@anthusai/papyrus 5.43.0-next.1 → 5.43.0-next.10

package/amplify/functions/category-action/handler.ts

@@ -24,6 +24,7 @@ import {
   requestDelegation,
   type DelegationStore,
 } from "../shared/curation-delegation-flow";
+import { claimGroups } from "../../../lib/staff-groups";
 
 type ReviewHandler = Schema["reviewSteeringProposal"]["functionHandler"];
 type ReferenceCurationHandler = Schema["reviewReferenceCuration"]["functionHandler"];
@@ -360,7 +361,7 @@ function requireSignedInPerson(event: { identity?: unknown }): { sub: string; la
   }
   const identity = event.identity as { sub?: unknown; claims?: Record<string, unknown> };
   const claims = identity.claims ?? {};
-  const groups = Array.isArray(claims["cognito:groups"]) ? (claims["cognito:groups"] as unknown[]) : [];
+  const groups = claimGroups(claims["cognito:groups"]);
   return {
     sub: normalizeRequiredString(claims.sub ?? identity.sub, "identity.sub"),
     label: normalizeOptionalString(claims.email) ?? normalizeOptionalString(claims.name) ?? "Newsroom editor",

package/amplify/functions/monitoring-view/schema.js

@@ -14,6 +14,14 @@ export const monitoringViewSchemaDefinitions = {
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
         .handler(functionHandler("monitoringView", monitoringView)),
+    // One more page of one Monitoring list (runs, routerRuns, items, emailSubmissions), after a cursor from
+    // the overview or a previous page. filter "held" lists only held email submissions, restarting from the newest.
+    monitoringPage: a
+        .query()
+        .arguments({ list: a.string().required(), cursor: a.string(), filter: a.string(), scope: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(functionHandler("monitoringView", monitoringView)),
     monitoringEmailSubmission: a
         .query()
         .arguments({ receiptId: a.string().required() })
@@ -26,6 +34,14 @@ export const monitoringViewSchemaDefinitions = {
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
         .handler(functionHandler("monitoringView", monitoringView)),
+    // Accept ("release") or Reject ("discard") one held email submission. The function validates the
+    // signed-in editor and that the message is routed to this publication; the receiver applies it.
+    monitoringDecideEmailSubmission: a
+        .mutation()
+        .arguments({ receiptId: a.string().required(), decision: a.string().required(), reason: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(functionHandler("monitoringView", monitoringView)),
     monitoringResolveEmailArticleLink: a
         .mutation()
         .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })

package/amplify/functions/monitoring-view/schema.ts

@@ -16,6 +16,14 @@ export const monitoringViewSchemaDefinitions = {
     .returns(a.json())
     .authorization((allow) => [allow.groups(editors)])
     .handler(functionHandler("monitoringView", monitoringView)),
+  // One more page of one Monitoring list (runs, routerRuns, items, emailSubmissions), after a cursor from
+  // the overview or a previous page. filter "held" lists only held email submissions, restarting from the newest.
+  monitoringPage: a
+    .query()
+    .arguments({ list: a.string().required(), cursor: a.string(), filter: a.string(), scope: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(functionHandler("monitoringView", monitoringView)),
   monitoringEmailSubmission: a
     .query()
     .arguments({ receiptId: a.string().required() })
@@ -28,6 +36,14 @@ export const monitoringViewSchemaDefinitions = {
     .returns(a.json())
     .authorization((allow) => [allow.groups(editors)])
     .handler(functionHandler("monitoringView", monitoringView)),
+  // Accept ("release") or Reject ("discard") one held email submission. The function validates the
+  // signed-in editor and that the message is routed to this publication; the receiver applies it.
+  monitoringDecideEmailSubmission: a
+    .mutation()
+    .arguments({ receiptId: a.string().required(), decision: a.string().required(), reason: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(functionHandler("monitoringView", monitoringView)),
   monitoringResolveEmailArticleLink: a
     .mutation()
     .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })

package/amplify/functions/procedure-action/handler.ts

@@ -3,6 +3,7 @@ import { getAmplifyDataClientConfig } from "@aws-amplify/backend/function/runtim
 import { Amplify } from "aws-amplify";
 import { generateClient } from "aws-amplify/data";
 import type { Schema } from "../../data/resource";
+import { claimGroups } from "../../../lib/staff-groups";
 
 type DataClient = ReturnType<typeof generateClient<Schema>>;
 type DataClientErrors = Array<{ message?: string | null } | string | null> | null | undefined;
@@ -474,20 +475,11 @@ function validateJsonSchemaInput(schema: Record<string, unknown>, input: Record<
 
 function requireAdmin(event: ProcedureEvent): void {
   const claims = objectValue(event.identity?.claims);
-  const groups = [
-    ...normalizeClaimGroups(claims["cognito:groups"]),
-    ...normalizeClaimGroups(claims.groups),
-  ];
+  const groups = [...claimGroups(claims["cognito:groups"]), ...claimGroups(claims.groups)];
   if (groups.includes("admin")) return;
   throw new Error("Admin role required.");
 }
 
-function normalizeClaimGroups(value: unknown): string[] {
-  if (Array.isArray(value)) return value.map((entry) => String(entry).trim()).filter(Boolean);
-  if (typeof value === "string") return value.split(",").map((entry) => entry.trim()).filter(Boolean);
-  return [];
-}
-
 async function getDataClient(): Promise<DataClient> {
   if (!clientPromise) {
     clientPromise = (async () => {

package/amplify/functions/proposal-actions/proposals.py

@@ -92,6 +92,25 @@ def is_appsync_event(event: dict[str, Any]) -> bool:
     return "arguments" in event and ("info" in event or event_field_name(event) is not None)
 PROPOSER_AI = "ai"
 STAFF_GROUPS = frozenset({"editor", "admin"})
+
+_GROUP_SEPARATORS = re.compile(r"[\s,]+")
+
+
+def claim_groups(value: Any) -> list[str]:
+    """Copy of ``papyrus_content.staff_groups.claim_groups`` (this function ships without that package; a test keeps them equal)."""
+    if isinstance(value, (list, tuple, set, frozenset)):
+        raw = [item for item in value if isinstance(item, str)]
+    elif isinstance(value, str):
+        raw = _GROUP_SEPARATORS.split(value)
+    else:
+        return []
+    cleaned = (item.strip().strip("\"'[](){}").strip() for item in raw)
+    return [item for item in cleaned if item]
+
+
+def has_editor_rights(groups: Any) -> bool:
+    """``admin`` has every editor right: an admin who is not in the ``editor`` group is staff."""
+    return any(group.lower() in STAFF_GROUPS for group in claim_groups(groups))
 #: The only moves an operator's IAM role may make, as (from, to). Everything after the draft is an editor's decision.
 OPERATOR_TRANSITIONS = frozenset({(DRAFT, IN_STEERING), (DRAFT, DECLINED)})
 BY_STAFF, BY_OPERATOR = "staff", "operator"
@@ -140,10 +159,8 @@ def staff_subject(identity: dict[str, Any]) -> str | None:
     """The Cognito subject of an editor or admin, or ``None`` for anyone else."""
     claims = identity.get("claims") or {}
     groups = claims.get("cognito:groups") or identity.get("groups") or []
-    if isinstance(groups, str):
-        groups = [group.strip() for group in groups.strip("[]").replace(",", " ").split()]
     subject = identity.get("sub")
-    if not isinstance(subject, str) or not subject or not STAFF_GROUPS.intersection(groups):
+    if not isinstance(subject, str) or not subject or not has_editor_rights(groups):
         return None
     return subject
 

package/amplify/plugins/reader-steering/function/handler.py

@@ -1468,10 +1468,8 @@ def handle_staff_event(event: dict[str, Any], *, store: Any, settings: ReaderSet
     identity = event.get("identity") or {}
     claims = identity.get("claims") or {}
     groups = claims.get("cognito:groups") or identity.get("groups") or []
-    if isinstance(groups, str):
-        groups = [group.strip() for group in groups.strip("[]").replace(",", " ").split()]
     subject = identity.get("sub")
-    if not isinstance(subject, str) or not subject or not moderation_rules.STAFF_GROUPS.intersection(groups):
+    if not isinstance(subject, str) or not subject or not moderation_rules.has_editor_rights(groups):
         return moderation_rules.refused("not_staff", "Only editors and admins can moderate.").to_dict()
     arguments = event.get("arguments") or {}
     outcome = moderation_rules.apply_action(

package/amplify/plugins/reader-steering/function/moderation.py

@@ -37,6 +37,25 @@ READER_ID = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f
 ACTION_ID = re.compile(r"mod-[0-9a-f]{32}")
 MAXIMUM_REASON = 500
 STAFF_GROUPS = frozenset({"editor", "admin"})
+
+_GROUP_SEPARATORS = re.compile(r"[\s,]+")
+
+
+def claim_groups(value: Any) -> list[str]:
+    """Copy of ``papyrus_content.staff_groups.claim_groups`` (this function ships without that package; a test keeps them equal)."""
+    if isinstance(value, (list, tuple, set, frozenset)):
+        raw = [item for item in value if isinstance(item, str)]
+    elif isinstance(value, str):
+        raw = _GROUP_SEPARATORS.split(value)
+    else:
+        return []
+    cleaned = (item.strip().strip("\"'[](){}").strip() for item in raw)
+    return [item for item in cleaned if item]
+
+
+def has_editor_rights(groups: Any) -> bool:
+    """``admin`` has every editor right: an admin who is not in the ``editor`` group is staff."""
+    return any(group.lower() in STAFF_GROUPS for group in claim_groups(groups))
 ITEM_ID_PREFIX = "item-"
 
 

package/bin/papyrus-infra.mjs

@@ -3,6 +3,7 @@
  * papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]
  * papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]
  * papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader
+ * papyrus-infra synth --site infra/site.json --part chat [--chat-lambdas DIR] [--out cdk.out]   (the private chat data stack)
  * papyrus-infra deploy --site infra/site.json [--only-branch main] [--only-app-id ID] [--out cdk.out] [--account A] [--region R]
  * Synthesizes the app-shell stack for a publication from its own site.json,
  * prints one of the generated Amplify build specs, or deploys the stack from
@@ -16,6 +17,7 @@ import { resolveCdkEnvironment } from "../src/cdk-environment.mjs";
 
 const USAGE = [
   "Usage: papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]",
+  "       papyrus-infra synth --site infra/site.json --part chat [--chat-lambdas DIR] [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader",
   "       papyrus-infra deploy-edge --stack NAME --template FILE [--adoption-template FILE --adopt-resources FILE] [--parameter KEY=VALUE]... [--delete-function NAME] [--only-branch main] [--only-app-id ID] [--region R]",
@@ -186,8 +188,9 @@ if (command === "deploy") {
 }
 
 let AmplifyAppShellStack;
+let PapyrusChatStack;
 try {
-  ({ AmplifyAppShellStack } = await import("../infra/index.js"));
+  ({ AmplifyAppShellStack, PapyrusChatStack } = await import("../infra/index.js"));
 } catch (error) {
   console.error(`papyrus-infra: ${error instanceof Error ? error.message : error}`);
   process.exit(1);
@@ -195,6 +198,23 @@ try {
 
 const { App } = createRequire(path.join(process.cwd(), "noop.js"))("aws-cdk-lib");
 const app = new App({ outdir: path.resolve(opt("out", "cdk.out")) });
+if (opt("part", "shell") === "chat") {
+  // The site's private newsroom chat data stack (docs/private-newsroom-chat-per-site.md); deployed before the app shell enables chat.
+  if (!config.chat?.enabled) {
+    console.error(`papyrus-infra: site ${config.siteId} has no enabled chat block`);
+    process.exit(1);
+  }
+  const lambdaAssetDirectory = opt("chat-lambdas");
+  const chatStack = new PapyrusChatStack(app, {
+    config,
+    env: resolveEnvironmentOrExit(),
+    lambdaAssetDirectory: lambdaAssetDirectory ? path.resolve(lambdaAssetDirectory) : undefined,
+    description: `Private Papyrus newsroom chat data plane for ${config.siteId}.`,
+  });
+  app.synth();
+  console.log(`synthesized ${chatStack.stackName} -> ${path.resolve(opt("out", "cdk.out"))}`);
+  process.exit(0);
+}
 new AmplifyAppShellStack(app, `AmplifyAppShell-${config.siteId}`, config, {
   env: resolveEnvironmentOrExit(),
   stackName: resolveStackName(config),

package/components/dev-sandbox-editor-sign-in.tsx

@@ -2,9 +2,9 @@
 
 import { fetchAuthSession, signIn, signOut } from "aws-amplify/auth";
 import { configureAmplifyClient } from "./amplify-client-provider";
+import { hasEditorRights } from "../lib/staff-groups";
 import type { DevSandboxEditorAuth } from "../lib/dev-sandbox-editor-auth";
 
-const EDITOR_GROUPS = new Set(["editor", "admin"]);
 
 function readSessionGroups(session: Awaited<ReturnType<typeof fetchAuthSession>>): string[] {
   const accessPayload = session.tokens?.accessToken?.payload ?? {};
@@ -29,7 +29,7 @@ function readSessionGroups(session: Awaited<ReturnType<typeof fetchAuthSession>>
 
 function sessionHasEditorAccess(session: Awaited<ReturnType<typeof fetchAuthSession>>): boolean {
   if (!session.tokens?.accessToken) return false;
-  return readSessionGroups(session).some((group) => EDITOR_GROUPS.has(group));
+  return hasEditorRights(readSessionGroups(session));
 }
 
 export async function ensureDevSandboxEditorSession(

package/components/monitoring-overview-view.tsx

@@ -1,5 +1,6 @@
 import { useEffect, useRef, useState } from "react";
 import Link from "next/link";
+import { CheckIcon, XIcon } from "lucide-react";
 import { getNewsroomNavHref } from "../lib/newsroom-nav";
 import {
   confidenceText,
@@ -12,7 +13,12 @@ import {
   beginEmailSubmissionAction,
   endEmailSubmissionAction,
   isCurrentEmailSubmissionAction,
+  emailSubmissionAccepted,
+  QUARANTINE_LABELS,
+  type EmailDecisionResult,
+  type EmailQuarantine,
   type MonitoringItem,
+  type MonitoringListName,
   type MonitoringEmailDetails,
   type MonitoringEmailArticleResolution,
   type EmailReferenceImportItem,
@@ -25,6 +31,27 @@ import {
 
 export type MonitoringMode = "publication" | "all";
 
+/** How a paged list loads more: the page owns the cursors and the requests, the view only shows the button. */
+export type MonitoringPaging = {
+  /** Loads the next page of a list; the page appends it. */
+  onLoadMore?: (list: MonitoringListName) => void;
+  /** The list whose next page is being fetched. */
+  loadingList?: MonitoringListName | null;
+  /** Show only email submissions held for review (restarts the email list from its newest held message). */
+  heldOnly?: boolean;
+  onHeldOnlyChange?: (heldOnly: boolean) => void;
+};
+
+function LoadMore({ list, cursor, paging }: { list: MonitoringListName; cursor: string | null | undefined; paging?: MonitoringPaging }) {
+  if (!cursor || !paging?.onLoadMore) return null;
+  const loading = paging.loadingList === list;
+  return (
+    <button type="button" data-monitoring-load-more={list} disabled={loading} onClick={() => paging.onLoadMore?.(list)}>
+      {loading ? "Loading…" : "Load more"}
+    </button>
+  );
+}
+
 const STATUS_WORDS: Record<string, string> = { complete: "Complete", partial: "Partial", stopped: "Stopped", failed: "Failed", error: "Error" };
 const status = (value: string) => STATUS_WORDS[value] ?? value;
 const STOP_WORDS: Record<string, string> = {
@@ -97,8 +124,10 @@ function QueueItem({ item, ownId, demo }: { item: MonitoringItem; ownId: string
   );
 }
 
-export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink, onImportCandidates }: {
+export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink, onImportCandidates, onDecide, cursor, paging }: {
   items: MonitoringEmailSummary[]; detail: MonitoringEmailDetails | null; onOpen?: (receiptId: string) => void;
+  cursor?: string | null; paging?: MonitoringPaging;
+  onDecide?: (receiptId: string, decision: "accept" | "reject", reason: string) => Promise<EmailDecisionResult>;
   onResolveArticleLink?: (receiptId: string, candidateIndex: number) => Promise<MonitoringEmailArticleResolution>;
   onImportCandidates?: (receiptId: string, items: EmailReferenceImportItem[]) => Promise<EmailReferenceImportOutcome>;
 }) {
@@ -108,8 +137,15 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
   const [busyImportByReceipt, setBusyImportByReceipt] = useState<Record<string, boolean>>({});
   const [noticeByReceipt, setNoticeByReceipt] = useState<Record<string, string>>({});
   const [importedByReceipt, setImportedByReceipt] = useState<Record<string, EmailReferenceImportOutcome["references"]>>({});
+  const [decidedByReceipt, setDecidedByReceipt] = useState<Record<string, EmailQuarantine>>({});
+  const [reasonByReceipt, setReasonByReceipt] = useState<Record<string, string>>({});
+  const [busyDecisionByReceipt, setBusyDecisionByReceipt] = useState<Record<string, boolean>>({});
   const receiptId = detail && "submission" in detail ? detail.submission.receiptId : null;
   const receiptKey = receiptId ?? "";
+  const quarantine = (detail && "submission" in detail ? decidedByReceipt[receiptKey] ?? detail.submission.quarantine : null);
+  const accepted = emailSubmissionAccepted(quarantine);
+  const reason = reasonByReceipt[receiptKey] ?? "";
+  const busyDecision = busyDecisionByReceipt[receiptKey] ?? false;
   const selected = selectedByReceipt[receiptKey] ?? {};
   const resolved = resolvedByReceipt[receiptKey] ?? {};
   const busyIndex = busyIndexByReceipt[receiptKey] ?? null;
@@ -139,7 +175,7 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
       if (!isCurrentEmailSubmissionAction(activeReceiptId.current, requestReceiptId)) return;
       if (!("url" in result)) {
         const reason = "reason" in result && typeof result.reason === "string"
-          && /^(?:redirect_[a-z_]+|resolution_record_invalid|resolution_not_recorded)$/.test(result.reason)
+          && /^(?:redirect_[a-z_]+|resolution_record_invalid|resolution_not_recorded|invalid_url|not_public|dns|timeout|connection|tls|loop|http_4xx|http_5xx|blocked|too_large|unreadable|unsafe_destination|no_query|search_unavailable|search_error|no_match)$/.test(result.reason)
           ? ` (${result.reason})` : "";
         setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: `The article destination could not be resolved safely${reason}. The original link remains private and unchanged.` }));
         return;
@@ -147,7 +183,9 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
       const candidate = detail && "submission" in detail ? detail.candidateLinks[index] : null;
       setResolvedByReceipt((current) => ({ ...current, [requestReceiptId]: { ...current[requestReceiptId], [index]: { url: result.url, title: result.title || candidate?.title || "Article" } } }));
       setSelectedByReceipt((current) => ({ ...current, [requestReceiptId]: { ...current[requestReceiptId], [index]: true } }));
-      setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "Resolved. This request may be recorded as a click by the newsletter sender." }));
+      setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: result.foundVia === "search"
+        ? `The newsletter link could not be followed, so this article was found by searching the headline (match ${Math.round((result.search?.matchScore ?? 0) * 100)}%). Check that it is the right article before importing it.`
+        : "Resolved. This request may be recorded as a click by the newsletter sender." }));
     } catch {
       if (isCurrentEmailSubmissionAction(activeReceiptId.current, requestReceiptId)) {
         setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "The article destination could not be resolved. Try again later." }));
@@ -158,6 +196,34 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
     }
   };
 
+  const decide = async (decision: "accept" | "reject") => {
+    if (!receiptId || !onDecide) return;
+    const requestReceiptId = receiptId;
+    const actionKey = `decide:${requestReceiptId}`;
+    if (!beginEmailSubmissionAction(inFlightActions.current, actionKey)) return;
+    setBusyDecisionByReceipt((current) => ({ ...current, [requestReceiptId]: true }));
+    setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "" }));
+    try {
+      const result = await onDecide(requestReceiptId, decision, reason.trim());
+      if ("ok" in result) {
+        setDecidedByReceipt((current) => ({ ...current, [requestReceiptId]: result.quarantine }));
+        setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: decision === "accept"
+          ? "Accepted. The receiver queues it within a minute; the links can be added to References once it is queued."
+          : "Rejected. The message is closed and kept privately until it expires." }));
+      } else if ("error" in result && result.quarantine) {
+        setDecidedByReceipt((current) => ({ ...current, [requestReceiptId]: result.quarantine as EmailQuarantine }));
+        setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "Another decision was already recorded for this message; it cannot be changed." }));
+      } else {
+        setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "The decision was not recorded. Check your editor access and try again." }));
+      }
+    } catch {
+      setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "The decision was not recorded. It is safe to try again." }));
+    } finally {
+      endEmailSubmissionAction(inFlightActions.current, actionKey);
+      setBusyDecisionByReceipt((current) => ({ ...current, [requestReceiptId]: false }));
+    }
+  };
+
   const importSelected = async () => {
     if (!receiptId || !detail || !("submission" in detail) || !onImportCandidates) return;
     const requestReceiptId = receiptId;
@@ -199,6 +265,12 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
   return (
     <article className="news-desk-doctrine-card" data-monitoring-section="email-submissions">
       <div className="news-desk-doctrine-card__header"><div><h3>Email submissions</h3><span>Untrusted source material held privately for editor review</span></div></div>
+      {paging?.onHeldOnlyChange ? (
+        <div className="news-desk-monitoring__scope" role="group" aria-label="Filter email submissions">
+          <button type="button" aria-pressed={!paging.heldOnly} data-email-filter="all" onClick={() => paging.onHeldOnlyChange?.(false)}>All</button>
+          <button type="button" aria-pressed={paging.heldOnly === true} data-email-filter="held" onClick={() => paging.onHeldOnlyChange?.(true)}>Held for review</button>
+        </div>
+      ) : null}
       {items.length ? <ul className="news-desk-monitoring__list">
         {items.map((item) => <li key={item.receiptId} data-email-submission={item.receiptId}>
           <strong>{item.subject || "(no subject)"}</strong>
@@ -210,40 +282,70 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
           <span>SES signals — SPF {item.verdicts.spf}, DKIM {item.verdicts.dkim}, DMARC {item.verdicts.dmarc}; spam {item.verdicts.spam}, virus {item.verdicts.virus}</span>
           {item.warnings.length ? <span>Warnings: {item.warnings.join(", ")}</span> : null}
           {item.errorCode ? <span>State: {item.status} ({item.errorCode})</span> : <span>State: {item.status}</span>}
+          {item.quarantine ? <span data-email-quarantine-state={item.quarantine.state}>{QUARANTINE_LABELS[item.quarantine.state]}</span> : null}
           {onOpen ? <button type="button" onClick={() => onOpen(item.receiptId)}>Read email and review candidate links</button> : null}
         </li>)}
-      </ul> : <p>No email submissions are available for this publication.</p>}
+      </ul> : <p>{paging?.heldOnly ? "No email submissions are held for review." : "No email submissions are available for this publication."}</p>}
+      <LoadMore list="emailSubmissions" cursor={cursor} paging={paging} />
       {detail && "submission" in detail ? (
         <section aria-label="Email submission details" data-email-submission-details={detail.submission.receiptId}>
           <h4>{detail.submission.subject || "Submitted email"}</h4>
           <p>Original content is shown as inert text. Sender and message content are untrusted; no instructions are executed.</p>
           <pre style={{ whiteSpace: "pre-wrap", overflowWrap: "anywhere" }}>{detail.safeBodyText}</pre>
+          {quarantine ? <section aria-label="Held for review" data-email-quarantine={quarantine.state}>
+            <h5>{QUARANTINE_LABELS[quarantine.state]}</h5>
+            {quarantine.state === "quarantined" ? <>
+              <p>This message was held privately and nothing was routed. Accept it to queue its links as if it had been accepted, or Reject it to close it. Sender identity and authentication signals never grant access; the decision is yours and is recorded.</p>
+              <label>Why? (optional)
+                <textarea value={reason} rows={3} maxLength={500} style={{ display: "block", width: "100%" }}
+                  onChange={(event) => setReasonByReceipt((current) => ({ ...current, [receiptKey]: event.target.value }))} />
+              </label>
+              <button type="button" data-email-decision="accept" disabled={busyDecision || !onDecide} onClick={() => void decide("accept")}>
+                <CheckIcon aria-hidden="true" size={16} /> Accept
+              </button>
+              <button type="button" data-email-decision="reject" disabled={busyDecision || !onDecide} onClick={() => void decide("reject")}>
+                <XIcon aria-hidden="true" size={16} /> Reject
+              </button>
+            </> : null}
+            {quarantine.decision ? <p data-email-decision-record>
+              {quarantine.decision.action === "accept" ? "Accepted" : "Rejected"}
+              {quarantine.decision.by ? ` by ${quarantine.decision.by}` : ""}{quarantine.decision.at ? ` on ${formatUtc(quarantine.decision.at)}` : ""}
+              {quarantine.decision.reason ? `. Why: ${quarantine.decision.reason}` : "."}
+            </p> : null}
+            {quarantine.failure ? <p role="alert">The decision could not be applied ({quarantine.failure}).</p> : null}
+            {quarantine.state === "expired" ? <p>This message expired and can no longer be accepted.</p> : null}
+            {notice && !accepted ? <p role="status" data-email-decision-result>{notice}</p> : null}
+          </section> : null}
           <h5>Candidate references ({detail.candidateLinks.length})</h5>
           <ul>{detail.candidateLinks.map((link, index) => <li key={`${link.url}-${index}`}>
-            {link.resolutionStatus === "unresolved" && !resolved[index]
+            {!accepted
+              ? <span>{link.title || "Source link"} <code>{link.url}</code></span>
+              : link.resolutionStatus === "unresolved" && !resolved[index]
               ? <span>{link.title || "Newsletter article link"} (tracking redirect not opened)</span>
               : <a href={(resolved[index]?.url ?? link.url)} target="_blank" rel="noreferrer noopener">{resolved[index]?.title ?? (link.title || "Source link")}</a>}
-            <label>
+            {accepted ? <label>
               <input type="checkbox" checked={selected[index] ?? false}
                 disabled={link.resolutionStatus === "unresolved" && !resolved[index]}
                 onChange={(event) => setSelectedByReceipt((current) => ({ ...current, [receiptKey]: { ...current[receiptKey], [index]: event.target.checked } }))} />
               Add as pending Reference
-            </label>
-            {link.resolutionStatus === "unresolved" && !resolved[index] ? (
+            </label> : null}
+            {accepted && link.resolutionStatus === "unresolved" && !resolved[index] ? (
               <button type="button" disabled={busyIndex !== null || !onResolveArticleLink} onClick={() => void resolveLink(index)}>
                 {busyIndex === index ? "Resolving…" : "Resolve article redirect (may register a click)"}
               </button>
             ) : null}
           </li>)}</ul>
-          <p>Adding links creates or reuses pending References. It does not approve, label, classify, or publish them.</p>
-          <button type="button" disabled={busyImport || !onImportCandidates || !detail.submission.corpusId}
-            onClick={() => void importSelected()}>
-            {busyImport ? "Adding References…" : "Add selected links to References"}
-          </button>
-          {notice ? <p role="status" data-email-import-result>{notice}</p> : null}
-          {importedReferences.length ? <ul>{importedReferences.map((reference, index) => (
-            <li key={`${reference.id}-${index}`}><Link href={getNewsroomNavHref(`/newsroom/references/${encodeURIComponent(reference.lineageId)}`, false)}>Review imported Reference {index + 1}</Link></li>
-          ))}</ul> : null}
+          {accepted ? <>
+            <p>Adding links creates or reuses pending References. It does not approve, label, classify, or publish them.</p>
+            <button type="button" disabled={busyImport || !onImportCandidates || !detail.submission.corpusId}
+              onClick={() => void importSelected()}>
+              {busyImport ? "Adding References…" : "Add selected links to References"}
+            </button>
+            {notice ? <p role="status" data-email-import-result>{notice}</p> : null}
+            {importedReferences.length ? <ul>{importedReferences.map((reference, index) => (
+              <li key={`${reference.id}-${index}`}><Link href={getNewsroomNavHref(`/newsroom/references/${encodeURIComponent(reference.lineageId)}`, false)}>Review imported Reference {index + 1}</Link></li>
+            ))}</ul> : null}
+          </> : <p>Links stay inert text, and nothing can be added to References, until this message is accepted.</p>}
         </section>
       ) : detail && "error" in detail ? <p role="alert">You cannot read this submission.</p>
         : detail && "state" in detail ? <p role="alert">Submission details are unavailable.</p> : null}
@@ -251,8 +353,9 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
   );
 }
 
-function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onImportCandidates }: {
-  data: MonitoringOverview; demo: boolean; emailDetail: MonitoringEmailDetails | null; onEmailOpen: (id: string) => void;
+function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onImportCandidates, onDecide, paging }: {
+  data: MonitoringOverview; demo: boolean; paging?: MonitoringPaging; emailDetail: MonitoringEmailDetails | null; onEmailOpen: (id: string) => void;
+  onDecide?: (receiptId: string, decision: "accept" | "reject", reason: string) => Promise<EmailDecisionResult>;
   onResolveArticleLink?: (receiptId: string, candidateIndex: number) => Promise<MonitoringEmailArticleResolution>;
   onImportCandidates?: (receiptId: string, items: EmailReferenceImportItem[]) => Promise<EmailReferenceImportOutcome>;
 }) {
@@ -264,8 +367,10 @@ function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onI
       ) : null}
 
       <EmailSubmissions items={data.emailSubmissions ?? []} detail={emailDetail} onOpen={onEmailOpen}
+        cursor={data.cursors?.emailSubmissions} paging={paging}
         onResolveArticleLink={demo ? undefined : onResolveArticleLink}
-        onImportCandidates={demo ? undefined : onImportCandidates} />
+        onImportCandidates={demo ? undefined : onImportCandidates}
+        onDecide={demo ? undefined : onDecide} />
 
       <article className="news-desk-doctrine-card" data-monitoring-section="router">
         <div className="news-desk-doctrine-card__header"><div><h3>Router</h3><span>Sends collected items to the shared Cyclotron and delivers relevant ones to References</span></div></div>
@@ -323,6 +428,7 @@ function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onI
             ))}
           </ul>
         ) : <p>No collector runs recorded yet.</p>}
+        <LoadMore list="runs" cursor={data.cursors?.runs} paging={paging} />
         {data.routerRuns.length ? (
           <ul className="news-desk-monitoring__list" data-monitoring-router-runs>
             {data.routerRuns.map((run) => (
@@ -335,6 +441,7 @@ function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onI
             ))}
           </ul>
         ) : null}
+        <LoadMore list="routerRuns" cursor={data.cursors?.routerRuns} paging={paging} />
       </article>
 
       <article className="news-desk-doctrine-card" data-monitoring-section="queue">
@@ -344,6 +451,7 @@ function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onI
             {data.items.map((item) => <QueueItem key={`${item.monitorId ?? ""}-${item.sourceId}-${item.revision}`} item={item} ownId={data.scope.publicationId} demo={demo} />)}
           </ul>
         ) : <p>No items in the queue.</p>}
+        <LoadMore list="items" cursor={data.cursors?.items} paging={paging} />
         {data.hiddenNotRelevant > 0 ? (
           <p className="news-desk-delegation-note" data-monitoring-hidden>
             {data.hiddenNotRelevant} {data.hiddenNotRelevant === 1 ? "item" : "items"} judged not relevant to this publication {data.hiddenNotRelevant === 1 ? "is" : "are"} not listed.
@@ -373,7 +481,10 @@ export function MonitoringOverviewView({
   onEmailOpen = () => {},
   onResolveArticleLink,
   onImportCandidates,
+  onDecide,
+  paging,
 }: {
+  paging?: MonitoringPaging;
   result: MonitoringResult | null;
   canViewAll: boolean;
   mode: MonitoringMode;
@@ -383,6 +494,7 @@ export function MonitoringOverviewView({
   onEmailOpen?: (receiptId: string) => void;
   onResolveArticleLink?: (receiptId: string, candidateIndex: number) => Promise<MonitoringEmailArticleResolution>;
   onImportCandidates?: (receiptId: string, items: EmailReferenceImportItem[]) => Promise<EmailReferenceImportOutcome>;
+  onDecide?: (receiptId: string, decision: "accept" | "reject", reason: string) => Promise<EmailDecisionResult>;
 }) {
   let body: React.ReactNode;
   if (result === null) {
@@ -399,7 +511,7 @@ export function MonitoringOverviewView({
     body = <Message kind="empty" title="Nothing has been collected yet">No feed is configured and no run has been recorded. Items appear here after the collector&apos;s first run.</Message>;
   } else {
     body = <Ready data={result} demo={demo} emailDetail={emailDetail} onEmailOpen={onEmailOpen}
-      onResolveArticleLink={onResolveArticleLink} onImportCandidates={onImportCandidates} />;
+      onResolveArticleLink={onResolveArticleLink} onImportCandidates={onImportCandidates} onDecide={onDecide} paging={paging} />;
   }
   const scopeLine = result && "scope" in result
     ? (result.scope.mode === "all" ? "Showing the whole shared pipeline, every publication." : `Showing what is relevant to ${result.scope.publicationId ?? "this publication"}.`)