From a9edbbf6e9bc9f38e4bda260b652d6b863f6b9c1 Mon Sep 17 00:00:00 2001
From: Zack Story <2302315+rt2zz@users.noreply.github.com>
Date: Sun, 18 Oct 2026 17:34:02 -0700
Subject: [PATCH 1/3] feat(sync): gate a peer's publishing on review

A peer whose committed .sidecar sets `review = "required"` publishes nothing
until a review approves exactly what would leave the machine. Redaction
catches secrets that look like secrets; a reviewer, usually a coding agent,
catches what pattern matching cannot.

- Gated peers never push local history: each approved review publishes one
  commit of the reviewed tree on the public base it was measured from, and
  the canonical merge is built only from what the remote already holds.
  Local main is never reset and is joined to each publish by a link merge,
  so later edits merge without spurious forks. Reviews are per repo family
  and cover local main, so a rejection holds every sibling worktree.
- Publishing git runs hermetically (withPublicGit): fixed identity, no
  hooks, rerere, signing, push options, replacement objects, or local
  attributes, drivers, and filters. "Already public" comes only from
  sidecar's own refs/sidecar-public fetch.
- Review records and packets live in the state dir. A detached runner
  starts the machine-local reviewer command; verdicts come from
  `sidecar review approve|reject`, taken under the sync lock, so a reviewer
  can hand a review off to a discussion and decide later. Reviews undecided
  past `review-timeout`, rejected, failed, or without a reviewer need
  attention in sync, status, and the health heartbeat, which never carries
  a reason.
- .sidecar parsing is now strict: unknown keys and other versions are
  refused, so a policy key an older CLI doesn't know fails closed.
- Add `sidecar review`, `init --review/--review-timeout`, optional
  `.sidecar-review` guidance, docs/review.md, and tests.
---
 README.md                                  |    5 +
 docs/agents.md                             |   16 +
 docs/commands.md                           |   42 +-
 docs/review.md                             |  237 +++
 docs/rules.md                              |    3 +-
 docs/sync.md                               |    5 +
 packages/sidecar/CLAUDE.md                 |   31 +-
 packages/sidecar/dist/cli.js               | 1759 ++++++++++++++++----
 packages/sidecar/src/cmd-init.ts           |   20 +-
 packages/sidecar/src/cmd-refresh.ts        |  109 +-
 packages/sidecar/src/cmd-review.ts         |  239 +++
 packages/sidecar/src/cmd-status.ts         |   45 +-
 packages/sidecar/src/cmd-sync.ts           |   85 +-
 packages/sidecar/src/commands.ts           |   13 +-
 packages/sidecar/src/config.ts             |   74 +-
 packages/sidecar/src/git.ts                |   19 +-
 packages/sidecar/src/health.ts             |   30 +-
 packages/sidecar/src/install.ts            |   11 +
 packages/sidecar/src/review.ts             |  599 +++++++
 packages/sidecar/src/state.ts              |   37 +-
 packages/sidecar/src/sync.ts               |  599 ++++++-
 packages/sidecar/src/util.ts               |    5 +
 packages/sidecar/tests/cli.test.ts         |   30 +
 packages/sidecar/tests/cmd-sync.test.ts    |    1 +
 packages/sidecar/tests/health.test.ts      |   29 +
 packages/sidecar/tests/integration.test.ts |  159 +-
 packages/sidecar/tests/review.test.ts      |  278 ++++
 skills/sidecar/SKILL.md                    |   16 +-
 28 files changed, 4035 insertions(+), 461 deletions(-)
 create mode 100644 docs/review.md
 create mode 100644 packages/sidecar/src/cmd-review.ts
 create mode 100644 packages/sidecar/src/review.ts
 create mode 100644 packages/sidecar/tests/review.test.ts

diff --git a/README.md b/README.md
index e77822a..ad2adb3 100644
--- a/README.md
+++ b/README.md
@@ -43,6 +43,10 @@ while a background daemon keeps every clone in sync.
 - **Secrets stay home.** Pasted API keys and tokens are redacted from pushes
   while your local files stay untouched; PII redaction is one flag away —
   [how redaction works](docs/redaction.md).
+- **Optional review before publishing.** Turn on `review = "required"` and
+  nothing leaves the machine until a coding agent (or you) approves it, for
+  the sensitive content that pattern matching can't see —
+  [how review works](docs/review.md).
 
 ## Quickstart
 
@@ -102,6 +106,7 @@ Every command acts on all peers unless `--peer` names one —
 - [Peers](docs/sync.md#peers-several-sidecars-in-one-repo) — several sidecars in one repo, one committed and one ignored
 - [Per-file rules](docs/rules.md) — glob-based merge and redaction policy for each peer
 - [Redaction](docs/redaction.md) — what's stripped from pushes and how to review it
+- [Review before publishing](docs/review.md) — gate a peer's pushes on an agent's or your approval
 - [Editor search visibility](docs/editors.md) — making gitignored files searchable
 - [Global vs local installs](docs/install.md) — the newest install wins
 - [All commands](docs/commands.md)
diff --git a/docs/agents.md b/docs/agents.md
index 51148d1..10009b9 100644
--- a/docs/agents.md
+++ b/docs/agents.md
@@ -82,6 +82,22 @@ checkout: let that operation finish before retrying. Repeated failures need
 diagnosis using the reported error, `sidecar status`, `sidecar tail`, or
 `sidecar health`; force-refreshing or removing a lock is not routine recovery.
 
+## When publishing is held for review
+
+A peer with `review = "required"` publishes nothing until a review approves
+it. `sidecar sync` succeeds and says the work is held; that does not mean it
+reached the remote. Report a held sync as held. Check `sidecar status` for the
+review's state, and leave the decision to the reviewer or the person the user
+named.
+
+An agent acting as the reviewer reads the packet it was given (start with
+`$SIDECAR_REVIEW_PROMPT`). It decides with `sidecar review approve <id>` or
+`sidecar review reject <id> --reason "<file: what kind of content>"`, without
+repeating the sensitive value in the reason. When unsure, it leaves the review
+open and asks. It does not approve its own changes to get a handoff through
+faster, and it does not edit `.sidecar` to turn review off. See
+[review.md](review.md).
+
 ## Choose how concurrent work survives
 
 Use separate files for independent handoffs when possible. A single shared
diff --git a/docs/commands.md b/docs/commands.md
index 517988f..5bc98e8 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -16,6 +16,8 @@ sidecar clone              # clone or update the configured sidecar repo
 sidecar refresh            # delete the sidecar checkout and clone it again
 sidecar merge --fork-files # merge inbox branches and preserve conflicts
 sidecar redactions         # preview what redaction changes on the next push
+sidecar review             # list the reviews gating a review-required peer
+sidecar review approve <id>   # publish what a review covers
 sidecar instances          # list known local sidecar checkouts
 sidecar daemon status      # report daemon health, service state, settings paths
 sidecar daemon restart     # restart the background auto-sync process
@@ -51,9 +53,11 @@ repository yet becomes one when a remote is named: `sidecar init <remote>
 | `--inbox <template>` | inbox branch template (default `sidecar-inbox/{user}/{random}`) |
 | `--redaction <mode>` | what gets redacted on push: `secrets+pii`, `secrets`, or `none` — defaults to `secrets`; see [redaction.md](redaction.md) |
 | `--resolve <mode>` | `fork` (default) uses Git's clean merges and preserves conflicting versions as separate files; `lww` keeps the newest whole file without combining contents — see [Conflicts](sync.md#conflicts) |
+| `--review <mode>` | `required` holds everything this peer would publish until a review approves it; `off` (default) — see [review.md](review.md) |
+| `--review-timeout <duration>` | how long a review may sit undecided before it needs attention (default `1h`) |
 | `--debounce <duration>` | this repo's least time between remote round trips once edits land (`90s`, `10m`, `1h`, or seconds); the daemon's `--debounce` otherwise — see [Cadence](sync.md#cadence) |
 | `--interval <duration>` | this repo's most time between round trips while it is quiet, to within one daemon cycle; the daemon's `--interval` otherwise, which is also the floor |
-| `--ignored` | keep this peer out of the tree: its config, rules file, and checkout go in `.git/info/exclude` instead of the committed `.gitignore` |
+| `--ignored` | keep this peer out of the tree: its config, rules file, review guidelines, and checkout go in `.git/info/exclude` instead of the committed `.gitignore` |
 | `--no-clone` | write config and registration only; skip cloning |
 | `--no-bootstrap-main` | don't create the canonical branch on an empty remote |
 | `--local-install` | add `sidecarsync` to `devDependencies` (plus the bun/pnpm trust entry) so fresh clones self-register on install |
@@ -73,8 +77,8 @@ optional prompt defaults to no.
 
 ### `sidecar deinit [--yes] [--peer <name>]`
 
-Removes Sidecar from the current Git repository: the peer's config and rules, the
-configured checkout, Sidecar-owned `.gitignore`, Zed search, and daemon
+Removes Sidecar from the current Git repository: the peer's config, rules, and
+review guidelines, the configured checkout, Sidecar-owned `.gitignore`, Zed search, and daemon
 registry entries. Lines in `.git/info/exclude` are left in place: that file
 is shared by every working copy of the repo, and another may still declare
 the ignored peer. It preserves unrelated settings and does not touch
@@ -128,10 +132,16 @@ the daemon's) holds the repo's sync lock, `sync` fails immediately with
 no-ops and exits 0. That's what the daemon uses, since its next trigger
 retries anyway.
 
+For a peer with [review](review.md) required, the remote phase publishes an
+approved review instead of pushing the inbox, then opens or advances the
+review of whatever is still unpublished. A sync that leaves work held says
+so, and still succeeds: holding is the policy working, not a failure.
+
 ### `sidecar snapshot [--push] [-m|--message <text>] [--peer <name>]`
 
 Commit local sidecar changes to the inbox branch without merging anything.
-`--push` also pushes the inbox branch. Takes the same sync lock as `sync`.
+`--push` also pushes the inbox branch; a peer with review required refuses
+it, since only an approved review publishes. Takes the same sync lock as `sync`.
 
 ### `sidecar merge [--fork-files] [--no-push] [--peer <name>]`
 
@@ -146,6 +156,26 @@ immediately if another operation holds it.
 The peer's [rules file](rules.md) can select `fork` or `lww` per path. A
 mixed merge requires `--fork-files` if any conflicting path uses `fork`.
 
+For a peer with review required, the pushed merge combines only what the
+remote already has — every inbox as published — and local main is rebuilt on
+it; see [review.md](review.md#what-gets-published).
+
+### `sidecar review [<subcommand>] [<id>] [--peer <name>]`
+
+The reviews that gate a peer with `review = "required"`. See
+[review.md](review.md). Where an id is optional, it defaults to the repo's one
+open review.
+
+| command | effect |
+|---|---|
+| `sidecar review [--json]` | this repo's reviews, newest first, with any that need attention |
+| `sidecar review show [<id>] [--json]` | state, reason, changed files, and the diff exactly as it would be published |
+| `sidecar review approve [<id>] [--no-sync]` | approve, then publish it now unless `--no-sync`; also overrides a rejection |
+| `sidecar review reject [<id>] [--reason <text>]` | hold publishing until the content changes |
+| `sidecar review retry [<id>]` | run this machine's reviewer on it again |
+| `sidecar review reviewer [<command>\|--unset]` | show or set this machine's reviewer, a shell command |
+| `sidecar review run <id> <attempt>` | the background runner a sync starts; not for direct use |
+
 ### `sidecar redactions [--peer <name>]`
 
 Preview exactly what redaction changes: a per-file diff of local content
@@ -295,7 +325,7 @@ colored is worth reading:
 | dim | labels, and values that mean "nothing here" (`no`, `none`, `never`) |
 | purple | your repo |
 | yellow | the sidecar — its checkout path and the remote it syncs with |
-| **bold yellow** | something is waiting on you: `dirty: yes`, a pending inbox count, a detached checkout, or a checkout parked off its inbox branch |
+| **bold yellow** | something is waiting on you: `dirty: yes`, a pending inbox count, a detached checkout, a checkout parked off its inbox branch, or a review that needs attention |
 | green | `daemon: running` |
 | red | the daemon should be running and isn't, no global install owns one, or the checkout is missing |
 
@@ -310,6 +340,8 @@ lines together are what a fresh clone sees when its `bun install`/`npm install`
 found no global sidecar to clone for (see [install.md](install.md)).
 `last sync:` comes from the machine-level instance registry and is never colored
 by age: a sidecar only syncs when something changed, so a quiet week is normal.
+A peer with review required adds a `review:` line: the open review, if any,
+and why it needs attention when it does (see [review.md](review.md#needs-attention)).
 
 Color is off automatically when output is not a terminal, so `sidecar status |
 grep dirty` stays clean. `NO_COLOR=1` (or `FORCE_COLOR=0`, or `TERM=dumb`) turns
diff --git a/docs/review.md b/docs/review.md
new file mode 100644
index 0000000..fbb326a
--- /dev/null
+++ b/docs/review.md
@@ -0,0 +1,237 @@
+# Review before publishing
+
+[Redaction](redaction.md) catches secrets that look like secrets. It can't
+tell that a paragraph names a customer, describes an unreleased plan, or
+quotes a private conversation. A peer with review turned on publishes nothing
+until a reviewer — usually a coding agent, sometimes you — approves exactly
+what would leave the machine.
+
+Review is opt-in per peer. Sync on this machine is unaffected: sibling
+checkouts still see each other's edits within seconds. Only publishing to the
+remote waits for review.
+
+## Turning it on
+
+In the peer's committed config:
+
+```toml
+review = "required"
+review-timeout = "1h"   # optional; how long a review may sit undecided (default 1h)
+```
+
+Or `sidecar init <remote> --review required [--review-timeout 30m]`.
+
+Then tell this machine who reviews:
+
+```sh
+sidecar review reviewer "claude-sidecar"   # any shell command
+sidecar review reviewer                     # show it
+sidecar review reviewer --unset
+```
+
+The policy is committed, and the reviewer command is machine-local. A command
+written in `.sidecar` would be one that any clone of the repo could make your
+daemon run. Each person picks their own reviewer: Claude, Codex, a script, or
+none at all. With no reviewer configured, reviews wait for
+`sidecar review approve` and are flagged as needing attention.
+
+Optional guidance for reviewers goes in `.sidecar-review` (or
+`.sidecar-review.<peer>`), beside the config, in plain prose:
+
+```markdown
+This sidecar is shared with contractors. Nothing about customers by name,
+pricing, or hiring.
+```
+
+It's policy, like the [rules file](rules.md): in a nested sidecar it lives in
+the host repo, outside the synced content, and changes go through the same
+review as `.sidecar`.
+
+## What a reviewer gets
+
+When a sync finds unpublished changes, it opens a review and starts the
+reviewer in the background. The sync doesn't wait for it. The reviewer runs
+through `/bin/sh -c` in the review's packet directory, with:
+
+| variable | value |
+|---|---|
+| `SIDECAR_REVIEW_ID` | the review's id |
+| `SIDECAR_REVIEW_DIR` | the packet directory (also the working directory) |
+| `SIDECAR_REVIEW_PROMPT` | `instructions.md`: what to look for and how to decide |
+| `SIDECAR_REVIEW_DIFF` | `diff.patch`: the change exactly as it would be published |
+| `SIDECAR_REVIEW_ROOT`, `SIDECAR_REVIEW_PEER`, `SIDECAR_REVIEW_CONFIG` | which repo and peer |
+
+The packet also holds `review.json` (changed paths, metadata) and
+`guidelines.md` when the repo has guidance. A file the diff can't show — a
+binary, text that isn't UTF-8, or one whose attributes turn diffs off — has
+its complete new content under `opaque/`, and the instructions list each one:
+nothing publishes that isn't in the packet. The diff is of committed content,
+so it is already redacted: secrets redaction caught appear as `<API_KEY>`
+placeholders, never as values. Packets live in sidecar's state dir and only
+your user can read them.
+
+## Deciding
+
+A review is decided by command, never by the reviewer's exit status:
+
+```sh
+sidecar review approve <id>
+sidecar review reject <id> --reason "plans/q3.md: unreleased pricing"
+```
+
+Approving publishes at once (`--no-sync` leaves it to the next sync).
+Rejecting holds publishing until the flagged content changes. The next sync
+then opens a fresh review of the new state. Approving a rejected review
+overrides the rejection. The id can be omitted when the repo has exactly one
+open review.
+
+Decisions wait for the peer's sync lock, so a verdict can never change under a
+sync that is acting on it. Once a sync has begun publishing an approved review,
+it can no longer be rejected.
+
+The exit status says only whether the reviewer itself worked:
+
+- **Exit 0 with a verdict:** decided.
+- **Exit 0 without one:** the review moved somewhere else, such as a thread or
+  a person. It stays open until someone runs `approve` or `reject`.
+- **Nonzero:** the reviewer broke. The review needs attention;
+  `sidecar review retry` runs it again.
+
+That middle case is what makes discussion possible. A reviewer can open a
+thread in your agent tool with the packet, exit, and let the agent there
+decide with you, running the same two commands when you agree.
+
+### Example reviewers
+
+The simplest has the agent read the packet and print a verdict, and a script
+turns that into the command. The agent needs no permission to run anything:
+
+```sh
+#!/bin/sh
+# claude-sidecar — or swap `claude -p` for `codex exec`
+verdict=$(claude -p "$(cat "$SIDECAR_REVIEW_PROMPT")
+
+Do not run any commands. Read diff.patch, then end your reply with one line:
+APPROVE, or REJECT: <file and what kind of content, without repeating it>" | tail -n 1)
+case "$verdict" in
+  APPROVE) exec sidecar review approve "$SIDECAR_REVIEW_ID" ;;
+  REJECT:*) exec sidecar review reject "$SIDECAR_REVIEW_ID" --reason "${verdict#REJECT: }" ;;
+  *) exit 0 ;;  # undecided: leave it open for a person
+esac
+```
+
+A reviewer that hands off instead:
+
+```sh
+#!/bin/sh
+# Open a conversation about the review, then leave it to whoever is in it.
+my-agent-tool new-thread --title "sidecar review $SIDECAR_REVIEW_ID" \
+  --message "$(cat "$SIDECAR_REVIEW_PROMPT")" --cwd "$SIDECAR_REVIEW_DIR"
+```
+
+## Needs attention
+
+A review needs attention when it:
+
+- was rejected
+- has a reviewer that failed or stopped without a verdict
+- has no reviewer on this machine
+- has stayed undecided for longer than `review-timeout`
+
+Attention changes nothing about what's published. It makes the hold visible:
+`sidecar sync` and `sidecar status` say why, and the
+[health heartbeat](commands.md#fleet-health) reports
+`publishing held, review needs attention` to every machine. The heartbeat
+carries the state only, never a rejection's reason: the reason describes what
+was sensitive. For the same reason a gated peer's failure heartbeat names the
+stage that failed but not git's message, which can quote unreviewed file names;
+the details stay in `sidecar tail` on that machine.
+
+```sh
+sidecar review                   # this repo's reviews, newest first
+sidecar review show <id>         # state, reason, changed files, and the diff
+```
+
+## What gets published
+
+A gated peer never pushes its own history. Snapshots stay on this machine,
+along with every intermediate state they recorded, including one that was
+rejected and then fixed. What leaves is one commit per approved review, whose
+tree is exactly what the reviewer saw. Its parent is the public commit the
+review was measured from, so the canonical merge combines only commits the
+remote already has. Its push can't carry anything unreviewed either.
+
+Reviews belong to the repo family, not to one checkout. Linked checkouts of a
+repo share one clone and one local `main` (see
+[One machine, many working copies](sync.md#one-machine-many-working-copies)),
+so they share one review of what that `main` holds. A rejection holds every
+sibling, and two siblings never race the same content to the remote. One
+review is open at a time. Edits made while it's open wait for the next one,
+which covers everything after what was approved.
+
+When the remote has no `main` yet, it starts as an empty commit, never as the
+checkout's history or anything staged in it, and the first review covers
+everything the checkout holds.
+
+Nothing else rides along. Everything sidecar publishes — review commits, the
+canonical merge, the health heartbeat — is built with this checkout's own git
+setup switched off, because none of it is in the packet:
+
+- commits carry `user@host`, the identity the heartbeat already shows, never
+  the checkout's configured or environment git identity; they are never
+  signed and always UTF-8
+- hooks and rerere don't run; attributes come only from sidecar's own
+  redaction setting, so no `.gitattributes` can select a merge driver, filter,
+  or line-ending conversion, and drivers defined in config are replaced by
+  git's own
+- replacement objects (`git replace`) are ignored, so the packet shows the
+  blobs that are really published
+- what counts as already on the remote comes from sidecar's own fetch
+  (`refs/sidecar-public/`), never from `origin/*` refs that other tools can
+  write
+- pushes never follow tags, send no configured push options, and are refused
+  while `remote.origin.pushurl` points somewhere else
+- last-writer-wins clocks are generated by sidecar, never copied from local
+  commit messages
+
+Local merges still use your hooks and drivers; whatever they produce lands in
+local `main` and is reviewed like any other change.
+
+Local `main` is never reset for a gated peer. Each published commit is joined
+to it by a local link merge that records "this is what was published". That
+link keeps your later edits from conflicting with your own published ones. It
+changes no file and is never pushed.
+
+## Limits worth knowing
+
+- **Every machine syncing the peer needs a sidecar that knows about review.**
+  Current versions refuse config keys they don't recognize. Versions from
+  before review existed silently ignore `review = "required"` and push as
+  usual. Update every machine before turning it on.
+- **An agent's judgment is not a guarantee.** Review adds a reader who
+  understands context. It doesn't prove nothing sensitive gets through, and a
+  reviewer can be wrong in either direction.
+- **The reviewer sees the redacted diff, not your working tree.** That keeps
+  caught secrets away from it. It also means what redaction rewrote shows up
+  as placeholders.
+- **Turning review off publishes local history.** The next sync pushes the
+  inbox branch as an ungated peer does, including snapshots that review kept
+  local. Turning it off is a decision about everything still on this machine.
+- **Anything published earlier stays in the remote's history.** Review gates
+  what's published from now on.
+- **In [standalone mode](standalone.md), every writer controls the policy**,
+  including turning review off.
+- **Review guards against mistakes, not against someone at the keyboard.**
+  Anyone who can run commands as you can push directly, edit `.sidecar`,
+  approve a review, or change the records in the state dir.
+- **Some metadata publishes without review.** The health heartbeat (machine
+  `user@host`, the checkout's absolute path, peer, inbox name, sidecar
+  version, sync status and timestamps) and the empty initial commit of a new
+  remote are sidecar's own and go out before any review.
+- **Reviewers must read the whole packet.** Files listed under `opaque/` are
+  part of what an approval publishes; `diff.patch` alone does not show them.
+- **Pushes follow your git's routing for the remote.** `url.*.insteadOf`
+  rewrites still apply — they are how many setups authenticate — so they
+  decide where "the remote" is.
+- **Path names must be UTF-8.** A changed path that isn't fails the review
+  rather than publishing unseen.
diff --git a/docs/rules.md b/docs/rules.md
index 280f865..6ed975e 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -90,7 +90,8 @@ shared ignore entries remain in place for other working copies.
 ## Who controls policy
 
 In a nested sidecar, the rules live in the host repo beside its config,
-outside the checkout that Sidecar syncs. A `.sidecar-rules` file arriving
+outside the checkout that Sidecar syncs. So does a peer's review guidance,
+`.sidecar-review` or `.sidecar-review.<name>` (see [review.md](review.md)). A `.sidecar-rules` file arriving
 inside that checkout does not override the host policy. Review host policy
 changes through the same process as changes to `.sidecar`.
 
diff --git a/docs/sync.md b/docs/sync.md
index 7e269e3..6e6b7c9 100644
--- a/docs/sync.md
+++ b/docs/sync.md
@@ -46,6 +46,11 @@ everything a commit every minute would, at a hundredth of the history.
 
 ## Inbox branches and conflict-free merging
 
+(A peer with [review](review.md) required differs in one way: it never
+pushes its inbox history, only one commit per approved review, and the
+canonical merge combines only what the remote already has. See
+[What gets published](review.md#what-gets-published).)
+
 Each sync snapshots local changes onto a per-machine inbox branch and pushes
 it, then merges all inbox branches into the canonical branch and pushes that.
 Because every machine writes only to its own inbox, a sync never stops you to
diff --git a/packages/sidecar/CLAUDE.md b/packages/sidecar/CLAUDE.md
index 2b80ae7..e5cfa66 100644
--- a/packages/sidecar/CLAUDE.md
+++ b/packages/sidecar/CLAUDE.md
@@ -16,8 +16,10 @@ automatically by `export *`.
 - `state.ts` — machine-local state dir: settings.json, instances.json registry, event log, per-family sync lock.
 - `service.ts` — OS service wrapper for the daemon (launchd/systemd/Startup), pid liveness. The loop itself is `daemon.ts`.
 - `ui.ts` — label/value output rows, human timestamps, blocking TTY prompts.
+- `review.ts` — the review gate's records and packets (machine-local, in the state dir), the detached reviewer runner, and review state. The publishing it gates lives in `sync.ts`.
 - `sync.ts` — the engine: snapshot, inbox merge + conflict forking, clone/settle, redaction filter wiring, health heartbeat.
 - `cmd-init.ts` / `cmd-status.ts` / `cmd-daemon.ts` / `cmd-sync.ts` — command handlers, thin over the modules above.
+- `cmd-review.ts` — `sidecar review`: list, show, decide, retry, set the machine's reviewer, and the `review run` runner entry.
 - `cmd-refresh.ts` — the exception to "thin": `sidecar refresh` owns its own engine code, because it is the only path that deletes a checkout and the guards keeping that safe belong next to it rather than beside the clone/settle functions they resemble.
 - `commands.ts` — the COMMANDS table + dispatch. **Adding a command = one table entry here plus a handler in a cmd-\*.ts**; usage text and typo suggestions derive from the table.
 - `bin.ts` — entry point; resolves which install runs the command (newest wins between global and project-local) before `main()` does any work.
@@ -58,11 +60,38 @@ automatically by `export *`.
   and is how a `(root, config)` pair knows which file it came from. A command
   fans out over `loadPeers(selectedPeer(parsed))`; the daemon names the peer
   through `SIDECAR_PEER`, an env var like every other request it makes.
+- **Review gating.** A peer with `review = "required"` never pushes local
+  history: only one commit per approved review, whose tree is the reviewed
+  tree, and canonical merges built from public refs alone
+  (`mergePublishedInboxes`). Never route a gated peer through
+  `syncBranchBeforePush`/`pushBranch` or push local main. Reviews are per repo
+  family and cover local main, which a gated peer never resets (each publish
+  is joined to it by a link merge — dropping links brings back spurious
+  forks). The reviewer command is machine-local (`settings.json`), never read
+  from committed config. Review reasons stay out of logs and heartbeats, and
+  so do a gated peer's git failure messages (they quote unreviewed paths).
+  Verdicts change only under the peer's sync lock; runners write only their
+  own attempt's file. Anything a publish commit carries beyond the reviewed
+  tree is sidecar-generated, never copied from local commit messages.
+- **Public git.** Every git operation that builds or sends what a gated peer
+  publishes — and every health heartbeat, including reading the previous one —
+  runs under `withPublicGit`, which replaces all injected config and fixes
+  identity, encoding, hooks, rerere, signing, push options, replacement
+  objects, and attributes (`GIT_ATTR_SOURCE` = empty tree). Reviewers launch
+  outside it. "Already public" means `refs/sidecar-public/*`, written only by
+  `fetchPublic` inside the wrapper, never `origin/*`; a push does not move
+  them, so refetch after any push a later step measures from. Every push passes
+  `--no-follow-tags`. Gated bootstrap uses plumbing (empty tree), never the
+  index. Packet enumeration uses `diff-tree` with explicit options, never
+  porcelain `git diff`, whose config can hide paths.
+- **Strict config.** `readConfig` refuses unknown keys and other versions, so
+  a policy key an older CLI doesn't know fails closed. A new `.sidecar` key
+  goes in `CONFIG_KEYS`.
 
 ## Build & test
 
 - `bun run build` bundles `src/bin.ts` into the single committed `dist/cli.js`;
-  `import.meta.url` tricks (`redactCliPath`, `packageVersion`) resolve against
+  `import.meta.url` tricks (`sidecarCliPath`, `packageVersion`) resolve against
   that bundle at runtime, so keep the one-file output.
 - `bun run check` typechecks. `bun run test` is the fast suite and does not
   build or spawn the real CLI. `bun run test:integration` rebuilds `dist` and
diff --git a/packages/sidecar/dist/cli.js b/packages/sidecar/dist/cli.js
index 9557a92..199ab8f 100755
--- a/packages/sidecar/dist/cli.js
+++ b/packages/sidecar/dist/cli.js
@@ -196,6 +196,9 @@ function currentUser() {
 function currentHost() {
   return os.hostname().split(".", 1)[0] || "unknown";
 }
+function currentMachine() {
+  return `${currentUser()}@${currentHost()}`;
+}
 function parseDuration(value) {
   if (typeof value === "number")
     return Number.isFinite(value) && value >= 0 ? value : undefined;
@@ -229,6 +232,10 @@ import os2 from "node:os";
 import path2 from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+function sidecarCliPath() {
+  const self = fileURLToPath(import.meta.url);
+  return self.endsWith(".ts") ? path2.join(path2.dirname(self), "..", "dist", "cli.js") : self;
+}
 function packageVersion() {
   let current = path2.dirname(fileURLToPath(import.meta.url));
   while (true) {
@@ -380,6 +387,12 @@ function remoteRefExists(repo, branch) {
 function isAncestor(repo, maybeAncestor, descendant) {
   return git(repo, ["merge-base", "--is-ancestor", maybeAncestor, descendant], { check: false }).status === 0;
 }
+function treeOf(repo, ref) {
+  return git(repo, ["rev-parse", `${ref}^{tree}`]).stdout.trim();
+}
+function emptyTree(repo) {
+  return git(repo, ["mktree"], { input: "" }).stdout.trim();
+}
 function gitToplevel(cwd) {
   const root = gitToplevelOptional(cwd);
   if (!root)
@@ -428,12 +441,16 @@ function ensureClean(repo) {
   if (isDirty(repo))
     throw new SidecarError("sidecar checkout has uncommitted changes");
 }
+function sidecarIdentity() {
+  return { name: currentUser(), email: `${slug(currentUser())}@${slug(currentHost())}.local` };
+}
 function ensureCommitIdentity(repo) {
+  const { name, email } = sidecarIdentity();
   if (git(repo, ["config", "user.name"], { check: false }).status !== 0) {
-    git(repo, ["config", "user.name", currentUser()]);
+    git(repo, ["config", "user.name", name]);
   }
   if (git(repo, ["config", "user.email"], { check: false }).status !== 0) {
-    git(repo, ["config", "user.email", `${slug(currentUser())}@${slug(currentHost())}.local`]);
+    git(repo, ["config", "user.email", email]);
   }
 }
 function familyPrimaryRoot(root) {
@@ -1582,7 +1599,8 @@ function parseHealthRecord(text) {
     lastFailureAt: typeof record.lastFailureAt === "string" ? record.lastFailureAt : undefined,
     consecutiveFailures: typeof record.consecutiveFailures === "number" && Number.isFinite(record.consecutiveFailures) ? record.consecutiveFailures : 0,
     stage: typeof record.stage === "string" ? record.stage : undefined,
-    message: typeof record.message === "string" ? record.message : undefined
+    message: typeof record.message === "string" ? record.message : undefined,
+    review: record.review === "pending" || record.review === "attention" ? record.review : undefined
   };
 }
 function serializeHealthRecord(record) {
@@ -1595,24 +1613,27 @@ function nextHealthRecord(previous, identity, outcome, now) {
     ...identity,
     status: outcome.status,
     updatedAt: now,
-    lastSuccessAt: previous?.lastSuccessAt,
-    lastFailureAt: previous?.lastFailureAt,
+    lastSuccessAt: isoTimestamp(previous?.lastSuccessAt),
+    lastFailureAt: isoTimestamp(previous?.lastFailureAt),
     consecutiveFailures: 0
   };
   if (outcome.status === "ok")
-    return { ...base, lastSuccessAt: now };
+    return { ...base, lastSuccessAt: now, ...outcome.review ? { review: outcome.review } : {} };
   return {
     ...base,
     lastFailureAt: now,
-    consecutiveFailures: (previous?.consecutiveFailures ?? 0) + 1,
+    consecutiveFailures: Math.max(0, Math.floor(previous?.consecutiveFailures ?? 0)) + 1,
     stage: outcome.stage,
     message: redactText(outcome.message).trim().slice(-MESSAGE_LIMIT)
   };
 }
+function isoTimestamp(value) {
+  return value && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/.test(value) ? value : undefined;
+}
 function shouldPublishHealth(previous, next, now = Date.now()) {
   if (!previous)
     return true;
-  if (next.status === "failed" || previous.status !== next.status)
+  if (next.status === "failed" || previous.status !== next.status || previous.review !== next.review)
     return true;
   const last = Date.parse(previous.updatedAt);
   if (!Number.isFinite(last))
@@ -3538,6 +3559,12 @@ function ensureDistinctCheckouts(peers) {
 function sameRemoteKey(remote) {
   return remote.trim().replace(/\/+$/, "").replace(/\.git$/, "");
 }
+function reviewRequired(config) {
+  return config.review === "required";
+}
+function reviewTimeoutSeconds(config) {
+  return config.reviewTimeout ?? DEFAULT_REVIEW_TIMEOUT_SECONDS;
+}
 function findConfigRoot(start) {
   const root = findConfigRootOptional(start);
   if (root)
@@ -3566,6 +3593,8 @@ function writeConfig(configPath, config) {
     `resolve = ${JSON.stringify(config.resolve ?? DEFAULT_RESOLVE)}`,
     ...config.debounce === undefined ? [] : [`debounce = ${config.debounce}`],
     ...config.interval === undefined ? [] : [`interval = ${config.interval}`],
+    ...reviewRequired(config) ? [`review = "required"`] : [],
+    ...config.reviewTimeout === undefined ? [] : [`review-timeout = ${config.reviewTimeout}`],
     ""
   ].join(`
 `);
@@ -3584,6 +3613,14 @@ function readConfig(configPath, options = {}) {
       throw error;
     throw new SidecarError(`${configPath} is not valid TOML: ${error instanceof Error ? error.message : String(error)}`);
   }
+  const unknown = Object.keys(values).filter((key) => !CONFIG_KEYS.has(key));
+  if (unknown.length) {
+    throw new SidecarError(`${configPath}: unknown key${unknown.length > 1 ? "s" : ""} ${unknown.map((key) => JSON.stringify(key)).join(", ")}; this sidecar may be older than the config — update it with \`sidecar update\``);
+  }
+  const version = numberConfigValue(configPath, values, "version", CONFIG_VERSION);
+  if (version !== CONFIG_VERSION) {
+    throw new SidecarError(`${configPath}: config version ${version} is not supported by this sidecar (expected ${CONFIG_VERSION}); update it with \`sidecar update\``);
+  }
   const remote = optionalStringConfigValue(configPath, values, "remote");
   if (!remote)
     throw new SidecarError(`${configPath} is missing remote`);
@@ -3592,7 +3629,7 @@ function readConfig(configPath, options = {}) {
   const config = {
     peer,
     remote,
-    version: numberConfigValue(configPath, values, "version", 1),
+    version,
     path: stringConfigValue(configPath, values, "path", DEFAULT_PATH),
     branch: stringConfigValue(configPath, values, "branch", DEFAULT_BRANCH),
     inbox: stringConfigValue(configPath, values, "inbox", DEFAULT_INBOX),
@@ -3600,6 +3637,8 @@ function readConfig(configPath, options = {}) {
     resolve: resolveModeConfigValue(stringConfigValue(configPath, values, "resolve", DEFAULT_RESOLVE), configPath),
     debounce: durationConfigValue(values.debounce, `${configPath} debounce`),
     interval: durationConfigValue(values.interval, `${configPath} interval`),
+    review: reviewModeConfigValue(stringConfigValue(configPath, values, "review", "off"), configPath),
+    reviewTimeout: durationConfigValue(values["review-timeout"], `${configPath} review-timeout`),
     rules: options.loadRules === false ? undefined : readRules(rulesPath),
     rulesPath
   };
@@ -3616,6 +3655,11 @@ function redactionModeConfigValue(value, source) {
     return value;
   throw new SidecarError(`${source}: invalid redaction mode ${JSON.stringify(value)}; expected one of ${REDACTION_MODES.join(", ")}`);
 }
+function reviewModeConfigValue(value, source) {
+  if (REVIEW_MODES.includes(value))
+    return value;
+  throw new SidecarError(`${source}: invalid review mode ${JSON.stringify(value)}; expected one of ${REVIEW_MODES.join(", ")}`);
+}
 function durationConfigValue(value, source) {
   if (value === undefined)
     return;
@@ -3736,6 +3780,8 @@ function inboxPrefix(config) {
   return inboxBranchPrefix(config.inbox);
 }
 function remoteBranchName(remoteBranch) {
+  if (remoteBranch.startsWith(PUBLIC_REFS))
+    return remoteBranch.slice(PUBLIC_REFS.length);
   return remoteBranch.startsWith("origin/") ? remoteBranch.slice("origin/".length) : remoteBranch;
 }
 function matchesInboxPrefix(prefix, branch) {
@@ -3749,7 +3795,7 @@ function inboxBranchPrefix(template) {
   const slashIndex = staticPrefix.lastIndexOf("/");
   return slashIndex === -1 ? staticPrefix : staticPrefix.slice(0, slashIndex + 1);
 }
-var DEFAULT_PATH = "sidecar", DEFAULT_BRANCH = "main", DEFAULT_INBOX = "sidecar-inbox/{user}/{random}", branchValidity, DEFAULT_PEER = "default", PEER_ENV = "SIDECAR_PEER", PEER_NAME, RESERVED_PEER_SUFFIXES, RESOLVE_MODES, DEFAULT_RESOLVE = "fork";
+var DEFAULT_PATH = "sidecar", DEFAULT_BRANCH = "main", DEFAULT_INBOX = "sidecar-inbox/{user}/{random}", branchValidity, DEFAULT_PEER = "default", PEER_ENV = "SIDECAR_PEER", SOFT_SYNC_ENV = "SIDECAR_SYNC_SOFT", LOCAL_SYNC_ENV = "SIDECAR_SYNC_LOCAL", PEER_NAME, RESERVED_PEER_SUFFIXES, RESOLVE_MODES, DEFAULT_RESOLVE = "fork", REVIEW_MODES, DEFAULT_REVIEW_TIMEOUT_SECONDS, CONFIG_VERSION = 1, CONFIG_KEYS, PUBLIC_REFS = "refs/sidecar-public/";
 var init_config = __esm(() => {
   init_dist();
   init_util();
@@ -3761,6 +3807,21 @@ var init_config = __esm(() => {
   PEER_NAME = /^[a-z0-9][a-z0-9-]*$/;
   RESERVED_PEER_SUFFIXES = new Set(["swp", "swo", "swx", "bak", "orig", "rej", "tmp", "old", "example", "sample", "lock"]);
   RESOLVE_MODES = ["fork", "lww"];
+  REVIEW_MODES = ["off", "required"];
+  DEFAULT_REVIEW_TIMEOUT_SECONDS = 60 * 60;
+  CONFIG_KEYS = new Set([
+    "version",
+    "remote",
+    "path",
+    "branch",
+    "inbox",
+    "redaction",
+    "resolve",
+    "debounce",
+    "interval",
+    "review",
+    "review-timeout"
+  ]);
 });
 
 // src/state.ts
@@ -3803,7 +3864,8 @@ function readSettings() {
       daemonEnabled: typeof record.daemonEnabled === "boolean" ? record.daemonEnabled : true,
       autoUpdate: typeof record.autoUpdate === "boolean" ? record.autoUpdate : true,
       lastUpdateCheckAt: typeof record.lastUpdateCheckAt === "string" ? record.lastUpdateCheckAt : undefined,
-      installSource: INSTALL_SOURCES.has(record.installSource) ? record.installSource : undefined
+      installSource: INSTALL_SOURCES.has(record.installSource) ? record.installSource : undefined,
+      reviewer: typeof record.reviewer === "string" && record.reviewer.trim() ? record.reviewer : undefined
     };
   } catch (error) {
     logSidecarEvent("failure", {
@@ -3823,6 +3885,8 @@ function writeSettings(settings) {
     record.lastUpdateCheckAt = settings.lastUpdateCheckAt;
   if (settings.installSource)
     record.installSource = settings.installSource;
+  if (settings.reviewer)
+    record.reviewer = settings.reviewer;
   fs6.writeFileSync(settingsPath(), `${JSON.stringify(record, null, 2)}
 `, "utf8");
 }
@@ -4073,8 +4137,21 @@ function acquireSyncLockOrThrow(root, peer) {
     return release;
   throw new SidecarError("another sidecar sync is already running; try again once it finishes");
 }
+function acquireSyncLockWaiting(root, peer) {
+  const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  const deadline = Date.now() + SYNC_LOCK_WAIT_MS;
+  while (true) {
+    const release = acquireSyncLock(root, peer);
+    if (release)
+      return release;
+    if (Date.now() >= deadline) {
+      throw new SidecarError("another sidecar sync is still running; try again once it finishes");
+    }
+    Atomics.wait(sleeper, 0, 0, 250);
+  }
+}
 function withSyncLock(root, peer, onBusy, fn) {
-  const releaseLock = onBusy === "skip" ? acquireSyncLock(root, peer) : acquireSyncLockOrThrow(root, peer);
+  const releaseLock = onBusy === "skip" ? acquireSyncLock(root, peer) : onBusy === "wait" ? acquireSyncLockWaiting(root, peer) : acquireSyncLockOrThrow(root, peer);
   if (!releaseLock) {
     console.log("another sidecar sync is already running; skipping this soft sync");
     return false;
@@ -4106,7 +4183,7 @@ function syncLockIsStale(lockDir) {
     return error.code !== "EPERM";
   }
 }
-var STATE_DIR_ENV = "SIDECAR_STATE_DIR", DEFAULT_SETTINGS, LOG_ROTATE_BYTES;
+var STATE_DIR_ENV = "SIDECAR_STATE_DIR", DEFAULT_SETTINGS, LOG_ROTATE_BYTES, SYNC_LOCK_WAIT_MS;
 var init_state = __esm(() => {
   init_util();
   init_git();
@@ -4115,6 +4192,7 @@ var init_state = __esm(() => {
   init_redaction();
   DEFAULT_SETTINGS = { daemonEnabled: true, autoUpdate: true };
   LOG_ROTATE_BYTES = 5 * 1024 * 1024;
+  SYNC_LOCK_WAIT_MS = 10 * 60 * 1000;
 });
 
 // src/service.ts
@@ -4415,12 +4493,413 @@ var init_service = __esm(() => {
   init_state();
 });
 
-// src/sync.ts
+// src/review.ts
 import crypto4 from "node:crypto";
 import fs8 from "node:fs";
-import os5 from "node:os";
 import path8 from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { spawn as spawn2, spawnSync as spawnSync4 } from "node:child_process";
+function newId() {
+  return crypto4.randomBytes(4).toString("hex");
+}
+function reviewsDir() {
+  return path8.join(sidecarStateDir(), "reviews");
+}
+function reviewDir(id) {
+  return path8.join(reviewsDir(), id);
+}
+function writePrivateFile(filePath, text) {
+  const temporary = `${filePath}.${crypto4.randomUUID()}.tmp`;
+  try {
+    fs8.writeFileSync(temporary, text, { encoding: "utf8", mode: 384 });
+    fs8.renameSync(temporary, filePath);
+  } finally {
+    fs8.rmSync(temporary, { force: true });
+  }
+}
+function writePrivateJson(filePath, value) {
+  writePrivateFile(filePath, `${JSON.stringify(value, null, 2)}
+`);
+}
+function readJson(filePath) {
+  try {
+    return JSON.parse(fs8.readFileSync(filePath, "utf8"));
+  } catch {
+    return;
+  }
+}
+function readReview(id) {
+  if (!ID_PATTERN.test(id))
+    return;
+  const dir = reviewDir(id);
+  const record = readJson(path8.join(dir, "review.json"));
+  if (!record || record.id !== id)
+    return;
+  const verdict = readJson(path8.join(dir, "verdict.json"));
+  const attempt = currentAttempt(dir);
+  const run = attempt ? readJson(runPath(dir, attempt)) : undefined;
+  return { record, verdict, run, state: reviewState(record, verdict, run), dir };
+}
+function currentAttempt(dir) {
+  try {
+    const attempt = fs8.readFileSync(path8.join(dir, "attempt"), "utf8").trim();
+    return ID_PATTERN.test(attempt) ? attempt : undefined;
+  } catch {
+    return;
+  }
+}
+function runPath(dir, attempt) {
+  return path8.join(dir, `run-${attempt}.json`);
+}
+function reviewFamily(sidecarPath) {
+  return realpathOr(gitCommonDir(sidecarPath));
+}
+function listReviews(sidecarPath) {
+  let ids;
+  try {
+    ids = fs8.readdirSync(reviewsDir());
+  } catch {
+    return [];
+  }
+  const family = sidecarPath === undefined ? undefined : reviewFamily(sidecarPath);
+  return ids.map(readReview).filter((review) => review !== undefined).filter((review) => family === undefined || review.record.family === family).sort((left, right) => right.record.createdAt.localeCompare(left.record.createdAt) || right.record.id.localeCompare(left.record.id));
+}
+function findReview(idOrPrefix) {
+  const exact = readReview(idOrPrefix);
+  if (exact)
+    return exact;
+  const matches = listReviews().filter((review) => review.record.id.startsWith(idOrPrefix));
+  if (matches.length === 1)
+    return matches[0];
+  if (matches.length > 1)
+    throw new SidecarError(`review id ${JSON.stringify(idOrPrefix)} is ambiguous; use more of it`);
+  throw new SidecarError(`no review ${JSON.stringify(idOrPrefix)} on this machine`);
+}
+function isOpen(review) {
+  return review.state !== "published" && review.state !== "superseded";
+}
+function assertOpen(review) {
+  if (!isOpen(review))
+    throw new SidecarError(`review ${review.record.id} is already ${review.state}`);
+}
+function openReview(sidecarPath) {
+  return listReviews(sidecarPath).find(isOpen);
+}
+function reviewState(record, verdict, run) {
+  if (record.publishedAt)
+    return "published";
+  if (record.supersededAt)
+    return "superseded";
+  if (verdict)
+    return verdict.verdict;
+  if (run?.finishedAt && run.exitCode !== 0)
+    return "failed";
+  if (run && !run.finishedAt && !pidAlive(run.pid))
+    return "failed";
+  return "pending";
+}
+function pidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function reviewAttention(review, now = Date.now()) {
+  if (review.state === "rejected")
+    return "rejected";
+  if (review.state === "failed") {
+    const run = review.run;
+    if (run?.finishedAt) {
+      return run.signal ? `reviewer stopped by ${run.signal} without a verdict` : `reviewer exited ${run.exitCode} without a verdict`;
+    }
+    return "reviewer stopped without a verdict";
+  }
+  if (review.state !== "pending")
+    return;
+  if (!review.run && !readSettings().reviewer)
+    return "no reviewer is configured on this machine";
+  const age = (now - Date.parse(review.record.createdAt)) / 1000;
+  if (age > review.record.timeoutSeconds)
+    return `undecided for over ${formatDuration(review.record.timeoutSeconds)}`;
+  return;
+}
+function formatDuration(seconds) {
+  if (seconds >= 3600 && seconds % 3600 === 0)
+    return `${seconds / 3600}h`;
+  if (seconds >= 60 && seconds % 60 === 0)
+    return `${seconds / 60}m`;
+  return `${Math.round(seconds)}s`;
+}
+function peerReviewGuidelinesFileName(name) {
+  return name === DEFAULT_PEER ? ".sidecar-review" : `.sidecar-review.${name}`;
+}
+function peerReviewGuidelinesPath(root, name) {
+  return path8.join(root, peerReviewGuidelinesFileName(name));
+}
+function readGuidelines(root, peer) {
+  try {
+    const text = fs8.readFileSync(peerReviewGuidelinesPath(root, peer), "utf8").trim();
+    return text || undefined;
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw new SidecarError(`could not read ${peerReviewGuidelinesPath(root, peer)}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function createReview(options) {
+  const { root, config, sidecarPath, base, head } = options;
+  const guidelines = readGuidelines(root, config.peer);
+  const id = newId();
+  const dir = reviewDir(id);
+  fs8.mkdirSync(reviewsDir(), { recursive: true, mode: 448 });
+  fs8.mkdirSync(dir, { mode: 448 });
+  const from = base ?? emptyTree(sidecarPath);
+  const fields = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--name-status", "-z", from, head]).stdout.split("\x00").filter(Boolean);
+  const files = [];
+  for (let index = 0;index + 1 < fields.length; index += 2)
+    files.push({ status: fields[index], path: fields[index + 1] });
+  writeOpaqueArtifacts(sidecarPath, dir, from, head, files);
+  const diff = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "-p", "--no-color", "--no-ext-diff", "--no-textconv", from, head]).stdout;
+  const record = {
+    schema: REVIEW_SCHEMA,
+    id,
+    family: reviewFamily(sidecarPath),
+    root,
+    peer: config.peer,
+    ...base ? { base } : {},
+    head,
+    tree: treeOf(sidecarPath, head),
+    files,
+    createdAt: nowIso(),
+    timeoutSeconds: reviewTimeoutSeconds(config)
+  };
+  writePrivateFile(path8.join(dir, "diff.patch"), diff);
+  if (guidelines)
+    writePrivateFile(path8.join(dir, "guidelines.md"), `${guidelines}
+`);
+  writePrivateFile(path8.join(dir, "instructions.md"), reviewInstructions(record, config, guidelines));
+  writePrivateJson(path8.join(dir, "review.json"), record);
+  logSidecarEvent("review-open", { id, root, peer: config.peer, files: files.length });
+  pruneClosedReviews(sidecarPath);
+  return { record, state: "pending", dir };
+}
+function writeOpaqueArtifacts(repo, dir, from, head, files) {
+  const binary = new Set(git(repo, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--numstat", "-z", from, head]).stdout.split("\x00").filter((entry) => entry.startsWith("-\t-\t")).map((entry) => entry.slice("-\t-\t".length)));
+  const blobs = new Set(git(repo, ["ls-tree", "-r", "-z", "--full-tree", head]).stdout.split("\x00").filter((entry) => entry.split(" ")[1] === "blob").map((entry) => entry.slice(entry.indexOf("\t") + 1)));
+  const utf8 = new TextDecoder("utf-8", { fatal: true });
+  const isText = (blob) => {
+    try {
+      utf8.decode(blob);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  let count = 0;
+  for (const file of files) {
+    if (file.status === "D" || !blobs.has(file.path))
+      continue;
+    const blob = gitBytes(repo, ["cat-file", "blob", `${head}:${file.path}`]).stdout;
+    if (!binary.has(file.path) && isText(blob))
+      continue;
+    count += 1;
+    file.artifact = path8.join("opaque", String(count).padStart(4, "0"));
+    fs8.mkdirSync(path8.join(dir, "opaque"), { recursive: true, mode: 448 });
+    fs8.writeFileSync(path8.join(dir, file.artifact), blob, { mode: 384 });
+  }
+}
+function updateRecord(review, change) {
+  const record = { ...review.record, ...change };
+  writePrivateJson(path8.join(review.dir, "review.json"), record);
+  review.record = record;
+}
+function markPublishing(review, inbox, commit) {
+  updateRecord(review, { publishing: { inbox, commit } });
+}
+function markPublished(review, commit) {
+  updateRecord(review, { publishedAt: nowIso(), publishedCommit: commit });
+  logSidecarEvent("review-published", { id: review.record.id, commit });
+}
+function markSuperseded(review) {
+  updateRecord(review, { supersededAt: nowIso() });
+  logSidecarEvent("review-superseded", { id: review.record.id });
+}
+function pruneClosedReviews(sidecarPath) {
+  const closed = listReviews(sidecarPath).filter((review) => !isOpen(review));
+  for (const review of closed.slice(KEEP_CLOSED_REVIEWS)) {
+    fs8.rmSync(review.dir, { recursive: true, force: true });
+  }
+}
+function pruneOrphanedReviews() {
+  for (const review of listReviews()) {
+    if (!fs8.existsSync(review.record.family))
+      fs8.rmSync(review.dir, { recursive: true, force: true });
+  }
+}
+function opaqueSection(record) {
+  const opaque = record.files.filter((file) => file.artifact);
+  if (!opaque.length)
+    return "";
+  return `
+These files' content does not appear faithfully in \`diff.patch\` (binary, not
+UTF-8, or diffs turned off). Their complete new content, as it would be
+published, is in the packet.
+Inspect each one; if you cannot, do not approve:
+
+${opaque.map((file) => `- \`${file.artifact}\` — ${file.path}`).join(`
+`)}
+`;
+}
+function reviewInstructions(record, config, guidelines) {
+  return `# Sidecar publish review ${record.id}
+
+A sidecar is a scratchpad repository that syncs automatically to a shared Git
+remote (${redactText(config.remote)}). This machine wants to publish the change in
+\`diff.patch\`. Everyone with access to that remote can read what you approve,
+and it stays in the remote's history.
+
+Decide whether anything in the change should not leave this machine. This is
+not a code review: ignore quality, style, and correctness.
+
+Secret redaction has already run. Values it caught appear as placeholders such
+as \`<API_KEY>\`, \`<TOKEN>\`, or \`<SECRET>\`; they are not leaks. Look for what
+pattern matching misses:
+
+- credentials in unusual formats, or ones split across lines
+- personal data about real people: contact details, health, finances, private conversations
+- confidential material: customer names and data, unreleased plans, internal-only details
+- anything the repository's guidelines below rule out
+
+## Files
+
+All in this directory (\`$SIDECAR_REVIEW_DIR\`):
+
+- \`diff.patch\` — the change exactly as it would be published
+- \`review.json\` — the repository, peer, and changed paths
+${guidelines ? "- `guidelines.md` — this repository's guidelines, repeated below\n" : ""}${opaqueSection(record)}
+## Guidelines
+
+${guidelines ?? "This repository has no review guidelines (`.sidecar-review` beside its `.sidecar`)."}
+
+## Decide
+
+Approve, and the change is published on the next sync:
+
+    sidecar review approve ${record.id}
+
+Reject, saying which file and what kind of content. Do not repeat the
+sensitive value itself:
+
+    sidecar review reject ${record.id} --reason "<file: what kind of content>"
+
+If you are unsure, or a person should weigh in, do neither: leave the review
+open and raise it with them. Nothing is published until someone approves, and
+they decide with the same two commands.
+`;
+}
+function configuredReviewer() {
+  const command = readSettings().reviewer;
+  if (!command)
+    throw new SidecarError("no reviewer is configured; set one with `sidecar review reviewer <command>`");
+  return command;
+}
+function launchReviewer(review) {
+  const attempt = newId();
+  writePrivateFile(path8.join(review.dir, "attempt"), `${attempt}
+`);
+  review.run = undefined;
+  const child = spawn2(process.execPath, [sidecarCliPath(), "review", "run", review.record.id, attempt], {
+    cwd: review.dir,
+    detached: true,
+    stdio: "ignore",
+    env: { ...process.env, [SKIP_LOCAL_EXEC_ENV]: "1" }
+  });
+  child.unref();
+  logSidecarEvent("review-launch", { id: review.record.id, attempt });
+}
+function runReviewer(idOrPrefix, attempt) {
+  const review = findReview(idOrPrefix);
+  const { id } = review.record;
+  assertOpen(review);
+  if (currentAttempt(review.dir) !== attempt)
+    return 0;
+  const command = configuredReviewer();
+  const file = runPath(review.dir, attempt);
+  const run = { attempt, pid: process.pid, command, startedAt: nowIso() };
+  writePrivateJson(file, run);
+  const log = fs8.openSync(path8.join(review.dir, "reviewer.log"), "a", 384);
+  let result;
+  try {
+    result = spawnSync4("/bin/sh", ["-c", command], {
+      cwd: review.dir,
+      stdio: ["ignore", log, log],
+      env: reviewerEnv(review)
+    });
+  } finally {
+    fs8.closeSync(log);
+  }
+  const finished = { ...run, finishedAt: nowIso(), exitCode: result.status, signal: result.signal };
+  writePrivateJson(file, finished);
+  logSidecarEvent("review-run", { id, attempt, exitCode: result.status, signal: result.signal });
+  return 0;
+}
+function reviewerEnv(review) {
+  const env = { ...process.env };
+  for (const name of [PEER_ENV, SOFT_SYNC_ENV, LOCAL_SYNC_ENV, SKIP_LOCAL_EXEC_ENV, GLOBAL_EXEC_ENV])
+    delete env[name];
+  const { record } = review;
+  return {
+    ...env,
+    SIDECAR_REVIEW_ID: record.id,
+    SIDECAR_REVIEW_DIR: review.dir,
+    SIDECAR_REVIEW_PROMPT: path8.join(review.dir, "instructions.md"),
+    SIDECAR_REVIEW_DIFF: path8.join(review.dir, "diff.patch"),
+    SIDECAR_REVIEW_ROOT: record.root,
+    SIDECAR_REVIEW_PEER: record.peer,
+    SIDECAR_REVIEW_CONFIG: peerConfigPath(record.root, record.peer)
+  };
+}
+function decideReview(review, verdict, reason) {
+  assertOpen(review);
+  if (review.record.publishing && verdict === "rejected") {
+    throw new SidecarError(`review ${review.record.id} is already being published; it can no longer be rejected`);
+  }
+  const record = { verdict, ...reason ? { reason } : {}, decidedAt: nowIso() };
+  writePrivateJson(path8.join(review.dir, "verdict.json"), record);
+  review.verdict = record;
+  review.state = verdict;
+  logSidecarEvent("review-decision", { id: review.record.id, verdict });
+}
+function resetReview(review) {
+  assertOpen(review);
+  if (review.record.publishing)
+    throw new SidecarError(`review ${review.record.id} is already being published`);
+  fs8.rmSync(path8.join(review.dir, "verdict.json"), { force: true });
+  fs8.rmSync(path8.join(review.dir, "attempt"), { force: true });
+  review.verdict = undefined;
+  review.run = undefined;
+  review.state = "pending";
+}
+var REVIEW_SCHEMA = 1, KEEP_CLOSED_REVIEWS = 10, ID_PATTERN, PACKET_DIFF_OPTIONS;
+var init_review = __esm(() => {
+  init_util();
+  init_git();
+  init_install();
+  init_config();
+  init_state();
+  init_redaction();
+  ID_PATTERN = /^[0-9a-f]+$/;
+  PACKET_DIFF_OPTIONS = ["-r", "--no-renames", "--ignore-submodules=none"];
+});
+
+// src/sync.ts
+import crypto5 from "node:crypto";
+import fs9 from "node:fs";
+import os5 from "node:os";
+import path9 from "node:path";
 function syncProject(root, config, options) {
   const stage = (name) => options.onStage?.(name);
   stage("checkout");
@@ -4444,7 +4923,9 @@ function syncProject(root, config, options) {
     settleCheckouts(sidecarPath, config, inbox, siblings);
   }
   if (!options.remote)
-    return;
+    return {};
+  if (reviewRequired(config))
+    return publishReviewed(root, sidecarPath, config, inbox, siblings, stage);
   stage("push-inbox");
   syncBranchBeforePush(sidecarPath, inbox, config);
   pushBranch(sidecarPath, inbox);
@@ -4452,6 +4933,262 @@ function syncProject(root, config, options) {
   mergeInboxBranches(sidecarPath, config, { forkFiles: true, push: true, remote: true });
   stage("settle-remote");
   settleCheckouts(sidecarPath, config, inbox, siblings);
+  return {};
+}
+function withPublicGit(repo, fn) {
+  assertRedactionFilterIntact(repo);
+  const { name, email } = sidecarIdentity();
+  const overrides = [
+    ["core.hooksPath", os5.devNull],
+    ["core.attributesFile", os5.devNull],
+    ["core.autocrlf", "false"],
+    ["commit.gpgSign", "false"],
+    ["tag.gpgSign", "false"],
+    ["i18n.commitEncoding", "UTF-8"],
+    ["rerere.enabled", "false"],
+    ["rerere.autoUpdate", "false"],
+    ["merge.renormalize", "false"],
+    ["merge.default", "text"],
+    ["push.pushOption", ""],
+    ["push.followTags", "false"],
+    ...neutralizedDrivers(repo)
+  ];
+  const env = {
+    GIT_AUTHOR_NAME: name,
+    GIT_AUTHOR_EMAIL: email,
+    GIT_COMMITTER_NAME: name,
+    GIT_COMMITTER_EMAIL: email,
+    GIT_NO_REPLACE_OBJECTS: "1",
+    GIT_ATTR_SOURCE: emptyTree(repo),
+    GIT_CONFIG_PARAMETERS: undefined,
+    GIT_CONFIG_COUNT: String(overrides.length)
+  };
+  overrides.forEach(([key, value], index) => {
+    env[`GIT_CONFIG_KEY_${index}`] = key;
+    env[`GIT_CONFIG_VALUE_${index}`] = value;
+  });
+  const saved = Object.fromEntries(Object.keys(env).map((key) => [key, process.env[key]]));
+  const apply = (values) => {
+    for (const [key, value] of Object.entries(values)) {
+      if (value === undefined)
+        delete process.env[key];
+      else
+        process.env[key] = value;
+    }
+  };
+  apply(env);
+  try {
+    return fn();
+  } finally {
+    apply(saved);
+  }
+}
+function neutralizedDrivers(repo) {
+  const keys = git(repo, ["config", "--name-only", "--get-regexp", "^(merge|filter)\\..+\\.(driver|clean|smudge|process)$"], { check: false }).stdout.split(`
+`).filter(Boolean);
+  return keys.flatMap((key) => {
+    const [section, ...rest] = key.split(".");
+    const driver = rest.slice(0, -1).join(".");
+    if (section === "merge")
+      return [[`merge.${driver}.driver`, "git merge-file --marker-size=%L %A %O %B"]];
+    if (driver === REDACTION_FILTER_NAME)
+      return [];
+    return [[`filter.${driver}.clean`, "cat"], [`filter.${driver}.smudge`, "cat"], [`filter.${driver}.process`, ""], [`filter.${driver}.required`, "false"]];
+  });
+}
+function assertRedactionFilterIntact(repo) {
+  if (git(repo, ["config", "--get-all", `filter.${REDACTION_FILTER_NAME}.process`], { check: false }).status === 0) {
+    throw new SidecarError(`filter.${REDACTION_FILTER_NAME}.process is configured; remove it — a review-gated peer publishes only through sidecar's own redaction filter`);
+  }
+}
+function assertPublishDestination(repo) {
+  const pushUrl = git(repo, ["config", "--get-all", "remote.origin.pushurl"], { check: false }).stdout.trim();
+  if (!pushUrl)
+    return;
+  const url = git(repo, ["config", "--get", "remote.origin.url"], { check: false }).stdout.trim();
+  if (pushUrl !== url) {
+    throw new SidecarError("remote.origin.pushurl sends this sidecar's pushes somewhere other than its remote; a review-gated peer publishes only to its remote — unset it");
+  }
+}
+function fetchPublic(repo) {
+  git(repo, ["fetch", "--quiet", "--prune", "--no-tags", "origin", "+refs/heads/*:refs/remotes/origin/*", `+refs/heads/*:${PUBLIC_REFS}*`]);
+}
+function publicRef(branch) {
+  return `${PUBLIC_REFS}${branch}`;
+}
+function refreshPublicRefs(repo) {
+  withPublicGit(repo, () => fetchPublic(repo));
+}
+function publicTip(repo, branch) {
+  return git(repo, ["rev-parse", "--verify", "--quiet", publicRef(branch)], { check: false }).stdout.trim() || undefined;
+}
+function isPublic(repo, commit) {
+  return Boolean(git(repo, ["for-each-ref", "--contains", commit, "--format=%(refname)", PUBLIC_REFS]).stdout.trim());
+}
+function publishReviewed(root, sidecarPath, config, inbox, siblings, stage) {
+  stage("fetch");
+  withPublicGit(sidecarPath, () => {
+    fetchPublic(sidecarPath);
+    if (!publicTip(sidecarPath, config.branch))
+      bootstrapReviewedMain(sidecarPath, config);
+    stage("publish");
+    const open = openReview(sidecarPath);
+    if (open?.state === "approved")
+      publishApprovedReview(sidecarPath, config, inbox, open);
+  });
+  stage("merge");
+  mergePublishedInboxes(sidecarPath, config, { forkFiles: true });
+  stage("merge-local");
+  mergeInboxBranches(sidecarPath, config, { forkFiles: true, push: false, remote: false });
+  stage("settle-remote");
+  settleCheckouts(sidecarPath, config, inbox, siblings);
+  stage("review");
+  const gate = withPublicGit(sidecarPath, () => gateUnpublished(root, sidecarPath, config));
+  if (gate?.launch)
+    launchReviewer(gate.review);
+  return gate ? { held: { review: gate.review, attention: reviewAttention(gate.review) } } : {};
+}
+function gateUnpublished(root, sidecarPath, config) {
+  const head = git(sidecarPath, ["rev-parse", `refs/heads/${config.branch}`]).stdout.trim();
+  const headTree = treeOf(sidecarPath, head);
+  const publicMain = publicTip(sidecarPath, config.branch);
+  const base = publicMain ? git(sidecarPath, ["merge-base", head, publicMain], { check: false }).stdout.trim() || undefined : undefined;
+  const open = openReview(sidecarPath);
+  const hasReviewer = Boolean(readSettings().reviewer);
+  if (base && treeOf(sidecarPath, base) === headTree) {
+    if (open && open.state !== "approved")
+      markSuperseded(open);
+    return;
+  }
+  if (open?.state === "pending" || open?.state === "approved") {
+    return { review: open, launch: open.state === "pending" && !open.run && hasReviewer };
+  }
+  if (open) {
+    if (open.record.tree === headTree)
+      return { review: open, launch: false };
+    markSuperseded(open);
+  }
+  const review = createReview({ root, config, sidecarPath, base, head });
+  console.log(`opened review ${paint("brand", review.record.id)} for ${review.record.files.length} changed file(s)`);
+  return { review, launch: hasReviewer };
+}
+function publishApprovedReview(sidecarPath, config, inbox, review) {
+  const { record } = review;
+  if (!record.publishing && record.base && !isPublic(sidecarPath, record.base)) {
+    markSuperseded(review);
+    console.log(`review ${paint("brand", record.id)} was measured from a commit the remote does not have; reviewing again`);
+    return;
+  }
+  assertPublishDestination(sidecarPath);
+  const target = record.publishing ?? { inbox, commit: cutPublishCommit(sidecarPath, config, inbox, record) };
+  if (!record.publishing)
+    markPublishing(review, target.inbox, target.commit);
+  if (!isAncestor(sidecarPath, target.commit, publicRef(target.inbox))) {
+    const push = git(sidecarPath, ["push", "--no-follow-tags", "origin", `${target.commit}:refs/heads/${target.inbox}`], { check: false });
+    if (push.status !== 0) {
+      throw new SidecarError(push.stderr.trim() || `could not publish review ${record.id} to ${target.inbox}`);
+    }
+    fetchPublic(sidecarPath);
+    console.log(`published review ${paint("brand", record.id)} to ${paint("brand", target.inbox)}`);
+  }
+  linkPublished(sidecarPath, config, review, target.commit);
+  markPublished(review, target.commit);
+}
+function cutPublishCommit(sidecarPath, config, inbox, record) {
+  const previous = publicTip(sidecarPath, inbox);
+  const parents = [
+    ...record.base ? [record.base] : [],
+    ...previous && !(record.base && isAncestor(sidecarPath, previous, record.base)) ? [previous] : []
+  ];
+  const body = [
+    "sidecar publish",
+    "",
+    `source: ${currentMachine()}`,
+    `inbox: ${inbox}`,
+    `review: ${record.id}`,
+    ...publishedWriteTrailers(sidecarPath, config, record)
+  ];
+  return git(sidecarPath, [
+    "commit-tree",
+    record.tree,
+    ...parents.flatMap((parent) => ["-p", parent]),
+    "-m",
+    body.join(`
+`)
+  ]).stdout.trim();
+}
+function publishedWriteTrailers(repo, config, record) {
+  const defaults = { resolve: config.resolve, redaction: config.redaction };
+  const paths = record.files.map((file) => file.path).filter((filePath) => resolveFileRules(config.rules, filePath, defaults).resolve === "lww");
+  if (paths.length > WRITTEN_TRAILER_LIMIT)
+    return [];
+  const now = Math.floor(Date.now() / 1000);
+  return paths.map((filePath) => {
+    const { time } = lastWriteEvent(repo, record.head, filePath);
+    return lwwWrittenTrailer(filePath, { time: Math.min(Math.max(0, time), now), source: `review-${record.id}` });
+  });
+}
+function linkPublished(sidecarPath, config, review, published) {
+  const main = `refs/heads/${config.branch}`;
+  if (isAncestor(sidecarPath, published, main))
+    return;
+  if (!isAncestor(sidecarPath, review.record.head, main)) {
+    logSidecarEvent("review-link-skip", { sidecarPath, id: review.record.id });
+    return;
+  }
+  withScratchWorktree(sidecarPath, config, "HEAD", (worktree) => {
+    git(worktree, ["switch", config.branch]);
+    git(worktree, ["merge", "--no-ff", "--allow-unrelated-histories", "-s", "ours", "-m", `sidecar: link published review ${review.record.id}`, published]);
+  });
+}
+function mergePublishedInboxes(sidecarPath, config, options) {
+  return withPublicGit(sidecarPath, () => {
+    fetchPublic(sidecarPath);
+    if (!publicTip(sidecarPath, config.branch))
+      return 0;
+    const publicMain = publicRef(config.branch);
+    if (publishedInboxBranches(sidecarPath, config).every((ref) => isAncestor(sidecarPath, ref, publicMain))) {
+      console.log("no published inbox branches to merge");
+      return 0;
+    }
+    assertPublishDestination(sidecarPath);
+    return withScratchWorktree(sidecarPath, config, publicMain, (worktree) => {
+      assertRedactionFilterIntact(worktree);
+      const maxAttempts = 3;
+      for (let attempt = 1;; attempt += 1) {
+        if (attempt > 1) {
+          fetchPublic(sidecarPath);
+          git(worktree, ["reset", "--hard", publicMain]);
+        }
+        const pending = publishedInboxBranches(worktree, config).filter((ref) => !isAncestor(worktree, ref, "HEAD"));
+        if (!pending.length) {
+          console.log("no published inbox branches to merge");
+          return 0;
+        }
+        const merged = [];
+        for (const ref of pending) {
+          console.log(`merging ${paint("brand", remoteBranchName(ref))}`);
+          if (mergeInboxBranch(worktree, config, ref, options))
+            merged.push(ref);
+        }
+        const push = git(worktree, ["push", "--no-follow-tags", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
+        if (push.status !== 0) {
+          if (attempt >= maxAttempts)
+            throw new SidecarError(push.stderr.trim() || `could not push ${config.branch}`);
+          console.log(`push of ${config.branch} was rejected; refetching and retrying`);
+          continue;
+        }
+        fetchPublic(sidecarPath);
+        console.log(`pushed ${config.branch}`);
+        console.log(`merged ${merged.length} inbox branch(es)`);
+        return merged.length;
+      }
+    });
+  });
+}
+function publishedInboxBranches(repo, config) {
+  const prefix = inboxPrefix(config);
+  return git(repo, ["for-each-ref", "--format=%(refname)", PUBLIC_REFS]).stdout.split(/\r?\n/).map((ref) => ref.trim()).filter((ref) => ref && matchesInboxPrefix(prefix, ref.slice(PUBLIC_REFS.length))).sort();
 }
 function settleCheckouts(sidecarPath, config, inbox, siblings) {
   refreshInboxFromMain(sidecarPath, config, inbox);
@@ -4500,25 +5237,7 @@ function reportSyncHealth(root, config, outcome) {
     const sidecarPath = resolveSidecarPath(root, config);
     if (!hasGitMetadata(sidecarPath))
       return;
-    const branch = healthBranchFor(sidecarPath);
-    const previous = readHealthRecordAt(sidecarPath, `origin/${branch}`);
-    const identity = {
-      machine: `${currentUser()}@${currentHost()}`,
-      root,
-      peer: config.peer === DEFAULT_PEER ? undefined : config.peer,
-      inbox: expandInbox(config, sidecarPath),
-      version: packageVersion()
-    };
-    const record = nextHealthRecord(previous, identity, outcome, nowIso());
-    if (!shouldPublishHealth(previous, record))
-      return;
-    publishHealthRecord(sidecarPath, branch, record);
-    logSidecarEvent("health", {
-      branch,
-      status: record.status,
-      stage: record.stage,
-      consecutiveFailures: record.consecutiveFailures
-    });
+    withPublicGit(sidecarPath, () => publishHealth(root, config, sidecarPath, outcome));
   } catch (error) {
     logSidecarEvent("failure", {
       command: "health",
@@ -4527,6 +5246,29 @@ function reportSyncHealth(root, config, outcome) {
     });
   }
 }
+function publishHealth(root, config, sidecarPath, outcome) {
+  const branch = healthBranchFor(sidecarPath);
+  const previous = readHealthRecordAt(sidecarPath, `origin/${branch}`);
+  const identity = {
+    machine: currentMachine(),
+    root,
+    peer: config.peer === DEFAULT_PEER ? undefined : config.peer,
+    inbox: expandInbox(config, sidecarPath),
+    version: packageVersion()
+  };
+  const record = nextHealthRecord(previous, identity, outcome, nowIso());
+  if (!shouldPublishHealth(previous, record))
+    return;
+  if (reviewRequired(config))
+    assertPublishDestination(sidecarPath);
+  publishHealthRecord(sidecarPath, branch, record);
+  logSidecarEvent("health", {
+    branch,
+    status: record.status,
+    stage: record.stage,
+    consecutiveFailures: record.consecutiveFailures
+  });
+}
 function publishHealthRecord(sidecarPath, branch, record) {
   const blob = git(sidecarPath, ["hash-object", "-w", "--stdin"], {
     input: serializeHealthRecord(record)
@@ -4535,17 +5277,8 @@ function publishHealthRecord(sidecarPath, branch, record) {
     input: `100644 blob ${blob}	${HEALTH_FILE}
 `
   }).stdout.trim();
-  const commit = git(sidecarPath, [
-    "-c",
-    `user.name=${currentUser()}`,
-    "-c",
-    `user.email=${slug(currentUser())}@${slug(currentHost())}.local`,
-    "commit-tree",
-    tree,
-    "-m",
-    `health: ${record.status} — ${record.machine}`
-  ]).stdout.trim();
-  git(sidecarPath, ["push", "--force", "origin", `${commit}:refs/heads/${branch}`]);
+  const commit = git(sidecarPath, ["commit-tree", tree, "-m", `health: ${record.status} — ${record.machine}`]).stdout.trim();
+  git(sidecarPath, ["push", "--no-follow-tags", "--force", "origin", `${commit}:refs/heads/${branch}`]);
 }
 function readHealthRecordAt(sidecarPath, ref) {
   const result = git(sidecarPath, ["show", `${ref}:${HEALTH_FILE}`], { check: false });
@@ -4572,9 +5305,9 @@ function mergeInboxBranches(sidecarPath, config, options) {
   ensureCommitIdentity(sidecarPath);
   if (options.remote)
     fetch(sidecarPath, false);
-  if (!hasPendingInboxWork(sidecarPath, config)) {
+  if (!hasPendingInboxWork(sidecarPath, config) && mainContainsRemote(sidecarPath, config)) {
     if (options.push && !mainMatchesRemote(sidecarPath, config)) {
-      const push = git(sidecarPath, ["push", "origin", `refs/heads/${config.branch}:refs/heads/${config.branch}`], {
+      const push = git(sidecarPath, ["push", "--no-follow-tags", "origin", `refs/heads/${config.branch}:refs/heads/${config.branch}`], {
         check: false
       });
       if (push.status === 0) {
@@ -4593,18 +5326,21 @@ function mergeInboxBranches(sidecarPath, config, options) {
   if (git(sidecarPath, ["branch", "--show-current"]).stdout.trim() === config.branch) {
     ensureInboxBranch(sidecarPath, config, expandInbox(config, sidecarPath));
   }
-  const scratch = path8.join(os5.tmpdir(), `sidecar-merge-${crypto4.createHash("sha1").update(sidecarPath).digest("hex").slice(0, 12)}`);
-  const worktree = path8.join(scratch, "checkout");
+  return withScratchWorktree(sidecarPath, config, "HEAD", (worktree) => mergeInboxBranchesAt(worktree, config, options));
+}
+function withScratchWorktree(sidecarPath, config, start, fn) {
+  const scratch = path9.join(os5.tmpdir(), `sidecar-merge-${crypto5.createHash("sha1").update(sidecarPath).digest("hex").slice(0, 12)}`);
+  const worktree = path9.join(scratch, "checkout");
   git(sidecarPath, ["worktree", "remove", "--force", worktree], { check: false });
-  fs8.rmSync(scratch, { recursive: true, force: true });
+  fs9.rmSync(scratch, { recursive: true, force: true });
   git(sidecarPath, ["worktree", "prune", "--expire", "now"], { check: false });
   try {
-    git(sidecarPath, ["worktree", "add", "--detach", worktree]);
+    git(sidecarPath, ["worktree", "add", "--detach", worktree, start]);
     ensureRedactionFilter(worktree, config.redaction, config);
-    return mergeInboxBranchesAt(worktree, config, options);
+    return fn(worktree);
   } finally {
     git(sidecarPath, ["worktree", "remove", "--force", worktree], { check: false });
-    fs8.rmSync(scratch, { recursive: true, force: true });
+    fs9.rmSync(scratch, { recursive: true, force: true });
   }
 }
 function mainMatchesRemote(repo, config) {
@@ -4615,6 +5351,11 @@ function mainMatchesRemote(repo, config) {
   const remote = refs.get(remoteRef);
   return local !== undefined && local === remote;
 }
+function mainContainsRemote(repo, config) {
+  if (!remoteRefExists(repo, config.branch) || !branchExists(repo, config.branch))
+    return true;
+  return isAncestor(repo, `origin/${config.branch}`, `refs/heads/${config.branch}`);
+}
 function hasPendingInboxWork(repo, config) {
   const main = `refs/heads/${config.branch}`;
   return pendingInboxBranches(repo, config).some((branch) => !isAncestor(repo, branch, main));
@@ -4638,7 +5379,7 @@ function mergeInboxBranchesAt(sidecarPath, config, options) {
         merged.push(remoteBranch);
     }
     if (options.push) {
-      const push = git(sidecarPath, ["push", "-u", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
+      const push = git(sidecarPath, ["push", "--no-follow-tags", "-u", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
       if (push.status !== 0) {
         if (attempt >= maxAttempts) {
           throw new SidecarError(push.stderr.trim() || `could not push ${config.branch}`);
@@ -4712,7 +5453,7 @@ function familySidecarCheckout(root, config) {
   if (primaryConfig.remote !== config.remote)
     return;
   const primaryPath = resolveSidecarPath(primary, primaryConfig);
-  if (path8.resolve(primaryPath) === path8.resolve(primary))
+  if (path9.resolve(primaryPath) === path9.resolve(primary))
     return;
   if (!hasGitMetadata(primaryPath))
     cloneOrUpdate(primary, primaryConfig, true);
@@ -4732,7 +5473,7 @@ function checkoutIsUnlinkedFromFamily(root, config, sidecarPath) {
   if (isStandalone(config))
     return false;
   try {
-    if (!fs8.statSync(path8.join(sidecarPath, ".git")).isDirectory())
+    if (!fs9.statSync(path9.join(sidecarPath, ".git")).isDirectory())
       return false;
   } catch {
     return false;
@@ -4749,13 +5490,13 @@ function checkoutIsUnlinkedFromFamily(root, config, sidecarPath) {
 }
 function cloneOrUpdate(root, config, bootstrapMain, options) {
   const sidecarPath = resolveSidecarPath(root, config);
-  if (fs8.existsSync(sidecarPath) && !hasGitMetadata(sidecarPath)) {
-    if (fs8.readdirSync(sidecarPath).length) {
+  if (fs9.existsSync(sidecarPath) && !hasGitMetadata(sidecarPath)) {
+    if (fs9.readdirSync(sidecarPath).length) {
       throw new SidecarError(`${sidecarPath} exists and is not an empty Git repo`);
     }
-    fs8.rmdirSync(sidecarPath);
+    fs9.rmdirSync(sidecarPath);
   }
-  if (!fs8.existsSync(sidecarPath)) {
+  if (!fs9.existsSync(sidecarPath)) {
     const primaryPath = familySidecarCheckout(root, config);
     if (primaryPath)
       git(primaryPath, ["worktree", "add", "--detach", sidecarPath]);
@@ -4776,7 +5517,7 @@ function cloneOrUpdate(root, config, bootstrapMain, options) {
     throw new SidecarError(`${sidecarPath} is not usable as a sidecar checkout`);
   }
   if (options?.checkoutId) {
-    fs8.writeFileSync(path8.join(gitDir(sidecarPath), "sidecar-id"), `${options.checkoutId}
+    fs9.writeFileSync(path9.join(gitDir(sidecarPath), "sidecar-id"), `${options.checkoutId}
 `, {
       encoding: "utf8",
       mode: 384
@@ -4793,6 +5534,10 @@ function cloneOrUpdate(root, config, bootstrapMain, options) {
 function bootstrapMainBranch(repo, config) {
   if (remoteRefExists(repo, config.branch))
     return;
+  if (reviewRequired(config)) {
+    withPublicGit(repo, () => bootstrapReviewedMain(repo, config));
+    return;
+  }
   if (hasAnyCommit(repo)) {
     const current = git(repo, ["branch", "--show-current"]).stdout.trim();
     if (current !== config.branch) {
@@ -4811,7 +5556,7 @@ function bootstrapMainBranch(repo, config) {
     pushBranch(repo, config.branch);
     return;
   }
-  fs8.writeFileSync(path8.join(repo, "README.md"), `# Sidecar
+  fs9.writeFileSync(path9.join(repo, "README.md"), `# Sidecar
 
 Scratch space for a code repository: plans, notes, and agent context.
 This is a plain git repo you own — read it, edit it, clone it anywhere.
@@ -4821,6 +5566,21 @@ Kept in sync by [sidecar](https://github.com/endograph/sidecar).
   git(repo, ["commit", "-m", "Initialize sidecar"]);
   pushBranch(repo, config.branch);
 }
+function bootstrapReviewedMain(repo, config) {
+  assertPublishDestination(repo);
+  const root = git(repo, ["commit-tree", emptyTree(repo), "-m", "Initialize sidecar"]).stdout.trim();
+  git(repo, ["push", "--no-follow-tags", "origin", `${root}:refs/heads/${config.branch}`]);
+  fetchPublic(repo);
+  console.log(`started ${config.branch} on the remote empty; this checkout's content is published through review`);
+  const ref = `refs/heads/${config.branch}`;
+  if (!hasAnyCommit(repo)) {
+    git(repo, ["update-ref", ref, root]);
+    return;
+  }
+  const local = git(repo, ["rev-parse", "--verify", "--quiet", ref], { check: false }).stdout.trim() || git(repo, ["rev-parse", "HEAD"]).stdout.trim();
+  const link = git(repo, ["commit-tree", treeOf(repo, local), "-p", local, "-p", root, "-m", "sidecar: link the remote's initial main"]).stdout.trim();
+  git(repo, ["update-ref", ref, link]);
+}
 function ensureMainBranch(repo, config) {
   if (branchExists(repo, config.branch)) {
     git(repo, ["switch", config.branch]);
@@ -4842,6 +5602,10 @@ function ensureMainBranch(repo, config) {
     git(repo, ["merge", "--ff-only", remoteBranch]);
     return;
   }
+  if (reviewRequired(config)) {
+    mergeInboxBranch(repo, config, remoteBranch, { forkFiles: true });
+    return;
+  }
   const tip = git(repo, ["rev-parse", "--short", "HEAD"]).stdout.trim();
   const discarded = `refs/sidecar-discarded/${config.branch}/${utcTimestamp()}-${tip}`;
   git(repo, ["update-ref", discarded, "HEAD"], { check: false });
@@ -4889,29 +5653,29 @@ function ensureSidecarCheckout(root, config) {
   return requireSidecarCheckout(root, config);
 }
 function snapshot(repo, mainRoot, inbox, message = "sidecar snapshot", redactionMode = DEFAULT_REDACTION_MODE, policy) {
-  if (fs8.existsSync(path8.join(gitDir(repo), "MERGE_HEAD"))) {
+  if (fs9.existsSync(path9.join(gitDir(repo), "MERGE_HEAD"))) {
     throw new SidecarError("cannot snapshot an unfinished merge; resolve or abort it before syncing");
   }
   const rewired = ensureRedactionFilter(repo, redactionMode, policy);
-  const revisionPath = path8.join(gitDir(repo), "sidecar-redaction-revision");
+  const revisionPath = path9.join(gitDir(repo), "sidecar-redaction-revision");
   const revision = `${REDACTION_FILTER_REVISION}:${redactionMode}:${rulesFingerprint(policy?.rules)}`;
   let appliedRevision = "";
   try {
-    appliedRevision = fs8.readFileSync(revisionPath, "utf8");
+    appliedRevision = fs9.readFileSync(revisionPath, "utf8");
   } catch {}
   git(repo, ["add", "-A"]);
   if ((rewired || appliedRevision !== revision) && hasAnyCommit(repo)) {
     git(repo, ["add", "--renormalize", "."]);
   }
   if (git(repo, ["diff", "--cached", "--quiet"], { check: false }).status === 0) {
-    fs8.writeFileSync(revisionPath, revision, "utf8");
+    fs9.writeFileSync(revisionPath, revision, "utf8");
     console.log("no sidecar changes to snapshot");
     return false;
   }
   const staged = git(repo, ["diff", "--cached", "--name-only", "-z", "--diff-filter=d"]).stdout.split("\x00").filter(Boolean);
-  const source = `${currentUser()}@${currentHost()}`;
+  const source = currentMachine();
   const body = [message, "", `source: ${source}`];
-  if (path8.resolve(repo) !== path8.resolve(mainRoot)) {
+  if (path9.resolve(repo) !== path9.resolve(mainRoot)) {
     const mainHead = git(mainRoot, ["rev-parse", "--short", "HEAD"], { check: false });
     body.push(`main-head: ${mainHead.status === 0 ? mainHead.stdout.trim() : "unborn"}`);
   }
@@ -4919,7 +5683,7 @@ function snapshot(repo, mainRoot, inbox, message = "sidecar snapshot", redaction
   body.push(...writtenTrailers(repo, staged));
   git(repo, ["commit", "-m", body.join(`
 `)]);
-  fs8.writeFileSync(revisionPath, revision, "utf8");
+  fs9.writeFileSync(revisionPath, revision, "utf8");
   console.log(`committed sidecar snapshot to ${paint("brand", inbox)}`);
   reportRedactions(repo, staged, redactionMode, policy?.rules);
   return true;
@@ -4933,7 +5697,7 @@ function writtenTrailers(repo, staged) {
 `))
       continue;
     try {
-      const seconds = Math.floor(fs8.lstatSync(path8.join(repo, relPath)).mtimeMs / 1000);
+      const seconds = Math.floor(fs9.lstatSync(path9.join(repo, relPath)).mtimeMs / 1000);
       if (seconds > 0)
         trailers.push(`${WRITTEN_TRAILER} ${seconds} ${relPath}`);
     } catch {}
@@ -4944,7 +5708,7 @@ function reportRedactions(repo, staged, mode, rules) {
   let files = 0;
   let items = 0;
   for (const relPath of staged) {
-    const delta = fileRedactionDelta(path8.join(repo, relPath), mode, { rules, relativePath: relPath });
+    const delta = fileRedactionDelta(path9.join(repo, relPath), mode, { rules, relativePath: relPath });
     if (!delta)
       continue;
     files += 1;
@@ -4958,7 +5722,7 @@ function reportRedactions(repo, staged, mode, rules) {
 function fileRedactionDelta(filePath, mode, policy) {
   let data;
   try {
-    data = fs8.readFileSync(filePath);
+    data = fs9.readFileSync(filePath);
   } catch {
     return;
   }
@@ -4973,14 +5737,14 @@ function fileRedactionDelta(filePath, mode, policy) {
   return { text, redacted, items };
 }
 function checkoutRedactionPolicy(repo) {
-  const policyPath = path8.join(gitDir(repo), REDACTION_POLICY_FILE);
+  const policyPath = path9.join(gitDir(repo), REDACTION_POLICY_FILE);
   let bound;
   try {
-    bound = JSON.parse(fs8.readFileSync(policyPath, "utf8"));
+    bound = JSON.parse(fs9.readFileSync(policyPath, "utf8"));
   } catch {
     throw new SidecarError("missing or invalid checkout redaction policy; run `sidecar sync`");
   }
-  if (!bound || typeof bound !== "object" || typeof bound.fingerprint !== "string" || bound.rulesPath !== undefined && (typeof bound.rulesPath !== "string" || !path8.isAbsolute(bound.rulesPath))) {
+  if (!bound || typeof bound !== "object" || typeof bound.fingerprint !== "string" || bound.rulesPath !== undefined && (typeof bound.rulesPath !== "string" || !path9.isAbsolute(bound.rulesPath))) {
     throw new SidecarError("invalid checkout redaction policy; run `sidecar sync`");
   }
   const mode = redactionModeConfigValue(bound.mode, "checkout redaction mode");
@@ -4995,27 +5759,28 @@ function ensureRedactionFilter(repo, mode = DEFAULT_REDACTION_MODE, policy) {
   if (policy?.rules?.length && !policy.rulesPath) {
     throw new SidecarError("path redaction rules require an explicit host rules file");
   }
-  const rulesPath = policy?.rulesPath ? path8.resolve(policy.rulesPath) : undefined;
+  const rulesPath = policy?.rulesPath ? path9.resolve(policy.rulesPath) : undefined;
   if (rulesPath && rulesFingerprint(readRules(rulesPath)) !== fingerprint) {
     throw new SidecarError("sidecar rules changed during this operation; run `sidecar sync` to apply them");
   }
-  const policyPath = path8.join(gitDir(repo), REDACTION_POLICY_FILE);
+  const policyPath = path9.join(gitDir(repo), REDACTION_POLICY_FILE);
   const bound = JSON.stringify({ mode, rulesPath, fingerprint });
   let previous = "";
   try {
-    previous = fs8.readFileSync(policyPath, "utf8");
+    previous = fs9.readFileSync(policyPath, "utf8");
   } catch {}
   const policyChanged = previous !== bound;
   if (policyChanged)
-    fs8.writeFileSync(policyPath, bound, { encoding: "utf8", mode: 384 });
-  const command = `${filterCommandQuote(process.execPath)} ${filterCommandQuote(redactCliPath())} redact --checkout-policy --path %f`;
+    fs9.writeFileSync(policyPath, bound, { encoding: "utf8", mode: 384 });
+  const command = `${filterCommandQuote(process.execPath)} ${filterCommandQuote(sidecarCliPath())} redact --checkout-policy --path %f`;
   const wanted = [
     [`filter.${REDACTION_FILTER_NAME}.clean`, command],
     [`filter.${REDACTION_FILTER_NAME}.revision`, REDACTION_FILTER_REVISION],
     [`filter.${REDACTION_FILTER_NAME}.smudge`, "cat"],
     [`filter.${REDACTION_FILTER_NAME}.required`, "true"]
   ];
-  const attributesPath = path8.join(gitCommonDir(repo), "info", "attributes");
+  const processKey = `filter.${REDACTION_FILTER_NAME}.process`;
+  const attributesPath = path9.join(gitCommonDir(repo), "info", "attributes");
   const line = `* filter=${REDACTION_FILTER_NAME}`;
   const configured = git(repo, ["config", "--get-regexp", `^filter\\.${REDACTION_FILTER_NAME}\\.`], {
     check: false
@@ -5025,10 +5790,10 @@ function ensureRedactionFilter(repo, mode = DEFAULT_REDACTION_MODE, policy) {
     const space = entry.indexOf(" ");
     return [entry.slice(0, space), entry.slice(space + 1)];
   }));
-  const configOk = wanted.every(([key, value]) => current.get(key) === value);
+  const configOk = wanted.every(([key, value]) => current.get(key) === value) && !current.has(processKey);
   let attributes = "";
   try {
-    attributes = fs8.readFileSync(attributesPath, "utf8");
+    attributes = fs9.readFileSync(attributesPath, "utf8");
   } catch {}
   const attributesOk = attributes.split(/\r?\n/).includes(line);
   if (configOk && attributesOk)
@@ -5036,9 +5801,10 @@ function ensureRedactionFilter(repo, mode = DEFAULT_REDACTION_MODE, policy) {
   for (const [key, value] of wanted) {
     git(repo, ["config", key, value]);
   }
+  git(repo, ["config", "--unset-all", processKey], { check: false });
   if (!attributesOk) {
-    fs8.mkdirSync(path8.dirname(attributesPath), { recursive: true });
-    fs8.appendFileSync(attributesPath, attributes && !attributes.endsWith(`
+    fs9.mkdirSync(path9.dirname(attributesPath), { recursive: true });
+    fs9.appendFileSync(attributesPath, attributes && !attributes.endsWith(`
 `) ? `
 ${line}
 ` : `${line}
@@ -5048,13 +5814,13 @@ ${line}
 }
 function removeRedactionFilter(repo) {
   git(repo, ["config", "--remove-section", `filter.${REDACTION_FILTER_NAME}`], { check: false });
-  fs8.rmSync(path8.join(gitDir(repo), "sidecar-redaction-revision"), { force: true });
-  fs8.rmSync(path8.join(gitDir(repo), REDACTION_POLICY_FILE), { force: true });
-  const attributesPath = path8.join(gitCommonDir(repo), "info", "attributes");
+  fs9.rmSync(path9.join(gitDir(repo), "sidecar-redaction-revision"), { force: true });
+  fs9.rmSync(path9.join(gitDir(repo), REDACTION_POLICY_FILE), { force: true });
+  const attributesPath = path9.join(gitCommonDir(repo), "info", "attributes");
   const line = `* filter=${REDACTION_FILTER_NAME}`;
   let contents;
   try {
-    contents = fs8.readFileSync(attributesPath, "utf8");
+    contents = fs9.readFileSync(attributesPath, "utf8");
   } catch {
     return;
   }
@@ -5063,17 +5829,13 @@ function removeRedactionFilter(repo) {
   if (kept.length === lines.length)
     return;
   if (kept.every((entry) => !entry.trim())) {
-    fs8.rmSync(attributesPath, { force: true });
+    fs9.rmSync(attributesPath, { force: true });
   } else {
-    fs8.writeFileSync(attributesPath, `${kept.join(`
+    fs9.writeFileSync(attributesPath, `${kept.join(`
 `).replace(/\s+$/g, "")}
 `, "utf8");
   }
 }
-function redactCliPath() {
-  const self = fileURLToPath2(import.meta.url);
-  return self.endsWith(".ts") ? path8.join(path8.dirname(self), "..", "dist", "cli.js") : self;
-}
 function filterCommandQuote(value) {
   return `"${value.replace(/([\\"$`])/g, "\\$1")}"`;
 }
@@ -5120,7 +5882,7 @@ function refreshInboxFromMain(repo, config, inbox) {
   }
 }
 function pushBranch(repo, branch) {
-  git(repo, ["push", "-u", "origin", `HEAD:refs/heads/${branch}`]);
+  git(repo, ["push", "--no-follow-tags", "-u", "origin", `HEAD:refs/heads/${branch}`]);
   console.log(`pushed ${paint("brand", branch)}`);
 }
 function forkConflicts(repo, remoteBranch, selectedPaths) {
@@ -5163,14 +5925,14 @@ function forkConflicts(repo, remoteBranch, selectedPaths) {
         continue;
       const { oid, mode } = stages[stage];
       const outPath = forkPath(conflictPath, label, oid);
-      const fullOut = path8.join(repo, outPath);
-      fs8.mkdirSync(path8.dirname(fullOut), { recursive: true });
-      fs8.rmSync(fullOut, { force: true });
+      const fullOut = path9.join(repo, outPath);
+      fs9.mkdirSync(path9.dirname(fullOut), { recursive: true });
+      fs9.rmSync(fullOut, { force: true });
       if (mode === "120000")
-        fs8.symlinkSync(blob.toString("utf8"), fullOut);
+        fs9.symlinkSync(blob.toString("utf8"), fullOut);
       else {
-        fs8.writeFileSync(fullOut, blob);
-        fs8.chmodSync(fullOut, mode === "100755" ? 493 : 420);
+        fs9.writeFileSync(fullOut, blob);
+        fs9.chmodSync(fullOut, mode === "100755" ? 493 : 420);
       }
       git(repo, ["add", "--", `:(literal)${outPath}`]);
       versions.push({
@@ -5178,18 +5940,18 @@ function forkConflicts(repo, remoteBranch, selectedPaths) {
         label,
         oid,
         path: outPath,
-        sha256: crypto4.createHash("sha256").update(blob).digest("hex")
+        sha256: crypto5.createHash("sha256").update(blob).digest("hex")
       });
     }
     git(repo, ["rm", "-f", "--", `:(literal)${conflictPath}`]);
     manifest.paths.push({ path: conflictPath, versions });
   }
-  const manifestDir = path8.join(repo, ".sidecar-conflicts");
-  fs8.mkdirSync(manifestDir, { recursive: true });
-  const manifestPath = path8.join(manifestDir, `${timestamp}-${manifestLabel}-fork-files.json`);
-  fs8.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  const manifestDir = path9.join(repo, ".sidecar-conflicts");
+  fs9.mkdirSync(manifestDir, { recursive: true });
+  const manifestPath = path9.join(manifestDir, `${timestamp}-${manifestLabel}-fork-files.json`);
+  fs9.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  git(repo, ["add", "--", `:(literal)${path8.relative(repo, manifestPath)}`]);
+  git(repo, ["add", "--", `:(literal)${path9.relative(repo, manifestPath)}`]);
   if (Object.keys(selectConflictPaths(unmergedPaths(repo), selectedPaths)).length) {
     throw new SidecarError("fork-files did not clear all unmerged paths");
   }
@@ -5219,7 +5981,7 @@ function resolveLastWriterWins(repo, canonicalBranch, remoteBranch, selectedPath
     ...selections.filter((entry) => entry.winner).map((entry) => entry.filePath)
   ]);
   for (const filePath of present) {
-    for (let parent = path8.posix.dirname(filePath);parent !== "."; parent = path8.posix.dirname(parent)) {
+    for (let parent = path9.posix.dirname(filePath);parent !== "."; parent = path9.posix.dirname(parent)) {
       if (present.has(parent))
         throw new SidecarError(`last-writer-wins selected incompatible file and directory paths: ${parent}, ${filePath}`);
     }
@@ -5246,12 +6008,12 @@ function resolveLastWriterWins(repo, canonicalBranch, remoteBranch, selectedPath
     written.push(lwwWrittenTrailer(filePath, write));
   }
   if (manifest.paths.length) {
-    const manifestDir = path8.join(repo, ".sidecar-conflicts");
-    fs8.mkdirSync(manifestDir, { recursive: true });
-    const manifestPath = path8.join(manifestDir, `${timestamp}-${fileLabel(branch)}-lww.json`);
-    fs8.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}
+    const manifestDir = path9.join(repo, ".sidecar-conflicts");
+    fs9.mkdirSync(manifestDir, { recursive: true });
+    const manifestPath = path9.join(manifestDir, `${timestamp}-${fileLabel(branch)}-lww.json`);
+    fs9.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-    git(repo, ["add", "--", `:(literal)${path8.relative(repo, manifestPath)}`]);
+    git(repo, ["add", "--", `:(literal)${path9.relative(repo, manifestPath)}`]);
   }
   if (Object.keys(selectConflictPaths(unmergedPaths(repo), selectedPaths)).length) {
     throw new SidecarError("last-writer-wins did not clear all unmerged paths");
@@ -5279,7 +6041,7 @@ function treeEntry(repo, ref, filePath) {
   return;
 }
 function lwwTrailerPrefix(filePath) {
-  return `sidecar-lww-${crypto4.createHash("sha256").update(filePath).digest("hex")}:`;
+  return `sidecar-lww-${crypto5.createHash("sha256").update(filePath).digest("hex")}:`;
 }
 function lwwWrittenTrailer(filePath, write) {
   return `${lwwTrailerPrefix(filePath)} ${write.time} ${write.source || "-"}`;
@@ -5326,11 +6088,11 @@ function recordedLwwEvent(body, prefix) {
   return Number.isInteger(time) && time >= 0 && source ? { time, source: source === "-" ? "" : source } : undefined;
 }
 function forkPath(conflictPath, label, oid) {
-  const parsed = path8.parse(conflictPath);
+  const parsed = path9.parse(conflictPath);
   const shortOid = oid ? oid.slice(0, 7) : "missing";
   const safeLabel = fileLabel(label);
   const forkName = parsed.ext ? `${parsed.name}.conflict.${safeLabel}.${shortOid}${parsed.ext}` : `${parsed.name}.conflict.${safeLabel}.${shortOid}`;
-  return path8.join(parsed.dir, forkName);
+  return path9.join(parsed.dir, forkName);
 }
 function fileLabel(value) {
   return slug(value).replaceAll("/", "-");
@@ -5389,7 +6151,7 @@ function pendingInboxBranches(repo, config) {
   });
   return [...local, ...remote].sort();
 }
-var SOFT_SYNC_ENV = "SIDECAR_SYNC_SOFT", LOCAL_SYNC_ENV = "SIDECAR_SYNC_LOCAL", WRITTEN_TRAILER = "written:", WRITTEN_TRAILER_LIMIT = 500, REDACTION_FILTER_NAME = "sidecar-redact", REDACTION_FILTER_REVISION = "2", REDACTION_POLICY_FILE = "sidecar-redaction-policy";
+var WRITTEN_TRAILER = "written:", WRITTEN_TRAILER_LIMIT = 500, REDACTION_FILTER_NAME = "sidecar-redact", REDACTION_FILTER_REVISION = "2", REDACTION_POLICY_FILE = "sidecar-redaction-policy";
 var init_sync = __esm(() => {
   init_color();
   init_util();
@@ -5397,13 +6159,14 @@ var init_sync = __esm(() => {
   init_install();
   init_config();
   init_state();
+  init_review();
   init_rules();
   init_health();
   init_redaction();
 });
 
 // src/ui.ts
-import fs9 from "node:fs";
+import fs10 from "node:fs";
 function announcePeer(peer, peers) {
   const index = peers.indexOf(peer);
   if (index > 0)
@@ -5465,13 +6228,13 @@ function promptYesNoDefaultNo(question) {
   return answer === "y" || answer === "yes";
 }
 function promptLine(prompt) {
-  fs9.writeSync(1, prompt);
-  const fd = fs9.openSync(process.platform === "win32" ? "CONIN$" : "/dev/tty", "r");
+  fs10.writeSync(1, prompt);
+  const fd = fs10.openSync(process.platform === "win32" ? "CONIN$" : "/dev/tty", "r");
   try {
     const chunks = [];
     const buffer = Buffer.alloc(1);
     while (true) {
-      const bytesRead = fs9.readSync(fd, buffer, 0, 1, null);
+      const bytesRead = fs10.readSync(fd, buffer, 0, 1, null);
       if (bytesRead === 0)
         break;
       const char = buffer.toString("utf8", 0, bytesRead);
@@ -5482,7 +6245,7 @@ function promptLine(prompt) {
     }
     return chunks.join("").trim();
   } finally {
-    fs9.closeSync(fd);
+    fs10.closeSync(fd);
   }
 }
 var init_ui = __esm(() => {
@@ -5491,9 +6254,9 @@ var init_ui = __esm(() => {
 });
 
 // src/cmd-init.ts
-import fs10 from "node:fs";
-import path9 from "node:path";
-import { spawnSync as spawnSync4 } from "node:child_process";
+import fs11 from "node:fs";
+import path10 from "node:path";
+import { spawnSync as spawnSync5 } from "node:child_process";
 function cmdDeinit(args) {
   const parsed = parseOptions(args, { boolean: new Set(["--yes", "-y"]), value: new Set(["--peer"]) });
   if (parsed.positional.length)
@@ -5515,7 +6278,7 @@ function cmdDeinit(args) {
   const configPath = peerConfigPath(root, name);
   const leftovers = [];
   let config;
-  if (fs10.existsSync(configPath)) {
+  if (fs11.existsSync(configPath)) {
     try {
       config = readConfig(configPath);
     } catch {
@@ -5548,12 +6311,14 @@ function cmdDeinit(args) {
       removeCheckout(checkoutPath);
       const ignoreEntry = ignoreEntryForSidecarPath(root, config.path);
       if (ignoreEntry) {
-        removeIgnoreEntry(path9.join(root, ".gitignore"), ignoreEntry);
+        removeIgnoreEntry(path10.join(root, ".gitignore"), ignoreEntry);
         removeZedInclusion(root, ignoreEntry);
       }
     }
-    fs10.rmSync(configPath, { force: true });
-    fs10.rmSync(peerRulesPath(root, name), { force: true });
+    fs11.rmSync(configPath, { force: true });
+    fs11.rmSync(peerRulesPath(root, name), { force: true });
+    fs11.rmSync(peerReviewGuidelinesPath(root, name), { force: true });
+    pruneOrphanedReviews();
     unregisterInstance(configPath);
   });
   console.log(`removed sidecar from ${paint("repo", root)}${name === DEFAULT_PEER ? "" : ` (peer ${paint("brand", name)})`}`);
@@ -5568,9 +6333,9 @@ function cmdDeinit(args) {
 function assertDeinitTarget(root, checkoutPath) {
   const target = realpathOr(checkoutPath);
   const host = realpathOr(root);
-  const hostFromTarget = path9.relative(target, host);
-  const parts = path9.relative(host, target).split(path9.sep);
-  const containsHost = !path9.isAbsolute(hostFromTarget) && hostFromTarget.split(path9.sep)[0] !== "..";
+  const hostFromTarget = path10.relative(target, host);
+  const parts = path10.relative(host, target).split(path10.sep);
+  const containsHost = !path10.isAbsolute(hostFromTarget) && hostFromTarget.split(path10.sep)[0] !== "..";
   if (containsHost || parts.includes(".git") || parts.includes(".jj")) {
     throw new SidecarError(`refusing to delete ${checkoutPath}, which contains the host repo or its VCS metadata`);
   }
@@ -5591,19 +6356,19 @@ function releaseStandaloneCheckout(root, config) {
 }
 function removeCheckout(checkoutPath) {
   try {
-    if (fs10.statSync(path9.join(checkoutPath, ".git")).isFile()) {
+    if (fs11.statSync(path10.join(checkoutPath, ".git")).isFile()) {
       git(checkoutPath, ["worktree", "remove", "--force", checkoutPath], { check: false });
     }
   } catch {}
-  fs10.rmSync(checkoutPath, { recursive: true, force: true });
+  fs11.rmSync(checkoutPath, { recursive: true, force: true });
 }
 function cmdInit(args) {
   const parsed = parseOptions(args, {
     boolean: new Set(["--no-clone", "--no-bootstrap-main", "--local-install", "--ignored"]),
-    value: new Set(["--path", "--branch", "--inbox", "--redaction", "--resolve", "--debounce", "--interval", "--peer"])
+    value: new Set(["--path", "--branch", "--inbox", "--redaction", "--resolve", "--review", "--review-timeout", "--debounce", "--interval", "--peer"])
   });
   if (parsed.positional.length > 1) {
-    throw new SidecarError("usage: sidecar init [remote] [--peer name] [--path sidecar] [--branch main] [--inbox template] [--redaction mode] [--resolve fork|lww] [--debounce 10m] [--interval 1h] [--ignored]");
+    throw new SidecarError("usage: sidecar init [remote] [--peer name] [--path sidecar] [--branch main] [--inbox template] [--redaction mode] [--resolve fork|lww] [--review off|required] [--review-timeout 1h] [--debounce 10m] [--interval 1h] [--ignored]");
   }
   const remote = parsed.positional[0];
   const requestedPeer = parsed.values.get("--peer");
@@ -5643,10 +6408,10 @@ function cmdInit(args) {
 }
 function configurePeer(root, name, remote, parsed) {
   const configPath = peerConfigPath(root, name);
-  let reuse = !remote && fs10.existsSync(configPath);
-  if (remote && fs10.existsSync(configPath)) {
+  let reuse = !remote && fs11.existsSync(configPath);
+  if (remote && fs11.existsSync(configPath)) {
     const existing = readConfig(configPath);
-    const unchanged = existing.remote === remote && existing.path === getValue(parsed, "--path", existing.path) && existing.branch === getValue(parsed, "--branch", existing.branch) && existing.inbox === getValue(parsed, "--inbox", existing.inbox) && existing.redaction === getValue(parsed, "--redaction", existing.redaction) && existing.resolve === getValue(parsed, "--resolve", existing.resolve) && existing.debounce === durationConfigValue(parsed.values.get("--debounce") ?? existing.debounce, "--debounce") && existing.interval === durationConfigValue(parsed.values.get("--interval") ?? existing.interval, "--interval");
+    const unchanged = existing.remote === remote && existing.path === getValue(parsed, "--path", existing.path) && existing.branch === getValue(parsed, "--branch", existing.branch) && existing.inbox === getValue(parsed, "--inbox", existing.inbox) && existing.redaction === getValue(parsed, "--redaction", existing.redaction) && existing.resolve === getValue(parsed, "--resolve", existing.resolve) && existing.debounce === durationConfigValue(parsed.values.get("--debounce") ?? existing.debounce, "--debounce") && existing.interval === durationConfigValue(parsed.values.get("--interval") ?? existing.interval, "--interval") && existing.review === getValue(parsed, "--review", existing.review ?? "off") && existing.reviewTimeout === durationConfigValue(parsed.values.get("--review-timeout") ?? existing.reviewTimeout, "--review-timeout");
     reuse = unchanged || !promptOverwriteConfig(configPath, existing.remote, remote);
   }
   const config = reuse ? readConfig(configPath) : buildInitConfig(root, name, remote, parsed);
@@ -5658,7 +6423,7 @@ function configurePeer(root, name, remote, parsed) {
     if (isStandalone(config)) {
       throw new SidecarError("--ignored cannot apply to a standalone sidecar: its .sidecar is part of the tree it syncs");
     }
-    for (const file of [peerFileName(name), peerRulesFileName(name)]) {
+    for (const file of [peerFileName(name), peerRulesFileName(name), peerReviewGuidelinesFileName(name)]) {
       if (isGitTracked(root, file)) {
         throw new SidecarError(`${file} is tracked by git; \`git rm --cached ${file}\` before ignoring it`);
       }
@@ -5691,9 +6456,11 @@ function excludePeerFile(root, name) {
     throw new SidecarError(`--ignored needs a git exclude file, and ${root} has none; ignore ${configFile} in your own VCS config`);
   }
   const rulesFile = peerRulesFileName(name);
+  const guidelinesFile = peerReviewGuidelinesFileName(name);
   ensureIgnoreLine(exclude, `/${configFile}`);
   ensureIgnoreLine(exclude, `/${rulesFile}`);
-  console.log(`ignored ${configFile} and ${rulesFile} via .git/info/exclude`);
+  ensureIgnoreLine(exclude, `/${guidelinesFile}`);
+  console.log(`ignored ${configFile}, ${rulesFile}, and ${guidelinesFile} via .git/info/exclude`);
 }
 function initRoot(remote, parsed) {
   const cwd = process.cwd();
@@ -5726,7 +6493,9 @@ function buildInitConfig(root, name, remote, parsed) {
     redaction: parsed.values.has("--redaction") ? redactionModeConfigValue(getValue(parsed, "--redaction", DEFAULT_REDACTION_MODE), "--redaction") : promptRedactionMode(),
     resolve: parsed.values.has("--resolve") ? resolveModeConfigValue(getValue(parsed, "--resolve", DEFAULT_RESOLVE), "--resolve") : DEFAULT_RESOLVE,
     debounce: durationConfigValue(parsed.values.get("--debounce"), "--debounce"),
-    interval: durationConfigValue(parsed.values.get("--interval"), "--interval")
+    interval: durationConfigValue(parsed.values.get("--interval"), "--interval"),
+    review: reviewModeConfigValue(getValue(parsed, "--review", "off"), "--review"),
+    reviewTimeout: durationConfigValue(parsed.values.get("--review-timeout"), "--review-timeout")
   };
 }
 function printCheckoutVisibility(root, config) {
@@ -5743,7 +6512,7 @@ function printCheckoutVisibility(root, config) {
     console.log(`sidecar path outside repo; not updating .gitignore`);
     return;
   }
-  ensureIgnoreEntry(exclude ?? path9.join(root, ".gitignore"), ignoreEntry);
+  ensureIgnoreEntry(exclude ?? path10.join(root, ".gitignore"), ignoreEntry);
   const name = ignoreEntry.replace(/\/+$/, "");
   console.log(`ignored ${name}/ via ${exclude ? ".git/info/exclude" : ".gitignore"}`);
   if (hasZedInclusion(root, ignoreEntry)) {
@@ -5757,8 +6526,8 @@ function printCheckoutVisibility(root, config) {
   }
 }
 function offerLocalInstall(root, standalone, forced) {
-  const manifestPath = path9.join(root, "package.json");
-  if (!fs10.existsSync(manifestPath)) {
+  const manifestPath = path10.join(root, "package.json");
+  if (!fs11.existsSync(manifestPath)) {
     if (forced)
       throw new SidecarError("--local-install requires a package.json");
     return;
@@ -5768,7 +6537,7 @@ function offerLocalInstall(root, standalone, forced) {
   let source;
   let manifest;
   try {
-    source = fs10.readFileSync(manifestPath, "utf8");
+    source = fs11.readFileSync(manifestPath, "utf8");
     const parsed = JSON.parse(source);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       throw new Error("not an object");
@@ -5794,7 +6563,7 @@ function offerLocalInstall(root, standalone, forced) {
     manifest.pnpm = pnpm;
   }
   const indent = /^([ \t]+)"/m.exec(source)?.[1] ?? "  ";
-  fs10.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, indent)}
+  fs11.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, indent)}
 `);
   console.log(`added ${paint("brand", PACKAGE_NAME)} to devDependencies; run your package manager's install to pin it`);
   if (managers.has("bun")) {
@@ -5822,7 +6591,7 @@ function detectPackageManagers(root) {
     ["package-lock.json", "npm"],
     ["yarn.lock", "yarn"]
   ];
-  return new Set(lockfiles.filter(([file]) => fs10.existsSync(path9.join(root, file))).map(([, manager]) => manager));
+  return new Set(lockfiles.filter(([file]) => fs11.existsSync(path10.join(root, file))).map(([, manager]) => manager));
 }
 function ensureDaemonSetup(globalSidecar) {
   if (process.env[SKIP_SERVICE_ENV] === "1")
@@ -5832,7 +6601,7 @@ function ensureDaemonSetup(globalSidecar) {
   const service = daemonServiceStatus();
   if (!service.available || service.installed && service.running)
     return;
-  const result = spawnSync4(globalSidecar, ["daemon", "enable"], {
+  const result = spawnSync5(globalSidecar, ["daemon", "enable"], {
     encoding: "utf8",
     env: {
       ...process.env,
@@ -5884,7 +6653,7 @@ function warnIfGlobalPredatesPeers(executable, peers) {
   console.error(`sidecar: warning: the global sidecar (${version ? `v${version}` : "unknown version"}) predates peers; its daemon syncs only .sidecar until it is updated`);
 }
 function registerInstallWithGlobalSidecar(executable, root) {
-  const result = spawnSync4(executable, ["register-install"], {
+  const result = spawnSync5(executable, ["register-install"], {
     cwd: root,
     encoding: "utf8",
     env: {
@@ -5901,7 +6670,7 @@ function installGlobalSidecar() {
   const bun = findExecutableOnPath(process.platform === "win32" ? "bun.exe" : "bun");
   const command = bun ? [bun, "add", "-g", PACKAGE_SPEC] : ["npm", "install", "-g", PACKAGE_SPEC];
   console.log(`running ${command.join(" ")}`);
-  const result = spawnSync4(command[0], command.slice(1), { stdio: "inherit" });
+  const result = spawnSync5(command[0], command.slice(1), { stdio: "inherit" });
   if (result.status !== 0) {
     throw new SidecarError(`global sidecar install failed; run \`${command.join(" ")}\` manually`);
   }
@@ -5920,7 +6689,7 @@ function cmdClone(args) {
     const { root, config } = peer;
     if (parsed.flags.has("--if-missing")) {
       const sidecarPath = resolveSidecarPath(root, config);
-      if (fs10.existsSync(sidecarPath) && hasGitMetadata(sidecarPath))
+      if (fs11.existsSync(sidecarPath) && hasGitMetadata(sidecarPath))
         continue;
     }
     cloneOrUpdate(root, config, !parsed.flags.has("--no-bootstrap-main"));
@@ -6008,7 +6777,7 @@ function createRemoteWithGh(root) {
   const origin = git(root, ["remote", "get-url", "origin"], { check: false }).stdout.trim() || undefined;
   const parsedOrigin = origin ? parseGitHubRemote(origin) : undefined;
   const owner = parsedOrigin?.owner ?? ghLogin(gh);
-  const baseName = parsedOrigin?.repo ?? path9.basename(root);
+  const baseName = parsedOrigin?.repo ?? path10.basename(root);
   const suggested = owner ? `${owner}/${baseName}-sidecar` : `${baseName}-sidecar`;
   const answer = promptLine(`repository to create ${paint("quiet", `[${suggested}]`)}: `) || suggested;
   const fullName = answer.includes("/") ? answer : owner ? `${owner}/${answer}` : undefined;
@@ -6016,7 +6785,7 @@ function createRemoteWithGh(root) {
     throw new SidecarError("could not determine the repository owner; enter it as owner/name");
   }
   console.log(`running gh repo create ${fullName} --private`);
-  const create = spawnSync4(gh, ["repo", "create", fullName, "--private"], { stdio: "inherit" });
+  const create = spawnSync5(gh, ["repo", "create", fullName, "--private"], { stdio: "inherit" });
   if (create.status !== 0) {
     throw new SidecarError("gh repo create failed; create the repo yourself and rerun `sidecar init <remote>`");
   }
@@ -6030,14 +6799,14 @@ function parseGitHubRemote(url) {
   return { owner: match[1], repo: match[2] };
 }
 function ghLogin(gh) {
-  const result = spawnSync4(gh, ["api", "user", "-q", ".login"], { encoding: "utf8" });
+  const result = spawnSync5(gh, ["api", "user", "-q", ".login"], { encoding: "utf8" });
   if (result.status !== 0)
     return;
   const login = result.stdout.trim();
   return login || undefined;
 }
 function ghGitProtocol(gh) {
-  const result = spawnSync4(gh, ["config", "get", "git_protocol"], { encoding: "utf8" });
+  const result = spawnSync5(gh, ["config", "get", "git_protocol"], { encoding: "utf8" });
   if (result.status !== 0)
     return "https";
   return result.stdout.trim() || "https";
@@ -6057,38 +6826,38 @@ function removeIgnoreEntry(ignorePath, sidecarPath) {
   removeIgnoreLine(ignorePath, `/${sidecarPath.replace(/^\/+|\/+$/g, "")}/`);
 }
 function ensureIgnoreLine(ignorePath, entry) {
-  const lines = fs10.existsSync(ignorePath) ? fs10.readFileSync(ignorePath, "utf8").split(/\r?\n/) : [];
+  const lines = fs11.existsSync(ignorePath) ? fs11.readFileSync(ignorePath, "utf8").split(/\r?\n/) : [];
   if (lines.includes(entry))
     return;
   while (lines.length && lines[lines.length - 1] === "")
     lines.pop();
   lines.push(entry);
-  fs10.mkdirSync(path9.dirname(ignorePath), { recursive: true });
-  fs10.writeFileSync(ignorePath, `${lines.join(`
+  fs11.mkdirSync(path10.dirname(ignorePath), { recursive: true });
+  fs11.writeFileSync(ignorePath, `${lines.join(`
 `).replace(/\s+$/g, "")}
 `, "utf8");
 }
 function removeIgnoreLine(ignorePath, entry) {
-  if (!fs10.existsSync(ignorePath))
+  if (!fs11.existsSync(ignorePath))
     return;
-  const lines = fs10.readFileSync(ignorePath, "utf8").split(/\r?\n/);
+  const lines = fs11.readFileSync(ignorePath, "utf8").split(/\r?\n/);
   const kept = lines.filter((line) => line !== entry);
   if (kept.length === lines.length)
     return;
   if (kept.every((line) => !line.trim())) {
-    fs10.rmSync(ignorePath);
+    fs11.rmSync(ignorePath);
   } else {
-    fs10.writeFileSync(ignorePath, `${kept.join(`
+    fs11.writeFileSync(ignorePath, `${kept.join(`
 `).replace(/\s+$/g, "")}
 `, "utf8");
   }
 }
 function hasZedInclusion(root, sidecarPath) {
-  const settingsPath2 = path9.join(root, ".zed", "settings.json");
-  if (!fs10.existsSync(settingsPath2))
+  const settingsPath2 = path10.join(root, ".zed", "settings.json");
+  if (!fs11.existsSync(settingsPath2))
     return false;
   try {
-    const parsed = JSON.parse(fs10.readFileSync(settingsPath2, "utf8"));
+    const parsed = JSON.parse(fs11.readFileSync(settingsPath2, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return false;
     const inclusions = parsed.file_scan_inclusions;
@@ -6102,11 +6871,11 @@ function zedInclusionGlob(sidecarPath) {
 }
 function ensureZedInclusion(root, sidecarPath) {
   const glob = zedInclusionGlob(sidecarPath);
-  const settingsPath2 = path9.join(root, ".zed", "settings.json");
+  const settingsPath2 = path10.join(root, ".zed", "settings.json");
   let settings = {};
-  if (fs10.existsSync(settingsPath2)) {
+  if (fs11.existsSync(settingsPath2)) {
     try {
-      const parsed = JSON.parse(fs10.readFileSync(settingsPath2, "utf8"));
+      const parsed = JSON.parse(fs11.readFileSync(settingsPath2, "utf8"));
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
         return false;
       settings = parsed;
@@ -6118,18 +6887,18 @@ function ensureZedInclusion(root, sidecarPath) {
   if (!inclusions.includes(glob)) {
     inclusions.push(glob);
     settings.file_scan_inclusions = inclusions;
-    fs10.mkdirSync(path9.dirname(settingsPath2), { recursive: true });
-    fs10.writeFileSync(settingsPath2, `${JSON.stringify(settings, null, 2)}
+    fs11.mkdirSync(path10.dirname(settingsPath2), { recursive: true });
+    fs11.writeFileSync(settingsPath2, `${JSON.stringify(settings, null, 2)}
 `, "utf8");
   }
   return true;
 }
 function removeZedInclusion(root, sidecarPath) {
-  const settingsPath2 = path9.join(root, ".zed", "settings.json");
-  if (!fs10.existsSync(settingsPath2))
+  const settingsPath2 = path10.join(root, ".zed", "settings.json");
+  if (!fs11.existsSync(settingsPath2))
     return;
   try {
-    const settings = JSON.parse(fs10.readFileSync(settingsPath2, "utf8"));
+    const settings = JSON.parse(fs11.readFileSync(settingsPath2, "utf8"));
     if (!settings || typeof settings !== "object" || Array.isArray(settings))
       return;
     const inclusions = settings.file_scan_inclusions;
@@ -6144,17 +6913,17 @@ function removeZedInclusion(root, sidecarPath) {
     } else {
       delete settings.file_scan_inclusions;
     }
-    fs10.writeFileSync(settingsPath2, `${JSON.stringify(settings, null, 2)}
+    fs11.writeFileSync(settingsPath2, `${JSON.stringify(settings, null, 2)}
 `, "utf8");
   } catch {
     console.error(`sidecar: warning: could not safely remove the Zed inclusion from ${settingsPath2}`);
   }
 }
 function ignoreEntryForSidecarPath(root, sidecarPath) {
-  const resolvedRoot = path9.resolve(root);
-  const resolvedSidecarPath = path9.resolve(root, sidecarPath);
-  const relative = path9.relative(resolvedRoot, resolvedSidecarPath);
-  if (!relative || relative.startsWith("..") || path9.isAbsolute(relative))
+  const resolvedRoot = path10.resolve(root);
+  const resolvedSidecarPath = path10.resolve(root, sidecarPath);
+  const relative = path10.relative(resolvedRoot, resolvedSidecarPath);
+  if (!relative || relative.startsWith("..") || path10.isAbsolute(relative))
     return;
   return relative;
 }
@@ -6170,11 +6939,12 @@ var init_cmd_init = __esm(() => {
   init_ui();
   init_redaction();
   init_rules();
+  init_review();
 });
 
 // src/cmd-refresh.ts
-import fs11 from "node:fs";
-import path10 from "node:path";
+import fs12 from "node:fs";
+import path11 from "node:path";
 function worktreeHoldingBranch(repo, branch) {
   const result = git(repo, ["worktree", "list", "--porcelain"], { check: false });
   if (result.status !== 0)
@@ -6202,13 +6972,53 @@ function unpushedCommits(sidecarPath) {
   });
   return counted.status === 0 ? Number(counted.stdout.trim()) || 0 : 0;
 }
-function dependentWorktrees(sidecarPath) {
+function heldWork(sidecarPath, config, inbox) {
+  const gated = reviewRequired(config);
+  const unpushed = gated ? 0 : unpushedCommits(sidecarPath);
+  const unpublished = gated && !gatedWorkIsPublished(sidecarPath, config, inbox);
+  const dirtyFiles = git(sidecarPath, ["status", "--porcelain"], { check: false }).stdout.split(`
+`).filter(Boolean).length;
+  return [
+    unpushed ? `${unpushed} commit(s) the remote has not seen` : "",
+    unpublished ? "changes not yet published through review" : "",
+    dirtyFiles ? `${dirtyFiles} uncommitted file(s)` : ""
+  ].filter(Boolean);
+}
+function gatedWorkIsPublished(sidecarPath, config, inbox) {
+  if (!hasAnyCommit(sidecarPath))
+    return true;
+  const tree = (ref) => {
+    const result = git(sidecarPath, ["rev-parse", "--verify", "--quiet", `${ref}^{tree}`], { check: false });
+    return result.status === 0 ? result.stdout.trim() : undefined;
+  };
+  const main = `refs/heads/${config.branch}`;
+  const publicMain = tree(`${PUBLIC_REFS}${config.branch}`);
+  const mainTree = tree(main);
+  const mainPublished = mainTree === undefined || mainTree === publicMain;
+  const published = (ref, branch) => {
+    const own = tree(ref);
+    return own === publicMain || own === tree(`${PUBLIC_REFS}${branch}`) || mainPublished && isAncestor(sidecarPath, ref, main);
+  };
+  if (!published("HEAD", inbox))
+    return false;
+  if (!ownsStore(sidecarPath))
+    return true;
+  if (!mainPublished)
+    return false;
+  const prefix = inboxPrefix(config);
+  return git(sidecarPath, ["for-each-ref", "--format=%(refname)", "refs/heads/"]).stdout.split(`
+`).filter((ref) => ref && matchesInboxPrefix(prefix, ref.slice("refs/heads/".length))).every((ref) => published(ref, ref.slice("refs/heads/".length)));
+}
+function ownsStore(sidecarPath) {
   try {
-    if (!fs11.statSync(path10.join(sidecarPath, ".git")).isDirectory())
-      return [];
+    return fs12.statSync(path11.join(sidecarPath, ".git")).isDirectory();
   } catch {
-    return [];
+    return false;
   }
+}
+function dependentWorktrees(sidecarPath) {
+  if (!ownsStore(sidecarPath))
+    return [];
   const result = git(sidecarPath, ["worktree", "list", "--porcelain"], { check: false });
   if (result.status !== 0)
     return [];
@@ -6219,11 +7029,11 @@ function existingCheckoutId(sidecarPath) {
   const candidates = [];
   const reported = git(sidecarPath, ["rev-parse", "--git-dir"], { check: false });
   if (reported.status === 0)
-    candidates.push(path10.resolve(sidecarPath, reported.stdout.trim()));
-  candidates.push(path10.join(sidecarPath, ".git"));
+    candidates.push(path11.resolve(sidecarPath, reported.stdout.trim()));
+  candidates.push(path11.join(sidecarPath, ".git"));
   for (const candidate of candidates) {
     try {
-      const id = slug(fs11.readFileSync(path10.join(candidate, "sidecar-id"), "utf8"));
+      const id = slug(fs12.readFileSync(path11.join(candidate, "sidecar-id"), "utf8"));
       if (id)
         return id;
     } catch {}
@@ -6235,12 +7045,20 @@ function refreshCheckout(root, config) {
   if (isStandalone(config)) {
     throw new SidecarError("refusing to delete a standalone sidecar, which is the repo itself");
   }
-  const relative = path10.relative(root, sidecarPath);
-  if (!relative || relative.startsWith("..") || path10.isAbsolute(relative)) {
+  const relative = path11.relative(root, sidecarPath);
+  if (!relative || relative.startsWith("..") || path11.isAbsolute(relative)) {
     throw new SidecarError(`refusing to delete ${sidecarPath}, which is not inside ${root}`);
   }
   const checkoutId = existingCheckoutId(sidecarPath);
-  fs11.rmSync(sidecarPath, { recursive: true, force: true });
+  if (ownsStore(sidecarPath)) {
+    let open;
+    try {
+      open = openReview(sidecarPath);
+    } catch {}
+    if (open)
+      markSuperseded(open);
+  }
+  fs12.rmSync(sidecarPath, { recursive: true, force: true });
   const family = familySidecarCheckout(root, config);
   if (family) {
     git(family, ["worktree", "prune", "--expire", "now"], { check: false });
@@ -6302,14 +7120,13 @@ function refreshPeer({ root, config, name }, parsed) {
   if (readable) {
     inbox = expandInbox(config, sidecarPath);
     fetch(sidecarPath, true, false);
-    const unpushed = unpushedCommits(sidecarPath);
-    const dirtyFiles = git(sidecarPath, ["status", "--porcelain"], { check: false }).stdout.split(`
-`).filter(Boolean).length;
-    if ((unpushed || dirtyFiles) && !force) {
-      const held = [
-        unpushed ? `${unpushed} commit(s) the remote has not seen` : "",
-        dirtyFiles ? `${dirtyFiles} uncommitted file(s)` : ""
-      ].filter(Boolean);
+    if (reviewRequired(config)) {
+      try {
+        refreshPublicRefs(sidecarPath);
+      } catch {}
+    }
+    const held = heldWork(sidecarPath, config, inbox);
+    if (held.length && !force) {
       throw new SidecarError(`this checkout still holds ${held.join(" and ")}; run \`sidecar sync\` to push them, then refresh — or \`sidecar refresh --force\` to discard them`);
     }
   }
@@ -6337,7 +7154,7 @@ function refreshPeer({ root, config, name }, parsed) {
   }
   let declined;
   withSyncLock(root, name, "throw", () => {
-    if (readable && !force && isDirty(sidecarPath)) {
+    if (readable && !force && inbox && heldWork(sidecarPath, config, inbox).length) {
       throw new SidecarError("the sidecar checkout changed while waiting for confirmation; rerun refresh");
     }
     if (standalone)
@@ -6359,10 +7176,11 @@ var init_cmd_refresh = __esm(() => {
   init_sync();
   init_ui();
   init_rules();
+  init_review();
 });
 
 // src/cmd-status.ts
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 function statusLine(label, value, role) {
   labelLine(STATUS_LABEL_WIDTH, label, value, role);
 }
@@ -6395,6 +7213,8 @@ function printPeerStatus({ root, config, configPath }) {
   statusLine("main branch", config.branch);
   statusLine("inbox branch", inbox);
   statusLine("conflicts", config.resolve === "lww" ? "last writer wins" : "fork files");
+  if (reviewRequired(config))
+    printReviewLine(sidecarPath);
   if (!checkoutPresent) {
     statusLine("checkout", "missing — run `sidecar init`", "bad");
     printDaemonLine();
@@ -6425,6 +7245,36 @@ function printPeerStatus({ root, config, configPath }) {
     statusLine("pending inbox", "none", "quiet");
   }
 }
+function printReviewLine(sidecarPath) {
+  const review = hasGitMetadata(sidecarPath) ? openReview(sidecarPath) : undefined;
+  const reviewer = readSettings().reviewer;
+  if (!review) {
+    if (reviewer)
+      statusLine("review", `required — nothing waiting (reviewer: ${reviewer})`, "quiet");
+    else
+      statusLine("review", "required — no reviewer configured; reviews wait for `sidecar review approve`", "attn");
+    return;
+  }
+  const attention = reviewAttention(review);
+  const age = formatRelativeTime(review.record.createdAt) ?? review.record.createdAt;
+  const summary = `${review.state} ${review.record.id}, opened ${age}, ${review.record.files.length} file(s)`;
+  statusLine("review", attention ? `${summary} — needs attention: ${attention}` : summary, attention ? "attn" : undefined);
+  if (review.verdict?.reason)
+    console.log(`  ${paint("quiet", review.verdict.reason)}`);
+  console.log(`  ${paint("quiet", `sidecar review show ${review.record.id}`)}`);
+}
+function openReviewPayload(sidecarPath) {
+  const review = openReview(sidecarPath);
+  if (!review)
+    return;
+  return {
+    id: review.record.id,
+    state: review.state,
+    attention: reviewAttention(review),
+    createdAt: review.record.createdAt,
+    files: review.record.files.length
+  };
+}
 function statusPayload({ root, name, config, configPath }) {
   const sidecarPath = resolveSidecarPath(root, config);
   const checkoutPresent = hasGitMetadata(sidecarPath);
@@ -6445,13 +7295,15 @@ function statusPayload({ root, name, config, configPath }) {
     familyLinked: checkoutPresent ? !checkoutIsUnlinkedFromFamily(root, config, sidecarPath) : undefined,
     daemon: daemonHealth().text,
     lastSyncAt: readInstances().find((instance) => instance.configPath === configPath)?.lastSyncAt,
-    pendingInbox: checkoutPresent ? pendingStatusInboxBranches(sidecarPath, config) : undefined
+    pendingInbox: checkoutPresent ? pendingStatusInboxBranches(sidecarPath, config) : undefined,
+    review: reviewRequired(config) ? { required: true, open: checkoutPresent ? openReviewPayload(sidecarPath) : undefined } : undefined
   };
 }
 function pendingStatusInboxBranches(sidecarPath, config) {
   fetch(sidecarPath, true, false);
   const base = remoteRefExists(sidecarPath, config.branch) ? `origin/${config.branch}` : branchExists(sidecarPath, config.branch) ? config.branch : "HEAD";
-  return pendingInboxBranches(sidecarPath, config).filter((remoteBranch) => !isAncestor(sidecarPath, remoteBranch, base));
+  const candidates = reviewRequired(config) ? pendingInboxBranches(sidecarPath, config).filter((branch) => branch.startsWith("origin/")) : pendingInboxBranches(sidecarPath, config);
+  return candidates.filter((remoteBranch) => !isAncestor(sidecarPath, remoteBranch, base));
 }
 function daemonHealth() {
   if (!shouldUseGlobalRegistry()) {
@@ -6553,6 +7405,10 @@ function healthStatusLine(state, record) {
     const age = formatRelativeTime(record.updatedAt) ?? record.updatedAt;
     return { text: `stale — last reported ${age}`, role: "attn" };
   }
+  if (record.review === "attention")
+    return { text: "ok — publishing held, review needs attention", role: "attn" };
+  if (record.review === "pending")
+    return { text: "ok — publishing held for review", role: "ok" };
   return { text: "ok", role: "ok" };
 }
 function cmdInstances(args) {
@@ -6606,16 +7462,16 @@ function cmdTail(args) {
     throw new SidecarError("--lines requires a positive integer");
   }
   const filePath = sidecarLogPath();
-  if (!fs12.existsSync(filePath)) {
+  if (!fs13.existsSync(filePath)) {
     if (parsed.flags.has("-f") || parsed.flags.has("--follow")) {
       followLog(filePath, 0);
       return 0;
     }
     return 0;
   }
-  const stat = fs12.statSync(filePath);
+  const stat = fs13.statSync(filePath);
   if (stat.size > 0) {
-    process.stdout.write(lastLines(fs12.readFileSync(filePath, "utf8"), lines));
+    process.stdout.write(lastLines(fs13.readFileSync(filePath, "utf8"), lines));
   }
   if (parsed.flags.has("-f") || parsed.flags.has("--follow")) {
     followLog(filePath, stat.size);
@@ -6638,7 +7494,7 @@ function followLog(filePath, startOffset) {
     sleep(1000);
     let stat;
     try {
-      stat = fs12.statSync(filePath);
+      stat = fs13.statSync(filePath);
     } catch {
       offset = 0;
       continue;
@@ -6647,17 +7503,17 @@ function followLog(filePath, startOffset) {
       offset = 0;
     if (stat.size <= offset)
       continue;
-    const fd = fs12.openSync(filePath, "r");
+    const fd = fs13.openSync(filePath, "r");
     try {
       const length = stat.size - offset;
       const buffer = Buffer.alloc(length);
-      const bytesRead = fs12.readSync(fd, buffer, 0, length, offset);
+      const bytesRead = fs13.readSync(fd, buffer, 0, length, offset);
       if (bytesRead > 0) {
         process.stdout.write(buffer.subarray(0, bytesRead).toString("utf8"));
         offset += bytesRead;
       }
     } finally {
-      fs12.closeSync(fd);
+      fs13.closeSync(fd);
     }
   }
 }
@@ -6676,6 +7532,7 @@ var init_cmd_status = __esm(() => {
   init_sync();
   init_ui();
   init_health();
+  init_review();
   STATUS_LABEL_WIDTH = "pending inbox:".length;
 });
 
@@ -7064,20 +7921,20 @@ var require_ignore = __commonJS((exports, module) => {
     const index = body.indexOf(SLASH);
     return index < 0 || index === body.length - 1;
   };
-  var basenameOf = (path11) => {
-    const end = path11.length - 1;
-    const index = path11.lastIndexOf(SLASH, path11[end] === SLASH ? end - 1 : end);
-    return index < 0 ? path11 : path11.slice(index + 1);
+  var basenameOf = (path12) => {
+    const end = path12.length - 1;
+    const index = path12.lastIndexOf(SLASH, path12[end] === SLASH ? end - 1 : end);
+    return index < 0 ? path12 : path12.slice(index + 1);
   };
-  var parentOf = (path11) => {
-    if (path11.charCodeAt(0) === SLASH_CODE || path11.indexOf(DOUBLE_SLASH) >= 0) {
-      const slices = path11.split(SLASH).filter(Boolean);
+  var parentOf = (path12) => {
+    if (path12.charCodeAt(0) === SLASH_CODE || path12.indexOf(DOUBLE_SLASH) >= 0) {
+      const slices = path12.split(SLASH).filter(Boolean);
       slices.pop();
       return slices.length ? slices.join(SLASH) + SLASH : EMPTY;
     }
-    const end = path11.length - 1;
-    const cut = path11.lastIndexOf(SLASH, path11.charCodeAt(end) === SLASH_CODE ? end - 1 : end);
-    return cut < 0 ? EMPTY : path11.slice(0, cut + 1);
+    const end = path12.length - 1;
+    const cut = path12.lastIndexOf(SLASH, path12.charCodeAt(end) === SLASH_CODE ? end - 1 : end);
+    return cut < 0 ? EMPTY : path12.slice(0, cut + 1);
   };
   var isString = (subject) => typeof subject === "string";
   var checkPattern = (pattern) => pattern && isString(pattern) && !REGEX_TEST_BLANK_LINE.test(pattern) && !REGEX_INVALID_TRAILING_BACKSLASH.test(pattern) && pattern.indexOf("#") !== 0;
@@ -7162,19 +8019,19 @@ var require_ignore = __commonJS((exports, module) => {
       makeArray(isString(pattern) ? splitPattern(pattern) : pattern).forEach(this._add, this);
       return this._added;
     }
-    test(path11, checkUnignored, mode) {
+    test(path12, checkUnignored, mode) {
       let ignored = false;
       let unignored = false;
       let matchedRule;
       const rules = this._rules;
       const { length } = rules;
       const shortcut = this._basenameCount * 2 >= length;
-      const basename = shortcut ? basenameOf(path11) : path11;
+      const basename = shortcut ? basenameOf(path12) : path12;
       for (let index = 0;index < length; index++) {
         const rule = rules[index];
         const { negative } = rule;
         const skip = unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored;
-        if (!skip && rule[mode].test(shortcut && rule._basenameOnly ? basename : path11)) {
+        if (!skip && rule[mode].test(shortcut && rule._basenameOnly ? basename : path12)) {
           ignored = !negative;
           unignored = negative;
           matchedRule = negative ? UNDEFINED : rule;
@@ -7193,38 +8050,38 @@ var require_ignore = __commonJS((exports, module) => {
   var throwError = (message, Ctor) => {
     throw new Ctor(message);
   };
-  var checkPath = (path11, originalPath, doThrow) => {
-    if (!isString(path11)) {
+  var checkPath = (path12, originalPath, doThrow) => {
+    if (!isString(path12)) {
       return doThrow(`path must be a string, but got \`${originalPath}\``, TypeError);
     }
-    if (!path11) {
+    if (!path12) {
       return doThrow(`path must not be empty`, TypeError);
     }
-    if (checkPath.isNotRelative(path11)) {
+    if (checkPath.isNotRelative(path12)) {
       const r = "`path.relative()`d";
       return doThrow(`path should be a ${r} string, but got "${originalPath}"`, RangeError);
     }
     return true;
   };
-  var isNotRelative = (path11) => {
-    const first = path11.charCodeAt(0);
+  var isNotRelative = (path12) => {
+    const first = path12.charCodeAt(0);
     if (first === SLASH_CODE) {
       return true;
     }
     if (first !== DOT_CODE) {
       return false;
     }
-    if (path11.length === 1) {
+    if (path12.length === 1) {
       return true;
     }
-    const second = path11.charCodeAt(1);
+    const second = path12.charCodeAt(1);
     if (second === SLASH_CODE) {
       return true;
     }
     if (second !== DOT_CODE) {
       return false;
     }
-    return path11.length === 2 || path11.charCodeAt(2) === SLASH_CODE;
+    return path12.length === 2 || path12.charCodeAt(2) === SLASH_CODE;
   };
   checkPath.isNotRelative = isNotRelative;
   checkPath.convert = (p) => p;
@@ -7254,51 +8111,51 @@ var require_ignore = __commonJS((exports, module) => {
       return this.add(pattern);
     }
     _test(originalPath, cache, checkUnignored) {
-      const path11 = originalPath && checkPath.convert(originalPath);
-      checkPath(path11, originalPath, this._strictPathCheck ? throwError : RETURN_FALSE);
-      return this._t(path11, cache, checkUnignored);
+      const path12 = originalPath && checkPath.convert(originalPath);
+      checkPath(path12, originalPath, this._strictPathCheck ? throwError : RETURN_FALSE);
+      return this._t(path12, cache, checkUnignored);
     }
-    checkIgnore(path11) {
-      if (path11.charCodeAt(path11.length - 1) !== SLASH_CODE) {
-        return this.test(path11);
+    checkIgnore(path12) {
+      if (path12.charCodeAt(path12.length - 1) !== SLASH_CODE) {
+        return this.test(path12);
       }
-      const parentPath = parentOf(path11);
+      const parentPath = parentOf(path12);
       if (parentPath) {
         const parent = this._t(parentPath, this._testCache, true);
         if (parent.ignored) {
           return parent;
         }
       }
-      return this._rules.test(path11, false, MODE_CHECK_IGNORE);
+      return this._rules.test(path12, false, MODE_CHECK_IGNORE);
     }
-    _t(path11, cache, checkUnignored) {
-      if (path11 in cache) {
-        return cache[path11];
+    _t(path12, cache, checkUnignored) {
+      if (path12 in cache) {
+        return cache[path12];
       }
-      const parentPath = parentOf(path11);
+      const parentPath = parentOf(path12);
       const parent = parentPath ? this._t(parentPath, cache, checkUnignored) : UNDEFINED;
-      return cache[path11] = parent && parent.ignored ? parent : this._rules.test(path11, checkUnignored, MODE_IGNORE);
+      return cache[path12] = parent && parent.ignored ? parent : this._rules.test(path12, checkUnignored, MODE_IGNORE);
     }
-    ignores(path11) {
-      return this._test(path11, this._ignoreCache, false).ignored;
+    ignores(path12) {
+      return this._test(path12, this._ignoreCache, false).ignored;
     }
     createFilter() {
-      return (path11) => !this.ignores(path11);
+      return (path12) => !this.ignores(path12);
     }
     filter(paths) {
       return makeArray(paths).filter(this.createFilter());
     }
-    test(path11) {
-      return this._test(path11, this._testCache, true);
+    test(path12) {
+      return this._test(path12, this._testCache, true);
     }
   }
   var factory = (options) => new Ignore(options);
-  var isPathValid = (path11) => checkPath(path11 && checkPath.convert(path11), path11, RETURN_FALSE);
+  var isPathValid = (path12) => checkPath(path12 && checkPath.convert(path12), path12, RETURN_FALSE);
   var setupWindows = () => {
     const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
     checkPath.convert = makePosix;
     const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
-    checkPath.isNotRelative = (path11) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path11) || isNotRelative(path11);
+    checkPath.isNotRelative = (path12) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path12) || isNotRelative(path12);
   };
   if (typeof process !== "undefined" && process.platform === "win32") {
     setupWindows();
@@ -7321,15 +8178,15 @@ __export(exports_daemon, {
   checkAndInstallUpdate: () => checkAndInstallUpdate,
   WATCH_LIMIT: () => WATCH_LIMIT
 });
-import fs13 from "node:fs";
-import path11 from "node:path";
-import { spawn as spawn2 } from "node:child_process";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import fs14 from "node:fs";
+import path12 from "node:path";
+import { spawn as spawn3 } from "node:child_process";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function peerRoot(key) {
-  return path11.dirname(key);
+  return path12.dirname(key);
 }
 function peerName(key) {
-  return peerNameOf(path11.basename(key)) ?? DEFAULT_PEER;
+  return peerNameOf(path12.basename(key)) ?? DEFAULT_PEER;
 }
 function peerFields(key) {
   const peer = peerName(key);
@@ -7417,7 +8274,7 @@ function maybeAdoptNewerInstall(state, bootVersion) {
     executable: onPath,
     reason: "new-install"
   });
-  const child = spawn2(onPath, ["daemon", "restart"], {
+  const child = spawn3(onPath, ["daemon", "restart"], {
     detached: true,
     stdio: "ignore",
     windowsHide: true,
@@ -7437,7 +8294,7 @@ async function runCycle(state) {
   let skipped = 0;
   for (const instance of readInstances()) {
     const key = instance.configPath;
-    if (!fs13.existsSync(instance.configPath)) {
+    if (!fs14.existsSync(instance.configPath)) {
       const misses = (state.misses.get(key) ?? 0) + 1;
       state.misses.set(key, misses);
       if (misses >= PRUNE_AFTER_MISSES) {
@@ -7551,7 +8408,7 @@ async function syncIfDirty(state, key, trigger) {
 }
 async function checkoutIsDirty(key) {
   const sidecarPath = readInstances().find((instance) => instance.configPath === key)?.sidecarPath;
-  if (!sidecarPath || !fs13.existsSync(sidecarPath))
+  if (!sidecarPath || !fs14.existsSync(sidecarPath))
     return false;
   const result = await runChild("git", ["-C", sidecarPath, "status", "--porcelain"], { timeoutMs: 30000 });
   return result.status === 0 && Boolean(result.stdout.trim());
@@ -7559,7 +8416,7 @@ async function checkoutIsDirty(key) {
 function localSidecarCliPath(root) {
   if (!projectDependsOnSidecar(root))
     return;
-  const candidate = path11.join(root, "node_modules", PACKAGE_NAME, "dist", "cli.js");
+  const candidate = path12.join(root, "node_modules", PACKAGE_NAME, "dist", "cli.js");
   if (!isFile(candidate))
     return;
   const localVersion = installedPackageVersion(root);
@@ -7568,10 +8425,10 @@ function localSidecarCliPath(root) {
   return candidate;
 }
 function currentCliPath() {
-  return process.argv[1] || fileURLToPath3(import.meta.url);
+  return process.argv[1] || fileURLToPath2(import.meta.url);
 }
 function selectWatchTargets(instances, limit = WATCH_LIMIT) {
-  return [...instances].filter((instance) => fs13.existsSync(instance.configPath) && fs13.existsSync(instance.sidecarPath)).sort((left, right) => instanceRecency(right) - instanceRecency(left)).slice(0, limit);
+  return [...instances].filter((instance) => fs14.existsSync(instance.configPath) && fs14.existsSync(instance.sidecarPath)).sort((left, right) => instanceRecency(right) - instanceRecency(left)).slice(0, limit);
 }
 function instanceRecency(instance) {
   const time = Date.parse(instance.lastSyncAt ?? instance.updatedAt ?? instance.registeredAt);
@@ -7622,8 +8479,8 @@ async function refreshWatchers(state) {
         });
         watcher.on("all", (...args) => {
           scheduleWatchSync(state, key);
-          const changedPath = typeof args[1] === "string" ? path11.resolve(args[1]) : "";
-          if (changedPath !== path11.join(path11.resolve(sidecarPath), ".gitignore"))
+          const changedPath = typeof args[1] === "string" ? path12.resolve(args[1]) : "";
+          if (changedPath !== path12.join(path12.resolve(sidecarPath), ".gitignore"))
             return;
           if (state.watchers.get(key) !== watcher)
             return;
@@ -7717,7 +8574,7 @@ async function watchRegistry(state) {
     const watcher = chokidar.watch(sidecarStateDir(), { ignoreInitial: true, depth: 0 });
     watcher.on("all", (...args) => {
       const filePath = typeof args[1] === "string" ? args[1] : "";
-      if (path11.basename(filePath) !== "instances.json")
+      if (path12.basename(filePath) !== "instances.json")
         return;
       if (state.registryTimer)
         return;
@@ -7736,7 +8593,7 @@ async function watchRegistry(state) {
 function compileGitignoreMatcher(lines) {
   const rules = import_ignore.default({ ignorecase: false }).add(lines);
   return (relativePath) => {
-    const normalized = relativePath.split(path11.sep).join("/");
+    const normalized = relativePath.split(path12.sep).join("/");
     if (!import_ignore.default.isPathValid(normalized))
       return false;
     return rules.ignores(normalized);
@@ -7745,19 +8602,19 @@ function compileGitignoreMatcher(lines) {
 function watchIgnoreMatcher(sidecarPath) {
   let gitignore;
   try {
-    const ignoreFile = path11.join(sidecarPath, ".gitignore");
-    if (fs13.existsSync(ignoreFile)) {
-      gitignore = compileGitignoreMatcher(fs13.readFileSync(ignoreFile, "utf8").split(`
+    const ignoreFile = path12.join(sidecarPath, ".gitignore");
+    if (fs14.existsSync(ignoreFile)) {
+      gitignore = compileGitignoreMatcher(fs14.readFileSync(ignoreFile, "utf8").split(`
 `));
     }
   } catch {}
-  const root = path11.resolve(sidecarPath);
+  const root = path12.resolve(sidecarPath);
   return (candidate, stats) => {
-    const relative = path11.relative(root, candidate);
+    const relative = path12.relative(root, candidate);
     if (!relative)
       return false;
-    const normalized = relative.split(path11.sep).join("/");
-    if (normalized === ".." || normalized.startsWith("../") || path11.isAbsolute(relative))
+    const normalized = relative.split(path12.sep).join("/");
+    if (normalized === ".." || normalized.startsWith("../") || path12.isAbsolute(relative))
       return true;
     if (normalized === ".git" || normalized.startsWith(".git/"))
       return true;
@@ -7836,10 +8693,10 @@ function restartAfterUpdate() {
 }
 async function acquireDaemonPid() {
   const pidPath = daemonPidPath();
-  fs13.mkdirSync(path11.dirname(pidPath), { recursive: true });
+  fs14.mkdirSync(path12.dirname(pidPath), { recursive: true });
   while (true) {
     try {
-      fs13.writeFileSync(pidPath, `${process.pid}
+      fs14.writeFileSync(pidPath, `${process.pid}
 `, { encoding: "utf8", flag: "wx" });
       return;
     } catch (error) {
@@ -7855,7 +8712,7 @@ async function acquireDaemonPid() {
       continue;
     }
     logSidecarEvent("daemon-pid-heal", { holder: holder ?? null });
-    fs13.rmSync(pidPath, { force: true });
+    fs14.rmSync(pidPath, { force: true });
   }
 }
 function installShutdownHandlers() {
@@ -7870,12 +8727,12 @@ function installShutdownHandlers() {
 function removeOwnPidFile() {
   try {
     if (readPid(daemonPidPath()) === process.pid)
-      fs13.rmSync(daemonPidPath(), { force: true });
+      fs14.rmSync(daemonPidPath(), { force: true });
   } catch {}
 }
 function readPid(pidPath) {
   try {
-    const pid = Number(fs13.readFileSync(pidPath, "utf8").trim());
+    const pid = Number(fs14.readFileSync(pidPath, "utf8").trim());
     return Number.isInteger(pid) && pid > 0 ? pid : undefined;
   } catch {
     return;
@@ -7883,7 +8740,7 @@ function readPid(pidPath) {
 }
 function runChild(command, args, options) {
   return new Promise((resolve) => {
-    const child = spawn2(command, args, {
+    const child = spawn3(command, args, {
       cwd: options.cwd,
       env: options.env ?? process.env,
       stdio: ["ignore", "pipe", "pipe"],
@@ -7916,21 +8773,21 @@ function runChild(command, args, options) {
 }
 function isFile(filePath) {
   try {
-    return fs13.statSync(filePath).isFile();
+    return fs14.statSync(filePath).isFile();
   } catch {
     return false;
   }
 }
 function realpathOr2(filePath) {
   try {
-    return fs13.realpathSync(filePath);
+    return fs14.realpathSync(filePath);
   } catch {
-    return path11.resolve(filePath);
+    return path12.resolve(filePath);
   }
 }
 function isInsidePath2(child, parent) {
-  const relative = path11.relative(parent, child);
-  return Boolean(relative) && !relative.startsWith("..") && !path11.isAbsolute(relative);
+  const relative = path12.relative(parent, child);
+  return Boolean(relative) && !relative.startsWith("..") && !path12.isAbsolute(relative);
 }
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -8132,9 +8989,9 @@ var init_cmd_daemon = __esm(() => {
 });
 
 // src/cmd-sync.ts
-import fs14 from "node:fs";
+import fs15 from "node:fs";
 import os6 from "node:os";
-import path12 from "node:path";
+import path13 from "node:path";
 function cmdSnapshot(args) {
   const parsed = parseOptions(args, {
     boolean: new Set(["--push"]),
@@ -8154,6 +9011,9 @@ function cmdSnapshot(args) {
       ensureInboxBranch(sidecarPath, config, inbox);
       const committed = snapshot(sidecarPath, root, inbox, getValue(parsed, "--message", getValue(parsed, "-m", "")) || undefined, config.redaction, config);
       if (committed && parsed.flags.has("--push")) {
+        if (reviewRequired(config)) {
+          throw new SidecarError("this peer requires review before anything is published; `sidecar sync` opens or advances the review");
+        }
         syncBranchBeforePush(sidecarPath, inbox, config);
         pushBranch(sidecarPath, inbox);
       }
@@ -8171,12 +9031,19 @@ function cmdSync(args) {
   }
   const peers = loadPeers(selectedPeer(parsed), { loadRules: false });
   const failed = [];
+  const soft = parsed.flags.has("--soft") || process.env[SOFT_SYNC_ENV] === "1";
+  const options = {
+    lock: soft ? "skip" : "throw",
+    remote: !parsed.flags.has("--local") && process.env[LOCAL_SYNC_ENV] !== "1",
+    snapshot: !parsed.flags.has("--no-snapshot"),
+    message: getValue(parsed, "--message", getValue(parsed, "-m", "")) || undefined
+  };
   for (const peer of peers) {
     announcePeer(peer, peers);
     try {
       if (peer.config.rulesPath)
         peer.config.rules = readRules(peer.config.rulesPath);
-      syncPeer(peer, parsed);
+      syncPeer(peer, options);
     } catch (error) {
       if (peers.length === 1)
         throw error;
@@ -8189,18 +9056,19 @@ function cmdSync(args) {
   }
   return 0;
 }
-function syncPeer(peer, parsed) {
+function syncPeer(peer, options) {
   const { root, config } = peer;
-  const soft = parsed.flags.has("--soft") || process.env[SOFT_SYNC_ENV] === "1";
-  const remote = !parsed.flags.has("--local") && process.env[LOCAL_SYNC_ENV] !== "1";
+  const { remote } = options;
+  const soft = options.lock === "skip";
   let stage = "start";
+  let outcome = {};
   let synced;
   try {
-    synced = withSyncLock(root, peer.name, soft ? "skip" : "throw", () => {
-      syncProject(root, config, {
-        snapshot: !parsed.flags.has("--no-snapshot"),
+    synced = withSyncLock(root, peer.name, options.lock, () => {
+      outcome = syncProject(root, config, {
+        snapshot: options.snapshot,
         remote,
-        message: getValue(parsed, "--message", getValue(parsed, "-m", "")) || undefined,
+        message: options.message,
         onStage: (name) => {
           stage = name;
         }
@@ -8208,17 +9076,25 @@ function syncPeer(peer, parsed) {
       registerCurrentInstance(root, config, remote ? { event: "sync", lastSyncAt: nowIso() } : { event: "sync-local" });
     });
   } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
     if (remote)
       reportSyncHealth(root, config, {
         status: "failed",
         stage,
-        message: error instanceof Error ? error.message : String(error)
+        message: reviewRequired(config) ? "details are kept on this machine; see `sidecar tail` there" : message
       });
+    if (reviewRequired(config))
+      logSidecarEvent("failure", { command: "sync", root, stage, message });
     throw error;
   }
   if (synced) {
+    const held = outcome.held;
+    if (held) {
+      const { id } = held.review.record;
+      console.log(held.attention ? `sidecar: publishing is held — review ${id} needs attention: ${held.attention}; \`sidecar review show ${id}\`` : `sidecar: publishing is held for review ${id}; \`sidecar review show ${id}\``);
+    }
     if (remote)
-      reportSyncHealth(root, config, { status: "ok" });
+      reportSyncHealth(root, config, held ? { status: "ok", review: held.attention ? "attention" : "pending" } : { status: "ok" });
     if (!soft) {
       const sidecarPath = resolveSidecarPath(root, config);
       if (checkoutIsUnlinkedFromFamily(root, config, sidecarPath)) {
@@ -8244,11 +9120,14 @@ function cmdMerge(args) {
     const sidecarPath = requireSidecarCheckout(root, config);
     withSyncLock(root, peer.name, "throw", () => {
       ensureRedactionFilter(sidecarPath, config.redaction, config);
-      mergeInboxBranches(sidecarPath, config, {
-        forkFiles: parsed.flags.has("--fork-files"),
-        push: !parsed.flags.has("--no-push"),
-        remote: true
-      });
+      const forkFiles = parsed.flags.has("--fork-files");
+      const push = !parsed.flags.has("--no-push");
+      if (reviewRequired(config) && push) {
+        mergePublishedInboxes(sidecarPath, config, { forkFiles });
+        mergeInboxBranches(sidecarPath, config, { forkFiles, push: false, remote: false });
+        return;
+      }
+      mergeInboxBranches(sidecarPath, config, { forkFiles, push, remote: true });
     });
   }
   return 0;
@@ -8272,7 +9151,7 @@ function printPeerRedactions({ root, config }) {
   let shown = 0;
   let items = 0;
   for (const relPath of files) {
-    const delta = fileRedactionDelta(path12.join(sidecarPath, relPath), config.redaction, { rules: config.rules, relativePath: relPath });
+    const delta = fileRedactionDelta(path13.join(sidecarPath, relPath), config.redaction, { rules: config.rules, relativePath: relPath });
     if (!delta)
       continue;
     if (shown)
@@ -8291,12 +9170,12 @@ ${items} redaction(s) in ${shown} file(s) will be pushed this way (default: ${co
   console.log("local files are untouched; redaction is controlled by the peer's configuration and rules");
 }
 function printRedactionDiff(original, redacted) {
-  const scratch = fs14.mkdtempSync(path12.join(os6.tmpdir(), "sidecar-redactions-"));
+  const scratch = fs15.mkdtempSync(path13.join(os6.tmpdir(), "sidecar-redactions-"));
   try {
-    const localPath = path12.join(scratch, "local");
-    const pushedPath = path12.join(scratch, "pushed");
-    fs14.writeFileSync(localPath, original, "utf8");
-    fs14.writeFileSync(pushedPath, redacted, "utf8");
+    const localPath = path13.join(scratch, "local");
+    const pushedPath = path13.join(scratch, "pushed");
+    fs15.writeFileSync(localPath, original, "utf8");
+    fs15.writeFileSync(pushedPath, redacted, "utf8");
     const color = colorLevel() > 0 ? ["--color"] : [];
     const diff = gitRaw(["diff", "--no-index", ...color, "--", localPath, pushedPath], { check: false });
     const lines = diff.stdout.split(`
@@ -8307,7 +9186,7 @@ function printRedactionDiff(original, redacted) {
     if (body)
       console.log(body);
   } finally {
-    fs14.rmSync(scratch, { recursive: true, force: true });
+    fs15.rmSync(scratch, { recursive: true, force: true });
   }
 }
 function cmdRedact(args) {
@@ -8323,15 +9202,15 @@ function cmdRedact(args) {
   }
   const mode = redactionModeConfigValue(getValue(parsed, "--mode", DEFAULT_REDACTION_MODE), "--mode");
   const rulesPath = parsed.values.get("--rules");
-  const effective = checkoutPolicy ? checkoutRedactionPolicy(process.cwd()) : { mode, rules: rulesPath ? readRules(path12.resolve(rulesPath)) : [] };
+  const effective = checkoutPolicy ? checkoutRedactionPolicy(process.cwd()) : { mode, rules: rulesPath ? readRules(path13.resolve(rulesPath)) : [] };
   const relativePath = parsed.values.get("--path");
   if ((checkoutPolicy || rulesPath) && !relativePath)
     throw new SidecarError("redaction rules require --path");
   const effectiveMode = relativePath ? resolveFileRules(effective.rules, relativePath, { resolve: "fork", redaction: effective.mode }).redaction : effective.mode;
-  const output = redactBuffer(fs14.readFileSync(0), effectiveMode);
+  const output = redactBuffer(fs15.readFileSync(0), effectiveMode);
   let offset = 0;
   while (offset < output.length) {
-    offset += fs14.writeSync(1, output, offset, output.length - offset);
+    offset += fs15.writeSync(1, output, offset, output.length - offset);
   }
   return 0;
 }
@@ -8347,6 +9226,215 @@ var init_cmd_sync = __esm(() => {
   init_ui();
 });
 
+// src/cmd-review.ts
+import fs16 from "node:fs";
+import path14 from "node:path";
+function cmdReview(args) {
+  const [subcommand = "list", ...rest] = args[0]?.startsWith("-") ? ["list", ...args] : args;
+  switch (subcommand) {
+    case "list":
+      return listCommand(rest);
+    case "show":
+      return showCommand(rest);
+    case "approve":
+    case "reject":
+      return decideCommand(subcommand, rest);
+    case "retry":
+      return retryCommand(rest);
+    case "reviewer":
+      return reviewerCommand(rest);
+    case "run":
+      return runCommand(rest);
+    default:
+      throw new SidecarError(`unknown review command ${JSON.stringify(subcommand)}; ${USAGE}`);
+  }
+}
+function listCommand(args) {
+  const parsed = parseOptions(args, { boolean: new Set(["--json"]), value: new Set(["--peer"]) });
+  if (parsed.positional.length)
+    throw new SidecarError(USAGE);
+  const peers = loadPeers(selectedPeer(parsed));
+  if (parsed.flags.has("--json")) {
+    console.log(JSON.stringify(peers.map((peer) => ({
+      peer: peer.name,
+      required: reviewRequired(peer.config),
+      reviews: peerReviews(peer).map(reviewPayload)
+    })), null, 2));
+    return 0;
+  }
+  for (const peer of peers) {
+    announcePeer(peer, peers);
+    if (!reviewRequired(peer.config)) {
+      console.log(paint("quiet", 'review is off for this peer; turn it on with review = "required" in its config'));
+      continue;
+    }
+    const reviews = peerReviews(peer);
+    if (!reviews.length) {
+      console.log(paint("quiet", "no reviews yet; the next sync with unpublished changes opens one"));
+      continue;
+    }
+    for (const review of reviews)
+      printReviewRow(review);
+  }
+  return 0;
+}
+function peerReviews(peer) {
+  const sidecarPath = resolveSidecarPath(peer.root, peer.config);
+  return hasGitMetadata(sidecarPath) ? listReviews(sidecarPath) : [];
+}
+function printReviewRow(review) {
+  const attention = reviewAttention(review);
+  const age = formatRelativeTime(review.record.createdAt) ?? review.record.createdAt;
+  const text = `${review.record.id}  ${review.state.padEnd(10)}  ${age}, ${review.record.files.length} file(s)`;
+  if (attention)
+    console.log(`${paint("attn", text)}  needs attention: ${attention}`);
+  else
+    console.log(isOpen(review) ? text : paint("quiet", text));
+}
+function reviewPayload(review) {
+  return {
+    id: review.record.id,
+    state: review.state,
+    attention: reviewAttention(review),
+    createdAt: review.record.createdAt,
+    files: review.record.files,
+    reason: review.verdict?.reason,
+    decidedAt: review.verdict?.decidedAt,
+    publishedAt: review.record.publishedAt,
+    publishedCommit: review.record.publishedCommit,
+    dir: review.dir
+  };
+}
+function showCommand(args) {
+  const parsed = parseOptions(args, { boolean: new Set(["--json"]), value: new Set(["--peer"]) });
+  if (parsed.positional.length > 1)
+    throw new SidecarError(USAGE);
+  const review = selectReview(parsed.positional[0], selectedPeer(parsed));
+  if (parsed.flags.has("--json")) {
+    console.log(JSON.stringify(reviewPayload(review), null, 2));
+    return 0;
+  }
+  const { record } = review;
+  const line = (label, value, role) => labelLine(LABEL_WIDTH, label, value, role);
+  const attention = reviewAttention(review);
+  line("review", record.id, "brand");
+  line("state", attention ? `${review.state} — needs attention: ${attention}` : review.state, attention ? "attn" : undefined);
+  line("repo", record.root, "repo");
+  if (record.peer !== "default")
+    line("peer", record.peer);
+  line("opened", formatRelativeTime(record.createdAt) ?? record.createdAt);
+  if (review.verdict)
+    line("decided", `${review.verdict.verdict} ${formatRelativeTime(review.verdict.decidedAt) ?? review.verdict.decidedAt}`);
+  if (review.verdict?.reason)
+    line("reason", review.verdict.reason);
+  if (review.run)
+    line("reviewer", review.run.command, "quiet");
+  line("packet", review.dir, "quiet");
+  console.log("");
+  for (const file of record.files) {
+    console.log(`  ${file.status}  ${file.path}${file.artifact ? paint("quiet", `  (not in the diff; full content: ${path14.join(review.dir, file.artifact)})`) : ""}`);
+  }
+  console.log("");
+  process.stdout.write(fs16.readFileSync(path14.join(review.dir, "diff.patch"), "utf8"));
+  if (isOpen(review)) {
+    console.log("");
+    console.log(paint("quiet", `decide with \`sidecar review approve ${record.id}\` or \`sidecar review reject ${record.id} --reason "..."\``));
+  }
+  return 0;
+}
+function decideCommand(verdict, args) {
+  const parsed = parseOptions(args, { boolean: new Set(["--no-sync"]), value: new Set(["--reason", "--peer"]) });
+  if (parsed.positional.length > 1)
+    throw new SidecarError(USAGE);
+  const selected = selectReview(parsed.positional[0], selectedPeer(parsed));
+  const reason = parsed.values.get("--reason")?.trim() || undefined;
+  const { id } = selected.record;
+  withLockedReview(selected, (review) => decideReview(review, verdict === "approve" ? "approved" : "rejected", reason));
+  if (verdict === "reject") {
+    console.log(`rejected review ${paint("brand", id)}; nothing it covers is published`);
+    console.log("change the files it flags and the next sync opens a new review, or approve it to override");
+    return 0;
+  }
+  console.log(`approved review ${paint("brand", id)}`);
+  if (parsed.flags.has("--no-sync")) {
+    console.log("it publishes on the next sync");
+    return 0;
+  }
+  const peer = loadPeer(selected.record.root, selected.record.peer);
+  syncPeer(peer, { lock: "wait", remote: true, snapshot: true });
+  return 0;
+}
+function retryCommand(args) {
+  const parsed = parseOptions(args, { boolean: new Set, value: new Set(["--peer"]) });
+  if (parsed.positional.length > 1)
+    throw new SidecarError(USAGE);
+  configuredReviewer();
+  const selected = selectReview(parsed.positional[0], selectedPeer(parsed));
+  withLockedReview(selected, (review) => {
+    resetReview(review);
+    launchReviewer(review);
+  });
+  console.log(`relaunched the reviewer for review ${paint("brand", selected.record.id)}`);
+  return 0;
+}
+function withLockedReview(selected, fn) {
+  const { id, root, peer } = selected.record;
+  withSyncLock(root, peer, "wait", () => {
+    const review = readReview(id);
+    if (!review)
+      throw new SidecarError(`review ${id} is gone`);
+    fn(review);
+  });
+}
+function reviewerCommand(args) {
+  const parsed = parseOptions(args, { boolean: new Set(["--unset"]), value: new Set });
+  const settings = readSettings();
+  if (parsed.flags.has("--unset")) {
+    if (parsed.positional.length)
+      throw new SidecarError("usage: sidecar review reviewer [<command>|--unset]");
+    writeSettings({ ...settings, reviewer: undefined });
+    console.log("reviewer unset; reviews now wait for `sidecar review approve`");
+    return 0;
+  }
+  if (!parsed.positional.length) {
+    console.log(settings.reviewer ?? paint("quiet", "no reviewer configured"));
+    return 0;
+  }
+  const command = parsed.positional.join(" ").trim();
+  if (!command)
+    throw new SidecarError("the reviewer command is empty");
+  writeSettings({ ...settings, reviewer: command });
+  console.log(`reviewer set to ${paint("brand", command)}`);
+  return 0;
+}
+function runCommand(args) {
+  if (args.length !== 2)
+    throw new SidecarError("usage: sidecar review run <id> <attempt>");
+  return runReviewer(args[0], args[1]);
+}
+function selectReview(id, peer) {
+  if (id)
+    return findReview(id);
+  const open = loadPeers(peer).map((candidate) => resolveSidecarPath(candidate.root, candidate.config)).filter(hasGitMetadata).map(openReview).filter((review) => review !== undefined);
+  if (open.length === 1)
+    return open[0];
+  if (!open.length)
+    throw new SidecarError("no open review here; pass a review id (`sidecar review` lists them)");
+  throw new SidecarError(`more than one open review here (${open.map((review) => review.record.id).join(", ")}); pass the id`);
+}
+var USAGE = "usage: sidecar review [list|show|approve|reject|retry|reviewer] [id] [--reason text] [--no-sync] [--json] [--peer name]", LABEL_WIDTH;
+var init_cmd_review = __esm(() => {
+  init_color();
+  init_util();
+  init_git();
+  init_config();
+  init_state();
+  init_review();
+  init_cmd_sync();
+  init_ui();
+  LABEL_WIDTH = "reviewer:".length;
+});
+
 // src/commands.ts
 function run(argv) {
   const [command, ...rest] = argv;
@@ -8420,12 +9508,13 @@ var init_commands = __esm(() => {
   init_cmd_status();
   init_cmd_daemon();
   init_cmd_sync();
+  init_cmd_review();
   COMMANDS = [
     {
       name: "init",
       run: cmdInit,
       section: "common",
-      usage: "init [remote] [--peer name] [--path sidecar|.] [--branch main] [--inbox template] [--redaction none|secrets|secrets+pii] [--resolve fork|lww] [--debounce 10m] [--interval 1h] [--ignored] [--local-install]",
+      usage: "init [remote] [--peer name] [--path sidecar|.] [--branch main] [--inbox template] [--redaction none|secrets|secrets+pii] [--resolve fork|lww] [--review off|required] [--review-timeout 1h] [--debounce 10m] [--interval 1h] [--ignored] [--local-install]",
       notes: [
         "--path . makes this repo itself the sidecar (standalone)",
         "--peer name adds a second sidecar as .sidecar.name; --ignored keeps it out of the tree",
@@ -8447,6 +9536,16 @@ var init_commands = __esm(() => {
       usage: "redactions [--peer name]",
       summary: "preview what redaction rewrites before content is pushed"
     },
+    {
+      name: "review",
+      run: cmdReview,
+      section: "common",
+      usage: "review [show|approve|reject|retry] [id] [--reason text] [--no-sync] [--json] [--peer name]",
+      notes: [
+        'the reviews that gate a peer with review = "required"; approve publishes at once',
+        "review reviewer [<command>|--unset] sets who reviews on this machine"
+      ]
+    },
     {
       name: "sync",
       run: cmdSync,
@@ -8556,20 +9655,20 @@ var init_cli = __esm(() => {
 
 // src/bin.ts
 init_cli();
-import fs15 from "node:fs";
-import path13 from "node:path";
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import fs17 from "node:fs";
+import path15 from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 var SKIP_LOCAL_EXEC_ENV3 = "SIDECAR_SKIP_LOCAL_EXEC";
 var GLOBAL_EXEC_ENV3 = "SIDECAR_GLOBAL_EXEC";
 var PACKAGE_NAME2 = "sidecarsync";
 var GLOBAL_ONLY_COMMANDS = new Set(["daemon", "deinit", "register-install", "set-install-source", "update"]);
 if (process.argv[2] !== "redact" && !process.env[SKIP_LOCAL_EXEC_ENV3]) {
-  const local = findLocalInstall(process.cwd(), fileURLToPath4(import.meta.url));
+  const local = findLocalInstall(process.cwd(), fileURLToPath3(import.meta.url));
   if (local) {
     process.env[GLOBAL_EXEC_ENV3] = "1";
     if (local.newer && !GLOBAL_ONLY_COMMANDS.has(process.argv[2])) {
-      const result = spawnSync5(process.execPath, [local.executable, ...process.argv.slice(2)], {
+      const result = spawnSync6(process.execPath, [local.executable, ...process.argv.slice(2)], {
         stdio: "inherit",
         env: {
           ...process.env,
@@ -8586,15 +9685,15 @@ if (process.argv[2] !== "redact" && !process.env[SKIP_LOCAL_EXEC_ENV3]) {
 }
 process.exit(await main());
 function findLocalInstall(start, self) {
-  let current = path13.resolve(start);
+  let current = path15.resolve(start);
   while (true) {
     if (projectDependsOnSidecar2(current)) {
-      const candidate = path13.join(current, "node_modules", PACKAGE_NAME2, "dist", "cli.js");
+      const candidate = path15.join(current, "node_modules", PACKAGE_NAME2, "dist", "cli.js");
       if (isFile2(candidate) && !sameFile(candidate, self)) {
         return { executable: candidate, newer: localIsNewer(current) };
       }
     }
-    const parent = path13.dirname(current);
+    const parent = path15.dirname(current);
     if (parent === current)
       return;
     current = parent;
@@ -8605,11 +9704,11 @@ function localIsNewer(projectRoot) {
   return localVersion !== undefined && compareVersions(localVersion, packageVersion()) > 0;
 }
 function projectDependsOnSidecar2(projectRoot) {
-  const manifestPath = path13.join(projectRoot, "package.json");
+  const manifestPath = path15.join(projectRoot, "package.json");
   if (!isFile2(manifestPath))
     return false;
   try {
-    const manifest = JSON.parse(fs15.readFileSync(manifestPath, "utf8"));
+    const manifest = JSON.parse(fs17.readFileSync(manifestPath, "utf8"));
     return Boolean(manifest.dependencies?.[PACKAGE_NAME2] || manifest.devDependencies?.[PACKAGE_NAME2] || manifest.optionalDependencies?.[PACKAGE_NAME2] || manifest.peerDependencies?.[PACKAGE_NAME2]);
   } catch {
     return false;
@@ -8617,14 +9716,14 @@ function projectDependsOnSidecar2(projectRoot) {
 }
 function isFile2(filePath) {
   try {
-    return fs15.statSync(filePath).isFile();
+    return fs17.statSync(filePath).isFile();
   } catch {
     return false;
   }
 }
 function sameFile(first, second) {
   try {
-    return fs15.realpathSync(first) === fs15.realpathSync(second);
+    return fs17.realpathSync(first) === fs17.realpathSync(second);
   } catch {
     return false;
   }
diff --git a/packages/sidecar/src/cmd-init.ts b/packages/sidecar/src/cmd-init.ts
index 4fee71a..2d85a86 100644
--- a/packages/sidecar/src/cmd-init.ts
+++ b/packages/sidecar/src/cmd-init.ts
@@ -51,6 +51,7 @@ import {
   durationConfigValue,
   redactionModeConfigValue,
   resolveModeConfigValue,
+  reviewModeConfigValue,
   selectedPeer,
   validateBranch,
   validateInboxTemplate,
@@ -64,6 +65,7 @@ import { cloneOrUpdate, removeRedactionFilter, syncProject } from "./sync.js";
 import { announcePeer, promptLine, promptYesNo, promptYesNoDefaultNo } from "./ui.js";
 import { DEFAULT_REDACTION_MODE, REDACTION_MODES, type RedactionMode } from "./redaction.js";
 import { peerRulesFileName, peerRulesPath, readRules, rulesMayRedact } from "./rules.js";
+import { peerReviewGuidelinesFileName, peerReviewGuidelinesPath, pruneOrphanedReviews } from "./review.js";
 
 export function cmdDeinit(args: string[]): number {
   const parsed = parseOptions(args, { boolean: new Set(["--yes", "-y"]), value: new Set(["--peer"]) });
@@ -148,6 +150,8 @@ export function cmdDeinit(args: string[]): number {
     }
     fs.rmSync(configPath, { force: true });
     fs.rmSync(peerRulesPath(root, name), { force: true });
+    fs.rmSync(peerReviewGuidelinesPath(root, name), { force: true });
+    pruneOrphanedReviews();
     unregisterInstance(configPath);
   });
 
@@ -221,11 +225,11 @@ function removeCheckout(checkoutPath: string): void {
 export function cmdInit(args: string[]): number {
   const parsed = parseOptions(args, {
     boolean: new Set(["--no-clone", "--no-bootstrap-main", "--local-install", "--ignored"]),
-    value: new Set(["--path", "--branch", "--inbox", "--redaction", "--resolve", "--debounce", "--interval", "--peer"]),
+    value: new Set(["--path", "--branch", "--inbox", "--redaction", "--resolve", "--review", "--review-timeout", "--debounce", "--interval", "--peer"]),
   });
   if (parsed.positional.length > 1) {
     throw new SidecarError(
-      "usage: sidecar init [remote] [--peer name] [--path sidecar] [--branch main] [--inbox template] [--redaction mode] [--resolve fork|lww] [--debounce 10m] [--interval 1h] [--ignored]",
+      "usage: sidecar init [remote] [--peer name] [--path sidecar] [--branch main] [--inbox template] [--redaction mode] [--resolve fork|lww] [--review off|required] [--review-timeout 1h] [--debounce 10m] [--interval 1h] [--ignored]",
     );
   }
 
@@ -297,7 +301,9 @@ function configurePeer(root: string, name: string, remote: string | undefined, p
       existing.redaction === getValue(parsed, "--redaction", existing.redaction) &&
       existing.resolve === getValue(parsed, "--resolve", existing.resolve) &&
       existing.debounce === durationConfigValue(parsed.values.get("--debounce") ?? existing.debounce, "--debounce") &&
-      existing.interval === durationConfigValue(parsed.values.get("--interval") ?? existing.interval, "--interval");
+      existing.interval === durationConfigValue(parsed.values.get("--interval") ?? existing.interval, "--interval") &&
+      existing.review === getValue(parsed, "--review", existing.review ?? "off") &&
+      existing.reviewTimeout === durationConfigValue(parsed.values.get("--review-timeout") ?? existing.reviewTimeout, "--review-timeout");
     reuse = unchanged || !promptOverwriteConfig(configPath, existing.remote, remote);
   }
   const config = reuse ? readConfig(configPath) : buildInitConfig(root, name, remote, parsed);
@@ -312,7 +318,7 @@ function configurePeer(root: string, name: string, remote: string | undefined, p
     if (isStandalone(config)) {
       throw new SidecarError("--ignored cannot apply to a standalone sidecar: its .sidecar is part of the tree it syncs");
     }
-    for (const file of [peerFileName(name), peerRulesFileName(name)]) {
+    for (const file of [peerFileName(name), peerRulesFileName(name), peerReviewGuidelinesFileName(name)]) {
       if (isGitTracked(root, file)) {
         throw new SidecarError(`${file} is tracked by git; \`git rm --cached ${file}\` before ignoring it`);
       }
@@ -355,9 +361,11 @@ function excludePeerFile(root: string, name: string): void {
     throw new SidecarError(`--ignored needs a git exclude file, and ${root} has none; ignore ${configFile} in your own VCS config`);
   }
   const rulesFile = peerRulesFileName(name);
+  const guidelinesFile = peerReviewGuidelinesFileName(name);
   ensureIgnoreLine(exclude, `/${configFile}`);
   ensureIgnoreLine(exclude, `/${rulesFile}`);
-  console.log(`ignored ${configFile} and ${rulesFile} via .git/info/exclude`);
+  ensureIgnoreLine(exclude, `/${guidelinesFile}`);
+  console.log(`ignored ${configFile}, ${rulesFile}, and ${guidelinesFile} via .git/info/exclude`);
 }
 
 /**
@@ -420,6 +428,8 @@ function buildInitConfig(root: string, name: string, remote: string | undefined,
       : DEFAULT_RESOLVE,
     debounce: durationConfigValue(parsed.values.get("--debounce"), "--debounce"),
     interval: durationConfigValue(parsed.values.get("--interval"), "--interval"),
+    review: reviewModeConfigValue(getValue(parsed, "--review", "off"), "--review"),
+    reviewTimeout: durationConfigValue(parsed.values.get("--review-timeout"), "--review-timeout"),
   };
 }
 
diff --git a/packages/sidecar/src/cmd-refresh.ts b/packages/sidecar/src/cmd-refresh.ts
index 7c686b3..9c4b362 100644
--- a/packages/sidecar/src/cmd-refresh.ts
+++ b/packages/sidecar/src/cmd-refresh.ts
@@ -17,7 +17,7 @@ import {
   fetch,
   git,
   hasAnyCommit,
-  isDirty,
+  isAncestor,
 } from "./git.js";
 import {
   type Peer,
@@ -25,8 +25,12 @@ import {
   expandInbox,
   isStandalone,
   loadPeers,
+  PUBLIC_REFS,
+  inboxPrefix,
+  matchesInboxPrefix,
   requireSidecarCheckout,
   resolveSidecarPath,
+  reviewRequired,
   selectedPeer,
 } from "./config.js";
 import { logSidecarEvent, registerCurrentInstance, withSyncLock } from "./state.js";
@@ -36,9 +40,11 @@ import {
   ensureMainBranch,
   ensureRedactionFilter,
   familySidecarCheckout,
+  refreshPublicRefs,
 } from "./sync.js";
 import { announcePeer, promptYesNoDefaultNo } from "./ui.js";
 import { rulesMayRedact } from "./rules.js";
+import { type Review, markSuperseded, openReview } from "./review.js";
 
 /**
  * Which of a repo's worktrees holds a branch, if any.
@@ -91,17 +97,75 @@ export function unpushedCommits(sidecarPath: string): number {
   return counted.status === 0 ? Number(counted.stdout.trim()) || 0 : 0;
 }
 
+/**
+ * What deleting this checkout would lose, as phrases for a refusal; empty
+ * when nothing. Measured against the remote refs as last fetched.
+ */
+function heldWork(sidecarPath: string, config: SidecarConfig, inbox: string): string[] {
+  // A review-gated checkout never pushes its own commits, so counting them
+  // would refuse forever; what it would lose is content not yet published.
+  const gated = reviewRequired(config);
+  const unpushed = gated ? 0 : unpushedCommits(sidecarPath);
+  const unpublished = gated && !gatedWorkIsPublished(sidecarPath, config, inbox);
+  const dirtyFiles = git(sidecarPath, ["status", "--porcelain"], { check: false })
+    .stdout.split("\n")
+    .filter(Boolean).length;
+  return [
+    unpushed ? `${unpushed} commit(s) the remote has not seen` : "",
+    unpublished ? "changes not yet published through review" : "",
+    dirtyFiles ? `${dirtyFiles} uncommitted file(s)` : "",
+  ].filter(Boolean);
+}
+
+/**
+ * Whether deleting this gated checkout loses nothing unpublished. Its own
+ * HEAD must be published, or held by a local main that is. A checkout owning
+ * the family's store takes local main and every sibling's inbox with it, so
+ * then all of those must be published too: a gated bootstrap, for one, leaves
+ * the checkout's history on local main while its inbox starts empty.
+ */
+function gatedWorkIsPublished(sidecarPath: string, config: SidecarConfig, inbox: string): boolean {
+  if (!hasAnyCommit(sidecarPath)) return true;
+  const tree = (ref: string): string | undefined => {
+    const result = git(sidecarPath, ["rev-parse", "--verify", "--quiet", `${ref}^{tree}`], { check: false });
+    return result.status === 0 ? result.stdout.trim() : undefined;
+  };
+  // Against the public refs, not origin/*: those are local state any hook or
+  // tool can write, and a forged one would let refresh delete unpublished work.
+  const main = `refs/heads/${config.branch}`;
+  const publicMain = tree(`${PUBLIC_REFS}${config.branch}`);
+  const mainTree = tree(main);
+  const mainPublished = mainTree === undefined || mainTree === publicMain;
+  const published = (ref: string, branch: string): boolean => {
+    const own = tree(ref);
+    return own === publicMain || own === tree(`${PUBLIC_REFS}${branch}`) || (mainPublished && isAncestor(sidecarPath, ref, main));
+  };
+  if (!published("HEAD", inbox)) return false;
+  if (!ownsStore(sidecarPath)) return true;
+  if (!mainPublished) return false;
+  const prefix = inboxPrefix(config);
+  return git(sidecarPath, ["for-each-ref", "--format=%(refname)", "refs/heads/"])
+    .stdout.split("\n")
+    .filter((ref) => ref && matchesInboxPrefix(prefix, ref.slice("refs/heads/".length)))
+    .every((ref) => published(ref, ref.slice("refs/heads/".length)));
+}
+
+/** Whether this checkout holds its family's Git store rather than linking to one. */
+function ownsStore(sidecarPath: string): boolean {
+  try {
+    return fs.statSync(path.join(sidecarPath, ".git")).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Checkouts hanging off this one as linked worktrees — the ones that deleting it
  * would break. Empty unless this checkout owns the store: asked of a linked
  * worktree, `worktree list` answers for the whole family.
  */
 export function dependentWorktrees(sidecarPath: string): string[] {
-  try {
-    if (!fs.statSync(path.join(sidecarPath, ".git")).isDirectory()) return [];
-  } catch {
-    return [];
-  }
+  if (!ownsStore(sidecarPath)) return [];
   const result = git(sidecarPath, ["worktree", "list", "--porcelain"], { check: false });
   if (result.status !== 0) return [];
   const self = realpathOr(sidecarPath);
@@ -172,6 +236,18 @@ export function refreshCheckout(root: string, config: SidecarConfig): void {
   }
 
   const checkoutId = existingCheckoutId(sidecarPath);
+  // Deleting the family's own clone deletes the commits its open review is
+  // of, so retire it; the next sync reviews whatever is still unpublished. A
+  // linked worktree shares the clone and leaves the review alone.
+  if (ownsStore(sidecarPath)) {
+    let open: Review | undefined;
+    try {
+      open = openReview(sidecarPath);
+    } catch {
+      // An unreadable clone (refresh --force) has no family to look up.
+    }
+    if (open) markSuperseded(open);
+  }
   fs.rmSync(sidecarPath, { recursive: true, force: true });
   // Something may still hold an admin entry for the path this checkout occupied:
   // the family's clone if it was a linked worktree, or the family's clone again
@@ -309,15 +385,14 @@ function refreshPeer({ root, config, name }: Peer, parsed: ParsedOptions): void
     // current as the network allows before anything is counted against it. A
     // stale one over-counts, which errs toward refusing.
     fetch(sidecarPath, true, false);
-    const unpushed = unpushedCommits(sidecarPath);
-    const dirtyFiles = git(sidecarPath, ["status", "--porcelain"], { check: false })
-      .stdout.split("\n")
-      .filter(Boolean).length;
-    if ((unpushed || dirtyFiles) && !force) {
-      const held = [
-        unpushed ? `${unpushed} commit(s) the remote has not seen` : "",
-        dirtyFiles ? `${dirtyFiles} uncommitted file(s)` : "",
-      ].filter(Boolean);
+    // A gated checkout is measured against the public refs, which only
+    // sidecar's own fetch writes; offline, they stay as last fetched, which
+    // errs toward refusing.
+    if (reviewRequired(config)) {
+      try { refreshPublicRefs(sidecarPath); } catch { /* offline: last fetched */ }
+    }
+    const held = heldWork(sidecarPath, config, inbox);
+    if (held.length && !force) {
       throw new SidecarError(
         `this checkout still holds ${held.join(" and ")}; run \`sidecar sync\` to push them, then refresh — or \`sidecar refresh --force\` to discard them`,
       );
@@ -372,7 +447,9 @@ function refreshPeer({ root, config, name }: Peer, parsed: ParsedOptions): void
   withSyncLock(root, name, "throw", () => {
     // Re-read under the lock: the prompt above is unbounded, and a sync or an
     // agent could have written to the checkout while it sat there.
-    if (readable && !force && isDirty(sidecarPath)) {
+    // Every guard, not only dirtiness: a sync in that window can snapshot new
+    // work and leave the checkout clean but holding it.
+    if (readable && !force && inbox && heldWork(sidecarPath, config, inbox).length) {
       throw new SidecarError("the sidecar checkout changed while waiting for confirmation; rerun refresh");
     }
     if (standalone) declined = refreshStandaloneCheckout(root, config, force);
diff --git a/packages/sidecar/src/cmd-review.ts b/packages/sidecar/src/cmd-review.ts
new file mode 100644
index 0000000..927b9a4
--- /dev/null
+++ b/packages/sidecar/src/cmd-review.ts
@@ -0,0 +1,239 @@
+// `sidecar review`: list, show, and decide the reviews that gate a peer's
+// publishing, set this machine's reviewer, and — as `review run` — the
+// background runner a sync starts. The records and runner live in review.ts;
+// the publishing they gate lives in sync.ts.
+import fs from "node:fs";
+import path from "node:path";
+
+import { type Role, paint } from "./color.js";
+import { SidecarError, parseOptions } from "./util.js";
+import { hasGitMetadata } from "./git.js";
+import { type Peer, loadPeer, loadPeers, resolveSidecarPath, reviewRequired, selectedPeer } from "./config.js";
+import { readSettings, withSyncLock, writeSettings } from "./state.js";
+import {
+  type Review,
+  configuredReviewer,
+  decideReview,
+  findReview,
+  isOpen,
+  launchReviewer,
+  listReviews,
+  openReview,
+  readReview,
+  resetReview,
+  reviewAttention,
+  runReviewer,
+} from "./review.js";
+import { syncPeer } from "./cmd-sync.js";
+import { announcePeer, formatRelativeTime, labelLine } from "./ui.js";
+
+const USAGE = "usage: sidecar review [list|show|approve|reject|retry|reviewer] [id] [--reason text] [--no-sync] [--json] [--peer name]";
+// "reviewer:" is the longest label.
+const LABEL_WIDTH = "reviewer:".length;
+
+export function cmdReview(args: string[]): number {
+  const [subcommand = "list", ...rest] = args[0]?.startsWith("-") ? ["list", ...args] : args;
+  switch (subcommand) {
+    case "list":
+      return listCommand(rest);
+    case "show":
+      return showCommand(rest);
+    case "approve":
+    case "reject":
+      return decideCommand(subcommand, rest);
+    case "retry":
+      return retryCommand(rest);
+    case "reviewer":
+      return reviewerCommand(rest);
+    case "run":
+      return runCommand(rest);
+    default:
+      throw new SidecarError(`unknown review command ${JSON.stringify(subcommand)}; ${USAGE}`);
+  }
+}
+
+function listCommand(args: string[]): number {
+  const parsed = parseOptions(args, { boolean: new Set(["--json"]), value: new Set(["--peer"]) });
+  if (parsed.positional.length) throw new SidecarError(USAGE);
+  const peers = loadPeers(selectedPeer(parsed));
+  if (parsed.flags.has("--json")) {
+    console.log(JSON.stringify(peers.map((peer) => ({
+      peer: peer.name,
+      required: reviewRequired(peer.config),
+      reviews: peerReviews(peer).map(reviewPayload),
+    })), null, 2));
+    return 0;
+  }
+  for (const peer of peers) {
+    announcePeer(peer, peers);
+    if (!reviewRequired(peer.config)) {
+      console.log(paint("quiet", "review is off for this peer; turn it on with review = \"required\" in its config"));
+      continue;
+    }
+    const reviews = peerReviews(peer);
+    if (!reviews.length) {
+      console.log(paint("quiet", "no reviews yet; the next sync with unpublished changes opens one"));
+      continue;
+    }
+    for (const review of reviews) printReviewRow(review);
+  }
+  return 0;
+}
+
+function peerReviews(peer: Peer): Review[] {
+  const sidecarPath = resolveSidecarPath(peer.root, peer.config);
+  return hasGitMetadata(sidecarPath) ? listReviews(sidecarPath) : [];
+}
+
+function printReviewRow(review: Review): void {
+  const attention = reviewAttention(review);
+  const age = formatRelativeTime(review.record.createdAt) ?? review.record.createdAt;
+  const text = `${review.record.id}  ${review.state.padEnd(10)}  ${age}, ${review.record.files.length} file(s)`;
+  if (attention) console.log(`${paint("attn", text)}  needs attention: ${attention}`);
+  else console.log(isOpen(review) ? text : paint("quiet", text));
+}
+
+function reviewPayload(review: Review): Record<string, unknown> {
+  return {
+    id: review.record.id,
+    state: review.state,
+    attention: reviewAttention(review),
+    createdAt: review.record.createdAt,
+    files: review.record.files,
+    reason: review.verdict?.reason,
+    decidedAt: review.verdict?.decidedAt,
+    publishedAt: review.record.publishedAt,
+    publishedCommit: review.record.publishedCommit,
+    dir: review.dir,
+  };
+}
+
+function showCommand(args: string[]): number {
+  const parsed = parseOptions(args, { boolean: new Set(["--json"]), value: new Set(["--peer"]) });
+  if (parsed.positional.length > 1) throw new SidecarError(USAGE);
+  const review = selectReview(parsed.positional[0], selectedPeer(parsed));
+  if (parsed.flags.has("--json")) {
+    console.log(JSON.stringify(reviewPayload(review), null, 2));
+    return 0;
+  }
+  const { record } = review;
+  const line = (label: string, value: string, role?: Role): void => labelLine(LABEL_WIDTH, label, value, role);
+  const attention = reviewAttention(review);
+  line("review", record.id, "brand");
+  line("state", attention ? `${review.state} — needs attention: ${attention}` : review.state, attention ? "attn" : undefined);
+  line("repo", record.root, "repo");
+  if (record.peer !== "default") line("peer", record.peer);
+  line("opened", formatRelativeTime(record.createdAt) ?? record.createdAt);
+  if (review.verdict) line("decided", `${review.verdict.verdict} ${formatRelativeTime(review.verdict.decidedAt) ?? review.verdict.decidedAt}`);
+  if (review.verdict?.reason) line("reason", review.verdict.reason);
+  if (review.run) line("reviewer", review.run.command, "quiet");
+  line("packet", review.dir, "quiet");
+  console.log("");
+  for (const file of record.files) {
+    console.log(`  ${file.status}  ${file.path}${file.artifact ? paint("quiet", `  (not in the diff; full content: ${path.join(review.dir, file.artifact)})`) : ""}`);
+  }
+  console.log("");
+  process.stdout.write(fs.readFileSync(path.join(review.dir, "diff.patch"), "utf8"));
+  if (isOpen(review)) {
+    console.log("");
+    console.log(paint("quiet", `decide with \`sidecar review approve ${record.id}\` or \`sidecar review reject ${record.id} --reason "..."\``));
+  }
+  return 0;
+}
+
+function decideCommand(verdict: "approve" | "reject", args: string[]): number {
+  const parsed = parseOptions(args, { boolean: new Set(["--no-sync"]), value: new Set(["--reason", "--peer"]) });
+  if (parsed.positional.length > 1) throw new SidecarError(USAGE);
+  const selected = selectReview(parsed.positional[0], selectedPeer(parsed));
+  const reason = parsed.values.get("--reason")?.trim() || undefined;
+  const { id } = selected.record;
+  withLockedReview(selected, (review) => decideReview(review, verdict === "approve" ? "approved" : "rejected", reason));
+
+  if (verdict === "reject") {
+    console.log(`rejected review ${paint("brand", id)}; nothing it covers is published`);
+    console.log("change the files it flags and the next sync opens a new review, or approve it to override");
+    return 0;
+  }
+  console.log(`approved review ${paint("brand", id)}`);
+  if (parsed.flags.has("--no-sync")) {
+    console.log("it publishes on the next sync");
+    return 0;
+  }
+  // Publishing now rather than at the daemon's next round trip, which can be
+  // ten minutes away. The sync that opened this review may still hold the
+  // lock — a fast reviewer approves from inside it — so wait for it.
+  const peer = loadPeer(selected.record.root, selected.record.peer);
+  syncPeer(peer, { lock: "wait", remote: true, snapshot: true });
+  return 0;
+}
+
+function retryCommand(args: string[]): number {
+  const parsed = parseOptions(args, { boolean: new Set(), value: new Set(["--peer"]) });
+  if (parsed.positional.length > 1) throw new SidecarError(USAGE);
+  configuredReviewer();
+  const selected = selectReview(parsed.positional[0], selectedPeer(parsed));
+  withLockedReview(selected, (review) => {
+    resetReview(review);
+    launchReviewer(review);
+  });
+  console.log(`relaunched the reviewer for review ${paint("brand", selected.record.id)}`);
+  return 0;
+}
+
+/**
+ * Runs `fn` on a fresh read of the review under the sync lock of the peer it
+ * gates: a sync acts on the verdict it reads, so no verdict may change while
+ * one runs. A reviewer often decides while the sync that launched it still
+ * holds that lock, so this waits for it.
+ */
+function withLockedReview(selected: Review, fn: (review: Review) => void): void {
+  const { id, root, peer } = selected.record;
+  withSyncLock(root, peer, "wait", () => {
+    const review = readReview(id);
+    if (!review) throw new SidecarError(`review ${id} is gone`);
+    fn(review);
+  });
+}
+
+function reviewerCommand(args: string[]): number {
+  const parsed = parseOptions(args, { boolean: new Set(["--unset"]), value: new Set() });
+  const settings = readSettings();
+  if (parsed.flags.has("--unset")) {
+    if (parsed.positional.length) throw new SidecarError("usage: sidecar review reviewer [<command>|--unset]");
+    writeSettings({ ...settings, reviewer: undefined });
+    console.log("reviewer unset; reviews now wait for `sidecar review approve`");
+    return 0;
+  }
+  if (!parsed.positional.length) {
+    console.log(settings.reviewer ?? paint("quiet", "no reviewer configured"));
+    return 0;
+  }
+  // One argument is the whole shell command; several are joined, so
+  // `sidecar review reviewer claude-sidecar --fast` also works unquoted.
+  const command = parsed.positional.join(" ").trim();
+  if (!command) throw new SidecarError("the reviewer command is empty");
+  writeSettings({ ...settings, reviewer: command });
+  console.log(`reviewer set to ${paint("brand", command)}`);
+  return 0;
+}
+
+function runCommand(args: string[]): number {
+  if (args.length !== 2) throw new SidecarError("usage: sidecar review run <id> <attempt>");
+  return runReviewer(args[0], args[1]);
+}
+
+/**
+ * The review a command means: the id given, or — when there is exactly one —
+ * the open review of the repo the command runs in.
+ */
+function selectReview(id: string | undefined, peer: string | undefined): Review {
+  if (id) return findReview(id);
+  const open = loadPeers(peer)
+    .map((candidate) => resolveSidecarPath(candidate.root, candidate.config))
+    .filter(hasGitMetadata)
+    .map(openReview)
+    .filter((review): review is Review => review !== undefined);
+  if (open.length === 1) return open[0];
+  if (!open.length) throw new SidecarError("no open review here; pass a review id (`sidecar review` lists them)");
+  throw new SidecarError(`more than one open review here (${open.map((review) => review.record.id).join(", ")}); pass the id`);
+}
diff --git a/packages/sidecar/src/cmd-status.ts b/packages/sidecar/src/cmd-status.ts
index 85a56a8..8316057 100644
--- a/packages/sidecar/src/cmd-status.ts
+++ b/packages/sidecar/src/cmd-status.ts
@@ -15,6 +15,7 @@ import {
   loadPeers,
   requireSidecarCheckout,
   resolveSidecarPath,
+  reviewRequired,
   selectedPeer,
 } from "./config.js";
 import { instancePeer, instancesPath, listInstanceStatuses, readInstances, readSettings, sidecarLogPath } from "./state.js";
@@ -22,6 +23,7 @@ import { daemonServiceStatus } from "./service.js";
 import { checkoutIsUnlinkedFromFamily, pendingInboxBranches, readFleetHealth } from "./sync.js";
 import { announcePeer, formatRelativeTime, formatTimestampPair, labelLine } from "./ui.js";
 import { type HealthRecord, type HealthState, summarizeHealthStates } from "./health.js";
+import { openReview, reviewAttention } from "./review.js";
 
 // "pending inbox:" is the longest label; every value starts one space past it.
 const STATUS_LABEL_WIDTH = "pending inbox:".length;
@@ -61,6 +63,7 @@ function printPeerStatus({ root, config, configPath }: Peer): void {
   statusLine("main branch", config.branch);
   statusLine("inbox branch", inbox);
   statusLine("conflicts", config.resolve === "lww" ? "last writer wins" : "fork files");
+  if (reviewRequired(config)) printReviewLine(sidecarPath);
 
   if (!checkoutPresent) {
     // The state a fresh clone lands in when nothing cloned for it: say what to
@@ -100,6 +103,36 @@ function printPeerStatus({ root, config, configPath }: Peer): void {
   }
 }
 
+// What holds this checkout's publishing. Machine-local, so it needs no fetch:
+// the review records are the whole story.
+function printReviewLine(sidecarPath: string): void {
+  const review = hasGitMetadata(sidecarPath) ? openReview(sidecarPath) : undefined;
+  const reviewer = readSettings().reviewer;
+  if (!review) {
+    if (reviewer) statusLine("review", `required — nothing waiting (reviewer: ${reviewer})`, "quiet");
+    else statusLine("review", "required — no reviewer configured; reviews wait for `sidecar review approve`", "attn");
+    return;
+  }
+  const attention = reviewAttention(review);
+  const age = formatRelativeTime(review.record.createdAt) ?? review.record.createdAt;
+  const summary = `${review.state} ${review.record.id}, opened ${age}, ${review.record.files.length} file(s)`;
+  statusLine("review", attention ? `${summary} — needs attention: ${attention}` : summary, attention ? "attn" : undefined);
+  if (review.verdict?.reason) console.log(`  ${paint("quiet", review.verdict.reason)}`);
+  console.log(`  ${paint("quiet", `sidecar review show ${review.record.id}`)}`);
+}
+
+function openReviewPayload(sidecarPath: string): Record<string, unknown> | undefined {
+  const review = openReview(sidecarPath);
+  if (!review) return undefined;
+  return {
+    id: review.record.id,
+    state: review.state,
+    attention: reviewAttention(review),
+    createdAt: review.record.createdAt,
+    files: review.record.files.length,
+  };
+}
+
 function statusPayload({ root, name, config, configPath }: Peer): Record<string, unknown> {
   const sidecarPath = resolveSidecarPath(root, config);
   const checkoutPresent = hasGitMetadata(sidecarPath);
@@ -121,6 +154,7 @@ function statusPayload({ root, name, config, configPath }: Peer): Record<string,
     daemon: daemonHealth().text,
     lastSyncAt: readInstances().find((instance) => instance.configPath === configPath)?.lastSyncAt,
     pendingInbox: checkoutPresent ? pendingStatusInboxBranches(sidecarPath, config) : undefined,
+    review: reviewRequired(config) ? { required: true, open: checkoutPresent ? openReviewPayload(sidecarPath) : undefined } : undefined,
   };
 }
 
@@ -131,9 +165,12 @@ function pendingStatusInboxBranches(sidecarPath: string, config: SidecarConfig):
     : branchExists(sidecarPath, config.branch)
       ? config.branch
       : "HEAD";
-  return pendingInboxBranches(sidecarPath, config).filter(
-    (remoteBranch) => !isAncestor(sidecarPath, remoteBranch, base),
-  );
+  // A review-gated checkout's local inbox branches never reach main as such —
+  // only their published commits do — so only the remote's count as pending.
+  const candidates = reviewRequired(config)
+    ? pendingInboxBranches(sidecarPath, config).filter((branch) => branch.startsWith("origin/"))
+    : pendingInboxBranches(sidecarPath, config);
+  return candidates.filter((remoteBranch) => !isAncestor(sidecarPath, remoteBranch, base));
 }
 
 /**
@@ -256,6 +293,8 @@ function healthStatusLine(state: HealthState, record: HealthRecord): { text: str
     const age = formatRelativeTime(record.updatedAt) ?? record.updatedAt;
     return { text: `stale — last reported ${age}`, role: "attn" };
   }
+  if (record.review === "attention") return { text: "ok — publishing held, review needs attention", role: "attn" };
+  if (record.review === "pending") return { text: "ok — publishing held for review", role: "ok" };
   return { text: "ok", role: "ok" };
 }
 
diff --git a/packages/sidecar/src/cmd-sync.ts b/packages/sidecar/src/cmd-sync.ts
index 5eccd94..0f9ec21 100644
--- a/packages/sidecar/src/cmd-sync.ts
+++ b/packages/sidecar/src/cmd-sync.ts
@@ -9,30 +9,33 @@ import { colorLevel, stripColor } from "./color.js";
 import { SidecarError, getValue, nowIso, parseOptions } from "./util.js";
 import { ensureCommitIdentity, git, gitRaw } from "./git.js";
 import {
+  LOCAL_SYNC_ENV,
   type Peer,
+  SOFT_SYNC_ENV,
   expandInbox,
   loadPeers,
   redactionModeConfigValue,
   requireSidecarCheckout,
   resolveSidecarPath,
+  reviewRequired,
   selectedPeer,
 } from "./config.js";
-import { registerCurrentInstance, withSyncLock } from "./state.js";
+import { logSidecarEvent, registerCurrentInstance, withSyncLock } from "./state.js";
 import {
-  LOCAL_SYNC_ENV,
-  SOFT_SYNC_ENV,
   checkoutIsUnlinkedFromFamily,
   checkoutRedactionPolicy,
   ensureInboxBranch,
   ensureRedactionFilter,
   fileRedactionDelta,
   mergeInboxBranches,
+  mergePublishedInboxes,
   pushBranch,
   redactBuffer,
   reportSyncHealth,
   snapshot,
   syncBranchBeforePush,
   syncProject,
+  type SyncOutcome,
 } from "./sync.js";
 import { DEFAULT_REDACTION_MODE } from "./redaction.js";
 import { readRules, resolveFileRules } from "./rules.js";
@@ -66,6 +69,10 @@ export function cmdSnapshot(args: string[]): number {
         config,
       );
       if (committed && parsed.flags.has("--push")) {
+        // A gated peer's snapshots are local history; only a review publishes.
+        if (reviewRequired(config)) {
+          throw new SidecarError("this peer requires review before anything is published; `sidecar sync` opens or advances the review");
+        }
         syncBranchBeforePush(sidecarPath, inbox, config);
         pushBranch(sidecarPath, inbox);
       }
@@ -87,11 +94,21 @@ export function cmdSync(args: string[]): number {
   // gets its turn, and the failures are reported together at the end.
   const peers = loadPeers(selectedPeer(parsed), { loadRules: false });
   const failed: string[] = [];
+  const soft = parsed.flags.has("--soft") || process.env[SOFT_SYNC_ENV] === "1";
+  const options: PeerSyncOptions = {
+    // A soft sync is a request, not a demand: the daemon issues them, and one
+    // that loses the lock to a running sync can no-op because the interval or
+    // watcher will simply request again. A manual sync must never pretend.
+    lock: soft ? "skip" : "throw",
+    remote: !parsed.flags.has("--local") && process.env[LOCAL_SYNC_ENV] !== "1",
+    snapshot: !parsed.flags.has("--no-snapshot"),
+    message: getValue(parsed, "--message", getValue(parsed, "-m", "")) || undefined,
+  };
   for (const peer of peers) {
     announcePeer(peer, peers);
     try {
       if (peer.config.rulesPath) peer.config.rules = readRules(peer.config.rulesPath);
-      syncPeer(peer, parsed);
+      syncPeer(peer, options);
     } catch (error) {
       if (peers.length === 1) throw error;
       failed.push(peer.name);
@@ -104,25 +121,30 @@ export function cmdSync(args: string[]): number {
   return 0;
 }
 
-function syncPeer(peer: Peer, parsed: ReturnType<typeof parseOptions>): void {
+export type PeerSyncOptions = {
+  lock: "throw" | "skip" | "wait";
+  // false settles this machine and stops there: no fetch, no push, and
+  // nothing that can fail because a remote is unreachable.
+  remote: boolean;
+  snapshot: boolean;
+  message?: string;
+};
+
+export function syncPeer(peer: Peer, options: PeerSyncOptions): void {
   const { root, config } = peer;
-  // A soft sync is a request, not a demand: the daemon issues them, and one
-  // that loses the lock to a running sync can no-op because the interval or
-  // watcher will simply request again. A manual sync must never pretend.
-  const soft = parsed.flags.has("--soft") || process.env[SOFT_SYNC_ENV] === "1";
-  const remote = !parsed.flags.has("--local") && process.env[LOCAL_SYNC_ENV] !== "1";
+  const { remote } = options;
+  const soft = options.lock === "skip";
   // Which step was in flight when a sync threw, so the heartbeat can say
   // "failed at snapshot" rather than only "failed".
   let stage = "start";
+  let outcome: SyncOutcome = {};
   let synced: boolean;
   try {
-    synced = withSyncLock(root, peer.name, soft ? "skip" : "throw", () => {
-      syncProject(root, config, {
-        snapshot: !parsed.flags.has("--no-snapshot"),
-        // --local settles this machine and stops there: no fetch, no push, and
-        // nothing that can fail because a remote is unreachable.
+    synced = withSyncLock(root, peer.name, options.lock, () => {
+      outcome = syncProject(root, config, {
+        snapshot: options.snapshot,
         remote,
-        message: getValue(parsed, "--message", getValue(parsed, "-m", "")) || undefined,
+        message: options.message,
         onStage: (name) => {
           stage = name;
         },
@@ -134,17 +156,29 @@ function syncPeer(peer: Peer, parsed: ReturnType<typeof parseOptions>): void {
         : { event: "sync-local" });
     });
   } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
     if (remote) reportSyncHealth(root, config, {
       status: "failed",
       stage,
-      message: error instanceof Error ? error.message : String(error),
+      // Git's diagnostics quote paths, and on a gated peer a path is content
+      // nobody has reviewed yet. The heartbeat says where it failed; the
+      // details stay in this machine's log.
+      message: reviewRequired(config) ? "details are kept on this machine; see `sidecar tail` there" : message,
     });
+    if (reviewRequired(config)) logSidecarEvent("failure", { command: "sync", root, stage, message });
     throw error;
   }
   // A soft sync that lost the lock never attempted anything, so it has nothing
   // to report; the sync holding the lock will report for this checkout.
   if (synced) {
-    if (remote) reportSyncHealth(root, config, { status: "ok" });
+    const held = outcome.held;
+    if (held) {
+      const { id } = held.review.record;
+      console.log(held.attention
+        ? `sidecar: publishing is held — review ${id} needs attention: ${held.attention}; \`sidecar review show ${id}\``
+        : `sidecar: publishing is held for review ${id}; \`sidecar review show ${id}\``);
+    }
+    if (remote) reportSyncHealth(root, config, held ? { status: "ok", review: held.attention ? "attention" : "pending" } : { status: "ok" });
     // Only on a sync someone asked for. The daemon runs the same command on its
     // interval, where a standing note about a working checkout is log noise.
     if (!soft) {
@@ -176,11 +210,16 @@ export function cmdMerge(args: string[]): number {
       // Filter wiring mutates the shared Git config too, so keep it under
       // the same lock as the merge and its temporary worktree cleanup.
       ensureRedactionFilter(sidecarPath, config.redaction, config);
-      mergeInboxBranches(sidecarPath, config, {
-        forkFiles: parsed.flags.has("--fork-files"),
-        push: !parsed.flags.has("--no-push"),
-        remote: true,
-      });
+      const forkFiles = parsed.flags.has("--fork-files");
+      const push = !parsed.flags.has("--no-push");
+      // A gated peer's local main holds unpublished merges, so the pushed main
+      // is built from published inboxes alone, and local main rebuilt on it.
+      if (reviewRequired(config) && push) {
+        mergePublishedInboxes(sidecarPath, config, { forkFiles });
+        mergeInboxBranches(sidecarPath, config, { forkFiles, push: false, remote: false });
+        return;
+      }
+      mergeInboxBranches(sidecarPath, config, { forkFiles, push, remote: true });
     });
   }
   return 0;
diff --git a/packages/sidecar/src/commands.ts b/packages/sidecar/src/commands.ts
index 4234a30..67f9b0f 100644
--- a/packages/sidecar/src/commands.ts
+++ b/packages/sidecar/src/commands.ts
@@ -10,6 +10,7 @@ import { cmdRefresh } from "./cmd-refresh.js";
 import { cmdHealth, cmdInstances, cmdStatus, cmdTail } from "./cmd-status.js";
 import { cmdDaemon, cmdRegisterInstall, cmdSetInstallSource, cmdUpdate } from "./cmd-daemon.js";
 import { cmdMerge, cmdRedact, cmdRedactions, cmdSnapshot, cmdSync } from "./cmd-sync.js";
+import { cmdReview } from "./cmd-review.js";
 
 type CommandSection = "common" | "sync" | "advanced";
 
@@ -31,7 +32,7 @@ const COMMANDS: Command[] = [
     run: cmdInit,
     section: "common",
     usage:
-      "init [remote] [--peer name] [--path sidecar|.] [--branch main] [--inbox template] [--redaction none|secrets|secrets+pii] [--resolve fork|lww] [--debounce 10m] [--interval 1h] [--ignored] [--local-install]",
+      "init [remote] [--peer name] [--path sidecar|.] [--branch main] [--inbox template] [--redaction none|secrets|secrets+pii] [--resolve fork|lww] [--review off|required] [--review-timeout 1h] [--debounce 10m] [--interval 1h] [--ignored] [--local-install]",
     notes: [
       "--path . makes this repo itself the sidecar (standalone)",
       "--peer name adds a second sidecar as .sidecar.name; --ignored keeps it out of the tree",
@@ -53,6 +54,16 @@ const COMMANDS: Command[] = [
     usage: "redactions [--peer name]",
     summary: "preview what redaction rewrites before content is pushed",
   },
+  {
+    name: "review",
+    run: cmdReview,
+    section: "common",
+    usage: "review [show|approve|reject|retry] [id] [--reason text] [--no-sync] [--json] [--peer name]",
+    notes: [
+      "the reviews that gate a peer with review = \"required\"; approve publishes at once",
+      "review reviewer [<command>|--unset] sets who reviews on this machine",
+    ],
+  },
   {
     name: "sync",
     run: cmdSync,
diff --git a/packages/sidecar/src/config.ts b/packages/sidecar/src/config.ts
index 2245669..e089ab9 100644
--- a/packages/sidecar/src/config.ts
+++ b/packages/sidecar/src/config.ts
@@ -35,6 +35,14 @@ const branchValidity = new Map<string, boolean>();
 export const DEFAULT_PEER = "default";
 /** How the daemon names the peer a spawned sync is for; commands read it as `--peer`. */
 export const PEER_ENV = "SIDECAR_PEER";
+// An env var rather than a flag so the daemon can request soft syncs from
+// older pinned project-local CLIs, which ignore it instead of rejecting an
+// unknown option.
+export const SOFT_SYNC_ENV = "SIDECAR_SYNC_SOFT";
+// Likewise a variable rather than a flag: the daemon settles this machine far
+// more often than it talks to the remote, and a pinned older CLI has to be able
+// to ignore the request instead of rejecting an option it never heard of.
+export const LOCAL_SYNC_ENV = "SIDECAR_SYNC_LOCAL";
 const PEER_NAME = /^[a-z0-9][a-z0-9-]*$/;
 // Suffixes an editor or a cautious hand puts on a copy of `.sidecar`. A swap
 // file or a backup must never be read as a peer, so these names are refused at
@@ -166,6 +174,26 @@ export const RESOLVE_MODES = ["fork", "lww"] as const;
 export type ResolveMode = (typeof RESOLVE_MODES)[number];
 export const DEFAULT_RESOLVE: ResolveMode = "fork";
 
+/**
+ * `required` holds everything this peer would publish until a review approves
+ * it; see review.ts. The policy is committed with the config, while the
+ * command that performs a review is machine-local: a committed command would
+ * be one a cloned repo could make every machine's daemon run.
+ */
+export const REVIEW_MODES = ["off", "required"] as const;
+export type ReviewMode = (typeof REVIEW_MODES)[number];
+const DEFAULT_REVIEW_TIMEOUT_SECONDS = 60 * 60;
+
+/** The only .sidecar format this version reads. */
+const CONFIG_VERSION = 1;
+// Every key the config may carry. Anything else is refused rather than
+// ignored: a policy key this version does not understand — review is the
+// first — would otherwise be silently dropped, and a sync that drops a
+// publishing gate fails open.
+const CONFIG_KEYS = new Set([
+  "version", "remote", "path", "branch", "inbox", "redaction", "resolve", "debounce", "interval", "review", "review-timeout",
+]);
+
 export type SidecarConfig = {
   /** Which peer this is — derived from the file name, never written into it. */
   peer: string;
@@ -187,8 +215,20 @@ export type SidecarConfig = {
    */
   debounce?: number;
   interval?: number;
+  /** Absent means off. */
+  review?: ReviewMode;
+  /** Seconds a review may stay undecided before it needs attention. */
+  reviewTimeout?: number;
 };
 
+export function reviewRequired(config: SidecarConfig): boolean {
+  return config.review === "required";
+}
+
+export function reviewTimeoutSeconds(config: SidecarConfig): number {
+  return config.reviewTimeout ?? DEFAULT_REVIEW_TIMEOUT_SECONDS;
+}
+
 export function findConfigRoot(start: string): string {
   const root = findConfigRootOptional(start);
   if (root) return root;
@@ -217,6 +257,8 @@ export function writeConfig(configPath: string, config: SidecarConfig): void {
     `resolve = ${JSON.stringify(config.resolve ?? DEFAULT_RESOLVE)}`,
     ...(config.debounce === undefined ? [] : [`debounce = ${config.debounce}`]),
     ...(config.interval === undefined ? [] : [`interval = ${config.interval}`]),
+    ...(reviewRequired(config) ? [`review = "required"`] : []),
+    ...(config.reviewTimeout === undefined ? [] : [`review-timeout = ${config.reviewTimeout}`]),
     "",
   ].join("\n");
   fs.writeFileSync(configPath, text, "utf8");
@@ -235,6 +277,19 @@ export function readConfig(configPath: string, options: { loadRules?: boolean }
     throw new SidecarError(`${configPath} is not valid TOML: ${error instanceof Error ? error.message : String(error)}`);
   }
 
+  const unknown = Object.keys(values).filter((key) => !CONFIG_KEYS.has(key));
+  if (unknown.length) {
+    throw new SidecarError(
+      `${configPath}: unknown key${unknown.length > 1 ? "s" : ""} ${unknown.map((key) => JSON.stringify(key)).join(", ")}; this sidecar may be older than the config — update it with \`sidecar update\``,
+    );
+  }
+  const version = numberConfigValue(configPath, values, "version", CONFIG_VERSION);
+  if (version !== CONFIG_VERSION) {
+    throw new SidecarError(
+      `${configPath}: config version ${version} is not supported by this sidecar (expected ${CONFIG_VERSION}); update it with \`sidecar update\``,
+    );
+  }
+
   const remote = optionalStringConfigValue(configPath, values, "remote");
   if (!remote) throw new SidecarError(`${configPath} is missing remote`);
 
@@ -243,7 +298,7 @@ export function readConfig(configPath: string, options: { loadRules?: boolean }
   const config = {
     peer,
     remote,
-    version: numberConfigValue(configPath, values, "version", 1),
+    version,
     path: stringConfigValue(configPath, values, "path", DEFAULT_PATH),
     branch: stringConfigValue(configPath, values, "branch", DEFAULT_BRANCH),
     inbox: stringConfigValue(configPath, values, "inbox", DEFAULT_INBOX),
@@ -254,6 +309,8 @@ export function readConfig(configPath: string, options: { loadRules?: boolean }
     resolve: resolveModeConfigValue(stringConfigValue(configPath, values, "resolve", DEFAULT_RESOLVE), configPath),
     debounce: durationConfigValue(values.debounce, `${configPath} debounce`),
     interval: durationConfigValue(values.interval, `${configPath} interval`),
+    review: reviewModeConfigValue(stringConfigValue(configPath, values, "review", "off"), configPath),
+    reviewTimeout: durationConfigValue(values["review-timeout"], `${configPath} review-timeout`),
     rules: options.loadRules === false ? undefined : readRules(rulesPath),
     rulesPath,
   };
@@ -274,6 +331,13 @@ export function redactionModeConfigValue(value: string, source: string): Redacti
   );
 }
 
+export function reviewModeConfigValue(value: string, source: string): ReviewMode {
+  if ((REVIEW_MODES as readonly string[]).includes(value)) return value as ReviewMode;
+  throw new SidecarError(
+    `${source}: invalid review mode ${JSON.stringify(value)}; expected one of ${REVIEW_MODES.join(", ")}`,
+  );
+}
+
 export function durationConfigValue(value: unknown, source: string): number | undefined {
   if (value === undefined) return undefined;
   const seconds = parseDuration(value);
@@ -442,7 +506,15 @@ export function inboxPrefix(config: SidecarConfig): string {
   return inboxBranchPrefix(config.inbox);
 }
 
+/**
+ * Where a review-gated peer keeps the remote's branches as sidecar last
+ * fetched them; see the review-gated section of sync.ts.
+ */
+export const PUBLIC_REFS = "refs/sidecar-public/";
+
+/** A branch's own name from its remote-tracking or public ref. */
 export function remoteBranchName(remoteBranch: string): string {
+  if (remoteBranch.startsWith(PUBLIC_REFS)) return remoteBranch.slice(PUBLIC_REFS.length);
   return remoteBranch.startsWith("origin/") ? remoteBranch.slice("origin/".length) : remoteBranch;
 }
 
diff --git a/packages/sidecar/src/git.ts b/packages/sidecar/src/git.ts
index 1f7b211..12d6517 100644
--- a/packages/sidecar/src/git.ts
+++ b/packages/sidecar/src/git.ts
@@ -86,6 +86,15 @@ export function isAncestor(repo: string, maybeAncestor: string, descendant: stri
   return git(repo, ["merge-base", "--is-ancestor", maybeAncestor, descendant], { check: false }).status === 0;
 }
 
+export function treeOf(repo: string, ref: string): string {
+  return git(repo, ["rev-parse", `${ref}^{tree}`]).stdout.trim();
+}
+
+/** The empty tree, written to the object store so plumbing can name it. */
+export function emptyTree(repo: string): string {
+  return git(repo, ["mktree"], { input: "" }).stdout.trim();
+}
+
 export function gitToplevel(cwd: string): string {
   const root = gitToplevelOptional(cwd);
   if (!root) throw new SidecarError("not inside a Git repository");
@@ -148,12 +157,18 @@ export function ensureClean(repo: string): void {
   if (isDirty(repo)) throw new SidecarError("sidecar checkout has uncommitted changes");
 }
 
+/** The identity sidecar commits as when nothing else is configured. */
+export function sidecarIdentity(): { name: string; email: string } {
+  return { name: currentUser(), email: `${slug(currentUser())}@${slug(currentHost())}.local` };
+}
+
 export function ensureCommitIdentity(repo: string): void {
+  const { name, email } = sidecarIdentity();
   if (git(repo, ["config", "user.name"], { check: false }).status !== 0) {
-    git(repo, ["config", "user.name", currentUser()]);
+    git(repo, ["config", "user.name", name]);
   }
   if (git(repo, ["config", "user.email"], { check: false }).status !== 0) {
-    git(repo, ["config", "user.email", `${slug(currentUser())}@${slug(currentHost())}.local`]);
+    git(repo, ["config", "user.email", email]);
   }
 }
 
diff --git a/packages/sidecar/src/health.ts b/packages/sidecar/src/health.ts
index 678aeb3..4f38259 100644
--- a/packages/sidecar/src/health.ts
+++ b/packages/sidecar/src/health.ts
@@ -52,9 +52,17 @@ const MESSAGE_LIMIT = 500;
 
 export type HealthStatus = "ok" | "failed";
 
+/**
+ * A review-gated checkout whose unpublished work is held: `pending` while a
+ * review is in progress, `attention` once it needs a person. Only the state
+ * is published — never a reviewer's reason, which describes what was
+ * sensitive.
+ */
+export type HealthReview = "pending" | "attention";
+
 /** What a sync attempt turned out to be, before it becomes a record. */
 export type HealthOutcome =
-  | { status: "ok" }
+  | { status: "ok"; review?: HealthReview }
   | { status: "failed"; stage: string; message: string };
 
 /** Who is reporting — the parts of a record that don't depend on the outcome. */
@@ -82,6 +90,8 @@ export type HealthRecord = HealthIdentity & {
   /** Which step of the sync threw; only present on a failing record. */
   stage?: string;
   message?: string;
+  /** Present while a review holds this checkout's publishing. */
+  review?: HealthReview;
 };
 
 /** How the fleet view reads a record — `stale` is derived, never stored. */
@@ -143,6 +153,7 @@ export function parseHealthRecord(text: string): HealthRecord | undefined {
         : 0,
     stage: typeof record.stage === "string" ? record.stage : undefined,
     message: typeof record.message === "string" ? record.message : undefined,
+    review: record.review === "pending" || record.review === "attention" ? record.review : undefined,
   };
 }
 
@@ -164,20 +175,23 @@ export function nextHealthRecord(
   outcome: HealthOutcome,
   now: string,
 ): HealthRecord {
+  // Only what parses as a timestamp carries forward. The previous record is
+  // read back from a ref, and a heartbeat is published for every peer before
+  // any review: nothing but sidecar's own values may ride along.
   const base: HealthRecord = {
     schema: HEALTH_SCHEMA,
     ...identity,
     status: outcome.status,
     updatedAt: now,
-    lastSuccessAt: previous?.lastSuccessAt,
-    lastFailureAt: previous?.lastFailureAt,
+    lastSuccessAt: isoTimestamp(previous?.lastSuccessAt),
+    lastFailureAt: isoTimestamp(previous?.lastFailureAt),
     consecutiveFailures: 0,
   };
-  if (outcome.status === "ok") return { ...base, lastSuccessAt: now };
+  if (outcome.status === "ok") return { ...base, lastSuccessAt: now, ...(outcome.review ? { review: outcome.review } : {}) };
   return {
     ...base,
     lastFailureAt: now,
-    consecutiveFailures: (previous?.consecutiveFailures ?? 0) + 1,
+    consecutiveFailures: Math.max(0, Math.floor(previous?.consecutiveFailures ?? 0)) + 1,
     stage: outcome.stage,
     // The message is a git failure verbatim, and git quotes remote URLs — which
     // carry tokens. Redacting here rather than at the call site means the
@@ -187,6 +201,10 @@ export function nextHealthRecord(
   };
 }
 
+function isoTimestamp(value: string | undefined): string | undefined {
+  return value && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/.test(value) ? value : undefined;
+}
+
 /**
  * Whether `next` is worth a push. Failures and transitions always are —
  * everything else is the same "still fine" the branch already holds, and only
@@ -198,7 +216,7 @@ export function shouldPublishHealth(
   now = Date.now(),
 ): boolean {
   if (!previous) return true;
-  if (next.status === "failed" || previous.status !== next.status) return true;
+  if (next.status === "failed" || previous.status !== next.status || previous.review !== next.review) return true;
   const last = Date.parse(previous.updatedAt);
   if (!Number.isFinite(last)) return true;
   // A clock behind the branch's own timestamp would otherwise defer forever.
diff --git a/packages/sidecar/src/install.ts b/packages/sidecar/src/install.ts
index 52f33bd..88b7619 100644
--- a/packages/sidecar/src/install.ts
+++ b/packages/sidecar/src/install.ts
@@ -18,6 +18,17 @@ export type InstallSource = "npm" | "bun" | "curl";
 
 export const INSTALL_SOURCES = new Set<InstallSource>(["npm", "bun", "curl"]);
 
+/**
+ * The built CLI bundle this process runs from, for anything that has to start
+ * this exact install outside the current process: git's clean filter, the
+ * background review runner. Run from TypeScript sources (tests), that is the
+ * sibling dist build.
+ */
+export function sidecarCliPath(): string {
+  const self = fileURLToPath(import.meta.url);
+  return self.endsWith(".ts") ? path.join(path.dirname(self), "..", "dist", "cli.js") : self;
+}
+
 export function packageVersion(): string {
   let current = path.dirname(fileURLToPath(import.meta.url));
   while (true) {
diff --git a/packages/sidecar/src/review.ts b/packages/sidecar/src/review.ts
new file mode 100644
index 0000000..dbdf684
--- /dev/null
+++ b/packages/sidecar/src/review.ts
@@ -0,0 +1,599 @@
+// The review gate: what a review-gated peer may publish, and who said so.
+//
+// A peer with `review = "required"` never pushes its own history. The engine
+// (sync.ts) publishes one commit per approved review, whose tree is exactly
+// the tree the reviewer saw. This module owns the reviews themselves: their
+// records, the packet a reviewer reads, the background runner around the
+// configured reviewer command, and the state a review is in.
+//
+// Everything here is machine-local. A packet holds a diff of content that has
+// not been cleared to leave this machine, so it lives in the state dir, owner
+// readable only, and nothing about it reaches the remote except the commit an
+// approval publishes.
+//
+// A review's files each have one writer. The sync and the decision commands
+// write under the peer's sync lock, so a verdict can never change while a sync
+// is acting on it; a runner writes only the file for its own attempt, so a
+// superseded runner can never overwrite the current one:
+//   review.json           the sync: opened, publishing, published, superseded
+//   verdict.json          `sidecar review approve|reject`
+//   attempt               whoever launches a runner: the current attempt's id
+//   run-<attempt>.json    that attempt's runner, around the reviewer command
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+
+import { SidecarError, nowIso, realpathOr } from "./util.js";
+import { emptyTree, git, gitBytes, gitCommonDir, treeOf } from "./git.js";
+import { GLOBAL_EXEC_ENV, SKIP_LOCAL_EXEC_ENV, sidecarCliPath } from "./install.js";
+import {
+  DEFAULT_PEER,
+  LOCAL_SYNC_ENV,
+  PEER_ENV,
+  SOFT_SYNC_ENV,
+  type SidecarConfig,
+  peerConfigPath,
+  reviewTimeoutSeconds,
+} from "./config.js";
+import { logSidecarEvent, readSettings, sidecarStateDir } from "./state.js";
+import { redactText } from "./redaction.js";
+
+const REVIEW_SCHEMA = 1;
+/** Closed reviews kept per family, newest first; older packets are deleted. */
+const KEEP_CLOSED_REVIEWS = 10;
+/** Review and attempt ids: generated hex, so never a path outside the reviews dir. */
+const ID_PATTERN = /^[0-9a-f]+$/;
+
+function newId(): string {
+  return crypto.randomBytes(4).toString("hex");
+}
+
+/**
+ * One changed path. `artifact` names the packet file holding its complete
+ * published content when the diff cannot show it (see writeOpaqueArtifacts),
+ * so nothing publishes unseen.
+ */
+export type ReviewFile = { status: string; path: string; artifact?: string };
+
+export type ReviewRecord = {
+  schema: number;
+  id: string;
+  /**
+   * The repo family's shared git dir. Sibling checkouts share one clone and
+   * one local main, so they share one review: see the review-gated section of
+   * sync.ts.
+   */
+  family: string;
+  root: string;
+  peer: string;
+  /**
+   * The public commit the diff is measured from — the newest remote main
+   * commit the reviewed head contains. Absent when the head shares no history
+   * with the remote, in which case the diff is against the empty tree.
+   */
+  base?: string;
+  /** Local main when the review opened. */
+  head: string;
+  /** The tree an approval publishes: the head's, pinned at review time. */
+  tree: string;
+  files: ReviewFile[];
+  createdAt: string;
+  timeoutSeconds: number;
+  /**
+   * The commit this review publishes and where, recorded before the push so a
+   * sync that dies mid-publish — or a sibling resuming after it — pushes that
+   * same commit rather than cutting a second one.
+   */
+  publishing?: { inbox: string; commit: string };
+  publishedAt?: string;
+  publishedCommit?: string;
+  supersededAt?: string;
+};
+
+export type ReviewVerdict = { verdict: "approved" | "rejected"; reason?: string; decidedAt: string };
+
+type ReviewRun = {
+  attempt: string;
+  pid: number;
+  command: string;
+  startedAt: string;
+  finishedAt?: string;
+  exitCode?: number | null;
+  signal?: string | null;
+};
+
+export type ReviewState = "pending" | "approved" | "rejected" | "failed" | "published" | "superseded";
+
+export type Review = {
+  record: ReviewRecord;
+  verdict?: ReviewVerdict;
+  run?: ReviewRun;
+  state: ReviewState;
+  dir: string;
+};
+
+// ---------------------------------------------------------------------------
+// Records
+// ---------------------------------------------------------------------------
+
+function reviewsDir(): string {
+  return path.join(sidecarStateDir(), "reviews");
+}
+
+function reviewDir(id: string): string {
+  return path.join(reviewsDir(), id);
+}
+
+function writePrivateFile(filePath: string, text: string): void {
+  const temporary = `${filePath}.${crypto.randomUUID()}.tmp`;
+  try {
+    fs.writeFileSync(temporary, text, { encoding: "utf8", mode: 0o600 });
+    fs.renameSync(temporary, filePath);
+  } finally {
+    fs.rmSync(temporary, { force: true });
+  }
+}
+
+function writePrivateJson(filePath: string, value: unknown): void {
+  writePrivateFile(filePath, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function readJson<T>(filePath: string): T | undefined {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8")) as T;
+  } catch {
+    return undefined;
+  }
+}
+
+export function readReview(id: string): Review | undefined {
+  if (!ID_PATTERN.test(id)) return undefined;
+  const dir = reviewDir(id);
+  const record = readJson<ReviewRecord>(path.join(dir, "review.json"));
+  if (!record || record.id !== id) return undefined;
+  const verdict = readJson<ReviewVerdict>(path.join(dir, "verdict.json"));
+  const attempt = currentAttempt(dir);
+  const run = attempt ? readJson<ReviewRun>(runPath(dir, attempt)) : undefined;
+  return { record, verdict, run, state: reviewState(record, verdict, run), dir };
+}
+
+function currentAttempt(dir: string): string | undefined {
+  try {
+    const attempt = fs.readFileSync(path.join(dir, "attempt"), "utf8").trim();
+    return ID_PATTERN.test(attempt) ? attempt : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function runPath(dir: string, attempt: string): string {
+  return path.join(dir, `run-${attempt}.json`);
+}
+
+/** The key a checkout's reviews are filed under: its family's shared git dir. */
+function reviewFamily(sidecarPath: string): string {
+  return realpathOr(gitCommonDir(sidecarPath));
+}
+
+/** Every review on this machine, newest first, optionally for one checkout's family. */
+export function listReviews(sidecarPath?: string): Review[] {
+  let ids: string[];
+  try {
+    ids = fs.readdirSync(reviewsDir());
+  } catch {
+    return [];
+  }
+  const family = sidecarPath === undefined ? undefined : reviewFamily(sidecarPath);
+  return ids
+    .map(readReview)
+    .filter((review): review is Review => review !== undefined)
+    .filter((review) => family === undefined || review.record.family === family)
+    .sort((left, right) => right.record.createdAt.localeCompare(left.record.createdAt) || right.record.id.localeCompare(left.record.id));
+}
+
+/** A review found by its id or an unambiguous prefix of it. */
+export function findReview(idOrPrefix: string): Review {
+  const exact = readReview(idOrPrefix);
+  if (exact) return exact;
+  const matches = listReviews().filter((review) => review.record.id.startsWith(idOrPrefix));
+  if (matches.length === 1) return matches[0];
+  if (matches.length > 1) throw new SidecarError(`review id ${JSON.stringify(idOrPrefix)} is ambiguous; use more of it`);
+  throw new SidecarError(`no review ${JSON.stringify(idOrPrefix)} on this machine`);
+}
+
+export function isOpen(review: Review): boolean {
+  return review.state !== "published" && review.state !== "superseded";
+}
+
+function assertOpen(review: Review): void {
+  if (!isOpen(review)) throw new SidecarError(`review ${review.record.id} is already ${review.state}`);
+}
+
+/** The one review a checkout's family may have open at a time. */
+export function openReview(sidecarPath: string): Review | undefined {
+  return listReviews(sidecarPath).find(isOpen);
+}
+
+function reviewState(record: ReviewRecord, verdict?: ReviewVerdict, run?: ReviewRun): ReviewState {
+  if (record.publishedAt) return "published";
+  if (record.supersededAt) return "superseded";
+  if (verdict) return verdict.verdict;
+  if (run?.finishedAt && run.exitCode !== 0) return "failed";
+  // A runner that died without finishing never recorded an exit; it is as
+  // failed as one that exited nonzero.
+  if (run && !run.finishedAt && !pidAlive(run.pid)) return "failed";
+  return "pending";
+}
+
+function pidAlive(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "EPERM";
+  }
+}
+
+/**
+ * Why a review is waiting on a person rather than on its reviewer, or
+ * undefined while it is simply in progress. A rejection, a reviewer that
+ * failed, no reviewer at all, and a review open past its timeout all hold the
+ * peer's publishing the same way; this is what makes them visible.
+ */
+export function reviewAttention(review: Review, now = Date.now()): string | undefined {
+  if (review.state === "rejected") return "rejected";
+  if (review.state === "failed") {
+    const run = review.run;
+    if (run?.finishedAt) {
+      return run.signal ? `reviewer stopped by ${run.signal} without a verdict` : `reviewer exited ${run.exitCode} without a verdict`;
+    }
+    return "reviewer stopped without a verdict";
+  }
+  if (review.state !== "pending") return undefined;
+  if (!review.run && !readSettings().reviewer) return "no reviewer is configured on this machine";
+  const age = (now - Date.parse(review.record.createdAt)) / 1000;
+  if (age > review.record.timeoutSeconds) return `undecided for over ${formatDuration(review.record.timeoutSeconds)}`;
+  return undefined;
+}
+
+function formatDuration(seconds: number): string {
+  if (seconds >= 3600 && seconds % 3600 === 0) return `${seconds / 3600}h`;
+  if (seconds >= 60 && seconds % 60 === 0) return `${seconds / 60}m`;
+  return `${Math.round(seconds)}s`;
+}
+
+// ---------------------------------------------------------------------------
+// Opening a review
+// ---------------------------------------------------------------------------
+
+/** The committed guidance for a peer's reviewer, beside its config like the rules file. */
+export function peerReviewGuidelinesFileName(name: string): string {
+  return name === DEFAULT_PEER ? ".sidecar-review" : `.sidecar-review.${name}`;
+}
+
+export function peerReviewGuidelinesPath(root: string, name: string): string {
+  return path.join(root, peerReviewGuidelinesFileName(name));
+}
+
+function readGuidelines(root: string, peer: string): string | undefined {
+  try {
+    const text = fs.readFileSync(peerReviewGuidelinesPath(root, peer), "utf8").trim();
+    return text || undefined;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    // Guidance the reviewer was meant to apply and cannot read is not the
+    // same as no guidance; fail the sync rather than review without it.
+    throw new SidecarError(
+      `could not read ${peerReviewGuidelinesPath(root, peer)}: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+}
+
+// What the packet enumerates is what an approval publishes, so it comes from
+// plumbing and spells out every option porcelain would take from config: a
+// `diff.ignoreSubmodules` or a rename heuristic must never hide a changed path.
+const PACKET_DIFF_OPTIONS = ["-r", "--no-renames", "--ignore-submodules=none"];
+
+/**
+ * Writes the record and packet for a review of `base..head`. The packet is
+ * what a reviewer reads: the diff exactly as it would be published (committed
+ * blobs, so already redacted), the changed paths, the repo's guidelines, and
+ * instructions that say how to decide.
+ */
+export function createReview(options: { root: string; config: SidecarConfig; sidecarPath: string; base?: string; head: string }): Review {
+  const { root, config, sidecarPath, base, head } = options;
+  const guidelines = readGuidelines(root, config.peer);
+  const id = newId();
+  const dir = reviewDir(id);
+  fs.mkdirSync(reviewsDir(), { recursive: true, mode: 0o700 });
+  fs.mkdirSync(dir, { mode: 0o700 });
+
+  const from = base ?? emptyTree(sidecarPath);
+  const fields = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--name-status", "-z", from, head]).stdout.split("\0").filter(Boolean);
+  const files: ReviewFile[] = [];
+  for (let index = 0; index + 1 < fields.length; index += 2) files.push({ status: fields[index], path: fields[index + 1] });
+  writeOpaqueArtifacts(sidecarPath, dir, from, head, files);
+  const diff = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "-p", "--no-color", "--no-ext-diff", "--no-textconv", from, head]).stdout;
+
+  const record: ReviewRecord = {
+    schema: REVIEW_SCHEMA,
+    id,
+    family: reviewFamily(sidecarPath),
+    root,
+    peer: config.peer,
+    ...(base ? { base } : {}),
+    head,
+    tree: treeOf(sidecarPath, head),
+    files,
+    createdAt: nowIso(),
+    timeoutSeconds: reviewTimeoutSeconds(config),
+  };
+  writePrivateFile(path.join(dir, "diff.patch"), diff);
+  if (guidelines) writePrivateFile(path.join(dir, "guidelines.md"), `${guidelines}\n`);
+  writePrivateFile(path.join(dir, "instructions.md"), reviewInstructions(record, config, guidelines));
+  // The record last: a directory without one is not yet a review, so a crash
+  // mid-packet leaves nothing a sync would wait on.
+  writePrivateJson(path.join(dir, "review.json"), record);
+  logSidecarEvent("review-open", { id, root, peer: config.peer, files: files.length });
+  pruneClosedReviews(sidecarPath);
+  return { record, state: "pending", dir };
+}
+
+/**
+ * Git shows a binary — or a file whose attributes say `-diff` — as "Binary
+ * files differ", and text that is not UTF-8 reaches the packet garbled, so
+ * the diff alone would let either publish unseen. Each such file's complete
+ * new content goes into the packet instead, as the committed blob: exactly
+ * the bytes an approval publishes. Sets `artifact` on those files.
+ */
+function writeOpaqueArtifacts(repo: string, dir: string, from: string, head: string, files: ReviewFile[]): void {
+  const binary = new Set(
+    git(repo, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--numstat", "-z", from, head])
+      .stdout.split("\0")
+      .filter((entry) => entry.startsWith("-\t-\t"))
+      .map((entry) => entry.slice("-\t-\t".length)),
+  );
+  // Entry types from the tree itself: a gitlink names a commit in another
+  // repository, which this one need not hold, and the patch already shows it.
+  const blobs = new Set(
+    git(repo, ["ls-tree", "-r", "-z", "--full-tree", head])
+      .stdout.split("\0")
+      .filter((entry) => entry.split(" ")[1] === "blob")
+      .map((entry) => entry.slice(entry.indexOf("\t") + 1)),
+  );
+  const utf8 = new TextDecoder("utf-8", { fatal: true });
+  const isText = (blob: Buffer): boolean => {
+    try {
+      utf8.decode(blob);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  let count = 0;
+  for (const file of files) {
+    if (file.status === "D" || !blobs.has(file.path)) continue;
+    const blob = gitBytes(repo, ["cat-file", "blob", `${head}:${file.path}`]).stdout;
+    if (!binary.has(file.path) && isText(blob)) continue;
+    count += 1;
+    file.artifact = path.join("opaque", String(count).padStart(4, "0"));
+    fs.mkdirSync(path.join(dir, "opaque"), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(dir, file.artifact), blob, { mode: 0o600 });
+  }
+}
+
+function updateRecord(review: Review, change: Partial<ReviewRecord>): void {
+  const record = { ...review.record, ...change };
+  writePrivateJson(path.join(review.dir, "review.json"), record);
+  review.record = record;
+}
+
+export function markPublishing(review: Review, inbox: string, commit: string): void {
+  updateRecord(review, { publishing: { inbox, commit } });
+}
+
+export function markPublished(review: Review, commit: string): void {
+  updateRecord(review, { publishedAt: nowIso(), publishedCommit: commit });
+  logSidecarEvent("review-published", { id: review.record.id, commit });
+}
+
+export function markSuperseded(review: Review): void {
+  updateRecord(review, { supersededAt: nowIso() });
+  logSidecarEvent("review-superseded", { id: review.record.id });
+}
+
+// Closed packets hold diffs nobody needs any more; keep a short history for
+// `sidecar review` and delete the rest.
+function pruneClosedReviews(sidecarPath: string): void {
+  const closed = listReviews(sidecarPath).filter((review) => !isOpen(review));
+  for (const review of closed.slice(KEEP_CLOSED_REVIEWS)) {
+    fs.rmSync(review.dir, { recursive: true, force: true });
+  }
+}
+
+/** Removes the reviews of families whose clone is gone; deinit's half of the packets. */
+export function pruneOrphanedReviews(): void {
+  for (const review of listReviews()) {
+    if (!fs.existsSync(review.record.family)) fs.rmSync(review.dir, { recursive: true, force: true });
+  }
+}
+
+function opaqueSection(record: ReviewRecord): string {
+  const opaque = record.files.filter((file) => file.artifact);
+  if (!opaque.length) return "";
+  return `
+These files' content does not appear faithfully in \`diff.patch\` (binary, not
+UTF-8, or diffs turned off). Their complete new content, as it would be
+published, is in the packet.
+Inspect each one; if you cannot, do not approve:
+
+${opaque.map((file) => `- \`${file.artifact}\` — ${file.path}`).join("\n")}
+`;
+}
+
+function reviewInstructions(record: ReviewRecord, config: SidecarConfig, guidelines: string | undefined): string {
+  return `# Sidecar publish review ${record.id}
+
+A sidecar is a scratchpad repository that syncs automatically to a shared Git
+remote (${redactText(config.remote)}). This machine wants to publish the change in
+\`diff.patch\`. Everyone with access to that remote can read what you approve,
+and it stays in the remote's history.
+
+Decide whether anything in the change should not leave this machine. This is
+not a code review: ignore quality, style, and correctness.
+
+Secret redaction has already run. Values it caught appear as placeholders such
+as \`<API_KEY>\`, \`<TOKEN>\`, or \`<SECRET>\`; they are not leaks. Look for what
+pattern matching misses:
+
+- credentials in unusual formats, or ones split across lines
+- personal data about real people: contact details, health, finances, private conversations
+- confidential material: customer names and data, unreleased plans, internal-only details
+- anything the repository's guidelines below rule out
+
+## Files
+
+All in this directory (\`$SIDECAR_REVIEW_DIR\`):
+
+- \`diff.patch\` — the change exactly as it would be published
+- \`review.json\` — the repository, peer, and changed paths
+${guidelines ? "- `guidelines.md` — this repository's guidelines, repeated below\n" : ""}${opaqueSection(record)}
+## Guidelines
+
+${guidelines ?? "This repository has no review guidelines (`.sidecar-review` beside its `.sidecar`)."}
+
+## Decide
+
+Approve, and the change is published on the next sync:
+
+    sidecar review approve ${record.id}
+
+Reject, saying which file and what kind of content. Do not repeat the
+sensitive value itself:
+
+    sidecar review reject ${record.id} --reason "<file: what kind of content>"
+
+If you are unsure, or a person should weigh in, do neither: leave the review
+open and raise it with them. Nothing is published until someone approves, and
+they decide with the same two commands.
+`;
+}
+
+// ---------------------------------------------------------------------------
+// Running the reviewer
+// ---------------------------------------------------------------------------
+
+/** This machine's reviewer command, or a failure that says how to set one. */
+export function configuredReviewer(): string {
+  const command = readSettings().reviewer;
+  if (!command) throw new SidecarError("no reviewer is configured; set one with `sidecar review reviewer <command>`");
+  return command;
+}
+
+/**
+ * Starts the runner for a review in the background and returns at once. A
+ * review takes minutes; the sync that opened it holds the sync lock and must
+ * not wait for one.
+ */
+export function launchReviewer(review: Review): void {
+  // A fresh attempt id retires whatever runner came before: it can still
+  // finish, but its record is no longer the one this review reads.
+  const attempt = newId();
+  writePrivateFile(path.join(review.dir, "attempt"), `${attempt}\n`);
+  review.run = undefined;
+  const child = spawn(process.execPath, [sidecarCliPath(), "review", "run", review.record.id, attempt], {
+    cwd: review.dir,
+    detached: true,
+    stdio: "ignore",
+    // This exact install runs the review it opened: the packet format is its.
+    env: { ...process.env, [SKIP_LOCAL_EXEC_ENV]: "1" },
+  });
+  child.unref();
+  logSidecarEvent("review-launch", { id: review.record.id, attempt });
+}
+
+/**
+ * The runner: runs the configured reviewer to completion and records how it
+ * ended. The verdict is not the exit status — a reviewer decides through
+ * `sidecar review approve|reject`, now or after a discussion that outlives it.
+ * A zero exit without a verdict is a review still in progress somewhere else;
+ * a nonzero one is a reviewer that broke.
+ */
+export function runReviewer(idOrPrefix: string, attempt: string): number {
+  const review = findReview(idOrPrefix);
+  const { id } = review.record;
+  assertOpen(review);
+  // Launched, then superseded by a retry before it got going.
+  if (currentAttempt(review.dir) !== attempt) return 0;
+  const command = configuredReviewer();
+
+  const file = runPath(review.dir, attempt);
+  const run: ReviewRun = { attempt, pid: process.pid, command, startedAt: nowIso() };
+  writePrivateJson(file, run);
+  const log = fs.openSync(path.join(review.dir, "reviewer.log"), "a", 0o600);
+  let result;
+  try {
+    result = spawnSync("/bin/sh", ["-c", command], {
+      cwd: review.dir,
+      stdio: ["ignore", log, log],
+      env: reviewerEnv(review),
+    });
+  } finally {
+    fs.closeSync(log);
+  }
+  const finished: ReviewRun = { ...run, finishedAt: nowIso(), exitCode: result.status, signal: result.signal };
+  writePrivateJson(file, finished);
+  logSidecarEvent("review-run", { id, attempt, exitCode: result.status, signal: result.signal });
+  return 0;
+}
+
+function reviewerEnv(review: Review): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { ...process.env };
+  // The runner inherits the requests a daemon made of the sync that opened
+  // the review. A reviewer that runs `sidecar` must get a plain one.
+  for (const name of [PEER_ENV, SOFT_SYNC_ENV, LOCAL_SYNC_ENV, SKIP_LOCAL_EXEC_ENV, GLOBAL_EXEC_ENV]) delete env[name];
+  const { record } = review;
+  return {
+    ...env,
+    SIDECAR_REVIEW_ID: record.id,
+    SIDECAR_REVIEW_DIR: review.dir,
+    SIDECAR_REVIEW_PROMPT: path.join(review.dir, "instructions.md"),
+    SIDECAR_REVIEW_DIFF: path.join(review.dir, "diff.patch"),
+    SIDECAR_REVIEW_ROOT: record.root,
+    SIDECAR_REVIEW_PEER: record.peer,
+    SIDECAR_REVIEW_CONFIG: peerConfigPath(record.root, record.peer),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Deciding
+// ---------------------------------------------------------------------------
+
+export function decideReview(review: Review, verdict: ReviewVerdict["verdict"], reason?: string): void {
+  assertOpen(review);
+  // Publication has begun: the commit may already be on the remote, so a
+  // rejection now would claim something it cannot deliver.
+  if (review.record.publishing && verdict === "rejected") {
+    throw new SidecarError(`review ${review.record.id} is already being published; it can no longer be rejected`);
+  }
+  const record: ReviewVerdict = { verdict, ...(reason ? { reason } : {}), decidedAt: nowIso() };
+  writePrivateJson(path.join(review.dir, "verdict.json"), record);
+  review.verdict = record;
+  review.state = verdict;
+  // Never the reason: it describes what was sensitive, and the log is
+  // something people paste into bug reports.
+  logSidecarEvent("review-decision", { id: review.record.id, verdict });
+}
+
+/** Clears a review's verdict and run so its reviewer can take it again. */
+export function resetReview(review: Review): void {
+  assertOpen(review);
+  if (review.record.publishing) throw new SidecarError(`review ${review.record.id} is already being published`);
+  fs.rmSync(path.join(review.dir, "verdict.json"), { force: true });
+  fs.rmSync(path.join(review.dir, "attempt"), { force: true });
+  review.verdict = undefined;
+  review.run = undefined;
+  review.state = "pending";
+}
diff --git a/packages/sidecar/src/state.ts b/packages/sidecar/src/state.ts
index a5d4790..18cf00e 100644
--- a/packages/sidecar/src/state.ts
+++ b/packages/sidecar/src/state.ts
@@ -44,6 +44,12 @@ export type SidecarSettings = {
   autoUpdate: boolean;
   lastUpdateCheckAt?: string;
   installSource?: InstallSource;
+  /**
+   * The shell command that reviews what a review-gated peer would publish.
+   * Machine-local by design: .sidecar says a review is required, this says
+   * who on this machine performs it. See review.ts.
+   */
+  reviewer?: string;
 };
 
 const DEFAULT_SETTINGS: SidecarSettings = { daemonEnabled: true, autoUpdate: true };
@@ -62,6 +68,7 @@ export function readSettings(): SidecarSettings {
       installSource: INSTALL_SOURCES.has(record.installSource as InstallSource)
         ? (record.installSource as InstallSource)
         : undefined,
+      reviewer: typeof record.reviewer === "string" && record.reviewer.trim() ? record.reviewer : undefined,
     };
   } catch (error) {
     logSidecarEvent("failure", {
@@ -80,6 +87,7 @@ export function writeSettings(settings: SidecarSettings): void {
   };
   if (settings.lastUpdateCheckAt) record.lastUpdateCheckAt = settings.lastUpdateCheckAt;
   if (settings.installSource) record.installSource = settings.installSource;
+  if (settings.reviewer) record.reviewer = settings.reviewer;
   fs.writeFileSync(settingsPath(), `${JSON.stringify(record, null, 2)}\n`, "utf8");
 }
 
@@ -413,11 +421,34 @@ export function acquireSyncLockOrThrow(root: string, peer: string): () => void {
   throw new SidecarError("another sidecar sync is already running; try again once it finishes");
 }
 
+// As long as the daemon lets one sync run: a decision waiting on a slow sync
+// must outlast it rather than fail and lose the verdict.
+const SYNC_LOCK_WAIT_MS = 10 * 60 * 1000;
+
+// Waits out a running sync rather than failing against it. For follow-ups to
+// something that already happened — an approved review publishing — where the
+// sync that launched it may still be finishing.
+function acquireSyncLockWaiting(root: string, peer: string): () => void {
+  const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  const deadline = Date.now() + SYNC_LOCK_WAIT_MS;
+  while (true) {
+    const release = acquireSyncLock(root, peer);
+    if (release) return release;
+    if (Date.now() >= deadline) {
+      throw new SidecarError("another sidecar sync is still running; try again once it finishes");
+    }
+    Atomics.wait(sleeper, 0, 0, 250);
+  }
+}
+
 // The one place that decides what a busy lock means: "throw" for commands the
 // user demanded, "skip" for soft requests that can no-op because their trigger
-// will fire again. Returns whether the work ran.
-export function withSyncLock(root: string, peer: string, onBusy: "throw" | "skip", fn: () => void): boolean {
-  const releaseLock = onBusy === "skip" ? acquireSyncLock(root, peer) : acquireSyncLockOrThrow(root, peer);
+// will fire again, "wait" for follow-ups that must run but can be late.
+// Returns whether the work ran.
+export function withSyncLock(root: string, peer: string, onBusy: "throw" | "skip" | "wait", fn: () => void): boolean {
+  const releaseLock = onBusy === "skip"
+    ? acquireSyncLock(root, peer)
+    : onBusy === "wait" ? acquireSyncLockWaiting(root, peer) : acquireSyncLockOrThrow(root, peer);
   if (!releaseLock) {
     console.log("another sidecar sync is already running; skipping this soft sync");
     return false;
diff --git a/packages/sidecar/src/sync.ts b/packages/sidecar/src/sync.ts
index 65df2c8..cc7d06a 100644
--- a/packages/sidecar/src/sync.ts
+++ b/packages/sidecar/src/sync.ts
@@ -6,12 +6,12 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
 
 import { paint } from "./color.js";
-import { SidecarError, currentHost, currentUser, nowIso, realpathOr, slug, utcTimestamp } from "./util.js";
+import { SidecarError, currentMachine, currentUser, nowIso, realpathOr, slug, utcTimestamp } from "./util.js";
 import {
   branchExists,
+  emptyTree,
   ensureClean,
   ensureCommitIdentity,
   familyPrimaryRoot,
@@ -26,10 +26,13 @@ import {
   isAncestor,
   isDirty,
   remoteRefExists,
+  sidecarIdentity,
+  treeOf,
 } from "./git.js";
-import { packageVersion } from "./install.js";
+import { packageVersion, sidecarCliPath } from "./install.js";
 import {
   DEFAULT_PEER,
+  PUBLIC_REFS,
   type SidecarConfig,
   checkoutRandom,
   expandInbox,
@@ -42,8 +45,20 @@ import {
   remoteBranchName,
   requireSidecarCheckout,
   resolveSidecarPath,
+  reviewRequired,
 } from "./config.js";
-import { logSidecarEvent } from "./state.js";
+import { logSidecarEvent, readSettings } from "./state.js";
+import {
+  type Review,
+  type ReviewRecord,
+  createReview,
+  launchReviewer,
+  markPublished,
+  markPublishing,
+  markSuperseded,
+  openReview,
+  reviewAttention,
+} from "./review.js";
 import { readRules, resolveFileRules, rulesFingerprint, type SidecarRules } from "./rules.js";
 import {
   HEALTH_FILE,
@@ -66,14 +81,12 @@ import {
   redactText,
 } from "./redaction.js";
 
-// An env var rather than a flag so the daemon can request soft syncs from
-// older pinned project-local CLIs, which ignore it instead of rejecting an
-// unknown option.
-export const SOFT_SYNC_ENV = "SIDECAR_SYNC_SOFT";
-// Likewise a variable rather than a flag: the daemon settles this machine far
-// more often than it talks to the remote, and a pinned older CLI has to be able
-// to ignore the request instead of rejecting an option it never heard of.
-export const LOCAL_SYNC_ENV = "SIDECAR_SYNC_LOCAL";
+/**
+ * What a sync left undone on purpose. `held` is a review-gated peer whose
+ * unpublished work is waiting on a review; `attention` says why a person is
+ * needed, when one is.
+ */
+export type SyncOutcome = { held?: { review: Review; attention?: string } };
 
 /**
  * A sync in two phases, local first. Runs inside the repo's sync lock —
@@ -91,7 +104,7 @@ export function syncProject(
   root: string,
   config: SidecarConfig,
   options: { snapshot: boolean; remote: boolean; message?: string; onStage?: (stage: string) => void },
-): void {
+): SyncOutcome {
   const stage = (name: string): void => options.onStage?.(name);
 
   stage("checkout");
@@ -127,7 +140,8 @@ export function syncProject(
     stage("settle");
     settleCheckouts(sidecarPath, config, inbox, siblings);
   }
-  if (!options.remote) return;
+  if (!options.remote) return {};
+  if (reviewRequired(config)) return publishReviewed(root, sidecarPath, config, inbox, siblings, stage);
 
   stage("push-inbox");
   syncBranchBeforePush(sidecarPath, inbox, config);
@@ -136,6 +150,413 @@ export function syncProject(
   mergeInboxBranches(sidecarPath, config, { forkFiles: true, push: true, remote: true });
   stage("settle-remote");
   settleCheckouts(sidecarPath, config, inbox, siblings);
+  return {};
+}
+
+// ---------------------------------------------------------------------------
+// Review-gated publishing
+//
+// A peer with `review = "required"` never pushes its own history: snapshots
+// stay on this machine, and so does every intermediate state they recorded,
+// including one a reviewer rejected. What leaves is one commit per approved
+// review, whose tree is the tree the reviewer saw, on top of the public
+// commit the review measured from. Everything the canonical merge combines is
+// already public, so its push can carry nothing unreviewed either.
+//
+// The unit of review is the repo family's local main, not one checkout:
+// sibling checkouts share it, settle onto it within seconds, unreviewed, and
+// so publish exactly what it holds. Reviewing it once means a rejection holds
+// every sibling, and two siblings never race the same content to the remote.
+// Local main is never reset for a gated peer (see ensureMainBranch), and each
+// publish is joined to it by a link merge (see linkPublished), which is what
+// keeps later merges free of conflicts the edits never had.
+//
+// "Already public" means PUBLIC_REFS: the remote's branches as fetchPublic
+// last saw them, inside withPublicGit. remotes/origin/* is local state any
+// hook or tool can write, so a gated peer's public base, publish parents, and
+// canonical merge inputs never come from it.
+// ---------------------------------------------------------------------------
+
+/**
+ * Runs `fn` with git confined to what a reviewer saw. Anything this checkout's
+ * own git setup can add to a published commit or push is switched off for the
+ * duration, because none of it is in the packet:
+ *
+ * - identity: author and committer are sidecar's own, whatever config or
+ *   environment says, and commits are never signed and always UTF-8;
+ * - replacement objects: a `git replace` would make the packet show one blob
+ *   while the published tree holds another;
+ * - hooks, which can add files or message text to a commit, or forge refs;
+ * - rerere, which can replay a recorded local resolution into a merge;
+ * - configured push options, which reach the remote's hooks;
+ * - attributes: they are read from the empty tree, so no `.gitattributes` —
+ *   public, or pulled in by any include — selects a merge driver, filter, or
+ *   line-ending conversion. Only sidecar's own `info/attributes` applies,
+ *   whose redaction filter is pinned to its known command; drivers and
+ *   filters defined in config are neutralized as well, in case.
+ *
+ * Settings travel as environment config, replacing any the caller had in
+ * force (which would otherwise outrank them); sync is synchronous, so the
+ * environment is this call's alone.
+ */
+function withPublicGit<T>(repo: string, fn: () => T): T {
+  assertRedactionFilterIntact(repo);
+  const { name, email } = sidecarIdentity();
+  const overrides: Array<[string, string]> = [
+    ["core.hooksPath", os.devNull],
+    ["core.attributesFile", os.devNull],
+    ["core.autocrlf", "false"],
+    ["commit.gpgSign", "false"],
+    ["tag.gpgSign", "false"],
+    ["i18n.commitEncoding", "UTF-8"],
+    ["rerere.enabled", "false"],
+    ["rerere.autoUpdate", "false"],
+    ["merge.renormalize", "false"],
+    ["merge.default", "text"],
+    ["push.pushOption", ""],
+    ["push.followTags", "false"],
+    ...neutralizedDrivers(repo),
+  ];
+  const env: Record<string, string | undefined> = {
+    GIT_AUTHOR_NAME: name,
+    GIT_AUTHOR_EMAIL: email,
+    GIT_COMMITTER_NAME: name,
+    GIT_COMMITTER_EMAIL: email,
+    GIT_NO_REPLACE_OBJECTS: "1",
+    GIT_ATTR_SOURCE: emptyTree(repo),
+    GIT_CONFIG_PARAMETERS: undefined,
+    GIT_CONFIG_COUNT: String(overrides.length),
+  };
+  overrides.forEach(([key, value], index) => {
+    env[`GIT_CONFIG_KEY_${index}`] = key;
+    env[`GIT_CONFIG_VALUE_${index}`] = value;
+  });
+
+  const saved = Object.fromEntries(Object.keys(env).map((key) => [key, process.env[key]]));
+  const apply = (values: Record<string, string | undefined>): void => {
+    for (const [key, value] of Object.entries(values)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  };
+  apply(env);
+  try {
+    return fn();
+  } finally {
+    apply(saved);
+  }
+}
+
+/** Overrides that turn every merge driver and filter in config, except redaction, into git's own no-ops. */
+function neutralizedDrivers(repo: string): Array<[string, string]> {
+  const keys = git(repo, ["config", "--name-only", "--get-regexp", "^(merge|filter)\\..+\\.(driver|clean|smudge|process)$"], { check: false })
+    .stdout.split("\n").filter(Boolean);
+  return keys.flatMap((key): Array<[string, string]> => {
+    const [section, ...rest] = key.split(".");
+    const driver = rest.slice(0, -1).join(".");
+    if (section === "merge") return [[`merge.${driver}.driver`, "git merge-file --marker-size=%L %A %O %B"]];
+    if (driver === REDACTION_FILTER_NAME) return [];
+    return [[`filter.${driver}.clean`, "cat"], [`filter.${driver}.smudge`, "cat"], [`filter.${driver}.process`, ""], [`filter.${driver}.required`, "false"]];
+  });
+}
+
+/**
+ * Fails closed when a process filter is in force under the redaction filter's
+ * name: git would run it instead of the pinned clean command, and environment
+ * config cannot unset a key. ensureRedactionFilter removes one from repo
+ * config, so one still visible came from somewhere else — an include.
+ */
+function assertRedactionFilterIntact(repo: string): void {
+  if (git(repo, ["config", "--get-all", `filter.${REDACTION_FILTER_NAME}.process`], { check: false }).status === 0) {
+    throw new SidecarError(`filter.${REDACTION_FILTER_NAME}.process is configured; remove it — a review-gated peer publishes only through sidecar's own redaction filter`);
+  }
+}
+
+/**
+ * Refuses a push that `remote.origin.pushurl` would send somewhere other than
+ * the remote's own URL. URL rewrites (`url.*.insteadOf`) stay honored: they
+ * are how people route a host through the transport that authenticates.
+ */
+function assertPublishDestination(repo: string): void {
+  const pushUrl = git(repo, ["config", "--get-all", "remote.origin.pushurl"], { check: false }).stdout.trim();
+  if (!pushUrl) return;
+  const url = git(repo, ["config", "--get", "remote.origin.url"], { check: false }).stdout.trim();
+  if (pushUrl !== url) {
+    throw new SidecarError("remote.origin.pushurl sends this sidecar's pushes somewhere other than its remote; a review-gated peer publishes only to its remote — unset it");
+  }
+}
+
+/** Refreshes the remote's branches, into origin/* for local use and PUBLIC_REFS. Call inside withPublicGit. */
+function fetchPublic(repo: string): void {
+  git(repo, ["fetch", "--quiet", "--prune", "--no-tags", "origin", "+refs/heads/*:refs/remotes/origin/*", `+refs/heads/*:${PUBLIC_REFS}*`]);
+}
+
+function publicRef(branch: string): string {
+  return `${PUBLIC_REFS}${branch}`;
+}
+
+/** The remote's tip of `branch` as last fetched, if it has one. */
+/**
+ * Brings the public refs current for a caller outside the publish path —
+ * refresh, deciding what deleting a checkout would lose.
+ */
+export function refreshPublicRefs(repo: string): void {
+  withPublicGit(repo, () => fetchPublic(repo));
+}
+
+function publicTip(repo: string, branch: string): string | undefined {
+  return git(repo, ["rev-parse", "--verify", "--quiet", publicRef(branch)], { check: false }).stdout.trim() || undefined;
+}
+
+/** Whether the remote, as last fetched, has `commit` on any branch. */
+function isPublic(repo: string, commit: string): boolean {
+  return Boolean(git(repo, ["for-each-ref", "--contains", commit, "--format=%(refname)", PUBLIC_REFS]).stdout.trim());
+}
+
+function publishReviewed(
+  root: string,
+  sidecarPath: string,
+  config: SidecarConfig,
+  inbox: string,
+  siblings: string[],
+  stage: (name: string) => void,
+): SyncOutcome {
+  stage("fetch");
+  withPublicGit(sidecarPath, () => {
+    fetchPublic(sidecarPath);
+    // An emptied remote, or one this existing checkout predates: start main
+    // there the gated way, so reviews have a public base to measure from.
+    if (!publicTip(sidecarPath, config.branch)) bootstrapReviewedMain(sidecarPath, config);
+    stage("publish");
+    const open = openReview(sidecarPath);
+    if (open?.state === "approved") publishApprovedReview(sidecarPath, config, inbox, open);
+  });
+  stage("merge");
+  mergePublishedInboxes(sidecarPath, config, { forkFiles: true });
+  // Takes the remote's new main into local main, and this checkout's latest
+  // snapshot with it, so the review below sees the whole family.
+  stage("merge-local");
+  mergeInboxBranches(sidecarPath, config, { forkFiles: true, push: false, remote: false });
+  stage("settle-remote");
+  settleCheckouts(sidecarPath, config, inbox, siblings);
+  stage("review");
+  // Inside withPublicGit so the packet shows the blobs an approval would
+  // publish; the reviewer starts outside it, in the caller's environment.
+  const gate = withPublicGit(sidecarPath, () => gateUnpublished(root, sidecarPath, config));
+  if (gate?.launch) launchReviewer(gate.review);
+  return gate ? { held: { review: gate.review, attention: reviewAttention(gate.review) } } : {};
+}
+
+/**
+ * Opens, keeps, or retires the family's review so that it covers what local
+ * main holds and the remote does not. One review is open at a time: work that
+ * lands while one is undecided waits for the next, which batches review the
+ * way the debounce batches pushes. Returns the review holding publication, if
+ * any, and whether its reviewer should be launched.
+ */
+function gateUnpublished(root: string, sidecarPath: string, config: SidecarConfig): { review: Review; launch: boolean } | undefined {
+  const head = git(sidecarPath, ["rev-parse", `refs/heads/${config.branch}`]).stdout.trim();
+  const headTree = treeOf(sidecarPath, head);
+  const publicMain = publicTip(sidecarPath, config.branch);
+  const base = publicMain ? git(sidecarPath, ["merge-base", head, publicMain], { check: false }).stdout.trim() || undefined : undefined;
+  const open = openReview(sidecarPath);
+  const hasReviewer = Boolean(readSettings().reviewer);
+
+  if (base && treeOf(sidecarPath, base) === headTree) {
+    // Whatever an undecided review was waiting to publish is gone or already
+    // public. An approval still publishes: it was given, and its tree is safe.
+    if (open && open.state !== "approved") markSuperseded(open);
+    return undefined;
+  }
+  if (open?.state === "pending" || open?.state === "approved") {
+    // A reviewer configured after the review opened takes it from here.
+    return { review: open, launch: open.state === "pending" && !open.run && hasReviewer };
+  }
+  if (open) {
+    // Rejected or failed: it holds until the content changes, and the change
+    // is what the next review sees.
+    if (open.record.tree === headTree) return { review: open, launch: false };
+    markSuperseded(open);
+  }
+  const review = createReview({ root, config, sidecarPath, base, head });
+  console.log(`opened review ${paint("brand", review.record.id)} for ${review.record.files.length} changed file(s)`);
+  return { review, launch: hasReviewer };
+}
+
+/**
+ * Publishes an approved review as one new commit on this checkout's inbox
+ * branch, then joins it to local main. Call inside withPublicGit.
+ */
+function publishApprovedReview(sidecarPath: string, config: SidecarConfig, inbox: string, review: Review): void {
+  const { record } = review;
+  // The base becomes the publish commit's parent, so it must already be on
+  // the remote: anything else would push its history along with it.
+  if (!record.publishing && record.base && !isPublic(sidecarPath, record.base)) {
+    markSuperseded(review);
+    console.log(`review ${paint("brand", record.id)} was measured from a commit the remote does not have; reviewing again`);
+    return;
+  }
+  assertPublishDestination(sidecarPath);
+  // A sync that recorded its commit and then died — in this checkout or a
+  // sibling — left the one commit this review may publish. Push that again,
+  // to the inbox it was cut for, rather than cutting a second one.
+  const target = record.publishing ?? { inbox, commit: cutPublishCommit(sidecarPath, config, inbox, record) };
+  if (!record.publishing) markPublishing(review, target.inbox, target.commit);
+  if (!isAncestor(sidecarPath, target.commit, publicRef(target.inbox))) {
+    // Never forced: the family is the inbox's only writer, so a rejection
+    // means something is wrong, and overwriting would hide it.
+    const push = git(sidecarPath, ["push", "--no-follow-tags", "origin", `${target.commit}:refs/heads/${target.inbox}`], { check: false });
+    if (push.status !== 0) {
+      throw new SidecarError(push.stderr.trim() || `could not publish review ${record.id} to ${target.inbox}`);
+    }
+    fetchPublic(sidecarPath);
+    console.log(`published review ${paint("brand", record.id)} to ${paint("brand", target.inbox)}`);
+  }
+  linkPublished(sidecarPath, config, review, target.commit);
+  markPublished(review, target.commit);
+}
+
+/**
+ * The reviewed tree as a commit: first parent the public commit the review
+ * was measured from, second the inbox's previously published tip (unless the
+ * base already contains it) so the push is a fast-forward. Write times for
+ * last-writer-wins travel as carried trailers, since the snapshots that
+ * recorded them stay behind.
+ */
+function cutPublishCommit(sidecarPath: string, config: SidecarConfig, inbox: string, record: ReviewRecord): string {
+  const previous = publicTip(sidecarPath, inbox);
+  const parents = [
+    ...(record.base ? [record.base] : []),
+    ...(previous && !(record.base && isAncestor(sidecarPath, previous, record.base)) ? [previous] : []),
+  ];
+  const body = [
+    "sidecar publish",
+    "",
+    `source: ${currentMachine()}`,
+    `inbox: ${inbox}`,
+    `review: ${record.id}`,
+    ...publishedWriteTrailers(sidecarPath, config, record),
+  ];
+  return git(sidecarPath, [
+    "commit-tree",
+    record.tree,
+    ...parents.flatMap((parent) => ["-p", parent]),
+    "-m",
+    body.join("\n"),
+  ]).stdout.trim();
+}
+
+/**
+ * Carried last-writer-wins clocks for the reviewed paths that resolve by lww.
+ * The write events live in local snapshot trailers the remote never sees;
+ * without these every published path would read as written at publish time.
+ */
+function publishedWriteTrailers(repo: string, config: SidecarConfig, record: ReviewRecord): string[] {
+  const defaults = { resolve: config.resolve, redaction: config.redaction };
+  const paths = record.files
+    .map((file) => file.path)
+    .filter((filePath) => resolveFileRules(config.rules, filePath, defaults).resolve === "lww");
+  if (paths.length > WRITTEN_TRAILER_LIMIT) return [];
+  // Nothing read out of a local commit message passes into a published one:
+  // those messages are unreviewed, and a source or a clock can carry any text
+  // shaped like one. Each path's write is this review's own, a token no other
+  // write shares; its time is the recorded one, bounded to a plausible clock.
+  const now = Math.floor(Date.now() / 1000);
+  return paths.map((filePath) => {
+    const { time } = lastWriteEvent(repo, record.head, filePath);
+    return lwwWrittenTrailer(filePath, { time: Math.min(Math.max(0, time), now), source: `review-${record.id}` });
+  });
+}
+
+/**
+ * Joins the published commit to the local history it was cut from.
+ *
+ * The publish commit's parent is the public base, so on its own git would see
+ * no relation between it and the local main it reproduces — and merging the
+ * remote's main back in would measure every edit made since from that base,
+ * turning each file touched after the approval into a conflict. A merge with
+ * the "ours" strategy records that local main already contains the published
+ * state without changing a file. Local main only grows, so the reviewed head
+ * is in it; the link is never pushed, and every sibling inherits it when it
+ * settles onto main.
+ */
+function linkPublished(sidecarPath: string, config: SidecarConfig, review: Review, published: string): void {
+  const main = `refs/heads/${config.branch}`;
+  if (isAncestor(sidecarPath, published, main)) return;
+  // A main rebuilt from scratch no longer holds what was reviewed; claiming it
+  // contains the published state would be a false merge that drops content.
+  if (!isAncestor(sidecarPath, review.record.head, main)) {
+    logSidecarEvent("review-link-skip", { sidecarPath, id: review.record.id });
+    return;
+  }
+  withScratchWorktree(sidecarPath, config, "HEAD", (worktree) => {
+    git(worktree, ["switch", config.branch]);
+    // Unrelated when the review measured from nothing: the published commit
+    // is then a root of its own, and local main still holds its state.
+    git(worktree, ["merge", "--no-ff", "--allow-unrelated-histories", "-s", "ours", "-m", `sidecar: link published review ${review.record.id}`, published]);
+  });
+}
+
+/**
+ * The canonical merge for a review-gated peer: the remote's main plus every
+ * inbox as the remote has it. Local inbox branches never enter it — they hold
+ * unpublished snapshots — so the merge result, and the push of it, is built
+ * from public commits alone.
+ */
+export function mergePublishedInboxes(sidecarPath: string, config: SidecarConfig, options: { forkFiles: boolean }): number {
+  return withPublicGit(sidecarPath, () => {
+    fetchPublic(sidecarPath);
+    if (!publicTip(sidecarPath, config.branch)) return 0;
+    const publicMain = publicRef(config.branch);
+    if (publishedInboxBranches(sidecarPath, config).every((ref) => isAncestor(sidecarPath, ref, publicMain))) {
+      console.log("no published inbox branches to merge");
+      return 0;
+    }
+    assertPublishDestination(sidecarPath);
+    return withScratchWorktree(sidecarPath, config, publicMain, (worktree) => {
+      // Config can differ by worktree (includeIf gitdir), so check here too.
+      assertRedactionFilterIntact(worktree);
+      const maxAttempts = 3;
+      for (let attempt = 1; ; attempt += 1) {
+        if (attempt > 1) {
+          fetchPublic(sidecarPath);
+          git(worktree, ["reset", "--hard", publicMain]);
+        }
+        const pending = publishedInboxBranches(worktree, config).filter((ref) => !isAncestor(worktree, ref, "HEAD"));
+        if (!pending.length) {
+          console.log("no published inbox branches to merge");
+          return 0;
+        }
+        const merged: string[] = [];
+        for (const ref of pending) {
+          console.log(`merging ${paint("brand", remoteBranchName(ref))}`);
+          if (mergeInboxBranch(worktree, config, ref, options)) merged.push(ref);
+        }
+        const push = git(worktree, ["push", "--no-follow-tags", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
+        if (push.status !== 0) {
+          if (attempt >= maxAttempts) throw new SidecarError(push.stderr.trim() || `could not push ${config.branch}`);
+          console.log(`push of ${config.branch} was rejected; refetching and retrying`);
+          continue;
+        }
+        // A push does not move the public refs, and the gate measures from
+        // them: without this, it would see what was just merged as unpublished.
+        fetchPublic(sidecarPath);
+        console.log(`pushed ${config.branch}`);
+        console.log(`merged ${merged.length} inbox branch(es)`);
+        return merged.length;
+      }
+    });
+  });
+}
+
+/** Every inbox branch as the remote has it, including this checkout's own, as public refs. */
+function publishedInboxBranches(repo: string, config: SidecarConfig): string[] {
+  const prefix = inboxPrefix(config);
+  return git(repo, ["for-each-ref", "--format=%(refname)", PUBLIC_REFS])
+    .stdout.split(/\r?\n/)
+    .map((ref) => ref.trim())
+    .filter((ref) => ref && matchesInboxPrefix(prefix, ref.slice(PUBLIC_REFS.length)))
+    .sort();
 }
 
 /**
@@ -247,24 +668,9 @@ export function reportSyncHealth(root: string, config: SidecarConfig, outcome: H
     // it's in the local log and there is nowhere to say so from.
     if (!hasGitMetadata(sidecarPath)) return;
 
-    const branch = healthBranchFor(sidecarPath);
-    const previous = readHealthRecordAt(sidecarPath, `origin/${branch}`);
-    const identity: HealthIdentity = {
-      machine: `${currentUser()}@${currentHost()}`,
-      root,
-      peer: config.peer === DEFAULT_PEER ? undefined : config.peer,
-      inbox: expandInbox(config, sidecarPath),
-      version: packageVersion(),
-    };
-    const record = nextHealthRecord(previous, identity, outcome, nowIso());
-    if (!shouldPublishHealth(previous, record)) return;
-    publishHealthRecord(sidecarPath, branch, record);
-    logSidecarEvent("health", {
-      branch,
-      status: record.status,
-      stage: record.stage,
-      consecutiveFailures: record.consecutiveFailures,
-    });
+    // The previous record is read inside withPublicGit too: what it carries
+    // forward must be the blob the remote has, not a local replacement.
+    withPublicGit(sidecarPath, () => publishHealth(root, config, sidecarPath, outcome));
   } catch (error) {
     logSidecarEvent("failure", {
       command: "health",
@@ -274,6 +680,28 @@ export function reportSyncHealth(root: string, config: SidecarConfig, outcome: H
   }
 }
 
+function publishHealth(root: string, config: SidecarConfig, sidecarPath: string, outcome: HealthOutcome): void {
+  const branch = healthBranchFor(sidecarPath);
+  const previous = readHealthRecordAt(sidecarPath, `origin/${branch}`);
+  const identity: HealthIdentity = {
+    machine: currentMachine(),
+    root,
+    peer: config.peer === DEFAULT_PEER ? undefined : config.peer,
+    inbox: expandInbox(config, sidecarPath),
+    version: packageVersion(),
+  };
+  const record = nextHealthRecord(previous, identity, outcome, nowIso());
+  if (!shouldPublishHealth(previous, record)) return;
+  if (reviewRequired(config)) assertPublishDestination(sidecarPath);
+  publishHealthRecord(sidecarPath, branch, record);
+  logSidecarEvent("health", {
+    branch,
+    status: record.status,
+    stage: record.stage,
+    consecutiveFailures: record.consecutiveFailures,
+  });
+}
+
 /**
  * Writes the heartbeat with plumbing, deliberately touching nothing the sync
  * path uses: no working tree, no index, no branch checkout, and — because
@@ -291,19 +719,10 @@ function publishHealthRecord(sidecarPath: string, branch: string, record: Health
   const tree = git(sidecarPath, ["mktree"], {
     input: `100644 blob ${blob}\t${HEALTH_FILE}\n`,
   }).stdout.trim();
-  // Identity comes in on the command line rather than from repo config, so
-  // publishing doesn't depend on a config write having succeeded first.
-  const commit = git(sidecarPath, [
-    "-c",
-    `user.name=${currentUser()}`,
-    "-c",
-    `user.email=${slug(currentUser())}@${slug(currentHost())}.local`,
-    "commit-tree",
-    tree,
-    "-m",
-    `health: ${record.status} — ${record.machine}`,
-  ]).stdout.trim();
-  git(sidecarPath, ["push", "--force", "origin", `${commit}:refs/heads/${branch}`]);
+  // Identity comes from withPublicGit's environment rather than repo config,
+  // so publishing doesn't depend on a config write having succeeded first.
+  const commit = git(sidecarPath, ["commit-tree", tree, "-m", `health: ${record.status} — ${record.machine}`]).stdout.trim();
+  git(sidecarPath, ["push", "--no-follow-tags", "--force", "origin", `${commit}:refs/heads/${branch}`]);
 }
 
 /** Reads a heartbeat straight out of a ref; `git show` on a blob is unfiltered. */
@@ -362,14 +781,16 @@ export function mergeInboxBranches(
   // local merge sees only what this machine holds and does not fetch; a remote
   // one fetches first, so the same question also covers the other machines.
   if (options.remote) fetch(sidecarPath, false);
-  if (!hasPendingInboxWork(sidecarPath, config)) {
+  // A main that lacks the remote's latest is work too, merge or not: bringing
+  // it current is ensureMainBranch's job, inside the worktree below.
+  if (!hasPendingInboxWork(sidecarPath, config) && mainContainsRemote(sidecarPath, config)) {
     // Nothing to merge, but the local phase advances main before the remote
     // phase runs, so main is routinely owed to the remote with no merge behind
     // it. Sending a branch needs no checkout — and so needs no worktree. A
     // rejected push means another machine moved main and this is a real
     // reconcile after all, so fall through and do it properly.
     if (options.push && !mainMatchesRemote(sidecarPath, config)) {
-      const push = git(sidecarPath, ["push", "origin", `refs/heads/${config.branch}:refs/heads/${config.branch}`], {
+      const push = git(sidecarPath, ["push", "--no-follow-tags", "origin", `refs/heads/${config.branch}:refs/heads/${config.branch}`], {
         check: false,
       });
       if (push.status === 0) {
@@ -399,6 +820,15 @@ export function mergeInboxBranches(
   if (git(sidecarPath, ["branch", "--show-current"]).stdout.trim() === config.branch) {
     ensureInboxBranch(sidecarPath, config, expandInbox(config, sidecarPath));
   }
+  return withScratchWorktree(sidecarPath, config, "HEAD", (worktree) => mergeInboxBranchesAt(worktree, config, options));
+}
+
+/**
+ * Runs `fn` in a throwaway linked worktree detached at `start`, with this
+ * checkout's redaction policy bound to it. Merges happen there so the user's
+ * checkout never switches branches.
+ */
+function withScratchWorktree<T>(sidecarPath: string, config: SidecarConfig, start: string, fn: (worktree: string) => T): T {
   // A deterministic path (rather than mkdtemp) lets a new sync reclaim the
   // worktree a killed sync left behind; a stale registration would otherwise
   // block `git switch <main>` in every future merge. The sync lock prevents
@@ -412,9 +842,9 @@ export function mergeInboxBranches(
   fs.rmSync(scratch, { recursive: true, force: true });
   git(sidecarPath, ["worktree", "prune", "--expire", "now"], { check: false });
   try {
-    git(sidecarPath, ["worktree", "add", "--detach", worktree]);
+    git(sidecarPath, ["worktree", "add", "--detach", worktree, start]);
     ensureRedactionFilter(worktree, config.redaction, config);
-    return mergeInboxBranchesAt(worktree, config, options);
+    return fn(worktree);
   } finally {
     git(sidecarPath, ["worktree", "remove", "--force", worktree], { check: false });
     fs.rmSync(scratch, { recursive: true, force: true });
@@ -435,6 +865,12 @@ function mainMatchesRemote(repo: string, config: SidecarConfig): boolean {
   return local !== undefined && local === remote;
 }
 
+/** Whether local main already holds everything the remote's main does. */
+function mainContainsRemote(repo: string, config: SidecarConfig): boolean {
+  if (!remoteRefExists(repo, config.branch) || !branchExists(repo, config.branch)) return true;
+  return isAncestor(repo, `origin/${config.branch}`, `refs/heads/${config.branch}`);
+}
+
 /** Whether any inbox branch still sits outside the local main branch. */
 function hasPendingInboxWork(repo: string, config: SidecarConfig): boolean {
   const main = `refs/heads/${config.branch}`;
@@ -478,7 +914,7 @@ function mergeInboxBranchesAt(
     if (options.push) {
       const push = git(
         sidecarPath,
-        ["push", "-u", "origin", `HEAD:refs/heads/${config.branch}`],
+        ["push", "--no-follow-tags", "-u", "origin", `HEAD:refs/heads/${config.branch}`],
         { check: false },
       );
       if (push.status !== 0) {
@@ -711,6 +1147,10 @@ export function cloneOrUpdate(
 export function bootstrapMainBranch(repo: string, config: SidecarConfig): void {
   if (remoteRefExists(repo, config.branch)) return;
 
+  if (reviewRequired(config)) {
+    withPublicGit(repo, () => bootstrapReviewedMain(repo, config));
+    return;
+  }
   if (hasAnyCommit(repo)) {
     const current = git(repo, ["branch", "--show-current"]).stdout.trim();
     if (current !== config.branch) {
@@ -748,6 +1188,36 @@ Kept in sync by [sidecar](https://github.com/endograph/sidecar).
   pushBranch(repo, config.branch);
 }
 
+/**
+ * Starts the remote's main for a review-gated peer. Whatever the checkout
+ * holds — history, or files staged in an unborn repo — would publish
+ * unreviewed through an ordinary first commit, so the remote gets a root
+ * commit of the empty tree, made with plumbing that reads neither HEAD nor the
+ * index. Existing local history is linked to it the way a publish is (see
+ * linkPublished); the next sync then reviews everything the checkout holds as
+ * one change from nothing. Call inside withPublicGit.
+ */
+function bootstrapReviewedMain(repo: string, config: SidecarConfig): void {
+  assertPublishDestination(repo);
+  const root = git(repo, ["commit-tree", emptyTree(repo), "-m", "Initialize sidecar"]).stdout.trim();
+  git(repo, ["push", "--no-follow-tags", "origin", `${root}:refs/heads/${config.branch}`]);
+  fetchPublic(repo);
+  console.log(`started ${config.branch} on the remote empty; this checkout's content is published through review`);
+  const ref = `refs/heads/${config.branch}`;
+  // Unborn: local main starts at the public root. Nothing staged is touched;
+  // it reaches the inbox at the next snapshot and is reviewed from there.
+  if (!hasAnyCommit(repo)) {
+    git(repo, ["update-ref", ref, root]);
+    return;
+  }
+  const local = git(repo, ["rev-parse", "--verify", "--quiet", ref], { check: false }).stdout.trim()
+    || git(repo, ["rev-parse", "HEAD"]).stdout.trim();
+  // A merge commit of local main's own tree: no file changes, whether or not
+  // main is checked out anywhere.
+  const link = git(repo, ["commit-tree", treeOf(repo, local), "-p", local, "-p", root, "-m", "sidecar: link the remote's initial main"]).stdout.trim();
+  git(repo, ["update-ref", ref, link]);
+}
+
 export function ensureMainBranch(repo: string, config: SidecarConfig): void {
   if (branchExists(repo, config.branch)) {
     git(repo, ["switch", config.branch]);
@@ -774,6 +1244,15 @@ export function ensureMainBranch(repo: string, config: SidecarConfig): void {
     git(repo, ["merge", "--ff-only", remoteBranch]);
     return;
   }
+  // A review-gated peer's local main is this machine's whole view: the
+  // remote's main with every unpublished local merge on top, including the
+  // link that joins each published commit to the history it was cut from
+  // (see linkPublished). Resetting it would discard those links, so it takes
+  // the remote's side in as a merge instead.
+  if (reviewRequired(config)) {
+    mergeInboxBranch(repo, config, remoteBranch, { forkFiles: true });
+    return;
+  }
   // Diverged: another machine won a push race. Local commits beyond the
   // remote are only sidecar-generated inbox merges, so the remote side wins
   // and any still-pending inbox branches get re-merged on top of it.
@@ -885,7 +1364,7 @@ export function snapshot(
     .stdout.split("\0")
     .filter(Boolean);
 
-  const source = `${currentUser()}@${currentHost()}`;
+  const source = currentMachine();
   const body = [message, "", `source: ${source}`];
   // main-head pins a snapshot to the code it was taken against. Standalone has
   // no separate code repo — mainRoot is this repo — so the trailer would just
@@ -1044,7 +1523,7 @@ export function ensureRedactionFilter(
   // %f is shell-quoted by Git itself, including whitespace and metacharacters.
   // Always run the filter: another checkout or a path rule can require
   // redaction even when this peer's default is none.
-  const command = `${filterCommandQuote(process.execPath)} ${filterCommandQuote(redactCliPath())} redact --checkout-policy --path %f`;
+  const command = `${filterCommandQuote(process.execPath)} ${filterCommandQuote(sidecarCliPath())} redact --checkout-policy --path %f`;
   const wanted: Array<[string, string]> = [
     [`filter.${REDACTION_FILTER_NAME}.clean`, command],
     [`filter.${REDACTION_FILTER_NAME}.revision`, REDACTION_FILTER_REVISION],
@@ -1053,6 +1532,9 @@ export function ensureRedactionFilter(
     [`filter.${REDACTION_FILTER_NAME}.smudge`, "cat"],
     [`filter.${REDACTION_FILTER_NAME}.required`, "true"],
   ];
+  // Git prefers a process filter over clean/smudge, so one configured under
+  // this name would replace redaction outright; it is removed, never kept.
+  const processKey = `filter.${REDACTION_FILTER_NAME}.process`;
   // info/attributes lives in the shared git dir; the worktree-local git dir
   // differs from it inside linked worktrees (which merging uses).
   const attributesPath = path.join(gitCommonDir(repo), "info", "attributes");
@@ -1074,7 +1556,7 @@ export function ensureRedactionFilter(
         return [entry.slice(0, space), entry.slice(space + 1)] as [string, string];
       }),
   );
-  const configOk = wanted.every(([key, value]) => current.get(key) === value);
+  const configOk = wanted.every(([key, value]) => current.get(key) === value) && !current.has(processKey);
   let attributes = "";
   try {
     attributes = fs.readFileSync(attributesPath, "utf8");
@@ -1087,6 +1569,7 @@ export function ensureRedactionFilter(
   for (const [key, value] of wanted) {
     git(repo, ["config", key, value]);
   }
+  git(repo, ["config", "--unset-all", processKey], { check: false });
   if (!attributesOk) {
     fs.mkdirSync(path.dirname(attributesPath), { recursive: true });
     fs.appendFileSync(
@@ -1123,14 +1606,6 @@ export function removeRedactionFilter(repo: string): void {
   }
 }
 
-// The filter must be runnable by plain git, outside this process: point it at
-// the built CLI bundle (when running from TypeScript sources, e.g. tests, the
-// sibling dist build).
-function redactCliPath(): string {
-  const self = fileURLToPath(import.meta.url);
-  return self.endsWith(".ts") ? path.join(path.dirname(self), "..", "dist", "cli.js") : self;
-}
-
 // Git runs filter commands through sh; double quotes keep paths with spaces
 // intact.
 function filterCommandQuote(value: string): string {
@@ -1188,7 +1663,7 @@ function refreshInboxFromMain(repo: string, config: SidecarConfig, inbox: string
 }
 
 export function pushBranch(repo: string, branch: string): void {
-  git(repo, ["push", "-u", "origin", `HEAD:refs/heads/${branch}`]);
+  git(repo, ["push", "--no-follow-tags", "-u", "origin", `HEAD:refs/heads/${branch}`]);
   console.log(`pushed ${paint("brand", branch)}`);
 }
 
diff --git a/packages/sidecar/src/util.ts b/packages/sidecar/src/util.ts
index 2f9ab54..ccba2d1 100644
--- a/packages/sidecar/src/util.ts
+++ b/packages/sidecar/src/util.ts
@@ -118,6 +118,11 @@ export function currentHost(): string {
   return os.hostname().split(".", 1)[0] || "unknown";
 }
 
+/** `user@host`: how this machine names itself in commits and heartbeats. */
+export function currentMachine(): string {
+  return `${currentUser()}@${currentHost()}`;
+}
+
 /**
  * A duration as seconds: a bare number is seconds, a string takes an
  * `s`, `m`, or `h` suffix ("90s", "10m", "1h"). Undefined when unparseable.
diff --git a/packages/sidecar/tests/cli.test.ts b/packages/sidecar/tests/cli.test.ts
index 41e3c54..f3e5d67 100644
--- a/packages/sidecar/tests/cli.test.ts
+++ b/packages/sidecar/tests/cli.test.ts
@@ -134,6 +134,36 @@ describe("config", () => {
     expect(() => readConfig(configPath)).toThrow(/interval: invalid duration "soon"/);
   });
 
+  test("refuses keys it does not know rather than dropping them", () => {
+    const configPath = path.join(tempDir(), ".sidecar");
+    fs.writeFileSync(configPath, 'remote = "git@github.com:org/repo.git"\nreveiw = "required"\n', "utf8");
+    expect(() => readConfig(configPath)).toThrow(/unknown key "reveiw"/);
+  });
+
+  test("refuses a config version it does not read", () => {
+    const configPath = path.join(tempDir(), ".sidecar");
+    fs.writeFileSync(configPath, 'version = 2\nremote = "git@github.com:org/repo.git"\n', "utf8");
+    expect(() => readConfig(configPath)).toThrow(/config version 2 is not supported/);
+  });
+
+  test("reads review policy and its timeout, and writes them back only when set", () => {
+    const configPath = path.join(tempDir(), ".sidecar");
+    fs.writeFileSync(configPath, 'remote = "git@github.com:org/repo.git"\n', "utf8");
+    expect(readConfig(configPath)).toMatchObject({ review: "off", reviewTimeout: undefined });
+    writeConfig(configPath, readConfig(configPath));
+    expect(fs.readFileSync(configPath, "utf8")).not.toContain("review");
+
+    fs.writeFileSync(configPath, 'remote = "git@github.com:org/repo.git"\nreview = "required"\nreview-timeout = "30m"\n', "utf8");
+    const config = readConfig(configPath);
+    expect(config).toMatchObject({ review: "required", reviewTimeout: 1800 });
+    writeConfig(configPath, config);
+    expect(fs.readFileSync(configPath, "utf8")).toContain('review = "required"\nreview-timeout = 1800\n');
+    expect(readConfig(configPath)).toMatchObject({ review: "required", reviewTimeout: 1800 });
+
+    fs.writeFileSync(configPath, 'remote = "git@github.com:org/repo.git"\nreview = "agent"\n', "utf8");
+    expect(() => readConfig(configPath)).toThrow(/invalid review mode "agent"; expected one of off, required/);
+  });
+
   test("parses TOML strings with comments and escapes", () => {
     const root = tempDir();
     const configPath = path.join(root, ".sidecar");
diff --git a/packages/sidecar/tests/cmd-sync.test.ts b/packages/sidecar/tests/cmd-sync.test.ts
index 8c7d591..12338c3 100644
--- a/packages/sidecar/tests/cmd-sync.test.ts
+++ b/packages/sidecar/tests/cmd-sync.test.ts
@@ -39,6 +39,7 @@ beforeEach(() => {
   vi.stubEnv("SIDECAR_SYNC_LOCAL", "");
   vi.stubEnv("SIDECAR_SYNC_SOFT", "");
   vi.mocked(loadPeers).mockReturnValue([peer]);
+  vi.mocked(syncProject).mockReturnValue({});
   vi.mocked(withSyncLock).mockImplementation((_root, _peer, _mode, callback) => {
     locked = true;
     try { callback(); } finally { locked = false; }
diff --git a/packages/sidecar/tests/health.test.ts b/packages/sidecar/tests/health.test.ts
index aa0d1ad..18a310e 100644
--- a/packages/sidecar/tests/health.test.ts
+++ b/packages/sidecar/tests/health.test.ts
@@ -128,6 +128,17 @@ describe("nextHealthRecord", () => {
   });
 });
 
+describe("carried fields", () => {
+  test("only timestamps carry forward from a previous record", () => {
+    const forged = { ...ok(T0), lastSuccessAt: "PRIVATE text", lastFailureAt: "2026-07-26T08:00:00.000Z", consecutiveFailures: 2.7 };
+    const record = nextHealthRecord(forged, identity, { status: "failed", stage: "merge", message: "x" }, T1);
+    expect(record.lastSuccessAt).toBeUndefined();
+    expect(record.lastFailureAt).toBe(T1);
+    expect(record.consecutiveFailures).toBe(3);
+    expect(nextHealthRecord(forged, identity, { status: "ok" }, T1).lastFailureAt).toBe("2026-07-26T08:00:00.000Z");
+  });
+});
+
 describe("shouldPublishHealth", () => {
   const heartbeatAgo = (ms: number): number => Date.parse(T0) + ms;
 
@@ -145,6 +156,18 @@ describe("shouldPublishHealth", () => {
     expect(shouldPublishHealth(ok(T0), ok(T1), heartbeatAgo(HEALTH_HEARTBEAT_MS))).toBe(true);
   });
 
+  test("a review hold starting, changing, or clearing is a transition", () => {
+    const held = nextHealthRecord(ok(T0), identity, { status: "ok", review: "pending" }, T1);
+    const attention = nextHealthRecord(held, identity, { status: "ok", review: "attention" }, T1);
+    const clear = nextHealthRecord(attention, identity, { status: "ok" }, T1);
+    expect(held.review).toBe("pending");
+    expect(clear.review).toBeUndefined();
+    expect(shouldPublishHealth(ok(T0), held, heartbeatAgo(1000))).toBe(true);
+    expect(shouldPublishHealth(held, attention, heartbeatAgo(1000))).toBe(true);
+    expect(shouldPublishHealth(attention, clear, heartbeatAgo(1000))).toBe(true);
+    expect(shouldPublishHealth({ ...attention, updatedAt: T0 }, attention, heartbeatAgo(1000))).toBe(false);
+  });
+
   test("publishes rather than waiting forever when a clock runs behind the branch", () => {
     expect(shouldPublishHealth(ok(T2), ok(T2), Date.parse(T0))).toBe(true);
     expect(shouldPublishHealth({ ...ok(T0), updatedAt: "not a date" }, ok(T1))).toBe(true);
@@ -186,6 +209,12 @@ describe("record round-tripping", () => {
     expect(record?.consecutiveFailures).toBe(0);
   });
 
+  test("keeps a review hold and drops an unknown one", () => {
+    const held = nextHealthRecord(ok(T0), identity, { status: "ok", review: "attention" }, T1);
+    expect(parseHealthRecord(serializeHealthRecord(held))?.review).toBe("attention");
+    expect(parseHealthRecord(JSON.stringify({ status: "ok", updatedAt: T0, review: "maybe" }))?.review).toBeUndefined();
+  });
+
   test("rejects what isn't a record at all", () => {
     expect(parseHealthRecord("not json")).toBeUndefined();
     expect(parseHealthRecord("[]")).toBeUndefined();
diff --git a/packages/sidecar/tests/integration.test.ts b/packages/sidecar/tests/integration.test.ts
index 34351c6..db1c48e 100644
--- a/packages/sidecar/tests/integration.test.ts
+++ b/packages/sidecar/tests/integration.test.ts
@@ -2361,11 +2361,12 @@ describe("sidecar peers", () => {
 
     const output = runSidecar(["init", privateRemote, "--peer", "private", "--ignored"], main);
 
-    expect(output).toContain("ignored .sidecar.private and .sidecar-rules.private via .git/info/exclude");
+    expect(output).toContain("ignored .sidecar.private, .sidecar-rules.private, and .sidecar-review.private via .git/info/exclude");
     expect(output).toContain("ignored private/ via .git/info/exclude");
     const excludePath = path.join(main, ".git", "info", "exclude");
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar.private\n");
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar-rules.private\n");
+    expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar-review.private\n");
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/private/\n");
     fs.writeFileSync(path.join(main, ".sidecar-rules.private"), '[[rules]]\nglob = "**"\nresolve = "fork"\n');
     // The committed ignore file and the tree carry no trace of the peer.
@@ -2382,6 +2383,7 @@ describe("sidecar peers", () => {
     // may still declare the peer, so its lines are left where they are.
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar.private\n");
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar-rules.private\n");
+    expect(fs.readFileSync(excludePath, "utf8")).toContain("/.sidecar-review.private\n");
     expect(fs.readFileSync(excludePath, "utf8")).toContain("/private/\n");
     expect(fs.existsSync(path.join(main, ".sidecar"))).toBe(true);
   });
@@ -2457,6 +2459,161 @@ describe("sidecar peers", () => {
   });
 });
 
+describe("review-gated publishing", () => {
+  test("publishes only approved trees, and a rejected state never reaches the remote", async () => {
+    const { main, remote, sidecar } = initSidecarProject(["--review", "required"]);
+    const env = reviewerEnv(main);
+    runSidecar(["review", "reviewer", env.reviewer], main, env.vars);
+
+    fs.writeFileSync(path.join(sidecar, "notes.md"), "hello\n", "utf8");
+    const first = openedReview(runSidecar(["sync"], main, env.vars));
+    await waitForReview(main, first, "published", env.vars);
+    expect(remoteFile(remote, "notes.md")).toBe("hello\n");
+    // Publishing settles it: nothing is left to review, so no second review opens.
+    const afterPublish = JSON.parse(runSidecar(["review", "--json"], main, env.vars))[0].reviews;
+    expect(afterPublish.map((review: { id: string }) => review.id)).toEqual([first]);
+
+    fs.writeFileSync(path.join(sidecar, "notes.md"), "hello\nCONFIDENTIAL acquisition of Initech\n", "utf8");
+    const rejected = openedReview(runSidecar(["sync"], main, env.vars));
+    await waitForReview(main, rejected, "rejected", env.vars);
+    expect(runSidecar(["sync"], main, env.vars)).toContain("needs attention: rejected");
+    expect(remoteObjectsContain(remote, "CONFIDENTIAL")).toBe(false);
+
+    fs.writeFileSync(path.join(sidecar, "notes.md"), "hello\nan acquisition is planned\n", "utf8");
+    const fixed = openedReview(runSidecar(["sync"], main, env.vars));
+    expect(fixed).not.toBe(rejected);
+    await waitForReview(main, fixed, "published", env.vars);
+    expect(remoteFile(remote, "notes.md")).toBe("hello\nan acquisition is planned\n");
+    // The rejected snapshot stays in local history only.
+    expect(remoteObjectsContain(remote, "CONFIDENTIAL")).toBe(false);
+    expect(gitRaw(["--git-dir", remote, "log", "--all", "--format=%s"]).stdout).not.toContain("sidecar snapshot");
+  });
+
+  test("edits made during an open review, and a sibling worktree's, publish without forks", async () => {
+    const { main, worktree, remote, state } = initWorktreeFamily(["--review", "required"]);
+    const env = reviewerEnv(main, { SIDECAR_STATE_DIR: state });
+    runSidecar(["clone"], worktree, env.vars);
+    runSidecar(["review", "reviewer", env.reviewer], main, env.vars);
+    const sidecar = path.join(main, "sidecar");
+    const sibling = path.join(worktree, "sidecar");
+
+    fs.writeFileSync(env.defer, "", "utf8");
+    fs.writeFileSync(path.join(sidecar, "plan.md"), "v1\n", "utf8");
+    const first = openedReview(runSidecar(["sync"], main, env.vars));
+    await waitForReview(main, first, "pending", env.vars, (review) => fs.readFileSync(path.join(String(review.dir), "reviewer.log"), "utf8").includes("deferring"));
+    expect(fs.readFileSync(path.join(sibling, "plan.md"), "utf8")).toBe("v1\n");
+
+    fs.writeFileSync(path.join(sidecar, "plan.md"), "v1\nv2\n", "utf8");
+    const second = runSidecar(["sync"], main, env.vars);
+    expect(second).not.toContain("opened review");
+    fs.writeFileSync(path.join(sibling, "sibling.md"), "sibling note\n", "utf8");
+    runSidecar(["sync", "--local"], worktree, env.vars);
+
+    // A person approves what the review covered: v1 alone, not the edit after it.
+    fs.rmSync(env.defer);
+    const approved = runSidecar(["review", "approve", first], main, env.vars);
+    expect(remoteFile(remote, "plan.md")).toBe("v1\n");
+    await waitForReview(main, openedReview(approved), "published", env.vars);
+    runSidecar(["sync"], worktree, env.vars);
+    runSidecar(["sync"], main, env.vars);
+
+    expect(remoteFile(remote, "plan.md")).toBe("v1\nv2\n");
+    expect(remoteFile(remote, "sibling.md")).toBe("sibling note\n");
+    for (const tree of [sidecar, sibling]) {
+      expect(git(tree, ["ls-files"]).stdout).not.toMatch(/\.conflict\.|\.sidecar-conflicts\//);
+    }
+    expect(fs.readFileSync(path.join(sibling, "plan.md"), "utf8")).toBe("v1\nv2\n");
+  });
+
+  test("an undecided review needs attention after its timeout, and the heartbeat carries no reason", async () => {
+    const { main, remote, sidecar } = initSidecarProject(["--review", "required", "--review-timeout", "1s"]);
+    const env = reviewerEnv(main);
+    runSidecar(["review", "reviewer", env.reviewer], main, env.vars);
+    fs.writeFileSync(env.defer, "", "utf8");
+    fs.writeFileSync(path.join(sidecar, "later.md"), "decide later\n", "utf8");
+
+    const id = openedReview(runSidecar(["sync"], main, env.vars));
+    await waitForReview(main, id, "pending", env.vars, (review) => fs.readFileSync(path.join(String(review.dir), "reviewer.log"), "utf8").includes("deferring"));
+    await new Promise((resolve) => setTimeout(resolve, 1500));
+    expect(runSidecar(["sync"], main, env.vars)).toContain("needs attention: undecided for over 1s");
+    expect(runSidecar(["status"], main, env.vars)).toContain("needs attention");
+
+    const heartbeats = remoteBranches(remote).filter((branch) => branch.startsWith("sidecar-health/"))
+      .map((branch) => JSON.parse(gitRaw(["--git-dir", remote, "show", `${branch}:health.json`]).stdout));
+    expect(heartbeats.map((record) => record.review)).toContain("attention");
+
+    runSidecar(["review", "approve", id], main, env.vars);
+    expect(remoteFile(remote, "later.md")).toBe("decide later\n");
+  });
+
+  test("a gated peer refuses to push a snapshot directly", () => {
+    const { main, sidecar } = initSidecarProject(["--review", "required"]);
+    fs.writeFileSync(path.join(sidecar, "notes.md"), "hello\n", "utf8");
+    const result = runSidecarRaw(["snapshot", "--push"], main);
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain("requires review");
+  });
+});
+
+// A reviewer that rejects anything CONFIDENTIAL, defers while `defer` exists,
+// and approves the rest — through a `sidecar` on PATH, as a real one would.
+function reviewerEnv(main: string, extra: Record<string, string> = {}): { reviewer: string; defer: string; vars: Record<string, string> } {
+  const dir = tempDir();
+  const bin = path.join(dir, "bin");
+  fs.mkdirSync(bin);
+  fs.writeFileSync(path.join(bin, "sidecar"), `#!/bin/sh\nexec "${process.execPath}" "${cliPath}" "$@"\n`, { mode: 0o755 });
+  const defer = path.join(dir, "defer");
+  const reviewer = path.join(dir, "reviewer.sh");
+  fs.writeFileSync(reviewer, `#!/bin/sh
+if grep -q CONFIDENTIAL "$SIDECAR_REVIEW_DIFF"; then
+  exec sidecar review reject "$SIDECAR_REVIEW_ID" --reason "notes.md: an internal plan"
+fi
+if [ -f "${defer}" ]; then echo deferring; exit 0; fi
+exec sidecar review approve "$SIDECAR_REVIEW_ID"
+`, { mode: 0o755 });
+  return {
+    reviewer,
+    defer,
+    vars: { PATH: `${bin}:${process.env.PATH}`, SIDECAR_STATE_DIR: path.join(main, ".sidecar-test-state"), ...extra },
+  };
+}
+
+function openedReview(output: string): string {
+  const id = /opened review ([0-9a-f]+)/.exec(output)?.[1];
+  if (!id) throw new Error(`no review opened:\n${output}`);
+  return id;
+}
+
+// "published" is recorded before the approving sync pushes main, so a wait
+// for it also waits for that sync to let go of the lock.
+async function waitForReview(
+  main: string,
+  id: string,
+  state: string,
+  env: Record<string, string>,
+  also: (review: Record<string, unknown>) => boolean = () => true,
+): Promise<void> {
+  const locks = path.join(env.SIDECAR_STATE_DIR, "locks");
+  await waitFor(() => {
+    const shown = runSidecarRaw(["review", "show", id, "--json"], main, env);
+    if (shown.status !== 0) return false;
+    const review = JSON.parse(shown.stdout) as Record<string, unknown>;
+    const idle = !fs.existsSync(locks) || fs.readdirSync(locks).length === 0;
+    return review.state === state && idle && also(review);
+  }, 60_000);
+}
+
+function remoteFile(remote: string, file: string): string | undefined {
+  const result = gitRaw(["--git-dir", remote, "show", `main:${file}`], { check: false });
+  return result.status === 0 ? result.stdout : undefined;
+}
+
+function remoteObjectsContain(remote: string, text: string): boolean {
+  const objects = gitRaw(["--git-dir", remote, "rev-list", "--all", "--objects"]).stdout
+    .split("\n").filter(Boolean).map((line) => line.split(" ")[0]);
+  return objects.some((oid) => gitRaw(["--git-dir", remote, "cat-file", "-p", oid]).stdout.includes(text));
+}
+
 function remoteBranches(remote: string): string[] {
   return gitRaw(["--git-dir", remote, "branch", "--format=%(refname:short)"])
     .stdout.split("\n")
diff --git a/packages/sidecar/tests/review.test.ts b/packages/sidecar/tests/review.test.ts
new file mode 100644
index 0000000..aba8054
--- /dev/null
+++ b/packages/sidecar/tests/review.test.ts
@@ -0,0 +1,278 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+
+vi.mock("../src/git.js", async (original) => ({
+  ...await original<typeof import("../src/git.js")>(),
+  emptyTree: vi.fn(),
+  git: vi.fn(),
+  gitBytes: vi.fn(),
+  gitCommonDir: vi.fn(),
+  treeOf: vi.fn(),
+}));
+vi.mock("../src/state.js", async (original) => ({
+  ...await original<typeof import("../src/state.js")>(),
+  logSidecarEvent: vi.fn(),
+}));
+
+import { emptyTree, git, gitBytes, gitCommonDir, treeOf } from "../src/git.js";
+import { logSidecarEvent, readSettings, writeSettings } from "../src/state.js";
+import type { SidecarConfig } from "../src/config.js";
+import {
+  type Review,
+  createReview,
+  decideReview,
+  findReview,
+  listReviews,
+  markPublished,
+  markPublishing,
+  markSuperseded,
+  openReview,
+  readReview,
+  resetReview,
+  reviewAttention,
+} from "../src/review.js";
+
+const config: SidecarConfig = {
+  peer: "default", version: 1, path: "sidecar", remote: "https://bot:hunter2secret@example.com/notes.git", branch: "main",
+  inbox: "sidecar-inbox/{user}/{random}", redaction: "secrets", resolve: "fork", review: "required", reviewTimeout: 3600,
+};
+let directory: string;
+let root: string;
+let numstat = "";
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  numstat = "1\t0\tnotes.md\0";
+  directory = fs.mkdtempSync(path.join(os.tmpdir(), "sidecar-review-"));
+  root = path.join(directory, "repo");
+  fs.mkdirSync(path.join(root, "sidecar", ".git"), { recursive: true });
+  vi.stubEnv("SIDECAR_STATE_DIR", path.join(directory, "state"));
+  vi.mocked(gitCommonDir).mockImplementation((checkout) => path.join(checkout, ".git"));
+  vi.mocked(emptyTree).mockReturnValue("empty-tree");
+  vi.mocked(treeOf).mockReturnValue("tree-oid");
+  vi.mocked(gitBytes).mockReturnValue({ status: 0, stdout: Buffer.from("plain text\n"), stderr: Buffer.alloc(0) });
+  vi.mocked(git).mockImplementation((_repo, args) => {
+    let stdout = "";
+    if (args[0] === "diff-tree" && args.includes("--name-status")) stdout = "M\0notes.md\0A\0plans/q3.md\0";
+    else if (args[0] === "diff-tree" && args.includes("--numstat")) stdout = numstat;
+    else if (args[0] === "diff-tree") stdout = "diff --git a/notes.md b/notes.md\n+a new line\n";
+    else if (args[0] === "ls-tree") stdout = ["100644 blob aaa\tnotes.md", "100644 blob bbb\tplans/q3.md", "160000 commit ccc\tvendor/lib"].join("\x00");
+    return { status: 0, stdout, stderr: "" };
+  });
+});
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+  fs.rmSync(directory, { recursive: true, force: true });
+});
+
+function open(checkout = path.join(root, "sidecar")): Review {
+  return createReview({ root, config, sidecarPath: checkout, base: "base-oid", head: "head-oid" });
+}
+
+function writeRun(review: Review, run: Record<string, unknown>, attempt = "a1"): void {
+  fs.writeFileSync(path.join(review.dir, "attempt"), `${attempt}\n`, "utf8");
+  fs.writeFileSync(path.join(review.dir, `run-${attempt}.json`), JSON.stringify({ attempt, ...run }), "utf8");
+}
+
+describe("opening a review", () => {
+  test("writes an owner-only packet with the diff, changed paths, guidelines, and instructions", () => {
+    fs.writeFileSync(path.join(root, ".sidecar-review"), "No customer names.\n", "utf8");
+    const review = open();
+    const { record } = review;
+
+    expect(record).toMatchObject({
+      family: fs.realpathSync(path.join(root, "sidecar", ".git")),
+      base: "base-oid",
+      head: "head-oid",
+      tree: "tree-oid",
+      files: [{ status: "M", path: "notes.md" }, { status: "A", path: "plans/q3.md" }],
+      timeoutSeconds: 3600,
+    });
+    expect(git).toHaveBeenCalledWith(path.join(root, "sidecar"), expect.arrayContaining(["diff-tree", "--ignore-submodules=none", "-p", "base-oid", "head-oid"]));
+    expect(fs.statSync(review.dir).mode & 0o777).toBe(0o700);
+    for (const file of ["review.json", "diff.patch", "instructions.md", "guidelines.md"]) {
+      expect(fs.statSync(path.join(review.dir, file)).mode & 0o777).toBe(0o600);
+    }
+    expect(fs.readFileSync(path.join(review.dir, "diff.patch"), "utf8")).toContain("+a new line");
+    const instructions = fs.readFileSync(path.join(review.dir, "instructions.md"), "utf8");
+    expect(instructions).toContain(`sidecar review approve ${record.id}`);
+    expect(instructions).toContain(`sidecar review reject ${record.id} --reason`);
+    expect(instructions).toContain("No customer names.");
+    // The remote URL is quoted for context; its credentials are not.
+    expect(instructions).not.toContain("hunter2secret");
+    expect(review.state).toBe("pending");
+  });
+
+  test("puts the full content of files the diff cannot show into the packet", () => {
+    numstat = "1\t0\tnotes.md\0-\t-\tplans/q3.md\0";
+    vi.mocked(gitBytes).mockReturnValue({ status: 0, stdout: Buffer.from([0, 1, 2, 0x43]), stderr: Buffer.alloc(0) });
+    const review = open();
+    const opaque = review.record.files.find((file) => file.path === "plans/q3.md")!;
+    expect(opaque.artifact).toBe(path.join("opaque", "0001"));
+    expect(review.record.files.find((file) => file.path === "notes.md")!.artifact).toBeUndefined();
+    expect(gitBytes).toHaveBeenCalledWith(path.join(root, "sidecar"), ["cat-file", "blob", "head-oid:plans/q3.md"]);
+    expect(fs.readFileSync(path.join(review.dir, opaque.artifact!))).toEqual(Buffer.from([0, 1, 2, 0x43]));
+    expect(fs.statSync(path.join(review.dir, opaque.artifact!)).mode & 0o777).toBe(0o600);
+    const instructions = fs.readFileSync(path.join(review.dir, "instructions.md"), "utf8");
+    expect(instructions).toContain("`opaque/0001` — plans/q3.md");
+    expect(instructions).toContain("if you cannot, do not approve");
+  });
+
+  test("treats text that is not UTF-8 as content the diff cannot show", () => {
+    vi.mocked(gitBytes).mockImplementation((_repo, args) => ({
+      status: 0,
+      stdout: String(args.at(-1)).endsWith("plans/q3.md") ? Buffer.from([0xf9, 0xec, 0xe5, 0xed]) : Buffer.from("plain\n"),
+      stderr: Buffer.alloc(0),
+    }));
+    const review = open();
+    expect(review.record.files.find((file) => file.path === "plans/q3.md")!.artifact).toBe(path.join("opaque", "0001"));
+    expect(review.record.files.find((file) => file.path === "notes.md")!.artifact).toBeUndefined();
+  });
+
+  test("diffs against the empty tree when the head shares no history with the remote", () => {
+    createReview({ root, config, sidecarPath: path.join(root, "sidecar"), head: "head-oid" });
+    expect(git).toHaveBeenCalledWith(path.join(root, "sidecar"), expect.arrayContaining(["diff-tree", "-p", "empty-tree", "head-oid"]));
+  });
+
+  test("says so when the repository has no guidelines", () => {
+    const review = open();
+    expect(fs.existsSync(path.join(review.dir, "guidelines.md"))).toBe(false);
+    expect(fs.readFileSync(path.join(review.dir, "instructions.md"), "utf8")).toContain("has no review guidelines");
+  });
+
+  test("reads a named peer's guidelines from its own file", () => {
+    fs.writeFileSync(path.join(root, ".sidecar-review.notes"), "Notes only.\n", "utf8");
+    fs.writeFileSync(path.join(root, ".sidecar-review"), "Default only.\n", "utf8");
+    const review = createReview({ root, config: { ...config, peer: "notes" }, sidecarPath: path.join(root, "sidecar"), head: "head-oid" });
+    expect(fs.readFileSync(path.join(review.dir, "guidelines.md"), "utf8")).toBe("Notes only.\n");
+  });
+});
+
+describe("review state", () => {
+  test("a verdict decides the state, and a rejection's reason stays out of the log", () => {
+    const review = open();
+    decideReview(review, "rejected", "plans/q3.md: an unreleased plan");
+    const reread = readReview(review.record.id)!;
+    expect(reread.state).toBe("rejected");
+    expect(reread.verdict?.reason).toBe("plans/q3.md: an unreleased plan");
+    expect(reviewAttention(reread)).toBe("rejected");
+    expect(logSidecarEvent).toHaveBeenCalledWith("review-decision", { id: review.record.id, verdict: "rejected" });
+    expect(JSON.stringify(vi.mocked(logSidecarEvent).mock.calls)).not.toContain("unreleased");
+  });
+
+  test("a person can override a rejection until the review is published", () => {
+    const review = open();
+    decideReview(review, "rejected");
+    decideReview(review, "approved");
+    expect(readReview(review.record.id)!.state).toBe("approved");
+    markPublished(review, "published-oid");
+    const published = readReview(review.record.id)!;
+    expect(published.state).toBe("published");
+    expect(() => decideReview(published, "rejected")).toThrow(/already published/);
+  });
+
+  test("a reviewer that exits nonzero without a verdict has failed", () => {
+    const review = open();
+    writeRun(review, { pid: process.pid, command: "reviewer", startedAt: "t", finishedAt: "t", exitCode: 2, signal: null });
+    const reread = readReview(review.record.id)!;
+    expect(reread.state).toBe("failed");
+    expect(reviewAttention(reread)).toBe("reviewer exited 2 without a verdict");
+  });
+
+  test("a reviewer that exits zero without a verdict is a review still in progress", () => {
+    writeSettings({ ...readSettings(), reviewer: "reviewer" });
+    const review = open();
+    writeRun(review, { pid: process.pid, command: "reviewer", startedAt: "t", finishedAt: "t", exitCode: 0, signal: null });
+    const reread = readReview(review.record.id)!;
+    expect(reread.state).toBe("pending");
+    expect(reviewAttention(reread)).toBeUndefined();
+  });
+
+  test("a runner that died before finishing has failed", () => {
+    const review = open();
+    writeRun(review, { pid: 999_999, command: "reviewer", startedAt: "t" });
+    const reread = readReview(review.record.id)!;
+    expect(reread.state).toBe("failed");
+    expect(reviewAttention(reread)).toBe("reviewer stopped without a verdict");
+  });
+
+  test("needs attention with no reviewer configured, or once open past its timeout", () => {
+    const review = open();
+    expect(reviewAttention(review)).toBe("no reviewer is configured on this machine");
+    writeSettings({ ...readSettings(), reviewer: "reviewer" });
+    const opened = Date.parse(review.record.createdAt);
+    expect(reviewAttention(review, opened + 3599_000)).toBeUndefined();
+    expect(reviewAttention(review, opened + 3601_000)).toBe("undecided for over 1h");
+  });
+
+  test("only the current attempt's runner counts", () => {
+    const review = open();
+    writeRun(review, { pid: process.pid, command: "reviewer", startedAt: "t", finishedAt: "t", exitCode: 0 }, "new");
+    // The retired attempt's runner finishes late and badly; it is not the record read.
+    fs.writeFileSync(path.join(review.dir, "run-old.json"), JSON.stringify({ attempt: "old", pid: 1, startedAt: "t", finishedAt: "t", exitCode: 7 }));
+    expect(readReview(review.record.id)!.state).toBe("pending");
+  });
+
+  test("once publication has begun, a review can no longer be rejected or reset", () => {
+    const review = open();
+    decideReview(review, "approved");
+    markPublishing(review, "sidecar-inbox/test/abc", "commit-oid");
+    const reread = readReview(review.record.id)!;
+    expect(reread.record.publishing).toEqual({ inbox: "sidecar-inbox/test/abc", commit: "commit-oid" });
+    expect(() => decideReview(reread, "rejected")).toThrow(/already being published/);
+    expect(() => resetReview(reread)).toThrow(/already being published/);
+  });
+
+  test("reset clears the verdict and run so the reviewer can take it again", () => {
+    const review = open();
+    writeRun(review, { pid: 999_999, command: "reviewer", startedAt: "t", finishedAt: "t", exitCode: 1 });
+    decideReview(review, "rejected", "no");
+    resetReview(review);
+    const reread = readReview(review.record.id)!;
+    expect(reread.state).toBe("pending");
+    expect(reread.verdict).toBeUndefined();
+    expect(reread.run).toBeUndefined();
+  });
+});
+
+describe("finding reviews", () => {
+  test("a family has one open review: the newest that is neither published nor superseded", () => {
+    const checkout = path.join(root, "sidecar");
+    const first = open();
+    markSuperseded(first);
+    const second = open();
+    const elsewhere = path.join(directory, "other", "sidecar");
+    fs.mkdirSync(path.join(elsewhere, ".git"), { recursive: true });
+    const unrelated = open(elsewhere);
+
+    expect(openReview(checkout)?.record.id).toBe(second.record.id);
+    expect(openReview(elsewhere)?.record.id).toBe(unrelated.record.id);
+    expect(listReviews(checkout).map((review) => review.record.id).sort()).toEqual([first.record.id, second.record.id].sort());
+  });
+
+  test("a sibling checkout of the same family shares its review", () => {
+    const review = open();
+    const sibling = path.join(directory, "sibling", "sidecar");
+    vi.mocked(gitCommonDir).mockImplementation(() => path.join(root, "sidecar", ".git"));
+    expect(openReview(sibling)?.record.id).toBe(review.record.id);
+  });
+
+  test("ids resolve by unambiguous prefix, and never as paths", () => {
+    const review = open();
+    expect(findReview(review.record.id.slice(0, 3)).record.id).toBe(review.record.id);
+    expect(() => findReview("zz")).toThrow(/no review "zz"/);
+    expect(readReview("../state")).toBeUndefined();
+  });
+
+  test("keeps only the ten newest closed reviews per family", () => {
+    const checkout = path.join(root, "sidecar");
+    for (let index = 0; index < 13; index += 1) markSuperseded(open());
+    open();
+    const reviews = listReviews(checkout);
+    expect(reviews.filter((review) => review.state === "superseded")).toHaveLength(10);
+    expect(reviews.filter((review) => review.state === "pending")).toHaveLength(1);
+  });
+});
diff --git a/skills/sidecar/SKILL.md b/skills/sidecar/SKILL.md
index 8975a6f..eefa3a5 100644
--- a/skills/sidecar/SKILL.md
+++ b/skills/sidecar/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: sidecar
-description: Use the sidecarsync CLI to read, update, and synchronize Sidecar notes or state in repos with .sidecar configurations. Covers peer selection, standalone repos, per-file rules, and fork recovery.
+description: Use the sidecarsync CLI to read, update, and synchronize Sidecar notes or state in repos with .sidecar configurations. Covers peer selection, standalone repos, per-file rules, fork recovery, and review-gated publishing.
 ---
 
 # Sidecar
@@ -63,6 +63,20 @@ another machine. If a sync reports a busy lock, allow the active operation to fi
 retrying; do not remove the lock. Report persistent failures with the peer and
 error. Do not use `refresh --force`, `deinit`, reset, or clean as routine retries.
 
+## Review-gated peers
+
+A config with `review = "required"` holds publication until a review approves
+it. A sync that says publishing is held has not published. Report it as held,
+with the review state from `sidecar status --json` (`review.open`). Do not
+approve a review unless you were asked to review it, and never turn review
+off to get a sync through.
+
+When you are the reviewer, the packet is in `$SIDECAR_REVIEW_DIR`; follow
+`$SIDECAR_REVIEW_PROMPT`. Decide with `sidecar review approve ID` or
+`sidecar review reject ID --reason "<file: kind of content>"`. Keep the
+sensitive value out of the reason. If a person should weigh in, decide nothing
+and raise it with them.
+
 ## Policy and recovery
 
 Rules are `.sidecar-rules` for the default peer and `.sidecar-rules.NAME` for

From 7ded7ea195e35b50cfe905d3aa935bb1474cecb0 Mon Sep 17 00:00:00 2001
From: Zack Story <2302315+rt2zz@users.noreply.github.com>
Date: Sun, 18 Oct 2026 21:01:57 -0700
Subject: [PATCH 2/3] fix(sync): harden the review gate and simplify its review
 lifecycle

Fixes from a joint review (Claude and Codex) of the review gate.

- A shared store is bound to review: a gated peer marks it
  (`sidecar.review` in its git config) and an ungated peer refuses to
  snapshot, merge, or push through it. Families never link across review
  modes, so an ungated sibling can no longer publish gated work.
- One review launches its reviewer once. `review retry` retires the review
  and opens a new one of the same change, so a stale reviewer can only
  decide a closed review. The attempt files and resetReview are gone; a
  launch that never records a run counts as failed.
- Every review has a public base. A remote main that was started over is
  joined to local main by a link commit, never merged or reset. Publishing
  checks every parent of the cut or resumed commit is public, and keeps the
  prepared commit reachable under refs/sidecar-publishing/<id>. The
  empty-tree packet and parentless publish paths are removed.
- Gated failure details reach only the terminal: once a process touches a
  gated (or unreadable) config or a review packet, cli.ts logs failures
  without a message; the heartbeat carries the stage only; the daemon logs
  a gated peer's exit status and omits watcher error details.
- Re-running init keeps existing settings for omitted flags, so it can no
  longer drop the review gate. `snapshot --push` on a gated peer is refused
  before anything is snapshotted. `review reviewer` takes the command as one
  argument. The gated heartbeat reads its previous record from public refs.
  Refresh points gated work at review, and publishing skips a redundant
  fetch.
---
 docs/commands.md                           |   6 +-
 docs/review.md                             |  28 +-
 packages/sidecar/CLAUDE.md                 |  21 +-
 packages/sidecar/dist/cli.js               | 671 +++++++++++----------
 packages/sidecar/src/cli.ts                |   4 +-
 packages/sidecar/src/cmd-init.ts           |  54 +-
 packages/sidecar/src/cmd-refresh.ts        |  21 +-
 packages/sidecar/src/cmd-review.ts         |  41 +-
 packages/sidecar/src/cmd-sync.ts           |  32 +-
 packages/sidecar/src/config.ts             |  39 +-
 packages/sidecar/src/daemon.ts             |  25 +-
 packages/sidecar/src/review.ts             | 100 ++-
 packages/sidecar/src/sync.ts               | 233 ++++---
 packages/sidecar/tests/cli.test.ts         |  34 ++
 packages/sidecar/tests/integration.test.ts |  40 +-
 packages/sidecar/tests/review.test.ts      |  47 +-
 16 files changed, 843 insertions(+), 553 deletions(-)

diff --git a/docs/commands.md b/docs/commands.md
index 5bc98e8..5ddd3ff 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -172,9 +172,9 @@ open review.
 | `sidecar review show [<id>] [--json]` | state, reason, changed files, and the diff exactly as it would be published |
 | `sidecar review approve [<id>] [--no-sync]` | approve, then publish it now unless `--no-sync`; also overrides a rejection |
 | `sidecar review reject [<id>] [--reason <text>]` | hold publishing until the content changes |
-| `sidecar review retry [<id>]` | run this machine's reviewer on it again |
-| `sidecar review reviewer [<command>\|--unset]` | show or set this machine's reviewer, a shell command |
-| `sidecar review run <id> <attempt>` | the background runner a sync starts; not for direct use |
+| `sidecar review retry [<id>]` | retire it and open a new review of the same change, with a fresh reviewer run |
+| `sidecar review reviewer ["<command>"\|--unset]` | show or set this machine's reviewer, a shell command quoted as one argument |
+| `sidecar review run <id>` | the background runner a sync starts; not for direct use |
 
 ### `sidecar redactions [--peer <name>]`
 
diff --git a/docs/review.md b/docs/review.md
index fbb326a..17e28b0 100644
--- a/docs/review.md
+++ b/docs/review.md
@@ -24,7 +24,7 @@ Or `sidecar init <remote> --review required [--review-timeout 30m]`.
 Then tell this machine who reviews:
 
 ```sh
-sidecar review reviewer "claude-sidecar"   # any shell command
+sidecar review reviewer "claude-sidecar"   # any shell command, quoted as one argument
 sidecar review reviewer                     # show it
 sidecar review reviewer --unset
 ```
@@ -95,7 +95,9 @@ The exit status says only whether the reviewer itself worked:
 - **Exit 0 without one:** the review moved somewhere else, such as a thread or
   a person. It stays open until someone runs `approve` or `reject`.
 - **Nonzero:** the reviewer broke. The review needs attention;
-  `sidecar review retry` runs it again.
+  `sidecar review retry` retires it and opens a new review of the same change
+  with a fresh run of the reviewer. A reviewer still working on the old review
+  can no longer decide it.
 
 That middle case is what makes discussion possible. A reviewer can open a
 thread in your agent tool with the packet, exit, and let the agent there
@@ -134,7 +136,7 @@ my-agent-tool new-thread --title "sidecar review $SIDECAR_REVIEW_ID" \
 A review needs attention when it:
 
 - was rejected
-- has a reviewer that failed or stopped without a verdict
+- has a reviewer that failed, never started, or stopped without a verdict
 - has no reviewer on this machine
 - has stayed undecided for longer than `review-timeout`
 
@@ -144,8 +146,9 @@ Attention changes nothing about what's published. It makes the hold visible:
 `publishing held, review needs attention` to every machine. The heartbeat
 carries the state only, never a rejection's reason: the reason describes what
 was sensitive. For the same reason a gated peer's failure heartbeat names the
-stage that failed but not git's message, which can quote unreviewed file names;
-the details stay in `sidecar tail` on that machine.
+stage that failed but not git's message, which can quote unreviewed file names.
+Nor does the log, the daemon's included: run the command by hand on that machine
+to see the details.
 
 ```sh
 sidecar review                   # this repo's reviews, newest first
@@ -165,12 +168,17 @@ Reviews belong to the repo family, not to one checkout. Linked checkouts of a
 repo share one clone and one local `main` (see
 [One machine, many working copies](sync.md#one-machine-many-working-copies)),
 so they share one review of what that `main` holds. A rejection holds every
-sibling, and two siblings never race the same content to the remote. One
+sibling, and two siblings never race the same content to the remote. So every
+working copy sharing that clone must require review: a working copy with review
+off gets its own clone, and one whose config changes after linking refuses to
+sync through the shared clone rather than publish what its siblings hold. One
 review is open at a time. Edits made while it's open wait for the next one,
 which covers everything after what was approved.
 
 When the remote has no `main` yet, it starts as an empty commit, never as the
 checkout's history or anything staged in it, and the first review covers
+everything the checkout holds. When the remote's `main` was started over, local
+`main` is joined to the new one the same way, and the next review again covers
 everything the checkout holds.
 
 Nothing else rides along. Everything sidecar publishes — review commits, the
@@ -214,9 +222,11 @@ changes no file and is never pushed.
 - **The reviewer sees the redacted diff, not your working tree.** That keeps
   caught secrets away from it. It also means what redaction rewrote shows up
   as placeholders.
-- **Turning review off publishes local history.** The next sync pushes the
-  inbox branch as an ungated peer does, including snapshots that review kept
-  local. Turning it off is a decision about everything still on this machine.
+- **Turning review off publishes local history.** A clone a gated peer has used
+  remembers it, and sync refuses until you confirm with
+  `git -C <checkout> config --unset sidecar.review`. The next sync then pushes
+  as an ungated peer does, including snapshots that review kept local. Turning
+  it off is a decision about everything still on this machine.
 - **Anything published earlier stays in the remote's history.** Review gates
   what's published from now on.
 - **In [standalone mode](standalone.md), every writer controls the policy**,
diff --git a/packages/sidecar/CLAUDE.md b/packages/sidecar/CLAUDE.md
index e5cfa66..0c73ea9 100644
--- a/packages/sidecar/CLAUDE.md
+++ b/packages/sidecar/CLAUDE.md
@@ -67,11 +67,22 @@ automatically by `export *`.
   `syncBranchBeforePush`/`pushBranch` or push local main. Reviews are per repo
   family and cover local main, which a gated peer never resets (each publish
   is joined to it by a link merge — dropping links brings back spurious
-  forks). The reviewer command is machine-local (`settings.json`), never read
-  from committed config. Review reasons stay out of logs and heartbeats, and
-  so do a gated peer's git failure messages (they quote unreviewed paths).
-  Verdicts change only under the peer's sync lock; runners write only their
-  own attempt's file. Anything a publish commit carries beyond the reviewed
+  forks; a remote main that was started over is joined by a link commit too).
+  Every sharer of a store must be gated: `bindReviewPolicy` marks the store
+  before anything is snapshotted or merged and refuses an ungated peer, and
+  families never link across review modes. Every review has a public base,
+  and every parent of a publish commit must be public when it is pushed,
+  resumed publishes included; a prepared commit stays reachable under
+  `refs/sidecar-publishing/<id>`. The reviewer command is machine-local
+  (`settings.json`), never read from committed config. Review reasons stay
+  out of logs and heartbeats, and so do a gated peer's git failure messages
+  (they quote unreviewed paths): once a process has touched a gated (or
+  unreadable) config or a review packet (`privateFailures`), cli.ts logs its
+  failures without a message, the heartbeat carries the stage only, and the
+  daemon logs a gated peer's exit status, never its output. The terminal
+  still shows the details. Verdicts change only under the peer's sync lock. A review launches
+  its reviewer once; retry opens a new review, so a stale reviewer can only
+  decide a closed one. Anything a publish commit carries beyond the reviewed
   tree is sidecar-generated, never copied from local commit messages.
 - **Public git.** Every git operation that builds or sends what a gated peer
   publishes — and every health heartbeat, including reading the previous one —
diff --git a/packages/sidecar/dist/cli.js b/packages/sidecar/dist/cli.js
index 199ab8f..7b5c97e 100755
--- a/packages/sidecar/dist/cli.js
+++ b/packages/sidecar/dist/cli.js
@@ -331,157 +331,6 @@ var init_install = __esm(() => {
   INSTALL_SOURCES = new Set(["npm", "bun", "curl"]);
 });
 
-// src/git.ts
-import fs3 from "node:fs";
-import path3 from "node:path";
-import { spawnSync as spawnSync2 } from "node:child_process";
-function git(repo, args, options = {}) {
-  return gitRaw(["-C", repo, ...args], options);
-}
-function gitBytes(repo, args, options = {}) {
-  const check = options.check ?? true;
-  const result = spawnSync2("git", ["-C", repo, ...args], {
-    encoding: "buffer",
-    maxBuffer: 100 * 1024 * 1024
-  });
-  const status = result.status ?? 1;
-  const stdout = Buffer.isBuffer(result.stdout) ? result.stdout : Buffer.from(result.stdout ?? "");
-  const stderr = Buffer.isBuffer(result.stderr) ? result.stderr : Buffer.from(result.stderr ?? "");
-  if (check && status !== 0) {
-    throw new SidecarError(stderr.toString("utf8").trim() || stdout.toString("utf8").trim());
-  }
-  return { status, stdout, stderr };
-}
-function gitRaw(args, options = {}) {
-  const check = options.check ?? true;
-  const result = spawnSync2("git", args, {
-    encoding: "utf8",
-    input: options.input,
-    maxBuffer: 100 * 1024 * 1024
-  });
-  const status = result.status ?? 1;
-  const stdout = result.stdout ?? "";
-  const stderr = result.stderr ?? "";
-  if (check && status !== 0) {
-    throw new SidecarError(stderr.trim() || stdout.trim());
-  }
-  return { status, stdout, stderr };
-}
-function fetch(repo, quiet, check = true) {
-  const args = ["fetch", "--prune", "origin", "+refs/heads/*:refs/remotes/origin/*"];
-  if (quiet)
-    args.splice(1, 0, "--quiet");
-  git(repo, args, { check });
-}
-function hasAnyCommit(repo) {
-  return git(repo, ["rev-parse", "--verify", "HEAD"], { check: false }).status === 0;
-}
-function branchExists(repo, branch) {
-  return git(repo, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], { check: false }).status === 0;
-}
-function remoteRefExists(repo, branch) {
-  return git(repo, ["show-ref", "--verify", "--quiet", `refs/remotes/origin/${branch}`], {
-    check: false
-  }).status === 0;
-}
-function isAncestor(repo, maybeAncestor, descendant) {
-  return git(repo, ["merge-base", "--is-ancestor", maybeAncestor, descendant], { check: false }).status === 0;
-}
-function treeOf(repo, ref) {
-  return git(repo, ["rev-parse", `${ref}^{tree}`]).stdout.trim();
-}
-function emptyTree(repo) {
-  return git(repo, ["mktree"], { input: "" }).stdout.trim();
-}
-function gitToplevel(cwd) {
-  const root = gitToplevelOptional(cwd);
-  if (!root)
-    throw new SidecarError("not inside a Git repository");
-  return root;
-}
-function gitToplevelOptional(cwd) {
-  const result = gitRaw(["-C", cwd, "rev-parse", "--show-toplevel"], { check: false });
-  if (result.status !== 0)
-    return;
-  return result.stdout.trim();
-}
-function gitCommonDir(root) {
-  const commonDir = gitCommonDirOptional(root);
-  if (!commonDir)
-    throw new SidecarError("not inside a Git repository");
-  return commonDir;
-}
-function gitExcludePath(root) {
-  const commonDir = gitCommonDirOptional(root);
-  return commonDir ? path3.join(commonDir, "info", "exclude") : undefined;
-}
-function isGitIgnored(root, relativePath) {
-  return git(root, ["check-ignore", "-q", "--", relativePath], { check: false }).status === 0;
-}
-function isGitTracked(root, relativePath) {
-  return git(root, ["ls-files", "--error-unmatch", "--", relativePath], { check: false }).status === 0;
-}
-function gitCommonDirOptional(root) {
-  const result = gitRaw(["-C", root, "rev-parse", "--git-common-dir"], { check: false });
-  if (result.status !== 0)
-    return;
-  return path3.resolve(root, result.stdout.trim());
-}
-function gitDir(repo) {
-  const result = git(repo, ["rev-parse", "--git-dir"]).stdout.trim();
-  return path3.isAbsolute(result) ? result : path3.resolve(repo, result);
-}
-function hasGitMetadata(repo) {
-  return fs3.existsSync(path3.join(repo, ".git"));
-}
-function isDirty(repo) {
-  return Boolean(git(repo, ["status", "--porcelain"]).stdout.trim());
-}
-function ensureClean(repo) {
-  if (isDirty(repo))
-    throw new SidecarError("sidecar checkout has uncommitted changes");
-}
-function sidecarIdentity() {
-  return { name: currentUser(), email: `${slug(currentUser())}@${slug(currentHost())}.local` };
-}
-function ensureCommitIdentity(repo) {
-  const { name, email } = sidecarIdentity();
-  if (git(repo, ["config", "user.name"], { check: false }).status !== 0) {
-    git(repo, ["config", "user.name", name]);
-  }
-  if (git(repo, ["config", "user.email"], { check: false }).status !== 0) {
-    git(repo, ["config", "user.email", email]);
-  }
-}
-function familyPrimaryRoot(root) {
-  const primary = jjDefaultWorkspace(root) ?? gitMainWorktree(root);
-  if (!primary)
-    return;
-  return realpathOr(primary) === realpathOr(root) ? undefined : primary;
-}
-function jjDefaultWorkspace(root) {
-  const pointer = path3.join(root, ".jj", "repo");
-  try {
-    if (!fs3.statSync(pointer).isFile())
-      return;
-    const repo = path3.resolve(path3.dirname(pointer), fs3.readFileSync(pointer, "utf8").trim());
-    const workspace = path3.dirname(path3.dirname(repo));
-    return fs3.existsSync(path3.join(workspace, ".jj")) ? workspace : undefined;
-  } catch {
-    return;
-  }
-}
-function gitMainWorktree(root) {
-  const result = git(root, ["worktree", "list", "--porcelain"], { check: false });
-  if (result.status !== 0)
-    return;
-  const entry = result.stdout.split(/\r?\n/).find((line) => line.startsWith("worktree "));
-  return entry?.slice("worktree ".length).trim() || undefined;
-}
-var init_git = __esm(() => {
-  init_util();
-});
-
 // ../../node_modules/.bun/smol-toml@1.7.0/node_modules/smol-toml/dist/date.js
 var DATE_TIME_RE, TomlDate;
 var init_date = __esm(() => {
@@ -1445,6 +1294,157 @@ var init_dist = __esm(() => {
    */
 });
 
+// src/git.ts
+import fs3 from "node:fs";
+import path3 from "node:path";
+import { spawnSync as spawnSync2 } from "node:child_process";
+function git(repo, args, options = {}) {
+  return gitRaw(["-C", repo, ...args], options);
+}
+function gitBytes(repo, args, options = {}) {
+  const check = options.check ?? true;
+  const result = spawnSync2("git", ["-C", repo, ...args], {
+    encoding: "buffer",
+    maxBuffer: 100 * 1024 * 1024
+  });
+  const status = result.status ?? 1;
+  const stdout = Buffer.isBuffer(result.stdout) ? result.stdout : Buffer.from(result.stdout ?? "");
+  const stderr = Buffer.isBuffer(result.stderr) ? result.stderr : Buffer.from(result.stderr ?? "");
+  if (check && status !== 0) {
+    throw new SidecarError(stderr.toString("utf8").trim() || stdout.toString("utf8").trim());
+  }
+  return { status, stdout, stderr };
+}
+function gitRaw(args, options = {}) {
+  const check = options.check ?? true;
+  const result = spawnSync2("git", args, {
+    encoding: "utf8",
+    input: options.input,
+    maxBuffer: 100 * 1024 * 1024
+  });
+  const status = result.status ?? 1;
+  const stdout = result.stdout ?? "";
+  const stderr = result.stderr ?? "";
+  if (check && status !== 0) {
+    throw new SidecarError(stderr.trim() || stdout.trim());
+  }
+  return { status, stdout, stderr };
+}
+function fetch(repo, quiet, check = true) {
+  const args = ["fetch", "--prune", "origin", "+refs/heads/*:refs/remotes/origin/*"];
+  if (quiet)
+    args.splice(1, 0, "--quiet");
+  git(repo, args, { check });
+}
+function hasAnyCommit(repo) {
+  return git(repo, ["rev-parse", "--verify", "HEAD"], { check: false }).status === 0;
+}
+function branchExists(repo, branch) {
+  return git(repo, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], { check: false }).status === 0;
+}
+function remoteRefExists(repo, branch) {
+  return git(repo, ["show-ref", "--verify", "--quiet", `refs/remotes/origin/${branch}`], {
+    check: false
+  }).status === 0;
+}
+function isAncestor(repo, maybeAncestor, descendant) {
+  return git(repo, ["merge-base", "--is-ancestor", maybeAncestor, descendant], { check: false }).status === 0;
+}
+function treeOf(repo, ref) {
+  return git(repo, ["rev-parse", `${ref}^{tree}`]).stdout.trim();
+}
+function emptyTree(repo) {
+  return git(repo, ["mktree"], { input: "" }).stdout.trim();
+}
+function gitToplevel(cwd) {
+  const root = gitToplevelOptional(cwd);
+  if (!root)
+    throw new SidecarError("not inside a Git repository");
+  return root;
+}
+function gitToplevelOptional(cwd) {
+  const result = gitRaw(["-C", cwd, "rev-parse", "--show-toplevel"], { check: false });
+  if (result.status !== 0)
+    return;
+  return result.stdout.trim();
+}
+function gitCommonDir(root) {
+  const commonDir = gitCommonDirOptional(root);
+  if (!commonDir)
+    throw new SidecarError("not inside a Git repository");
+  return commonDir;
+}
+function gitExcludePath(root) {
+  const commonDir = gitCommonDirOptional(root);
+  return commonDir ? path3.join(commonDir, "info", "exclude") : undefined;
+}
+function isGitIgnored(root, relativePath) {
+  return git(root, ["check-ignore", "-q", "--", relativePath], { check: false }).status === 0;
+}
+function isGitTracked(root, relativePath) {
+  return git(root, ["ls-files", "--error-unmatch", "--", relativePath], { check: false }).status === 0;
+}
+function gitCommonDirOptional(root) {
+  const result = gitRaw(["-C", root, "rev-parse", "--git-common-dir"], { check: false });
+  if (result.status !== 0)
+    return;
+  return path3.resolve(root, result.stdout.trim());
+}
+function gitDir(repo) {
+  const result = git(repo, ["rev-parse", "--git-dir"]).stdout.trim();
+  return path3.isAbsolute(result) ? result : path3.resolve(repo, result);
+}
+function hasGitMetadata(repo) {
+  return fs3.existsSync(path3.join(repo, ".git"));
+}
+function isDirty(repo) {
+  return Boolean(git(repo, ["status", "--porcelain"]).stdout.trim());
+}
+function ensureClean(repo) {
+  if (isDirty(repo))
+    throw new SidecarError("sidecar checkout has uncommitted changes");
+}
+function sidecarIdentity() {
+  return { name: currentUser(), email: `${slug(currentUser())}@${slug(currentHost())}.local` };
+}
+function ensureCommitIdentity(repo) {
+  const { name, email } = sidecarIdentity();
+  if (git(repo, ["config", "user.name"], { check: false }).status !== 0) {
+    git(repo, ["config", "user.name", name]);
+  }
+  if (git(repo, ["config", "user.email"], { check: false }).status !== 0) {
+    git(repo, ["config", "user.email", email]);
+  }
+}
+function familyPrimaryRoot(root) {
+  const primary = jjDefaultWorkspace(root) ?? gitMainWorktree(root);
+  if (!primary)
+    return;
+  return realpathOr(primary) === realpathOr(root) ? undefined : primary;
+}
+function jjDefaultWorkspace(root) {
+  const pointer = path3.join(root, ".jj", "repo");
+  try {
+    if (!fs3.statSync(pointer).isFile())
+      return;
+    const repo = path3.resolve(path3.dirname(pointer), fs3.readFileSync(pointer, "utf8").trim());
+    const workspace = path3.dirname(path3.dirname(repo));
+    return fs3.existsSync(path3.join(workspace, ".jj")) ? workspace : undefined;
+  } catch {
+    return;
+  }
+}
+function gitMainWorktree(root) {
+  const result = git(root, ["worktree", "list", "--porcelain"], { check: false });
+  if (result.status !== 0)
+    return;
+  const entry = result.stdout.split(/\r?\n/).find((line) => line.startsWith("worktree "));
+  return entry?.slice("worktree ".length).trim() || undefined;
+}
+var init_git = __esm(() => {
+  init_util();
+});
+
 // src/redaction.ts
 function redactText(input, mode = DEFAULT_REDACTION_MODE) {
   if (mode === "none")
@@ -3562,6 +3562,16 @@ function sameRemoteKey(remote) {
 function reviewRequired(config) {
   return config.review === "required";
 }
+function privateFailures() {
+  return failuresArePrivate;
+}
+function keepFailuresPrivate() {
+  failuresArePrivate = true;
+}
+function notePeerPolicy(config) {
+  if (reviewRequired(config))
+    keepFailuresPrivate();
+}
 function reviewTimeoutSeconds(config) {
   return config.reviewTimeout ?? DEFAULT_REVIEW_TIMEOUT_SECONDS;
 }
@@ -3583,7 +3593,11 @@ function findConfigRootOptional(start) {
   }
 }
 function writeConfig(configPath, config) {
-  const text = [
+  notePeerPolicy(config);
+  fs5.writeFileSync(configPath, configText(config), "utf8");
+}
+function configText(config) {
+  return [
     `version = ${config.version}`,
     `remote = ${JSON.stringify(config.remote)}`,
     `path = ${JSON.stringify(config.path)}`,
@@ -3598,7 +3612,6 @@ function writeConfig(configPath, config) {
     ""
   ].join(`
 `);
-  fs5.writeFileSync(configPath, text, "utf8");
 }
 function readConfig(configPath, options = {}) {
   let values;
@@ -3609,10 +3622,14 @@ function readConfig(configPath, options = {}) {
     }
     values = parsed;
   } catch (error) {
+    if (error.code !== "ENOENT")
+      keepFailuresPrivate();
     if (error instanceof SidecarError)
       throw error;
     throw new SidecarError(`${configPath} is not valid TOML: ${error instanceof Error ? error.message : String(error)}`);
   }
+  if (values.review !== undefined && values.review !== "off")
+    keepFailuresPrivate();
   const unknown = Object.keys(values).filter((key) => !CONFIG_KEYS.has(key));
   if (unknown.length) {
     throw new SidecarError(`${configPath}: unknown key${unknown.length > 1 ? "s" : ""} ${unknown.map((key) => JSON.stringify(key)).join(", ")}; this sidecar may be older than the config — update it with \`sidecar update\``);
@@ -3795,7 +3812,7 @@ function inboxBranchPrefix(template) {
   const slashIndex = staticPrefix.lastIndexOf("/");
   return slashIndex === -1 ? staticPrefix : staticPrefix.slice(0, slashIndex + 1);
 }
-var DEFAULT_PATH = "sidecar", DEFAULT_BRANCH = "main", DEFAULT_INBOX = "sidecar-inbox/{user}/{random}", branchValidity, DEFAULT_PEER = "default", PEER_ENV = "SIDECAR_PEER", SOFT_SYNC_ENV = "SIDECAR_SYNC_SOFT", LOCAL_SYNC_ENV = "SIDECAR_SYNC_LOCAL", PEER_NAME, RESERVED_PEER_SUFFIXES, RESOLVE_MODES, DEFAULT_RESOLVE = "fork", REVIEW_MODES, DEFAULT_REVIEW_TIMEOUT_SECONDS, CONFIG_VERSION = 1, CONFIG_KEYS, PUBLIC_REFS = "refs/sidecar-public/";
+var DEFAULT_PATH = "sidecar", DEFAULT_BRANCH = "main", DEFAULT_INBOX = "sidecar-inbox/{user}/{random}", branchValidity, DEFAULT_PEER = "default", PEER_ENV = "SIDECAR_PEER", SOFT_SYNC_ENV = "SIDECAR_SYNC_SOFT", LOCAL_SYNC_ENV = "SIDECAR_SYNC_LOCAL", PEER_NAME, RESERVED_PEER_SUFFIXES, RESOLVE_MODES, DEFAULT_RESOLVE = "fork", REVIEW_MODES, DEFAULT_REVIEW_TIMEOUT_SECONDS, CONFIG_VERSION = 1, CONFIG_KEYS, failuresArePrivate = false, PUBLIC_REFS = "refs/sidecar-public/";
 var init_config = __esm(() => {
   init_dist();
   init_util();
@@ -4528,6 +4545,7 @@ function readJson(filePath) {
   }
 }
 function readReview(id) {
+  keepFailuresPrivate();
   if (!ID_PATTERN.test(id))
     return;
   const dir = reviewDir(id);
@@ -4535,20 +4553,11 @@ function readReview(id) {
   if (!record || record.id !== id)
     return;
   const verdict = readJson(path8.join(dir, "verdict.json"));
-  const attempt = currentAttempt(dir);
-  const run = attempt ? readJson(runPath(dir, attempt)) : undefined;
+  const run = readJson(runPath(dir));
   return { record, verdict, run, state: reviewState(record, verdict, run), dir };
 }
-function currentAttempt(dir) {
-  try {
-    const attempt = fs8.readFileSync(path8.join(dir, "attempt"), "utf8").trim();
-    return ID_PATTERN.test(attempt) ? attempt : undefined;
-  } catch {
-    return;
-  }
-}
-function runPath(dir, attempt) {
-  return path8.join(dir, `run-${attempt}.json`);
+function runPath(dir) {
+  return path8.join(dir, "run.json");
 }
 function reviewFamily(sidecarPath) {
   return realpathOr(gitCommonDir(sidecarPath));
@@ -4595,6 +4604,8 @@ function reviewState(record, verdict, run) {
     return "failed";
   if (run && !run.finishedAt && !pidAlive(run.pid))
     return "failed";
+  if (!run && record.launchedAt && (Date.now() - Date.parse(record.launchedAt)) / 1000 > LAUNCH_GRACE_SECONDS)
+    return "failed";
   return "pending";
 }
 function pidAlive(pid) {
@@ -4612,14 +4623,16 @@ function reviewAttention(review, now = Date.now()) {
     return "rejected";
   if (review.state === "failed") {
     const run = review.run;
-    if (run?.finishedAt) {
+    if (!run)
+      return "reviewer never started";
+    if (run.finishedAt) {
       return run.signal ? `reviewer stopped by ${run.signal} without a verdict` : `reviewer exited ${run.exitCode} without a verdict`;
     }
     return "reviewer stopped without a verdict";
   }
   if (review.state !== "pending")
     return;
-  if (!review.run && !readSettings().reviewer)
+  if (!review.record.launchedAt && !readSettings().reviewer)
     return "no reviewer is configured on this machine";
   const age = (now - Date.parse(review.record.createdAt)) / 1000;
   if (age > review.record.timeoutSeconds)
@@ -4656,20 +4669,19 @@ function createReview(options) {
   const dir = reviewDir(id);
   fs8.mkdirSync(reviewsDir(), { recursive: true, mode: 448 });
   fs8.mkdirSync(dir, { mode: 448 });
-  const from = base ?? emptyTree(sidecarPath);
-  const fields = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--name-status", "-z", from, head]).stdout.split("\x00").filter(Boolean);
+  const fields = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--name-status", "-z", base, head]).stdout.split("\x00").filter(Boolean);
   const files = [];
   for (let index = 0;index + 1 < fields.length; index += 2)
     files.push({ status: fields[index], path: fields[index + 1] });
-  writeOpaqueArtifacts(sidecarPath, dir, from, head, files);
-  const diff = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "-p", "--no-color", "--no-ext-diff", "--no-textconv", from, head]).stdout;
+  writeOpaqueArtifacts(sidecarPath, dir, base, head, files);
+  const diff = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "-p", "--no-color", "--no-ext-diff", "--no-textconv", base, head]).stdout;
   const record = {
     schema: REVIEW_SCHEMA,
     id,
     family: reviewFamily(sidecarPath),
     root,
     peer: config.peer,
-    ...base ? { base } : {},
+    base,
     head,
     tree: treeOf(sidecarPath, head),
     files,
@@ -4807,28 +4819,25 @@ function configuredReviewer() {
   return command;
 }
 function launchReviewer(review) {
-  const attempt = newId();
-  writePrivateFile(path8.join(review.dir, "attempt"), `${attempt}
-`);
-  review.run = undefined;
-  const child = spawn2(process.execPath, [sidecarCliPath(), "review", "run", review.record.id, attempt], {
+  updateRecord(review, { launchedAt: nowIso() });
+  const child = spawn2(process.execPath, [sidecarCliPath(), "review", "run", review.record.id], {
     cwd: review.dir,
     detached: true,
     stdio: "ignore",
     env: { ...process.env, [SKIP_LOCAL_EXEC_ENV]: "1" }
   });
   child.unref();
-  logSidecarEvent("review-launch", { id: review.record.id, attempt });
+  logSidecarEvent("review-launch", { id: review.record.id });
 }
-function runReviewer(idOrPrefix, attempt) {
+function runReviewer(idOrPrefix) {
   const review = findReview(idOrPrefix);
   const { id } = review.record;
   assertOpen(review);
-  if (currentAttempt(review.dir) !== attempt)
-    return 0;
+  if (review.run)
+    throw new SidecarError(`review ${id}'s reviewer already ran; \`sidecar review retry ${id}\` opens a new review of the same change`);
   const command = configuredReviewer();
-  const file = runPath(review.dir, attempt);
-  const run = { attempt, pid: process.pid, command, startedAt: nowIso() };
+  const file = runPath(review.dir);
+  const run = { pid: process.pid, command, startedAt: nowIso() };
   writePrivateJson(file, run);
   const log = fs8.openSync(path8.join(review.dir, "reviewer.log"), "a", 384);
   let result;
@@ -4843,7 +4852,7 @@ function runReviewer(idOrPrefix, attempt) {
   }
   const finished = { ...run, finishedAt: nowIso(), exitCode: result.status, signal: result.signal };
   writePrivateJson(file, finished);
-  logSidecarEvent("review-run", { id, attempt, exitCode: result.status, signal: result.signal });
+  logSidecarEvent("review-run", { id, exitCode: result.status, signal: result.signal });
   return 0;
 }
 function reviewerEnv(review) {
@@ -4873,17 +4882,7 @@ function decideReview(review, verdict, reason) {
   review.state = verdict;
   logSidecarEvent("review-decision", { id: review.record.id, verdict });
 }
-function resetReview(review) {
-  assertOpen(review);
-  if (review.record.publishing)
-    throw new SidecarError(`review ${review.record.id} is already being published`);
-  fs8.rmSync(path8.join(review.dir, "verdict.json"), { force: true });
-  fs8.rmSync(path8.join(review.dir, "attempt"), { force: true });
-  review.verdict = undefined;
-  review.run = undefined;
-  review.state = "pending";
-}
-var REVIEW_SCHEMA = 1, KEEP_CLOSED_REVIEWS = 10, ID_PATTERN, PACKET_DIFF_OPTIONS;
+var REVIEW_SCHEMA = 1, KEEP_CLOSED_REVIEWS = 10, ID_PATTERN, LAUNCH_GRACE_SECONDS = 60, PACKET_DIFF_OPTIONS;
 var init_review = __esm(() => {
   init_util();
   init_git();
@@ -4907,6 +4906,7 @@ function syncProject(root, config, options) {
   if (!options.remote && !hasAnyCommit(sidecarPath)) {
     throw new SidecarError(`local sync requires an initialized sidecar checkout at ${sidecarPath}; run \`sidecar sync\` first`);
   }
+  bindReviewPolicy(sidecarPath, config);
   const inbox = expandInbox(config, sidecarPath);
   ensureCommitIdentity(sidecarPath);
   ensureRedactionFilter(sidecarPath, config.redaction, config);
@@ -5037,7 +5037,7 @@ function publishReviewed(root, sidecarPath, config, inbox, siblings, stage) {
       publishApprovedReview(sidecarPath, config, inbox, open);
   });
   stage("merge");
-  mergePublishedInboxes(sidecarPath, config, { forkFiles: true });
+  withPublicGit(sidecarPath, () => mergeFetchedInboxes(sidecarPath, config, { forkFiles: true }));
   stage("merge-local");
   mergeInboxBranches(sidecarPath, config, { forkFiles: true, push: false, remote: false });
   stage("settle-remote");
@@ -5052,16 +5052,18 @@ function gateUnpublished(root, sidecarPath, config) {
   const head = git(sidecarPath, ["rev-parse", `refs/heads/${config.branch}`]).stdout.trim();
   const headTree = treeOf(sidecarPath, head);
   const publicMain = publicTip(sidecarPath, config.branch);
-  const base = publicMain ? git(sidecarPath, ["merge-base", head, publicMain], { check: false }).stdout.trim() || undefined : undefined;
+  const base = publicMain && git(sidecarPath, ["merge-base", head, publicMain], { check: false }).stdout.trim();
+  if (!base)
+    throw new SidecarError(`local ${config.branch} shares no history with the remote's; nothing is reviewed or published until it does`);
   const open = openReview(sidecarPath);
   const hasReviewer = Boolean(readSettings().reviewer);
-  if (base && treeOf(sidecarPath, base) === headTree) {
+  if (treeOf(sidecarPath, base) === headTree) {
     if (open && open.state !== "approved")
       markSuperseded(open);
     return;
   }
   if (open?.state === "pending" || open?.state === "approved") {
-    return { review: open, launch: open.state === "pending" && !open.run && hasReviewer };
+    return { review: open, launch: open.state === "pending" && !open.record.launchedAt && hasReviewer };
   }
   if (open) {
     if (open.record.tree === headTree)
@@ -5074,16 +5076,21 @@ function gateUnpublished(root, sidecarPath, config) {
 }
 function publishApprovedReview(sidecarPath, config, inbox, review) {
   const { record } = review;
-  if (!record.publishing && record.base && !isPublic(sidecarPath, record.base)) {
-    markSuperseded(review);
-    console.log(`review ${paint("brand", record.id)} was measured from a commit the remote does not have; reviewing again`);
-    return;
-  }
-  assertPublishDestination(sidecarPath);
   const target = record.publishing ?? { inbox, commit: cutPublishCommit(sidecarPath, config, inbox, record) };
-  if (!record.publishing)
-    markPublishing(review, target.inbox, target.commit);
-  if (!isAncestor(sidecarPath, target.commit, publicRef(target.inbox))) {
+  const protectRef = publishingRef(record.id);
+  if (!isPublic(sidecarPath, target.commit)) {
+    const parents = git(sidecarPath, ["rev-list", "--parents", "-n", "1", target.commit]).stdout.trim().split(" ").slice(1);
+    if (!parents.every((parent) => isPublic(sidecarPath, parent))) {
+      markSuperseded(review);
+      git(sidecarPath, ["update-ref", "-d", protectRef], { check: false });
+      console.log(`review ${paint("brand", record.id)} was measured from a commit the remote does not have; reviewing again`);
+      return;
+    }
+    assertPublishDestination(sidecarPath);
+    if (!record.publishing) {
+      git(sidecarPath, ["update-ref", protectRef, target.commit]);
+      markPublishing(review, target.inbox, target.commit);
+    }
     const push = git(sidecarPath, ["push", "--no-follow-tags", "origin", `${target.commit}:refs/heads/${target.inbox}`], { check: false });
     if (push.status !== 0) {
       throw new SidecarError(push.stderr.trim() || `could not publish review ${record.id} to ${target.inbox}`);
@@ -5093,13 +5100,27 @@ function publishApprovedReview(sidecarPath, config, inbox, review) {
   }
   linkPublished(sidecarPath, config, review, target.commit);
   markPublished(review, target.commit);
+  git(sidecarPath, ["update-ref", "-d", protectRef], { check: false });
+}
+function publishingRef(id) {
+  return `refs/sidecar-publishing/${id}`;
+}
+function retryReview(review) {
+  const { record } = review;
+  if (!isOpen(review))
+    throw new SidecarError(`review ${record.id} is already ${review.state}`);
+  if (record.publishing)
+    throw new SidecarError(`review ${record.id} is already being published`);
+  const config = loadPeer(record.root, record.peer).config;
+  const sidecarPath = requireSidecarCheckout(record.root, config);
+  markSuperseded(review);
+  const fresh = withPublicGit(sidecarPath, () => createReview({ root: record.root, config, sidecarPath, base: record.base, head: record.head }));
+  launchReviewer(fresh);
+  return fresh;
 }
 function cutPublishCommit(sidecarPath, config, inbox, record) {
   const previous = publicTip(sidecarPath, inbox);
-  const parents = [
-    ...record.base ? [record.base] : [],
-    ...previous && !(record.base && isAncestor(sidecarPath, previous, record.base)) ? [previous] : []
-  ];
+  const parents = [record.base, ...previous && !isAncestor(sidecarPath, previous, record.base) ? [previous] : []];
   const body = [
     "sidecar publish",
     "",
@@ -5138,52 +5159,55 @@ function linkPublished(sidecarPath, config, review, published) {
   }
   withScratchWorktree(sidecarPath, config, "HEAD", (worktree) => {
     git(worktree, ["switch", config.branch]);
-    git(worktree, ["merge", "--no-ff", "--allow-unrelated-histories", "-s", "ours", "-m", `sidecar: link published review ${review.record.id}`, published]);
+    git(worktree, ["merge", "--no-ff", "-s", "ours", "-m", `sidecar: link published review ${review.record.id}`, published]);
   });
 }
 function mergePublishedInboxes(sidecarPath, config, options) {
   return withPublicGit(sidecarPath, () => {
     fetchPublic(sidecarPath);
-    if (!publicTip(sidecarPath, config.branch))
-      return 0;
-    const publicMain = publicRef(config.branch);
-    if (publishedInboxBranches(sidecarPath, config).every((ref) => isAncestor(sidecarPath, ref, publicMain))) {
-      console.log("no published inbox branches to merge");
-      return 0;
-    }
-    assertPublishDestination(sidecarPath);
-    return withScratchWorktree(sidecarPath, config, publicMain, (worktree) => {
-      assertRedactionFilterIntact(worktree);
-      const maxAttempts = 3;
-      for (let attempt = 1;; attempt += 1) {
-        if (attempt > 1) {
-          fetchPublic(sidecarPath);
-          git(worktree, ["reset", "--hard", publicMain]);
-        }
-        const pending = publishedInboxBranches(worktree, config).filter((ref) => !isAncestor(worktree, ref, "HEAD"));
-        if (!pending.length) {
-          console.log("no published inbox branches to merge");
-          return 0;
-        }
-        const merged = [];
-        for (const ref of pending) {
-          console.log(`merging ${paint("brand", remoteBranchName(ref))}`);
-          if (mergeInboxBranch(worktree, config, ref, options))
-            merged.push(ref);
-        }
-        const push = git(worktree, ["push", "--no-follow-tags", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
-        if (push.status !== 0) {
-          if (attempt >= maxAttempts)
-            throw new SidecarError(push.stderr.trim() || `could not push ${config.branch}`);
-          console.log(`push of ${config.branch} was rejected; refetching and retrying`);
-          continue;
-        }
+    return mergeFetchedInboxes(sidecarPath, config, options);
+  });
+}
+function mergeFetchedInboxes(sidecarPath, config, options) {
+  if (!publicTip(sidecarPath, config.branch))
+    return 0;
+  const publicMain = publicRef(config.branch);
+  if (publishedInboxBranches(sidecarPath, config).every((ref) => isAncestor(sidecarPath, ref, publicMain))) {
+    console.log("no published inbox branches to merge");
+    return 0;
+  }
+  assertPublishDestination(sidecarPath);
+  return withScratchWorktree(sidecarPath, config, publicMain, (worktree) => {
+    assertRedactionFilterIntact(worktree);
+    const maxAttempts = 3;
+    for (let attempt = 1;; attempt += 1) {
+      if (attempt > 1) {
         fetchPublic(sidecarPath);
-        console.log(`pushed ${config.branch}`);
-        console.log(`merged ${merged.length} inbox branch(es)`);
-        return merged.length;
+        git(worktree, ["reset", "--hard", publicMain]);
       }
-    });
+      const pending = publishedInboxBranches(worktree, config).filter((ref) => !isAncestor(worktree, ref, "HEAD"));
+      if (!pending.length) {
+        console.log("no published inbox branches to merge");
+        return 0;
+      }
+      const merged = [];
+      for (const ref of pending) {
+        console.log(`merging ${paint("brand", remoteBranchName(ref))}`);
+        if (mergeInboxBranch(worktree, config, ref, options))
+          merged.push(ref);
+      }
+      const push = git(worktree, ["push", "--no-follow-tags", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
+      if (push.status !== 0) {
+        if (attempt >= maxAttempts)
+          throw new SidecarError(push.stderr.trim() || `could not push ${config.branch}`);
+        console.log(`push of ${config.branch} was rejected; refetching and retrying`);
+        continue;
+      }
+      fetchPublic(sidecarPath);
+      console.log(`pushed ${config.branch}`);
+      console.log(`merged ${merged.length} inbox branch(es)`);
+      return merged.length;
+    }
   });
 }
 function publishedInboxBranches(repo, config) {
@@ -5202,7 +5226,7 @@ function settleCheckouts(sidecarPath, config, inbox, siblings) {
     } catch (error) {
       logSidecarEvent("settle-skip", {
         sidecarPath: sibling,
-        message: error instanceof Error ? error.message : String(error)
+        ...reviewRequired(config) ? {} : { message: error instanceof Error ? error.message : String(error) }
       });
     }
   }
@@ -5242,13 +5266,19 @@ function reportSyncHealth(root, config, outcome) {
     logSidecarEvent("failure", {
       command: "health",
       root,
-      message: `could not publish health: ${error instanceof Error ? error.message : String(error)}`
+      message: reviewRequired(config) ? "could not publish health" : `could not publish health: ${error instanceof Error ? error.message : String(error)}`
     });
   }
 }
 function publishHealth(root, config, sidecarPath, outcome) {
   const branch = healthBranchFor(sidecarPath);
-  const previous = readHealthRecordAt(sidecarPath, `origin/${branch}`);
+  const gated = reviewRequired(config);
+  if (gated && outcome.status === "failed") {
+    try {
+      fetchPublic(sidecarPath);
+    } catch {}
+  }
+  const previous = readHealthRecordAt(sidecarPath, gated ? publicRef(branch) : `origin/${branch}`);
   const identity = {
     machine: currentMachine(),
     root,
@@ -5259,7 +5289,7 @@ function publishHealth(root, config, sidecarPath, outcome) {
   const record = nextHealthRecord(previous, identity, outcome, nowIso());
   if (!shouldPublishHealth(previous, record))
     return;
-  if (reviewRequired(config))
+  if (gated)
     assertPublishDestination(sidecarPath);
   publishHealthRecord(sidecarPath, branch, record);
   logSidecarEvent("health", {
@@ -5450,7 +5480,7 @@ function familySidecarCheckout(root, config) {
   } catch {
     return;
   }
-  if (primaryConfig.remote !== config.remote)
+  if (!sharesFamilyCheckout(primaryConfig, config))
     return;
   const primaryPath = resolveSidecarPath(primary, primaryConfig);
   if (path9.resolve(primaryPath) === path9.resolve(primary))
@@ -5482,12 +5512,25 @@ function checkoutIsUnlinkedFromFamily(root, config, sidecarPath) {
   if (!primary)
     return false;
   try {
-    const primaryConfig = readConfig(peerConfigPath(primary, config.peer));
-    return primaryConfig.remote === config.remote;
+    return sharesFamilyCheckout(readConfig(peerConfigPath(primary, config.peer)), config);
   } catch {
     return false;
   }
 }
+function sharesFamilyCheckout(primaryConfig, config) {
+  return primaryConfig.remote === config.remote && reviewRequired(primaryConfig) === reviewRequired(config);
+}
+function bindReviewPolicy(sidecarPath, config) {
+  const bound = git(sidecarPath, ["config", "--local", "--get", REVIEW_POLICY_KEY], { check: false }).stdout.trim();
+  if (reviewRequired(config)) {
+    if (bound !== "required")
+      git(sidecarPath, ["config", "--local", REVIEW_POLICY_KEY, "required"]);
+    return;
+  }
+  if (bound === "required") {
+    throw new SidecarError(`${sidecarPath} holds work from a peer that requires review, and this peer would publish it unreviewed; set review = "required" in this repo's ${peerFileName(config.peer)} too — or, to publish that work without review, \`git -C ${sidecarPath} config --unset ${REVIEW_POLICY_KEY}\``);
+  }
+}
 function cloneOrUpdate(root, config, bootstrapMain, options) {
   const sidecarPath = resolveSidecarPath(root, config);
   if (fs9.existsSync(sidecarPath) && !hasGitMetadata(sidecarPath)) {
@@ -5525,6 +5568,7 @@ function cloneOrUpdate(root, config, bootstrapMain, options) {
   }
   ensureCommitIdentity(sidecarPath);
   ensureRedactionFilter(sidecarPath, config.redaction, config);
+  bindReviewPolicy(sidecarPath, config);
   if (bootstrapMain)
     bootstrapMainBranch(sidecarPath, config);
   const inbox = expandInbox(config, sidecarPath);
@@ -5603,6 +5647,12 @@ function ensureMainBranch(repo, config) {
     return;
   }
   if (reviewRequired(config)) {
+    if (git(repo, ["merge-base", "HEAD", remoteBranch], { check: false }).status !== 0) {
+      const link = git(repo, ["commit-tree", treeOf(repo, "HEAD"), "-p", "HEAD", "-p", remoteBranch, "-m", `sidecar: link the remote's new ${config.branch}`]).stdout.trim();
+      git(repo, ["merge", "--ff-only", link]);
+      console.log(`${remoteBranch} was started over; local ${config.branch} is joined to it and reviewed from there`);
+      return;
+    }
     mergeInboxBranch(repo, config, remoteBranch, { forkFiles: true });
     return;
   }
@@ -6151,7 +6201,7 @@ function pendingInboxBranches(repo, config) {
   });
   return [...local, ...remote].sort();
 }
-var WRITTEN_TRAILER = "written:", WRITTEN_TRAILER_LIMIT = 500, REDACTION_FILTER_NAME = "sidecar-redact", REDACTION_FILTER_REVISION = "2", REDACTION_POLICY_FILE = "sidecar-redaction-policy";
+var REVIEW_POLICY_KEY = "sidecar.review", WRITTEN_TRAILER = "written:", WRITTEN_TRAILER_LIMIT = 500, REDACTION_FILTER_NAME = "sidecar-redact", REDACTION_FILTER_REVISION = "2", REDACTION_POLICY_FILE = "sidecar-redaction-policy";
 var init_sync = __esm(() => {
   init_color();
   init_util();
@@ -6409,12 +6459,14 @@ function cmdInit(args) {
 function configurePeer(root, name, remote, parsed) {
   const configPath = peerConfigPath(root, name);
   let reuse = !remote && fs11.existsSync(configPath);
+  let built;
   if (remote && fs11.existsSync(configPath)) {
     const existing = readConfig(configPath);
-    const unchanged = existing.remote === remote && existing.path === getValue(parsed, "--path", existing.path) && existing.branch === getValue(parsed, "--branch", existing.branch) && existing.inbox === getValue(parsed, "--inbox", existing.inbox) && existing.redaction === getValue(parsed, "--redaction", existing.redaction) && existing.resolve === getValue(parsed, "--resolve", existing.resolve) && existing.debounce === durationConfigValue(parsed.values.get("--debounce") ?? existing.debounce, "--debounce") && existing.interval === durationConfigValue(parsed.values.get("--interval") ?? existing.interval, "--interval") && existing.review === getValue(parsed, "--review", existing.review ?? "off") && existing.reviewTimeout === durationConfigValue(parsed.values.get("--review-timeout") ?? existing.reviewTimeout, "--review-timeout");
-    reuse = unchanged || !promptOverwriteConfig(configPath, existing.remote, remote);
+    built = buildInitConfig(root, name, remote, parsed, existing);
+    reuse = configText(built) === configText(existing) || !promptOverwriteConfig(configPath, existing.remote, remote);
   }
-  const config = reuse ? readConfig(configPath) : buildInitConfig(root, name, remote, parsed);
+  const config = reuse ? readConfig(configPath) : built ?? buildInitConfig(root, name, remote, parsed);
+  notePeerPolicy(config);
   if (!reuse) {
     config.rulesPath = peerRulesPath(root, name);
     config.rules = readRules(config.rulesPath);
@@ -6475,9 +6527,9 @@ function initRoot(remote, parsed) {
   console.log(`initialized ${paint("repo", cwd)} as a Git repository`);
   return cwd;
 }
-function buildInitConfig(root, name, remote, parsed) {
+function buildInitConfig(root, name, remote, parsed, existing) {
   const defaultPath = name === DEFAULT_PEER ? DEFAULT_PATH : name;
-  const rawPath = parsed.values.has("--path") ? getValue(parsed, "--path", defaultPath) : promptSidecarPath(root, name, defaultPath);
+  const rawPath = parsed.values.has("--path") ? getValue(parsed, "--path", defaultPath) : existing?.path ?? promptSidecarPath(root, name, defaultPath);
   const sidecarPath = pathIsRepoRoot(root, rawPath) ? "." : rawPath;
   const standalone = isStandalonePath(sidecarPath);
   if (standalone && name !== DEFAULT_PEER) {
@@ -6488,14 +6540,14 @@ function buildInitConfig(root, name, remote, parsed) {
     remote: remote ?? (standalone ? standaloneRemote(root) : promptRemote(root)),
     version: 1,
     path: sidecarPath,
-    branch: getValue(parsed, "--branch", DEFAULT_BRANCH),
-    inbox: getValue(parsed, "--inbox", DEFAULT_INBOX),
-    redaction: parsed.values.has("--redaction") ? redactionModeConfigValue(getValue(parsed, "--redaction", DEFAULT_REDACTION_MODE), "--redaction") : promptRedactionMode(),
-    resolve: parsed.values.has("--resolve") ? resolveModeConfigValue(getValue(parsed, "--resolve", DEFAULT_RESOLVE), "--resolve") : DEFAULT_RESOLVE,
-    debounce: durationConfigValue(parsed.values.get("--debounce"), "--debounce"),
-    interval: durationConfigValue(parsed.values.get("--interval"), "--interval"),
-    review: reviewModeConfigValue(getValue(parsed, "--review", "off"), "--review"),
-    reviewTimeout: durationConfigValue(parsed.values.get("--review-timeout"), "--review-timeout")
+    branch: getValue(parsed, "--branch", existing?.branch ?? DEFAULT_BRANCH),
+    inbox: getValue(parsed, "--inbox", existing?.inbox ?? DEFAULT_INBOX),
+    redaction: parsed.values.has("--redaction") ? redactionModeConfigValue(getValue(parsed, "--redaction", DEFAULT_REDACTION_MODE), "--redaction") : existing?.redaction ?? promptRedactionMode(),
+    resolve: parsed.values.has("--resolve") ? resolveModeConfigValue(getValue(parsed, "--resolve", DEFAULT_RESOLVE), "--resolve") : existing?.resolve ?? DEFAULT_RESOLVE,
+    debounce: durationConfigValue(parsed.values.get("--debounce"), "--debounce") ?? existing?.debounce,
+    interval: durationConfigValue(parsed.values.get("--interval"), "--interval") ?? existing?.interval,
+    review: reviewModeConfigValue(getValue(parsed, "--review", existing?.review ?? "off"), "--review"),
+    reviewTimeout: durationConfigValue(parsed.values.get("--review-timeout"), "--review-timeout") ?? existing?.reviewTimeout
   };
 }
 function printCheckoutVisibility(root, config) {
@@ -7119,15 +7171,17 @@ function refreshPeer({ root, config, name }, parsed) {
   let inbox;
   if (readable) {
     inbox = expandInbox(config, sidecarPath);
-    fetch(sidecarPath, true, false);
     if (reviewRequired(config)) {
       try {
         refreshPublicRefs(sidecarPath);
       } catch {}
+    } else {
+      fetch(sidecarPath, true, false);
     }
     const held = heldWork(sidecarPath, config, inbox);
     if (held.length && !force) {
-      throw new SidecarError(`this checkout still holds ${held.join(" and ")}; run \`sidecar sync\` to push them, then refresh — or \`sidecar refresh --force\` to discard them`);
+      const publish = reviewRequired(config) ? "approve its review (`sidecar review`) and sync to publish them" : "run `sidecar sync` to push them";
+      throw new SidecarError(`this checkout still holds ${held.join(" and ")}; ${publish}, then refresh — or \`sidecar refresh --force\` to discard them`);
     }
   }
   if (standalone) {
@@ -8182,6 +8236,13 @@ import fs14 from "node:fs";
 import path12 from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
+function outputIsPrivate(key) {
+  try {
+    return reviewRequired(readConfig(key, { loadRules: false }));
+  } catch {
+    return true;
+  }
+}
 function peerRoot(key) {
   return path12.dirname(key);
 }
@@ -8381,7 +8442,7 @@ async function syncInstance(state, key, trigger, options = {}) {
         command: "daemon",
         ...peerFields(key),
         trigger,
-        message: result.timedOut ? "sync timed out" : result.output.trim().slice(-500) || `sync exited ${result.status}`
+        message: result.timedOut ? "sync timed out" : !outputIsPrivate(key) && result.output.trim().slice(-500) || `sync exited ${result.status}`
       });
     }
   } finally {
@@ -8493,7 +8554,7 @@ async function refreshWatchers(state) {
           logSidecarEvent("failure", {
             command: "daemon",
             ...peerFields(key),
-            message: `watcher error: ${error instanceof Error ? error.message : String(error)}`
+            message: outputIsPrivate(key) ? "watcher error" : `watcher error: ${error instanceof Error ? error.message : String(error)}`
           });
         });
         state.watchers.set(key, watcher);
@@ -8501,7 +8562,7 @@ async function refreshWatchers(state) {
         logSidecarEvent("failure", {
           command: "daemon",
           ...peerFields(key),
-          message: `could not watch ${sidecarPath}: ${error instanceof Error ? error.message : String(error)}`
+          message: outputIsPrivate(key) ? `could not watch ${sidecarPath}` : `could not watch ${sidecarPath}: ${error instanceof Error ? error.message : String(error)}`
         });
       }
     }
@@ -9000,20 +9061,23 @@ function cmdSnapshot(args) {
   if (parsed.positional.length)
     throw new SidecarError("usage: sidecar snapshot [--push] [-m message] [--peer name]");
   const peers = loadPeers(selectedPeer(parsed));
+  const push = parsed.flags.has("--push");
+  const gated = push ? peers.filter((peer) => reviewRequired(peer.config)) : [];
+  if (gated.length) {
+    throw new SidecarError(`${peers.length === 1 ? "this peer requires" : `${gated.map((peer) => peer.name).join(", ")} require`} review before anything is published; snapshot without --push, and \`sidecar sync\` opens or advances the review`);
+  }
   for (const peer of peers) {
     announcePeer(peer, peers);
     const { root, config } = peer;
     const sidecarPath = requireSidecarCheckout(root, config);
     withSyncLock(root, peer.name, "throw", () => {
+      bindReviewPolicy(sidecarPath, config);
       const inbox = expandInbox(config, sidecarPath);
       ensureCommitIdentity(sidecarPath);
       ensureRedactionFilter(sidecarPath, config.redaction, config);
       ensureInboxBranch(sidecarPath, config, inbox);
       const committed = snapshot(sidecarPath, root, inbox, getValue(parsed, "--message", getValue(parsed, "-m", "")) || undefined, config.redaction, config);
-      if (committed && parsed.flags.has("--push")) {
-        if (reviewRequired(config)) {
-          throw new SidecarError("this peer requires review before anything is published; `sidecar sync` opens or advances the review");
-        }
+      if (committed && push) {
         syncBranchBeforePush(sidecarPath, inbox, config);
         pushBranch(sidecarPath, inbox);
       }
@@ -9076,15 +9140,12 @@ function syncPeer(peer, options) {
       registerCurrentInstance(root, config, remote ? { event: "sync", lastSyncAt: nowIso() } : { event: "sync-local" });
     });
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
     if (remote)
       reportSyncHealth(root, config, {
         status: "failed",
         stage,
-        message: reviewRequired(config) ? "details are kept on this machine; see `sidecar tail` there" : message
+        message: reviewRequired(config) ? "details are shown only by a sync run by hand on that machine" : error instanceof Error ? error.message : String(error)
       });
-    if (reviewRequired(config))
-      logSidecarEvent("failure", { command: "sync", root, stage, message });
     throw error;
   }
   if (synced) {
@@ -9119,6 +9180,7 @@ function cmdMerge(args) {
     const { root, config } = peer;
     const sidecarPath = requireSidecarCheckout(root, config);
     withSyncLock(root, peer.name, "throw", () => {
+      bindReviewPolicy(sidecarPath, config);
       ensureRedactionFilter(sidecarPath, config.redaction, config);
       const forkFiles = parsed.flags.has("--fork-files");
       const push = !parsed.flags.has("--no-push");
@@ -9370,37 +9432,36 @@ function retryCommand(args) {
     throw new SidecarError(USAGE);
   configuredReviewer();
   const selected = selectReview(parsed.positional[0], selectedPeer(parsed));
-  withLockedReview(selected, (review) => {
-    resetReview(review);
-    launchReviewer(review);
-  });
-  console.log(`relaunched the reviewer for review ${paint("brand", selected.record.id)}`);
+  const fresh = withLockedReview(selected, retryReview);
+  console.log(`retired review ${paint("brand", selected.record.id)}; review ${paint("brand", fresh.record.id)} covers the same change, and its reviewer is running`);
   return 0;
 }
 function withLockedReview(selected, fn) {
   const { id, root, peer } = selected.record;
+  let result;
   withSyncLock(root, peer, "wait", () => {
     const review = readReview(id);
     if (!review)
       throw new SidecarError(`review ${id} is gone`);
-    fn(review);
+    result = fn(review);
   });
+  return result;
 }
 function reviewerCommand(args) {
-  const parsed = parseOptions(args, { boolean: new Set(["--unset"]), value: new Set });
   const settings = readSettings();
-  if (parsed.flags.has("--unset")) {
-    if (parsed.positional.length)
-      throw new SidecarError("usage: sidecar review reviewer [<command>|--unset]");
+  if (!args.length) {
+    console.log(settings.reviewer ?? paint("quiet", "no reviewer configured"));
+    return 0;
+  }
+  if (args.length === 1 && args[0] === "--unset") {
     writeSettings({ ...settings, reviewer: undefined });
     console.log("reviewer unset; reviews now wait for `sidecar review approve`");
     return 0;
   }
-  if (!parsed.positional.length) {
-    console.log(settings.reviewer ?? paint("quiet", "no reviewer configured"));
-    return 0;
+  if (args.length !== 1) {
+    throw new SidecarError('usage: sidecar review reviewer ["<command>"|--unset]; quote the command as one argument');
   }
-  const command = parsed.positional.join(" ").trim();
+  const command = args[0].trim();
   if (!command)
     throw new SidecarError("the reviewer command is empty");
   writeSettings({ ...settings, reviewer: command });
@@ -9408,9 +9469,9 @@ function reviewerCommand(args) {
   return 0;
 }
 function runCommand(args) {
-  if (args.length !== 2)
-    throw new SidecarError("usage: sidecar review run <id> <attempt>");
-  return runReviewer(args[0], args[1]);
+  if (args.length !== 1)
+    throw new SidecarError("usage: sidecar review run <id>");
+  return runReviewer(args[0]);
 }
 function selectReview(id, peer) {
   if (id)
@@ -9430,6 +9491,7 @@ var init_cmd_review = __esm(() => {
   init_config();
   init_state();
   init_review();
+  init_sync();
   init_cmd_sync();
   init_ui();
   LABEL_WIDTH = "reviewer:".length;
@@ -9616,7 +9678,7 @@ async function main(argv = process.argv.slice(2)) {
     if (command !== "redact" && command !== "deinit" && shouldUseGlobalRegistry()) {
       logSidecarEvent("failure", {
         command,
-        message: error instanceof Error ? error.message : String(error)
+        ...privateFailures() ? {} : { message: error instanceof Error ? error.message : String(error) }
       });
     }
     if (error instanceof SidecarError) {
@@ -9634,6 +9696,7 @@ var init_cli = __esm(() => {
   init_color();
   init_util();
   init_install();
+  init_config();
   init_state();
   init_commands();
   init_util();
diff --git a/packages/sidecar/src/cli.ts b/packages/sidecar/src/cli.ts
index 4a57e96..b9087c1 100644
--- a/packages/sidecar/src/cli.ts
+++ b/packages/sidecar/src/cli.ts
@@ -6,6 +6,7 @@
 import { colorLevel, paint } from "./color.js";
 import { SidecarError } from "./util.js";
 import { shouldUseGlobalRegistry } from "./install.js";
+import { privateFailures } from "./config.js";
 import { logSidecarEvent } from "./state.js";
 import { run } from "./commands.js";
 
@@ -40,7 +41,8 @@ export async function main(argv = process.argv.slice(2)): Promise<number> {
     if (command !== "redact" && command !== "deinit" && shouldUseGlobalRegistry()) {
       logSidecarEvent("failure", {
         command,
-        message: error instanceof Error ? error.message : String(error),
+        // The terminal still gets the message below.
+        ...(privateFailures() ? {} : { message: error instanceof Error ? error.message : String(error) }),
       });
     }
     if (error instanceof SidecarError) {
diff --git a/packages/sidecar/src/cmd-init.ts b/packages/sidecar/src/cmd-init.ts
index 2d85a86..84815bc 100644
--- a/packages/sidecar/src/cmd-init.ts
+++ b/packages/sidecar/src/cmd-init.ts
@@ -48,7 +48,9 @@ import {
   peerFileName,
   readConfig,
   resolveSidecarPath,
+  configText,
   durationConfigValue,
+  notePeerPolicy,
   redactionModeConfigValue,
   resolveModeConfigValue,
   reviewModeConfigValue,
@@ -288,25 +290,17 @@ export function cmdInit(args: string[]): number {
 function configurePeer(root: string, name: string, remote: string | undefined, parsed: ParsedOptions): Peer {
   const configPath = peerConfigPath(root, name);
   let reuse = !remote && fs.existsSync(configPath);
+  let built: SidecarConfig | undefined;
   if (remote && fs.existsSync(configPath)) {
     const existing = readConfig(configPath);
-    // Omitted flags fall back to the EXISTING values, not the defaults — a
-    // plain re-init must not read as a request to reset settings (a non-TTY
-    // re-init would fail, and a prompted "y" would silently flip redaction).
-    const unchanged =
-      existing.remote === remote &&
-      existing.path === getValue(parsed, "--path", existing.path) &&
-      existing.branch === getValue(parsed, "--branch", existing.branch) &&
-      existing.inbox === getValue(parsed, "--inbox", existing.inbox) &&
-      existing.redaction === getValue(parsed, "--redaction", existing.redaction) &&
-      existing.resolve === getValue(parsed, "--resolve", existing.resolve) &&
-      existing.debounce === durationConfigValue(parsed.values.get("--debounce") ?? existing.debounce, "--debounce") &&
-      existing.interval === durationConfigValue(parsed.values.get("--interval") ?? existing.interval, "--interval") &&
-      existing.review === getValue(parsed, "--review", existing.review ?? "off") &&
-      existing.reviewTimeout === durationConfigValue(parsed.values.get("--review-timeout") ?? existing.reviewTimeout, "--review-timeout");
-    reuse = unchanged || !promptOverwriteConfig(configPath, existing.remote, remote);
-  }
-  const config = reuse ? readConfig(configPath) : buildInitConfig(root, name, remote, parsed);
+    // Omitted flags keep the EXISTING values, not the defaults: a re-init
+    // changes only what it names. Anything else would silently flip
+    // redaction, or drop a review gate, on a prompted "y".
+    built = buildInitConfig(root, name, remote, parsed, existing);
+    reuse = configText(built) === configText(existing) || !promptOverwriteConfig(configPath, existing.remote, remote);
+  }
+  const config = reuse ? readConfig(configPath) : built ?? buildInitConfig(root, name, remote, parsed);
+  notePeerPolicy(config);
   if (!reuse) {
     config.rulesPath = peerRulesPath(root, name);
     config.rules = readRules(config.rulesPath);
@@ -394,13 +388,19 @@ function initRoot(remote: string | undefined, parsed: ParsedOptions): string {
 // Question order matters: the checkout path decides whether this is a
 // standalone sidecar, and that in turn changes the default answer to both of
 // the questions after it.
-function buildInitConfig(root: string, name: string, remote: string | undefined, parsed: ParsedOptions): SidecarConfig {
+function buildInitConfig(
+  root: string,
+  name: string,
+  remote: string | undefined,
+  parsed: ParsedOptions,
+  existing?: SidecarConfig,
+): SidecarConfig {
   // A named peer's checkout is named after it by default: `--peer research`
   // lives in `research/`, beside the default peer's `sidecar/`.
   const defaultPath = name === DEFAULT_PEER ? DEFAULT_PATH : name;
   const rawPath = parsed.values.has("--path")
     ? getValue(parsed, "--path", defaultPath)
-    : promptSidecarPath(root, name, defaultPath);
+    : existing?.path ?? promptSidecarPath(root, name, defaultPath);
   // `--path $PWD` and `--path foo/..` mean the same thing as `--path .`;
   // store them as "." so standalone detection — a string check on the config
   // — can't be dodged by spelling the root differently and land the repo in
@@ -418,18 +418,18 @@ function buildInitConfig(root: string, name: string, remote: string | undefined,
     remote: remote ?? (standalone ? standaloneRemote(root) : promptRemote(root)),
     version: 1,
     path: sidecarPath,
-    branch: getValue(parsed, "--branch", DEFAULT_BRANCH),
-    inbox: getValue(parsed, "--inbox", DEFAULT_INBOX),
+    branch: getValue(parsed, "--branch", existing?.branch ?? DEFAULT_BRANCH),
+    inbox: getValue(parsed, "--inbox", existing?.inbox ?? DEFAULT_INBOX),
     redaction: parsed.values.has("--redaction")
       ? redactionModeConfigValue(getValue(parsed, "--redaction", DEFAULT_REDACTION_MODE), "--redaction")
-      : promptRedactionMode(),
+      : existing?.redaction ?? promptRedactionMode(),
     resolve: parsed.values.has("--resolve")
       ? resolveModeConfigValue(getValue(parsed, "--resolve", DEFAULT_RESOLVE), "--resolve")
-      : DEFAULT_RESOLVE,
-    debounce: durationConfigValue(parsed.values.get("--debounce"), "--debounce"),
-    interval: durationConfigValue(parsed.values.get("--interval"), "--interval"),
-    review: reviewModeConfigValue(getValue(parsed, "--review", "off"), "--review"),
-    reviewTimeout: durationConfigValue(parsed.values.get("--review-timeout"), "--review-timeout"),
+      : existing?.resolve ?? DEFAULT_RESOLVE,
+    debounce: durationConfigValue(parsed.values.get("--debounce"), "--debounce") ?? existing?.debounce,
+    interval: durationConfigValue(parsed.values.get("--interval"), "--interval") ?? existing?.interval,
+    review: reviewModeConfigValue(getValue(parsed, "--review", existing?.review ?? "off"), "--review"),
+    reviewTimeout: durationConfigValue(parsed.values.get("--review-timeout"), "--review-timeout") ?? existing?.reviewTimeout,
   };
 }
 
diff --git a/packages/sidecar/src/cmd-refresh.ts b/packages/sidecar/src/cmd-refresh.ts
index 9c4b362..faef544 100644
--- a/packages/sidecar/src/cmd-refresh.ts
+++ b/packages/sidecar/src/cmd-refresh.ts
@@ -381,20 +381,25 @@ function refreshPeer({ root, config, name }: Peer, parsed: ParsedOptions): void
   let inbox: string | undefined;
   if (readable) {
     inbox = expandInbox(config, sidecarPath);
-    // origin/<inbox> is what decides how much is unpushed, so it has to be as
-    // current as the network allows before anything is counted against it. A
-    // stale one over-counts, which errs toward refusing.
-    fetch(sidecarPath, true, false);
-    // A gated checkout is measured against the public refs, which only
-    // sidecar's own fetch writes; offline, they stay as last fetched, which
-    // errs toward refusing.
+    // What is held is measured against the remote, so it has to be as current
+    // as the network allows; offline, it stays as last fetched, which errs
+    // toward refusing. A gated checkout is measured against the public refs,
+    // which only sidecar's own fetch writes; an ungated one against
+    // origin/<inbox>, which decides how much is unpushed.
     if (reviewRequired(config)) {
       try { refreshPublicRefs(sidecarPath); } catch { /* offline: last fetched */ }
+    } else {
+      fetch(sidecarPath, true, false);
     }
     const held = heldWork(sidecarPath, config, inbox);
     if (held.length && !force) {
+      // A gated checkout's work leaves only through an approved review, which
+      // syncing alone does not give.
+      const publish = reviewRequired(config)
+        ? "approve its review (`sidecar review`) and sync to publish them"
+        : "run `sidecar sync` to push them";
       throw new SidecarError(
-        `this checkout still holds ${held.join(" and ")}; run \`sidecar sync\` to push them, then refresh — or \`sidecar refresh --force\` to discard them`,
+        `this checkout still holds ${held.join(" and ")}; ${publish}, then refresh — or \`sidecar refresh --force\` to discard them`,
       );
     }
   }
diff --git a/packages/sidecar/src/cmd-review.ts b/packages/sidecar/src/cmd-review.ts
index 927b9a4..e46aa93 100644
--- a/packages/sidecar/src/cmd-review.ts
+++ b/packages/sidecar/src/cmd-review.ts
@@ -16,14 +16,13 @@ import {
   decideReview,
   findReview,
   isOpen,
-  launchReviewer,
   listReviews,
   openReview,
   readReview,
-  resetReview,
   reviewAttention,
   runReviewer,
 } from "./review.js";
+import { retryReview } from "./sync.js";
 import { syncPeer } from "./cmd-sync.js";
 import { announcePeer, formatRelativeTime, labelLine } from "./ui.js";
 
@@ -172,11 +171,10 @@ function retryCommand(args: string[]): number {
   if (parsed.positional.length > 1) throw new SidecarError(USAGE);
   configuredReviewer();
   const selected = selectReview(parsed.positional[0], selectedPeer(parsed));
-  withLockedReview(selected, (review) => {
-    resetReview(review);
-    launchReviewer(review);
-  });
-  console.log(`relaunched the reviewer for review ${paint("brand", selected.record.id)}`);
+  // A new review rather than the old one reopened: whatever the old review's
+  // reviewer still does, it can only decide a review that is closed.
+  const fresh = withLockedReview(selected, retryReview);
+  console.log(`retired review ${paint("brand", selected.record.id)}; review ${paint("brand", fresh.record.id)} covers the same change, and its reviewer is running`);
   return 0;
 }
 
@@ -186,31 +184,34 @@ function retryCommand(args: string[]): number {
  * one runs. A reviewer often decides while the sync that launched it still
  * holds that lock, so this waits for it.
  */
-function withLockedReview(selected: Review, fn: (review: Review) => void): void {
+function withLockedReview<T>(selected: Review, fn: (review: Review) => T): T {
   const { id, root, peer } = selected.record;
+  let result: T | undefined;
   withSyncLock(root, peer, "wait", () => {
     const review = readReview(id);
     if (!review) throw new SidecarError(`review ${id} is gone`);
-    fn(review);
+    result = fn(review);
   });
+  return result as T;
 }
 
 function reviewerCommand(args: string[]): number {
-  const parsed = parseOptions(args, { boolean: new Set(["--unset"]), value: new Set() });
   const settings = readSettings();
-  if (parsed.flags.has("--unset")) {
-    if (parsed.positional.length) throw new SidecarError("usage: sidecar review reviewer [<command>|--unset]");
+  if (!args.length) {
+    console.log(settings.reviewer ?? paint("quiet", "no reviewer configured"));
+    return 0;
+  }
+  if (args.length === 1 && args[0] === "--unset") {
     writeSettings({ ...settings, reviewer: undefined });
     console.log("reviewer unset; reviews now wait for `sidecar review approve`");
     return 0;
   }
-  if (!parsed.positional.length) {
-    console.log(settings.reviewer ?? paint("quiet", "no reviewer configured"));
-    return 0;
+  // The one argument is the whole shell command, quoted as the shell will
+  // run it. Rejoining several would lose their quoting.
+  if (args.length !== 1) {
+    throw new SidecarError("usage: sidecar review reviewer [\"<command>\"|--unset]; quote the command as one argument");
   }
-  // One argument is the whole shell command; several are joined, so
-  // `sidecar review reviewer claude-sidecar --fast` also works unquoted.
-  const command = parsed.positional.join(" ").trim();
+  const command = args[0].trim();
   if (!command) throw new SidecarError("the reviewer command is empty");
   writeSettings({ ...settings, reviewer: command });
   console.log(`reviewer set to ${paint("brand", command)}`);
@@ -218,8 +219,8 @@ function reviewerCommand(args: string[]): number {
 }
 
 function runCommand(args: string[]): number {
-  if (args.length !== 2) throw new SidecarError("usage: sidecar review run <id> <attempt>");
-  return runReviewer(args[0], args[1]);
+  if (args.length !== 1) throw new SidecarError("usage: sidecar review run <id>");
+  return runReviewer(args[0]);
 }
 
 /**
diff --git a/packages/sidecar/src/cmd-sync.ts b/packages/sidecar/src/cmd-sync.ts
index 0f9ec21..6c05387 100644
--- a/packages/sidecar/src/cmd-sync.ts
+++ b/packages/sidecar/src/cmd-sync.ts
@@ -20,8 +20,9 @@ import {
   reviewRequired,
   selectedPeer,
 } from "./config.js";
-import { logSidecarEvent, registerCurrentInstance, withSyncLock } from "./state.js";
+import { registerCurrentInstance, withSyncLock } from "./state.js";
 import {
+  bindReviewPolicy,
   checkoutIsUnlinkedFromFamily,
   checkoutRedactionPolicy,
   ensureInboxBranch,
@@ -49,6 +50,15 @@ export function cmdSnapshot(args: string[]): number {
   if (parsed.positional.length) throw new SidecarError("usage: sidecar snapshot [--push] [-m message] [--peer name]");
 
   const peers = loadPeers(selectedPeer(parsed));
+  const push = parsed.flags.has("--push");
+  // A gated peer's snapshots are local history; only a review publishes.
+  // Refused before any peer is touched, so the command does all or nothing.
+  const gated = push ? peers.filter((peer) => reviewRequired(peer.config)) : [];
+  if (gated.length) {
+    throw new SidecarError(
+      `${peers.length === 1 ? "this peer requires" : `${gated.map((peer) => peer.name).join(", ")} require`} review before anything is published; snapshot without --push, and \`sidecar sync\` opens or advances the review`,
+    );
+  }
   for (const peer of peers) {
     announcePeer(peer, peers);
     const { root, config } = peer;
@@ -56,6 +66,7 @@ export function cmdSnapshot(args: string[]): number {
     // Snapshotting while a daemon sync is mid-merge would commit on whatever
     // branch the merge has checked out, so take the same lock syncs use.
     withSyncLock(root, peer.name, "throw", () => {
+      bindReviewPolicy(sidecarPath, config);
       const inbox = expandInbox(config, sidecarPath);
       ensureCommitIdentity(sidecarPath);
       ensureRedactionFilter(sidecarPath, config.redaction, config);
@@ -68,11 +79,7 @@ export function cmdSnapshot(args: string[]): number {
         config.redaction,
         config,
       );
-      if (committed && parsed.flags.has("--push")) {
-        // A gated peer's snapshots are local history; only a review publishes.
-        if (reviewRequired(config)) {
-          throw new SidecarError("this peer requires review before anything is published; `sidecar sync` opens or advances the review");
-        }
+      if (committed && push) {
         syncBranchBeforePush(sidecarPath, inbox, config);
         pushBranch(sidecarPath, inbox);
       }
@@ -156,16 +163,16 @@ export function syncPeer(peer: Peer, options: PeerSyncOptions): void {
         : { event: "sync-local" });
     });
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
     if (remote) reportSyncHealth(root, config, {
       status: "failed",
       stage,
-      // Git's diagnostics quote paths, and on a gated peer a path is content
-      // nobody has reviewed yet. The heartbeat says where it failed; the
-      // details stay in this machine's log.
-      message: reviewRequired(config) ? "details are kept on this machine; see `sidecar tail` there" : message,
+      // Git's diagnostics quote paths, and on a gated peer a path can be
+      // content nobody has reviewed yet. The heartbeat says where it failed;
+      // the details reach only this terminal (see privateFailures).
+      message: reviewRequired(config)
+        ? "details are shown only by a sync run by hand on that machine"
+        : error instanceof Error ? error.message : String(error),
     });
-    if (reviewRequired(config)) logSidecarEvent("failure", { command: "sync", root, stage, message });
     throw error;
   }
   // A soft sync that lost the lock never attempted anything, so it has nothing
@@ -209,6 +216,7 @@ export function cmdMerge(args: string[]): number {
     withSyncLock(root, peer.name, "throw", () => {
       // Filter wiring mutates the shared Git config too, so keep it under
       // the same lock as the merge and its temporary worktree cleanup.
+      bindReviewPolicy(sidecarPath, config);
       ensureRedactionFilter(sidecarPath, config.redaction, config);
       const forkFiles = parsed.flags.has("--fork-files");
       const push = !parsed.flags.has("--no-push");
diff --git a/packages/sidecar/src/config.ts b/packages/sidecar/src/config.ts
index e089ab9..837da91 100644
--- a/packages/sidecar/src/config.ts
+++ b/packages/sidecar/src/config.ts
@@ -225,6 +225,31 @@ export function reviewRequired(config: SidecarConfig): boolean {
   return config.review === "required";
 }
 
+let failuresArePrivate = false;
+
+/**
+ * Whether this process has touched a peer that requires review — or one whose
+ * policy it could not tell. Its failures then stay out of the event log (see
+ * cli.ts): git's messages quote paths, a gated peer's paths can be content
+ * nobody has reviewed, and the log is something people paste into bug
+ * reports. Every command reaches a peer through readConfig, a config it is
+ * about to write (notePeerPolicy), or a review packet (readReview), and each
+ * marks the process before anything else can fail.
+ */
+export function privateFailures(): boolean {
+  return failuresArePrivate;
+}
+
+/** Marks this process's failures private: it holds, or may hold, unreviewed content. */
+export function keepFailuresPrivate(): void {
+  failuresArePrivate = true;
+}
+
+/** Marks this process's failures private when `config` requires review. */
+export function notePeerPolicy(config: SidecarConfig): void {
+  if (reviewRequired(config)) keepFailuresPrivate();
+}
+
 export function reviewTimeoutSeconds(config: SidecarConfig): number {
   return config.reviewTimeout ?? DEFAULT_REVIEW_TIMEOUT_SECONDS;
 }
@@ -247,7 +272,13 @@ export function findConfigRootOptional(start: string): string | undefined {
 }
 
 export function writeConfig(configPath: string, config: SidecarConfig): void {
-  const text = [
+  notePeerPolicy(config);
+  fs.writeFileSync(configPath, configText(config), "utf8");
+}
+
+/** A config as its file holds it: what two configs must share to be the same. */
+export function configText(config: SidecarConfig): string {
+  return [
     `version = ${config.version}`,
     `remote = ${JSON.stringify(config.remote)}`,
     `path = ${JSON.stringify(config.path)}`,
@@ -261,7 +292,6 @@ export function writeConfig(configPath: string, config: SidecarConfig): void {
     ...(config.reviewTimeout === undefined ? [] : [`review-timeout = ${config.reviewTimeout}`]),
     "",
   ].join("\n");
-  fs.writeFileSync(configPath, text, "utf8");
 }
 
 export function readConfig(configPath: string, options: { loadRules?: boolean } = {}): SidecarConfig {
@@ -273,9 +303,14 @@ export function readConfig(configPath: string, options: { loadRules?: boolean }
     }
     values = parsed as Record<string, unknown>;
   } catch (error) {
+    // A config that exists but cannot be read may be a gated peer's.
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") keepFailuresPrivate();
     if (error instanceof SidecarError) throw error;
     throw new SidecarError(`${configPath} is not valid TOML: ${error instanceof Error ? error.message : String(error)}`);
   }
+  // Before anything else is validated or loaded: anything but a plain "off"
+  // may be a gated peer, so its failures are private from here on.
+  if (values.review !== undefined && values.review !== "off") keepFailuresPrivate();
 
   const unknown = Object.keys(values).filter((key) => !CONFIG_KEYS.has(key));
   if (unknown.length) {
diff --git a/packages/sidecar/src/daemon.ts b/packages/sidecar/src/daemon.ts
index b293023..7635f13 100644
--- a/packages/sidecar/src/daemon.ts
+++ b/packages/sidecar/src/daemon.ts
@@ -27,6 +27,7 @@ import {
   readConfig,
   readInstances,
   readSettings,
+  reviewRequired,
   sidecarStateDir,
   startDetachedDaemon,
   unregisterInstance,
@@ -56,6 +57,19 @@ export type DaemonOptions = {
   debounceSeconds: number;
 };
 
+/**
+ * Whether a peer's sync output and watcher errors must stay out of the
+ * daemon's log: a gated peer's can name files nobody has reviewed. A config that cannot be read
+ * counts as gated, so the answer fails closed.
+ */
+function outputIsPrivate(key: PeerKey): boolean {
+  try {
+    return reviewRequired(readConfig(key, { loadRules: false }));
+  } catch {
+    return true;
+  }
+}
+
 /**
  * Everything the daemon tracks is keyed by the peer's config path, not the
  * repo root: a repo with several peers is several sidecars, each with its own
@@ -346,7 +360,9 @@ async function syncInstance(
         command: "daemon",
         ...peerFields(key),
         trigger,
-        message: result.timedOut ? "sync timed out" : result.output.trim().slice(-500) || `sync exited ${result.status}`,
+        message: result.timedOut
+          ? "sync timed out"
+          : (!outputIsPrivate(key) && result.output.trim().slice(-500)) || `sync exited ${result.status}`,
       });
     }
   } finally {
@@ -466,7 +482,8 @@ export async function refreshWatchers(state: DaemonState): Promise<void> {
           logSidecarEvent("failure", {
             command: "daemon",
             ...peerFields(key),
-            message: `watcher error: ${error instanceof Error ? error.message : String(error)}`,
+            // A filesystem error names the file, and on a gated peer that can be unreviewed content.
+            message: outputIsPrivate(key) ? "watcher error" : `watcher error: ${error instanceof Error ? error.message : String(error)}`,
           });
         });
         state.watchers.set(key, watcher);
@@ -474,7 +491,9 @@ export async function refreshWatchers(state: DaemonState): Promise<void> {
         logSidecarEvent("failure", {
           command: "daemon",
           ...peerFields(key),
-          message: `could not watch ${sidecarPath}: ${error instanceof Error ? error.message : String(error)}`,
+          message: outputIsPrivate(key)
+            ? `could not watch ${sidecarPath}`
+            : `could not watch ${sidecarPath}: ${error instanceof Error ? error.message : String(error)}`,
         });
       }
     }
diff --git a/packages/sidecar/src/review.ts b/packages/sidecar/src/review.ts
index dbdf684..d336d5d 100644
--- a/packages/sidecar/src/review.ts
+++ b/packages/sidecar/src/review.ts
@@ -13,19 +13,19 @@
 //
 // A review's files each have one writer. The sync and the decision commands
 // write under the peer's sync lock, so a verdict can never change while a sync
-// is acting on it; a runner writes only the file for its own attempt, so a
-// superseded runner can never overwrite the current one:
-//   review.json           the sync: opened, publishing, published, superseded
-//   verdict.json          `sidecar review approve|reject`
-//   attempt               whoever launches a runner: the current attempt's id
-//   run-<attempt>.json    that attempt's runner, around the reviewer command
+// is acting on it. A review launches its reviewer at most once; a retry opens
+// a new review, so a reviewer that outlives its review can only ever decide
+// one that is closed:
+//   review.json   the sync: opened, launched, publishing, published, superseded
+//   verdict.json  `sidecar review approve|reject`
+//   run.json      the runner, around the reviewer command
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 
 import { SidecarError, nowIso, realpathOr } from "./util.js";
-import { emptyTree, git, gitBytes, gitCommonDir, treeOf } from "./git.js";
+import { git, gitBytes, gitCommonDir, treeOf } from "./git.js";
 import { GLOBAL_EXEC_ENV, SKIP_LOCAL_EXEC_ENV, sidecarCliPath } from "./install.js";
 import {
   DEFAULT_PEER,
@@ -33,6 +33,7 @@ import {
   PEER_ENV,
   SOFT_SYNC_ENV,
   type SidecarConfig,
+  keepFailuresPrivate,
   peerConfigPath,
   reviewTimeoutSeconds,
 } from "./config.js";
@@ -42,8 +43,10 @@ import { redactText } from "./redaction.js";
 const REVIEW_SCHEMA = 1;
 /** Closed reviews kept per family, newest first; older packets are deleted. */
 const KEEP_CLOSED_REVIEWS = 10;
-/** Review and attempt ids: generated hex, so never a path outside the reviews dir. */
+/** Review ids: generated hex, so never a path outside the reviews dir. */
 const ID_PATTERN = /^[0-9a-f]+$/;
+/** How long a launched runner has to record itself before the review counts as failed. */
+const LAUNCH_GRACE_SECONDS = 60;
 
 function newId(): string {
   return crypto.randomBytes(4).toString("hex");
@@ -69,10 +72,10 @@ export type ReviewRecord = {
   peer: string;
   /**
    * The public commit the diff is measured from — the newest remote main
-   * commit the reviewed head contains. Absent when the head shares no history
-   * with the remote, in which case the diff is against the empty tree.
+   * commit the reviewed head contains. Always present: a gated peer's local
+   * main is joined to the remote's main before anything is reviewed.
    */
-  base?: string;
+  base: string;
   /** Local main when the review opened. */
   head: string;
   /** The tree an approval publishes: the head's, pinned at review time. */
@@ -80,6 +83,8 @@ export type ReviewRecord = {
   files: ReviewFile[];
   createdAt: string;
   timeoutSeconds: number;
+  /** When the sync started this review's one runner. */
+  launchedAt?: string;
   /**
    * The commit this review publishes and where, recorded before the push so a
    * sync that dies mid-publish — or a sibling resuming after it — pushes that
@@ -94,7 +99,6 @@ export type ReviewRecord = {
 export type ReviewVerdict = { verdict: "approved" | "rejected"; reason?: string; decidedAt: string };
 
 type ReviewRun = {
-  attempt: string;
   pid: number;
   command: string;
   startedAt: string;
@@ -148,27 +152,19 @@ function readJson<T>(filePath: string): T | undefined {
 }
 
 export function readReview(id: string): Review | undefined {
+  // A packet holds unreviewed content, so any failure near one is private.
+  keepFailuresPrivate();
   if (!ID_PATTERN.test(id)) return undefined;
   const dir = reviewDir(id);
   const record = readJson<ReviewRecord>(path.join(dir, "review.json"));
   if (!record || record.id !== id) return undefined;
   const verdict = readJson<ReviewVerdict>(path.join(dir, "verdict.json"));
-  const attempt = currentAttempt(dir);
-  const run = attempt ? readJson<ReviewRun>(runPath(dir, attempt)) : undefined;
+  const run = readJson<ReviewRun>(runPath(dir));
   return { record, verdict, run, state: reviewState(record, verdict, run), dir };
 }
 
-function currentAttempt(dir: string): string | undefined {
-  try {
-    const attempt = fs.readFileSync(path.join(dir, "attempt"), "utf8").trim();
-    return ID_PATTERN.test(attempt) ? attempt : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function runPath(dir: string, attempt: string): string {
-  return path.join(dir, `run-${attempt}.json`);
+function runPath(dir: string): string {
+  return path.join(dir, "run.json");
 }
 
 /** The key a checkout's reviews are filed under: its family's shared git dir. */
@@ -221,8 +217,10 @@ function reviewState(record: ReviewRecord, verdict?: ReviewVerdict, run?: Review
   if (verdict) return verdict.verdict;
   if (run?.finishedAt && run.exitCode !== 0) return "failed";
   // A runner that died without finishing never recorded an exit; it is as
-  // failed as one that exited nonzero.
+  // failed as one that exited nonzero. So is one that never started: the
+  // review launches only once, so nothing else will.
   if (run && !run.finishedAt && !pidAlive(run.pid)) return "failed";
+  if (!run && record.launchedAt && (Date.now() - Date.parse(record.launchedAt)) / 1000 > LAUNCH_GRACE_SECONDS) return "failed";
   return "pending";
 }
 
@@ -246,13 +244,14 @@ export function reviewAttention(review: Review, now = Date.now()): string | unde
   if (review.state === "rejected") return "rejected";
   if (review.state === "failed") {
     const run = review.run;
-    if (run?.finishedAt) {
+    if (!run) return "reviewer never started";
+    if (run.finishedAt) {
       return run.signal ? `reviewer stopped by ${run.signal} without a verdict` : `reviewer exited ${run.exitCode} without a verdict`;
     }
     return "reviewer stopped without a verdict";
   }
   if (review.state !== "pending") return undefined;
-  if (!review.run && !readSettings().reviewer) return "no reviewer is configured on this machine";
+  if (!review.record.launchedAt && !readSettings().reviewer) return "no reviewer is configured on this machine";
   const age = (now - Date.parse(review.record.createdAt)) / 1000;
   if (age > review.record.timeoutSeconds) return `undecided for over ${formatDuration(review.record.timeoutSeconds)}`;
   return undefined;
@@ -302,7 +301,7 @@ const PACKET_DIFF_OPTIONS = ["-r", "--no-renames", "--ignore-submodules=none"];
  * blobs, so already redacted), the changed paths, the repo's guidelines, and
  * instructions that say how to decide.
  */
-export function createReview(options: { root: string; config: SidecarConfig; sidecarPath: string; base?: string; head: string }): Review {
+export function createReview(options: { root: string; config: SidecarConfig; sidecarPath: string; base: string; head: string }): Review {
   const { root, config, sidecarPath, base, head } = options;
   const guidelines = readGuidelines(root, config.peer);
   const id = newId();
@@ -310,12 +309,11 @@ export function createReview(options: { root: string; config: SidecarConfig; sid
   fs.mkdirSync(reviewsDir(), { recursive: true, mode: 0o700 });
   fs.mkdirSync(dir, { mode: 0o700 });
 
-  const from = base ?? emptyTree(sidecarPath);
-  const fields = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--name-status", "-z", from, head]).stdout.split("\0").filter(Boolean);
+  const fields = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "--name-status", "-z", base, head]).stdout.split("\0").filter(Boolean);
   const files: ReviewFile[] = [];
   for (let index = 0; index + 1 < fields.length; index += 2) files.push({ status: fields[index], path: fields[index + 1] });
-  writeOpaqueArtifacts(sidecarPath, dir, from, head, files);
-  const diff = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "-p", "--no-color", "--no-ext-diff", "--no-textconv", from, head]).stdout;
+  writeOpaqueArtifacts(sidecarPath, dir, base, head, files);
+  const diff = git(sidecarPath, ["diff-tree", ...PACKET_DIFF_OPTIONS, "-p", "--no-color", "--no-ext-diff", "--no-textconv", base, head]).stdout;
 
   const record: ReviewRecord = {
     schema: REVIEW_SCHEMA,
@@ -323,7 +321,7 @@ export function createReview(options: { root: string; config: SidecarConfig; sid
     family: reviewFamily(sidecarPath),
     root,
     peer: config.peer,
-    ...(base ? { base } : {}),
+    base,
     head,
     tree: treeOf(sidecarPath, head),
     files,
@@ -495,15 +493,12 @@ export function configuredReviewer(): string {
 /**
  * Starts the runner for a review in the background and returns at once. A
  * review takes minutes; the sync that opened it holds the sync lock and must
- * not wait for one.
+ * not wait for one. Call under that lock: the launch is recorded first, so no
+ * later sync launches a second runner for the same review.
  */
 export function launchReviewer(review: Review): void {
-  // A fresh attempt id retires whatever runner came before: it can still
-  // finish, but its record is no longer the one this review reads.
-  const attempt = newId();
-  writePrivateFile(path.join(review.dir, "attempt"), `${attempt}\n`);
-  review.run = undefined;
-  const child = spawn(process.execPath, [sidecarCliPath(), "review", "run", review.record.id, attempt], {
+  updateRecord(review, { launchedAt: nowIso() });
+  const child = spawn(process.execPath, [sidecarCliPath(), "review", "run", review.record.id], {
     cwd: review.dir,
     detached: true,
     stdio: "ignore",
@@ -511,7 +506,7 @@ export function launchReviewer(review: Review): void {
     env: { ...process.env, [SKIP_LOCAL_EXEC_ENV]: "1" },
   });
   child.unref();
-  logSidecarEvent("review-launch", { id: review.record.id, attempt });
+  logSidecarEvent("review-launch", { id: review.record.id });
 }
 
 /**
@@ -521,16 +516,15 @@ export function launchReviewer(review: Review): void {
  * A zero exit without a verdict is a review still in progress somewhere else;
  * a nonzero one is a reviewer that broke.
  */
-export function runReviewer(idOrPrefix: string, attempt: string): number {
+export function runReviewer(idOrPrefix: string): number {
   const review = findReview(idOrPrefix);
   const { id } = review.record;
   assertOpen(review);
-  // Launched, then superseded by a retry before it got going.
-  if (currentAttempt(review.dir) !== attempt) return 0;
+  if (review.run) throw new SidecarError(`review ${id}'s reviewer already ran; \`sidecar review retry ${id}\` opens a new review of the same change`);
   const command = configuredReviewer();
 
-  const file = runPath(review.dir, attempt);
-  const run: ReviewRun = { attempt, pid: process.pid, command, startedAt: nowIso() };
+  const file = runPath(review.dir);
+  const run: ReviewRun = { pid: process.pid, command, startedAt: nowIso() };
   writePrivateJson(file, run);
   const log = fs.openSync(path.join(review.dir, "reviewer.log"), "a", 0o600);
   let result;
@@ -545,7 +539,7 @@ export function runReviewer(idOrPrefix: string, attempt: string): number {
   }
   const finished: ReviewRun = { ...run, finishedAt: nowIso(), exitCode: result.status, signal: result.signal };
   writePrivateJson(file, finished);
-  logSidecarEvent("review-run", { id, attempt, exitCode: result.status, signal: result.signal });
+  logSidecarEvent("review-run", { id, exitCode: result.status, signal: result.signal });
   return 0;
 }
 
@@ -587,13 +581,3 @@ export function decideReview(review: Review, verdict: ReviewVerdict["verdict"],
   logSidecarEvent("review-decision", { id: review.record.id, verdict });
 }
 
-/** Clears a review's verdict and run so its reviewer can take it again. */
-export function resetReview(review: Review): void {
-  assertOpen(review);
-  if (review.record.publishing) throw new SidecarError(`review ${review.record.id} is already being published`);
-  fs.rmSync(path.join(review.dir, "verdict.json"), { force: true });
-  fs.rmSync(path.join(review.dir, "attempt"), { force: true });
-  review.verdict = undefined;
-  review.run = undefined;
-  review.state = "pending";
-}
diff --git a/packages/sidecar/src/sync.ts b/packages/sidecar/src/sync.ts
index cc7d06a..25ab4f2 100644
--- a/packages/sidecar/src/sync.ts
+++ b/packages/sidecar/src/sync.ts
@@ -38,8 +38,10 @@ import {
   expandInbox,
   inboxPrefix,
   isStandalone,
+  loadPeer,
   matchesInboxPrefix,
   peerConfigPath,
+  peerFileName,
   readConfig,
   redactionModeConfigValue,
   remoteBranchName,
@@ -52,6 +54,7 @@ import {
   type Review,
   type ReviewRecord,
   createReview,
+  isOpen,
   launchReviewer,
   markPublished,
   markPublishing,
@@ -117,6 +120,7 @@ export function syncProject(
   if (!options.remote && !hasAnyCommit(sidecarPath)) {
     throw new SidecarError(`local sync requires an initialized sidecar checkout at ${sidecarPath}; run \`sidecar sync\` first`);
   }
+  bindReviewPolicy(sidecarPath, config);
   const inbox = expandInbox(config, sidecarPath);
   ensureCommitIdentity(sidecarPath);
   ensureRedactionFilter(sidecarPath, config.redaction, config);
@@ -295,7 +299,6 @@ function publicRef(branch: string): string {
   return `${PUBLIC_REFS}${branch}`;
 }
 
-/** The remote's tip of `branch` as last fetched, if it has one. */
 /**
  * Brings the public refs current for a caller outside the publish path —
  * refresh, deciding what deleting a checkout would lose.
@@ -304,6 +307,7 @@ export function refreshPublicRefs(repo: string): void {
   withPublicGit(repo, () => fetchPublic(repo));
 }
 
+/** The remote's tip of `branch` as last fetched, if it has one. */
 function publicTip(repo: string, branch: string): string | undefined {
   return git(repo, ["rev-parse", "--verify", "--quiet", publicRef(branch)], { check: false }).stdout.trim() || undefined;
 }
@@ -332,7 +336,7 @@ function publishReviewed(
     if (open?.state === "approved") publishApprovedReview(sidecarPath, config, inbox, open);
   });
   stage("merge");
-  mergePublishedInboxes(sidecarPath, config, { forkFiles: true });
+  withPublicGit(sidecarPath, () => mergeFetchedInboxes(sidecarPath, config, { forkFiles: true }));
   // Takes the remote's new main into local main, and this checkout's latest
   // snapshot with it, so the review below sees the whole family.
   stage("merge-local");
@@ -358,19 +362,23 @@ function gateUnpublished(root: string, sidecarPath: string, config: SidecarConfi
   const head = git(sidecarPath, ["rev-parse", `refs/heads/${config.branch}`]).stdout.trim();
   const headTree = treeOf(sidecarPath, head);
   const publicMain = publicTip(sidecarPath, config.branch);
-  const base = publicMain ? git(sidecarPath, ["merge-base", head, publicMain], { check: false }).stdout.trim() || undefined : undefined;
+  // ensureMainBranch joins local main to the remote's, so this always finds
+  // one. Failing that, nothing here has a public base to publish onto.
+  const base = publicMain && git(sidecarPath, ["merge-base", head, publicMain], { check: false }).stdout.trim();
+  if (!base) throw new SidecarError(`local ${config.branch} shares no history with the remote's; nothing is reviewed or published until it does`);
   const open = openReview(sidecarPath);
   const hasReviewer = Boolean(readSettings().reviewer);
 
-  if (base && treeOf(sidecarPath, base) === headTree) {
+  if (treeOf(sidecarPath, base) === headTree) {
     // Whatever an undecided review was waiting to publish is gone or already
     // public. An approval still publishes: it was given, and its tree is safe.
     if (open && open.state !== "approved") markSuperseded(open);
     return undefined;
   }
   if (open?.state === "pending" || open?.state === "approved") {
-    // A reviewer configured after the review opened takes it from here.
-    return { review: open, launch: open.state === "pending" && !open.run && hasReviewer };
+    // Each review launches its reviewer once. One configured after the review
+    // opened takes it from here.
+    return { review: open, launch: open.state === "pending" && !open.record.launchedAt && hasReviewer };
   }
   if (open) {
     // Rejected or failed: it holds until the content changes, and the change
@@ -389,20 +397,29 @@ function gateUnpublished(root: string, sidecarPath: string, config: SidecarConfi
  */
 function publishApprovedReview(sidecarPath: string, config: SidecarConfig, inbox: string, review: Review): void {
   const { record } = review;
-  // The base becomes the publish commit's parent, so it must already be on
-  // the remote: anything else would push its history along with it.
-  if (!record.publishing && record.base && !isPublic(sidecarPath, record.base)) {
-    markSuperseded(review);
-    console.log(`review ${paint("brand", record.id)} was measured from a commit the remote does not have; reviewing again`);
-    return;
-  }
-  assertPublishDestination(sidecarPath);
   // A sync that recorded its commit and then died — in this checkout or a
   // sibling — left the one commit this review may publish. Push that again,
   // to the inbox it was cut for, rather than cutting a second one.
   const target = record.publishing ?? { inbox, commit: cutPublishCommit(sidecarPath, config, inbox, record) };
-  if (!record.publishing) markPublishing(review, target.inbox, target.commit);
-  if (!isAncestor(sidecarPath, target.commit, publicRef(target.inbox))) {
+  const protectRef = publishingRef(record.id);
+  if (!isPublic(sidecarPath, target.commit)) {
+    // The commit's parents must already be on the remote: anything else would
+    // push their history along with it. A remote rewritten since the commit
+    // was cut can drop one, so this holds for a resumed publish too.
+    const parents = git(sidecarPath, ["rev-list", "--parents", "-n", "1", target.commit]).stdout.trim().split(" ").slice(1);
+    if (!parents.every((parent) => isPublic(sidecarPath, parent))) {
+      markSuperseded(review);
+      git(sidecarPath, ["update-ref", "-d", protectRef], { check: false });
+      console.log(`review ${paint("brand", record.id)} was measured from a commit the remote does not have; reviewing again`);
+      return;
+    }
+    assertPublishDestination(sidecarPath);
+    if (!record.publishing) {
+      // Reachable from a ref before it is recorded, so gc cannot prune the
+      // one commit a resumed publish would push.
+      git(sidecarPath, ["update-ref", protectRef, target.commit]);
+      markPublishing(review, target.inbox, target.commit);
+    }
     // Never forced: the family is the inbox's only writer, so a rejection
     // means something is wrong, and overwriting would hide it.
     const push = git(sidecarPath, ["push", "--no-follow-tags", "origin", `${target.commit}:refs/heads/${target.inbox}`], { check: false });
@@ -414,6 +431,33 @@ function publishApprovedReview(sidecarPath: string, config: SidecarConfig, inbox
   }
   linkPublished(sidecarPath, config, review, target.commit);
   markPublished(review, target.commit);
+  git(sidecarPath, ["update-ref", "-d", protectRef], { check: false });
+}
+
+/** Keeps a review's prepared publish commit reachable until it is published or retired. Never pushed or fetched. */
+function publishingRef(id: string): string {
+  return `refs/sidecar-publishing/${id}`;
+}
+
+/**
+ * Retires a review and opens a new one of the same change, with its own
+ * reviewer launch. The retired review is closed, so its reviewer — still
+ * running, perhaps — can no longer decide anything. Call under the peer's
+ * sync lock.
+ */
+export function retryReview(review: Review): Review {
+  const { record } = review;
+  if (!isOpen(review)) throw new SidecarError(`review ${record.id} is already ${review.state}`);
+  if (record.publishing) throw new SidecarError(`review ${record.id} is already being published`);
+  const config = loadPeer(record.root, record.peer).config;
+  const sidecarPath = requireSidecarCheckout(record.root, config);
+  // Retired first: a retry that dies partway leaves no review open, and the
+  // next sync opens one of whatever local main holds — never two.
+  markSuperseded(review);
+  const fresh = withPublicGit(sidecarPath, () =>
+    createReview({ root: record.root, config, sidecarPath, base: record.base, head: record.head }));
+  launchReviewer(fresh);
+  return fresh;
 }
 
 /**
@@ -425,10 +469,7 @@ function publishApprovedReview(sidecarPath: string, config: SidecarConfig, inbox
  */
 function cutPublishCommit(sidecarPath: string, config: SidecarConfig, inbox: string, record: ReviewRecord): string {
   const previous = publicTip(sidecarPath, inbox);
-  const parents = [
-    ...(record.base ? [record.base] : []),
-    ...(previous && !(record.base && isAncestor(sidecarPath, previous, record.base)) ? [previous] : []),
-  ];
+  const parents = [record.base, ...(previous && !isAncestor(sidecarPath, previous, record.base) ? [previous] : [])];
   const body = [
     "sidecar publish",
     "",
@@ -491,9 +532,7 @@ function linkPublished(sidecarPath: string, config: SidecarConfig, review: Revie
   }
   withScratchWorktree(sidecarPath, config, "HEAD", (worktree) => {
     git(worktree, ["switch", config.branch]);
-    // Unrelated when the review measured from nothing: the published commit
-    // is then a root of its own, and local main still holds its state.
-    git(worktree, ["merge", "--no-ff", "--allow-unrelated-histories", "-s", "ours", "-m", `sidecar: link published review ${review.record.id}`, published]);
+    git(worktree, ["merge", "--no-ff", "-s", "ours", "-m", `sidecar: link published review ${review.record.id}`, published]);
   });
 }
 
@@ -506,46 +545,51 @@ function linkPublished(sidecarPath: string, config: SidecarConfig, review: Revie
 export function mergePublishedInboxes(sidecarPath: string, config: SidecarConfig, options: { forkFiles: boolean }): number {
   return withPublicGit(sidecarPath, () => {
     fetchPublic(sidecarPath);
-    if (!publicTip(sidecarPath, config.branch)) return 0;
-    const publicMain = publicRef(config.branch);
-    if (publishedInboxBranches(sidecarPath, config).every((ref) => isAncestor(sidecarPath, ref, publicMain))) {
-      console.log("no published inbox branches to merge");
-      return 0;
-    }
-    assertPublishDestination(sidecarPath);
-    return withScratchWorktree(sidecarPath, config, publicMain, (worktree) => {
-      // Config can differ by worktree (includeIf gitdir), so check here too.
-      assertRedactionFilterIntact(worktree);
-      const maxAttempts = 3;
-      for (let attempt = 1; ; attempt += 1) {
-        if (attempt > 1) {
-          fetchPublic(sidecarPath);
-          git(worktree, ["reset", "--hard", publicMain]);
-        }
-        const pending = publishedInboxBranches(worktree, config).filter((ref) => !isAncestor(worktree, ref, "HEAD"));
-        if (!pending.length) {
-          console.log("no published inbox branches to merge");
-          return 0;
-        }
-        const merged: string[] = [];
-        for (const ref of pending) {
-          console.log(`merging ${paint("brand", remoteBranchName(ref))}`);
-          if (mergeInboxBranch(worktree, config, ref, options)) merged.push(ref);
-        }
-        const push = git(worktree, ["push", "--no-follow-tags", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
-        if (push.status !== 0) {
-          if (attempt >= maxAttempts) throw new SidecarError(push.stderr.trim() || `could not push ${config.branch}`);
-          console.log(`push of ${config.branch} was rejected; refetching and retrying`);
-          continue;
-        }
-        // A push does not move the public refs, and the gate measures from
-        // them: without this, it would see what was just merged as unpublished.
+    return mergeFetchedInboxes(sidecarPath, config, options);
+  });
+}
+
+/** mergePublishedInboxes over the public refs as already fetched. Call inside withPublicGit. */
+function mergeFetchedInboxes(sidecarPath: string, config: SidecarConfig, options: { forkFiles: boolean }): number {
+  if (!publicTip(sidecarPath, config.branch)) return 0;
+  const publicMain = publicRef(config.branch);
+  if (publishedInboxBranches(sidecarPath, config).every((ref) => isAncestor(sidecarPath, ref, publicMain))) {
+    console.log("no published inbox branches to merge");
+    return 0;
+  }
+  assertPublishDestination(sidecarPath);
+  return withScratchWorktree(sidecarPath, config, publicMain, (worktree) => {
+    // Config can differ by worktree (includeIf gitdir), so check here too.
+    assertRedactionFilterIntact(worktree);
+    const maxAttempts = 3;
+    for (let attempt = 1; ; attempt += 1) {
+      if (attempt > 1) {
         fetchPublic(sidecarPath);
-        console.log(`pushed ${config.branch}`);
-        console.log(`merged ${merged.length} inbox branch(es)`);
-        return merged.length;
+        git(worktree, ["reset", "--hard", publicMain]);
       }
-    });
+      const pending = publishedInboxBranches(worktree, config).filter((ref) => !isAncestor(worktree, ref, "HEAD"));
+      if (!pending.length) {
+        console.log("no published inbox branches to merge");
+        return 0;
+      }
+      const merged: string[] = [];
+      for (const ref of pending) {
+        console.log(`merging ${paint("brand", remoteBranchName(ref))}`);
+        if (mergeInboxBranch(worktree, config, ref, options)) merged.push(ref);
+      }
+      const push = git(worktree, ["push", "--no-follow-tags", "origin", `HEAD:refs/heads/${config.branch}`], { check: false });
+      if (push.status !== 0) {
+        if (attempt >= maxAttempts) throw new SidecarError(push.stderr.trim() || `could not push ${config.branch}`);
+        console.log(`push of ${config.branch} was rejected; refetching and retrying`);
+        continue;
+      }
+      // A push does not move the public refs, and the gate measures from
+      // them: without this, it would see what was just merged as unpublished.
+      fetchPublic(sidecarPath);
+      console.log(`pushed ${config.branch}`);
+      console.log(`merged ${merged.length} inbox branch(es)`);
+      return merged.length;
+    }
   });
 }
 
@@ -590,7 +634,8 @@ export function settleCheckouts(
     } catch (error) {
       logSidecarEvent("settle-skip", {
         sidecarPath: sibling,
-        message: error instanceof Error ? error.message : String(error),
+        // Git's message can quote a path nobody has reviewed yet.
+        ...(reviewRequired(config) ? {} : { message: error instanceof Error ? error.message : String(error) }),
       });
     }
   }
@@ -675,14 +720,24 @@ export function reportSyncHealth(root: string, config: SidecarConfig, outcome: H
     logSidecarEvent("failure", {
       command: "health",
       root,
-      message: `could not publish health: ${error instanceof Error ? error.message : String(error)}`,
+      message: reviewRequired(config)
+        ? "could not publish health"
+        : `could not publish health: ${error instanceof Error ? error.message : String(error)}`,
     });
   }
 }
 
 function publishHealth(root: string, config: SidecarConfig, sidecarPath: string, outcome: HealthOutcome): void {
   const branch = healthBranchFor(sidecarPath);
-  const previous = readHealthRecordAt(sidecarPath, `origin/${branch}`);
+  const gated = reviewRequired(config);
+  // A gated peer reads the remote's own record, as fetchPublic saw it. A
+  // completed sync fetched after its last push; a failed one may not have
+  // fetched at all, so it does here — and when it cannot, the push below
+  // most likely cannot either.
+  if (gated && outcome.status === "failed") {
+    try { fetchPublic(sidecarPath); } catch { /* offline: as last fetched */ }
+  }
+  const previous = readHealthRecordAt(sidecarPath, gated ? publicRef(branch) : `origin/${branch}`);
   const identity: HealthIdentity = {
     machine: currentMachine(),
     root,
@@ -692,7 +747,7 @@ function publishHealth(root: string, config: SidecarConfig, sidecarPath: string,
   };
   const record = nextHealthRecord(previous, identity, outcome, nowIso());
   if (!shouldPublishHealth(previous, record)) return;
-  if (reviewRequired(config)) assertPublishDestination(sidecarPath);
+  if (gated) assertPublishDestination(sidecarPath);
   publishHealthRecord(sidecarPath, branch, record);
   logSidecarEvent("health", {
     branch,
@@ -1019,7 +1074,7 @@ export function familySidecarCheckout(root: string, config: SidecarConfig): stri
   } catch {
     return undefined;
   }
-  if (primaryConfig.remote !== config.remote) return undefined;
+  if (!sharesFamilyCheckout(primaryConfig, config)) return undefined;
 
   const primaryPath = resolveSidecarPath(primary, primaryConfig);
   if (path.resolve(primaryPath) === path.resolve(primary)) return undefined;
@@ -1076,13 +1131,45 @@ export function checkoutIsUnlinkedFromFamily(
   const primary = familyPrimaryRoot(root);
   if (!primary) return false;
   try {
-    const primaryConfig = readConfig(peerConfigPath(primary, config.peer));
-    return primaryConfig.remote === config.remote;
+    return sharesFamilyCheckout(readConfig(peerConfigPath(primary, config.peer)), config);
   } catch {
     return false;
   }
 }
 
+/**
+ * Whether a working copy may share the family primary's checkout. A shared
+ * store's local history is every sharer's to publish, so a peer that requires
+ * review never shares one with a peer that does not: see bindReviewPolicy.
+ */
+function sharesFamilyCheckout(primaryConfig: SidecarConfig, config: SidecarConfig): boolean {
+  return primaryConfig.remote === config.remote && reviewRequired(primaryConfig) === reviewRequired(config);
+}
+
+const REVIEW_POLICY_KEY = "sidecar.review";
+
+/**
+ * Binds a checkout's shared store to review, or refuses a peer that would
+ * publish it unreviewed. Sibling checkouts share one store, local inbox
+ * branches and local main included, and an ungated sync merges and pushes
+ * all of it — so once a gated peer has used a store, the store says so, and
+ * every peer that writes through it must be gated too. A family whose
+ * policies drift apart after linking fails closed here, on whichever side
+ * syncs first. Call before anything is snapshotted, merged, or pushed.
+ */
+export function bindReviewPolicy(sidecarPath: string, config: SidecarConfig): void {
+  const bound = git(sidecarPath, ["config", "--local", "--get", REVIEW_POLICY_KEY], { check: false }).stdout.trim();
+  if (reviewRequired(config)) {
+    if (bound !== "required") git(sidecarPath, ["config", "--local", REVIEW_POLICY_KEY, "required"]);
+    return;
+  }
+  if (bound === "required") {
+    throw new SidecarError(
+      `${sidecarPath} holds work from a peer that requires review, and this peer would publish it unreviewed; set review = "required" in this repo's ${peerFileName(config.peer)} too — or, to publish that work without review, \`git -C ${sidecarPath} config --unset ${REVIEW_POLICY_KEY}\``,
+    );
+  }
+}
+
 export function cloneOrUpdate(
   root: string,
   config: SidecarConfig,
@@ -1137,6 +1224,7 @@ export function cloneOrUpdate(
 
   ensureCommitIdentity(sidecarPath);
   ensureRedactionFilter(sidecarPath, config.redaction, config);
+  bindReviewPolicy(sidecarPath, config);
   if (bootstrapMain) bootstrapMainBranch(sidecarPath, config);
 
   const inbox = expandInbox(config, sidecarPath);
@@ -1250,6 +1338,15 @@ export function ensureMainBranch(repo: string, config: SidecarConfig): void {
   // (see linkPublished). Resetting it would discard those links, so it takes
   // the remote's side in as a merge instead.
   if (reviewRequired(config)) {
+    if (git(repo, ["merge-base", "HEAD", remoteBranch], { check: false }).status !== 0) {
+      // The remote's main was started over. Join it the way bootstrap does: a
+      // commit of local main's own tree, so nothing local is lost and the
+      // next review measures everything here from the new public base.
+      const link = git(repo, ["commit-tree", treeOf(repo, "HEAD"), "-p", "HEAD", "-p", remoteBranch, "-m", `sidecar: link the remote's new ${config.branch}`]).stdout.trim();
+      git(repo, ["merge", "--ff-only", link]);
+      console.log(`${remoteBranch} was started over; local ${config.branch} is joined to it and reviewed from there`);
+      return;
+    }
     mergeInboxBranch(repo, config, remoteBranch, { forkFiles: true });
     return;
   }
diff --git a/packages/sidecar/tests/cli.test.ts b/packages/sidecar/tests/cli.test.ts
index f3e5d67..336b1f7 100644
--- a/packages/sidecar/tests/cli.test.ts
+++ b/packages/sidecar/tests/cli.test.ts
@@ -7,6 +7,7 @@ import { afterEach, beforeEach, describe, expect, test } from "vitest";
 
 import {
   DEFAULT_INBOX,
+  bindReviewPolicy,
   checkoutRandom,
   ensureMainBranch,
   expandInbox,
@@ -915,6 +916,22 @@ describe.skipIf(process.env.SIDECAR_INTEGRATION !== "1")("main branch reconcilia
     expect(isAncestor(loser, "origin/sidecar-inbox/test/r1", "origin/main")).toBe(true);
   });
 
+  test("joins a gated main to a remote main that was started over, keeping every local file", () => {
+    const { winner, loser } = divergedClones();
+    git(winner, ["switch", "--orphan", "fresh"]);
+    git(winner, ["commit", "--allow-empty", "-m", "started over"]);
+    git(winner, ["push", "--force", "origin", "fresh:main"]);
+    const before = git(loser, ["rev-parse", "HEAD"]).stdout.trim();
+    const tree = git(loser, ["rev-parse", "HEAD^{tree}"]).stdout.trim();
+
+    fetch(loser, true);
+    ensureMainBranch(loser, { ...config, review: "required" });
+
+    expect(git(loser, ["rev-parse", "HEAD^{tree}"]).stdout.trim()).toBe(tree);
+    expect(isAncestor(loser, before, "HEAD")).toBe(true);
+    expect(isAncestor(loser, "origin/main", "HEAD")).toBe(true);
+  });
+
   // A pushes after B last fetched, so B's main and origin/main diverge —
   // the state a lost push race leaves behind.
   function divergedClones(): { winner: string; loser: string } {
@@ -944,6 +961,23 @@ describe.skipIf(process.env.SIDECAR_INTEGRATION !== "1")("main branch reconcilia
   }
 });
 
+describe.skipIf(process.env.SIDECAR_INTEGRATION !== "1")("shared review policy", () => {
+  const config: SidecarConfig = { peer: "default", remote: "x", version: 1, path: "sidecar", branch: "main", inbox: DEFAULT_INBOX, redaction: "none", resolve: "fork" };
+
+  test("a store a gated peer has used refuses an ungated one, from any of its worktrees", () => {
+    const repo = initRepo();
+    const sibling = path.join(tempDir(), "sibling");
+    git(repo, ["commit", "--allow-empty", "-m", "base"]);
+    git(repo, ["worktree", "add", "--detach", sibling]);
+
+    bindReviewPolicy(repo, config);
+    bindReviewPolicy(sibling, { ...config, review: "required" });
+    bindReviewPolicy(repo, { ...config, review: "required" });
+    expect(() => bindReviewPolicy(repo, config)).toThrow(/requires review/);
+    expect(() => bindReviewPolicy(sibling, config)).toThrow(/requires review/);
+  });
+});
+
 describe("daemon pid identification", () => {
   test("rejects dead pids and live non-daemon processes", () => {
     expect(pidIsSidecarDaemon(999_999)).toBe(false);
diff --git a/packages/sidecar/tests/integration.test.ts b/packages/sidecar/tests/integration.test.ts
index db1c48e..60dd28d 100644
--- a/packages/sidecar/tests/integration.test.ts
+++ b/packages/sidecar/tests/integration.test.ts
@@ -2546,12 +2546,46 @@ describe("review-gated publishing", () => {
     expect(remoteFile(remote, "later.md")).toBe("decide later\n");
   });
 
-  test("a gated peer refuses to push a snapshot directly", () => {
+  test("a gated peer refuses to push a snapshot directly, before snapshotting anything", () => {
     const { main, sidecar } = initSidecarProject(["--review", "required"]);
-    fs.writeFileSync(path.join(sidecar, "notes.md"), "hello\n", "utf8");
-    const result = runSidecarRaw(["snapshot", "--push"], main);
+    const before = git(sidecar, ["rev-parse", "HEAD"]).stdout.trim();
+    for (const content of [undefined, "hello\n"]) {
+      if (content) fs.writeFileSync(path.join(sidecar, "notes.md"), content, "utf8");
+      const result = runSidecarRaw(["snapshot", "--push"], main);
+      expect(result.status).not.toBe(0);
+      expect(result.stderr).toContain("requires review");
+      expect(git(sidecar, ["rev-parse", "HEAD"]).stdout.trim()).toBe(before);
+    }
+  });
+
+  test("a working copy whose review policy drifts from its family's refuses to sync the shared store", () => {
+    const { main, worktree, remote, state } = initWorktreeFamily(["--review", "required"]);
+    const env = { SIDECAR_STATE_DIR: state };
+    runSidecar(["clone"], worktree, env);
+    fs.writeFileSync(path.join(main, "sidecar", "plan.md"), "unreviewed plan\n", "utf8");
+    runSidecar(["sync"], main, env);
+
+    const config = path.join(worktree, ".sidecar");
+    fs.writeFileSync(config, fs.readFileSync(config, "utf8").replace('review = "required"\n', ""), "utf8");
+    const result = runSidecarRaw(["sync"], worktree, env);
     expect(result.status).not.toBe(0);
     expect(result.stderr).toContain("requires review");
+    expect(remoteObjectsContain(remote, "unreviewed plan")).toBe(false);
+  });
+
+  test("retrying a review retires it, so its old reviewer can no longer decide", () => {
+    const { main, sidecar } = initSidecarProject(["--review", "required"]);
+    const env = reviewerEnv(main);
+    fs.writeFileSync(path.join(sidecar, "notes.md"), "hello\n", "utf8");
+    const first = openedReview(runSidecar(["sync"], main, env.vars));
+    runSidecar(["review", "reviewer", `touch ${JSON.stringify(env.defer)}`], main, env.vars);
+
+    const retried = /review ([0-9a-f]+) covers the same change/.exec(runSidecar(["review", "retry", first], main, env.vars))?.[1];
+    expect(retried).toBeDefined();
+    expect(retried).not.toBe(first);
+    const late = runSidecarRaw(["review", "approve", first, "--no-sync"], main, env.vars);
+    expect(late.status).not.toBe(0);
+    expect(late.stderr).toContain("already superseded");
   });
 });
 
diff --git a/packages/sidecar/tests/review.test.ts b/packages/sidecar/tests/review.test.ts
index aba8054..0b24922 100644
--- a/packages/sidecar/tests/review.test.ts
+++ b/packages/sidecar/tests/review.test.ts
@@ -5,7 +5,6 @@ import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 
 vi.mock("../src/git.js", async (original) => ({
   ...await original<typeof import("../src/git.js")>(),
-  emptyTree: vi.fn(),
   git: vi.fn(),
   gitBytes: vi.fn(),
   gitCommonDir: vi.fn(),
@@ -16,7 +15,7 @@ vi.mock("../src/state.js", async (original) => ({
   logSidecarEvent: vi.fn(),
 }));
 
-import { emptyTree, git, gitBytes, gitCommonDir, treeOf } from "../src/git.js";
+import { git, gitBytes, gitCommonDir, treeOf } from "../src/git.js";
 import { logSidecarEvent, readSettings, writeSettings } from "../src/state.js";
 import type { SidecarConfig } from "../src/config.js";
 import {
@@ -30,7 +29,6 @@ import {
   markSuperseded,
   openReview,
   readReview,
-  resetReview,
   reviewAttention,
 } from "../src/review.js";
 
@@ -50,7 +48,6 @@ beforeEach(() => {
   fs.mkdirSync(path.join(root, "sidecar", ".git"), { recursive: true });
   vi.stubEnv("SIDECAR_STATE_DIR", path.join(directory, "state"));
   vi.mocked(gitCommonDir).mockImplementation((checkout) => path.join(checkout, ".git"));
-  vi.mocked(emptyTree).mockReturnValue("empty-tree");
   vi.mocked(treeOf).mockReturnValue("tree-oid");
   vi.mocked(gitBytes).mockReturnValue({ status: 0, stdout: Buffer.from("plain text\n"), stderr: Buffer.alloc(0) });
   vi.mocked(git).mockImplementation((_repo, args) => {
@@ -72,9 +69,13 @@ function open(checkout = path.join(root, "sidecar")): Review {
   return createReview({ root, config, sidecarPath: checkout, base: "base-oid", head: "head-oid" });
 }
 
-function writeRun(review: Review, run: Record<string, unknown>, attempt = "a1"): void {
-  fs.writeFileSync(path.join(review.dir, "attempt"), `${attempt}\n`, "utf8");
-  fs.writeFileSync(path.join(review.dir, `run-${attempt}.json`), JSON.stringify({ attempt, ...run }), "utf8");
+function writeRun(review: Review, run: Record<string, unknown>): void {
+  fs.writeFileSync(path.join(review.dir, "run.json"), JSON.stringify(run), "utf8");
+}
+
+function markLaunched(review: Review, secondsAgo: number): void {
+  const record = { ...review.record, launchedAt: new Date(Date.now() - secondsAgo * 1000).toISOString() };
+  fs.writeFileSync(path.join(review.dir, "review.json"), JSON.stringify(record), "utf8");
 }
 
 describe("opening a review", () => {
@@ -132,11 +133,6 @@ describe("opening a review", () => {
     expect(review.record.files.find((file) => file.path === "notes.md")!.artifact).toBeUndefined();
   });
 
-  test("diffs against the empty tree when the head shares no history with the remote", () => {
-    createReview({ root, config, sidecarPath: path.join(root, "sidecar"), head: "head-oid" });
-    expect(git).toHaveBeenCalledWith(path.join(root, "sidecar"), expect.arrayContaining(["diff-tree", "-p", "empty-tree", "head-oid"]));
-  });
-
   test("says so when the repository has no guidelines", () => {
     const review = open();
     expect(fs.existsSync(path.join(review.dir, "guidelines.md"))).toBe(false);
@@ -146,7 +142,7 @@ describe("opening a review", () => {
   test("reads a named peer's guidelines from its own file", () => {
     fs.writeFileSync(path.join(root, ".sidecar-review.notes"), "Notes only.\n", "utf8");
     fs.writeFileSync(path.join(root, ".sidecar-review"), "Default only.\n", "utf8");
-    const review = createReview({ root, config: { ...config, peer: "notes" }, sidecarPath: path.join(root, "sidecar"), head: "head-oid" });
+    const review = createReview({ root, config: { ...config, peer: "notes" }, sidecarPath: path.join(root, "sidecar"), base: "base-oid", head: "head-oid" });
     expect(fs.readFileSync(path.join(review.dir, "guidelines.md"), "utf8")).toBe("Notes only.\n");
   });
 });
@@ -208,33 +204,24 @@ describe("review state", () => {
     expect(reviewAttention(review, opened + 3601_000)).toBe("undecided for over 1h");
   });
 
-  test("only the current attempt's runner counts", () => {
+  test("a launched reviewer that never records a run has failed once its grace period passes", () => {
+    writeSettings({ ...readSettings(), reviewer: "reviewer" });
     const review = open();
-    writeRun(review, { pid: process.pid, command: "reviewer", startedAt: "t", finishedAt: "t", exitCode: 0 }, "new");
-    // The retired attempt's runner finishes late and badly; it is not the record read.
-    fs.writeFileSync(path.join(review.dir, "run-old.json"), JSON.stringify({ attempt: "old", pid: 1, startedAt: "t", finishedAt: "t", exitCode: 7 }));
+    markLaunched(review, 10);
     expect(readReview(review.record.id)!.state).toBe("pending");
+    markLaunched(review, 120);
+    const reread = readReview(review.record.id)!;
+    expect(reread.state).toBe("failed");
+    expect(reviewAttention(reread)).toBe("reviewer never started");
   });
 
-  test("once publication has begun, a review can no longer be rejected or reset", () => {
+  test("once publication has begun, a review can no longer be rejected", () => {
     const review = open();
     decideReview(review, "approved");
     markPublishing(review, "sidecar-inbox/test/abc", "commit-oid");
     const reread = readReview(review.record.id)!;
     expect(reread.record.publishing).toEqual({ inbox: "sidecar-inbox/test/abc", commit: "commit-oid" });
     expect(() => decideReview(reread, "rejected")).toThrow(/already being published/);
-    expect(() => resetReview(reread)).toThrow(/already being published/);
-  });
-
-  test("reset clears the verdict and run so the reviewer can take it again", () => {
-    const review = open();
-    writeRun(review, { pid: 999_999, command: "reviewer", startedAt: "t", finishedAt: "t", exitCode: 1 });
-    decideReview(review, "rejected", "no");
-    resetReview(review);
-    const reread = readReview(review.record.id)!;
-    expect(reread.state).toBe("pending");
-    expect(reread.verdict).toBeUndefined();
-    expect(reread.run).toBeUndefined();
   });
 });
 

From a901dbefab05a8c647d09c8291bb18152984aa7e Mon Sep 17 00:00:00 2001
From: Zack Story <2302315+rt2zz@users.noreply.github.com>
Date: Sun, 18 Oct 2026 21:28:00 -0700
Subject: [PATCH 3/3] fix(review): refuse to retry an approved review

Retry is for a reviewer that broke. On an approved review not yet
publishing, it superseded the approval and opened a pending review in its
place, quietly withdrawing a decision. It now refuses; `reject` is the way
to withdraw an approval before it publishes.
---
 docs/commands.md                           | 2 +-
 docs/review.md                             | 2 +-
 packages/sidecar/dist/cli.js               | 2 ++
 packages/sidecar/src/sync.ts               | 3 +++
 packages/sidecar/tests/integration.test.ts | 5 +++++
 5 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/docs/commands.md b/docs/commands.md
index 5ddd3ff..5b85a9d 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -172,7 +172,7 @@ open review.
 | `sidecar review show [<id>] [--json]` | state, reason, changed files, and the diff exactly as it would be published |
 | `sidecar review approve [<id>] [--no-sync]` | approve, then publish it now unless `--no-sync`; also overrides a rejection |
 | `sidecar review reject [<id>] [--reason <text>]` | hold publishing until the content changes |
-| `sidecar review retry [<id>]` | retire it and open a new review of the same change, with a fresh reviewer run |
+| `sidecar review retry [<id>]` | retire it and open a new review of the same change, with a fresh reviewer run (not once approved) |
 | `sidecar review reviewer ["<command>"\|--unset]` | show or set this machine's reviewer, a shell command quoted as one argument |
 | `sidecar review run <id>` | the background runner a sync starts; not for direct use |
 
diff --git a/docs/review.md b/docs/review.md
index 17e28b0..706ea55 100644
--- a/docs/review.md
+++ b/docs/review.md
@@ -97,7 +97,7 @@ The exit status says only whether the reviewer itself worked:
 - **Nonzero:** the reviewer broke. The review needs attention;
   `sidecar review retry` retires it and opens a new review of the same change
   with a fresh run of the reviewer. A reviewer still working on the old review
-  can no longer decide it.
+  can no longer decide it. An approved review can't be retried; it publishes.
 
 That middle case is what makes discussion possible. A reviewer can open a
 thread in your agent tool with the packet, exit, and let the agent there
diff --git a/packages/sidecar/dist/cli.js b/packages/sidecar/dist/cli.js
index 7b5c97e..2d1e8f2 100755
--- a/packages/sidecar/dist/cli.js
+++ b/packages/sidecar/dist/cli.js
@@ -5111,6 +5111,8 @@ function retryReview(review) {
     throw new SidecarError(`review ${record.id} is already ${review.state}`);
   if (record.publishing)
     throw new SidecarError(`review ${record.id} is already being published`);
+  if (review.state === "approved")
+    throw new SidecarError(`review ${record.id} is approved and publishes on the next sync`);
   const config = loadPeer(record.root, record.peer).config;
   const sidecarPath = requireSidecarCheckout(record.root, config);
   markSuperseded(review);
diff --git a/packages/sidecar/src/sync.ts b/packages/sidecar/src/sync.ts
index 25ab4f2..9cc4608 100644
--- a/packages/sidecar/src/sync.ts
+++ b/packages/sidecar/src/sync.ts
@@ -449,6 +449,9 @@ export function retryReview(review: Review): Review {
   const { record } = review;
   if (!isOpen(review)) throw new SidecarError(`review ${record.id} is already ${review.state}`);
   if (record.publishing) throw new SidecarError(`review ${record.id} is already being published`);
+  // An approval is a decision, not a reviewer that broke; retrying would
+  // quietly withdraw it.
+  if (review.state === "approved") throw new SidecarError(`review ${record.id} is approved and publishes on the next sync`);
   const config = loadPeer(record.root, record.peer).config;
   const sidecarPath = requireSidecarCheckout(record.root, config);
   // Retired first: a retry that dies partway leaves no review open, and the
diff --git a/packages/sidecar/tests/integration.test.ts b/packages/sidecar/tests/integration.test.ts
index 60dd28d..9ecd504 100644
--- a/packages/sidecar/tests/integration.test.ts
+++ b/packages/sidecar/tests/integration.test.ts
@@ -2586,6 +2586,11 @@ describe("review-gated publishing", () => {
     const late = runSidecarRaw(["review", "approve", first, "--no-sync"], main, env.vars);
     expect(late.status).not.toBe(0);
     expect(late.stderr).toContain("already superseded");
+
+    runSidecar(["review", "approve", retried!, "--no-sync"], main, env.vars);
+    const again = runSidecarRaw(["review", "retry", retried!], main, env.vars);
+    expect(again.status).not.toBe(0);
+    expect(again.stderr).toContain("is approved");
   });
 });