Every publish is sanctioned in exactly one of two ways:
- a routed human approval, or
- a scheduled time gate, set at submit
never both.
And right before the POST, a verifier checks the whole lineage again: who
submitted, who owns it, caption verbatim, image sha256 pinned at submit,
anchor binding. A forged row refuses with zero provider calls.