The response is bound to the submitter's ORCID; the report PDFs read as print

Recording a choice on the response page now requires an ORCID session
(verified by the site's proxy and signed into the body) whose iD matches the
one the paper was submitted with; test-tier records accept any whitelisted
test iD, since they store a tier token. The page view carries the submitter's
iD so the page can enable the buttons for the right person. The acceptance
email says so in one sentence. The panel report and RQC PDFs open every
reviewer block and no longer tell the reader to expand rows.

intake/author_approval.py

@@ -178,6 +178,9 @@ def public_view(sub_dir: Path, rec: dict) -> dict:
     return {
         "sub_id": Path(sub_dir).name,
         "test_mode": is_test(Path(sub_dir).name),
+        # The page compares the signed-in ORCID with this before it enables the
+        # buttons; test records carry a tier token, not an ORCID, so they send "".
+        "submitter_orcid": "" if is_test(Path(sub_dir).name) else str((sub.get("form") or {}).get("orcid") or ""),
         "title": sub.get("title") or "",
         "author_display": author,
         "reserved_doi": st.get("crossref_doi") or "",

intake/intake_server.py

@@ -1372,6 +1372,20 @@ async def api_approve_record(request: Request):
     except Exception:
         raise HTTPException(404, "no such approval link")
     test_mode = author_approval.is_test(sub_dir.name)
+    # The link identifies the paper; the person is the ORCID session the site's
+    # proxy verified and signed into the body (2026-09-28). Test records accept
+    # any whitelisted test ORCID: their stored ORCID is a tier token.
+    session_orcid = _normalize_orcid(str(d.get("orcid") or ""))
+    if not session_orcid:
+        raise HTTPException(401, "Sign in with the ORCID iD you submitted with, then respond again.")
+    try:
+        sub_rec = json.loads((sub_dir / "submission.json").read_text())
+    except Exception:
+        sub_rec = {}
+    expected = _normalize_orcid(str((sub_rec.get("form") or {}).get("orcid") or ""))
+    person_ok = is_test_submission(session_orcid) if test_mode else (bool(expected) and session_orcid == expected)
+    if not person_ok:
+        raise HTTPException(403, "This response must come from the ORCID iD the paper was submitted with.")
     try:
         excl = d.get("exclusions") or []
         if not isinstance(excl, list) or len(excl) > 20:

intake/notify_author.py

@@ -129,6 +129,13 @@ def _md_to_pdf_bytes(md_text: str, *, doc_title: str | None = None,
         if end != -1:
             body_md = body_md[end + 4:].lstrip("\n")
     inner = _md_lib.markdown(body_md, extensions=["extra", "sane_lists", "tables"])
+    # Print has no rows to expand: open every reviewer block and say so
+    # (the web record keeps its collapsed rows).
+    inner = inner.replace("<details", "<details open")
+    inner = re.sub(r"Individual reviewer assessments are collapsed by default\.\s*Expand any row to read that "
+                   r"reviewer.s summary\s*and per-dimension justification\.",
+                   "Individual reviewer assessments follow, one per reviewer, each with its summary and "
+                   "per-dimension justification.", inner)
     title_html = f"<title>{doc_title}</title>" if doc_title else ""
     full = (
         f"<!DOCTYPE html><html><head><meta charset='utf-8'>"

intake/templates/submission_accept_upload_pending.md

@@ -31,7 +31,7 @@ These are the terms you accepted at submission (icsacinstitute.org/terms, revise
 
 ## Your response
 
-Open your personal link to approve publication. There you can also tick anything you would rather we did not do — social media, print or broadcast advertising, newsletters, website features, or the annual print and ebook edition of *Persistence* — each all-or-nothing; leave a note for the curation team; ask us to hold and correct something; or withdraw:
+Open your personal link to approve publication. The page asks you to sign in with the ORCID iD you submitted with; the link and that sign-in together are your signature. There you can also tick anything you would rather we did not do — social media, print or broadcast advertising, newsletters, website features, or the annual print and ebook edition of *Persistence* — each all-or-nothing; leave a note for the curation team; ask us to hold and correct something; or withdraw:
 
 **{{approval_url}}**