diff --git a/application/single_app/app.py b/application/single_app/app.py
index b577689b8..1f72fd2ce 100644
--- a/application/single_app/app.py
+++ b/application/single_app/app.py
@@ -62,6 +62,7 @@
 from route_frontend_notifications import *
 from route_frontend_terms_of_use import register_route_frontend_terms_of_use
 from route_frontend_v2 import register_route_frontend_v2
+from route_access_restriction import register_route_access_restriction
 from route_custom_pages import register_route_custom_pages
 
 from route_backend_chats import *
@@ -927,6 +928,11 @@ def _is_idle_timeout_exempt(path):
     '/api/v2/terms-of-use',
     '/api/v2/terms-of-use/accept',
     '/api/v2/terms-of-use/decline',
+    # The Access restricted screen. The Terms of Use pages require an unrestricted account,
+    # so gating this screen on the terms would bounce a restricted user between the two.
+    '/access-restricted',
+    '/v2/access-restricted',
+    '/api/v2/access-restriction',
     '/robots933456.txt',
     '/favicon.ico',
     '/acceptable_use_policy.html',
@@ -1384,6 +1390,11 @@ def list_semantic_kernel_plugins():
 # ------------------- Terms of Use Routes --
 register_route_blueprint('frontend_terms_of_use', register_route_frontend_terms_of_use)
 
+# ------------------- Access Restricted Routes -----------
+# Login-only on purpose: user_required sends a suspended or blocked user here, so these
+# pages must not require an unrestricted account themselves.
+register_route_blueprint('access_restriction', register_route_access_restriction, login_required_blueprint)
+
 # ------------------- User Profile Routes ----------------
 register_route_blueprint('frontend_profile', register_route_frontend_profile, login_required_blueprint)
 
diff --git a/application/single_app/config.py b/application/single_app/config.py
index 031f58018..cb343976b 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -101,7 +101,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.261.296"
+VERSION = "0.261.297"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 # Opt-out for deployments where App Service Easy Auth is active but the platform
diff --git a/application/single_app/functions_access_restriction.py b/application/single_app/functions_access_restriction.py
new file mode 100644
index 000000000..501e1ed7f
--- /dev/null
+++ b/application/single_app/functions_access_restriction.py
@@ -0,0 +1,213 @@
+# functions_access_restriction.py
+"""Describe a user's access restriction for the access gate and the Access restricted screen.
+
+Control Center and safety remediation restrict a user by writing
+``settings.access = {'status': 'deny', 'datetime_to_allow': <ISO 8601 or None>}``. A
+suspension or block applied for a safety violation also stores a ``notice`` beside them:
+the title and message the user was sent, so the screen a restricted user lands on can say
+why. Control Center writes replace the whole ``access`` value, so restoring access there
+clears the notice too.
+
+This module only reads and builds those values. It imports nothing from ``config`` or
+``functions_settings``: reading the signed-in user's settings, and restoring an expired
+suspension, happen in ``functions_authentication.get_user_access_restriction``.
+"""
+
+from datetime import datetime, timezone
+
+
+ACCESS_RESTRICTION_KIND_SUSPENDED = 'suspended'
+ACCESS_RESTRICTION_KIND_BLOCKED = 'blocked'
+ACCESS_RESTRICTION_KINDS = (
+    ACCESS_RESTRICTION_KIND_SUSPENDED,
+    ACCESS_RESTRICTION_KIND_BLOCKED,
+)
+ACCESS_RESTRICTION_SOURCE_SAFETY_VIOLATION = 'safety_violation'
+
+# What the gate answers an API call from a restricted user with, and where it sends a page.
+ACCESS_RESTRICTED_ERROR = 'access_restricted'
+V2_ACCESS_RESTRICTED_PATH = '/v2/access-restricted'
+CLASSIC_ACCESS_RESTRICTED_PATH = '/access-restricted'
+V2_ACCESS_RESTRICTION_API_PATH = '/api/v2/access-restriction'
+ACCESS_RESTRICTION_PATHS = frozenset({
+    V2_ACCESS_RESTRICTED_PATH,
+    CLASSIC_ACCESS_RESTRICTED_PATH,
+    V2_ACCESS_RESTRICTION_API_PATH,
+})
+
+ACCESS_STATE_ALLOW = 'allow'
+ACCESS_STATE_EXPIRED = 'expired'
+ACCESS_STATE_RESTRICTED = 'restricted'
+
+NOTICE_TITLE_MAX_LENGTH = 200
+NOTICE_MESSAGE_MAX_LENGTH = 4000
+NOTICE_REFERENCE_MAX_LENGTH = 200
+
+LEGACY_PERMANENT_DENY_REASON = 'Access denied by administrator'
+LEGACY_TIMED_DENY_PREFIX = 'Access denied until '
+
+# Shown when a restriction carries no notice, such as one applied from Control Center.
+_DEFAULT_COPY = {
+    ACCESS_RESTRICTION_KIND_SUSPENDED: (
+        'Your access is temporarily suspended',
+        'An administrator has temporarily suspended your access to this application. '
+        'Your access is restored automatically at the time shown.',
+    ),
+    ACCESS_RESTRICTION_KIND_BLOCKED: (
+        'Your access has been blocked',
+        'An administrator has blocked your access to this application. '
+        'Contact your administrator if you have questions about this decision.',
+    ),
+}
+
+_API_SENTENCES = {
+    ACCESS_RESTRICTION_KIND_SUSPENDED: 'Your access to this application is temporarily suspended.',
+    ACCESS_RESTRICTION_KIND_BLOCKED: 'Your access to this application has been blocked by an administrator.',
+}
+
+PUBLIC_RESTRICTION_FIELDS = ('kind', 'until', 'title', 'message', 'reference_id')
+
+
+def _clean_text(value, max_length):
+    """Return trimmed text no longer than ``max_length``, or '' for anything that isn't text."""
+    if not isinstance(value, str):
+        return ''
+    return value.strip()[:max_length]
+
+
+def parse_access_restore_time(value):
+    """Return a stored restore time as an aware UTC datetime, or None when it can't be read.
+
+    A value without a UTC offset is read as UTC, as Control Center reads it.
+    """
+    if not isinstance(value, str) or not value.strip():
+        return None
+    try:
+        parsed = datetime.fromisoformat(value.strip().replace('Z', '+00:00'))
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=timezone.utc)
+    return parsed.astimezone(timezone.utc)
+
+
+def _restriction(kind, until=None, title='', message='', reference_id=None):
+    default_title, default_message = _DEFAULT_COPY[kind]
+    return {
+        'kind': kind,
+        'until': until if kind == ACCESS_RESTRICTION_KIND_SUSPENDED else None,
+        'title': title or default_title,
+        'message': message or default_message,
+        'reference_id': reference_id or None,
+    }
+
+
+def _notice_copy(notice, kind):
+    """Return ``(title, message, reference_id)`` from a stored notice that matches ``kind``.
+
+    A notice written for a different kind of restriction describes something that no longer
+    applies, so it is ignored and the generic copy is used instead.
+    """
+    if not isinstance(notice, dict) or notice.get('kind') != kind:
+        return '', '', None
+    return (
+        _clean_text(notice.get('title'), NOTICE_TITLE_MAX_LENGTH),
+        _clean_text(notice.get('message'), NOTICE_MESSAGE_MAX_LENGTH),
+        _clean_text(notice.get('reference_id'), NOTICE_REFERENCE_MAX_LENGTH) or None,
+    )
+
+
+def describe_access_restriction(access_settings, now=None):
+    """Return ``(state, restriction)`` for a stored ``settings.access`` value.
+
+    ``state`` is ``'allow'``, ``'expired'`` -- a suspension whose restore time has passed,
+    which the caller restores -- or ``'restricted'``, the only state that comes with a
+    restriction. A deny whose restore time can't be read stays in force with no end date,
+    as it always has, and is described as a block.
+
+    The restriction holds ``kind``, ``until`` (ISO 8601 UTC, suspensions only), ``title``,
+    ``message`` and ``reference_id``.
+    """
+    if not isinstance(access_settings, dict) or access_settings.get('status') != 'deny':
+        return ACCESS_STATE_ALLOW, None
+
+    kind = ACCESS_RESTRICTION_KIND_BLOCKED
+    until = None
+    if access_settings.get('datetime_to_allow'):
+        restore_at = parse_access_restore_time(access_settings.get('datetime_to_allow'))
+        if restore_at is not None:
+            if (now or datetime.now(timezone.utc)) >= restore_at:
+                return ACCESS_STATE_EXPIRED, None
+            kind = ACCESS_RESTRICTION_KIND_SUSPENDED
+            until = restore_at.isoformat()
+
+    title, message, reference_id = _notice_copy(access_settings.get('notice'), kind)
+    return ACCESS_STATE_RESTRICTED, _restriction(kind, until, title, message, reference_id)
+
+
+def legacy_access_denied_reason(access_settings, restriction):
+    """Return the reason ``check_user_access_status`` has always given for a restriction."""
+    if restriction.get('kind') == ACCESS_RESTRICTION_KIND_SUSPENDED:
+        return f"{LEGACY_TIMED_DENY_PREFIX}{access_settings.get('datetime_to_allow')}"
+    return LEGACY_PERMANENT_DENY_REASON
+
+
+def fallback_access_restriction(reason=None):
+    """Describe a restriction from its legacy reason alone, with the generic copy.
+
+    Used when the access check refused a user but the stored details could not be read
+    again, so the response still says whether access returns on its own.
+    """
+    text = reason if isinstance(reason, str) else ''
+    if text.startswith(LEGACY_TIMED_DENY_PREFIX):
+        restore_at = parse_access_restore_time(text[len(LEGACY_TIMED_DENY_PREFIX):])
+        if restore_at is not None:
+            return _restriction(ACCESS_RESTRICTION_KIND_SUSPENDED, restore_at.isoformat())
+    return _restriction(ACCESS_RESTRICTION_KIND_BLOCKED)
+
+
+def public_access_restriction(restriction):
+    """Return only the fields of a restriction that are shown to the restricted user."""
+    restriction = restriction if isinstance(restriction, dict) else {}
+    return {field: restriction.get(field) for field in PUBLIC_RESTRICTION_FIELDS}
+
+
+def access_restricted_sentence(restriction):
+    """Return the plain sentence an API response gives a restricted user."""
+    kind = (restriction or {}).get('kind')
+    return _API_SENTENCES.get(kind, _API_SENTENCES[ACCESS_RESTRICTION_KIND_BLOCKED])
+
+
+def build_access_restriction_notice(
+    kind,
+    title,
+    message,
+    until=None,
+    reference_id=None,
+    source=ACCESS_RESTRICTION_SOURCE_SAFETY_VIOLATION,
+    applied_at=None,
+):
+    """Return the ``notice`` stored beside a restriction so the restricted user can see why."""
+    if kind not in ACCESS_RESTRICTION_KINDS:
+        raise ValueError(f'Unsupported access restriction kind: {kind}')
+    return {
+        'kind': kind,
+        'title': _clean_text(title, NOTICE_TITLE_MAX_LENGTH),
+        'message': _clean_text(message, NOTICE_MESSAGE_MAX_LENGTH),
+        'until': until if kind == ACCESS_RESTRICTION_KIND_SUSPENDED and until else None,
+        'source': source,
+        'reference_id': _clean_text(reference_id, NOTICE_REFERENCE_MAX_LENGTH) or None,
+        'applied_at': applied_at or datetime.now(timezone.utc).isoformat(),
+    }
+
+
+def is_v2_request_path(path):
+    """True for V2 pages and V2 API calls. Mirrors ``_is_v2_request_path`` in app.py."""
+    return path in ('/v2', '/api/v2') or path.startswith('/v2/') or path.startswith('/api/v2/')
+
+
+def access_restricted_page_path(request_path):
+    """Return the Access restricted page for the interface ``request_path`` belongs to."""
+    if is_v2_request_path(str(request_path or '')):
+        return V2_ACCESS_RESTRICTED_PATH
+    return CLASSIC_ACCESS_RESTRICTED_PATH
diff --git a/application/single_app/functions_authentication.py b/application/single_app/functions_authentication.py
index 1d466e4a4..203b64024 100644
--- a/application/single_app/functions_authentication.py
+++ b/application/single_app/functions_authentication.py
@@ -6,6 +6,17 @@
 from flask import has_request_context
 
 from config import *
+from functions_access_restriction import (
+    ACCESS_RESTRICTED_ERROR,
+    ACCESS_STATE_EXPIRED,
+    ACCESS_STATE_RESTRICTED,
+    access_restricted_page_path,
+    access_restricted_sentence,
+    describe_access_restriction,
+    fallback_access_restriction,
+    legacy_access_denied_reason,
+    public_access_restriction,
+)
 from functions_appinsights import log_event
 from functions_settings import *
 from functions_debug import debug_print
@@ -743,53 +754,98 @@ def decorated_function(*args, **kwargs):
         return f(*args, **kwargs)
     return decorated_function
 
+def _read_user_access_restriction(user_id):
+    """Return ``(restriction, reason)`` for the user's stored access setting.
+
+    ``restriction`` is None when access is allowed. A suspension whose restore time has
+    passed is restored here, which also clears its notice. Raises when the settings can't
+    be read; callers allow access then, so a storage fault never locks a user out.
+    """
+    # Imported at call time, as the access check always has been, so the check uses the
+    # settings functions functions_settings holds when it runs.
+    from functions_settings import get_user_settings, update_user_settings
+
+    user_settings = get_user_settings(user_id) or {}
+    stored_settings = user_settings.get('settings') if isinstance(user_settings, dict) else None
+    access_settings = stored_settings.get('access') if isinstance(stored_settings, dict) else None
+
+    state, restriction = describe_access_restriction(access_settings)
+    if state == ACCESS_STATE_EXPIRED:
+        update_user_settings(user_id, {
+            'access': {
+                'status': 'allow',
+                'datetime_to_allow': None
+            }
+        })
+        return None, None
+    if state != ACCESS_STATE_RESTRICTED:
+        return None, None
+    return restriction, legacy_access_denied_reason(access_settings, restriction)
+
+
+def get_user_access_restriction(user_id):
+    """Return the user's current access restriction, or None when access is allowed.
+
+    The restriction holds ``kind`` ('suspended' or 'blocked'), ``until`` (ISO 8601 UTC,
+    suspensions only), ``title``, ``message`` and ``reference_id`` -- the user's own data
+    only. Like ``check_user_access_status``, an expired suspension is restored and a failure
+    to read the settings allows access.
+    """
+    if not user_id:
+        return None
+    try:
+        restriction, _reason = _read_user_access_restriction(user_id)
+    except Exception as e:
+        log_event(
+            "[ACCESS_RESTRICTION] Access restriction could not be read; access allowed.",
+            extra={"user_id": user_id, "error_type": type(e).__name__},
+            level=logging.WARNING,
+        )
+        return None
+    return restriction
+
+
 def check_user_access_status(user_id):
     """
     Check if user access is currently allowed based on Control Center settings.
     Returns (is_allowed: bool, reason: str)
     """
     try:
-        from functions_settings import get_user_settings
-        user_settings = get_user_settings(user_id)
-        
-        access_settings = user_settings.get('settings', {}).get('access', {})
-        status = access_settings.get('status', 'allow')
-        
-        if status == 'allow':
-            return True, None
-        
-        if status == 'deny':
-            datetime_to_allow = access_settings.get('datetime_to_allow')
-            if datetime_to_allow:
-                try:
-                    # Check if time-based restriction has expired
-                    allow_time = datetime.fromisoformat(datetime_to_allow.replace('Z', '+00:00'))
-                    current_time = datetime.now(timezone.utc)
-                    
-                    if current_time >= allow_time:
-                        # Time-based restriction has expired, automatically restore access
-                        from functions_settings import update_user_settings
-                        update_user_settings(user_id, {
-                            'access': {
-                                'status': 'allow',
-                                'datetime_to_allow': None
-                            }
-                        })
-                        return True, None
-                    else:
-                        return False, f"Access denied until {datetime_to_allow}"
-                except ValueError:
-                    # Invalid datetime format, treat as permanent deny
-                    return False, "Access denied by administrator"
-            else:
-                return False, "Access denied by administrator"
-        
-        return True, None  # Default to allow if status is unknown
-        
+        restriction, reason = _read_user_access_restriction(user_id)
     except Exception as e:
         debug_print(f"Error checking user access status: {e}")
         return True, None  # Default to allow on error to prevent lockouts
 
+    if restriction is None:
+        return True, None
+    return False, reason
+
+
+def _is_api_request():
+    return (
+        request.accept_mimetypes.accept_json and not request.accept_mimetypes.accept_html
+    ) or request.path.startswith('/api/')
+
+
+def access_restricted_response(user_id, reason=None):
+    """Answer a request from a user whose access is restricted.
+
+    API calls get a 403 that says why, with the caller's own restriction. Page requests
+    are sent to the Access restricted page of the interface they came from, which is
+    served to restricted users so they can read the notice and sign out.
+    """
+    restriction = get_user_access_restriction(user_id) or fallback_access_restriction(reason)
+    restricted_url = access_restricted_page_path(request.path)
+    if _is_api_request():
+        return jsonify({
+            "error": ACCESS_RESTRICTED_ERROR,
+            "message": access_restricted_sentence(restriction),
+            "restriction": public_access_restriction(restriction),
+            "restricted_url": restricted_url,
+        }), 403
+    return redirect(restricted_url)
+
+
 def user_required(f):
     @wraps(f)
     def decorated_function(*args, **kwargs):
@@ -806,10 +862,7 @@ def decorated_function(*args, **kwargs):
             if user_id:
                 is_allowed, reason = check_user_access_status(user_id)
                 if not is_allowed:
-                    if request.accept_mimetypes.accept_json and not request.accept_mimetypes.accept_html or request.path.startswith('/api/'):
-                        return jsonify({"error": "Access Denied", "message": reason}), 403
-                    else:
-                        return f"Access Denied: {reason}", 403
+                    return access_restricted_response(user_id, reason)
         
         return f(*args, **kwargs)
     return decorated_function
diff --git a/application/single_app/functions_safety_remediation.py b/application/single_app/functions_safety_remediation.py
index 806fea96b..2e3e8333f 100644
--- a/application/single_app/functions_safety_remediation.py
+++ b/application/single_app/functions_safety_remediation.py
@@ -3,13 +3,24 @@
 """Helpers for safety violation remediation actions and notifications."""
 
 import logging
-from datetime import datetime
-from typing import Any, Dict, Optional
+import uuid
+from datetime import datetime, timedelta, timezone
+from typing import Any, Dict, List, Optional, Tuple
+
+from azure.core import MatchConditions
+from azure.cosmos import exceptions as cosmos_exceptions
 
 from config import cosmos_safety_container
+from functions_access_restriction import (
+    ACCESS_RESTRICTION_KIND_BLOCKED,
+    ACCESS_RESTRICTION_KIND_SUSPENDED,
+    ACCESS_RESTRICTION_SOURCE_SAFETY_VIOLATION,
+    build_access_restriction_notice,
+    parse_access_restore_time,
+)
 from functions_appinsights import log_event
 from functions_debug import debug_print
-from functions_notifications import create_notification
+from functions_notifications import create_notification, mark_notification_read
 from functions_settings import get_user_settings, update_user_settings
 
 
@@ -17,6 +28,39 @@
 SAFETY_REMEDIATION_SUSPEND = 'SuspendUser'
 SAFETY_REMEDIATION_BLOCK = 'BlockUser'
 
+# Warnings the signed-in user still has to acknowledge, read at most this many at a time.
+SAFETY_WARNING_PENDING_LIMIT = 20
+SAFETY_WARNING_WRITE_ATTEMPTS = 3
+SAFETY_WARNING_FALLBACK_MESSAGE = (
+    'An administrator reviewed content you submitted and sent you this warning. '
+    'Please review the acceptable use requirements before continuing.'
+)
+
+WARNING_ACKNOWLEDGMENT_PENDING = 'pending'
+WARNING_ACKNOWLEDGMENT_ACKNOWLEDGED = 'acknowledged'
+WARNING_ACKNOWLEDGMENT_NOT_TRACKED = 'not_tracked'
+
+# A reviewer can warn about the same violation again, which replaces the warning on it. An
+# acknowledgment of the earlier one is refused with this code rather than recorded against
+# a warning the user has not read.
+SAFETY_WARNING_REPLACED_CODE = 'safety_warning_replaced'
+SAFETY_WARNING_REPLACED_MESSAGE = (
+    'A newer warning replaced this one. Read the newer warning, then acknowledge it.'
+)
+
+# A save claims the violation before it sends a warning, so of two overlapping saves -- a
+# double-click, or two reviewers -- only one sends. While the claim is held the violation is
+# 'sending', which never counts as a warning to acknowledge. A claim older than the time to
+# live is from a save that stopped before it finished: it no longer blocks, and it reads as
+# a failed send, which saving the warning again retries.
+SAFETY_WARNING_SENDING_STATUS = 'sending'
+SAFETY_WARNING_SEND_CLAIM_TTL = timedelta(minutes=5)
+SAFETY_WARNING_SEND_CLAIM_FIELDS = ('warning_send_claim_id', 'warning_send_claimed_at')
+SAFETY_WARNING_SEND_INTERRUPTED_MESSAGE = (
+    'The save that was sending this warning did not finish, so it is not known whether the '
+    'warning reached the user. Saving the warning again sends it again.'
+)
+
 
 def get_safety_log_item(log_id: str) -> Dict[str, Any]:
     """Return a safety log item by its document id."""
@@ -132,6 +176,15 @@ def execute_safety_violation_action(
                 'access': {
                     'status': 'deny',
                     'datetime_to_allow': datetime_to_allow,
+                    # What the user was told, so the Access restricted screen can show it.
+                    'notice': build_access_restriction_notice(
+                        ACCESS_RESTRICTION_KIND_SUSPENDED,
+                        normalized_title,
+                        normalized_message,
+                        until=datetime_to_allow,
+                        reference_id=safety_log.get('id'),
+                        source=ACCESS_RESTRICTION_SOURCE_SAFETY_VIOLATION,
+                    ),
                 }
             },
             allow_cross_user=True,
@@ -147,6 +200,13 @@ def execute_safety_violation_action(
                 'access': {
                     'status': 'deny',
                     'datetime_to_allow': None,
+                    'notice': build_access_restriction_notice(
+                        ACCESS_RESTRICTION_KIND_BLOCKED,
+                        normalized_title,
+                        normalized_message,
+                        reference_id=safety_log.get('id'),
+                        source=ACCESS_RESTRICTION_SOURCE_SAFETY_VIOLATION,
+                    ),
                 }
             },
             allow_cross_user=True,
@@ -204,5 +264,366 @@ def execute_safety_violation_action(
         'success': True,
         'message': result_message,
         'notification_id': notification.get('id'),
+        'notification_title': normalized_title,
+        'notification_message': normalized_message,
         'target_user': target_user,
     }
+
+
+def build_safety_action_execution_updates(
+    action: str,
+    execution_result: Dict[str, Any],
+    executed_at: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Return the safety log fields that record an executed remediation action.
+
+    An executed warning is also marked as needing the user's acknowledgment, with the title
+    and message the user was sent, so it can be shown to them until they acknowledge it.
+    Warnings executed before this was recorded carry none of these fields and are never
+    shown again.
+    """
+    executed_at = executed_at or datetime.now(timezone.utc).isoformat()
+    updates = {
+        'action_request_status': 'executed',
+        'action_executed_at': executed_at,
+        'action_execution_error': None,
+    }
+    if action == SAFETY_REMEDIATION_WARNING:
+        result = execution_result or {}
+        updates.update({
+            'warning_requires_acknowledgment': True,
+            'warning_notification_id': result.get('notification_id'),
+            'warning_title': result.get('notification_title'),
+            'warning_message': result.get('notification_message'),
+            'warning_issued_at': executed_at,
+            'warning_acknowledged_at': None,
+        })
+    return updates
+
+
+def _request_status(log_item: Dict[str, Any]) -> str:
+    return str(log_item.get('action_request_status') or '').strip().lower()
+
+
+def safety_warning_send_in_progress(log_item: Dict[str, Any], now: Optional[datetime] = None) -> bool:
+    """True while a save is sending a warning on this violation, so other writes must wait.
+
+    A claim older than ``SAFETY_WARNING_SEND_CLAIM_TTL`` either way, or one whose time can't
+    be read, is from a save that stopped before it finished, and does not block.
+    """
+    if _request_status(log_item) != SAFETY_WARNING_SENDING_STATUS:
+        return False
+    # The claim time is stored as an ISO UTC time, read the same way as a restore time.
+    claimed_at = parse_access_restore_time(log_item.get('warning_send_claimed_at'))
+    if claimed_at is None:
+        return False
+    now = now or datetime.now(timezone.utc)
+    return abs(now - claimed_at) < SAFETY_WARNING_SEND_CLAIM_TTL
+
+
+def is_interrupted_safety_warning_send(log_item: Dict[str, Any], now: Optional[datetime] = None) -> bool:
+    """True for a violation left 'sending' by a save that stopped before it finished."""
+    return (
+        _request_status(log_item) == SAFETY_WARNING_SENDING_STATUS
+        and not safety_warning_send_in_progress(log_item, now)
+    )
+
+
+def mark_interrupted_safety_warning_send(log_item: Dict[str, Any]) -> None:
+    """Treat an unfinished send as a failed one, in place, so saving the warning retries it."""
+    log_item['action_request_status'] = 'failed'
+    log_item['action_execution_error'] = SAFETY_WARNING_SEND_INTERRUPTED_MESSAGE
+    for field in SAFETY_WARNING_SEND_CLAIM_FIELDS:
+        log_item.pop(field, None)
+
+
+def present_safety_warning_send_state(log_item: Dict[str, Any], now: Optional[datetime] = None) -> None:
+    """Prepare a listed violation's send state for display, in place.
+
+    The claim's id and time are internal. An unfinished send reads as failed, as the next
+    save records it, rather than as sending forever.
+    """
+    if is_interrupted_safety_warning_send(log_item, now):
+        mark_interrupted_safety_warning_send(log_item)
+    for field in SAFETY_WARNING_SEND_CLAIM_FIELDS:
+        log_item.pop(field, None)
+
+
+def _replace_safety_log_if_unchanged(body: Dict[str, Any]) -> Dict[str, Any]:
+    """Write a safety log only if it is still the version that was read."""
+    etag = body.get('_etag')
+    if not etag:
+        # Cosmos DB always returns an ETag; only a store without them lands here.
+        stored = cosmos_safety_container.upsert_item(body)
+    else:
+        stored = cosmos_safety_container.replace_item(
+            item=body['id'],
+            body=body,
+            etag=etag,
+            match_condition=MatchConditions.IfNotModified,
+        )
+    return stored if isinstance(stored, dict) else body
+
+
+def claim_safety_warning_send(log_item: Dict[str, Any]) -> Tuple[Dict[str, Any], str]:
+    """Mark a violation as sending a warning, unless it changed since this save read it.
+
+    The write is conditional on the ETag the save read, so of two saves that read the same
+    version only one claims it. The other gets ``CosmosAccessConditionFailedError`` and must
+    send nothing. The claim also stores the rest of the save's changes. Returns the stored
+    record and the claim's id.
+    """
+    claim_id = str(uuid.uuid4())
+    body = dict(log_item)
+    body.update({
+        'action_request_status': SAFETY_WARNING_SENDING_STATUS,
+        'warning_send_claim_id': claim_id,
+        'warning_send_claimed_at': datetime.now(timezone.utc).isoformat(),
+    })
+    return _replace_safety_log_if_unchanged(body), claim_id
+
+
+def record_safety_warning_send(
+    claimed: Dict[str, Any],
+    claim_id: str,
+    updates: Dict[str, Any],
+) -> Optional[Dict[str, Any]]:
+    """Store what a claimed send did on its violation, and release the claim.
+
+    The write is conditional on the claimed version. When another writer changed the record
+    meanwhile but kept the claim -- archiving it, for example -- the outcome is written on
+    the latest version instead. Returns the stored record, or None when the claim was lost:
+    the record was deleted, or replaced without the claim, so nothing could be recorded.
+    """
+    log_id = claimed.get('id')
+    current = claimed
+    for attempt in range(SAFETY_WARNING_WRITE_ATTEMPTS):
+        if attempt:
+            try:
+                current = cosmos_safety_container.read_item(item=log_id, partition_key=log_id)
+            except cosmos_exceptions.CosmosResourceNotFoundError:
+                return None
+        if current.get('warning_send_claim_id') != claim_id:
+            return None
+        body = dict(current)
+        body.update(updates)
+        for field in SAFETY_WARNING_SEND_CLAIM_FIELDS:
+            body.pop(field, None)
+        body['last_updated'] = datetime.utcnow().isoformat()
+        try:
+            return _replace_safety_log_if_unchanged(body)
+        except cosmos_exceptions.CosmosAccessConditionFailedError:
+            continue
+        except cosmos_exceptions.CosmosResourceNotFoundError:
+            return None
+    return None
+
+
+def serialize_safety_warning_state(log_item: Dict[str, Any]) -> Dict[str, Any]:
+    """Return a record's warning acknowledgment state for reviewers and the warned user.
+
+    ``warning_acknowledgment_status`` is None unless the record holds an executed warning;
+    then it is ``pending``, ``acknowledged`` or ``not_tracked`` for a warning sent before
+    acknowledgment was recorded.
+    """
+    executed_warning = (
+        log_item.get('action') == SAFETY_REMEDIATION_WARNING
+        and str(log_item.get('action_request_status') or '').strip().lower() == 'executed'
+    )
+    requires_acknowledgment = log_item.get('warning_requires_acknowledgment') is True
+    status = None
+    if executed_warning:
+        if not requires_acknowledgment:
+            status = WARNING_ACKNOWLEDGMENT_NOT_TRACKED
+        elif log_item.get('warning_acknowledged_at'):
+            status = WARNING_ACKNOWLEDGMENT_ACKNOWLEDGED
+        else:
+            status = WARNING_ACKNOWLEDGMENT_PENDING
+    return {
+        'warning_requires_acknowledgment': requires_acknowledgment,
+        'warning_issued_at': log_item.get('warning_issued_at'),
+        'warning_acknowledged_at': log_item.get('warning_acknowledged_at'),
+        'warning_acknowledgment_status': status,
+    }
+
+
+def _user_safe_categories(log_item: Dict[str, Any]) -> List[Dict[str, Any]]:
+    categories = []
+    for entry in log_item.get('triggered_categories') or []:
+        if not isinstance(entry, dict):
+            continue
+        name = str(entry.get('category') or '').strip()
+        if not name:
+            continue
+        severity = entry.get('severity')
+        if isinstance(severity, bool) or not isinstance(severity, (int, float)):
+            severity = None
+        categories.append({'category': name, 'severity': severity})
+    return categories
+
+
+def _warning_issued_at(log_item: Dict[str, Any]) -> Optional[str]:
+    """When the warning now on a violation was sent. Each warning sent on it has its own."""
+    return log_item.get('warning_issued_at') or log_item.get('action_executed_at')
+
+
+def serialize_safety_warning_for_user(log_item: Dict[str, Any]) -> Dict[str, Any]:
+    """Return only what the warned user may see of a warning: what they were sent, and when."""
+    return {
+        'id': log_item.get('id'),
+        'violation_id': log_item.get('id'),
+        'title': str(log_item.get('warning_title') or '').strip()
+        or _default_notification_title(SAFETY_REMEDIATION_WARNING),
+        'message': str(log_item.get('warning_message') or '').strip() or SAFETY_WARNING_FALLBACK_MESSAGE,
+        'issued_at': _warning_issued_at(log_item),
+        'acknowledged_at': log_item.get('warning_acknowledged_at'),
+        'triggered_categories': _user_safe_categories(log_item),
+    }
+
+
+def _is_acknowledgeable_warning(log_item: Dict[str, Any], user_id: str) -> bool:
+    """True for the caller's own executed warning that asks for acknowledgment."""
+    return (
+        bool(user_id)
+        and log_item.get('user_id') == user_id
+        and log_item.get('content_origin', 'user') == 'user'
+        and log_item.get('action') == SAFETY_REMEDIATION_WARNING
+        and str(log_item.get('action_request_status') or '').strip().lower() == 'executed'
+        and log_item.get('warning_requires_acknowledgment') is True
+    )
+
+
+_PENDING_WARNING_CONDITIONS = (
+    "c.user_id = @user_id "
+    "AND c.action = @action "
+    "AND c.action_request_status = 'executed' "
+    "AND c.warning_requires_acknowledgment = true "
+    "AND (NOT IS_DEFINED(c.warning_acknowledged_at) OR IS_NULL(c.warning_acknowledged_at)) "
+    "AND (NOT IS_DEFINED(c.content_origin) OR c.content_origin = 'user')"
+)
+
+
+def _pending_warning_parameters(user_id: str) -> List[Dict[str, Any]]:
+    return [
+        {'name': '@user_id', 'value': user_id},
+        {'name': '@action', 'value': SAFETY_REMEDIATION_WARNING},
+    ]
+
+
+def count_pending_safety_warnings(user_id: str) -> int:
+    """Return how many warnings the user still has to acknowledge.
+
+    V2 bootstrap carries this so the interface only asks for the warnings themselves when
+    there are some, rather than on every page load.
+    """
+    if not user_id:
+        return 0
+    values = cosmos_safety_container.query_items(
+        query=f"SELECT VALUE COUNT(1) FROM c WHERE {_PENDING_WARNING_CONDITIONS}",
+        parameters=_pending_warning_parameters(user_id),
+        enable_cross_partition_query=True,
+    )
+    return sum(int(value) for value in values if isinstance(value, (int, float)) and not isinstance(value, bool))
+
+
+def list_pending_safety_warnings(user_id: str) -> List[Dict[str, Any]]:
+    """Return the caller's warnings that still need acknowledgment, oldest first."""
+    if not user_id:
+        return []
+    query = (
+        "SELECT c.id, c.user_id, c.content_origin, c.action, c.action_request_status, "
+        "c.action_executed_at, c.warning_requires_acknowledgment, c.warning_acknowledged_at, "
+        "c.warning_title, c.warning_message, c.warning_issued_at, c.triggered_categories "
+        f"FROM c WHERE {_PENDING_WARNING_CONDITIONS}"
+    )
+    items = list(cosmos_safety_container.query_items(
+        query=query,
+        parameters=_pending_warning_parameters(user_id),
+        enable_cross_partition_query=True,
+    ))
+    pending = [
+        item for item in items
+        if _is_acknowledgeable_warning(item, user_id) and not item.get('warning_acknowledged_at')
+    ]
+    pending.sort(key=lambda item: str(item.get('warning_issued_at') or item.get('action_executed_at') or ''))
+    return [serialize_safety_warning_for_user(item) for item in pending[:SAFETY_WARNING_PENDING_LIMIT]]
+
+
+def _mark_warning_notification_read(log_item: Dict[str, Any], user_id: str) -> None:
+    """Mark the bell notification that delivered the warning as read for its recipient."""
+    notification_id = str(log_item.get('warning_notification_id') or '').strip()
+    if not notification_id:
+        return
+    if not mark_notification_read(notification_id, user_id):
+        log_event(
+            '[SAFETY_WARNINGS] The warning notification could not be marked read.',
+            extra={'safety_log_id': log_item.get('id'), 'user_id': user_id},
+            level=logging.WARNING,
+        )
+
+
+def acknowledge_safety_warning(
+    log_id: str,
+    user_id: str,
+    issued_at: Optional[str] = None,
+) -> Tuple[str, Optional[Dict[str, Any]]]:
+    """Record that the signed-in user acknowledged their own warning.
+
+    Returns ``(status, warning)``. ``status`` is ``acknowledged``, ``already_acknowledged``,
+    ``replaced`` or ``not_found``. A record that doesn't exist, belongs to someone else, or
+    isn't a warning that asks for acknowledgment is ``not_found``, so the answer never
+    confirms another user's record. ``issued_at`` is when the warning the user read was
+    sent: when the violation now holds a warning sent at another time, the one they read was
+    replaced, and nothing is recorded (``replaced``). Without it, the warning now on the
+    violation is acknowledged. The write is conditional on the stored ETag and retried, so a
+    reviewer saving the record at the same moment is never overwritten.
+    """
+    normalized_id = str(log_id or '').strip()
+    if not normalized_id or not user_id:
+        return 'not_found', None
+    expected_issued_at = str(issued_at or '').strip()
+
+    for _attempt in range(SAFETY_WARNING_WRITE_ATTEMPTS):
+        try:
+            item = cosmos_safety_container.read_item(item=normalized_id, partition_key=normalized_id)
+        except cosmos_exceptions.CosmosResourceNotFoundError:
+            return 'not_found', None
+        if not _is_acknowledgeable_warning(item, user_id):
+            return 'not_found', None
+        if expected_issued_at and expected_issued_at != str(_warning_issued_at(item) or '').strip():
+            return 'replaced', None
+        if item.get('warning_acknowledged_at'):
+            _mark_warning_notification_read(item, user_id)
+            return 'already_acknowledged', serialize_safety_warning_for_user(item)
+
+        item['warning_acknowledged_at'] = datetime.now(timezone.utc).isoformat()
+        etag = item.get('_etag')
+        try:
+            if etag:
+                stored = cosmos_safety_container.replace_item(
+                    item=normalized_id,
+                    body=item,
+                    etag=etag,
+                    match_condition=MatchConditions.IfNotModified,
+                )
+            else:
+                stored = cosmos_safety_container.upsert_item(item)
+        except cosmos_exceptions.CosmosAccessConditionFailedError:
+            continue
+
+        stored = stored if isinstance(stored, dict) else item
+        _mark_warning_notification_read(stored, user_id)
+        log_event(
+            '[SAFETY_WARNINGS] Safety warning acknowledged by its recipient.',
+            extra={
+                'safety_log_id': normalized_id,
+                'user_id': user_id,
+                'warning_issued_at': stored.get('warning_issued_at'),
+            },
+        )
+        return 'acknowledged', serialize_safety_warning_for_user(stored)
+
+    raise cosmos_exceptions.CosmosAccessConditionFailedError(
+        status_code=412,
+        message='The safety warning changed while it was being acknowledged.',
+    )
diff --git a/application/single_app/route_access_restriction.py b/application/single_app/route_access_restriction.py
new file mode 100644
index 000000000..08f161b46
--- /dev/null
+++ b/application/single_app/route_access_restriction.py
@@ -0,0 +1,127 @@
+# route_access_restriction.py
+"""The Access restricted screen, in both interfaces, and the call behind the V2 page.
+
+A user whose access an administrator suspended or blocked can still sign in, but
+``functions_authentication.user_required`` refuses every app surface and sends them here.
+These routes are therefore login-only on purpose: they must stay reachable by exactly the
+users ``user_required`` refuses. They only ever describe the signed-in user's own
+restriction, read from their own settings, and never accept a user id from the request.
+
+The Admin role is not subject to access restrictions, so an Admin is always told they are
+not restricted, matching what ``user_required`` enforces.
+"""
+
+from flask import jsonify, make_response, render_template, session
+
+from functions_access_restriction import (
+    ACCESS_RESTRICTION_KIND_SUSPENDED,
+    parse_access_restore_time,
+    public_access_restriction,
+)
+from functions_authentication import get_user_access_restriction, login_required
+from functions_branding_urls import build_custom_logo_urls
+from functions_settings import get_settings, sanitize_settings_for_user
+from route_frontend_v2 import _serve_v2_shell
+from swagger_wrapper import get_auth_security, swagger_route
+
+
+NO_STORE_HEADERS = {"Cache-Control": "no-store"}
+
+
+def _session_user():
+    user = session.get("user")
+    return user if isinstance(user, dict) else {}
+
+
+def _current_restriction():
+    """Return the signed-in user's own restriction, as ``user_required`` would enforce it."""
+    user = _session_user()
+    if "Admin" in (user.get("roles") or []):
+        return None
+    user_id = user.get("oid") or user.get("sub")
+    if not user_id:
+        return None
+    return get_user_access_restriction(user_id)
+
+
+def _restore_display(restriction):
+    """Return a UTC rendering of a suspension's restore time for the server-rendered page."""
+    if not restriction or restriction.get("kind") != ACCESS_RESTRICTION_KIND_SUSPENDED:
+        return ""
+    restore_at = parse_access_restore_time(restriction.get("until"))
+    return restore_at.strftime("%Y-%m-%d %H:%M UTC") if restore_at else ""
+
+
+def _restricted_page_branding(raw_settings, public_settings):
+    """Return the branding the V2 page draws: the fields the V2 Terms of Use page receives.
+
+    Read from the same settings as ``route_backend_v2._build_branding``. Only the logo URLs
+    are returned, never the stored image data.
+    """
+    show_logo = bool(raw_settings.get("show_logo", False))
+    logo_url, logo_dark_url = build_custom_logo_urls(raw_settings)
+    classification_banner = None
+    if raw_settings.get("classification_banner_enabled") and raw_settings.get("classification_banner_text"):
+        classification_banner = {
+            "enabled": True,
+            "text": raw_settings.get("classification_banner_text"),
+            "color": raw_settings.get("classification_banner_color") or "#ffc107",
+            "text_color": raw_settings.get("classification_banner_text_color") or "#ffffff",
+        }
+    return {
+        "app_title": public_settings.get("app_title") or "SimpleChat",
+        "hide_app_title": bool(raw_settings.get("hide_app_title", False)),
+        "show_logo": show_logo,
+        "logo_url": logo_url if show_logo else None,
+        "logo_dark_url": logo_dark_url if show_logo else None,
+        "classification_banner": classification_banner,
+    }
+
+
+def register_route_access_restriction(bp):
+    @bp.route("/v2/access-restricted", methods=["GET"])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    def v2_access_restricted():
+        """Serve the V2 SPA shell for the Access restricted page.
+
+        This static rule is matched ahead of the ``/v2/<path:subpath>`` catch-all, which
+        requires the User role and an unrestricted account. The page itself loads nothing
+        but ``/api/v2/access-restriction``.
+        """
+        return _serve_v2_shell()
+
+    @bp.route("/api/v2/access-restriction", methods=["GET"])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    def v2_access_restriction():
+        """Return the signed-in user's own access restriction for the V2 page.
+
+        ``restricted`` is False once a suspension has ended -- the read restores it -- or
+        an administrator has restored access, and the page then offers to continue.
+        """
+        restriction = _current_restriction()
+        settings = get_settings() or {}
+        payload = {
+            "restricted": restriction is not None,
+            "branding": _restricted_page_branding(settings, sanitize_settings_for_user(settings)),
+        }
+        if restriction is not None:
+            payload["restriction"] = public_access_restriction(restriction)
+        return jsonify(payload), 200, NO_STORE_HEADERS
+
+    @bp.route("/access-restricted", methods=["GET"])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    def access_restricted():
+        """Render the classic Access restricted page for the signed-in user."""
+        restriction = _current_restriction()
+        public_settings = sanitize_settings_for_user(get_settings() or {})
+        response = make_response(render_template(
+            "access_restricted.html",
+            app_settings=public_settings,
+            restriction=public_access_restriction(restriction) if restriction else None,
+            restore_display=_restore_display(restriction),
+        ))
+        response.headers["Cache-Control"] = "no-store"
+        return response
diff --git a/application/single_app/route_backend_control_center.py b/application/single_app/route_backend_control_center.py
index 5762d5c13..5073c3ca9 100644
--- a/application/single_app/route_backend_control_center.py
+++ b/application/single_app/route_backend_control_center.py
@@ -75,6 +75,7 @@
     select_workspace_ids, workspace_members, workspace_row,
 )
 from functions_safety_remediation import (
+    build_safety_action_execution_updates,
     execute_safety_violation_action,
     get_safety_log_item,
     update_safety_log_action_state,
@@ -8762,15 +8763,16 @@ def _execute_safety_violation_request(approval, executor_id, executor_email, exe
             },
         )
 
-        update_safety_log_action_state(safety_log_id, {
-            'action_request_status': 'executed',
+        # Warnings are sent without approval now; this path still finishes warn_user
+        # requests created before that, and marks them for acknowledgment the same way.
+        execution_updates = build_safety_action_execution_updates(action, result)
+        execution_updates.update({
             'action_request_id': approval.get('id'),
             'action_request_type': approval.get('request_type'),
             'action_requested_at': approval.get('created_at'),
             'action_approved_at': approval.get('approved_at'),
-            'action_executed_at': datetime.utcnow().isoformat(),
-            'action_execution_error': None,
         })
+        update_safety_log_action_state(safety_log_id, execution_updates)
 
         return result
 
diff --git a/application/single_app/route_backend_safety.py b/application/single_app/route_backend_safety.py
index 2b722460c..7b6725974 100644
--- a/application/single_app/route_backend_safety.py
+++ b/application/single_app/route_backend_safety.py
@@ -39,21 +39,66 @@
     SAFETY_REMEDIATION_BLOCK,
     SAFETY_REMEDIATION_SUSPEND,
     SAFETY_REMEDIATION_WARNING,
+    SAFETY_WARNING_REPLACED_CODE,
+    SAFETY_WARNING_REPLACED_MESSAGE,
+    acknowledge_safety_warning,
+    build_safety_action_execution_updates,
+    claim_safety_warning_send,
     execute_safety_violation_action,
+    is_interrupted_safety_warning_send,
+    list_pending_safety_warnings,
+    mark_interrupted_safety_warning_send,
+    present_safety_warning_send_state,
+    record_safety_warning_send,
     resolve_safety_target_user,
+    safety_warning_send_in_progress,
+    serialize_safety_warning_state,
 )
+from functions_activity_logging import log_general_admin_action
 from functions_settings import *
 from swagger_wrapper import swagger_route, get_auth_security
 
 
 ALLOWED_SAFETY_PAGE_SIZES = {10, 20, 50, 100}
 ALLOWED_SAFETY_STATUSES = {'New', 'In-Review', 'Resolved', 'Dismissed'}
-ALLOWED_SAFETY_ACTIONS = {'None', 'WarnUser', 'SuspendUser', 'Escalate', 'BlockUser'}
+# Escalate was a label with no workflow behind it. It can no longer be chosen, but a record
+# that already carries it stays editable, so it is still accepted when it is unchanged.
+SAFETY_ACTION_ESCALATE_LEGACY = 'Escalate'
+SELECTABLE_SAFETY_ACTIONS = {'None', 'WarnUser', 'SuspendUser', 'BlockUser'}
+ALLOWED_SAFETY_ACTIONS = SELECTABLE_SAFETY_ACTIONS | {SAFETY_ACTION_ESCALATE_LEGACY}
+SAFETY_ESCALATE_RETIRED_MESSAGE = (
+    'Escalate is no longer available as a safety action. '
+    'Choose None, Warn user, Suspend user or Block user.'
+)
+SAFETY_WARNING_SEND_FAILED_MESSAGE = 'The warning notification could not be sent.'
+# The signed-in user's own pending warnings are never cached, whatever the answer.
+SAFETY_WARNINGS_NO_STORE_HEADERS = {'Cache-Control': 'no-store'}
+# Of two overlapping saves that would send a warning -- a double-click, or two reviewers --
+# only the one that claims the violation first sends it; the other is refused with this code.
+SAFETY_WARNING_IN_PROGRESS_CODE = 'safety_warning_in_progress'
+SAFETY_WARNING_SENDING_MESSAGE = (
+    'A warning for this violation is being sent right now, so nothing was saved. '
+    'Reload the violation in a moment to see the result.'
+)
+SAFETY_WARNING_CLAIM_CONFLICT_MESSAGE = (
+    'Another save of this violation got there first, so this one saved nothing and sent no '
+    'warning. Reload the violation in a moment to see the result.'
+)
+SAFETY_WARNING_NOT_RECORDED_CODE = 'safety_warning_not_recorded'
+SAFETY_WARNING_NOT_RECORDED_MESSAGE = (
+    'The warning was sent to the user, but it could not be recorded on this violation. '
+    'Reload the violation before saving it again, so the warning is not sent twice.'
+)
 SAFETY_REMEDIATION_ACTIONS = {
     SAFETY_REMEDIATION_WARNING,
     SAFETY_REMEDIATION_SUSPEND,
     SAFETY_REMEDIATION_BLOCK,
 }
+# Suspend and block restrict access, so another eligible reviewer must approve them.
+SAFETY_APPROVAL_REQUIRED_ACTIONS = {
+    SAFETY_REMEDIATION_SUSPEND,
+    SAFETY_REMEDIATION_BLOCK,
+}
 SAFETY_ACTION_REQUEST_TYPE_MAP = {
     SAFETY_REMEDIATION_WARNING: TYPE_WARN_USER,
     SAFETY_REMEDIATION_SUSPEND: TYPE_SUSPEND_USER,
@@ -194,6 +239,8 @@ def _query_safety_logs(
     ))
     for log_item in logs:
         log_item.update(serialize_archive_metadata(log_item))
+        present_safety_warning_send_state(log_item)
+        log_item.update(serialize_safety_warning_state(log_item))
     return strip_private_chat_checks(logs) if user_id else logs
 
 
@@ -335,6 +382,145 @@ def _log_safety_audit_failure(log_id, lifecycle_action):
         level=logging.ERROR,
     )
 
+
+def _log_safety_warning_sent(item, actor, notification_id):
+    """Record the reviewer's warning in the activity log, the audit an approval used to be."""
+    return log_general_admin_action(
+        admin_user_id=actor.get('id'),
+        admin_email=actor.get('email') or '',
+        action='safety_violation_warning_sent',
+        description='Sent a safety violation warning to a user.',
+        additional_context={
+            'record_type': 'safety_violation',
+            'record_id': item.get('id'),
+            'target_user_id': item.get('user_id'),
+            'notification_id': notification_id,
+        },
+    )
+
+
+def _send_safety_warning_now(item, actor, notification_title, notification_message):
+    """Send a warning as the reviewer saves it, and record it on the violation.
+
+    A suspension or block restricts access, so it waits for a second reviewer. A warning
+    restricts nothing, so it is sent at once: the reviewer's decision is audited, and the
+    user has to acknowledge the warning before carrying on.
+
+    Nothing is sent until this save has claimed the violation, with a write conditional on
+    the version it read, so of two overlapping saves -- a double-click, or two reviewers --
+    only one sends the warning. The outcome is then written on the claimed version.
+    Returns ``(response, status)``.
+    """
+    item['action_request_id'] = None
+    item['action_request_type'] = None
+    item['action_requested_at'] = None
+    item['action_approved_at'] = None
+    item['action_notification_title'] = notification_title or None
+    item['action_notification_message'] = notification_message or None
+    item['action_datetime_to_allow'] = None
+    item['action_executed_at'] = None
+    item['action_execution_error'] = None
+    item['last_updated'] = datetime.utcnow().isoformat()
+
+    try:
+        claimed, claim_id = claim_safety_warning_send(item)
+    except CosmosAccessConditionFailedError:
+        log_event(
+            '[SAFETY_REMEDIATION] An overlapping save claimed the safety warning first; this save sent nothing.',
+            {'safety_log_id': item.get('id'), 'actor_id': actor.get('id')},
+            level=logging.WARNING,
+        )
+        return jsonify({
+            'error': SAFETY_WARNING_CLAIM_CONFLICT_MESSAGE,
+            'code': SAFETY_WARNING_IN_PROGRESS_CODE,
+        }), 409
+
+    try:
+        execution_result = execute_safety_violation_action(
+            action=SAFETY_REMEDIATION_WARNING,
+            safety_log=claimed,
+            notification_title=notification_title,
+            notification_message=notification_message,
+            datetime_to_allow=None,
+            actor=actor,
+        )
+    except Exception as exc:
+        log_event(
+            '[SAFETY_REMEDIATION] A safety warning could not be sent.',
+            {
+                'safety_log_id': item.get('id'),
+                'actor_id': actor.get('id'),
+                'error_type': type(exc).__name__,
+            },
+            level=logging.ERROR,
+        )
+        try:
+            recorded = record_safety_warning_send(claimed, claim_id, {
+                'action_request_status': 'failed',
+                'action_executed_at': None,
+                'action_execution_error': SAFETY_WARNING_SEND_FAILED_MESSAGE,
+            })
+        except Exception:
+            recorded = None
+        if recorded is None:
+            log_event(
+                '[SAFETY_REMEDIATION] A failed safety warning could not be recorded on its violation.',
+                {'safety_log_id': item.get('id'), 'actor_id': actor.get('id')},
+                level=logging.ERROR,
+            )
+        return jsonify({
+            'error': 'The warning could not be sent. The rest of the review was saved; save it again to retry.',
+        }), 500
+
+    notification_id = execution_result.get('notification_id')
+    updates = build_safety_action_execution_updates(SAFETY_REMEDIATION_WARNING, execution_result)
+    record_error_type = None
+    try:
+        stored = record_safety_warning_send(claimed, claim_id, updates)
+    except Exception as exc:
+        stored = None
+        record_error_type = type(exc).__name__
+    # The warning reached the user either way, so the reviewer's decision is audited.
+    audit_logged = _log_safety_warning_sent(stored or claimed, actor, notification_id)
+
+    if stored is None:
+        log_event(
+            '[SAFETY_REMEDIATION] A safety warning was sent, but it could not be recorded on its violation.',
+            {
+                'safety_log_id': item.get('id'),
+                'target_user_id': item.get('user_id'),
+                'actor_id': actor.get('id'),
+                'notification_id': notification_id,
+                'error_type': record_error_type or 'claim_lost',
+            },
+            level=logging.ERROR,
+        )
+        return jsonify({
+            'error': SAFETY_WARNING_NOT_RECORDED_MESSAGE,
+            'code': SAFETY_WARNING_NOT_RECORDED_CODE,
+            'audit_logged': audit_logged,
+        }), 500 if record_error_type else 409
+
+    log_event(
+        '[SAFETY_REMEDIATION] Safety warning sent without a second reviewer.',
+        {
+            'safety_log_id': item.get('id'),
+            'target_user_id': item.get('user_id'),
+            'actor_id': actor.get('id'),
+            'actor_email': actor.get('email'),
+            'notification_id': notification_id,
+        },
+    )
+    response = {
+        'message': 'Warning sent to the user.',
+        'approval_required': False,
+        'approval_id': None,
+        'audit_logged': audit_logged,
+    }
+    if not response['audit_logged']:
+        response['audit_warning'] = 'The warning was sent, but the audit activity could not be recorded.'
+    return jsonify(response), 200
+
 def register_route_backend_safety(bp):
     def chat_check_error(error):
         if isinstance(error, (CosmosAccessConditionFailedError, CosmosResourceNotFoundError)):
@@ -491,6 +677,12 @@ def update_safety_log(log_id):
         """
         Updates status, action, and notes on a safety log.
         Also sets timestamps (created_at if missing, and last_updated).
+
+        Warn user sends the warning as soon as the review is saved; saving the record again
+        does not send it twice, and of two overlapping saves only the one that claims the
+        violation first sends it. Suspend user and Block user restrict access, so they create an
+        approval request that another eligible reviewer must approve. Escalate can no longer
+        be chosen; it is only accepted unchanged on a record that already carries it.
         """
         data = request.get_json() or {}
         status = data.get("status")
@@ -508,6 +700,11 @@ def update_safety_log(log_id):
                 return jsonify({'error': 'Invalid safety action'}), 400
 
             item = cosmos_safety_container.read_item(item=log_id, partition_key=log_id)
+            previous_action = str(item.get('action') or 'None')
+            existing_request_status = str(item.get('action_request_status') or '').strip().lower()
+
+            if action == SAFETY_ACTION_ESCALATE_LEGACY and previous_action != SAFETY_ACTION_ESCALATE_LEGACY:
+                return jsonify({'error': SAFETY_ESCALATE_RETIRED_MESSAGE}), 400
 
             if action in SAFETY_REMEDIATION_ACTIONS and item.get("content_origin", "user") != "user":
                 return jsonify({"error": "AI-generated findings cannot be used to warn or restrict a user."}), 400
@@ -515,12 +712,21 @@ def update_safety_log(log_id):
             if not item.get("created_at"):
                 item["created_at"] = datetime.utcnow().isoformat()
 
-            existing_request_status = str(item.get('action_request_status') or '').strip().lower()
             if existing_request_status == 'pending':
                 return jsonify({
                     'error': 'This violation already has a pending remediation approval request.'
                 }), 409
 
+            # While another save is sending a warning, the violation waits for it to finish.
+            if safety_warning_send_in_progress(item):
+                return jsonify({
+                    'error': SAFETY_WARNING_SENDING_MESSAGE,
+                    'code': SAFETY_WARNING_IN_PROGRESS_CODE,
+                }), 409
+            if is_interrupted_safety_warning_send(item):
+                mark_interrupted_safety_warning_send(item)
+                existing_request_status = 'failed'
+
             normalized_datetime_to_allow = None
             if action in SAFETY_REMEDIATION_ACTIONS:
                 normalized_datetime_to_allow = _validate_safety_remediation_request(action, datetime_to_allow)
@@ -537,7 +743,16 @@ def update_safety_log(log_id):
             if not actor.get('id'):
                 return jsonify({'error': 'No user ID found in session'}), 403
 
-            if action in SAFETY_REMEDIATION_ACTIONS:
+            # Saving a warned record again, for example to resolve it, must not warn twice.
+            warning_already_sent = (
+                action == SAFETY_REMEDIATION_WARNING
+                and previous_action == SAFETY_REMEDIATION_WARNING
+                and existing_request_status == 'executed'
+            )
+            if action == SAFETY_REMEDIATION_WARNING and not warning_already_sent:
+                return _send_safety_warning_now(item, actor, notification_title, notification_message)
+
+            if action in SAFETY_APPROVAL_REQUIRED_ACTIONS:
                 target_user = resolve_safety_target_user(item.get('user_id'))
                 request_type = SAFETY_ACTION_REQUEST_TYPE_MAP[action]
                 approval_reason = notes or notification_message or f"Requested {action} for safety violation {log_id}."
@@ -607,7 +822,7 @@ def update_safety_log(log_id):
 
             cosmos_safety_container.upsert_item(item)
 
-            if action in SAFETY_REMEDIATION_ACTIONS:
+            if action in SAFETY_APPROVAL_REQUIRED_ACTIONS:
                 if item.get('action_request_status') == 'pending':
                     return jsonify({
                         'message': 'Safety log updated and remediation approval request created.',
@@ -621,17 +836,30 @@ def update_safety_log(log_id):
                     'approval_id': item.get('action_request_id'),
                 }), 200
 
+            if warning_already_sent:
+                return jsonify({
+                    'message': 'Safety log updated. The warning was already sent, so it was not sent again.',
+                    'approval_required': False,
+                    'warning_already_sent': True,
+                }), 200
+
             return jsonify({"message": "Safety log updated successfully."}), 200
+        except exceptions.CosmosResourceNotFoundError:
+            return jsonify({'error': 'Safety violation not found'}), 404
         except exceptions.CosmosHttpResponseError as e:
-            return jsonify({"error": str(e)}), 404
+            log_event('[SAFETY_VIOLATIONS] Failed to update safety log', {
+                'safety_log_id': log_id,
+                'error_type': type(e).__name__,
+            }, level=logging.ERROR)
+            return jsonify({'error': 'Failed to update safety log.'}), 500
         except ValueError as e:
             return jsonify({'error': str(e)}), 400
         except Exception as e:
             log_event('[SAFETY_VIOLATIONS] Failed to update safety log', {
                 'safety_log_id': log_id,
-                'error': str(e),
+                'error_type': type(e).__name__,
             }, level=logging.ERROR)
-            return jsonify({'error': f'Failed to update safety log: {str(e)}'}), 500
+            return jsonify({'error': 'Failed to update safety log.'}), 500
 
     @bp.route('/api/safety/logs/<string:log_id>/archive', methods=['PATCH'])
     @swagger_route(security=get_auth_security())
@@ -703,6 +931,14 @@ def delete_safety_log(log_id):
                         'approval request is pending.'
                     )
                 }), 409
+            if safety_warning_send_in_progress(item):
+                return jsonify({
+                    'error': (
+                        'This safety violation cannot be deleted while a warning for it is '
+                        'being sent. Try again in a moment.'
+                    ),
+                    'code': SAFETY_WARNING_IN_PROGRESS_CODE,
+                }), 409
             cosmos_safety_container.delete_item(item=log_id, partition_key=log_id)
         except exceptions.CosmosResourceNotFoundError:
             return jsonify({'error': 'Safety violation not found'}), 404
@@ -854,3 +1090,76 @@ def update_my_safety_log(log_id):
         except exceptions.CosmosHttpResponseError as e:
             log_event("[CONTENT_SAFETY] User content-check note could not be saved.", extra={"error_type": type(e).__name__}, level=logging.WARNING)
             return jsonify({"error": "The content-check note could not be saved."}), 404
+
+    # A warning that was sent must stay acknowledgeable even if an administrator later turns
+    # content checks reporting off, so these two routes are not gated on that setting.
+    @bp.route('/api/safety/warnings/pending', methods=['GET'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    def get_pending_safety_warnings():
+        """Return the signed-in user's own safety warnings that still need acknowledgment.
+
+        Only what the user was sent is returned: the title, message, when it was issued,
+        the violation id and its triggered categories.
+        """
+        user_id = _get_safety_session_user_id()
+        if not user_id:
+            return jsonify({"error": "No user ID found in session"}), 403, SAFETY_WARNINGS_NO_STORE_HEADERS
+
+        try:
+            warnings = list_pending_safety_warnings(user_id)
+        except Exception as e:
+            log_event(
+                "[SAFETY_WARNINGS] Pending safety warnings could not be read.",
+                extra={"user_id": user_id, "error_type": type(e).__name__},
+                level=logging.WARNING,
+            )
+            return jsonify({"error": "Your warnings could not be loaded."}), 500, SAFETY_WARNINGS_NO_STORE_HEADERS
+
+        return jsonify({"warnings": warnings, "count": len(warnings)}), 200, SAFETY_WARNINGS_NO_STORE_HEADERS
+
+    @bp.route('/api/safety/warnings/<string:log_id>/acknowledge', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    def acknowledge_pending_safety_warning(log_id):
+        """Record that the signed-in user acknowledged one of their own safety warnings.
+
+        Repeating it changes nothing. Any record that isn't the caller's own warning is
+        answered 404, so the response never confirms that another user's record exists.
+        The body may carry ``issued_at``, as listed by the pending route: when the
+        violation has since been warned about again, the warning the user read was
+        replaced, and 409 ``safety_warning_replaced`` records nothing.
+        """
+        user_id = _get_safety_session_user_id()
+        if not user_id:
+            return jsonify({"error": "No user ID found in session"}), 403
+
+        payload = request.get_json(silent=True)
+        issued_at = payload.get('issued_at') if isinstance(payload, dict) else None
+        if issued_at is not None and not isinstance(issued_at, str):
+            return jsonify({"error": "issued_at must be a string."}), 400
+
+        try:
+            status, warning = acknowledge_safety_warning(log_id, user_id, issued_at=issued_at)
+        except Exception as e:
+            log_event(
+                "[SAFETY_WARNINGS] A safety warning acknowledgment could not be saved.",
+                extra={"user_id": user_id, "error_type": type(e).__name__},
+                level=logging.ERROR,
+            )
+            return jsonify({"error": "Your acknowledgment could not be saved. Try again."}), 500
+
+        if status == 'not_found':
+            return jsonify({"error": "Warning not found."}), 404
+        if status == 'replaced':
+            return jsonify({
+                "error": SAFETY_WARNING_REPLACED_MESSAGE,
+                "code": SAFETY_WARNING_REPLACED_CODE,
+            }), 409
+        return jsonify({
+            "success": True,
+            "already_acknowledged": status == 'already_acknowledged',
+            "warning": warning,
+        }), 200
diff --git a/application/single_app/route_backend_v2.py b/application/single_app/route_backend_v2.py
index 2e7d3926f..70e1e32c0 100644
--- a/application/single_app/route_backend_v2.py
+++ b/application/single_app/route_backend_v2.py
@@ -170,6 +170,7 @@
     keyvault_model_endpoint_save_helper,
 )
 from functions_keyvault_errors import KeyVaultSecretStorageError
+from functions_safety_remediation import count_pending_safety_warnings
 from functions_source_review import (
     get_source_review_runtime_capabilities,
     is_source_review_enabled_for_user,
@@ -1112,6 +1113,20 @@ def v2_bootstrap():
             except Exception as exc:
                 logger.warning(f"[V2_BOOTSTRAP] Failed to resolve workspace sections: {exc}")
 
+            # Safety warnings an administrator sent that still need the user's
+            # acknowledgment. Only the count rides here, so the interface asks for the
+            # warnings themselves only when there are some. A failed read counts none; the
+            # next bootstrap, on reload or when the tab comes back, reads again.
+            pending_safety_warnings = 0
+            try:
+                pending_safety_warnings = count_pending_safety_warnings(user_id)
+            except Exception as exc:
+                log_event(
+                    "[V2_BOOTSTRAP] Pending safety warnings could not be counted.",
+                    extra={"user_id": user_id, "error_type": type(exc).__name__},
+                    level=logging.WARNING,
+                )
+
             payload = {
                 "version": VERSION,
                 "user": {
@@ -1148,6 +1163,7 @@ def v2_bootstrap():
                 "notices": _build_notices(public_settings, user_settings_dict),
                 "workspace": workspace,
                 "workspace_uploads": _build_workspace_uploads(public_settings),
+                "safety_warnings": {"pending": pending_safety_warnings},
                 "settings": public_settings,
             }
 
diff --git a/application/single_app/static/js/access-restricted.js b/application/single_app/static/js/access-restricted.js
new file mode 100644
index 000000000..195606f70
--- /dev/null
+++ b/application/single_app/static/js/access-restricted.js
@@ -0,0 +1,32 @@
+// access-restricted.js
+// Shows a suspension's restore time in the reader's own locale and time zone. The page
+// already renders it in UTC, so the text only improves when this runs.
+
+(function () {
+    function formatLocalDateTime(value) {
+        const parsed = new Date(value);
+        if (Number.isNaN(parsed.getTime())) {
+            return '';
+        }
+        try {
+            return parsed.toLocaleString(undefined, { dateStyle: 'full', timeStyle: 'short' });
+        } catch (error) {
+            return parsed.toLocaleString();
+        }
+    }
+
+    function localizeRestoreTimes() {
+        document.querySelectorAll('time[data-local-datetime]').forEach(function (element) {
+            const formatted = formatLocalDateTime(element.dataset.localDatetime || '');
+            if (formatted) {
+                element.textContent = formatted;
+            }
+        });
+    }
+
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', localizeRestoreTimes);
+    } else {
+        localizeRestoreTimes();
+    }
+}());
diff --git a/application/single_app/static/js/admin/admin-safety-violations.js b/application/single_app/static/js/admin/admin-safety-violations.js
index 7154ab557..8bf519c92 100644
--- a/application/single_app/static/js/admin/admin-safety-violations.js
+++ b/application/single_app/static/js/admin/admin-safety-violations.js
@@ -13,11 +13,14 @@
     const SAFETY_VIEW_STORAGE_KEY = 'simplechat.admin.safetyViolations.viewMode';
 
     const SAFETY_REMEDIATION_ACTIONS = new Set(['WarnUser', 'SuspendUser', 'BlockUser']);
+    // Escalate is no longer an action. A record that already carries it keeps it, labelled
+    // as legacy, and only that record's editor offers it again.
+    const LEGACY_ESCALATE_ACTION = 'Escalate';
     const ACTION_LABELS = {
         None: 'None',
         WarnUser: 'Warn user',
         SuspendUser: 'Suspend user',
-        Escalate: 'Escalate',
+        Escalate: 'Escalated (legacy)',
         BlockUser: 'Block user',
     };
 
@@ -415,6 +418,8 @@
         const requestStatus = String(logItem.action_request_status || '').toLowerCase();
         if (requestStatus === 'pending') {
             actionLabel += ' (Pending approval)';
+        } else if (requestStatus === 'sending') {
+            actionLabel += ' (Sending)';
         } else if (requestStatus === 'failed') {
             actionLabel += ' (Execution failed)';
         }
@@ -470,10 +475,55 @@
         return messageLines.join('\n');
     }
 
+    function isExecutedWarning(logItem) {
+        return logItem.action === 'WarnUser'
+            && String(logItem.action_request_status || '').toLowerCase() === 'executed';
+    }
+
+    function syncLegacyEscalateOption(selectElement, logItem) {
+        if (!selectElement) {
+            return;
+        }
+
+        const existingOption = Array.from(selectElement.options).find(function (option) {
+            return option.value === LEGACY_ESCALATE_ACTION;
+        });
+        if (logItem.action === LEGACY_ESCALATE_ACTION) {
+            if (!existingOption) {
+                const legacyOption = document.createElement('option');
+                legacyOption.value = LEGACY_ESCALATE_ACTION;
+                legacyOption.textContent = ACTION_LABELS.Escalate;
+                selectElement.appendChild(legacyOption);
+            }
+        } else if (existingOption) {
+            existingOption.remove();
+        }
+    }
+
+    function updateWarningAcknowledgment(logItem) {
+        const acknowledgmentElement = document.getElementById('safetyWarningAcknowledgment');
+        if (!acknowledgmentElement) {
+            return;
+        }
+
+        const status = isExecutedWarning(logItem) ? logItem.warning_acknowledgment_status : null;
+        let text = '';
+        if (status === 'acknowledged') {
+            text = `Warning acknowledged ${formatDateTime(logItem.warning_acknowledged_at)}`;
+        } else if (status === 'pending') {
+            text = 'Warning sent. Not yet acknowledged by the user.';
+        } else if (status === 'not_tracked') {
+            text = 'Warning sent before acknowledgment was tracked.';
+        }
+        acknowledgmentElement.textContent = text;
+        setElementHidden(acknowledgmentElement, !text);
+    }
+
     function updateRemediationFields(logItem, forcePopulate) {
         const action = document.getElementById('editAction')?.value || 'None';
         const remediationFields = document.getElementById('safetyRemediationFields');
         const remediationHelp = document.getElementById('safetyRemediationHelp');
+        const notificationGroup = document.getElementById('safetyNotificationGroup');
         const notificationMessage = document.getElementById('editNotificationMessage');
         const suspendGroup = document.getElementById('safetySuspendUntilGroup');
         const suspendInput = document.getElementById('editSuspendUntil');
@@ -494,12 +544,18 @@
             return;
         }
 
+        // A warning already sent is not sent again, so saving this record again only updates it.
+        const warningAlreadySent = action === 'WarnUser' && isExecutedWarning(logItem);
+        setElementHidden(notificationGroup, warningAlreadySent);
+
         const helpTextMap = {
-            WarnUser: 'Warn user sends a notification to the affected user. If this reviewer also has the required Control Center approval role, the warning is approved and sent immediately.',
-            SuspendUser: 'Suspend user uses the Control Center access restriction workflow. Reviewers without approval authority create a pending request instead of applying the suspension immediately.',
-            BlockUser: 'Block user applies a permanent access restriction through the same Control Center access workflow, with no automatic restore date.',
+            WarnUser: 'Warn user sends the warning to the affected user as soon as you save, without a second reviewer. The user must acknowledge it the next time they use SimpleChat.',
+            SuspendUser: 'Suspend user restricts access until the restore date. Because it restricts access, saving creates an approval request, and the suspension applies only after another eligible reviewer approves it.',
+            BlockUser: 'Block user restricts access with no automatic restore date. Saving creates an approval request, and the block applies only after another eligible reviewer approves it.',
         };
-        remediationHelp.textContent = helpTextMap[action] || '';
+        remediationHelp.textContent = warningAlreadySent
+            ? 'This warning was already sent. Saving updates the review without sending the warning again.'
+            : (helpTextMap[action] || '');
 
         const generatedMessage = buildDefaultNotificationMessage(logItem, action);
         const savedMessage = logItem.action === action ? logItem.action_notification_message : '';
@@ -594,7 +650,7 @@
         setTextContent('safetyResolvedCount', data.resolved_count || 0);
         setTextContent('safetyDismissedCount', data.dismissed_count || 0);
         setTextContent('safetyRecentCount', data.recent_30_day_count || 0);
-        setTextContent('safetyEscalatedCount', (data.escalate_count || 0) + (data.block_user_count || 0));
+        setTextContent('safetyBlockedCount', data.block_user_count || 0);
 
         setTextContent('safetyStatsNewSummary', data.new_count || 0);
         setTextContent('safetyStatsInReviewSummary', data.in_review_count || 0);
@@ -603,7 +659,12 @@
         setTextContent('safetyStatsNoneActionSummary', data.none_action_count || 0);
         setTextContent('safetyStatsWarnSummary', data.warn_user_count || 0);
         setTextContent('safetyStatsSuspendSummary', data.suspend_user_count || 0);
-        setTextContent('safetyStatsEscalateSummary', (data.escalate_count || 0) + (data.block_user_count || 0));
+        setTextContent('safetyStatsBlockSummary', data.block_user_count || 0);
+        // Escalations recorded before the action was removed are still counted, and only
+        // shown when there are any.
+        const legacyEscalations = data.escalate_count || 0;
+        setTextContent('safetyStatsLegacyEscalateSummary', legacyEscalations);
+        setElementHidden(document.getElementById('safetyStatsLegacyEscalateRow'), legacyEscalations <= 0);
     }
 
     async function renderSafetyRows(items) {
@@ -752,6 +813,7 @@
         setTextContent('editMessage', item.message || '');
         appendCategoryBadges(document.getElementById('editCategories'), item, 'No triggered categories');
         document.getElementById('editStatus').value = item.status || 'New';
+        syncLegacyEscalateOption(document.getElementById('editAction'), item);
         document.getElementById('editAction').value = item.action || 'None';
         for (const option of document.getElementById('editAction').options) {
             option.disabled = item.content_origin === 'assistant' && SAFETY_REMEDIATION_ACTIONS.has(option.value);
@@ -759,6 +821,7 @@
         document.getElementById('editNotes').value = item.notes || '';
         document.getElementById('editLogId').value = item.id || '';
         setTextContent('safetyEditStatus', '');
+        updateWarningAcknowledgment(item);
         const archiveButton = document.getElementById('archiveSafetyBtn');
         if (archiveButton) {
             archiveButton.dataset.archived = item.isArchived ? 'true' : 'false';
@@ -986,12 +1049,21 @@
 
         if (saveButton) {
             saveButton.addEventListener('click', function () {
+                if (saveButton.disabled) {
+                    return;
+                }
+                // A second click while the save is in flight would send a second request.
+                saveButton.disabled = true;
+                saveButton.setAttribute('aria-busy', 'true');
                 saveSafetyChanges().catch(function (error) {
                     const statusElement = document.getElementById('safetyEditStatus');
                     if (statusElement) {
                         statusElement.textContent = error.message;
                         statusElement.className = 'small text-danger me-auto';
                     }
+                }).finally(function () {
+                    saveButton.disabled = false;
+                    saveButton.removeAttribute('aria-busy');
                 });
             });
         }
diff --git a/application/single_app/static/js/profile/profile-tabs.js b/application/single_app/static/js/profile/profile-tabs.js
index 8de4c556e..01fe9df03 100644
--- a/application/single_app/static/js/profile/profile-tabs.js
+++ b/application/single_app/static/js/profile/profile-tabs.js
@@ -1253,6 +1253,14 @@
         }
     }
 
+    // Escalate is no longer recorded; older records keep it and are labelled as legacy.
+    function formatViolationAction(action) {
+        if (action === 'Escalate') {
+            return 'Escalated (legacy)';
+        }
+        return action || 'None';
+    }
+
     function renderViolationTableRows(items) {
         const tbody = document.querySelector('#profile-violations-table tbody');
         if (!tbody) {
@@ -1272,7 +1280,7 @@
             row.appendChild(createTextCell(logItem.message || '', 'table-message-cell', logItem.message || ''));
             row.appendChild(createSafetyCategoryCell(logItem));
             row.appendChild(createTextCell(logItem.status || 'New'));
-            row.appendChild(createTextCell(logItem.action || 'None'));
+            row.appendChild(createTextCell(formatViolationAction(logItem.action)));
             row.appendChild(createTextCell(logItem.user_notes || '', 'table-note-cell', logItem.user_notes || ''));
 
             const detailsCell = document.createElement('td');
@@ -1346,7 +1354,7 @@
         setTextContent('profile-violation-detail-message', selectedItem.message || '');
         appendSafetyCategoryBadges(document.getElementById('profile-violation-detail-categories'), selectedItem, '-');
         setTextContent('profile-violation-detail-status', selectedItem.status || 'New');
-        setTextContent('profile-violation-detail-action', selectedItem.action || 'None');
+        setTextContent('profile-violation-detail-action', formatViolationAction(selectedItem.action));
         document.getElementById('profile-violation-detail-hidden-id').value = selectedItem.id || '';
         document.getElementById('profile-violation-detail-user-notes').value = selectedItem.user_notes || '';
         setTextContent('profile-violation-save-status', '');
diff --git a/application/single_app/templates/access_restricted.html b/application/single_app/templates/access_restricted.html
new file mode 100644
index 000000000..438563ea3
--- /dev/null
+++ b/application/single_app/templates/access_restricted.html
@@ -0,0 +1,191 @@
+<!-- access_restricted.html -->
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Access restricted - {{ app_settings.app_title or 'SimpleChat' }}</title>
+    <link href="{{ url_for('static', filename='css/bootstrap.min.css') }}" rel="stylesheet" />
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/bootstrap-icons.min.css') }}" />
+    <style>
+        :root {
+            color-scheme: light;
+        }
+
+        body {
+            background: #f7f8fb;
+            color: #24262d;
+            display: flex;
+            flex-direction: column;
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+            margin: 0;
+            min-height: 100vh;
+        }
+
+        .restricted-banner {
+            align-items: center;
+            display: flex;
+            font-weight: 700;
+            justify-content: center;
+            letter-spacing: 0.5px;
+            min-height: 40px;
+            padding: 0.25rem 1rem;
+            text-align: center;
+        }
+
+        .restricted-main {
+            align-items: center;
+            display: flex;
+            flex: 1;
+            justify-content: center;
+            padding: 1.5rem;
+        }
+
+        .restricted-panel {
+            background: #ffffff;
+            border: 1px solid #d9dee8;
+            border-radius: 12px;
+            box-shadow: 0 16px 48px rgba(32, 41, 64, 0.12);
+            max-width: 680px;
+            padding: 2rem;
+            width: 100%;
+        }
+
+        .restricted-identity {
+            align-items: center;
+            display: flex;
+            gap: 0.9rem;
+            margin-bottom: 1.25rem;
+        }
+
+        .restricted-identity img {
+            max-height: 48px;
+            max-width: 48px;
+        }
+
+        .restricted-app-title {
+            color: #667085;
+            font-size: 0.98rem;
+            font-weight: 600;
+            margin: 0;
+        }
+
+        .restricted-eyebrow {
+            color: #b42318;
+            font-size: 0.85rem;
+            font-weight: 700;
+            letter-spacing: 0.04em;
+            margin-bottom: 0.35rem;
+            text-transform: uppercase;
+        }
+
+        .restricted-title {
+            color: #1d2939;
+            font-size: clamp(1.5rem, 3vw, 2rem);
+            font-weight: 700;
+            line-height: 1.2;
+            margin-bottom: 1rem;
+        }
+
+        .restricted-message {
+            background: #f8fafc;
+            border: 1px solid #e4e7ec;
+            border-radius: 10px;
+            color: #344054;
+            line-height: 1.6;
+            max-height: min(45vh, 420px);
+            overflow: auto;
+            padding: 1.1rem 1.25rem;
+            white-space: pre-wrap;
+        }
+
+        .restricted-details {
+            display: grid;
+            gap: 0.35rem 1rem;
+            grid-template-columns: max-content 1fr;
+            margin: 1.25rem 0 0;
+        }
+
+        .restricted-details dt {
+            color: #475467;
+            font-weight: 600;
+        }
+
+        .restricted-details dd {
+            margin: 0;
+            overflow-wrap: anywhere;
+        }
+
+        .restricted-actions {
+            display: flex;
+            flex-wrap: wrap;
+            gap: 0.75rem;
+            justify-content: flex-end;
+            margin-top: 1.5rem;
+        }
+    </style>
+</head>
+<body>
+    {% if app_settings.classification_banner_enabled and app_settings.classification_banner_text %}
+        <div id="classification-banner" class="restricted-banner" role="note"
+             style="background: {{ app_settings.classification_banner_color or '#ffc107' }}; color: {{ app_settings.classification_banner_text_color or '#ffffff' }};">
+            {{ app_settings.classification_banner_text }}
+        </div>
+    {% endif %}
+
+    <!-- Access restricted panel -->
+    <div class="restricted-main">
+        <main class="restricted-panel" aria-labelledby="access-restricted-title" data-testid="access-restricted">
+            <section class="restricted-identity" aria-label="Application identity">
+                {% if app_settings.show_logo %}
+                    {% if app_settings.custom_logo_base64 %}
+                        <img src="{{ url_for('static', filename='images/custom_logo.png') }}?v={{ app_settings.logo_version | default(1) }}" alt="" />
+                    {% else %}
+                        <img src="{{ url_for('static', filename='images/logo-lightmode.png') }}" alt="" />
+                    {% endif %}
+                {% endif %}
+                {% if not app_settings.hide_app_title %}
+                    <p class="restricted-app-title">{{ app_settings.app_title or 'SimpleChat' }}</p>
+                {% endif %}
+            </section>
+
+            {% if restriction %}
+                <p class="restricted-eyebrow">Access restricted</p>
+                <h1 id="access-restricted-title" class="restricted-title">{{ restriction.title }}</h1>
+                <div class="restricted-message" data-testid="access-restricted-message">{{ restriction.message }}</div>
+
+                <dl class="restricted-details">
+                    <dt>Access returns</dt>
+                    {% if restriction.kind == 'suspended' and restriction.until %}
+                        <dd>
+                            <time datetime="{{ restriction.until }}" data-local-datetime="{{ restriction.until }}">{{ restore_display }}</time>
+                        </dd>
+                    {% else %}
+                        <dd>No automatic restore date. Contact your administrator about this decision.</dd>
+                    {% endif %}
+                    {% if restriction.reference_id %}
+                        <dt>Reference</dt>
+                        <dd>{{ restriction.reference_id }}</dd>
+                    {% endif %}
+                </dl>
+
+                <div class="restricted-actions">
+                    <a class="btn btn-outline-secondary" href="{{ url_for('frontend_authentication.logout') }}">
+                        <i class="bi bi-box-arrow-right me-1" aria-hidden="true"></i>Sign out
+                    </a>
+                </div>
+            {% else %}
+                <h1 id="access-restricted-title" class="restricted-title">Your access is available</h1>
+                <p>Your account is not restricted. You can continue to the application.</p>
+
+                <div class="restricted-actions">
+                    <a class="btn btn-outline-secondary" href="{{ url_for('frontend_authentication.logout') }}">Sign out</a>
+                    <a class="btn btn-primary" href="{{ url_for('public_app.index') }}">Continue</a>
+                </div>
+            {% endif %}
+        </main>
+    </div>
+
+    <script src="{{ url_for('static', filename='js/access-restricted.js') }}"></script>
+</body>
+</html>
diff --git a/application/single_app/templates/admin_safety_violations.html b/application/single_app/templates/admin_safety_violations.html
index 1233a89fb..72dab218f 100644
--- a/application/single_app/templates/admin_safety_violations.html
+++ b/application/single_app/templates/admin_safety_violations.html
@@ -289,8 +289,8 @@ <h3 class="h5" id="unchecked-chat-heading">Unchecked chat content</h3>
         </div>
         <div class="col-md-6 col-xl-2">
           <div class="surface-card">
-            <div class="stat-value text-info" id="safetyEscalatedCount">-</div>
-            <div class="stat-label">Escalated</div>
+            <div class="stat-value text-info" id="safetyBlockedCount">-</div>
+            <div class="stat-label">Blocked</div>
           </div>
         </div>
       </div>
@@ -333,8 +333,12 @@ <h5 class="mb-3"><i class="bi bi-tools me-2"></i>Action Distribution</h5>
               <strong id="safetyStatsSuspendSummary">-</strong>
             </div>
             <div class="summary-row">
-              <span>Escalate or block</span>
-              <strong id="safetyStatsEscalateSummary">-</strong>
+              <span>Block user</span>
+              <strong id="safetyStatsBlockSummary">-</strong>
+            </div>
+            <div class="summary-row d-none" id="safetyStatsLegacyEscalateRow">
+              <span>Escalated (legacy)</span>
+              <strong id="safetyStatsLegacyEscalateSummary">-</strong>
             </div>
           </div>
         </div>
@@ -362,7 +366,6 @@ <h5 class="mb-3"><i class="bi bi-tools me-2"></i>Action Distribution</h5>
                 <option value="None">None</option>
                 <option value="WarnUser">Warn user</option>
                 <option value="SuspendUser">Suspend user</option>
-                <option value="Escalate">Escalate</option>
                 <option value="BlockUser">Block user</option>
               </select>
             </div>
@@ -471,16 +474,16 @@ <h5 class="modal-title" id="editModalLabel">View Violation</h5>
             <option value="None">None</option>
             <option value="WarnUser">Warn user</option>
             <option value="SuspendUser">Suspend user</option>
-            <option value="Escalate">Escalate</option>
             <option value="BlockUser">Block user</option>
           </select>
         </div>
+        <div class="alert alert-secondary py-2 d-none" id="safetyWarningAcknowledgment" role="status"></div>
         <div class="mb-3 d-none" id="safetyRemediationFields">
           <div class="alert alert-info py-2" id="safetyRemediationHelp"></div>
-          <div class="mb-3">
+          <div class="mb-3" id="safetyNotificationGroup">
             <label class="form-label fw-bold" for="editNotificationMessage">Notification</label>
             <textarea class="form-control" id="editNotificationMessage" rows="5"></textarea>
-            <div class="form-text">This message is sent to the affected user. If approval is required, it is sent after the request is approved.</div>
+            <div class="form-text">This message is sent to the affected user. A warning is sent when you save; a suspension or block is sent once another reviewer approves it.</div>
           </div>
           <div class="d-none" id="safetySuspendUntilGroup">
             <label class="form-label fw-bold" for="editSuspendUntil">Restore access on</label>
diff --git a/application/single_app/templates/my_safety_violations.html b/application/single_app/templates/my_safety_violations.html
index 34b66a15b..789172297 100644
--- a/application/single_app/templates/my_safety_violations.html
+++ b/application/single_app/templates/my_safety_violations.html
@@ -102,7 +102,6 @@ <h2>My Safety Violations</h2>
         <option value="None">None</option>
         <option value="WarnUser">WarnUser</option>
         <option value="SuspendUser">SuspendUser</option>
-        <option value="Escalate">Escalate</option>
         <option value="BlockUser">BlockUser</option>
       </select>
     </div>
@@ -243,6 +242,14 @@ <h5 class="modal-title">Violation Details</h5>
   const viewModal = new bootstrap.Modal(document.getElementById('viewViolationModal')); // Bootstrap 5 modal instance
 
   // --- DATA FETCHING & RENDERING ---
+  // Escalate is no longer recorded; older records keep it and are labelled as legacy.
+  function formatViolationAction(action) {
+    if (action === "Escalate") {
+      return "Escalated (legacy)";
+    }
+    return action || "None";
+  }
+
   function fetchMySafetyLogs() {
     // Show loading state
     tableBody.html(`
@@ -296,7 +303,7 @@ <h5 class="modal-title">Violation Details</h5>
     row.append($("<td></td>").text(log.message || ""));
     row.append($("<td></td>").text(triggered));
     row.append($("<td></td>").text(log.status || "New"));
-    row.append($("<td></td>").text(log.action || "None"));
+    row.append($("<td></td>").text(formatViolationAction(log.action)));
     row.append($("<td class='text-truncate'></td>").attr('title', userNotes).text(userNotes)); // Truncate notes
     // View/Edit button
     const viewBtn = $("<button class='btn btn-sm btn-primary view-edit-btn'></button>")
@@ -381,7 +388,7 @@ <h5 class="modal-title">Violation Details</h5>
       .join(", ");
     $("#detailCategories").text(triggered || "None");
     $("#detailStatus").text(log.status || "New");
-    $("#detailAction").text(log.action || "None");
+    $("#detailAction").text(formatViolationAction(log.action));
 
     // Editable user notes
     $("#detailUserNotes").val(log.user_notes || "");
diff --git a/application/single_app/templates/profile.html b/application/single_app/templates/profile.html
index e5c6859a6..dab8f3e7e 100644
--- a/application/single_app/templates/profile.html
+++ b/application/single_app/templates/profile.html
@@ -1940,7 +1940,6 @@ <h5 class="mb-2"><i class="bi bi-shield-exclamation me-2"></i>My Safety Violatio
                             <option value="None">None</option>
                             <option value="WarnUser">WarnUser</option>
                             <option value="SuspendUser">SuspendUser</option>
-                            <option value="Escalate">Escalate</option>
                             <option value="BlockUser">BlockUser</option>
                         </select>
                     </div>
diff --git a/application/v2_ui/src/App.tsx b/application/v2_ui/src/App.tsx
index 951149dc9..920d8b912 100644
--- a/application/v2_ui/src/App.tsx
+++ b/application/v2_ui/src/App.tsx
@@ -12,6 +12,7 @@ import { useUserSettingsStore } from './stores/userSettingsStore';
 import { initializeTheme, hydrateUiPreferences } from './stores/uiStore';
 import { startImageApprovalTracking } from './lib/imageProposalResume';
 import { useNotificationRuntime } from './lib/useNotificationRuntime';
+import { useSafetyWarningRuntime } from './lib/useSafetyWarningRuntime';
 import { useWorkflowAlertRuntime } from './lib/useWorkflowAlertRuntime';
 import { useWorkflowRunTracker } from './lib/useWorkflowRunTracker';
 import { workflowRunTrackerShouldRun } from './lib/workflowRunTracker';
@@ -33,6 +34,7 @@ import { PublicDirectoryPage } from './pages/PublicDirectoryPage';
 import { clearWorkspaceEditorDrafts } from './lib/workspaceEditorDrafts';
 import { ContentReviewPage } from './pages/ContentReviewPage';
 import { TermsOfUsePage } from './pages/TermsOfUsePage';
+import { AccessRestrictedPage } from './pages/AccessRestrictedPage';
 import { ApprovalsPage } from './pages/ApprovalsPage';
 import { ControlCenterPage } from './pages/ControlCenterPage';
 import { SupportLatestFeaturesPage } from './pages/SupportLatestFeaturesPage';
@@ -102,6 +104,10 @@ export function App() {
     // Every other call is refused until the terms are accepted, so this page loads nothing
     // the shell needs and renders on its own.
     const onTermsPage = location.pathname === '/terms-of-use';
+    // The same holds while an administrator has suspended or blocked the account: the server
+    // sends every V2 page here, and only this page's own call is answered.
+    const onAccessRestrictedPage = location.pathname === '/access-restricted';
+    const standalonePage = onTermsPage || onAccessRestrictedPage;
 
     useEffect(() => {
         clearWorkspaceEditorDrafts();
@@ -109,7 +115,7 @@ export function App() {
 
     useEffect(() => {
         initializeTheme();
-        if (onTermsPage) {
+        if (standalonePage) {
             return;
         }
         void load();
@@ -128,7 +134,7 @@ export function App() {
         // run that was still going. The restored record has no stream behind it; the run
         // history fetched when the panel opens is what settles it.
         restorePersistedRuns();
-    }, [load, loadUserSettings, onTermsPage]);
+    }, [load, loadUserSettings, standalonePage]);
 
     /**
      * Re-read the payload when the tab comes back to the front.
@@ -146,7 +152,7 @@ export function App() {
      * spurious wake-up is one wasted request.
      */
     useEffect(() => {
-        if (onTermsPage) {
+        if (standalonePage) {
             return undefined;
         }
         const onVisible = () => {
@@ -163,7 +169,7 @@ export function App() {
             document.removeEventListener('visibilitychange', onVisible);
             window.removeEventListener('focus', onVisible);
         };
-    }, [refreshBootstrap, onTermsPage]);
+    }, [refreshBootstrap, standalonePage]);
 
     useEffect(() => {
         const title = data?.branding?.app_title;
@@ -205,6 +211,12 @@ export function App() {
     useNotificationRuntime(Boolean(data) && !error);
     // Workflow alerts that ask to pop up. It listens to the bell's count rather than polling.
     useWorkflowAlertRuntime(Boolean(data) && !error);
+    // Safety warnings an administrator sent, which stay on screen until acknowledged.
+    // Bootstrap says how many are waiting; they are read only when there are some.
+    useSafetyWarningRuntime(
+        data && !error && !standalonePage ? data.safety_warnings?.pending ?? 0 : null,
+        data,
+    );
     // The saved workflows chats started: one tracker for the tab, for the run cards, the chat
     // list's running tag and the results each run posts back to its chat.
     useWorkflowRunTracker(Boolean(data) && !error && workflowRunTrackerShouldRun(data?.features));
@@ -213,6 +225,10 @@ export function App() {
         return <TermsOfUsePage />;
     }
 
+    if (onAccessRestrictedPage) {
+        return <AccessRestrictedPage />;
+    }
+
     if (loading) {
         return <BootScreen />;
     }
diff --git a/application/v2_ui/src/components/layout/AppShell.tsx b/application/v2_ui/src/components/layout/AppShell.tsx
index 47bda1fb8..2aba188fb 100644
--- a/application/v2_ui/src/components/layout/AppShell.tsx
+++ b/application/v2_ui/src/components/layout/AppShell.tsx
@@ -10,6 +10,7 @@
 import { useEffect, useRef, useState, type ReactNode } from 'react';
 import { Sidebar } from './Sidebar';
 import { Toaster } from '../ui/Toaster';
+import { SafetyWarningDialogHost } from '../notifications/SafetyWarningDialog';
 import { WorkflowAlertCardHost } from '../notifications/WorkflowAlertCard';
 import { WorkflowAlertLiveRegion } from '../notifications/WorkflowAlertLiveRegion';
 import { useBootstrapStore } from '../../stores/bootstrapStore';
@@ -81,6 +82,7 @@ export function AppShell({ children }: { children: ReactNode }) {
             <Toaster />
             <WorkflowAlertCardHost />
             <WorkflowAlertLiveRegion />
+            <SafetyWarningDialogHost />
         </div>
     );
 }
diff --git a/application/v2_ui/src/components/notifications/SafetyWarningDialog.tsx b/application/v2_ui/src/components/notifications/SafetyWarningDialog.tsx
new file mode 100644
index 000000000..15b00bad8
--- /dev/null
+++ b/application/v2_ui/src/components/notifications/SafetyWarningDialog.tsx
@@ -0,0 +1,112 @@
+// SafetyWarningDialog.tsx
+// The dialog a safety warning from an administrator appears in, over whatever page is open.
+//
+// A warning has to be acknowledged, so the dialog has no close button and Escape or a click
+// outside it leaves it on screen -- as a workflow alert that needs acknowledgment never tucks
+// away. "I understand" records the acknowledgment on the server and shows the next waiting
+// warning, if there is one. A reload, another tab or another device shows it again until then.
+//
+// Everything shown is the warning's own text, rendered as text.
+
+import { Loader2, ShieldAlert } from 'lucide-react';
+import { Modal } from '../ui/Modal';
+import { GlassButton } from '../ui/primitives';
+import { describeSafetyWarningCategories, formatSafetyWarningDate, safetyWarningKey } from '../../lib/safetyWarnings';
+import { refreshNotificationCount } from '../../stores/notificationStore';
+import { useSafetyWarningStore } from '../../stores/safetyWarningStore';
+
+const DIALOG_TITLE = 'A warning from your administrators';
+
+function keepOpen(): void {
+    // Escape and the backdrop do nothing: only "I understand" closes a warning.
+}
+
+export function SafetyWarningDialogHost() {
+    const warning = useSafetyWarningStore((state) => state.warnings[0] ?? null);
+    const waiting = useSafetyWarningStore((state) => state.warnings.length);
+    const acknowledgingKey = useSafetyWarningStore((state) => state.acknowledgingKey);
+    const error = useSafetyWarningStore((state) => state.error);
+    const acknowledge = useSafetyWarningStore((state) => state.acknowledge);
+
+    if (!warning) {
+        return null;
+    }
+
+    const busy = acknowledgingKey === safetyWarningKey(warning);
+    const issued = formatSafetyWarningDate(warning.issuedAt);
+    const categories = describeSafetyWarningCategories(warning.categories);
+
+    const onAcknowledge = async () => {
+        if (await acknowledge(warning)) {
+            // The warning's notice in the bell was marked read with it.
+            void refreshNotificationCount();
+        }
+    };
+
+    return (
+        <Modal
+            title={DIALOG_TITLE}
+            onClose={keepOpen}
+            banner={
+                <div className="flex items-start gap-3 border-b border-edge px-4 py-3">
+                    <span className="flex h-9 w-9 shrink-0 items-center justify-center rounded-xl bg-warn-soft text-warn">
+                        <ShieldAlert size={18} aria-hidden="true" />
+                    </span>
+                    <div className="min-w-0">
+                        <h2 className="text-sm font-semibold text-text-1">{DIALOG_TITLE}</h2>
+                        <p className="mt-0.5 text-xs text-text-3">
+                            {waiting > 1 ? `Warning 1 of ${waiting}. ` : ''}
+                            Read it, then confirm you understand it to carry on.
+                        </p>
+                    </div>
+                </div>
+            }
+            footer={
+                <>
+                    {error ? (
+                        <p role="alert" className="mr-auto text-xs text-danger">
+                            {error}
+                        </p>
+                    ) : null}
+                    <GlassButton
+                        type="button"
+                        variant="primary"
+                        size="sm"
+                        disabled={busy}
+                        onClick={() => void onAcknowledge()}
+                        data-testid="v2-safety-warning-acknowledge"
+                    >
+                        {busy ? <Loader2 size={14} className="animate-spin" aria-hidden="true" /> : null}
+                        I understand
+                    </GlassButton>
+                </>
+            }
+        >
+            <div className="space-y-3" data-testid="v2-safety-warning">
+                <h3 className="text-base font-semibold break-words text-text-1">{warning.title}</h3>
+                <p
+                    className="rounded-xl border border-edge bg-surface-sunken p-3 text-sm leading-relaxed break-words whitespace-pre-wrap text-text-1"
+                    data-testid="v2-safety-warning-message"
+                >
+                    {warning.message}
+                </p>
+                <dl className="grid gap-x-3 gap-y-1 text-xs sm:grid-cols-[max-content_1fr]">
+                    {issued ? (
+                        <>
+                            <dt className="font-medium text-text-2">Sent</dt>
+                            <dd className="text-text-1">{issued}</dd>
+                        </>
+                    ) : null}
+                    {categories ? (
+                        <>
+                            <dt className="font-medium text-text-2">Flagged categories</dt>
+                            <dd className="text-text-1">{categories}</dd>
+                        </>
+                    ) : null}
+                    <dt className="font-medium text-text-2">Reference</dt>
+                    <dd className="break-all text-text-1">{warning.id}</dd>
+                </dl>
+            </div>
+        </Modal>
+    );
+}
diff --git a/application/v2_ui/src/components/settings/ViolationsTab.tsx b/application/v2_ui/src/components/settings/ViolationsTab.tsx
index ae9a1c7ee..0e0893a68 100644
--- a/application/v2_ui/src/components/settings/ViolationsTab.tsx
+++ b/application/v2_ui/src/components/settings/ViolationsTab.tsx
@@ -24,7 +24,12 @@ const PAGE_SIZE = 10;
 const STATUSES = ['New', 'In-Review', 'Resolved', 'Dismissed'];
 
 /** Actions an administrator can record against a violation. */
-const ACTIONS = ['None', 'WarnUser', 'SuspendUser', 'Escalate', 'BlockUser'];
+const ACTIONS = ['None', 'WarnUser', 'SuspendUser', 'BlockUser'];
+
+/** Escalate is no longer recorded; older records keep it and are labelled as legacy. */
+function actionLabel(action: string): string {
+    return action === 'Escalate' ? 'Escalated (legacy)' : action;
+}
 
 interface TriggeredCategory {
     category?: string;
@@ -41,6 +46,32 @@ interface SafetyLog {
     admin_notes?: string;
     created_at?: string;
     last_updated?: string;
+    /** Set on a warning the administrators sent: `pending` until it is acknowledged. */
+    warning_acknowledgment_status?: 'pending' | 'acknowledged' | 'not_tracked' | null;
+    warning_acknowledged_at?: string | null;
+}
+
+/** Whether the user has acknowledged a warning they were sent, as one line. */
+function WarningAcknowledgment({ log }: { log: SafetyLog }) {
+    if (log.warning_acknowledgment_status === 'acknowledged') {
+        const acknowledged = log.warning_acknowledged_at ? new Date(log.warning_acknowledged_at) : null;
+        return (
+            <p className="mt-1.5 flex items-center gap-1 text-xs text-ok">
+                <Check size={12} aria-hidden="true" />
+                {acknowledged && !Number.isNaN(acknowledged.getTime())
+                    ? `You acknowledged this warning on ${acknowledged.toLocaleString()}.`
+                    : 'You acknowledged this warning.'}
+            </p>
+        );
+    }
+    if (log.warning_acknowledgment_status === 'pending') {
+        return (
+            <p className="mt-1.5 text-xs font-medium text-warn">
+                Not yet acknowledged. The warning is shown to you until you confirm you understand it.
+            </p>
+        );
+    }
+    return null;
 }
 
 interface LogsResponse {
@@ -315,7 +346,7 @@ export function ViolationsTab() {
                                         </span>
                                         {log.action && log.action !== 'None' && (
                                             <span className="rounded-full border border-edge px-2 py-0.5 text-[11px] text-text-2">
-                                                {log.action}
+                                                {actionLabel(log.action)}
                                             </span>
                                         )}
                                         {log.created_at && (
@@ -331,6 +362,8 @@ export function ViolationsTab() {
                                         </p>
                                     )}
 
+                                    <WarningAcknowledgment log={log} />
+
                                     {(log.triggered_categories ?? []).length > 0 && (
                                         <p className="mt-1 text-xs text-text-3">
                                             {(log.triggered_categories ?? [])
diff --git a/application/v2_ui/src/lib/accessRestriction.ts b/application/v2_ui/src/lib/accessRestriction.ts
new file mode 100644
index 000000000..6d154ae6a
--- /dev/null
+++ b/application/v2_ui/src/lib/accessRestriction.ts
@@ -0,0 +1,95 @@
+// accessRestriction.ts
+// The call behind the V2 Access restricted page. The server decides everything -- whether the
+// account is restricted, until when, and what the user was told -- so the page only renders
+// what this returns. The route only ever describes the signed-in user's own account.
+
+import { request } from './apiClient';
+import type { TermsOfUseBranding } from './termsOfUse';
+
+export type AccessRestrictionKind = 'suspended' | 'blocked';
+
+export interface AccessRestriction {
+    kind: AccessRestrictionKind;
+    /** ISO 8601 UTC. Set only for a suspension, which ends on its own. */
+    until: string | null;
+    /** Plain text. Rendered as text, never as HTML. */
+    title: string;
+    /** Plain text. Rendered as text, never as HTML. */
+    message: string;
+    /** The safety violation the restriction was applied for, when there is one. */
+    referenceId: string | null;
+}
+
+export interface AccessRestrictionStatus {
+    restricted: boolean;
+    restriction: AccessRestriction | null;
+    branding: Partial<TermsOfUseBranding>;
+}
+
+/** Shown when the server sends no notice text, matching the server's own fallback copy. */
+const FALLBACK_COPY: Record<AccessRestrictionKind, { title: string; message: string }> = {
+    suspended: {
+        title: 'Your access is temporarily suspended',
+        message:
+            'An administrator has temporarily suspended your access to this application. '
+            + 'Your access is restored automatically at the time shown.',
+    },
+    blocked: {
+        title: 'Your access has been blocked',
+        message:
+            'An administrator has blocked your access to this application. '
+            + 'Contact your administrator if you have questions about this decision.',
+    },
+};
+
+function text(value: unknown): string {
+    return typeof value === 'string' ? value.trim() : '';
+}
+
+/** Read the route's answer defensively; anything it can't vouch for falls back to safe copy. */
+export function parseAccessRestrictionStatus(payload: unknown): AccessRestrictionStatus {
+    const body = (payload && typeof payload === 'object' ? payload : {}) as Record<string, unknown>;
+    const branding = (body.branding && typeof body.branding === 'object'
+        ? body.branding
+        : {}) as Partial<TermsOfUseBranding>;
+    if (body.restricted !== true) {
+        return { restricted: false, restriction: null, branding };
+    }
+    const raw = (body.restriction && typeof body.restriction === 'object'
+        ? body.restriction
+        : {}) as Record<string, unknown>;
+    const kind: AccessRestrictionKind = raw.kind === 'suspended' && text(raw.until) ? 'suspended' : 'blocked';
+    return {
+        restricted: true,
+        restriction: {
+            kind,
+            until: kind === 'suspended' ? text(raw.until) : null,
+            title: text(raw.title) || FALLBACK_COPY[kind].title,
+            message: text(raw.message) || FALLBACK_COPY[kind].message,
+            referenceId: text(raw.reference_id) || null,
+        },
+        branding,
+    };
+}
+
+export async function fetchAccessRestriction(signal?: AbortSignal): Promise<AccessRestrictionStatus> {
+    return parseAccessRestrictionStatus(
+        await request<unknown>('/api/v2/access-restriction', { signal }),
+    );
+}
+
+/** A restore time in the reader's own locale and time zone, or null when it can't be read. */
+export function formatRestoreTime(until: string | null | undefined, locale?: string): string | null {
+    if (!until) {
+        return null;
+    }
+    const parsed = new Date(until);
+    if (Number.isNaN(parsed.getTime())) {
+        return null;
+    }
+    try {
+        return parsed.toLocaleString(locale, { dateStyle: 'full', timeStyle: 'short' });
+    } catch {
+        return parsed.toLocaleString();
+    }
+}
diff --git a/application/v2_ui/src/lib/apiClient.ts b/application/v2_ui/src/lib/apiClient.ts
index 7f499da88..f16582a7a 100644
--- a/application/v2_ui/src/lib/apiClient.ts
+++ b/application/v2_ui/src/lib/apiClient.ts
@@ -91,6 +91,49 @@ export function safeTermsOfUseUrl(next: unknown): string {
     return `${V2_TERMS_OF_USE_PATH}?${new URLSearchParams({ next: safeSameOriginUrl(next, '/v2') }).toString()}`;
 }
 
+/** Where the server's access gate sends a suspended or blocked V2 user. */
+export const V2_ACCESS_RESTRICTED_PATH = '/v2/access-restricted';
+
+/**
+ * True when a failed response is the server's access gate: an administrator suspended or
+ * blocked this account, so every call is refused until that ends.
+ */
+export function isAccessRestricted(status: number, payload: unknown): boolean {
+    return (
+        status === 403 &&
+        typeof payload === 'object' &&
+        payload !== null &&
+        (payload as Record<string, unknown>).error === 'access_restricted'
+    );
+}
+
+/**
+ * Leave for the Access restricted page when the server says this account is restricted.
+ *
+ * A restriction can be applied while a tab is open, after which every call is refused. The
+ * page says why and how long it lasts, which beats a screen full of failures. Skipped on
+ * the page itself so a refused call there cannot loop.
+ */
+export function redirectToAccessRestricted(): boolean {
+    if (typeof window === 'undefined' || !window.location) {
+        return false;
+    }
+    if (window.location.pathname === V2_ACCESS_RESTRICTED_PATH) {
+        return false;
+    }
+    window.location.assign(V2_ACCESS_RESTRICTED_PATH);
+    return true;
+}
+
+/** Follow the server's gates when a failed response is one of them. */
+function followServerGate(status: number, payload: unknown): void {
+    if (isTermsOfUseRequired(status, payload)) {
+        redirectToTermsOfUse();
+    } else if (isAccessRestricted(status, payload)) {
+        redirectToAccessRestricted();
+    }
+}
+
 /**
  * Leave for the Terms of Use page when the server says acceptance is now required.
  *
@@ -165,9 +208,7 @@ export async function requestWithStatus<T>(path: string, options: RequestOptions
 
     if (!response.ok) {
         const { message, payload } = await readErrorMessage(response);
-        if (isTermsOfUseRequired(response.status, payload)) {
-            redirectToTermsOfUse();
-        }
+        followServerGate(response.status, payload);
         throw new ApiError(message, response.status, payload);
     }
 
@@ -219,9 +260,7 @@ export async function uploadFileWithStatus<T>(
 
     if (!response.ok) {
         const { message, payload } = await readErrorMessage(response);
-        if (isTermsOfUseRequired(response.status, payload)) {
-            redirectToTermsOfUse();
-        }
+        followServerGate(response.status, payload);
         throw new ApiError(message, response.status, payload);
     }
 
diff --git a/application/v2_ui/src/lib/safetyWarnings.ts b/application/v2_ui/src/lib/safetyWarnings.ts
new file mode 100644
index 000000000..428dd403c
--- /dev/null
+++ b/application/v2_ui/src/lib/safetyWarnings.ts
@@ -0,0 +1,125 @@
+// safetyWarnings.ts
+// Safety warnings an administrator sent the signed-in user. A warning has to be acknowledged:
+// it stays on screen until the user says they understand it. The server keeps the record of
+// which warnings are still waiting, so a reload, another tab or another device shows them too.
+//
+// Everything here is the user's own data -- what they were sent and when -- rendered as text.
+
+import { api } from './apiClient';
+
+export interface SafetyWarningCategory {
+    category: string;
+    severity: number | null;
+}
+
+export interface SafetyWarning {
+    /**
+     * The safety violation the warning was sent for. A reviewer can warn about the same
+     * violation again, so one warning is this with `issuedAt`: see safetyWarningKey.
+     */
+    id: string;
+    /** Plain text. Rendered as text, never as HTML. */
+    title: string;
+    /** Plain text. Rendered as text, never as HTML. */
+    message: string;
+    issuedAt: string | null;
+    categories: SafetyWarningCategory[];
+}
+
+/** The server's answer when the warning acknowledged was replaced by a newer one. */
+export const SAFETY_WARNING_REPLACED_CODE = 'safety_warning_replaced';
+
+const FALLBACK_TITLE = 'Safety Violation Warning';
+
+/** Identifies one warning sent: the violation, and when it was sent. */
+export function safetyWarningKey(warning: Pick<SafetyWarning, 'id' | 'issuedAt'>): string {
+    return JSON.stringify([warning.id, warning.issuedAt]);
+}
+
+function text(value: unknown): string {
+    return typeof value === 'string' ? value.trim() : '';
+}
+
+function parseCategory(value: unknown): SafetyWarningCategory[] {
+    if (!value || typeof value !== 'object') {
+        return [];
+    }
+    const raw = value as Record<string, unknown>;
+    const category = text(raw.category);
+    if (!category) {
+        return [];
+    }
+    const severity = typeof raw.severity === 'number' && Number.isFinite(raw.severity) ? raw.severity : null;
+    return [{ category, severity }];
+}
+
+/** One warning from the route, or null when it isn't one the dialog can show. */
+export function parseSafetyWarning(value: unknown): SafetyWarning | null {
+    if (!value || typeof value !== 'object') {
+        return null;
+    }
+    const raw = value as Record<string, unknown>;
+    const id = text(raw.id);
+    const message = text(raw.message);
+    if (!id || !message) {
+        return null;
+    }
+    return {
+        id,
+        title: text(raw.title) || FALLBACK_TITLE,
+        message,
+        issuedAt: text(raw.issued_at) || null,
+        categories: Array.isArray(raw.triggered_categories)
+            ? raw.triggered_categories.flatMap(parseCategory)
+            : [],
+    };
+}
+
+/** The route's answer, oldest warning first. Throws when the answer isn't a warning list. */
+export function parsePendingSafetyWarnings(payload: unknown): SafetyWarning[] {
+    const body = (payload && typeof payload === 'object' ? payload : {}) as Record<string, unknown>;
+    if (!Array.isArray(body.warnings)) {
+        throw new Error('The pending warnings response was invalid.');
+    }
+    return body.warnings
+        .map(parseSafetyWarning)
+        .filter((warning): warning is SafetyWarning => warning !== null);
+}
+
+export async function fetchPendingSafetyWarnings(signal?: AbortSignal): Promise<SafetyWarning[]> {
+    return parsePendingSafetyWarnings(await api.get<unknown>('/api/safety/warnings/pending', signal));
+}
+
+/**
+ * Acknowledge the warning the user read. Sending when it was sent lets the server refuse
+ * (409 SAFETY_WARNING_REPLACED_CODE) when the violation has since been warned about again.
+ */
+export async function acknowledgeSafetyWarning(warning: Pick<SafetyWarning, 'id' | 'issuedAt'>): Promise<void> {
+    await api.post(
+        `/api/safety/warnings/${encodeURIComponent(warning.id)}/acknowledge`,
+        warning.issuedAt ? { issued_at: warning.issuedAt } : {},
+    );
+}
+
+/** The flagged categories as one line, such as "Hate (severity 4), Violence (severity 2)". */
+export function describeSafetyWarningCategories(categories: SafetyWarningCategory[]): string {
+    return categories
+        .map(({ category, severity }) => (severity === null ? category : `${category} (severity ${severity})`))
+        .join(', ');
+}
+
+/** When a warning was sent, in the reader's own locale, or null when it can't be read. */
+export function formatSafetyWarningDate(value: string | null, locale?: string): string | null {
+    if (!value) {
+        return null;
+    }
+    const parsed = new Date(value);
+    if (Number.isNaN(parsed.getTime())) {
+        return null;
+    }
+    try {
+        return parsed.toLocaleString(locale, { dateStyle: 'medium', timeStyle: 'short' });
+    } catch {
+        return parsed.toLocaleString();
+    }
+}
diff --git a/application/v2_ui/src/lib/types.ts b/application/v2_ui/src/lib/types.ts
index 620e60eb8..24c3222b6 100644
--- a/application/v2_ui/src/lib/types.ts
+++ b/application/v2_ui/src/lib/types.ts
@@ -1195,6 +1195,13 @@ export interface BootstrapPayload {
     workspace_uploads?: {
         categories: { name: string; extensions: string[] }[];
     };
+    /**
+     * Safety warnings an administrator sent that still need this user's acknowledgment.
+     * Only the count: the warnings themselves are read when it is above zero.
+     */
+    safety_warnings?: {
+        pending: number;
+    };
     /** Sanitized settings. Never contains keys, secrets or connection strings. */
     settings: Json;
 }
diff --git a/application/v2_ui/src/lib/useSafetyWarningRuntime.ts b/application/v2_ui/src/lib/useSafetyWarningRuntime.ts
new file mode 100644
index 000000000..3b1c64e3b
--- /dev/null
+++ b/application/v2_ui/src/lib/useSafetyWarningRuntime.ts
@@ -0,0 +1,41 @@
+// useSafetyWarningRuntime.ts
+// Reads the safety warnings waiting for the signed-in user's acknowledgment, for the dialog in
+// SafetyWarningDialog.tsx.
+//
+// Bootstrap carries how many there are, and the warnings themselves are read only when that
+// count is above zero, so a user with nothing to acknowledge costs no extra request. App.tsx
+// reads bootstrap again whenever the tab comes back to the front, so the count -- and with it
+// this read -- follows a warning sent while the tab was away, or one acknowledged in another
+// tab, which the server then no longer counts.
+
+import { useEffect } from 'react';
+import { fetchPendingSafetyWarnings } from './safetyWarnings';
+import { useSafetyWarningStore } from '../stores/safetyWarningStore';
+
+/**
+ * @param pending Warnings bootstrap says are waiting, or null before a session has loaded.
+ * @param revision The bootstrap payload, so each fresh read of it is followed even when the
+ *   count is unchanged.
+ */
+export function useSafetyWarningRuntime(pending: number | null, revision: unknown): void {
+    useEffect(() => {
+        if (pending === null) {
+            return undefined;
+        }
+        if (pending <= 0) {
+            useSafetyWarningStore.getState().receive([]);
+            return undefined;
+        }
+        const controller = new AbortController();
+        void fetchPendingSafetyWarnings(controller.signal)
+            .then((warnings) => {
+                if (!controller.signal.aborted) {
+                    useSafetyWarningStore.getState().receive(warnings);
+                }
+            })
+            .catch(() => {
+                // What is already known stays; the next bootstrap read tries again.
+            });
+        return () => controller.abort();
+    }, [pending, revision]);
+}
diff --git a/application/v2_ui/src/pages/AccessRestrictedPage.tsx b/application/v2_ui/src/pages/AccessRestrictedPage.tsx
new file mode 100644
index 000000000..a808a4cb7
--- /dev/null
+++ b/application/v2_ui/src/pages/AccessRestrictedPage.tsx
@@ -0,0 +1,214 @@
+// AccessRestrictedPage.tsx
+// The V2 Access restricted page. When an administrator suspends or blocks an account, the
+// server's access gate sends every V2 page here instead of showing an error, so the user can
+// read what they were told, see whether access comes back on its own, and sign out.
+//
+// Rendered outside the application shell: every other API call is refused while the account
+// is restricted, so nothing the shell needs could load. It reads one route, which only ever
+// describes the signed-in user's own account.
+
+import { useEffect, useState } from 'react';
+import { CalendarClock, CircleCheck, LogIn, LogOut, ShieldAlert, TriangleAlert } from 'lucide-react';
+import { GlassButton, GlassPanel, Skeleton } from '../components/ui/primitives';
+import { useUiStore } from '../stores/uiStore';
+import { ApiError, apiUrl } from '../lib/apiClient';
+import {
+    fetchAccessRestriction,
+    formatRestoreTime,
+    type AccessRestrictionStatus,
+} from '../lib/accessRestriction';
+
+const LINK_BUTTON =
+    'inline-flex h-10 items-center justify-center gap-2 rounded-xl px-4 text-sm font-medium transition-colors';
+
+export function AccessRestrictedPage() {
+    const theme = useUiStore((state) => state.theme);
+    const [status, setStatus] = useState<AccessRestrictionStatus | null>(null);
+    const [loadError, setLoadError] = useState<string | null>(null);
+    const [sessionExpired, setSessionExpired] = useState(false);
+    const [attempt, setAttempt] = useState(0);
+
+    useEffect(() => {
+        const controller = new AbortController();
+        setLoadError(null);
+        fetchAccessRestriction(controller.signal)
+            .then((result) => {
+                if (!controller.signal.aborted) {
+                    setStatus(result);
+                }
+            })
+            .catch((error: unknown) => {
+                if (controller.signal.aborted) {
+                    return;
+                }
+                if (error instanceof ApiError && error.status === 401) {
+                    setSessionExpired(true);
+                    return;
+                }
+                setLoadError('Your account status could not be loaded. Try again in a moment.');
+            });
+        return () => controller.abort();
+    }, [attempt]);
+
+    const branding = status?.branding;
+    const appTitle = branding?.app_title || 'SimpleChat';
+    useEffect(() => {
+        document.title = status?.restricted ? `Access restricted - ${appTitle}` : appTitle;
+    }, [status, appTitle]);
+
+    const banner = branding?.classification_banner;
+    const themedLogoUrl = theme === 'dark' ? branding?.logo_dark_url : branding?.logo_url;
+    const logoUrl = branding?.show_logo ? themedLogoUrl : null;
+    const restriction = status?.restriction ?? null;
+    const restoreTime = restriction?.kind === 'suspended' ? formatRestoreTime(restriction.until) : null;
+
+    const signOut = (
+        <a
+            href={apiUrl('/logout')}
+            className={`${LINK_BUTTON} glass-flat text-text-1 hover:bg-surface-2`}
+            data-testid="v2-access-restricted-signout"
+        >
+            <LogOut size={16} aria-hidden="true" />
+            Sign out
+        </a>
+    );
+
+    return (
+        <div className="flex h-full flex-col">
+            {banner?.enabled && banner.text ? (
+                <div
+                    id="classification-banner"
+                    role="note"
+                    className="flex h-8 shrink-0 items-center justify-center text-sm font-bold tracking-wide"
+                    style={{ background: banner.color, color: banner.text_color }}
+                >
+                    {banner.text}
+                </div>
+            ) : null}
+
+            <main className="flex min-h-0 flex-1 items-start justify-center overflow-y-auto p-4 sm:items-center sm:p-6">
+                <GlassPanel
+                    edge
+                    elevation="raised"
+                    className="flex max-h-full w-full max-w-2xl flex-col p-6 sm:p-8"
+                    data-testid="v2-access-restricted"
+                >
+                    {(logoUrl || (branding && !branding.hide_app_title)) && (
+                        <div className="mb-5 flex items-center gap-3">
+                            {logoUrl ? (
+                                <img src={logoUrl} alt="" className="h-8 w-auto max-w-[160px] object-contain" />
+                            ) : null}
+                            {branding && !branding.hide_app_title ? (
+                                <span className="text-sm font-semibold text-text-2">{appTitle}</span>
+                            ) : null}
+                        </div>
+                    )}
+
+                    {sessionExpired ? (
+                        <div className="flex items-start gap-3">
+                            <LogIn size={20} className="mt-0.5 shrink-0 text-accent" aria-hidden="true" />
+                            <div>
+                                <h1 className="font-semibold text-text-1">Your session has expired</h1>
+                                <p className="mt-1 text-sm text-text-3">Sign in again to see your account status.</p>
+                                <a href={apiUrl('/login')} className={`${LINK_BUTTON} mt-4 bg-accent text-on-accent hover:bg-accent-hover`}>
+                                    Sign in
+                                </a>
+                            </div>
+                        </div>
+                    ) : loadError ? (
+                        <div role="alert" className="flex items-start gap-3">
+                            <TriangleAlert size={20} className="mt-0.5 shrink-0 text-danger" aria-hidden="true" />
+                            <div>
+                                <h1 className="font-semibold text-text-1">Account status unavailable</h1>
+                                <p className="mt-1 text-sm text-text-3">{loadError}</p>
+                                <div className="mt-4 flex flex-wrap gap-2">
+                                    <GlassButton variant="primary" onClick={() => setAttempt((value) => value + 1)}>
+                                        Try again
+                                    </GlassButton>
+                                    {signOut}
+                                </div>
+                            </div>
+                        </div>
+                    ) : !status ? (
+                        <div className="space-y-3" aria-busy="true">
+                            <Skeleton className="h-7 w-64" />
+                            <Skeleton className="h-4 w-full" />
+                            <Skeleton className="h-4 w-2/3" />
+                            <span className="sr-only">Loading your account status</span>
+                        </div>
+                    ) : restriction ? (
+                        <>
+                            <div className="flex items-start gap-3">
+                                <span className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl bg-danger-soft text-danger">
+                                    <ShieldAlert size={20} aria-hidden="true" />
+                                </span>
+                                <div className="min-w-0">
+                                    <p className="text-xs font-semibold tracking-wide text-danger uppercase">
+                                        Access restricted
+                                    </p>
+                                    <h1 className="mt-0.5 text-xl font-semibold text-text-1">{restriction.title}</h1>
+                                </div>
+                            </div>
+
+                            {/* Plain text the administrator wrote. Never HTML. */}
+                            <div
+                                className="mt-5 min-h-0 overflow-y-auto rounded-xl border border-edge bg-surface-sunken p-4 text-sm leading-relaxed whitespace-pre-wrap text-text-1"
+                                data-testid="v2-access-restricted-message"
+                            >
+                                {restriction.message}
+                            </div>
+
+                            <dl className="mt-5 grid gap-x-4 gap-y-2 text-sm sm:grid-cols-[max-content_1fr]">
+                                <dt className="flex items-center gap-1.5 font-medium text-text-2">
+                                    <CalendarClock size={14} aria-hidden="true" />
+                                    Access returns
+                                </dt>
+                                <dd className="text-text-1" data-testid="v2-access-restricted-until">
+                                    {restriction.kind === 'suspended' && restriction.until ? (
+                                        <time dateTime={restriction.until}>{restoreTime ?? restriction.until}</time>
+                                    ) : (
+                                        'No automatic restore date. Contact your administrator about this decision.'
+                                    )}
+                                </dd>
+                                {restriction.referenceId ? (
+                                    <>
+                                        <dt className="font-medium text-text-2">Reference</dt>
+                                        <dd className="break-all text-text-1" data-testid="v2-access-restricted-reference">
+                                            {restriction.referenceId}
+                                        </dd>
+                                    </>
+                                ) : null}
+                            </dl>
+
+                            <div className="mt-6 flex flex-col-reverse gap-2 sm:flex-row sm:justify-end">{signOut}</div>
+                        </>
+                    ) : (
+                        <>
+                            <div className="flex items-start gap-3">
+                                <span className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl bg-ok-soft text-ok">
+                                    <CircleCheck size={20} aria-hidden="true" />
+                                </span>
+                                <div className="min-w-0">
+                                    <h1 className="text-xl font-semibold text-text-1">Your access is available</h1>
+                                    <p className="mt-1 text-sm text-text-3">
+                                        Your account is not restricted, so you can continue to {appTitle}.
+                                    </p>
+                                </div>
+                            </div>
+                            <div className="mt-6 flex flex-col-reverse gap-2 sm:flex-row sm:justify-end">
+                                {signOut}
+                                <a
+                                    href="/v2"
+                                    className={`${LINK_BUTTON} bg-accent text-on-accent hover:bg-accent-hover`}
+                                    data-testid="v2-access-restricted-continue"
+                                >
+                                    Continue
+                                </a>
+                            </div>
+                        </>
+                    )}
+                </GlassPanel>
+            </main>
+        </div>
+    );
+}
diff --git a/application/v2_ui/src/pages/AdminSafetyViolationsPage.tsx b/application/v2_ui/src/pages/AdminSafetyViolationsPage.tsx
index 1c79d8077..c5940726a 100644
--- a/application/v2_ui/src/pages/AdminSafetyViolationsPage.tsx
+++ b/application/v2_ui/src/pages/AdminSafetyViolationsPage.tsx
@@ -11,9 +11,22 @@ import { GlassButton, GlassPanel, Skeleton } from '../components/ui/primitives';
 const PAGE_SIZES = [10, 20, 50, 100];
 const VIEW_STORAGE_KEY = 'simplechat.v2.admin.safety.viewMode';
 const STATUSES = ['New', 'In-Review', 'Resolved', 'Dismissed'];
-const ACTIONS = ['None', 'WarnUser', 'SuspendUser', 'Escalate', 'BlockUser'];
+const ACTIONS = ['None', 'WarnUser', 'SuspendUser', 'BlockUser'];
+// Escalate is no longer an action. A record that already carries it keeps it, labelled as
+// legacy, and only that record's review offers it again.
+const LEGACY_ESCALATE_ACTION = 'Escalate';
 const REMEDIATION_ACTIONS = new Set(['WarnUser', 'SuspendUser', 'BlockUser']);
 
+function actionLabel(value: string): string {
+    if (value === LEGACY_ESCALATE_ACTION) return 'Escalated (legacy)';
+    return value === 'None' ? 'None' : value.replace(/([a-z])([A-Z])/g, '$1 $2');
+}
+
+/** A warning that was sent. Saving the record again does not resend it. */
+function isExecutedWarning(log: SafetyLog): boolean {
+    return log.action === 'WarnUser' && (log.action_request_status || '').toLowerCase() === 'executed';
+}
+
 interface TriggeredCategory {
     category?: string;
     severity?: number;
@@ -34,6 +47,10 @@ interface SafetyLog {
     action_request_status?: string;
     action_notification_message?: string;
     action_datetime_to_allow?: string;
+    /** Set on an executed warning: `pending` until the user acknowledges it. */
+    warning_acknowledgment_status?: 'pending' | 'acknowledged' | 'not_tracked' | null;
+    warning_acknowledged_at?: string | null;
+    warning_issued_at?: string | null;
     isArchived?: boolean;
 }
 
@@ -161,12 +178,28 @@ function StatusBadge({ value }: { value?: string }) {
 }
 
 function ActionBadge({ log }: { log: SafetyLog }) {
-    const label = log.action || 'None';
+    const label = actionLabel(log.action || 'None');
     const requestStatus = (log.action_request_status || '').toLowerCase();
-    const suffix = requestStatus === 'pending' ? ' · Pending approval' : requestStatus === 'failed' ? ' · Failed' : '';
+    let suffix = requestStatus === 'pending' ? ' · Pending approval' : requestStatus === 'sending' ? ' · Sending' : requestStatus === 'failed' ? ' · Failed' : '';
+    if (isExecutedWarning(log)) {
+        if (log.warning_acknowledgment_status === 'acknowledged') suffix = ' · Acknowledged';
+        else if (log.warning_acknowledgment_status === 'pending') suffix = ' · Not yet acknowledged';
+    }
     return <span className="rounded-full border border-edge px-2 py-0.5 text-xs text-text-2">{label}{suffix}</span>;
 }
 
+/** Whether the user has acknowledged a warning that was sent, for the review dialog. */
+function warningAcknowledgmentText(log: SafetyLog): string | null {
+    if (!isExecutedWarning(log)) return null;
+    if (log.warning_acknowledgment_status === 'acknowledged') {
+        return `Warning acknowledged ${formatDate(log.warning_acknowledged_at ?? undefined)}`;
+    }
+    if (log.warning_acknowledgment_status === 'pending') {
+        return 'Warning sent. Not yet acknowledged by the user.';
+    }
+    return 'Warning sent before acknowledgment was tracked.';
+}
+
 function Stat({ label, value }: { label: string; value?: number }) {
     return (
         <GlassPanel elevation="flat" className="p-3">
@@ -336,7 +369,7 @@ export function AdminSafetyViolationsPage() {
             action,
             notes: draft.notes,
         };
-        if (REMEDIATION_ACTIONS.has(action)) {
+        if (REMEDIATION_ACTIONS.has(action) && !(action === 'WarnUser' && isExecutedWarning(selected))) {
             payload.notification_message = draft.notificationMessage;
             if (action === 'SuspendUser') {
                 const restoreDate = toIsoDateTime(draft.datetimeToAllow);
@@ -350,15 +383,15 @@ export function AdminSafetyViolationsPage() {
         setSaving(true);
         setDetailError(null);
         try {
-            const result = await api.patch<{ message?: string; approval_required?: boolean }>(
+            const result = await api.patch<{ message?: string; approval_required?: boolean; audit_warning?: string }>(
                 `/api/safety/logs/${encodeURIComponent(selected.id)}`,
                 payload,
             );
             setSelected(null);
             setDraft(null);
             setNotice({
-                message: result.message || 'Safety review saved.',
-                warning: Boolean(result.approval_required),
+                message: result.audit_warning || result.message || 'Safety review saved.',
+                warning: Boolean(result.approval_required || result.audit_warning),
             });
             setRefresh((value) => value + 1);
         } catch (caught) {
@@ -596,7 +629,10 @@ export function AdminSafetyViolationsPage() {
                     <Stat label="Resolved" value={stats?.resolved_count} />
                     <Stat label="Dismissed" value={stats?.dismissed_count} />
                     <Stat label="Recent 30 days" value={stats?.recent_30_day_count} />
-                    <Stat label="Escalated or blocked" value={(stats?.escalate_count ?? 0) + (stats?.block_user_count ?? 0)} />
+                    <Stat
+                        label={(stats?.escalate_count ?? 0) > 0 ? `Blocked · ${stats?.escalate_count} escalated (legacy)` : 'Blocked'}
+                        value={stats?.block_user_count}
+                    />
                 </div>
                 <GlassPanel elevation="flat" className="grid gap-3 p-3 sm:grid-cols-2">
                     <div className="text-xs text-text-2">
@@ -610,7 +646,8 @@ export function AdminSafetyViolationsPage() {
                         <h2 className="mb-2 font-semibold text-text-1">Action distribution</h2>
                         <div className="flex flex-wrap gap-x-4 gap-y-1">
                             <span>None {stats?.none_action_count ?? 0}</span><span>Warn {stats?.warn_user_count ?? 0}</span>
-                            <span>Suspend {stats?.suspend_user_count ?? 0}</span><span>Escalate {stats?.escalate_count ?? 0}</span><span>Block {stats?.block_user_count ?? 0}</span>
+                            <span>Suspend {stats?.suspend_user_count ?? 0}</span><span>Block {stats?.block_user_count ?? 0}</span>
+                            {(stats?.escalate_count ?? 0) > 0 && <span>Escalated (legacy) {stats?.escalate_count}</span>}
                         </div>
                     </div>
                 </GlassPanel>
@@ -628,7 +665,7 @@ export function AdminSafetyViolationsPage() {
                             Action
                             <select value={draftFilters.action} onChange={(event) => setDraftFilters((current) => ({ ...current, action: event.target.value }))} className="mt-1 block w-full rounded-lg border border-edge bg-surface-solid px-2.5 py-2 text-sm text-text-1">
                                 <option value="">All actions</option>
-                                {ACTIONS.map((value) => <option key={value} value={value}>{value === 'None' ? 'None' : value.replace(/([a-z])([A-Z])/g, '$1 $2')}</option>)}
+                                {ACTIONS.map((value) => <option key={value} value={value}>{actionLabel(value)}</option>)}
                             </select>
                         </label>
                         <label className="block text-xs font-medium text-text-2">
@@ -738,6 +775,11 @@ export function AdminSafetyViolationsPage() {
                             <p role="status" className="rounded-lg bg-info-soft p-3 text-xs text-info">A remediation approval is pending. This record cannot be changed or deleted until the request is decided.</p>
                         )}
                         <div className="flex flex-wrap gap-2"><StatusBadge value={selected.status} /><ActionBadge log={selected} /></div>
+                        {warningAcknowledgmentText(selected) && (
+                            <p className="rounded-lg bg-surface-2 p-3 text-xs text-text-2" data-testid="v2-safety-warning-acknowledgment">
+                                {warningAcknowledgmentText(selected)}
+                            </p>
+                        )}
                         <div><h3 className="text-xs font-semibold text-text-3">Flagged message</h3><p className="mt-1 max-h-48 overflow-y-auto whitespace-pre-wrap break-words rounded-lg bg-surface-2 p-3 text-sm text-text-1">{selected.message || 'No message captured.'}</p></div>
                         <div><h3 className="text-xs font-semibold text-text-3">Triggered categories</h3><p className="mt-1 text-sm text-text-2">{categoryText(selected) || 'No triggered categories.'}</p></div>
                         {selected.user_notes ? <div><h3 className="text-xs font-semibold text-text-3">User notes</h3><p className="mt-1 whitespace-pre-wrap text-sm text-text-2">{selected.user_notes}</p></div> : null}
@@ -760,9 +802,9 @@ export function AdminSafetyViolationsPage() {
                                         : '',
                                 } : current);
                             }} className="mt-1 w-full rounded-lg border border-edge bg-surface-solid px-3 py-2 text-sm text-text-1">
-                                {ACTIONS.map((value) => (
+                                {(selected.action === LEGACY_ESCALATE_ACTION ? [...ACTIONS, LEGACY_ESCALATE_ACTION] : ACTIONS).map((value) => (
                                     <option key={value} value={value} disabled={selected.content_origin === 'assistant' && REMEDIATION_ACTIONS.has(value)}>
-                                        {value === 'None' ? 'None' : value.replace(/([a-z])([A-Z])/g, '$1 $2')}
+                                        {actionLabel(value)}
                                     </option>
                                 ))}
                             </select>
@@ -771,16 +813,20 @@ export function AdminSafetyViolationsPage() {
                             <div className="space-y-3 rounded-xl border border-info/30 bg-info-soft p-3">
                                 <p className="text-xs text-info">
                                     {draft.action === 'WarnUser'
-                                        ? 'The warning is sent immediately only when this reviewer has the required approval role; otherwise it becomes a pending request.'
+                                        ? isExecutedWarning(selected)
+                                            ? 'This warning was already sent. Saving updates the review without sending the warning again.'
+                                            : 'The warning is sent to the user as soon as you save, without a second reviewer. The user must acknowledge it the next time they use SimpleChat.'
                                         : draft.action === 'SuspendUser'
-                                            ? 'Reviewers without approval authority create a pending request instead of applying a suspension.'
-                                            : 'This access restriction uses the same approval workflow as Control Center.'}
+                                            ? 'A suspension restricts access, so saving creates an approval request. It applies only after another eligible reviewer approves it.'
+                                            : 'A block restricts access, so saving creates an approval request. It applies only after another eligible reviewer approves it.'}
                                 </p>
                                 {selected.content_origin === 'assistant' && <p className="text-xs text-warn">AI-generated findings cannot be used to warn or restrict a user.</p>}
+                                {!(draft.action === 'WarnUser' && isExecutedWarning(selected)) && (
                                 <label className="block text-xs font-medium text-text-2">
                                     Notification message
                                     <textarea rows={4} value={draft.notificationMessage} onChange={(event) => setDraft((current) => current ? { ...current, notificationMessage: event.target.value } : current)} className="mt-1 w-full rounded-lg border border-edge bg-surface-solid px-3 py-2 text-sm text-text-1" />
                                 </label>
+                                )}
                                 {draft.action === 'SuspendUser' && (
                                     <label className="block text-xs font-medium text-text-2">
                                         Restore access on
diff --git a/application/v2_ui/src/stores/bootstrapStore.ts b/application/v2_ui/src/stores/bootstrapStore.ts
index 0507cff8d..cfcb40c3f 100644
--- a/application/v2_ui/src/stores/bootstrapStore.ts
+++ b/application/v2_ui/src/stores/bootstrapStore.ts
@@ -5,7 +5,7 @@
 
 import { create } from 'zustand';
 import { fetchBootstrap } from '../lib/endpoints';
-import { ApiError, isTermsOfUseRequired } from '../lib/apiClient';
+import { ApiError, isAccessRestricted, isTermsOfUseRequired } from '../lib/apiClient';
 import type { BootstrapPayload, PromptOption } from '../lib/types';
 
 /**
@@ -59,10 +59,14 @@ export const useBootstrapStore = create<BootstrapState>((set, get) => ({
             const data = await fetchBootstrap();
             set({ data, loading: false });
         } catch (error) {
-            // The terms gate refused the call and apiClient is already navigating to the
-            // Terms of Use page. Staying on the boot screen avoids flashing a misleading
-            // "session expired" panel during that navigation.
-            if (error instanceof ApiError && isTermsOfUseRequired(error.status, error.payload)) {
+            // The terms gate or the access gate refused the call and apiClient is already
+            // navigating to the page that explains it. Staying on the boot screen avoids
+            // flashing a misleading "session expired" panel during that navigation.
+            if (
+                error instanceof ApiError &&
+                (isTermsOfUseRequired(error.status, error.payload) ||
+                    isAccessRestricted(error.status, error.payload))
+            ) {
                 return;
             }
             const isAuthError = error instanceof ApiError && error.isAuthError;
diff --git a/application/v2_ui/src/stores/safetyWarningStore.ts b/application/v2_ui/src/stores/safetyWarningStore.ts
new file mode 100644
index 000000000..68f373966
--- /dev/null
+++ b/application/v2_ui/src/stores/safetyWarningStore.ts
@@ -0,0 +1,104 @@
+// safetyWarningStore.ts
+// The safety warnings waiting for the signed-in user's acknowledgment. The runtime that reads
+// them (lib/useSafetyWarningRuntime.ts) fills it, and the dialog that shows them
+// (components/notifications/SafetyWarningDialog.tsx) acknowledges them, oldest first.
+//
+// A reviewer can warn about the same violation again, so everything here tells warnings apart
+// by safetyWarningKey -- the violation and when the warning was sent -- not by violation alone.
+
+import { create } from 'zustand';
+import { ApiError } from '../lib/apiClient';
+import {
+    SAFETY_WARNING_REPLACED_CODE,
+    acknowledgeSafetyWarning,
+    fetchPendingSafetyWarnings,
+    safetyWarningKey,
+    type SafetyWarning,
+} from '../lib/safetyWarnings';
+
+export const SAFETY_WARNING_ACKNOWLEDGE_ERROR = 'Your acknowledgment could not be saved. Try again.';
+
+interface SafetyWarningState {
+    /** Waiting for acknowledgment, oldest first. The dialog shows the first. */
+    warnings: SafetyWarning[];
+    /** The safetyWarningKey of the warning being acknowledged. */
+    acknowledgingKey: string | null;
+    error: string | null;
+    /** Replace the list with the server's. */
+    receive: (warnings: SafetyWarning[]) => void;
+    /** Acknowledge one warning. Resolves true once it no longer needs acknowledgment. */
+    acknowledge: (warning: SafetyWarning) => Promise<boolean>;
+    reset: () => void;
+}
+
+/**
+ * Warnings acknowledged in this tab, by safetyWarningKey. A read that left before the
+ * acknowledgment landed still lists them, and must not bring the dialog back for a warning
+ * already answered -- but a newer warning on the same violation is a different warning.
+ */
+const acknowledgedKeys = new Set<string>();
+
+function isReplacedWarning(error: unknown): boolean {
+    if (!(error instanceof ApiError) || error.status !== 409) {
+        return false;
+    }
+    const payload = error.payload;
+    return Boolean(payload && typeof payload === 'object'
+        && (payload as Record<string, unknown>).code === SAFETY_WARNING_REPLACED_CODE);
+}
+
+export const useSafetyWarningStore = create<SafetyWarningState>((set, get) => ({
+    warnings: [],
+    acknowledgingKey: null,
+    error: null,
+
+    receive: (warnings) =>
+        set((state) => {
+            const next = warnings.filter((warning) => !acknowledgedKeys.has(safetyWarningKey(warning)));
+            // An error belongs to the warning on screen; a different one starts clean.
+            const lead = state.warnings[0];
+            const nextLead = next[0];
+            const sameLead = Boolean(lead && nextLead && safetyWarningKey(lead) === safetyWarningKey(nextLead));
+            return { warnings: next, error: sameLead ? state.error : null };
+        }),
+
+    acknowledge: async (warning) => {
+        if (get().acknowledgingKey) {
+            return false;
+        }
+        const key = safetyWarningKey(warning);
+        set({ acknowledgingKey: key, error: null });
+        let replaced = false;
+        try {
+            await acknowledgeSafetyWarning(warning);
+        } catch (error) {
+            // 404 means it no longer needs acknowledgment here: it was withdrawn. 409 replaced
+            // means a newer warning on the same violation took its place, so that one is read
+            // next. Anything else keeps it on screen to try again.
+            replaced = isReplacedWarning(error);
+            if (!replaced && !(error instanceof ApiError && error.status === 404)) {
+                set({ acknowledgingKey: null, error: SAFETY_WARNING_ACKNOWLEDGE_ERROR });
+                return false;
+            }
+        }
+        acknowledgedKeys.add(key);
+        set((state) => ({
+            warnings: state.warnings.filter((item) => safetyWarningKey(item) !== key),
+            acknowledgingKey: null,
+            error: null,
+        }));
+        if (replaced) {
+            try {
+                get().receive(await fetchPendingSafetyWarnings());
+            } catch {
+                // The next bootstrap read shows the newer warning.
+            }
+        }
+        return true;
+    },
+
+    reset: () => {
+        acknowledgedKeys.clear();
+        set({ warnings: [], acknowledgingKey: null, error: null });
+    },
+}));
\ No newline at end of file
diff --git a/docs/_data/app_surface.yml b/docs/_data/app_surface.yml
index 0657cfa5c..82464c2e8 100644
--- a/docs/_data/app_surface.yml
+++ b/docs/_data/app_surface.yml
@@ -8,7 +8,7 @@ counts:
   actions: 32
   chat_controls: 47
   sub_elements: 3
-  app_pages: 29
+  app_pages: 30
   feature_surfaces: 25
 capabilities:
 - key: enable_action_ai_assistant
@@ -1187,6 +1187,9 @@ app_pages:
 - template: acceptable_use_policy.html
   slug: acceptable-use-policy
   route_url: /acceptable_use_policy.html
+- template: access_restricted.html
+  slug: access-restricted
+  route_url: /access-restricted
 - template: admin_feedback_review.html
   slug: admin-feedback-review
   route_url: /admin/feedback_review
diff --git a/docs/admin/security.md b/docs/admin/security.md
index 6414273a4..e9267335c 100644
--- a/docs/admin/security.md
+++ b/docs/admin/security.md
@@ -194,6 +194,8 @@ Test the connection before saving. By default, a check that cannot finish allows
 
 **Trigger information** appends safe category and severity information to blocked-input notices. The expanded chat checks do not echo matched sensitive values, and removed-output notices do not repeat the rejected answer. AI-generated findings are not user misconduct and cannot be used to warn, suspend, or block the user through the remediation actions.
 
+Reviewers act on a user's findings from the Safety Violations review. A warning is sent as soon as the reviewer saves it, and the user must acknowledge it. A suspension or block waits for a second eligible reviewer, and the restricted user then sees an **Access restricted** screen at sign-in that explains why, instead of an error. See [Review safety violations]({{ '/guides/admin-review-safety-violations/' | relative_url }}).
+
 #### Settings
 
 | Setting | What it does | Default | Notes |
diff --git a/docs/explanation/features/ACCESS_RESTRICTED_SIGN_IN_SCREEN.md b/docs/explanation/features/ACCESS_RESTRICTED_SIGN_IN_SCREEN.md
new file mode 100644
index 000000000..dfe5d3e00
--- /dev/null
+++ b/docs/explanation/features/ACCESS_RESTRICTED_SIGN_IN_SCREEN.md
@@ -0,0 +1,119 @@
+# Access Restricted Sign-In Screen
+
+Implemented in version: **0.261.297**
+
+## Overview and Purpose
+
+When an administrator suspends or blocks an account, the user can still sign in, but every app surface used to answer with a bare `Access Denied: Access denied by administrator` page or a 403 error. The notice the administrators sent explaining why went to the notification bell, which a restricted user can no longer open, so they never saw it.
+
+Every app surface now sends a restricted user to an **Access restricted** screen instead. It shows the notice they were sent, says whether the restriction is a suspension (with the restore date and time in the reader's own locale) or a block, gives the safety violation reference when there is one, and offers **Sign out**. The V2 interface shows the V2 page; the classic interface shows a matching server-rendered page.
+
+The Admin role is not subject to access restrictions, as before.
+
+Related changes in the same version:
+- Safety warnings are sent without a second reviewer and must be acknowledged. See [Safety Remediation Actions Fix](../fixes/SAFETY_REMEDIATION_ACTIONS_FIX.md).
+
+Dependencies:
+- `application/single_app/functions_access_restriction.py` (new)
+- `application/single_app/functions_authentication.py`
+- `application/single_app/route_access_restriction.py` (new)
+- `application/single_app/functions_safety_remediation.py`
+- `application/single_app/app.py`
+- `application/single_app/templates/access_restricted.html` (new)
+- `application/single_app/static/js/access-restricted.js` (new)
+- `application/v2_ui/src/pages/AccessRestrictedPage.tsx` (new)
+- `application/v2_ui/src/lib/accessRestriction.ts` (new)
+- `application/v2_ui/src/lib/apiClient.ts`
+- `application/v2_ui/src/stores/bootstrapStore.ts`
+- `application/v2_ui/src/App.tsx`
+
+## Technical Specifications
+
+### Stored restriction and notice
+
+Control Center and safety remediation both restrict a user through `settings.access`:
+
+```json
+{
+  "status": "deny",
+  "datetime_to_allow": "2026-10-08T14:00:00Z",
+  "notice": {
+    "kind": "suspended",
+    "title": "Account Suspension Notice",
+    "message": "Your access is suspended pending review.",
+    "until": "2026-10-08T14:00:00Z",
+    "source": "safety_violation",
+    "reference_id": "<safety violation id>",
+    "applied_at": "2026-10-07T21:40:10+00:00"
+  }
+}
+```
+
+- `datetime_to_allow` set means a suspension that ends on its own; `null` means a block.
+- `notice` is written by `execute_safety_violation_action` when an approved safety suspension or block takes effect. Its title and message are exactly the ones in the notification sent to the user, including the default text used when the reviewer left the notification blank.
+- Control Center writes replace the whole `access` value, so restoring access there also clears the notice. A restriction applied from Control Center has no notice, and the screen shows generic copy for it.
+- A notice written for a different kind of restriction than the one now stored is ignored.
+
+### Access gate
+
+`user_required` still decides access with `check_user_access_status(user_id)`, whose signature and return values are unchanged. Both it and the new `get_user_access_restriction(user_id)` read the setting through `functions_access_restriction.describe_access_restriction`, so they always agree:
+
+- A suspension whose restore time has passed is restored on read, as before, which clears the notice.
+- A failure to read the settings allows access, as before, so a storage fault never locks users out.
+- A restore time without a UTC offset is read as UTC, as Control Center reads it. Previously such a value made the comparison fail and the user was let in.
+- A restore time that cannot be parsed keeps the deny in force with no end date, and is described as a block.
+
+When a non-Admin user is restricted:
+
+| Request | Response |
+| --- | --- |
+| API call (`/api/...`, or a request that accepts JSON and not HTML) | `403 {"error": "access_restricted", "message": <sentence>, "restriction": {...}, "restricted_url": <page>}` |
+| V2 page (`/v2`, `/v2/...`) | Redirect to `/v2/access-restricted` |
+| Any other page | Redirect to `/access-restricted` |
+
+`restriction` holds only the caller's own data: `kind` (`suspended` or `blocked`), `until` (ISO 8601 UTC, suspensions only), `title`, `message` and `reference_id`.
+
+### Routes
+
+These are registered on the `access_restriction` Blueprint with a login-only policy. They must not require `user_required`, because it is what refuses restricted users. None of them accepts a user id; each reads the signed-in user's own settings.
+
+| Route | Purpose |
+| --- | --- |
+| `GET /v2/access-restricted` | Serves the V2 SPA shell. As a static rule it is matched ahead of the `/v2/<path:subpath>` catch-all. |
+| `GET /api/v2/access-restriction` | `{"restricted": bool, "restriction"?: {...}, "branding": {...}}`, with `Cache-Control: no-store`. `branding` carries the application title, logo URLs and classification banner the page draws. An Admin is always `restricted: false`. |
+| `GET /access-restricted` | The classic page. Autoescaped Jinja, sanitized settings only, `Cache-Control: no-store`. |
+
+All three are exempt from the Terms of Use gate. The Terms of Use pages require an unrestricted account, so gating the restricted screen on the terms would bounce a restricted user between the two. Idle-session timeout still applies to them, so an idle session ends as usual and the user sees the screen again after signing back in.
+
+### V2 interface
+
+- `lib/apiClient.ts` adds `isAccessRestricted(status, payload)` and sends the tab to `/v2/access-restricted` whenever any call is refused by the gate, so a restriction applied while a tab is open is shown at once. It does not navigate when the tab is already on that page.
+- `bootstrapStore.load()` stays on the boot screen while that navigation happens, rather than flashing the "session expired" error.
+- `App.tsx` renders `AccessRestrictedPage` outside the bootstrap gate for the `/access-restricted` path and loads nothing the shell needs there.
+- The page reads `GET /api/v2/access-restriction`. A restricted account sees the notice title and message as plain text, **Access returns** with the restore time formatted in the reader's locale or "No automatic restore date", the reference when there is one, and **Sign out**. If the account is no longer restricted, for example because the suspension ended, it says so and offers **Continue**. An expired session offers **Sign in**.
+
+### Classic interface
+
+`templates/access_restricted.html` renders the same information without the application navigation, whose calls would all be refused. The restore time is rendered in UTC and `static/js/access-restricted.js` rewrites it in the reader's locale.
+
+## Usage Instructions
+
+Nothing needs to be enabled. To see the screen:
+
+1. As a safety reviewer, choose **Suspend user** or **Block user** on a violation and save. Another eligible reviewer approves the request in **Approval Requests**.
+2. Sign in as the affected user. Every page opens the Access restricted screen with the notice they were sent.
+3. Restore access from Control Center, or wait for the suspension to end. The screen then offers **Continue**.
+
+## Testing and Validation
+
+- `functional_tests/test_access_restricted_gate.py`: restriction description and expiry, legacy reasons, the structured 403 for API calls, V2 and classic redirects, the static route winning over the catch-all, caller-only data, expired-suspension restore, the Admin bypass, allow-on-error, the classic page escaping notice text, login-only routes, and the Terms of Use and idle-timeout exemptions. Real modules run in fresh processes with network access blocked, under normal and optimized Python.
+- `functional_tests/test_safety_violation_remediation_approvals.py`: suspend and block write the notice with the text the user was sent.
+- `functional_tests/test_v2_access_restriction_and_safety_warning_logic.mjs`: the real V2 API client redirects once on the gate's 403 and never loops on the page; the restriction payload is parsed defensively.
+- `ui_tests/test_v2_access_restricted_and_safety_warning.py`: a restricted user lands on the page instead of an error, the notice renders as text, the restore time is localized, and blocked and restored accounts read differently.
+- `ui_tests/test_classic_safety_review_and_access_restricted.py`: the classic page renders the notice as text, shows the restore time in the reader's locale, and reads differently for a block and a restored account.
+- `functional_tests/route_tests/`: the three routes are classified as login-only, and the Blueprint is registered with `login_required_blueprint`.
+
+Known limitations:
+
+- The gate covers every route that requires the User role (`user_required`), which includes every chat, workspace and V2 surface. Routes that have only ever required sign-in, such as the classic Profile page and custom pages, are unchanged, so a restricted user can still open them.
+- A restricted user cannot acknowledge a pending safety warning until access returns, because the warning routes require an unrestricted account.
diff --git a/docs/explanation/features/index.md b/docs/explanation/features/index.md
index d2c48dcce..a60ac4d24 100644
--- a/docs/explanation/features/index.md
+++ b/docs/explanation/features/index.md
@@ -18,6 +18,7 @@ category: Version History
 - [Activity Log Auto-Refresh](CONTROL_CENTER_ACTIVITY_LOG_AUTO_REFRESH.md)
 - [Activity Log Layout Presets](ACTIVITY_LOG_LAYOUT_PRESETS.md)
 - [Content Safety Violation Messages](CONTENT_SAFETY_VIOLATION_MESSAGES.md)
+- [Access Restricted Sign-In Screen](ACCESS_RESTRICTED_SIGN_IN_SCREEN.md)
 
 ## Agent and Action Features
 
diff --git a/docs/explanation/features/v0.241.127/SAFETY_VIOLATION_REMEDIATION_APPROVALS.md b/docs/explanation/features/v0.241.127/SAFETY_VIOLATION_REMEDIATION_APPROVALS.md
index 888ac96a8..297156a17 100644
--- a/docs/explanation/features/v0.241.127/SAFETY_VIOLATION_REMEDIATION_APPROVALS.md
+++ b/docs/explanation/features/v0.241.127/SAFETY_VIOLATION_REMEDIATION_APPROVALS.md
@@ -66,4 +66,11 @@ Validation performed
 
 Known limitations
 
-- `Escalate` remains unchanged because the repository does not currently include a downstream escalation workflow beyond the existing label.
\ No newline at end of file
+- `Escalate` remains unchanged because the repository does not currently include a downstream escalation workflow beyond the existing label.
+
+Updated in version: **0.261.297**
+
+- `Warn user` no longer creates an approval request: the warning is sent when the reviewer saves the review, and the user must acknowledge it. `Suspend user` and `Block user` still require approval by another eligible reviewer.
+- `Escalate` can no longer be chosen. Records that already carry it are labelled `Escalated (legacy)`.
+- An executed suspension or block stores the notice the user was sent, which a restricted user sees on the Access restricted screen at sign-in.
+- See [Safety Remediation Actions Fix](../../fixes/SAFETY_REMEDIATION_ACTIONS_FIX.md) and [Access Restricted Sign-In Screen](../ACCESS_RESTRICTED_SIGN_IN_SCREEN.md).
\ No newline at end of file
diff --git a/docs/explanation/fixes/SAFETY_REMEDIATION_ACTIONS_FIX.md b/docs/explanation/fixes/SAFETY_REMEDIATION_ACTIONS_FIX.md
new file mode 100644
index 000000000..70e9211e3
--- /dev/null
+++ b/docs/explanation/fixes/SAFETY_REMEDIATION_ACTIONS_FIX.md
@@ -0,0 +1,118 @@
+# Safety Remediation Actions Fix
+
+Fixed/Implemented in version: **0.261.297**
+
+## Issue Description
+
+Two of the four remediation actions on the Safety Violations review did nothing in practice:
+
+- **Warn user** never reached the user in a deployment with one administrator. Saving a warning created a `warn_user` approval request, and since [0.241.030](v0.241.030/APPROVAL_REQUESTER_ACTION_BOUNDARY_FIX.md) a requester can never approve their own request. With nobody else eligible to approve it, the request sat pending until it was automatically denied, and the violation stayed locked while it was pending.
+- **Escalate** was only a label. It was stored on the record and counted in the statistics, but nothing escalated anything, which [the remediation feature](../features/v0.241.127/SAFETY_VIOLATION_REMEDIATION_APPROVALS.md) recorded as a known limitation.
+
+A warning that did reach a user was also easy to miss: it was one more notice in the bell, and nothing showed whether the user had read it.
+
+## Root Cause Analysis
+
+All three remediation actions were routed through the same approval workflow so that no single reviewer could act on another user alone. That rule is right for suspensions and blocks, which take away access, but a warning only informs the user, and holding it for a second reviewer meant it was never sent where there was no second reviewer. Escalate was added as an action before any escalation workflow existed, and none was built.
+
+## Technical Details
+
+### Files Modified
+
+- `application/single_app/route_backend_safety.py`
+- `application/single_app/functions_safety_remediation.py`
+- `application/single_app/route_backend_control_center.py`
+- `application/single_app/route_backend_v2.py`
+- `application/single_app/templates/admin_safety_violations.html`
+- `application/single_app/static/js/admin/admin-safety-violations.js`
+- `application/single_app/templates/my_safety_violations.html`
+- `application/single_app/templates/profile.html`
+- `application/single_app/static/js/profile/profile-tabs.js`
+- `application/v2_ui/src/pages/AdminSafetyViolationsPage.tsx`
+- `application/v2_ui/src/components/settings/ViolationsTab.tsx`
+- `application/v2_ui/src/components/notifications/SafetyWarningDialog.tsx` (new)
+- `application/v2_ui/src/lib/safetyWarnings.ts` (new)
+- `application/v2_ui/src/lib/useSafetyWarningRuntime.ts` (new)
+- `application/v2_ui/src/stores/safetyWarningStore.ts` (new)
+- `application/single_app/config.py`
+
+### Warnings are sent when the review is saved
+
+The two-person rule is relaxed for warnings only, because a warning restricts nothing:
+
+- Saving **Warn user** calls `execute_safety_violation_action` straight away. No approval request is created, and the response is `{"message": "Warning sent to the user.", "approval_required": false}`.
+- The reviewer's decision is still audited: an activity-log entry (`safety_violation_warning_sent`) and a `[SAFETY_REMEDIATION]` event record who sent it, to whom, and the notification id. These replace the audit trail the approval request used to provide.
+- Saving a record whose warning was already sent, for example to resolve it, updates the review without sending the warning again and returns `warning_already_sent: true`.
+- If the notification cannot be created, the rest of the review is saved, the record is marked `action_request_status: "failed"`, and the response is a 500 asking the reviewer to save again. No exception text is returned.
+- The existing guards remain: a record with a pending approval returns 409, and AI-generated findings cannot be used to warn or restrict a user.
+
+#### Overlapping saves send one warning
+
+A double-click, or two reviewers saving the same violation at once, could otherwise send the warning twice: both saves would read the record before either had recorded the warning. So a save claims the violation before anything is sent:
+
+- The claim is a write conditional on the ETag the save read (`IfNotModified`). It stores the review with `action_request_status: "sending"`, `warning_send_claim_id` and `warning_send_claimed_at`. Of two saves that read the same version, only one claims it. The other sends nothing and returns 409 `{"error": ..., "code": "safety_warning_in_progress"}`.
+- While a claim is fresh, other saves and deletes of the violation return the same 409, as they do for a pending approval. `sending` never counts as a warning to acknowledge: it isn't listed or counted as pending, can't be acknowledged, and has no acknowledgment status.
+- The outcome, sent or failed, is then written on the claimed version, and the claim is released. If another writer changed the record meanwhile but kept the claim, as archiving does, the outcome is written on the latest version. If the claim was lost, because the record was deleted or replaced without it, nothing is overwritten. The warning has been sent, so the decision is still audited, and the response is `{"code": "safety_warning_not_recorded"}` (409, or 500 when the write itself failed) telling the reviewer to reload before saving again.
+- A claim older than five minutes, or one whose time can't be read, is from a save that stopped before it finished. It no longer blocks, lists as `failed` with an explanation, and is recorded as failed by the next save. Saving **Warn user** again retries it, and of two saves that retry it at once only one sends.
+- The classic page disables **Save Review** while its request is in flight. The V2 page already did.
+- Archiving, and saves that don't send a warning, still write without a condition. One that read the violation just before the claim and writes after it replaces the claim, or the recorded warning if the send has finished. A replaced claim is reported as not recorded, as above.
+
+**Suspend user** and **Block user** are unchanged: saving creates an approval request that another eligible reviewer must approve, and the requester can never approve their own request.
+
+A `warn_user` approval created before this version still completes when approved through the Control Center approval path, and is then treated like any other executed warning.
+
+### Warnings must be acknowledged
+
+When a warning executes, by either path, the violation records:
+
+| Field | Meaning |
+| --- | --- |
+| `warning_requires_acknowledgment` | `true`. Warnings sent before this version do not have it and are never shown again. |
+| `warning_notification_id` | The bell notification that delivered the warning. |
+| `warning_title`, `warning_message` | Exactly what the user was sent. |
+| `warning_issued_at` | When it was sent. |
+| `warning_acknowledged_at` | `null` until the user acknowledges it. |
+
+New user routes, which require a signed-in, unrestricted User session and are deliberately not gated on the content checks report, so a warning already sent stays acknowledgeable:
+
+- `GET /api/safety/warnings/pending` returns `{"warnings": [...], "count": n}`, oldest first, `Cache-Control: no-store`. Each warning holds only `id`, `violation_id`, `title`, `message`, `issued_at`, `acknowledged_at` and `triggered_categories`.
+- `POST /api/safety/warnings/<id>/acknowledge` records `warning_acknowledged_at` and marks the delivering notification read. Repeating it changes nothing and returns `already_acknowledged: true`. A record that isn't the caller's own executed warning returns 404 `Warning not found.`, the same answer as a record that doesn't exist. The write is conditional on the record's ETag and retried, so a reviewer saving the record at the same moment is never overwritten.
+- A reviewer can warn about the same violation again by changing the action away from **Warn user** and back. The new warning replaces the earlier one's fields and clears `warning_acknowledged_at`, so one warning is the violation `id` together with `issued_at`. The acknowledge body may carry the `issued_at` the pending route listed, and the V2 dialog always sends it. When the violation now holds a warning sent at another time, the route returns 409 `{"error": ..., "code": "safety_warning_replaced"}` and records nothing, so an acknowledgment is never recorded against a warning the user hasn't read. A body that omits `issued_at` acknowledges the warning the violation now holds. A non-string `issued_at` returns 400.
+
+V2 bootstrap carries `safety_warnings.pending`, the count of waiting warnings. The V2 interface reads the warnings only when that count is above zero, after bootstrap loads and again whenever the tab comes back to the front, so a user with nothing to acknowledge makes no extra request. A modal dialog, **A warning from your administrators**, shows each warning's title, message, when it was sent and its flagged categories. It has no close button, and Escape or a click outside it leaves it open; **I understand** acknowledges the warning and shows the next one. It appears again in any tab, on any device, until acknowledged.
+
+Reviewers see the state on the record: the admin list and detail JSON add `warning_acknowledgment_status` (`pending`, `acknowledged`, `not_tracked` for a warning sent before this version, or `null` for anything else) beside the fields above. The V2 review dialog shows "Warning acknowledged *date*" or "Not yet acknowledged", and the user's V2 **Settings > Violations** tab shows whether they acknowledged it.
+
+### Escalate is no longer an action
+
+- It is removed from the action choices and filters in the V2 and classic admin pages and the users' violation lists.
+- The API rejects a change to `Escalate` with 400. A record that already carries `Escalate` still saves with it unchanged, so it can be resolved or noted; it can be moved to another action, but not back.
+- Records that carry it are labelled **Escalated (legacy)**. `escalate_count` stays in the statistics JSON. The V2 tile that read "Escalated or blocked" now reads **Blocked** and mentions legacy escalations only when there are any; the classic page's **Escalated** tile is now **Blocked**.
+
+### Testing Approach
+
+- `functional_tests/test_safety_warning_acknowledgment.py` (including a warning withdrawn or replaced by a newer one on the same violation)
+- `functional_tests/test_safety_warning_send_claim.py` (two overlapping saves send one warning; saves, deletes and acknowledgments wait while a warning is being sent; a stale claim is retried once; a lost claim is reported, not overwritten)
+- `functional_tests/test_safety_escalate_removal.py`
+- `functional_tests/test_safety_violation_remediation_approvals.py` (updated to run offline, and to cover the second-reviewer rule and the restriction notice)
+- `functional_tests/test_v2_access_restriction_and_safety_warning_logic.mjs`
+- `ui_tests/test_v2_access_restricted_and_safety_warning.py`
+- `ui_tests/test_classic_safety_review_and_access_restricted.py` (the classic review page offers no Escalate, labels a legacy record, explains which actions need a second reviewer, shows whether a sent warning was acknowledged, shows Blocked statistics, and disables Save while a save is in flight)
+- `functional_tests/route_tests/` policy inventories for the two warning routes
+
+## Validation
+
+### Before
+
+- In a deployment with one administrator, **Warn user** created a request nobody could approve, and the warning was never sent.
+- A delivered warning was one more notice in the bell, with no record of whether it was read.
+- **Escalate** could be chosen and did nothing.
+
+### After
+
+- A warning is sent as the review is saved, is not sent again when the record is saved later or when two saves overlap, and is audited.
+- The user has to acknowledge it before carrying on in the V2 interface, and reviewers can see whether they have.
+- Suspensions and blocks still need a second eligible reviewer.
+- **Escalate** can't be chosen; existing records keep it, labelled as legacy.
+
+Related: [Access Restricted Sign-In Screen](../features/ACCESS_RESTRICTED_SIGN_IN_SCREEN.md), which shows a suspended or blocked user why at sign-in.
diff --git a/docs/explanation/fixes/index.md b/docs/explanation/fixes/index.md
index 6494b470a..bff72a2ab 100644
--- a/docs/explanation/fixes/index.md
+++ b/docs/explanation/fixes/index.md
@@ -6,6 +6,7 @@ order: 120
 category: Version History
 ---
 
+- [Safety Remediation Actions Fix](SAFETY_REMEDIATION_ACTIONS_FIX.md)
 - [Mixed-Source Admin Settings Fix](MIXED_SOURCE_ADMIN_SETTINGS_FIX.md)
 - [Video Indexer Deployment Region and Permissions Fix](VIDEO_INDEXER_DEPLOYMENT_REGION_AND_PERMISSIONS_FIX.md)
 - [Search Result Cache Admin Setting Fix](SEARCH_RESULT_CACHE_ADMIN_SETTING_FIX.md)
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index 1c0fb0a9a..1164584f7 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,6 +2,45 @@
 
 For feature-focused and fix-focused drill-downs by version, see [Features by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/features) and [Fixes by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/fixes).
 
+### **(v0.261.297)**
+
+#### New Features
+
+*   **Access Restricted Screen For Suspended And Blocked Users**
+    *   A user whose access an administrator suspended or blocked can still sign in, but every page now opens an **Access restricted** screen instead of a bare "Access Denied" error. It shows the notice the user was sent, whether access returns on its own and when (in the user's own time zone), the safety violation reference, and **Sign out**. Once the suspension ends or access is restored, the screen offers **Continue**.
+    *   V2 pages go to `/v2/access-restricted` and classic pages to `/access-restricted`. API calls get `403 {"error": "access_restricted", "message", "restriction", "restricted_url"}` with the caller's own restriction, and the V2 interface follows it to the screen from any page, including when a restriction is applied while a tab is open.
+    *   An approved safety suspension or block now stores the notice with the restriction, using the same title and message as the notification. Control Center restrictions carry no notice and show generic text; restoring access from Control Center clears it.
+    *   The screen's routes require sign-in but not an unrestricted account, describe only the signed-in user's own restriction, and are exempt from the Terms of Use gate so a restricted user is never bounced between the two. Idle-session timeout still applies. Accounts with the Admin role are still never restricted.
+    *   (Ref: `functions_access_restriction.py`, `functions_authentication.py` `user_required`, `get_user_access_restriction`, `route_access_restriction.py`, `access_restricted.html`, `AccessRestrictedPage.tsx`, `apiClient.ts`, [Access Restricted Sign-In Screen](features/ACCESS_RESTRICTED_SIGN_IN_SCREEN.md))
+
+*   **Safety Warnings Must Be Acknowledged**
+    *   A warning from a safety reviewer now opens a dialog, **A warning from your administrators**, the next time the user opens the V2 interface, and appears again in every tab and on every device until they select **I understand**. Escape and clicks outside the dialog don't dismiss it.
+    *   Reviewers see **Warning acknowledged** with the date, or **Not yet acknowledged**, on the violation, and users see the same state in **Settings > Violations**. Warnings sent before this version are never shown again.
+    *   A reviewer can warn about the same violation again. The user then has to acknowledge the newer warning, even in a tab where they acknowledged the earlier one, and an acknowledgment is only recorded against the warning the user read: one replaced while on screen is answered with the newer warning instead.
+    *   New routes `GET /api/safety/warnings/pending` and `POST /api/safety/warnings/<id>/acknowledge` return and change only the caller's own warnings. Bootstrap carries the pending count, so a user with no warnings makes no extra request.
+    *   (Ref: `functions_safety_remediation.py`, `route_backend_safety.py`, `route_backend_v2.py` bootstrap `safety_warnings`, `SafetyWarningDialog.tsx`, `useSafetyWarningRuntime.ts`, `ViolationsTab.tsx`, [Safety Remediation Actions Fix](fixes/SAFETY_REMEDIATION_ACTIONS_FIX.md))
+
+#### Bug Fixes
+
+*   **Safety Warnings Are Sent Without A Second Reviewer**
+    *   In a deployment with one administrator, **Warn user** created an approval request that nobody could approve, because a requester can never approve their own request, so the warning was never sent. A warning restricts nothing, so it is now sent as soon as the reviewer saves the review, and recorded in the activity log. Saving the record again, for example to resolve it, doesn't send it twice.
+    *   Two saves that overlap, such as a double-click or two reviewers at once, send it once. A save claims the violation with a write conditional on the version it read before anything is sent, and the other save is refused with `409 safety_warning_in_progress`. While a warning is being sent the violation reads **Sending**, can't be changed or deleted, and never counts as a warning to acknowledge. A claim left by a save that stopped is released after five minutes. The classic page also disables **Save Review** while its request is in flight.
+    *   **Suspend user** and **Block user** still create an approval request that another eligible reviewer must approve. A **Warn User** request created before this version still completes when approved.
+    *   The review's guidance text in both interfaces now describes which actions wait for a second reviewer.
+    *   (Ref: `route_backend_safety.py` `update_safety_log`, `functions_safety_remediation.py` `claim_safety_warning_send`, `record_safety_warning_send`, `route_backend_control_center.py` `_execute_safety_violation_request`, `AdminSafetyViolationsPage.tsx`, `admin-safety-violations.js`, [Safety Remediation Actions Fix](fixes/SAFETY_REMEDIATION_ACTIONS_FIX.md))
+
+#### Breaking Changes
+
+*   **Escalate Removed As A Safety Action**
+    *   **Escalate** was a label with no workflow behind it. It can no longer be chosen in either interface, and the API rejects a change to `Escalate` with 400. Records that already carry it keep it, are labelled **Escalated (legacy)**, and can still be saved. `escalate_count` remains in the statistics; the V2 "Escalated or blocked" tile is now **Blocked**.
+    *   **Migration**: None required. Resolve or re-action legacy escalated records as needed.
+    *   (Ref: `route_backend_safety.py`, `AdminSafetyViolationsPage.tsx`, `ViolationsTab.tsx`, `admin_safety_violations.html`, `my_safety_violations.html`, `profile.html`)
+
+*   **Access-Restriction Responses Changed**
+    *   API calls from a restricted user now return `403` with `"error": "access_restricted"` and a structured `restriction`, instead of `"error": "Access Denied"` with the reason as `message`. Browser page requests are redirected to the Access restricted screen instead of returning a plain-text 403.
+    *   **Migration**: Integrations that matched the old `Access Denied` error string should check for `access_restricted` instead.
+    *   (Ref: `functions_authentication.py` `access_restricted_response`)
+
 ### **(v0.261.296)**
 
 #### User Interface Enhancements
diff --git a/docs/guides/admin-review-safety-violations.md b/docs/guides/admin-review-safety-violations.md
index b1a6ef9e1..1cde4f289 100644
--- a/docs/guides/admin-review-safety-violations.md
+++ b/docs/guides/admin-review-safety-violations.md
@@ -1,10 +1,10 @@
 ---
 layout: page
 title: "Review safety violations"
-description: "Review flagged activity, manage remediation requests, and recheck chat messages whose required safety checks did not finish."
+description: "Review flagged activity, warn, suspend, or block a user, and recheck chat messages whose required safety checks did not finish."
 section: "Guides"
 audience: admin
-version: "0.261.277"
+version: "0.261.297"
 ---
 
 ## What this covers
@@ -17,16 +17,46 @@ The page appears in the account menu when either **Content Safety** or **Content
 
 ## Review violations
 
-The summary shows total, open, resolved, dismissed, recent, and escalated-or-blocked counts, plus status and action distributions. Filter by status, recorded action, and active/archived records. Choose the page size and list or card view; export CSV downloads all violations matching the active filters.
+The summary shows total, open, resolved, dismissed, recent, and blocked counts, plus status and action distributions. Filter by status, recorded action, and active/archived records. Choose the page size and list or card view; export CSV downloads all violations matching the active filters.
 
-Open **Review** to inspect the flagged message, triggered categories, user notes, and current review status. Reviewers can set a status and administrator notes. Actions that warn or restrict a user require notification details and use the existing approval and access-restriction workflow. A suspension also requires a restore date. The server validates the action and reviewer permissions; AI-generated findings cannot be used to warn or restrict a user.
+Open **Review** to inspect the flagged message, triggered categories, user notes, and current review status. Reviewers can set a status and administrator notes, and choose an action. The server validates the action and reviewer permissions; AI-generated findings cannot be used to warn or restrict a user.
 
 Archive preserves a violation outside the active queue and can be reversed from the archived view. Permanent deletion cannot be undone, is confirmed in the page, preserves audit history, and is refused by the server while a remediation approval is pending.
 
+## Warn, suspend, or block a user
+
+Each action sends the user the notification text in the review. Leave it as generated, or edit it: the default text names the violation, its triggered categories and your administrator notes.
+
+| Action | What happens when you save | Who else is involved |
+| --- | --- | --- |
+| **Warn user** | The warning is sent to the user straight away. | Nobody. A warning restricts nothing, so it doesn't wait for another reviewer. Your decision is recorded in the activity log. |
+| **Suspend user** | An approval request is created. Access is restricted until the restore date you set only once the request is approved. | Another eligible reviewer approves it in **Approval Requests**. You can deny your own request to cancel it, but never approve it. |
+| **Block user** | An approval request is created. Access is blocked, with no restore date, only once the request is approved. | The same as a suspension. |
+
+Suspensions and blocks need a second reviewer because they take away a person's access; requiring two people for that decision protects users from a single mistaken or malicious reviewer. A record with a pending approval can't be changed or deleted until the request is decided.
+
+Saving a warned record again, for example to resolve it, doesn't send the warning a second time. Neither do two saves that overlap, such as a double-click or two reviewers saving the same violation at once: only the first sends it, and the other is refused and asks you to reload. While a warning is being sent, the violation shows **Sending** and can't be changed or deleted. If you change the action away from **Warn user**, save, and later choose **Warn user** again, a new warning is sent. It replaces the earlier one on the record, and the user has to acknowledge the new warning even if they acknowledged the earlier one.
+
+### Warning acknowledgment
+
+A warning has to be acknowledged. The V2 interface shows it in a dialog the next time the user opens SimpleChat, and again in every tab and on every device until they select **I understand**. In the classic interface the warning arrives as a notification.
+
+The review shows **Warning acknowledged** with the date, or **Not yet acknowledged**, so you can tell whether the user has read it before deciding on a further step. An acknowledgment always belongs to the warning the user read: if a newer warning replaces it while it is on their screen, selecting **I understand** shows the newer warning instead of recording anything. Warnings sent before version 0.261.297 are shown as sent before acknowledgment was tracked, and are never shown to the user again.
+
+### What a suspended or blocked user sees
+
+Once a suspension or block takes effect, the user can still sign in, but every page opens an **Access restricted** screen instead of an error. It shows the notification text from the review, the restore date and time for a suspension in the user's own time zone, the violation id, and a **Sign out** link. A suspension ends by itself at the restore time; restore access earlier from Control Center. A restriction applied from Control Center shows generic text, since it carries no notification.
+
+Users with the **Admin** role are never restricted, even when an access restriction is stored for them.
+
+### Escalate
+
+**Escalate** was a label with no workflow behind it, and it can no longer be chosen. Records that already carry it show **Escalated (legacy)** and can still be saved, so you can resolve them or replace the action with another one. The summary only mentions legacy escalations when there are some.
+
 ## Recheck unchecked chat content
 
 The unchecked queue shows check metadata, not message bodies. Filter it by conversation source, message type, or incomplete scanner, then load further results as needed. **Recheck** applies current rules to the selected message and requires explicit confirmation. A confirmed finding on an AI reply can remove it from saved and shared chat; rechecking cannot undo earlier views or external actions. A checker outage leaves the message available and marked for another attempt.
 
 ## Version
 
-Implemented in version **0.261.277** (`application/single_app/config.py`).
+Implemented in version **0.261.277** (`application/single_app/config.py`). Warnings without a second reviewer, warning acknowledgment, the Access restricted screen and the removal of Escalate were added in version **0.261.297**.
diff --git a/docs/guides/review-approval-requests.md b/docs/guides/review-approval-requests.md
index d742d31be..04b8ee840 100644
--- a/docs/guides/review-approval-requests.md
+++ b/docs/guides/review-approval-requests.md
@@ -4,7 +4,7 @@ title: "Review approval requests"
 description: "Find, approve, or deny requests that need reviewer action."
 section: "Guides"
 audience: user
-version: "0.261.038"
+version: "0.261.297"
 ---
 
 ## What this does
@@ -88,6 +88,12 @@ decisions. See [Microsoft 365 data and approvals]({{ '/guides/microsoft-365-conv
 
 The request status changes in the table. Approved executable requests complete the requested action, while denied requests remain recorded with the decision.
 
+## Safety violation actions
+
+From **0.261.297**, a safety reviewer's **Warn user** is sent as soon as the review is saved and no longer creates an approval request: a warning restricts nothing, so it does not need a second person. **Suspend user** and **Block user** still create one, because they take away a person's access. Another eligible reviewer must approve them; the reviewer who requested one can deny it to cancel it but can never approve it. Eligible reviewers hold the `Admin` role, or `ControlCenterAdmin` when Control Center requires that role. A **Warn User** request created before 0.261.297 can still be approved, and the warning is then sent.
+
+When an approved suspension or block takes effect, the user sees an **Access restricted** screen whenever they sign in, with the notification from the request and, for a suspension, when access returns. Accounts with the `Admin` role are not affected by access restrictions. See [Review safety violations]({{ '/guides/admin-review-safety-violations/' | relative_url }}).
+
 ## Review screened document content
 
 Content-screening requests use a dedicated evidence and remediation workflow rather than the generic **Approve & Execute** action. The whole document stays unavailable until its complete scan and required review are resolved.
diff --git a/docs/reference/logging-tags.md b/docs/reference/logging-tags.md
index 3ce59cb35..690adbba1 100644
--- a/docs/reference/logging-tags.md
+++ b/docs/reference/logging-tags.md
@@ -24,6 +24,7 @@ Last inventoried: 2026-08-10
 - `[RATE_LIMIT]`
 - `[WORKFLOW_ALERTS]`
 - `[YAMCS_PLUGIN]`
+- `[ACCESS_RESTRICTION]`
 - `[ACTIVITY_LOGGING]`
 - `[ADMIN_FEEDBACK]`
 - `[ADMIN_RELEASE_NOTIFICATIONS]`
@@ -220,6 +221,7 @@ Last inventoried: 2026-08-10
 - `[SAFETY_LIFECYCLE]`
 - `[SAFETY_REMEDIATION]`
 - `[SAFETY_VIOLATIONS]`
+- `[SAFETY_WARNINGS]`
 - `[SAVE_CHUNKS]`
 - `[SAVE_CHUNKS_BATCH]`
 - `[SEARCH_CACHE_DEBUG]`
@@ -278,6 +280,7 @@ Last inventoried: 2026-08-10
 - `[USER_SETTINGS_CACHE]`
 - `[XSD_GENERATION]`
 - `[XSD_INGESTION]`
+- `[V2_BOOTSTRAP]`
 - `[VIDEO]`
 - `[VIDEO_CHUNK]`
 - `[VIDEO_INDEXER]`
diff --git a/functional_tests/route_tests/test_route_blueprint_policy_inventory.py b/functional_tests/route_tests/test_route_blueprint_policy_inventory.py
index 009d328d5..223049a8b 100644
--- a/functional_tests/route_tests/test_route_blueprint_policy_inventory.py
+++ b/functional_tests/route_tests/test_route_blueprint_policy_inventory.py
@@ -2,7 +2,7 @@
 #!/usr/bin/env python3
 """
 Functional test for route blueprint policy inventory.
-Version: 0.261.296
+Version: 0.261.297
 Implemented in: 0.242.069
 Plan editor policy coverage: 0.261.102
 Selected-group context policy coverage: 0.261.126
@@ -17,6 +17,7 @@
 Global agent and action editor policy coverage: 0.261.271
 Control Center dashboard route policy coverage: 0.261.279
 V2 Support menu Latest Features route policy coverage: 0.261.296
+Access restricted screen and safety warning policy coverage: 0.261.297
 
 This test ensures every SimpleChat route is assigned to a Blueprint-based
 security policy or an explicit reviewed route exemption.
@@ -47,6 +48,9 @@
 }
 
 REGISTERED_BLUEPRINT_POLICIES = {
+    # Login-only on purpose: user_required sends a suspended or blocked user to these
+    # Access restricted pages, which only describe the signed-in user's own restriction.
+    "access_restriction": ("login_required",),
     "backend_analysis_results": ("login_required", "user_required"),
     "backend_chats": ("login_required", "user_required"),
     "backend_collaboration": ("login_required", "user_required"),
@@ -345,6 +349,14 @@
         "login_required", "user_required", "enabled_required", "workflow_user_required", "workflow_results_required",
     ),
     ("route_backend_analysis_results.py", "get_saved_analysis_result"): ("login_required", "user_required"),
+    # The warned user's own safety warnings: a user session, deliberately not gated on the
+    # content checks report, so a warning already sent stays acknowledgeable.
+    ("route_backend_safety.py", "get_pending_safety_warnings"): ("login_required", "user_required"),
+    ("route_backend_safety.py", "acknowledge_pending_safety_warning"): ("login_required", "user_required"),
+    # The Access restricted screen: login-only, see REGISTERED_BLUEPRINT_POLICIES.
+    ("route_access_restriction.py", "v2_access_restricted"): ("login_required",),
+    ("route_access_restriction.py", "v2_access_restriction"): ("login_required",),
+    ("route_access_restriction.py", "access_restricted"): ("login_required",),
     ("app.py", "session_heartbeat"): ("login_required",),
     ("app.py", "list_semantic_kernel_plugins"): ("login_required", "admin_required"),
     ("route_backend_plugins.py", "get_agent_action_targets"): ("login_required", "user_required"),
@@ -650,6 +662,37 @@ def test_content_screening_routes_keep_authenticated_blueprint_guards() -> None:
         assert "bp.before_request(user_required_blueprint())" in read_text(APP_DIR / name)
 
 
+def test_access_restricted_routes_are_login_only() -> None:
+    """The Access restricted screen is reachable by exactly the users user_required refuses.
+
+    It must require a signed-in session, and must not require the User role check that
+    refuses restricted users, or a suspended user could never read why. Explicit raises keep
+    this check under ``python -O``.
+    """
+    expected_routes = {
+        "/v2/access-restricted": "v2_access_restricted",
+        "/api/v2/access-restriction": "v2_access_restriction",
+        "/access-restricted": "access_restricted",
+    }
+    routes = [route for route in iter_route_functions() if route.path in expected_routes]
+    found = {route.path: route.function_name for route in routes}
+    if len(routes) != len(expected_routes) or found != expected_routes:
+        raise AssertionError(f"Unexpected Access restricted routes: {sorted(found.items())}.")
+    for route in routes:
+        if route.file_name != "route_access_restriction.py" or route.route_target != "bp":
+            raise AssertionError(f"{route.function_name} moved to {route.file_name}:{route.route_target}.")
+        if route.decorator_names != ("bp.route", "swagger_route", "login_required"):
+            raise AssertionError(f"{route.function_name} decorators changed: {route.decorator_names}.")
+
+    app_source = read_text(APP_DIR / "app.py")
+    registration = (
+        "register_route_blueprint('access_restriction', register_route_access_restriction, "
+        "login_required_blueprint)"
+    )
+    if registration not in app_source:
+        raise AssertionError("The Access restricted Blueprint must be registered with login_required_blueprint.")
+
+
 if __name__ == "__main__":
     tests = [
         test_route_policy_inventory_assets_and_version_are_current,
@@ -664,6 +707,7 @@ def test_content_screening_routes_keep_authenticated_blueprint_guards() -> None:
         test_workflow_run_status_route_keeps_the_personal_workflow_security_policy,
         test_workflow_handoff_routes_keep_the_personal_workflow_security_policy,
         test_content_screening_routes_keep_authenticated_blueprint_guards,
+        test_access_restricted_routes_are_login_only,
     ]
     results = []
     for test in tests:
diff --git a/functional_tests/route_tests/test_route_unauthenticated_policy_contract.py b/functional_tests/route_tests/test_route_unauthenticated_policy_contract.py
index 8b4a5d297..3d246c32c 100644
--- a/functional_tests/route_tests/test_route_unauthenticated_policy_contract.py
+++ b/functional_tests/route_tests/test_route_unauthenticated_policy_contract.py
@@ -2,11 +2,12 @@
 # test_route_unauthenticated_policy_contract.py
 """
 Functional test for route unauthenticated access policy contract.
-Version: 0.261.227
+Version: 0.261.297
 Implemented in: 0.242.069
 Workflow result context coverage: 0.261.214
 Workflow run status coverage: 0.261.227
 Workflow hand-off coverage: 0.261.250
+Access restricted screen coverage: 0.261.297
 
 This test ensures every SimpleChat route has an explicit expected unauthenticated
 access behavior: public, browser-session authenticated, admin-only, or external
@@ -66,6 +67,12 @@
     "/api/approvals",
     "/swagger",
     "/api/swagger/",
+    # The Access restricted screen: a suspended or blocked user is refused by user_required
+    # and sent here, so it needs a signed-in session and nothing more. It only ever
+    # describes the signed-in user's own restriction.
+    "/access-restricted",
+    "/v2/access-restricted",
+    "/api/v2/access-restriction",
 )
 
 USER_SESSION_PATH_PREFIXES = (
@@ -325,6 +332,32 @@ def test_workflow_handoff_routes_require_a_signed_in_user_session() -> None:
             raise AssertionError(f"{route.function_name} must not accept bearer tokens.")
 
 
+def test_access_restricted_routes_require_a_session_but_not_an_unrestricted_account() -> None:
+    """The Access restricted screen answers a signed-in user, never an anonymous one.
+
+    Explicit raises keep this check under ``python -O``.
+    """
+    expected = {
+        "/v2/access-restricted": "v2_access_restricted",
+        "/api/v2/access-restriction": "v2_access_restriction",
+        "/access-restricted": "access_restricted",
+    }
+    matches = [route for route in iter_route_functions() if route.path in expected]
+    found = {route.path: route.function_name for route in matches}
+    if len(matches) != len(expected) or found != expected:
+        raise AssertionError(f"Unexpected Access restricted routes: {sorted(found.items())}.")
+    for route in matches:
+        if expected_policy(route.path) != "session_login_401_or_redirect":
+            raise AssertionError(f"{route.function_name} policy changed: {expected_policy(route.path)}.")
+        if "login_required" not in route.decorator_names:
+            raise AssertionError(f"{route.function_name} must require a signed-in session.")
+        if "user_required" in route.decorator_names or "accesstoken_required" in route.decorator_names:
+            raise AssertionError(f"{route.function_name} must stay reachable by a restricted user.")
+    # Every other V2 page still requires an unrestricted account.
+    if expected_policy("/v2/chat") != "session_user_401_or_redirect":
+        raise AssertionError("The V2 app lost its user-session policy.")
+
+
 if __name__ == "__main__":
     tests = [
         test_every_route_has_unauthenticated_access_policy,
@@ -334,6 +367,7 @@ def test_workflow_handoff_routes_require_a_signed_in_user_session() -> None:
         test_workflow_result_context_requires_a_signed_in_user_session,
         test_workflow_run_status_requires_a_signed_in_user_session,
         test_workflow_handoff_routes_require_a_signed_in_user_session,
+        test_access_restricted_routes_require_a_session_but_not_an_unrestricted_account,
     ]
     results = []
     for test in tests:
diff --git a/functional_tests/test_access_restricted_gate.py b/functional_tests/test_access_restricted_gate.py
new file mode 100644
index 000000000..cce1b4373
--- /dev/null
+++ b/functional_tests/test_access_restricted_gate.py
@@ -0,0 +1,351 @@
+#!/usr/bin/env python3
+# test_access_restricted_gate.py
+"""
+Functional test for the Access restricted sign-in screen and the access gate.
+Version: 0.261.297
+Implemented in: 0.261.297
+
+This test ensures that a suspended or blocked user can still sign in but is sent to an
+Access restricted screen by every app surface: API calls get a structured 403 with the
+caller's own restriction, V2 pages redirect to /v2/access-restricted and classic pages to
+/access-restricted. The restricted-page routes are login-only, describe only the caller's
+own restriction, restore an expired suspension, keep the Admin bypass, allow access when
+settings can't be read, are exempt from the Terms of Use gate, and render notice text as
+text. Real modules run in fresh processes with network access blocked, under normal and
+optimized Python.
+"""
+
+import ast
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+APP_DIR = ROOT / "application" / "single_app"
+sys.path.insert(0, str(APP_DIR))
+sys.path.insert(0, str(ROOT / "functional_tests"))
+
+from test_support.versioning import assert_app_version_at_least  # noqa: E402
+
+RESTRICTED_PATHS = ("/access-restricted", "/v2/access-restricted", "/api/v2/access-restriction")
+
+
+def _load_access_restriction_module():
+    import functions_access_restriction
+
+    return functions_access_restriction
+
+
+def test_restriction_is_described_from_the_stored_access_setting():
+    """Suspensions, blocks, expiry and notices are read the way the gate enforces them."""
+    from datetime import datetime, timezone
+
+    module = _load_access_restriction_module()
+    now = datetime(2026, 10, 7, 12, 0, tzinfo=timezone.utc)
+
+    assert module.describe_access_restriction(None, now) == ("allow", None)
+    assert module.describe_access_restriction({"status": "allow"}, now) == ("allow", None)
+    assert module.describe_access_restriction({"status": "unknown"}, now) == ("allow", None)
+    assert module.describe_access_restriction(
+        {"status": "deny", "datetime_to_allow": "2026-10-07T11:59:59Z"}, now,
+    ) == ("expired", None)
+
+    state, suspended = module.describe_access_restriction({
+        "status": "deny",
+        "datetime_to_allow": "2026-10-08T14:00:00.000Z",
+        "notice": {
+            "kind": "suspended",
+            "title": "  Account Suspension Notice  ",
+            "message": "Your access is suspended pending review.",
+            "reference_id": "safety-log-1",
+        },
+    }, now)
+    assert state == "restricted"
+    assert suspended == {
+        "kind": "suspended",
+        "until": "2026-10-08T14:00:00+00:00",
+        "title": "Account Suspension Notice",
+        "message": "Your access is suspended pending review.",
+        "reference_id": "safety-log-1",
+    }
+
+    # A restore time without an offset is read as UTC, as Control Center reads it.
+    _state, naive = module.describe_access_restriction(
+        {"status": "deny", "datetime_to_allow": "2026-10-08T14:00:00"}, now,
+    )
+    assert naive["kind"] == "suspended" and naive["until"] == "2026-10-08T14:00:00+00:00"
+
+    # No notice: generic copy. An unreadable restore time stays in force as a block.
+    for access in (
+        {"status": "deny", "datetime_to_allow": None},
+        {"status": "deny", "datetime_to_allow": "not a date"},
+    ):
+        state, blocked = module.describe_access_restriction(access, now)
+        assert state == "restricted"
+        assert blocked["kind"] == "blocked" and blocked["until"] is None
+        assert blocked["title"] == "Your access has been blocked"
+        assert blocked["reference_id"] is None
+
+    # A notice written for another kind of restriction no longer describes it.
+    _state, mismatched = module.describe_access_restriction({
+        "status": "deny",
+        "datetime_to_allow": None,
+        "notice": {"kind": "suspended", "title": "Old suspension", "message": "Old", "reference_id": "x"},
+    }, now)
+    assert mismatched["title"] == "Your access has been blocked"
+    assert mismatched["reference_id"] is None
+
+    _state, long_notice = module.describe_access_restriction({
+        "status": "deny",
+        "notice": {"kind": "blocked", "title": "t" * 500, "message": "m" * 9000},
+    }, now)
+    assert len(long_notice["title"]) == module.NOTICE_TITLE_MAX_LENGTH
+    assert len(long_notice["message"]) == module.NOTICE_MESSAGE_MAX_LENGTH
+
+
+def test_legacy_reasons_fallback_and_page_paths():
+    """check_user_access_status keeps its reasons; the gate picks the interface's page."""
+    module = _load_access_restriction_module()
+    timed = {"status": "deny", "datetime_to_allow": "2999-01-01T00:00:00Z"}
+    _state, restriction = module.describe_access_restriction(timed)
+    assert module.legacy_access_denied_reason(timed, restriction) == "Access denied until 2999-01-01T00:00:00Z"
+    blocked = {"status": "deny", "datetime_to_allow": None}
+    _state, restriction = module.describe_access_restriction(blocked)
+    assert module.legacy_access_denied_reason(blocked, restriction) == "Access denied by administrator"
+
+    fallback = module.fallback_access_restriction("Access denied until 2999-01-01T00:00:00Z")
+    assert fallback["kind"] == "suspended" and fallback["until"] == "2999-01-01T00:00:00+00:00"
+    assert module.fallback_access_restriction("Access denied by administrator")["kind"] == "blocked"
+    assert module.fallback_access_restriction(None)["kind"] == "blocked"
+
+    assert module.public_access_restriction({**fallback, "user_id": "someone", "notes": "x"}) == fallback
+
+    for path in ("/v2", "/v2/chat", "/api/v2/bootstrap"):
+        assert module.access_restricted_page_path(path) == "/v2/access-restricted", path
+    for path in ("/chats", "/api/safety/logs/my", "/v2x"):
+        assert module.access_restricted_page_path(path) == "/access-restricted", path
+
+    notice = module.build_access_restriction_notice(
+        "suspended", " Title ", "Message", until="2026-10-08T14:00:00Z", reference_id="log-1",
+    )
+    assert notice["kind"] == "suspended" and notice["title"] == "Title"
+    assert notice["until"] == "2026-10-08T14:00:00Z" and notice["reference_id"] == "log-1"
+    assert notice["source"] == "safety_violation" and notice["applied_at"]
+    assert module.build_access_restriction_notice("blocked", "T", "M", until="ignored")["until"] is None
+    with pytest.raises(ValueError):
+        module.build_access_restriction_notice("escalated", "T", "M")
+
+
+def _app_assignment(source, name):
+    for node in ast.parse(source).body:
+        if isinstance(node, ast.Assign) and any(
+            isinstance(target, ast.Name) and target.id == name for target in node.targets
+        ):
+            return ast.literal_eval(node.value)
+    raise AssertionError(f"{name} not found")
+
+
+def test_restricted_paths_skip_the_terms_gate_but_keep_idle_timeout():
+    """A restricted user is never bounced between the two gates, and idle sessions still end."""
+    app_source = (APP_DIR / "app.py").read_text(encoding="utf-8")
+    terms_exempt = _app_assignment(app_source, "TERMS_OF_USE_EXEMPT_PATHS")
+    idle_exempt = _app_assignment((APP_DIR / "config.py").read_text(encoding="utf-8"), "IDLE_TIMEOUT_EXEMPT_PATHS")
+    for path in RESTRICTED_PATHS:
+        assert path in terms_exempt, f"{path} must be exempt from the Terms of Use gate"
+        assert path not in idle_exempt, f"{path} must keep idle-timeout enforcement"
+
+    assert (
+        "register_route_blueprint('access_restriction', register_route_access_restriction, "
+        "login_required_blueprint)"
+    ) in app_source
+
+
+GATE_PROBE = r'''
+import importlib
+import json
+import sys
+import tempfile
+from contextlib import ExitStack
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from unittest.mock import patch
+
+root = Path(sys.argv[1])
+sys.path.insert(0, str(root / "functional_tests"))
+sys.path.insert(0, str(root / "application" / "single_app"))
+from test_support.offline_bootstrap import offline_app_imports
+from test_support.safety_review_harness import build_gate_app, check, sign_in, sign_out
+
+future = (datetime.now(timezone.utc) + timedelta(days=2)).replace(microsecond=0)
+past = datetime.now(timezone.utc) - timedelta(minutes=5)
+
+with offline_app_imports(), ExitStack() as stack, tempfile.TemporaryDirectory() as scratch:
+    importlib.import_module(sys.argv[2])
+    import functions_authentication as auth
+
+    shell = Path(scratch) / "index.html"
+    shell.write_text("<!doctype html><html><head><title>x</title></head><body>V2-SHELL</body></html>", encoding="utf-8")
+    gate = build_gate_app(stack, shell)
+    client = gate.client
+    adapter = gate.app.url_map.bind("localhost")
+
+    # The static page rule wins over the /v2/<path:subpath> catch-all, whatever the order.
+    check(adapter.match("/v2/access-restricted")[0] == "access_restriction.v2_access_restricted", "static rule lost")
+    check(adapter.match("/v2/chat")[0] == "frontend_v2.v2_app_deep_link", "catch-all moved")
+
+    gate.user_docs["user-1"] = {"id": "user-1", "settings": {"access": {
+        "status": "deny", "datetime_to_allow": None,
+        "notice": {"kind": "blocked", "title": "Account Access Blocked <script>alert(1)</script>",
+                   "message": "Blocked for repeated violations.", "reference_id": "safety-log-1",
+                   "source": "safety_violation"},
+    }}}
+    gate.user_docs["user-2"] = {"id": "user-2", "settings": {"access": {
+        "status": "deny", "datetime_to_allow": None,
+        "notice": {"kind": "blocked", "title": "Another user's notice", "message": "Private to user 2.",
+                   "reference_id": "safety-log-2"},
+    }}}
+    sign_in(client, "user-1")
+
+    response = client.get("/api/v2/bootstrap")
+    body = response.get_json()
+    check(response.status_code == 403, f"API call was not refused: {response.status_code}")
+    check(body["error"] == "access_restricted", str(body))
+    check(body["message"] == "Your access to this application has been blocked by an administrator.", str(body))
+    check(body["restricted_url"] == "/v2/access-restricted", str(body))
+    check(set(body["restriction"]) == {"kind", "until", "title", "message", "reference_id"}, str(body))
+    check(body["restriction"]["reference_id"] == "safety-log-1", str(body))
+    check("user 2" not in json.dumps(body), "Another user's notice leaked")
+
+    response = client.get("/api/notifications/count")
+    check(response.status_code == 403 and response.get_json()["restricted_url"] == "/access-restricted", "classic API")
+
+    response = client.get("/v2/chat", headers={"Accept": "text/html"})
+    check(response.status_code == 302, f"V2 page not redirected: {response.status_code}")
+    check(response.headers["Location"].endswith("/v2/access-restricted"), response.headers["Location"])
+    response = client.get("/chats", headers={"Accept": "text/html"})
+    check(response.status_code == 302 and response.headers["Location"].endswith("/access-restricted"), "classic page")
+
+    response = client.get("/v2/access-restricted", headers={"Accept": "text/html"})
+    check(response.status_code == 200 and b"V2-SHELL" in response.data, "Restricted user cannot load the V2 page")
+
+    for query in ("", "?user_id=user-2"):
+        response = client.get(f"/api/v2/access-restriction{query}")
+        body = response.get_json()
+        check(response.status_code == 200, f"restriction route failed: {response.status_code}")
+        check(response.headers.get("Cache-Control") == "no-store", "restriction route is cacheable")
+        check(body["restricted"] is True and body["restriction"]["reference_id"] == "safety-log-1", str(body))
+        check("user 2" not in json.dumps(body) and "safety-log-2" not in json.dumps(body), "Cross-user read")
+        check(set(body["branding"]) >= {"app_title", "classification_banner"}, str(body))
+
+    response = client.get("/access-restricted", headers={"Accept": "text/html"})
+    html = response.get_data(as_text=True)
+    check(response.status_code == 200 and response.headers.get("Cache-Control") == "no-store", "classic page")
+    check("&lt;script&gt;alert(1)&lt;/script&gt;" in html and "<script>alert(1)" not in html, "Notice not escaped")
+    check("Blocked for repeated violations." in html and "safety-log-1" in html, "Notice missing")
+    check('href="/logout"' in html and "Sign out" in html, "Sign out link missing")
+    check("No automatic restore date" in html, "Block not described")
+
+    # A suspension shows its restore time; the page renders UTC and the script localizes it.
+    gate.user_docs["user-1"]["settings"]["access"] = {
+        "status": "deny", "datetime_to_allow": future.isoformat().replace("+00:00", "Z"),
+        "notice": {"kind": "suspended", "title": "Account Suspension Notice", "message": "Suspended.",
+                   "reference_id": "safety-log-9"},
+    }
+    body = client.get("/api/v2/access-restriction").get_json()
+    check(body["restriction"]["kind"] == "suspended", str(body))
+    check(body["restriction"]["until"] == future.isoformat(), str(body))
+    body = client.get("/api/v2/bootstrap").get_json()
+    check(body["message"] == "Your access to this application is temporarily suspended.", str(body))
+    html = client.get("/access-restricted").get_data(as_text=True)
+    check(f'datetime="{future.isoformat()}"' in html and future.strftime("%Y-%m-%d %H:%M UTC") in html, "restore time")
+    check("js/access-restricted.js" in html, "local time script missing")
+
+    allowed, reason = auth.check_user_access_status("user-1")
+    check(not allowed and reason == f"Access denied until {future.isoformat().replace('+00:00', 'Z')}", reason)
+    gate.user_docs["user-2"]["settings"]["access"]["datetime_to_allow"] = None
+    check(auth.check_user_access_status("user-2") == (False, "Access denied by administrator"), "legacy block reason")
+
+    # An expired suspension is restored on read, which clears its notice, and access returns.
+    gate.user_docs["user-1"]["settings"]["access"] = {
+        "status": "deny", "datetime_to_allow": past.isoformat(),
+        "notice": {"kind": "suspended", "title": "Old", "message": "Old"},
+    }
+    body = client.get("/api/v2/access-restriction").get_json()
+    check(body == {"restricted": False, "branding": body["branding"]}, str(body))
+    check(gate.user_docs["user-1"]["settings"]["access"] == {"status": "allow", "datetime_to_allow": None}, "not restored")
+    check(client.get("/api/v2/bootstrap").status_code == 200, "Restored user still refused")
+    html = client.get("/access-restricted").get_data(as_text=True)
+    check("Your access is available" in html and 'href="/"' in html, "No continue link")
+
+    # Admins are never restricted, whatever their settings say.
+    gate.user_docs["admin-1"] = {"id": "admin-1", "settings": {"access": {"status": "deny", "datetime_to_allow": None}}}
+    sign_in(client, "admin-1", roles=("Admin",))
+    check(client.get("/api/v2/bootstrap").status_code == 200, "Admin bypass lost")
+    check(client.get("/api/v2/access-restriction").get_json()["restricted"] is False, "Admin reported restricted")
+
+    # Unreadable settings allow access, as the access check always has.
+    gate.user_docs["user-3"] = RuntimeError("settings store unavailable")
+    sign_in(client, "user-3")
+    check(client.get("/api/v2/bootstrap").status_code == 200, "A storage fault locked the user out")
+    check(client.get("/api/v2/access-restriction").get_json()["restricted"] is False, "fault reported restricted")
+
+    # When the check refuses but the details can't be read again, the reason still says
+    # whether access returns on its own.
+    with patch.object(auth, "check_user_access_status", lambda user_id: (False, "Access denied until 2999-01-01T00:00:00Z")):
+        body = client.get("/api/v2/bootstrap").get_json()
+        check(body["restriction"]["kind"] == "suspended", str(body))
+        check(body["restriction"]["until"] == "2999-01-01T00:00:00+00:00", str(body))
+
+    # Login-only: no session means sign in, never the user's restriction.
+    sign_out(client)
+    response = client.get("/api/v2/access-restriction")
+    check(response.status_code == 401, f"anonymous read allowed: {response.status_code}")
+    response = client.get("/v2/access-restricted", headers={"Accept": "text/html"})
+    check(response.status_code == 302 and response.headers["Location"].endswith("/login"), "anonymous page")
+
+print("PASS: access gate and Access restricted screen")
+'''
+
+
+@pytest.mark.parametrize("first_import", ["functions_authentication", "route_access_restriction"])
+@pytest.mark.parametrize("optimized", [False, True])
+def test_real_access_gate_and_restricted_routes(first_import, optimized):
+    command = [sys.executable, "-B"]
+    if optimized:
+        command.append("-O")
+    result = subprocess.run(
+        command + ["-c", GATE_PROBE, str(ROOT), first_import],
+        capture_output=True,
+        text=True,
+        timeout=180,
+        check=False,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert "PASS: access gate and Access restricted screen" in result.stdout
+
+
+def test_v2_access_restricted_page_is_wired():
+    """The SPA renders the page outside the bootstrap gate and follows the server's gate."""
+    v2 = ROOT / "application" / "v2_ui" / "src"
+    app_tsx = (v2 / "App.tsx").read_text(encoding="utf-8")
+    assert "location.pathname === '/access-restricted'" in app_tsx
+    assert "return <AccessRestrictedPage />;" in app_tsx
+    api_client = (v2 / "lib" / "apiClient.ts").read_text(encoding="utf-8")
+    assert "export function isAccessRestricted(" in api_client
+    assert "'access_restricted'" in api_client
+    assert "export const V2_ACCESS_RESTRICTED_PATH = '/v2/access-restricted';" in api_client
+    bootstrap_store = (v2 / "stores" / "bootstrapStore.ts").read_text(encoding="utf-8")
+    assert "isAccessRestricted(error.status, error.payload)" in bootstrap_store
+    page = (v2 / "pages" / "AccessRestrictedPage.tsx").read_text(encoding="utf-8")
+    assert "dangerouslySetInnerHTML" not in page
+    assert "fetchAccessRestriction" in page and "apiUrl('/logout')" in page
+
+
+def test_version():
+    assert_app_version_at_least("0.261.297")
+
+
+if __name__ == "__main__":
+    sys.exit(pytest.main([__file__, "-q"]))
diff --git a/functional_tests/test_safety_escalate_removal.py b/functional_tests/test_safety_escalate_removal.py
new file mode 100644
index 000000000..d5f813968
--- /dev/null
+++ b/functional_tests/test_safety_escalate_removal.py
@@ -0,0 +1,146 @@
+#!/usr/bin/env python3
+# test_safety_escalate_removal.py
+"""
+Functional test for removing Escalate as a safety action.
+Version: 0.261.297
+Implemented in: 0.261.297
+
+This test ensures that Escalate can no longer be chosen in either interface or set through
+the API, while records that already carry it stay editable, are labelled
+"Escalated (legacy)", and are still counted in the escalate_count statistic. Real modules run
+in fresh processes with network access blocked, under normal and optimized Python.
+"""
+
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+APP_DIR = ROOT / "application" / "single_app"
+V2_SRC = ROOT / "application" / "v2_ui" / "src"
+sys.path.insert(0, str(ROOT / "functional_tests"))
+
+from test_support.versioning import assert_app_version_at_least  # noqa: E402
+
+LEGACY_LABEL = "Escalated (legacy)"
+
+
+ESCALATE_PROBE = r'''
+import importlib
+import sys
+from contextlib import ExitStack
+from pathlib import Path
+
+root = Path(sys.argv[1])
+sys.path.insert(0, str(root / "functional_tests"))
+sys.path.insert(0, str(root / "application" / "single_app"))
+from test_support.offline_bootstrap import offline_app_imports
+from test_support.safety_review_harness import build_safety_app, check, sign_in
+
+with offline_app_imports(), ExitStack() as stack:
+    importlib.import_module(sys.argv[2])
+    h = build_safety_app(stack)
+    client, container = h.client, h.container
+    base = {"user_id": "user-1", "status": "New", "created_at": "2026-10-01T00:00:00", "message": "Flagged"}
+    container.seed({**base, "id": "log-none", "action": "None"})
+    container.seed({**base, "id": "log-escalated", "action": "Escalate"})
+    sign_in(client, "reviewer-1", roles=("Admin",))
+
+    response = client.patch("/api/safety/logs/log-none", json={"status": "In-Review", "action": "Escalate"})
+    body = response.get_json()
+    check(response.status_code == 400 and "Escalate is no longer available" in body["error"], str(body))
+    check(container.items["log-none"]["action"] == "None" and container.items["log-none"]["status"] == "New",
+          "A refused Escalate still changed the record")
+
+    response = client.patch("/api/safety/logs/log-escalated", json={
+        "status": "Resolved", "action": "Escalate", "notes": "Closed out.",
+    })
+    check(response.status_code == 200, f"A legacy record could not be edited: {response.get_json()}")
+    stored = container.items["log-escalated"]
+    check(stored["action"] == "Escalate" and stored["status"] == "Resolved" and stored["notes"] == "Closed out.", str(stored))
+    check(h.notifications == [] and h.approvals == [], "Escalate did something")
+
+    stats = client.get("/api/safety/logs/stats").get_json()
+    check(stats["escalate_count"] == 1 and stats["block_user_count"] == 0, str(stats))
+
+    # Moving a legacy record off Escalate is allowed; it can't be set back afterwards.
+    check(client.patch("/api/safety/logs/log-escalated", json={"action": "None"}).status_code == 200, "move off")
+    response = client.patch("/api/safety/logs/log-escalated", json={"action": "Escalate"})
+    check(response.status_code == 400, "Escalate could be set again")
+    check(client.get("/api/safety/logs/stats").get_json()["escalate_count"] == 0, "stale escalate_count")
+
+    response = client.patch("/api/safety/logs/log-none", json={"action": "Bogus"})
+    check(response.status_code == 400 and response.get_json()["error"] == "Invalid safety action", "unknown action")
+
+print("PASS: Escalate removed, legacy records kept")
+'''
+
+
+@pytest.mark.parametrize("optimized", [False, True])
+def test_real_escalate_rules(optimized):
+    command = [sys.executable, "-B"]
+    if optimized:
+        command.append("-O")
+    result = subprocess.run(
+        command + ["-c", ESCALATE_PROBE, str(ROOT), "route_backend_safety"],
+        capture_output=True,
+        text=True,
+        timeout=180,
+        check=False,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert "PASS: Escalate removed, legacy records kept" in result.stdout
+
+
+def _actions_constant(source):
+    match = re.search(r"const ACTIONS = \[([^\]]*)\];", source)
+    assert match, "ACTIONS constant not found"
+    return match.group(1)
+
+
+def test_v2_pages_no_longer_offer_escalate():
+    admin_page = (V2_SRC / "pages" / "AdminSafetyViolationsPage.tsx").read_text(encoding="utf-8")
+    violations = (V2_SRC / "components" / "settings" / "ViolationsTab.tsx").read_text(encoding="utf-8")
+    for source in (admin_page, violations):
+        assert "Escalate" not in _actions_constant(source)
+        assert LEGACY_LABEL in source
+    # Only a record that already carries Escalate offers it again, as its legacy label.
+    assert "selected.action === LEGACY_ESCALATE_ACTION ? [...ACTIONS, LEGACY_ESCALATE_ACTION] : ACTIONS" in admin_page
+    assert "Escalated or blocked" not in admin_page
+    assert "label={(stats?.escalate_count ?? 0) > 0" in admin_page
+
+
+def test_classic_pages_no_longer_offer_escalate():
+    for template in ("admin_safety_violations.html", "my_safety_violations.html", "profile.html"):
+        source = (APP_DIR / "templates" / template).read_text(encoding="utf-8")
+        assert '<option value="Escalate">' not in source, template
+    admin_template = (APP_DIR / "templates" / "admin_safety_violations.html").read_text(encoding="utf-8")
+    assert 'id="safetyBlockedCount"' in admin_template and 'id="safetyStatsLegacyEscalateRow"' in admin_template
+    assert 'id="safetyEscalatedCount"' not in admin_template
+
+    admin_script = (APP_DIR / "static" / "js" / "admin" / "admin-safety-violations.js").read_text(encoding="utf-8")
+    assert "Escalate: 'Escalated (legacy)'" in admin_script
+    assert "function syncLegacyEscalateOption(selectElement, logItem)" in admin_script
+    for path in (
+        APP_DIR / "templates" / "my_safety_violations.html",
+        APP_DIR / "static" / "js" / "profile" / "profile-tabs.js",
+    ):
+        assert LEGACY_LABEL in path.read_text(encoding="utf-8"), path.name
+
+
+def test_backend_keeps_the_legacy_action_and_statistic():
+    source = (APP_DIR / "route_backend_safety.py").read_text(encoding="utf-8")
+    assert "SELECTABLE_SAFETY_ACTIONS = {'None', 'WarnUser', 'SuspendUser', 'BlockUser'}" in source
+    assert "ALLOWED_SAFETY_ACTIONS = SELECTABLE_SAFETY_ACTIONS | {SAFETY_ACTION_ESCALATE_LEGACY}" in source
+    assert '"escalate_count": 0,' in source
+
+
+def test_version():
+    assert_app_version_at_least("0.261.297")
+
+
+if __name__ == "__main__":
+    sys.exit(pytest.main([__file__, "-q"]))
diff --git a/functional_tests/test_safety_violation_remediation_approvals.py b/functional_tests/test_safety_violation_remediation_approvals.py
index f789a004a..7545c6529 100644
--- a/functional_tests/test_safety_violation_remediation_approvals.py
+++ b/functional_tests/test_safety_violation_remediation_approvals.py
@@ -2,26 +2,28 @@
 # test_safety_violation_remediation_approvals.py
 """
 Functional test for safety violation remediation approvals.
-Version: 0.241.030
+Version: 0.261.297
 Implemented in: 0.241.030
-
-This test ensures warn, suspend, and block actions collect user-facing
-remediation details, follow the shared approval workflow, and apply the same
-access restriction payloads used by Control Center restrictions.
+Warnings sent without approval, restriction notice persisted: 0.261.297
+
+This test ensures warn, suspend, and block actions collect user-facing remediation
+details; that a warning is sent as soon as a reviewer saves it, while a suspension or block
+still needs a second eligible reviewer, and a requester can never approve their own
+request; and that suspend and block write the same access restriction payload Control
+Center uses, with the notice the user was sent. Real modules run in fresh processes with
+network access blocked, under normal and optimized Python.
 """
 
+import subprocess
 import sys
 from pathlib import Path
-from unittest.mock import patch
+
+import pytest
 
 
 ROOT_DIR = Path(__file__).resolve().parent.parent
 APP_DIR = ROOT_DIR / 'application' / 'single_app'
 
-if str(APP_DIR) not in sys.path:
-    sys.path.insert(0, str(APP_DIR))
-
-
 ADMIN_SAFETY_TEMPLATE = APP_DIR / 'templates' / 'admin_safety_violations.html'
 ADMIN_SAFETY_JS = APP_DIR / 'static' / 'js' / 'admin' / 'admin-safety-violations.js'
 APPROVALS_TEMPLATE = APP_DIR / 'templates' / 'approvals.html'
@@ -53,6 +55,7 @@ def test_safety_remediation_ui_and_route_markers():
             'id="safetyRemediationFields"',
             'id="editNotificationMessage"',
             'id="editSuspendUntil"',
+            'id="safetyWarningAcknowledgment"',
         ],
         'admin safety template',
     )
@@ -64,9 +67,12 @@ def test_safety_remediation_ui_and_route_markers():
             'datetime_to_allow',
             'function updateRemediationFields(logItem, forcePopulate)',
             'showPageStatus(result.message ||',
+            'as soon as you save, without a second reviewer',
+            'another eligible reviewer approves it',
         ],
         'admin safety script',
     )
+    assert 'If this reviewer also has the required Control Center approval role' not in admin_safety_js
     assert_markers(
         approvals_template,
         [
@@ -86,6 +92,8 @@ def test_safety_remediation_ui_and_route_markers():
             "item['action_notification_title'] = notification_title or None",
             "item['action_notification_message'] = notification_message or None",
             "item['action_datetime_to_allow'] = normalized_datetime_to_allow",
+            'SAFETY_APPROVAL_REQUIRED_ACTIONS = {',
+            'return _send_safety_warning_now(item, actor, notification_title, notification_message)',
         ],
         'backend safety route',
     )
@@ -93,120 +101,152 @@ def test_safety_remediation_ui_and_route_markers():
     print('✅ Safety remediation UI and approval markers are present')
 
 
-def test_safety_remediation_execution_and_approval_roles():
-    """Safety remediation roles and execution payloads should match the new workflow."""
-    print('🔍 Testing safety remediation execution and approval role routing...')
+REMEDIATION_PROBE = r'''
+import importlib
+import sys
+from contextlib import ExitStack
+from pathlib import Path
+from unittest.mock import patch
+
+root = Path(sys.argv[1])
+sys.path.insert(0, str(root / "functional_tests"))
+sys.path.insert(0, str(root / "application" / "single_app"))
+from test_support.offline_bootstrap import offline_app_imports
+from test_support.safety_review_harness import build_safety_app, check, sign_in
 
+with offline_app_imports(), ExitStack() as stack:
+    importlib.import_module(sys.argv[2])
     import functions_approvals
-    import functions_safety_remediation
-
-    with patch.object(functions_approvals, 'get_settings', return_value={'require_member_of_control_center_admin': True}):
-        assert functions_approvals.get_approval_roles_for_request_type(functions_approvals.TYPE_WARN_USER) == ['ControlCenterAdmin']
-        assert functions_approvals.get_approval_roles_for_request_type(functions_approvals.TYPE_SUSPEND_USER) == ['ControlCenterAdmin']
-        assert functions_approvals.get_approval_roles_for_request_type(functions_approvals.TYPE_BLOCK_USER) == ['ControlCenterAdmin']
-
-    with patch.object(functions_approvals, 'get_settings', return_value={'require_member_of_control_center_admin': False}):
-        assert functions_approvals.get_approval_roles_for_request_type(functions_approvals.TYPE_WARN_USER) == ['Admin']
-
-    approval_doc = {
-        'request_type': functions_approvals.TYPE_SUSPEND_USER,
-        'requester_id': 'safety-admin-1',
-        'metadata': {},
-    }
-    with patch.object(functions_approvals, 'get_approval_roles_for_request_type', return_value=['ControlCenterAdmin']):
-        assert not functions_approvals._can_user_approve(approval_doc, 'safety-admin-1', ['Admin'])
-        assert not functions_approvals._can_user_approve(approval_doc, 'safety-admin-1', ['ControlCenterAdmin'])
-        assert functions_approvals._can_user_deny(approval_doc, 'safety-admin-1', ['ControlCenterAdmin'])
-        assert functions_approvals._can_user_approve(approval_doc, 'control-admin-2', ['ControlCenterAdmin'])
-
-    created_notifications = []
-    access_updates = []
-
-    def fake_create_notification(**kwargs):
-        notification = dict(kwargs)
-        notification['id'] = f"notification-{len(created_notifications) + 1}"
-        created_notifications.append(notification)
-        return notification
-
-    def fake_update_user_settings(user_id, updates, allow_cross_user=False):
-        access_updates.append({
-            'user_id': user_id,
-            'updates': updates,
-            'allow_cross_user': allow_cross_user,
-        })
-        return {'id': user_id, 'settings': updates}
-
-    actor = {
-        'id': 'safety-admin-1',
-        'email': 'safety.admin@example.com',
-        'display_name': 'Safety Admin',
-    }
-    safety_log = {
-        'id': 'safety-log-1',
-        'user_id': 'user-1',
-        'triggered_categories': [
-            {'category': 'Violence', 'severity': 4},
-            {'category': 'Hate', 'severity': 2},
-        ],
-        'notes': 'Repeat policy violation.',
-    }
-
-    with patch.object(functions_safety_remediation, 'create_notification', side_effect=fake_create_notification), \
-         patch.object(functions_safety_remediation, 'update_user_settings', side_effect=fake_update_user_settings), \
-         patch.object(functions_safety_remediation, 'get_user_settings', return_value={
-             'email': 'user@example.com',
-             'display_name': 'Target User',
-         }), \
-         patch.object(functions_safety_remediation, 'log_event', lambda *args, **kwargs: None), \
-         patch.object(functions_safety_remediation, 'debug_print', lambda *args, **kwargs: None):
-        warn_result = functions_safety_remediation.execute_safety_violation_action(
-            action=functions_safety_remediation.SAFETY_REMEDIATION_WARNING,
-            safety_log=safety_log,
-            notification_title='',
-            notification_message='',
-            datetime_to_allow=None,
-            actor=actor,
-        )
-
-        assert warn_result['success'] is True
-        assert warn_result['message'] == 'Warning notification sent to the user.'
-        assert created_notifications[-1]['notification_type'] == 'safety_violation_warning'
-        assert access_updates == []
-
-        suspend_result = functions_safety_remediation.execute_safety_violation_action(
-            action=functions_safety_remediation.SAFETY_REMEDIATION_SUSPEND,
-            safety_log=safety_log,
-            notification_title='Temporary suspension',
-            notification_message='Your access is suspended pending review.',
-            datetime_to_allow='2025-01-15T12:00:00Z',
-            actor=actor,
-        )
-
-        assert suspend_result['success'] is True
-        assert suspend_result['message'] == 'User access suspended until 2025-01-15T12:00:00Z.'
-        assert access_updates[-1]['user_id'] == 'user-1'
-        assert access_updates[-1]['updates']['access']['status'] == 'deny'
-        assert access_updates[-1]['updates']['access']['datetime_to_allow'] == '2025-01-15T12:00:00Z'
-        assert access_updates[-1]['allow_cross_user'] is True
-        assert created_notifications[-1]['notification_type'] == 'safety_violation_suspension'
-
-        block_result = functions_safety_remediation.execute_safety_violation_action(
-            action=functions_safety_remediation.SAFETY_REMEDIATION_BLOCK,
-            safety_log=safety_log,
-            notification_title='Access blocked',
-            notification_message='Your access has been blocked.',
-            datetime_to_allow=None,
-            actor=actor,
-        )
-
-        assert block_result['success'] is True
-        assert block_result['message'] == 'User access blocked indefinitely.'
-        assert access_updates[-1]['updates']['access']['status'] == 'deny'
-        assert access_updates[-1]['updates']['access']['datetime_to_allow'] is None
-        assert created_notifications[-1]['notification_type'] == 'safety_violation_block'
-
-    print('✅ Safety remediation execution and approval roles match the workflow')
+    import functions_safety_remediation as remediation
+    import route_backend_safety as safety_routes
+
+    with patch.object(functions_approvals, "get_settings", return_value={"require_member_of_control_center_admin": True}):
+        for request_type in (functions_approvals.TYPE_WARN_USER, functions_approvals.TYPE_SUSPEND_USER,
+                             functions_approvals.TYPE_BLOCK_USER):
+            check(functions_approvals.get_approval_roles_for_request_type(request_type) == ["ControlCenterAdmin"],
+                  request_type)
+    with patch.object(functions_approvals, "get_settings", return_value={"require_member_of_control_center_admin": False}):
+        check(functions_approvals.get_approval_roles_for_request_type(functions_approvals.TYPE_WARN_USER) == ["Admin"],
+              "warn roles")
+
+    approval_doc = {"request_type": functions_approvals.TYPE_SUSPEND_USER, "requester_id": "safety-admin-1", "metadata": {}}
+    with patch.object(functions_approvals, "get_approval_roles_for_request_type", return_value=["ControlCenterAdmin"]):
+        check(not functions_approvals._can_user_approve(approval_doc, "safety-admin-1", ["Admin"]), "requester approve")
+        check(not functions_approvals._can_user_approve(approval_doc, "safety-admin-1", ["ControlCenterAdmin"]), "self")
+        check(functions_approvals._can_user_deny(approval_doc, "safety-admin-1", ["ControlCenterAdmin"]), "deny")
+        check(functions_approvals._can_user_approve(approval_doc, "control-admin-2", ["ControlCenterAdmin"]), "other")
+
+    # The requester can never approve their own request, whatever roles they hold.
+    pending = {"id": "approval-1", "group_id": "user-1", "status": "pending", "requester_id": "safety-admin-1",
+               "request_type": functions_approvals.TYPE_BLOCK_USER}
+    try:
+        functions_approvals.approve_request("approval-1", "user-1", "safety-admin-1", "a@contoso.test", "A",
+                                            approval=dict(pending))
+    except PermissionError:
+        pass
+    else:
+        raise AssertionError("A requester approved their own request")
+    for request_type in safety_routes.SAFETY_ACTION_REQUEST_TYPE_MAP.values():
+        check(safety_routes._actor_can_self_approve_safety_request(request_type, ["Admin", "ControlCenterAdmin"]) is False,
+              request_type)
+
+    # Suspend and block still wait for a second reviewer; nothing is applied on save.
+    h = build_safety_app(stack)
+    client, container = h.client, h.container
+    base = {"user_id": "user-1", "status": "New", "action": "None", "created_at": "2026-10-01T00:00:00",
+            "triggered_categories": [{"category": "Violence", "severity": 4}]}
+    container.seed({**base, "id": "log-suspend"})
+    container.seed({**base, "id": "log-block"})
+    sign_in(client, "safety-admin-1", roles=("Admin",))
+    for log_id, payload, request_type in (
+        ("log-suspend", {"action": "SuspendUser", "datetime_to_allow": "2026-10-15T12:00:00Z",
+                         "notification_message": "Suspended pending review."}, "suspend_user"),
+        ("log-block", {"action": "BlockUser", "notification_message": "Blocked."}, "block_user"),
+    ):
+        response = client.patch(f"/api/safety/logs/{log_id}", json={"status": "In-Review", **payload})
+        body = response.get_json()
+        check(response.status_code == 200 and body["approval_required"] is True, str(body))
+        approval = h.approvals[-1]
+        check(approval["request_type"] == request_type and approval["requester_id"] == "safety-admin-1", str(approval))
+        check(approval["group_id"] == "user-1" and approval["metadata"]["safety_log_id"] == log_id, str(approval))
+        check(container.items[log_id]["action_request_status"] == "pending", log_id)
+        response = client.patch(f"/api/safety/logs/{log_id}", json={"status": "Resolved"})
+        check(response.status_code == 409, "A pending record could be changed")
+    check(h.access_writes == [] and h.notifications == [], "A restriction applied before approval")
+
+    response = client.patch("/api/safety/logs/log-suspend-missing", json={"status": "Resolved"})
+    check(response.status_code == 404 and response.get_json() == {"error": "Safety violation not found"}, "missing")
+
+    # Execution, once approved: the notification, plus the access payload Control Center
+    # uses, with the notice the user was sent.
+    h.notifications.clear()
+    h.access_writes.clear()
+    actor = {"id": "control-admin-2", "email": "approver@contoso.test"}
+    safety_log = {"id": "safety-log-1", "user_id": "user-1", "notes": "Repeat policy violation.",
+                  "triggered_categories": [{"category": "Violence", "severity": 4}, {"category": "Hate", "severity": 2}]}
+
+    warn = remediation.execute_safety_violation_action(
+        action="WarnUser", safety_log=safety_log, notification_title="", notification_message="",
+        datetime_to_allow=None, actor=actor,
+    )
+    check(warn["success"] is True and warn["message"] == "Warning notification sent to the user.", str(warn))
+    check(h.notifications[-1]["notification_type"] == "safety_violation_warning", "warning type")
+    check(warn["notification_title"] == "Safety Violation Warning", str(warn))
+    check(warn["notification_message"] == h.notifications[-1]["message"], "the sent message is not returned")
+    check(h.access_writes == [], "A warning restricted access")
+
+    suspend = remediation.execute_safety_violation_action(
+        action="SuspendUser", safety_log=safety_log, notification_title="Temporary suspension",
+        notification_message="Your access is suspended pending review.", datetime_to_allow="2025-01-15T12:00:00Z",
+        actor=actor,
+    )
+    check(suspend["message"] == "User access suspended until 2025-01-15T12:00:00Z.", str(suspend))
+    write = h.access_writes[-1]
+    access = write["updates"]["access"]
+    check(write["user_id"] == "user-1" and write["allow_cross_user"] is True, str(write))
+    check(access["status"] == "deny" and access["datetime_to_allow"] == "2025-01-15T12:00:00Z", str(access))
+    notice = access["notice"]
+    check(notice["kind"] == "suspended" and notice["until"] == "2025-01-15T12:00:00Z", str(notice))
+    check(notice["title"] == "Temporary suspension" and notice["message"] == "Your access is suspended pending review.",
+          str(notice))
+    check(notice["source"] == "safety_violation" and notice["reference_id"] == "safety-log-1" and notice["applied_at"],
+          str(notice))
+    check(h.notifications[-1]["notification_type"] == "safety_violation_suspension", "suspension type")
+    check(h.notifications[-1]["title"] == notice["title"], "notice differs from the notification")
+
+    block = remediation.execute_safety_violation_action(
+        action="BlockUser", safety_log=safety_log, notification_title="", notification_message="",
+        datetime_to_allow=None, actor=actor,
+    )
+    check(block["message"] == "User access blocked indefinitely.", str(block))
+    access = h.access_writes[-1]["updates"]["access"]
+    check(access["status"] == "deny" and access["datetime_to_allow"] is None, str(access))
+    check(access["notice"]["kind"] == "blocked" and access["notice"]["until"] is None, str(access))
+    check(access["notice"]["title"] == "Account Access Blocked", str(access))
+    check(access["notice"]["message"] == h.notifications[-1]["message"], "the default notice differs from the sent one")
+    check("Admin notes: Repeat policy violation." in access["notice"]["message"], "default message changed")
+    check(h.notifications[-1]["notification_type"] == "safety_violation_block", "block type")
+
+print("PASS: safety remediation approvals and execution")
+'''
+
+
+@pytest.mark.parametrize('optimized', [False, True])
+def test_safety_remediation_execution_and_approval_roles(optimized):
+    """Safety remediation roles, the two-person rule and execution payloads match the workflow."""
+    command = [sys.executable, '-B']
+    if optimized:
+        command.append('-O')
+    result = subprocess.run(
+        command + ['-c', REMEDIATION_PROBE, str(ROOT_DIR), 'route_backend_safety'],
+        capture_output=True,
+        text=True,
+        timeout=180,
+        check=False,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert 'PASS: safety remediation approvals and execution' in result.stdout
 
 
 if __name__ == '__main__':
-    raise SystemExit(0)
\ No newline at end of file
+    sys.exit(pytest.main([__file__, '-q']))
diff --git a/functional_tests/test_safety_warning_acknowledgment.py b/functional_tests/test_safety_warning_acknowledgment.py
new file mode 100644
index 000000000..7edd1315f
--- /dev/null
+++ b/functional_tests/test_safety_warning_acknowledgment.py
@@ -0,0 +1,358 @@
+#!/usr/bin/env python3
+# test_safety_warning_acknowledgment.py
+"""
+Functional test for immediate, must-acknowledge safety warnings.
+Version: 0.261.297
+Implemented in: 0.261.297
+
+This test ensures that a safety reviewer's warning is sent as the review is saved, without
+an approval request, and is sent once per violation; that the warned user can list and
+acknowledge only their own warnings, with only what they were sent; that acknowledging is
+idempotent, marks the delivering notification read and never overwrites a concurrent
+reviewer save; that an acknowledgment of a warning since withdrawn or replaced by a newer
+warning on the same violation records nothing; that warnings sent before acknowledgment was
+tracked never ask for it; that the user-facing routes are not gated on the content checks
+report; and that a failed send is recorded and can be retried. Real modules run in fresh
+processes with network access blocked, under normal and optimized Python.
+"""
+
+import ast
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+APP_DIR = ROOT / "application" / "single_app"
+sys.path.insert(0, str(ROOT / "functional_tests"))
+
+from test_support.versioning import assert_app_version_at_least  # noqa: E402
+
+
+WARNING_PROBE = r'''
+import importlib
+import json
+import sys
+from contextlib import ExitStack
+from pathlib import Path
+
+root = Path(sys.argv[1])
+sys.path.insert(0, str(root / "functional_tests"))
+sys.path.insert(0, str(root / "application" / "single_app"))
+from test_support.offline_bootstrap import offline_app_imports
+from test_support.safety_review_harness import build_safety_app, check, sign_in, sign_out
+
+USER_FIELDS = {"id", "violation_id", "title", "message", "issued_at", "acknowledged_at", "triggered_categories"}
+
+with offline_app_imports(), ExitStack() as stack:
+    importlib.import_module(sys.argv[2])
+    import functions_safety_remediation as remediation
+
+    h = build_safety_app(stack)
+    client, container = h.client, h.container
+    base = {"status": "New", "action": "None", "created_at": "2026-10-01T00:00:00", "message": "Flagged text",
+            "triggered_categories": [{"category": "Hate", "severity": 4}, {"category": "Violence", "severity": 2}]}
+    container.seed({**base, "id": "log-warn", "user_id": "user-1", "notes": "Reviewer-only notes"})
+    container.seed({**base, "id": "log-legacy", "user_id": "user-1", "action": "WarnUser",
+                    "action_request_status": "executed", "status": "Resolved"})
+    container.seed({**base, "id": "log-other", "user_id": "user-2"})
+    container.seed({**base, "id": "log-ai", "user_id": "user-1", "content_origin": "assistant"})
+
+    # A reviewer's warning is sent as the review is saved: no approval, no restriction.
+    sign_in(client, "reviewer-1", roles=("Admin",))
+    response = client.patch("/api/safety/logs/log-warn", json={
+        "status": "In-Review", "action": "WarnUser", "notes": "Reviewer-only notes", "notification_message": "",
+    })
+    body = response.get_json()
+    check(response.status_code == 200, f"warning save failed: {response.status_code} {body}")
+    check(body["approval_required"] is False and body["message"] == "Warning sent to the user.", str(body))
+    check(body["audit_logged"] is True and h.approvals == [], "A warning created an approval request")
+    check(h.access_writes == [], "A warning restricted access")
+    check(len(h.notifications) == 1, f"expected one notification, got {len(h.notifications)}")
+    sent = h.notifications[0]
+    check(sent["notification_type"] == "safety_violation_warning" and sent["user_id"] == "user-1", str(sent))
+    stored = container.items["log-warn"]
+    check(stored["action_request_status"] == "executed" and stored["action_request_id"] is None, str(stored))
+    check(stored["warning_requires_acknowledgment"] is True and stored["warning_acknowledged_at"] is None, str(stored))
+    check(stored["warning_notification_id"] == sent["id"], str(stored))
+    check(stored["warning_title"] == sent["title"] and stored["warning_message"] == sent["message"], str(stored))
+    check(stored["warning_issued_at"] == stored["action_executed_at"], str(stored))
+    audit = h.audits[-1]
+    check(audit["action"] == "safety_violation_warning_sent" and audit["admin_user_id"] == "reviewer-1", str(audit))
+    check(audit["additional_context"]["record_id"] == "log-warn", str(audit))
+
+    # Saving the warned record again, here to resolve it, does not warn twice.
+    response = client.patch("/api/safety/logs/log-warn", json={
+        "status": "Resolved", "action": "WarnUser", "notes": "Resolved after the warning.",
+    })
+    body = response.get_json()
+    check(response.status_code == 200 and body.get("warning_already_sent") is True, str(body))
+    check(len(h.notifications) == 1, "A re-save sent the warning again")
+    check(container.items["log-warn"]["status"] == "Resolved", "the re-save was not stored")
+    check(container.items["log-warn"]["warning_notification_id"] == sent["id"], "the warning record changed")
+
+    # Reviewers see the acknowledgment state on the list.
+    logs = {row["id"]: row for row in client.get("/api/safety/logs?page=1&page_size=100").get_json()["logs"]}
+    check(logs["log-warn"]["warning_acknowledgment_status"] == "pending", str(logs["log-warn"]))
+    check(logs["log-legacy"]["warning_acknowledgment_status"] == "not_tracked", str(logs["log-legacy"]))
+    check(logs["log-other"]["warning_acknowledgment_status"] is None, str(logs["log-other"]))
+
+    # The warned user sees only what they were sent, and legacy warnings never ask.
+    sign_in(client, "user-1")
+    response = client.get("/api/safety/warnings/pending")
+    body = response.get_json()
+    check(response.status_code == 200 and response.headers.get("Cache-Control") == "no-store", str(body))
+    check([warning["id"] for warning in body["warnings"]] == ["log-warn"] and body["count"] == 1, str(body))
+    warning = body["warnings"][0]
+    check(set(warning) == USER_FIELDS, f"unexpected warning fields: {sorted(warning)}")
+    check(warning["message"] == sent["message"] and warning["title"] == sent["title"], str(warning))
+    check(warning["triggered_categories"] == [{"category": "Hate", "severity": 4},
+                                              {"category": "Violence", "severity": 2}], str(warning))
+    serialized = json.dumps(body)
+    check("Resolved after the warning." not in serialized and "Flagged text" not in serialized, "Record data leaked")
+    check("notification-" not in serialized and "user-1" not in serialized, "Internal fields leaked")
+    check(remediation.count_pending_safety_warnings("user-1") == 1, "bootstrap count differs from the list")
+    check(remediation.count_pending_safety_warnings("user-2") == 0, "another user's warning was counted")
+    check(any(query.startswith("SELECT VALUE COUNT(1) FROM c WHERE c.user_id = @user_id") for query in container.queries),
+          "the count is not scoped to the caller")
+
+    # Another user can neither see nor acknowledge it, and can't tell it exists.
+    sign_in(client, "user-2")
+    check(client.get("/api/safety/warnings/pending").get_json()["warnings"] == [], "cross-user listing")
+    for log_id in ("log-warn", "does-not-exist"):
+        response = client.post(f"/api/safety/warnings/{log_id}/acknowledge", json={})
+        check(response.status_code == 404 and response.get_json() == {"error": "Warning not found."}, log_id)
+    check(container.items["log-warn"]["warning_acknowledged_at"] is None, "cross-user acknowledgment")
+
+    # The owner acknowledges once; a reviewer saving at the same moment is kept.
+    sign_in(client, "user-1")
+
+    def reviewer_saves(store):
+        item = store.read_item("log-warn", "log-warn")
+        item["notes"] = "Concurrent reviewer note"
+        store.upsert_item(item)
+
+    container.before_replace = reviewer_saves
+    response = client.post("/api/safety/warnings/log-warn/acknowledge", json={})
+    body = response.get_json()
+    check(response.status_code == 200 and body["already_acknowledged"] is False, str(body))
+    check(body["warning"]["acknowledged_at"] and set(body["warning"]) == USER_FIELDS, str(body))
+    stored = container.items["log-warn"]
+    check(stored["notes"] == "Concurrent reviewer note", "The acknowledgment overwrote a reviewer save")
+    first_acknowledgment = stored["warning_acknowledged_at"]
+    check(bool(first_acknowledgment), "acknowledgment not stored")
+    check((sent["id"], "user-1") in h.read_marks, "The warning notification was not marked read")
+
+    response = client.post("/api/safety/warnings/log-warn/acknowledge", json={})
+    check(response.status_code == 200 and response.get_json()["already_acknowledged"] is True, "not idempotent")
+    check(container.items["log-warn"]["warning_acknowledged_at"] == first_acknowledgment, "A repeat moved the time")
+    check(client.get("/api/safety/warnings/pending").get_json()["warnings"] == [], "acknowledged warning pending")
+    check(remediation.count_pending_safety_warnings("user-1") == 0, "an acknowledged warning is still counted")
+    for log_id in ("log-legacy", "log-ai", "log-other"):
+        response = client.post(f"/api/safety/warnings/{log_id}/acknowledge", json={})
+        check(response.status_code == 404, f"{log_id} was acknowledgeable")
+
+    # A sent warning stays acknowledgeable when content checks reporting is turned off.
+    h.settings["enable_content_safety"] = False
+    check(client.get("/api/safety/warnings/pending").status_code == 200, "warnings gated on the report")
+    check(client.post("/api/safety/warnings/log-warn/acknowledge", json={}).status_code == 200, "ack gated")
+    check(client.get("/api/safety/logs/my").status_code == 403, "the violation list lost its gate")
+    h.settings["enable_content_safety"] = True
+
+    sign_in(client, "reviewer-1", roles=("Admin",))
+    logs = {row["id"]: row for row in client.get("/api/safety/logs?page=1&page_size=100").get_json()["logs"]}
+    check(logs["log-warn"]["warning_acknowledgment_status"] == "acknowledged", str(logs["log-warn"]))
+    check(logs["log-warn"]["warning_acknowledged_at"] == first_acknowledgment, str(logs["log-warn"]))
+
+    # A violation can be warned about again. An acknowledgment names the warning the user
+    # read, so one read before a withdrawal or a newer warning is never recorded against it.
+    container.seed({**base, "id": "log-resend", "user_id": "user-1"})
+    response = client.patch("/api/safety/logs/log-resend", json={"status": "In-Review", "action": "WarnUser"})
+    check(response.status_code == 200, f"first warning not sent: {response.get_json()}")
+    first_sent_at = "2026-10-02T09:00:00+00:00"
+    container.items["log-resend"]["warning_issued_at"] = first_sent_at
+    sign_in(client, "user-1")
+    pending = {item["id"]: item for item in client.get("/api/safety/warnings/pending").get_json()["warnings"]}
+    check(pending["log-resend"]["issued_at"] == first_sent_at, str(pending))
+    sign_in(client, "reviewer-1", roles=("Admin",))
+    response = client.patch("/api/safety/logs/log-resend", json={"status": "In-Review", "action": "None"})
+    check(response.status_code == 200, "the warning could not be withdrawn")
+    sign_in(client, "user-1")
+    response = client.post("/api/safety/warnings/log-resend/acknowledge", json={"issued_at": first_sent_at})
+    check(response.status_code == 404, "a withdrawn warning was acknowledged")
+    sign_in(client, "reviewer-1", roles=("Admin",))
+    response = client.patch("/api/safety/logs/log-resend", json={
+        "status": "In-Review", "action": "WarnUser", "notification_message": "A second warning.",
+    })
+    check(response.status_code == 200 and response.get_json().get("warning_already_sent") is not True, "not re-sent")
+    resent = container.items["log-resend"]
+    second_sent_at = resent["warning_issued_at"]
+    check(second_sent_at != first_sent_at and resent["warning_acknowledged_at"] is None, str(resent))
+    sign_in(client, "user-1")
+    response = client.post("/api/safety/warnings/log-resend/acknowledge", json={"issued_at": first_sent_at})
+    check(response.status_code == 409 and response.get_json() == {
+        "error": remediation.SAFETY_WARNING_REPLACED_MESSAGE, "code": "safety_warning_replaced",
+    }, f"a replaced warning: {response.status_code} {response.get_json()}")
+    check(container.items["log-resend"]["warning_acknowledged_at"] is None, "the newer warning was acknowledged unread")
+    pending = {item["id"]: item for item in client.get("/api/safety/warnings/pending").get_json()["warnings"]}
+    check(pending["log-resend"]["issued_at"] == second_sent_at, str(pending))
+    check(pending["log-resend"]["message"] == "A second warning.", str(pending))
+    for bad_body in ({"issued_at": 5}, {"issued_at": ["x"]}):
+        response = client.post("/api/safety/warnings/log-resend/acknowledge", json=bad_body)
+        check(response.status_code == 400, f"accepted {bad_body}")
+    response = client.post("/api/safety/warnings/log-resend/acknowledge", json={"issued_at": second_sent_at})
+    check(response.status_code == 200 and response.get_json()["already_acknowledged"] is False, "newer ack refused")
+    response = client.post("/api/safety/warnings/log-resend/acknowledge", json={"issued_at": second_sent_at})
+    check(response.status_code == 200 and response.get_json()["already_acknowledged"] is True, "newer ack repeat")
+    # Another user naming the right send time still learns nothing.
+    sign_in(client, "user-2")
+    response = client.post("/api/safety/warnings/log-resend/acknowledge", json={"issued_at": first_sent_at})
+    check(response.status_code == 404 and response.get_json() == {"error": "Warning not found."}, "cross-user replaced")
+    sign_in(client, "reviewer-1", roles=("Admin",))
+
+    # A failed send is recorded without exception text, and saving again retries it.
+    container.seed({**base, "id": "log-fail", "user_id": "user-1"})
+    h.fail_notifications = True
+    response = client.patch("/api/safety/logs/log-fail", json={"status": "In-Review", "action": "WarnUser"})
+    text = response.get_data(as_text=True)
+    check(response.status_code == 500 and "could not be sent" in response.get_json()["error"], text)
+    check("RuntimeError" not in text and "Failed to create" not in text, "exception text reached the browser")
+    failed = container.items["log-fail"]
+    check(failed["action_request_status"] == "failed" and failed["status"] == "In-Review", str(failed))
+    check(not failed.get("warning_requires_acknowledgment"), "a failed warning asks for acknowledgment")
+    h.fail_notifications = False
+    response = client.patch("/api/safety/logs/log-fail", json={"status": "In-Review", "action": "WarnUser"})
+    check(response.status_code == 200 and container.items["log-fail"]["action_request_status"] == "executed", "retry")
+
+    # A warn_user approval created before this change still completes, through the same
+    # three steps the Control Center approval path takes, and asks for acknowledgment.
+    container.seed({**base, "id": "log-approved", "user_id": "user-1", "action": "WarnUser",
+                    "action_request_status": "pending", "action_request_id": "approval-legacy"})
+    log_item = remediation.get_safety_log_item("log-approved")
+    result = remediation.execute_safety_violation_action(
+        action="WarnUser", safety_log=log_item, notification_title="", notification_message="",
+        datetime_to_allow=None, actor={"id": "approver-2", "email": "approver@contoso.test"},
+    )
+    updates = remediation.build_safety_action_execution_updates("WarnUser", result)
+    updates.update({"action_request_id": "approval-legacy", "action_request_type": "warn_user"})
+    remediation.update_safety_log_action_state("log-approved", updates)
+    approved = container.items["log-approved"]
+    check(approved["action_request_status"] == "executed" and approved["warning_requires_acknowledgment"] is True, str(approved))
+    check(approved["warning_notification_id"] == result["notification_id"], str(approved))
+    sign_in(client, "user-1")
+    pending = client.get("/api/safety/warnings/pending").get_json()["warnings"]
+    check([item["id"] for item in pending] == ["log-fail", "log-approved"], str(pending))
+
+    suspend_updates = remediation.build_safety_action_execution_updates("SuspendUser", {"notification_id": "n"})
+    check(not any(key.startswith("warning_") for key in suspend_updates), str(suspend_updates))
+
+    # Signed out, nothing is answered; restricted, the warning waits until access returns.
+    sign_out(client)
+    check(client.get("/api/safety/warnings/pending").status_code == 401, "anonymous read")
+    h.user_docs["user-1"] = {"id": "user-1", "settings": {"access": {"status": "deny", "datetime_to_allow": None}}}
+    sign_in(client, "user-1")
+    response = client.get("/api/safety/warnings/pending")
+    check(response.status_code == 403 and response.get_json()["error"] == "access_restricted", "restricted read")
+
+    from test_support.cosmos_query_guard import cosmos_query_problems
+    for query in container.queries:
+        check(not cosmos_query_problems(query), f"unsupported cross-partition query: {query}")
+
+print("PASS: immediate, must-acknowledge safety warnings")
+'''
+
+
+@pytest.mark.parametrize("first_import", ["functions_safety_remediation", "route_backend_safety"])
+@pytest.mark.parametrize("optimized", [False, True])
+def test_real_warning_send_and_acknowledgment(first_import, optimized):
+    command = [sys.executable, "-B"]
+    if optimized:
+        command.append("-O")
+    result = subprocess.run(
+        command + ["-c", WARNING_PROBE, str(ROOT), first_import],
+        capture_output=True,
+        text=True,
+        timeout=180,
+        check=False,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert "PASS: immediate, must-acknowledge safety warnings" in result.stdout
+
+
+def _function_source(path, name):
+    source = path.read_text(encoding="utf-8")
+    for node in ast.walk(ast.parse(source)):
+        if isinstance(node, ast.FunctionDef) and node.name == name:
+            return ast.get_source_segment(source, node)
+    raise AssertionError(f"{name} not found in {path.name}")
+
+
+def test_route_contracts_for_the_user_warning_routes():
+    """The user routes require a user session and are not gated on the content checks report."""
+    tree = ast.parse((APP_DIR / "route_backend_safety.py").read_text(encoding="utf-8"))
+    expected = {
+        "get_pending_safety_warnings": "bp.route('/api/safety/warnings/pending', methods=['GET'])",
+        "acknowledge_pending_safety_warning": (
+            "bp.route('/api/safety/warnings/<string:log_id>/acknowledge', methods=['POST'])"
+        ),
+    }
+    found = {
+        node.name: [ast.unparse(item) for item in node.decorator_list]
+        for node in ast.walk(tree)
+        if isinstance(node, ast.FunctionDef) and node.name in expected
+    }
+    assert set(found) == set(expected)
+    for name, route in expected.items():
+        assert found[name] == [
+            route,
+            "swagger_route(security=get_auth_security())",
+            "login_required",
+            "user_required",
+        ], found[name]
+
+
+def test_control_center_approval_path_marks_warnings_for_acknowledgment():
+    """Approvals created before warnings stopped needing one finish the same way."""
+    source = _function_source(APP_DIR / "route_backend_control_center.py", "_execute_safety_violation_request")
+    assert "build_safety_action_execution_updates(action, result)" in source
+    assert "update_safety_log_action_state(safety_log_id, execution_updates)" in source
+
+
+def test_v2_warning_dialog_and_settings_are_wired():
+    v2 = ROOT / "application" / "v2_ui" / "src"
+    app_tsx = (v2 / "App.tsx").read_text(encoding="utf-8")
+    # Read only when bootstrap counts some, so a user with none costs no extra request.
+    assert "data && !error && !standalonePage ? data.safety_warnings?.pending ?? 0 : null," in app_tsx
+    runtime = (v2 / "lib" / "useSafetyWarningRuntime.ts").read_text(encoding="utf-8")
+    assert "if (pending <= 0) {" in runtime and "}, [pending, revision]);" in runtime
+    bootstrap = (APP_DIR / "route_backend_v2.py").read_text(encoding="utf-8")
+    assert "pending_safety_warnings = count_pending_safety_warnings(user_id)" in bootstrap
+    assert '"safety_warnings": {"pending": pending_safety_warnings},' in bootstrap
+    shell = (v2 / "components" / "layout" / "AppShell.tsx").read_text(encoding="utf-8")
+    assert "<SafetyWarningDialogHost />" in shell
+    dialog = (v2 / "components" / "notifications" / "SafetyWarningDialog.tsx").read_text(encoding="utf-8")
+    assert "A warning from your administrators" in dialog and "I understand" in dialog
+    assert "dangerouslySetInnerHTML" not in dialog
+    client = (v2 / "lib" / "safetyWarnings.ts").read_text(encoding="utf-8")
+    assert "/api/safety/warnings/pending" in client
+    assert "/api/safety/warnings/${encodeURIComponent(warning.id)}/acknowledge" in client
+    # The acknowledgment names the warning read, so the server can refuse a replaced one.
+    assert "warning.issuedAt ? { issued_at: warning.issuedAt } : {}" in client
+    store = (v2 / "stores" / "safetyWarningStore.ts").read_text(encoding="utf-8")
+    assert "acknowledgedKeys.has(safetyWarningKey(warning))" in store
+    assert "SAFETY_WARNING_REPLACED_CODE" in store and "fetchPendingSafetyWarnings()" in store
+    violations = (v2 / "components" / "settings" / "ViolationsTab.tsx").read_text(encoding="utf-8")
+    assert "warning_acknowledgment_status" in violations
+    admin_page = (v2 / "pages" / "AdminSafetyViolationsPage.tsx").read_text(encoding="utf-8")
+    assert "Warning acknowledged" in admin_page and "Not yet acknowledged" in admin_page
+    assert "The warning is sent to the user as soon as you save" in admin_page
+    assert "otherwise it becomes a pending request" not in admin_page
+
+
+def test_version():
+    assert_app_version_at_least("0.261.297")
+
+
+if __name__ == "__main__":
+    sys.exit(pytest.main([__file__, "-q"]))
diff --git a/functional_tests/test_safety_warning_send_claim.py b/functional_tests/test_safety_warning_send_claim.py
new file mode 100644
index 000000000..45877ad32
--- /dev/null
+++ b/functional_tests/test_safety_warning_send_claim.py
@@ -0,0 +1,297 @@
+#!/usr/bin/env python3
+# test_safety_warning_send_claim.py
+"""
+Functional test for sending a safety warning exactly once when saves overlap.
+Version: 0.261.297
+Implemented in: 0.261.297
+
+This test ensures that a reviewer's save claims the violation, with a write conditional on
+the version it read, before it sends a warning; that of two overlapping saves -- a
+double-click, or two reviewers -- only one sends, and the other is refused with 409
+safety_warning_in_progress and sends nothing; that while a warning is being sent, other
+saves and deletes wait, and the violation never counts as a warning to acknowledge; that a
+claim left by a save that never finished stops blocking after its time to live, reads as a
+failed send, and is retried by only one of two saves; and that a send whose claim was lost
+is reported and audited rather than recorded over another writer. Real modules run in fresh
+processes with network access blocked, under normal and optimized Python.
+"""
+
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+APP_DIR = ROOT / "application" / "single_app"
+sys.path.insert(0, str(ROOT / "functional_tests"))
+
+from test_support.versioning import assert_app_version_at_least  # noqa: E402
+
+
+CLAIM_PROBE = r'''
+import importlib
+import sys
+from contextlib import ExitStack
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+root = Path(sys.argv[1])
+sys.path.insert(0, str(root / "functional_tests"))
+sys.path.insert(0, str(root / "application" / "single_app"))
+from azure.cosmos import exceptions as cosmos_exceptions
+from test_support.offline_bootstrap import offline_app_imports
+from test_support.safety_review_harness import build_safety_app, check, sign_in
+
+WARN = {"status": "In-Review", "action": "WarnUser", "notes": "Warned.", "notification_message": "Please stop."}
+
+with offline_app_imports(), ExitStack() as stack:
+    importlib.import_module(sys.argv[2])
+    import functions_safety_remediation as remediation
+    import route_backend_safety as routes
+
+    CLAIM_FIELDS = remediation.SAFETY_WARNING_SEND_CLAIM_FIELDS
+    h = build_safety_app(stack)
+    client, container = h.client, h.container
+    other = h.new_client()
+    warned_user = h.new_client()
+    sign_in(client, "reviewer-1", roles=("Admin",))
+    sign_in(other, "reviewer-2", roles=("Admin",))
+    sign_in(warned_user, "user-1")
+    base = {"status": "New", "action": "None", "created_at": "2026-10-01T00:00:00", "message": "Flagged text",
+            "user_id": "user-1", "triggered_categories": [{"category": "Hate", "severity": 4}]}
+
+    def sent_for(log_id):
+        return [item for item in h.notifications if item["metadata"]["safety_log_id"] == log_id]
+
+    def audited_for(log_id):
+        return [item for item in h.audits if item["additional_context"]["record_id"] == log_id]
+
+    def listed(log_id):
+        logs = other.get("/api/safety/logs?page=1&page_size=100").get_json()["logs"]
+        return {row["id"]: row for row in logs}[log_id]
+
+    def unclaimed(record):
+        return not any(field in record for field in CLAIM_FIELDS)
+
+    def refused_in_progress(response):
+        body = response.get_json() or {}
+        return response.status_code == 409 and body.get("code") == "safety_warning_in_progress"
+
+    # 1. Two saves read the same version (a double-click, or two reviewers). The one that
+    # claims the violation first sends the warning; the other sends nothing.
+    container.seed({**base, "id": "log-race"})
+    overlapping = {}
+
+    def overlapping_save(store):
+        overlapping["response"] = other.patch("/api/safety/logs/log-race", json=WARN)
+
+    container.before_replace = overlapping_save
+    response = client.patch("/api/safety/logs/log-race", json=WARN)
+    check(overlapping["response"].status_code == 200, f"the first save failed: {overlapping['response'].get_json()}")
+    check(refused_in_progress(response), f"the overlapping save: {response.status_code} {response.get_json()}")
+    check(response.get_json()["error"] == routes.SAFETY_WARNING_CLAIM_CONFLICT_MESSAGE, str(response.get_json()))
+    check(len(sent_for("log-race")) == 1, f"expected one warning, sent {len(sent_for('log-race'))}")
+    stored = container.items["log-race"]
+    check(stored["action_request_status"] == "executed" and unclaimed(stored), str(stored))
+    check(stored["warning_notification_id"] == sent_for("log-race")[0]["id"], str(stored))
+    audits = audited_for("log-race")
+    check(len(audits) == 1 and audits[0]["admin_user_id"] == "reviewer-2", str(audits))
+
+    # 2. While a warning is being sent, the violation is claimed and waits: other saves and
+    # deletes are refused, and it never counts as a warning to acknowledge -- even when it
+    # still holds the fields of a warning sent and withdrawn before.
+    container.seed({**base, "id": "log-busy", "action_request_status": "executed",
+                    "warning_requires_acknowledgment": True, "warning_acknowledged_at": None,
+                    "warning_issued_at": "2026-10-02T09:00:00+00:00", "warning_message": "Earlier."})
+    during = {}
+
+    def while_sending():
+        record = container.items["log-busy"]
+        during["record"] = dict(record)
+        during["warn"] = other.patch("/api/safety/logs/log-busy", json=WARN)
+        during["notes"] = other.patch("/api/safety/logs/log-busy", json={
+            "status": "Dismissed", "action": "None", "notes": "Changed my mind.",
+        })
+        during["delete"] = other.delete("/api/safety/logs/log-busy")
+        during["count"] = remediation.count_pending_safety_warnings("user-1")
+        during["pending"] = warned_user.get("/api/safety/warnings/pending").get_json()["warnings"]
+        during["ack"] = warned_user.post("/api/safety/warnings/log-busy/acknowledge", json={})
+        during["listed"] = listed("log-busy")
+
+    h.before_notification = while_sending
+    count_before = remediation.count_pending_safety_warnings("user-1")
+    response = client.patch("/api/safety/logs/log-busy", json=WARN)
+    check(response.status_code == 200, f"the send failed: {response.get_json()}")
+    claimed = during["record"]
+    check(claimed["action_request_status"] == "sending" and claimed["action"] == "WarnUser", str(claimed))
+    check(all(claimed.get(field) for field in CLAIM_FIELDS), f"no claim before sending: {claimed}")
+    check(claimed["notes"] == "Warned.", "the claim did not store the review")
+    for key in ("warn", "notes", "delete"):
+        check(refused_in_progress(during[key]), f"{key}: {during[key].status_code} {during[key].get_json()}")
+    check(during["warn"].get_json()["error"] == routes.SAFETY_WARNING_SENDING_MESSAGE, str(during["warn"].get_json()))
+    pending_ids = [warning["id"] for warning in during["pending"]]
+    check(during["count"] == count_before and "log-busy" not in pending_ids, "a warning being sent counted as pending")
+    check("c.action_request_status = 'executed'" in remediation._PENDING_WARNING_CONDITIONS, "count not scoped")
+    check(during["ack"].status_code == 404, "a warning being sent was acknowledgeable")
+    row = during["listed"]
+    check(row["action_request_status"] == "sending" and row["warning_acknowledgment_status"] is None, str(row))
+    check(unclaimed(row), "the claim was listed")
+    stored = container.items["log-busy"]
+    check(stored["action_request_status"] == "executed" and stored["notes"] == "Warned." and unclaimed(stored), str(stored))
+    check(stored["warning_message"] == "Please stop." and stored["warning_acknowledged_at"] is None, str(stored))
+    check(len(sent_for("log-busy")) == 1, "a refused save sent a warning")
+    check(remediation.count_pending_safety_warnings("user-1") == count_before + 1, "the sent warning is not pending")
+
+    # 3. A claim's time to live: a fresh claim blocks; an old, future or unreadable one does not.
+    now = datetime.now(timezone.utc)
+    sending = lambda claimed_at: {"action_request_status": "sending", "warning_send_claimed_at": claimed_at}
+    check(remediation.safety_warning_send_in_progress(sending((now - timedelta(seconds=30)).isoformat()), now), "fresh")
+    naive = (now - timedelta(seconds=5)).replace(tzinfo=None).isoformat()
+    check(remediation.safety_warning_send_in_progress({**sending(naive), "action_request_status": "Sending"}, now), "naive")
+    for claimed_at in ((now - timedelta(minutes=6)).isoformat(), (now + timedelta(minutes=6)).isoformat(), "soon", "", None):
+        check(not remediation.safety_warning_send_in_progress(sending(claimed_at), now), f"{claimed_at!r} blocked")
+        check(remediation.is_interrupted_safety_warning_send(sending(claimed_at), now), f"{claimed_at!r} not stale")
+    executed = {"action_request_status": "executed", "warning_send_claimed_at": now.isoformat()}
+    check(not remediation.safety_warning_send_in_progress(executed, now), "only 'sending' is a claim")
+    check(not remediation.is_interrupted_safety_warning_send(executed, now), "only 'sending' is interrupted")
+
+    container.seed({**base, "id": "log-fresh", "action": "WarnUser", "action_request_status": "sending",
+                    "warning_send_claim_id": "another-save",
+                    "warning_send_claimed_at": (now - timedelta(seconds=20)).isoformat()})
+    response = client.patch("/api/safety/logs/log-fresh", json=WARN)
+    check(refused_in_progress(response) and not sent_for("log-fresh"), f"a fresh claim: {response.get_json()}")
+    check(container.items["log-fresh"]["warning_send_claim_id"] == "another-save", "a fresh claim was replaced")
+
+    # 4. A claim left by a save that never finished reads as a failed send and stops blocking.
+    # Two saves that retry it at once send it once.
+    stale = (now - timedelta(minutes=10)).isoformat()
+    container.seed({**base, "id": "log-stale", "action": "WarnUser", "action_request_status": "sending",
+                    "warning_send_claim_id": "crashed-save", "warning_send_claimed_at": stale})
+    row = listed("log-stale")
+    check(row["action_request_status"] == "failed" and unclaimed(row), str(row))
+    check(row["action_execution_error"] == remediation.SAFETY_WARNING_SEND_INTERRUPTED_MESSAGE, str(row))
+    overlapping.clear()
+
+    def overlapping_retry(store):
+        overlapping["response"] = other.patch("/api/safety/logs/log-stale", json=WARN)
+
+    container.before_replace = overlapping_retry
+    response = client.patch("/api/safety/logs/log-stale", json=WARN)
+    check(overlapping["response"].status_code == 200, f"a stale claim blocked: {overlapping['response'].get_json()}")
+    check(refused_in_progress(response), f"the second retry: {response.status_code} {response.get_json()}")
+    check(len(sent_for("log-stale")) == 1, f"a stale claim was retried {len(sent_for('log-stale'))} times")
+    stored = container.items["log-stale"]
+    check(stored["action_request_status"] == "executed" and unclaimed(stored), str(stored))
+    check(stored["warning_requires_acknowledgment"] is True and stored["action_execution_error"] is None, str(stored))
+
+    # A stale claim is also cleared by a save that doesn't warn, as a failed send.
+    container.seed({**base, "id": "log-stale-none", "action": "WarnUser", "action_request_status": "sending",
+                    "warning_send_claim_id": "crashed-save", "warning_send_claimed_at": "not a time"})
+    response = client.patch("/api/safety/logs/log-stale-none", json={"status": "Dismissed", "action": "None"})
+    check(response.status_code == 200, f"a stale claim blocked a save: {response.get_json()}")
+    stored = container.items["log-stale-none"]
+    check(stored["action"] == "None" and stored["action_request_status"] == "failed" and unclaimed(stored), str(stored))
+    check(not sent_for("log-stale-none"), "a save that doesn't warn sent a warning")
+
+    # 5. A writer that keeps the claim -- archiving, which reads and writes the whole record --
+    # is kept, and the warning is recorded on its version.
+    container.seed({**base, "id": "log-archived"})
+
+    def archive_meanwhile():
+        record = container.read_item("log-archived", "log-archived")
+        record["is_archived"] = True
+        container.upsert_item(record)
+
+    h.before_notification = archive_meanwhile
+    response = client.patch("/api/safety/logs/log-archived", json=WARN)
+    check(response.status_code == 200, f"a concurrent archive failed the send: {response.get_json()}")
+    stored = container.items["log-archived"]
+    check(stored["is_archived"] is True and stored["action_request_status"] == "executed" and unclaimed(stored), str(stored))
+    check(stored["warning_notification_id"] == sent_for("log-archived")[0]["id"], str(stored))
+
+    # 6. A writer that replaced the record without the claim, or deleted it, is never
+    # overwritten. The warning was sent once, so it is audited and the reviewer is told.
+    container.seed({**base, "id": "log-lost"})
+
+    def overwrite_without_claim():
+        record = container.read_item("log-lost", "log-lost")
+        for field in CLAIM_FIELDS:
+            record.pop(field)
+        record.update({"action": "None", "action_request_status": None, "notes": "Another reviewer's save"})
+        container.upsert_item(record)
+
+    h.before_notification = overwrite_without_claim
+    response = client.patch("/api/safety/logs/log-lost", json=WARN)
+    body = response.get_json()
+    check(response.status_code == 409 and body["code"] == "safety_warning_not_recorded", f"{response.status_code} {body}")
+    check(body["error"] == routes.SAFETY_WARNING_NOT_RECORDED_MESSAGE and body["audit_logged"] is True, str(body))
+    stored = container.items["log-lost"]
+    check(stored["notes"] == "Another reviewer's save" and "warning_notification_id" not in stored, str(stored))
+    check(len(sent_for("log-lost")) == 1 and len(audited_for("log-lost")) == 1, "not sent and audited once")
+
+    container.seed({**base, "id": "log-deleted"})
+    h.before_notification = lambda: container.delete_item("log-deleted", "log-deleted")
+    response = client.patch("/api/safety/logs/log-deleted", json=WARN)
+    check(response.status_code == 409 and response.get_json()["code"] == "safety_warning_not_recorded", "deleted")
+    check("log-deleted" not in container.items and len(sent_for("log-deleted")) == 1, "a deleted record came back")
+
+    # 7. When the outcome can't be written, the claim stays, so a quick retry can't send the
+    # warning twice; it stops blocking once its time to live passes.
+    container.seed({**base, "id": "log-unwritten"})
+
+    def unavailable(store):
+        raise cosmos_exceptions.CosmosHttpResponseError(status_code=503, message="Unavailable")
+
+    h.before_notification = lambda: setattr(container, "before_replace", unavailable)
+    response = client.patch("/api/safety/logs/log-unwritten", json=WARN)
+    check(response.status_code == 500 and response.get_json()["code"] == "safety_warning_not_recorded", "503")
+    check(container.items["log-unwritten"]["action_request_status"] == "sending", "the claim was dropped")
+    check(refused_in_progress(client.patch("/api/safety/logs/log-unwritten", json=WARN)), "a quick retry was allowed")
+    check(len(sent_for("log-unwritten")) == 1, "a quick retry sent the warning again")
+
+    # 8. A send that fails releases its claim, so saving again retries it at once.
+    container.seed({**base, "id": "log-failed"})
+    h.fail_notifications = True
+    response = client.patch("/api/safety/logs/log-failed", json=WARN)
+    h.fail_notifications = False
+    stored = container.items["log-failed"]
+    check(response.status_code == 500 and stored["action_request_status"] == "failed" and unclaimed(stored), str(stored))
+    check(stored["notes"] == "Warned.", "the rest of the review was not saved")
+    response = client.patch("/api/safety/logs/log-failed", json=WARN)
+    check(response.status_code == 200 and len(sent_for("log-failed")) == 1, f"retry: {response.get_json()}")
+
+print("PASS: a safety warning is sent once when saves overlap")
+'''
+
+
+@pytest.mark.parametrize("first_import", ["functions_safety_remediation", "route_backend_safety"])
+@pytest.mark.parametrize("optimized", [False, True])
+def test_overlapping_saves_send_one_warning(first_import, optimized):
+    command = [sys.executable, "-B"]
+    if optimized:
+        command.append("-O")
+    result = subprocess.run(
+        command + ["-c", CLAIM_PROBE, str(ROOT), first_import],
+        capture_output=True,
+        text=True,
+        timeout=180,
+        check=False,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert "PASS: a safety warning is sent once when saves overlap" in result.stdout
+
+
+def test_classic_save_button_waits_for_its_request():
+    """The classic review disables Save while its request is in flight."""
+    script = (APP_DIR / "static" / "js" / "admin" / "admin-safety-violations.js").read_text(encoding="utf-8")
+    assert "saveButton.disabled = true;" in script
+    assert "}).finally(function () {\n                    saveButton.disabled = false;" in script.replace("\r\n", "\n")
+
+
+def test_version():
+    assert_app_version_at_least("0.261.297")
+
+
+if __name__ == "__main__":
+    sys.exit(pytest.main([__file__, "-q"]))
diff --git a/functional_tests/test_support/safety_review_harness.py b/functional_tests/test_support/safety_review_harness.py
new file mode 100644
index 000000000..ab4ba9ec9
--- /dev/null
+++ b/functional_tests/test_support/safety_review_harness.py
@@ -0,0 +1,283 @@
+# safety_review_harness.py
+"""Closed-world harnesses for the safety review, safety warning and access-gate routes.
+
+Version: 0.261.297
+Implemented in: 0.261.297
+
+Used inside ``offline_app_imports()`` by fresh-process probes. The real route modules,
+decorators and helpers run on a real Flask app and session. Only the storage and delivery
+seams are replaced: the safety container (with ETags and conditional replace), user
+settings, notifications, approval requests and the activity log.
+"""
+
+import copy
+import itertools
+from importlib.metadata import version as package_version
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import werkzeug
+from azure.cosmos import exceptions as cosmos_exceptions
+from flask import Blueprint, Flask, jsonify
+
+
+APP_ROOT = Path(__file__).resolve().parents[2] / "application" / "single_app"
+
+APP_SETTINGS = {
+    "enable_content_safety": True,
+    "enable_content_screening": False,
+    "require_member_of_safety_violation_admin": False,
+    "require_member_of_control_center_admin": False,
+    "app_title": "SimpleChat",
+    "show_logo": False,
+    "hide_app_title": False,
+}
+
+
+def check(condition, message):
+    """Raise rather than assert, so a probe still checks under ``python -O``."""
+    if not condition:
+        raise AssertionError(message)
+
+
+def _quiet(*args, **kwargs):
+    return None
+
+
+def _test_client(app):
+    # Flask 2.x test clients read werkzeug.__version__, which Werkzeug 3 no longer defines.
+    with patch.object(werkzeug, "__version__", package_version("werkzeug"), create=True):
+        return app.test_client()
+
+
+class FakeSafetyContainer:
+    """A Cosmos-like container keyed by id, with ETags and conditional replace."""
+
+    def __init__(self):
+        self.items = {}
+        self.revision = itertools.count(1)
+        self.queries = []
+        # Called once, just before the next replace, to stand in for a concurrent writer.
+        self.before_replace = None
+
+    def seed(self, item):
+        stored = copy.deepcopy(item)
+        stored["_etag"] = str(next(self.revision))
+        self.items[stored["id"]] = stored
+        return copy.deepcopy(stored)
+
+    def read_item(self, item, partition_key, **kwargs):
+        if item not in self.items:
+            raise cosmos_exceptions.CosmosResourceNotFoundError(status_code=404, message="Not found")
+        return copy.deepcopy(self.items[item])
+
+    def upsert_item(self, body, **kwargs):
+        return self.seed(body)
+
+    def replace_item(self, item, body, etag=None, match_condition=None, **kwargs):
+        if self.before_replace is not None:
+            hook, self.before_replace = self.before_replace, None
+            hook(self)
+        current = self.items.get(item)
+        if current is None:
+            raise cosmos_exceptions.CosmosResourceNotFoundError(status_code=404, message="Not found")
+        if etag is not None and current.get("_etag") != etag:
+            raise cosmos_exceptions.CosmosAccessConditionFailedError(status_code=412, message="Changed")
+        return self.seed(body)
+
+    def delete_item(self, item, partition_key, **kwargs):
+        self.items.pop(item, None)
+
+    def query_items(self, query, parameters=None, **kwargs):
+        self.queries.append(query)
+        values = {parameter["name"]: parameter["value"] for parameter in parameters or []}
+        rows = [copy.deepcopy(item) for item in self.items.values()]
+        for name, field in (("@user_id", "user_id"), ("@action", "action"), ("@status", "status")):
+            if name in values:
+                rows = [row for row in rows if row.get(field) == values[name]]
+        if query.startswith("SELECT VALUE COUNT(1)"):
+            # The pending-warning count: the rest of its WHERE clause, applied here.
+            return [sum(
+                1 for row in rows
+                if row.get("action_request_status") == "executed"
+                and row.get("warning_requires_acknowledgment") is True
+                and not row.get("warning_acknowledged_at")
+                and row.get("content_origin", "user") == "user"
+            )]
+        return rows
+
+
+def _patch_user_settings(stack, user_docs, writes):
+    """Replace the user-settings store the access check and remediation read and write."""
+    import functions_safety_remediation as remediation
+    import functions_settings
+
+    def get_user_settings(user_id, allow_cross_user=False):
+        doc = user_docs.get(user_id)
+        if isinstance(doc, Exception):
+            raise doc
+        return copy.deepcopy(doc) if doc else {"id": user_id, "settings": {}}
+
+    def update_user_settings(user_id, updates, allow_cross_user=False):
+        doc = user_docs.setdefault(user_id, {"id": user_id, "settings": {}})
+        doc.setdefault("settings", {}).update(copy.deepcopy(updates))
+        writes.append({"user_id": user_id, "updates": copy.deepcopy(updates), "allow_cross_user": allow_cross_user})
+        return True
+
+    for module in (functions_settings, remediation):
+        stack.enter_context(patch.object(module, "get_user_settings", get_user_settings))
+        stack.enter_context(patch.object(module, "update_user_settings", update_user_settings))
+
+
+def _patch_app_settings(stack, settings):
+    import functions_authentication as auth
+    import functions_settings
+
+    def get_settings(*args, **kwargs):
+        return copy.deepcopy(settings)
+
+    stack.enter_context(patch.object(functions_settings, "get_settings", get_settings))
+    stack.enter_context(patch.object(auth, "get_settings", get_settings))
+    return get_settings
+
+
+def sign_in(client, user_id, roles=("User",), name="Test User"):
+    with client.session_transaction() as session:
+        session["user"] = {
+            "oid": user_id,
+            "roles": list(roles),
+            "name": name,
+            "preferred_username": f"{user_id}@contoso.test",
+        }
+
+
+def sign_out(client):
+    with client.session_transaction() as session:
+        session.clear()
+
+
+def build_safety_app(stack):
+    """The real safety routes on a Blueprint guarded as app.py guards backend_safety."""
+    import functions_authentication as auth
+    import functions_safety_remediation as remediation
+    import route_backend_safety as safety_routes
+
+    container = FakeSafetyContainer()
+    state = SimpleNamespace(
+        container=container,
+        user_docs={},
+        access_writes=[],
+        notifications=[],
+        read_marks=[],
+        approvals=[],
+        audits=[],
+        settings=copy.deepcopy(APP_SETTINGS),
+        fail_notifications=False,
+        # Called once, just before the next notification is created: stands in for a request
+        # that arrives while a warning is being sent.
+        before_notification=None,
+    )
+    _patch_app_settings(stack, state.settings)
+    _patch_user_settings(stack, state.user_docs, state.access_writes)
+    stack.enter_context(patch.object(remediation, "cosmos_safety_container", container))
+    stack.enter_context(patch.object(safety_routes, "cosmos_safety_container", container))
+
+    def create_notification(**kwargs):
+        if state.before_notification is not None:
+            hook, state.before_notification = state.before_notification, None
+            hook()
+        if state.fail_notifications:
+            return None
+        notification = dict(kwargs)
+        notification["id"] = f"notification-{len(state.notifications) + 1}"
+        state.notifications.append(notification)
+        return notification
+
+    def mark_notification_read(notification_id, user_id):
+        state.read_marks.append((notification_id, user_id))
+        return True
+
+    def create_approval_request(**kwargs):
+        approval = dict(kwargs)
+        approval.update({
+            "id": f"approval-{len(state.approvals) + 1}",
+            "status": "pending",
+            "created_at": "2026-10-07T12:00:00",
+        })
+        state.approvals.append(approval)
+        return approval
+
+    def log_general_admin_action(**kwargs):
+        state.audits.append(kwargs)
+        return True
+
+    stack.enter_context(patch.object(remediation, "create_notification", create_notification))
+    stack.enter_context(patch.object(remediation, "mark_notification_read", mark_notification_read))
+    stack.enter_context(patch.object(safety_routes, "create_approval_request", create_approval_request))
+    stack.enter_context(patch.object(safety_routes, "log_general_admin_action", log_general_admin_action))
+    for module in (remediation, safety_routes, auth):
+        stack.enter_context(patch.object(module, "log_event", _quiet))
+    stack.enter_context(patch.object(remediation, "debug_print", _quiet))
+
+    app = Flask("safety-review-harness", root_path=str(APP_ROOT))
+    app.secret_key = "offline-test-only"
+    app.config["TESTING"] = True
+    blueprint = Blueprint("backend_safety", __name__)
+    blueprint.before_request(auth.user_required_blueprint())
+    safety_routes.register_route_backend_safety(blueprint)
+    app.register_blueprint(blueprint)
+    state.app = app
+    state.client = _test_client(app)
+    # Another browser: a second reviewer, or the warned user, with a session of their own.
+    state.new_client = lambda: _test_client(app)
+    return state
+
+
+def build_gate_app(stack, shell_path):
+    """The real access gate, Access restricted routes and V2 shell routes, guarded as app.py does."""
+    import functions_authentication as auth
+    import route_access_restriction as restricted
+    import route_frontend_v2 as frontend_v2
+
+    state = SimpleNamespace(
+        user_docs={},
+        access_writes=[],
+        settings=copy.deepcopy(APP_SETTINGS),
+    )
+    get_settings = _patch_app_settings(stack, state.settings)
+    _patch_user_settings(stack, state.user_docs, state.access_writes)
+    stack.enter_context(patch.object(restricted, "get_settings", get_settings))
+    stack.enter_context(patch.object(frontend_v2, "get_v2_index_path", lambda: str(shell_path)))
+    for module in (auth, frontend_v2):
+        stack.enter_context(patch.object(module, "log_event", _quiet))
+
+    app = Flask("access-gate-harness", root_path=str(APP_ROOT))
+    app.secret_key = "offline-test-only"
+    app.config["TESTING"] = True
+
+    authentication = Blueprint("frontend_authentication", __name__)
+    authentication.add_url_rule("/login", "login", lambda: "Sign in page")
+    authentication.add_url_rule("/logout", "logout", lambda: "Signed out")
+    public_app = Blueprint("public_app", __name__)
+    public_app.add_url_rule("/", "index", lambda: "Home")
+
+    access_restriction = Blueprint("access_restriction", __name__)
+    access_restriction.before_request(auth.login_required_blueprint())
+    restricted.register_route_access_restriction(access_restriction)
+
+    v2_shell = Blueprint("frontend_v2", __name__)
+    v2_shell.before_request(auth.user_required_blueprint())
+    frontend_v2.register_route_frontend_v2(v2_shell)
+
+    gated = Blueprint("gated", __name__)
+    gated.before_request(auth.user_required_blueprint())
+    gated.add_url_rule("/chats", "chats", lambda: "Chats page")
+    gated.add_url_rule("/api/v2/bootstrap", "bootstrap", lambda: jsonify({"ok": True}))
+    gated.add_url_rule("/api/notifications/count", "count", lambda: jsonify({"count": 0}))
+
+    for blueprint in (authentication, public_app, access_restriction, v2_shell, gated):
+        app.register_blueprint(blueprint)
+    state.app = app
+    state.client = _test_client(app)
+    return state
diff --git a/functional_tests/test_v2_access_restriction_and_safety_warning_logic.mjs b/functional_tests/test_v2_access_restriction_and_safety_warning_logic.mjs
new file mode 100644
index 000000000..a25b05473
--- /dev/null
+++ b/functional_tests/test_v2_access_restriction_and_safety_warning_logic.mjs
@@ -0,0 +1,263 @@
+// test_v2_access_restriction_and_safety_warning_logic.mjs
+// Version: 0.261.297
+// Implemented in: 0.261.297
+// Executes the real V2 modules (lib/apiClient.ts, lib/accessRestriction.ts, lib/safetyWarnings.ts
+// and stores/safetyWarningStore.ts) against controlled HTTP. Pins that a 403 from the server's
+// access gate sends the tab to the Access restricted page once, without looping on that page;
+// that the restriction and warning payloads are read defensively; and that the warning store
+// keeps a warning until it is acknowledged, drops one the server no longer has, never brings
+// back one acknowledged while an older read was in flight, still shows a newer warning sent on
+// the same violation, and reads the newer warning when the one on screen was replaced.
+
+import assert from 'node:assert/strict';
+import './test_support/tsResolve.mjs';
+
+const apiClient = await import('../application/v2_ui/src/lib/apiClient.ts');
+const { parseAccessRestrictionStatus, formatRestoreTime } = await import('../application/v2_ui/src/lib/accessRestriction.ts');
+const {
+    describeSafetyWarningCategories,
+    parsePendingSafetyWarnings,
+} = await import('../application/v2_ui/src/lib/safetyWarnings.ts');
+const { useSafetyWarningStore, SAFETY_WARNING_ACKNOWLEDGE_ERROR } = await import('../application/v2_ui/src/stores/safetyWarningStore.ts');
+
+const { ApiError, isAccessRestricted, requestWithStatus, V2_ACCESS_RESTRICTED_PATH } = apiClient;
+
+let answer = () => new Response(null, { status: 204 });
+const requests = [];
+globalThis.fetch = async (url, init) => {
+    const request = { url: String(url), method: init?.method ?? 'GET' };
+    if (init?.body !== undefined) {
+        request.body = JSON.parse(init.body);
+    }
+    requests.push(request);
+    return answer(String(url), init);
+};
+
+const assigned = [];
+globalThis.window = {
+    location: {
+        pathname: '/v2/chat',
+        search: '',
+        hash: '',
+        assign: (url) => assigned.push(url),
+    },
+};
+
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+}
+
+const RESTRICTED = {
+    error: 'access_restricted',
+    message: 'Your access to this application has been blocked by an administrator.',
+    restriction: { kind: 'blocked', until: null, title: 'Blocked', message: 'Blocked.', reference_id: 'log-1' },
+    restricted_url: '/v2/access-restricted',
+};
+
+let checks = 0;
+async function check(name, run) {
+    await run();
+    checks += 1;
+    console.log(`ok ${name}`);
+}
+
+async function failure(send) {
+    try {
+        await send();
+    } catch (error) {
+        return error;
+    }
+    assert.fail('The request unexpectedly succeeded.');
+}
+
+await check('only the access gate counts as a restriction', () => {
+    assert.equal(isAccessRestricted(403, RESTRICTED), true);
+    assert.equal(isAccessRestricted(403, { error: 'Forbidden' }), false);
+    assert.equal(isAccessRestricted(403, { error: 'Access Denied' }), false);
+    assert.equal(isAccessRestricted(401, RESTRICTED), false);
+    assert.equal(isAccessRestricted(403, 'access_restricted'), false);
+    assert.equal(V2_ACCESS_RESTRICTED_PATH, '/v2/access-restricted');
+});
+
+await check('a refused call sends the tab to the Access restricted page', async () => {
+    answer = () => json(RESTRICTED, 403);
+    const error = await failure(() => requestWithStatus('/api/v2/bootstrap'));
+    assert.ok(error instanceof ApiError);
+    assert.equal(error.status, 403);
+    assert.equal(error.message, RESTRICTED.message);
+    assert.deepEqual(error.payload, RESTRICTED);
+    assert.deepEqual(assigned, ['/v2/access-restricted']);
+});
+
+await check('a refused call on the page itself does not loop', async () => {
+    assigned.length = 0;
+    window.location.pathname = '/v2/access-restricted';
+    answer = () => json(RESTRICTED, 403);
+    await failure(() => requestWithStatus('/api/notifications/count'));
+    assert.deepEqual(assigned, []);
+    window.location.pathname = '/v2/chat';
+});
+
+await check('the terms gate still wins its own redirect', async () => {
+    assigned.length = 0;
+    answer = () => json({ error: 'terms_of_use_required', message: 'Accept the terms.' }, 403);
+    await failure(() => requestWithStatus('/api/v2/bootstrap'));
+    assert.equal(assigned.length, 1);
+    assert.ok(assigned[0].startsWith('/v2/terms-of-use?'), assigned[0]);
+    assigned.length = 0;
+    answer = () => json({ error: 'Forbidden', message: 'Insufficient permissions' }, 403);
+    await failure(() => requestWithStatus('/api/v2/bootstrap'));
+    assert.deepEqual(assigned, [], 'An ordinary 403 navigated away');
+});
+
+await check('the restriction status is read defensively', () => {
+    assert.deepEqual(parseAccessRestrictionStatus({ restricted: false, branding: { app_title: 'Contoso' } }), {
+        restricted: false,
+        restriction: null,
+        branding: { app_title: 'Contoso' },
+    });
+    const suspended = parseAccessRestrictionStatus({
+        restricted: true,
+        restriction: { kind: 'suspended', until: '2026-10-08T14:00:00+00:00', title: ' Suspended ', message: 'Wait.', reference_id: 'log-9' },
+    });
+    assert.deepEqual(suspended.restriction, {
+        kind: 'suspended',
+        until: '2026-10-08T14:00:00+00:00',
+        title: 'Suspended',
+        message: 'Wait.',
+        referenceId: 'log-9',
+    });
+    // A suspension without a restore time can't say when access returns: shown as a block.
+    const noUntil = parseAccessRestrictionStatus({ restricted: true, restriction: { kind: 'suspended', title: '', message: '' } });
+    assert.equal(noUntil.restriction.kind, 'blocked');
+    assert.equal(noUntil.restriction.until, null);
+    assert.equal(noUntil.restriction.title, 'Your access has been blocked');
+    assert.equal(noUntil.restriction.referenceId, null);
+    assert.equal(parseAccessRestrictionStatus(null).restricted, false);
+    assert.equal(formatRestoreTime('not a date'), null);
+    assert.equal(formatRestoreTime(null), null);
+    assert.equal(typeof formatRestoreTime('2026-10-08T14:00:00+00:00', 'en-US'), 'string');
+});
+
+await check('pending warnings are read defensively, oldest first as sent', () => {
+    const warnings = parsePendingSafetyWarnings({
+        warnings: [
+            {
+                id: 'log-1', title: 'Warning', message: 'Please review the policy.', issued_at: '2026-10-07T12:00:00+00:00',
+                triggered_categories: [{ category: 'Hate', severity: 4 }, { category: 'Violence' }, { severity: 2 }, 'x'],
+            },
+            { id: 'log-2', message: 'No title.' },
+            { id: '', message: 'No id.' },
+            { id: 'log-3', message: '' },
+            null,
+        ],
+    });
+    assert.deepEqual(warnings.map((warning) => warning.id), ['log-1', 'log-2']);
+    assert.deepEqual(warnings[0].categories, [{ category: 'Hate', severity: 4 }, { category: 'Violence', severity: null }]);
+    assert.equal(warnings[1].title, 'Safety Violation Warning');
+    assert.equal(warnings[1].issuedAt, null);
+    assert.equal(describeSafetyWarningCategories(warnings[0].categories), 'Hate (severity 4), Violence');
+    assert.throws(() => parsePendingSafetyWarnings({ error: 'nope' }), /invalid/);
+});
+
+const WARNINGS = parsePendingSafetyWarnings({
+    warnings: [
+        { id: 'log-1', title: 'First', message: 'First warning.', issued_at: '2026-10-01T09:00:00+00:00' },
+        { id: 'log-2', title: 'Second', message: 'Second warning.' },
+    ],
+});
+const ids = () => useSafetyWarningStore.getState().warnings.map((warning) => warning.id);
+
+await check('a warning stays until it is acknowledged, and an old read cannot bring it back', async () => {
+    const store = useSafetyWarningStore;
+    store.getState().reset();
+    store.getState().receive(WARNINGS);
+    assert.deepEqual(ids(), ['log-1', 'log-2']);
+
+    requests.length = 0;
+    answer = () => json({ success: true, already_acknowledged: false, warning: {} });
+    assert.equal(await store.getState().acknowledge(WARNINGS[0]), true);
+    // The server is told which warning was read, so it can refuse one since replaced.
+    assert.deepEqual(requests, [{
+        url: '/api/safety/warnings/log-1/acknowledge',
+        method: 'POST',
+        body: { issued_at: '2026-10-01T09:00:00+00:00' },
+    }]);
+    assert.deepEqual(ids(), ['log-2']);
+
+    // A read that left before the acknowledgment landed still lists it.
+    store.getState().receive(WARNINGS);
+    assert.deepEqual(ids(), ['log-2']);
+});
+
+await check('a failed acknowledgment keeps the warning and says so', async () => {
+    const store = useSafetyWarningStore;
+    requests.length = 0;
+    answer = () => json({ error: 'Your acknowledgment could not be saved. Try again.' }, 500);
+    assert.equal(await store.getState().acknowledge(WARNINGS[1]), false);
+    // Without a send time, the acknowledgment names only the violation.
+    assert.deepEqual(requests[0].body, {});
+    assert.equal(store.getState().error, SAFETY_WARNING_ACKNOWLEDGE_ERROR);
+    assert.equal(store.getState().acknowledgingKey, null);
+    assert.deepEqual(ids(), ['log-2']);
+});
+
+await check('a warning the server no longer has is dropped', async () => {
+    const store = useSafetyWarningStore;
+    answer = () => json({ error: 'Warning not found.' }, 404);
+    assert.equal(await store.getState().acknowledge(WARNINGS[1]), true);
+    assert.deepEqual(store.getState().warnings, []);
+    assert.equal(store.getState().error, null);
+});
+
+const RESENT = parsePendingSafetyWarnings({
+    warnings: [{ id: 'log-1', title: 'Again', message: 'A second warning.', issued_at: '2026-10-05T09:00:00+00:00' }],
+});
+
+await check('a newer warning on the same violation shows after the earlier one was acknowledged', () => {
+    const store = useSafetyWarningStore;
+    // log-1 was acknowledged above. A reviewer then warned about the same violation again.
+    store.getState().receive([...WARNINGS, ...RESENT]);
+    assert.deepEqual(store.getState().warnings.map((warning) => warning.title), ['Again']);
+
+    // The same goes for one sent again after the earlier warning was withdrawn (log-2 above).
+    const again = parsePendingSafetyWarnings({
+        warnings: [{ id: 'log-2', title: 'Second again', message: 'Sent again.', issued_at: '2026-10-06T09:00:00+00:00' }],
+    });
+    store.getState().receive(again);
+    assert.deepEqual(store.getState().warnings.map((warning) => warning.title), ['Second again']);
+});
+
+await check('a warning replaced while on screen is dropped and the newer one is read', async () => {
+    const store = useSafetyWarningStore;
+    store.getState().reset();
+    const onScreen = parsePendingSafetyWarnings({
+        warnings: [{ id: 'log-7', title: 'Old', message: 'Old text.', issued_at: '2026-10-01T09:00:00+00:00' }],
+    });
+    const newer = { id: 'log-7', title: 'New', message: 'New text.', issued_at: '2026-10-02T09:00:00+00:00' };
+    store.getState().receive(onScreen);
+
+    requests.length = 0;
+    answer = (url, init) => {
+        if (init?.method === 'POST') {
+            return json({ error: 'A newer warning replaced this one.', code: 'safety_warning_replaced' }, 409);
+        }
+        return json({ warnings: [newer], count: 1 });
+    };
+    assert.equal(await store.getState().acknowledge(onScreen[0]), true);
+    assert.deepEqual(requests.map((request) => `${request.method} ${request.url}`), [
+        'POST /api/safety/warnings/log-7/acknowledge',
+        'GET /api/safety/warnings/pending',
+    ]);
+    assert.deepEqual(requests[0].body, { issued_at: '2026-10-01T09:00:00+00:00' });
+    assert.deepEqual(store.getState().warnings.map((warning) => warning.title), ['New']);
+    assert.equal(store.getState().error, null);
+
+    // Any other 409 is a failure to try again, not a replacement.
+    answer = () => json({ error: 'Conflict.' }, 409);
+    assert.equal(await store.getState().acknowledge(store.getState().warnings[0]), false);
+    assert.equal(store.getState().error, SAFETY_WARNING_ACKNOWLEDGE_ERROR);
+    assert.deepEqual(store.getState().warnings.map((warning) => warning.title), ['New']);
+});
+
+console.log(`${checks} checks passed`);
diff --git a/ui_tests/test_classic_safety_review_and_access_restricted.py b/ui_tests/test_classic_safety_review_and_access_restricted.py
new file mode 100644
index 000000000..b3c766712
--- /dev/null
+++ b/ui_tests/test_classic_safety_review_and_access_restricted.py
@@ -0,0 +1,313 @@
+# test_classic_safety_review_and_access_restricted.py
+"""
+Browser coverage for the classic safety review changes and the classic Access restricted page.
+Version: 0.261.297
+Implemented in: 0.261.297
+
+Render the real classic templates with Jinja and run the real local scripts behind a closed,
+in-memory API. Check that the admin review no longer offers Escalate, labels a legacy
+escalated record and offers its legacy action only on that record, describes which actions
+wait for a second reviewer, shows whether a sent warning was acknowledged without offering to
+resend it, and shows Blocked statistics with legacy escalations only when there are some; and
+that the classic Access restricted page renders the notice as text and shows the restore time
+in the reader's locale. Unexpected requests, page errors and browser dialogs fail.
+"""
+
+import copy
+import mimetypes
+from pathlib import Path
+from urllib.parse import unquote, urlsplit
+
+import pytest
+from jinja2 import ChainableUndefined, ChoiceLoader, DictLoader, Environment, FileSystemLoader, select_autoescape
+from playwright.sync_api import Page, expect
+
+from ui_tests.fixtures.playwright_connection import connect_options  # noqa: F401
+
+
+pytestmark = pytest.mark.ui
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+TEMPLATES = REPO_ROOT / "application" / "single_app" / "templates"
+STATIC = REPO_ROOT / "application" / "single_app" / "static"
+ORIGIN = "http://classic-safety.test"
+
+BASE_TEMPLATE = """<!doctype html>
+<html lang="en"><head><meta charset="UTF-8" />
+<title>{% block title %}{% endblock %}</title>
+<link rel="stylesheet" href="/static/css/bootstrap.min.css" />
+<link rel="stylesheet" href="/static/css/bootstrap-icons.min.css" />
+{% block head %}{% endblock %}
+</head><body>
+{% block content %}{% endblock %}
+<script src="/static/js/bootstrap/bootstrap.bundle.min.js"></script>
+{% block scripts %}{% endblock %}
+</body></html>"""
+
+LOGS = [
+    {
+        "id": "log-legacy", "user_id": "user-1", "message": "Legacy escalated record.", "status": "In-Review",
+        "action": "Escalate", "notes": "", "created_at": "2026-05-01T12:00:00Z", "last_updated": "2026-05-01T12:00:00Z",
+        "triggered_categories": [{"category": "Hate", "severity": 4}],
+    },
+    {
+        "id": "log-warned", "user_id": "user-2", "message": "Warned record.", "status": "Resolved",
+        "action": "WarnUser", "action_request_status": "executed", "notes": "Sent.",
+        "warning_requires_acknowledgment": True, "warning_acknowledgment_status": "pending",
+        "warning_acknowledged_at": None, "created_at": "2026-05-02T12:00:00Z", "last_updated": "2026-05-02T12:00:00Z",
+        "triggered_categories": [{"category": "Violence", "severity": 4}],
+    },
+    {
+        "id": "log-new", "user_id": "user-3", "message": "New record.", "status": "New", "action": "None",
+        "notes": "", "created_at": "2026-05-03T12:00:00Z", "last_updated": "2026-05-03T12:00:00Z",
+        "triggered_categories": [{"category": "Sexual", "severity": 2}],
+    },
+]
+
+
+class ClassicSafetyFixture:
+    """The classic admin safety review and Access restricted pages behind a closed API."""
+
+    def __init__(self, page: Page):
+        self.page = page
+        self.logs = copy.deepcopy(LOGS)
+        self.stats = {
+            "total_count": 3, "new_count": 1, "in_review_count": 1, "resolved_count": 1, "dismissed_count": 0,
+            "warn_user_count": 1, "suspend_user_count": 0, "escalate_count": 1, "block_user_count": 4,
+            "none_action_count": 1, "recent_30_day_count": 3,
+        }
+        self.restriction = None
+        self.patches = []
+        # Saves are answered with patch_reply, or held open until a test fulfills them.
+        self.patch_reply = (200, {"message": "Warning sent to the user.", "approval_required": False})
+        self.hold_patches = False
+        self.held = []
+        self.errors = []
+        self.unexpected = []
+        self.dialogs = []
+        page.on("pageerror", lambda error: self.errors.append(str(error)))
+        page.on("dialog", self._dialog)
+        page.route("**/*", self._route)
+
+    def _dialog(self, dialog):
+        self.dialogs.append(dialog.type)
+        dialog.dismiss()
+
+    def _render(self, template, **context):
+        environment = Environment(
+            loader=ChoiceLoader([DictLoader({"base.html": BASE_TEMPLATE}), FileSystemLoader(str(TEMPLATES))]),
+            undefined=ChainableUndefined,
+            autoescape=select_autoescape(["html"]),
+        )
+        endpoints = {"frontend_authentication.logout": "/logout", "public_app.index": "/"}
+        environment.globals["url_for"] = (
+            lambda endpoint, **values: endpoints.get(endpoint) or "/static/" + values.get("filename", "")
+        )
+        return environment.get_template(template).render(**context)
+
+    def _route(self, route):
+        request = route.request
+        url = urlsplit(request.url)
+        if not request.url.startswith(ORIGIN + "/"):
+            self.unexpected.append(request.url)
+            route.abort()
+            return
+        path = unquote(url.path)
+        if path.startswith("/static/"):
+            file = (STATIC / path.removeprefix("/static/")).resolve()
+            if file.is_relative_to(STATIC.resolve()) and file.is_file():
+                mime = "text/javascript" if file.suffix == ".js" else mimetypes.guess_type(str(file))[0] or "application/octet-stream"
+                route.fulfill(path=str(file), content_type=mime)
+                return
+        elif path == "/admin/safety_violations":
+            route.fulfill(body=self._render(
+                "admin_safety_violations.html",
+                app_settings={"app_title": "SimpleChat"},
+                settings={"enable_content_safety": True},
+            ), content_type="text/html")
+            return
+        elif path == "/access-restricted":
+            route.fulfill(body=self._render(
+                "access_restricted.html",
+                app_settings={"app_title": "SimpleChat", "show_logo": False, "hide_app_title": False},
+                restriction=self.restriction,
+                restore_display="2031-03-04 15:30 UTC",
+            ), content_type="text/html")
+            return
+        elif path == "/api/safety/logs/stats":
+            route.fulfill(json=self.stats)
+            return
+        elif path == "/api/safety/logs" and request.method == "GET":
+            route.fulfill(json={"logs": self.logs, "page": 1, "page_size": 10, "total_count": len(self.logs)})
+            return
+        elif path.startswith("/api/safety/logs/") and request.method == "PATCH":
+            self.patches.append((path.rsplit("/", 1)[-1], request.post_data_json))
+            if self.hold_patches:
+                self.held.append(route)
+                return
+            status, body = self.patch_reply
+            route.fulfill(status=status, json=body)
+            return
+        elif path == "/api/safety/chat-checks":
+            route.fulfill(json={"items": [], "continuation": None})
+            return
+        elif path.startswith("/api/user/info/"):
+            route.fulfill(json={"display_name": "Test User", "email": "user@contoso.test"})
+            return
+        elif path == "/favicon.ico":
+            route.fulfill(status=204)
+            return
+        self.unexpected.append(f"{request.method} {path}")
+        route.fulfill(status=404, json={"error": "Unexpected fixture request."})
+
+    def assert_clean(self):
+        assert not self.unexpected, self.unexpected
+        assert not self.errors, self.errors
+        assert not self.dialogs, self.dialogs
+
+
+@pytest.fixture
+def classic_ui(page):
+    fixture = ClassicSafetyFixture(page)
+    yield fixture
+    fixture.assert_clean()
+
+
+def _open_review(page, log_id):
+    page.locator(f'#safetyLogsTable button[data-log-id="{log_id}"][data-action="view"]').click()
+    modal = page.locator("#editModal")
+    expect(modal).to_be_visible()
+    return modal
+
+
+def test_admin_review_retires_escalate_and_shows_warning_state(classic_ui):
+    page = classic_ui.page
+    page.goto(f"{ORIGIN}/admin/safety_violations", wait_until="networkidle")
+
+    expect(page.locator("#safetyBlockedCount")).to_have_text("4")
+    expect(page.locator("#safetyStatsBlockSummary")).to_have_text("4")
+    expect(page.locator("#safetyStatsLegacyEscalateRow")).to_be_visible()
+    expect(page.locator("#safetyStatsLegacyEscalateSummary")).to_have_text("1")
+
+    page.get_by_role("tab", name="All Data").click()
+    filter_values = page.locator("#filterAction option").evaluate_all("options => options.map(option => option.value)")
+    assert filter_values == ["", "None", "WarnUser", "SuspendUser", "BlockUser"], filter_values
+    table = page.locator("#safetyLogsTable tbody")
+    expect(table).to_contain_text("Escalated (legacy)")
+
+    # A legacy record keeps its action, labelled as legacy; other records don't offer it.
+    modal = _open_review(page, "log-legacy")
+    expect(page.locator("#editAction")).to_have_value("Escalate")
+    expect(page.locator("#editAction option[value='Escalate']")).to_have_text("Escalated (legacy)")
+    expect(page.locator("#safetyWarningAcknowledgment")).to_be_hidden()
+    modal.locator(".btn-close").click()
+    expect(modal).to_be_hidden()
+
+    # A sent warning shows its acknowledgment state and is not offered for sending again.
+    modal = _open_review(page, "log-warned")
+    expect(page.locator("#editAction option[value='Escalate']")).to_have_count(0)
+    expect(page.locator("#safetyWarningAcknowledgment")).to_have_text("Warning sent. Not yet acknowledged by the user.")
+    expect(page.locator("#safetyRemediationHelp")).to_contain_text("already sent")
+    expect(page.locator("#safetyNotificationGroup")).to_be_hidden()
+    modal.locator(".btn-close").click()
+    expect(modal).to_be_hidden()
+
+    # A new warning is sent on save, while suspensions and blocks wait for another reviewer.
+    _open_review(page, "log-new")
+    page.locator("#editAction").select_option("SuspendUser")
+    expect(page.locator("#safetyRemediationHelp")).to_contain_text("another eligible reviewer approves it")
+    page.locator("#editAction").select_option("WarnUser")
+    expect(page.locator("#safetyRemediationHelp")).to_contain_text("as soon as you save, without a second reviewer")
+    expect(page.locator("#safetyNotificationGroup")).to_be_visible()
+    page.locator("#saveChangesBtn").click()
+    expect(page.locator("#safetyPageStatusAlert")).to_have_text("Warning sent to the user.")
+    log_id, payload = classic_ui.patches[-1]
+    assert log_id == "log-new" and payload["action"] == "WarnUser" and payload["notification_message"]
+
+
+def test_legacy_escalations_are_only_mentioned_when_there_are_some(classic_ui):
+    classic_ui.stats["escalate_count"] = 0
+    page = classic_ui.page
+    page.goto(f"{ORIGIN}/admin/safety_violations", wait_until="networkidle")
+    expect(page.locator("#safetyBlockedCount")).to_have_text("4")
+    expect(page.locator("#safetyStatsLegacyEscalateRow")).to_be_hidden()
+
+
+def test_save_waits_for_its_request_so_a_double_click_sends_one(classic_ui):
+    page = classic_ui.page
+    page.goto(f"{ORIGIN}/admin/safety_violations", wait_until="networkidle")
+    page.get_by_role("tab", name="All Data").click()
+    _open_review(page, "log-new")
+    page.locator("#editAction").select_option("WarnUser")
+    save = page.locator("#saveChangesBtn")
+
+    classic_ui.hold_patches = True
+    save.click()
+    expect(save).to_be_disabled()
+    expect(save).to_have_attribute("aria-busy", "true")
+    # A second click while the save is in flight does nothing.
+    save.dispatch_event("click")
+    page.evaluate("() => new Promise((resolve) => setTimeout(resolve, 150))")
+    assert len(classic_ui.patches) == 1, classic_ui.patches
+
+    classic_ui.hold_patches = False
+    classic_ui.held.pop().fulfill(json={"message": "Warning sent to the user.", "approval_required": False})
+    expect(page.locator("#safetyPageStatusAlert")).to_have_text("Warning sent to the user.")
+    expect(save).to_be_enabled()
+    expect(save).not_to_have_attribute("aria-busy", "true")
+    assert len(classic_ui.patches) == 1, classic_ui.patches
+
+    # A save the server refuses gives Save back, with the reason.
+    refused = (
+        "Another save of this violation got there first, so this one saved nothing and sent no "
+        "warning. Reload the violation in a moment to see the result."
+    )
+    classic_ui.patch_reply = (409, {"error": refused, "code": "safety_warning_in_progress"})
+    _open_review(page, "log-new")
+    page.locator("#editAction").select_option("WarnUser")
+    save.click()
+    expect(page.locator("#safetyEditStatus")).to_have_text(refused)
+    expect(save).to_be_enabled()
+    assert len(classic_ui.patches) == 2, classic_ui.patches
+
+
+def test_classic_access_restricted_page_shows_the_notice_and_local_restore_time(classic_ui):
+    classic_ui.restriction = {
+        "kind": "suspended",
+        "until": "2031-03-04T15:30:00+00:00",
+        "title": "Account Suspension Notice",
+        "message": "Suspended pending review.\n<b>Not bold</b>",
+        "reference_id": "safety-log-42",
+    }
+    page = classic_ui.page
+    page.goto(f"{ORIGIN}/access-restricted", wait_until="networkidle")
+
+    expect(page.get_by_role("heading", name="Account Suspension Notice")).to_be_visible()
+    message = page.get_by_test_id("access-restricted-message")
+    expect(message).to_contain_text("<b>Not bold</b>")
+    expect(message.locator("b")).to_have_count(0)
+    expected_local = page.evaluate(
+        "new Date('2031-03-04T15:30:00+00:00').toLocaleString(undefined, { dateStyle: 'full', timeStyle: 'short' })"
+    )
+    expect(page.locator("time[datetime='2031-03-04T15:30:00+00:00']")).to_have_text(expected_local)
+    expect(page.get_by_text("safety-log-42")).to_be_visible()
+    expect(page.get_by_role("link", name="Sign out")).to_have_attribute("href", "/logout")
+
+    page.set_viewport_size({"width": 390, "height": 844})
+    assert page.evaluate("document.documentElement.scrollWidth <= window.innerWidth")
+
+
+def test_classic_access_restricted_page_for_a_block_and_a_restored_account(classic_ui):
+    classic_ui.restriction = {
+        "kind": "blocked", "until": None, "title": "Your access has been blocked",
+        "message": "An administrator has blocked your access.", "reference_id": None,
+    }
+    page = classic_ui.page
+    page.goto(f"{ORIGIN}/access-restricted", wait_until="networkidle")
+    expect(page.get_by_text("No automatic restore date")).to_be_visible()
+    expect(page.locator("time")).to_have_count(0)
+
+    classic_ui.restriction = None
+    page.reload(wait_until="networkidle")
+    expect(page.get_by_role("heading", name="Your access is available")).to_be_visible()
+    expect(page.get_by_role("link", name="Continue")).to_have_attribute("href", "/")
diff --git a/ui_tests/test_v2_access_restricted_and_safety_warning.py b/ui_tests/test_v2_access_restricted_and_safety_warning.py
new file mode 100644
index 000000000..2b8a30bcb
--- /dev/null
+++ b/ui_tests/test_v2_access_restricted_and_safety_warning.py
@@ -0,0 +1,329 @@
+# test_v2_access_restricted_and_safety_warning.py
+"""
+Browser coverage for the V2 Access restricted page and the safety warning dialog.
+Version: 0.261.297
+Implemented in: 0.261.297
+
+Serve the real built SPA through Playwright request interception with a closed API
+boundary. Check that a restricted user whose first call is refused lands on the Access
+restricted page instead of an error, sees the administrator's notice as text, when access
+returns in their own locale, the violation reference and a Sign out link; that a block and
+a restored account read differently; that a safety warning appears in a dialog that Escape
+does not dismiss, is acknowledged with "I understand" naming when the warning read was sent,
+shows the next waiting warning, shows the newer warning when the one on screen was replaced,
+and stays when an acknowledgment fails; and that warnings are read only when bootstrap counts
+some, including when the reader comes back to the tab. Unexpected requests and page errors
+fail.
+"""
+
+import copy
+import sys
+from pathlib import Path
+from urllib.parse import urlsplit
+
+import pytest
+from playwright.sync_api import Page, Route, expect
+
+sys.path.insert(0, str(Path(__file__).resolve().parent / "fixtures"))
+
+from playwright_connection import connect_options  # noqa: E402,F401
+from v2_notification_stubs import is_notification_count, notification_count_payload  # noqa: E402
+
+
+pytestmark = pytest.mark.ui
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+STATIC_ROOT = REPO_ROOT / "application" / "single_app" / "static"
+SPA_INDEX = STATIC_ROOT / "v2" / "index.html"
+ORIGIN = "http://simplechat.test"
+
+SUSPENSION = {
+    "restricted": True,
+    "restriction": {
+        "kind": "suspended",
+        "until": "2031-03-04T15:30:00+00:00",
+        "title": "Account Suspension Notice",
+        "message": "Your access is suspended pending review.\n<b>Not bold</b>",
+        "reference_id": "safety-log-42",
+    },
+    "branding": {"app_title": "SimpleChat", "hide_app_title": False, "show_logo": False, "classification_banner": None},
+}
+
+WARNINGS = [
+    {
+        "id": "log-1",
+        "violation_id": "log-1",
+        "title": "Safety Violation Warning",
+        "message": "A safety review has been completed.\n<i>Plain text</i>",
+        "issued_at": "2026-10-07T12:00:00+00:00",
+        "acknowledged_at": None,
+        "triggered_categories": [{"category": "Hate", "severity": 4}],
+    },
+    {
+        "id": "log-2",
+        "violation_id": "log-2",
+        "title": "Second warning",
+        "message": "Please review the acceptable use policy.",
+        "issued_at": "2026-10-07T13:00:00+00:00",
+        "acknowledged_at": None,
+        "triggered_categories": [],
+    },
+]
+
+
+class RestrictionFixture:
+    """The V2 app with an in-memory API for access restrictions and safety warnings."""
+
+    def __init__(self, page: Page):
+        self.page = page
+        self.restricted_bootstrap = False
+        self.restriction_payload = copy.deepcopy(SUSPENSION)
+        self.warnings = []
+        self.pending_reads = 0
+        self.acknowledgments = []
+        self.acknowledgment_bodies = []
+        self.fail_next_acknowledgment = False
+        self.errors = []
+        self.unexpected_requests = []
+        page.on("pageerror", lambda error: self.errors.append(str(error)))
+        page.route("**/*", self._route)
+
+    def _bootstrap(self):
+        return {
+            "version": "0.261.297",
+            "user": {"id": "user-1", "display_name": "Test User", "email": "test.user@contoso.test",
+                     "is_admin": False, "roles": ["User"]},
+            "branding": {"app_title": "SimpleChat", "show_logo": False, "hide_app_title": False},
+            "features": {},
+            "catalogs": {"models": [], "agents": [], "prompts": [], "initial_model_selection": None},
+            "scope": {"groups": [], "public_workspaces": []},
+            "navigation": {"custom_pages": {"enabled": False, "items": []},
+                           "external_links": {"enabled": False, "items": []}},
+            "workspace": {"sections": {}},
+            "safety_warnings": {"pending": len(self.warnings)},
+            "settings": {},
+        }
+
+    def _route(self, route: Route):
+        request = route.request
+        parsed = urlsplit(request.url)
+        path = parsed.path
+        method = request.method
+        if f"{parsed.scheme}://{parsed.netloc}" != ORIGIN:
+            self.unexpected_requests.append(request.url)
+            route.abort()
+            return
+        if method == "GET" and (path == "/v2" or path.startswith("/v2/")):
+            route.fulfill(path=str(SPA_INDEX), content_type="text/html")
+        elif method == "GET" and path.startswith("/static/"):
+            asset = (STATIC_ROOT / path.removeprefix("/static/")).resolve()
+            if asset.is_relative_to(STATIC_ROOT.resolve()) and asset.is_file():
+                route.fulfill(path=str(asset))
+            else:
+                self.unexpected_requests.append(path)
+                route.fulfill(status=404, body="Fixture asset not found")
+        elif method == "GET" and path == "/api/v2/bootstrap":
+            if self.restricted_bootstrap:
+                route.fulfill(status=403, json={
+                    "error": "access_restricted",
+                    "message": "Your access to this application is temporarily suspended.",
+                    "restriction": self.restriction_payload.get("restriction"),
+                    "restricted_url": "/v2/access-restricted",
+                })
+            else:
+                route.fulfill(json=self._bootstrap())
+        elif method == "GET" and path == "/api/v2/access-restriction":
+            route.fulfill(json=self.restriction_payload, headers={"Cache-Control": "no-store"})
+        elif path == "/api/user/settings":
+            if self.restricted_bootstrap:
+                route.fulfill(status=403, json={"error": "access_restricted", "message": "Restricted."})
+            elif method == "GET":
+                route.fulfill(json={"settings": self.preferences})
+            else:
+                self.preferences.update(request.post_data_json["settings"])
+                route.fulfill(json={"message": "Saved."})
+        elif is_notification_count(method, path):
+            route.fulfill(json=notification_count_payload())
+        elif method == "GET" and path == "/api/approvals":
+            route.fulfill(json={"approvals": [], "total_count": 0, "total_pages": 1})
+        elif method == "GET" and path == "/api/safety/warnings/pending":
+            self.pending_reads += 1
+            route.fulfill(json={"warnings": self.warnings, "count": len(self.warnings)})
+        elif method == "POST" and path.startswith("/api/safety/warnings/") and path.endswith("/acknowledge"):
+            warning_id = path.removeprefix("/api/safety/warnings/").removesuffix("/acknowledge")
+            body = request.post_data_json or {}
+            self.acknowledgments.append(warning_id)
+            self.acknowledgment_bodies.append(body)
+            if self.fail_next_acknowledgment:
+                self.fail_next_acknowledgment = False
+                route.fulfill(status=500, json={"error": "Your acknowledgment could not be saved. Try again."})
+                return
+            current = next((item for item in self.warnings if item["id"] == warning_id), None)
+            if current and body.get("issued_at") and body["issued_at"] != current["issued_at"]:
+                route.fulfill(status=409, json={
+                    "error": "A newer warning replaced this one. Read the newer warning, then acknowledge it.",
+                    "code": "safety_warning_replaced",
+                })
+                return
+            self.warnings = [item for item in self.warnings if item["id"] != warning_id]
+            route.fulfill(json={"success": True, "already_acknowledged": False, "warning": {"id": warning_id}})
+        else:
+            self.unexpected_requests.append(f"{method} {path}")
+            route.fulfill(status=404, json={"error": "Unexpected fixture request."})
+
+    def open(self, path, *, width=1440, height=900):
+        if not SPA_INDEX.is_file():
+            pytest.fail("Build the V2 SPA first: npm --prefix application/v2_ui run build")
+        self.preferences = {"darkModeEnabled": False, "v2RailCollapsed": width < 1024}
+        self.page.set_viewport_size({"width": width, "height": height})
+        self.page.goto(f"{ORIGIN}{path}", wait_until="networkidle")
+
+    def assert_clean(self):
+        assert not self.unexpected_requests, self.unexpected_requests
+        assert not self.errors, self.errors
+
+
+@pytest.fixture
+def restriction_ui(page):
+    fixture = RestrictionFixture(page)
+    yield fixture
+    fixture.assert_clean()
+
+
+def test_restricted_user_lands_on_the_access_restricted_page(restriction_ui):
+    restriction_ui.restricted_bootstrap = True
+    restriction_ui.open("/v2/approvals")
+    page = restriction_ui.page
+
+    expect(page).to_have_url(f"{ORIGIN}/v2/access-restricted")
+    panel = page.get_by_test_id("v2-access-restricted")
+    expect(panel).to_be_visible()
+    expect(page.get_by_role("heading", name="Account Suspension Notice")).to_be_visible()
+    message = page.get_by_test_id("v2-access-restricted-message")
+    expect(message).to_contain_text("<b>Not bold</b>")
+    expect(message.locator("b")).to_have_count(0)
+    expect(page.get_by_text("Could not start SimpleChat")).to_have_count(0)
+    expect(page.get_by_text("Your session has expired")).to_have_count(0)
+
+    until = page.get_by_test_id("v2-access-restricted-until").locator("time")
+    expect(until).to_have_attribute("datetime", "2031-03-04T15:30:00+00:00")
+    expected_local = page.evaluate(
+        "new Date('2031-03-04T15:30:00+00:00').toLocaleString(undefined, { dateStyle: 'full', timeStyle: 'short' })"
+    )
+    expect(until).to_have_text(expected_local)
+    expect(page.get_by_test_id("v2-access-restricted-reference")).to_have_text("safety-log-42")
+    expect(page.get_by_test_id("v2-access-restricted-signout")).to_have_attribute("href", "/logout")
+    assert page.title() == "Access restricted - SimpleChat"
+
+
+def test_block_and_restored_account_read_differently(restriction_ui):
+    restriction_ui.restriction_payload = {
+        "restricted": True,
+        "restriction": {"kind": "blocked", "until": None, "title": "Account Access Blocked",
+                        "message": "Blocked for repeated violations.", "reference_id": None},
+        "branding": {"app_title": "SimpleChat", "hide_app_title": False, "show_logo": False},
+    }
+    restriction_ui.open("/v2/access-restricted", width=390, height=844)
+    page = restriction_ui.page
+    expect(page.get_by_role("heading", name="Account Access Blocked")).to_be_visible()
+    expect(page.get_by_test_id("v2-access-restricted-until")).to_contain_text("No automatic restore date")
+    expect(page.get_by_test_id("v2-access-restricted-reference")).to_have_count(0)
+    expect(page.get_by_test_id("v2-access-restricted-signout")).to_be_visible()
+    assert page.evaluate("document.documentElement.scrollWidth <= window.innerWidth")
+
+    restriction_ui.restriction_payload = {"restricted": False, "branding": {"app_title": "SimpleChat"}}
+    page.reload(wait_until="networkidle")
+    expect(page.get_by_role("heading", name="Your access is available")).to_be_visible()
+    expect(page.get_by_test_id("v2-access-restricted-continue")).to_have_attribute("href", "/v2")
+
+
+def test_safety_warning_must_be_acknowledged(restriction_ui):
+    restriction_ui.warnings = copy.deepcopy(WARNINGS)
+    restriction_ui.open("/v2/approvals")
+    page = restriction_ui.page
+
+    dialog = page.get_by_role("dialog", name="A warning from your administrators")
+    expect(dialog).to_be_visible()
+    expect(dialog.get_by_role("heading", name="Safety Violation Warning")).to_be_visible()
+    expect(dialog).to_contain_text("Warning 1 of 2.")
+    message = dialog.get_by_test_id("v2-safety-warning-message")
+    expect(message).to_contain_text("<i>Plain text</i>")
+    expect(message.locator("i")).to_have_count(0)
+    expect(dialog).to_contain_text("Hate (severity 4)")
+    expect(dialog.get_by_role("button", name="Close")).to_have_count(0)
+
+    page.keyboard.press("Escape")
+    expect(dialog).to_be_visible()
+
+    dialog.get_by_role("button", name="I understand").click()
+    expect(dialog.get_by_role("heading", name="Second warning")).to_be_visible()
+    expect(dialog).not_to_contain_text("Warning 1 of")
+    dialog.get_by_role("button", name="I understand").click()
+    expect(page.get_by_role("dialog", name="A warning from your administrators")).to_have_count(0)
+    assert restriction_ui.acknowledgments == ["log-1", "log-2"]
+    # Each acknowledgment names when the warning read was sent.
+    assert restriction_ui.acknowledgment_bodies == [
+        {"issued_at": WARNINGS[0]["issued_at"]},
+        {"issued_at": WARNINGS[1]["issued_at"]},
+    ]
+
+
+def test_a_warning_replaced_while_on_screen_shows_the_newer_one(restriction_ui):
+    restriction_ui.warnings = copy.deepcopy(WARNINGS[:1])
+    restriction_ui.open("/v2/approvals")
+    page = restriction_ui.page
+
+    dialog = page.get_by_role("dialog", name="A warning from your administrators")
+    expect(dialog.get_by_role("heading", name="Safety Violation Warning")).to_be_visible()
+
+    # While it is on screen, a reviewer warns about the same violation again.
+    restriction_ui.warnings = [{
+        **copy.deepcopy(WARNINGS[0]),
+        "title": "Updated warning",
+        "message": "Please read this newer warning.",
+        "issued_at": "2026-10-08T09:00:00+00:00",
+    }]
+    dialog.get_by_role("button", name="I understand").click()
+    expect(dialog.get_by_role("heading", name="Updated warning")).to_be_visible()
+    expect(dialog.get_by_test_id("v2-safety-warning-message")).to_have_text("Please read this newer warning.")
+    expect(dialog.get_by_role("alert")).to_have_count(0)
+    assert restriction_ui.pending_reads == 2
+
+    dialog.get_by_role("button", name="I understand").click()
+    expect(page.get_by_role("dialog", name="A warning from your administrators")).to_have_count(0)
+    assert restriction_ui.acknowledgment_bodies == [
+        {"issued_at": "2026-10-07T12:00:00+00:00"},
+        {"issued_at": "2026-10-08T09:00:00+00:00"},
+    ]
+
+
+def test_failed_acknowledgment_keeps_the_warning(restriction_ui):
+    restriction_ui.warnings = copy.deepcopy(WARNINGS[:1])
+    restriction_ui.fail_next_acknowledgment = True
+    restriction_ui.open("/v2/approvals")
+    page = restriction_ui.page
+
+    dialog = page.get_by_role("dialog", name="A warning from your administrators")
+    expect(dialog).to_be_visible()
+    dialog.get_by_role("button", name="I understand").click()
+    expect(dialog.get_by_role("alert")).to_have_text("Your acknowledgment could not be saved. Try again.")
+    expect(dialog).to_be_visible()
+
+    dialog.get_by_role("button", name="I understand").click()
+    expect(page.get_by_role("dialog", name="A warning from your administrators")).to_have_count(0)
+    assert restriction_ui.acknowledgments == ["log-1", "log-1"]
+
+
+def test_warnings_are_read_only_when_bootstrap_counts_some(restriction_ui):
+    restriction_ui.open("/v2/approvals")
+    page = restriction_ui.page
+    expect(page.get_by_test_id("v2-approvals-page")).to_be_visible()
+    expect(page.get_by_role("dialog", name="A warning from your administrators")).to_have_count(0)
+    assert restriction_ui.pending_reads == 0
+
+    # A warning sent while the tab was away shows when the reader comes back to it.
+    restriction_ui.warnings = copy.deepcopy(WARNINGS[1:])
+    page.evaluate("window.dispatchEvent(new Event('focus'))")
+    dialog = page.get_by_role("dialog", name="A warning from your administrators")
+    expect(dialog.get_by_role("heading", name="Second warning")).to_be_visible()
+    assert restriction_ui.pending_reads == 1