Saving and publishing are different operations
Saving preserves work in progress. Publishing exposes reviewed content to readers. Combining the two can leak unfinished copy or publish changes that happened after review.
Bind review to an exact version
Submission creates an immutable snapshot of the body and metadata, identified by a hash. A reviewer approves that snapshot. A later draft edit needs a new review; the live page remains pinned to its existing approved revision.
Restore within current access policy
Restoration must respect today's permissions. A document made private must not become public merely because an older revision is restored. Restoring a publication should also preserve the current draft.
Verify behavior, not just the interface
Check that draft edits leave the live page intact, self-approval is denied, stale writes conflict and withdrawal immediately blocks public access. Trustworthy website operations begin with these small invariants.