@open-everywhere/core 0.1.0

package/agent/approvals/flow.ts

@@ -0,0 +1,2185 @@
+// The propose and click halves of the in-chat approvals plane: `requestApproval` freezes the args and posts the code-rendered card, `resolveApprovalClick` is the ONE decide implementation every surface's click funnels through, and `handleApprovalPayload` owns the Slack click end to end and never throws.
+// Deliberately separate from eve's native HITL, which carries no approver policy, no frozen-args card and no audit trail; revisit only if eve's own HITL grows them.
+
+import { createHash, randomUUID } from "node:crypto";
+import { getOperationalStore } from "../operational/provider.js";
+import { appendAudit } from "../audit/audit.js";
+import { getConfig } from "../access/config.js";
+import { swallowRoomOp, swallowRoomPost } from "../channels/egress-spoof.js";
+import { admitProviderRegistration } from "../access/provider-selection.js";
+import { criteriaDomain } from "../memory/domain.js";
+import { bridgeSlackForm } from "../channels/slack-bridge.js";
+import { emitTelemetry } from "../observability/telemetry.js";
+import { grainUsesUnifiedWindow, supervisorGrainFor } from "../channels/unified-supervisor.js";
+import { mintWakeId, type UnifiedWakeOrigin } from "../channels/unified-window.js";
+import { dispatchApprovalDecisionWake } from "../channels/unified.js";
+import { postSurfaceText, surfaceMessageOps } from "../channels/surface-message-ops.js";
+import { renderApprovalDecisionMessage, type ApprovalOutcome } from "./decision-wake.js";
+import {
+  captureApprovalDecisionAuthority,
+  readApprovalDecisionAuthority,
+  rememberApprovalDecisionAuthority,
+} from "./decision-authority.internal.js";
+import { actionKind, whereFromScope } from "./actions.js";
+import {
+  approvalModeForDomain,
+  approversForScopeKey,
+  chainAuditDetail,
+  preApprovalRulesForScopeKey,
+  resolveApproverChain,
+  toolForActionKind,
+  type ApprovalChainRequest,
+} from "../access/approver-chain.js";
+import { shadowJudgeAuditDetail } from "../access/approval-judge.js";
+import { RESUME_TOOL, TOOL_CONSEQUENCE } from "../access/consequence.js";
+import { haltAuditDetail, haltRefusalMessage, haltScopeFor, resolveHalt, type HaltDeps } from "../access/halt.js";
+import { parseScopeKey, platformOfScopeKey } from "../access/scope-key.js";
+import { tryPrincipalKey } from "../identity/principal-key.js";
+import { checkClickerFloor, clickRoomMatches, clickerFloorRefusalNotice, type ClickerFloorRefusal } from "./clicker-floor.js";
+import { checkCardDisclosure, cardDisclosureRefusalNotice } from "./card-disclosure.js";
+import { pendingCardBlocks, decidedCardBlocks, judgeLiftNoticeBlocks, judgeLiftNoticeText, type RenderedCard } from "./card.js";
+import { contradictJudgeAllow, judgeContradictionNotice, type ContradictJudgeAllowOutcome } from "./judge-contradiction.js";
+import { describeDeclaredPermissionKind, sessionGrantKind } from "./session-grant.js";
+import {
+  consumeCardPostedThisTurn,
+  markCardPostedThisTurn,
+  noteRoutineRunPermissionRefusal,
+  peekCardPostedThisTurn,
+} from "./card-signal.js";
+import { withTaintDisclosure } from "./taint-disclosure.js";
+import { withArmingApproval } from "./arming-context.js";
+import { getSettings } from "../settings/settings.js";
+import type { ActionKind, PendingActionRow, PendingStatus } from "./types.js";
+import type { BindableContext } from "../identity/binding.js";
+// The ActionKind registrations below are side-effect imports, placed at this click-path entry point so a click resolves its kind regardless of which propose tool ran first. None of these modules imports flow.ts, so none of them closes a cycle.
+import "./memory-purge.js";
+import "./access-request.js";
+// `memory.remember` is GONE (OPE-389): memory writes are ordinary file edits captured at session end, and their gate is the taint fence plus the destructive-write floor, not a card.
+import "./skill-create.js";
+import "./routine-create.js";
+import "./pr-open.js";
+import "./skill-delete.js";
+import "./routine-cancel.js";
+import "./routine-lifecycle.js";
+import "./routine-policy.js";
+// The webhook kinds are the only ones whose `execute` MINTS a secret, which is why they live behind a code-rendered card and a verified clicker — the model proposes a source and a posture and is never in the mint path.
+import "./webhook.js";
+import "./webhook-declare.js";
+import "./agent-create.js";
+import "./ticket-actions.js";
+import "./ticket-create.js";
+import "./chat-post.js";
+import "./chat-dm.js";
+import "./session-checkpoint.js";
+// The `routine.permission` kind. The NAMED imports are what carries the registration side effect here — a type-only import would drop it.
+import { ROUTINE_PERMISSION_KIND, parseRoutinePermissionArgs, routineCardGenerationState } from "./routine-permission.js";
+import {
+  markRoutinePermissionAsked,
+  planRoutinePermissionCard,
+  routineCardArmedBy,
+  routineCardProbe,
+  routinePermissionCardPointer,
+  routinePermissionRefusalClause,
+  type RoutineCardPointer,
+  type RoutinePermissionCardState,
+} from "../routines/permission-card.js";
+import { routineCardKeepsStateClause, routineCardWaitBudgetMs, routineCardWaitRefusalClause, waitForRoutineCardDecision } from "../routines/permission-card-wait.js";
+// The refusal-site seam (OPE-1357). This module fills the slot at load; the unattended connector
+// fence reads it. A LEAF import — routine-permission-offer.ts imports nothing at all.
+import {
+  registerRoutinePermissionCardOfferer,
+  type RoutinePermissionCardOffer,
+  type RoutinePermissionCardResult,
+} from "./routine-permission-offer.js";
+import { ROUTINE_PERMISSION_NO_EXPIRY } from "../routines/declared-permissions.js";
+// The per-turn slot, read for the wedge id's turn scope (OPE-1348). A LEAF import — turn-clock.ts
+// imports `eve/context` and nothing else in the tree, so it closes no cycle here either.
+import { readTurnClock } from "../observability/turn-clock.js";
+
+/** Every button/action_id this feature owns is prefixed with this — the front route's
+ *  classify step uses it to decide "ours" vs. "forward to Eve" (e.g. Eve's own `eve_input:`
+ *  HITL buttons). Also embedded literally (not imported) in card.ts's button `action_id`s —
+ *  see card.ts's import of this same constant; kept as ONE source of truth. */
+export const OE_APPROVAL_PREFIX = "oe_approval:";
+
+/** A minimal structural type for the real/injected Slack `chat.*` client — matches
+ *  agent/channels/slack-events.ts's `slackForm` signature exactly, so the real one satisfies
+ *  it with no adapter. */
+type PostFn = (method: string, body: string) => Promise<Record<string, unknown> | undefined>;
+
+/** A click decision. `approve_session` approves this proposal AND remembers the granting session, but only on a GRANTABLE kind — exactly one is grantable (`pr.open`); on every other kind the verb degrades to a one-off `approve` and grants nothing. */
+export type ApprovalDecision = "approve" | "reject" | "approve_session" | "contradict";
+
+/** Every decision word the click grammar accepts, as one list — the parser's membership test and
+ *  approvals-test.ts's pin read the same array, so a new verb cannot reach one and miss the other. */
+const APPROVAL_DECISIONS: readonly ApprovalDecision[] = ["approve", "reject", "approve_session", "contradict"];
+
+/** Parse an `oe_approval:{decision}:{id}` action_id. Returns null for anything else, including a well-formed-looking id with a garbage decision segment, so a caller can treat "not parseable" as "not ours" without a second check. */
+export function parseApprovalAction(actionId: string): { decision: ApprovalDecision; id: string } | null {
+  if (!actionId.startsWith(OE_APPROVAL_PREFIX)) return null;
+  const rest = actionId.slice(OE_APPROVAL_PREFIX.length);
+  const sep = rest.indexOf(":");
+  if (sep < 0) return null;
+  const decision = rest.slice(0, sep) as ApprovalDecision;
+  const id = rest.slice(sep + 1);
+  if (!APPROVAL_DECISIONS.includes(decision) || id.length === 0) return null;
+  return { decision, id };
+}
+
+/** TTL (hours) for a session-approval memo (OPE-53) — a GC bound, NOT the death mechanism (the memo's
+ *  session_id embeds the window generation, so a rotation misses it regardless). Declared in
+ *  `agent/settings/settings.ts`; `defineSettings` refuses a non-positive value at boot. */
+function sessionApprovalTtlHours(): number {
+  return getSettings().approvals.sessionTtlHours;
+}
+
+/** The bare session/window token frozen into a pr.open pending's args (OPE-53), or undefined when the
+ *  proposing turn couldn't be identified (⇒ no session skip was ever offered — the memo stays unset).
+ *  Read generically off the frozen JSON — the click core never imports pr-open's arg shape. */
+function sessionIdFromFrozenArgs(argsJson: string): string | undefined {
+  try {
+    const parsed = JSON.parse(argsJson) as { sessionId?: unknown };
+    return typeof parsed.sessionId === "string" && parsed.sessionId.length > 0 ? parsed.sessionId : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Default TTL (hours) before a pending action lazily expires. Declared in
+ *  `agent/settings/settings.ts`; `defineSettings` refuses a non-positive value at boot. */
+function approvalTtlHours(): number {
+  return getSettings().approvals.ttlHours;
+}
+
+/**
+ * WHERE the card was, and therefore where the decision was made. An `approval.*` row's own where-columns come from the ASKING scope, and a REDIRECTED card lands in a room that appears nowhere in the scopeKey. Additive detail only — the partition is deliberately untouched.
+ * 🔴 A VENUE FIELD ONLY EVER CARRIES A REAL PLATFORM IDENTIFIER: a domain-level or principal-level scopeKey names no room, so those rows leave the two keys ABSENT rather than borrow a pseudo-workspace every audit reader filtering on a workspace would silently absorb.
+ */
+export interface DecisionVenueDetail {
+  readonly venuePlatform?: string;
+  readonly venueWorkspace?: string;
+  readonly venueChannel?: string;
+}
+
+/** The (platform, workspace, channel) a ROOM key names, or undefined when it names no room —
+ *  `roomNamespace`'s three-field twin. Same fail-closed grammar read: only the `tenant`/`surface`
+ *  kinds are rooms; a bare domain name or a `user:` principal key is not one. */
+function venueRoom(key: string | undefined | null): { readonly platform: string; readonly workspace: string; readonly channel?: string } | undefined {
+  if (!key) return undefined;
+  const parsed = parseScopeKey(key);
+  if (parsed.kind === "surface") return { platform: parsed.platform, workspace: parsed.workspace, channel: parsed.surface };
+  if (parsed.kind === "tenant") return { platform: parsed.platform, workspace: parsed.workspace };
+  return undefined;
+}
+
+/**
+ * Resolve the venue for one decision. Order is AVAILABILITY, not authority: the mint-frozen `postedTo` (the only rung that can be right for a REDIRECTED card), then the room the click came from, then the asking scope for rows minted before `postedTo` existed.
+ * The CHANNEL comes from `channelId` first: that is by construction the channel the card was posted into, whereas a scopeKey can name a FOREIGN surface under an explicit-scope override.
+ */
+function venueDetail(
+  where: { readonly postedTo?: string | null; readonly channelId?: string | null; readonly scopeKey: string },
+  clickSurfaceKey?: string,
+): DecisionVenueDetail {
+  const room = venueRoom(where.postedTo) ?? venueRoom(clickSurfaceKey) ?? venueRoom(where.scopeKey);
+  const channel = where.channelId ?? room?.channel;
+  return {
+    ...(room ? { venuePlatform: room.platform, venueWorkspace: room.workspace } : {}),
+    ...(channel ? { venueChannel: channel } : {}),
+  };
+}
+
+/** The fully-qualified surfaceKey of the surface a card is posted to, frozen at mint. The binding's workspace IS the workspace the card lands in, which is what makes mint-time as authoritative as the click payload's own team/guild id. */
+export function postedToSurfaceKey(binding: { readonly platform: string; readonly workspace: string }, channelId: string): string {
+  return `${binding.platform}/${binding.workspace}/${channelId}`;
+}
+
+export interface RequestApprovalInput {
+  readonly org: string;
+  readonly kind: string;
+  /** The FROZEN mutation args — validated by the caller against the kind's own arg shape
+   *  BEFORE calling this (requestApproval only checks the kind is registered). */
+  readonly args: unknown;
+  readonly scopeKey: string;
+  readonly domain?: string | null;
+  readonly requestedBy: string;
+  readonly channelId: string;
+  readonly threadTs?: string | null;
+  /** The fully-qualified surfaceKey of the PROPOSING surface the card is posted to, frozen at mint because scopeKey is NOT a workspace source. Absent ⇒ the row freezes NULL and a sweep expiry is audit-only. */
+  readonly postedTo?: string | null;
+  /**
+   * OPTIONAL display-only body lines for the PENDING card, overriding `kind.summarize(args)` — for a kind whose frozen args deliberately REDACT what the approver must still read before clicking (memory.purge freezes only the bullets' hashes).
+   * INVARIANT: they must be rendered by CODE from the same source data the args were frozen from, never model text, so the approver still reads exactly what will execute. Never persisted; click-time re-renders use summarize(frozen args).
+   */
+  readonly summaryLines?: readonly string[];
+  /**
+   * APPROVER-CHAIN context the caller can see and this function cannot: requestApproval takes no ctx by design (the control plane calls it headless), so the turn's signals are supplied by the propose tool.
+   * 🔴 `unattended` IS REQUIRED, and an absent `chain` bag defaults it to `true`: a safety control whose unknown state reads as SAFE is not a control. Derive it with `unattendedOf(ctx)` — lint:principal-gate rule 5 refuses any other spelling. `tainted` stays optional and falls back to the chain's own in-turn signal.
+   */
+  readonly chain?: {
+    readonly unattended: boolean;
+    readonly tainted?: boolean;
+  };
+  /**
+   * Mint this pending with NO CLOCK — the far-future sentinel instead of `now + approvals.ttlHours`. A FLAG, NOT A DATE: an arbitrary `expiresAt` would let a propose site mint a row already in the past, whose card posts into the room and whose every click then resolves "expired".
+   * 🔴 Nothing expires such a row on a clock, by construction; the routine GENERATION bounds its authority instead, and an ignored card must stay clickable. A SUPERSEDED `routine.permission` card is reaped by the sweep's second pass, which is scoped to that ONE kind — a future kind setting this flag owes the sweep its own reaper.
+   */
+  readonly noClockExpiry?: true;
+}
+
+/** Post the code-rendered card for `row` and resolve to the posted message's platform id, or undefined on ANY failure — implementations must never throw. requestApproval treats undefined as "the card never made it", marks the pending expired and throws its own error. */
+export type CardPoster = (row: PendingActionRow, summaryLines: readonly string[]) => Promise<string | undefined>;
+
+// A non-Slack surface owns its own approval-card render and post, registered here from its own bundle — a vendor import cannot cross the bundle boundary.
+// Slack is deliberately NOT registered: an absent poster means the built-in Block Kit render below.
+const CARD_POSTERS = new Map<string, CardPoster>();
+
+/** Register (or replace) a platform's approval-card poster. Called once per bundle at boot. */
+export function registerCardPoster(platform: string, poster: CardPoster): void {
+  if (!admitProviderRegistration(platform, "approval-card-poster")) return;
+  CARD_POSTERS.set(platform, poster);
+}
+
+/** The card poster for `platform`, or undefined (Slack, or any unregistered surface → the default
+ *  render path). The propose tools resolve `{ postCard: cardPosterFor(platform) }` from this. */
+export function cardPosterFor(platform: string | undefined): CardPoster | undefined {
+  return platform === undefined ? undefined : CARD_POSTERS.get(platform);
+}
+
+/**
+ * Post the judge-lift NOTICE into the room the card would have gone to — the room's only trace of an act nobody was asked about, carrying the one "This should not have run" button. That button must carry the `contradict` verb bound to `row.id`, in whatever envelope the surface uses.
+ * BEST-EFFORT BY CONTRACT: implementations must never throw. The frozen args have already executed and the audit rows are written, so a failed post must never turn a completed action into a thrown error; nothing consumes a return value.
+ */
+export type JudgeLiftNoticePoster = (row: PendingActionRow, summaryLines: readonly string[], outcomeLine: string) => Promise<void>;
+
+const JUDGE_LIFT_NOTICE_POSTERS = new Map<string, JudgeLiftNoticePoster>();
+
+/** Register (or replace) a platform's judge-lift notice poster. Called once per bundle at boot.
+ *  Slack is deliberately NOT registered — its notice is the built-in Block Kit render below, the
+ *  same way it is the built-in renderer for the pending card. */
+export function registerJudgeLiftNoticePoster(platform: string, poster: JudgeLiftNoticePoster): void {
+  if (!admitProviderRegistration(platform, "judge-lift-notice-poster")) return;
+  JUDGE_LIFT_NOTICE_POSTERS.set(platform, poster);
+}
+
+/** The judge-lift notice poster for `platform`, or undefined — Slack (whose notice is the built-in
+ *  Block Kit render below) and every surface with no component plane, which takes the shared TEXT
+ *  render instead. A registered poster is the BUTTON arm, never the whole road. */
+export function judgeLiftNoticePosterFor(platform: string | undefined): JudgeLiftNoticePoster | undefined {
+  return platform === undefined ? undefined : JUDGE_LIFT_NOTICE_POSTERS.get(platform);
+}
+
+/** How the judge-lift notice renders on one surface — the three arms of {@link postJudgeLiftNotice},
+ *  and the answer {@link judgeLiftNoticeRenderFor} gives. `none` is a room this deployment cannot
+ *  post into at all. */
+export type JudgeLiftNoticeRender = "poster" | "blocks" | "text" | "none";
+
+/**
+ * WHICH arm renders the judge-lift notice for `platform`. ONE ROAD, THREE RENDERS (OPE-1854): a bundle's registered poster carries the contradict BUTTON in its own envelope; Slack takes core's built-in Block Kit render; every other surface with a text transport takes the shared plain-text render, which spells the overrule out in words because no button can land there.
+ * 🔴 IT IS A CAPABILITY QUESTION, NOT A PLATFORM LIST — the same shape as {@link hasApprovalCardPath}. A surface reaches `none` only by registering no notice poster AND no `SurfaceMessageOps` transport, which is a room nothing can be posted into, and the parity gate reads this so such a silence has to be declared rather than discovered in production.
+ */
+export function judgeLiftNoticeRenderFor(platform: string | undefined): JudgeLiftNoticeRender {
+  if (platform === undefined) return "none";
+  if (JUDGE_LIFT_NOTICE_POSTERS.has(platform)) return "poster";
+  if (platform === "slack") return "blocks";
+  return surfaceMessageOps(platform) !== undefined ? "text" : "none";
+}
+
+/** Does a judge-lifted act leave a trace in a `platform` room at all? The predicate the surface-parity
+ *  gate probes its `judge-lift-notice` cell with. */
+export function hasJudgeLiftNoticePath(platform: string): boolean {
+  return judgeLiftNoticeRenderFor(platform) !== "none";
+}
+
+/**
+ * THE ONE ROAD the judge-lift notice takes, on every surface. It resolves the render for the frozen platform and posts it, and it NEVER THROWS: the frozen args have already executed and the audit rows are written, so a failed post must never report a completed mutation as a failed tool call.
+ * The card's audience-disclosure gate also protects this notice because both renders carry the same code-owned action summary. It suppresses only the notice: the action has already run and keeps its successful result and audit trail.
+ * 🔴 The egress-spoof gate runs BEFORE any POST transport, never inside one — a registered poster owns its own vendor call — and OUTSIDE the `try`, because its Vercel refusal is a deploy misconfiguration the best-effort catch must not eat. The price, accepted: on that refusal a completed mutation is reported as a failed tool call and loses its audit row.
+ */
+async function postJudgeLiftNotice(
+  platform: string | undefined,
+  post: PostFn,
+  input: { readonly kind: string; readonly scopeKey: string; readonly channelId: string; readonly threadTs?: string | null; readonly postedTo?: string | null },
+  row: PendingActionRow,
+  summarize: () => readonly string[],
+  outcomeLine: string,
+): Promise<void> {
+  const render = judgeLiftNoticeRenderFor(platform);
+  if (render === "none") return;
+  if (input.postedTo && !(await checkCardDisclosure(input.postedTo)).ok) return;
+  if (swallowRoomOp(`a judge-lift notice for "${input.kind}" (${input.scopeKey})`)) return;
+  // `try`/`catch`, not `.catch()`: a poster that throws SYNCHRONOUSLY never returns a promise to attach a handler to. The kind's own `summarize` runs INSIDE it for the same reason the post does — the frozen args have already executed, so a throw from either would report a completed mutation as a failed tool call AND skip its `approval.autoapproved` row.
+  try {
+    const noticeLines = summarize();
+    if (render === "poster") await judgeLiftNoticePosterFor(platform)!(row, noticeLines, outcomeLine);
+    else if (render === "blocks") await postRenderedCard(post, input.channelId, input.threadTs, judgeLiftNoticeBlocks(row, noticeLines, outcomeLine));
+    // `postSurfaceText` is itself fail-soft and logs the transport's own reason with the surface
+    // context this frame does not have — the same division of labour the poster arm has.
+    // `threadTs` is honoured by the Slack arm and IGNORED by every registered `SurfaceMessageOps`
+    // transport, so on those surfaces the notice lands in the container rather than under the
+    // proposing message. That is a property of the shared post seam, not of this caller —
+    // channels/hooks/turn-anchor.ts's cancel note passes it on the same terms — and the notice is
+    // about the room, so the container is the right audience either way.
+    else await postSurfaceText(platform!, { channelId: input.channelId, text: judgeLiftNoticeText(row, noticeLines, outcomeLine), threadTs: input.threadTs });
+  } catch {
+    // Deliberately silent here: each poster logs its own failure with the surface context this
+    // frame does not have (discord-flow.ts's `postDiscordCardMessage` names the channel).
+  }
+}
+
+/**
+ * The approver chain LOWERED a gated verb, so nothing was proposed: the frozen args already EXECUTED, and `outcome` is what the kind's own `execute` returned. `resolvedBy` names the chain ELEMENT that produced the verdict and only ever that — a mode lift records itself in `ChainResolution.transforms` instead.
+ * 🔴 Do NOT write a discriminator against a closed list of element names: the surface elements are latent today rather than absent, and a caller for either one puts its name here without touching this file.
+ */
+export interface AutoApprovedOutcome {
+  readonly outcome: string;
+  readonly resolvedBy: string;
+  /** The HUMAN whose click let this run proceed — set only on the routine permission card's in-window approval, absent on every chain lift. A chain lift is config-reviewed policy acting with nobody present; reporting the second as the first would tell a routine's owner the machine decided something they decided. */
+  readonly grantedBy?: string;
+}
+
+/** 🔴 It EXTENDS the seam's result rather than being it: `armedBy` is the field that turns this plane's deny into an allow, so it must not reach a refusal site through the registry — the slot's return type carries `clause` alone, and the registration at the foot of this file drops the rest at that boundary. */
+interface RoutinePermissionCardOutcome extends RoutinePermissionCardResult {
+  /** The HUMAN whose click let this run proceed — set only when a person approved the card inside
+   *  the timed wait AND the standing grant row is really written. */
+  readonly armedBy?: string;
+  /** Did a timed wait really run? The standing advice says an unattended run "cannot wait on an approval card", which is false once this run has just spent the budget doing exactly that — so the advice reads off this rather than off the setting. */
+  readonly waited?: boolean;
+}
+
+/** What {@link requestApproval} hands back. `autoApproved` present ⇒ NO card exists and the
+ *  mutation has ALREADY happened; `deduped` ⇒ the LIVE card of an identical earlier proposal. */
+export interface RequestApprovalResult {
+  readonly id: string;
+  readonly expiresAt: string;
+  readonly deduped?: boolean;
+  readonly autoApproved?: AutoApprovedOutcome;
+  /** Set on the CARD path only, when a person REJECTED a proposal with the same dedup identity within the approval TTL. It is information for the proposer's result and never a block: a second human ask must still mint a card. */
+  readonly priorRejection?: PriorRejection;
+}
+
+/** The newest reject of the same proposal inside the approval TTL: who rejected it and when. */
+export interface PriorRejection {
+  readonly decidedBy: string;
+  readonly decidedAt: string;
+}
+
+/** The identity an auto-approved WEDGE row records: WHAT was decided, WHERE, WHO asked and WHO
+ *  decided. Every field is frozen at the decision, so a redelivery of the same step body reproduces
+ *  all of them. The TURN is added by {@link wedgeActionId} itself. */
+interface WedgeIdentity {
+  readonly org: string;
+  readonly kind: string;
+  readonly scopeKey: string;
+  readonly channelId: string;
+  readonly threadTs: string | null;
+  readonly argsJson: string;
+  /** The proposing principal. In the row already; in the identity because two people proposing the
+   *  identical act must not share one row that names only the first of them. */
+  readonly requestedBy: string;
+  readonly decidedBy: string;
+}
+
+/**
+ * The id of an auto-approved wedge row: a digest of the decision it records, SCOPED TO THE TURN that made it. eve re-executes an UNCOMMITTED step body on crash-recovery redelivery and the two executions are byte-identical from inside the step, so both hash the same id here and addPendingActionIfAbsent makes the second write a no-op.
+ * 🔴 BOTH halves of the (session, turn) pair are load-bearing: content alone folds every nightly fire into the first night's row, and eve's turn id restarts at 0 in every session. With neither, this mints a fresh id — a duplicate row is noise, a swallowed one is an authorisation missing from the table. It does NOT make a kind's `execute` idempotent.
+ */
+function wedgeActionId(identity: WedgeIdentity): string {
+  const turn = readTurnClock();
+  // BOTH, or neither. A session id with no turn cannot separate two turns of one session; a turn id
+  // with no session cannot separate two sessions at the same ordinal, which is the nightly-routine
+  // case. Either one missing means this frame has no identity to key on, so it mints instead.
+  if (turn === undefined || turn === null || turn.turnId.length === 0 || turn.sessionId.length === 0) return randomUUID();
+  // JSON, not a joined string: a separator that can appear inside `argsJson` would let two
+  // different decisions produce one material, and a fingerprint that can collide is not one.
+  const material = JSON.stringify([turn.sessionId, turn.turnId, identity.org, identity.kind, identity.scopeKey, identity.channelId, identity.threadTs, identity.argsJson, identity.requestedBy, identity.decidedBy]);
+  return uuidFromDigest(createHash("sha256").update(material).digest("hex"));
+}
+
+/**
+ * THE ACTION KIND OF THE LIFT VERB, read from the registry rather than spelled — the ONE kind the click halt arrow exempts, so a halt can never deny its own lift.
+ * A bare literal would survive a rename of the verb's registry row: the arrow would exempt a kind no card carries, the chat lift would silently die under the next halt, and a test spelling the same dead literal would stay green. `undefined` when the row is not an action-kind row, which exempts nothing.
+ */
+const HALT_LIFT_ACTION_KIND: string | undefined = (() => {
+  const via = TOOL_CONSEQUENCE[RESUME_TOOL]?.via;
+  return via !== undefined && via.kind === "action-kind" ? via.action : undefined;
+})();
+
+/** The frozen args a live-card dedup compares: the row's argsJson with the kind's `proseArgs` dropped. Both sides are built by the same code in the same key order, so the re-serialised strings compare byte for byte. Unparseable or non-object args ride whole. */
+function dedupIdentity(argsJson: string, proseArgs: readonly string[] | undefined): string {
+  if (proseArgs === undefined || proseArgs.length === 0) return argsJson;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(argsJson);
+  } catch {
+    return argsJson;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return argsJson;
+  return JSON.stringify(Object.fromEntries(Object.entries(parsed as Record<string, unknown>).filter(([k]) => !proseArgs.includes(k))));
+}
+
+/** A sha256 digest rendered in the shape every pending-action id carries. Nothing downstream parses a row id, but keeping the shape means no reader has to learn a second one, and ONE renderer serves both derived ids so they cannot drift. */
+function uuidFromDigest(hex: string): string {
+  const variant = ((parseInt(hex.slice(16, 17), 16) & 0x3) | 0x8).toString(16);
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-8${hex.slice(13, 16)}-${variant}${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
+
+/**
+ * THE REDELIVERY IDENTITY OF ONE CARDED PROPOSAL — the id a pending takes when its kind declares a VOLATILE arg, so a redelivered step body lands on the card it already minted instead of posting a second one. Undefined when the kind declares none, or when this frame can name no (session, turn). The ordinary dedup matches the frozen argsJson, which a live MEASUREMENT changes between deliveries.
+ * 🔴 The (session, turn) pair keeps a genuine RE-ASK out: a redelivery shares both, a later turn does not. THE MEASUREMENT STAYS ON THE ROW — only the key drops it, because the card must still show the coverage measured when the approver was asked.
+ */
+function redeliveryActionId(kindDef: Pick<ActionKind, "volatileArgs">, input: RequestApprovalInput): string | undefined {
+  const volatileArgs = kindDef.volatileArgs;
+  if (volatileArgs === undefined || volatileArgs.length === 0) return undefined;
+  const turn = readTurnClock();
+  if (turn === undefined || turn === null || turn.turnId.length === 0 || turn.sessionId.length === 0) return undefined;
+  // The REQUEST, with the measurements dropped. Built from the same object the caller froze, in the
+  // same order, so the two deliveries stringify identically — the property `argsJson` itself relies
+  // on. A non-object `args` carries no named field to drop, so it rides whole.
+  const args = input.args;
+  const stable =
+    args !== null && typeof args === "object" && !Array.isArray(args)
+      ? Object.fromEntries(Object.entries(args as Record<string, unknown>).filter(([k]) => !volatileArgs.includes(k)))
+      : args;
+  // JSON, not a joined string — a separator that can appear inside the args would let two different
+  // proposals produce one material, and a fingerprint that can collide is not one.
+  const material = JSON.stringify([turn.sessionId, turn.turnId, input.org, input.kind, input.scopeKey, input.channelId, input.threadTs ?? null, JSON.stringify(stable ?? null), input.requestedBy]);
+  return uuidFromDigest(createHash("sha256").update(material).digest("hex"));
+}
+
+/**
+ * The propose tools' reply line for the auto-approved branch: one place where the sentence is guaranteed to say the two things the card path's "posted, awaiting a human" would get wrong here — no card exists to wait on, and the action has already run.
+ * THE RELAY INSTRUCTION IS LOAD-BEARING: half these tools return an internal-only note on the card path, so with nothing posted anywhere this string is the ONLY report the asker can receive, and it has to ask to be spoken.
+ */
+export function autoApprovedNote(what: string, autoApproved: AutoApprovedOutcome): string {
+  // A PERSON'S CLICK, not a chain lift (OPE-1290 PR 2). The run was refused, a permission card went
+  // into the routine's own room, and someone answered it before the run gave up. There IS a card
+  // and a human behind this outcome, so the chain sentence below would be false in both halves.
+  if (autoApproved.grantedBy !== undefined) {
+    return (
+      `done — ${what}: this run was refused, a permission card went to the routine's room, and <@${autoApproved.grantedBy}> approved it while the run was still waiting — ` +
+      `so it ran, and every later run of this instruction may do it without asking. ${autoApproved.outcome}. Tell the user.`
+    );
+  }
+  return (
+    `done — ${what}: the approver chain auto-approved this (${autoApproved.resolvedBy}), so no card was posted and it has ALREADY run — ` +
+    `${autoApproved.outcome}. Tell the user; there is no card for them to see.`
+  );
+}
+
+export interface RequestApprovalDeps {
+  readonly post?: PostFn;
+  /** Platform-aware card poster override. Absent → the default Slack Block Kit render+post
+   *  below, byte-for-byte the original path (approvals-test.ts pins it). Present (e.g. the
+   *  Discord poster, approvals/discord-flow.ts) → it owns render+post for its surface. */
+  readonly postCard?: CardPoster;
+  /** The live proposal turn, used only to freeze its already-validated wake authority for a later
+   * decision continuation. Headless control-plane proposals omit it. */
+  readonly authorityContext?: BindableContext;
+}
+
+/** Propose one pending action: validate the kind, freeze `args` as JSON, insert the row, post the code-rendered card, stamp its message ts and audit `approval.requested`. If the card fails to post, the pending is marked expired immediately and this THROWS — a pending nobody can see must never linger silently. */
+export async function requestApproval(
+  input: RequestApprovalInput,
+  deps: RequestApprovalDeps = {},
+): Promise<RequestApprovalResult> {
+  const kindDef = actionKind(input.kind);
+  if (!kindDef) {
+    throw new Error(`requestApproval: no registered ActionKind for "${input.kind}"`);
+  }
+
+  // THE APPROVER CHAIN, resolved BEFORE anything is minted or posted, for every TOOL-proposed kind. The NON-TOOL kinds are deliberately not routed through it: they are raised by hooks with their own pinned bars, and carding the spend checkpoint on a tainted unattended run would deny the session the checkpoint exists to pause.
+  // Verdicts: deny ⇒ throw; allow ⇒ AUTO-APPROVE (a decided wedge row, plus an `approval.autoapproved` row per execution); ask ⇒ the card path below. Every resolution writes its `approval.chain` row with BOTH verdicts visible.
+  const chainTool = toolForActionKind(input.kind);
+  if (chainTool !== undefined) {
+    // approval-chain: exempt — this IS the site that applies the fail-closed default, and it is the
+    // only chain request in the tree built with no turn to read. The optional authority context is
+    // used solely to freeze a later decision continuation; this chain still reads no turn posture,
+    // so every propose site derives unattendedness and hands it in, which is what rule 5 enforces.
+    const chainReq: ApprovalChainRequest = {
+      tool: chainTool,
+      action: input.kind,
+      args: input.args,
+      scopeKey: input.scopeKey,
+      ...(input.domain != null ? { domain: input.domain } : {}),
+      // 🔴 THE JUDGE'S DISARM ADDRESS IS ORG-SCOPED (OPE-1368), and this is the ONLY site that opts
+      // into the judge, so this is the only site whose `org` a reader consults. Passing it is what
+      // stops one org's `rearm_approval_judge` from cancelling another org's break-glass disarm.
+      org: input.org,
+      principalId: input.requestedBy,
+      // 🔴 FAIL CLOSED: no `chain` bag ⇒ NOBODY IS WATCHING, so a gated verb denies instead of carding into an empty room. The old `?? false` inverted it — a propose site that forgot the line read as "a human is present", the one answer that costs something when it is wrong.
+      unattended: input.chain?.unattended ?? true,
+      ...(input.chain?.tainted !== undefined ? { tainted: input.chain.tainted } : {}),
+      ...(input.domain != null ? { mode: approvalModeForDomain(input.domain) } : {}),
+      // 🔴 THE BREAK-GLASS HALT is a runtime SOURCE for the same `mode` stage, resolved here because this is the one site that resolves the chain for a real propose. `resolveHalt` FAILS CLOSED, which is safe precisely because the arrow exempts `resume` by name.
+      // The address axes are whatever this proposal can NAME — its surface and tenant from the scopeKey, its domain, the requester's person key — and a domain-less, surface-less proposal is still covered by an ORG-WIDE halt.
+      halted: (await resolveHalt(haltScopeFor({ org: input.org, scopeKey: input.scopeKey, domain: input.domain, ...(input.requestedBy !== undefined ? { principalId: input.requestedBy } : {}) }))).halted,
+      // OPE-310: a beneficiary-clicker kind's MINT needs a human `decidedBy`; tell the chain so its
+      // beneficiary-clicker-floor arrow can refuse to lower it (see approver-chain.ts). The reveal
+      // itself goes to the ASKER, not to the decider (OPE-327) — the floor is about who may DECIDE a
+      // destructive mint, never about who receives what it mints.
+      ...(kindDef.beneficiaryClicker === true ? { beneficiaryClicker: true } : {}),
+    };
+    // `judge: true` — the propose plane is the ONE caller that opts into the armed judge: a consult here is a real awaited model call whose allow executes frozen args, which is right at a propose and wrong at a simulator. The await is bounded and happens only on a defer-flipped row.
+    // `rules` are the scope's admin-authored pre-approval rules, resolved through the same scope seam as the approvers and read only if a consult actually happens.
+    const resolution = await resolveApproverChain(chainReq, {
+      approvers: approversForScopeKey(input.scopeKey, input.domain ?? undefined),
+      rules: preApprovalRulesForScopeKey(input.scopeKey, input.domain ?? undefined),
+      judge: true,
+    });
+    await appendAudit({
+      ...whereFromScope(input.org, input.scopeKey),
+      principalId: input.requestedBy,
+      action: "approval.chain",
+      detail: chainAuditDetail(chainReq, resolution),
+    }).catch(() => undefined);
+
+    // One `approval.judge.verdict` row PER CONSULT — the judge's live track record, which the flip review queries and which makes a lift or a deny answerable after the fact. It lands even when the judge deferred, timed out or was skipped by an operator's disarm: a consult that changed nothing is still evidence.
+    // 🔴 A FIRST LIVE `verdict: "deny"` DESERVES INDIVIDUAL REVIEW — read its reasoning before trusting the class.
+    if (resolution.judge !== undefined) {
+      await appendAudit({
+        ...whereFromScope(input.org, input.scopeKey),
+        principalId: input.requestedBy,
+        action: "approval.judge.verdict",
+        detail: {
+          tool: chainTool,
+          action: input.kind,
+          mode: "enforce",
+          verdict: resolution.judge.verdict,
+          enforcedVerdict: resolution.verdict,
+          resolvedBy: resolution.resolvedBy,
+          // The displaced per-verb default — what this row would have resolved before its flip.
+          registryVerdict: resolution.registryVerdict,
+          source: resolution.judge.source,
+          passes: resolution.judge.passes,
+          ...(resolution.judge.pass1 !== undefined ? { pass1: resolution.judge.pass1 } : {}),
+          // `ruleId` is present only when the judge cited a rule that really exists in this scope's authored set, so every rule-driven auto-allow is traceable to prose a human deployed. `ruleCitation: "unmatched"` is the fence firing: the judge named a rule that does not exist, and an allow on that basis was degraded to an ask.
+          ...(resolution.judge.ruleId !== undefined ? { ruleId: resolution.judge.ruleId } : {}),
+          ...(resolution.judge.ruleCitation !== undefined ? { ruleCitation: resolution.judge.ruleCitation } : {}),
+          reasoning: resolution.judge.reasoning,
+          cacheKey: resolution.judge.cacheKey,
+          cacheHit: resolution.judge.cacheHit,
+          unattended: chainReq.unattended,
+          ...(input.domain != null ? { domain: input.domain } : {}),
+        },
+      }).catch(() => undefined);
+    }
+
+    // THE SHADOW JUDGE — log-only, and live only when approvals.judgeMode is exactly "shadow" (phase 2's enforcing judge is the `judge: true` above; never both). The resolution is never touched, and every judge failure is swallowed.
+    // DETACHED deliberately (measured live 2026-08-08): awaiting it added tens of seconds to every shadow-eligible carded turn and downstream work started missing its budgets. The row is best-effort — a turn that ends first loses it.
+    void shadowJudgeAuditDetail(chainReq, resolution)
+      .then((shadowDetail) =>
+        shadowDetail === undefined
+          ? undefined
+          : appendAudit({
+              ...whereFromScope(input.org, input.scopeKey),
+              principalId: input.requestedBy,
+              action: "approval.judge.shadow",
+              detail: shadowDetail,
+            }),
+      )
+      .catch(() => undefined);
+
+    if (resolution.verdict === "deny") {
+      // The `denied` telemetry is emitted at EACH throw rather than at the top of this branch: the routine permission card's timed wait can end this branch in a LIFT, and a call that emitted `denied` and then `autoapproved` would double-count itself and report a refusal that did not happen.
+      const denied = (): void => emitTelemetry("oe.feature.used", { "oe.feature": "approval_requested", "oe.outcome": "denied" });
+      const reason = resolution.transforms.find((t) => t.to === "deny")?.reason;
+      // A JUDGE deny (OPE-318 phase 2) gets its own sentence: it is not config-reviewed policy —
+      // it is the armed judge's final verdict on a defer-flipped row, and the honest next step is
+      // a human proposing it themselves (or an operator reviewing the row's flip), never a config
+      // diff hunt. The audit trail is the `approval.judge.verdict` row written above.
+      if (resolution.resolvedBy === "judge") {
+        denied();
+        throw new Error(
+          `"${input.kind}" was DENIED by the approval judge — nothing was proposed and no card was posted. ` +
+            `The judge's reasoning is recorded in the audit log (approval.judge.verdict); if this looks wrong, a person can propose the action themselves, and the operator can review this verb's defer flip.`,
+        );
+      }
+      // A tainted UNATTENDED run denies with the same `ask-unattended` reason a plain undeclared-gate fire gets, and the standing advice would be WRONG for it — no standing grant lifts a taint floor. Naming taint lets the model route around it (ask a person, or retry in a clean turn) instead of concluding the tool is unavailable.
+      const taintedDeny = resolution.tainted && reason === "ask-unattended";
+      // THE ROUTINE PERMISSION CARD. The refusal above still stands by default: the routine's own room learns what its routine wanted, and one click arms the NEXT run. Only a routine fire refused for `ask-unattended`, on a kind a creation card could have declared, reaches the planner at all.
+      // With `approvals.routineCardWaitSeconds` armed, this call HOLDS for a bounded window on that card so a person who is around can answer it while the run is still up. It ships 0.
+      const card: RoutinePermissionCardOutcome =
+        reason === "ask-unattended"
+          ? await offerRoutinePermissionCardForProposal(input, { tainted: resolution.tainted, deps })
+          : { clause: "" };
+      // 🔴 THE ONE PATH THAT LIFTS THIS DENY, and only a HUMAN CLICK reaches it: the wait ran while this run was still up, someone approved the card, and the standing permission row they wrote has been read back — so refusing the call that raised the card would be theatre.
+      // The act is attributed to the CLICKER, never to the fire: the wedge row is minted `approved`/`decidedBy: <them>` and `execute` runs under their id, which keeps "who authorised this?" answerable from the row alone.
+      if (card.armedBy !== undefined) {
+        const store = getOperationalStore();
+        const decidedAt = new Date().toISOString();
+        const wedgeArgsJson = JSON.stringify(input.args ?? null);
+        const wedge: PendingActionRow = {
+          // DERIVED, never minted — a redelivery of this step body writes no second row. See
+          // {@link wedgeActionId}.
+          id: wedgeActionId({
+            org: input.org,
+            kind: input.kind,
+            scopeKey: input.scopeKey,
+            channelId: input.channelId,
+            threadTs: input.threadTs ?? null,
+            argsJson: wedgeArgsJson,
+            requestedBy: input.requestedBy,
+            decidedBy: card.armedBy,
+          }),
+          org: input.org,
+          kind: input.kind,
+          argsJson: wedgeArgsJson,
+          scopeKey: input.scopeKey,
+          domain: input.domain ?? null,
+          requestedBy: input.requestedBy,
+          channelId: input.channelId,
+          threadTs: input.threadTs ?? null,
+          messageTs: null,
+          postedTo: input.postedTo ?? null,
+          status: "approved",
+          createdAt: decidedAt,
+          // Its own mint instant, exactly as the chain-lowered wedge above: the row is already
+          // terminal, and a live-looking expiry on a decided row is what the click path's
+          // contradict branch had to special-case.
+          expiresAt: decidedAt,
+          decidedBy: card.armedBy,
+          decidedAt,
+        };
+        const minted = await store.addPendingActionIfAbsent(wedge);
+        const outcome = await kindDef.execute(input.args, card.armedBy);
+        await appendAudit({
+          ...whereFromScope(input.org, input.scopeKey),
+          principalId: card.armedBy,
+          action: "approval.autoapproved",
+          // 🔴 THE AUDIT ROW IS PER EXECUTION, THE WEDGE ROW IS PER AUTHORISATION PER (SESSION, TURN). This row is written either way, because dropping it would under-claim an act that really ran. `wedgeRowReused` states ONLY that a row with this id already existed — a redelivery produces that, and so does the same authorisation raised twice in one turn.
+          detail: {
+            id: wedge.id,
+            kind: input.kind,
+            scopeKey: input.scopeKey,
+            resolvedBy: "routine-permission-card",
+            transforms: resolution.transforms.map((t) => t.name),
+            ...(minted ? {} : { wedgeRowReused: true }),
+          },
+        }).catch(() => undefined);
+        emitTelemetry("oe.feature.used", { "oe.feature": "approval_requested", "oe.outcome": "autoapproved" });
+        return { id: wedge.id, expiresAt: wedge.expiresAt, autoApproved: { outcome, resolvedBy: "routine-permission-card", grantedBy: card.armedBy } };
+      }
+      denied();
+      throw new Error(
+        `"${input.kind}" was DENIED by the approver chain (${resolution.resolvedBy}${reason !== undefined ? `, ${reason}` : ""}) — ` +
+          `nothing was proposed and no card was posted. ${
+            taintedDeny
+              ? "This turn read external content, so this action needs a person to confirm it — and this run is unattended, so there is nobody to ask. No standing grant lifts that; ask a person to do this, or raise it again in a turn that has not read anything external."
+              : reason === "ask-unattended"
+                ? card.waited === true
+                  ? // This run DID wait on a card, so the standing advice's first half would
+                    // contradict the wait clause appended below it. What survives is the advice
+                    // that is still true and still actionable.
+                    "Arm the permission on the routine's creation card, or ask a person to do this."
+                  : "An unattended run cannot wait on an approval card; arm the permission on the routine's creation card, or ask a person to do this."
+                : "This refusal is config-reviewed policy; a config diff to the denying element is the only way to lift it."
+          }${card.clause}`,
+      );
+    }
+
+    if (resolution.verdict === "allow" && resolution.registryVerdict === "ask") {
+      // Config/mode lowered a gated verb: execute the FROZEN args now, with a decided pending row
+      // minted for the wedge (status approved, decidedBy `chain:<element>` — never a human's id).
+      const store = getOperationalStore();
+      const now = new Date();
+      const decidedBy = `chain:${resolution.resolvedBy}`;
+      const rowArgsJson = JSON.stringify(input.args ?? null);
+      const row: PendingActionRow = {
+        // DERIVED, never minted — the chain-lowered wedge is redelivered exactly as the
+        // routine-permission one is. See {@link wedgeActionId}.
+        id: wedgeActionId({
+          org: input.org,
+          kind: input.kind,
+          scopeKey: input.scopeKey,
+          channelId: input.channelId,
+          threadTs: input.threadTs ?? null,
+          argsJson: rowArgsJson,
+          requestedBy: input.requestedBy,
+          decidedBy,
+        }),
+        org: input.org,
+        kind: input.kind,
+        argsJson: rowArgsJson,
+        scopeKey: input.scopeKey,
+        domain: input.domain ?? null,
+        requestedBy: input.requestedBy,
+        channelId: input.channelId,
+        threadTs: input.threadTs ?? null,
+        messageTs: null,
+        postedTo: input.postedTo ?? null,
+        status: "approved",
+        createdAt: now.toISOString(),
+        expiresAt: now.toISOString(),
+        decidedBy,
+        decidedAt: now.toISOString(),
+      };
+      const minted = await store.addPendingActionIfAbsent(row);
+      const outcome = await kindDef.execute(input.args, decidedBy);
+      // THE JUDGE-LIFT NOTICE, gated on `resolvedBy === "judge"` (a config or mode lift is reviewed policy a human deployed) and on a frozen `postedTo` (a room is never guessed from the asking scope). {@link postJudgeLiftNotice} is the ONE road from here: it picks the render for that frozen platform and never throws, so every surface this deployment can post into leaves a trace.
+      const noticePlatform = resolution.resolvedBy === "judge" ? platformOfScopeKey(input.postedTo) : undefined;
+      if (noticePlatform !== undefined) {
+        await postJudgeLiftNotice(noticePlatform, deps.post ?? bridgeSlackForm, input, row, () => withTaintDisclosure(input.summaryLines ? [...input.summaryLines] : kindDef.summarize(input.args), input.args), outcome);
+      }
+      await appendAudit({
+        ...whereFromScope(input.org, input.scopeKey),
+        principalId: input.requestedBy,
+        action: "approval.autoapproved",
+        // `wedgeRowReused` on the same terms as the routine-permission wedge above: the row is per
+        // authorisation per (session, turn), this audit row is per execution, and the flag states
+        // only that a row with this id already existed.
+        detail: {
+          id: row.id,
+          kind: input.kind,
+          scopeKey: input.scopeKey,
+          resolvedBy: resolution.resolvedBy,
+          transforms: resolution.transforms.map((t) => t.name),
+          ...(minted ? {} : { wedgeRowReused: true }),
+        },
+      }).catch(() => undefined);
+      emitTelemetry("oe.feature.used", { "oe.feature": "approval_requested", "oe.outcome": "autoapproved" });
+      return { id: row.id, expiresAt: row.expiresAt, autoApproved: { outcome, resolvedBy: resolution.resolvedBy } };
+    }
+    // ask (or an allow that matches the registry's own allow — nothing to lower): the card path.
+  }
+
+  // AUDIENCE DISCLOSURE, asked BEFORE the dedup lookup and before any row exists. It runs FIRST on purpose: a dedup hit hands back a LIVE card already sitting in the room, so answering "may this room see this?" with a pointer to it would be wrong, and refusing before any mint leaves no pending to reconcile.
+  // Deliberately NOT keyed on the kind's tier — the disclosure happens at POST time and posting never reads the tier. INERT without a `postedTo`: absent ⇒ we cannot ask ⇒ we do not refuse.
+  if (input.postedTo) {
+    const disclosure = await checkCardDisclosure(input.postedTo);
+    if (!disclosure.ok) {
+      // Reuses the approval plane's existing refusal action rather than minting a parallel one. No `id`, because no row was created; `at` distinguishes this propose-time refusal from the click-time rows that share the action.
+      await appendAudit({
+        ...whereFromScope(input.org, input.scopeKey),
+        principalId: input.requestedBy,
+        action: "approval.denied",
+        detail: {
+          kind: input.kind,
+          scopeKey: input.scopeKey,
+          postedTo: input.postedTo,
+          ...venueDetail({ postedTo: input.postedTo, channelId: input.channelId, scopeKey: input.scopeKey }),
+          reason: disclosure.reason,
+          at: "propose",
+        },
+      }).catch(() => undefined);
+      emitTelemetry("oe.feature.used", { "oe.feature": "approval_requested", "oe.outcome": "withheld" });
+      throw new Error(cardDisclosureRefusalNotice());
+    }
+  }
+
+  const post = deps.post ?? bridgeSlackForm;
+  const store = getOperationalStore();
+
+  const now = new Date();
+  // A no-clock kind mints the same far-future sentinel its grant rows carry, so the two read alike
+  // in the tables — see RequestApprovalInput.noClockExpiry for which kinds, and why.
+  const expiresAt = input.noClockExpiry ? ROUTINE_PERMISSION_NO_EXPIRY : new Date(now.getTime() + approvalTtlHours() * 3_600_000).toISOString();
+  const argsJson = JSON.stringify(input.args ?? null);
+
+  // DEDUP: an IDENTICAL action already awaiting a click on this same surface hands back the LIVE card instead of minting a second one. Identity is the FROZEN (kind, scopeKey, channelId, argsJson) tuple, so a different proposed value is a genuinely new proposal with its own card.
+  // `listPendingActions` returns only `pending` rows, so a rejected or expired proposal never dedups — a re-propose mints a fresh card. Expiry is SWEEP-based, so the `expiresAt` check is what stops dedup handing back a card whose click would only ever resolve "expired".
+  // A kind's `proseArgs` (free text such as a spend `reason`) leave the identity, so the same request in new words still folds onto the live card.
+  const nowIso = now.toISOString();
+  const identity = dedupIdentity(argsJson, kindDef.proseArgs);
+  const dup = (await store.listPendingActions(input.org)).find(
+    (r) =>
+      r.kind === input.kind &&
+      r.scopeKey === input.scopeKey &&
+      r.channelId === input.channelId &&
+      dedupIdentity(r.argsJson, kindDef.proseArgs) === identity &&
+      r.expiresAt > nowIso,
+  );
+  if (dup) {
+    emitTelemetry("oe.feature.used", { "oe.feature": "approval_requested", "oe.outcome": "deduped" });
+    return { id: dup.id, expiresAt: dup.expiresAt, deduped: true };
+  }
+
+  // THE PRIOR REJECT (OPE-2071). The same dedup identity REJECTED within the approval TTL does not stop this card: the reject text invites a new proposal, and a second human ask must mint one. The result only REPORTS the reject, so a proposer that retries on its own learns the answer it never received. The read is fail-soft because it is information, never a gate.
+  const rejectedSince = new Date(now.getTime() - approvalTtlHours() * 3_600_000).toISOString();
+  const priorRejection = await findPriorRejection(store, input, kindDef, identity, rejectedSince);
+
+  // Freeze the proposal's exact host-owned wake before minting anything. A unified proposal whose
+  // current wake cannot prove its surface must fail closed before a card can invite a click; a
+  // headless/native proposal has no window continuation authority to preserve.
+  const decisionAuthority = deps.authorityContext === undefined ? undefined : await captureApprovalDecisionAuthority(deps.authorityContext);
+
+  // THE REDELIVERY GUARD (OPE-1556) — the second arm of the dedup, and the ONLY one that can see a
+  // redelivered proposal whose kind froze a live MEASUREMENT into its args. See
+  // {@link redeliveryActionId}: `undefined` for every kind that declares no volatile arg, which is
+  // every kind but `spend.set` today, so this is inert for them and they mint exactly as before.
+  let id: string = randomUUID();
+  const redeliveryId = redeliveryActionId(kindDef, input);
+  if (redeliveryId !== undefined) {
+    const prior = await store.getPendingAction(input.org, redeliveryId);
+    if (prior === null) {
+      // Nothing under this identity yet — take it, so a redelivery of THIS step body finds the row
+      // it is about to write rather than minting a second card beside it.
+      id = redeliveryId;
+    } else if (prior.status === "pending" && prior.expiresAt > nowIso) {
+      // The redelivery. Hand back the LIVE card, exactly as the args dedup above does — same
+      // return shape, same telemetry, so a reader cannot tell which arm caught it and does not
+      // need to.
+      emitTelemetry("oe.feature.used", { "oe.feature": "approval_requested", "oe.outcome": "deduped" });
+      return { id: prior.id, expiresAt: prior.expiresAt, deduped: true };
+    }
+    // Otherwise a TERMINAL row already holds that id — decided, rejected or wall-expired inside this
+    // same turn. Minting onto it would be a primary-key throw over a proposal that is genuinely new
+    // (the approvals plane must never point a caller at a dead card), so this one mints fresh and
+    // simply gets no redelivery guard. `id` keeps its `randomUUID()`.
+  }
+
+  // `let`, not `const`: the conflict branch below re-mints the row under a random id when a
+  // concurrent writer already holds the derived one and its row is terminal.
+  let row: PendingActionRow = {
+    id,
+    org: input.org,
+    kind: input.kind,
+    argsJson,
+    scopeKey: input.scopeKey,
+    domain: input.domain ?? null,
+    requestedBy: input.requestedBy,
+    channelId: input.channelId,
+    threadTs: input.threadTs ?? null,
+    messageTs: null,
+    postedTo: input.postedTo ?? null,
+    status: "pending",
+    createdAt: now.toISOString(),
+    expiresAt,
+    decidedBy: null,
+    decidedAt: null,
+  };
+
+  if (row.id === redeliveryId) {
+    // 🔴 A DERIVED ID IS INSERTED WITHOUT CONFLICT, never with a plain INSERT: the read above and this write are not atomic and the id is deterministic, so two proposals sharing one (session, turn) both read null and both insert, and a plain insert would make the loser throw out of a propose that should simply have deduped.
+    // The `randomUUID()` path below keeps the plain insert — no other caller can compute that id, so it has no conflict to lose.
+    if (!(await store.addPendingActionIfAbsent(row))) {
+      const winner = await store.getPendingAction(input.org, row.id);
+      if (winner !== null && winner.status === "pending" && winner.expiresAt > nowIso) {
+        emitTelemetry("oe.feature.used", { "oe.feature": "approval_requested", "oe.outcome": "deduped" });
+        return { id: winner.id, expiresAt: winner.expiresAt, deduped: true };
+      }
+      // The winner is already terminal (decided or wall-expired between the two writes). The
+      // approvals plane must never point a caller at a dead card, so this proposal mints a fresh
+      // row under a random id instead — the same answer the terminal-row branch above gives.
+      const fresh: PendingActionRow = { ...row, id: randomUUID() };
+      await store.addPendingAction(fresh);
+      row = fresh;
+    }
+  } else {
+    await store.addPendingAction(row);
+  }
+
+  if (decisionAuthority !== undefined) {
+    try {
+      await rememberApprovalDecisionAuthority(row.org, row.id, row.expiresAt, decisionAuthority);
+    } catch (err) {
+      await store.decidePendingAction(row.org, row.id, "expired", "system", new Date().toISOString()).catch(() => {});
+      await appendAudit({
+        ...whereFromScope(row.org, row.scopeKey),
+        principalId: row.requestedBy,
+        action: "approval.expired",
+        detail: { id: row.id, kind: row.kind, cause: "decision_authority_store_failed" },
+      }).catch(() => undefined);
+      throw new Error(`requestApproval: could not freeze the proposing seat authority; marked expired and did not post a card: ${String(err)}`);
+    }
+  }
+
+  // The taint DISCLOSURE line is applied here rather than inside each kind, so no card can be minted without it. A caller-supplied `summaryLines` goes through it too: overriding the render must not be a way to drop the disclosure.
+  const summaryLines = withTaintDisclosure(input.summaryLines ? [...input.summaryLines] : kindDef.summarize(input.args), input.args);
+
+  // LOCAL EVAL SPOOF: swallowing hands back a synthetic ts so the row, the audit and the card signal all run normally. Without it a local-eval target holds no bot token, the post fails, and every gated verb hard-fails under eval.
+  // 🔴 THE ORDER IS WHAT MAKES IT COVER EVERY PLATFORM — a registered CardPoster owns its own vendor call, so a gate checked after the branch below would swallow Slack's card and leave every other surface posting for real.
+  let messageTs = swallowRoomPost(`an approval-card post for "${input.kind}" (${input.scopeKey})`, "card");
+  // WHY the post did not land, when the transport names a reason. A registered CardPoster owns its
+  // own vendor call and its contract returns a bare undefined, so that arm has none to report — the
+  // honest string below says exactly that rather than inventing one (OPE-1861).
+  let postFailure: string | undefined;
+  if (messageTs === undefined) {
+    // A non-Slack surface owns its own render+post (CardPoster contract: never throws,
+    // undefined = failed). Everything after this point is platform-neutral.
+    if (deps.postCard) {
+      messageTs = await deps.postCard(row, summaryLines);
+      if (!messageTs) postFailure = "the surface's own card post did not land and reported no reason";
+    } else {
+      const posted = await postRenderedCard(post, input.channelId, input.threadTs, pendingCardBlocks(row, summaryLines));
+      messageTs = posted.ts;
+      postFailure = posted.error;
+    }
+  }
+
+  if (!messageTs) {
+    // The card never made it to the surface — nobody can see this pending, so it must not
+    // linger as an unseeable "pending" forever. Mark it expired (best-effort) and throw.
+    await store.decidePendingAction(input.org, row.id, "expired", "system", new Date().toISOString()).catch(() => {});
+    // An approval expiring is an ACTION-LIFECYCLE event (audit-wedge WS-3) — a dispatched
+    // approval that never resolves owes a terminal row, the same "a row closes a row" principle
+    // as the ticketing no_reply rows. Cause distinguishes this failed-post expiry from a TTL sweep.
+    await appendAudit({
+      ...whereFromScope(input.org, input.scopeKey),
+      principalId: input.requestedBy,
+      action: "approval.expired",
+      detail: { id: row.id, kind: input.kind, cause: "card_post_failed", ...(postFailure ? { reason: postFailure } : {}) },
+    });
+    emitTelemetry("oe.feature.used", { "oe.feature": "approval_requested", "oe.outcome": "failed" });
+    // The transport's own refusal reason rides BOTH halves: in the message for a human reader, and
+    // as a property for a caller that must classify it (spend/checkpoint.ts) without parsing a
+    // sentence that also carries the kind and the scope key. Token-free — see {@link postRenderedCard}.
+    const reason = postFailure ?? "the surface refused the post";
+    // 🔴 THE ERROR IS BUILT INSIDE THE `throw`, NOT BOUND TO A `const` FIRST. `lint:principal-gate`
+    // reads `const <name> = <rhs mentioning requestApproval>` as an ALIAS DECLARATION for the propose
+    // function, and then treats every `<name>(` in the file as a propose site — so binding this
+    // message to a local turns an unrelated line into a hard security-lint failure (measured on this
+    // file). The message must name `requestApproval`, so the binding is what gives way.
+    throw Object.assign(
+      new Error(`requestApproval: failed to post the approval card for "${input.kind}" (${input.scopeKey}) — ${reason}; marked expired, nothing is awaiting a click.`),
+      { [CARD_POST_REASON_KEY]: reason },
+    );
+  }
+
+  await store.setPendingActionMessage(input.org, row.id, messageTs);
+  // The card is now on the surface — signal channels/slack.ts's message.completed to
+  // suppress the model's redundant text reply this turn (Tommy, live: "the card should
+  // suffice"). Set ONLY here, after the post is confirmed — never on a refusal/validation
+  // path above this function, where the thrown error IS the message the user needs.
+  markCardPostedThisTurn();
+  await appendAudit({
+    ...whereFromScope(input.org, input.scopeKey),
+    principalId: input.requestedBy,
+    action: "approval.requested",
+    detail: { id: row.id, kind: input.kind, scopeKey: input.scopeKey, ...(row.domain ? { domain: row.domain } : {}) },
+  });
+  emitTelemetry("oe.feature.used", { "oe.feature": "approval_requested", "oe.outcome": "ok" });
+
+  return { id: row.id, expiresAt, ...(priorRejection !== undefined ? { priorRejection } : {}) };
+}
+
+/** The newest REJECTED row since `sinceIso` whose dedup identity equals this proposal's: same kind, scopeKey, channelId and non-prose args. Undefined when none matches or the read fails. */
+async function findPriorRejection(
+  store: ReturnType<typeof getOperationalStore>,
+  input: RequestApprovalInput,
+  kindDef: Pick<ActionKind, "proseArgs">,
+  identity: string,
+  sinceIso: string,
+): Promise<PriorRejection | undefined> {
+  // `.then` first, so a store that throws synchronously is caught like one that rejects.
+  const rows = await Promise.resolve()
+    .then(() => store.listRejectedActionsSince(input.org, sinceIso))
+    .catch(() => [] as readonly PendingActionRow[]);
+  const match = rows.find(
+    (r) =>
+      r.kind === input.kind &&
+      r.scopeKey === input.scopeKey &&
+      r.channelId === input.channelId &&
+      r.decidedBy !== null &&
+      r.decidedAt !== null &&
+      r.decidedAt >= sinceIso &&
+      dedupIdentity(r.argsJson, kindDef.proseArgs) === identity,
+  );
+  return match === undefined ? undefined : { decidedBy: match.decidedBy as string, decidedAt: match.decidedAt as string };
+}
+
+/** The permission key is read back off the proposal's own frozen args (the persisted wire name is `grantKey`), so it names the routine generation the refused act was proposed under. A proposal carrying no routine key is not a fire's, and this plane has nothing to offer it. */
+async function offerRoutinePermissionCardForProposal(
+  input: RequestApprovalInput,
+  ctx: { readonly tainted: boolean; readonly deps: RequestApprovalDeps },
+): Promise<RoutinePermissionCardOutcome> {
+  const grantKey = sessionIdFromFrozenArgs(JSON.stringify(input.args ?? null));
+  if (grantKey === undefined) return { clause: "" };
+  return await offerRoutinePermissionCard(
+    {
+      org: input.org,
+      // `pr.open` is both this plane's ActionKind and the grant plane's declaration for it, which is
+      // why one field carries both vocabularies — see `declarableRoutinePermission`.
+      declaration: input.kind,
+      // Carried for the seam's CAPPED path, which this call site never takes — the propose plane
+      // does not come through `offerRoutinePermissionCardFor` — but the field is required, and
+      // `input.kind` is the same string the planner resolves the kind from below.
+      grantKind: input.kind,
+      grantKey,
+      scopeKey: input.scopeKey,
+      domain: input.domain ?? null,
+      requestedBy: input.requestedBy,
+      tainted: ctx.tainted,
+      // THIS plane spends the run's own time on the card: the refused act is a tool call in the
+      // model's turn, so a wait here holds the turn a human can still answer.
+      waitBudgetMs: routineCardWaitBudgetMs(),
+    },
+    ctx.deps,
+  );
+}
+
+/**
+ * 🔴 IT CANNOT CHANGE THE REFUSAL: the deny is already decided by the time this runs, every failure inside it is swallowed, and all it can add to the thrown sentence is a clause derived from a row that exists. A courtesy must never turn a clean refusal into a crash.
+ * 🔴 REFUSAL-SITE-AGNOSTIC: the other site that refuses a fire (the unattended connector fence) reaches this through the registry seam rather than by importing it, so neither site gets a behaviour the other does not. The poster is resolved for the ROUTINE's platform, which is often not the refused act's.
+ */
+async function offerRoutinePermissionCard(
+  offer: RoutinePermissionCardOffer,
+  deps: RequestApprovalDeps,
+): Promise<RoutinePermissionCardOutcome> {
+  try {
+    const budgetMs = offer.waitBudgetMs;
+    const grantKey = offer.grantKey;
+    const plan = await planRoutinePermissionCard({
+      org: offer.org,
+      declaration: offer.declaration,
+      grantKey,
+      scopeKey: offer.scopeKey,
+      domain: offer.domain ?? null,
+      requestedBy: offer.requestedBy,
+      tainted: offer.tainted,
+      nowIso: new Date().toISOString(),
+    });
+    if (!plan.card || plan.askedMemoKind === undefined) {
+      // A `live` state is the other state with a card to wait on: an earlier fire posted it and nobody has answered, so this fire re-points at that same card and spends its budget on it. Every other state has no card to wait for, so the refusal is immediate.
+      // The pointer is resolved for the row the planner itself found, never looked up a second time, so the URL and the state can never describe different cards.
+      const at = plan.cardId ? await routinePermissionCardPointer(offer.org, plan.cardId) : {};
+      const clause = routinePermissionRefusalClause(plan.state, false, at.permalink);
+      if (budgetMs <= 0 || plan.cardId === undefined || plan.grantKind === undefined) {
+        noteRunRefusal(plan.state, plan.grantKind, at, plan.cardId !== undefined);
+        return { clause };
+      }
+      const settled = await settleRoutineCardWait(offer.org, { cardId: plan.cardId, grantKey, grantKind: plan.grantKind }, clause, budgetMs);
+      // `true`, and the guard three lines up is why: this branch is reachable only once
+      // `plan.cardId === undefined` has already returned, so a card is known to exist here.
+      return noteUnlessArmed(settled, plan.state, plan.grantKind, at, true);
+    }
+    // The planner resolves the routine's room through the DISPATCH registry, which is wired for more platforms than the CARD registry — without this test the post would fall through to the built-in Slack path and fire a Slack call at a Teams conversation id, on every fire forever (the post fails, so no ask-memo is written, so nothing stops the retry).
+    if (!hasApprovalCardPath(plan.platform ?? "")) return { clause: "" };
+    // 🔴 THE CARD SIGNAL MUST NOT SURVIVE THIS CALL. The surfaces read "a card posted this turn" to SUPPRESS the model's reply, but this turn is being REFUSED, its thrown sentence is the text that still has to reach the room, and the card went to a different room anyway — so the flag is read beforehand and restored.
+    const hadCardSignal = peekCardPostedThisTurn();
+    // A re-entrant requestApproval, and it terminates: `routine.permission` is a
+    // NON_TOOL_ACTION_KIND, so `toolForActionKind` answers undefined, no chain is built for it and
+    // this branch cannot be reached a second time.
+    const poster = cardPosterFor(plan.platform ?? "");
+    let cardId: string | undefined;
+    try {
+      // 🔴 KEEP THE MARKER BELOW ADJACENT TO THE CALL. `principal-gate-lint` anchors the exemption
+      // to the propose site by adjacency, so wrapping the call in an assignment EXPRESSION hides it
+      // and the lint hard-errors (measured on this branch). Hence `const posted` + a second line.
+      // approval-chain: exempt — `routine.permission` is a NON_TOOL_ACTION_KIND (access/consequence.ts),
+      // so `toolForActionKind` answers undefined and this call builds no chain request at all. An
+      // attendedness bag here would be inert AND wrong: the site that raises this card is BY
+      // CONSTRUCTION an unattended fire's refusal, so the unattended arrow would kill the one card
+      // that exists to be read after that run has ended. The ruling for this kind is the
+      // spend-checkpoint precedent (OPE-1290, 2026-08-31): the card blocks nothing and can only mint
+      // a row the declare layer would have accepted.
+      // approval-authority: headless — this unattended routine refusal has no live model turn or wake envelope.
+      const posted = await requestApproval(plan.card, {
+        ...(deps.post ? { post: deps.post } : {}),
+        ...(poster ? { postCard: poster } : {}),
+      });
+      cardId = posted.id;
+    } finally {
+      if (!hadCardSignal) consumeCardPostedThisTurn();
+    }
+    // Only AFTER the post: a memo written first would suppress the card forever if the post failed.
+    await markRoutinePermissionAsked(
+      offer.org,
+      grantKey,
+      plan.askedMemoKind,
+      offer.requestedBy,
+      new Date().toISOString(),
+    );
+    // The pointer is resolved AFTER the post, off the row `setPendingActionMessage` has just
+    // stamped — which is why the same call serves this fire and every later one (OPE-1356).
+    const at = cardId ? await routinePermissionCardPointer(offer.org, cardId) : {};
+    const clause = routinePermissionRefusalClause(plan.state, true, at.permalink);
+    if (budgetMs <= 0 || plan.grantKind === undefined) {
+      noteRunRefusal(plan.state, plan.grantKind, at, cardId !== undefined);
+      return { clause };
+    }
+    const settled = await settleRoutineCardWait(offer.org, { cardId, grantKey, grantKind: plan.grantKind }, clause, budgetMs);
+    return noteUnlessArmed(settled, plan.state, plan.grantKind, at, cardId !== undefined);
+  } catch {
+    // TWO REGIONS REACH HERE, and they leave the world in different states. The ordinary one is a card that did not post: the refusal says nothing about a card, no ask-memo was written, and the next fire tries again.
+    // The `try` also covers the WAIT, which runs after a successful post and after the memo — an escape there returns the same empty clause, so the refusal UNDER-claims rather than inventing a sentence that points at a card.
+    return { clause: "" };
+  }
+}
+
+// 🔴 THE SEAM IS FILLED HERE, AT MODULE LOAD, and only here: the connector fence calls the slot rather than this function, because a connection module resolved at eve boot must not drag this module's channel and card graph in. An empty slot answers the empty clause, which is the honest degradation.
+// 🔴 The CLAUSE is taken and the rest DROPPED at this boundary — rebuilding the answer as `{ clause }` is what makes "the seam cannot widen a refusal" true by construction rather than by a caller's discipline. No injected poster: the card resolves its own from the routine's platform.
+registerRoutinePermissionCardOfferer(async (offer) => ({ clause: (await offerRoutinePermissionCard(offer, {})).clause }));
+
+/** 🔴 THE LEDGER IS WRITTEN AFTER THE WAIT, NEVER BEFORE IT: a wait that ends `approved` lets the run proceed, so a loss recorded first would put "this run asked for permissions it does not have" on the report of a run that got the permission and used it. `armedBy` is the one signal that it proceeded. */
+function noteUnlessArmed(
+  settled: RoutinePermissionCardOutcome,
+  state: RoutinePermissionCardState,
+  grantKind: string | undefined,
+  at: RoutineCardPointer,
+  cardPosted: boolean,
+): RoutinePermissionCardOutcome {
+  if (settled.armedBy === undefined) noteRunRefusal(state, grantKind, at, cardPosted);
+  return settled;
+}
+
+/**
+ * 🔴 `cardPosted` COMES FROM THE PLANNER, NOT FROM THE POINTER: `routinePermissionCardPointer` returns `{}` on any throw, so deriving it here would report "no card is waiting" about a card sitting in the routine's room — the overclaim that sends an owner to the `edit_routine` bump that destroys it.
+ * The pointer read decides the PERMALINK and nothing else.
+ */
+function noteRunRefusal(state: RoutinePermissionCardState, grantKind: string | undefined, at: RoutineCardPointer, cardPosted: boolean): void {
+  if (grantKind === undefined) return;
+  noteRoutineRunPermissionRefusal({
+    permission: describeDeclaredPermissionKind(grantKind),
+    // 🔴 THE PERMALINK ONLY, NEVER THE ROOM (OPE-1383). `at.room` is the raw
+    // `platform/workspace/channel` triple off the card's frozen row, and the block that renders this
+    // pointer rides every reply, not just the routine's report post. What a reader needs — that a
+    // card is waiting at all — travels as the boolean instead.
+    card: at.permalink ?? null,
+    cardPosted,
+    // This producer IS the card plane's own consult, so it is never the capped case — the cap
+    // short-circuits in `approvals/routine-permission-offer.ts` before this function is reached.
+    cardCapped: false,
+    // `unreadable` is the ONE state that established nothing about the card. Every other state got
+    // here off a row it read — including `declined`, where "no card" is a fact and worth saying.
+    cardKnown: state !== "unreadable",
+  });
+}
+
+/**
+ * THE TIMED WAIT between "a card is on the surface" and the refusal being thrown. 🔴 IT DECIDES NOTHING ABOUT THE CARD: on a deadline it simply stops polling — no CAS, no expiry, no row — because the run's question ("may I do this right now?") and the card's ("may this routine do this at all?") are different questions.
+ * 🔴 An approval is taken ONLY with the grant row in hand: `armedBy` is read back from the row a click writes, so a click that armed nothing cannot let the run proceed.
+ */
+async function settleRoutineCardWait(
+  org: string,
+  ctx: { readonly cardId: string; readonly grantKey: string; readonly grantKind: string },
+  cardClause: string,
+  budgetMs: number,
+): Promise<RoutinePermissionCardOutcome> {
+  const outcome = await waitForRoutineCardDecision(budgetMs, {
+    probe: () => routineCardProbe(org, ctx.cardId, ctx.grantKey, ctx.grantKind),
+    sleep: (ms) => new Promise<void>((resolve) => setTimeout(resolve, ms)),
+    nowMs: () => Date.now(),
+  });
+  emitTelemetry("oe.feature.used", { "oe.feature": "routine_permission_card_wait", "oe.outcome": outcome });
+  if (outcome === "approved") {
+    const armedBy = await routineCardArmedBy(org, ctx.grantKey, ctx.grantKind);
+    // No `armedBy` after an `approved` verdict means the row vanished between the probe and this
+    // read — a revoke landing mid-wait. Fall through to the refusal rather than proceeding on a
+    // permission that is no longer held.
+    if (armedBy !== undefined) return { clause: cardClause, armedBy, waited: true };
+  }
+  // 🔴 THE PRE-WAIT CLAUSE SURVIVES ONLY WHERE IT IS STILL TRUE. It was computed BEFORE the wait and
+  // describes the card at wait start ("nobody has decided it yet"); the wait clause describes it at
+  // wait end. Concatenating both unconditionally puts "nobody has decided it yet" and "a person
+  // declined it" in one paragraph. Only the deadline leaves the card as the first sentence found it.
+  const waitClause = routineCardWaitRefusalClause(outcome, Math.round(budgetMs / 1_000));
+  return { clause: (routineCardKeepsStateClause(outcome) ? cardClause : "") + waitClause, waited: true };
+}
+
+/** Platform-aware CardPoster selection: a non-Slack surface's poster is registered by its provider bundle, and Slack registers none so requestApproval's default Block Kit path runs unchanged. Platforms with no card path never get here — {@link hasApprovalCardPath} refuses them at plan time. */
+export function approvalPostDeps(platform: string, authorityContext?: BindableContext): RequestApprovalDeps {
+  const poster = cardPosterFor(platform);
+  return {
+    ...(poster ? { postCard: poster } : {}),
+    ...(authorityContext ? { authorityContext } : {}),
+  };
+}
+
+/**
+ * The surfaces that can render Approve/Reject: Slack (the built-in Block Kit path) plus any platform whose bundle registered a CardPoster.
+ * 🔴 It answers a property of a ROOM, never of a request — for "can this REQUEST work from here", reach for {@link checkApprovalVenue} instead. A surface with no card path is now ROUTED (approvals/card-venue.ts) rather than refused.
+ */
+export function hasApprovalCardPath(platform: string): boolean {
+  return platform === "slack" || cardPosterFor(platform) !== undefined;
+}
+
+/**
+ * Is `row` a spend-cap pending whose level needs ORG-ADMIN approval specifically? Two levels qualify: "domain", because a domain admin is a domain LEAD and not the budget owner, and "user", because a per-person allowance is an act about a NAMED THIRD PARTY who is not in the room the card lands in and has no seat.
+ * The frozen `domain` is independently null on every user-level row, so the domain-admin fallback is unreachable there twice over — a fence a single future edit can open is not a fence. Parse failure reads as "not one of those levels", fail-soft, which can only narrow what this refuses.
+ */
+export function isOrgAdminOnlySpendCap(row: PendingActionRow): boolean {
+  if (row.kind !== "spend.set" && row.kind !== "spend.clear") return false;
+  try {
+    const args = JSON.parse(row.argsJson) as { level?: unknown };
+    return args.level === "domain" || args.level === "user";
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Standing is checked against the row's FROZEN `domain`, never a domain re-resolved from the current channel — a domain reassignment must not silently change who can decide an already-posted card. A domain-level or USER-level spend cap is ORG-ADMIN ONLY, and the domain-admin fallback never applies to either.
+ * 🔴 FAIL-CLOSED without a clicker platform or tenant: a bare id would otherwise match another platform's — or another workspace's — roster entry that happens to be the same digits, and admin-tier approval is on the other side of this predicate. The `platformAdmin` seam is unaffected.
+ */
+/** The (platform, tenant) a ROOM key names, or `undefined` when it names no room. One parse for
+ *  both halves — a key that yields a platform always yields its workspace too, so the two can never
+ *  be sourced from different fallback rungs and end up describing different rooms. */
+function roomNamespace(scopeKey: string | undefined | null): { readonly platform: string; readonly tenant: string } | undefined {
+  if (!scopeKey) return undefined;
+  const parsed = parseScopeKey(scopeKey);
+  return parsed.kind === "tenant" || parsed.kind === "surface" ? { platform: parsed.platform, tenant: parsed.workspace } : undefined;
+}
+
+export function clickerMayDecide(
+  row: PendingActionRow,
+  clickerId: string,
+  clickerPlatform: string | undefined,
+  clickerTenant: string | undefined,
+): boolean {
+  if (!clickerPlatform) return false;
+  const domains = getConfig().loadDomains();
+  const key = tryPrincipalKey(clickerPlatform, clickerTenant, clickerId);
+  if (key === undefined) return false;
+  if (criteriaDomain("org", domains)?.admins?.includes(key) === true) return true;
+  if (isOrgAdminOnlySpendCap(row)) return false;
+  if (!row.domain) return false;
+  const explicit = domains.find((d) => d.name === row.domain);
+  return explicit?.admins?.includes(key) === true;
+}
+
+/** The subset of Slack's `block_actions` interactivity payload this handler reads. Loosely
+ *  typed (see card.ts's SlackBlock note) — this is untrusted-shape wire JSON, probed rather
+ *  than assumed. */
+interface BlockActionsPayload {
+  readonly actions?: readonly { readonly action_id?: unknown; readonly value?: unknown }[];
+  readonly user?: { readonly id?: unknown };
+  readonly channel?: { readonly id?: unknown };
+  readonly message?: { readonly ts?: unknown };
+  /** The workspace the click came from — needed to form the proposing channel's fully-qualified
+   *  surfaceKey (`slack/<team>/<channel>`) for the window-domain check. Slack always includes it on
+   *  an interactive payload; absent ⇒ the decision wake is skipped (fail-soft). */
+  readonly team?: { readonly id?: unknown };
+}
+
+export interface HandleApprovalDeps {
+  readonly post?: PostFn;
+  /** Seam for the cross-thread DECISION WAKE (task #102): injected in tests to capture the dispatch
+   *  without a live eve receive. Absent ⇒ the real {@link wakeWindowOnDecision} deps (the live
+   *  {@link dispatchApprovalDecisionWake}). */
+  readonly decisionWake?: DecisionWakeDeps;
+  /** OPTIONAL positive per-clicker guest verdict, fed to {@link resolveApprovalClick}'s `clickerIsGuest`. `true`/`false` when the surface can positively classify the clicker, `undefined` when it cannot — `undefined` is ALWAYS inert. Core stays Slack-probe-free, so there is no live default; the Slack front wires one in. */
+  readonly clickerIsGuest?: (userId: string, teamId: string | undefined) => Promise<boolean | undefined>;
+  /** The Slack route's own `waitUntil`, forwarded whole to {@link ResolveApprovalClickInput.waitUntil} — see there for what it governs and what an absent one means. This handler is core, so the front route supplies it rather than this module reaching for a host API. */
+  readonly waitUntil?: (p: Promise<unknown>) => void;
+}
+
+async function updateCard(post: PostFn, channelId: string, ts: string | undefined, card: RenderedCard): Promise<void> {
+  if (!ts) return; // no message to update (shouldn't happen once a row has a messageTs) — degrade silently
+  // The shared egress exit (channels/egress-spoof.ts). THIS is the common card rewrite — every
+  // Approve/Reject click lands here, and `ts` comes off the LIVE Slack payload rather than the
+  // `spoof-card-…` synthetic, so without this gate a spoofed run holding a bot token really
+  // rewrites a real card. `updateCardText` below carries the same gate for the rarer copy.
+  if (swallowRoomOp("a slack approval-card rewrite")) return;
+  const body = new URLSearchParams();
+  body.set("channel", channelId);
+  body.set("ts", ts);
+  body.set("text", card.text);
+  body.set("blocks", JSON.stringify(card.blocks));
+  await post("chat.update", body.toString());
+}
+
+async function updateCardText(post: PostFn, channelId: string, ts: string | undefined, text: string): Promise<void> {
+  if (!ts) return;
+  // The shared egress exit (channels/egress-spoof.ts) — a card rewrite changes what the room sees,
+  // so it is a room post like any other.
+  if (swallowRoomOp("a slack approval-card rewrite")) return;
+  const body = new URLSearchParams();
+  body.set("channel", channelId);
+  body.set("ts", ts);
+  body.set("text", text);
+  // chat.update KEEPS a message's existing blocks unless new ones are sent — and blocks
+  // take render precedence over text. Replace them with the plain text, or the stale
+  // Approve/Reject buttons would stay visible (and clickable) under the new message.
+  body.set("blocks", JSON.stringify([{ type: "section", text: { type: "mrkdwn", text } }]));
+  await post("chat.update", body.toString());
+}
+
+/**
+ * Post ONE code-rendered Block Kit message. `ts` on success; `error` on any failure.
+ * Shared by the pending card and the judge-lift notice so the two cannot drift in how they send
+ * the same shape (`text` is the required plain-text fallback; `blocks` is the render).
+ * 🔴 `error` IS TOKEN-FREE BY CONSTRUCTION, and that is what lets a caller report WHY: it carries
+ * Slack's own `error` enum code and nothing else — no header, no response body, no token — exactly
+ * as channels/surface-message-ops.ts's strict post already does. A caller that discards it leaves
+ * the person who must act on the failure with no reason at all (OPE-1861).
+ */
+async function postRenderedCard(post: PostFn, channelId: string, threadTs: string | null | undefined, card: RenderedCard): Promise<{ ts?: string; error?: string }> {
+  const body = new URLSearchParams();
+  body.set("channel", channelId);
+  if (threadTs) body.set("thread_ts", threadTs);
+  body.set("text", card.text);
+  body.set("blocks", JSON.stringify(card.blocks));
+  const res = await post("chat.postMessage", body.toString());
+  if (res?.ok === true && typeof res.ts === "string") return { ts: res.ts };
+  // THREE CAUSES, THREE STRINGS. Collapsing them loses the operator's next step: a swallowed network
+  // error read as "no bot token" sends someone to rotate a credential that is fine.
+  if (res && typeof res["error"] === "string") return { error: res["error"] as string };
+  // `res` is undefined when no bot token is configured, or the bridge's own fail-soft form()
+  // swallowed a network error before this point. Those two are genuinely indistinguishable here,
+  // so the string names both rather than picking one.
+  if (!res) return { error: "no bot token is configured, or the request never reached the surface" };
+  return { error: "the surface accepted the post but named no message id" };
+}
+
+/** The key {@link cardPostFailureReason} reads. Its own symbol, so the producer and the reader
+ *  cannot drift on a string literal. */
+const CARD_POST_REASON_KEY = "oeCardPostReason";
+
+/**
+ * The transport's own refusal reason for a failed card post, or undefined when the error is not one.
+ * 🔴 IT IS A PROPERTY, NOT THE MESSAGE. A caller that must tell a person what to do next used to
+ * have only the thrown sentence to read, and that sentence also interpolates the kind and the scope
+ * key — so a room called `404` classified as an unreachable room (OPE-1861). The reason travels
+ * beside the message instead, and the message stays the human-readable half.
+ */
+export function cardPostFailureReason(err: unknown): string | undefined {
+  if (typeof err !== "object" || err === null) return undefined;
+  const reason = (err as Record<string, unknown>)[CARD_POST_REASON_KEY];
+  return typeof reason === "string" ? reason : undefined;
+}
+
+async function postThreadNote(post: PostFn, channelId: string, threadTs: string | undefined, text: string): Promise<void> {
+  // The shared egress exit (channels/egress-spoof.ts) — the click path's refusal notes are room
+  // posts too.
+  if (swallowRoomOp("a slack approval thread note")) return;
+  const body = new URLSearchParams();
+  body.set("channel", channelId);
+  if (threadTs) body.set("thread_ts", threadTs);
+  body.set("text", text);
+  await post("chat.postMessage", body.toString());
+}
+
+/**
+ * The decision outcome posted as a NEW message into the pending's anchor thread. The click path otherwise only EDITS the card in place, which the owning session's backscroll never sees — so without this the proposing session sits on stale "already pending" knowledge and re-proposes against a dead card.
+ * A rejected or expired notice must state plainly that NOTHING was applied and a fresh proposal is fine; it must never read as "approved" or auto-retry. `<@id>` is the mention syntax on Slack AND Discord, so one render feeds both.
+ */
+function decisionNoticeText(summaryLines: string[], outcomeLine: string, clickerId: string, status: PendingStatus): string {
+  const what = summaryLines[0] ?? "the requested change";
+  // A kind whose DECLINE is durable returns a line saying what the decline recorded, and it
+  // REPLACES the "propose again" tail — for that kind the whole point is that nothing will propose
+  // it again. Every other reject passes the literal "rejected" and reads exactly as it always did.
+  if (status === "rejected") {
+    return outcomeLine === "rejected"
+      ? `⛔ Approval REJECTED by <@${clickerId}> — "${what}" was NOT applied. Propose again if it's still needed.`
+      : `⛔ Approval REJECTED by <@${clickerId}> — "${what}" was NOT applied. ${outcomeLine}.`;
+  }
+  if (status === "expired") return `⌛ Approval EXPIRED without a decision — "${what}" was NOT applied. Propose again if it's still needed.`;
+  return `✅ Approval APPROVED by <@${clickerId}> — "${what}": ${outcomeLine}`;
+}
+
+/** Re-render a row's summary lines from its own (kind, frozen argsJson) — used whenever the
+ *  click path needs to redraw the card without re-deriving args from anywhere else. */
+function summaryLinesFor(row: PendingActionRow): string[] {
+  const kindDef = actionKind(row.kind);
+  if (!kindDef) return [`(no registered ActionKind for "${row.kind}")`];
+  try {
+    const args = JSON.parse(row.argsJson);
+    // `live: false` — a redraw happens in whatever turn the CLICKER is in, and that turn's taint has
+    // nothing to do with this proposal's. Only the frozen flag speaks here (OPE-307).
+    return withTaintDisclosure(kindDef.summarize(args), args, { live: false });
+  } catch {
+    return ["(failed to render this pending's summary)"];
+  }
+}
+
+/** What one decide attempt resolved to — the discriminated result every surface renders in its own idiom. The store mutation, the audit rows and the kind execution have ALREADY happened by the time this returns: a caller only draws UI from it, never decides anything further. */
+export type ApprovalClickResolution =
+  /** No row for (org, id) — a stale card from before an aged-out sweep, or garbage. */
+  | { readonly outcome: "unknown" }
+  /** Already decided/expired — a stale re-click or a double-click race that lost. Nothing to
+   *  do; re-rendering risks clobbering a legitimate decided card with an outdated `row`. */
+  | { readonly outcome: "not-pending" }
+  /** This click's lazy-expiry CAS won: the row is now expired, render the expired card. */
+  | { readonly outcome: "expired"; readonly row: PendingActionRow; readonly summaryLines: string[] }
+  /** The row was past its TTL but someone else's CAS (click or sweep) got there first. */
+  | { readonly outcome: "expired-race" }
+  /** No registered ActionKind for the row's kind — cannot decide (already console.error'd). */
+  | { readonly outcome: "unregistered-kind" }
+  /** Admin-policy kind, clicker has no standing. The row is NOT consumed — it stays
+   *  "pending" so a real admin can still act on the same card. */
+  | { readonly outcome: "denied"; readonly row: PendingActionRow }
+  /** The CLICK ITSELF was refused before the policy branch (OPE-185, approvals/clicker-floor.ts):
+   *  an observed-guest room, an unattested room on a beneficiary kind, or a click from a room that
+   *  isn't the card's. Like "denied", the row is NOT consumed — it stays "pending" so the same card
+   *  can still be decided from an internal room. `reason` selects the copy the surface renders. */
+  | { readonly outcome: "clicker-denied"; readonly row: PendingActionRow; readonly reason: ClickerFloorRefusal }
+  /** Someone else's click won the decide CAS first — silent, the winner renders the card. */
+  | { readonly outcome: "lost-race" }
+  /**
+   * A BREAK-GLASS HALT covers the row's frozen address, and the lift's own card is EXEMPT here. 🔴 THE HALT EDITS NO ROW: the pending stays `pending` — no decide CAS, no lazy-expiry CAS, no execute — so the SAME card is clickable again once an admin runs `resume`.
+   * 🔴 THE BOUND ON "STILL CLICKABLE": the TTL SWEEP is not halt-gated, so a halt longer than `approvals.ttlHours` loses the outstanding cards to the sweep anyway and those proposals have to be re-asked. This arrow refuses; it does not preserve.
+   */
+  | { readonly outcome: "halted"; readonly row: PendingActionRow; readonly notice: string }
+  /** Decided (approved — executed, possibly `FAILED: …` — or rejected). `row` carries the
+   *  decided status/decidedBy; `outcomeLine` is the executor's outcome line — or, on a reject, the
+   *  literal "rejected" unless the kind implements `declined()` (approvals/types.ts), in which case
+   *  it is that hook's line and BOTH renderers show it. Audits already appended. */
+  | {
+      readonly outcome: "decided";
+      readonly row: PendingActionRow;
+      readonly summaryLines: string[];
+      readonly outcomeLine: string;
+      /** Whether the kind's `execute` RAN and how it ended — "none" for a reject (nothing runs).
+       *  Required, so a new decide return site cannot forget the fact the decision wake needs
+       *  (OPE-1097): the resumed seat is told the approved act already ran, in the executor's own
+       *  words, and a `FAILED:` prefix on `outcomeLine` is never the thing that decides it. */
+      readonly executed: "ok" | "failed" | "none";
+    }
+  /** A "this should not have run" click on a judge-lift wedge row: NOTHING executes and no row is consumed — the act already happened, and this only records the human's overrule in the audit trail, where it changes nothing automatically. */
+  | {
+      readonly outcome: "contradicted";
+      readonly row: PendingActionRow;
+      readonly summaryLines: string[];
+      readonly contradiction: ContradictJudgeAllowOutcome;
+    };
+
+export interface ResolveApprovalClickInput {
+  readonly org: string;
+  readonly id: string;
+  readonly decision: ApprovalDecision;
+  readonly clickerId: string;
+  /**
+   * OPTIONAL platform-native admin standing, evaluated against the FROZEN row and OR-ed with the config-as-code roster. Discord passes guild-administrator standing; Slack passes nothing, so its only admin source is the roster.
+   * A predicate rather than a boolean because the standing may depend on the row being decided, and async because the DM-click leg needs I/O. Only evaluated on a roster MISS, so the common case never pays it.
+   */
+  readonly platformAdmin?: (row: PendingActionRow) => boolean | Promise<boolean>;
+  /**
+   * Where the click PHYSICALLY happened, as a fully-qualified `platform/workspace/surface` key, taken from the CLICK and never from the frozen row — an explicit-scope override can freeze a scopeKey naming a foreign workspace.
+   * 🔴 ABSENT ⇒ THE CLICKER GATE DOES NOT RUN AT ALL, deliberately: the headless control plane has no room and no clicker context and is already authorized by its own RBAC. Keying the gate on `platformAdmin` instead would kill that plane, since it asserts `() => true` there.
+   */
+  readonly clickContext?: { readonly surfaceKey: string };
+  /** Notice deps for the session-grant RELEASE, and nothing else on this path: the rows it decides have no platform handler above them, so the release posts their notices itself off each row's own frozen `postedTo`. Absent ⇒ the live posters. The clicked row's OWN feedback is unaffected. */
+  readonly releaseFeedback?: SweepFeedbackDeps;
+  /** The PLATFORM the clicker's id lives in — supplied explicitly by the surface, because a click id is only meaningful inside its own vendor's namespace and nothing else on this input reliably carries it. Absent ⇒ the ROSTER arm of `clickerMayDecide` refuses; `platformAdmin` is unaffected. */
+  readonly clickerPlatform?: string;
+  /** The TENANT the clicker's id was issued by, on a tenant-scoped platform, and ignored by the rest so a provider need not know which those are. Omitted, it falls back to the WORKSPACE segment of the click's own room key. Absent AND underivable on a tenant-scoped platform ⇒ the ROSTER arm refuses. */
+  readonly clickerTenant?: string;
+  /** OPTIONAL positive per-clicker guest verdict — clicker-floor.ts's leg D, supplied by a surface that can positively classify the clicking person. `undefined` (the default) leaves leg D inert, exactly as if the surface had never been asked. */
+  readonly clickerIsGuest?: boolean;
+  /** Injection seam for the HALT arrow below — the same `HaltDeps` shape access/halt.ts gives every other arrow, so a test can drive a halted click without an operational store. Absent ⇒ the live store. */
+  readonly halt?: HaltDeps;
+  /**
+   * The host's "keep this promise alive past the response" hook. It governs the session-grant RELEASE and nothing else: PRESENT ⇒ the release runs OFF the response path, so the interactivity ack is written before any sibling card executes.
+   * ABSENT ⇒ the release is AWAITED, not deferred: on a serverless host a promise with nowhere to live is frozen with the invocation, so a defer with no `waitUntil` would DROP the release rather than defer it.
+   */
+  readonly waitUntil?: (p: Promise<unknown>) => void;
+}
+
+/** The ONE refused-click audit row; `reason` is the whole point of it — the admin-standing refusal, the three clicker-floor legs and the break-glass arrow. Best-effort like every other audit here: a refusal is already the safe outcome, so a failed audit write must never become a thrown error the surface has to render. */
+async function auditClickerDenial(
+  org: string,
+  row: PendingActionRow,
+  clickerId: string,
+  reason: ClickerFloorRefusal | "not-admin" | "halted",
+  /** Pass the click's own room key ONLY where {@link clickRoomMatches} has ALREADY passed. On a `foreign-room` refusal the click came from a room that is provably NOT the card's, so feeding it here would let a legacy row stamp the intruder's room as the venue. */
+  clickSurfaceKey?: string,
+  /** Reason-specific ids and names — today the halt address (`haltAuditDetail`). IDS AND NAMES
+   *  ONLY, like every other detail on this row; never free text from a caller. */
+  extraDetail?: Record<string, unknown>,
+): Promise<void> {
+  await appendAudit({
+    ...whereFromScope(org, row.scopeKey),
+    principalId: clickerId,
+    action: "approval.denied",
+    // The venue matters MOST on this row (OPE-332): `foreign-room` and `audience-floor` are claims
+    // about a room, and until now the row named the reason without ever naming the room.
+    detail: { id: row.id, kind: row.kind, ...venueDetail(row, clickSurfaceKey), reason, ...extraDetail },
+  }).catch(() => undefined);
+}
+
+/** Is this pending's frozen proposal TAINTED? Read generically off the frozen JSON, so the click core never imports one kind's arg shape. Anything unparseable reads as TAINTED — the fail-closed direction, so a proposal whose taint cannot be established never rides another card's session grant. */
+function taintedFrozenProposal(argsJson: string): boolean {
+  try {
+    return (JSON.parse(argsJson) as { tainted?: unknown }).tainted === true;
+  } catch {
+    return true;
+  }
+}
+
+/**
+ * How many sibling cards ONE session grant releases. Each released row runs a real `execute`, so the candidate set is the only thing that bounds the work a single button press does — the cap stops a looping seat or a grown pending set turning one click into an arbitrarily long chain.
+ * 🔴 PAST THE CAP THE EXTRA CARDS ARE LEFT PENDING, NOT DECIDED: they stay clickable, which is the pre-release position and is safe.
+ */
+export const MAX_SESSION_GRANT_RELEASES = 32;
+
+/**
+ * RELEASE THE CARDS THE SESSION GRANT ALREADY COVERS. A parent that fans out N workers has all N carded before any click exists, and the frozen args differ, so one "Approve for session" click used to leave N−1 stale cards each still needing its own. A row is released exactly when a FRESH propose of it would now skip its card: same session, same memo kind, not tainted, not halted.
+ * 🔴 NOT RETROACTIVE — only rows still `pending` are touched — and it decides with `approve`, never `approve_session`, so one click writes ONE memo and this cannot recurse. A released row's CARD is not re-rendered; a stale button costs one wasted press, since the CAS has already decided the row. Best-effort throughout.
+ */
+async function releaseSessionGrantedPendings(input: {
+  readonly sessionId: string;
+  readonly memoKind: string;
+  /** The row the human clicked — never released by its own grant; its click path decides it. */
+  readonly grantedOn: PendingActionRow;
+  /**
+   * The human's OWN click, forwarded whole. 🔴 EVERY RELEASED ROW RUNS THE SAME CLICKER GATE against its OWN room: passing only the clicker id would leave `clickContext` absent, which turns that gate off entirely and would execute a card in a room this member may not act in. A grant spreads a decision; it may not spread reach.
+   * 🔴 The card-audience gate is NOT re-run here, and nothing re-runs it — it is a PROPOSE-time gate every released row already passed when its own card was minted.
+   */
+  readonly click: ResolveApprovalClickInput;
+}): Promise<readonly string[]> {
+  const org = input.click.org;
+  const released: string[] = [];
+  try {
+    const store = getOperationalStore();
+    // `listPendingActions` is `WHERE status = 'pending'`, which is exactly the set at issue.
+    const matched = (await store.listPendingActions(org)).filter(
+      (r) =>
+        r.id !== input.grantedOn.id &&
+        sessionIdFromFrozenArgs(r.argsJson) === input.sessionId &&
+        sessionGrantKind(r) === input.memoKind &&
+        !taintedFrozenProposal(r.argsJson),
+    );
+    // The cap is read on the CANDIDATE SET, before any row is decided, so it bounds the work rather than the outcome. Both store adapters order `listPendingActions` by `created_at ASC`, so the slice keeps the OLDEST cards — the ones nearest their TTL.
+    const candidates = matched.slice(0, MAX_SESSION_GRANT_RELEASES);
+    if (matched.length > candidates.length) {
+      console.warn(
+        `[open-everywhere:approvals] session-grant release capped at ${String(candidates.length)} of ${String(matched.length)} candidate cards (org=${org}); the rest stay pending and clickable`,
+      );
+    }
+    for (const candidate of candidates) {
+      const halt = await resolveHalt(
+        haltScopeFor({
+          org,
+          scopeKey: candidate.scopeKey,
+          domain: candidate.domain,
+          principalId: candidate.requestedBy,
+        }),
+      ).catch(() => ({ halted: true }) as { readonly halted: boolean });
+      if (halt.halted) continue;
+      // The ordinary approve path, so the release takes the SAME CAS, the same gates, the same
+      // execute and the same `approval.approved` row a human's own click would take.
+      // `approve`, never `approve_session`: one click writes one memo.
+      const outcome = await resolveApprovalClick({ ...input.click, id: candidate.id, decision: "approve" });
+      if (outcome.outcome !== "decided") continue;
+      released.push(candidate.id);
+      // `resolveApprovalClick` does not post, and this call has no platform handler above it, so the release delivers the notice itself off the row's own mint-frozen `postedTo`. Without it a released row would execute in silence, and a released execute that FAILED would exist only in an audit row nobody in the room reads.
+      await rowDecisionFeedback(
+        outcome.row ?? candidate,
+        {
+          summaryLines: outcome.summaryLines ?? summaryLinesFor(candidate),
+          // "approved" is the OUTCOME the room is told, and it is right whether the kind's own
+          // `execute` succeeded or failed — `executed` carries that half, and `outcomeLine` carries its
+          // text, so a released act that failed says so in the room rather than reading as a clean one.
+          outcome: "approved",
+          outcomeLine: outcome.outcomeLine ?? "approved",
+          executed: outcome.executed ?? "none",
+          clickerId: input.click.clickerId,
+        },
+        input.click.releaseFeedback ?? {},
+      ).catch(() => undefined);
+    }
+    // 🔴 A TRUNCATED SET IS AUDITED EVEN WHEN NOTHING WAS RELEASED. The `console.warn` above is a
+    // webhook function's stdout, which does not reach an operator (slack-front.ts records that
+    // measurement), so without this row "why did those cards not move?" has no answer in any durable
+    // store — an operator would read one release row naming N ids and nothing saying a set was cut.
+    const truncated = matched.length > candidates.length;
+    if (released.length > 0 || truncated) {
+      await appendAudit({
+        ...whereFromScope(org, input.grantedOn.scopeKey),
+        principalId: input.click.clickerId,
+        action: SESSION_GRANT_RELEASED_ACTION,
+        detail: {
+          id: input.grantedOn.id,
+          memoKind: input.memoKind,
+          released,
+          ...(truncated ? { candidates: matched.length, cap: MAX_SESSION_GRANT_RELEASES } : {}),
+        },
+      }).catch(() => undefined);
+    }
+  } catch (err) {
+    console.warn(`[open-everywhere:approvals] session-grant release failed (org=${org}): ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return released;
+}
+
+/** The audit action naming the cards ONE session grant released — the join between a human's single click and the several actions it decided. Without it an operator sees N `approval.approved` rows attributed to someone who pressed one button, with nothing saying why. */
+export const SESSION_GRANT_RELEASED_ACTION = "approval.session_grant_released";
+
+/** Run the release off the response path where the route gave us a hook. 🔴 NEVER THROWS, on either arm: the deferred arm runs after the response has gone, where a rejection would tell nobody anything, and the awaited arm sits in a `finally` whose job is to leave the caller's own resolution untouched. */
+async function runSessionGrantRelease(tail: () => Promise<unknown>, waitUntil: ((p: Promise<unknown>) => void) | undefined): Promise<void> {
+  const logFailure = (err: unknown): undefined => {
+    console.warn(`[open-everywhere:approvals] session-grant release tail failed: ${err instanceof Error ? err.message : String(err)}`);
+    return undefined;
+  };
+  if (waitUntil === undefined) {
+    await tail().catch(logFailure);
+    return;
+  }
+  const deferred = tail().catch(logFailure);
+  try {
+    waitUntil(deferred);
+  } catch (err) {
+    // A host whose hook REFUSES the registration (an invocation already closing, a wrapper that
+    // rejects late work). Awaiting is the only remaining way the release can happen at all, and it
+    // is the shape a caller with no hook already gets — better a slow ack than a dropped release.
+    logFailure(err);
+    await deferred;
+  }
+}
+
+/** The ONE decide implementation: load the row, lazily expire it, check the approver policy, CAS-decide, execute the frozen args and audit the outcome, then report what happened for the surface to render. Throws only on genuinely unexpected failures; platform handlers wrap it in their own fail-soft catch. */
+export async function resolveApprovalClick(input: ResolveApprovalClickInput): Promise<ApprovalClickResolution> {
+  const store = getOperationalStore();
+  const row = await store.getPendingAction(input.org, input.id);
+
+  if (!row) return { outcome: "unknown" };
+
+  // THE CONTRADICT VERB reads a row that is ALREADY DECIDED, so it must skip the not-pending bail and the lazy-expiry CAS — both exist to protect a LIVE pending, and the wedge row's `expiresAt` is its own mint instant.
+  // It still passes the kind lookup, the clicker gate and the admin-standing check: the row asserts that a person WITH STANDING judged the machine wrong, and without the check anyone could put that assertion in the honest record.
+  const contradicting = input.decision === "contradict";
+  if (!contradicting && row.status !== "pending") return { outcome: "not-pending" };
+
+  // 🔴 THE BREAK-GLASS HALT ARROW AT THE CLICK: a card minted before a halt was still fully clickable during one. It asks about the ROW'S FROZEN ADDRESS, byte-identically to the propose arrow's own question, so a halt that would have stopped this proposal stops its click too. THE LIMIT: the person axis names the REQUESTER, so a user-level halt on the CLICKER alone does not reach this arrow.
+  // 🔴 TWO NARROW EXEMPTIONS: the LIFT VERB, because `resume` mints a card and the chain is where a halt denies — without it no chat lift could reopen the deployment, and the fail-closed arm would make an unreadable halt store unliftable; and CONTRADICT, which runs no `execute`, consumes no row and only records the honest record.
+  if (!contradicting && row.kind !== HALT_LIFT_ACTION_KIND) {
+    const haltState = await resolveHalt(
+      haltScopeFor({
+        org: input.org,
+        scopeKey: row.scopeKey,
+        domain: row.domain,
+        ...(row.requestedBy ? { principalId: row.requestedBy } : {}),
+      }),
+      input.halt ?? {},
+    );
+    if (haltState.halted) {
+      // No `clickSurfaceKey` here: this arrow runs BEFORE `clickRoomMatches`, so the click's own room is still unverified, and feeding it in would let a foreign-room click stamp the INTRUDER's workspace as the venue on a legacy row. The row's own `postedTo`/`scopeKey` answer the venue instead.
+      await auditClickerDenial(input.org, row, input.clickerId, "halted", undefined, haltAuditDetail(haltState));
+      emitTelemetry("oe.feature.used", { "oe.feature": "approval_decided", "oe.outcome": "halted" });
+      return { outcome: "halted", row, notice: haltRefusalMessage(haltState, "deciding this request") };
+    }
+  }
+
+  const nowIso = new Date().toISOString();
+  if (!contradicting && Date.parse(row.expiresAt) <= Date.now()) {
+    const cas = await store.decidePendingAction(input.org, row.id, "expired", "system", nowIso);
+    if (!cas) return { outcome: "expired-race" };
+    const expiredRow: PendingActionRow = { ...row, status: "expired", decidedBy: "system", decidedAt: nowIso };
+    // Terminal lifecycle row (audit-wedge WS-3): this late click's CAS just expired the pending —
+    // audit it as an action taken (cause "ttl"), matching the failed-post site above.
+    await appendAudit({
+      ...whereFromScope(input.org, row.scopeKey),
+      principalId: "system",
+      action: "approval.expired",
+      detail: { id: row.id, kind: row.kind, cause: "ttl" },
+    });
+    emitTelemetry("oe.feature.used", { "oe.feature": "approval_decided", "oe.outcome": "expired" });
+    return { outcome: "expired", row: expiredRow, summaryLines: summaryLinesFor(expiredRow) };
+  }
+
+  const kindDef = actionKind(row.kind);
+  if (!kindDef) {
+    console.error(`[open-everywhere:approvals] no registered ActionKind for "${row.kind}" (pending ${row.id}) — cannot decide`);
+    return { outcome: "unregistered-kind" };
+  }
+
+  // THE CLICKER GATE (OPE-185) — the only thing between "the transport says this click is real"
+  // and the tier branch below. Runs after the kind lookup (leg B reads the kind's flag) and BEFORE
+  // the policy branch, because a refusal here must never consume the row. Skipped entirely without
+  // a clickContext — see the field doc for why that omission is load-bearing rather than lazy.
+  if (input.clickContext) {
+    const { surfaceKey } = input.clickContext;
+    // Leg C — HARDENING, not a hole-closer. No exploit path was found for its absence; neither
+    // Slack nor Discord lets a non-app principal post components carrying our action_id/custom_id.
+    // Tier-independent on purpose: it is a claim about the click's provenance, not about standing.
+    if (!clickRoomMatches(row, surfaceKey)) {
+      // No `surfaceKey` argument on purpose — see the param doc on auditClickerDenial.
+      await auditClickerDenial(input.org, row, input.clickerId, "foreign-room");
+      return { outcome: "clicker-denied", row, reason: "foreign-room" };
+    }
+    // Legs A, B and D are MEMBER-TIER ONLY: the admin tier does not have this hole, because `clickerMayDecide` already pins the decider to the roster against the row's FROZEN domain.
+    // What the admin tier does share is that the AUDIENCE is unconstrained even when the decider is — a disclosure problem, not a clicker problem, and refusing an admin decision here would cost real availability in externally-shared rooms to close a different hole.
+    if (kindDef.policy === "member") {
+      const verdict = await checkClickerFloor(surfaceKey, {
+        beneficiaryClicker: kindDef.beneficiaryClicker === true,
+        clickerIsGuest: input.clickerIsGuest,
+      });
+      if (!verdict.ok) {
+        await auditClickerDenial(input.org, row, input.clickerId, verdict.reason, surfaceKey);
+        return { outcome: "clicker-denied", row, reason: verdict.reason };
+      }
+    }
+  }
+
+  // The clicker's namespace, best evidence first: what the surface told us, else the room the click came from, else the surface the card was posted into. All three are the SAME platform and workspace by construction — `clickRoomMatches` has already pinned the click to the card's room — so this is a fallback chain over availability, not over authority.
+  const clickerRoom = roomNamespace(input.clickContext?.surfaceKey) ?? roomNamespace(row.postedTo);
+  const clickerPlatform = input.clickerPlatform ?? clickerRoom?.platform;
+  const clickerTenant = input.clickerTenant ?? clickerRoom?.tenant;
+  if (kindDef.policy === "admin" && !clickerMayDecide(row, input.clickerId, clickerPlatform, clickerTenant) && (await input.platformAdmin?.(row)) !== true) {
+    // A refused click is an ACTION-LIFECYCLE event as much as a decided one. `approval.denied` is that row, shared by both refusal families and distinguished by `reason`.
+    await auditClickerDenial(input.org, row, input.clickerId, "not-admin", input.clickContext?.surfaceKey);
+    return { outcome: "denied", row };
+  }
+
+  // The room this decision is being made in (OPE-332), stamped into every audit row below. Resolved
+  // ONCE here so an approve, a reject, a failed execute and the session-grant memo can never
+  // disagree about where the same click happened.
+  const venue = venueDetail(row, input.clickContext?.surfaceKey);
+
+  // Record the overrule and stop: no CAS, no execute, no decision feedback — the wedge row is already terminal and the act already ran. The producer owns the "is this really a judge lift?" test and the per-row de-duplication, so an ordinary approve/reject click can never reach it.
+  if (contradicting) {
+    const res = await contradictJudgeAllow({ org: input.org, id: row.id, principalId: input.clickerId, route: "click", venue });
+    emitTelemetry("oe.feature.used", { "oe.feature": "approval_judge_contradicted", "oe.outcome": res.outcome });
+    return { outcome: "contradicted", row, summaryLines: summaryLinesFor(row), contradiction: res.outcome };
+  }
+
+  const status = input.decision === "reject" ? "rejected" : "approved";
+  const cas = await store.decidePendingAction(input.org, row.id, status, input.clickerId, nowIso);
+  if (!cas) return { outcome: "lost-race" }; // someone else's click (or the expiry sweep) won first
+
+  const decidedRow: PendingActionRow = { ...row, status, decidedBy: input.clickerId, decidedAt: nowIso };
+  const summaryLines = summaryLinesFor(decidedRow);
+
+  if (status === "rejected") {
+    await appendAudit({ ...whereFromScope(input.org, row.scopeKey), principalId: input.clickerId, action: "approval.rejected", detail: { id: row.id, kind: row.kind, ...venue } });
+    emitTelemetry("oe.feature.used", { "oe.feature": "approval_decided", "oe.outcome": "rejected" });
+    // THE DURABLE DECLINE: only kinds that declare the hook run anything here; for every other kind `outcomeLine` stays the literal "rejected". The row is ALREADY decided above, so a throw here becomes the line the clicker reads and changes nothing else.
+    // 🔴 THE LINE IS SHOWN: a discarded result would leave a clicker believing a decline was remembered when it was not.
+    let outcomeLine = "rejected";
+    if (kindDef.declined) {
+      outcomeLine = await kindDef
+        .declined(JSON.parse(row.argsJson) as unknown, input.clickerId)
+        .catch((err: unknown) => `rejected — ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return { outcome: "decided", row: decidedRow, summaryLines, outcomeLine, executed: "none" };
+  }
+
+  /**
+   * 🔴 THE RELEASE RUNS AFTER THIS ROW'S OWN EXECUTE, in the `finally`. It used to run first, which put the human's own clicked act behind N sibling approve-and-execute cycles — so a click that died mid-release lost the act the button was pressed for, having already CAS-ed its row approved. The MEMO write stays where it is: the member approved the session, not just this call.
+   * 🔴 THE CAS-THEN-EXECUTE ORDER IS NOT INVERTED: executing first would let a released row and a human's own click both run the frozen act. A lost act leaves a decided row an operator can read; a DOUBLE act cannot be taken back. The tail is RESUMABLE instead — every row a killed invocation did not reach is still pending and still clickable.
+   */
+  let releaseTail: (() => Promise<unknown>) | undefined;
+
+  // "Approve for session" remembers the proposing session so later proposals of the SAME grantable kind skip the card. `sessionGrantKind` is the ONE predicate for "is this grantable, and under what memo kind", and it answers null for everything but `pr.open`, so the verb degrades to a one-off approve on every injection gate.
+  // The memo is keyed (org, sessionId, memoKind), so a grant is never read under a kind it was not written for, and it is set BEFORE execute so it persists even if THIS action fails. Best-effort: a memo write failure never fails the decision.
+  if (input.decision === "approve_session") {
+    const memoKind = sessionGrantKind(row);
+    const sessionId = sessionIdFromFrozenArgs(row.argsJson);
+    if (memoKind && sessionId) {
+      const expiresAt = new Date(Date.now() + sessionApprovalTtlHours() * 3_600_000).toISOString();
+      await store.setSessionApproval({ org: input.org, sessionId, kind: memoKind, grantedBy: input.clickerId, createdAt: nowIso, expiresAt }).catch(() => {});
+      await appendAudit({ ...whereFromScope(input.org, row.scopeKey), principalId: input.clickerId, action: "approval.session_granted", detail: { id: row.id, kind: row.kind, memoKind, ...venue } }).catch(() => undefined);
+      // OPE-251: …AND THE CARDS THE GRANT ALREADY COVERS ARE RELEASED, not left stale. See
+      // {@link releaseSessionGrantedPendings}, and the block above for when it runs.
+      releaseTail = () => releaseSessionGrantedPendings({ sessionId, memoKind, grantedOn: row, click: input });
+    }
+  }
+
+  try {
+    const args = JSON.parse(row.argsJson) as unknown;
+    // Publish WHICH CARD is executing for the duration of the write, so a kind whose write is durable evidence can name the approval that armed it — which `decidedBy` alone cannot. Ambient and fail-soft: nothing may authorise on it. This is the ONLY place it may be set, or "armed by this card" stops being true.
+    const outcome = await withArmingApproval({ id: row.id, kind: row.kind }, () => kindDef.execute(args, input.clickerId));
+    await appendAudit({ ...whereFromScope(input.org, row.scopeKey), principalId: input.clickerId, action: "approval.approved", detail: { id: row.id, kind: row.kind, ...venue, outcome } });
+    emitTelemetry("oe.feature.used", { "oe.feature": "approval_decided", "oe.outcome": "approved" });
+    return { outcome: "decided", row: decidedRow, summaryLines, outcomeLine: outcome, executed: "ok" };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    await appendAudit({ ...whereFromScope(input.org, row.scopeKey), principalId: input.clickerId, action: "approval.failed", detail: { id: row.id, kind: row.kind, ...venue, error: message } });
+    emitTelemetry("oe.feature.used", { "oe.feature": "approval_decided", "oe.outcome": "failed" });
+    return { outcome: "decided", row: decidedRow, summaryLines, outcomeLine: `FAILED: ${message}`, executed: "failed" };
+  } finally {
+    // A `finally`, so a FAILED clicked act still releases the siblings: the grant is the human's decision about the SESSION, and whether this one call's `execute` threw says nothing about the other cards it covers. The returned resolution is already computed, and `runSessionGrantRelease` never throws, which is what keeps that true.
+    if (releaseTail) await runSessionGrantRelease(releaseTail, input.waitUntil);
+  }
+}
+
+/** Test seams for the sweep's expiry FEEDBACK (task #105) — absent ⇒ the live posters/dispatch. */
+export interface SweepFeedbackDeps {
+  readonly post?: PostFn;
+  /** Discord notice poster — defaults to {@link postDiscordDecisionNotice}. */
+  readonly discordNotice?: (row: PendingActionRow, text: string) => Promise<unknown>;
+  readonly decisionWake?: DecisionWakeDeps;
+}
+
+/** Expiry feedback for ONE swept row — the sweep-side twin of the click paths' feedback calls. See {@link rowDecisionFeedback} for what a null `postedTo`, a platform with no card path, and a transport failure each do. */
+async function sweepExpiryFeedback(row: PendingActionRow, deps: SweepFeedbackDeps): Promise<void> {
+  await rowDecisionFeedback(row, { summaryLines: summaryLinesFor(row), outcome: "expired", outcomeLine: "expired", executed: "none" }, deps);
+}
+
+/**
+ * Deliver ONE row's decision feedback off its own frozen `postedTo` — the shape every caller that holds a decided row but NO click payload needs, so the expiry sweep and the session-grant release cannot derive the poster two different ways.
+ * NULL `postedTo` ⇒ skip silently (a pre-migration row, or a deliberately card-less one); a platform with no approval-card path also skips. No TRANSPORT failure throws; the egress spoof's Vercel refusal is the one exception, contained by each caller's own `try`.
+ */
+async function rowDecisionFeedback(
+  row: PendingActionRow,
+  what: Pick<DecisionFeedbackInput, "summaryLines" | "outcome" | "outcomeLine" | "executed"> & { readonly clickerId?: string },
+  deps: SweepFeedbackDeps = {},
+): Promise<void> {
+  if (!row.postedTo) return;
+  const [platform, workspace] = row.postedTo.split("/");
+  if (!workspace) return;
+  const post = deps.post ?? bridgeSlackForm;
+  const postNotice =
+    platform === "slack"
+      ? (text: string) => postThreadNote(post, row.channelId, row.threadTs ?? row.messageTs ?? undefined, text)
+      : platform === "discord"
+        ? (text: string) => (deps.discordNotice ?? postDiscordDecisionNotice)(row, text)
+        : null;
+  if (!postNotice) return;
+  await deliverDecisionFeedback(
+    {
+      row,
+      ...what,
+      // The mint-frozen workspace segment plays the click payload's team.id/guild_id role.
+      target: platform === "slack" ? slackDecisionWakeTarget(row, workspace) : discordDecisionWakeTarget(row, workspace),
+      postNotice,
+    },
+    deps.decisionWake,
+  );
+}
+
+/**
+ * An unclicked pending that ages past its TTL never gets a terminal row on its own, so this CAS-expires each one, audits `approval.expired` (cause "ttl") and feeds the expiry back to the proposing session, which would otherwise keep believing in a dead card. Best-effort per row: a failed CAS, audit or feedback never aborts the sweep.
+ * IT RUNS TWO PASSES: the TTL pass closes every row whose clock ran out, and {@link reapSupersededRoutineCards} closes the rows that HAVE no clock. Both counts are returned together.
+ */
+export async function sweepExpiredPendings(org: string, now: Date = new Date(), deps: SweepFeedbackDeps = {}): Promise<number> {
+  const store = getOperationalStore();
+  const nowIso = now.toISOString();
+  const expired = await store.listExpiredPendingActions(org, nowIso);
+  let count = 0;
+  for (const row of expired) {
+    try {
+      const won = await store.decidePendingAction(org, row.id, "expired", "system", nowIso);
+      if (!won) continue; // a click's lazy-expiry (or another sweep) won first — it audits its own row
+      await appendAudit({
+        ...whereFromScope(org, row.scopeKey),
+        principalId: "system",
+        action: "approval.expired",
+        detail: { id: row.id, kind: row.kind, cause: "ttl" },
+      });
+      count++;
+      await sweepExpiryFeedback({ ...row, status: "expired", decidedBy: "system", decidedAt: nowIso }, deps);
+    } catch (err) {
+      console.warn(`[open-everywhere:approvals] sweepExpiredPendings: failed to expire ${row.id}: ${String(err)}`);
+    }
+  }
+  return count + (await reapSupersededRoutineCards(org, now, deps));
+}
+
+/**
+ * REAP the routine permission cards a later `edit_routine` or delete left unanswerable. Such a row is minted with the far-future sentinel on purpose, so no TTL reaches it and its bound is the GENERATION inside the frozen `grantKey` — without this pass the routine's room keeps a card with live buttons whose every click answers "nothing was armed". The sweep is where it belongs: an edited routine may never fire again, and a deleted one never will.
+ * 🔴 EVERY CARD IT EXPIRES IS ONE A CLICK WOULD REFUSE, and the set is a strict SUBSET: an unreadable routine or an unparseable args blob is left alone, because expiring a live card because one read blinked is the failure the fail-closed posture exists to prevent.
+ */
+export async function reapSupersededRoutineCards(org: string, now: Date = new Date(), deps: SweepFeedbackDeps = {}): Promise<number> {
+  const store = getOperationalStore();
+  const nowIso = now.toISOString();
+  // `listPendingActions` is `WHERE status = 'pending'`, which is exactly the set at issue: a card a
+  // click or an earlier sweep already decided is terminal and is not this pass's business.
+  const pending = await store.listPendingActions(org).catch(() => [] as readonly PendingActionRow[]);
+  let count = 0;
+  for (const row of pending) {
+    if (row.kind !== ROUTINE_PERMISSION_KIND) continue;
+    const args = parseRoutinePermissionArgs(row.argsJson);
+    if (!args) continue; // fail-closed: a row whose frozen pair cannot be read is never decided here
+    try {
+      const state = await routineCardGenerationState(args);
+      // `current` is a live card. `unreadable` is not a verdict at all — see that function's doc.
+      if (state.state === "current" || state.state === "unreadable") continue;
+      const won = await store.decidePendingAction(org, row.id, "expired", "system", nowIso);
+      if (!won) continue; // a click (or another sweep) won the CAS first — it audits its own row
+      await appendAudit({
+        ...whereFromScope(org, row.scopeKey),
+        principalId: "system",
+        action: "approval.expired",
+        // The cause is NOT "ttl": no clock ran out. An operator reading the trail has to be able to
+        // tell a card that aged out from a card whose question stopped existing.
+        detail: { id: row.id, kind: row.kind, cause: state.state === "gone" ? "routine-deleted" : "routine-superseded", routine: args.routineId },
+      });
+      count++;
+      await sweepExpiryFeedback({ ...row, status: "expired", decidedBy: "system", decidedAt: nowIso }, deps);
+    } catch (err) {
+      console.warn(`[open-everywhere:approvals] reapSupersededRoutineCards: failed to expire ${row.id}: ${String(err)}`);
+    }
+  }
+  return count;
+}
+
+// A unified WINDOW session woken by a mention in a DIFFERENT thread never sees the in-thread decision notice — OE's own bot post cannot wake it, and its next wake elsewhere does not backscroll this thread.
+// Measured live 2026-07-19: an admin rejected a spend card, and a fresh ask in a new thread was answered "just needs an admin to Approve" about the dead card. This wake pushes the decision into the owning session so its belief updates.
+
+export interface DecisionWakeDeps {
+  /** The dispatch seam — defaults to the live cross-process window dispatch. Injected in tests to
+   *  capture the payload without a live eve receive. */
+  readonly dispatch?: typeof dispatchApprovalDecisionWake;
+  readonly now?: () => string;
+  readonly mintWakeId?: () => string;
+}
+
+/**
+ * Push a DECIDED/EXPIRED outcome into the PROPOSING window session. No-op unless the proposing surface windows AND a live window session exists — a classic per-thread session backscrolls the in-thread notice on its next human wake, so it needs no push. Best-effort and NEVER throws.
+ * The token is read LIVE off the window's own registry row, so the wake targets the live seat even across a rotation, and the origin is the card's anchor thread.
+ */
+export async function wakeWindowOnDecision(
+  input: {
+    readonly row: PendingActionRow;
+    readonly outcome: ApprovalOutcome;
+    readonly summaryLine: string;
+    /** The admin who decided — absent for a system (TTL) expiry. */
+    readonly clickerId?: string;
+    /** What the kind's `execute` did, for an APPROVED outcome (OPE-1097) — see
+     *  {@link ApprovalDecisionWakeInput.execution}. */
+    readonly execution?: { readonly ran: "ok" | "failed"; readonly line: string };
+    /** The PROPOSING channel's fully-qualified surfaceKey (`platform/workspace/surface`). */
+    readonly surfaceKey: string;
+    readonly origin: UnifiedWakeOrigin;
+  },
+  deps: DecisionWakeDeps = {},
+): Promise<boolean> {
+  const dispatch = deps.dispatch ?? dispatchApprovalDecisionWake;
+  const mint = deps.mintWakeId ?? mintWakeId;
+  const nowIso = (deps.now ?? (() => new Date().toISOString()))();
+
+  const authority = await readApprovalDecisionAuthority(input.row.org, input.row.id);
+  const surfaceKey = authority?.surfaceKey ?? input.surfaceKey;
+  const origin = authority?.origin ?? input.origin;
+
+  let domainName: string;
+  let registryKey: string;
+  try {
+    const grain = supervisorGrainFor(surfaceKey, getConfig().loadDomains());
+    if (!grainUsesUnifiedWindow(grain) || grain.domainName === undefined) return false; // classic per-thread — the notice suffices
+    domainName = grain.domainName;
+    registryKey = grain.registryKey;
+  } catch {
+    return false; // config error → skip (fail-soft to today's notice-only behaviour)
+  }
+
+  const store = getOperationalStore();
+  const session = await store.getChannelSession(input.row.org, registryKey).catch(() => null);
+  if (!session) return false; // no live window session to update
+
+  const wakeId = mint();
+  const message = renderApprovalDecisionMessage(
+    {
+      origin,
+      wakeId,
+      summaryLine: input.summaryLine,
+      outcome: input.outcome,
+      ...(input.clickerId ? { clickerId: input.clickerId } : {}),
+      ...(input.execution ? { execution: input.execution } : {}),
+      pendingId: input.row.id,
+    },
+    nowIso,
+  );
+  // The dispatch receives only the proposal-frozen binding/requester. It never sees the decision
+  // actor's auth; the standing-grain default keeps this informational continuation narrow-handed.
+  const delivered = await dispatch({
+    token: session.token,
+    origin,
+    wakeId,
+    message,
+    domain: domainName,
+    ...(authority
+      ? {
+          binding: authority.binding,
+          requester: authority.requester,
+          nonMemberWake: authority.nonMemberWake,
+        }
+      : {}),
+  }).catch(() => false);
+
+  // Lifecycle audit (WS-3 discipline — ids/labels only, never the notice body).
+  await appendAudit({
+    ...whereFromScope(input.row.org, input.row.scopeKey),
+    principalId: input.clickerId ?? "system",
+    action: "approval.decision_wake",
+    detail: { id: input.row.id, kind: input.row.kind, outcome: input.outcome, domain: domainName, delivered, wakeId },
+  }).catch(() => undefined);
+  return delivered;
+}
+
+/** The team id comes from the CLICK, which is authoritative for the workspace the card lives in — the frozen scopeKey can name a DIFFERENT workspace under an explicit-scope override, so it must NOT be the workspace source. Null without a team id, and the decision wake is skipped, fail-soft. */
+function slackDecisionWakeTarget(row: PendingActionRow, teamId: string | undefined): { surfaceKey: string; origin: UnifiedWakeOrigin } | null {
+  if (!teamId) return null;
+  return {
+    surfaceKey: `slack/${teamId}/${row.channelId}`,
+    origin: { platform: "slack", channelId: row.channelId, ...(row.threadTs ? { threadTs: row.threadTs } : {}) },
+  };
+}
+
+/**
+ * The Discord analogue: surfaceKey and wake origin from the frozen row plus a guild id, taken from the click's signed interaction or from the mint-frozen `postedTo`, never from the frozen scopeKey.
+ * 🔴 GUILD-ONLY because a decision wake is dispatched into a WINDOW and needs a surfaceKey naming a window-enabled surface. A DM belongs to no domain and no shared window, so there is nothing to name — hence null, not a DM-shaped origin.
+ */
+export function discordDecisionWakeTarget(row: PendingActionRow, guildId: string | undefined): { surfaceKey: string; origin: UnifiedWakeOrigin } | null {
+  if (!guildId) return null;
+  return {
+    surfaceKey: `discord/${guildId}/${row.channelId}`,
+    origin: { platform: "discord", channelId: row.channelId, guildId, ...(row.messageTs ? { messageId: row.messageTs } : {}) },
+  };
+}
+
+/** A FRESH message into the card's own channel, anchored to the card — fresh because the click path's card edit is invisible to backscroll, exactly like Slack's chat.update. Throws on failure; callers reach it only through {@link deliverDecisionFeedback}, which swallows notice failures. */
+export function postDiscordDecisionNotice(row: PendingActionRow, text: string): Promise<unknown> {
+  const ops = surfaceMessageOps("discord");
+  if (!ops) return Promise.resolve(undefined); // discord transport not registered — no notice (fail-soft)
+  return ops.postText(row.channelId, text, row.messageTs ? { replyToMessageId: row.messageTs } : undefined);
+}
+
+export interface DecisionFeedbackInput {
+  /** The DECIDED row (status already flipped — the CAS won before any feedback fires). */
+  readonly row: PendingActionRow;
+  readonly summaryLines: string[];
+  readonly outcome: ApprovalOutcome;
+  /** The executor's outcome line. "expired" for a sweep, and "rejected" for a reject — unless the
+   *  kind implements `declined()` (approvals/types.ts), whose line replaces it and IS rendered:
+   *  {@link decisionNoticeText} reads it on a rejection too, and drops its "propose again" tail. */
+  readonly outcomeLine: string;
+  /** Whether the kind's `execute` ran (OPE-1097). "none" on every non-approval path — a reject and
+   *  an expiry run nothing. Required so a new feedback call site states it rather than inherits a
+   *  default: this is what tells the resumed seat the approved act is already done. */
+  readonly executed: "ok" | "failed" | "none";
+  /** The deciding admin — absent for a system (TTL) expiry. */
+  readonly clickerId?: string;
+  /** The wake target, or null to skip the wake (no authoritative workspace id — fail-soft). */
+  readonly target: { surfaceKey: string; origin: UnifiedWakeOrigin } | null;
+  readonly postNotice: (text: string) => Promise<unknown>;
+}
+
+/**
+ * The ONE decision-feedback sequence, shared by both click paths and the TTL sweep: post the human-facing notice into the pending's anchor conversation, then push the outcome into the owning window session. BOTH legs are independently best-effort, and no transport failure throws.
+ * 🔴 The NOTICE leg takes the shared egress exit; the WAKE leg deliberately does not, because it puts nothing in a room. The one thing that CAN throw is the spoof's Vercel refusal — a deploy misconfiguration, loud by design, impossible on a deploy that has not set the flag.
+ */
+export async function deliverDecisionFeedback(input: DecisionFeedbackInput, decisionWake?: DecisionWakeDeps): Promise<void> {
+  if (!swallowRoomOp(`an approval decision notice (${input.outcome})`)) {
+    await input.postNotice(decisionNoticeText(input.summaryLines, input.outcomeLine, input.clickerId ?? "system", input.outcome)).catch(() => undefined);
+  }
+  if (input.target) {
+    await wakeWindowOnDecision(
+      {
+        row: input.row,
+        outcome: input.outcome,
+        summaryLine: input.summaryLines[0] ?? "the requested change",
+        ...(input.clickerId ? { clickerId: input.clickerId } : {}),
+        // The approval RAN the act; the seat did not. Carry the executor's own outcome line into the
+        // wake so the resumed seat can see the work is already done and does not re-issue it
+        // (OPE-1097). Only an approval has one — a reject and an expiry run nothing.
+        ...(input.executed === "none" ? {} : { execution: { ran: input.executed, line: input.outcomeLine } }),
+        surfaceKey: input.target.surfaceKey,
+        origin: input.target.origin,
+      },
+      decisionWake,
+    ).catch(() => undefined);
+  }
+}
+
+/**
+ * Handle one parsed Slack `block_actions` payload. Returns false for anything that is not an `oe_approval:` action (the caller forwards those to eve); otherwise it owns the click end to end and NEVER throws — Slack's interactivity endpoint must always get its 200.
+ * 🔴 That includes the egress spoof's Vercel refusal, deliberately: Slack retries a POST that does not answer, so letting it escape would turn one misconfigured deploy into a retry storm. It stays loud at `requestApproval`, which mints no card on such a deploy.
+ */
+export async function handleApprovalPayload(payload: unknown, deps: HandleApprovalDeps = {}): Promise<boolean> {
+  const p = payload as BlockActionsPayload | null | undefined;
+  const action = p?.actions?.[0];
+  const actionId = typeof action?.action_id === "string" ? action.action_id : undefined;
+  if (actionId === undefined) return false; // not a block_actions click at all, or no action_id
+
+  const parsed = parseApprovalAction(actionId);
+  if (!parsed) return false; // a real click, but not one of ours (e.g. Eve's eve_input:) — forward
+
+  const post = deps.post ?? bridgeSlackForm;
+
+  try {
+    const org = typeof action?.value === "string" ? action.value : undefined;
+    const clickerId = typeof p?.user?.id === "string" ? p.user.id : undefined;
+    const channelId = typeof p?.channel?.id === "string" ? p.channel.id : undefined;
+    const messageTs = typeof p?.message?.ts === "string" ? p.message.ts : undefined;
+    const teamId = typeof p?.team?.id === "string" ? p.team.id : undefined;
+
+    if (!org || !clickerId || !channelId) {
+      console.error(`[open-everywhere:approvals] malformed block_actions payload for "${actionId}" — missing org/user/channel; ignoring the click`);
+      return true; // it WAS ours; fail soft rather than forward a half-understood payload to Eve
+    }
+
+    // Leg D's verdict (OPE-589) — resolved BEFORE the decide call so a positive guest verdict can
+    // never race a lost CAS. `.catch` mirrors every other best-effort probe on this path: a thrown
+    // dep must degrade to "no verdict", never abort the click.
+    const clickerIsGuest = deps.clickerIsGuest ? await deps.clickerIsGuest(clickerId, teamId).catch(() => undefined) : undefined;
+
+    const res = await resolveApprovalClick({
+      org,
+      id: parsed.id,
+      decision: parsed.decision,
+      clickerId,
+      // This handler parses SLACK's block_actions payload, so the clicker id is a Slack member id
+      // — stated rather than derived, so the roster check keeps working on the theoretical
+      // missing-`team.id` path below where there is no surface key to read a platform off.
+      clickerPlatform: "slack",
+      // The room the button was physically pressed in (OPE-185). Slack always carries `team.id` on
+      // an interactive payload; on the theoretical absence we pass NO context rather than guessing a
+      // workspace, which leaves the clicker gate inert — the same fail-soft posture the decision-wake
+      // target already takes with the same missing field, and never a refusal built on a fabricated key.
+      ...(teamId ? { clickContext: { surfaceKey: `slack/${teamId}/${channelId}` } } : {}),
+      ...(clickerIsGuest === undefined ? {} : { clickerIsGuest }),
+      // OPE-1709 — the route's background-work hook, so the session-grant release leaves the
+      // interactivity ack's budget. Absent on a caller that supplies none, which keeps that caller's
+      // awaited shape byte-identical.
+      ...(deps.waitUntil ? { waitUntil: deps.waitUntil } : {}),
+    });
+    switch (res.outcome) {
+      case "unknown":
+        // 🔴 A CONTRADICT click must NEVER rewrite its own message: the judge-lift notice is the room's only record that an act ran with nobody asked, and blanking it because the wedge row has aged out would delete exactly the evidence it exists to keep.
+        if (parsed.decision === "contradict") {
+          await postThreadNote(post, channelId, messageTs, `<@${clickerId}> ${judgeContradictionNotice("unknown")}`);
+          return true;
+        }
+        await updateCardText(post, channelId, messageTs, "This approval request is no longer known (it may have already been decided or has aged out).");
+        return true;
+      case "not-pending":
+      case "expired-race":
+      case "unregistered-kind":
+      case "lost-race":
+        return true; // silent by design — see each resolution's doc above
+      case "expired": {
+        await updateCard(post, channelId, messageTs, decidedCardBlocks(res.row, res.summaryLines, "expired"));
+        // A late-click expiry is a system TTL lapse with no deciding admin, so no `clickerId` rides the feedback.
+        await deliverDecisionFeedback(
+          {
+            row: res.row,
+            summaryLines: res.summaryLines,
+            outcome: "expired",
+            outcomeLine: "expired",
+            executed: "none",
+            target: slackDecisionWakeTarget(res.row, teamId),
+            postNotice: (text) => postThreadNote(post, channelId, res.row.threadTs ?? messageTs, text),
+          },
+          deps.decisionWake,
+        );
+        return true;
+      }
+      case "denied":
+        await postThreadNote(post, channelId, res.row.threadTs ?? messageTs, `<@${clickerId}> only a domain/org admin can decide this request.`);
+        return true;
+      case "clicker-denied":
+        // Same shape as "denied" — an in-thread note, card untouched, row still pending — because
+        // it is the same story from the human's side: your click didn't apply, and the card is
+        // still live for someone who can. The copy is the ONE renderer (clicker-floor.ts) so this
+        // and the Discord ephemeral cannot drift.
+        await postThreadNote(post, channelId, res.row.threadTs ?? messageTs, `<@${clickerId}> ${clickerFloorRefusalNotice(res.reason)}`);
+        return true;
+      case "halted":
+        // Same shape as "denied": an in-thread note, card UNTOUCHED, row still pending — live until the TTL sweep reaps it, since the sweep is not halt-gated. The copy is access/halt.ts's ONE renderer, so a Slack room and a Discord room are told the same thing about the same halt.
+        await postThreadNote(post, channelId, res.row.threadTs ?? messageTs, `<@${clickerId}> ${res.notice}`);
+        return true;
+      case "contradicted": {
+        // The notice card stays as it is — the act it reports still happened, and replacing it
+        // would erase the room's only record of it. The reply is an in-thread line naming what the
+        // click did, so the person who pressed the button can see their overrule landed.
+        await postThreadNote(post, channelId, res.row.threadTs ?? messageTs, `<@${clickerId}> ${judgeContradictionNotice(res.contradiction)}`);
+        return true;
+      }
+      case "decided": {
+        await updateCard(post, channelId, messageTs, decidedCardBlocks(res.row, res.summaryLines, res.outcomeLine));
+        // `res.row.status` is "approved" | "rejected" here — both valid ApprovalOutcome values — and the deciding admin rides as `clickerId`.
+        await deliverDecisionFeedback(
+          {
+            row: res.row,
+            summaryLines: res.summaryLines,
+            outcome: res.row.status as ApprovalOutcome,
+            outcomeLine: res.outcomeLine,
+            executed: res.executed,
+            clickerId,
+            target: slackDecisionWakeTarget(res.row, teamId),
+            postNotice: (text) => postThreadNote(post, channelId, res.row.threadTs ?? messageTs, text),
+          },
+          deps.decisionWake,
+        );
+        return true;
+      }
+    }
+  } catch (err) {
+    // A genuinely unexpected failure (store outage, malformed row, …) after we'd already
+    // established this WAS an oe_approval: click — fail soft, never throw out of this
+    // function; Slack's interactivity endpoint must always get its 200.
+    console.error(`[open-everywhere:approvals] handleApprovalPayload failed softly for "${actionId}": ${String(err)}`);
+    return true;
+  }
+}