From edb42c1cae31244d4d34936b6b0709843a1eb4dd Mon Sep 17 00:00:00 2001
From: Michael Johnson <mjohnson459@gmail.com>
Date: Tue, 11 Aug 2026 21:31:44 +0100
Subject: [PATCH 1/3] Fleet UI: a dedicated pane for reviewing a candidate map
 before promoting it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

M4's rule is that uploading is not publishing, which leaves an operator a
decision to make — and the only thing on screen to make it with was a
timestamp in a `<select>`. Selecting a candidate showed nothing: the canvas
beside the picker was always the *canonical* basemap, so promotion was an act
of faith in a filename.

Three GETs answer "what am I promoting", mirroring `/v1/maps/<site>/<floor>/…`
for a revision that is not canonical: `…/revisions/<rev>/{map.json,map.png,
zones.json}`. Three things there are load-bearing. `read_map`'s **`image_url`
is now revision-aware** — a transform from the revision and pixels from
`/v1/maps` would have drawn the published map under the candidate's label,
which looks entirely convincing and is the exact failure being removed. The
zones read is revision-scoped and deliberately **not gated on a published
map** where `read_zones` is, because the review that matters most is the first
candidate on a floor with nothing published; that does not loosen the
vocabulary/binding split, since naming a revision is naming a map frame and
these stay off `/v1/zones`. And it reports **`source: revision|floor`**:
`_zones_file` falls back to the floor's `zones.yaml`, and inherited zones were
taught in a previous session's frame — they draw perfectly over the new map and
are wrong by however far the two origins differ, which no coordinate can say.

The browser gets a fourth pane (`ui/review.mjs`) rather than a mode on the map
pane. That pane is fleet operations: live robots on the published basemap,
follow, fit, dispatch. A candidate is a different map frame with no robots in
it, and the view has to grow zone editing, a carry-forward report and a build
report. So review is a *mode* — opening it stands the operations panes down at
every width, because two canvases (one canonical with robots, one a candidate
without) is the confusion a dedicated view avoids. It addresses a floor
directly from `/v1/sites`, not through the selected robot: the floor worth
reviewing is often one no robot is reporting. It shows every revision newest
first (invalid ones included, with their reason), the candidate's own map and
zones, why it is promotable, its provenance, and the promote button. The map
pane keeps only an `N candidates — review` signpost.

**The bootstrap deadlock is fixed.** A floor's revisions were fetched only
after its basemap loaded, behind an early return, so a floor whose only
revisions were candidates listed none of them — and the first promotion on any
floor could never be made from a browser. The two fetches are now independent.

Verified: `pytest mote_fleet/test` 250 passed (6 skipped without a broker;
`test_e2e_map_registry.py` passes against a real mosquitto), `ui_test.mjs` 42
passed under node, and `pixi run fleet-ui-check` 25/25 in a real headless
Chrome — including that the review canvas paints from a *revision's* image URL
rather than the canonical one, that a phone reaches the pane and its canvas
fits itself, and that the first promotion on a floor with nothing published
goes through end to end. The browser run caught two defects fixed here: the
promotion result note was wiped by the reload that followed it, and the phone
layout squeezed the review body's grid rows so the canvas landed on top of the
provenance.

Editing a candidate's zones is task 346, which lands in this pane's zone rows.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ArvMnoUP7kJbdnrZjeLftb
---
 CLAUDE.md                            |  23 +-
 docs/fleet/README.md                 |  58 +++-
 docs/fleet/fleet-api.md              |  54 ++++
 mote_fleet/server/bundle_store.py    |  51 +++-
 mote_fleet/server/fleet_server.py    |  32 +-
 mote_fleet/server/ui/app.mjs         | 139 +++++----
 mote_fleet/server/ui/index.html      |  54 +++-
 mote_fleet/server/ui/map.mjs         |  12 +-
 mote_fleet/server/ui/review.mjs      | 440 +++++++++++++++++++++++++++
 mote_fleet/server/ui/style.css       | 176 +++++++++++
 mote_fleet/test/browser_check.mjs    | 171 ++++++++++-
 mote_fleet/test/test_map_registry.py | 133 ++++++++
 mote_fleet/test/ui_check.py          |  40 +++
 mote_fleet/test/ui_test.mjs          | 227 +++++++++++++-
 14 files changed, 1515 insertions(+), 95 deletions(-)
 create mode 100644 mote_fleet/server/ui/review.mjs

diff --git a/CLAUDE.md b/CLAUDE.md
index 9ccbfe6..c5dfe29 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -109,7 +109,7 @@ Milestone M2 of `docs/design/fleet.md`; the operator flow is `docs/fleet/README.
 
 ## Fleet: the operator view + dispatch API (M3)
 
-Milestone M3 of `docs/design/fleet.md`, and the end of v0. The **HTTP** wire is specified as its own versioned contract in **`docs/fleet/fleet-api.md`** (M1's MQTT one is `control-plane.md`); the operator flow is `docs/fleet/README.md` §6–9 and the measurements are `m3-verification.md`. **The two directions of the loop take different paths on purpose.** *Reads* ride MQTT: the browser subscribes to `mote/v1/+/{presence,health,pose,task/status}` over WebSockets, and because all of those are retained it has the whole fleet's state within a second of loading — no polling, no service in the middle. *Writes* ride HTTP: `POST /v1/robots/<id>/dispatch` authorizes an operator token (`fleetctl operator new --name <you>`; the name is what the audit row records), writes the audit row, then publishes to the same `task/command` topic. **The topic tree did not change — only who publishes to it**, and `fleetctl dispatch` moved to the API too, so there is one write path rather than one per client. The command grammar is still parsed only by the robot's task layer: a parser in the server would be a second grammar to keep in step. **The browser cannot publish**: `server/ui/mqtt.mjs` is a hand-rolled subscribe-only MQTT 3.1.1 client that implements no PUBLISH packet, so the split is enforced by omission (M7 makes it structural with a subscribe-only broker credential). The UI is static ES modules — no bundler, no npm, no vendored library — served by the same stdlib `http.server`; `map.mjs` holds the Q5 world→pixel transform (`px = (wx-origin_x)/res`, `py = height - (wy-origin_y)/res`) and a pan/zoom/follow canvas, and only draws robots on the *same* site+floor as the selected one because a pose from another floor is a different map frame. **Basemaps come from site bundles on the fleet box** (`--maps-dir`, default `$MOTE_FLEET_HOME/sites`, the layout `sites.py` writes, seeded by rsync until **M4** makes the registry canonical behind the same two routes). **M1's websockets blocker is settled**: `pixi run fleet-broker` runs `eclipse-mosquitto` under docker with the repo's own `mosquitto.conf`, because conda-forge's build has none; `pixi run -e fleet fleet-broker-local` is the conda binary for a box without docker, and it strips the WS stanza and says so. Two things that run in the same file (`test_ui.py` → `ui_test.mjs`) are the MQTT codec and the transform, tested under node against the very files the browser loads; `browser_check.mjs` drives a real headless Chrome over CDP against a running stack and is an operator's tool, not a CI test — `pixi run fleet-ui-check` is that stack in one command (broker on ephemeral ports, server, a temp `MOTE_FLEET_HOME`, the sim's `office_world` bundle as the basemap, and `test/fake_robots.py`, which publishes `protocol.py` payloads and answers `task/command` and is *not* a second robot implementation), torn down afterwards; `-- --keep` leaves it up for UI work. It stays out of CI because it needs docker (conda's mosquitto still has no websockets) *and* a chrome, which the arm runner has not — the decision, and what wiring it in would take, are recorded in `m3-verification.md` §2 rather than left looking like coverage. **The phone is the realistic off-LAN client**, so below 760 px the three panes become one at a time behind a bottom tab bar (`server/ui/layout.mjs`), selecting a robot in the roster navigates to the map — what the desktop layout gets for free by showing both — and the canvas gained pinch-to-zoom (`pinchSpan`/`pinchUpdate` in `map.mjs`, pure and tested, because a division by a zero span puts NaN in the view scale and blanks the map for good) plus a fingertip-sized hit target. The breakpoint is a **silent** seam — CSS decides what is displayed, JS decides when a selection navigates, and disagreement yields a tab bar over stacked panes rather than an error — so it lives in `layout.mjs` and `ui_test.mjs` reads the stylesheet and holds it there, as it does for every pane having a tab and for `touch-action: none` on the canvas (without which the browser eats the drag and the pinch before a single pointer event arrives). Dispatch gained a **zone picker that writes `goto <zone>` into the command box rather than sending it**: the grammar stays the robot's, and the keyboard leaves the common case. Three pre-existing bugs fell out, all of which a desk hides: `hidden` does not hide an element whose class sets `display` (the empty promote picker), the canvas backing store was resized on width alone so a height change left the previous frame's scale bar under the new one, and the scale bar was drawn in the dark theme's near-white on a white basemap — a canvas gets no cascade, so it now reads `--dim` off the element. Measurements, including `browser_check.mjs`'s phone pass, are `m3-verification.md` §9; **a real device is still the acceptance** — emulation gets the viewport and the touch points right and the thumb wrong.
+Milestone M3 of `docs/design/fleet.md`, and the end of v0. The **HTTP** wire is specified as its own versioned contract in **`docs/fleet/fleet-api.md`** (M1's MQTT one is `control-plane.md`); the operator flow is `docs/fleet/README.md` §6–9 and the measurements are `m3-verification.md`. **The two directions of the loop take different paths on purpose.** *Reads* ride MQTT: the browser subscribes to `mote/v1/+/{presence,health,pose,task/status}` over WebSockets, and because all of those are retained it has the whole fleet's state within a second of loading — no polling, no service in the middle. *Writes* ride HTTP: `POST /v1/robots/<id>/dispatch` authorizes an operator token (`fleetctl operator new --name <you>`; the name is what the audit row records), writes the audit row, then publishes to the same `task/command` topic. **The topic tree did not change — only who publishes to it**, and `fleetctl dispatch` moved to the API too, so there is one write path rather than one per client. The command grammar is still parsed only by the robot's task layer: a parser in the server would be a second grammar to keep in step. **The browser cannot publish**: `server/ui/mqtt.mjs` is a hand-rolled subscribe-only MQTT 3.1.1 client that implements no PUBLISH packet, so the split is enforced by omission (M7 makes it structural with a subscribe-only broker credential). The UI is static ES modules — no bundler, no npm, no vendored library — served by the same stdlib `http.server`; `map.mjs` holds the Q5 world→pixel transform (`px = (wx-origin_x)/res`, `py = height - (wy-origin_y)/res`) and a pan/zoom/follow canvas, and only draws robots on the *same* site+floor as the selected one because a pose from another floor is a different map frame. **Basemaps come from site bundles on the fleet box** (`--maps-dir`, default `$MOTE_FLEET_HOME/sites`, the layout `sites.py` writes, seeded by rsync until **M4** makes the registry canonical behind the same two routes). **M1's websockets blocker is settled**: `pixi run fleet-broker` runs `eclipse-mosquitto` under docker with the repo's own `mosquitto.conf`, because conda-forge's build has none; `pixi run -e fleet fleet-broker-local` is the conda binary for a box without docker, and it strips the WS stanza and says so. Two things that run in the same file (`test_ui.py` → `ui_test.mjs`) are the MQTT codec and the transform, tested under node against the very files the browser loads; `browser_check.mjs` drives a real headless Chrome over CDP against a running stack and is an operator's tool, not a CI test — `pixi run fleet-ui-check` is that stack in one command (broker on ephemeral ports, server, a temp `MOTE_FLEET_HOME`, the sim's `office_world` bundle as the basemap, and `test/fake_robots.py`, which publishes `protocol.py` payloads and answers `task/command` and is *not* a second robot implementation), torn down afterwards; `-- --keep` leaves it up for UI work. It stays out of CI because it needs docker (conda's mosquitto still has no websockets) *and* a chrome, which the arm runner has not — the decision, and what wiring it in would take, are recorded in `m3-verification.md` §2 rather than left looking like coverage. **A fourth pane, `review`, is where a candidate map is looked at and promoted** (`server/ui/review.mjs`; routes and rationale under the map registry below). It is a *mode*, not a column: opening it stands the operations panes down at every width, because two canvases — one canonical with robots on it, one a candidate without — is the confusion a dedicated view exists to remove. **The phone is the realistic off-LAN client**, so below 760 px the panes become one at a time behind a bottom tab bar (`server/ui/layout.mjs`), selecting a robot in the roster navigates to the map — what the desktop layout gets for free by showing both — and the canvas gained pinch-to-zoom (`pinchSpan`/`pinchUpdate` in `map.mjs`, pure and tested, because a division by a zero span puts NaN in the view scale and blanks the map for good) plus a fingertip-sized hit target. The breakpoint is a **silent** seam — CSS decides what is displayed, JS decides when a selection navigates, and disagreement yields a tab bar over stacked panes rather than an error — so it lives in `layout.mjs` and `ui_test.mjs` reads the stylesheet and holds it there, as it does for every pane having a tab and for `touch-action: none` on the canvas (without which the browser eats the drag and the pinch before a single pointer event arrives). Dispatch gained a **zone picker that writes `goto <zone>` into the command box rather than sending it**: the grammar stays the robot's, and the keyboard leaves the common case. Three pre-existing bugs fell out, all of which a desk hides: `hidden` does not hide an element whose class sets `display` (the empty promote picker), the canvas backing store was resized on width alone so a height change left the previous frame's scale bar under the new one, and the scale bar was drawn in the dark theme's near-white on a white basemap — a canvas gets no cascade, so it now reads `--dim` off the element. Measurements, including `browser_check.mjs`'s phone pass, are `m3-verification.md` §9; **a real device is still the acceptance** — emulation gets the viewport and the touch points right and the thumb wrong.
 
 ## Fleet: the map registry (M4)
 
@@ -163,6 +163,27 @@ its map at startup, so health now carries the revision each robot is actually
 running. M3's `/v1/maps` routes kept their shape and changed source; the
 dashboard additionally draws the floor's taught zones (circle, polygon or
 waypoint cross) from `/v1/maps/<site>/<floor>/zones.json`.
+**Promotion is a decision, so the operator has to be able to see what they are
+deciding about** — and until the review pane existed the only thing on screen
+was a timestamp, the canvas beside the picker being always the *canonical*
+basemap. Three GETs answer it, the same three questions `/v1/maps` answers asked
+of a revision that is not canonical: `…/revisions/<rev>/{map.json,map.png,
+zones.json}`. Three things are load-bearing. `read_map`'s **`image_url` is
+revision-aware**, because a transform from the revision and pixels from
+`/v1/maps` would draw the published map under the candidate's label — convincing
+and wrong, which is the exact failure being removed. The zones read is
+**revision-scoped and deliberately not gated on a published map** where
+`read_zones` is (the review that matters most is the first candidate on a floor
+with nothing published), which does not loosen the vocabulary/binding split:
+naming a revision is naming a map frame, and these stay under `/v1/maps`-shaped
+paths and never under `/v1/zones`. And it reports **`source: revision|floor`**,
+because `_zones_file` falls back to the floor's `zones.yaml` and inherited zones
+were taught in a *previous* session's frame — they draw perfectly over the new
+map and are wrong by however far the two origins differ, which no coordinate can
+say. One UI ordering bug fell out and is fixed in both panes: the floor's
+revisions were fetched only *after* its basemap loaded, behind an early return,
+so a floor whose only revisions were candidates listed none of them and **the
+first promotion on any floor could never be made from a browser**.
 
 ## Fleet: the zone vocabulary
 
diff --git a/docs/fleet/README.md b/docs/fleet/README.md
index 69987ac..516ae34 100644
--- a/docs/fleet/README.md
+++ b/docs/fleet/README.md
@@ -623,8 +623,10 @@ heartbeats stopped.
 
 `fleet-server` serves the operator view at `http://<fleet-box>:8080/`. It is the
 fleet-wide picture — who is out there, where they are, what they are doing, and
-sending one of them somewhere — and nothing else: the deep single-robot view
-(3D, sensors, teleop) is Foxglove's job (M2), which each robot row deep-links to.
+sending one of them somewhere — plus the one decision the fleet cannot make for
+you: which map a floor should be on (the **review** pane, §11). The deep
+single-robot view (3D, sensors, teleop) is Foxglove's job (M2), which each robot
+row deep-links to.
 
 ![The fleet dashboard](../images/fleet-ui.webp)
 
@@ -662,14 +664,17 @@ outline for a `polygon`, a cross for a bare waypoint, each labelled — so the
 canonical revision, in that revision's map frame.
 
 Beside the map's floor label is the **canonical revision** it is showing, and,
-when a robot has published one, a picker to promote a candidate onto the floor
-(§11). Both need the operator token; without one the pane is read-only.
+when the floor has candidates waiting, a button into the **review** pane —
+which is where a candidate is looked at and promoted (§11). The map pane keeps
+no promote control of its own: this canvas draws robots on the *published*
+basemap, so promoting from beside it would mean promoting a map you have not
+seen.
 
 ![The dashboard on a phone](../images/fleet-ui-phone.webp)
 
 **On a phone.** The realistic off-LAN client is a phone — it is what an operator
 has in a corridor, and "where is the robot and what is it doing" is exactly the
-question you ask from one. Below 760 px the three panes become **one at a time**
+question you ask from one. Below 760 px the four panes become **one at a time**
 behind a tab bar at the bottom of the screen, within thumb reach, so the map
 gets the whole display instead of a couple of hundred pixels between the roster
 and the detail pane. Two things follow from losing the side-by-side view:
@@ -862,7 +867,48 @@ pixi run -e fleet fleetctl -- promote home ground 20260728T090412
 #   announced on mote/v1/registry/site/home/floor/ground/current (retained); agents will pull it
 ```
 
-The dashboard does the same thing with a picker beside the map (§9).
+### Reviewing one before you promote it
+
+`fleetctl sites <site> <floor>` tells you a revision is *valid*. It cannot tell
+you whether it is the map you want, and for a long time neither could the
+dashboard: the promote picker listed candidates as timestamps and the canvas
+beside it was always the published basemap, so a promotion was an act of faith
+in a filename. The dashboard's **review** pane is where that decision is now
+made.
+
+Open it from the tab bar, or from the map pane's `N candidates — review` button,
+which appears whenever the floor on screen has something waiting. It shows:
+
+- **A site/floor picker of its own**, fed by the registry rather than by which
+  robot is selected. The floor worth reviewing is often one no robot is
+  reporting — mapped by a robot since switched off, or side-loaded.
+- **Every revision of that floor**, newest first, the published one included so
+  you can see what you would be replacing. A revision the validator refused is
+  listed too, with its reason, because "why can I not promote the map my robot
+  just published" is a question this pane should answer.
+- **The candidate's own map**, drawn from that revision's own image — not the
+  published one — with its own zones over it. Switching between two candidates
+  keeps the viewport, which is how you compare them.
+- **Why it is promotable**: the validator's verdict and warnings, plus where the
+  revision came from, when it was mapped, its size and resolution, the free/
+  occupied/unknown split, whether it carries a posegraph (i.e. whether mapping
+  can be continued in this frame), its bytes and digest.
+- **The zones in it**, and — the part that is easy to miss — whether they are
+  the revision's own or **inherited from the floor**. Inherited zones were
+  taught in a previous session's frame: they draw perfectly over the new map and
+  are wrong by however far the two origins differ. The pane says so in words,
+  because the canvas cannot.
+- **The promote button**, which is the same audited flip `fleetctl promote`
+  makes.
+
+Everything except that button is a read. Nothing you do here changes any floor
+until you promote.
+
+**A floor with nothing published yet works the same way** — which was not always
+true: the dashboard used to fetch a floor's revisions only after its basemap had
+loaded, so a floor whose only revisions were candidates listed none of them and
+its first promotion could not be made in a browser at all. Reviewing and
+promoting the first map on a floor is now the ordinary path.
 
 ### What the robots then do
 
diff --git a/docs/fleet/fleet-api.md b/docs/fleet/fleet-api.md
index 4a24fef..fb42e4e 100644
--- a/docs/fleet/fleet-api.md
+++ b/docs/fleet/fleet-api.md
@@ -97,6 +97,9 @@ GET  /v1/sites                           the registry: every floor + its canonic
 GET  /v1/sites/<site>/floors/<floor>     every revision, validated, with provenance
 POST     …/revisions/<rev>               upload a candidate revision (a robot)
 GET      …/revisions/<rev>/bundle.tar.gz pull a revision (a robot)
+GET      …/revisions/<rev>/map.json      that revision's own transform + size
+GET      …/revisions/<rev>/map.png       that revision's own image
+GET      …/revisions/<rev>/zones.json    that revision's own zone binding
 POST     …/revisions/<rev>/promote       make it canonical (an operator)
 GET  /                                   the operator UI (static files)
 ```
@@ -451,6 +454,51 @@ a temporary directory, renames it into `maps/<rev>/`, and flips the local `map`
 symlink — so a half-transferred revision is never visible and nothing has to be
 undone if the transfer dies.
 
+### `GET …/revisions/<rev>/map.json`, `…/map.png`, `…/zones.json`
+
+The same three questions `/v1/maps/<site>/<floor>/…` answers, asked of a
+revision that is **not** the floor's canonical one. Uploading is not publishing,
+so an operator has a decision to make; these are what lets them see what they
+are deciding about, and they are what the dashboard's review pane reads.
+
+`map.json` is `/v1/maps`' payload with `revision` naming this revision and
+`image_url` pointing at *this* route's `map.png`:
+
+```json
+{"schema":1,"site":"home","floor":"ground","revision":"20260802T145731",
+ "resolution":0.05,"origin":[-2.927,-2.934,0.0],"width":438,"height":238,
+ "image":"map.png",
+ "image_url":"/v1/sites/home/floors/ground/revisions/20260802T145731/map.png"}
+```
+
+That URL is load-bearing. `/v1/maps/<site>/<floor>/map.png` serves whatever is
+*published*, so a client that took the transform from here and the pixels from
+there would draw the map the operator already has under the candidate's label —
+which looks entirely convincing and is the exact failure this route removes.
+
+`zones.json` carries one extra field over the canonical route:
+
+```json
+{"schema":1,"site":"home","floor":"ground","revision":"20260802T145731",
+ "source":"floor","frame_id":"map","zones":[…]}
+```
+
+`source` is `revision` when the revision carries its own `zones.yaml` and
+`floor` when it inherits the floor's. The difference matters and the coordinates
+cannot express it: inherited zones were taught in a *previous* SLAM session's
+frame, so they draw perfectly over this map and are wrong by however far the two
+origins differ.
+
+Unlike `read_zones` on the canonical route, this is **not gated on there being a
+published map** — the review that matters most is the first candidate on a floor
+with nothing published at all. That does not loosen the vocabulary/binding
+split: these are still coordinates, still served under a path bound to a
+basemap, and still never over `/v1/zones`. Naming a revision is naming a map
+frame.
+
+All three are reads, so like every other read route they take no operator token;
+M7 changes that for all of them at once.
+
 ---
 
 ## What the browser is allowed to do
@@ -461,3 +509,9 @@ listener with a client that implements no PUBLISH packet
 ([`ui/mqtt.mjs`](../../mote_fleet/server/ui/mqtt.mjs)) — the split is enforced by
 omission, not by intention. M7 makes that structural on the broker side too,
 with a subscribe-only credential.
+
+**Reviewing a candidate is all GETs.** The review pane reads a revision's
+`map.json`, `map.png` and `zones.json` and writes nothing; its one write is the
+`promote` M4 already had, which is authorized and audited like any other. Zone
+*editing* is a separate write (`POST …/floors/<floor>/zones`) that derives a new
+candidate and still changes no published floor.
diff --git a/mote_fleet/server/bundle_store.py b/mote_fleet/server/bundle_store.py
index f883145..eecd31b 100644
--- a/mote_fleet/server/bundle_store.py
+++ b/mote_fleet/server/bundle_store.py
@@ -232,8 +232,11 @@ def _report(self, directory: Path, upload: dict) -> dict:
                 pass  # a read-only store still answers, just without the cache
         return report.as_dict()
 
+    def revision_url(self, site: str, floor: str, revision: str, leaf: str) -> str:
+        return f"/v1/sites/{site}/floors/{floor}/revisions/{revision}/{leaf}"
+
     def bundle_url(self, site: str, floor: str, revision: str) -> str:
-        return f"/v1/sites/{site}/floors/{floor}/revisions/{revision}/bundle.tar.gz"
+        return self.revision_url(site, floor, revision, "bundle.tar.gz")
 
     def read_map(self, site: str, floor: str, revision: str | None = None) -> dict:
         """A floor's map metadata for the world→pixel transform (Q5).
@@ -243,6 +246,14 @@ def read_map(self, site: str, floor: str, revision: str | None = None) -> dict:
         revision on upload and the same the robot writes against — M3 shipped a
         hand-rolled reader here with a note that M4 would replace it, and this
         is that.
+
+        ``image_url`` names the route the caller must fetch to get *these*
+        pixels, which is not the same route in both cases: the canonical map is
+        served under ``/v1/maps`` and a named revision under its own path. A
+        payload describing a candidate's transform while pointing at the
+        canonical image is the one failure the review view exists to remove —
+        the operator would be shown the map they already have, labelled as the
+        one they are about to promote.
         """
         directory = self.revision_dir(site, floor, revision or self._live(site, floor))
         meta = bundle.read_map(directory / bundle.MAP_YAML)
@@ -259,7 +270,11 @@ def read_map(self, site: str, floor: str, revision: str | None = None) -> dict:
             site=site,
             floor=floor,
             revision=self.canonical(site, floor) if revision is None else revision,
-            image_url=f"/v1/maps/{site}/{floor}/map.png",
+            image_url=(
+                f"/v1/maps/{site}/{floor}/map.png"
+                if revision is None
+                else self.revision_url(site, floor, revision, "map.png")
+            ),
         )
         meta["_image_path"] = str(image)
         return meta
@@ -291,6 +306,38 @@ def read_zones(self, site: str, floor: str) -> dict:
             "zones": list(zones["zones"].values()),
         }
 
+    def read_revision_zones(self, site: str, floor: str, revision: str) -> dict:
+        """One **revision's** zones, for the operator reviewing it.
+
+        Still a binding, and still served the way a binding must be: under the
+        revision's own path, beside the revision's own basemap, never over
+        ``/v1/zones``. What it drops is :meth:`read_zones`' gate on there being
+        a published map — which is the one thing that would make it useless
+        here, because the review that matters most is the *first* candidate on
+        a floor with nothing published at all. Naming a revision is naming a
+        map frame, so the coordinates still arrive with something to mean.
+        """
+        # An unknown revision is a 404 about the revision rather than about the
+        # zones, and the floor-level fallback below must not answer for one.
+        directory = self.revision_dir(site, floor, revision)
+        path = self._zones_file(site, floor, revision=revision)
+        if path is None:
+            raise StoreError(f"no zones for {site}/{floor}/{revision}", 404)
+        zones = bundle.read_zones(path)
+        return {
+            "site": site,
+            "floor": floor,
+            "revision": revision,
+            # Which of ``_zones_file``'s two candidates answered. The reviewer
+            # cannot tell from the coordinates, and the difference is the trap
+            # M4 named: a revision carrying no zones inherits the floor's, which
+            # were taught in a *previous* SLAM session's frame and are therefore
+            # wrong for this map by exactly however far the two origins differ.
+            "source": "revision" if path.parent == directory else "floor",
+            "frame_id": zones["frame_id"],
+            "zones": list(zones["zones"].values()),
+        }
+
     def read_vocabulary(self, site: str, floor: str) -> dict:
         """The floor's zone **vocabulary** — names, kinds and aliases, no
         coordinates and no frame.
diff --git a/mote_fleet/server/fleet_server.py b/mote_fleet/server/fleet_server.py
index 2705b19..005a01a 100644
--- a/mote_fleet/server/fleet_server.py
+++ b/mote_fleet/server/fleet_server.py
@@ -33,6 +33,9 @@
     GET  /v1/sites/<site>/floors/<floor>     revisions, validated, with provenance
     POST     .../revisions/<rev>             upload a candidate revision (robot)
     GET      .../revisions/<rev>/bundle.tar.gz   pull one (robot)
+    GET      .../revisions/<rev>/map.json    that revision's own Q5 transform
+    GET      .../revisions/<rev>/map.png     that revision's own image
+    GET      .../revisions/<rev>/zones.json  that revision's own zone binding
     POST     .../revisions/<rev>/promote     make it canonical (operator)
     POST /v1/sites/<site>/floors/<floor>/zones  edited zones -> new candidate (operator)
     GET  /                                   the operator UI (static files)
@@ -132,10 +135,13 @@
 # test without a package.json declaring the tree a module.
 mimetypes.add_type("text/javascript", ".mjs")
 
-#: Route shape for the registry's per-revision paths.
+#: Route shape for the registry's per-revision paths. The three review leaves
+#: mirror ``/v1/maps/<site>/<floor>/…`` exactly, because they answer the same
+#: three questions about a revision that is *not* the floor's canonical one —
+#: which is what an operator has to see before promoting it.
 REVISION_RE = re.compile(
     r"^(?P<site>[^/]+)/floors/(?P<floor>[^/]+)/revisions/(?P<revision>[^/]+)"
-    r"(?P<leaf>/promote|/bundle\.tar\.gz)?$"
+    r"(?P<leaf>/promote|/bundle\.tar\.gz|/map\.json|/map\.png|/zones\.json)?$"
 )
 
 
@@ -532,8 +538,17 @@ def _map(self, rest: str):
         if leaf == "zones.json":
             self._store(lambda store: store.read_zones(site, floor))
             return
+        self._send_map(leaf, lambda store: store.read_map(site, floor))
+
+    def _send_map(self, leaf: str, load):
+        """``map.json`` or ``map.png`` from one ``read_map`` call.
+
+        Shared by the canonical basemap and by a revision under review, so the
+        transform and the pixels a client is handed can never come from
+        different reads of the store.
+        """
         try:
-            meta = self.server.store.read_map(site, floor)
+            meta = load(self.server.store)
         except StoreError as exc:
             self._error(exc.code, str(exc))
             return
@@ -609,13 +624,22 @@ def _registry_get(self, rest: str):
                 self._store(lambda store: store.detail(site, floor))
             return
         match = REVISION_RE.match(rest)
-        if not match or match.group("leaf") != "/bundle.tar.gz":
+        # `/promote` is a POST, and a bare revision path has nothing to answer:
+        # both are 404 here rather than falling through to the bundle.
+        if not match or match.group("leaf") in (None, "/promote"):
             self._error(404, f"no route /v1/sites/{rest}")
             return
         site, floor = match.group("site"), match.group("floor")
         revision = match.group("revision")
         if not self._names(site, floor, revision):
             return
+        leaf = match.group("leaf").lstrip("/")
+        if leaf == "zones.json":
+            self._store(lambda store: store.read_revision_zones(site, floor, revision))
+            return
+        if leaf in ("map.json", "map.png"):
+            self._send_map(leaf, lambda store: store.read_map(site, floor, revision))
+            return
         try:
             blob = self.server.store.pack(site, floor, revision)
         except StoreError as exc:
diff --git a/mote_fleet/server/ui/app.mjs b/mote_fleet/server/ui/app.mjs
index 0167b26..e0e931b 100644
--- a/mote_fleet/server/ui/app.mjs
+++ b/mote_fleet/server/ui/app.mjs
@@ -15,6 +15,7 @@
 import { BrokerReader, parseTopic } from './mqtt.mjs';
 import { MapView } from './map.mjs';
 import { ZoneEditor } from './zone_editor.mjs';
+import { ReviewView } from './review.mjs';
 import { setupPanes } from './layout.mjs';
 
 const TOKEN_KEY = 'mote.operator.token';
@@ -42,6 +43,7 @@ const state = {
 const dom = {};
 let mapView = null;
 let editor = null;
+let review = null;
 let panes = null;
 let pending = false;
 
@@ -192,6 +194,12 @@ async function ensureMap(record) {
     return;
   }
   dom.mapLabel.textContent = key;
+  // What revisions the floor has does not depend on it having a published map,
+  // and must not be fetched as though it did. This used to sit after the
+  // basemap fetch, behind its early return, so a floor whose only revisions
+  // were candidates reported no candidates — and the first promotion on any
+  // floor could never be made from the browser (observed live, 2026-08-02).
+  loadFloor(site, floor, key);
   try {
     const meta = await api(`/v1/maps/${site}/${floor}/map.json`);
     const image = new Image();
@@ -209,7 +217,6 @@ async function ensureMap(record) {
   api(`/v1/maps/${site}/${floor}/zones.json`)
     .then((body) => state.mapKey === key && setZones(body.zones))
     .catch(() => state.mapKey === key && setZones([]));
-  loadFloor(site, floor, key);
 }
 
 // Taught places go two ways: onto the basemap, and into the dispatch picker.
@@ -233,29 +240,25 @@ async function loadFloor(site, floor, key) {
   renderRevisions();
 }
 
-// Which revision the floor is on, and what else could be promoted onto it. A
-// candidate is a map some robot published that changes nothing until an
-// operator says so, so this is where that decision is made.
+// Which revision the floor is on, and whether anything is waiting to replace
+// it. The decision is deliberately *not* made here: this canvas draws live
+// robots on the **canonical** basemap, so a promote button beside it would be
+// a promotion made without ever seeing the map being promoted — which is what
+// the review pane exists to end. This is the signpost to it.
+//
+// Candidates the validator refused are counted too: "why can I not promote the
+// map my robot just published" is a question the review pane can answer and a
+// filtered-out row cannot.
 function renderRevisions() {
   const floor = state.floor;
-  if (!floor) {
-    dom.revisions.hidden = true;
-    dom.mapRevision.textContent = '';
-    return;
-  }
-  dom.mapRevision.textContent = floor.canonical || 'no published map';
-  const candidates = floor.revisions.filter(
-    (revision) => !revision.canonical && revision.ok,
-  );
-  dom.revisions.hidden = candidates.length === 0;
-  dom.revision.replaceChildren(
-    ...candidates.map((revision) =>
-      el('option', {
-        value: revision.revision,
-        text: `${revision.revision}${revision.robot_id ? ` · ${revision.robot_id}` : ''}`,
-      }),
-    ),
-  );
+  dom.mapRevision.textContent = floor ? floor.canonical || 'no published map' : '';
+  const candidates = floor
+    ? floor.revisions.filter((revision) => !revision.canonical)
+    : [];
+  dom.reviewJump.hidden = candidates.length === 0;
+  dom.reviewJump.textContent = `${candidates.length} candidate${
+    candidates.length === 1 ? '' : 's'
+  } — review`;
 }
 
 // The zones of the floor on screen, as a `goto` the operator does not have to
@@ -278,29 +281,18 @@ function onZone() {
   dom.dispatchNote.className = 'note';
 }
 
-async function onPromote(event) {
-  event.preventDefault();
-  const revision = dom.revision.value;
-  if (!state.floor || !revision) return;
-  const { site, floor } = state.floor;
-  dom.promoteNote.textContent = `promoting ${revision}…`;
-  dom.promoteNote.className = 'note';
-  try {
-    const body = await api(
-      `/v1/sites/${site}/floors/${floor}/revisions/${revision}/promote`,
-      { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{"schema":1}' },
-    );
-    dom.promoteNote.textContent = body.announced
-      ? `${site}/${floor} is on ${body.revision}; robots will pull it`
-      : `promoted, but not announced: ${body.detail}`;
-    // Re-read the floor rather than assume: the basemap on screen is now a
-    // different map.
-    state.mapKey = null;
-    scheduleRender();
-  } catch (error) {
-    dom.promoteNote.textContent = error.message;
-    dom.promoteNote.className = 'note error';
-  }
+// Into the review pane, on the floor already on screen. Promotion lives there
+// because that is where the candidate's own map is drawn.
+function onReviewJump() {
+  panes.show('review');
+  if (state.mapKey) review.open(state.mapKey);
+}
+
+// A promotion happened in the review pane: this pane's basemap is now a
+// different map, so re-resolve it rather than keep drawing the old one.
+function onPromoted() {
+  state.mapKey = null;
+  scheduleRender();
 }
 
 // Editing starts from the zones on screen — the canonical floor's — and never
@@ -330,7 +322,7 @@ async function onSaveZones() {
     });
     editor.finish();
     dom.zonesEdit.disabled = false;
-    dom.promoteNote.textContent = `zone candidate ${body.revision} saved \u2014 the zones shown are the candidate's; pick it in the picker and promote it`;
+    dom.promoteNote.textContent = `zone candidate ${body.revision} saved \u2014 the zones shown are the candidate's; open review to see it and promote it`;
     dom.promoteNote.className = 'note';
     await loadFloor(site, floor, state.mapKey);
   } catch (error) {
@@ -604,12 +596,25 @@ function bind() {
     token: 'token',
     mapLabel: 'map-label',
     mapRevision: 'map-revision',
-    revisions: 'revisions',
-    revision: 'revision',
+    reviewJump: 'review-jump',
     promoteNote: 'promote-note',
     canvas: 'map-canvas',
     follow: 'follow',
     fit: 'fit',
+    reviewFloors: 'review-floors',
+    reviewFloor: 'review-floor',
+    reviewCanonical: 'review-canonical',
+    reviewRevisions: 'review-revisions',
+    reviewVerdict: 'review-verdict',
+    reviewVerdictNotes: 'review-verdict-notes',
+    reviewProvenance: 'review-provenance',
+    reviewZones: 'review-zones',
+    reviewZoneSource: 'review-zone-source',
+    reviewCanvas: 'review-canvas',
+    reviewMapLabel: 'review-map-label',
+    reviewPromote: 'review-promote',
+    reviewFit: 'review-fit',
+    reviewNote: 'review-note',
     zonesEdit: 'zones-edit',
     zoneEditor: 'zone-editor',
     zoneRows: 'zone-rows',
@@ -636,10 +641,38 @@ export async function boot() {
       scheduleRender();
     },
   });
-  // The canvas has no size until its pane is on screen, so the map is told when
-  // it becomes visible rather than fitting into a hidden 0x0 box.
-  panes = setupPanes({ onShow: (name) => name === 'map' && mapView.shown() });
+  review = new ReviewView({
+    api,
+    onPromoted,
+    dom: {
+      canvas: dom.reviewCanvas,
+      floors: dom.reviewFloors,
+      floor: dom.reviewFloor,
+      canonical: dom.reviewCanonical,
+      revisions: dom.reviewRevisions,
+      verdict: dom.reviewVerdict,
+      verdictNotes: dom.reviewVerdictNotes,
+      provenance: dom.reviewProvenance,
+      zones: dom.reviewZones,
+      zoneSource: dom.reviewZoneSource,
+      mapLabel: dom.reviewMapLabel,
+      promote: dom.reviewPromote,
+      fit: dom.reviewFit,
+      note: dom.reviewNote,
+    },
+  });
+  // A canvas has no size until its pane is on screen, so each map is told when
+  // it becomes visible rather than fitting into a hidden 0x0 box. The review
+  // pane's canvas is hidden at *every* width until the pane is opened, so this
+  // is the only moment it can be fitted at all.
+  panes = setupPanes({
+    onShow: (name) => {
+      if (name === 'map') mapView.shown();
+      if (name === 'review') review.shown();
+    },
+  });
   dom.zone.addEventListener('change', onZone);
+  dom.reviewJump.addEventListener('click', onReviewJump);
   dom.fit.addEventListener('click', () => {
     mapView.follow(null);
     dom.follow.checked = false;
@@ -651,7 +684,6 @@ export async function boot() {
     mapView.draw();
   });
   dom.dispatch.addEventListener('submit', onDispatch);
-  dom.revisions.addEventListener('submit', onPromote);
   editor = new ZoneEditor(mapView, {
     panel: dom.zoneEditor,
     rows: dom.zoneRows,
@@ -670,6 +702,9 @@ export async function boot() {
   document.getElementById('contract').textContent = state.config.contract;
   await checkOperator();
   await loadRoster().catch((error) => console.warn('roster unavailable', error));
+  // The registry's floors, not the fleet's: a floor worth reviewing may have no
+  // robot reporting it at all.
+  await review.loadFloors().catch((error) => console.warn('registry unavailable', error));
 
   const { root, presence, health, pose, status } = state.config.topics;
   const reader = new BrokerReader({
diff --git a/mote_fleet/server/ui/index.html b/mote_fleet/server/ui/index.html
index 897b91c..7645ce2 100644
--- a/mote_fleet/server/ui/index.html
+++ b/mote_fleet/server/ui/index.html
@@ -44,11 +44,10 @@ <h2>map</h2>
           <span id="map-label" class="dim">—</span>
           <span id="map-revision" class="pill"></span>
           <!-- A candidate is a map a robot published; it changes nothing until
-               an operator promotes it here (or with fleetctl). -->
-          <form id="revisions" class="revisions" hidden>
-            <select id="revision" title="candidate map revisions for this floor"></select>
-            <button type="submit">promote</button>
-          </form>
+               an operator promotes it. Promotion happens in the review pane,
+               where the candidate's own map is on screen — this is only the
+               signpost that says there is something to look at. -->
+          <button id="review-jump" type="button" hidden></button>
           <label class="check"><input type="checkbox" id="follow" /> follow</label>
           <button id="fit" type="button">fit</button>
           <button id="zones-edit" type="button">edit zones</button>
@@ -68,6 +67,50 @@ <h2>map</h2>
         </div>
       </section>
 
+      <!-- Candidate review. Addressed by floor rather than by robot: the floor
+           worth reviewing is often one no robot is reporting. Everything it
+           reads is a GET of a *revision's* own routes, so what is on the canvas
+           is the map about to be promoted and not the one already published. -->
+      <section class="pane review-pane" data-pane="review">
+        <div class="pane-head">
+          <h2>review</h2>
+          <span id="review-map-label" class="dim">—</span>
+          <button id="review-fit" type="button">fit</button>
+        </div>
+
+        <div class="review-body">
+          <div class="review-side">
+            <div id="review-floors" class="review-floors" hidden>
+              <select id="review-floor" title="site and floor to review"></select>
+            </div>
+            <p class="dim">
+              published: <span id="review-canonical" class="pill">—</span>
+            </p>
+            <div id="review-revisions" class="revision-rows"></div>
+
+            <h3>why it is promotable</h3>
+            <p id="review-verdict" class="verdict"></p>
+            <ul id="review-verdict-notes" class="verdict-notes"></ul>
+            <div id="review-provenance" class="facts"></div>
+
+            <button id="review-promote" type="button" class="promote" disabled>
+              promote this revision
+            </button>
+            <p id="review-note" class="note"></p>
+          </div>
+
+          <div class="review-map">
+            <canvas id="review-canvas"></canvas>
+            <h3>zones</h3>
+            <!-- Which map frame these coordinates were taught in. A revision
+                 that carries no zones.yaml inherits the floor's, which is a
+                 different SLAM session's frame — the trap M4 named. -->
+            <p id="review-zone-source" class="dim"></p>
+            <div id="review-zones" class="zone-rows"></div>
+          </div>
+        </div>
+      </section>
+
       <section class="pane detail-pane" data-pane="detail">
         <div class="pane-head">
           <h2 id="detail-name">no robot selected</h2>
@@ -126,6 +169,7 @@ <h3>task status</h3>
         roster
       </button>
       <button type="button" data-pane="map" role="tab" aria-selected="false">map</button>
+      <button type="button" data-pane="review" role="tab" aria-selected="false">review</button>
       <button type="button" id="tab-detail" data-pane="detail" role="tab" aria-selected="false">
         robot
       </button>
diff --git a/mote_fleet/server/ui/map.mjs b/mote_fleet/server/ui/map.mjs
index f070c39..96fd4ce 100644
--- a/mote_fleet/server/ui/map.mjs
+++ b/mote_fleet/server/ui/map.mjs
@@ -134,8 +134,16 @@ export class MapView {
 
   // -- data -------------------------------------------------------------
 
-  setMap(map, image) {
-    const changed = !this.map || this.map.site !== map.site || this.map.floor !== map.floor;
+  // `refit` overrides the default test for a caller that knows better. The
+  // fleet map changes basemap only when it changes floor, so that is the test;
+  // the review view swaps between revisions *of* one floor, where holding the
+  // viewport is how two candidates get compared — but a revision of a different
+  // size has to be re-fitted or it lands off screen.
+  setMap(map, image, refit = null) {
+    const changed =
+      refit === null
+        ? !this.map || this.map.site !== map.site || this.map.floor !== map.floor
+        : refit;
     this.map = map;
     this.image = image;
     if (changed) {
diff --git a/mote_fleet/server/ui/review.mjs b/mote_fleet/server/ui/review.mjs
new file mode 100644
index 0000000..ea00ce6
--- /dev/null
+++ b/mote_fleet/server/ui/review.mjs
@@ -0,0 +1,440 @@
+// Candidate review: see the map you are about to promote, then promote it.
+//
+// M4's rule is that uploading is not publishing, which puts a decision in front
+// of an operator — and until this view existed, the only thing on screen to
+// make it with was a timestamp in a `<select>`. Selecting a candidate showed
+// nothing, because the canvas beside the picker was always the *canonical*
+// basemap. Promotion was therefore an act of faith (mapping-pipeline.md stage
+// 3, and an operator asking "how am I meant to verify it?" on 2026-08-02).
+//
+// Three things make this a pane of its own rather than a mode on the map pane:
+//
+//   - The map pane is fleet operations: live robots on the *published* basemap,
+//     follow, fit, dispatch. A candidate is a different map frame with no
+//     robots in it. Two meanings on one canvas is the confusion this avoids.
+//   - It addresses a floor **directly**. The map pane derives the floor on
+//     screen from the selected robot's pose or health, which is wrong here: the
+//     interesting floor is often one no robot is reporting — mapped by a robot
+//     since switched off, or (once the build stage lands) built on the fleet
+//     box with no robot involved at all.
+//   - It has room to grow. The carry-forward report, the build report, and the
+//     zone editing that turns a placeholder `zone_03` into `kitchen` all render
+//     here. The zone list below is deliberately a row per zone with its own
+//     cells, because that is where those controls go.
+//
+// The write surface does not grow: everything this view reads is a GET, and the
+// one thing it writes is the promote M4 already had.
+
+import { MapView } from './map.mjs';
+
+// -- routes ---------------------------------------------------------------
+
+// A revision's own leaves, which is the whole point: `/v1/maps/<site>/<floor>/`
+// serves whatever is *canonical*, so a review view built on those routes would
+// draw the map the operator already has and label it with the candidate's id —
+// the precise failure this replaces.
+export function revisionPath(site, floor, revision, leaf) {
+  return `/v1/sites/${site}/floors/${floor}/revisions/${revision}/${leaf}`;
+}
+
+export function floorPath(site, floor) {
+  return `/v1/sites/${site}/floors/${floor}`;
+}
+
+export function floorKey(site, floor) {
+  return `${site}/${floor}`;
+}
+
+export function parseFloorKey(key) {
+  const [site, floor] = String(key || '').split('/');
+  return site && floor ? { site, floor } : null;
+}
+
+// -- what the list says ---------------------------------------------------
+
+// Newest first: the candidate someone has come to look at is the one that just
+// arrived. The canonical revision stays in the list rather than being filtered
+// out of it — "what am I replacing" is half of the decision, and on a floor
+// with nothing published it is the answer "nothing yet".
+export function orderedRevisions(detail) {
+  return [...((detail && detail.revisions) || [])].reverse();
+}
+
+// Which revision to open a floor on. The newest promotable candidate, because
+// that is what a review is for; failing that the newest anything, so a floor
+// whose only candidates are broken still shows why.
+export function defaultRevision(detail) {
+  const ordered = orderedRevisions(detail);
+  return (
+    ordered.find((revision) => !revision.canonical && revision.ok) ||
+    ordered.find((revision) => !revision.canonical) ||
+    ordered[0] ||
+    null
+  );
+}
+
+// Why this revision may or may not be promoted, said before the click rather
+// than discovered by it. The verdict is the *validator's* — the same report the
+// server re-runs at promotion — so this can never encourage a promotion the
+// server will refuse, nor discourage one it would accept.
+export function promotability(revision) {
+  if (!revision) return { promotable: false, verdict: 'no revision selected', notes: [] };
+  const warnings = revision.warnings || [];
+  if (!revision.ok) {
+    return { promotable: false, verdict: 'not promotable', notes: revision.errors || [] };
+  }
+  if (revision.canonical) {
+    return { promotable: false, verdict: 'already the published map', notes: warnings };
+  }
+  return {
+    promotable: true,
+    verdict: warnings.length ? 'valid, with warnings' : 'valid — promotable',
+    notes: warnings,
+  };
+}
+
+function percent(fraction) {
+  return typeof fraction === 'number' ? `${(fraction * 100).toFixed(1)}%` : '—';
+}
+
+export function formatBytes(count) {
+  if (typeof count !== 'number') return '—';
+  if (count < 1024) return `${count} B`;
+  if (count < 1024 * 1024) return `${(count / 1024).toFixed(1)} kB`;
+  return `${(count / 1024 / 1024).toFixed(1)} MB`;
+}
+
+// Everything the registry already knows about a revision, which is everything
+// needed to judge one: where it came from, what the validator measured in it,
+// and what it would replace. No new payload — `detail()` has carried all of
+// this since M4; there was simply nowhere to show it.
+export function provenanceRows(revision) {
+  if (!revision) return [];
+  const map = revision.map || {};
+  const occupancy = revision.occupancy || {};
+  const meta = revision.meta || {};
+  const zones = revision.zones || [];
+  return [
+    ['revision', revision.revision],
+    ['uploaded', revision.uploaded_at || 'not by this server (seeded on disk)'],
+    ['from', revision.robot_id || revision.uploaded_by || '—'],
+    ['mapped', meta.saved || '—'],
+    ['bag', meta.bag || '—'],
+    [
+      'size',
+      map.width && map.height
+        ? `${map.width}x${map.height} px at ${map.resolution} m/px`
+        : '—',
+    ],
+    [
+      'occupancy',
+      occupancy.total
+        ? `${percent(occupancy.free)} free · ${percent(occupancy.occupied)} occupied · ${percent(
+            occupancy.unknown,
+          )} unknown`
+        : '—',
+    ],
+    // A revision with no posegraph navigates perfectly and simply cannot be
+    // mapped further, which the validator reports as a warning rather than an
+    // error. Saying which it is here is cheaper than reading the warning.
+    ['posegraph', revision.files && revision.files['map.posegraph'] ? 'yes' : 'no — cannot be extended'],
+    // The zones *inside* the bundle, which is not always the set drawn beside
+    // it — see `zoneSource` for the difference and why it matters.
+    ['zones in bundle', zones.length ? `${zones.length}: ${zones.join(', ')}` : 'none'],
+    ['bytes', formatBytes(revision.bytes)],
+    ['sha256', revision.sha256 ? `${revision.sha256.slice(0, 16)}…` : '—'],
+  ];
+}
+
+// Where the zones on screen came from, which the coordinates cannot say. A
+// revision that carries none inherits the floor's — taught in a *previous* SLAM
+// session's frame, and so wrong for this map by however far the two origins
+// differ. That is a reason to look before promoting, which is what this pane is
+// for, so it is said out loud rather than left to the validator's warning list.
+export function zoneSource(source, count) {
+  if (!count) return 'this revision carries no zones';
+  if (source === 'floor') {
+    return 'inherited from the floor — this revision carries none, so these were taught on another map frame';
+  }
+  return 'taught in this revision’s own frame';
+}
+
+// One zone's geometry in a phrase. The vocabulary half (kind, aliases) is shown
+// in its own cells; this is the binding half, which is the half that is only
+// true against the map beside it.
+export function zoneSummary(zone) {
+  if (zone.polygon && zone.polygon.length >= 3) {
+    return `polygon, ${zone.polygon.length} vertices`;
+  }
+  if (typeof zone.radius === 'number') return `circle, r ${zone.radius} m`;
+  if (zone.x !== undefined && zone.y !== undefined) {
+    return `waypoint ${zone.x.toFixed(2)}, ${zone.y.toFixed(2)}`;
+  }
+  return 'no footprint';
+}
+
+// -- the view -------------------------------------------------------------
+
+function el(tag, attributes = {}, children = []) {
+  const node = document.createElement(tag);
+  for (const [key, value] of Object.entries(attributes)) {
+    if (key === 'class') node.className = value;
+    else if (key === 'text') node.textContent = value;
+    else if (key.startsWith('on')) node.addEventListener(key.slice(2), value);
+    else if (value !== null && value !== undefined) node.setAttribute(key, value);
+  }
+  for (const child of [].concat(children)) if (child) node.append(child);
+  return node;
+}
+
+export class ReviewView {
+  constructor({ api, dom, onPromoted = () => {} }) {
+    this.api = api;
+    this.dom = dom;
+    this.onPromoted = onPromoted;
+    this.floors = [];
+    this.key = null;
+    this.detail = null;
+    this.selected = null;
+    // Every load is stamped, and a load whose stamp is stale drops its result
+    // on the floor. Selecting a floor fires three fetches (detail, map, zones)
+    // and an image decode; without this, clicking through two candidates draws
+    // whichever finished last rather than the one selected.
+    this.epoch = 0;
+    this.map = new MapView(dom.canvas);
+    dom.floor.addEventListener('change', () => this.open(dom.floor.value));
+    dom.promote.addEventListener('click', () => this.promote());
+    dom.fit.addEventListener('click', () => {
+      this.map.fit();
+      this.map.draw();
+    });
+  }
+
+  // The pane's canvas has no size until the pane is on screen, so a fit done
+  // before that yields a scale of 0 and a map that stays blank for ever.
+  shown() {
+    this.map.shown();
+  }
+
+  // -- loading ----------------------------------------------------------
+
+  // Floors come from the registry's own list, not from what a robot is
+  // reporting: a floor nobody is standing on is exactly the one to review.
+  async loadFloors() {
+    try {
+      const body = await this.api('/v1/sites');
+      this.floors = body.sites || [];
+    } catch (error) {
+      this.floors = [];
+      this.note(`could not list floors: ${error.message}`, true);
+    }
+    this.renderFloors();
+    if (!this.key && this.floors.length) {
+      await this.open(floorKey(this.floors[0].site, this.floors[0].floor));
+    }
+  }
+
+  async open(key, revision = null) {
+    const parsed = parseFloorKey(key);
+    if (!parsed) return;
+    const epoch = (this.epoch += 1);
+    this.key = key;
+    this.dom.floor.value = key;
+    this.note('');
+    try {
+      this.detail = await this.api(floorPath(parsed.site, parsed.floor));
+    } catch (error) {
+      this.detail = null;
+      this.note(error.message, true);
+    }
+    if (epoch !== this.epoch) return;
+    this.renderRevisions();
+    const wanted =
+      (revision &&
+        orderedRevisions(this.detail).find((row) => row.revision === revision)) ||
+      defaultRevision(this.detail);
+    await this.select(wanted, epoch);
+  }
+
+  async select(revision, epoch = null) {
+    if (epoch === null) epoch = (this.epoch += 1);
+    this.selected = revision;
+    this.renderRevisions();
+    this.renderVerdict();
+    if (!revision) {
+      this.map.clearMap();
+      this.dom.mapLabel.textContent = this.detail
+        ? 'no revisions on this floor'
+        : 'no floor selected';
+      this.renderZones([]);
+      return;
+    }
+    const { site, floor } = parseFloorKey(this.key);
+    this.dom.mapLabel.textContent = `${this.key} · ${revision.revision}`;
+    try {
+      const meta = await this.api(revisionPath(site, floor, revision.revision, 'map.json'));
+      const image = new Image();
+      image.src = meta.image_url;
+      await image.decode();
+      if (epoch !== this.epoch) return;
+      // Two revisions of one floor are compared by switching between them, so
+      // the viewport is kept — unless the maps are different sizes, where
+      // keeping it would leave the new one off screen.
+      const sized = this.map.map;
+      const refit =
+        !sized || sized.width !== meta.width || sized.height !== meta.height;
+      this.map.setMap(meta, image, refit);
+    } catch (error) {
+      if (epoch !== this.epoch) return;
+      this.map.clearMap();
+      this.dom.mapLabel.textContent = `${this.key} · ${revision.revision} — ${error.message}`;
+    }
+    // A revision may legitimately carry no zones, which is a 404 and not a
+    // failure worth a red note.
+    try {
+      const body = await this.api(
+        revisionPath(site, floor, revision.revision, 'zones.json'),
+      );
+      if (epoch !== this.epoch) return;
+      this.map.setZones(body.zones || []);
+      this.renderZones(body.zones || [], body.source);
+    } catch (error) {
+      if (epoch !== this.epoch) return;
+      this.map.setZones([]);
+      this.renderZones([]);
+    }
+  }
+
+  // -- rendering --------------------------------------------------------
+
+  renderFloors() {
+    const current = this.key;
+    this.dom.floor.replaceChildren(
+      ...this.floors.map((entry) => {
+        const key = floorKey(entry.site, entry.floor);
+        const candidates = (entry.candidates || []).length;
+        return el('option', {
+          value: key,
+          text: candidates ? `${key} — ${candidates} candidate${candidates > 1 ? 's' : ''}` : key,
+        });
+      }),
+    );
+    if (current) this.dom.floor.value = current;
+    this.dom.floors.hidden = this.floors.length === 0;
+  }
+
+  renderRevisions() {
+    const revisions = orderedRevisions(this.detail);
+    this.dom.canonical.textContent = this.detail
+      ? this.detail.canonical || 'nothing published yet'
+      : '—';
+    this.dom.revisions.replaceChildren(
+      ...revisions.map((revision) =>
+        el(
+          'button',
+          {
+            type: 'button',
+            class: `revision-row ${
+              this.selected && this.selected.revision === revision.revision ? 'selected' : ''
+            } ${revision.ok ? '' : 'bad'}`,
+            onclick: () => this.select(revision),
+          },
+          [
+            el('span', { class: 'revision-id', text: revision.revision }),
+            el('span', {
+              class: 'revision-tag',
+              text: revision.canonical ? 'published' : 'candidate',
+            }),
+            el('span', {
+              class: 'revision-sub',
+              text: `${revision.robot_id || revision.uploaded_by || 'unattributed'} · ${
+                revision.ok ? 'valid' : revision.errors[0] || 'invalid'
+              }`,
+            }),
+          ],
+        ),
+      ),
+    );
+    if (!revisions.length) {
+      this.dom.revisions.replaceChildren(
+        el('p', { class: 'empty', text: 'no revisions on this floor' }),
+      );
+    }
+  }
+
+  renderVerdict() {
+    const { promotable, verdict, notes } = promotability(this.selected);
+    this.dom.verdict.textContent = verdict;
+    this.dom.verdict.className = `verdict ${
+      this.selected && !this.selected.ok ? 'error' : promotable ? 'ok' : ''
+    }`;
+    this.dom.verdictNotes.replaceChildren(
+      ...notes.map((note) => el('li', { text: note })),
+    );
+    this.dom.promote.disabled = !promotable;
+    this.dom.provenance.replaceChildren(
+      ...provenanceRows(this.selected).map(([key, value]) =>
+        el('div', { class: 'fact' }, [
+          el('span', { class: 'fact-key', text: key }),
+          el('span', { class: 'fact-value', text: String(value) }),
+        ]),
+      ),
+    );
+  }
+
+  // One row per zone, three cells. Read-only here on purpose — the write half
+  // (rename, alias, kind, click-to-teach a pose) is task 346, and it edits
+  // exactly these rows.
+  renderZones(zones, source = '') {
+    this.dom.zoneSource.textContent = zoneSource(source, zones.length);
+    this.dom.zones.replaceChildren(
+      ...zones.map((zone) =>
+        el('div', { class: 'zone-row' }, [
+          el('span', { class: 'zone-name', text: zone.display_name || zone.name }),
+          el('span', { class: 'zone-kind', text: zone.kind || 'area' }),
+          el('span', { class: 'dim', text: zoneSummary(zone) }),
+        ]),
+      ),
+    );
+  }
+
+  note(text, bad = false) {
+    this.dom.note.textContent = text;
+    this.dom.note.className = `note ${bad ? 'error' : ''}`;
+  }
+
+  // -- the one write ----------------------------------------------------
+
+  async promote() {
+    if (!this.selected || !this.key) return;
+    const { site, floor } = parseFloorKey(this.key);
+    const revision = this.selected.revision;
+    this.note(`promoting ${revision}…`);
+    try {
+      const body = await this.api(
+        `${floorPath(site, floor)}/revisions/${revision}/promote`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: '{"schema":1}',
+        },
+      );
+      // Re-read rather than assume: this floor's canonical revision, its
+      // basemap and every robot's "is it running the fleet's map" answer have
+      // all just changed. The result is reported *after* the re-read, because
+      // opening a floor clears this note — say it first and the one message
+      // that reports what happened is wiped by the refresh that follows it.
+      await this.loadFloors();
+      await this.open(this.key, revision);
+      this.note(
+        body.announced
+          ? `${site}/${floor} is on ${body.revision}; robots will pull it`
+          : `promoted, but not announced: ${body.detail}`,
+        !body.announced,
+      );
+      this.onPromoted(site, floor, revision);
+    } catch (error) {
+      this.note(error.message, true);
+    }
+  }
+}
diff --git a/mote_fleet/server/ui/style.css b/mote_fleet/server/ui/style.css
index 537bda0..24d8794 100644
--- a/mote_fleet/server/ui/style.css
+++ b/mote_fleet/server/ui/style.css
@@ -642,3 +642,179 @@ main {
   display: flex;
   gap: 6px;
 }
+
+/* -- candidate review ----------------------------------------------------- */
+
+/* Review is a *mode*, not a fourth column. The fleet-operations panes stand
+   down while it is up, at every width: two maps side by side — one canonical
+   with robots on it, one a candidate without — is the confusion a dedicated
+   view exists to remove, and on a 1440 px desk neither canvas would be wide
+   enough to read anyway.
+
+   The `:has` rule outranks `.pane.active` on specificity, so this holds inside
+   the narrow media query too (where it is already true, one pane at a time). */
+.review-pane {
+  display: none;
+  grid-column: 1 / -1;
+  border-right: none;
+  overflow: hidden;
+}
+
+.review-pane.active {
+  display: flex;
+}
+
+main:has(.review-pane.active) > .pane:not(.review-pane) {
+  display: none;
+}
+
+.review-body {
+  flex: 1;
+  min-height: 0;
+  display: grid;
+  grid-template-columns: 360px minmax(0, 1fr);
+  gap: 14px;
+}
+
+.review-side,
+.review-map {
+  min-width: 0;
+  min-height: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  overflow: auto;
+}
+
+.review-side h3,
+.review-map h3 {
+  margin: 4px 0 0;
+}
+
+#review-canvas {
+  flex: 1;
+  width: 100%;
+  min-height: 240px;
+  display: block;
+  cursor: grab;
+  /* As the fleet map: without this the browser takes the drag and the pinch
+     before a single pointer event reaches the canvas. */
+  touch-action: none;
+  background: var(--void);
+  border: 1px solid var(--line);
+  border-radius: 6px;
+}
+
+.revision-rows {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  max-height: 220px;
+  overflow-y: auto;
+}
+
+.revision-row {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) auto;
+  gap: 2px 8px;
+  text-align: left;
+  padding: 6px 8px;
+}
+
+.revision-id,
+.revision-tag {
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.revision-row.selected {
+  border-color: var(--accent);
+  color: var(--accent);
+}
+
+/* A revision the validator refused is listed, not hidden: "why can I not
+   promote the map my robot just published" is a question this view has to be
+   able to answer. */
+.revision-row.bad .revision-id {
+  text-decoration: line-through;
+}
+
+.revision-sub {
+  grid-column: 1 / -1;
+  color: var(--dim);
+  font-size: 12px;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.verdict.ok {
+  color: var(--ok);
+}
+
+.verdict.error {
+  color: var(--fault);
+}
+
+.verdict-notes {
+  margin: 0;
+  padding-left: 18px;
+  color: var(--dim);
+  font-size: 12px;
+}
+
+.verdict-notes:empty {
+  display: none;
+}
+
+/* The editor's row grid ends in an `auto` column sized to a button; here the
+   third cell is a phrase of arbitrary length, which would push the row wider
+   than the pane. Task 346 replaces these cells with controls and inherits the
+   row shape either way. */
+#review-zones .zone-row {
+  grid-template-columns: minmax(0, 1fr) 72px minmax(0, 1fr);
+}
+
+#review-zones .zone-row > span {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+button.promote {
+  align-self: flex-start;
+}
+
+button.promote:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+/* One column below the breakpoint: a phone shows the candidate list, then the
+   map, then the zones, and scrolls the pane between them.
+
+   The scroll has to move from the two columns to the pane itself. Left as a
+   `flex: 1` child of a fixed-height pane, the body keeps the pane's height and
+   its two auto rows are squeezed into it — with `overflow: visible` on the
+   columns, the canvas then lands *on top of* the provenance rather than below
+   them. So the body takes its content's height and the pane scrolls. */
+@media (max-width: 760px) {
+  .review-pane {
+    overflow: auto;
+  }
+
+  .review-body {
+    flex: none;
+    grid-template-columns: 1fr;
+    grid-auto-rows: auto;
+  }
+
+  .review-side,
+  .review-map {
+    overflow: visible;
+  }
+
+  #review-canvas {
+    flex: none;
+    height: 46vh;
+  }
+}
diff --git a/mote_fleet/test/browser_check.mjs b/mote_fleet/test/browser_check.mjs
index c3d21bc..84b3f54 100644
--- a/mote_fleet/test/browser_check.mjs
+++ b/mote_fleet/test/browser_check.mjs
@@ -11,7 +11,10 @@
 // server, a basemap and a fake fleet on ports nobody else is using — and is how
 // to run these checks without one. Point it at a stack of your own with:
 //
-//     node mote_fleet/test/browser_check.mjs http://localhost:8080 [token] [out.png]
+//     node mote_fleet/test/browser_check.mjs http://localhost:8080 [token] [out.png] [site/floor]
+//
+// The trailing `site/floor` is a floor with candidates and no published map; if
+// it is given, the bootstrap checks run against it.
 //
 // It speaks the Chrome DevTools Protocol over node's built-in WebSocket, so it
 // needs no npm install: only a chrome/chromium on PATH.
@@ -25,6 +28,7 @@ import { join } from 'node:path';
 const url = process.argv[2] || 'http://localhost:8080';
 const token = process.argv[3] || '';
 const shot = process.argv[4] || 'fleet-ui.png';
+const unpublished = process.argv[5] || '';
 
 function onPath(name) {
   return (process.env.PATH || '').split(':').some((dir) => {
@@ -118,6 +122,19 @@ function check(name, ok, detail = '') {
 // could ever be a gate rather than an operator's tool.
 const DEADLINE_MS = 20000;
 
+// How much of a canvas has been drawn on. The only honest answer to "is the map
+// there" — every other signal (a decoded image, a loaded payload) is upstream of
+// the one thing that can silently go wrong, which is fitting into a canvas that
+// had no size when it was fitted.
+const paintedPixels = (id) => `(() => {
+      const canvas = document.getElementById('${id}');
+      const ctx = canvas.getContext('2d');
+      const data = ctx.getImageData(0, 0, canvas.width, canvas.height).data;
+      let painted = 0;
+      for (let i = 3; i < data.length; i += 4) if (data[i] > 0) painted += 1;
+      return painted;
+    })()`;
+
 async function settle(session, expression, satisfied, timeout = DEADLINE_MS) {
   const deadline = Date.now() + timeout;
   for (;;) {
@@ -192,18 +209,7 @@ try {
   );
   check('a basemap was resolved for the selected robot', mapLabel.includes('/'), mapLabel);
 
-  const drawn = await settle(
-    session,
-    `(() => {
-      const canvas = document.getElementById('map-canvas');
-      const ctx = canvas.getContext('2d');
-      const data = ctx.getImageData(0, 0, canvas.width, canvas.height).data;
-      let painted = 0;
-      for (let i = 3; i < data.length; i += 4) if (data[i] > 0) painted += 1;
-      return painted;
-    })()`,
-    (painted) => painted > 10000,
-  );
+  const drawn = await settle(session, paintedPixels('map-canvas'), (painted) => painted > 10000);
   check('the map canvas has pixels on it', drawn > 10000, `${drawn} painted pixels`);
 
   const subsystems = await settle(
@@ -241,6 +247,125 @@ try {
   writeFileSync(shot, Buffer.from(screenshot.data, 'base64'));
   console.log(`screenshot: ${shot}`);
 
+  // -- candidate review ---------------------------------------------------
+  //
+  // M4's rule is that uploading is not publishing, which leaves an operator a
+  // decision to make; until this pane existed the only thing on screen to make
+  // it with was a timestamp. Whether they can actually *see* the candidate is a
+  // question about a canvas, so only a browser can answer it.
+
+  const signpost = await settle(
+    session,
+    `(() => {
+      const button = document.getElementById('review-jump');
+      return button && !button.hidden ? button.textContent : '';
+    })()`,
+    (text) => text.includes('candidate'),
+  );
+  check('the map pane signposts the floor’s candidates', signpost.includes('candidate'), signpost);
+
+  await session.evaluate(`document.getElementById('review-jump').click()`);
+  const reviewed = await settle(
+    session,
+    `document.getElementById('review-map-label').textContent`,
+    (label) => /\d{8}T\d{6}/.test(label),
+  );
+  check('the review pane opened on a candidate revision', /\d{8}T\d{6}/.test(reviewed), reviewed);
+
+  const candidateDrawn = await settle(
+    session,
+    paintedPixels('review-canvas'),
+    (painted) => painted > 10000,
+  );
+  check(
+    'the candidate’s own map is drawn on the review canvas',
+    candidateDrawn > 10000,
+    `${candidateDrawn} painted pixels`,
+  );
+
+  // The fixture's candidate is the published map mirrored, so a review pane
+  // that fetched the canonical image — the defect this replaces — would draw a
+  // perfectly convincing map. The URL is what separates the two.
+  const source = await session.evaluate(
+    `[...performance.getEntriesByType('resource')]
+       .map(entry => new URL(entry.name).pathname)
+       .filter(path => path.endsWith('/map.png')).join(' ')`,
+  );
+  check(
+    'the review pane fetched a revision’s image, not the canonical basemap',
+    /\/revisions\/\d{8}T\d{6}\/map\.png/.test(source),
+    source,
+  );
+
+  const zoneRows = await settle(
+    session,
+    `document.querySelectorAll('#review-zones .zone-row').length`,
+    (rows) => rows > 0,
+  );
+  check('the candidate’s zones are listed beside it', zoneRows > 0, `${zoneRows} rows`);
+
+  const verdict = await session.evaluate(`(() => ({
+    verdict: document.getElementById('review-verdict').textContent,
+    enabled: !document.getElementById('review-promote').disabled,
+    facts: document.querySelectorAll('#review-provenance .fact').length,
+  }))()`);
+  check(
+    'the pane says why the revision is promotable, and offers to',
+    verdict.enabled && verdict.facts > 0,
+    JSON.stringify(verdict),
+  );
+
+  const reviewShot = shot.replace(/(\.png)?$/, '-review.png');
+  const reviewPng = await session.send('Page.captureScreenshot', { format: 'png' });
+  writeFileSync(reviewShot, Buffer.from(reviewPng.data, 'base64'));
+  console.log(`screenshot: ${reviewShot}`);
+
+  // -- the first promotion on a floor -------------------------------------
+  //
+  // A floor whose only revisions are candidates. Its detail used to be fetched
+  // only after a basemap had loaded — behind an early return — so it listed no
+  // candidates at all and its first promotion could never be made here.
+
+  if (unpublished && token) {
+    const opened = await session.evaluate(`(() => {
+      const select = document.getElementById('review-floor');
+      const option = [...select.options].find(o => o.value === ${JSON.stringify(unpublished)});
+      if (!option) return '';
+      select.value = option.value;
+      select.dispatchEvent(new Event('change'));
+      return option.value;
+    })()`);
+    check(`${unpublished} is in the floor picker`, opened === unpublished, opened || 'not listed');
+
+    // Settled on the *label*, not on the row count: the previous floor's rows
+    // are still on screen while this one's detail is in flight, so a predicate
+    // of "some rows exist" is satisfied before anything has changed and the
+    // promote below then fires at the wrong floor's revision.
+    const listed = await settle(
+      session,
+      `(() => ({
+        canonical: document.getElementById('review-canonical').textContent,
+        label: document.getElementById('review-map-label').textContent,
+        rows: document.querySelectorAll('#review-revisions .revision-row').length,
+        promotable: !document.getElementById('review-promote').disabled,
+      }))()`,
+      (state) => state.label.startsWith(unpublished),
+    );
+    check(
+      'a floor with nothing published still lists its candidates',
+      listed.rows > 0 && listed.promotable && /nothing published/.test(listed.canonical),
+      JSON.stringify(listed),
+    );
+
+    await session.evaluate(`document.getElementById('review-promote').click()`);
+    const promoted = await settle(
+      session,
+      `document.getElementById('review-note').textContent`,
+      (note) => /is on \d{8}T\d{6}/.test(note),
+    );
+    check('the first promotion on a floor goes through', /is on /.test(promoted), promoted);
+  }
+
   // -- the phone ----------------------------------------------------------
   //
   // The off-LAN client is a phone, and a phone is not a narrow desktop: it has
@@ -298,6 +423,26 @@ try {
   })()`);
   check('no pane scrolls sideways on a phone', sideways === '', sideways);
 
+  // The review canvas is hidden at *every* width until its pane is opened, so
+  // unlike the fleet map it is never fitted at load. If `shown()` is not wired
+  // through the tab bar it measures 0x0, fits to a scale of 0, and stays blank
+  // for good — with nothing on screen to say why.
+  await session.evaluate(`document.querySelector('.panes [data-pane="review"]').click()`);
+  const phoneReview = await settle(
+    session,
+    paintedPixels('review-canvas'),
+    (painted) => painted > 10000,
+  );
+  check(
+    'the review canvas fits itself when its pane is opened on a phone',
+    phoneReview > 10000,
+    `${phoneReview} painted pixels`,
+  );
+  const reviewPhoneShot = shot.replace(/(\.png)?$/, '-review-phone.png');
+  const reviewPhonePng = await session.send('Page.captureScreenshot', { format: 'png' });
+  writeFileSync(reviewPhoneShot, Buffer.from(reviewPhonePng.data, 'base64'));
+  console.log(`screenshot: ${reviewPhoneShot}`);
+
   // Switching panes changes the canvas's height but not its width. Resizing on
   // width alone leaves a backing store `clearRect` cannot fully reach, and the
   // previous frame stays visible along the bottom.
diff --git a/mote_fleet/test/test_map_registry.py b/mote_fleet/test/test_map_registry.py
index a9d6f7a..aefd726 100644
--- a/mote_fleet/test/test_map_registry.py
+++ b/mote_fleet/test/test_map_registry.py
@@ -379,6 +379,139 @@ def test_pulling_a_revision_that_is_not_there_is_404(server):
     )
 
 
+# ---- reviewing a candidate before promoting it --------------------------
+#
+# An operator who cannot see a candidate is promoting on faith in a timestamp,
+# which is what the dashboard's review view exists to end. These three routes
+# are the whole of what it reads: the candidate's own transform, its own
+# pixels, and its own zones — all three named by the revision, none of them
+# reachable through the canonical basemap's routes.
+
+
+def review(revision, leaf, site=SITE, floor=FLOOR):
+    return f"/v1/sites/{site}/floors/{floor}/revisions/{revision}/{leaf}"
+
+
+@pytest.fixture
+def candidate(server, robot, tmp_path):
+    """A stored candidate whose map is visibly not the canonical one."""
+    upload(server, packed_revision(tmp_path, name="candidate", width=60, height=45))
+    return "20260727T101500"
+
+
+def test_a_candidates_map_json_describes_that_revision(server, candidate):
+    status, body = get(server, review(candidate, "map.json"))
+    assert status == 200
+    assert (body["width"], body["height"]) == (60, 45)
+    assert body["revision"] == candidate
+    assert body["resolution"] == 0.05
+    assert body["origin"][:2] == [-2.927, -2.934]
+    # The whole point of the route: a client that follows this URL gets the
+    # candidate's pixels. Left pointing at /v1/maps — as it was — the review
+    # view would draw the canonical map under the candidate's label, which is
+    # exactly the promotion-on-faith this replaces.
+    assert body["image_url"] == review(candidate, "map.png")
+
+
+def test_a_candidates_map_png_is_not_the_canonical_maps(server, candidate):
+    status, content_type, candidate_bytes = get_bytes(
+        server, review(candidate, "map.png")
+    )
+    assert (status, content_type) == (200, "image/png")
+    _, _, canonical_bytes = get_bytes(server, f"/v1/maps/{SITE}/{FLOOR}/map.png")
+    assert candidate_bytes != canonical_bytes
+    # Nothing was promoted to get here: reviewing is a read.
+    _, floor = get(server, f"/v1/sites/{SITE}/floors/{FLOOR}")
+    assert floor["canonical"] == "20260726T120000"
+
+
+def test_a_candidates_zones_are_its_own(server, robot, tmp_path):
+    directory = write_revision(tmp_path / "rev")
+    (directory / "zones.yaml").write_text(
+        "frame_id: map\nzones:\n  loading_bay: {x: 9.0, y: -1.0}\n"
+    )
+    upload(server, bundle.pack(directory))
+    status, body = get(server, review("20260727T101500", "zones.json"))
+    assert status == 200
+    assert body["revision"] == "20260727T101500"
+    assert body["source"] == "revision"
+    assert [zone["name"] for zone in body["zones"]] == ["loading_bay"]
+    # And the floor's published binding is untouched by having been reviewed.
+    _, published = get(server, f"/v1/maps/{SITE}/{FLOOR}/zones.json")
+    assert sorted(zone["name"] for zone in published["zones"]) == [
+        "kitchen",
+        "sluice",
+        "ward",
+    ]
+
+
+def test_a_revision_with_no_zones_falls_back_to_the_floors(server, robot, tmp_path):
+    """``_zones_file``'s rule, unchanged: a floor seeded by rsync keeps its
+    zones at floor level, and a revision that carries none inherits them.
+
+    ``source`` is what makes that safe to show a reviewer. Inherited zones were
+    taught in a *previous* session's frame, so they draw perfectly over this map
+    and are wrong by however far the two origins differ — nothing in the
+    coordinates says which case this is, so the payload does.
+    """
+    upload(server, packed_revision(tmp_path, name="bare", zones=False))
+    floor_dir = server.maps / SITE / "floors" / FLOOR
+    (floor_dir / "zones.yaml").write_text(
+        "frame_id: map\nzones:\n  lobby: {x: 0.0, y: 0.0}\n"
+    )
+    _, body = get(server, review("20260727T101500", "zones.json"))
+    assert [zone["name"] for zone in body["zones"]] == ["lobby"]
+    assert body["source"] == "floor"
+
+
+def test_a_revision_with_no_zones_anywhere_is_404(server, robot, tmp_path):
+    upload(server, packed_revision(tmp_path, name="bare", zones=False))
+    expect_error(lambda: get(server, review("20260727T101500", "zones.json")), 404)
+
+
+@pytest.mark.parametrize("leaf", ["map.json", "map.png", "zones.json"])
+def test_reviewing_a_revision_that_is_not_there_is_404(server, leaf):
+    expect_error(lambda: get(server, review("20260101T000000", leaf)), 404)
+
+
+@pytest.mark.parametrize("leaf", ["map.json", "map.png", "zones.json"])
+def test_a_review_route_refuses_a_name_it_could_not_have_written(server, leaf):
+    expect_error(lambda: get(server, review("..%2F..%2Fregistry.db", leaf)), 400)
+
+
+@pytest.mark.parametrize("leaf", ["map.json", "map.png", "zones.json"])
+def test_reviewing_needs_no_operator_token(server, candidate, leaf):
+    """Reads are unauthenticated exactly as every other read route is; M7
+    changes that for all of them at once rather than for these three."""
+    assert get_bytes(server, review(candidate, leaf))[0] == 200
+
+
+def test_the_first_candidate_on_a_floor_can_be_reviewed_and_promoted(
+    server, robot, operator, tmp_path
+):
+    """The bootstrap case: a floor whose only revisions are candidates.
+
+    Nothing about review may depend on there already being a canonical map, or
+    the first promotion on any floor could never be made — which is precisely
+    the floor an operator most needs to look at before promoting.
+    """
+    upload(server, packed_revision(tmp_path, name="first"), floor="loft")
+    _, detail = get(server, f"/v1/sites/{SITE}/floors/loft")
+    assert detail["canonical"] is None
+    assert [r["revision"] for r in detail["revisions"]] == ["20260727T101500"]
+
+    _, meta = get(server, review("20260727T101500", "map.json", floor="loft"))
+    assert meta["revision"] == "20260727T101500"
+    _, zones = get(server, review("20260727T101500", "zones.json", floor="loft"))
+    assert zones["zones"]
+    assert (
+        get_bytes(server, review("20260727T101500", "map.png", floor="loft"))[0] == 200
+    )
+
+    status, body = promote(server, "20260727T101500", operator, floor="loft")
+    assert (status, body["revision"]) == (200, "20260727T101500")
+
+
 # ---- zones on the basemap -----------------------------------------------
 
 
diff --git a/mote_fleet/test/ui_check.py b/mote_fleet/test/ui_check.py
index fb0c9d6..986d474 100644
--- a/mote_fleet/test/ui_check.py
+++ b/mote_fleet/test/ui_check.py
@@ -63,6 +63,12 @@
 #: link so the broker published its will.
 ROBOTS = ("ok", "degraded", "offline")
 
+#: A floor with candidates and **no published map**, which is the bootstrap case
+#: the review view had to fix: the floor detail used to be fetched only after a
+#: basemap had loaded, so a floor with nothing published listed no candidates
+#: and its first promotion could never be made from a browser.
+UNPUBLISHED_FLOOR = "unpublished"
+
 #: Where the broker image tag is pinned — once, in the compose file, for every
 #: broker the fleet runs (``broker.sh`` defers to it the same way). A tag of its
 #: own here would be a third broker that could drift onto a mosquitto whose
@@ -238,6 +244,38 @@ def seed_maps(root: Path, site: str) -> Path:
     return maps
 
 
+def seed_candidates(maps: Path, site: str, floor: str) -> dict:
+    """Two candidates to review, because a floor that has only ever had one map
+    gives the review pane nothing to say.
+
+    One lands beside the published revision of the floor the robots are on. The
+    other is the whole of a second floor with nothing published at all — the
+    bootstrap case (``UNPUBLISHED_FLOOR``). Both are derived from the committed
+    bundle rather than synthesised, so they are real revisions the validator
+    accepts; neither carries an ``upload.json``, which is also true of a floor
+    seeded by rsync and is the provenance case worth having on screen.
+    """
+    from PIL import Image
+
+    source = (maps / site / "floors" / floor / "map").resolve()
+
+    def candidate(target_floor: str, revision: str) -> str:
+        target = maps / site / "floors" / target_floor / "maps" / revision
+        shutil.copytree(source, target)
+        # Mirrored, so the candidate is visibly not the published map. A review
+        # pane that quietly drew the canonical basemap under the candidate's
+        # label — the exact defect this view removes — would otherwise look
+        # perfectly right in a screenshot.
+        with Image.open(target / "map.png") as image:
+            image.transpose(Image.FLIP_LEFT_RIGHT).save(target / "map.png")
+        return revision
+
+    return {
+        floor: candidate(floor, "20260802T145731"),
+        UNPUBLISHED_FLOOR: candidate(UNPUBLISHED_FLOOR, "20260802T150442"),
+    }
+
+
 def published_revision(maps: Path, site: str, floor: str) -> str:
     """What the floor's ``map`` symlink points at — the revision the registry
     will call canonical, and so the one the robots should report running."""
@@ -317,6 +355,7 @@ def main(argv=None):
 
         db = root / "registry.db"
         maps = seed_maps(root, args.site)
+        seed_candidates(maps, args.site, args.floor)
         stack.spawn(
             "fleet-server",
             [
@@ -399,6 +438,7 @@ def main(argv=None):
                 url,
                 token,
                 str(Path(args.screenshot).resolve()),
+                f"{args.site}/{UNPUBLISHED_FLOOR}",
             ]
         )
         return result.returncode
diff --git a/mote_fleet/test/ui_test.mjs b/mote_fleet/test/ui_test.mjs
index d60fc9e..7e400cc 100644
--- a/mote_fleet/test/ui_test.mjs
+++ b/mote_fleet/test/ui_test.mjs
@@ -1,11 +1,15 @@
-// The dashboard's two load-bearing pure pieces, under node.
+// The dashboard's load-bearing pure pieces, under node.
 //
 // Everything else in the UI is DOM and canvas, which a browser is the only
-// honest place to test. These two are not: the MQTT codec decides whether the
-// read path works at all, and the world→pixel transform decides whether a robot
-// is drawn where it actually is. Both are exported from files the browser loads
-// unchanged — `.mjs` is what lets node import them with no package.json and no
-// build step.
+// honest place to test. These are not: the MQTT codec decides whether the read
+// path works at all, the world→pixel transform decides whether a robot is drawn
+// where it actually is, the zone editor's geometry decides what an edit does,
+// and the review pane's route builders decide *which map* is on the canvas at
+// all. Each is exported from a file the browser loads unchanged — `.mjs` is what
+// lets node import them with no package.json and no build step.
+//
+// The seams the stylesheet and the markup share with all of that fail silently
+// rather than loudly, so they are read out of those files and asserted here too.
 //
 //     node --test mote_fleet/test/ui_test.mjs
 
@@ -250,7 +254,7 @@ test('the tab bar and the panes address each other by the same names', () => {
   const html = read('index.html');
   const panes = [...html.matchAll(/class="pane[^"]*" data-pane="([^"]+)"/g)].map((m) => m[1]);
   const tabs = [...html.matchAll(/<button[^>]*data-pane="([^"]+)"/g)].map((m) => m[1]);
-  assert.deepEqual(panes, ['roster', 'map', 'detail']);
+  assert.deepEqual(panes, ['roster', 'map', 'review', 'detail']);
   // A pane with no tab is simply unreachable on a phone, and nothing says so.
   assert.deepEqual([...tabs].sort(), [...panes].sort());
 });
@@ -261,12 +265,14 @@ test('exactly one pane starts active, so a phone opens on something', () => {
   assert.equal(active.length, 1);
 });
 
-test('the map canvas takes its own touch gestures', () => {
+test('both map canvases take their own touch gestures', () => {
   // Without `touch-action: none` the browser consumes the drag and the pinch
   // before the canvas sees a single pointer event.
   const css = read('style.css');
-  const canvas = css.slice(css.indexOf('#map-canvas {'));
-  assert.match(canvas.slice(0, canvas.indexOf('}')), /touch-action:\s*none/);
+  for (const id of ['#map-canvas {', '#review-canvas {']) {
+    const canvas = css.slice(css.indexOf(id));
+    assert.match(canvas.slice(0, canvas.indexOf('}')), /touch-action:\s*none/, id);
+  }
 });
 
 // -- the zone editor ------------------------------------------------------
@@ -354,3 +360,204 @@ test('the zone editor panel hides when hidden, whatever its class sets', () => {
     assert.ok(html.includes(`id="${id}"`), `index.html is missing #${id}`);
   }
 });
+
+// -- candidate review -----------------------------------------------------
+//
+// The read half of the review pane. Its canvas needs a browser like every other
+// canvas here, but the part that decides *which map is on it* does not: these
+// are the route builders, the list ordering and the promotable verdict, and a
+// regression in the first of them is the specific failure the whole view exists
+// to remove — the canonical basemap drawn under a candidate's label.
+
+const {
+  defaultRevision,
+  floorKey,
+  floorPath,
+  formatBytes,
+  orderedRevisions,
+  parseFloorKey,
+  promotability,
+  provenanceRows,
+  revisionPath,
+  zoneSource,
+  zoneSummary,
+} = await import('../server/ui/review.mjs');
+
+test('a candidate is read from its own routes, never the canonical basemap', () => {
+  for (const leaf of ['map.json', 'map.png', 'zones.json']) {
+    const path = revisionPath('home', 'ground', '20260802T145731', leaf);
+    assert.equal(path, `/v1/sites/home/floors/ground/revisions/20260802T145731/${leaf}`);
+    // /v1/maps/<site>/<floor>/<leaf> serves whatever is *published*. A review
+    // view reading those would show the map the operator already has.
+    assert.ok(!path.startsWith('/v1/maps/'), `${leaf} must not come from /v1/maps`);
+    assert.ok(path.includes('20260802T145731'), `${leaf} must name the revision`);
+  }
+});
+
+test('a floor is addressed directly, not through a robot', () => {
+  assert.equal(floorPath('home', 'ground'), '/v1/sites/home/floors/ground');
+  assert.equal(floorKey('home', 'ground'), 'home/ground');
+  assert.deepEqual(parseFloorKey('home/ground'), { site: 'home', floor: 'ground' });
+  assert.equal(parseFloorKey('home'), null);
+  assert.equal(parseFloorKey(''), null);
+});
+
+const canonicalRevision = {
+  revision: '20260726T120000',
+  canonical: true,
+  ok: true,
+  errors: [],
+  warnings: [],
+};
+const goodRevision = {
+  revision: '20260802T145731',
+  canonical: false,
+  ok: true,
+  errors: [],
+  warnings: [],
+};
+const warnedRevision = {
+  revision: '20260802T150000',
+  canonical: false,
+  ok: true,
+  errors: [],
+  warnings: ['no map.posegraph'],
+};
+const brokenRevision = {
+  revision: '20260803T090000',
+  canonical: false,
+  ok: false,
+  errors: ['the map has no free space'],
+  warnings: [],
+};
+
+test('revisions are listed newest first, canonical included', () => {
+  const detail = { revisions: [canonicalRevision, goodRevision, brokenRevision] };
+  assert.deepEqual(
+    orderedRevisions(detail).map((entry) => entry.revision),
+    [brokenRevision.revision, goodRevision.revision, canonicalRevision.revision],
+  );
+  assert.deepEqual(orderedRevisions(null), []);
+});
+
+test('a floor opens on the newest promotable candidate', () => {
+  assert.equal(
+    defaultRevision({ revisions: [canonicalRevision, goodRevision] }).revision,
+    goodRevision.revision,
+  );
+  // A floor whose only candidate is broken still opens on it: "why can I not
+  // promote this" is the question that brought the operator here.
+  assert.equal(
+    defaultRevision({ revisions: [canonicalRevision, brokenRevision] }).revision,
+    brokenRevision.revision,
+  );
+  // Nothing but the published map: there is still something to look at.
+  assert.equal(
+    defaultRevision({ revisions: [canonicalRevision] }).revision,
+    canonicalRevision.revision,
+  );
+  assert.equal(defaultRevision({ revisions: [] }), null);
+});
+
+test('the promote button follows the validator, not the view', () => {
+  assert.equal(promotability(goodRevision).promotable, true);
+  assert.equal(promotability(warnedRevision).promotable, true);
+  assert.deepEqual(promotability(warnedRevision).notes, ['no map.posegraph']);
+  // Refused by the server too, so refusing the click is honest rather than
+  // opinionated — and the reason shown is the server's own.
+  assert.equal(promotability(brokenRevision).promotable, false);
+  assert.deepEqual(promotability(brokenRevision).notes, ['the map has no free space']);
+  assert.equal(promotability(canonicalRevision).promotable, false);
+  assert.equal(promotability(null).promotable, false);
+});
+
+test('provenance is read off the payload the registry already sends', () => {
+  const rows = Object.fromEntries(
+    provenanceRows({
+      ...goodRevision,
+      robot_id: 'mote-01',
+      uploaded_at: '2026-08-02T14:57:31Z',
+      bytes: 2048,
+      sha256: 'a'.repeat(64),
+      map: { width: 500, height: 300, resolution: 0.05 },
+      occupancy: { total: 150000, free: 0.79, occupied: 0.11, unknown: 0.1 },
+      meta: { saved: '2026-08-02T14:57:31' },
+      zones: ['kitchen', 'ward'],
+      files: { 'map.posegraph': 12 },
+    }),
+  );
+  assert.equal(rows.revision, goodRevision.revision);
+  assert.equal(rows.from, 'mote-01');
+  assert.equal(rows.size, '500x300 px at 0.05 m/px');
+  assert.match(rows.occupancy, /79\.0% free/);
+  assert.equal(rows.posegraph, 'yes');
+  assert.equal(rows['zones in bundle'], '2: kitchen, ward');
+  // A revision seeded on disk rather than uploaded has no provenance at all,
+  // and saying so beats an empty cell that reads like a missing value.
+  const bare = Object.fromEntries(provenanceRows({ ...goodRevision }));
+  assert.match(bare.uploaded, /seeded on disk/);
+  assert.match(bare.posegraph, /cannot be extended/);
+});
+
+test('bytes are readable at every size a revision comes in', () => {
+  assert.equal(formatBytes(512), '512 B');
+  assert.equal(formatBytes(2048), '2.0 kB');
+  assert.equal(formatBytes(5 * 1024 * 1024), '5.0 MB');
+  assert.equal(formatBytes(undefined), '—');
+});
+
+test('a zone row says which of the three footprints it is', () => {
+  assert.equal(
+    zoneSummary({ name: 'ward', polygon: [[0, 0], [1, 0], [1, 1]] }),
+    'polygon, 3 vertices',
+  );
+  assert.equal(zoneSummary({ name: 'kitchen', x: 1, y: 2, radius: 1.5 }), 'circle, r 1.5 m');
+  assert.equal(zoneSummary({ name: 'pickup', x: 1, y: 2 }), 'waypoint 1.00, 2.00');
+});
+
+test('inherited zones are called inherited, because coordinates cannot say so', () => {
+  // A revision carrying no zones.yaml inherits the floor's, taught in another
+  // SLAM session's frame. They draw perfectly and are wrong by however far the
+  // two map origins differ — invisible on the canvas, so it is said in words.
+  assert.match(zoneSource('floor', 3), /inherited from the floor/);
+  assert.match(zoneSource('revision', 3), /own frame/);
+  assert.match(zoneSource('revision', 0), /carries no zones/);
+});
+
+test('review is a mode: opening it stands the operations panes down', () => {
+  // Two maps side by side — one canonical with robots on it, one a candidate
+  // without — is the confusion a dedicated pane exists to remove, so the rule
+  // holds at every width rather than only on a phone.
+  const css = read('style.css');
+  assert.match(
+    css,
+    /main:has\(\.review-pane\.active\) > \.pane:not\(\.review-pane\)\s*\{\s*display:\s*none/,
+  );
+  assert.match(css, /\.review-pane\.active\s*\{\s*display:\s*flex/);
+});
+
+test('the review pane has every element app.mjs binds to it', () => {
+  const html = read('index.html');
+  for (const id of [
+    'review-jump',
+    'review-floors',
+    'review-floor',
+    'review-canonical',
+    'review-revisions',
+    'review-verdict',
+    'review-verdict-notes',
+    'review-provenance',
+    'review-zones',
+    'review-zone-source',
+    'review-canvas',
+    'review-map-label',
+    'review-promote',
+    'review-fit',
+    'review-note',
+  ]) {
+    assert.ok(html.includes(`id="${id}"`), `index.html is missing #${id}`);
+  }
+  // The map pane's promote picker moved here wholesale: a promote button next
+  // to the canonical basemap is a promotion made without seeing the map.
+  assert.ok(!html.includes('id="revision"'), 'the map pane still has a promote picker');
+});

From 71b658ab993a726112cc9fe394da6d3ce2ffb44a Mon Sep 17 00:00:00 2001
From: Michael Johnson <mjohnson459@gmail.com>
Date: Wed, 12 Aug 2026 13:10:53 +0100
Subject: [PATCH 2/3] Review pane: answer the question the heading asks, and
 say what it is asking about
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three things an operator hit on the first real look at the pane.

**"why it is promotable" promised a reason and gave a verdict.** The heading
asked a question; underneath it sat "valid, with warnings" and then three
bullets, every one of which is a complaint. Read top to bottom that is a claim
followed by its own counter-evidence, with nothing saying why the complaints do
not count. They do not count because the bar is exactly one thing — the
validator found no *errors* — and nothing on screen said so. The heading is now
"can this be promoted?", which the next line answers: "yes — no errors. These
warnings do not block it:", or "no — the validator refuses it:". The list is
introduced as what it is, and only when it has something in it.

**Two warnings with word-for-word identical text.** `CONTINUABLE` is
`(map.posegraph, map.data)` and `bundle.validate` emitted one message per
missing file, so a revision without a posegraph produced the same sentence
twice and read as two problems. slam_toolbox writes the pair together and
either half missing means the same thing, so it is one message naming whichever
halves are absent. This is the shared validator, so `save-map` and the upload
path get the same collapse.

**The floor picker had no label.** Its value is a `site/floor` with the
candidate count appended, which reads as a status line rather than a control.
It now says what it is.

Verified: bundle 50 passed (two new cases — both halves missing, and one),
mote_fleet 250 passed, ui_test 43 passed with the verdict's shape pinned
(answers yes/no, names the "no errors" bar, and only ends in a colon when a
list follows).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ArvMnoUP7kJbdnrZjeLftb
---
 mote_bringup/mote_bringup/bundle.py | 12 +++++++----
 mote_bringup/test/test_bundle.py    | 18 ++++++++++++++++-
 mote_fleet/server/ui/index.html     |  6 +++++-
 mote_fleet/server/ui/review.mjs     | 31 ++++++++++++++++++++++++-----
 mote_fleet/server/ui/style.css      | 18 +++++++++++++++++
 mote_fleet/test/ui_test.mjs         | 18 +++++++++++++++++
 6 files changed, 92 insertions(+), 11 deletions(-)

diff --git a/mote_bringup/mote_bringup/bundle.py b/mote_bringup/mote_bringup/bundle.py
index 5020246..afb4a25 100644
--- a/mote_bringup/mote_bringup/bundle.py
+++ b/mote_bringup/mote_bringup/bundle.py
@@ -651,11 +651,15 @@ def validate(revision_dir, *, require_posegraph: bool = True) -> Report:
         elif not report.files[name]:
             report.errors.append(f"{name} is empty")
 
-    for name in CONTINUABLE:
-        if report.files.get(name):
-            continue
+    # One message however many of them are absent. slam_toolbox writes the
+    # posegraph and its data as a pair, either half missing means exactly the
+    # same thing, and a line per file produced two entries with word-for-word
+    # identical text — which reads as two separate problems.
+    missing = [name for name in CONTINUABLE if not report.files.get(name)]
+    if missing:
         message = (
-            f"{name} is missing — mapping cannot be continued in this frame "
+            f"{' and '.join(missing)} {'is' if len(missing) == 1 else 'are'} "
+            "missing — mapping cannot be continued in this frame "
             "(extend, don't remap)"
         )
         (report.errors if require_posegraph else report.warnings).append(message)
diff --git a/mote_bringup/test/test_bundle.py b/mote_bringup/test/test_bundle.py
index 3c895e2..51d8afe 100644
--- a/mote_bringup/test/test_bundle.py
+++ b/mote_bringup/test/test_bundle.py
@@ -374,7 +374,23 @@ def test_a_missing_posegraph_is_an_error_for_a_publisher_and_a_warning_for_a_rea
     assert not bundle.validate(directory).ok
     lenient = bundle.validate(directory, require_posegraph=False)
     assert lenient.ok
-    assert any("map.posegraph" in warning for warning in lenient.warnings)
+    # One entry naming both halves, not one per file. slam_toolbox writes the
+    # posegraph and its data as a pair, so a line each produced two warnings
+    # with word-for-word identical text — two problems, to anyone reading them.
+    assert lenient.warnings == [
+        "map.posegraph and map.data are missing — mapping cannot be continued "
+        "in this frame (extend, don't remap)"
+    ]
+
+
+def test_half_a_posegraph_names_only_the_half_that_is_missing(tmp_path):
+    directory = revision(tmp_path / "rev")
+    (directory / "map.data").unlink()
+    report = bundle.validate(directory, require_posegraph=False)
+    assert report.warnings == [
+        "map.data is missing — mapping cannot be continued in this frame "
+        "(extend, don't remap)"
+    ]
 
 
 def test_a_truncated_upload_is_caught(tmp_path):
diff --git a/mote_fleet/server/ui/index.html b/mote_fleet/server/ui/index.html
index 7645ce2..53312d5 100644
--- a/mote_fleet/server/ui/index.html
+++ b/mote_fleet/server/ui/index.html
@@ -81,6 +81,7 @@ <h2>review</h2>
         <div class="review-body">
           <div class="review-side">
             <div id="review-floors" class="review-floors" hidden>
+              <label for="review-floor">site / floor</label>
               <select id="review-floor" title="site and floor to review"></select>
             </div>
             <p class="dim">
@@ -88,7 +89,10 @@ <h2>review</h2>
             </p>
             <div id="review-revisions" class="revision-rows"></div>
 
-            <h3>why it is promotable</h3>
+            <!-- A question the next line answers. It used to read "why it is
+                 promotable", which promised a reason and then showed a verdict
+                 over a list of warnings — i.e. the case *against*. -->
+            <h3>can this be promoted?</h3>
             <p id="review-verdict" class="verdict"></p>
             <ul id="review-verdict-notes" class="verdict-notes"></ul>
             <div id="review-provenance" class="facts"></div>
diff --git a/mote_fleet/server/ui/review.mjs b/mote_fleet/server/ui/review.mjs
index ea00ce6..a1e9b51 100644
--- a/mote_fleet/server/ui/review.mjs
+++ b/mote_fleet/server/ui/review.mjs
@@ -73,22 +73,43 @@ export function defaultRevision(detail) {
   );
 }
 
-// Why this revision may or may not be promoted, said before the click rather
-// than discovered by it. The verdict is the *validator's* — the same report the
+// Whether this revision may be promoted, said before the click rather than
+// discovered by it. The verdict is the *validator's* — the same report the
 // server re-runs at promotion — so this can never encourage a promotion the
 // server will refuse, nor discourage one it would accept.
+//
+// **The bar is exactly "no errors", and the verdict has to say so**, because
+// the list underneath it is not the reason for the verdict: warnings are what
+// is imperfect about a revision that passes anyway (a missing posegraph
+// navigates perfectly and simply cannot be extended). A bare "valid, with
+// warnings" over three complaints reads as a claim with its own evidence
+// against it — which is how this was first written, and it left an operator
+// asking what the answer actually was. So the verdict answers yes or no, names
+// the criterion, and introduces the list as what it is.
 export function promotability(revision) {
   if (!revision) return { promotable: false, verdict: 'no revision selected', notes: [] };
   const warnings = revision.warnings || [];
   if (!revision.ok) {
-    return { promotable: false, verdict: 'not promotable', notes: revision.errors || [] };
+    return {
+      promotable: false,
+      verdict: 'no — the validator refuses it:',
+      notes: revision.errors || [],
+    };
   }
   if (revision.canonical) {
-    return { promotable: false, verdict: 'already the published map', notes: warnings };
+    return {
+      promotable: false,
+      verdict: warnings.length
+        ? 'this is already the floor’s published map. Warnings:'
+        : 'this is already the floor’s published map',
+      notes: warnings,
+    };
   }
   return {
     promotable: true,
-    verdict: warnings.length ? 'valid, with warnings' : 'valid — promotable',
+    verdict: warnings.length
+      ? 'yes — no errors. These warnings do not block it:'
+      : 'yes — the validator found nothing wrong with it',
     notes: warnings,
   };
 }
diff --git a/mote_fleet/server/ui/style.css b/mote_fleet/server/ui/style.css
index 24d8794..ded046d 100644
--- a/mote_fleet/server/ui/style.css
+++ b/mote_fleet/server/ui/style.css
@@ -705,6 +705,24 @@ main:has(.review-pane.active) > .pane:not(.review-pane) {
   border-radius: 6px;
 }
 
+/* The picker carries a `site/floor` value and nothing else said so — with the
+   candidate count appended it read as a status line rather than a control. */
+.review-floors {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.review-floors label {
+  color: var(--dim);
+  flex: none;
+}
+
+.review-floors select {
+  flex: 1;
+  min-width: 0;
+}
+
 .revision-rows {
   display: flex;
   flex-direction: column;
diff --git a/mote_fleet/test/ui_test.mjs b/mote_fleet/test/ui_test.mjs
index 7e400cc..4508dcf 100644
--- a/mote_fleet/test/ui_test.mjs
+++ b/mote_fleet/test/ui_test.mjs
@@ -471,6 +471,24 @@ test('the promote button follows the validator, not the view', () => {
   assert.equal(promotability(null).promotable, false);
 });
 
+test('the verdict answers the question and says what the bar is', () => {
+  // The heading asks "can this be promoted?". A verdict that only classifies
+  // the revision ("valid, with warnings") over a list of complaints answers a
+  // different question and reads as its own counter-evidence — an operator
+  // looking at the first build of this pane asked what the answer was.
+  assert.match(promotability(goodRevision).verdict, /^yes\b/);
+  assert.match(promotability(warnedRevision).verdict, /^yes\b/);
+  assert.match(promotability(brokenRevision).verdict, /^no\b/);
+  // The bar is "no errors", and warnings are explicitly not part of it.
+  assert.match(promotability(warnedRevision).verdict, /no errors/);
+  assert.match(promotability(warnedRevision).verdict, /do not block/);
+  // A list with nothing in it must not be introduced as though it had
+  // something in it.
+  assert.doesNotMatch(promotability(goodRevision).verdict, /:$/);
+  assert.match(promotability(warnedRevision).verdict, /:$/);
+  assert.match(promotability(brokenRevision).verdict, /:$/);
+});
+
 test('provenance is read off the payload the registry already sends', () => {
   const rows = Object.fromEntries(
     provenanceRows({

From 9593934dd008e982a281984ec376569c01ff6f08 Mon Sep 17 00:00:00 2001
From: Michael Johnson <mjohnson459@gmail.com>
Date: Wed, 12 Aug 2026 17:06:23 +0100
Subject: [PATCH 3/3] Review pane: say the verdict as a state, not as a
 conversation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous commit fixed a real problem — "valid, with warnings" over three
complaints never said why the complaints did not count — but fixed it in the
wrong register. A heading phrased as a question ("can this be promoted?")
answered by "yes — no errors. These warnings do not block it:" reads as chat,
not as a control panel: every other heading on this page is a noun, and the
answer wrapped onto a second line and dangled on a colon.

The answer is a **state**. This page already has an idiom for one — a coloured
dot and a word, as the roster and the subsystem list say it — so the verdict is
`promotable` / `not promotable` / `already published` beside a dot, with the
colour on the dot rather than on the text. The part that was genuinely missing,
that the bar is "no errors" and warnings do not reach it, becomes a caption on
the list: "warnings — these do not block promotion", or "errors — these block
promotion". That is where it belongs, since it says what the list *is*.

It also supplies a break the pane needed: the bullets ran straight into
`revision  20260802T145731` with nothing between them, so the warnings and the
provenance blurred into one block. The facts now sit under their own
`provenance` heading.

`promotability()` returns `state` and `notesLabel` alongside the verdict, so all
of this stays a pure function with the DOM work downstream of it. The test that
pinned the question/answer shape is replaced by one that pins the opposite: at
most three words, no leading yes/no, no trailing punctuation.

One gap fell out of writing that test: it asserted a `.dot.<state>` rule for
every state, and `unknown` has none — it is the base `.dot` colour, expressed by
the absence of a modifier. The assertion was wrong rather than the stylesheet,
so it now describes that design instead of adding a redundant rule to satisfy
itself.

Verified: ui_test 45 passed, fleet-ui-check 25/25 in a real browser.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ArvMnoUP7kJbdnrZjeLftb
---
 mote_fleet/server/ui/app.mjs    |  2 ++
 mote_fleet/server/ui/index.html | 12 ++++---
 mote_fleet/server/ui/review.mjs | 62 ++++++++++++++++++++++-----------
 mote_fleet/server/ui/style.css  | 18 +++++++---
 mote_fleet/test/ui_test.mjs     | 60 ++++++++++++++++++++++---------
 5 files changed, 109 insertions(+), 45 deletions(-)

diff --git a/mote_fleet/server/ui/app.mjs b/mote_fleet/server/ui/app.mjs
index e0e931b..6d10675 100644
--- a/mote_fleet/server/ui/app.mjs
+++ b/mote_fleet/server/ui/app.mjs
@@ -607,6 +607,7 @@ function bind() {
     reviewRevisions: 'review-revisions',
     reviewVerdict: 'review-verdict',
     reviewVerdictNotes: 'review-verdict-notes',
+    reviewNotesLabel: 'review-notes-label',
     reviewProvenance: 'review-provenance',
     reviewZones: 'review-zones',
     reviewZoneSource: 'review-zone-source',
@@ -652,6 +653,7 @@ export async function boot() {
       revisions: dom.reviewRevisions,
       verdict: dom.reviewVerdict,
       verdictNotes: dom.reviewVerdictNotes,
+      notesLabel: dom.reviewNotesLabel,
       provenance: dom.reviewProvenance,
       zones: dom.reviewZones,
       zoneSource: dom.reviewZoneSource,
diff --git a/mote_fleet/server/ui/index.html b/mote_fleet/server/ui/index.html
index 53312d5..1a7bcdf 100644
--- a/mote_fleet/server/ui/index.html
+++ b/mote_fleet/server/ui/index.html
@@ -89,12 +89,16 @@ <h2>review</h2>
             </p>
             <div id="review-revisions" class="revision-rows"></div>
 
-            <!-- A question the next line answers. It used to read "why it is
-                 promotable", which promised a reason and then showed a verdict
-                 over a list of warnings — i.e. the case *against*. -->
-            <h3>can this be promoted?</h3>
+            <!-- A state, said the way every other state on this page is said:
+                 a coloured dot and a word. What the list underneath it is —
+                 and whether it blocks the button — is a caption on the list,
+                 not a sentence standing in for the state. -->
+            <h3>validation</h3>
             <p id="review-verdict" class="verdict"></p>
+            <p id="review-notes-label" class="notes-label" hidden></p>
             <ul id="review-verdict-notes" class="verdict-notes"></ul>
+
+            <h3>provenance</h3>
             <div id="review-provenance" class="facts"></div>
 
             <button id="review-promote" type="button" class="promote" disabled>
diff --git a/mote_fleet/server/ui/review.mjs b/mote_fleet/server/ui/review.mjs
index a1e9b51..2673824 100644
--- a/mote_fleet/server/ui/review.mjs
+++ b/mote_fleet/server/ui/review.mjs
@@ -78,39 +78,57 @@ export function defaultRevision(detail) {
 // server re-runs at promotion — so this can never encourage a promotion the
 // server will refuse, nor discourage one it would accept.
 //
-// **The bar is exactly "no errors", and the verdict has to say so**, because
-// the list underneath it is not the reason for the verdict: warnings are what
-// is imperfect about a revision that passes anyway (a missing posegraph
-// navigates perfectly and simply cannot be extended). A bare "valid, with
-// warnings" over three complaints reads as a claim with its own evidence
-// against it — which is how this was first written, and it left an operator
-// asking what the answer actually was. So the verdict answers yes or no, names
-// the criterion, and introduces the list as what it is.
+// **The bar is exactly "no errors", and that has to be legible**, because the
+// list underneath is not the reason for the verdict: warnings are what is
+// imperfect about a revision that passes anyway (a missing posegraph navigates
+// perfectly and simply cannot be extended). A bare "valid, with warnings" over
+// three complaints reads as a claim with its own evidence against it, and an
+// operator looking at the first build of this pane asked what the answer was.
+//
+// The answer is a **state**, not a sentence. It was briefly written as a
+// question in the heading answered by "yes — no errors. These warnings do not
+// block it:", which says the right thing in the wrong register: this is a
+// control panel, its other headings are nouns, and a wrapped sentence dangling
+// on a colon is not how a status reads. So the state is one word beside a
+// coloured dot — the idiom the roster and the subsystem list already use — and
+// what the list *is* moves into a caption on the list, which is where it
+// belongs and which also stops the bullets running into the provenance.
 export function promotability(revision) {
-  if (!revision) return { promotable: false, verdict: 'no revision selected', notes: [] };
+  if (!revision) {
+    return {
+      promotable: false,
+      verdict: 'no revision selected',
+      state: 'unknown',
+      notes: [],
+      notesLabel: '',
+    };
+  }
   const warnings = revision.warnings || [];
+  const warningLabel = 'warnings — these do not block promotion';
   if (!revision.ok) {
     return {
       promotable: false,
-      verdict: 'no — the validator refuses it:',
+      verdict: 'not promotable',
+      state: 'fault',
       notes: revision.errors || [],
+      notesLabel: 'errors — these block promotion',
     };
   }
   if (revision.canonical) {
     return {
       promotable: false,
-      verdict: warnings.length
-        ? 'this is already the floor’s published map. Warnings:'
-        : 'this is already the floor’s published map',
+      verdict: 'already published',
+      state: 'unknown',
       notes: warnings,
+      notesLabel: warnings.length ? warningLabel : '',
     };
   }
   return {
     promotable: true,
-    verdict: warnings.length
-      ? 'yes — no errors. These warnings do not block it:'
-      : 'yes — the validator found nothing wrong with it',
+    verdict: 'promotable',
+    state: 'ok',
     notes: warnings,
+    notesLabel: warnings.length ? warningLabel : '',
   };
 }
 
@@ -384,11 +402,13 @@ export class ReviewView {
   }
 
   renderVerdict() {
-    const { promotable, verdict, notes } = promotability(this.selected);
-    this.dom.verdict.textContent = verdict;
-    this.dom.verdict.className = `verdict ${
-      this.selected && !this.selected.ok ? 'error' : promotable ? 'ok' : ''
-    }`;
+    const { promotable, verdict, state, notes, notesLabel } = promotability(this.selected);
+    this.dom.verdict.replaceChildren(
+      el('span', { class: `dot ${state}` }),
+      el('span', { text: verdict }),
+    );
+    this.dom.notesLabel.textContent = notesLabel;
+    this.dom.notesLabel.hidden = !notesLabel;
     this.dom.verdictNotes.replaceChildren(
       ...notes.map((note) => el('li', { text: note })),
     );
diff --git a/mote_fleet/server/ui/style.css b/mote_fleet/server/ui/style.css
index ded046d..78b28ed 100644
--- a/mote_fleet/server/ui/style.css
+++ b/mote_fleet/server/ui/style.css
@@ -765,12 +765,22 @@ main:has(.review-pane.active) > .pane:not(.review-pane) {
   text-overflow: ellipsis;
 }
 
-.verdict.ok {
-  color: var(--ok);
+/* A coloured dot and a word, as the roster and the subsystem list say a state.
+   The colour rides on the dot rather than the text: a sentence in green reads
+   as prose, and this has to read as a status. */
+.verdict {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin: 0;
 }
 
-.verdict.error {
-  color: var(--fault);
+/* What the list below is, and whether it stands between the operator and the
+   button. Also the break that stops the bullets running into the provenance. */
+.notes-label {
+  margin: 2px 0 0;
+  color: var(--dim);
+  font-size: 12px;
 }
 
 .verdict-notes {
diff --git a/mote_fleet/test/ui_test.mjs b/mote_fleet/test/ui_test.mjs
index 4508dcf..42b5b51 100644
--- a/mote_fleet/test/ui_test.mjs
+++ b/mote_fleet/test/ui_test.mjs
@@ -471,22 +471,49 @@ test('the promote button follows the validator, not the view', () => {
   assert.equal(promotability(null).promotable, false);
 });
 
-test('the verdict answers the question and says what the bar is', () => {
-  // The heading asks "can this be promoted?". A verdict that only classifies
-  // the revision ("valid, with warnings") over a list of complaints answers a
-  // different question and reads as its own counter-evidence — an operator
-  // looking at the first build of this pane asked what the answer was.
-  assert.match(promotability(goodRevision).verdict, /^yes\b/);
-  assert.match(promotability(warnedRevision).verdict, /^yes\b/);
-  assert.match(promotability(brokenRevision).verdict, /^no\b/);
-  // The bar is "no errors", and warnings are explicitly not part of it.
-  assert.match(promotability(warnedRevision).verdict, /no errors/);
-  assert.match(promotability(warnedRevision).verdict, /do not block/);
-  // A list with nothing in it must not be introduced as though it had
-  // something in it.
-  assert.doesNotMatch(promotability(goodRevision).verdict, /:$/);
-  assert.match(promotability(warnedRevision).verdict, /:$/);
-  assert.match(promotability(brokenRevision).verdict, /:$/);
+test('the verdict is a state, not a sentence', () => {
+  // This is a control panel: a status is a word beside a coloured dot, the way
+  // the roster and the subsystem list say one. It was briefly a question in the
+  // heading answered by "yes — no errors. These warnings do not block it:",
+  // which said the right thing in the wrong register — and wrapped onto a
+  // second line ending in a dangling colon.
+  for (const revision of [goodRevision, warnedRevision, brokenRevision, canonicalRevision]) {
+    const { verdict } = promotability(revision);
+    assert.ok(verdict.split(' ').length <= 3, `"${verdict}" is a sentence, not a state`);
+    assert.doesNotMatch(verdict, /[:.]$/);
+    assert.doesNotMatch(verdict, /^(yes|no)\b/);
+  }
+  assert.equal(promotability(goodRevision).verdict, 'promotable');
+  assert.equal(promotability(brokenRevision).verdict, 'not promotable');
+  assert.equal(promotability(canonicalRevision).verdict, 'already published');
+});
+
+test('the state drives the dot, using the classes the page already has', () => {
+  assert.equal(promotability(goodRevision).state, 'ok');
+  assert.equal(promotability(warnedRevision).state, 'ok');
+  assert.equal(promotability(brokenRevision).state, 'fault');
+  assert.equal(promotability(canonicalRevision).state, 'unknown');
+  // A state string that maps to no styling is an invisible state. `unknown` is
+  // the exception by design: it is the base `.dot` colour, so it is expressed
+  // by the absence of a modifier rather than by a rule of its own.
+  const css = read('style.css');
+  for (const state of ['ok', 'fault']) {
+    assert.match(css, new RegExp(`\\.dot\\.${state}\\b`), `style.css has no .dot.${state}`);
+  }
+  assert.match(css, /\.dot \{[^}]*background:\s*var\(--unknown\)/);
+});
+
+test('the notes list is captioned with whether it blocks the button', () => {
+  // The bar is "no errors". That belongs on the list — it says what the list
+  // *is* — rather than inside a verdict standing in for the state.
+  assert.match(promotability(warnedRevision).notesLabel, /^warnings\b/);
+  assert.match(promotability(warnedRevision).notesLabel, /do not block/);
+  assert.match(promotability(brokenRevision).notesLabel, /^errors\b/);
+  assert.match(promotability(brokenRevision).notesLabel, /block/);
+  // No caption over an empty list, or it becomes a heading for nothing and the
+  // break it provides lands in the wrong place.
+  assert.equal(promotability(goodRevision).notesLabel, '');
+  assert.equal(promotability(canonicalRevision).notesLabel, '');
 });
 
 test('provenance is read off the payload the registry already sends', () => {
@@ -564,6 +591,7 @@ test('the review pane has every element app.mjs binds to it', () => {
     'review-revisions',
     'review-verdict',
     'review-verdict-notes',
+    'review-notes-label',
     'review-provenance',
     'review-zones',
     'review-zone-source',