diff --git a/docs/review-callback-handoff.md b/docs/review-callback-handoff.md
new file mode 100644
index 0000000..bccba2e
--- /dev/null
+++ b/docs/review-callback-handoff.md
@@ -0,0 +1,13 @@
+# Returning owner consent to review
+
+An optional callback registry maps the authenticated intent's client and callback IDs to one exact HTTPS URL. Configuration rejects credentials, queries, fragments, noncanonical paths, duplicate IDs and duplicate JSON fields. It permits at most 32 entries and a 4 KiB form-action policy. Callback selection never uses a browser-supplied address.
+
+After recording consent, the browser can request `POST /api/review-consent/handoff` with its signed ticket. The existing transport requires the current authenticated session, same origin and a session-bound CSRF token. The backend resolves the signed intent's callback before issuing a completion code and checks the current repository authority and saved consent. The transport reloads the session before returning the result. A missing registry leaves this endpoint unavailable.
+
+The page submits the completion envelope as the sole `completion` field in a native HTML POST form. Codes never enter URL parameters or browser storage. The page's form-action policy allows only the configured destinations and its own origin. It removes the temporary form when CSP blocks submission and shows a retry/status message. A late result after an account change cannot submit a form. The signed ticket stays in a controller closure for a retry; it is not submitted to the callback.
+
+The initial cross-site POST does not carry a review session cookie configured with SameSite=Strict. The review receiver must serve a non-caching landing page, then use a same-origin authenticated request and saved initiating-browser state before exchanging the code. Receiving the POST alone must not establish a binding. That receiver and startup activation are separate unfinished work. This change does not mount the upstream consent router or enable an integration.
+
+Validation covers callback configuration, current-session HTTP access, concurrent logout, signed callback scope, consent requirements, browser POST contents, account changes and malformed completions. The disposable MongoDB suite contains 23 passing tests. The local 100-replay binding benchmark measured median 2.20 ms and p95 2.69 ms on a one-CPU, 1 GiB container; this excludes provider traffic. Browser fixture results use synthetic HTTP backend responses and test TLS certificates, so they do not establish provider or certificate-verification behavior.
+
+The full local suite passed 762 tests, with 74 pending tests for optional fixtures. The targeted browser/page suite passed 17 tests, registry/HTTP tests passed 16 with one optional performance case pending, and TypeScript, targeted lint and the UI build passed. Chromium at 1280 and 320 pixels completed the native cross-site POST with no referrer or Strict cookie, no overflow, no external requests, no script errors and no WCAG A/AA violations. A third case blocked the destination with CSP and verified zero callback deliveries and removal of the code form. The first browser harness waited for a navigation that CSP intentionally blocked; changing the assertion to inspect the current document completed this case without changing application code.
diff --git a/public/partials/reviewConsent.htm b/public/partials/reviewConsent.htm
index a7f61ff..26e2639 100644
--- a/public/partials/reviewConsent.htm
+++ b/public/partials/reviewConsent.htm
@@ -4,7 +4,8 @@ <h1 class="mt-3">Approve artifact access</h1>
   <p>This records your approval as the repository owner or an authorized coauthor.</p>
   <p v-if="!user?.username">Sign in first, then reopen the artifact link from your submission. <a href="/signin">Sign in</a></p>
   <p v-if="error" role="alert">{{ error }}</p>
-  <p v-if="saved" role="status">Consent recorded. Artifact linking is not complete. Return to your submission to check its status.</p>
+  <p v-if="saved" role="status">Consent recorded. <span v-if="handoffEnabled">Continue to review to finish linking.</span><span v-else>Artifact linking is not complete. Return to your submission to check its status.</span></p>
+  <button v-if="saved && handoffEnabled" class="btn btn-primary" type="button" @click="continueReview" :disabled="busy">Continue to review</button>
   <form v-if="user?.username && !saved" @submit.prevent="loadPreview">
     <label for="review-repository">Anonymous repository ID</label>
     <input id="review-repository" class="form-control" v-model="repositoryId" maxlength="128" autocomplete="off" :disabled="busy || uncertain" aria-describedby="review-repository-help">
diff --git a/public/script/review-consent.js b/public/script/review-consent.js
index e58240a..5a329e2 100644
--- a/public/script/review-consent.js
+++ b/public/script/review-consent.js
@@ -13,11 +13,12 @@ export function takeReviewFragment(browser) {
 export function reviewConsentController(state, services) {
   const { http, promises, window: browser } = services;
   let handoff = services.takeReviewHandoff();
+  const scope = handoff ? { clientId: handoff.clientId, intentId: handoff.intentId } : null;
   let ticket, csrf, confirmId, consumeId, identity;
   let active = true, expiryTimer;
   const stop = promises.defer();
   const requestId = () => [...browser.crypto.getRandomValues(new Uint8Array(16))].map(byte => byte.toString(16).padStart(2, "0")).join("");
-  Object.assign(state, { repositoryId: "", busy: false, preview: null, acceptAccess: false, acceptRetention: false, uncertain: false, saved: false, expired: false, error: handoff ? "" : "Open a new artifact link from your submission. This link is missing or invalid." });
+  Object.assign(state, { repositoryId: "", handoffEnabled: false, busy: false, preview: null, acceptAccess: false, acceptRetention: false, uncertain: false, saved: false, expired: false, error: handoff ? "" : "Open a new artifact link from your submission. This link is missing or invalid." });
   const current = () => active && state.user?.username === identity;
   function dispose() {
     active = false; handoff = ticket = csrf = undefined;
@@ -28,7 +29,7 @@ export function reviewConsentController(state, services) {
   state.watch(() => state.user?.username, username => {
     if (!identity && username) identity = username;
     else if (identity && username !== identity) {
-      dispose(); state.preview = null; state.busy = false;
+      dispose(); state.preview = null; state.repositoryId = ""; state.busy = false; state.saved = false; state.handoffEnabled = false;
       state.error = "Your account changed. Open a new artifact link from your submission.";
     }
   });
@@ -44,8 +45,10 @@ export function reviewConsentController(state, services) {
     browser.clearTimeout(expiryTimer);
     consumeId ||= requestId();
     try {
-      csrf = (await http.get("/api/review-consent/csrf", { timeout: stop.promise })).data.csrf;
+      const protection = (await http.get("/api/review-consent/csrf", { timeout: stop.promise })).data;
       if (!current()) return;
+      csrf = protection.csrf;
+      state.handoffEnabled = protection.handoffEnabled === true;
       if (!/^[a-f0-9]{64}$/.test(csrf || "")) throw new Error("invalid_csrf");
       const result = (await http.post("/api/review-consent/preview", { repositoryId, intent: { ...handoff, requestId: consumeId } }, options())).data;
       if (!current()) return;
@@ -64,9 +67,36 @@ export function reviewConsentController(state, services) {
       const result = (await http.post("/api/review-consent/confirm", { ticket, requestId: confirmId, acceptAccess: true, acceptRetention: true }, options())).data;
       if (!current()) return;
       if (result?.requestId !== confirmId || !Number.isFinite(Date.parse(result.confirmedAt))) throw new Error("invalid_receipt");
-      state.saved = true; state.uncertain = false; handoff = ticket = undefined;
+      state.saved = true; state.uncertain = false; handoff = undefined; if (!state.handoffEnabled) ticket = undefined;
     } catch (error) {
       if (current()) { state.uncertain = true; state.error = "The confirmation was not verified. Retry with the same approval, or return to your submission to check its status."; }
     } finally { if (current()) state.busy = false; }
   };
+  state.continueReview = async () => {
+    if (!current() || state.busy || !state.saved || !state.handoffEnabled || !ticket || !scope) return;
+    state.busy = true; state.error = "";
+    let form;
+    const cleanup = () => { form?.remove(); browser.removeEventListener("securitypolicyviolation", blocked); };
+    const blocked = event => {
+      if (event.violatedDirective?.startsWith("form-action")) {
+        cleanup(); if (current()) { state.busy = false; state.error = "The return address was blocked. Return to your submission to check the artifact status."; }
+      }
+    };
+    try {
+      const result = (await http.post("/api/review-consent/handoff", { ticket }, options())).data;
+      if (!current()) return;
+      const completion = result?.completion;
+      const target = new URL(result?.callbackUrl);
+      if (!completion || Object.keys(completion).sort().join(",") !== "clientId,code,contract,expiresAt,intentId" || completion.contract !== "4open.artifacts/1" || completion.clientId !== scope.clientId || completion.intentId !== scope.intentId || !/^[a-f0-9]{64}$/.test(completion.code || "") || !Number.isFinite(Date.parse(completion.expiresAt)) || Date.parse(completion.expiresAt) <= Date.now() || Date.parse(completion.expiresAt) > Date.now() + 300000 || target.protocol !== "https:" || target.href !== result.callbackUrl || target.username || target.password || result.callbackUrl.includes("?") || result.callbackUrl.includes("#")) throw new Error("invalid_handoff");
+      form = browser.document.createElement("form"); form.method = "POST"; form.action = target.href;
+      const input = browser.document.createElement("input"); input.type = "hidden"; input.name = "completion"; input.value = JSON.stringify(completion);
+      form.appendChild(input); browser.document.body.appendChild(form);
+      browser.addEventListener("securitypolicyviolation", blocked);
+      state.on("dispose", cleanup);
+      form.submit();
+    } catch {
+      cleanup(); if (current()) { state.busy = false; state.error = "The return to review could not be prepared. Retry from this page, or return to your submission to check its status."; }
+    }
+  };
+
 }
diff --git a/src/server/review-consent-page.ts b/src/server/review-consent-page.ts
index 62e15c0..680bac5 100644
--- a/src/server/review-consent-page.ts
+++ b/src/server/review-consent-page.ts
@@ -1,3 +1,4 @@
+import { ReviewCallbacks } from "./service/review-callbacks";
 import { Request, Response } from "express";
 import { existsSync, readFileSync } from "fs";
 import { resolve } from "path";
@@ -17,6 +18,7 @@ export function isReviewConsentPagePath(path: string): boolean {
 
 export function createReviewConsentPage(
   manifestPath = resolve("public", "asset-manifest.json"),
+  callbacks?: ReviewCallbacks,
 ) {
   return (req: Request, res: Response): void => {
     res.set({
@@ -25,7 +27,7 @@ export function createReviewConsentPage(
       "X-Content-Type-Options": "nosniff",
       "X-Frame-Options": "DENY",
       "Content-Security-Policy":
-        "default-src 'self'; script-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'",
+        "default-src 'self'; script-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action " + (callbacks?.formAction || "'self'") + "; frame-ancestors 'none'",
     });
     if (
       req.originalUrl !== "/review-link" ||
diff --git a/src/server/service/review-callbacks.ts b/src/server/service/review-callbacks.ts
new file mode 100644
index 0000000..7c3dfe1
--- /dev/null
+++ b/src/server/service/review-callbacks.ts
@@ -0,0 +1,28 @@
+import { decodeReviewJSON } from "./review-json";
+const invalid = (): never => { throw new Error("Invalid review callback registry"); };
+export function createReviewCallbacks(raw: string) {
+  let value: unknown;
+  try { value = decodeReviewJSON(Buffer.from(raw, "utf8")); } catch { return invalid(); }
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).sort().join(",") !== "callbacks,version") return invalid();
+  const config = value as { version: unknown; callbacks: unknown };
+  if (config.version !== 1 || !Array.isArray(config.callbacks) || !config.callbacks.length || config.callbacks.length > 32) return invalid();
+  const callbacks = new Map<string, string>(), destinations = new Set<string>();
+  for (const item of config.callbacks) {
+    if (!item || typeof item !== "object" || Array.isArray(item) || Object.keys(item).sort().join(",") !== "callbackId,clientId,url") return invalid();
+    const { clientId, callbackId, url } = item;
+    if (![clientId, callbackId].every(id => typeof id === "string" && /^[a-f0-9]{32}$/.test(id)) || typeof url !== "string" || url.length > 2048) return invalid();
+    let parsed: URL;
+    try { parsed = new URL(url); } catch { return invalid(); }
+    if (parsed.protocol !== "https:" || parsed.href !== url || parsed.username || parsed.password || parsed.search || parsed.hash || url.includes("?") || url.includes("#") || !/^\/[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)*$/.test(parsed.pathname)) return invalid();
+    const key = clientId + ":" + callbackId;
+    if (callbacks.has(key)) return invalid();
+    callbacks.set(key, url); destinations.add(url);
+  }
+  const formAction = "'self' " + [...destinations].join(" ");
+  if (Buffer.byteLength(formAction) > 4096) return invalid();
+  return Object.freeze({
+    formAction,
+    resolve(clientId: string, callbackId: string): string | undefined { return callbacks.get(clientId + ":" + callbackId); },
+  });
+}
+export type ReviewCallbacks = ReturnType<typeof createReviewCallbacks>;
diff --git a/src/server/service/review-consent-http.ts b/src/server/service/review-consent-http.ts
index 262a067..8cc416d 100644
--- a/src/server/service/review-consent-http.ts
+++ b/src/server/service/review-consent-http.ts
@@ -1,3 +1,4 @@
+import { ReviewCallbacks } from "./review-callbacks";
 import { createHmac, timingSafeEqual } from "crypto";
 import * as express from "express";
 import { Request, Response } from "express";
@@ -51,6 +52,7 @@ export function createReviewConsentRouter(
   origin: string,
   backend: ReturnType<typeof createReviewOwnerConsent>,
   csrfKey: Buffer,
+  callbacks?: ReviewCallbacks,
 ) {
   try {
     if (new URL(origin).origin !== origin || !origin.startsWith("https://"))
@@ -77,7 +79,7 @@ export function createReviewConsentRouter(
     res.setHeader("Referrer-Policy", "no-referrer");
     res.setHeader("X-Content-Type-Options", "nosniff");
     res.removeHeader("Access-Control-Allow-Origin");
-    if (!["/csrf", "/preview", "/confirm"].includes(req.url))
+    if (!["/csrf", "/preview", "/confirm", ...(callbacks ? ["/handoff"] : [])].includes(req.url))
       return reject(res, 404, "not-found");
     if (req.method !== (req.url === "/csrf" ? "GET" : "POST"))
       return reject(res, 405, "invalid-request");
@@ -180,17 +182,24 @@ export function createReviewConsentRouter(
         return reject(res, 401, "unauthorized");
       // Derive without saving the session: a late CSRF response must never
       // resurrect a session that a concurrent logout has destroyed.
-      res.json({ csrf: csrf(fresh).toString("hex") });
+      res.json({ csrf: csrf(fresh).toString("hex"), handoffEnabled: !!callbacks });
     } catch {
       reject(res, 503, "unavailable");
     }
   });
   router.use(express.json({ limit: 12288, strict: true, inflate: false }));
-  router.post(["/preview", "/confirm"], async (req, res) => {
+  router.post(["/preview", "/confirm", "/handoff"], async (req, res) => {
     const actor = res.locals.consentActor as Context;
     try {
       let result: unknown;
-      if (req.url === "/preview") {
+      if (req.url === "/handoff") {
+        if (!callbacks || !fields(req.body, ["ticket"]) || typeof req.body.ticket !== "string" || !req.body.ticket || req.body.ticket.length > 8192) return reject(res, 400, "invalid-request");
+        const result = await backend.handoff(actor, req.body.ticket, callbacks.resolve);
+        if (res.destroyed || res.headersSent) return;
+        const fresh = await current(req);
+        if (!fresh || fresh.accountId !== actor.accountId || fresh.sessionId !== actor.sessionId) return reject(res, 401, "unauthorized");
+        res.json({ completion: { contract: result.completion.contract, clientId: result.completion.clientId, intentId: result.completion.intentId, code: result.completion.code, expiresAt: result.completion.expiresAt }, callbackUrl: result.callbackUrl });
+      } else if (req.url === "/preview") {
         if (
           !fields(req.body, ["repositoryId", "intent"]) ||
           typeof req.body.repositoryId !== "string" ||
diff --git a/src/server/service/review-owner-consent.ts b/src/server/service/review-owner-consent.ts
index 8c816a4..db4857f 100644
--- a/src/server/service/review-owner-consent.ts
+++ b/src/server/service/review-owner-consent.ts
@@ -228,7 +228,14 @@ export function createReviewOwnerConsent(
     createHmac("sha256", key)
       .update("4open.review-completion/1." + id + "." + nonce)
       .digest("hex");
-  return Object.freeze({
+  const api = {
+    async handoff(actor: Principal, ticket: string, resolveCallback: (clientId: string, callbackId: string) => string | undefined) {
+      const quote = decode(ticket, principal(actor));
+      const callbackUrl = resolveCallback(quote.intent.clientId, quote.intent.callbackId);
+      if (!callbackUrl) return deny("forbidden");
+      const completion = await api.completion(actor, ticket);
+      return Object.freeze({ completion, callbackUrl });
+    },
     // Called only with the current authenticated browser principal. The HTTP
     // adapter must retain its session reload, same-origin and CSRF checks.
     async completion(actor: Principal, ticket: string) {
@@ -590,5 +597,6 @@ export function createReviewOwnerConsent(
         },
       );
     },
-  });
+  };
+  return Object.freeze(api);
 }
diff --git a/test/review-callbacks.test.js b/test/review-callbacks.test.js
new file mode 100644
index 0000000..2c4e205
--- /dev/null
+++ b/test/review-callbacks.test.js
@@ -0,0 +1,22 @@
+require('ts-node/register/transpile-only');
+const { expect } = require('chai');
+const { createReviewCallbacks } = require('../src/server/service/review-callbacks');
+const entry = () => ({ clientId:'1'.repeat(32),callbackId:'2'.repeat(32),url:'https://review.example.test/api/v1/artifacts/callback' });
+const raw = callbacks => JSON.stringify({version:1,callbacks});
+describe('registered review callback destinations', () => {
+ it('binds exact HTTPS destinations to both client and callback IDs', () => {
+  const registry=createReviewCallbacks(raw([entry()]));
+  expect(registry.resolve(entry().clientId,entry().callbackId)).equal(entry().url);
+  expect(registry.resolve('3'.repeat(32),entry().callbackId)).equal(undefined);
+  expect(registry.resolve(entry().clientId,'4'.repeat(32))).equal(undefined);
+  expect(registry.formAction).equal("'self' "+entry().url);
+ });
+ it('rejects redirect parameters, URL credentials, aliases and unsafe CSP characters', () => {
+  for(const url of ['http://review.example.test/callback','https://owner:secret@review.example.test/callback','https://review.example.test/callback?','https://review.example.test/callback#','https://review.example.test/callback?redirect=https://other.test','https://review.example.test/a/../callback','https://review.example.test/%63allback','https://review.example.test/callback/','https://review.example.test/callback\n','https://review.example.test/','https://review.example.test/callback;script-src']) expect(()=>createReviewCallbacks(raw([{...entry(),url}]))).to.throw('Invalid review callback registry');
+ });
+ it('rejects duplicate decoded configuration fields and bounded registry overflows', () => {
+  for(const value of [raw([]),raw([entry(),entry()]),raw([{...entry(),extra:'x'}]),raw(Array.from({length:33},(_,i)=>({...entry(),callbackId:i.toString(16).padStart(32,'0')}))),raw([entry()]).replace('"version":1','"version":1,"ver\\u0073ion":1'),'{']) expect(()=>createReviewCallbacks(value)).to.throw('Invalid review callback registry');
+  const entries=Array.from({length:4},(_,i)=>({...entry(),callbackId:String(i).repeat(32),url:'https://review.example.test/'+('x'.repeat(1100))+i}));
+  expect(()=>createReviewCallbacks(raw(entries))).to.throw('Invalid review callback registry');
+ });
+});
diff --git a/test/review-consent-http.test.js b/test/review-consent-http.test.js
index 896b348..bba192b 100644
--- a/test/review-consent-http.test.js
+++ b/test/review-consent-http.test.js
@@ -7,6 +7,9 @@ const { randomBytes } = require("crypto");
 const {
   createReviewConsentRouter,
 } = require("../src/server/service/review-consent-http");
+const { createReviewCallbacks } = require("../src/server/service/review-callbacks");
+const callbackURL = "https://review.example.test/api/v1/artifacts/callback";
+const callbacks = createReviewCallbacks(JSON.stringify({version:1,callbacks:[{clientId:"1".repeat(32),callbackId:"6".repeat(32),url:callbackURL}]}));
 const origin = "https://anonymous.example.test";
 const owner = "a".repeat(24);
 const intent = {
@@ -108,6 +111,10 @@ describe("review consent browser HTTP transport", function () {
         };
       },
     };
+    backend.handoff = async (actor, ticket, resolveCallback) => {
+      calls.push({actor,ticket,handoff:true});
+      return { callbackUrl: resolveCallback(intent.clientId,"6".repeat(32)), completion: { contract: intent.contract, clientId: intent.clientId, intentId: intent.intentId, code: "9".repeat(64), expiresAt: new Date(Date.now()+60000).toISOString().replace(/\.\d{3}Z$/, "Z"), privateField: "private-field" }, privateField: "private-field" };
+    };
     const app = express();
     // Model a TLS-terminating trusted loopback proxy, never trust arbitrary peers.
     app.set("trust proxy", "loopback");
@@ -134,8 +141,9 @@ describe("review consent browser HTTP transport", function () {
     });
     app.use(
       "/api/review-consent",
-      createReviewConsentRouter(origin, backend, randomBytes(32)),
+      createReviewConsentRouter(origin, backend, randomBytes(32), callbacks),
     );
+    app.use("/api/review-consent-disabled", createReviewConsentRouter(origin, backend, randomBytes(32)));
     server = http.createServer(app);
     await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
     const login = await request("/test-login");
@@ -500,4 +508,27 @@ describe("review consent browser HTTP transport", function () {
       ) + "\n",
     );
   });
+  it('offers only a configured, current-session completion POST handoff', async function () {
+    expect((await request('/api/review-consent/csrf')).body.handoffEnabled).equal(true);
+    const response=await request('/api/review-consent/handoff',{body:{ticket:'synthetic-signed-ticket'}});
+    expect(response.status).equal(200);expect(response.body.callbackUrl).equal(callbackURL);
+    expect(response.body.completion.code).equal('9'.repeat(64));
+    expect(Object.keys(response.body.completion).sort()).deep.equal(['clientId','code','contract','expiresAt','intentId']);
+    expect(JSON.stringify(response.body)).not.include('private-field');
+    expect(response.headers['cache-control']).equal('no-store');
+    expect((await request('/api/review-consent/handoff',{body:{ticket:'synthetic-signed-ticket',callbackUrl:'https://other.example.test/callback'}})).status).equal(400);
+    expect((await request('/api/review-consent-disabled/csrf')).body.handoffEnabled).equal(false);
+    expect((await request('/api/review-consent-disabled/handoff',{body:{ticket:'synthetic-signed-ticket'}})).status).equal(404);
+  });
+  it('does not disclose a completion code after concurrent logout', async function () {
+    let entered, release;
+    const pending=new Promise(resolve=>{entered=resolve;});
+    const wait=new Promise(resolve=>{release=resolve;});
+    const original=backend.handoff;
+    backend.handoff=async(...args)=>{entered();await wait;return original(...args);};
+    const response=request('/api/review-consent/handoff',{body:{ticket:'synthetic-signed-ticket'}});
+    await pending;await new Promise(resolve=>store.destroy(sid,resolve));release();
+    const result=await response;expect(result.status).equal(401);expect(JSON.stringify(result.body)).not.include('9'.repeat(64));
+  });
+
 });
diff --git a/test/review-consent-ui.test.js b/test/review-consent-ui.test.js
index bd18167..4136502 100644
--- a/test/review-consent-ui.test.js
+++ b/test/review-consent-ui.test.js
@@ -127,4 +127,37 @@ describe('review consent browser page', function () {
     expect(b.document.body.textContent).not.include('Consent recorded.');
   });
 
+  it('posts a completion only to the configured callback without placing secrets in URLs or storage', async function () {
+    const completion={contract:'4open.artifacts/1',clientId:'1'.repeat(32),intentId:'2'.repeat(32),code:'9'.repeat(64),expiresAt:new Date(Date.now()+60000).toISOString()};
+    const callbackUrl='https://review.example.test/api/v1/artifacts/callback';
+    b=await browser({'/api/review-consent/csrf':()=>({csrf,handoffEnabled:true}),'/api/review-consent/handoff':()=>({completion,callbackUrl})});
+    const submissions=[];b.w.HTMLFormElement.prototype.submit=function(){submissions.push({action:this.action,method:this.method,completion:JSON.parse(this.elements.namedItem('completion').value)});};
+    await b.preview();await b.accept();await b.click('button[type=button]');
+    expect(b.document.body.textContent).include('Continue to review to finish linking');
+    await b.click('button[type=button]');
+    expect(submissions).deep.equal([{action:callbackUrl,method:'post',completion}]);
+    expect(b.w.location.href).equal('https://anonymous.example.test/review-link');
+    expect(JSON.stringify(b.w.localStorage)).not.include(completion.code);expect(b.w.sessionStorage.length).equal(0);
+    expect(b.document.documentElement.outerHTML).not.include(token).not.include('private-ticket');
+    expect(b.requests.find(r=>r.pathname.endsWith('/handoff')).payload).deep.equal({ticket:'private-ticket'});
+  });
+  it('does not submit a late completion after account change', async function () {
+    let resolve;
+    b=await browser({'/api/review-consent/csrf':()=>({csrf,handoffEnabled:true}),'/api/review-consent/handoff':()=>new Promise(yes=>{resolve=yes;})});
+    const submissions=[];b.w.HTMLFormElement.prototype.submit=function(){submissions.push(this.action);};
+    await b.preview();await b.accept();await b.click('button[type=button]');await b.click('button[type=button]');
+    b.app.state.user={username:'other'};await delay(5);
+    resolve({completion:{contract:'4open.artifacts/1',clientId:'1'.repeat(32),intentId:'2'.repeat(32),code:'9'.repeat(64),expiresAt:new Date(Date.now()+60000).toISOString()},callbackUrl:'https://review.example.test/api/v1/artifacts/callback'});await delay(30);
+    expect(submissions).length(0);expect(b.document.body.textContent).include('Your account changed');
+    expect(b.document.querySelector('#review-repository').value).equal('');
+  });
+  it('rejects a wrong-intent completion or an unsafe callback destination', async function () {
+    let wrongScope=true;
+    b=await browser({'/api/review-consent/csrf':()=>({csrf,handoffEnabled:true}),'/api/review-consent/handoff':()=>({completion:{contract:'4open.artifacts/1',clientId:'1'.repeat(32),intentId:wrongScope?'f'.repeat(32):'2'.repeat(32),code:'9'.repeat(64),expiresAt:new Date(Date.now()+60000).toISOString()},callbackUrl:wrongScope?'https://review.example.test/api/v1/artifacts/callback':'javascript:alert(1)'})});
+    const submissions=[];b.w.HTMLFormElement.prototype.submit=function(){submissions.push(this.action);};
+    await b.preview();await b.accept();await b.click('button[type=button]');await b.click('button[type=button]');
+    expect(submissions).length(0);wrongScope=false;await b.click('button[type=button]');expect(submissions).length(0);
+    expect(b.document.body.textContent).include('return to review could not be prepared');
+  });
+
 });
diff --git a/test/review-owner-consent.test.js b/test/review-owner-consent.test.js
index 8329e99..f8fea9d 100644
--- a/test/review-owner-consent.test.js
+++ b/test/review-owner-consent.test.js
@@ -783,4 +783,16 @@ describe("review owner consent transactions", function () {
     expect(await connection.db.collection('review_completions').countDocuments({})).equal(0);
   });
 
+  it('resolves callback scope from the signed intent before issuing a code', async function () {
+    const quoted=await store.preview(actor(),'synthetic-repository',request());
+    await store.confirm(actor(),quoted.ticket,confirmation());
+    await rejected(store.handoff(actor(),quoted.ticket,()=>undefined),'forbidden');
+    expect(await connection.db.collection('review_completions').countDocuments({})).equal(0);
+    const selected=[];
+    const result=await store.handoff(actor(),quoted.ticket,(client,callback)=>{selected.push([client,callback]);return 'https://review.example.test/api/v1/artifacts/callback';});
+    expect(selected).deep.equal([[intent().clientId,intent().callbackId]]);
+    expect(result.completion).deep.equal(await store.completion(actor(),quoted.ticket));
+    expect(result.callbackUrl).equal('https://review.example.test/api/v1/artifacts/callback');
+  });
+
 });