";
 import { readRules, resolveFileRules } from "./rules.js";
@@ -46,6 +50,15 @@ export function cmdSnapshot(args: string[]): number {
   if (parsed.positional.length) throw new SidecarError("usage: sidecar snapshot [--push] [-m message] [--peer name]");
 
   const peers = loadPeers(selectedPeer(parsed));
+  const push = parsed.flags.has("--push");
+  // A gated peer's snapshots are local history; only a review publishes.
+  // Refused before any peer is touched, so the command does all or nothing.
+  const gated = push ? peers.filter((peer) => reviewRequired(peer.config)) : [];
+  if (gated.length) {
+    throw new SidecarError(
+      `${peers.length === 1 ? "this peer requires" : `${gated.map((peer) => peer.name).join(", ")} require`} review before anything is published; snapshot without --push, and \`sidecar sync\` opens or advances the review`,
+    );
+  }
   for (const peer of peers) {
     announcePeer(peer, peers);
     const { root, config } = peer;
@@ -53,6 +66,7 @@ export function cmdSnapshot(args: string[]): number {
     // Snapshotting while a daemon sync is mid-merge would commit on whatever
     // branch the merge has checked out, so take the same lock syncs use.
     withSyncLock(root, peer.name, "throw", () => {
+      bindReviewPolicy(sidecarPath, config);
       const inbox = expandInbox(config, sidecarPath);
       ensureCommitIdentity(sidecarPath);
       ensureRedactionFilter(sidecarPath, config.redaction, config);
@@ -65,7 +79,7 @@ export function cmdSnapshot(args: string[]): number {
         config.redaction,
         config,
       );
-      if (committed && parsed.flags.has("--push")) {
+      if (committed && push) {
         syncBranchBeforePush(sidecarPath, inbox, config);
         pushBranch(sidecarPath, inbox);
       }
@@ -87,11 +101,21 @@ export function cmdSync(args: string[]): number {
   // gets its turn, and the failures are reported together at the end.
   const peers = loadPeers(selectedPeer(parsed), { loadRules: false });
   const failed: string[] = [];
+  const soft = parsed.flags.has("--soft") || process.env[SOFT_SYNC_ENV] === "1";
+  const options: PeerSyncOptions = {
+    // A soft sync is a request, not a demand: the daemon issues them, and one
+    // that loses the lock to a running sync can no-op because the interval or
+    // watcher will simply request again. A manual sync must never pretend.
+    lock: soft ? "skip" : "throw",
+    remote: !parsed.flags.has("--local") && process.env[LOCAL_SYNC_ENV] !== "1",
+    snapshot: !parsed.flags.has("--no-snapshot"),
+    message: getValue(parsed, "--message", getValue(parsed, "-m", "")) || undefined,
+  };
   for (const peer of peers) {
     announcePeer(peer, peers);
     try {
       if (peer.config.rulesPath) peer.config.rules = readRules(peer.config.rulesPath);
-      syncPeer(peer, parsed);
+      syncPeer(peer, options);
     } catch (error) {
       if (peers.length === 1) throw error;
       failed.push(peer.name);
@@ -104,25 +128,30 @@ export function cmdSync(args: string[]): number {
   return 0;
 }
 
-function syncPeer(peer: Peer, parsed: ReturnType<typeof parseOptions>): void {
+export type PeerSyncOptions = {
+  lock: "throw" | "skip" | "wait";
+  // false settles this machine and stops there: no fetch, no push, and
+  // nothing that can fail because a remote is unreachable.
+  remote: boolean;
+  snapshot: boolean;
+  message?: string;
+};
+
+export function syncPeer(peer: Peer, options: PeerSyncOptions): void {
   const { root, config } = peer;
-  // A soft sync is a request, not a demand: the daemon issues them, and one
-  // that loses the lock to a running sync can no-op because the interval or
-  // watcher will simply request again. A manual sync must never pretend.
-  const soft = parsed.flags.has("--soft") || process.env[SOFT_SYNC_ENV] === "1";
-  const remote = !parsed.flags.has("--local") && process.env[LOCAL_SYNC_ENV] !== "1";
+  const { remote } = options;
+  const soft = options.lock === "skip";
   // Which step was in flight when a sync threw, so the heartbeat can say
   // "failed at snapshot" rather than only "failed".
   let stage = "start";
+  let outcome: SyncOutcome = {};
   let synced: boolean;
   try {
-    synced = withSyncLock(root, peer.name, soft ? "skip" : "throw", () => {
-      syncProject(root, config, {
-        snapshot: !parsed.flags.has("--no-snapshot"),
-        // --local settles this machine and stops there: no fetch, no push, and
-        // nothing that can fail because a remote is unreachable.
+    synced = withSyncLock(root, peer.name, options.lock, () => {
+      outcome = syncProject(root, config, {
+        snapshot: options.snapshot,
         remote,
-        message: getValue(parsed, "--message", getValue(parsed, "-m", "")) || undefined,
+        message: options.message,
         onStage: (name) => {
           stage = name;
         },
@@ -137,14 +166,26 @@ function syncPeer(peer: Peer, parsed: ReturnType<typeof parseOptions>): void {
     if (remote) reportSyncHealth(root, config, {
       status: "failed",
       stage,
-      message: error instanceof Error ? error.message : String(error),
+      // Git's diagnostics quote paths, and on a gated peer a path can be
+      // content nobody has reviewed yet. The heartbeat says where it failed;
+      // the details reach only this terminal (see privateFailures).
+      message: reviewRequired(config)
+        ? "details are shown only by a sync run by hand on that machine"
+        : error instanceof Error ? error.message : String(error),
     });
     throw error;
   }
   // A soft sync that lost the lock never attempted anything, so it has nothing
   // to report; the sync holding the lock will report for this checkout.
   if (synced) {
-    if (remote) reportSyncHealth(root, config, { status: "ok" });
+    const held = outcome.held;
+    if (held) {
+      const { id } = held.review.record;
+      console.log(held.attention
+        ? `sidecar: publishing is held — review ${id} needs attention: ${held.attention}; \`sidecar review show ${id}\``
+        : `sidecar: publishing is held for review ${id}; \`sidecar review show ${id}\``);
+    }
+    if (remote) reportSyncHealth(root, config, held ? { status: "ok", review: held.attention ? "attention" : "pending" } : { status: "ok" });
     // Only on a sync someone asked for. The daemon runs the same command on its
     // interval, where a standing note about a working checkout is log noise.
     if (!soft) {
@@ -175,12 +216,18 @@ export function cmdMerge(args: string[]): number {
     withSyncLock(root, peer.name, "throw", () => {
       // Filter wiring mutates the shared Git config too, so keep it under
       // the same lock as the merge and its temporary worktree cleanup.
+      bindReviewPolicy(sidecarPath, config);
       ensureRedactionFilter(sidecarPath, config.redaction, config);
-      mergeInboxBranches(sidecarPath, config, {
-        forkFiles: parsed.flags.has("--fork-files"),
-        push: !parsed.flags.has("--no-push"),
-        remote: true,
-      });
+      const forkFiles = parsed.flags.has("--fork-files");
+      const push = !parsed.flags.has("--no-push");
+      // A gated peer's local main holds unpublished merges, so the pushed main
+      // is built from published inboxes alone, and local main rebuilt on it.
+      if (reviewRequired(config) && push) {
+        mergePublishedInboxes(sidecarPath, config, { forkFiles });
+        mergeInboxBranches(sidecarPath, config, { forkFiles, push: false, remote: false });
+        return;
+      }
+      mergeInboxBranches(sidecarPath, config, { forkFiles, push, remote: true });
     });
   }
   return 0;
diff --git a/packages/sidecar/src/commands.ts b/packages/sidecar/src/commands.ts
index 4234a30..67f9b0f 100644
--- a/packages/sidecar/src/commands.ts
+++ b/packages/sidecar/src/commands.ts
@@ -10,6 +10,7 @@ import { cmdRefresh } from "./cmd-refresh.js";
 import { cmdHealth, cmdInstances, cmdStatus, cmdTail } from "./cmd-status.js";
 import { cmdDaemon, cmdRegisterInstall, cmdSetInstallSource, cmdUpdate } from "./cmd-daemon.js";
 import { cmdMerge, cmdRedact, cmdRedactions, cmdSnapshot, cmdSync } from "./cmd-sync.js";
+import { cmdReview } from "./cmd-review.js";
 
 type CommandSection = "common" | "sync" | "advanced";
 
@@ -31,7 +32,7 @@ const COMMANDS: Command[] = [
     run: cmdInit,
     section: "common",
     usage:
-      "init [remote] [--peer name] [--path sidecar|.] [--branch main] [--inbox template] [--redaction none|secrets|secrets+pii] [--resolve fork|lww] [--debounce 10m] [--interval 1h] [--ignored] [--local-install]",
+      "init [remote] [--peer name] [--path sidecar|.] [--branch main] [--inbox template] [--redaction none|secrets|secrets+pii] [--resolve fork|lww] [--review off|required] [--review-timeout 1h] [--debounce 10m] [--interval 1h] [--ignored] [--local-install]",
     notes: [
       "--path . makes this repo itself the sidecar (standalone)",
       "--peer name adds a second sidecar as .sidecar.name; --ignored keeps it out of the tree",
@@ -53,6 +54,16 @@ const COMMANDS: Command[] = [
     usage: "redactions [--peer name]",
     summary: "preview what redaction rewrites before content is pushed",
   },
+  {
+    name: "review",
+    run: cmdReview,
+    section: "common",
+    usage: "review [show|approve|reject|retry] [id] [--reason text] [--no-sync] [--json] [--peer name]",
+    notes: [
+      "the reviews that gate a peer with review = \"required\"; approve publishes at once",
+      "review reviewer [<command>|--unset] sets who reviews on this machine",
+    ],
+  },
   {
     name: "sync",
     run: cmdSync,
diff --git a/packages/sidecar/src/config.ts b/packages/sidecar/src/config.ts
index 2245669..837da91 100644
--- a/packages/sidecar/src/config.ts
+++ b/packages/sidecar/src/config.ts
@@ -35,6 +35,14 @@ const branchValidity = new Map<string, boolean>();
 export const DEFAULT_PEER = "default";
 /** How the daemon names the peer a spawned sync is for; commands read it as `--peer`. */
 export const PEER_ENV = "SIDECAR_PEER";
+// An env var rather than a flag so the daemon can request soft syncs from
+// older pinned project-local CLIs, which ignore it instead of rejecting an
+// unknown option.
+export const SOFT_SYNC_ENV = "SIDECAR_SYNC_SOFT";
+// Likewise a variable rather than a flag: the daemon settles this machine far
+// more often than it talks to the remote, and a pinned older CLI has to be able
+// to ignore the request instead of rejecting an option it never heard of.
+export const LOCAL_SYNC_ENV = "SIDECAR_SYNC_LOCAL";
 const PEER_NAME = /^[a-z0-9][a-z0-9-]*$/;
 // Suffixes an editor or a cautious hand puts on a copy of `.sidecar`. A swap
 // file or a backup must never be read as a peer, so these names are refused at
@@ -166,6 +174,26 @@ export const RESOLVE_MODES = ["fork", "lww"] as const;
 export type ResolveMode = (typeof RESOLVE_MODES)[number];
 export const DEFAULT_RESOLVE: ResolveMode = "fork";
 
+/**
+ * `required` holds everything this peer would publish until a review approves
+ * it; see review.ts. The policy is committed with the config, while the
+ * command that performs a review is machine-local: a committed command would
+ * be one a cloned repo could make every machine's daemon run.
+ */
+export const REVIEW_MODES = ["off", "required"] as const;
+export type ReviewMode = (typeof REVIEW_MODES)[number];
+const DEFAULT_REVIEW_TIMEOUT_SECONDS = 60 * 60;
+
+/** The only .sidecar format this version reads. */
+const CONFIG_VERSION = 1;
+// Every key the config may carry. Anything else is refused rather than
+// ignored: a policy key this version does not understand — review is the
+// first — would otherwise be silently dropped, and a sync that drops a
+// publishing gate fails open.
+const CONFIG_KEYS = new Set([
+  "version", "remote", "path", "branch", "inbox", "redaction", "resolve", "debounce", "interval", "review", "review-timeout",
+]);
+
 export type SidecarConfig = {
   /** Which peer this is — derived from the file name, never written into it. */
   peer: string;
@@ -187,8 +215,45 @@ export type SidecarConfig = {
    */
   debounce?: number;
   interval?: number;
+  /** Absent means off. */
+  review?: ReviewMode;
+  /** Seconds a review may stay undecided before it needs attention. */
+  reviewTimeout?: number;
 };
 
+export function reviewRequired(config: SidecarConfig): boolean {
+  return config.review === "required";
+}
+
+let failuresArePrivate = false;
+
+/**
+ * Whether this process has touched a peer that requires review — or one whose
+ * policy it could not tell. Its failures then stay out of the event log (see
+ * cli.ts): git's messages quote paths, a gated peer's paths can be content
+ * nobody has reviewed, and the log is something people paste into bug
+ * reports. Every command reaches a peer through readConfig, a config it is
+ * about to write (notePeerPolicy), or a review packet (readReview), and each
+ * marks the process before anything else can fail.
+ */
+export function privateFailures(): boolean {
+  return failuresArePrivate;
+}
+
+/** Marks this process's failures private: it holds, or may hold, unreviewed content. */
+export function keepFailuresPrivate(): void {
+  failuresArePrivate = true;
+}
+
+/** Marks this process's failures private when `config` requires review. */
+export function notePeerPolicy(config: SidecarConfig): void {
+  if (reviewRequired(config)) keepFailuresPrivate();
+}
+
+export function reviewTimeoutSeconds(config: SidecarConfig): number {
+  return config.reviewTimeout ?? DEFAULT_REVIEW_TIMEOUT_SECONDS;
+}
+
 export function findConfigRoot(start: string): string {
   const root = findConfigRootOptional(start);
   if (root) return root;
@@ -207,7 +272,13 @@ export function findConfigRootOptional(start: string): string | undefined {
 }
 
 export function writeConfig(configPath: string, config: SidecarConfig): void {
-  const text = [
+  notePeerPolicy(config);
+  fs.writeFileSync(configPath, configText(config), "utf8");
+}
+
+/** A config as its file holds it: what two configs must share to be the same. */
+export function configText(config: SidecarConfig): string {
+  return [
     `version = ${config.version}`,
     `remote = ${JSON.stringify(config.remote)}`,
     `path = ${JSON.stringify(config.path)}`,
@@ -217,9 +288,10 @@ export function writeConfig(configPath: string, config: SidecarConfig): void {
     `resolve = ${JSON.stringify(config.resolve ?? DEFAULT_RESOLVE)}`,
     ...(config.debounce === undefined ? [] : [`debounce = ${config.debounce}`]),
     ...(config.interval === undefined ? [] : [`interval = ${config.interval}`]),
+    ...(reviewRequired(config) ? [`review = "required"`] : []),
+    ...(config.reviewTimeout === undefined ? [] : [`review-timeout = ${config.reviewTimeout}`]),
     "",
   ].join("\n");
-  fs.writeFileSync(configPath, text, "utf8");
 }
 
 export function readConfig(configPath: string, options: { loadRules?: boolean } = {}): SidecarConfig {
@@ -231,9 +303,27 @@ export function readConfig(configPath: string, options: { loadRules?: boolean }
     }
     values = parsed as Record<string, unknown>;
   } catch (error) {
+    // A config that exists but cannot be read may be a gated peer's.
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") keepFailuresPrivate();
     if (error instanceof SidecarError) throw error;
     throw new SidecarError(`${configPath} is not valid TOML: ${error instanceof Error ? error.message : String(error)}`);
   }
+  // Before anything else is validated or loaded: anything but a plain "off"
+  // may be a gated peer, so its failures are private from here on.
+  if (values.review !== undefined && values.review !== "off") keepFailuresPrivate();
+
+  const unknown = Object.keys(values).filter((key) => !CONFIG_KEYS.has(key));
+  if (unknown.length) {
+    throw new SidecarError(
+      `${configPath}: unknown key${unknown.length > 1 ? "s" : ""} ${unknown.map((key) => JSON.stringify(key)).join(", ")}; this sidecar may be older than the config — update it with \`sidecar update\``,
+    );
+  }
+  const version = numberConfigValue(configPath, values, "version", CONFIG_VERSION);
+  if (version !== CONFIG_VERSION) {
+    throw new SidecarError(
+      `${configPath}: config version ${version} is not supported by this sidecar (expected ${CONFIG_VERSION}); update it with \`sidecar update\``,
+    );
+  }
 
   const remote = optionalStringConfigValue(configPath, values, "remote");
   if (!remote) throw new SidecarError(`${configPath} is missing remote`);
@@ -243,7 +333,7 @@ export function readConfig(configPath: string, options: { loadRules?: boolean }
   const config = {
     peer,
     remote,
-    version: numberConfigValue(configPath, values, "version", 1),
+    version,
     path: stringConfigValue(configPath, values, "path", DEFAULT_PATH),
     branch: stringConfigValue(configPath, values, "branch", DEFAULT_BRANCH),
     inbox: stringConfigValue(configPath, values, "inbox", DEFAULT_INBOX),
@@ -254,6 +344,8 @@ export function readConfig(configPath: string, options: { loadRules?: boolean }
     resolve: resolveModeConfigValue(stringConfigValue(configPath, values, "resolve", DEFAULT_RESOLVE), configPath),
     debounce: durationConfigValue(values.debounce, `${configPath} debounce`),
     interval: durationConfigValue(values.interval, `${configPath} interval`),
+    review: reviewModeConfigValue(stringConfigValue(configPath, values, "review", "off"), configPath),
+    reviewTimeout: durationConfigValue(values["review-timeout"], `${configPath} review-timeout`),
     rules: options.loadRules === false ? undefined : readRules(rulesPath),
     rulesPath,
   };
@@ -274,6 +366,13 @@ export function redactionModeConfigValue(value: string, source: string): Redacti
   );
 }
 
+export function reviewModeConfigValue(value: string, source: string): ReviewMode {
+  if ((REVIEW_MODES as readonly string[]).includes(value)) return value as ReviewMode;
+  throw new SidecarError(
+    `${source}: invalid review mode ${JSON.stringify(value)}; expected one of ${REVIEW_MODES.join(", ")}`,
+  );
+}
+
 export function durationConfigValue(value: unknown, source: string): number | undefined {
   if (value === undefined) return undefined;
   const seconds = parseDuration(value);
@@ -442,7 +541,15 @@ export function inboxPrefix(config: SidecarConfig): string {
   return inboxBranchPrefix(config.inbox);
 }
 
+/**
+ * Where a review-gated peer keeps the remote's branches as sidecar last
+ * fetched them; see the review-gated section of sync.ts.
+ */
+export const PUBLIC_REFS = "refs/sidecar-public/";
+
+/** A branch's own name from its remote-tracking or public ref. */
 export function remoteBranchName(remoteBranch: string): string {
+  if (remoteBranch.startsWith(PUBLIC_REFS)) return remoteBranch.slice(PUBLIC_REFS.length);
   return remoteBranch.startsWith("origin/") ? remoteBranch.slice("origin/".length) : remoteBranch;
 }
 
diff --git a/packages/sidecar/src/daemon.ts b/packages/sidecar/src/daemon.ts
index b293023..7635f13 100644
--- a/packages/sidecar/src/daemon.ts
+++ b/packages/sidecar/src/daemon.ts
@@ -27,6 +27,7 @@ import {
   readConfig,
   readInstances,
   readSettings,
+  reviewRequired,
   sidecarStateDir,
   startDetachedDaemon,
   unregisterInstance,
@@ -56,6 +57,19 @@ export type DaemonOptions = {
   debounceSeconds: number;
 };
 
+/**
+ * Whether a peer's sync output and watcher errors must stay out of the
+ * daemon's log: a gated peer's can name files nobody has reviewed. A config that cannot be read
+ * counts as gated, so the answer fails closed.
+ */
+function outputIsPrivate(key: PeerKey): boolean {
+  try {
+    return reviewRequired(readConfig(key, { loadRules: false }));
+  } catch {
+    return true;
+  }
+}
+
 /**
  * Everything the daemon tracks is keyed by the peer's config path, not the
  * repo root: a repo with several peers is several sidecars, each with its own
@@ -346,7 +360,9 @@ async function syncInstance(
         command: "daemon",
         ...peerFields(key),
         trigger,
-        message: result.timedOut ? "sync timed out" : result.output.trim().slice(-500) || `sync exited ${result.status}`,
+        message: result.timedOut
+          ? "sync timed out"
+          : (!outputIsPrivate(key) && result.output.trim().slice(-500)) || `sync exited ${result.status}`,
       });
     }
   } finally {
@@ -466,7 +482,8 @@ export async function refreshWatchers(state: DaemonState): Promise<void> {
           logSidecarEvent("failure", {
             command: "daemon",
             ...peerFields(key),
-            message: `watcher error: ${error instanceof Error ? error.message : String(error)}`,
+            // A filesystem error names the file, and on a gated peer that can be unreviewed content.
+            message: outputIsPrivate(key) ? "watcher error" : `watcher error: ${error instanceof Error ? error.message : String(error)}`,
           });
         });
         state.watchers.set(key, watcher);
@@ -474,7 +491,9 @@ export async function refreshWatchers(state: DaemonState): Promise<void> {
         logSidecarEvent("failure", {
           command: "daemon",
           ...peerFields(key),
-          message: `could not watch ${sidecarPath}: ${error instanceof Error ? error.message : String(error)}`,
+          message: outputIsPrivate(key)
+            ? `could not watch ${sidecarPath}`
+            : `could not watch ${sidecarPath}: ${error instanceof Error ? error.message : String(error)}`,
         });
       }
     }
diff --git a/packages/sidecar/src/git.ts b/packages/sidecar/src/git.ts
index 1f7b211..12d6517 100644
--- a/packages/sidecar/src/git.ts
+++ b/packages/sidecar/src/git.ts
@@ -86,6 +86,15 @@ export function isAncestor(repo: string, maybeAncestor: string, descendant: stri
   return git(repo, ["merge-base", "--is-ancestor", maybeAncestor, descendant], { check: false }).status === 0;
 }
 
+export function treeOf(repo: string, ref: string): string {
+  return git(repo, ["rev-parse", `${ref}^{tree}`]).stdout.trim();
+}
+
+/** The empty tree, written to the object store so plumbing can name it. */
+export function emptyTree(repo: string): string {
+  return git(repo, ["mktree"], { input: "" }).stdout.trim();
+}
+
 export function gitToplevel(cwd: string): string {
   const root = gitToplevelOptional(cwd);
   if (!root) throw new SidecarError("not inside a Git repository");
@@ -148,12 +157,18 @@ export function ensureClean(repo: string): void {
   if (isDirty(repo)) throw new SidecarError("sidecar checkout has uncommitted changes");
 }
 
+/** The identity sidecar commits as when nothing else is configured. */
+export function sidecarIdentity(): { name: string; email: string } {
+  return { name: currentUser(), email: `${slug(currentUser())}@${slug(currentHost())}.local` };
+}
+
 export function ensureCommitIdentity(repo: string): void {
+  const { name, email } = sidecarIdentity();
   if (git(repo, ["config", "user.name"], { check: false }).status !== 0) {
-    git(repo, ["config", "user.name", currentUser()]);
+    git(repo, ["config", "user.name", name]);
   }
   if (git(repo, ["config", "user.email"], { check: false }).status !== 0) {
-    git(repo, ["config", "user.email", `${slug(currentUser())}@${slug(currentHost())}.local`]);
+    git(repo, ["config", "user.email", email]);
   }
 }
 
diff --git a/packages/sidecar/src/health.ts b/packages/sidecar/src/health.ts
index 678aeb3..4f38259 100644
--- a/packages/sidecar/src/health.ts
+++ b/packages/sidecar/src/health.ts
@@ -52,9 +52,17 @@ const MESSAGE_LIMIT = 500;
 
 export type HealthStatus = "ok" | "failed";
 
+/**
+ * A review-gated checkout whose unpublished work is held: `pending` while a
+ * review is in progress, `attention` once it needs a person. Only the state
+ * is published — never a reviewer's reason, which describes what was
+ * sensitive.
+ */
+export type HealthReview = "pending" | "attention";
+
 /** What a sync attempt turned out to be, before it becomes a record. */
 export type HealthOutcome =
-  | { status: "ok" }
+  | { status: "ok"; review?: HealthReview }
   | { status: "failed"; stage: string; message: string };
 
 /** Who is reporting — the parts of a record that don't depend on the outcome. */
@@ -82,6 +90,8 @@ export type HealthRecord = HealthIdentity & {
   /** Which step of the sync threw; only present on a failing record. */
   stage?: string;
   message?: string;
+  /** Present while a review holds this checkout's publishing. */
+  review?: HealthReview;
 };
 
 /** How the fleet view reads a record — `stale` is derived, never stored. */
@@ -143,6 +153,7 @@ export function parseHealthRecord(text: string): HealthRecord | undefined {
         : 0,
     stage: typeof record.stage === "string" ? record.stage : undefined,
     message: typeof record.message === "string" ? record.message : undefined,
+    review: record.review === "pending" || record.review === "attention" ? record.review : undefined,
   };
 }
 
@@ -164,20 +175,23 @@ export function nextHealthRecord(
   outcome: HealthOutcome,
   now: string,
 ): HealthRecord {
+  // Only what parses as a timestamp carries forward. The previous record is
+  // read back from a ref, and a heartbeat is published for every peer before
+  // any review: nothing but sidecar's own values may ride along.
   const base: HealthRecord = {
     schema: HEALTH_SCHEMA,
     ...identity,
     status: outcome.status,
     updatedAt: now,
-    lastSuccessAt: previous?.lastSuccessAt,
-    lastFailureAt: previous?.lastFailureAt,
+    lastSuccessAt: isoTimestamp(previous?.lastSuccessAt),
+    lastFailureAt: isoTimestamp(previous?.lastFailureAt),
     consecutiveFailures: 0,
   };
-  if (outcome.status === "ok") return { ...base, lastSuccessAt: now };
+  if (outcome.status === "ok") return { ...base, lastSuccessAt: now, ...(outcome.review ? { review: outcome.review } : {}) };
   return {
     ...base,
     lastFailureAt: now,
-    consecutiveFailures: (previous?.consecutiveFailures ?? 0) + 1,
+    consecutiveFailures: Math.max(0, Math.floor(previous?.consecutiveFailures ?? 0)) + 1,
     stage: outcome.stage,
     // The message is a git failure verbatim, and git quotes remote URLs — which
     // carry tokens. Redacting here rather than at the call site means the
@@ -187,6 +201,10 @@ export function nextHealthRecord(
   };
 }
 
+function isoTimestamp(value: string | undefined): string | undefined {
+  return value && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/.test(value) ? value : undefined;
+}
+
 /**
  * Whether `next` is worth a push. Failures and transitions always are —
  * everything else is the same "still fine" the branch already holds, and only
@@ -198,7 +216,7 @@ export function shouldPublishHealth(
   now = Date.now(),
 ): boolean {
   if (!previous) return true;
-  if (next.status === "failed" || previous.status !== next.status) return true;
+  if (next.status === "failed" || previous.status !== next.status || previous.review !== next.review) return true;
   const last = Date.parse(previous.updatedAt);
   if (!Number.isFinite(last)) return true;
   // A clock behind the branch's own timestamp would otherwise defer forever.
diff --git a/packages/sidecar/src/install.ts b/packages/sidecar/src/install.ts
index 52f33bd..88b7619 100644
--- a/packages/sidecar/src/install.ts
+++ b/packages/sidecar/src/install.ts
@@ -18,6 +18,17 @@ export type InstallSource = "npm" | "bun" | "curl";
 
 export const INSTALL_SOURCES = new Set<InstallSource>(["npm", "bun", "curl"]);
 
+/**
+ * The built CLI bundle this process runs from, for anything that has to start
+ * this exact install outside the current process: git's clean filter, the
+ * background review runner. Run from TypeScript sources (tests), that is the
+ * sibling dist build.
+ */
+export function sidecarCliPath(): string {
+  const self = fileURLToPath(import.meta.url);
+  return self.endsWith(".ts") ? path.join(path.dirname(self), "..", "dist", "cli.js") : self;
+}
+
 export function packageVersion(): string {
   let current = path.dirname(fileURLToPath(import.meta.url));
   while (true) {
diff --git a/packages/sidecar/src/review.ts b/packages/sidecar/src/review.ts
new file mode 100644
index 0000000..d336d5d
--- /dev/null
+++ b/packages/sidecar/src/review.ts
@@ -0,0 +1,583 @@
+// The review gate: what a review-gated peer may publish, and who said so.
+//
+// A peer with `review = "required"` never pushes its own history. The engine
+// (sync.ts) publishes one commit per approved review, whose tree is exactly
+// the tree the reviewer saw. This module owns the reviews themselves: their
+// records, the packet a reviewer reads, the background runner around the
+// configured reviewer command, and the state a review is in.
+//
+// Everything here is machine-local. A packet holds a diff of content that has
+// not been cleared to leave this machine, so it lives in the state dir, owner
+// readable only, and nothing about it reaches the remote except the commit an
+// approval publishes.
+//
+// A review's files each have one writer. The sync and the decision commands
+// write under the peer's sync lock, so a verdict can never change while a sync
+// is acting on it. A review launches its reviewer at most once; a retry opens
+// a new review, so a reviewer that outlives its review can only ever decide
+// one that is closed:
+//   review.json   the sync: opened, launched, publishing, published, superseded
+//   verdict.json  `sidecar review approve|reject`
+//   run.json      the runner, around the reviewer command
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+
+import { SidecarError, nowIso, realpathOr } from "./util.js";
+import { git, gitBytes, gitCommonDir, treeOf } from "./git.js";
+import { GLOBAL_EXEC_ENV, SKIP_LOCAL_EXEC_ENV, sidecarCliPath } from "./install.js";
+import {
+  DEFAULT_PEER,
+  LOCAL_SYNC_ENV,
+  PEER_ENV,
+  SOFT_SYNC_ENV,
+  type SidecarConfig,
+  keepFailuresPrivate,
+  peerConfigPath,
+  reviewTimeoutSeconds,
+} from "./config.js";
+import { logSidecarEvent, readSettings, sidecarStateDir } from "./state.js";
+import { redactText } from "./redaction.js";
+
+const REVIEW_SCHEMA = 1;
+/** Closed reviews kept per family, newest first; older packets are deleted. */
+const KEEP_CLOSED_REVIEWS = 10;
+/** Review ids: generated hex, so never a path outside the reviews dir. */
+const ID_PATTERN = /^[0-9a-f]+$/;
+/** How long a launched runner has to record itself before the review counts as failed. */
+const LAUNCH_GRACE_SECONDS = 60;
+
+function newId(): string {
+  return crypto.randomBytes(4).toString("hex");
+}
+
+/**
+ * One changed path. `artifact` names the packet file holding its complete
+ * published content when the diff cannot show it (see writeOpaqueArtifacts),
+ * so nothing publishes unseen.
+ */
+export type ReviewFile = { status: string; path: string; artifact?: string };
+
+export type ReviewRecord = {
+  schema: number;
+  id: string;
+  /**
+   * The repo family's shared git dir. Sibling checkouts share one clone and
+   * one local main, so they share one review: see the review-gated section of
+   * sync.ts.
+   */
+  family: string;
+  root: string;
+  peer: string;
+  /**
+   * The public commit the diff is measured from — the newest remote main
+   * commit the reviewed head contains. Always present: a gated peer's local
+   * main is joined to the remote's main before anything is reviewed.
+   */
+  base: string;
+  /** Local main when the review opened. */
+  head: string;
+  /** The tree an approval publishes: the head's, pinned at review time. */
+  tree: string;
+  files: ReviewFile[];
+  createdAt: string;
+  timeoutSeconds: number;
+  /** When the sync started this review's one runner. */
+  launchedAt?: string;
+  /**
+   * The commit this review publishes and where, recorded before the push so a
+   * sync that dies mid-publish — or a sibling resuming after it — pushes that
+   * same commit rather than cutting a second one.
+   */
+  publishing?: { inbox: string; commit: string };
+  publishedAt?: string;
+  publishedCommit?: string;
+  supersededAt?: string;
+};
+
+export type ReviewVerdict = { verdict: "approved" | "rejected"; reason?: string; decidedAt: string };
+
+type ReviewRun = {
+  pid: number;
+  command: string;
+  startedAt: string;
+  finishedAt?: string;
+  exitCode?: number | null;
+  signal?: string | null;
+};
+
+export type ReviewState = "pending" | "approved" | "rejected" | "failed" | "published" | "superseded";
+
+export type Review = {
+  record: ReviewRecord;
+  verdict?: ReviewVerdict;
+  run?: ReviewRun;
+  state: ReviewState;
+  dir: string;
+};
+
+// ---------------------------------------------------------------------------
+// Records
+// ---------------------------------------------------------------------------
+
+function reviewsDir(): string {
+  return path.join(sidecarStateDir(), "reviews");
+}
+
+function reviewDir(id: string): string {
+  return path.join(reviewsDir(), id);
+}
+
+function writePrivateFile(filePath: string, text: string): void {
+  const temporary = `${filePath}.${crypto.randomUUID()}.tmp`;
+  try {
+    fs.writeFileSync(temporary, text, { encoding: "utf8", mode: 0o600 });
+    fs.renameSync(temporary, filePath);
+  } finally {
+    fs.rmSync(temporary, { force: true });
+  }
+}
+
+function writePrivateJson(filePath: string, value: unknown): void {
+  writePrivateFile(filePath, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function readJson<T>(filePath: string): T | undefined {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8")) as T;
+  } catch {
+    return undefined;
+  }
+}
+
+export function readReview(id: string): Review | undefined {
+  // A packet holds unreviewed content, so any failure near one is private.
+  keepFailuresPrivate();
+  if (!ID_PATTERN.test(id)) return undefined;
+  const dir = reviewDir(id);
+  const record = readJson<ReviewRecord>(path.join(dir, "review.json"));
+  if (!record || record.id !== id) return undefined;
+  const verdict = readJson<ReviewVerdict>(path.join(dir, "verdict.json"));
+  const run = readJson<ReviewRun>(runPath(dir));
+  return { record, verdict, run, state: reviewState(record, verdict, run), dir };
+}
+
+function runPath(dir: string): string {
+  return path.join(dir, "run.json");
+}
+
+/** The key a checkout's reviews are filed under: its family's shared git dir. */
+function reviewFamily(sidecarPath: string): string {
+  return realpathOr(gitCommonDir(sidecarPath));
+}
+
+/** Every review on this machine, newest first, optionally for one checkout's family. */
+export function listReviews(sidecarPath?: string): Review[] {
+  let ids: string[];
+  try {
+    ids = fs.readdirSync(reviewsDir());
+  } catch {
+    return [];
+  }
+  const family = sidecarPath === undefined ? undefined : reviewFamily(sidecarPath);
+  return ids
+    .map(readReview)
+    .filter((review): review is Review => review !== undefined)
+    .filter((review) => family === undefined || review.record.family === family)
+    .sort((left, right) => right.record.createdAt.localeCompare(left.record.createdAt) || right.record.id.localeCompare(left.record.id));
+}
+
+/** A review found by its id or an unambiguous prefix of it. */
+export function findReview(idOrPrefix: string): Review {
+  const exact = readReview(idOrPrefix);
+  if (exact) return exact;
+  const matches = listReviews().filter((review) => review.record.id.startsWith(idOrPrefix));
+  if (matches.length === 1) return matches[0];
+  if (matches.length > 1) throw new SidecarError(`review id ${JSON.stringify(idOrPrefix)} is ambiguous; use more of it`);
+  throw new SidecarError(`no review ${JSON.stringify(idOrPrefix)} on this machine`);
+}
+
+export function isOpen(review: Review): boolean {
+  return review.state !== "published" && review.state !== "superseded";
+}
+
+function assertOpen(review: Review): void {
+  if (!isOpen(review)) throw new SidecarError(`review ${review.record.id} is already ${review.state}`);
+}
+
+/** The one review a checkout's family may have open at a time. */
+export function openReview(sidecarPath: string): Review | undefined {
+  return listReviews(sidecarPath).find(isOpen);
+}
+
+function reviewState(record: ReviewRecord, verdict?: ReviewVerdict, run?: ReviewRun): ReviewState {
+  if (record.publishedAt) return "published";
+  if (record.supersededAt) return "superseded";
+  if (verdict) return verdict.verdict;
+  if (run?.finishedAt && run.exitCode !== 0) return "failed";
+  // A runner that died without finishing never recorded an exit; it is as
+  // failed as one that exited nonzero. So is one that never started: the
+  // review launches only once, so nothing else will.
+  if (run && !run.finishedAt && !pidAlive(run.pid)) return "failed";
+  if (!run && record.launchedAt && (Date.now() - Date.parse(record.launchedAt)) / 1000 > LAUNCH_GRACE_SECONDS) return "failed";
+  return "pending";
+}
+
+function pidAlive(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "EPERM";
+  }
+}
+
+/**
+ * Why a review is waiting on a person rather than on its reviewer, or
+ * undefined while it is simply in progress. A rejection, a reviewer that
+ * failed, no reviewer at all, and a review open past its timeout all hold the
+ * peer's publishing the same way; this is what makes them visible.
+ */
+export function reviewAttention(review: Review, now = Date.now()): string | undefined {
+  if (review.state === "rejected") return "rejected";
+  if (review.state === "failed") {
+    const run = review.run;
+    if (!run) return "reviewer never started";
+    if (run.finishedAt) {
+      return run.signal ? `reviewer stopped by ${run.signal} without a verdict` : `reviewer exited ${run.exitCode} without a verdict`;
+    }
+    return "reviewer stopped without a verdict";
+  }
+  if (review.state !== "pending") return undefined;
+  if (!review.record.launchedAt && !readSettings().reviewer) return "no reviewer is configured on this machine";
+  const age = (now - Date.parse(review.record.createdAt)) / 1000;
+  if (age > review.record.timeoutSeconds) return `undecided for over ${formatDuration(review.record.timeoutSeconds)}`;
+  return undefined;
+}
+
+function formatDuration(seconds: number): string {
+  if (seconds >= 3600 && seconds % 3600 === 0) return `${seconds / 3600}h`;
+  if (seconds >= 60 && seconds % 60 === 0) return `${seconds / 60}m`;
+  return `${Math.round(seconds)}s`;
+}
+
+// ---------------------------------------------------------------------------
+// Opening a review
+// ---------------------------------------------------------------------------
+
+/** The committed guidance for a peer's reviewer, beside its config like the rules file. */
+export function peerReviewGuidelinesFileName(name: string): string {
+  return name === DEFAULT_PEER ? ".sidecar-review" : `.sidecar-review.${name}`;
+}
+
+export function peerReviewGuidelinesPath(root: string, name: string): string {
+  return path.join(root, peerReviewGuidelinesFileName(name));
+}
+
+function readGuidelines(root: string, peer: string): string | undefined {
+  try {
+    const text = fs.readFileSync(peerReviewGuidelinesPath(root, peer), "utf8").trim();
+    return text || undefined;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    // Guidance the reviewer was meant to apply and cannot read is not the
+    // same as no guidance; fail the sync rather than review without it.
+    throw new SidecarError(
+      `could not read ${peerReviewGuidelinesPath(root, peer)}: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+}
+
+// What the packet enumerates is what an approval publishes, so it comes from
+// plumbing and spells out every option porcelain would take from config: a
+// `diff.ignoreSubmodules` or a rename heuristic must never hide a changed path.
+const PACKET_DIFF_OPTIONS = ["-r", "--no-renames", "--ignore-submodules=none"];
+
+/**
+ * Writes the record and packet for a review of `base..head`. The packet is
+ * what a reviewer reads: the diff exactly as it would be published (committed
+ * blobs, so already redacted), the changed paths, the repo's guidelines, and
+ * instructions that say how to decide.
+ */
+export function createReview(options: { root: string; config: SidecarConfig; sidecarPath: string; base: string; head: string }): Review {
+  const { root, config, sidecarPath, base, head } = options;
+  const guidelines = readGuidelines(root, config.peer);
+  const id = newId();
+  const dir = reviewDir(id);
+  fs.mkdirSync(reviewsDir(), { recursive: true, mode: 0o700 });
+  fs.mkdirSync(dir, { mode: 0o700 });
+
+  const fields = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--name-status", "-z", base, head]).stdout.split("\0").filter(Boolean);
+  const files: ReviewFile[] = [];
+  for (let index = 0; index + 1 < fields.length; index += 2) files.push({ status: fields[index], path: fields[index + 1] });
+  writeOpaqueArtifacts(sidecarPath, dir, base, head, files);
+  const diff = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "-p", "--no-color", "--no-ext-diff", "--no-textconv", base, head]).stdout;
+
+  const record: ReviewRecord = {
+    schema: REVIEW_SCHEMA,
+    id,
+    family: reviewFamily(sidecarPath),
+    root,
+    peer: config.peer,
+    base,
+    head,
+    tree: treeOf(sidecarPath, head),
+    files,
+    createdAt: nowIso(),
+    timeoutSeconds: reviewTimeoutSeconds(config),
+  };
+  writePrivateFile(path.join(dir, "diff.patch"), diff);
+  if (guidelines) writePrivateFile(path.join(dir, "guidelines.md"), `${guidelines}\n`);
+  writePrivateFile(path.join(dir, "instructions.md"), reviewInstructions(record, config, guidelines));
+  // The record last: a directory without one is not yet a review, so a crash
+  // mid-packet leaves nothing a sync would wait on.
+  writePrivateJson(path.join(dir, "review.json"), record);
+  logSidecarEvent("review-open", { id, root, peer: config.peer, files: files.length });
+  pruneClosedReviews(sidecarPath);
+  return { record, state: "pending", dir };
+}
+
+/**
+ * Git shows a binary — or a file whose attributes say `-diff` — as "Binary
+ * files differ", and text that is not UTF-8 reaches the packet garbled, so
+ * the diff alone would let either publish unseen. Each such file's complete
+ * new content goes into the packet instead, as the committed blob: exactly
+ * the bytes an approval publishes. Sets `artifact` on those files.
+ */
+function writeOpaqueArtifacts(repo: string, dir: string, from: string, head: string, files: ReviewFile[]): void {
+  const binary = new Set(
+    git(repo, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--numstat", "-z", from, head])
+      .stdout.split("\0")
+      .filter((entry) => entry.startsWith("-\t-\t"))
+      .map((entry) => entry.slice("-\t-\t".length)),
+  );
+  // Entry types from the tree itself: a gitlink names a commit in another
+  // repository, which this one need not hold, and the patch already shows it.
+  const blobs = new Set(
+    git(repo, ["ls-tree", "-r", "-z", "--full-tree", head])
+      .stdout.split("\0")
+      .filter((entry) => entry.split(" ")[1] === "blob")
+      .map((entry) => entry.slice(entry.indexOf("\t") + 1)),
+  );
+  const utf8 = new TextDecoder("utf-8", { fatal: true });
+  const isText = (blob: Buffer): boolean => {
+    try {
+      utf8.decode(blob);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  let count = 0;
+  for (const file of files) {
+    if (file.status === "D" || !blobs.has(file.path)) continue;
+    const blob = gitBytes(repo, ["cat-file", "blob", `${head}:${file.path}`]).stdout;
+    if (!binary.has(file.path) && isText(blob)) continue;
+    count += 1;
+    file.artifact = path.join("opaque", String(count).padStart(4, "0"));
+    fs.mkdirSync(path.join(dir, "opaque"), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(dir, file.artifact), blob, { mode: 0o600 });
+  }
+}
+
+function updateRecord(review: Review, change: Partial<ReviewRecord>): void {
+  const record = { ...review.record, ...change };
+  writePrivateJson(path.join(review.dir, "review.json"), record);
+  review.record = record;
+}
+
+export function markPublishing(review: Review, inbox: string, commit: string): void {
+  updateRecord(review, { publishing: { inbox, commit } });
+}
+
+export function markPublished(review: Review, commit: string): void {
+  updateRecord(review, { publishedAt: nowIso(), publishedCommit: commit });
+  logSidecarEvent("review-published", { id: review.record.id, commit });
+}
+
+export function markSuperseded(review: Review): void {
+  updateRecord(review, { supersededAt: nowIso() });
+  logSidecarEvent("review-superseded", { id: review.record.id });
+}
+
+// Closed packets hold diffs nobody needs any more; keep a short history for
+// `sidecar review` and delete the rest.
+function pruneClosedReviews(sidecarPath: string): void {
+  const closed = listReviews(sidecarPath).filter((review) => !isOpen(review));
+  for (const review of closed.slice(KEEP_CLOSED_REVIEWS)) {
+    fs.rmSync(review.dir, { recursive: true, force: true });
+  }
+}
+
+/** Removes the reviews of families whose clone is gone; deinit's half of the packets. */
+export function pruneOrphanedReviews(): void {
+  for (const review of listReviews()) {
+    if (!fs.existsSync(review.record.family)) fs.rmSync(review.dir, { recursive: true, force: true });
+  }
+}
+
+function opaqueSection(record: ReviewRecord): string {
+  const opaque = record.files.filter((file) => file.artifact);
+  if (!opaque.length) return "";
+  return `
+These files' content does not appear faithfully in \`diff.patch\` (binary, not
+UTF-8, or diffs turned off). Their complete new content, as it would be
+published, is in the packet.
+Inspect each one; if you cannot, do not approve:
+
+${opaque.map((file) => `- \`${file.artifact}\` — ${file.path}`).join("\n")}
+`;
+}
+
+function reviewInstructions(record: ReviewRecord, config: SidecarConfig, guidelines: string | undefined): string {
+  return `# Sidecar publish review ${record.id}
+
+A sidecar is a scratchpad repository that syncs automatically to a shared Git
+remote (${redactText(config.remote)}). This machine wants to publish the change in
+\`diff.patch\`. Everyone with access to that remote can read what you approve,
+and it stays in the remote's history.
+
+Decide whether anything in the change should not leave this machine. This is
+not a code review: ignore quality, style, and correctness.
+
+Secret redaction has already run. Values it caught appear as placeholders such
+as \`<API_KEY>\`, \`<TOKEN>\`, or \`<SECRET>\`; they are not leaks. Look for what
+pattern matching misses:
+
+- credentials in unusual formats, or ones split across lines
+- personal data about real people: contact details, health, finances, private conversations
+- confidential material: customer names and data, unreleased plans, internal-only details
+- anything the repository's guidelines below rule out
+
+## Files
+
+All in this directory (\`$SIDECAR_REVIEW_DIR\`):
+
+- \`diff.patch\` — the change exactly as it would be published
+- \`review.json\` — the repository, peer, and changed paths
+${guidelines ? "- `guidelines.md` — this repository's guidelines, repeated below\n" : ""}${opaqueSection(record)}
+## Guidelines
+
+${guidelines ?? "This repository has no review guidelines (`.sidecar-review` beside its `.sidecar`)."}
+
+## Decide
+
+Approve, and the change is published on the next sync:
+
+    sidecar review approve ${record.id}
+
+Reject, saying which file and what kind of content. Do not repeat the
+sensitive value itself:
+
+    sidecar review reject ${record.id} --reason "<file: what kind of content>"
+
+If you are unsure, or a person should weigh in, do neither: leave the review
+open and raise it with them. Nothing is published until someone approves, and
+they decide with the same two commands.
+`;
+}
+
+// ---------------------------------------------------------------------------
+// Running the reviewer
+// ---------------------------------------------------------------------------
+
+/** This machine's reviewer command, or a failure that says how to set one. */
+export function configuredReviewer(): string {
+  const command = readSettings().reviewer;
+  if (!command) throw new SidecarError("no reviewer is configured; set one with `sidecar review reviewer <command>`");
+  return command;
+}
+
+/**
+ * Starts the runner for a review in the background and returns at once. A
+ * review takes minutes; the sync that opened it holds the sync lock and must
+ * not wait for one. Call under that lock: the launch is recorded first, so no
+ * later sync launches a second runner for the same review.
+ */
+export function launchReviewer(review: Review): void {
+  updateRecord(review, { launchedAt: nowIso() });
+  const child = spawn(process.execPath, [sidecarCliPath(), "review", "run", review.record.id], {
+    cwd: review.dir,
+    detached: true,
+    stdio: "ignore",
+    // This exact install runs the review it opened: the packet format is its.
+    env: { ...process.env, [SKIP_LOCAL_EXEC_ENV]: "1" },
+  });
+  child.unref();
+  logSidecarEvent("review-launch", { id: review.record.id });
+}
+
+/**
+ * The runner: runs the configured reviewer to completion and records how it
+ * ended. The verdict is not the exit status — a reviewer decides through
+ * `sidecar review approve|reject`, now or after a discussion that outlives it.
+ * A zero exit without a verdict is a review still in progress somewhere else;
+ * a nonzero one is a reviewer that broke.
+ */
+export function runReviewer(idOrPrefix: string): number {
+  const review = findReview(idOrPrefix);
+  const { id } = review.record;
+  assertOpen(review);
+  if (review.run) throw new SidecarError(`review ${id}'s reviewer already ran; \`sidecar review retry ${id}\` opens a new review of the same change`);
+  const command = configuredReviewer();
+
+  const file = runPath(review.dir);
+  const run: ReviewRun = { pid: process.pid, command, startedAt: nowIso() };
+  writePrivateJson(file, run);
+  const log = fs.openSync(path.join(review.dir, "reviewer.log"), "a", 0o600);
+  let result;
+  try {
+    result = spawnSync("/bin/sh", ["-c", command], {
+      cwd: review.dir,
+      stdio: ["ignore", log, log],
+      env: reviewerEnv(review),
+    });
+  } finally {
+    fs.closeSync(log);
+  }
+  const finished: ReviewRun = { ...run, finishedAt: nowIso(), exitCode: result.status, signal: result.signal };
+  writePrivateJson(file, finished);
+  logSidecarEvent("review-run", { id, exitCode: result.status, signal: result.signal });
+  return 0;
+}
+
+function reviewerEnv(review: Review): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { ...process.env };
+  // The runner inherits the requests a daemon made of the sync that opened
+  // the review. A reviewer that runs `sidecar` must get a plain one.
+  for (const name of [PEER_ENV, SOFT_SYNC_ENV, LOCAL_SYNC_ENV, SKIP_LOCAL_EXEC_ENV, GLOBAL_EXEC_ENV]) delete env[name];
+  const { record } = review;
+  return {
+    ...env,
+    SIDECAR_REVIEW_ID: record.id,
+    SIDECAR_REVIEW_DIR: review.dir,
+    SIDECAR_REVIEW_PROMPT: path.join(review.dir, "instructions.md"),
+    SIDECAR_REVIEW_DIFF: path.join(review.dir, "diff.patch"),
+    SIDECAR_REVIEW_ROOT: record.root,
+    SIDECAR_REVIEW_PEER: record.peer,
+    SIDECAR_REVIEW_CONFIG: peerConfigPath(record.root, record.peer),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Deciding
+// ---------------------------------------------------------------------------
+
+export function decideReview(review: Review, verdict: ReviewVerdict["verdict"], reason?: string): void {
+  assertOpen(review);
+  // Publication has begun: the commit may already be on the remote, so a
+  // rejection now would claim something it cannot deliver.
+  if (review.record.publishing && verdict === "rejected") {
+    throw new SidecarError(`review ${review.record.id} is already being published; it can no longer be rejected`);
+  }
+  const record: ReviewVerdict = { verdict, ...(reason ? { reason } : {}), decidedAt: nowIso() };
+  writePrivateJson(path.join(review.dir, "verdict.json"), record);
+  review.verdict = record;
+  review.state = verdict;
+  // Never the reason: it describes what was sensitive, and the log is
+  // something people paste into bug reports.
+  logSidecarEvent("review-decision", { id: review.record.id, verdict });
+}
+
diff --git a/packages/sidecar/src/state.ts b/packages/sidecar/src/state.ts
index a5d4790..18cf00e 100644
--- a/packages/sidecar/src/state.ts
+++ b/packages/sidecar/src/state.ts
@@ -44,6 +44,12 @@ export type SidecarSettings = {
   autoUpdate: boolean;
   lastUpdateCheckAt?: string;
   installSource?: InstallSource;
+  /**
+   * The shell command that reviews what a review-gated peer would publish.
+   * Machine-local by design: .sidecar says a review is required, this says
+   * who on this machine performs it. See review.ts.
+   */
+  reviewer?: string;
 };
 
 const DEFAULT_SETTINGS: SidecarSettings = { daemonEnabled: true, autoUpdate: true };
@@ -62,6 +68,7 @@ export function readSettings(): SidecarSettings {
       installSource: INSTALL_SOURCES.has(record.installSource as InstallSource)
         ? (record.installSource as InstallSource)
         : undefined,
+      reviewer: typeof record.reviewer === "string" && record.reviewer.trim() ? record.reviewer : undefined,
     };
   } catch (error) {
     logSidecarEvent("failure", {
@@ -80,6 +87,7 @@ export function writeSettings(settings: SidecarSettings): void {
   };
   if (settings.lastUpdateCheckAt) record.lastUpdateCheckAt = settings.lastUpdateCheckAt;
   if (settings.installSource) record.installSource = settings.installSource;
+  if (settings.reviewer) record.reviewer = settings.reviewer;
   fs.writeFileSync(settingsPath(), `${JSON.stringify(record, null, 2)}\n`, "utf8");
 }
 
@@ -413,11 +421,34 @@ export function acquireSyncLockOrThrow(root: string, peer: string): () => void {
   throw new SidecarError("another sidecar sync is already running; try again once it finishes");
 }
 
+// As long as the daemon lets one sync run: a decision waiting on a slow sync
+// must outlast it rather than fail and lose the verdict.
+const SYNC_LOCK_WAIT_MS = 10 * 60 * 1000;
+
+// Waits out a running sync rather than failing against it. For follow-ups to
+// something that already happened — an approved review publishing — where the
+// sync that launched it may still be finishing.
+function acquireSyncLockWaiting(root: string, peer: string): () => void {
+  const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  const deadline = Date.now() + SYNC_LOCK_WAIT_MS;
+  while (true) {
+    const release = acquireSyncLock(root, peer);
+    if (release) return release;
+    if (Date.now() >= deadline) {
+      throw new SidecarError("another sidecar sync is still running; try again once it finishes");
+    }
+    Atomics.wait(sleeper, 0, 0, 250);
+  }
+}
+
 // The one place that decides what a busy lock means: "throw" for commands the
 // user demanded, "skip" for soft requests that can no-op because their trigger
-// will fire again. Returns whether the work ran.
-export function withSyncLock(root: string, peer: string, onBusy: "throw" | "skip", fn: () => void): boolean {
-  const releaseLock = onBusy === "skip" ? acquireSyncLock(root, peer) : acquireSyncLockOrThrow(root, peer);
+// will fire again, "wait" for follow-ups that must run but can be late.
+// Returns whether the work ran.
+export function withSyncLock(root: string, peer: string, onBusy: "throw" | "skip" | "wait", fn: () => void): boolean {
+  const releaseLock = onBusy === "skip"
+    ? acquireSyncLock(root, peer)
+    : onBusy === "wait" ? acquireSyncLockWaiting(root, peer) : acquireSyncLockOrThrow(root, peer);
   if (!releaseLock) {
     console.log("another sidecar sync is already running; skipping this soft sync");
     return false;
diff --git a/packages/sidecar/src/sync.ts b/packages/sidecar/src/sync.ts
index 65df2c8..9cc4608 100644
--- a/packages/sidecar/src/sync.ts
+++ b/packages/sidecar/src/sync.ts
@@ -6,12 +6,12 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
 
 import { paint } from "./color.js";
-import { SidecarError, currentHost, currentUser, nowIso, realpathOr, slug, utcTimestamp } from "./util.js";
+import { SidecarError, currentMachine, currentUser, nowIso, realpathOr, slug, utcTimestamp } from "./util.js";
 import {
   branchExists,
+  emptyTree,
   ensureClean,
   ensureCommitIdentity,
   familyPrimaryRoot,
@@ -26,24 +26,42 @@ import {
   isAncestor,
   isDirty,
   remoteRefExists,
+  sidecarIdentity,
+  treeOf,
 } from "./git.js";
-import { packageVersion } from "./install.js";
+import { packageVersion, sidecarCliPath } from "./install.js";
 import {
   DEFAULT_PEER,
+  PUBLIC_REFS,
   type SidecarConfig,
   checkoutRandom,
   expandInbox,
   inboxPrefix,
   isStandalone,
+  loadPeer,
   matchesInboxPrefix,
   peerConfigPath,
+  peerFileName,
   readConfig,
   redactionModeConfigValue,
   remoteBranchName,
   requireSidecarCheckout,
   resolveSidecarPath,
+  reviewRequired,
 } from "./config.js";
-import { logSidecarEvent } from "./state.js";
+import { logSidecarEvent, readSettings } from "./state.js";
+import {
+  type Review,
+  type ReviewRecord,
+  createReview,
+  isOpen,
+  launchReviewer,
+  markPublished,
+  markPublishing,
+  markSuperseded,
+  openReview,
+  reviewAttention,
+} from "./review.js";
 import { readRules, resolveFileRules, rulesFingerprint, type SidecarRules } from "./rules.js";
 import {
   HEALTH_FILE,
@@ -66,14 +84,12 @@ import {
   redactText,
 } from "./redaction.js";
 
-// An env var rather than a flag so the daemon can request soft syncs from
-// older pinned project-local CLIs, which ignore it instead of rejecting an
-// unknown option.
-export const SOFT_SYNC_ENV = "SIDECAR_SYNC_SOFT";
-// Likewise a variable rather than a flag: the daemon settles this machine far
-// more often than it talks to the remote, and a pinned older CLI has to be able
-// to ignore the request instead of rejecting an option it never heard of.
-export const LOCAL_SYNC_ENV = "SIDECAR_SYNC_LOCAL";
+/**
+ * What a sync left undone on purpose. `held` is a review-gated peer whose
+ * unpublished work is waiting on a review; `attention` says why a person is
+ * needed, when one is.
+ */
+export type SyncOutcome = { held?: { review: Review; attention?: string } };
 
 /**
  * A sync in two phases, local first. Runs inside the repo's sync lock —
@@ -91,7 +107,7 @@ export function syncProject(
   root: string,
   config: SidecarConfig,
   options: { snapshot: boolean; remote: boolean; message?: string; onStage?: (stage: string) => void },
-): void {
+): SyncOutcome {
   const stage = (name: string): void => options.onStage?.(name);
 
   stage("checkout");
@@ -104,6 +120,7 @@ export function syncProject(
   if (!options.remote && !hasAnyCommit(sidecarPath)) {
     throw new SidecarError(`local sync requires an initialized sidecar checkout at ${sidecarPath}; run \`sidecar sync\` first`);
   }
+  bindReviewPolicy(sidecarPath, config);
   const inbox = expandInbox(config, sidecarPath);
   ensureCommitIdentity(sidecarPath);
   ensureRedactionFilter(sidecarPath, config.redaction, config);
@@ -127,7 +144,8 @@ export function syncProject(
     stage("settle");
     settleCheckouts(sidecarPath, config, inbox, siblings);
   }
-  if (!options.remote) return;
+  if (!options.remote) return {};
+  if (reviewRequired(config)) return publishReviewed(root, sidecarPath, config, inbox, siblings, stage);
 
   stage("push-inbox");
   syncBranchBeforePush(sidecarPath, inbox, config);
@@ -136,6 +154,456 @@ export function syncProject(
   mergeInboxBranches(sidecarPath, config, { forkFiles: true, push: true, remote: true });
   stage("settle-remote");
   settleCheckouts(sidecarPath, config, inbox, siblings);
+  return {};
+}
+
+// ---------------------------------------------------------------------------
+// Review-gated publishing
+//
+// A peer with `review = "required"` never pushes its own history: snapshots
+// stay on this machine, and so does every intermediate state they recorded,
+// including one a reviewer rejected. What leaves is one commit per approved
+// review, whose tree is the tree the reviewer saw, on top of the public
+// commit the review measured from. Everything the canonical merge combines is
+// already public, so its push can carry nothing unreviewed either.
+//
+// The unit of review is the repo family's local main, not one checkout:
+// sibling checkouts share it, settle onto it within seconds, unreviewed, and
+// so publish exactly what it holds. Reviewing it once means a rejection holds
+// every sibling, and two siblings never race the same content to the remote.
+// Local main is never reset for a gated peer (see ensureMainBranch), and each
+// publish is joined to it by a link merge (see linkPublished), which is what
+// keeps later merges free of conflicts the edits never had.
+//
+// "Already public" means PUBLIC_REFS: the remote's branches as fetchPublic
+// last saw them, inside withPublicGit. remotes/origin/* is local state any
+// hook or tool can write, so a gated peer's public base, publish parents, and
+// canonical merge inputs never come from it.
+// ---------------------------------------------------------------------------
+
+/**
+ * Runs `fn` with git confined to what a reviewer saw. Anything this checkout's
+ * own git setup can add to a published commit or push is switched off for the
+ * duration, because none of it is in the packet:
+ *
+ * - identity: author and committer are sidecar's own, whatever config or
+ *   environment says, and commits are never signed and always UTF-8;
+ * - replacement objects: a `git replace` would make the packet show one blob
+ *   while the published tree holds another;
+ * - hooks, which can add files or message text to a commit, or forge refs;
+ * - rerere, which can replay a recorded local resolution into a merge;
+ * - configured push options, which reach the remote's hooks;
+ * - attributes: they are read from the empty tree, so no `.gitattributes` —
+ *   public, or pulled in by any include — selects a merge driver, filter, or
+ *   line-ending conversion. Only sidecar's own `info/attributes` applies,
+ *   whose redaction filter is pinned to its known command; drivers and
+ *   filters defined in config are neutralized as well, in case.
+ *
+ * Settings travel as environment config, replacing any the caller had in
+ * force (which would otherwise outrank them); sync is synchronous, so the
+ * environment is this call's alone.
+ */
+function withPublicGit<T>(repo: string, fn: () => T): T {
+  assertRedactionFilterIntact(repo);
+  const { name, email } = sidecarIdentity();
+  const overrides: Array<[string, string]> = [
+    ["core.hooksPath", os.devNull],
+    ["core.attributesFile", os.devNull],
+    ["core.autocrlf", "false"],
+    ["commit.gpgSign", "false"],
+    ["tag.gpgSign", "false"],
+    ["i18n.commitEncoding", "UTF-8"],
+    ["rerere.enabled", "false"],
+    ["rerere.autoUpdate", "false"],
+    ["merge.renormalize", "false"],
+    ["merge.default", "text"],
+    ["push.pushOption", ""],
+    ["push.followTags", "false"],
+    ...neutralizedDrivers(repo),
+  ];
+  const env: Record<string, string | undefined> = {
+    GIT_AUTHOR_NAME: name,
+    GIT_AUTHOR_EMAIL: email,
+    GIT_COMMITTER_NAME: name,
+    GIT_COMMITTER_EMAIL: email,
+    GIT_NO_REPLACE_OBJECTS: "1",
+    GIT_ATTR_SOURCE: emptyTree(repo),
+    GIT_CONFIG_PARAMETERS: undefined,
+    GIT_CONFIG_COUNT: String(overrides.length),
+  };
+  overrides.forEach(([key, value], index) => {
+    env[`GIT_CONFIG_KEY_${index}`] = key;
+    env[`GIT_CONFIG_VALUE_${index}`] = value;
+  });
+
+  const saved = Object.fromEntries(Object.keys(env).map((key) => [key, process.env[key]]));
+  const apply = (values: Record<string, string | undefined>): void => {
+    for (const [key, value] of Object.entries(values)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  };
+  apply(env);
+  try {
+    return fn();
+  } finally {
+    apply(saved);
+  }
+}
+
+/** Overrides that turn every merge driver and filter in config, except redaction, into git's own no-ops. */
+function neutralizedDrivers(repo: string): Array<[string, string]> {
+  const keys = git(repo, ["config", "--name-only", "--get-regexp", "^(merge|filter)\\..+\\.(driver|clean|smudge|process)$"], { check: false })
+    .stdout.split("\n").filter(Boolean);
+  return keys.flatMap((key): Array<[string, string]> => {
+    const [section, ...rest] = key.split(".");
+    const driver = rest.slice(0, -1).join(".");
+    if (section === "merge") return [[`merge.${driver}.driver`, "git merge-file --marker-size=%L %A %O %B"]];
+    if (driver === REDACTION_FILTER_NAME) return [];
+    return [[`filter.${driver}.clean`, "cat"], [`filter.${driver}.smudge`, "cat"], [`filter.${driver}.process`, ""], [`filter.${driver}.required`, "false"]];
+  });
+}
+
+/**
+ * Fails closed when a process filter is in force under the redaction filter's
+ * name: git would run it instead of the pinned clean command, and environment
+ * config cannot unset a key. ensureRedactionFilter removes one from repo
+ * config, so one still visible came from somewhere else — an include.
+ */
+function assertRedactionFilterIntact(repo: string): void {
+  if (git(repo, ["config", "--get-all", `filter.${REDACTION_FILTER_NAME}.process`], { check: false }).status === 0) {
+    throw new SidecarError(`filter.${REDACTION_FILTER_NAME}.process is configured; remove it — a review-gated peer publishes only through sidecar's own redaction filter`);
+  }
+}
+
+/**
+ * Refuses a push that `remote.origin.pushurl` would send somewhere other than
+ * the remote's own URL. URL rewrites (`url.*.insteadOf`) stay honored: they
+ * are how people route a host through the transport that authenticates.
+ */
+function assertPublishDestination(repo: string): void {
+  const pushUrl = git(repo, ["config", "--get-all", "remote.origin.pushurl"], { check: false }).stdout.trim();
+  if (!pushUrl) return;
+  const url = git(repo, ["config", "--get", "remote.origin.url"], { check: false }).stdout.trim();
+  if (pushUrl !== url) {
+    throw new SidecarError("remote.origin.pushurl sends this sidecar's pushes somewhere other than its remote; a review-gated peer publishes only to its remote — unset it");
+  }
+}
+
+/** Refreshes the remote's branches, into origin/* for local use and PUBLIC_REFS. Call inside withPublicGit. */
+function fetchPublic(repo: string): void {
+  git(repo, ["fetch", "--quiet", "--prune", "--no-tags", "origin", "+refs/heads/*:refs/remotes/origin/*", `+refs/heads/*:${PUBLIC_REFS}*`]);
+}
+
+function publicRef(branch: string): string {
+  return `${PUBLIC_REFS}${branch}`;
+}
+
+/**
+ * Brings the public refs current for a caller outside the publish path —
+ * refresh, deciding what deleting a checkout would lose.
+ */
+export function refreshPublicRefs(repo: string): void {
+  withPublicGit(repo, () => fetchPublic(repo));
+}
+
+/** The remote's tip of `branch` as last fetched, if it has one. */
+function publicTip(repo: string, branch: string): string | undefined {
+  return git(repo, ["rev-parse", "--verify", "--quiet", publicRef(branch)], { check: false }).stdout.trim() || undefined;
+}
+
+/** Whether the remote, as last fetched, has `commit` on any branch. */
+function isPublic(repo: string, commit: string): boolean {
+  return Boolean(git(repo, ["for-each-ref", "--contains", commit, "--format=%(refname)", PUBLIC_REFS]).stdout.trim());
+}
+
+function publishReviewed(
+  root: string,
+  sidecarPath: string,
+  config: SidecarConfig,
+  inbox: string,
+  siblings: string[],
+  stage: (name: string) => void,
+): SyncOutcome {
+  stage("fetch");
+  withPublicGit(sidecarPath, () => {
+    fetchPublic(sidecarPath);
+    // An emptied remote, or one this existing checkout predates: start main
+    // there the gated way, so reviews have a public base to measure from.
+    if (!publicTip(sidecarPath, config.branch)) bootstrapReviewedMain(sidecarPath, config);
+    stage("publish");
+    const open = openReview(sidecarPath);
+    if (open?.state === "approved") publishApprovedReview(sidecarPath, config, inbox, open);
+  });
+  stage("merge");
+  withPublicGit(sidecarPath, () => mergeFetchedInboxes(sidecarPath, config, { forkFiles: true }));
+  // Takes the remote's new main into local main, and this checkout's latest
+  // snapshot with it, so the review below sees the whole family.
+  stage("merge-local");
+  mergeInboxBranches(sidecarPath, config, { forkFiles: true, push: false, remote: false });
+  stage("settle-remote");
+  settleCheckouts(sidecarPath, config, inbox, siblings);
+  stage("review");
+  // Inside withPublicGit so the packet shows the blobs an approval would
+  // publish; the reviewer starts outside it, in the caller's environment.
+  const gate = withPublicGit(sidecarPath, () => gateUnpublished(root, sidecarPath, config));
+  if (gate?.launch) launchReviewer(gate.review);
+  return gate ? { held: { review: gate.review, attention: reviewAttention(gate.review) } } : {};
+}
+
+/**
+ * Opens, keeps, or retires the family's review so that it covers what local
+ * main holds and the remote does not. One review is open at a time: work that
+ * lands while one is undecided waits for the next, which batches review the
+ * way the debounce batches pushes. Returns the review holding publication, if
+ * any, and whether its reviewer should be launched.
+ */
+function gateUnpublished(root: string, sidecarPath: string, config: SidecarConfig): { review: Review; launch: boolean } | undefined {
+  const head = git(sidecarPath, ["rev-parse", `refs/heads/${config.branch}`]).stdout.trim();
+  const headTree = treeOf(sidecarPath, head);
+  const publicMain = publicTip(sidecarPath, config.branch);
+  // ensureMainBranch joins local main to the remote's, so this always finds
+  // one. Failing that, nothing here has a public base to publish onto.
+  const base = publicMain && git(sidecarPath, ["merge-base", head, publicMain], { check: false }).stdout.trim();
+  if (!base) throw new SidecarError(`local ${config.branch} shares no history with the remote's; nothing is reviewed or published until it does`);
+  const open = openReview(sidecarPath);
+  const hasReviewer = Boolean(readSettings().reviewer);
+
+  if (treeOf(sidecarPath, base) === headTree) {
+    // Whatever an undecided review was waiting to publish is gone or already
+    // public. An approval still publishes: it was given, and its tree is safe.
+    if (open && open.state !== "approved") markSuperseded(open);
+    return undefined;
+  }
+  if (open?.state === "pending" || open?.state === "approved") {
+    // Each review launches its reviewer once. One configured after the review
+    // opened takes it from here.
+    return { review: open, launch: open.state === "pending" && !open.record.launchedAt && hasReviewer };
+  }
+  if (open) {
+    // Rejected or failed: it holds until the content changes, and the change
+    // is what the next review sees.
+    if (open.record.tree === headTree) return { review: open, launch: false };
+    markSuperseded(open);
+  }
+  const review = createReview({ root, config, sidecarPath, base, head });
+  console.log(`opened review ${paint("brand", review.record.id)} for ${review.record.files.length} changed file(s)`);
+  return { review, launch: hasReviewer };
+}
+
+/**
+ * Publishes an approved review as one new commit on this checkout's inbox
+ * branch, then joins it to local main. Call inside withPublicGit.
+ */
+function publishApprovedReview(sidecarPath: string, config: SidecarConfig, inbox: string, review: Review): void {
+  const { record } = review;
+  // A sync that recorded its commit and then died — in this checkout or a
+  // sibling — left the one commit this review may publish. Push that again,
+  // to the inbox it was cut for, rather than cutting a second one.
+  const target = record.publishing ?? { inbox, commit: cutPublishCommit(sidecarPath, config, inbox, record) };
+  const protectRef = publishingRef(record.id);
+  if (!isPublic(sidecarPath, target.commit)) {
+    // The commit's parents must already be on the remote: anything else would
+    // push their history along with it. A remote rewritten since the commit
+    // was cut can drop one, so this holds for a resumed publish too.
+    const parents = git(sidecarPath, ["rev-list", "--parents", "-n", "1", target.commit]).stdout.trim().split(" ").slice(1);
+    if (!parents.every((parent) => isPublic(sidecarPath, parent))) {
+      markSuperseded(review);
+      git(sidecarPath, ["update-ref", "-d", protectRef], { check: false });
+      console.log(`review ${paint("brand", record.id)} was measured from a commit the remote does not have; reviewing again`);
+      return;
+    }
+    assertPublishDestination(sidecarPath);
+    if (!record.publishing) {
+      // Reachable from a ref before it is recorded, so gc cannot prune the
+      // one commit a resumed publish would push.
+      git(sidecarPath, ["update-ref", protectRef, target.commit]);
+      markPublishing(review, target.inbox, target.commit);
+    }
+    // Never forced: the family is the inbox's only writer, so a rejection
+    // means something is wrong, and overwriting would hide it.
+    const push = git(sidecarPath, ["push", "--no-follow-tags", "origin", `${target.commit}:refs/heads/${target.inbox}`], { check: false });
+    if (push.status !== 0) {
+      throw new SidecarError(push.stderr.trim() || `could not publish review ${record.id} to ${target.inbox}`);
+    }
+    fetchPublic(sidecarPath);
+    console.log(`published review ${paint("brand", record.id)} to ${paint("brand", target.inbox)}`);
+  }
+  linkPublished(sidecarPath, config, review, target.commit);
+  markPublished(review, target.commit);
+  git(sidecarPath, ["update-ref", "-d", protectRef], { check: false });
+}
+
+/** Keeps a review's prepared publish commit reachable until it is published or retired. Never pushed or fetched. */
+function publishingRef(id: string): string {
+  return `refs/sidecar-publishing/${id}`;
+}
+
+/**
+ * Retires a review and opens a new one of the same change, with its own
+ * reviewer launch. The retired review is closed, so its reviewer — still
+ * running, perhaps — can no longer decide anything. Call under the peer's
+ * sync lock.
+ */
+export function retryReview(review: Review): Review {
+  const { record } = review;
+  if (!isOpen(review)) throw new SidecarError(`review ${record.id} is already ${review.state}`);
+  if (record.publishing) throw new SidecarError(`review ${record.id} is already being published`);
+  // An approval is a decision, not a reviewer that broke; retrying would
+  // quietly withdraw it.
+  if (review.state === "approved") throw new SidecarError(`review ${record.id} is approved and publishes on the next sync`);
+  const config = loadPeer(record.root, record.peer).config;
+  const sidecarPath = requireSidecarCheckout(record.root, config);
+  // Retired first: a retry that dies partway leaves no review open, and the
+  // next sync opens one of whatever local main holds — never two.
+  markSuperseded(review);
+  const fresh = withPublicGit(sidecarPath, () =>
+    createReview({ root: record.root, config, sidecarPath, base: record.base, head: record.head }));
+  launchReviewer(fresh);
+  return fresh;
+}
+
+/**
+ * The reviewed tree as a commit: first parent the public commit the review
+ * was measured from, second the inbox's previously published tip (unless the
+ * base already contains it) so the push is a fast-forward. Write times for
+ * last-writer-wins travel as carried trailers, since the snapshots that
+ * recorded them stay behind.
+ */
+function cutPublishCommit(sidecarPath: string, config: SidecarConfig, inbox: string, record: ReviewRecord): string {
+  const previous = publicTip(sidecarPath, inbox);
+  const parents = [record.base, ...(previous && !isAncestor(sidecarPath, previous, record.base) ? [previous] : [])];
+  const body = [
+    "sidecar publish",
+    "",
+    `source: ${currentMachine()}`,
+    `inbox: ${inbox}`,
+    `review: ${record.id}`,
+    ...publishedWriteTrailers(sidecarPath, config, record),
+  ];
+  return git(sidecarPath, [
+    "commit-tree",
+    record.tree,
+    ...parents.flatMap((parent) => ["-p", parent]),
+    "-m",
+    body.join("\n"),
+  ]).stdout.trim();
+}
+
+/**
+ * Carried last-writer-wins clocks for the reviewed paths that resolve by lww.
+ * The write events live in local snapshot trailers the remote never sees;
+ * without these every published path would read as written at publish time.
+ */
+function publishedWriteTrailers(repo: string, config: SidecarConfig, record: ReviewRecord): string[] {
+  const defaults = { resolve: config.resolve, redaction: config.redaction };
+  const paths = record.files
+    .map((file) => file.path)
+    .filter((filePath) => resolveFileRules(config.rules, filePath, defaults).resolve === "lww");
+  if (paths.length > WRITTEN_TRAILER_LIMIT) return [];
+  // Nothing read out of a local commit message passes into a published one:
+  // those messages are unreviewed, and a source or a clock can carry any text
+  // shaped like one. Each path's write is this review's own, a token no other
+  // write shares; its time is the recorded one, bounded to a plausible clock.
+  const now = Math.floor(Date.now() / 1000);
+  return paths.map((filePath) => {
+    const { time } = lastWriteEvent(repo, record.head, filePath);
+    return lwwWrittenTrailer(filePath, { time: Math.min(Math.max(0, time), now), source: `review-${record.id}` });
+  });
+}
+
+/**
+ * Joins the published commit to the local history it was cut from.
+ *
+ * The publish commit's parent is the public base, so on its own git would see
+ * no relation between it and the local main it reproduces — and merging the
+ * remote's main back in would measure every edit made since from that base,
+ * turning each file touched after the approval into a conflict. A merge with
+ * the "ours" strategy records that local main already contains the published
+ * state without changing a file. Local main only grows, so the reviewed head
+ * is in it; the link is never pushed, and every sibling inherits it when it
+ * settles onto main.
+ */
+function linkPublished(sidecarPath: string, config: SidecarConfig, review: Review, published: string): void {
+  const main = `refs/heads/${config.branch}`;
+  if (isAncestor(sidecarPath, published, main)) return;
+  // A main rebuilt from scratch no longer holds what was reviewed; claiming it
+  // contains the published state would be a false merge that drops content.
+  if (!isAncestor(sidecarPath, review.record.head, main)) {
+    logSidecarEvent("review-link-skip", { sidecarPath, id: review.record.id });
+    return;
+  }
+  withScratchWorktree(sidecarPath, config, "HEAD", (worktree) => {
+    git(worktree, ["switch", config.branch]);
+    git(worktree, ["merge", "--no-ff", "-s", "ours", "-m", `sidecar: link published review ${review.record.id}`, published]);
+  });
+}
+
+/**
+ * The canonical merge for a review-gated peer: the remote's main plus every
+ * inbox as the remote has it. Local inbox branches never enter it — they hold
+ * unpublished snapshots — so the merge result, and the push of it, is built
+ * from public commits alone.
+ */
+export function mergePublishedInboxes(sidecarPath: string, config: SidecarConfig, options: { forkFiles: boolean }): number {
+  return withPublicGit(sidecarPath, () => {
+    fetchPublic(sidecarPath);
+    return mergeFetchedInboxes(sidecarPath, config, options);
+  });
+}
+
+/** mergePublishedInboxes over the public refs as already fetched. Call inside withPublicGit. */
+function mergeFetchedInboxes(sidecarPath: string, config: SidecarConfig, options: { forkFiles: boolean }): number {
+  if (!publicTip(sidecarPath, config.branch)) return 0;
+  const publicMain = publicRef(config.branch);
+  if (publishedInboxBranches(sidecarPath, config).every((ref) => isAncestor(sidecarPath, ref, publicMain))) {
+    console.log("no published inbox branches to merge");
+    return 0;
+  }
+  assertPublishDestination(sidecarPath);
+  return withScratchWorktree(sidecarPath, config, publicMain, (worktree) => {
+    // Config can differ by worktree (includeIf gitdir), so check here too.
+    assertRedactionFilterIntact(worktree);
+    const maxAttempts = 3;
+    for (let attempt = 1; ; attempt += 1) {
+      if (attempt > 1) {
+        fetchPublic(sidecarPath);
+        git(worktree, ["reset", "--hard", publicMain]);
+      }
+      const pending = publishedInboxBranches(worktree, config).filter((ref) => !isAncestor(worktree, ref, "HEAD"));
+      if (!pending.length) {
+        console.log("no published inbox branches to merge");
+        return 0;
+      }
+      const merged: string[] = [];
+      for (const ref of pending) {
+        console.log(`merging ${paint("brand", remoteBranchName(ref))}`);
+        if (mergeInboxBranch(worktree, config, ref, options)) merged.push(ref);
+      }
+      const push = git(worktree, ["push", "--no-follow-tags", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
+      if (push.status !== 0) {
+        if (attempt >= maxAttempts) throw new SidecarError(push.stderr.trim() || `could not push ${config.branch}`);
+        console.log(`push of ${config.branch} was rejected; refetching and retrying`);
+        continue;
+      }
+      // A push does not move the public refs, and the gate measures from
+      // them: without this, it would see what was just merged as unpublished.
+      fetchPublic(sidecarPath);
+      console.log(`pushed ${config.branch}`);
+      console.log(`merged ${merged.length} inbox branch(es)`);
+      return merged.length;
+    }
+  });
+}
+
+/** Every inbox branch as the remote has it, including this checkout's own, as public refs. */
+function publishedInboxBranches(repo: string, config: SidecarConfig): string[] {
+  const prefix = inboxPrefix(config);
+  return git(repo, ["for-each-ref", "--format=%(refname)", PUBLIC_REFS])
+    .stdout.split(/\r?\n/)
+    .map((ref) => ref.trim())
+    .filter((ref) => ref && matchesInboxPrefix(prefix, ref.slice(PUBLIC_REFS.length)))
+    .sort();
 }
 
 /**
@@ -169,7 +637,8 @@ export function settleCheckouts(
     } catch (error) {
       logSidecarEvent("settle-skip", {
         sidecarPath: sibling,
-        message: error instanceof Error ? error.message : String(error),
+        // Git's message can quote a path nobody has reviewed yet.
+        ...(reviewRequired(config) ? {} : { message: error instanceof Error ? error.message : String(error) }),
       });
     }
   }
@@ -247,33 +716,50 @@ export function reportSyncHealth(root: string, config: SidecarConfig, outcome: H
     // it's in the local log and there is nowhere to say so from.
     if (!hasGitMetadata(sidecarPath)) return;
 
-    const branch = healthBranchFor(sidecarPath);
-    const previous = readHealthRecordAt(sidecarPath, `origin/${branch}`);
-    const identity: HealthIdentity = {
-      machine: `${currentUser()}@${currentHost()}`,
-      root,
-      peer: config.peer === DEFAULT_PEER ? undefined : config.peer,
-      inbox: expandInbox(config, sidecarPath),
-      version: packageVersion(),
-    };
-    const record = nextHealthRecord(previous, identity, outcome, nowIso());
-    if (!shouldPublishHealth(previous, record)) return;
-    publishHealthRecord(sidecarPath, branch, record);
-    logSidecarEvent("health", {
-      branch,
-      status: record.status,
-      stage: record.stage,
-      consecutiveFailures: record.consecutiveFailures,
-    });
+    // The previous record is read inside withPublicGit too: what it carries
+    // forward must be the blob the remote has, not a local replacement.
+    withPublicGit(sidecarPath, () => publishHealth(root, config, sidecarPath, outcome));
   } catch (error) {
     logSidecarEvent("failure", {
       command: "health",
       root,
-      message: `could not publish health: ${error instanceof Error ? error.message : String(error)}`,
+      message: reviewRequired(config)
+        ? "could not publish health"
+        : `could not publish health: ${error instanceof Error ? error.message : String(error)}`,
     });
   }
 }
 
+function publishHealth(root: string, config: SidecarConfig, sidecarPath: string, outcome: HealthOutcome): void {
+  const branch = healthBranchFor(sidecarPath);
+  const gated = reviewRequired(config);
+  // A gated peer reads the remote's own record, as fetchPublic saw it. A
+  // completed sync fetched after its last push; a failed one may not have
+  // fetched at all, so it does here — and when it cannot, the push below
+  // most likely cannot either.
+  if (gated && outcome.status === "failed") {
+    try { fetchPublic(sidecarPath); } catch { /* offline: as last fetched */ }
+  }
+  const previous = readHealthRecordAt(sidecarPath, gated ? publicRef(branch) : `origin/${branch}`);
+  const identity: HealthIdentity = {
+    machine: currentMachine(),
+    root,
+    peer: config.peer === DEFAULT_PEER ? undefined : config.peer,
+    inbox: expandInbox(config, sidecarPath),
+    version: packageVersion(),
+  };
+  const record = nextHealthRecord(previous, identity, outcome, nowIso());
+  if (!shouldPublishHealth(previous, record)) return;
+  if (gated) assertPublishDestination(sidecarPath);
+  publishHealthRecord(sidecarPath, branch, record);
+  logSidecarEvent("health", {
+    branch,
+    status: record.status,
+    stage: record.stage,
+    consecutiveFailures: record.consecutiveFailures,
+  });
+}
+
 /**
  * Writes the heartbeat with plumbing, deliberately touching nothing the sync
  * path uses: no working tree, no index, no branch checkout, and — because
@@ -291,19 +777,10 @@ function publishHealthRecord(sidecarPath: string, branch: string, record: Health
   const tree = git(sidecarPath, ["mktree"], {
     input: `100644 blob ${blob}\t${HEALTH_FILE}\n`,
   }).stdout.trim();
-  // Identity comes in on the command line rather than from repo config, so
-  // publishing doesn't depend on a config write having succeeded first.
-  const commit = git(sidecarPath, [
-    "-c",
-    `user.name=${currentUser()}`,
-    "-c",
-    `user.email=${slug(currentUser())}@${slug(currentHost())}.local`,
-    "commit-tree",
-    tree,
-    "-m",
-    `health: ${record.status} — ${record.machine}`,
-  ]).stdout.trim();
-  git(sidecarPath, ["push", "--force", "origin", `${commit}:refs/heads/${branch}`]);
+  // Identity comes from withPublicGit's environment rather than repo config,
+  // so publishing doesn't depend on a config write having succeeded first.
+  const commit = git(sidecarPath, ["commit-tree", tree, "-m", `health: ${record.status} — ${record.machine}`]).stdout.trim();
+  git(sidecarPath, ["push", "--no-follow-tags", "--force", "origin", `${commit}:refs/heads/${branch}`]);
 }
 
 /** Reads a heartbeat straight out of a ref; `git show` on a blob is unfiltered. */
@@ -362,14 +839,16 @@ export function mergeInboxBranches(
   // local merge sees only what this machine holds and does not fetch; a remote
   // one fetches first, so the same question also covers the other machines.
   if (options.remote) fetch(sidecarPath, false);
-  if (!hasPendingInboxWork(sidecarPath, config)) {
+  // A main that lacks the remote's latest is work too, merge or not: bringing
+  // it current is ensureMainBranch's job, inside the worktree below.
+  if (!hasPendingInboxWork(sidecarPath, config) && mainContainsRemote(sidecarPath, config)) {
     // Nothing to merge, but the local phase advances main before the remote
     // phase runs, so main is routinely owed to the remote with no merge behind
     // it. Sending a branch needs no checkout — and so needs no worktree. A
     // rejected push means another machine moved main and this is a real
     // reconcile after all, so fall through and do it properly.
     if (options.push && !mainMatchesRemote(sidecarPath, config)) {
-      const push = git(sidecarPath, ["push", "origin", `refs/heads/${config.branch}:refs/heads/${config.branch}`], {
+      const push = git(sidecarPath, ["push", "--no-follow-tags", "origin", `refs/heads/${config.branch}:refs/heads/${config.branch}`], {
         check: false,
       });
       if (push.status === 0) {
@@ -399,6 +878,15 @@ export function mergeInboxBranches(
   if (git(sidecarPath, ["branch", "--show-current"]).stdout.trim() === config.branch) {
     ensureInboxBranch(sidecarPath, config, expandInbox(config, sidecarPath));
   }
+  return withScratchWorktree(sidecarPath, config, "HEAD", (worktree) => mergeInboxBranchesAt(worktree, config, options));
+}
+
+/**
+ * Runs `fn` in a throwaway linked worktree detached at `start`, with this
+ * checkout's redaction policy bound to it. Merges happen there so the user's
+ * checkout never switches branches.
+ */
+function withScratchWorktree<T>(sidecarPath: string, config: SidecarConfig, start: string, fn: (worktree: string) => T): T {
   // A deterministic path (rather than mkdtemp) lets a new sync reclaim the
   // worktree a killed sync left behind; a stale registration would otherwise
   // block `git switch <main>` in every future merge. The sync lock prevents
@@ -412,9 +900,9 @@ export function mergeInboxBranches(
   fs.rmSync(scratch, { recursive: true, force: true });
   git(sidecarPath, ["worktree", "prune", "--expire", "now"], { check: false });
   try {
-    git(sidecarPath, ["worktree", "add", "--detach", worktree]);
+    git(sidecarPath, ["worktree", "add", "--detach", worktree, start]);
     ensureRedactionFilter(worktree, config.redaction, config);
-    return mergeInboxBranchesAt(worktree, config, options);
+    return fn(worktree);
   } finally {
     git(sidecarPath, ["worktree", "remove", "--force", worktree], { check: false });
     fs.rmSync(scratch, { recursive: true, force: true });
@@ -435,6 +923,12 @@ function mainMatchesRemote(repo: string, config: SidecarConfig): boolean {
   return local !== undefined && local === remote;
 }
 
+/** Whether local main already holds everything the remote's main does. */
+function mainContainsRemote(repo: string, config: SidecarConfig): boolean {
+  if (!remoteRefExists(repo, config.branch) || !branchExists(repo, config.branch)) return true;
+  return isAncestor(repo, `origin/${config.branch}`, `refs/heads/${config.branch}`);
+}
+
 /** Whether any inbox branch still sits outside the local main branch. */
 function hasPendingInboxWork(repo: string, config: SidecarConfig): boolean {
   const main = `refs/heads/${config.branch}`;
@@ -478,7 +972,7 @@ function mergeInboxBranchesAt(
     if (options.push) {
       const push = git(
         sidecarPath,
-        ["push", "-u", "origin", `HEAD:refs/heads/${config.branch}`],
+        ["push", "--no-follow-tags", "-u", "origin", `HEAD:refs/heads/${config.branch}`],
         { check: false },
       );
       if (push.status !== 0) {
@@ -583,7 +1077,7 @@ export function familySidecarCheckout(root: string, config: SidecarConfig): stri
   } catch {
     return undefined;
   }
-  if (primaryConfig.remote !== config.remote) return undefined;
+  if (!sharesFamilyCheckout(primaryConfig, config)) return undefined;
 
   const primaryPath = resolveSidecarPath(primary, primaryConfig);
   if (path.resolve(primaryPath) === path.resolve(primary)) return undefined;
@@ -640,13 +1134,45 @@ export function checkoutIsUnlinkedFromFamily(
   const primary = familyPrimaryRoot(root);
   if (!primary) return false;
   try {
-    const primaryConfig = readConfig(peerConfigPath(primary, config.peer));
-    return primaryConfig.remote === config.remote;
+    return sharesFamilyCheckout(readConfig(peerConfigPath(primary, config.peer)), config);
   } catch {
     return false;
   }
 }
 
+/**
+ * Whether a working copy may share the family primary's checkout. A shared
+ * store's local history is every sharer's to publish, so a peer that requires
+ * review never shares one with a peer that does not: see bindReviewPolicy.
+ */
+function sharesFamilyCheckout(primaryConfig: SidecarConfig, config: SidecarConfig): boolean {
+  return primaryConfig.remote === config.remote && reviewRequired(primaryConfig) === reviewRequired(config);
+}
+
+const REVIEW_POLICY_KEY = "sidecar.review";
+
+/**
+ * Binds a checkout's shared store to review, or refuses a peer that would
+ * publish it unreviewed. Sibling checkouts share one store, local inbox
+ * branches and local main included, and an ungated sync merges and pushes
+ * all of it — so once a gated peer has used a store, the store says so, and
+ * every peer that writes through it must be gated too. A family whose
+ * policies drift apart after linking fails closed here, on whichever side
+ * syncs first. Call before anything is snapshotted, merged, or pushed.
+ */
+export function bindReviewPolicy(sidecarPath: string, config: SidecarConfig): void {
+  const bound = git(sidecarPath, ["config", "--local", "--get", REVIEW_POLICY_KEY], { check: false }).stdout.trim();
+  if (reviewRequired(config)) {
+    if (bound !== "required") git(sidecarPath, ["config", "--local", REVIEW_POLICY_KEY, "required"]);
+    return;
+  }
+  if (bound === "required") {
+    throw new SidecarError(
+      `${sidecarPath} holds work from a peer that requires review, and this peer would publish it unreviewed; set review = "required" in this repo's ${peerFileName(config.peer)} too — or, to publish that work without review, \`git -C ${sidecarPath} config --unset ${REVIEW_POLICY_KEY}\``,
+    );
+  }
+}
+
 export function cloneOrUpdate(
   root: string,
   config: SidecarConfig,
@@ -701,6 +1227,7 @@ export function cloneOrUpdate(
 
   ensureCommitIdentity(sidecarPath);
   ensureRedactionFilter(sidecarPath, config.redaction, config);
+  bindReviewPolicy(sidecarPath, config);
   if (bootstrapMain) bootstrapMainBranch(sidecarPath, config);
 
   const inbox = expandInbox(config, sidecarPath);
@@ -711,6 +1238,10 @@ export function cloneOrUpdate(
 export function bootstrapMainBranch(repo: string, config: SidecarConfig): void {
   if (remoteRefExists(repo, config.branch)) return;
 
+  if (reviewRequired(config)) {
+    withPublicGit(repo, () => bootstrapReviewedMain(repo, config));
+    return;
+  }
   if (hasAnyCommit(repo)) {
     const current = git(repo, ["branch", "--show-current"]).stdout.trim();
     if (current !== config.branch) {
@@ -748,6 +1279,36 @@ Kept in sync by [sidecar](https://github.com/endograph/sidecar).
   pushBranch(repo, config.branch);
 }
 
+/**
+ * Starts the remote's main for a review-gated peer. Whatever the checkout
+ * holds — history, or files staged in an unborn repo — would publish
+ * unreviewed through an ordinary first commit, so the remote gets a root
+ * commit of the empty tree, made with plumbing that reads neither HEAD nor the
+ * index. Existing local history is linked to it the way a publish is (see
+ * linkPublished); the next sync then reviews everything the checkout holds as
+ * one change from nothing. Call inside withPublicGit.
+ */
+function bootstrapReviewedMain(repo: string, config: SidecarConfig): void {
+  assertPublishDestination(repo);
+  const root = git(repo, ["commit-tree", emptyTree(repo), "-m", "Initialize sidecar"]).stdout.trim();
+  git(repo, ["push", "--no-follow-tags", "origin", `${root}:refs/heads/${config.branch}`]);
+  fetchPublic(repo);
+  console.log(`started ${config.branch} on the remote empty; this checkout's content is published through review`);
+  const ref = `refs/heads/${config.branch}`;
+  // Unborn: local main starts at the public root. Nothing staged is touched;
+  // it reaches the inbox at the next snapshot and is reviewed from there.
+  if (!hasAnyCommit(repo)) {
+    git(repo, ["update-ref", ref, root]);
+    return;
+  }
+  const local = git(repo, ["rev-parse", "--verify", "--quiet", ref], { check: false }).stdout.trim()
+    || git(repo, ["rev-parse", "HEAD"]).stdout.trim();
+  // A merge commit of local main's own tree: no file changes, whether or not
+  // main is checked out anywhere.
+  const link = git(repo, ["commit-tree", treeOf(repo, local), "-p", local, "-p", root, "-m", "sidecar: link the remote's initial main"]).stdout.trim();
+  git(repo, ["update-ref", ref, link]);
+}
+
 export function ensureMainBranch(repo: string, config: SidecarConfig): void {
   if (branchExists(repo, config.branch)) {
     git(repo, ["switch", config.branch]);
@@ -774,6 +1335,24 @@ export function ensureMainBranch(repo: string, config: SidecarConfig): void {
     git(repo, ["merge", "--ff-only", remoteBranch]);
     return;
   }
+  // A review-gated peer's local main is this machine's whole view: the
+  // remote's main with every unpublished local merge on top, including the
+  // link that joins each published commit to the history it was cut from
+  // (see linkPublished). Resetting it would discard those links, so it takes
+  // the remote's side in as a merge instead.
+  if (reviewRequired(config)) {
+    if (git(repo, ["merge-base", "HEAD", remoteBranch], { check: false }).status !== 0) {
+      // The remote's main was started over. Join it the way bootstrap does: a
+      // commit of local main's own tree, so nothing local is lost and the
+      // next review measures everything here from the new public base.
+      const link = git(repo, ["commit-tree", treeOf(repo, "HEAD"), "-p", "HEAD", "-p", remoteBranch, "-m", `sidecar: link the remote's new ${config.branch}`]).stdout.trim();
+      git(repo, ["merge", "--ff-only", link]);
+      console.log(`${remoteBranch} was started over; local ${config.branch} is joined to it and reviewed from there`);
+      return;
+    }
+    mergeInboxBranch(repo, config, remoteBranch, { forkFiles: true });
+    return;
+  }
   // Diverged: another machine won a push race. Local commits beyond the
   // remote are only sidecar-generated inbox merges, so the remote side wins
   // and any still-pending inbox branches get re-merged on top of it.
@@ -885,7 +1464,7 @@ export function snapshot(
     .stdout.split("\0")
     .filter(Boolean);
 
-  const source = `${currentUser()}@${currentHost()}`;
+  const source = currentMachine();
   const body = [message, "", `source: ${source}`];
   // main-head pins a snapshot to the code it was taken against. Standalone has
   // no separate code repo — mainRoot is this repo — so the trailer would just
@@ -1044,7 +1623,7 @@ export function ensureRedactionFilter(
   // %f is shell-quoted by Git itself, including whitespace and metacharacters.
   // Always run the filter: another checkout or a path rule can require
   // redaction even when this peer's default is none.
-  const command = `${filterCommandQuote(process.execPath)} ${filterCommandQuote(redactCliPath())} redact --checkout-policy --path %f`;
+  const command = `${filterCommandQuote(process.execPath)} ${filterCommandQuote(sidecarCliPath())} redact --checkout-policy --path %f`;
   const wanted: Array<[string, string]> = [
     [`filter.${REDACTION_FILTER_NAME}.clean`, command],
     [`filter.${REDACTION_FILTER_NAME}.revision`, REDACTION_FILTER_REVISION],
@@ -1053,6 +1632,9 @@ export function ensureRedactionFilter(
     [`filter.${REDACTION_FILTER_NAME}.smudge`, "cat"],
     [`filter.${REDACTION_FILTER_NAME}.required`, "true"],
   ];
+  // Git prefers a process filter over clean/smudge, so one configured under
+  // this name would replace redaction outright; it is removed, never kept.
+  const processKey = `filter.${REDACTION_FILTER_NAME}.process`;
   // info/attributes lives in the shared git dir; the worktree-local git dir
   // differs from it inside linked worktrees (which merging uses).
   const attributesPath = path.join(gitCommonDir(repo), "info", "attributes");
@@ -1074,7 +1656,7 @@ export function ensureRedactionFilter(
         return [entry.slice(0, space), entry.slice(space + 1)] as [string, string];
       }),
   );
-  const configOk = wanted.every(([key, value]) => current.get(key) === value);
+  const configOk = wanted.every(([key, value]) => current.get(key) === value) && !current.has(processKey);
   let attributes = "";
   try {
     attributes = fs.readFileSync(attributesPath, "utf8");
@@ -1087,6 +1669,7 @@ export function ensureRedactionFilter(
   for (const [key, value] of wanted) {
     git(repo, ["config", key, value]);
   }
+  git(repo, ["config", "--unset-all", processKey], { check: false });
   if (!attributesOk) {
     fs.mkdirSync(path.dirname(attributesPath), { recursive: true });
     fs.appendFileSync(
@@ -1123,14 +1706,6 @@ export function removeRedactionFilter(repo: string): void {
   }
 }
 
-// The filter must be runnable by plain git, outside this process: point it at
-// the built CLI bundle (when running from TypeScript sources, e.g. tests, the
-// sibling dist build).
-function redactCliPath(): string {
-  const self = fileURLToPath(import.meta.url);
-  return self.endsWith(".ts") ? path.join(path.dirname(self), "..", "dist", "cli.js") : self;
-}
-
 // Git runs filter commands through sh; double quotes keep paths with spaces
 // intact.
 function filterCommandQuote(value: string): string {
@@ -1188,7 +1763,7 @@ function refreshInboxFromMain(repo: string, config: SidecarConfig, inbox: string
 }
 
 export function pushBranch(repo: string, branch: string): void {
-  git(repo, ["push", "-u", "origin", `HEAD:refs/heads/${branch}`]);
+  git(repo, ["push", "--no-follow-tags", "-u", "origin", `HEAD:refs/heads/${branch}`]);
   console.log(`pushed ${paint("brand", branch)}`);
 }
 
diff --git a/packages/sidecar/src/util.ts b/packages/sidecar/src/util.ts
index 2f9ab54..ccba2d1 100644
--- a/packages/sidecar/src/util.ts
+++ b/packages/sidecar/src/util.ts
@@ -118,6 +118,11 @@ export function currentHost(): string {
   return os.hostname().split(".", 1)[0] || "unknown";
 }
 
+/** `user@host`: how this machine names itself in commits and heartbeats. */
+export function currentMachine(): string {
+  return `${currentUser()}@${currentHost()}`;
+}
+
 /**
  * A duration as seconds: a bare number is seconds, a string takes an
  * `s`, `m`, or `h` suffix ("90s", "10m", "1h"). Undefined when unparseable.
diff --git a/packages/sidecar/tests/cli.test.ts b/packages/sidecar/tests/cli.test.ts
index 41e3c54..336b1f7 100644
--- a/packages/sidecar/tests/cli.test.ts
+++ b/packages/sidecar/tests/cli.test.ts
@@ -7,6 +7,7 @@ import { afterEach, beforeEach, describe, expect, test } from "vitest";
 
 import {
   DEFAULT_INBOX,
+  bindReviewPolicy,
   checkoutRandom,
   ensureMainBranch,
   expandInbox,
@@ -134,6 +135,36 @@ describe("config", () => {
     expect(() => readConfig(configPath)).toThrow(/interval: invalid duration "soon"/);
   });
 
+  test("refuses keys it does not know rather than dropping them", () => {
+    const configPath = path.join(tempDir(), ".sidecar");
+    fs.writeFileSync(configPath, 'remote = "git@github.com:org/repo.git"\nreveiw = "required"\n', "utf8");
+    expect(() => readConfig(configPath)).toThrow(/unknown key "reveiw"/);
+  });
+
+  test("refuses a config version it does not read", () => {
+    const configPath = path.join(tempDir(), ".sidecar");
+    fs.writeFileSync(configPath, 'version = 2\nremote = "git@github.com:org/repo.git"\n', "utf8");
+    expect(() => readConfig(configPath)).toThrow(/config version 2 is not supported/);
+  });
+
+  test("reads review policy and its timeout, and writes them back only when set", () => {
+    const configPath = path.join(tempDir(), ".sidecar");
+    fs.writeFileSync(configPath, 'remote = "git@github.com:org/repo.git"\n', "utf8");
+    expect(readConfig(configPath)).toMatchObject({ review: "off", reviewTimeout: undefined });
+    writeConfig(configPath, readConfig(configPath));
+    expect(fs.readFileSync(configPath, "utf8")).not.toContain("review");
+
+    fs.writeFileSync(configPath, 'remote = "git@github.com:org/repo.git"\nreview = "required"\nreview-timeout = "30m"\n', "utf8");
+    const config = readConfig(configPath);
+    expect(config).toMatchObject({ review: "required", reviewTimeout: 1800 });
+    writeConfig(configPath, config);
+    expect(fs.readFileSync(configPath, "utf8")).toContain('review = "required"\nreview-timeout = 1800\n');
+    expect(readConfig(configPath)).toMatchObject({ review: "required", reviewTimeout: 1800 });
+
+    fs.writeFileSync(configPath, 'remote = "git@github.com:org/repo.git"\nreview = "agent"\n', "utf8");
+    expect(() => readConfig(configPath)).toThrow(/invalid review mode "agent"; expected one of off, required/);
+  });
+
   test("parses TOML strings with comments and escapes", () => {
     const root = tempDir();
     const configPath = path.join(root, ".sidecar");
@@ -885,6 +916,22 @@ describe.skipIf(process.env.SIDECAR_INTEGRATION !== "1")("main branch reconcilia
     expect(isAncestor(loser, "origin/sidecar-inbox/test/r1", "origin/main")).toBe(true);
   });
 
+  test("joins a gated main to a remote main that was started over, keeping every local file", () => {
+    const { winner, loser } = divergedClones();
+    git(winner, ["switch", "--orphan", "fresh"]);
+    git(winner, ["commit", "--allow-empty", "-m", "started over"]);
+    git(winner, ["push", "--force", "origin", "fresh:main"]);
+    const before = git(loser, ["rev-parse", "HEAD"]).stdout.trim();
+    const tree = git(loser, ["rev-parse", "HEAD^{tree}"]).stdout.trim();
+
+    fetch(loser, true);
+    ensureMainBranch(loser, { ...config, review: "required" });
+
+    expect(git(loser, ["rev-parse", "HEAD^{tree}"]).stdout.trim()).toBe(tree);
+    expect(isAncestor(loser, before, "HEAD")).toBe(true);
+    expect(isAncestor(loser, "origin/main", "HEAD")).toBe(true);
+  });
+
   // A pushes after B last fetched, so B's main and origin/main diverge —
   // the state a lost push race leaves behind.
   function divergedClones(): { winner: string; loser: string } {
@@ -914,6 +961,23 @@ describe.skipIf(process.env.SIDECAR_INTEGRATION !== "1")("main branch reconcilia
   }
 });
 
+describe.skipIf(process.env.SIDECAR_INTEGRATION !== "1")("shared review policy", () => {
+  const config: SidecarConfig = { peer: "default", remote: "x", version: 1, path: "sidecar", branch: "main", inbox: DEFAULT_INBOX, redaction: "none", resolve: "fork" };
+
+  test("a store a gated peer has used refuses an ungated one, from any of its worktrees", () => {
+    const repo = initRepo();
+    const sibling = path.join(tempDir(), "sibling");
+    git(repo, ["commit", "--allow-empty", "-m", "base"]);
+    git(repo, ["worktree", "add", "--detach", sibling]);
+
+    bindReviewPolicy(repo, config);
+    bindReviewPolicy(sibling, { ...config, review: "required" });
+    bindReviewPolicy(repo, { ...config, review: "required" });
+    expect(() => bindReviewPolicy(repo, config)).toThrow(/requires review/);
+    expect(() => bindReviewPolicy(sibling, config)).toThrow(/requires review/);
+  });
+});
+
 describe("daemon pid identification", () => {
   test("rejects dead pids and live non-daemon processes", () => {
     expect(pidIsSidecarDaemon(999_999)).toBe(false);
diff --git a/packages/sidecar/tests/cmd-sync.test.ts b/packages/sidecar/tests/cmd-sync.test.ts
index 8c7d591..12338c3 100644
--- a/packages/sidecar/tests/cmd-sync.test.ts
+++ b/packages/sidecar/tests/cmd-sync.test.ts
@@ -39,6 +39,7 @@ beforeEach(() => {
   vi.stubEnv("SIDECAR_SYNC_LOCAL", "");
   vi.stubEnv("SIDECAR_SYNC_SOFT", "");
   vi.mocked(loadPeers).mockReturnValue([peer]);
+  vi.mocked(syncProject).mockReturnValue({});
   vi.mocked(withSyncLock).mockImplementation((_root, _peer, _mode, callback) => {
     locked = true;
     try { callback(); } finally { locked = false; }
diff --git a/packages/sidecar/tests/health.test.ts b/packages/sidecar/tests/health.test.ts
index aa0d1ad..18a310e 100644
--- a/packages/sidecar/tests/health.test.ts
+++ b/packages/sidecar/tests/health.test.ts
@@ -128,6 +128,17 @@ describe("nextHealthRecord", () => {
   });
 });
 
+describe("carried fields", () => {
+  test("only timestamps carry forward from a previous record", () => {
+    const forged = { ...ok(T0), lastSuccessAt: "PRIVATE text", lastFailureAt: "2026-07-26T08:00:00.000Z", consecutiveFailures: 2.7 };
+    const record = nextHealthRecord(forged, identity, { status: "failed", stage: "merge", message: "x" }, T1);
+    expect(record.lastSuccessAt).toBeUndefined();
+    expect(record.lastFailureAt).toBe(T1);
+    expect(record.consecutiveFailures).toBe(3);
+    expect(nextHealthRecord(forged, identity, { status: "ok" }, T1).lastFailureAt).toBe("2026-07-26T08:00:00.000Z");
+  });
+});
+
 describe("shouldPublishHealth", () => {
   const heartbeatAgo = (ms: number): number => Date.parse(T0) + ms;
 
@@ -145,6 +156,18 @@ describe("shouldPublishHealth", () => {
     expect(shouldPublishHealth(ok(T0), ok(T1), heartbeatAgo(HEALTH_HEARTBEAT_MS))).toBe(true);
   });
 
+  test("a review hold starting, changing, or clearing is a transition", () => {
+    const held = nextHealthRecord(ok(T0), identity, { status: "ok", review: "pending" }, T1);
+    const attention = nextHealthRecord(held, identity, { status: "ok", review: "attention" }, T1);
+    const clear = nextHealthRecord(attention, identity, { status: "ok" }, T1);
+    expect(held.review).toBe("pending");
+    expect(clear.review).toBeUndefined();
+    expect(shouldPublishHealth(ok(T0), held, heartbeatAgo(1000))).toBe(true);
+    expect(shouldPublishHealth(held, attention, heartbeatAgo(1000))).toBe(true);
+    expect(shouldPublishHealth(attention, clear, heartbeatAgo(1000))).toBe(true);
+    expect(shouldPublishHealth({ ...attention, updatedAt: T0 }, attention, heartbeatAgo(1000))).toBe(false);
+  });
+
   test("publishes rather than waiting forever when a clock runs behind the branch", () => {
     expect(shouldPublishHealth(ok(T2), ok(T2), Date.parse(T0))).toBe(true);
     expect(shouldPublishHealth({ ...ok(T0), updatedAt: "not a date" }, ok(T1))).toBe(true);
@@ -186,6 +209,12 @@ describe("record round-tripping", () => {
     expect(record?.consecutiveFailures).toBe(0);
   });
 
+  test("keeps a review hold and drops an unknown one", () => {
+    const held = nextHealthRecord(ok(T0), identity, { status: "ok", review: "attention" }, T1);
+    expect(parseHealthRecord(serializeHealthRecord(held))?.review).toBe("attention");
+    expect(parseHealthRecord(JSON.stringify({ status: "ok", updatedAt: T0, review: "maybe" }))?.review).toBeUndefined();
+  });
+
   test("rejects what isn't a record at all", () => {
     expect(parseHealthRecord("not json")).toBeUndefined();
     expect(parseHealthRecord("[]")).toBeUndefined();
diff --git a/packages/sidecar/tests/integration.test.ts b/packages/sidecar/tests/integration.test.ts
index 34351c6..9ecd504 100644
--- a/packages/sidecar/tests/integration.test.ts
+++ b/packages/sidecar/tests/integration.test.ts
@@ -2361,11 +2361,12 @@ describe("sidecar peers", () => {
 
     const output = runSidecar(["init", privateRemote, "--peer", "private", "--ignored"], main);
 
-    expect(output).toContain("ignored .sidecar.private and .sidecar-rules.private via .git/info/exclude");
+    expect(output).toContain("ignored .sidecar.private, .sidecar-rules.private, and .sidecar-review.private via .git/info/exclude");
     expect(output).toContain("ignored private/ via .git/info/exclude");
     const excludePath = path.join(main, ".git", "info", "exclude");
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar.private\n");
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar-rules.private\n");
+    expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar-review.private\n");
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/private/\n");
     fs.writeFileSync(path.join(main, ".sidecar-rules.private"), '[[rules]]\nglob = "**"\nresolve = "fork"\n');
     // The committed ignore file and the tree carry no trace of the peer.
@@ -2382,6 +2383,7 @@ describe("sidecar peers", () => {
     // may still declare the peer, so its lines are left where they are.
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar.private\n");
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar-rules.private\n");
+    expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar-review.private\n");
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/private/\n");
     expect(fs.existsSync(path.join(main, ".sidecar"))).toBe(true);
   });
@@ -2457,6 +2459,200 @@ describe("sidecar peers", () => {
   });
 });
 
+describe("review-gated publishing", () => {
+  test("publishes only approved trees, and a rejected state never reaches the remote", async () => {
+    const { main, remote, sidecar } = initSidecarProject(["--review", "required"]);
+    const env = reviewerEnv(main);
+    runSidecar(["review", "reviewer", env.reviewer], main, env.vars);
+
+    fs.writeFileSync(path.join(sidecar, "notes.md"), "hello\n", "utf8");
+    const first = openedReview(runSidecar(["sync"], main, env.vars));
+    await waitForReview(main, first, "published", env.vars);
+    expect(remoteFile(remote, "notes.md")).toBe("hello\n");
+    // Publishing settles it: nothing is left to review, so no second review opens.
+    const afterPublish = JSON.parse(runSidecar(["review", "--json"], main, env.vars))[0].reviews;
+    expect(afterPublish.map((review: { id: string }) => review.id)).toEqual([first]);
+
+    fs.writeFileSync(path.join(sidecar, "notes.md"), "hello\nCONFIDENTIAL acquisition of Initech\n", "utf8");
+    const rejected = openedReview(runSidecar(["sync"], main, env.vars));
+    await waitForReview(main, rejected, "rejected", env.vars);
+    expect(runSidecar(["sync"], main, env.vars)).toContain("needs attention: rejected");
+    expect(remoteObjectsContain(remote, "CONFIDENTIAL")).toBe(false);
+
+    fs.writeFileSync(path.join(sidecar, "notes.md"), "hello\nan acquisition is planned\n", "utf8");
+    const fixed = openedReview(runSidecar(["sync"], main, env.vars));
+    expect(fixed).not.toBe(rejected);
+    await waitForReview(main, fixed, "published", env.vars);
+    expect(remoteFile(remote, "notes.md")).toBe("hello\nan acquisition is planned\n");
+    // The rejected snapshot stays in local history only.
+    expect(remoteObjectsContain(remote, "CONFIDENTIAL")).toBe(false);
+    expect(gitRaw(["--git-dir", remote, "log", "--all", "--format=%s"]).stdout).not.toContain("sidecar snapshot");
+  });
+
+  test("edits made during an open review, and a sibling worktree's, publish without forks", async () => {
+    const { main, worktree, remote, state } = initWorktreeFamily(["--review", "required"]);
+    const env = reviewerEnv(main, { SIDECAR_STATE_DIR: state });
+    runSidecar(["clone"], worktree, env.vars);
+    runSidecar(["review", "reviewer", env.reviewer], main, env.vars);
+    const sidecar = path.join(main, "sidecar");
+    const sibling = path.join(worktree, "sidecar");
+
+    fs.writeFileSync(env.defer, "", "utf8");
+    fs.writeFileSync(path.join(sidecar, "plan.md"), "v1\n", "utf8");
+    const first = openedReview(runSidecar(["sync"], main, env.vars));
+    await waitForReview(main, first, "pending", env.vars, (review) => fs.readFileSync(path.join(String(review.dir), "reviewer.log"), "utf8").includes("deferring"));
+    expect(fs.readFileSync(path.join(sibling, "plan.md"), "utf8")).toBe("v1\n");
+
+    fs.writeFileSync(path.join(sidecar, "plan.md"), "v1\nv2\n", "utf8");
+    const second = runSidecar(["sync"], main, env.vars);
+    expect(second).not.toContain("opened review");
+    fs.writeFileSync(path.join(sibling, "sibling.md"), "sibling note\n", "utf8");
+    runSidecar(["sync", "--local"], worktree, env.vars);
+
+    // A person approves what the review covered: v1 alone, not the edit after it.
+    fs.rmSync(env.defer);
+    const approved = runSidecar(["review", "approve", first], main, env.vars);
+    expect(remoteFile(remote, "plan.md")).toBe("v1\n");
+    await waitForReview(main, openedReview(approved), "published", env.vars);
+    runSidecar(["sync"], worktree, env.vars);
+    runSidecar(["sync"], main, env.vars);
+
+    expect(remoteFile(remote, "plan.md")).toBe("v1\nv2\n");
+    expect(remoteFile(remote, "sibling.md")).toBe("sibling note\n");
+    for (const tree of [sidecar, sibling]) {
+      expect(git(tree, ["ls-files"]).stdout).not.toMatch(/\.conflict\.|\.sidecar-conflicts\//);
+    }
+    expect(fs.readFileSync(path.join(sibling, "plan.md"), "utf8")).toBe("v1\nv2\n");
+  });
+
+  test("an undecided review needs attention after its timeout, and the heartbeat carries no reason", async () => {
+    const { main, remote, sidecar } = initSidecarProject(["--review", "required", "--review-timeout", "1s"]);
+    const env = reviewerEnv(main);
+    runSidecar(["review", "reviewer", env.reviewer], main, env.vars);
+    fs.writeFileSync(env.defer, "", "utf8");
+    fs.writeFileSync(path.join(sidecar, "later.md"), "decide later\n", "utf8");
+
+    const id = openedReview(runSidecar(["sync"], main, env.vars));
+    await waitForReview(main, id, "pending", env.vars, (review) => fs.readFileSync(path.join(String(review.dir), "reviewer.log"), "utf8").includes("deferring"));
+    await new Promise((resolve) => setTimeout(resolve, 1500));
+    expect(runSidecar(["sync"], main, env.vars)).toContain("needs attention: undecided for over 1s");
+    expect(runSidecar(["status"], main, env.vars)).toContain("needs attention");
+
+    const heartbeats = remoteBranches(remote).filter((branch) => branch.startsWith("sidecar-health/"))
+      .map((branch) => JSON.parse(gitRaw(["--git-dir", remote, "show", `${branch}:health.json`]).stdout));
+    expect(heartbeats.map((record) => record.review)).toContain("attention");
+
+    runSidecar(["review", "approve", id], main, env.vars);
+    expect(remoteFile(remote, "later.md")).toBe("decide later\n");
+  });
+
+  test("a gated peer refuses to push a snapshot directly, before snapshotting anything", () => {
+    const { main, sidecar } = initSidecarProject(["--review", "required"]);
+    const before = git(sidecar, ["rev-parse", "HEAD"]).stdout.trim();
+    for (const content of [undefined, "hello\n"]) {
+      if (content) fs.writeFileSync(path.join(sidecar, "notes.md"), content, "utf8");
+      const result = runSidecarRaw(["snapshot", "--push"], main);
+      expect(result.status).not.toBe(0);
+      expect(result.stderr).toContain("requires review");
+      expect(git(sidecar, ["rev-parse", "HEAD"]).stdout.trim()).toBe(before);
+    }
+  });
+
+  test("a working copy whose review policy drifts from its family's refuses to sync the shared store", () => {
+    const { main, worktree, remote, state } = initWorktreeFamily(["--review", "required"]);
+    const env = { SIDECAR_STATE_DIR: state };
+    runSidecar(["clone"], worktree, env);
+    fs.writeFileSync(path.join(main, "sidecar", "plan.md"), "unreviewed plan\n", "utf8");
+    runSidecar(["sync"], main, env);
+
+    const config = path.join(worktree, ".sidecar");
+    fs.writeFileSync(config, fs.readFileSync(config, "utf8").replace('review = "required"\n', ""), "utf8");
+    const result = runSidecarRaw(["sync"], worktree, env);
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain("requires review");
+    expect(remoteObjectsContain(remote, "unreviewed plan")).toBe(false);
+  });
+
+  test("retrying a review retires it, so its old reviewer can no longer decide", () => {
+    const { main, sidecar } = initSidecarProject(["--review", "required"]);
+    const env = reviewerEnv(main);
+    fs.writeFileSync(path.join(sidecar, "notes.md"), "hello\n", "utf8");
+    const first = openedReview(runSidecar(["sync"], main, env.vars));
+    runSidecar(["review", "reviewer", `touch ${JSON.stringify(env.defer)}`], main, env.vars);
+
+    const retried = /review ([0-9a-f]+) covers the same change/.exec(runSidecar(["review", "retry", first], main, env.vars))?.[1];
+    expect(retried).toBeDefined();
+    expect(retried).not.toBe(first);
+    const late = runSidecarRaw(["review", "approve", first, "--no-sync"], main, env.vars);
+    expect(late.status).not.toBe(0);
+    expect(late.stderr).toContain("already superseded");
+
+    runSidecar(["review", "approve", retried!, "--no-sync"], main, env.vars);
+    const again = runSidecarRaw(["review", "retry", retried!], main, env.vars);
+    expect(again.status).not.toBe(0);
+    expect(again.stderr).toContain("is approved");
+  });
+});
+
+// A reviewer that rejects anything CONFIDENTIAL, defers while `defer` exists,
+// and approves the rest — through a `sidecar` on PATH, as a real one would.
+function reviewerEnv(main: string, extra: Record<string, string> = {}): { reviewer: string; defer: string; vars: Record<string, string> } {
+  const dir = tempDir();
+  const bin = path.join(dir, "bin");
+  fs.mkdirSync(bin);
+  fs.writeFileSync(path.join(bin, "sidecar"), `#!/bin/sh\nexec "${process.execPath}" "${cliPath}" "$@"\n`, { mode: 0o755 });
+  const defer = path.join(dir, "defer");
+  const reviewer = path.join(dir, "reviewer.sh");
+  fs.writeFileSync(reviewer, `#!/bin/sh
+if grep -q CONFIDENTIAL "$SIDECAR_REVIEW_DIFF"; then
+  exec sidecar review reject "$SIDECAR_REVIEW_ID" --reason "notes.md: an internal plan"
+fi
+if [ -f "${defer}" ]; then echo deferring; exit 0; fi
+exec sidecar review approve "$SIDECAR_REVIEW_ID"
+`, { mode: 0o755 });
+  return {
+    reviewer,
+    defer,
+    vars: { PATH: `${bin}:${process.env.PATH}`, SIDECAR_STATE_DIR: path.join(main, ".sidecar-test-state"), ...extra },
+  };
+}
+
+function openedReview(output: string): string {
+  const id = /opened review ([0-9a-f]+)/.exec(output)?.[1];
+  if (!id) throw new Error(`no review opened:\n${output}`);
+  return id;
+}
+
+// "published" is recorded before the approving sync pushes main, so a wait
+// for it also waits for that sync to let go of the lock.
+async function waitForReview(
+  main: string,
+  id: string,
+  state: string,
+  env: Record<string, string>,
+  also: (review: Record<string, unknown>) => boolean = () => true,
+): Promise<void> {
+  const locks = path.join(env.SIDECAR_STATE_DIR, "locks");
+  await waitFor(() => {
+    const shown = runSidecarRaw(["review", "show", id, "--json"], main, env);
+    if (shown.status !== 0) return false;
+    const review = JSON.parse(shown.stdout) as Record<string, unknown>;
+    const idle = !fs.existsSync(locks) || fs.readdirSync(locks).length === 0;
+    return review.state === state && idle && also(review);
+  }, 60_000);
+}
+
+function remoteFile(remote: string, file: string): string | undefined {
+  const result = gitRaw(["--git-dir", remote, "show", `main:${file}`], { check: false });
+  return result.status === 0 ? result.stdout : undefined;
+}
+
+function remoteObjectsContain(remote: string, text: string): boolean {
+  const objects = gitRaw(["--git-dir", remote, "rev-list", "--all", "--objects"]).stdout
+    .split("\n").filter(Boolean).map((line) => line.split(" ")[0]);
+  return objects.some((oid) => gitRaw(["--git-dir", remote, "cat-file", "-p", oid]).stdout.includes(text));
+}
+
 function remoteBranches(remote: string): string[] {
   return gitRaw(["--git-dir", remote, "branch", "--format=%(refname:short)"])
     .stdout.split("\n")
diff --git a/packages/sidecar/tests/review.test.ts b/packages/sidecar/tests/review.test.ts
new file mode 100644
index 0000000..0b24922
--- /dev/null
+++ b/packages/sidecar/tests/review.test.ts
@@ -0,0 +1,265 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+
+vi.mock("../src/git.js", async (original) => ({
+  ...await original<typeof import("../src/git.js")>(),
+  git: vi.fn(),
+  gitBytes: vi.fn(),
+  gitCommonDir: vi.fn(),
+  treeOf: vi.fn(),
+}));
+vi.mock("../src/state.js", async (original) => ({
+  ...await original<typeof import("../src/state.js")>(),
+  logSidecarEvent: vi.fn(),
+}));
+
+import { git, gitBytes, gitCommonDir, treeOf } from "../src/git.js";
+import { logSidecarEvent, readSettings, writeSettings } from "../src/state.js";
+import type { SidecarConfig } from "../src/config.js";
+import {
+  type Review,
+  createReview,
+  decideReview,
+  findReview,
+  listReviews,
+  markPublished,
+  markPublishing,
+  markSuperseded,
+  openReview,
+  readReview,
+  reviewAttention,
+} from "../src/review.js";
+
+const config: SidecarConfig = {
+  peer: "default", version: 1, path: "sidecar", remote: "https://bot:hunter2secret@example.com/notes.git", branch: "main",
+  inbox: "sidecar-inbox/{user}/{random}", redaction: "secrets", resolve: "fork", review: "required", reviewTimeout: 3600,
+};
+let directory: string;
+let root: string;
+let numstat = "";
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  numstat = "1\t0\tnotes.md\0";
+  directory = fs.mkdtempSync(path.join(os.tmpdir(), "sidecar-review-"));
+  root = path.join(directory, "repo");
+  fs.mkdirSync(path.join(root, "sidecar", ".git"), { recursive: true });
+  vi.stubEnv("SIDECAR_STATE_DIR", path.join(directory, "state"));
+  vi.mocked(gitCommonDir).mockImplementation((checkout) => path.join(checkout, ".git"));
+  vi.mocked(treeOf).mockReturnValue("tree-oid");
+  vi.mocked(gitBytes).mockReturnValue({ status: 0, stdout: Buffer.from("plain text\n"), stderr: Buffer.alloc(0) });
+  vi.mocked(git).mockImplementation((_repo, args) => {
+    let stdout = "";
+    if (args[0] === "diff-tree" && args.includes("--name-status")) stdout = "M\0notes.md\0A\0plans/q3.md\0";
+    else if (args[0] === "diff-tree" && args.includes("--numstat")) stdout = numstat;
+    else if (args[0] === "diff-tree") stdout = "diff --git a/notes.md b/notes.md\n+a new line\n";
+    else if (args[0] === "ls-tree") stdout = ["100644 blob aaa\tnotes.md", "100644 blob bbb\tplans/q3.md", "160000 commit ccc\tvendor/lib"].join("\x00");
+    return { status: 0, stdout, stderr: "" };
+  });
+});
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+  fs.rmSync(directory, { recursive: true, force: true });
+});
+
+function open(checkout = path.join(root, "sidecar")): Review {
+  return createReview({ root, config, sidecarPath: checkout, base: "base-oid", head: "head-oid" });
+}
+
+function writeRun(review: Review, run: Record<string, unknown>): void {
+  fs.writeFileSync(path.join(review.dir, "run.json"), JSON.stringify(run), "utf8");
+}
+
+function markLaunched(review: Review, secondsAgo: number): void {
+  const record = { ...review.record, launchedAt: new Date(Date.now() - secondsAgo * 1000).toISOString() };
+  fs.writeFileSync(path.join(review.dir, "review.json"), JSON.stringify(record), "utf8");
+}
+
+describe("opening a review", () => {
+  test("writes an owner-only packet with the diff, changed paths, guidelines, and instructions", () => {
+    fs.writeFileSync(path.join(root, ".sidecar-review"), "No customer names.\n", "utf8");
+    const review = open();
+    const { record } = review;
+
+    expect(record).toMatchObject({
+      family: fs.realpathSync(path.join(root, "sidecar", ".git")),
+      base: "base-oid",
+      head: "head-oid",
+      tree: "tree-oid",
+      files: [{ status: "M", path: "notes.md" }, { status: "A", path: "plans/q3.md" }],
+      timeoutSeconds: 3600,
+    });
+    expect(git).toHaveBeenCalledWith(path.join(root, "sidecar"), expect.arrayContaining(["diff-tree", "--ignore-submodules=none", "-p", "base-oid", "head-oid"]));
+    expect(fs.statSync(review.dir).mode & 0o777).toBe(0o700);
+    for (const file of ["review.json", "diff.patch", "instructions.md", "guidelines.md"]) {
+      expect(fs.statSync(path.join(review.dir, file)).mode & 0o777).toBe(0o600);
+    }
+    expect(fs.readFileSync(path.join(review.dir, "diff.patch"), "utf8")).toContain("+a new line");
+    const instructions = fs.readFileSync(path.join(review.dir, "instructions.md"), "utf8");
+    expect(instructions).toContain(`sidecar review approve ${record.id}`);
+    expect(instructions).toContain(`sidecar review reject ${record.id} --reason`);
+    expect(instructions).toContain("No customer names.");
+    // The remote URL is quoted for context; its credentials are not.
+    expect(instructions).not.toContain("hunter2secret");
+    expect(review.state).toBe("pending");
+  });
+
+  test("puts the full content of files the diff cannot show into the packet", () => {
+    numstat = "1\t0\tnotes.md\0-\t-\tplans/q3.md\0";
+    vi.mocked(gitBytes).mockReturnValue({ status: 0, stdout: Buffer.from([0, 1, 2, 0x43]), stderr: Buffer.alloc(0) });
+    const review = open();
+    const opaque = review.record.files.find((file) => file.path === "plans/q3.md")!;
+    expect(opaque.artifact).toBe(path.join("opaque", "0001"));
+    expect(review.record.files.find((file) => file.path === "notes.md")!.artifact).toBeUndefined();
+    expect(gitBytes).toHaveBeenCalledWith(path.join(root, "sidecar"), ["cat-file", "blob", "head-oid:plans/q3.md"]);
+    expect(fs.readFileSync(path.join(review.dir, opaque.artifact!))).toEqual(Buffer.from([0, 1, 2, 0x43]));
+    expect(fs.statSync(path.join(review.dir, opaque.artifact!)).mode & 0o777).toBe(0o600);
+    const instructions = fs.readFileSync(path.join(review.dir, "instructions.md"), "utf8");
+    expect(instructions).toContain("`opaque/0001` — plans/q3.md");
+    expect(instructions).toContain("if you cannot, do not approve");
+  });
+
+  test("treats text that is not UTF-8 as content the diff cannot show", () => {
+    vi.mocked(gitBytes).mockImplementation((_repo, args) => ({
+      status: 0,
+      stdout: String(args.at(-1)).endsWith("plans/q3.md") ? Buffer.from([0xf9, 0xec, 0xe5, 0xed]) : Buffer.from("plain\n"),
+      stderr: Buffer.alloc(0),
+    }));
+    const review = open();
+    expect(review.record.files.find((file) => file.path === "plans/q3.md")!.artifact).toBe(path.join("opaque", "0001"));
+    expect(review.record.files.find((file) => file.path === "notes.md")!.artifact).toBeUndefined();
+  });
+
+  test("says so when the repository has no guidelines", () => {
+    const review = open();
+    expect(fs.existsSync(path.join(review.dir, "guidelines.md"))).toBe(false);
+    expect(fs.readFileSync(path.join(review.dir, "instructions.md"), "utf8")).toContain("has no review guidelines");
+  });
+
+  test("reads a named peer's guidelines from its own file", () => {
+    fs.writeFileSync(path.join(root, ".sidecar-review.notes"), "Notes only.\n", "utf8");
+    fs.writeFileSync(path.join(root, ".sidecar-review"), "Default only.\n", "utf8");
+    const review = createReview({ root, config: { ...config, peer: "notes" }, sidecarPath: path.join(root, "sidecar"), base: "base-oid", head: "head-oid" });
+    expect(fs.readFileSync(path.join(review.dir, "guidelines.md"), "utf8")).toBe("Notes only.\n");
+  });
+});
+
+describe("review state", () => {
+  test("a verdict decides the state, and a rejection's reason stays out of the log", () => {
+    const review = open();
+    decideReview(review, "rejected", "plans/q3.md: an unreleased plan");
+    const reread = readReview(review.record.id)!;
+    expect(reread.state).toBe("rejected");
+    expect(reread.verdict?.reason).toBe("plans/q3.md: an unreleased plan");
+    expect(reviewAttention(reread)).toBe("rejected");
+    expect(logSidecarEvent).toHaveBeenCalledWith("review-decision", { id: review.record.id, verdict: "rejected" });
+    expect(JSON.stringify(vi.mocked(logSidecarEvent).mock.calls)).not.toContain("unreleased");
+  });
+
+  test("a person can override a rejection until the review is published", () => {
+    const review = open();
+    decideReview(review, "rejected");
+    decideReview(review, "approved");
+    expect(readReview(review.record.id)!.state).toBe("approved");
+    markPublished(review, "published-oid");
+    const published = readReview(review.record.id)!;
+    expect(published.state).toBe("published");
+    expect(() => decideReview(published, "rejected")).toThrow(/already published/);
+  });
+
+  test("a reviewer that exits nonzero without a verdict has failed", () => {
+    const review = open();
+    writeRun(review, { pid: process.pid, command: "reviewer", startedAt: "t", finishedAt: "t", exitCode: 2, signal: null });
+    const reread = readReview(review.record.id)!;
+    expect(reread.state).toBe("failed");
+    expect(reviewAttention(reread)).toBe("reviewer exited 2 without a verdict");
+  });
+
+  test("a reviewer that exits zero without a verdict is a review still in progress", () => {
+    writeSettings({ ...readSettings(), reviewer: "reviewer" });
+    const review = open();
+    writeRun(review, { pid: process.pid, command: "reviewer", startedAt: "t", finishedAt: "t", exitCode: 0, signal: null });
+    const reread = readReview(review.record.id)!;
+    expect(reread.state).toBe("pending");
+    expect(reviewAttention(reread)).toBeUndefined();
+  });
+
+  test("a runner that died before finishing has failed", () => {
+    const review = open();
+    writeRun(review, { pid: 999_999, command: "reviewer", startedAt: "t" });
+    const reread = readReview(review.record.id)!;
+    expect(reread.state).toBe("failed");
+    expect(reviewAttention(reread)).toBe("reviewer stopped without a verdict");
+  });
+
+  test("needs attention with no reviewer configured, or once open past its timeout", () => {
+    const review = open();
+    expect(reviewAttention(review)).toBe("no reviewer is configured on this machine");
+    writeSettings({ ...readSettings(), reviewer: "reviewer" });
+    const opened = Date.parse(review.record.createdAt);
+    expect(reviewAttention(review, opened + 3599_000)).toBeUndefined();
+    expect(reviewAttention(review, opened + 3601_000)).toBe("undecided for over 1h");
+  });
+
+  test("a launched reviewer that never records a run has failed once its grace period passes", () => {
+    writeSettings({ ...readSettings(), reviewer: "reviewer" });
+    const review = open();
+    markLaunched(review, 10);
+    expect(readReview(review.record.id)!.state).toBe("pending");
+    markLaunched(review, 120);
+    const reread = readReview(review.record.id)!;
+    expect(reread.state).toBe("failed");
+    expect(reviewAttention(reread)).toBe("reviewer never started");
+  });
+
+  test("once publication has begun, a review can no longer be rejected", () => {
+    const review = open();
+    decideReview(review, "approved");
+    markPublishing(review, "sidecar-inbox/test/abc", "commit-oid");
+    const reread = readReview(review.record.id)!;
+    expect(reread.record.publishing).toEqual({ inbox: "sidecar-inbox/test/abc", commit: "commit-oid" });
+    expect(() => decideReview(reread, "rejected")).toThrow(/already being published/);
+  });
+});
+
+describe("finding reviews", () => {
+  test("a family has one open review: the newest that is neither published nor superseded", () => {
+    const checkout = path.join(root, "sidecar");
+    const first = open();
+    markSuperseded(first);
+    const second = open();
+    const elsewhere = path.join(directory, "other", "sidecar");
+    fs.mkdirSync(path.join(elsewhere, ".git"), { recursive: true });
+    const unrelated = open(elsewhere);
+
+    expect(openReview(checkout)?.record.id).toBe(second.record.id);
+    expect(openReview(elsewhere)?.record.id).toBe(unrelated.record.id);
+    expect(listReviews(checkout).map((review) => review.record.id).sort()).toEqual([first.record.id, second.record.id].sort());
+  });
+
+  test("a sibling checkout of the same family shares its review", () => {
+    const review = open();
+    const sibling = path.join(directory, "sibling", "sidecar");
+    vi.mocked(gitCommonDir).mockImplementation(() => path.join(root, "sidecar", ".git"));
+    expect(openReview(sibling)?.record.id).toBe(review.record.id);
+  });
+
+  test("ids resolve by unambiguous prefix, and never as paths", () => {
+    const review = open();
+    expect(findReview(review.record.id.slice(0, 3)).record.id).toBe(review.record.id);
+    expect(() => findReview("zz")).toThrow(/no review "zz"/);
+    expect(readReview("../state")).toBeUndefined();
+  });
+
+  test("keeps only the ten newest closed reviews per family", () => {
+    const checkout = path.join(root, "sidecar");
+    for (let index = 0; index < 13; index += 1) markSuperseded(open());
+    open();
+    const reviews = listReviews(checkout);
+    expect(reviews.filter((review) => review.state === "superseded")).toHaveLength(10);
+    expect(reviews.filter((review) => review.state === "pending")).toHaveLength(1);
+  });
+});
diff --git a/skills/sidecar/SKILL.md b/skills/sidecar/SKILL.md
index 8975a6f..eefa3a5 100644
--- a/skills/sidecar/SKILL.md
+++ b/skills/sidecar/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: sidecar
-description: Use the sidecarsync CLI to read, update, and synchronize Sidecar notes or state in repos with .sidecar configurations. Covers peer selection, standalone repos, per-file rules, and fork recovery.
+description: Use the sidecarsync CLI to read, update, and synchronize Sidecar notes or state in repos with .sidecar configurations. Covers peer selection, standalone repos, per-file rules, fork recovery, and review-gated publishing.
 ---
 
 # Sidecar
@@ -63,6 +63,20 @@ another machine. If a sync reports a busy lock, allow the active operation to fi
 retrying; do not remove the lock. Report persistent failures with the peer and
 error. Do not use `refresh --force`, `deinit`, reset, or clean as routine retries.
 
+## Review-gated peers
+
+A config with `review = "required"` holds publication until a review approves
+it. A sync that says publishing is held has not published. Report it as held,
+with the review state from `sidecar status --json` (`review.open`). Do not
+approve a review unless you were asked to review it, and never turn review
+off to get a sync through.
+
+When you are the reviewer, the packet is in `$SIDECAR_REVIEW_DIR`; follow
+`$SIDECAR_REVIEW_PROMPT`. Decide with `sidecar review approve ID` or
+`sidecar review reject ID --reason "<file: kind of content>"`. Keep the
+sensitive value out of the reason. If a person should weigh in, decide nothing
+and raise it with them.
+
 ## Policy and recovery
 
 Rules are `.sidecar-rules` for the default peer and `.sidecar-rules.NAME` for